codex-multi-auth 2.23.0 → 2.24.0

package/config/minimal-codex.json

@@ -1,15 +1,15 @@
-{
-  "$schema": "./schema/config.schema.json",
-  "plugin": ["codex-multi-auth"],
-
-  "provider": {
-    "openai": {
-      "options": {
-        "store": false
-      }
-    }
-  },
-  "model": "openai/gpt-5.6-sol"
-}
-
-
+{
+  "$schema": "./schema/config.schema.json",
+  "plugin": ["codex-multi-auth"],
+
+  "provider": {
+    "openai": {
+      "options": {
+        "store": false
+      }
+    }
+  },
+  "model": "openai/gpt-5.6-sol"
+}
+
+

package/dist/index.js

@@ -672,12 +672,8 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                         capabilityPolicy: capabilityPolicyStore,
                                     });
                                 }
-                                catch (policyError) {
-                                    logWarn("Runtime policy evaluation failed open.", {
-                                        error: policyError instanceof Error
-                                            ? policyError.message
-                                            : String(policyError),
-                                    });
+                                catch {
+                                    logWarn("Runtime policy evaluation failed; request blocked.");
                                 }
                                 usageRecorder = createRuntimeUsageRecorder({
                                     source: "plugin-host",
@@ -692,6 +688,25 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                     statusCode: null,
                                     errorCode: "plugin_host_request_failed",
                                 };
+                                if (!runtimePolicyDecision) {
+                                    runtimeMetrics.failedRequests += 1;
+                                    runtimeMetrics.lastError = "Runtime policy unavailable";
+                                    syncRuntimeObservability(requestTraceId);
+                                    usageCompletion = {
+                                        outcome: "blocked",
+                                        statusCode: 503,
+                                        errorCode: "runtime_policy_unavailable",
+                                    };
+                                    return new Response(JSON.stringify({
+                                        error: {
+                                            message: "Runtime policy could not be loaded for this local request.",
+                                            code: "runtime_policy_unavailable",
+                                        },
+                                    }), {
+                                        status: 503,
+                                        headers: { "content-type": "application/json; charset=utf-8" },
+                                    });
+                                }
                                 if (runtimePolicyDecision && !runtimePolicyDecision.allowed) {
                                     runtimeMetrics.failedRequests += 1;
                                     runtimeMetrics.lastError = "Runtime policy blocked request";
@@ -715,6 +730,12 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                         },
                                     });
                                 }
+                                // This host cannot prove ordinary capacity and permitted reset
+                                // recovery are exhausted, so emergency accounts stay reserved.
+                                const blockedAccountIndexes = new Set([
+                                    ...(runtimePolicyDecision?.blockedAccountIndexes ?? []),
+                                    ...(runtimePolicyDecision?.emergencyAccountIndexes ?? []),
+                                ]);
                                 const abortSignal = requestInit?.signal ?? init?.signal ?? null;
                                 const sleep = createAbortableSleep(abortSignal);
                                 const poolCooldownRemainingMs = getPoolExhaustionCooldownRemaining();
@@ -843,7 +864,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                             typeof preferredSessionAccountIndex === "number") {
                                             usedPreferredSessionAccount = true;
                                             if (accountManager.isAccountAvailableForFamily(preferredSessionAccountIndex, modelFamily, model) &&
-                                                !runtimePolicyDecision?.blockedAccountIndexes.has(preferredSessionAccountIndex)) {
+                                                !blockedAccountIndexes.has(preferredSessionAccountIndex)) {
                                                 account = accountManager.getAccountByIndex(preferredSessionAccountIndex);
                                                 if (account) {
                                                     account.lastUsed = Date.now();
@@ -858,13 +879,14 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                             account = accountManager.getCurrentOrNextForFamilyHybrid(modelFamily, model, {
                                                 pidOffsetEnabled,
                                                 scoreBoostByAccount: capabilityBoostByAccount,
+                                                blockedAccountIndexes,
                                             });
                                         }
                                         if (!account || attempted.has(account.index)) {
                                             break;
                                         }
                                         attempted.add(account.index);
-                                        if (runtimePolicyDecision?.blockedAccountIndexes.has(account.index)) {
+                                        if (blockedAccountIndexes.has(account.index)) {
                                             continue;
                                         }
                                         // Log account selection for debugging rotation
@@ -1451,7 +1473,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                             runtimeMetrics.cumulativeLatencyMs += fetchLatencyMs;
                                             let responseForSuccess = response;
                                             if (isStreaming) {
-                                                const streamFallbackCandidateOrder = buildAdaptiveStreamFailoverCandidateOrder(account.index, accountSnapshotList);
+                                                const streamFallbackCandidateOrder = buildAdaptiveStreamFailoverCandidateOrder(account.index, accountSnapshotList.filter((candidate) => !blockedAccountIndexes.has(candidate.index)));
                                                 runtimeMetrics.lastStreamFailoverCandidateCount =
                                                     streamFallbackCandidateOrder.length;
                                                 runtimeMetrics.streamFailoverCandidatesConsidered +=
@@ -1472,7 +1494,8 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                                         if (abortSignal?.aborted) {
                                                             return null;
                                                         }
-                                                        if (!accountManager.isAccountAvailableForFamily(candidateIndex, modelFamily, model)) {
+                                                        if (blockedAccountIndexes.has(candidateIndex) ||
+                                                            !accountManager.isAccountAvailableForFamily(candidateIndex, modelFamily, model)) {
                                                             continue;
                                                         }
                                                         const fallbackAccount = accountManager.getAccountByIndex(candidateIndex);

