codex-multi-auth 2.16.0 → 2.17.2

package/dist/lib/auth/account-access.d.ts

@@ -0,0 +1,115 @@
+import type { CodexCliMirror, Workspace } from "../storage/public-types.js";
+import type { AccountIdSource } from "../types.js";
+/**
+ * Which accounts the backend will actually let the current credentials act as.
+ *
+ * Codex CLI >= 0.156.0 resolves this itself through
+ * `GET /backend-api/wham/accounts/check` before every request and refuses to run
+ * when the account it was told to use is absent from the answer
+ * ("selected workspace missing from routing discovery"). The id/organization
+ * lists carried inside the token claims are NOT the same thing: a token can list
+ * an organization it has no live authorization for, so selecting a workspace from
+ * the claims alone can persist an account id that every later request rejects.
+ */
+export interface AuthorizedAccounts {
+    /** Every account id the response listed, in the order it listed them. */
+    accountIds: string[];
+    /** The id the backend itself considers the default, when it named one. */
+    defaultAccountId?: string;
+}
+export interface FetchAuthorizedAccountsOptions {
+    /** Injection seam for tests; defaults to the global fetch. */
+    fetch?: typeof globalThis.fetch;
+    signal?: AbortSignal;
+}
+/**
+ * Reads the account ids out of a `wham/accounts/check` payload.
+ *
+ * Returns null when the payload carries no usable list, which the caller must
+ * treat as "unknown" rather than "nothing is authorized" — refusing every
+ * account on a shape we failed to parse would break logins for a response format
+ * change alone.
+ */
+export declare function parseAuthorizedAccounts(payload: unknown): AuthorizedAccounts | null;
+/**
+ * Asks the backend which accounts these credentials may act as.
+ *
+ * Fails open (resolves null) for every error: this check exists to catch a
+ * selection that would not work, so an unreachable or unparseable answer must
+ * leave the caller's existing behavior untouched rather than block a login.
+ */
+export declare function fetchAuthorizedAccounts(accessToken: string, options?: FetchAuthorizedAccountsOptions): Promise<AuthorizedAccounts | null>;
+export interface ConstrainedSelection {
+    /** The account id to actually persist. */
+    accountId: string;
+    /** True when the backend's answer forced a different id than requested. */
+    changed: boolean;
+    /** The id that was rejected, present only when `changed` is true. */
+    rejected?: string;
+}
+/**
+ * Narrows a chosen account id to one the backend authorizes.
+ *
+ * Only ever narrows: with no authorization data, no default to fall back to, or
+ * an id that is already authorized, the caller's own choice is returned
+ * unchanged. That keeps this a guard against a known-bad write rather than a new
+ * way for a login to end up somewhere the user did not ask for.
+ */
+export declare function constrainSelectionToAuthorized(accountId: string, authorized: AuthorizedAccounts | null): ConstrainedSelection;
+/** The slice of a resolved login selection this guard reads and rewrites. */
+export interface AccountSelectionLike {
+    accountIdOverride?: string;
+    accountIdSource?: AccountIdSource;
+    accountLabel?: string;
+    workspaces?: Workspace[];
+}
+/**
+ * Applies {@link constrainSelectionToAuthorized} to a resolved login selection.
+ *
+ * On a rewrite the source becomes `token`: the backend's default account IS the
+ * account these credentials are, so it must auto-follow later token refreshes
+ * (see `shouldUpdateAccountIdFromToken`) instead of being pinned the way an
+ * explicit org/manual choice is. The label follows the new id too; an empty
+ * label (not undefined) is deliberate, because the account-pool merge keeps
+ * the saved label on undefined and would go on naming the rejected workspace.
+ *
+ * The workspace list is narrowed with {@link toAuthorizedWorkspaces}.
+ */
+export declare function applyAuthorizedAccountConstraint<T extends AccountSelectionLike>(selection: T, authorized: AuthorizedAccounts | null): {
+    selection: T;
+    result: ConstrainedSelection | null;
+};
+/** The outcome of {@link refreshCodexCliMirror}. */
+export type CodexCliMirrorUpdate = "set" | "cleared";
+/**
+ * Re-checks an explicit (`manual`) binding and keeps its CodexCliMirror in
+ * step, mutating the record in place: set to the backend default while the
+ * explicit id is unauthorized, removed once it is authorized again. The
+ * explicit id itself is never changed. Fails open: no answer, no change.
+ */
+export declare function refreshCodexCliMirror(account: {
+    accountId?: string;
+    accountIdSource?: AccountIdSource;
+    codexCliMirror?: CodexCliMirror;
+}, accessToken: string, options?: FetchAuthorizedAccountsOptions): Promise<CodexCliMirrorUpdate | null>;
+/** The slice of a saved account record this migration reads and rewrites. */
+export interface StoredAccountIdentity {
+    accountId?: string;
+    accountIdSource?: AccountIdSource;
+    accountLabel?: string;
+    workspaces?: Workspace[];
+    currentWorkspaceIndex?: number;
+}
+/**
+ * Rebinds a saved account's id when it is not one the backend currently
+ * authorizes, mutating the record in place. This is the migration path for
+ * accounts saved before this guard existed (or by `codex-multi-auth workspace
+ * <account> <workspace>`, which has no live check of its own).
+ *
+ * Scoped to `accountIdSource === "org"` — the one source that never
+ * auto-follows the token (`shouldUpdateAccountIdFromToken`). "token" /
+ * "id_token" already self-correct through `applyTokenAccountIdentity`, and
+ * "manual" is an explicit `login --org` binding this must not override.
+ */
+export declare function reboundUnauthorizedAccountIdentity(account: StoredAccountIdentity, accessToken: string, options?: FetchAuthorizedAccountsOptions): Promise<ConstrainedSelection | null>;
+//# sourceMappingURL=account-access.d.ts.map

