codex-multi-auth 2.3.0-beta.0 → 2.3.0-beta.2

package/dist/lib/codex-manager/login-oauth.js

@@ -0,0 +1,345 @@
+import { stdin as input, stdout as output } from "node:process";
+import { createInterface } from "node:readline/promises";
+import { extractAccountEmail, extractAccountId, getAccountIdCandidates, resolveRequestAccountId, sanitizeEmail, selectBestAccountCandidate, } from "../accounts.js";
+import { createAuthorizationFlow, exchangeAuthorizationCode, redactOAuthUrlForLog, REDIRECT_URI, } from "../auth/auth.js";
+import { copyTextToClipboard, openBrowserUrl, } from "../auth/browser.js";
+import { runDeviceAuthFlow } from "../auth/device-auth.js";
+import { resolveOrgOverride } from "../auth/org-override.js";
+import { startLocalOAuthServer } from "../auth/server.js";
+import { setCodexCliActiveSelection } from "../codex-cli/writer.js";
+import { createLogger } from "../logger.js";
+import { MODEL_FAMILIES } from "../prompts/codex.js";
+import { findMatchingAccountIndex, withAccountStorageTransaction, } from "../storage.js";
+import { UI_COPY } from "../ui/ui-copy.js";
+import { applyAccountPoolResults, } from "./account-pool-write.js";
+import { stylePromptText } from "./formatters/index.js";
+import { classifyManualCallbackInput, } from "./manual-callback.js";
+const log = createLogger("codex-manager");
+/** @internal */
+export function isOAuthCancellation(result) {
+    const message = (result.message ?? result.reason ?? "").trim().toLowerCase();
+    return message.includes("cancelled") || message.includes("canceled");
+}
+/** @internal */
+export function isAbortError(error) {
+    if (!(error instanceof Error))
+        return false;
+    const maybe = error;
+    return maybe.name === "AbortError" || maybe.code === "ABORT_ERR";
+}
+/**
+ * Resolve the account-id selection for freshly-minted tokens.
+ *
+ * The org-override precedence (explicit `login --org` wins over the ambient
+ * CODEX_AUTH_ACCOUNT_ID env, for this call only) lives in the internal
+ * lib/auth/org-override.ts module so it can be unit-tested without exporting this
+ * CLI-internal function. Threading the org as a parameter avoids mutating
+ * process.env for the duration of a login, which raced on concurrent re-entry.
+ *
+ * @internal
+ */
+export function resolveAccountSelection(tokens, orgOverride) {
+    const candidates = getAccountIdCandidates(tokens.access, tokens.idToken);
+    // Surface every workspace/organization exposed by the token so the saved
+    // account can track them (issue #491/#512). Without this, same-email
+    // multi-workspace logins persisted rows with `workspaces: null` and
+    // `workspace <account>` was unusable. Built before the `--org` override
+    // branch so the explicit-binding flow persists workspaces too (#512).
+    const workspaces = candidates.length > 0
+        ? candidates.map((candidate) => ({
+            id: candidate.accountId,
+            name: candidate.label,
+            enabled: true,
+            isDefault: candidate.isDefault,
+        }))
+        : undefined;
+    const override = resolveOrgOverride(orgOverride);
+    if (override) {
+        // Prefer the token candidate's human label for the chosen org so the
+        // saved row is identifiable, falling back to a bare manual binding.
+        const matched = candidates.find((candidate) => candidate.accountId === override);
+        return {
+            ...tokens,
+            accountIdOverride: override,
+            accountIdSource: "manual",
+            accountLabel: matched?.label,
+            workspaces,
+        };
+    }
+    if (candidates.length === 0) {
+        return tokens;
+    }
+    if (candidates.length === 1) {
+        const [candidate] = candidates;
+        if (candidate) {
+            return {
+                ...tokens,
+                accountIdOverride: candidate.accountId,
+                accountIdSource: candidate.source,
+                accountLabel: candidate.label,
+                workspaces,
+            };
+        }
+    }
+    const best = selectBestAccountCandidate(candidates);
+    if (!best) {
+        return tokens;
+    }
+    return {
+        ...tokens,
+        accountIdOverride: best.accountId,
+        accountIdSource: best.source ?? "token",
+        accountLabel: best.label,
+        workspaces,
+    };
+}
+async function promptManualCallback(state, options = {}) {
+    const useInteractivePrompt = input.isTTY && output.isTTY;
+    if (!useInteractivePrompt && !options.allowNonTty) {
+        return { type: "cancelled" };
+    }
+    const rl = createInterface({ input, output });
+    try {
+        if (useInteractivePrompt) {
+            console.log("");
+            console.log(stylePromptText(UI_COPY.oauth.pastePrompt, "accent"));
+        }
+        const answer = useInteractivePrompt
+            ? await rl.question("◆  ")
+            : await new Promise((resolve, reject) => {
+                if (input.readableEnded || input.destroyed) {
+                    resolve(null);
+                    return;
+                }
+                let settled = false;
+                const handleInputClosed = () => {
+                    if (settled)
+                        return;
+                    settled = true;
+                    input.off("end", handleInputClosed);
+                    input.off("close", handleInputClosed);
+                    resolve(null);
+                };
+                const finish = (value) => {
+                    if (settled)
+                        return;
+                    settled = true;
+                    input.off("end", handleInputClosed);
+                    input.off("close", handleInputClosed);
+                    resolve(value);
+                };
+                const fail = (error) => {
+                    if (settled)
+                        return;
+                    settled = true;
+                    input.off("end", handleInputClosed);
+                    input.off("close", handleInputClosed);
+                    reject(error);
+                };
+                rl.question("")
+                    .then((value) => finish(value))
+                    .catch((error) => {
+                    if (isAbortError(error) || isReadlineClosedError(error)) {
+                        handleInputClosed();
+                        return;
+                    }
+                    fail(error);
+                });
+                input.once("end", handleInputClosed);
+                input.once("close", handleInputClosed);
+            });
+        return classifyManualCallbackInput(answer, state);
+    }
+    catch (error) {
+        if (isAbortError(error) || isReadlineClosedError(error)) {
+            return { type: "cancelled" };
+        }
+        throw error;
+    }
+    finally {
+        rl.close();
+    }
+}
+function isReadlineClosedError(error) {
+    if (!(error instanceof Error)) {
+        return false;
+    }
+    const errorCode = typeof error === "object" && error !== null && "code" in error
+        ? String(error.code)
+        : "";
+    return (errorCode === "ERR_USE_AFTER_CLOSE" ||
+        /readline was closed/i.test(error.message));
+}
+/** @internal */
+export async function runOAuthFlow(forceNewLogin, signInMode) {
+    const { pkce, state, url } = await createAuthorizationFlow({ forceNewLogin });
+    let code = null;
+    let oauthServer = null;
+    try {