package/dist/lib/account-policy.d.ts

@@ -7,6 +7,8 @@ export interface AccountPolicy {
     priority?: number;
     /** Opt in to periodic first-use completion for unused personal subscriptions. */
     autoPrime?: boolean;
+    /** Pool backup only, after primary subscriptions and reset credits are exhausted. */
+    emergencyOnly?: boolean;
     paused: boolean;
     drained: boolean;
     note: string | null;

package/dist/lib/account-policy.js

@@ -37,6 +37,7 @@ function normalizePolicy(key, value) {
         weight: normalizeWeight(record.weight),
         priority: normalizePriority(record.priority),
         autoPrime: record.autoPrime === true,
+        emergencyOnly: record.emergencyOnly === true,
         paused: record.paused === true,
         drained: record.drained === true,
         note: note.length > 0 ? note.slice(0, 500) : null,
@@ -112,7 +113,7 @@ export async function loadAccountPolicyStore(options = {}) {
                 if (!key.startsWith("sha256:"))
                     continue;
                 // Legacy rows may omit flags; explicit malformed values are not OFF.
-                if (!isRecord(row) || ["autoPrime", "paused", "drained"].some(flag => flag in row && typeof row[flag] !== "boolean")) {
+                if (!isRecord(row) || ["autoPrime", "emergencyOnly", "paused", "drained"].some(flag => flag in row && typeof row[flag] !== "boolean")) {
                     throw new Error("Invalid account policy row");
                 }
             }
@@ -241,6 +242,7 @@ export function upsertAccountPolicy(store, accountKey, mutate, now = Date.now())
     next.weight = normalizeWeight(next.weight);
     next.priority = normalizePriority(next.priority);
     next.autoPrime = next.autoPrime === true;
+    next.emergencyOnly = next.emergencyOnly === true;
     next.updatedAt = stampUpdatedAt(now, store.accounts[accountKey]?.updatedAt);
     store.accounts[accountKey] = next;
     return next;

package/dist/lib/accounts/rate-limits.d.ts

@@ -15,6 +15,12 @@ export interface RateLimitState {
 export interface RateLimitedEntity {
     rateLimitResetTimes: RateLimitState;
 }
+/**
+ * Bound legacy persisted routing deadlines once, when loading the account.
+ * These deadlines schedule revalidation; quota snapshots retain upstream resets.
+ * Never call this on every selection: that would slide the deadline indefinitely.
+ */
+export declare function boundRateLimitCache(times: RateLimitState, now?: number): RateLimitState;
 export declare function clearExpiredRateLimits(entity: RateLimitedEntity): void;
 /**
  * Remove every rate-limit reset entry from `entity`, regardless of whether the

package/dist/lib/accounts/rate-limits.js

@@ -2,7 +2,7 @@
  * Rate limiting utilities for account management.
  * Extracted from accounts.ts to reduce module size and improve cohesion.
  */
-import { LUNA_RESERVE_MODEL } from "../constants.js";
+import { LUNA_RESERVE_MODEL, RATE_LIMIT_CACHE_TTL_MS } from "../constants.js";
 import { nowMs } from "../utils.js";
 export function parseRateLimitReason(code) {
     if (!code)
@@ -28,6 +28,19 @@ export function clampNonNegativeInt(value, fallback) {
     }
     return value < 0 ? 0 : Math.floor(value);
 }
+/**
+ * Bound legacy persisted routing deadlines once, when loading the account.
+ * These deadlines schedule revalidation; quota snapshots retain upstream resets.
+ * Never call this on every selection: that would slide the deadline indefinitely.
+ */
+export function boundRateLimitCache(times, now = nowMs()) {
+    return Object.fromEntries(Object.entries(times).map(([key, until]) => [
+        key,
+        typeof until === "number"
+            ? Math.min(until, now + RATE_LIMIT_CACHE_TTL_MS)
+            : until,
+    ]));
+}
 export function clearExpiredRateLimits(entity) {
     const now = nowMs();
     const keys = Object.keys(entity.rateLimitResetTimes);

