codex-multi-auth 2.21.0 → 2.23.0

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-multi-auth",
-	"version": "2.21.0",
+	"version": "2.23.0",
   "description": "Install and operate codex-multi-auth for the official @openai/codex CLI with multi-account OAuth rotation, switching, health checks, and recovery tools.",
   "interface": {
     "composerIcon": "./assets/codex-multi-auth-icon.svg"

package/README.md

@@ -16,8 +16,9 @@ Using OpenCode rather than the Codex CLI? The sibling project [`oc-codex-multi-a
 ## What it does
 
 - **Account pool** — OAuth login for multiple ChatGPT accounts, stored locally under `~/.codex/multi-auth` (files `0600`, directories `0700`), with per-project pools under `projects/<project-key>/`.
-- **Switching and selection** — pin an account, pick the forecast-best one, or let health- and quota-aware hybrid selection rotate for you.
-- **Runtime rotation** — a default-on, loopback-only proxy that forwards Responses API and model-discovery traffic through the best available account during wrapper-launched Codex sessions.
+- **Switching and selection** — pin an account, pick the forecast-best one, follow saved account order within customized priority tiers with sequential scheduling, or let health- and quota-aware hybrid selection rotate for you.
+- **Runtime rotation** — a default-on, loopback-only proxy that forwards Responses API, model-discovery, image, thread-goal, and Codex dictation/transcription traffic through managed accounts during wrapper-launched Codex sessions.
+- **API capability evidence** — opted-in API/ZDR routes receive daily billable checks while the router runs; status distinguishes configured access programs from verified responses. See [check behavior and controls](docs/reference/commands.md#codex-multi-auth-check).
 - **Diagnostics and repair** — status, live health checks, quota forecasts, JSON reports, and `fix`/`doctor`/`verify` commands that recover stale or damaged local state.
 - **Luna Reserve fallback** — treats `gpt-reserve` as a separately metered Luna allowance, automatically falls back after a genuine Luna quota 429, and exposes the Reserve percentage through `limits --json --refresh`.
 - **Local governance** — file-backed usage ledger, budget guards, account tags/weights/pause/drain policies, routing profiles, and an optional loopback bridge with bearer tokens for local OpenAI-compatible clients.
@@ -27,7 +28,8 @@ Using OpenCode rather than the Codex CLI? The sibling project [`oc-codex-multi-a
 
 | Binary | Role |
 | --- | --- |
-| `codex-multi-auth` | The account manager. Runs all 31 management subcommands locally (`login`, `status`, `switch`, `forecast`, `rotation`, `fix`, ...). The `auth` prefix is optional: `codex-multi-auth login` ≡ `codex-multi-auth auth login`. |
+| `codex-multi-auth` | The account manager. Runs all management subcommands locally (`login`, `status`, `web`, `switch`, `forecast`, `rotation`, `fix`, ...). The `auth` prefix is optional: `codex-multi-auth login` ≡ `codex-multi-auth auth login`. |
+| `codex-ma` | Short alias for `codex-multi-auth`, including the local real-time web dashboard. |
 | `codex-multi-auth-codex` | Opt-in wrapper. Handles `auth ...` locally and forwards every other command to the official Codex CLI, enabling the rotation proxy for request-bearing commands. |
 | `mcodex` | Convenience launcher over the wrapper, with optional `--monitor` and `--tmux` modes. No account logic of its own. |
 | `codex-multi-auth-app-launcher` | User-level OS launcher routing helper (Windows shortcut, macOS wrapper app, Linux `.desktop`). |
@@ -51,6 +53,7 @@ codex-multi-auth login
 
 # 2. Repeat login to add more accounts, then inspect the pool
 codex-multi-auth status
+codex-ma web --no-open
 
 # 3. Probe account health and preview which account would serve next
 codex-multi-auth check
@@ -94,7 +97,7 @@ codex-multi-auth rotation status              # is live rotation enabled?
 
