codex-multi-auth 2.22.0 → 2.24.0

package/config/minimal-codex.json

@@ -1,15 +1,15 @@
-{
-  "$schema": "./schema/config.schema.json",
-  "plugin": ["codex-multi-auth"],
-
-  "provider": {
-    "openai": {
-      "options": {
-        "store": false
-      }
-    }
-  },
-  "model": "openai/gpt-5.6-sol"
-}
-
-
+{
+  "$schema": "./schema/config.schema.json",
+  "plugin": ["codex-multi-auth"],
+
+  "provider": {
+    "openai": {
+      "options": {
+        "store": false
+      }
+    }
+  },
+  "model": "openai/gpt-5.6-sol"
+}
+
+

package/config/schema/config.schema.json

@@ -31,6 +31,14 @@
     "pluginConfig": {
       "type": "object",
       "properties": {
+        "locale": {
+          "type": "string",
+          "enum": [
+            "auto",
+            "en",
+            "zh"
+          ]
+        },
         "codexMode": {
           "type": "boolean"
         },

package/dist/index.js

@@ -672,12 +672,8 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                         capabilityPolicy: capabilityPolicyStore,
                                     });
                                 }
-                                catch (policyError) {
-                                    logWarn("Runtime policy evaluation failed open.", {
-                                        error: policyError instanceof Error
-                                            ? policyError.message
-                                            : String(policyError),
-                                    });
+                                catch {
+                                    logWarn("Runtime policy evaluation failed; request blocked.");
                                 }
                                 usageRecorder = createRuntimeUsageRecorder({
                                     source: "plugin-host",
@@ -692,6 +688,25 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                     statusCode: null,
                                     errorCode: "plugin_host_request_failed",
                                 };
+                                if (!runtimePolicyDecision) {
+                                    runtimeMetrics.failedRequests += 1;
+                                    runtimeMetrics.lastError = "Runtime policy unavailable";
+                                    syncRuntimeObservability(requestTraceId);
+                                    usageCompletion = {
+                                        outcome: "blocked",
+                                        statusCode: 503,
+                                        errorCode: "runtime_policy_unavailable",
+                                    };
+                                    return new Response(JSON.stringify({
+                                        error: {
+                                            message: "Runtime policy could not be loaded for this local request.",
+                                            code: "runtime_policy_unavailable",
+                                        },
+                                    }), {
+                                        status: 503,
+                                        headers: { "content-type": "application/json; charset=utf-8" },
+                                    });
+                                }
                                 if (runtimePolicyDecision && !runtimePolicyDecision.allowed) {
                                     runtimeMetrics.failedRequests += 1;
                                     runtimeMetrics.lastError = "Runtime policy blocked request";
@@ -715,6 +730,12 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                         },
                                     });
                                 }
+                                // This host cannot prove ordinary capacity and permitted reset
+                                // recovery are exhausted, so emergency accounts stay reserved.
+                                const blockedAccountIndexes = new Set([
+                                    ...(runtimePolicyDecision?.blockedAccountIndexes ?? []),
+                                    ...(runtimePolicyDecision?.emergencyAccountIndexes ?? []),
+                                ]);
                                 const abortSignal = requestInit?.signal ?? init?.signal ?? null;
                                 const sleep = createAbortableSleep(abortSignal);
                                 const poolCooldownRemainingMs = getPoolExhaustionCooldownRemaining();
@@ -843,7 +864,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                             typeof preferredSessionAccountIndex === "number") {
                                             usedPreferredSessionAccount = true;
                                             if (accountManager.isAccountAvailableForFamily(preferredSessionAccountIndex, modelFamily, model) &&
-                                                !runtimePolicyDecision?.blockedAccountIndexes.has(preferredSessionAccountIndex)) {
+                                                !blockedAccountIndexes.has(preferredSessionAccountIndex)) {
                                                 account = accountManager.getAccountByIndex(preferredSessionAccountIndex);
                                                 if (account) {
                                                     account.lastUsed = Date.now();
@@ -858,13 +879,14 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                             account = accountManager.getCurrentOrNextForFamilyHybrid(modelFamily, model, {
                                                 pidOffsetEnabled,
                                                 scoreBoostByAccount: capabilityBoostByAccount,
+                                                blockedAccountIndexes,
                                             });
                                         }
                                         if (!account || attempted.has(account.index)) {
                                             break;
                                         }
                                         attempted.add(account.index);
-                                        if (runtimePolicyDecision?.blockedAccountIndexes.has(account.index)) {
+                                        if (blockedAccountIndexes.has(account.index)) {
                                             continue;
                                         }
                                         // Log account selection for debugging rotation
@@ -1451,7 +1473,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                             runtimeMetrics.cumulativeLatencyMs += fetchLatencyMs;
                                             let responseForSuccess = response;
                                             if (isStreaming) {
-                                                const streamFallbackCandidateOrder = buildAdaptiveStreamFailoverCandidateOrder(account.index, accountSnapshotList);
+                                                const streamFallbackCandidateOrder = buildAdaptiveStreamFailoverCandidateOrder(account.index, accountSnapshotList.filter((candidate) => !blockedAccountIndexes.has(candidate.index)));
                                                 runtimeMetrics.lastStreamFailoverCandidateCount =
                                                     streamFallbackCandidateOrder.length;
                                                 runtimeMetrics.streamFailoverCandidatesConsidered +=
@@ -1472,7 +1494,8 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                                         if (abortSignal?.aborted) {
                                                             return null;
                                                         }
-                                                        if (!accountManager.isAccountAvailableForFamily(candidateIndex, modelFamily, model)) {
+                                                        if (blockedAccountIndexes.has(candidateIndex) ||
+                                                            !accountManager.isAccountAvailableForFamily(candidateIndex, modelFamily, model)) {
                                                             continue;
                                                         }
                                                         const fallbackAccount = accountManager.getAccountByIndex(candidateIndex);