package/dist/lib/accounts.d.ts

@@ -70,6 +70,7 @@ export declare class AccountManager {
     private readonly persistedWorkspaceSelections;
     private readonly persistedWorkspaces;
     private hadPersistedStorage;
+    private hasUnpersistedRateLimitBounds;
     private readonly loadedAccountStorageSnapshot;
     private cursorByFamily;
     private currentAccountIndexByFamily;
@@ -334,7 +335,11 @@ export declare class AccountManager {
     commitRefreshedAuth(source: Pick<ManagedAccount, "index" | "accountId" | "email" | "refreshToken">, auth: OAuthAuthDetails): Promise<ManagedAccount | null>;
     toAuthDetails(account: ManagedAccount): Auth;
     getMinWaitTime(): number;
-    getMinWaitTimeForFamily(family: ModelFamily, model?: string | null): number;
+    /**
+     * Accounts in `excludedIndexes` (policy-blocked or reserved for this request)
+     * are not capacity the caller can retry into, so they never shorten the wait.
+     */
+    getMinWaitTimeForFamily(family: ModelFamily, model?: string | null, excludedIndexes?: ReadonlySet<number>): number;
     /**
      * Walks forward from `start` (inclusive) looking for the next enabled
      * account, wrapping around at most once. Returns -1 when every account in

