codex-multi-auth 2.2.2 → 2.3.0-beta.1

package/dist/lib/codex-manager/account-pool-write.js

@@ -0,0 +1,166 @@
+/**
+ * Choose the workspace a freshly-saved account should start on: prefer the
+ * workspace whose id matches the resolved accountId, otherwise the first
+ * enabled workspace, otherwise index 0.
+ */
+export function pickInitialWorkspaceIndex(workspaces, accountId) {
+    if (accountId) {
+        const matching = workspaces.findIndex((workspace) => workspace.id === accountId);
+        if (matching >= 0)
+            return matching;
+    }
+    const firstEnabled = workspaces.findIndex((workspace) => workspace.enabled !== false);
+    return firstEnabled >= 0 ? firstEnabled : 0;
+}
+/**
+ * Merge incoming workspaces with the saved set, preserving any per-workspace
+ * enabled/disabled state the user already had. Workspaces the login did not
+ * surface are dropped only when the login returned a workspace list at all;
+ * otherwise the existing list is kept untouched.
+ */
+export function mergeAccountWorkspaces(existing, incoming) {
+    if (!incoming)
+        return existing.workspaces;
+    return incoming.map((newWs) => {
+        const existingWs = existing.workspaces?.find((w) => w.id === newWs.id);
+        return existingWs
+            ? {
+                ...newWs,
+                enabled: existingWs.enabled,
+                disabledAt: existingWs.disabledAt,
+            }
+            : newWs;
+    });
+}
+/**
+ * Resolve the workspace index a refreshed account should point at after a
+ * merge: keep the user on their current workspace if it survived, else the
+ * default workspace, else the first enabled one, else index 0.
+ */
+export function resolveCurrentWorkspaceIndex(existing, mergedWorkspaces) {
+    if (!mergedWorkspaces || mergedWorkspaces.length === 0) {
+        return existing.currentWorkspaceIndex;
+    }
+    const currentWorkspaceId = existing.workspaces?.[typeof existing.currentWorkspaceIndex === "number"
+        ? existing.currentWorkspaceIndex
+        : 0]?.id;
+    if (currentWorkspaceId) {
+        const matching = mergedWorkspaces.findIndex((workspace) => workspace.id === currentWorkspaceId);
+        if (matching >= 0)
+            return matching;
+    }
+    const defaultIndex = mergedWorkspaces.findIndex((workspace) => workspace.isDefault === true);
+    if (defaultIndex >= 0)
+        return defaultIndex;
+    const firstEnabled = mergedWorkspaces.findIndex((workspace) => workspace.enabled !== false);
+    return firstEnabled >= 0 ? firstEnabled : 0;
+}
+/**
+ * Build the saved record for a login result that did not match any existing
+ * entry, seeding its workspace tracking from the token-derived workspaces.
+ */
+export function buildInsertedAccount(write) {
+    const initialWorkspaceIndex = write.workspaces && write.workspaces.length > 0
+        ? pickInitialWorkspaceIndex(write.workspaces, write.accountId)
+        : undefined;
+    return {
+        outcome: "inserted",
+        account: {
+            accountId: write.accountId,
+            accountIdSource: write.accountIdSource,
+            accountLabel: write.accountLabel,
+            email: write.email,
+            refreshToken: write.refreshToken,
+            accessToken: write.accessToken,
+            expiresAt: write.expiresAt,
+            enabled: true,
+            addedAt: write.now,
+            lastUsed: write.now,
+            workspaces: write.workspaces,
+            currentWorkspaceIndex: initialWorkspaceIndex,
+        },
+    };
+}
+/**
+ * Fold a login result onto an existing saved entry: refresh tokens/identity,
+ * merge workspace tracking, and classify whether this was a plain `updated`
+ * refresh or a `rebound` (a previously-unknown workspace appeared).