+        if (signInMode === "browser") {
+            try {
+                oauthServer = await startLocalOAuthServer({ state });
+            }
+            catch (serverError) {
+                log.warn("Local OAuth callback server unavailable; falling back to manual callback entry.", serverError instanceof Error
+                    ? {
+                        message: serverError.message,
+                        stack: serverError.stack,
+                        code: typeof serverError === "object" &&
+                            serverError !== null &&
+                            "code" in serverError
+                            ? String(serverError.code)
+                            : undefined,
+                    }
+                    : { error: String(serverError) });
+                oauthServer = null;
+            }
+        }
+        // Display the OAuth URL with sensitive query parameters (state,
+        // code, code_challenge, code_verifier) redacted so they do not leak
+        // into shell history, screen captures, CI transcripts, or clipboard
+        // managers. The full URL is still handed to the browser opener and
+        // the clipboard so sign-in continues to work end-to-end.
+        const displayUrl = redactOAuthUrlForLog(url);
+        if (signInMode === "browser") {
+            const opened = openBrowserUrl(url);
+            if (opened) {
+                console.log(stylePromptText(UI_COPY.oauth.browserOpened, "success"));
+            }
+            else {
+                console.log(stylePromptText(UI_COPY.oauth.browserOpenFail, "warning"));
+                console.log(`${stylePromptText(UI_COPY.oauth.goTo, "accent")} ${displayUrl}`);
+                const copied = copyTextToClipboard(url);
+                console.log(stylePromptText(copied ? UI_COPY.oauth.copyOk : UI_COPY.oauth.copyFail, copied ? "success" : "warning"));
+            }
+        }
+        else {
+            console.log(`${stylePromptText(UI_COPY.oauth.goTo, "accent")} ${displayUrl}`);
+            const copied = copyTextToClipboard(url);
+            console.log(stylePromptText(copied ? UI_COPY.oauth.copyOk : UI_COPY.oauth.copyFail, copied ? "success" : "warning"));
+        }
+        const waitingForCallback = signInMode === "browser" && oauthServer?.ready === true;
+        if (waitingForCallback && oauthServer) {
+            console.log(stylePromptText(UI_COPY.oauth.waitingCallback, "muted"));
+            const callbackResult = await oauthServer.waitForCode(state);
+            code = callbackResult?.code ?? null;
+        }
+        if (!code) {
+            console.log(stylePromptText(waitingForCallback
+                ? UI_COPY.oauth.callbackMissed
+                : signInMode === "manual"
+                    ? UI_COPY.oauth.callbackBypassed
+                    : UI_COPY.oauth.callbackUnavailable, "warning"));
+            const manualResult = await promptManualCallback(state, {
+                allowNonTty: signInMode === "manual",
+            });
+            // A parse/state failure must surface its own validation error instead
+            // of being reported as `Cancelled.` like a genuine user abort
+            // (issue #512 follow-up). Only an actual cancellation falls through to
+            // the cancelled path below.
+            if (manualResult.type === "invalid") {
+                return {
+                    type: "failed",
+                    reason: "invalid_response",
+                    message: UI_COPY.oauth.callbackInvalid,
+                };
+            }
+            if (manualResult.type === "state-mismatch") {
+                return {
+                    type: "failed",
+                    reason: "invalid_response",
+                    message: UI_COPY.oauth.callbackStateMismatch,
+                };
+            }
+            code = manualResult.type === "code" ? manualResult.code : null;
+        }
+    }
+    finally {
+        oauthServer?.close();
+    }
+    if (!code) {
+        return {
+            type: "failed",
+            reason: "unknown",
+            message: UI_COPY.oauth.cancelled,
+        };
+    }
+    return exchangeAuthorizationCode(code, pkce.verifier, REDIRECT_URI);
+}
+/** @internal */
+export async function runSignInFlow(forceNewLogin, signInMode, options = {}) {
+    if (signInMode === "device") {
+        // OpenAI owns the device-code account picker; there is no force-new-login
+        // equivalent to pass through for this mode.
+        // TODO: Thread a manager-level AbortSignal when login cancellation exists.
+        return runDeviceAuthFlow({
+            log: console.log,
+            timeoutMs: options.timeoutMs,
+            // CLI invocations rely on top-level await in scripts/codex-multi-auth.js;
+            // without keepAlive the polling timers unref and Node exits before the
+            // user can complete the browser step (issue #477).
+            keepAlive: true,
+        });
+    }
+    return runOAuthFlow(forceNewLogin, signInMode);
+}
+/** @internal */
+export async function persistAccountPool(results, replaceAll) {
+    if (results.length === 0)
+        return null;
+    return await withAccountStorageTransaction(async (loadedStorage, persist) => {
+        const stored = replaceAll ? null : loadedStorage;
+        const now = Date.now();
+        const existing = stored?.accounts ? [...stored.accounts] : [];
+        const writes = results.map((result) => {
+            const tokenAccountId = extractAccountId(result.access);
+            const accountId = resolveRequestAccountId(result.accountIdOverride, result.accountIdSource, tokenAccountId);
+            const accountIdSource = accountId
+                ? (result.accountIdSource ??
+                    (result.accountIdOverride ? "manual" : "token"))
+                : undefined;
+            return {
+                accountId,
+                accountIdSource,
+                accountLabel: result.accountLabel,
+                email: sanitizeEmail(extractAccountEmail(result.access, result.idToken)),
+                refreshToken: result.refresh,
+                accessToken: result.access,
+                expiresAt: result.expires,
+                workspaces: result.workspaces,
+                now,
+            };
+        });
+        const { accounts, activeIndex, outcome } = applyAccountPoolResults({
+            existing,
+            writes,
+            priorActiveIndex: stored?.activeIndex,
+            findMatchingAccountIndex,
+        });
+        const activeIndexByFamily = {};
+        for (const family of MODEL_FAMILIES) {
+            activeIndexByFamily[family] = activeIndex;
+        }
+        await persist({
+            version: 3,
+            accounts,
+            activeIndex,
+            activeIndexByFamily,
+        });
+        return outcome;
+    });
+}
+/** @internal */
+export async function syncSelectionToCodex(tokens) {
+    const tokenAccountId = extractAccountId(tokens.access);
+    const accountId = resolveRequestAccountId(tokens.accountIdOverride, tokens.accountIdSource, tokenAccountId);
+    const email = sanitizeEmail(extractAccountEmail(tokens.access, tokens.idToken));
+    await setCodexCliActiveSelection({
+        accountId,
+        email,
+        accessToken: tokens.access,
+        refreshToken: tokens.refresh,
+        expiresAt: tokens.expires,
+        idToken: tokens.idToken,
+    });
+}