package/dist/lib/accounts.js

@@ -9,7 +9,7 @@ import { MODEL_FAMILIES } from "./request/helpers/model-map.js";
 import { getHealthTracker, getTokenTracker, resetTrackers, selectHybridAccount, } from "./rotation.js";
 import { withRoutingMutex, } from "./routing-mutex.js";
 import { nowMs } from "./utils.js";
-import { ERROR_MESSAGES, HTTP_STATUS, LUNA_RESERVE_MODEL, MAX_RATE_LIMIT_DELAY_MS } from "./constants.js";
+import { ERROR_MESSAGES, HTTP_STATUS, LUNA_RESERVE_MODEL, RATE_LIMIT_CACHE_TTL_MS } from "./constants.js";
 import { CodexAuthError } from "./errors.js";
 import { loadCodexCliState, } from "./codex-cli/state.js";
 import { syncAccountStorageFromCodexCli } from "./codex-cli/sync.js";
@@ -21,7 +21,7 @@ export { extractAccountId, extractAccountEmail, getAccountIdCandidates, selectBe
 export { parseRateLimitReason, getQuotaKey, clampNonNegativeInt, clearExpiredRateLimits, clearAllRateLimits, isRateLimitedForQuotaKey, isRateLimitedForFamily, formatWaitTime, } from "./accounts/rate-limits.js";
 export { lookupCodexCliTokensByEmail, isCodexCliSyncEnabled, } from "./codex-cli/state.js";
 import { codexCliAccountIdFor, extractAccountId, extractAccountEmail, shouldUpdateAccountIdFromToken, sanitizeEmail, } from "./auth/token-utils.js";
-import { clampNonNegativeInt, getQuotaKey, clearExpiredRateLimits, clearAllRateLimits, isRateLimitedForFamily, formatWaitTime, } from "./accounts/rate-limits.js";
+import { boundRateLimitCache, clampNonNegativeInt, getQuotaKey, clearExpiredRateLimits, clearAllRateLimits, isRateLimitedForFamily, formatWaitTime, } from "./accounts/rate-limits.js";
 const log = createLogger("accounts");
 let nextRuntimeCircuitKeyId = 0;
 function getAccountCircuitKey(account) {
@@ -142,6 +142,7 @@ export class AccountManager {
     persistedWorkspaceSelections = new WeakMap();
     persistedWorkspaces = new WeakMap();
     hadPersistedStorage = false;
+    hasUnpersistedRateLimitBounds = false;
     loadedAccountStorageSnapshot;
     cursorByFamily = initFamilyState(0);
     currentAccountIndexByFamily = initFamilyState(-1);
@@ -201,6 +202,19 @@ export class AccountManager {
         }
         const manager = new AccountManager(authFallback, sourceOfTruthStorage);
         await manager.hydrateFromCodexCli();
+        if (manager.hasUnpersistedRateLimitBounds) {
+            // Short-lived wrappers may exit without another save; persisting the
+            // bound now keeps each restart from re-bounding from its own load time.
+            try {
+                await manager.saveToDisk(true);
+                manager.hasUnpersistedRateLimitBounds = false;
+            }
+            catch (error) {
+                log.debug("Failed to persist bounded rate-limit deadlines", {
+                    error: String(error),
+                });
+            }
+        }
         return manager;
     }
     /** @internal True when construction received a parsed/recovered storage snapshot. */
@@ -337,6 +351,11 @@ export class AccountManager {
                     return null;
                 }
                 const matchesFallback = !!authFallback && fallbackMatchedRowIndex === index;
+                const storedRateLimits = account.rateLimitResetTimes ?? {};
+                const rateLimitResetTimes = boundRateLimitCache(storedRateLimits, baseNow);
+                if (Object.entries(rateLimitResetTimes).some(([key, until]) => until !== storedRateLimits[key])) {
+                    this.hasUnpersistedRateLimitBounds = true;
+                }
                 const refreshToken = matchesFallback && authFallback
                     ? authFallback.refresh
                     : account.refreshToken;
@@ -362,7 +381,7 @@ export class AccountManager {
                     addedAt: clampNonNegativeInt(account.addedAt, baseNow),
                     lastUsed: clampNonNegativeInt(account.lastUsed, 0),
                     lastSwitchReason: account.lastSwitchReason,
-                    rateLimitResetTimes: account.rateLimitResetTimes ?? {},
+                    rateLimitResetTimes,
                     coolingDownUntil: account.coolingDownUntil,
                     cooldownReason: account.cooldownReason,
                     authInvalidatedAt: account.authInvalidatedAt,
@@ -1062,9 +1081,9 @@ export class AccountManager {
             // Fail closed: retain this new limit if the selection cannot be read.
             log.warn("Rate limit recorded while account selection metadata is unavailable");
         }
-        // Clamp to MAX_RATE_LIMIT_DELAY_MS so a bogus upstream retry-after value
-        // cannot wedge this account unavailable for years (see stress audit H1).
-        const retryMs = Math.min(Math.max(0, Math.floor(retryAfterMs)), MAX_RATE_LIMIT_DELAY_MS);
+        // A local rejection is authoritative for at most an hour. The next request
+        // then revalidates upstream, including after an out-of-band quota reset.
+        const retryMs = Math.min(Math.max(0, Math.floor(retryAfterMs)), RATE_LIMIT_CACHE_TTL_MS);
         const observedAtMs = nowMs();
         const resetAt = observedAtMs + retryMs;
         // Only carry forward an unsequenced entry that is still replayable.
@@ -1561,9 +1580,15 @@ export class AccountManager {
     getMinWaitTime() {
         return this.getMinWaitTimeForFamily("codex");
     }
-    getMinWaitTimeForFamily(family, model) {
+    /**
+     * Accounts in `excludedIndexes` (policy-blocked or reserved for this request)
+     * are not capacity the caller can retry into, so they never shorten the wait.
+     */
+    getMinWaitTimeForFamily(family, model, excludedIndexes) {
         const now = nowMs();
-        const enabledAccounts = this.accounts.filter((account) => account.enabled !== false && !this.isAccountAuthInvalidated(account));
+        const enabledAccounts = this.accounts.filter((account) => account.enabled !== false &&
+            !this.isAccountAuthInvalidated(account) &&
+            !excludedIndexes?.has(account.index));
         const available = enabledAccounts.filter((account) => {
             clearExpiredRateLimits(account);
             return (!isRateLimitedForFamily(account, family, model) &&

package/dist/lib/auth/token-utils.d.ts

@@ -45,6 +45,11 @@ export declare function extractAccountId(accessToken?: string): string | undefin
  */
 /** Whether an id is an OpenAI platform org id ("org-..."), never a ChatGPT workspace. */
 export declare function isOpenAiOrgId(accountId: string | undefined): boolean;
+/** Preserve the native client's org-alias mapping; this is not workspace fallback. */
+export declare function nativeWorkspaceIdentity(account: {
+    access?: string;
+    codexCliMirror?: CodexCliMirror;
+}, storedId: string | undefined): string | undefined;
 export declare function resolveCodexAuthAccountId(accountId: string | undefined, accessToken?: string, idToken?: string): string | undefined;
 /**
  * The account id to hand the ~/.codex/auth.json writer for a saved account,