+ */
+export function buildUpdatedAccount(existing, write) {
+    const nextEmail = write.email ?? existing.email;
+    const nextAccountId = write.accountId ?? existing.accountId;
+    const nextAccountIdSource = write.accountId
+        ? (write.accountIdSource ?? existing.accountIdSource)
+        : existing.accountIdSource;
+    const previousWorkspaceIds = new Set((existing.workspaces ?? []).map((workspace) => workspace.id));
+    const mergedWorkspaces = mergeAccountWorkspaces(existing, write.workspaces);
+    // Only a genuine *rebind* counts as "rebound": the account already tracked
+    // workspaces and the login surfaced one it had never seen. First-time
+    // enrichment of a pre-#491 row (no prior workspaces) is a plain `updated`,
+    // so the user is not told "Rebound workspace" on their first workspace-aware
+    // re-login (#512 follow-up).
+    const introducedNewWorkspace = previousWorkspaceIds.size > 0 &&
+        Boolean(write.workspaces?.some((workspace) => !previousWorkspaceIds.has(workspace.id)));
+    const nextCurrentWorkspaceIndex = resolveCurrentWorkspaceIndex(existing, mergedWorkspaces);
+    return {
+        outcome: introducedNewWorkspace ? "rebound" : "updated",
+        account: {
+            ...existing,
+            accountId: nextAccountId,
+            accountIdSource: nextAccountIdSource,
+            accountLabel: write.accountLabel ?? existing.accountLabel,
+            email: nextEmail,
+            refreshToken: write.refreshToken,
+            accessToken: write.accessToken,
+            expiresAt: write.expiresAt,
+            enabled: true,
+            lastUsed: write.now,
+            workspaces: mergedWorkspaces,
+            currentWorkspaceIndex: nextCurrentWorkspaceIndex,
+        },
+    };
+}
+/**
+ * Fold a batch of resolved login writes into the saved account list, returning
+ * the next account array, the selected index, and the outcome of the last
+ * write. This is the pure core of `persistAccountPool`: it owns the dedup →
+ * insert/update → workspace-tracking → active-index decisions that issue #512
+ * depends on, with the matching strategy injected so the production path and
+ * tests share the exact same behaviour.
+ */
+export function applyAccountPoolResults(params) {
+    const accounts = [...params.existing];
+    let selectedAccountIndex = null;
+    let selectedOutcome = null;
+    for (const write of params.writes) {
+        const existingIndex = params.findMatchingAccountIndex(accounts, {
+            accountId: write.accountId,
+            email: write.email,
+            refreshToken: write.refreshToken,
+        }, { allowUniqueAccountIdFallbackWithoutEmail: true });
+        if (existingIndex === undefined) {
+            const { account, outcome } = buildInsertedAccount(write);
+            selectedAccountIndex = accounts.length;
+            accounts.push(account);
+            selectedOutcome = outcome;
+            continue;
+        }
+        const existing = accounts[existingIndex];
+        if (!existing)
+            continue;
+        const { account, outcome } = buildUpdatedAccount(existing, write);
+        accounts[existingIndex] = account;
+        selectedAccountIndex = existingIndex;
+        selectedOutcome = outcome;
+    }
+    const fallbackActiveIndex = accounts.length === 0
+        ? 0