package/dist/lib/auth/account-access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-access.d.ts","sourceRoot":"","sources":["../../../lib/auth/account-access.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAC5E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,kBAAkB;IAClC,yEAAyE;IACzE,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,0EAA0E;IAC1E,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,8BAA8B;IAC9C,8DAA8D;IAC9D,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IAChC,MAAM,CAAC,EAAE,WAAW,CAAC;CACrB;AAeD;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACtC,OAAO,EAAE,OAAO,GACd,kBAAkB,GAAG,IAAI,CAgB3B;AAED;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAC5C,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,8BAAmC,GAC1C,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CA0BpC;AAED,MAAM,WAAW,oBAAoB;IACpC,0CAA0C;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,2EAA2E;IAC3E,OAAO,EAAE,OAAO,CAAC;IACjB,qEAAqE;IACrE,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;GAOG;AACH,wBAAgB,8BAA8B,CAC7C,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,kBAAkB,GAAG,IAAI,GACnC,oBAAoB,CAUtB;AAED,6EAA6E;AAC7E,MAAM,WAAW,oBAAoB;IACpC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;CACzB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gCAAgC,CAAC,CAAC,SAAS,oBAAoB,EAC9E,SAAS,EAAE,CAAC,EACZ,UAAU,EAAE,kBAAkB,GAAG,IAAI,GACnC;IAAE,SAAS,EAAE,CAAC,CAAC;IAAC,MAAM,EAAE,oBAAoB,GAAG,IAAI,CAAA;CAAE,CAsBvD;AA6BD,oDAAoD;AACpD,MAAM,MAAM,oBAAoB,GAAG,KAAK,GAAG,SAAS,CAAC;AAErD;;;;;GAKG;AACH,wBAAsB,qBAAqB,CAC1C,OAAO,EAAE;IACR,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,cAAc,CAAC,EAAE,cAAc,CAAC;CAChC,EACD,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,8BAAmC,GAC1C,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAoBtC;AAED,6EAA6E;AAC7E,MAAM,WAAW,qBAAqB;IACrC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;IACzB,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,kCAAkC,CACvD,OAAO,EAAE,qBAAqB,EAC9B,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,8BAAmC,GAC1C,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CA4BtC"}