package/dist/lib/account-policy.d.ts

@@ -7,6 +7,8 @@ export interface AccountPolicy {
     priority?: number;
     /** Opt in to periodic first-use completion for unused personal subscriptions. */
     autoPrime?: boolean;
+    /** Pool backup only, after primary subscriptions and reset credits are exhausted. */
+    emergencyOnly?: boolean;
     paused: boolean;
     drained: boolean;
     note: string | null;

package/dist/lib/account-policy.js

@@ -37,6 +37,7 @@ function normalizePolicy(key, value) {
         weight: normalizeWeight(record.weight),
         priority: normalizePriority(record.priority),
         autoPrime: record.autoPrime === true,
+        emergencyOnly: record.emergencyOnly === true,
         paused: record.paused === true,
         drained: record.drained === true,
         note: note.length > 0 ? note.slice(0, 500) : null,
@@ -112,7 +113,7 @@ export async function loadAccountPolicyStore(options = {}) {
                 if (!key.startsWith("sha256:"))
                     continue;
                 // Legacy rows may omit flags; explicit malformed values are not OFF.
-                if (!isRecord(row) || ["autoPrime", "paused", "drained"].some(flag => flag in row && typeof row[flag] !== "boolean")) {
+                if (!isRecord(row) || ["autoPrime", "emergencyOnly", "paused", "drained"].some(flag => flag in row && typeof row[flag] !== "boolean")) {
                     throw new Error("Invalid account policy row");
                 }
             }
@@ -241,6 +242,7 @@ export function upsertAccountPolicy(store, accountKey, mutate, now = Date.now())
     next.weight = normalizeWeight(next.weight);
     next.priority = normalizePriority(next.priority);
     next.autoPrime = next.autoPrime === true;
+    next.emergencyOnly = next.emergencyOnly === true;
     next.updatedAt = stampUpdatedAt(now, store.accounts[accountKey]?.updatedAt);
     store.accounts[accountKey] = next;
     return next;

package/dist/lib/accounts/rate-limits.d.ts

@@ -15,6 +15,12 @@ export interface RateLimitState {
 export interface RateLimitedEntity {
     rateLimitResetTimes: RateLimitState;
 }
+/**
+ * Bound legacy persisted routing deadlines once, when loading the account.
+ * These deadlines schedule revalidation; quota snapshots retain upstream resets.
+ * Never call this on every selection: that would slide the deadline indefinitely.
+ */
+export declare function boundRateLimitCache(times: RateLimitState, now?: number): RateLimitState;
 export declare function clearExpiredRateLimits(entity: RateLimitedEntity): void;
 /**
  * Remove every rate-limit reset entry from `entity`, regardless of whether the