+        : Math.max(0, Math.min(params.priorActiveIndex ?? 0, accounts.length - 1));
+    const activeIndex = accounts.length === 0
+        ? 0
+        : selectedAccountIndex === null
+            ? fallbackActiveIndex
+            : Math.max(0, Math.min(selectedAccountIndex, accounts.length - 1));
+    return { accounts, activeIndex, outcome: selectedOutcome };
+}
+//# sourceMappingURL=account-pool-write.js.map

package/dist/lib/codex-manager/account-pool-write.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-pool-write.js","sourceRoot":"","sources":["../../../lib/codex-manager/account-pool-write.ts"],"names":[],"mappings":"AAqCA;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACxC,UAAuB,EACvB,SAA6B;IAE7B,IAAI,SAAS,EAAE,CAAC;QACf,MAAM,QAAQ,GAAG,UAAU,CAAC,SAAS,CACpC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,SAAS,CACzC,CAAC;QACF,IAAI,QAAQ,IAAI,CAAC;YAAE,OAAO,QAAQ,CAAC;IACpC,CAAC;IACD,MAAM,YAAY,GAAG,UAAU,CAAC,SAAS,CACxC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,KAAK,KAAK,CAC1C,CAAC;IACF,OAAO,YAAY,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACrC,QAA+C,EAC/C,QAAiC;IAEjC,IAAI,CAAC,QAAQ;QAAE,OAAO,QAAQ,CAAC,UAAU,CAAC;IAC1C,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QAC7B,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC,CAAC;QACvE,OAAO,UAAU;YAChB,CAAC,CAAC;gBACA,GAAG,KAAK;gBACR,OAAO,EAAE,UAAU,CAAC,OAAO;gBAC3B,UAAU,EAAE,UAAU,CAAC,UAAU;aACjC;YACF,CAAC,CAAC,KAAK,CAAC;IACV,CAAC,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,4BAA4B,CAC3C,QAAyE,EACzE,gBAAyC;IAEzC,IAAI,CAAC,gBAAgB,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxD,OAAO,QAAQ,CAAC,qBAAqB,CAAC;IACvC,CAAC;IACD,MAAM,kBAAkB,GACvB,QAAQ,CAAC,UAAU,EAAE,CACpB,OAAO,QAAQ,CAAC,qBAAqB,KAAK,QAAQ;QACjD,CAAC,CAAC,QAAQ,CAAC,qBAAqB;QAChC,CAAC,CAAC,CAAC,CACJ,EAAE,EAAE,CAAC;IACP,IAAI,kBAAkB,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,SAAS,CAC1C,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,kBAAkB,CAClD,CAAC;QACF,IAAI,QAAQ,IAAI,CAAC;YAAE,OAAO,QAAQ,CAAC;IACpC,CAAC;IACD,MAAM,YAAY,GAAG,gBAAgB,CAAC,SAAS,CAC9C,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,KAAK,IAAI,CAC3C,CAAC;IACF,IAAI,YAAY,IAAI,CAAC;QAAE,OAAO,YAAY,CAAC;IAC3C,MAAM,YAAY,GAAG,gBAAgB,CAAC,SAAS,CAC9C,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,KAAK,KAAK,CAC1C,CAAC;IACF,OAAO,YAAY,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CACnC,KAA2B;IAE3B,MAAM,qBAAqB,GAC1B,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;QAC9C,CAAC,CAAC,yBAAyB,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC;QAC9D,CAAC,CAAC,SAAS,CAAC;IACd,OAAO;QACN,OAAO,EAAE,UAAU;QACnB,OAAO,EAAE;YACR,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,KAAK,CAAC,GAAG;YAClB,QAAQ,EAAE,KAAK,CAAC,GAAG;YACnB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,qBAAqB,EAAE,qBAAqB;SAC5C;KACD,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAClC,QAA2B,EAC3B,KAA2B;IAE3B,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC;IAChD,MAAM,aAAa,GAAG,KAAK,CAAC,SAAS,IAAI,QAAQ,CAAC,SAAS,CAAC;IAC5D,MAAM,mBAAmB,GAAG,KAAK,CAAC,SAAS;QAC1C,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,IAAI,QAAQ,CAAC,eAAe,CAAC;QACrD,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC;IAE5B,MAAM,oBAAoB,GAAG,IAAI,GAAG,CACnC,CAAC,QAAQ,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAC5D,CAAC;IACF,MAAM,gBAAgB,GAAG,sBAAsB,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IAC5E,2EAA2E;IAC3E,sEAAsE;IACtE,