package/dist/lib/auth/account-access.js

@@ -0,0 +1,214 @@
+import { CODEX_BASE_URL } from "../constants.js";
+const ACCOUNTS_CHECK_PATH = "/wham/accounts/check";
+const ACCOUNTS_CHECK_TIMEOUT_MS = 10_000;
+function readString(value) {
+    if (typeof value !== "string")
+        return undefined;
+    const trimmed = value.trim();
+    return trimmed.length > 0 ? trimmed : undefined;
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+ * Reads the account ids out of a `wham/accounts/check` payload.
+ *
+ * Returns null when the payload carries no usable list, which the caller must
+ * treat as "unknown" rather than "nothing is authorized" — refusing every
+ * account on a shape we failed to parse would break logins for a response format
+ * change alone.
+ */
+export function parseAuthorizedAccounts(payload) {
+    if (!isRecord(payload))
+        return null;
+    const accounts = payload.accounts;
+    if (!Array.isArray(accounts))
+        return null;
+    const accountIds = [];
+    for (const entry of accounts) {
+        if (!isRecord(entry))
+            continue;
+        const id = readString(entry.id) ?? readString(entry.account_id);
+        if (id && !accountIds.includes(id))
+            accountIds.push(id);
+    }
+    if (accountIds.length === 0)
+        return null;
+    const defaultAccountId = readString(payload.default_account_id);
+    return defaultAccountId ? { accountIds, defaultAccountId } : { accountIds };
+}
+/**
+ * Asks the backend which accounts these credentials may act as.
+ *
+ * Fails open (resolves null) for every error: this check exists to catch a
+ * selection that would not work, so an unreachable or unparseable answer must
+ * leave the caller's existing behavior untouched rather than block a login.
+ */
+export async function fetchAuthorizedAccounts(accessToken, options = {}) {
+    const token = readString(accessToken);
+    if (!token)
+        return null;
+    const doFetch = options.fetch ?? globalThis.fetch;
+    const timeout = AbortSignal.timeout(ACCOUNTS_CHECK_TIMEOUT_MS);
+    const signal = options.signal
+        ? AbortSignal.any([options.signal, timeout])
+        : timeout;
+    try {
+        const response = await doFetch(`${CODEX_BASE_URL}${ACCOUNTS_CHECK_PATH}`, {
+            method: "GET",
+            headers: {
+                authorization: `Bearer ${token}`,
+                accept: "application/json",
+            },
+            signal,
+        });
+        if (!response.ok)
+            return null;
+        return parseAuthorizedAccounts(await response.json());
+    }
+    catch {
+        // Deliberately silent about the cause: the token is in scope here and the
+        // failure is advisory, so there is nothing safe or useful to log.
+        return null;
+    }
+}
+/**
+ * Narrows a chosen account id to one the backend authorizes.
+ *
+ * Only ever narrows: with no authorization data, no default to fall back to, or
+ * an id that is already authorized, the caller's own choice is returned
+ * unchanged. That keeps this a guard against a known-bad write rather than a new
+ * way for a login to end up somewhere the user did not ask for.
+ */
+export function constrainSelectionToAuthorized(accountId, authorized) {
+    if (!authorized)
+        return { accountId, changed: false };
+    if (authorized.accountIds.includes(accountId)) {
+        return { accountId, changed: false };
+    }
+    const fallback = authorized.defaultAccountId;
+    if (!fallback || fallback === accountId) {
+        return { accountId, changed: false };
+    }
+    return { accountId: fallback, changed: true, rejected: accountId };
+}
+/**
+ * Applies {@link constrainSelectionToAuthorized} to a resolved login selection.
+ *
+ * On a rewrite the source becomes `token`: the backend's default account IS the
+ * account these credentials are, so it must auto-follow later token refreshes
+ * (see `shouldUpdateAccountIdFromToken`) instead of being pinned the way an
+ * explicit org/manual choice is. The label follows the new id too; an empty
+ * label (not undefined) is deliberate, because the account-pool merge keeps
+ * the saved label on undefined and would go on naming the rejected workspace.
+ *
+ * The workspace list is narrowed with {@link toAuthorizedWorkspaces}.
+ */
+export function applyAuthorizedAccountConstraint(selection, authorized) {
+    const current = readString(selection.accountIdOverride);
+    if (!current || !authorized)
+        return { selection, result: null };
+    const result = constrainSelectionToAuthorized(current, authorized);
+    if (!result.changed)
+        return { selection, result };
+    const workspaces = selection.workspaces
+        ? toAuthorizedWorkspaces(selection.workspaces, authorized, result.accountId)
+        : undefined;
+    return {
+        selection: {
+            ...selection,
+            accountIdOverride: result.accountId,
+            accountIdSource: "token",
+            accountLabel: workspaces?.find((workspace) => workspace.id === result.accountId)
+                ?.name ?? "",
+            ...(workspaces ? { workspaces } : {}),
+        },
+        result,
+    };
+}
+/**
+ * Keeps only workspaces the backend authorizes and makes `accountId` the one
+ * default, adding it when the token claims never listed it.
+ *
+ * The plugin host sends workspaces[currentWorkspaceIndex].id ahead of
+ * accountId, and the account-pool merge keeps a saved pointer while its id
+ * survives, else falls back to the default. With every unauthorized
+ * workspace gone and `accountId` the only default, neither path can land on
+ * a workspace the backend refuses.
+ */
+function toAuthorizedWorkspaces(workspaces, authorized, accountId) {
+    const kept = workspaces
+        .filter((workspace) => workspace.id === accountId || authorized.accountIds.includes(workspace.id))
+        .map((workspace) => ({ ...workspace, isDefault: workspace.id === accountId }));
+    if (!kept.some((workspace) => workspace.id === accountId)) {
+        kept.push({ id: accountId, enabled: true, isDefault: true });
+    }
+    return kept;
+}
+/**
+ * Re-checks an explicit (`manual`) binding and keeps its CodexCliMirror in
+ * step, mutating the record in place: set to the backend default while the
+ * explicit id is unauthorized, removed once it is authorized again. The
+ * explicit id itself is never changed. Fails open: no answer, no change.
+ */
+export async function refreshCodexCliMirror(account, accessToken, options = {}) {
+    if (account.accountIdSource !== "manual")
+        return null;
+    const currentId = readString(account.accountId);
+    if (!currentId)
+        return null;
+    const authorized = await fetchAuthorizedAccounts(accessToken, options);
+    if (!authorized)
+        return null;
+    if (authorized.accountIds.includes(currentId)) {
+        if (!account.codexCliMirror)
+            return null;
+        delete account.codexCliMirror;
+        return "cleared";
+    }
+    const result = constrainSelectionToAuthorized(currentId, authorized);
+    if (!result.changed)
+        return null;
+    const mirror = account.codexCliMirror;
+    if (mirror?.forAccountId === currentId && mirror.accountId === result.accountId) {
+        return null;
+    }
+    account.codexCliMirror = { forAccountId: currentId, accountId: result.accountId };
+    return "set";
+}
+/**
+ * Rebinds a saved account's id when it is not one the backend currently
+ * authorizes, mutating the record in place. This is the migration path for
+ * accounts saved before this guard existed (or by `codex-multi-auth workspace
+ * <account> <workspace>`, which has no live check of its own).
+ *
+ * Scoped to `accountIdSource === "org"` — the one source that never
+ * auto-follows the token (`shouldUpdateAccountIdFromToken`). "token" /
+ * "id_token" already self-correct through `applyTokenAccountIdentity`, and
+ * "manual" is an explicit `login --org` binding this must not override.
+ */
+export async function reboundUnauthorizedAccountIdentity(account, accessToken, options = {}) {
+    if (account.accountIdSource !== "org")
+        return null;
+    const currentId = readString(account.accountId);
+    if (!currentId)
+        return null;
+    const authorized = await fetchAuthorizedAccounts(accessToken, options);
+    const result = constrainSelectionToAuthorized(currentId, authorized);
+    if (!authorized || !result.changed)
+        return null;
+    account.accountId = result.accountId;
+    account.accountIdSource = "token";
+    // The workspace pointer has to follow the rebind: the plugin host sends
+    // the pointed-at workspace id ahead of accountId.
+    if (account.workspaces) {
+        account.workspaces = toAuthorizedWorkspaces(account.workspaces, authorized, result.accountId);
+        const workspaceIndex = account.workspaces.findIndex((workspace) => workspace.id === result.accountId);
+        account.currentWorkspaceIndex = workspaceIndex;
+        account.accountLabel = account.workspaces[workspaceIndex]?.name ?? "";
+    }
+    else if (account.accountLabel !== undefined) {
+        account.accountLabel = "";
+    }
+    return result;
+}