 ## Runtime rotation, in one paragraph
 
-With rotation on (the default), request-bearing wrapper commands — `exec`, `review`, `resume`, `fork`, `app`, and the bare TUI — route through a local proxy that picks the healthiest account per request, refreshes tokens as needed, and fails over across the pool on rate limits within a bounded retry budget. The proxy listens on loopback only, authenticates its own clients with a per-process token, forwards only Responses API, model-discovery, image, and thread-goal calls, and never writes account emails or tokens to client headers or logs. Plain `codex` is never touched: rotation exists only inside `codex-multi-auth-codex`/`mcodex` sessions, or inside the packaged desktop app after an opt-in, reversible bind. Turn it off with `codex-multi-auth rotation disable` or `CODEX_MULTI_AUTH_RUNTIME_ROTATION_PROXY=0`.
+With rotation on (the default), request-bearing wrapper commands — `exec`, `review`, `resume`, `fork`, `app`, and the bare TUI — route through a local proxy that picks the healthiest account per request, refreshes tokens as needed, and fails over across the pool on rate limits within a bounded retry budget. The proxy listens on loopback only, authenticates its own clients with a per-process token, forwards only Responses API, model-discovery, image, thread-goal, and `POST /transcribe` calls, and never writes account emails or tokens to client headers or logs. Transcription preserves the incoming multipart audio body and boundary, uses managed ChatGPT OAuth, and does not replay ambiguous audio uploads across accounts. Plain `codex` is never touched: rotation exists only inside `codex-multi-auth-codex`/`mcodex` sessions, or inside the packaged desktop app after an opt-in, reversible bind. Turn it off with `codex-multi-auth rotation disable` or `CODEX_MULTI_AUTH_RUNTIME_ROTATION_PROXY=0`.
 
 ## Where state lives
 
@@ -138,7 +141,7 @@ Common symptoms — wrong active account, OAuth callback port `1455` already bou
 
 ## Release notes
 
-- Current stable: [v2.21.0](docs/releases/v2.21.0.md) — `npm i -g codex-multi-auth`
+- Current stable: [v2.23.0](docs/releases/v2.23.0.md) — `npm i -g codex-multi-auth`
 - Earlier stable lines: [v2.6.0](docs/releases/v2.6.0.md), [v2.5.0](docs/releases/v2.5.0.md)
 - Full release archive: [docs/README.md#release-history](docs/README.md#release-history)
 

package/config/schema/config.schema.json

@@ -31,6 +31,14 @@
     "pluginConfig": {
       "type": "object",
       "properties": {
+        "locale": {
+          "type": "string",
+          "enum": [
+            "auto",
+            "en",
+            "zh"
+          ]
+        },
         "codexMode": {
           "type": "boolean"
         },

package/dist/lib/accounts.d.ts

@@ -70,6 +70,7 @@ export declare class AccountManager {
     private readonly persistedWorkspaceSelections;
     private readonly persistedWorkspaces;
     private hadPersistedStorage;
+    private readonly loadedAccountStorageSnapshot;
     private cursorByFamily;
     private currentAccountIndexByFamily;
     private lastToastAccountIndex;
@@ -103,6 +104,10 @@ export declare class AccountManager {
      */
     private routingMutexMode;
     static loadFromDisk(authFallback?: OAuthAuthDetails): Promise<AccountManager>;
+    /** @internal True when construction received a parsed/recovered storage snapshot. */
+    hasLoadedAccountStorageSnapshot(): boolean;
+    /** @internal True only when this account identity was explicitly persisted, not legacy-derived in memory. */
+    hasPersistedRecordId(account: ManagedAccount): boolean;
     hasRefreshToken(refreshToken: string): boolean;
     private hydrateFromCodexCli;
     constructor(authFallback?: OAuthAuthDetails, stored?: AccountStorageV3 | null);