2EAA2E;IAC3E,6EAA6E;IAC7E,6BAA6B;IAC7B,MAAM,sBAAsB,GAC3B,oBAAoB,CAAC,IAAI,GAAG,CAAC;QAC7B,OAAO,CACN,KAAK,CAAC,UAAU,EAAE,IAAI,CACrB,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CACtD,CACD,CAAC;IACH,MAAM,yBAAyB,GAAG,4BAA4B,CAC7D,QAAQ,EACR,gBAAgB,CAChB,CAAC;IAEF,OAAO;QACN,OAAO,EAAE,sBAAsB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QACvD,OAAO,EAAE;YACR,GAAG,QAAQ;YACX,SAAS,EAAE,aAAa;YACxB,eAAe,EAAE,mBAAmB;YACpC,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,QAAQ,CAAC,YAAY;YACzD,KAAK,EAAE,SAAS;YAChB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,KAAK,CAAC,GAAG;YACnB,UAAU,EAAE,gBAAgB;YAC5B,qBAAqB,EAAE,yBAAyB;SAChD;KACD,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAavC;IAKA,MAAM,QAAQ,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,oBAAoB,GAAkB,IAAI,CAAC;IAC/C,IAAI,eAAe,GAAmC,IAAI,CAAC;IAE3D,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QACnC,MAAM,aAAa,GAAG,MAAM,CAAC,wBAAwB,CACpD,QAAQ,EACR;YACC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,YAAY,EAAE,KAAK,CAAC,YAAY;SAChC,EACD,EAAE,wCAAwC,EAAE,IAAI,EAAE,CAClD,CAAC;QAEF,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YACjC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;YACzD,oBAAoB,GAAG,QAAQ,CAAC,MAAM,CAAC;YACvC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvB,eAAe,GAAG,OAAO,CAAC;YAC1B,SAAS;QACV,CAAC;QAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ;YAAE,SAAS;QAExB,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,mBAAmB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAClE,QAAQ,CAAC,aAAa,CAAC,GAAG,OAAO,CAAC;QAClC,oBAAoB,GAAG,aAAa,CAAC;QACrC,eAAe,GAAG,OAAO,CAAC;IAC3B,CAAC;IAED,MAAM,mBAAmB,GACxB,QAAQ,CAAC,MAAM,KAAK,CAAC;QACpB,CAAC,CAAC,CAAC;QACH,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7E,MAAM,WAAW,GAChB,QAAQ,CAAC,MAAM,KAAK,CAAC;QACpB,CAAC,CAAC,CAAC;QACH,CAAC,CAAC,oBAAoB,KAAK,IAAI;YAC9B,CAAC,CAAC,mBAAmB;YACrB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,oBAAoB,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IAEtE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;AAC5D,CAAC"}

package/dist/lib/codex-manager/manual-callback.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Classification of a manual OAuth callback entry.
+ *
+ * Splitting `invalid` and `state-mismatch` out from `cancelled` is the fix for
+ * the issue #512 follow-up: `login --manual` previously collapsed a malformed
+ * or wrong-attempt callback URL into the same `null` it used for a genuine user
+ * abort, so the CLI printed `Cancelled.` and hid the real validation error.
+ *
+ * - `code`: a valid authorization code + matching state were extracted.
+ * - `cancelled`: the user aborted (empty input, an Esc character, or one of the
+ *   cancel keywords `q`/`quit`/`cancel`/`back`).
+ * - `invalid`: the pasted value was missing the code and/or state parameter.
+ * - `state-mismatch`: the state did not match the one minted for this attempt.
+ */
+export type ManualCallbackClassification = {
+    type: "code";
+    code: string;
+} | {
+    type: "cancelled";
+} | {
+    type: "invalid";
+} | {
+    type: "state-mismatch";
+};
+/**
+ * Classify raw manual-callback input against the expected OAuth state. Pure and
+ * I/O-free so the CLI prompt and unit tests share identical behaviour.
+ *
+ * `answer` is `null` when the input stream closed before any line was read,
+ * which is treated as a cancellation.