package/dist/lib/auth/token-utils.d.ts

@@ -2,6 +2,7 @@
  * Token utility functions for JWT parsing and account ID extraction.
  * Extracted from accounts.ts to reduce module size and improve cohesion.
  */
+import type { CodexCliMirror } from "../storage/public-types.js";
 import type { AccountIdSource } from "../types.js";
 /**
  * Account ID candidate from token or organization data.
@@ -13,9 +14,13 @@ export interface AccountIdCandidate {
     isDefault?: boolean;
     isPersonal?: boolean;
 }
+/** Explicit metadata wins over the conventional Personal display name. */
+export declare function isPersonalAccountCandidate(candidate: AccountIdCandidate): boolean;
 /**
  * Select the best workspace candidate for OAuth account binding.
- * Preference order:
+ * Prefer a uniquely identifiable Personal workspace. Ambiguous CLI logins
+ * require an explicit choice before reaching this fallback selector.
+ * Fallback order when no unique Personal candidate exists:
  * 1) org default that is not personal
  * 2) org default (any)
  * 3) id_token candidate
@@ -30,6 +35,53 @@ export declare function selectBestAccountCandidate(candidates: AccountIdCandidat
  * @returns Account ID string or undefined if not found
  */
 export declare function extractAccountId(accessToken?: string): string | undefined;
+/**
+ * Maps a stored account id to the value Codex CLI accepts as tokens.account_id.
+ * Codex CLI >= 0.156 checks that field against the token's ChatGPT workspaces;
+ * an OpenAI platform org id ("org-...") is never one of them, so it resolves to
+ * the token's chatgpt_account_id claim instead, or undefined without a claim.
+ * The auth.json writer and every stored-vs-auth.json comparison must share
+ * this mapping, or org-sourced accounts read as permanently drifted.
+ */
+/** Whether an id is an OpenAI platform org id ("org-..."), never a ChatGPT workspace. */
+export declare function isOpenAiOrgId(accountId: string | undefined): boolean;
+export declare function resolveCodexAuthAccountId(accountId: string | undefined, accessToken?: string, idToken?: string): string | undefined;
+/**
+ * The account id to hand the ~/.codex/auth.json writer for a saved account,
+ * and to compare against that file. Applies the account's live
+ * {@link CodexCliMirror} first, then resolveCodexAuthAccountId's org-id
+ * substitution. An org id without a token claim is returned unchanged so the
+ * writer can still drop it. Every auth.json writer and drift check goes
+ * through this; a raw `account.accountId` there writes back an id Codex CLI
+ * refuses.
+ */
+export declare function codexCliAccountIdFor(account: {
+    accountId?: string;
+    codexCliMirror?: CodexCliMirror;
+}, accessToken?: string, idToken?: string): string | undefined;
+interface CodexAccountIdentity {
+    accountId?: string;
+    accessToken?: string;
+}
+/**
+ * The Codex CLI state's active account id with the access token of the
+ * snapshot it came from, so an "org-..." id (the legacy accounts.json keeps
+ * the raw id) can be resolved against that account's own token.
+ */
+export declare function codexCliActiveIdentity(state: {
+    activeAccountId?: string;
+    accounts?: ReadonlyArray<CodexAccountIdentity & {
+        isActive?: boolean;
+    }>;
+}): CodexAccountIdentity;
+/**
+ * Whether two account ids name the same Codex account. Equal raw ids match;
+ * otherwise each side goes through resolveCodexAuthAccountId with its own
+ * token, so a stored "org-..." id matches the workspace id the writer put in
+ * auth.json. Unresolvable ids (org id, no claim) never match a different id.
+ * Equal org ids still differ when both tokens name different workspaces.
+ */
+export declare function codexAuthAccountIdsMatch(left: CodexAccountIdentity, right: CodexAccountIdentity): boolean;
 /**
  * Extracts the email address from OAuth tokens.
  * Checks id_token first (where OpenAI puts email), then falls back to access_token.
@@ -72,4 +124,5 @@ export declare function resolveRuntimeRequestIdentity(input: {
  * @returns Sanitized email or undefined if invalid
  */
 export declare function sanitizeEmail(email: string | undefined): string | undefined;
+export {};
 //# sourceMappingURL=token-utils.d.ts.map