package/dist/lib/codex-manager/manual-callback.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Classification of a manual OAuth callback entry.
+ *
+ * Splitting `invalid` and `state-mismatch` out from `cancelled` is the fix for
+ * the issue #512 follow-up: `login --manual` previously collapsed a malformed
+ * or wrong-attempt callback URL into the same `null` it used for a genuine user
+ * abort, so the CLI printed `Cancelled.` and hid the real validation error.
+ *
+ * - `code`: a valid authorization code + matching state were extracted.
+ * - `cancelled`: the user aborted (empty input, an Esc character, or one of the
+ *   cancel keywords `q`/`quit`/`cancel`/`back`).
+ * - `invalid`: the pasted value was missing the code and/or state parameter.
+ * - `state-mismatch`: the state did not match the one minted for this attempt.
+ */
+export type ManualCallbackClassification = {
+    type: "code";
+    code: string;
+} | {
+    type: "cancelled";
+} | {
+    type: "invalid";
+} | {
+    type: "state-mismatch";
+};
+/**
+ * Classify raw manual-callback input against the expected OAuth state. Pure and
+ * I/O-free so the CLI prompt and unit tests share identical behaviour.
+ *
+ * `answer` is `null` when the input stream closed before any line was read,
+ * which is treated as a cancellation.
+ */
+export declare function classifyManualCallbackInput(answer: string | null, expectedState: string): ManualCallbackClassification;
+//# sourceMappingURL=manual-callback.d.ts.map