package/dist/lib/accounts/rate-limits.js

@@ -2,7 +2,7 @@
  * Rate limiting utilities for account management.
  * Extracted from accounts.ts to reduce module size and improve cohesion.
  */
-import { LUNA_RESERVE_MODEL } from "../constants.js";
+import { LUNA_RESERVE_MODEL, RATE_LIMIT_CACHE_TTL_MS } from "../constants.js";
 import { nowMs } from "../utils.js";
 export function parseRateLimitReason(code) {
     if (!code)
@@ -28,6 +28,19 @@ export function clampNonNegativeInt(value, fallback) {
     }
     return value < 0 ? 0 : Math.floor(value);
 }
+/**
+ * Bound legacy persisted routing deadlines once, when loading the account.
+ * These deadlines schedule revalidation; quota snapshots retain upstream resets.
+ * Never call this on every selection: that would slide the deadline indefinitely.
+ */
+export function boundRateLimitCache(times, now = nowMs()) {
+    return Object.fromEntries(Object.entries(times).map(([key, until]) => [
+        key,
+        typeof until === "number"
+            ? Math.min(until, now + RATE_LIMIT_CACHE_TTL_MS)
+            : until,
+    ]));
+}
 export function clearExpiredRateLimits(entity) {
     const now = nowMs();
     const keys = Object.keys(entity.rateLimitResetTimes);

package/dist/lib/accounts.d.ts

@@ -70,6 +70,7 @@ export declare class AccountManager {
     private readonly persistedWorkspaceSelections;
     private readonly persistedWorkspaces;
     private hadPersistedStorage;
+    private hasUnpersistedRateLimitBounds;
     private readonly loadedAccountStorageSnapshot;
     private cursorByFamily;
     private currentAccountIndexByFamily;
@@ -334,7 +335,11 @@ export declare class AccountManager {
     commitRefreshedAuth(source: Pick<ManagedAccount, "index" | "accountId" | "email" | "refreshToken">, auth: OAuthAuthDetails): Promise<ManagedAccount | null>;
     toAuthDetails(account: ManagedAccount): Auth;
     getMinWaitTime(): number;
-    getMinWaitTimeForFamily(family: ModelFamily, model?: string | null): number;
+    /**
+     * Accounts in `excludedIndexes` (policy-blocked or reserved for this request)
+     * are not capacity the caller can retry into, so they never shorten the wait.
+     */
+    getMinWaitTimeForFamily(family: ModelFamily, model?: string | null, excludedIndexes?: ReadonlySet<number>): number;
     /**
      * Walks forward from `start` (inclusive) looking for the next enabled
      * account, wrapping around at most once. Returns -1 when every account in