package/dist/lib/accounts.js

@@ -142,6 +142,7 @@ export class AccountManager {
     persistedWorkspaceSelections = new WeakMap();
     persistedWorkspaces = new WeakMap();
     hadPersistedStorage = false;
+    loadedAccountStorageSnapshot;
     cursorByFamily = initFamilyState(0);
     currentAccountIndexByFamily = initFamilyState(-1);
     lastToastAccountIndex = -1;
@@ -202,6 +203,18 @@ export class AccountManager {
         await manager.hydrateFromCodexCli();
         return manager;
     }
+    /** @internal True when construction received a parsed/recovered storage snapshot. */
+    hasLoadedAccountStorageSnapshot() {
+        return this.loadedAccountStorageSnapshot;
+    }
+    /** @internal True only when this account identity was explicitly persisted, not legacy-derived in memory. */
+    hasPersistedRecordId(account) {
+        const recordId = account.recordId?.trim();
+        if (!recordId || !this.persistenceBaseline)
+            return false;
+        const baseline = this.persistenceBaseline.accounts.find((row) => resolveAccountRecordId(row) === recordId);
+        return typeof baseline?.recordId === "string" && baseline.recordId.trim().length > 0;
+    }
     hasRefreshToken(refreshToken) {
         return this.accounts.some((account) => account.refreshToken === refreshToken);
     }
@@ -266,6 +279,7 @@ export class AccountManager {
     }
     constructor(authFallback, stored) {
         this.storagePathState = { ...getStoragePathState() };
+        this.loadedAccountStorageSnapshot = stored !== undefined && stored !== null;
         this.hadPersistedStorage = existsSync(this.resolveSelectionStoragePath());
         const fallbackAccountId = extractAccountId(authFallback?.access)?.trim() || undefined;
         const fallbackAccountEmail = sanitizeEmail(extractAccountEmail(authFallback?.access));
@@ -522,6 +536,7 @@ export class AccountManager {
                 _runtimeTrackerKey: trackerKey,
                 circuitKeyId,
                 rateLimitResetTimes: { ...account.rateLimitResetTimes },
+                workspaces: account.workspaces?.map((workspace) => ({ ...workspace })),
             };
         });
     }
@@ -1377,6 +1392,14 @@ export class AccountManager {
                 if (!storedAccount) {
                     return null;
                 }
+                const liveAccount = this.getAccountByIdentity(source, auth);
+                // Credential rotation proves auth health only. It must not erase an
+                // unrelated inference network/server/rate-limit backoff that happens
+                // to be live on the same account.
+                const preserveNonAuthCooldown = liveAccount?.cooldownReason !== undefined &&
+                    liveAccount.cooldownReason !== "auth-failure" &&
+                    typeof liveAccount.coolingDownUntil === "number" &&
+                    liveAccount.coolingDownUntil > nowMs();
                 storedAccount.refreshToken = auth.refresh;
                 storedAccount.accessToken = auth.access;
                 storedAccount.expiresAt = auth.expires;
@@ -1391,9 +1414,14 @@ export class AccountManager {
                 storedAccount.enabled = undefined;
                 delete storedAccount.authInvalidatedAt;
                 delete storedAccount.authInvalidationErrorCode;
-                delete storedAccount.coolingDownUntil;
-                delete storedAccount.cooldownReason;
-                const liveAccount = this.getAccountByIdentity(source, auth);
+                if (preserveNonAuthCooldown && liveAccount) {
+                    storedAccount.coolingDownUntil = liveAccount.coolingDownUntil;
+                    storedAccount.cooldownReason = liveAccount.cooldownReason;
+                }
+                else {
+                    delete storedAccount.coolingDownUntil;
+                    delete storedAccount.cooldownReason;
+                }
                 if (liveAccount) {
                     const previousLiveAccountState = {
                         access: liveAccount.access,
@@ -1411,7 +1439,8 @@ export class AccountManager {
                     };
                     this.updateFromAuth(liveAccount, auth);
                     liveAccount.enabled = true;
-                    this.clearAccountCooldown(liveAccount);
+                    if (!preserveNonAuthCooldown)
+                        this.clearAccountCooldown(liveAccount);
                     this.clearAuthFailures(liveAccount);
                     try {
                         await this.persistSnapshot(_current, nextStorage, persist, storedAccount);