package/dist/lib/codex-manager/manual-callback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manual-callback.d.ts","sourceRoot":"","sources":["../../../lib/codex-manager/manual-callback.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,4BAA4B,GACrC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GACrB;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GACnB;IAAE,IAAI,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAK9B;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAC1C,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,aAAa,EAAE,MAAM,GACnB,4BAA4B,CAmB9B"}

package/dist/lib/codex-manager/manual-callback.js

@@ -0,0 +1,30 @@
+import { parseAuthorizationInput } from "../auth/auth.js";
+const CANCEL_KEYWORDS = new Set(["", "q", "quit", "cancel", "back"]);
+const ESC_CHARACTER = "\u001b";
+/**
+ * Classify raw manual-callback input against the expected OAuth state. Pure and
+ * I/O-free so the CLI prompt and unit tests share identical behaviour.
+ *
+ * `answer` is `null` when the input stream closed before any line was read,
+ * which is treated as a cancellation.
+ */
+export function classifyManualCallbackInput(answer, expectedState) {
+    if (answer === null) {
+        return { type: "cancelled" };
+    }
+    if (answer.includes(ESC_CHARACTER)) {
+        return { type: "cancelled" };
+    }
+    const normalized = answer.trim().toLowerCase();
+    if (CANCEL_KEYWORDS.has(normalized)) {
+        return { type: "cancelled" };
+    }
+    const parsed = parseAuthorizationInput(answer);
+    if (!parsed.code || !parsed.state) {
+        return { type: "invalid" };
+    }
+    if (parsed.state !== expectedState) {
+        return { type: "state-mismatch" };
+    }
+    return { type: "code", code: parsed.code };
+}