package/dist/lib/accounts.js

@@ -9,7 +9,7 @@ import { MODEL_FAMILIES } from "./request/helpers/model-map.js";
 import { getHealthTracker, getTokenTracker, resetTrackers, selectHybridAccount, } from "./rotation.js";
 import { withRoutingMutex, } from "./routing-mutex.js";
 import { nowMs } from "./utils.js";
-import { ERROR_MESSAGES, HTTP_STATUS, LUNA_RESERVE_MODEL, MAX_RATE_LIMIT_DELAY_MS } from "./constants.js";
+import { ERROR_MESSAGES, HTTP_STATUS, LUNA_RESERVE_MODEL, RATE_LIMIT_CACHE_TTL_MS } from "./constants.js";
 import { CodexAuthError } from "./errors.js";
 import { loadCodexCliState, } from "./codex-cli/state.js";
 import { syncAccountStorageFromCodexCli } from "./codex-cli/sync.js";
@@ -21,7 +21,7 @@ export { extractAccountId, extractAccountEmail, getAccountIdCandidates, selectBe
 export { parseRateLimitReason, getQuotaKey, clampNonNegativeInt, clearExpiredRateLimits, clearAllRateLimits, isRateLimitedForQuotaKey, isRateLimitedForFamily, formatWaitTime, } from "./accounts/rate-limits.js";
 export { lookupCodexCliTokensByEmail, isCodexCliSyncEnabled, } from "./codex-cli/state.js";
 import { codexCliAccountIdFor, extractAccountId, extractAccountEmail, shouldUpdateAccountIdFromToken, sanitizeEmail, } from "./auth/token-utils.js";
-import { clampNonNegativeInt, getQuotaKey, clearExpiredRateLimits, clearAllRateLimits, isRateLimitedForFamily, formatWaitTime, } from "./accounts/rate-limits.js";
+import { boundRateLimitCache, clampNonNegativeInt, getQuotaKey, clearExpiredRateLimits, clearAllRateLimits, isRateLimitedForFamily, formatWaitTime, } from "./accounts/rate-limits.js";
 const log = createLogger("accounts");
 let nextRuntimeCircuitKeyId = 0;
 function getAccountCircuitKey(account) {
@@ -142,6 +142,7 @@ export class AccountManager {
     persistedWorkspaceSelections = new WeakMap();
     persistedWorkspaces = new WeakMap();
     hadPersistedStorage = false;
+    hasUnpersistedRateLimitBounds = false;
     loadedAccountStorageSnapshot;
     cursorByFamily = initFamilyState(0);
     currentAccountIndexByFamily = initFamilyState(-1);
@@ -201,6 +202,19 @@ export class AccountManager {
         }
         const manager = new AccountManager(authFallback, sourceOfTruthStorage);
         await manager.hydrateFromCodexCli();
+        if (manager.hasUnpersistedRateLimitBounds) {
+            // Short-lived wrappers may exit without another save; persisting the
+            // bound now keeps each restart from re-bounding from its own load time.
+            try {
+                await manager.saveToDisk(true);
+                manager.hasUnpersistedRateLimitBounds = false;
+            }
+            catch (error) {
+                log.debug("Failed to persist bounded rate-limit deadlines", {
+                    error: String(error),
+                });
+            }
+        }
         return manager;
     }
     /** @internal True when construction received a parsed/recovered storage snapshot. */
@@ -337,6 +351,11 @@ export class AccountManager {
                     return null;
                 }
                 const matchesFallback = !!authFallback && fallbackMatchedRowIndex === index;
+                const storedRateLimits = account.rateLimitResetTimes ?? {};
+                const rateLimitResetTimes = boundRateLimitCache(storedRateLimits, baseNow);
+                if (Object.entries(rateLimitResetTimes).some(([key, until]) => until !== storedRateLimits[key])) {
+                    this.hasUnpersistedRateLimitBounds = true;
+                }
                 const refreshToken = matchesFallback && authFallback
                     ? authFallback.refresh
                     : account.refreshToken;
@@ -362,7 +381,7 @@ export class AccountManager {
                     addedAt: clampNonNegativeInt(account.addedAt, baseNow),
                     lastUsed: clampNonNegativeInt(account.lastUsed, 0),
                     lastSwitchReason: account.lastSwitchReason,
-                    rateLimitResetTimes: account.rateLimitResetTimes ?? {},
+                    rateLimitResetTimes,
                     coolingDownUntil: account.coolingDownUntil,
                     cooldownReason: account.cooldownReason,
                     authInvalidatedAt: account.authInvalidatedAt,
@@ -1062,9 +1081,9 @@ export class AccountManager {
             // Fail closed: retain this new limit if the selection cannot be read.
             log.warn("Rate limit recorded while account selection metadata is unavailable");
         }
-        // Clamp to MAX_RATE_LIMIT_DELAY_MS so a bogus upstream retry-after value
-        // cannot wedge this account unavailable for years (see stress audit H1).
-        const retryMs = Math.min(Math.max(0, Math.floor(retryAfterMs)), MAX_RATE_LIMIT_DELAY_MS);
+        // A local rejection is authoritative for at most an hour. The next request
+        // then revalidates upstream, including after an out-of-band quota reset.
+        const retryMs = Math.min(Math.max(0, Math.floor(retryAfterMs)), RATE_LIMIT_CACHE_TTL_MS);
         const observedAtMs = nowMs();
         const resetAt = observedAtMs + retryMs;
         // Only carry forward an unsequenced entry that is still replayable.
@@ -1561,9 +1580,15 @@ export class AccountManager {
     getMinWaitTime() {
         return this.getMinWaitTimeForFamily("codex");
     }
-    getMinWaitTimeForFamily(family, model) {
+    /**
+     * Accounts in `excludedIndexes` (policy-blocked or reserved for this request)
+     * are not capacity the caller can retry into, so they never shorten the wait.
+     */
+    getMinWaitTimeForFamily(family, model, excludedIndexes) {
         const now = nowMs();
-        const enabledAccounts = this.accounts.filter((account) => account.enabled !== false && !this.isAccountAuthInvalidated(account));
+        const enabledAccounts = this.accounts.filter((account) => account.enabled !== false &&
+            !this.isAccountAuthInvalidated(account) &&
+            !excludedIndexes?.has(account.index));
         const available = enabledAccounts.filter((account) => {
             clearExpiredRateLimits(account);
             return (!isRateLimitedForFamily(account, family, model) &&