package/dist/lib/api-route-store.d.ts

@@ -1,5 +1,7 @@
 import { z } from "zod";
 declare const routeSchema: z.ZodObject<{
+    capabilityEpoch: z.ZodOptional<z.ZodString>;
+    legacyCapabilityCache: z.ZodOptional<z.ZodBoolean>;
     id: z.ZodString;
     label: z.ZodString;
     kind: z.ZodEnum<{
@@ -15,9 +17,14 @@ declare const routeSchema: z.ZodObject<{
     accessPrograms: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>;
     modelAccessPrograms: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>>;
 }, z.core.$strip>;
+export declare const MAX_API_ROUTES = 100;
 export type ApiRouteCredential = z.infer<typeof routeSchema>;
 export declare function getApiRoutesPath(): string;
 export declare function loadApiRoutes(path?: string): Promise<ApiRouteCredential[]>;
 export declare function saveApiRoutes(routes: ApiRouteCredential[], path?: string, expected?: ApiRouteCredential[]): Promise<void>;
+/** Return our committed snapshot, never a later writer's configuration. */
+export declare function saveApiRoutesSnapshot(routes: ApiRouteCredential[], path?: string, expected?: ApiRouteCredential[]): Promise<ApiRouteCredential[]>;
 export declare function updateApiModelDiscovery(route: ApiRouteCredential, models: string[], path?: string): Promise<ApiRouteCredential>;
+/** Migrate legacy ownership before taking any capability lease or cache lock. */
+export declare function ensureApiRouteCapabilityEpoch(route: ApiRouteCredential, signal?: AbortSignal): Promise<ApiRouteCredential | undefined>;
 export {};