package/dist/lib/auth/token-utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token-utils.d.ts","sourceRoot":"","sources":["../../../lib/auth/token-utils.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,OAAO,KAAK,EAAE,eAAe,EAAc,MAAM,aAAa,CAAC;AAE/D;;GAEG;AACH,MAAM,WAAW,kBAAkB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,eAAe,CAAC;IACxB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;CACrB;AAoND;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CACzC,UAAU,EAAE,kBAAkB,EAAE,GAC9B,kBAAkB,GAAG,SAAS,CA8BhC;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAKzE;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAuB9F;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CACrC,WAAW,CAAC,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,MAAM,GACd,kBAAkB,EAAE,CA+BtB;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAC7C,MAAM,EAAE,eAAe,GAAG,SAAS,EACnC,gBAAgB,CAAC,EAAE,MAAM,GACvB,OAAO,CAIT;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACtC,eAAe,EAAE,MAAM,GAAG,SAAS,EACnC,MAAM,EAAE,eAAe,GAAG,SAAS,EACnC,cAAc,EAAE,MAAM,GAAG,SAAS,GAChC,MAAM,GAAG,SAAS,CAMpB;AAED,MAAM,WAAW,sBAAsB;IACtC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAAE;IACpD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,sBAAsB,CAazB;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAK3E"}
+{"version":3,"file":"token-utils.d.ts","sourceRoot":"","sources":["../../../lib/auth/token-utils.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,KAAK,EAAE,eAAe,EAAc,MAAM,aAAa,CAAC;AAE/D;;GAEG;AACH,MAAM,WAAW,kBAAkB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,eAAe,CAAC;IACxB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;CACrB;AA4ND,0EAA0E;AAC1E,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,kBAAkB,GAAG,OAAO,CAGjF;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,0BAA0B,CACzC,UAAU,EAAE,kBAAkB,EAAE,GAC9B,kBAAkB,GAAG,SAAS,CAgChC;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAKzE;AAED;;;;;;;GAOG;AACH,yFAAyF;AACzF,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAEpE;AAED,wBAAgB,yBAAyB,CACxC,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,WAAW,CAAC,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,MAAM,GACd,MAAM,GAAG,SAAS,CAKpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CACnC,OAAO,EAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,cAAc,CAAA;CAAE,EAChE,WAAW,CAAC,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,MAAM,GACd,MAAM,GAAG,SAAS,CAQpB;AAED,UAAU,oBAAoB;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE;IAC7C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE,aAAa,CAAC,oBAAoB,GAAG;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CACxE,GAAG,oBAAoB,CAOvB;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACvC,IAAI,EAAE,oBAAoB,EAC1B,KAAK,EAAE,oBAAoB,GACzB,OAAO,CAUT;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAuB9F;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CACrC,WAAW,CAAC,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,MAAM,GACd,kBAAkB,EAAE,CA+BtB;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAC7C,MAAM,EAAE,eAAe,GAAG,SAAS,EACnC,gBAAgB,CAAC,EAAE,MAAM,GACvB,OAAO,CAIT;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACtC,eAAe,EAAE,MAAM,GAAG,SAAS,EACnC,MAAM,EAAE,eAAe,GAAG,SAAS,EACnC,cAAc,EAAE,MAAM,GAAG,SAAS,GAChC,MAAM,GAAG,SAAS,CAMpB;AAED,MAAM,WAAW,sBAAsB;IACtC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAAE;IACpD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,sBAAsB,CAazB;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAK3E"}