+ */
+export declare function classifyManualCallbackInput(answer: string | null, expectedState: string): ManualCallbackClassification;
+//# sourceMappingURL=manual-callback.d.ts.map

package/dist/lib/codex-manager/manual-callback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manual-callback.d.ts","sourceRoot":"","sources":["../../../lib/codex-manager/manual-callback.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,4BAA4B,GACrC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GACrB;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GACnB;IAAE,IAAI,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAK9B;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAC1C,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,aAAa,EAAE,MAAM,GACnB,4BAA4B,CAmB9B"}

package/dist/lib/codex-manager/manual-callback.js

@@ -0,0 +1,31 @@
+import { parseAuthorizationInput } from "../auth/auth.js";
+const CANCEL_KEYWORDS = new Set(["", "q", "quit", "cancel", "back"]);
+const ESC_CHARACTER = "\u001b";
+/**
+ * Classify raw manual-callback input against the expected OAuth state. Pure and
+ * I/O-free so the CLI prompt and unit tests share identical behaviour.
+ *
+ * `answer` is `null` when the input stream closed before any line was read,
+ * which is treated as a cancellation.
+ */
+export function classifyManualCallbackInput(answer, expectedState) {
+    if (answer === null) {
+        return { type: "cancelled" };
+    }
+    if (answer.includes(ESC_CHARACTER)) {
+        return { type: "cancelled" };
+    }
+    const normalized = answer.trim().toLowerCase();
+    if (CANCEL_KEYWORDS.has(normalized)) {
+        return { type: "cancelled" };
+    }
+    const parsed = parseAuthorizationInput(answer);
+    if (!parsed.code || !parsed.state) {
+        return { type: "invalid" };
+    }
+    if (parsed.state !== expectedState) {
+        return { type: "state-mismatch" };
+    }
+    return { type: "code", code: parsed.code };
+}
+//# sourceMappingURL=manual-callback.js.map

package/dist/lib/codex-manager/manual-callback.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manual-callback.js","sourceRoot":"","sources":["../../../lib/codex-manager/manual-callback.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAsB1D,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;AACrE,MAAM,aAAa,GAAG,QAAQ,CAAC;AAE/B;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CAC1C,MAAqB,EACrB,aAAqB;IAErB,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAC9B,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QACpC,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAC9B,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/C,IAAI,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QACrC,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAC9B,CAAC;IACD,MAAM,MAAM,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACnC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC5B,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,KAAK,aAAa,EAAE,CAAC;QACpC,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;IACnC,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AAC5C,CAAC"}

package/dist/lib/codex-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codex-manager.d.ts","sourceRoot":"","sources":["../../lib/codex-manager.ts"],"names":[],"mappings":"AA8MA,KAAK,UAAU,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,GAAG,OAAO,CAAC;AA8MxE,wBAAgB,sBAAsB,CACrC,MAAM,EAAE,MAAM,EACd,YAAY,GAAE,UAAoB,GAChC,MAAM,CA4CR;AA0gCD,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAQ3D;AA+3DD,wBAAsB,4BAA4B,IAAI,OAAO,CAAC,OAAO,CAAC,CAuGrE;AAuCD,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA+O7E"}