package/dist/lib/codex-manager/manual-callback.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manual-callback.js","sourceRoot":"","sources":["../../../lib/codex-manager/manual-callback.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAsB1D,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;AACrE,MAAM,aAAa,GAAG,QAAQ,CAAC;AAE/B;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CAC1C,MAAqB,EACrB,aAAqB;IAErB,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAC9B,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QACpC,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAC9B,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/C,IAAI,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QACrC,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAC9B,CAAC;IACD,MAAM,MAAM,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACnC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC5B,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,KAAK,aAAa,EAAE,CAAC;QACpC,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;IACnC,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AAC5C,CAAC"}

package/dist/lib/codex-manager/persist-selected-account.d.ts

@@ -0,0 +1,24 @@
+import type { PersistedSwitchReason } from "../schemas.js";
+import { type AccountStorageV3 } from "../storage.js";
+/**
+ * Persist an explicit account selection and sync it to the Codex CLI state.
+ *
+ * Shared by the `switch` and `best` commands (injected via their deps objects)
+ * and by the login dashboard's backup-restore flow. Moved verbatim out of
+ * lib/codex-manager.ts (audit roadmap §4.1.1 phase 3).
+ */
+export declare function persistAndSyncSelectedAccount({ storage, targetIndex, parsed, switchReason, initialSyncIdToken, preserveActiveIndexByFamily, setPin, clearPin, bumpAffinityGeneration, }: {
+    storage: AccountStorageV3;
+    targetIndex: number;
+    parsed: number;
+    switchReason: PersistedSwitchReason;
+    initialSyncIdToken?: string;
+    preserveActiveIndexByFamily?: boolean;
+    setPin?: boolean;
+    clearPin?: boolean;
+    bumpAffinityGeneration?: boolean;
+}): Promise<{
+    synced: boolean;
+    wasDisabled: boolean;
+}>;
+//# sourceMappingURL=persist-selected-account.d.ts.map

package/dist/lib/codex-manager/persist-selected-account.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"persist-selected-account.d.ts","sourceRoot":"","sources":["../../../lib/codex-manager/persist-selected-account.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EACN,KAAK,gBAAgB,EAIrB,MAAM,eAAe,CAAC;AAQvB;;;;;;GAMG;AACH,wBAAsB,6BAA6B,CAAC,EACnD,OAAO,EACP,WAAW,EACX,MAAM,EACN,YAAY,EACZ,kBAAkB,EAClB,2BAAmC,EACnC,MAAc,EACd,QAAgB,EAChB,sBAA8B,GAC9B,EAAE;IACF,OAAO,EAAE,gBAAgB,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,qBAAqB,CAAC;IACpC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,2BAA2B,CAAC,EAAE,OAAO,CAAC;IACtC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,sBAAsB,CAAC,EAAE,OAAO,CAAC;CACjC,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,OAAO,CAAA;CAAE,CAAC,CAqGrD"}