package/dist/lib/auth/token-utils.js

@@ -180,19 +180,33 @@ function collectCandidatesFromPayload(payload, source) {
  * Removes duplicate candidates by accountId.
  */
 function uniqueCandidates(candidates) {
-    const seen = new Set();
-    const result = [];
+    const byId = new Map();
     for (const candidate of candidates) {
-        if (seen.has(candidate.accountId))
+        const kept = byId.get(candidate.accountId);
+        if (!kept) {
+            byId.set(candidate.accountId, { ...candidate });
             continue;
-        seen.add(candidate.accountId);
-        result.push(candidate);
+        }
+        const wasPersonal = isPersonalAccountCandidate(kept);
+        if (kept.isPersonal === undefined && candidate.isPersonal !== undefined) {
+            kept.isPersonal = candidate.isPersonal;
+        }
+        if (!wasPersonal && isPersonalAccountCandidate(candidate) && kept.isPersonal !== false) {
+            kept.label = candidate.label;
+        }
     }
-    return result;
+    return [...byId.values()];
+}
+/** Explicit metadata wins over the conventional Personal display name. */
+export function isPersonalAccountCandidate(candidate) {
+    return candidate.isPersonal === true ||
+        (candidate.isPersonal !== false && /^Personal(?:\s*\(|\s*\[|$)/i.test(candidate.label.trim()));
 }
 /**
  * Select the best workspace candidate for OAuth account binding.
- * Preference order:
+ * Prefer a uniquely identifiable Personal workspace. Ambiguous CLI logins
+ * require an explicit choice before reaching this fallback selector.
+ * Fallback order when no unique Personal candidate exists:
  * 1) org default that is not personal
  * 2) org default (any)
  * 3) id_token candidate
@@ -203,6 +217,9 @@ function uniqueCandidates(candidates) {
 export function selectBestAccountCandidate(candidates) {
     if (candidates.length === 0)
         return undefined;
+    const personal = candidates.filter(isPersonalAccountCandidate);
+    if (personal.length === 1)
+        return personal[0];
     const orgDefaultNonPersonal = candidates.find((candidate) => candidate.source === "org" && candidate.isDefault === true && candidate.isPersonal !== true);
     if (orgDefaultNonPersonal)
         return orgDefaultNonPersonal;
@@ -232,6 +249,74 @@ export function extractAccountId(accessToken) {
     const accountId = decoded?.[JWT_CLAIM_PATH]?.chatgpt_account_id;
     return typeof accountId === "string" && accountId.trim() ? accountId : undefined;
 }
+/**
+ * Maps a stored account id to the value Codex CLI accepts as tokens.account_id.
+ * Codex CLI >= 0.156 checks that field against the token's ChatGPT workspaces;
+ * an OpenAI platform org id ("org-...") is never one of them, so it resolves to
+ * the token's chatgpt_account_id claim instead, or undefined without a claim.
+ * The auth.json writer and every stored-vs-auth.json comparison must share
+ * this mapping, or org-sourced accounts read as permanently drifted.
+ */
+/** Whether an id is an OpenAI platform org id ("org-..."), never a ChatGPT workspace. */
+export function isOpenAiOrgId(accountId) {
+    return /^org-/i.test(accountId?.trim() ?? "");
+}
+export function resolveCodexAuthAccountId(accountId, accessToken, idToken) {
+    const trimmed = accountId?.trim();
+    if (!trimmed)
+        return undefined;
+    if (!isOpenAiOrgId(trimmed))
+        return trimmed;
+    return extractAccountId(accessToken) ?? extractAccountId(idToken);
+}
+/**
+ * The account id to hand the ~/.codex/auth.json writer for a saved account,
+ * and to compare against that file. Applies the account's live
+ * {@link CodexCliMirror} first, then resolveCodexAuthAccountId's org-id
+ * substitution. An org id without a token claim is returned unchanged so the
+ * writer can still drop it. Every auth.json writer and drift check goes
+ * through this; a raw `account.accountId` there writes back an id Codex CLI
+ * refuses.
+ */
+export function codexCliAccountIdFor(account, accessToken, idToken) {
+    const accountId = account.accountId?.trim();
+    const mirror = account.codexCliMirror;
+    const selected = accountId && mirror && mirror.forAccountId === accountId
+        ? mirror.accountId
+        : account.accountId;
+    return resolveCodexAuthAccountId(selected, accessToken, idToken) ?? selected;
+}
+/**
+ * The Codex CLI state's active account id with the access token of the
+ * snapshot it came from, so an "org-..." id (the legacy accounts.json keeps
+ * the raw id) can be resolved against that account's own token.
+ */
+export function codexCliActiveIdentity(state) {
+    const accountId = state.activeAccountId?.trim();
+    const accounts = state.accounts ?? [];
+    const snapshot = accounts.find((entry) => !!accountId && entry.accountId?.trim() === accountId) ??
+        accounts.find((entry) => entry.isActive);
+    return { accountId, accessToken: snapshot?.accessToken };
+}
+/**
+ * Whether two account ids name the same Codex account. Equal raw ids match;
+ * otherwise each side goes through resolveCodexAuthAccountId with its own
+ * token, so a stored "org-..." id matches the workspace id the writer put in
+ * auth.json. Unresolvable ids (org id, no claim) never match a different id.
+ * Equal org ids still differ when both tokens name different workspaces.
+ */
+export function codexAuthAccountIdsMatch(left, right) {
+    const leftId = left.accountId?.trim();
+    const rightId = right.accountId?.trim();
+    if (!leftId || !rightId)
+        return false;
+    const leftResolved = resolveCodexAuthAccountId(leftId, left.accessToken);
+    const rightResolved = resolveCodexAuthAccountId(rightId, right.accessToken);
+    if (leftId === rightId) {
+        return !leftResolved || !rightResolved || leftResolved === rightResolved;
+    }
+    return !!leftResolved && leftResolved === rightResolved;
+}
 /**
  * Extracts the email address from OAuth tokens.
  * Checks id_token first (where OpenAI puts email), then falls back to access_token.