package/dist/lib/api-route-store.js

@@ -1,3 +1,4 @@
+import { randomUUID } from "node:crypto";
 import { promises as fs } from "node:fs";
 import { dirname, join } from "node:path";
 import { z } from "zod";
@@ -15,6 +16,9 @@ const programId = z.string().min(1).max(80).regex(/^[A-Za-z0-9][A-Za-z0-9._-]*$/
 const accessPrograms = z.record(programId, z.array(programId).max(32))
     .refine(value => Object.keys(value).length <= 16);
 const routeSchema = z.object({
+    /** Internal lifetime token. Store-owned; never trust an incoming token. */
+    capabilityEpoch: z.string().uuid().optional(),
+    legacyCapabilityCache: z.boolean().optional(),
     id: z
         .string()
         .min(1)
@@ -37,9 +41,10 @@ const routeSchema = z.object({
     modelAccessPrograms: z.record(modelId, accessPrograms)
         .refine(value => Object.keys(value).length <= 1000).optional(),
 });
+export const MAX_API_ROUTES = 100;
 const schema = z.object({
     version: z.literal(1),
-    routes: z.array(routeSchema).max(100),
+    routes: z.array(routeSchema).max(MAX_API_ROUTES),
 });
 export function getApiRoutesPath() {
     return join(getCodexMultiAuthDir(), "api-routes.json");
@@ -52,6 +57,9 @@ function validate(value) {
         throw new Error("Invalid API route configuration");
     return parsed.data.routes;
 }
+class InvalidApiRouteContentsError extends Error {
+    constructor() { super("Invalid API route configuration"); }
+}
 export async function loadApiRoutes(path = getApiRoutesPath()) {
     let raw;
     try {
@@ -78,39 +86,80 @@ export async function loadApiRoutes(path = getApiRoutesPath()) {
         return validate(JSON.parse(raw));
     }
     catch {
-        throw new Error("Invalid API route configuration");
+        throw new InvalidApiRouteContentsError();
     }
 }
-export async function saveApiRoutes(routes, path = getApiRoutesPath(), expected) {
+export function saveApiRoutes(routes, path = getApiRoutesPath(), expected) {
+    return saveApiRoutesInternal(routes, path, expected);
+}
+/** Return our committed snapshot, never a later writer's configuration. */
+export async function saveApiRoutesSnapshot(routes, path = getApiRoutesPath(), expected) {
+    let saved = [];
+    await saveApiRoutesInternal(routes, path, expected, false, undefined, value => { saved = value; });
+    return saved;
+}
+async function saveApiRoutesInternal(routes, path = getApiRoutesPath(), expected, discoveryExpansion = false, signal, onSaved) {
+    await withStorageLock(() => withFileTransactionLock(path, () => saveApiRoutesLocked(routes, path, expected, discoveryExpansion, signal, onSaved), { signal }));
+}
+async function saveApiRoutesLocked(routes, path = getApiRoutesPath(), expected, discoveryExpansion = false, signal, onSaved) {
     const validated = validate({ version: 1, routes });
-    const serialized = JSON.stringify({ version: 1, routes: validated }) + "\n";
+    let serialized = JSON.stringify({ version: 1, routes: validated }) + "\n";
     if (Buffer.byteLength(serialized) > 1024 * 1024)
         throw new Error("API route configuration is too large");
-    await withStorageLock(() => withFileTransactionLock(path, async () => {
-        await fs.mkdir(dirname(path), { recursive: true, mode: 0o700 });
-        const temp = tempPathFor(path);
-        try {
-            if (expected &&
-                JSON.stringify(await loadApiRoutes(path)) !==
-                    JSON.stringify(validate({ version: 1, routes: expected }))) {
-                throw new Error("API route configuration changed; reopen the menu before saving.");
-            }
-            await fs.writeFile(temp, serialized, { mode: 0o600, flag: "wx" });
-            await withRetry(() => fs.rename(temp, path), {
-                maxAttempts: 6,
-                backoffMs: 25,
-            });
-        }
-        finally {
-            await withRetry(() => fs.unlink(temp), {
-                maxAttempts: 6,
-                backoffMs: 25,
-            }).catch((error) => {
-                if (error.code !== "ENOENT")
-                    throw error;
-            });
+    signal?.throwIfAborted();
+    let current;
+    try {
+        current = await loadApiRoutes(path);
+    }
+    catch (error) {
+        // Only explicit replacement may repair parsed-content corruption. CAS,
+        // oversized reads and I/O failures must not be treated as an empty store.
+        if (expected !== undefined || !(error instanceof InvalidApiRouteContentsError))
+            throw error;