package/dist/lib/codex-manager/persist-selected-account.js

@@ -0,0 +1,107 @@
+import { extractAccountEmail, extractAccountId, sanitizeEmail, } from "../accounts.js";
+import { setCodexCliActiveSelection } from "../codex-cli/writer.js";
+import { MODEL_FAMILIES } from "../prompts/codex.js";
+import { queuedRefresh } from "../refresh-queue.js";
+import { getStoragePath, readAffinityGenerationFromDisk, saveAccounts, } from "../storage.js";
+import { applyTokenAccountIdentity, hasUsableAccessToken, } from "./account-credentials.js";
+import { normalizeFailureDetail } from "./formatters/index.js";
+import { saveAccountsWithRetry } from "./forecast-report-shared.js";
+/**
+ * Persist an explicit account selection and sync it to the Codex CLI state.
+ *
+ * Shared by the `switch` and `best` commands (injected via their deps objects)
+ * and by the login dashboard's backup-restore flow. Moved verbatim out of
+ * lib/codex-manager.ts (audit roadmap §4.1.1 phase 3).
+ */
+export async function persistAndSyncSelectedAccount({ storage, targetIndex, parsed, switchReason, initialSyncIdToken, preserveActiveIndexByFamily = false, setPin = false, clearPin = false, bumpAffinityGeneration = false, }) {
+    const account = storage.accounts[targetIndex];
+    if (!account) {
+        throw new Error(`Account ${parsed} not found.`);
+    }
+    const shouldPreserveActiveIndexByFamily = preserveActiveIndexByFamily &&
+        !!storage.activeIndexByFamily &&
+        targetIndex === storage.activeIndex;
+    storage.activeIndex = targetIndex;
+    storage.activeIndexByFamily = storage.activeIndexByFamily ?? {};
+    if (shouldPreserveActiveIndexByFamily) {
+        const maxIndex = Math.max(0, storage.accounts.length - 1);
+        for (const family of MODEL_FAMILIES) {
+            const raw = storage.activeIndexByFamily[family];
+            const candidate = typeof raw === "number" && Number.isFinite(raw) ? raw : targetIndex;
+            storage.activeIndexByFamily[family] = Math.max(0, Math.min(candidate, maxIndex));
+        }
+    }
+    else {
+        storage.activeIndexByFamily = storage.activeIndexByFamily ?? {};
+        for (const family of MODEL_FAMILIES) {
+            storage.activeIndexByFamily[family] = targetIndex;
+        }
+    }
+    const wasDisabled = account.enabled === false;
+    if (wasDisabled) {
+        account.enabled = true;
+    }
+    const switchNow = Date.now();
+    let syncAccessToken = account.accessToken;
+    let syncRefreshToken = account.refreshToken;
+    let syncExpiresAt = account.expiresAt;
+    let syncIdToken = initialSyncIdToken;
+    if (!hasUsableAccessToken(account, switchNow)) {
+        const refreshResult = await queuedRefresh(account.refreshToken);
+        if (refreshResult.type === "success") {
+            const tokenAccountId = extractAccountId(refreshResult.access);
+            const nextEmail = sanitizeEmail(extractAccountEmail(refreshResult.access, refreshResult.idToken));
+            if (account.refreshToken !== refreshResult.refresh) {
+                account.refreshToken = refreshResult.refresh;
+            }
+            if (account.accessToken !== refreshResult.access) {
+                account.accessToken = refreshResult.access;
+            }
+            if (account.expiresAt !== refreshResult.expires) {
+                account.expiresAt = refreshResult.expires;
+            }
+            if (nextEmail && nextEmail !== account.email) {
+                account.email = nextEmail;
+            }
+            applyTokenAccountIdentity(account, tokenAccountId);
+            syncAccessToken = refreshResult.access;
+            syncRefreshToken = refreshResult.refresh;
+            syncExpiresAt = refreshResult.expires;
+            syncIdToken = refreshResult.idToken;
+        }
+        else {
+            console.warn(`Switch validation refresh failed for account ${parsed}: ${normalizeFailureDetail(refreshResult.message, refreshResult.reason)}.`);
+        }
+    }
+    account.lastUsed = switchNow;
+    account.lastSwitchReason = switchReason;
+    if (setPin) {
+        storage.pinnedAccountIndex = targetIndex;
+    }
+    else if (clearPin) {
+        delete storage.pinnedAccountIndex;
+    }
+    if (bumpAffinityGeneration) {
+        // Re-read the on-disk generation right before saving so concurrent CLI
+        // processes don't lose increments via lost-update on the load+mutate
+        // pair. Math.max keeps the counter monotonically increasing — extra
+        // bumps are harmless (just an additional affinity invalidation), but a
+        // missed bump can let the proxy cling to the wrong account. The save
+        // itself is serialized by withStorageLock; this only narrows the
+        // lost-update window. See issue #474.
+        const diskGeneration = readAffinityGenerationFromDisk(getStoragePath());
+        const inMemoryGeneration = storage.affinityGeneration ?? 0;
+        storage.affinityGeneration =
+            Math.max(inMemoryGeneration, diskGeneration) + 1;
+    }
+    await saveAccountsWithRetry(storage, saveAccounts);
+    const synced = await setCodexCliActiveSelection({
+        accountId: account.accountId,
+        email: account.email,
+        accessToken: syncAccessToken,
+        refreshToken: syncRefreshToken,
+        expiresAt: syncExpiresAt,
+        ...(syncIdToken ? { idToken: syncIdToken } : {}),
+    });
+    return { synced, wasDisabled };
+}