package/dist/lib/auth/token-utils.js

@@ -261,6 +261,16 @@ export function extractAccountId(accessToken) {
 export function isOpenAiOrgId(accountId) {
     return /^org-/i.test(accountId?.trim() ?? "");
 }
+/** Preserve the native client's org-alias mapping; this is not workspace fallback. */
+export function nativeWorkspaceIdentity(account, storedId) {
+    const id = storedId?.trim();
+    if (!id)
+        return undefined;
+    if (!isOpenAiOrgId(id))
+        return id;
+    const native = codexCliAccountIdFor({ accountId: id, codexCliMirror: account.codexCliMirror }, account.access);
+    return native && !isOpenAiOrgId(native) ? native : undefined;
+}
 export function resolveCodexAuthAccountId(accountId, accessToken, idToken) {
     const trimmed = accountId?.trim();
     if (!trimmed)

package/dist/lib/codex-manager/commands/account.js

@@ -7,6 +7,7 @@ function printAccountUsage(logInfo) {
         "  codex-multi-auth account weight <index> <0..10>",
         "  codex-multi-auth account priority <index> <0..9>",
         "  codex-multi-auth account auto-prime <index> on|off",
+        "  codex-multi-auth account emergency-only <index> on|off",
         "  codex-multi-auth account pause|unpause|drain|undrain <index>",
         "  codex-multi-auth account note <index> <text>",
         "  codex-multi-auth account policy list [--json]",
@@ -37,6 +38,7 @@ function policySummary(store, storage) {
             weight: policy?.weight ?? 1,
             priority: policy?.priority ?? 1,
             autoPrime: policy?.autoPrime ?? false,
+            emergencyOnly: policy?.emergencyOnly ?? false,
             paused: policy?.paused ?? false,
             drained: policy?.drained ?? false,
             note: policy?.note ?? null,
@@ -84,6 +86,7 @@ export async function runAccountCommand(args, deps) {
                 `weight=${entry.weight}`,
                 `priority=${entry.priority}`,
                 `auto-prime=${entry.autoPrime ? "on" : "off"}`,
+                entry.emergencyOnly ? "emergency-only" : null,
                 entry.paused ? "paused" : null,
                 entry.drained ? "drained" : null,
                 entry.tags.length > 0 ? `tags=${entry.tags.join(",")}` : null,
@@ -120,6 +123,18 @@ export async function runAccountCommand(args, deps) {
         logInfo(`${command === "tag" ? "Tagged" : "Removed tag from"} account ${resolved.index + 1}: ${policy.tags.join(",") || "none"}`);
         return 0;
     }
+    if (command === "emergency-only") {
+        if (rest.length !== 2 || !["on", "off"].includes(rest[1] ?? "")) {
+            logError("emergency-only requires on or off.");
+            return 1;
+        }
+        await updateStore(store => ({
+            result: upsertAccountPolicy(store, accountKey, next => { next.emergencyOnly = rest[1] === "on"; }, now),
+            dirty: true,
+        }));
+        logInfo(`Emergency-only ${rest[1]} for account ${resolved.index + 1}.`);
+        return 0;
+    }
     if (command === "auto-prime") {
         if (rest.length !== 2 || !["on", "off"].includes(rest[1] ?? "")) {
             logError("auto-prime requires on or off.");