package/dist/lib/cli.d.ts

@@ -8,7 +8,7 @@ import type { AccountCurrentMarker } from "./runtime/runtime-current-account.js"
  */
 export declare function isNonInteractiveMode(): boolean;
 export declare function promptAddAnotherAccount(currentCount: number): Promise<boolean>;
-export type LoginMode = "add" | "forecast" | "fix" | "settings" | "fresh" | "manage" | "check" | "deep-check" | "verify-flagged" | "cancel";
+export type LoginMode = "add" | "forecast" | "fix" | "settings" | "api-models" | "fresh" | "manage" | "check" | "deep-check" | "verify-flagged" | "cancel";
 export interface ExistingAccountInfo {
     accountId?: string;
     accountLabel?: string;

package/dist/lib/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../lib/cli.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EAGN,KAAK,EACL,KAAK,aAAa,EAClB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAEjF;;;;GAIG;AACH,wBAAgB,oBAAoB,IAAI,OAAO,CAQ9C;AAED,wBAAsB,uBAAuB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAcpF;AAED,MAAM,MAAM,SAAS,GAClB,KAAK,GACL,UAAU,GACV,KAAK,GACL,UAAU,GACV,OAAO,GACP,QAAQ,GACR,OAAO,GACP,YAAY,GACZ,gBAAgB,GAChB,QAAQ,CAAC;AAEZ,MAAM,WAAW,mBAAmB;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,2BAA2B,CAAC,EAAE,MAAM,CAAC;IACrC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,cAAc,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACxC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,0BAA0B,CAAC,EAAE,OAAO,CAAC;IACrC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,UAAU,CAAC,EAAE,YAAY,GAAG,MAAM,CAAC;IACnC,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,gBAAgB;IAChC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC;CACpD;AAED,MAAM,WAAW,eAAe;IAC/B,IAAI,EAAE,SAAS,CAAC;IAChB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,SAAS,CAAC,EAAE,OAAO,CAAC;CACpB;AA0FD,wBAAsB,eAAe,CACpC,gBAAgB,EAAE,mBAAmB,EAAE,EACvC,OAAO,GAAE,gBAAqB,GAC5B,OAAO,CAAC,eAAe,CAAC,CAqG1B;AAED,MAAM,WAAW,yBAAyB;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,SAAS,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,uBAAuB;IACvC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wBAAsB,sBAAsB,CAC3C,UAAU,EAAE,yBAAyB,EAAE,EACvC,OAAO,GAAE,uBAA4B,GACnC,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC,CAyC3C;AAED,OAAO,EAAE,KAAK,EAAE,CAAC;AACjB,YAAY,EAAE,aAAa,EAAE,CAAC"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../lib/cli.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EAGN,KAAK,EACL,KAAK,aAAa,EAClB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAEjF;;;;GAIG;AACH,wBAAgB,oBAAoB,IAAI,OAAO,CAQ9C;AAED,wBAAsB,uBAAuB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAcpF;AAED,MAAM,MAAM,SAAS,GAClB,KAAK,GACL,UAAU,GACV,KAAK,GACL,UAAU,GACV,YAAY,GACZ,OAAO,GACP,QAAQ,GACR,OAAO,GACP,YAAY,GACZ,gBAAgB,GAChB,QAAQ,CAAC;AAEZ,MAAM,WAAW,mBAAmB;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,2BAA2B,CAAC,EAAE,MAAM,CAAC;IACrC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,cAAc,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACxC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,0BAA0B,CAAC,EAAE,OAAO,CAAC;IACrC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,UAAU,CAAC,EAAE,YAAY,GAAG,MAAM,CAAC;IACnC,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,gBAAgB;IAChC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC;CACpD;AAED,MAAM,WAAW,eAAe;IAC/B,IAAI,EAAE,SAAS,CAAC;IAChB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,SAAS,CAAC,EAAE,OAAO,CAAC;CACpB;AA2FD,wBAAsB,eAAe,CACpC,gBAAgB,EAAE,mBAAmB,EAAE,EACvC,OAAO,GAAE,gBAAqB,GAC5B,OAAO,CAAC,eAAe,CAAC,CAuG1B;AAED,MAAM,WAAW,yBAAyB;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,SAAS,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,uBAAuB;IACvC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wBAAsB,sBAAsB,CAC3C,UAAU,EAAE,yBAAyB,EAAE,EACvC,OAAO,GAAE,uBAA4B,GACnC,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC,CAyC3C;AAED,OAAO,EAAE,KAAK,EAAE,CAAC;AACjB,YAAY,EAAE,aAAa,EAAE,CAAC"}

package/dist/lib/cli.js

@@ -90,6 +90,8 @@ async function promptLoginModeFallback(existingAccounts) {
         while (true) {
             const answer = await rl.question(UI_COPY.fallback.selectModePrompt);
             const normalized = answer.trim().toLowerCase();
+            if (normalized === "api")
+                return { mode: "api-models" };
             if (normalized === "a" || normalized === "add")
                 return { mode: "add" };
             if (normalized === "b" || normalized === "p" || normalized === "forecast") {
@@ -142,6 +144,8 @@ export async function promptLoginMode(existingAccounts, options = {}) {
                 return { mode: "forecast" };
             case "fix":
                 return { mode: "fix" };
+            case "api-models":
+                return { mode: "api-models" };
             case "settings":
                 return { mode: "settings" };
             case "fresh":

package/dist/lib/codex-cli/state.d.ts

@@ -13,6 +13,13 @@ export interface CodexCliState {
     accounts: CodexCliAccountSnapshot[];
     activeAccountId?: string;
     activeEmail?: string;
+    /**
+     * The raw tokens.account_id of auth.json whenever auth.json exists, also
+     * when the state itself came from the legacy accounts.json. Codex CLI
+     * 0.156+ rejects an "org-..." value there (#700), unlike accounts.json,
+     * which keeps raw org ids.
+     */
+    authFileAccountId?: string;
     syncVersion?: number;
     sourceUpdatedAtMs?: number;
 }