package/dist/lib/api-route-store.d.ts

@@ -17,6 +17,7 @@ declare const routeSchema: z.ZodObject<{
     accessPrograms: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>;
     modelAccessPrograms: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>>;
 }, z.core.$strip>;
+export declare const MAX_API_ROUTES = 100;
 export type ApiRouteCredential = z.infer<typeof routeSchema>;
 export declare function getApiRoutesPath(): string;
 export declare function loadApiRoutes(path?: string): Promise<ApiRouteCredential[]>;

package/dist/lib/api-route-store.js

@@ -41,9 +41,10 @@ const routeSchema = z.object({
     modelAccessPrograms: z.record(modelId, accessPrograms)
         .refine(value => Object.keys(value).length <= 1000).optional(),
 });
+export const MAX_API_ROUTES = 100;
 const schema = z.object({
     version: z.literal(1),
-    routes: z.array(routeSchema).max(100),
+    routes: z.array(routeSchema).max(MAX_API_ROUTES),
 });
 export function getApiRoutesPath() {
     return join(getCodexMultiAuthDir(), "api-routes.json");

package/dist/lib/auth/account-access.js

@@ -1,5 +1,6 @@
 import { CODEX_BASE_URL } from "../constants.js";
 import { combineSignals } from "../utils.js";
+import { fetchAuth } from "./http.js";
 const ACCOUNTS_CHECK_PATH = "/wham/accounts/check";
 const ACCOUNTS_CHECK_TIMEOUT_MS = 10_000;
 function readString(value) {
@@ -49,7 +50,7 @@ export async function fetchAuthorizedAccounts(accessToken, options = {}) {
     const token = readString(accessToken);
     if (!token)
         return null;
-    const doFetch = options.fetch ?? globalThis.fetch;
+    const doFetch = options.fetch ?? fetchAuth;
     const timeout = AbortSignal.timeout(ACCOUNTS_CHECK_TIMEOUT_MS);
     // combineSignals wraps AbortSignal.any (available on every Node the
     // engines floor, `>=22.19`, permits) with null-tolerance; the native composite also detaches

package/dist/lib/auth/auth.js

@@ -2,6 +2,7 @@ import { randomBytes, webcrypto } from "node:crypto";
 import { logError } from "../logger.js";
 import { safeParseOAuthTokenResponse } from "../schemas.js";
 import { isAbortError } from "../utils.js";
+import { fetchAuth } from "./http.js";
 // OAuth constants (from openai/codex)
 export const CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
 export const AUTHORIZE_URL = "https://auth.openai.com/oauth/authorize";
@@ -396,7 +397,7 @@ export function parseAuthorizationInput(input) {
  * @returns Token result
  */
 export async function exchangeAuthorizationCode(code, verifier, redirectUri = REDIRECT_URI) {
-    const res = await fetch(TOKEN_URL, {
+    const res = await fetchAuth(TOKEN_URL, {
         method: "POST",
         headers: { "Content-Type": "application/x-www-form-urlencoded" },
         body: new URLSearchParams({
@@ -468,7 +469,7 @@ export function decodeJWT(token) {
 }
 export async function refreshAccessToken(refreshToken, options = {}) {
     try {
-        const response = await fetch(TOKEN_URL, {
+        const response = await fetchAuth(TOKEN_URL, {
             method: "POST",
             headers: { "Content-Type": "application/x-www-form-urlencoded" },
             signal: options?.signal,

package/dist/lib/auth/device-auth.js

@@ -1,4 +1,5 @@
 import { CLIENT_ID, exchangeAuthorizationCode, sanitizeOAuthResponseBodyForLog, } from "./auth.js";
+import { fetchAuth } from "./http.js";
 const DEVICE_AUTH_BASE_URL = "https://auth.openai.com";
 const DEVICE_AUTH_API_BASE_URL = `${DEVICE_AUTH_BASE_URL}/api/accounts`;
 export const DEVICE_AUTH_VERIFICATION_URL = `${DEVICE_AUTH_BASE_URL}/codex/device`;
@@ -14,7 +15,7 @@ const DEVICE_AUTH_TRANSIENT_PENDING_STATUSES = new Set([
     504,
 ]);
 function getFetch(options) {
-    return options.fetchImpl ?? fetch;
+    return options.fetchImpl ?? fetchAuth;
 }
 function getNow(options) {
     return options.now ?? Date.now;

package/dist/lib/auth/http.d.ts

@@ -0,0 +1 @@
+export { fetchWithProxy as fetchAuth } from "../request/proxy-fetch.js";

package/dist/lib/auth/http.js

@@ -0,0 +1 @@
+export { fetchWithProxy as fetchAuth } from "../request/proxy-fetch.js";