package/dist/lib/codex-manager/commands/resets.js

@@ -1,8 +1,14 @@
 import { AccountManager } from '../../accounts.js';
 import { loadAccounts } from '../../storage.js';
 import { runWithGlobalStoragePath } from '../../storage/path-state.js';
-import { createResetCreditService, resetTargetForStoredAccount, resetAccountLabel } from '../../runtime/account-reset-credits.js';
+import { createResetCreditService, resetTargetForStoredAccount, resetAccountLabel, formatResetCreditLine } from '../../runtime/account-reset-credits.js';
 import { withCheckProgress } from '../../ui/check-progress.js';
+// A pending result may belong to a workspace that was since disabled or deselected.
+function ownsPendingKey(account, key) {
+    const workspaces = account.workspaces?.map(workspace => ({ ...workspace, enabled: true }));
+    const selections = [undefined, ...(workspaces ?? []).map((_, index) => index)];
+    return selections.some(index => resetTargetForStoredAccount({ ...account, enabled: true, workspaces: index === undefined ? undefined : workspaces, currentWorkspaceIndex: index ?? account.currentWorkspaceIndex })?.key === key);
+}
 const usage = 'Usage: codex-multi-auth resets list [--refresh] | redeem <account-number> | auto manual|last-resort';
 export async function runResetsCommand(args) {
     const [command = 'list', value, ...extra] = args;
@@ -47,7 +53,13 @@ export async function runResetsCommand(args) {
                 const index = (storage?.accounts ?? []).findIndex(a => resetTargetForStoredAccount(a)?.key === state.lastRedemption?.key);
                 console.log(`Last confirmed reset: ${index >= 0 ? `account ${index + 1}` : "removed account"}; ${state.lastRedemption.outcome}; ${state.lastRedemption.automatic ? "automatic" : "explicit"}`);
             }
-            (storage?.accounts ?? []).forEach((a, i) => { const target = resetTargetForStoredAccount(a); const ambiguous = target && (keyCounts.get(target.key) ?? 0) > 1; const snapshot = target && !ambiguous ? (refreshed ?? state.snapshots)[target.key] : undefined; console.log(`${resetAccountLabel(a, i)}: ${snapshot?.availableCount ?? 'unknown'} reset credits${snapshot ? ` (checked ${Math.max(0, Math.floor((Date.now() - snapshot.updatedAt) / 1000))}s ago)` : ''}${ambiguous ? ' [ambiguous account identity; repair duplicate records]' : ''}${target?.key === state.pending?.key ? ' [redemption pending; retry this account]' : ''}`); });
+            (storage?.accounts ?? []).forEach((a, i) => {
+                const target = resetTargetForStoredAccount(a);
+                const ambiguous = target && (keyCounts.get(target.key) ?? 0) > 1;
+                const snapshot = target && !ambiguous ? (refreshed ?? state.snapshots)[target.key] : undefined;
+                console.log(`${resetAccountLabel(a, i)}: ${snapshot?.availableCount ?? 'unknown'} reset credits${snapshot ? ` (checked ${Math.max(0, Math.floor((Date.now() - snapshot.updatedAt) / 1000))}s ago)` : ''}${ambiguous ? ' [ambiguous account identity; repair duplicate records]' : ''}${target?.key === state.pending?.key ? ' [redemption pending; retry this account]' : ''}`);
+                snapshot?.credits?.forEach((c, idx) => console.log(formatResetCreditLine(c, idx)));
+            });
             const failed = refreshed ? targets.filter(target => (keyCounts.get(target.key) ?? 0) > 1 || !refreshed[target.key]).length : 0;
             if (failed) {
                 console.error(`${failed} of ${targets.length} reset-credit reads failed. Check account authentication and the native Codex backend (CODEX_MULTI_AUTH_USAGE_CODEX_BIN selects an executable). No credits were redeemed.`);
@@ -61,10 +73,11 @@ export async function runResetsCommand(args) {
             const pending = command === 'redeem' ? await service.status().then(s => s.pending ?? null, () => ({ key: undefined })) : null;
             // The pending record can belong to another account (a redeem is refused while
             // any result is pending); point at the account that actually needs the retry.
-            const owner = pending?.key ? (storage?.accounts ?? []).findIndex(a => resetTargetForStoredAccount({ ...a, enabled: true, workspaces: undefined })?.key === pending.key) : -1;
+            const pendingKey = pending?.key;
+            const owner = pendingKey ? (storage?.accounts ?? []).findIndex(a => ownsPendingKey(a, pendingKey)) : -1;
             const pendingAccount = owner >= 0 ? storage?.accounts[owner] : undefined;
-            const disabled = pendingAccount ? resetTargetForStoredAccount(pendingAccount) === null : false;
-            const retry = disabled ? `account ${owner + 1} or its workspace is disabled; re-enable it before retrying the pending result` : pending?.key && owner < 0 ? 'check it there (the pending account was removed)' : owner >= 0 && owner !== Number(value) - 1 ? `retry account ${owner + 1}, which holds the pending result` : 'retry the same account';
+            const disabled = pendingAccount ? resetTargetForStoredAccount(pendingAccount)?.key !== pendingKey : false;
+            const retry = disabled ? `account ${owner + 1} or its pending workspace is disabled or no longer selected; re-enable and select it before retrying the pending result` : pending?.key && owner < 0 ? 'check it there (the pending account was removed)' : owner >= 0 && owner !== Number(value) - 1 ? `retry account ${owner + 1}, which holds the pending result` : 'retry the same account';
             console.error(command === 'list' ? 'Reset-credit availability could not be refreshed. No credits were redeemed.' : command === 'auto' ? 'Reset-credit settings could not be updated.' : pending ? `Reset operation could not be confirmed. No new automatic redemption will be attempted while a result is pending; use resets list and ${retry}.` : 'No reset credit was redeemed. Availability could not be confirmed or a reset was just redeemed; run resets list --refresh and try again.');
             return 1;
         }