+        current = [];
+    }
+    await fs.mkdir(dirname(path), { recursive: true, mode: 0o700 });
+    const temp = tempPathFor(path);
+    try {
+        if (expected &&
+            JSON.stringify(current) !==
+                JSON.stringify(validate({ version: 1, routes: expected }))) {
+            throw new Error("API route configuration changed; reopen the menu before saving.");
         }
-    }));
+        const owned = validated.map(route => {
+            const old = current.find(value => value.id === route.id);
+            const policy = (value) => JSON.stringify([
+                value.kind, value.apiKey, value.enabled, value.probeCapabilities,
+                value.accessPrograms, value.modelAccessPrograms,
+                // Visibility is a selection set; menu ordering is not a policy edit.
+                ...(discoveryExpansion ? [] : [[...new Set(value.visibleModels)].sort()]),
+            ]);
+            const sameLifetime = old && policy(old) === policy(route);
+            const withoutLegacy = { ...route };
+            delete withoutLegacy.legacyCapabilityCache;
+            return { ...withoutLegacy, capabilityEpoch: sameLifetime ? old.capabilityEpoch ?? randomUUID() : randomUUID(),
+                ...(sameLifetime && (!old.capabilityEpoch || old.legacyCapabilityCache === true) ? { legacyCapabilityCache: true } : {}) };
+        });
+        serialized = JSON.stringify({ version: 1, routes: owned }) + "\n";
+        if (Buffer.byteLength(serialized) > 1024 * 1024)
+            throw Error("API route configuration is too large");
+        await fs.writeFile(temp, serialized, { mode: 0o600, flag: "wx" });
+        signal?.throwIfAborted();
+        await withRetry(() => fs.rename(temp, path), {
+            maxAttempts: 6,
+            backoffMs: 25,
+        });
+        onSaved?.(owned);
+    }
+    finally {
+        await withRetry(() => fs.unlink(temp), {
+            maxAttempts: 6,
+            backoffMs: 25,
+        }).catch((error) => {
+            if (error.code !== "ENOENT")
+                throw error;
+        });
+    }
 }
 /** Persist a discovery baseline and new GPT text IDs without undoing menu edits.
  * Callers supply IDs already filtered for the Responses endpoint family. */
@@ -122,7 +171,8 @@ export function updateApiModelDiscovery(route, models, path = getApiRoutesPath()
 }
 async function updateApiModelDiscoverySerial(route, models, path = getApiRoutesPath()) {
     const routes = await loadApiRoutes(path);
-    const current = routes.find((r) => r.id === route.id && r.apiKey === route.apiKey && r.kind === route.kind);
+    const current = routes.find((r) => r.id === route.id && r.apiKey === route.apiKey && r.kind === route.kind &&
+        (!route.capabilityEpoch || route.capabilityEpoch === r.capabilityEpoch));
     if (!current)
         return { ...route, enabled: false, visibleModels: [] };
     if (!current.enabled)
@@ -139,7 +189,26 @@ async function updateApiModelDiscoverySerial(route, models, path = getApiRoutesP
         knownModels: [...known],
         visibleModels: [...visible],
     };
+    let persisted = updated;
     if (JSON.stringify(updated) !== JSON.stringify(current))
-        await saveApiRoutes(routes.map((r) => (r.id === current.id ? updated : r)), path, routes);
-    return updated;
+        await saveApiRoutesInternal(routes.map((r) => (r.id === current.id ? updated : r)), path, routes, true, undefined, values => { const saved = values.find(value => value.id === updated.id); if (saved)
+            persisted = saved; });
+    return persisted;
+}
+/** Migrate legacy ownership before taking any capability lease or cache lock. */
+export async function ensureApiRouteCapabilityEpoch(route, signal) {
+    return withStorageLock(() => withFileTransactionLock(getApiRoutesPath(), async () => {
+        signal?.throwIfAborted();
+        const current = await loadApiRoutes();
+        const match = current.find(value => value.id === route.id && value.kind === route.kind && value.apiKey === route.apiKey);
+        if (!match || (route.capabilityEpoch && route.capabilityEpoch !== match.capabilityEpoch))
+            return undefined;
+        if (match.capabilityEpoch)
+            return match;
+        let migrated;
+        await saveApiRoutesLocked(current, getApiRoutesPath(), current, false, signal, values => {
+            migrated = values.find(value => value.id === route.id);
+        });
+        return migrated;
+    }, { signal }));
 }