package/dist/lib/auth/token-utils.d.ts

@@ -45,6 +45,11 @@ export declare function extractAccountId(accessToken?: string): string | undefin
  */
 /** Whether an id is an OpenAI platform org id ("org-..."), never a ChatGPT workspace. */
 export declare function isOpenAiOrgId(accountId: string | undefined): boolean;
+/** Preserve the native client's org-alias mapping; this is not workspace fallback. */
+export declare function nativeWorkspaceIdentity(account: {
+    access?: string;
+    codexCliMirror?: CodexCliMirror;
+}, storedId: string | undefined): string | undefined;
 export declare function resolveCodexAuthAccountId(accountId: string | undefined, accessToken?: string, idToken?: string): string | undefined;
 /**
  * The account id to hand the ~/.codex/auth.json writer for a saved account,

package/dist/lib/auth/token-utils.js

@@ -261,6 +261,16 @@ export function extractAccountId(accessToken) {
 export function isOpenAiOrgId(accountId) {
     return /^org-/i.test(accountId?.trim() ?? "");
 }
+/** Preserve the native client's org-alias mapping; this is not workspace fallback. */
+export function nativeWorkspaceIdentity(account, storedId) {
+    const id = storedId?.trim();
+    if (!id)
+        return undefined;
+    if (!isOpenAiOrgId(id))
+        return id;
+    const native = codexCliAccountIdFor({ accountId: id, codexCliMirror: account.codexCliMirror }, account.access);
+    return native && !isOpenAiOrgId(native) ? native : undefined;
+}
 export function resolveCodexAuthAccountId(accountId, accessToken, idToken) {
     const trimmed = accountId?.trim();
     if (!trimmed)

package/dist/lib/codex-manager/account-manager-commands.js

@@ -14,6 +14,7 @@ export const ACCOUNT_MANAGER_COMMANDS = new Set([
     "login",
     "list",
     "status",
+    "web",
     "limits",
     "switch",
     "unpin",

package/dist/lib/codex-manager/commands/account.js

@@ -7,6 +7,7 @@ function printAccountUsage(logInfo) {
         "  codex-multi-auth account weight <index> <0..10>",
         "  codex-multi-auth account priority <index> <0..9>",
         "  codex-multi-auth account auto-prime <index> on|off",
+        "  codex-multi-auth account emergency-only <index> on|off",
         "  codex-multi-auth account pause|unpause|drain|undrain <index>",
         "  codex-multi-auth account note <index> <text>",
         "  codex-multi-auth account policy list [--json]",
@@ -37,6 +38,7 @@ function policySummary(store, storage) {
             weight: policy?.weight ?? 1,
             priority: policy?.priority ?? 1,
             autoPrime: policy?.autoPrime ?? false,
+            emergencyOnly: policy?.emergencyOnly ?? false,
             paused: policy?.paused ?? false,
             drained: policy?.drained ?? false,
             note: policy?.note ?? null,
@@ -84,6 +86,7 @@ export async function runAccountCommand(args, deps) {
                 `weight=${entry.weight}`,
                 `priority=${entry.priority}`,
                 `auto-prime=${entry.autoPrime ? "on" : "off"}`,
+                entry.emergencyOnly ? "emergency-only" : null,
                 entry.paused ? "paused" : null,
                 entry.drained ? "drained" : null,
                 entry.tags.length > 0 ? `tags=${entry.tags.join(",")}` : null,
@@ -120,6 +123,18 @@ export async function runAccountCommand(args, deps) {
         logInfo(`${command === "tag" ? "Tagged" : "Removed tag from"} account ${resolved.index + 1}: ${policy.tags.join(",") || "none"}`);
         return 0;
     }
+    if (command === "emergency-only") {
+        if (rest.length !== 2 || !["on", "off"].includes(rest[1] ?? "")) {
+            logError("emergency-only requires on or off.");
+            return 1;
+        }
+        await updateStore(store => ({
+            result: upsertAccountPolicy(store, accountKey, next => { next.emergencyOnly = rest[1] === "on"; }, now),
+            dirty: true,
+        }));
+        logInfo(`Emergency-only ${rest[1]} for account ${resolved.index + 1}.`);
+        return 0;
+    }
     if (command === "auto-prime") {
         if (rest.length !== 2 || !["on", "off"].includes(rest[1] ?? "")) {
             logError("auto-prime requires on or off.");