package/dist/lib/codex-manager/quota-cache-helpers.d.ts

@@ -0,0 +1,18 @@
+import { type QuotaCacheData, type QuotaCacheEntry } from "../quota-cache.js";
+import type { CodexQuotaSnapshot } from "../quota-probe.js";
+import type { AccountMetadataV3 } from "../storage.js";
+/**
+ * Quota-cache lookup/update helpers shared by the manager CLI commands (audit
+ * roadmap §4.1.1 phase 3). These previously lived as module-private helpers in
+ * lib/codex-manager.ts and were closure-captured by the health check, the
+ * forecast/repair dependency factories, and the login dashboard menu. Moved
+ * verbatim so every consumer injects or imports the same single
+ * implementation.
+ */
+/** Default model used for live quota probes across manager commands. */
+export declare const DEFAULT_LIVE_PROBE_MODEL = "gpt-5.5";
+export declare function getPersistedQuotaViewForAccount(cache: QuotaCacheData | null, account: Pick<AccountMetadataV3, "accountId" | "email" | "rateLimitResetTimes">, accounts: readonly Pick<AccountMetadataV3, "accountId" | "email">[], now: number, emailFallbackState?: ReadonlyMap<string, import("../quota-readiness.js").QuotaEmailFallbackState>): QuotaCacheEntry | null;
+export declare function updateQuotaCacheForAccount(cache: QuotaCacheData, account: Pick<AccountMetadataV3, "accountId" | "email">, snapshot: CodexQuotaSnapshot, accounts: readonly Pick<AccountMetadataV3, "accountId" | "email">[], emailFallbackState?: ReadonlyMap<string, import("../quota-readiness.js").QuotaEmailFallbackState>): boolean;
+export declare function cloneQuotaCacheData(cache: QuotaCacheData): QuotaCacheData;
+export declare function pruneUnsafeQuotaEmailCacheEntry(cache: QuotaCacheData, email: string | undefined, accounts: readonly Pick<AccountMetadataV3, "accountId" | "email">[], emailFallbackState?: ReadonlyMap<string, import("../quota-readiness.js").QuotaEmailFallbackState>): boolean;
+//# sourceMappingURL=quota-cache-helpers.d.ts.map

package/dist/lib/codex-manager/quota-cache-helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"quota-cache-helpers.d.ts","sourceRoot":"","sources":["../../../lib/codex-manager/quota-cache-helpers.ts"],"names":[],"mappings":"AAOA,OAAO,EACN,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAG5D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAEvD;;;;;;;GAOG;AAEH,wEAAwE;AACxE,eAAO,MAAM,wBAAwB,YAAgB,CAAC;AA2BtD,wBAAgB,+BAA+B,CAC9C,KAAK,EAAE,cAAc,GAAG,IAAI,EAC5B,OAAO,EAAE,IAAI,CACZ,iBAAiB,EACjB,WAAW,GAAG,OAAO,GAAG,qBAAqB,CAC7C,EACD,QAAQ,EAAE,SAAS,IAAI,CAAC,iBAAiB,EAAE,WAAW,GAAG,OAAO,CAAC,EAAE,EACnE,GAAG,EAAE,MAAM,EACX,kBAAkB,+EAAyC,GACzD,eAAe,GAAG,IAAI,CA+BxB;AAED,wBAAgB,0BAA0B,CACzC,KAAK,EAAE,cAAc,EACrB,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,WAAW,GAAG,OAAO,CAAC,EACvD,QAAQ,EAAE,kBAAkB,EAC5B,QAAQ,EAAE,SAAS,IAAI,CAAC,iBAAiB,EAAE,WAAW,GAAG,OAAO,CAAC,EAAE,EACnE,kBAAkB,+EAAyC,GACzD,OAAO,CAuCT;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,cAAc,GAAG,cAAc,CAOzE;AAED,wBAAgB,+BAA+B,CAC9C,KAAK,EAAE,cAAc,EACrB,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,QAAQ,EAAE,SAAS,IAAI,CAAC,iBAAiB,EAAE,WAAW,GAAG,OAAO,CAAC,EAAE,EACnE,kBAAkB,+EAAyC,GACzD,OAAO,CAeT"}