package/dist/lib/auth/account-access.js

@@ -1,5 +1,6 @@
 import { CODEX_BASE_URL } from "../constants.js";
 import { combineSignals } from "../utils.js";
+import { fetchAuth } from "./http.js";
 const ACCOUNTS_CHECK_PATH = "/wham/accounts/check";
 const ACCOUNTS_CHECK_TIMEOUT_MS = 10_000;
 function readString(value) {
@@ -49,7 +50,7 @@ export async function fetchAuthorizedAccounts(accessToken, options = {}) {
     const token = readString(accessToken);
     if (!token)
         return null;
-    const doFetch = options.fetch ?? globalThis.fetch;
+    const doFetch = options.fetch ?? fetchAuth;
     const timeout = AbortSignal.timeout(ACCOUNTS_CHECK_TIMEOUT_MS);
     // combineSignals wraps AbortSignal.any (available on every Node the
     // engines floor, `>=22.19`, permits) with null-tolerance; the native composite also detaches

package/dist/lib/auth/auth.js

@@ -2,6 +2,7 @@ import { randomBytes, webcrypto } from "node:crypto";
 import { logError } from "../logger.js";
 import { safeParseOAuthTokenResponse } from "../schemas.js";
 import { isAbortError } from "../utils.js";
+import { fetchAuth } from "./http.js";
 // OAuth constants (from openai/codex)
 export const CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
 export const AUTHORIZE_URL = "https://auth.openai.com/oauth/authorize";
@@ -396,7 +397,7 @@ export function parseAuthorizationInput(input) {
  * @returns Token result
  */
 export async function exchangeAuthorizationCode(code, verifier, redirectUri = REDIRECT_URI) {
-    const res = await fetch(TOKEN_URL, {
+    const res = await fetchAuth(TOKEN_URL, {
         method: "POST",
         headers: { "Content-Type": "application/x-www-form-urlencoded" },
         body: new URLSearchParams({
@@ -468,7 +469,7 @@ export function decodeJWT(token) {
 }
 export async function refreshAccessToken(refreshToken, options = {}) {
     try {
-        const response = await fetch(TOKEN_URL, {
+        const response = await fetchAuth(TOKEN_URL, {
             method: "POST",
             headers: { "Content-Type": "application/x-www-form-urlencoded" },
             signal: options?.signal,

package/dist/lib/auth/device-auth.js

@@ -1,4 +1,5 @@
 import { CLIENT_ID, exchangeAuthorizationCode, sanitizeOAuthResponseBodyForLog, } from "./auth.js";
+import { fetchAuth } from "./http.js";
 const DEVICE_AUTH_BASE_URL = "https://auth.openai.com";
 const DEVICE_AUTH_API_BASE_URL = `${DEVICE_AUTH_BASE_URL}/api/accounts`;
 export const DEVICE_AUTH_VERIFICATION_URL = `${DEVICE_AUTH_BASE_URL}/codex/device`;
@@ -14,7 +15,7 @@ const DEVICE_AUTH_TRANSIENT_PENDING_STATUSES = new Set([
     504,
 ]);
 function getFetch(options) {
-    return options.fetchImpl ?? fetch;
+    return options.fetchImpl ?? fetchAuth;
 }
 function getNow(options) {
     return options.now ?? Date.now;

package/dist/lib/auth/http.d.ts

@@ -0,0 +1 @@
+export { fetchWithProxy as fetchAuth } from "../request/proxy-fetch.js";

package/dist/lib/auth/http.js

@@ -0,0 +1 @@
+export { fetchWithProxy as fetchAuth } from "../request/proxy-fetch.js";

package/dist/lib/codex-manager/account-manager-commands.js

@@ -14,6 +14,7 @@ export const ACCOUNT_MANAGER_COMMANDS = new Set([
     "login",
     "list",
     "status",
+    "web",
     "limits",
     "switch",
     "unpin",

package/dist/lib/codex-manager/api-login-menu.d.ts

@@ -2,7 +2,7 @@ import { type ApiRouteCredential } from "../api-route-store.js";
 import { type MenuItem } from "../ui/select.js";
 interface MenuDeps {
     load: () => Promise<ApiRouteCredential[]>;
-    save: (routes: ApiRouteCredential[], expected: ApiRouteCredential[]) => Promise<void>;
+    save: (routes: ApiRouteCredential[], expected: ApiRouteCredential[]) => Promise<ApiRouteCredential[]>;
     select: (items: MenuItem<string>[], message: string) => Promise<string | null>;
     text: (message: string) => Promise<string>;
     secret: () => Promise<string>;

package/dist/lib/codex-manager/api-login-menu.js

@@ -1,7 +1,7 @@
 import { randomUUID } from "node:crypto";
 import { createInterface } from "node:readline/promises";
 import { Writable } from "node:stream";
-import { loadApiRoutes, saveApiRoutes, } from "../api-route-store.js";
+import { loadApiRoutes, saveApiRoutesSnapshot, } from "../api-route-store.js";
 import { ApiModelRuntime } from "../runtime/api-model-runtime.js";
 import { select } from "../ui/select.js";
 async function ask(message, secret = false) {
@@ -35,7 +35,7 @@ async function ask(message, secret = false) {
 }
 const defaults = {
     load: loadApiRoutes,
-    save: (routes, expected) => saveApiRoutes(routes, undefined, expected),
+    save: (routes, expected) => saveApiRoutesSnapshot(routes, undefined, expected),
     select: (items, message) => select(items, { message, allowEscape: true }),
     text: (message) => ask(message),
     secret: () => ask("API key (hidden): ", true),
@@ -189,8 +189,7 @@ export async function runApiLoginMenu(overrides = {}) {
                 }
                 if (action !== "models") {
                     const next = routes.map((r) => (r.id === route?.id ? route : r));
-                    await d.save(next, routes);
-                    routes = next;
+                    routes = await d.save(next, routes);
                     continue;
                 }
             }
@@ -203,8 +202,7 @@ export async function runApiLoginMenu(overrides = {}) {
             const next = routes.some((r) => r.id === edited.id)
                 ? routes.map((r) => (r.id === edited.id ? edited : r))
                 : [...routes, edited];
-            await d.save(next, routes);
-            routes = next;
+            routes = await d.save(next, routes);
             d.log("Saved. Choose an API or ZDR model explicitly in Codex. Desktop login is unchanged.");
         }
         catch (error) {