package/dist/lib/codex-manager/commands/locale.d.ts

@@ -0,0 +1,12 @@
+import { type OutputLocaleSetting } from "../../locale.js";
+export interface LocaleCommandDeps {
+    loadConfig: () => {
+        locale?: OutputLocaleSetting;
+    };
+    saveConfig: (patch: {
+        locale: OutputLocaleSetting;
+    }) => Promise<void>;
+    logInfo?: (message: string) => void;
+    logError?: (message: string) => void;
+}
+export declare function runLocaleCommand(args: string[], deps: LocaleCommandDeps): Promise<number>;

package/dist/lib/codex-manager/commands/locale.js

@@ -0,0 +1,25 @@
+import { localeName, normalizeOutputLocaleSetting, resolveOutputLocale, } from "../../locale.js";
+export async function runLocaleCommand(args, deps) {
+    const logInfo = deps.logInfo ?? console.log;
+    const logError = deps.logError ?? console.error;
+    const requested = args[0]?.trim();
+    if (args.length > 1 || requested === "--help" || requested === "-h") {
+        logInfo("Usage: codex-multi-auth config locale [auto|en|zh]");
+        return requested === "--help" || requested === "-h" ? 0 : 1;
+    }
+    if (!requested) {
+        const configured = deps.loadConfig().locale ?? "auto";
+        const effective = resolveOutputLocale(configured);
+        logInfo(`Locale: ${configured} (effective: ${localeName(effective)})`);
+        return 0;
+    }
+    const locale = normalizeOutputLocaleSetting(requested);
+    if (!locale) {
+        logError(`Unsupported locale: ${requested}. Choose auto, en, or zh.`);
+        return 1;
+    }
+    await deps.saveConfig({ locale });
+    const effective = resolveOutputLocale(locale);
+    logInfo(`Locale saved: ${locale} (effective: ${localeName(effective)})`);
+    return 0;
+}