package/dist/lib/codex-manager/commands/workspace.d.ts

@@ -1,18 +1,20 @@
-import type { AccountStorageV3 } from "../../storage.js";
+import type { AccountStorageV3, withAccountStorageTransaction } from "../../storage.js";
 type LoadedStorage = AccountStorageV3 | null;
 export interface WorkspaceCommandDeps {
     setStoragePath: (path: string | null) => void;
     loadAccounts: () => Promise<LoadedStorage>;
     saveAccounts: (storage: AccountStorageV3) => Promise<void>;
+    withAccountStorageTransaction: typeof withAccountStorageTransaction;
     logError?: (message: string) => void;
     logInfo?: (message: string) => void;
 }
 /**
  * `codex-multi-auth workspace <account> [workspace]`
  *
- * With only an account index, lists the workspaces that account can rotate
+ * With only an account index, lists the workspaces that account can select
  * between (personal Plus vs business/team under one email, issue #491). With a
  * workspace index too, sets it as the active workspace for that account.
+ * A final enable/disable action changes availability without changing selection.
  */
 export declare function runWorkspaceCommand(args: string[], deps: WorkspaceCommandDeps): Promise<number>;
 export {};

package/dist/lib/codex-manager/commands/workspace.js

@@ -1,11 +1,12 @@
-import { formatAccountLabel, formatWorkspaceLines, } from "../../accounts.js";
+import { formatAccountLabel, formatWorkspaceLines, resolveAccountRecordId, } from "../../accounts.js";
 import { saveAccountsWithRetry } from "../forecast-report-shared.js";
 /**
  * `codex-multi-auth workspace <account> [workspace]`
  *
- * With only an account index, lists the workspaces that account can rotate
+ * With only an account index, lists the workspaces that account can select
  * between (personal Plus vs business/team under one email, issue #491). With a
  * workspace index too, sets it as the active workspace for that account.
+ * A final enable/disable action changes availability without changing selection.
  */
 export async function runWorkspaceCommand(args, deps) {
     deps.setStoragePath(null);
@@ -76,6 +77,36 @@ export async function runWorkspaceCommand(args, deps) {
         return 1;
     }
     const targetName = target.name?.trim() || "(unnamed)";
+    const action = args[2];
+    if (args.length > 3 || (action && action !== "enable" && action !== "disable")) {
+        logError("Invalid workspace action. Use enable or disable.");
+        return 1;
+    }
+    if (action) {
+        const recordId = resolveAccountRecordId(account);
+        const workspaceId = target.id;
+        return deps.withAccountStorageTransaction(async (current, persist) => {
+            // An explicit command is an operation, even if its initial snapshot already
+            // had that value. Apply it to the latest row under the storage lock.
+            const matches = current?.accounts.filter(row => resolveAccountRecordId(row) === recordId) ?? [];
+            const latest = matches.length === 1 ? matches[0] : undefined;
+            const latestWorkspaces = latest?.workspaces ?? [];
+            const workspaceMatches = latestWorkspaces.filter(row => row.id === workspaceId);
+            const workspace = workspaceMatches.length === 1 ? workspaceMatches[0] : undefined;
+            if (!current || !latest || !workspace) {
+                logError("Account or workspace changed concurrently; reload before changing workspace availability.");
+                return 1;
+            }
+            workspace.enabled = action === "enable";
+            // Absence of disabledAt distinguishes an operator exclusion from runtime health.
+            delete workspace.disabledAt;
+            await saveAccountsWithRetry(current, persist);
+            const currentIndex = latestWorkspaces.indexOf(workspace) + 1;
+            const currentName = workspace.name?.trim() || "(unnamed)";
+            logInfo(`Workspace ${currentIndex} [${currentName}] ${workspace.enabled ? "enabled" : "disabled"}. Selected workspace unchanged.`);
+            return 0;
+        });
+    }
     if (target.enabled === false) {
         logError(`Workspace ${parsedWorkspace} ([${targetName}]) is disabled and cannot be selected.`);
         return 1;

package/dist/lib/codex-manager/help.js

@@ -17,10 +17,10 @@ export function printUsage() {
         "  codex-multi-auth switch <index>   (pins the account for runtime routing)",
         "  codex-multi-auth resets list [--refresh] | redeem <account> | auto manual|last-resort",
         "  codex-multi-auth unpin            (clears the manual pin set by switch)",
-        "  codex-multi-auth workspace <account> [workspace]   (list or switch an account's workspaces)",
+        "  codex-multi-auth workspace <account> [workspace]   (list or select; add enable/disable to change availability)",
         "  codex-multi-auth best [--live] [--json] [--model <model>]   (clears any manual pin set by switch)",
         "  codex-multi-auth forecast [--live] [--json] [--explain] [--model <model>] [--no-runtime-overlay]",
-        "  codex-multi-auth account tag|untag|weight|priority|auto-prime|pause|unpause|drain|undrain|note|policy list ...",
+        "  codex-multi-auth account tag|untag|weight|priority|auto-prime|emergency-only|pause|unpause|drain|undrain|note|policy list ...",
         "",
         "Repair:",
         "  codex-multi-auth uninstall [--dry-run] [--json] [--clear-accounts]",