package/dist/lib/codex-manager/commands/locale.d.ts

@@ -0,0 +1,12 @@
+import { type OutputLocaleSetting } from "../../locale.js";
+export interface LocaleCommandDeps {
+    loadConfig: () => {
+        locale?: OutputLocaleSetting;
+    };
+    saveConfig: (patch: {
+        locale: OutputLocaleSetting;
+    }) => Promise<void>;
+    logInfo?: (message: string) => void;
+    logError?: (message: string) => void;
+}
+export declare function runLocaleCommand(args: string[], deps: LocaleCommandDeps): Promise<number>;

package/dist/lib/codex-manager/commands/locale.js

@@ -0,0 +1,25 @@
+import { localeName, normalizeOutputLocaleSetting, resolveOutputLocale, } from "../../locale.js";
+export async function runLocaleCommand(args, deps) {
+    const logInfo = deps.logInfo ?? console.log;
+    const logError = deps.logError ?? console.error;
+    const requested = args[0]?.trim();
+    if (args.length > 1 || requested === "--help" || requested === "-h") {
+        logInfo("Usage: codex-multi-auth config locale [auto|en|zh]");
+        return requested === "--help" || requested === "-h" ? 0 : 1;
+    }
+    if (!requested) {
+        const configured = deps.loadConfig().locale ?? "auto";
+        const effective = resolveOutputLocale(configured);
+        logInfo(`Locale: ${configured} (effective: ${localeName(effective)})`);
+        return 0;
+    }
+    const locale = normalizeOutputLocaleSetting(requested);
+    if (!locale) {
+        logError(`Unsupported locale: ${requested}. Choose auto, en, or zh.`);
+        return 1;
+    }
+    await deps.saveConfig({ locale });
+    const effective = resolveOutputLocale(locale);
+    logInfo(`Locale saved: ${locale} (effective: ${localeName(effective)})`);
+    return 0;
+}

package/dist/lib/codex-manager/commands/status.d.ts

@@ -4,9 +4,10 @@ import { loadAccountPolicyStore } from "../../account-policy.js";
 import { type ModelInventory } from "../../runtime/model-discovery-status.js";
 import type { ModelFamily } from "../../prompts/codex.js";
 import type { QuotaCacheData } from "../../quota-cache.js";
-import type { AppBindRouterStatus } from "../../runtime/app-bind.js";
+import { type AppBindRouterStatus } from "../../runtime/app-bind.js";
 import { type RuntimeAccountSignal } from "../../runtime/runtime-current-account.js";
 import type { RuntimeObservabilitySnapshot } from "../../runtime/runtime-observability.js";
+import { type OutputLocale } from "../../locale.js";
 import type { AccountStorageV3, StorageHealthSummary } from "../../storage.js";
 type LoadedStorage = AccountStorageV3 | null;
 export interface StatusCommandDeps {
@@ -31,6 +32,9 @@ export interface StatusCommandDeps {
     logInfo?: (message: string) => void;
     /** When true, emit a single machine-readable JSON object instead of text (cli-manager-03). */
     json?: boolean;
+    /** Compact human-facing summary. Undefined keeps the legacy detailed view for API callers. */
+    compact?: boolean;
+    locale?: OutputLocale;
 }
 export declare function runStatusCommand(deps: StatusCommandDeps): Promise<number>;
 export interface FeaturesCommandDeps {