+{"version":3,"file":"codex-manager.d.ts","sourceRoot":"","sources":["../../lib/codex-manager.ts"],"names":[],"mappings":"AAwNA,KAAK,UAAU,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,GAAG,OAAO,CAAC;AA8MxE,wBAAgB,sBAAsB,CACrC,MAAM,EAAE,MAAM,EACd,YAAY,GAAE,UAAoB,GAChC,MAAM,CA4CR;AAuhCD,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAQ3D;AAg3DD,wBAAsB,4BAA4B,IAAI,OAAO,CAAC,OAAO,CAAC,CAuGrE;AAuCD,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA+O7E"}

package/dist/lib/codex-manager.js

@@ -1,7 +1,7 @@
 import { stdin as input, stdout as output } from "node:process";
 import { createInterface } from "node:readline/promises";
 import { extractAccountEmail, extractAccountId, formatAccountLabel, formatWaitTime, getAccountIdCandidates, resolveRequestAccountId, sanitizeEmail, selectBestAccountCandidate, shouldUpdateAccountIdFromToken, } from "./accounts.js";
-import { createAuthorizationFlow, exchangeAuthorizationCode, parseAuthorizationInput, redactOAuthUrlForLog, REDIRECT_URI, } from "./auth/auth.js";
+import { createAuthorizationFlow, exchangeAuthorizationCode, redactOAuthUrlForLog, REDIRECT_URI, } from "./auth/auth.js";
 import { runDeviceAuthFlow } from "./auth/device-auth.js";
 import { resolveOrgOverride } from "./auth/org-override.js";
 import { copyTextToClipboard, isBrowserLaunchSuppressed, openBrowserUrl, } from "./auth/browser.js";
@@ -12,6 +12,8 @@ import { setCodexCliActiveSelection } from "./codex-cli/writer.js";
 import { runBestCommand, } from "./codex-manager/commands/best.js";
 import { runAccountCommand } from "./codex-manager/commands/account.js";
 import { ACCOUNT_MANAGER_COMMANDS } from "./codex-manager/account-manager-commands.js";
+import { applyAccountPoolResults, } from "./codex-manager/account-pool-write.js";
+import { classifyManualCallbackInput, } from "./codex-manager/manual-callback.js";
 import { runBudgetCommand } from "./codex-manager/commands/budget.js";
 import { runBridgeCommand } from "./codex-manager/commands/bridge.js";
 import { runCheckCommand } from "./codex-manager/commands/check.js";
@@ -856,15 +858,33 @@ async function syncCodexCliActiveSelectionIfDrifted(storage) {
  * process.env for the duration of a login, which raced on concurrent re-entry.
  */
 function resolveAccountSelection(tokens, orgOverride) {
+    const candidates = getAccountIdCandidates(tokens.access, tokens.idToken);
+    // Surface every workspace/organization exposed by the token so the saved
+    // account can track them (issue #491/#512). Without this, same-email
+    // multi-workspace logins persisted rows with `workspaces: null` and
+    // `workspace <account>` was unusable. Built before the `--org` override
+    // branch so the explicit-binding flow persists workspaces too (#512).
+    const workspaces = candidates.length > 0
+        ? candidates.map((candidate) => ({
+            id: candidate.accountId,
+            name: candidate.label,
+            enabled: true,
+            isDefault: candidate.isDefault,
+        }))
+        : undefined;
     const override = resolveOrgOverride(orgOverride);
     if (override) {
+        // Prefer the token candidate's human label for the chosen org so the
+        // saved row is identifiable, falling back to a bare manual binding.