package/dist/lib/codex-manager.js

@@ -63,7 +63,7 @@ import { loadQuotaCache, saveQuotaCache } from "./quota-cache.js";
 import { readAppRuntimeHelperAccountSignal } from "./runtime/runtime-current-account.js";
 import { fetchCodexQuotaSnapshot, formatQuotaSnapshotLine, } from "./quota-probe.js";
 import { queuedRefresh } from "./refresh-queue.js";
-import { clearAccounts, inspectStorageHealth, getLastAccountsSaveTimestamp, getStoragePath, loadAccounts, loadFlaggedAccounts, saveAccounts, setStoragePath, } from "./storage.js";
+import { clearAccounts, inspectStorageHealth, getLastAccountsSaveTimestamp, getStoragePath, loadAccounts, loadFlaggedAccounts, saveAccounts, setStoragePath, withAccountStorageTransaction, } from "./storage.js";
 // Formatter implementations moved to lib/codex-manager/formatters/ (audit
 // roadmap §4.1.1 phase 1). Re-exported here so existing consumers importing
 // from lib/codex-manager.js keep working unchanged.
@@ -256,6 +256,18 @@ export function buildSelectAccountTraced() {
                 blockedReasonByAccount[index] = AUTH_INVALIDATION_MARKER;
             }
         }
+        // This offline diagnostic cannot establish ordinary-pool exhaustion or
+        // perform permitted reset recovery. Leave emergency capacity reserved;
+        // keep any more specific policy, authentication, or runtime exclusion.
+        for (const account of accountsWithMetrics) {
+            if (policy.emergencyAccountIndexes?.has(account.index) &&
+                account.isAvailable &&
+                !blockedAccountIndexes.has(account.index)) {
+                blockedAccountIndexes.add(account.index);
+                blockedReasonByAccount[account.index] =
+                    "emergency-only: reserved until runtime confirms ordinary capacity and permitted resets are exhausted";
+            }
+        }
         return selectHybridAccountTraced({
             accounts: accountsWithMetrics,
             healthTracker,
@@ -368,6 +380,7 @@ const CLI_COMMAND_HANDLERS = new Map([
             setStoragePath,
             loadAccounts,
             saveAccounts,
+            withAccountStorageTransaction,
         }),
     ],
     ["check", (rest) => runCheckCommand({

package/dist/lib/constants.d.ts

@@ -116,3 +116,5 @@ export type WireReasoningEffort = Exclude<ModelReasoningEffort, "ultra">;
  * untouched.
  */
 export declare function stripModelEffortSuffix(modelId: string): string;
+/** Maximum lifetime of a local quota rejection before upstream revalidation. */
+export declare const RATE_LIMIT_CACHE_TTL_MS: number;

package/dist/lib/constants.js

@@ -136,3 +136,5 @@ export function stripModelEffortSuffix(modelId) {
         return modelId;
     return modelId.replace(EFFORT_SUFFIX_PATTERN, "");
 }
+/** Maximum lifetime of a local quota rejection before upstream revalidation. */
+export const RATE_LIMIT_CACHE_TTL_MS = 60 * 60_000;

package/dist/lib/context-budget-response.js

@@ -17,14 +17,14 @@ function buildPauseMessage(advisory) {
     const windowNote = advisory.windowSource === "override"
         ? "your configured window size"
         : "an estimated window size (unverified — set `contextBudgetGuardModelWindowOverrides` if you know the real limit)";
-    return `[Plugin Notice] Context budget guard paused this session at ${formatPercent(advisory.percent)}% of ${windowNote} for \`${advisory.model}\`, before hitting the model's actual limit.
-
-Please use one of these commands to reduce context size:
-
-• **/compact** - Compress conversation history (recommended)
-• **/clear** - Start fresh with empty context
-• **/undo** - Remove recent messages
-
+    return `[Plugin Notice] Context budget guard paused this session at ${formatPercent(advisory.percent)}% of ${windowNote} for \`${advisory.model}\`, before hitting the model's actual limit.
+
+Please use one of these commands to reduce context size:
+
+• **/compact** - Compress conversation history (recommended)
+• **/clear** - Start fresh with empty context
+• **/undo** - Remove recent messages
+
 Then retry your request. This pause clears itself automatically once your context usage drops back below the threshold.`;
 }
 /**