package/dist/lib/codex-cli/state.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"state.d.ts","sourceRoot":"","sources":["../../../lib/codex-cli/state.ts"],"names":[],"mappings":"AAgBA,MAAM,WAAW,uBAAuB;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,uBAAwB,SAAQ,uBAAuB;IACvE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,uBAAuB,EAAE,CAAC;IACpC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAsID;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,IAAI,OAAO,CAgB/C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,CAIhD;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CAI5C;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,IAAI,MAAM,CAI9C;AAwHD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,iBAAiB,CACtC,OAAO,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAA;CAAE,GAClC,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAwJ/B;AAED,wBAAsB,2BAA2B,CAChD,KAAK,EAAE,MAAM,GAAG,SAAS,GACvB,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAgBzC;AAED,wBAAgB,uBAAuB,IAAI,IAAI,CAI9C;AAED,wBAAgB,mCAAmC,IAAI,IAAI,CAE1D"}
+{"version":3,"file":"state.d.ts","sourceRoot":"","sources":["../../../lib/codex-cli/state.ts"],"names":[],"mappings":"AAgBA,MAAM,WAAW,uBAAuB;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,uBAAwB,SAAQ,uBAAuB;IACvE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,uBAAuB,EAAE,CAAC;IACpC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAsID;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,IAAI,OAAO,CAgB/C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,CAIhD;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CAI5C;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,IAAI,MAAM,CAI9C;AA0HD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,iBAAiB,CACtC,OAAO,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAA;CAAE,GAClC,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CA2K/B;AAED,wBAAsB,2BAA2B,CAChD,KAAK,EAAE,MAAM,GAAG,SAAS,GACvB,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAgBzC;AAED,wBAAgB,uBAAuB,IAAI,IAAI,CAI9C;AAED,wBAAgB,mCAAmC,IAAI,IAAI,CAE1D"}

package/dist/lib/codex-cli/state.js

@@ -299,6 +299,7 @@ function parseCodexCliAuthState(path, parsed, sourceUpdatedAtMs) {
         accounts: [snapshot],
         activeAccountId: accountId,
         activeEmail: email,
+        authFileAccountId: readTrimmedString(tokens.account_id) ?? readTrimmedString(tokens.accountId),
         syncVersion: readNumber(parsed.codexMultiAuthSyncVersion),
         sourceUpdatedAtMs,
     };
@@ -372,6 +373,23 @@ export async function loadCodexCliState(options) {
                     }
                     const state = parseCodexCliState(accountsPath, parsed, sourceUpdatedAtMs);
                     if (state) {
+                        if (hasAuthPath) {
+                            // Codex CLI itself reads auth.json, so a stale org account_id
+                            // there must stay visible behind a valid accounts.json.
+                            try {
+                                const authParsed = JSON.parse(await retryFsOperation(() => fs.readFile(authPath, "utf-8")));
+                                const authTokens = isRecord(authParsed) && isRecord(authParsed.tokens)
+                                    ? authParsed.tokens
+                                    : undefined;
+                                state.authFileAccountId = authTokens
+                                    ? (readTrimmedString(authTokens.account_id) ??
+                                        readTrimmedString(authTokens.accountId))
+                                    : undefined;
+                            }
+                            catch {
+                                // Unreadable auth.json: nothing to flag here.
+                            }
+                        }
                         incrementCodexCliMetric("readSuccesses");
                         log.debug("Loaded Codex CLI state", {
                             operation: "read-state",

package/dist/lib/codex-cli/writer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"writer.d.ts","sourceRoot":"","sources":["../../../lib/codex-cli/writer.ts"],"names":[],"mappings":"AAoBA,UAAU,eAAe;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AA8ND;;;;;;GAMG;AACH,wBAAgB,kCAAkC,IAAI,OAAO,CAG5D;AAiBD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,iCAAiC,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CASlF;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,2BAA2B,CAChD,UAAU,GAAE,MAAgC,GAC1C,OAAO,CAAC,OAAO,CAAC,CAgDlB;AAmHD,wBAAsB,0BAA0B,CAC/C,SAAS,EAAE,eAAe,GACxB,OAAO,CAAC,OAAO,CAAC,CAqMlB;AAED,wBAAgB,sCAAsC,IAAI,MAAM,CAE/D"}
+{"version":3,"file":"writer.d.ts","sourceRoot":"","sources":["../../../lib/codex-cli/writer.ts"],"names":[],"mappings":"AA4BA,UAAU,eAAe;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AA8ND;;;;;;GAMG;AACH,wBAAgB,kCAAkC,IAAI,OAAO,CAG5D;AAiBD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,iCAAiC,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CASlF;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,2BAA2B,CAChD,UAAU,GAAE,MAAgC,GAC1C,OAAO,CAAC,OAAO,CAAC,CAgDlB;AA4JD,wBAAsB,0BAA0B,CAC/C,SAAS,EAAE,eAAe,GACxB,OAAO,CAAC,OAAO,CAAC,CAkNlB;AAED,wBAAgB,sCAAsC,IAAI,MAAM,CAE/D"}