+        const matched = candidates.find((candidate) => candidate.accountId === override);
         return {
             ...tokens,
             accountIdOverride: override,
             accountIdSource: "manual",
+            accountLabel: matched?.label,
+            workspaces,
         };
     }
-    const candidates = getAccountIdCandidates(tokens.access, tokens.idToken);
     if (candidates.length === 0) {
         return tokens;
     }
@@ -876,6 +896,7 @@ function resolveAccountSelection(tokens, orgOverride) {
                 accountIdOverride: candidate.accountId,
                 accountIdSource: candidate.source,
                 accountLabel: candidate.label,
+                workspaces,
             };
         }
     }
@@ -888,6 +909,7 @@ function resolveAccountSelection(tokens, orgOverride) {
         accountIdOverride: best.accountId,
         accountIdSource: best.source ?? "token",
         accountLabel: best.label,
+        workspaces,
     };
 }
 function resolveStoredAccountIdentity(storedAccountId, storedAccountIdSource, tokenAccountId) {
@@ -922,7 +944,7 @@ function applyTokenAccountIdentity(account, tokenAccountId) {
 async function promptManualCallback(state, options = {}) {
     const useInteractivePrompt = input.isTTY && output.isTTY;
     if (!useInteractivePrompt && !options.allowNonTty) {
-        return null;
+        return { type: "cancelled" };
     }
     const rl = createInterface({ input, output });
     try {
@@ -974,30 +996,11 @@ async function promptManualCallback(state, options = {}) {
                 input.once("end", handleInputClosed);
                 input.once("close", handleInputClosed);
             });
-        if (answer === null) {
-            return null;
-        }
-        if (answer.includes("\u001b")) {
-            return null;
-        }
-        const normalized = answer.trim().toLowerCase();
-        if (normalized.length === 0 ||
-            normalized === "q" ||
-            normalized === "quit" ||
-            normalized === "cancel" ||
-            normalized === "back") {
-            return null;
-        }
-        const parsed = parseAuthorizationInput(answer);
-        if (!parsed.code || !parsed.state)
-            return null;
-        if (parsed.state !== state)
-            return null;
-        return parsed.code;
+        return classifyManualCallbackInput(answer, state);
     }
     catch (error) {
         if (isAbortError(error) || isReadlineClosedError(error)) {
-            return null;
+            return { type: "cancelled" };
         }
         throw error;
     }
@@ -1455,9 +1458,28 @@ async function runOAuthFlow(forceNewLogin, signInMode) {
                 : signInMode === "manual"
                     ? UI_COPY.oauth.callbackBypassed
                     : UI_COPY.oauth.callbackUnavailable, "warning"));
-            code = await promptManualCallback(state, {
+            const manualResult = await promptManualCallback(state, {
                 allowNonTty: signInMode === "manual",
             });
+            // A parse/state failure must surface its own validation error instead
+            // of being reported as `Cancelled.` like a genuine user abort
+            // (issue #512 follow-up). Only an actual cancellation falls through to
+            // the cancelled path below.
+            if (manualResult.type === "invalid") {
+                return {
+                    type: "failed",
+                    reason: "invalid_response",
+                    message: UI_COPY.oauth.callbackInvalid,
+                };
+            }
+            if (manualResult.type === "state-mismatch") {
+                return {
+                    type: "failed",
+                    reason: "invalid_response",
+                    message: UI_COPY.oauth.callbackStateMismatch,
+                };
+            }
+            code = manualResult.type === "code" ? manualResult.code : null;
         }
     }
     finally {
@@ -1490,85 +1512,47 @@ async function runSignInFlow(forceNewLogin, signInMode, options = {}) {
 }
 async function persistAccountPool(results, replaceAll) {
     if (results.length === 0)
-        return;
-    await withAccountStorageTransaction(async (loadedStorage, persist) => {
+        return null;
+    return await withAccountStorageTransaction(async (loadedStorage, persist) => {
         const stored = replaceAll ? null : loadedStorage;
         const now = Date.now();
-        const accounts = stored?.accounts ? [...stored.accounts] : [];
-        let selectedAccountIndex = null;
-        for (const result of results) {
+        const existing = stored?.accounts ? [...stored.accounts] : [];
+        const writes = results.map((result) => {
             const tokenAccountId = extractAccountId(result.access);
             const accountId = resolveRequestAccountId(result.accountIdOverride, result.accountIdSource, tokenAccountId);
             const accountIdSource = accountId
                 ? (result.accountIdSource ??