package/dist/lib/codex-manager/commands/resets.js

@@ -1,8 +1,14 @@
 import { AccountManager } from '../../accounts.js';
 import { loadAccounts } from '../../storage.js';
 import { runWithGlobalStoragePath } from '../../storage/path-state.js';
-import { createResetCreditService, resetTargetForStoredAccount, resetAccountLabel } from '../../runtime/account-reset-credits.js';
+import { createResetCreditService, resetTargetForStoredAccount, resetAccountLabel, formatResetCreditLine } from '../../runtime/account-reset-credits.js';
 import { withCheckProgress } from '../../ui/check-progress.js';
+// A pending result may belong to a workspace that was since disabled or deselected.
+function ownsPendingKey(account, key) {
+    const workspaces = account.workspaces?.map(workspace => ({ ...workspace, enabled: true }));
+    const selections = [undefined, ...(workspaces ?? []).map((_, index) => index)];
+    return selections.some(index => resetTargetForStoredAccount({ ...account, enabled: true, workspaces: index === undefined ? undefined : workspaces, currentWorkspaceIndex: index ?? account.currentWorkspaceIndex })?.key === key);
+}
 const usage = 'Usage: codex-multi-auth resets list [--refresh] | redeem <account-number> | auto manual|last-resort';
 export async function runResetsCommand(args) {
     const [command = 'list', value, ...extra] = args;
@@ -47,7 +53,13 @@ export async function runResetsCommand(args) {
                 const index = (storage?.accounts ?? []).findIndex(a => resetTargetForStoredAccount(a)?.key === state.lastRedemption?.key);
                 console.log(`Last confirmed reset: ${index >= 0 ? `account ${index + 1}` : "removed account"}; ${state.lastRedemption.outcome}; ${state.lastRedemption.automatic ? "automatic" : "explicit"}`);
             }
-            (storage?.accounts ?? []).forEach((a, i) => { const target = resetTargetForStoredAccount(a); const ambiguous = target && (keyCounts.get(target.key) ?? 0) > 1; const snapshot = target && !ambiguous ? (refreshed ?? state.snapshots)[target.key] : undefined; console.log(`${resetAccountLabel(a, i)}: ${snapshot?.availableCount ?? 'unknown'} reset credits${snapshot ? ` (checked ${Math.max(0, Math.floor((Date.now() - snapshot.updatedAt) / 1000))}s ago)` : ''}${ambiguous ? ' [ambiguous account identity; repair duplicate records]' : ''}${target?.key === state.pending?.key ? ' [redemption pending; retry this account]' : ''}`); });
+            (storage?.accounts ?? []).forEach((a, i) => {
+                const target = resetTargetForStoredAccount(a);
+                const ambiguous = target && (keyCounts.get(target.key) ?? 0) > 1;
+                const snapshot = target && !ambiguous ? (refreshed ?? state.snapshots)[target.key] : undefined;
+                console.log(`${resetAccountLabel(a, i)}: ${snapshot?.availableCount ?? 'unknown'} reset credits${snapshot ? ` (checked ${Math.max(0, Math.floor((Date.now() - snapshot.updatedAt) / 1000))}s ago)` : ''}${ambiguous ? ' [ambiguous account identity; repair duplicate records]' : ''}${target?.key === state.pending?.key ? ' [redemption pending; retry this account]' : ''}`);
+                snapshot?.credits?.forEach((c, idx) => console.log(formatResetCreditLine(c, idx)));
+            });
             const failed = refreshed ? targets.filter(target => (keyCounts.get(target.key) ?? 0) > 1 || !refreshed[target.key]).length : 0;
             if (failed) {
                 console.error(`${failed} of ${targets.length} reset-credit reads failed. Check account authentication and the native Codex backend (CODEX_MULTI_AUTH_USAGE_CODEX_BIN selects an executable). No credits were redeemed.`);
@@ -61,10 +73,11 @@ export async function runResetsCommand(args) {
             const pending = command === 'redeem' ? await service.status().then(s => s.pending ?? null, () => ({ key: undefined })) : null;
             // The pending record can belong to another account (a redeem is refused while
             // any result is pending); point at the account that actually needs the retry.
-            const owner = pending?.key ? (storage?.accounts ?? []).findIndex(a => resetTargetForStoredAccount({ ...a, enabled: true, workspaces: undefined })?.key === pending.key) : -1;
+            const pendingKey = pending?.key;
+            const owner = pendingKey ? (storage?.accounts ?? []).findIndex(a => ownsPendingKey(a, pendingKey)) : -1;
             const pendingAccount = owner >= 0 ? storage?.accounts[owner] : undefined;
-            const disabled = pendingAccount ? resetTargetForStoredAccount(pendingAccount) === null : false;
-            const retry = disabled ? `account ${owner + 1} or its workspace is disabled; re-enable it before retrying the pending result` : pending?.key && owner < 0 ? 'check it there (the pending account was removed)' : owner >= 0 && owner !== Number(value) - 1 ? `retry account ${owner + 1}, which holds the pending result` : 'retry the same account';
+            const disabled = pendingAccount ? resetTargetForStoredAccount(pendingAccount)?.key !== pendingKey : false;
+            const retry = disabled ? `account ${owner + 1} or its pending workspace is disabled or no longer selected; re-enable and select it before retrying the pending result` : pending?.key && owner < 0 ? 'check it there (the pending account was removed)' : owner >= 0 && owner !== Number(value) - 1 ? `retry account ${owner + 1}, which holds the pending result` : 'retry the same account';
             console.error(command === 'list' ? 'Reset-credit availability could not be refreshed. No credits were redeemed.' : command === 'auto' ? 'Reset-credit settings could not be updated.' : pending ? `Reset operation could not be confirmed. No new automatic redemption will be attempted while a result is pending; use resets list and ${retry}.` : 'No reset credit was redeemed. Availability could not be confirmed or a reset was just redeemed; run resets list --refresh and try again.');
             return 1;
         }

package/dist/lib/codex-manager/commands/status.d.ts

@@ -7,6 +7,7 @@ import type { QuotaCacheData } from "../../quota-cache.js";
 import { type AppBindRouterStatus } from "../../runtime/app-bind.js";
 import { type RuntimeAccountSignal } from "../../runtime/runtime-current-account.js";
 import type { RuntimeObservabilitySnapshot } from "../../runtime/runtime-observability.js";
+import { type OutputLocale } from "../../locale.js";
 import type { AccountStorageV3, StorageHealthSummary } from "../../storage.js";
 type LoadedStorage = AccountStorageV3 | null;
 export interface StatusCommandDeps {
@@ -31,6 +32,9 @@ export interface StatusCommandDeps {
     logInfo?: (message: string) => void;
     /** When true, emit a single machine-readable JSON object instead of text (cli-manager-03). */
     json?: boolean;
+    /** Compact human-facing summary. Undefined keeps the legacy detailed view for API callers. */
+    compact?: boolean;
+    locale?: OutputLocale;
 }
 export declare function runStatusCommand(deps: StatusCommandDeps): Promise<number>;
 export interface FeaturesCommandDeps {