                     (result.accountIdOverride ? "manual" : "token"))
                 : undefined;
-            const accountLabel = result.accountLabel;
-            const accountEmail = sanitizeEmail(extractAccountEmail(result.access, result.idToken));
-            const existingIndex = findMatchingAccountIndex(accounts, {
+            return {
                 accountId,
-                email: accountEmail,
-                refreshToken: result.refresh,
-            }, {
-                allowUniqueAccountIdFallbackWithoutEmail: true,
-            });
-            if (existingIndex === undefined) {
-                const newIndex = accounts.length;
-                accounts.push({
-                    accountId,
-                    accountIdSource,
-                    accountLabel,
-                    email: accountEmail,
-                    refreshToken: result.refresh,
-                    accessToken: result.access,
-                    expiresAt: result.expires,
-                    enabled: true,
-                    addedAt: now,
-                    lastUsed: now,
-                });
-                selectedAccountIndex = newIndex;
-                continue;
-            }
-            const existing = accounts[existingIndex];
-            if (!existing)
-                continue;
-            const nextEmail = accountEmail ?? existing.email;
-            const nextAccountId = accountId ?? existing.accountId;
-            const nextAccountIdSource = accountId
-                ? (accountIdSource ?? existing.accountIdSource)
-                : existing.accountIdSource;
-            accounts[existingIndex] = {
-                ...existing,
-                accountId: nextAccountId,
-                accountIdSource: nextAccountIdSource,
-                accountLabel: accountLabel ?? existing.accountLabel,
-                email: nextEmail,
+                accountIdSource,
+                accountLabel: result.accountLabel,
+                email: sanitizeEmail(extractAccountEmail(result.access, result.idToken)),
                 refreshToken: result.refresh,
                 accessToken: result.access,
                 expiresAt: result.expires,
-                enabled: true,
-                lastUsed: now,
+                workspaces: result.workspaces,
+                now,
             };
-            selectedAccountIndex = existingIndex;
-        }
-        const fallbackActiveIndex = accounts.length === 0
-            ? 0
-            : Math.max(0, Math.min(stored?.activeIndex ?? 0, accounts.length - 1));
-        const nextActiveIndex = accounts.length === 0
-            ? 0
-            : selectedAccountIndex === null
-                ? fallbackActiveIndex
-                : Math.max(0, Math.min(selectedAccountIndex, accounts.length - 1));
+        });
+        const { accounts, activeIndex, outcome } = applyAccountPoolResults({
+            existing,
+            writes,
+            priorActiveIndex: stored?.activeIndex,
+            findMatchingAccountIndex,
+        });
         const activeIndexByFamily = {};
         for (const family of MODEL_FAMILIES) {
-            activeIndexByFamily[family] = nextActiveIndex;
+            activeIndexByFamily[family] = activeIndex;
         }
         await persist({
             version: 3,
             accounts,
-            activeIndex: nextActiveIndex,
+            activeIndex,
             activeIndexByFamily,
         });
+        return outcome;
     });
 }
 async function syncSelectionToCodex(tokens) {
@@ -2396,14 +2380,22 @@ async function runAuthLoginFlow(loginOptions) {
                 return 1;
             }
             const resolved = resolveAccountSelection(tokenResult, loginOptions.org);
-            await persistAccountPool([resolved], false);
+            const persistOutcome = await persistAccountPool([resolved], false);
             await syncSelectionToCodex(resolved);
             const latestStorage = await loadAccounts();
             const count = latestStorage?.accounts.length ?? 1;
             existingCount = count;
             namedBackups = [];
             onboardingBackupDiscoveryWarning = null;
-            console.log(`Added account. Total: ${count}`);
+            // Only claim a new saved slot when one was actually appended. A
+            // same-email login that maps onto an existing entry updates or
+            // rebinds it instead of growing the pool (issue #512).
+            const outcomeMessage = persistOutcome === "rebound"
+                ? `Rebound workspace for existing account. Total: ${count}`
+                : persistOutcome === "updated"
+                    ? `Updated existing account. Total: ${count}`
+                    : `Added account. Total: ${count}`;
+            console.log(outcomeMessage);
             console.log("Next steps:");
             console.log("  codex-multi-auth status  Check that the wrapper is active.");
             console.log("  codex-multi-auth check   Confirm your saved accounts look healthy.");