codex-multi-auth 2.8.7 → 2.9.1

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-multi-auth",
-	"version": "2.8.7",
+	"version": "2.9.1",
   "description": "Install and operate codex-multi-auth for the official @openai/codex CLI with multi-account OAuth rotation, switching, health checks, and recovery tools.",
   "interface": {
     "composerIcon": "./assets/codex-multi-auth-icon.svg"

package/README.md

@@ -161,6 +161,19 @@ codex-multi-auth forecast --live
 
 If browser launch is blocked, use the alternate login paths in [docs/getting-started.md](docs/getting-started.md#alternate-login-paths).
 For remote or headless shells, prefer `codex-multi-auth login --device-auth`.
+To refresh one saved account without changing the active selection or manual
+pin, run:
+
+```bash
+codex-multi-auth login --account <index|email|account_id> --preserve-selection
+```
+
+Add `--device-auth` on a remote shell. The refreshed OAuth identity must match
+the requested saved account or nothing is written. Refreshing the account Codex
+is currently using still publishes its new tokens to the native CLI; refreshing
+any other account leaves the active selection and the manual pin untouched. A
+disabled account stays disabled. `--account` cannot be combined with `--org`,
+which would rebind the row to a different workspace.
 
 ---
 
@@ -392,7 +405,7 @@ codex-multi-auth doctor --json
 
 ## Release Notes
 
-- Current stable: [docs/releases/v2.8.7.md](docs/releases/v2.8.7.md) — install via `npm i -g codex-multi-auth`
+- Current stable: [docs/releases/v2.9.1.md](docs/releases/v2.9.1.md) — install via `npm i -g codex-multi-auth`
 - Previous stable: [docs/releases/v2.8.3.md](docs/releases/v2.8.3.md)
 - Previous stable: [docs/releases/v2.8.2.md](docs/releases/v2.8.2.md)
 - Previous stable: [docs/releases/v2.7.1.md](docs/releases/v2.7.1.md)

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAe,MAAM,kBAAkB,CAAC;AA2V5D;;;;;;;;;;;;;;;GAeG;AAEH,eAAO,MAAM,iBAAiB,EAAE,MA2uI/B,CAAC;AAEF,eAAO,MAAM,gBAAgB,KAAoB,CAAC;AAElD,eAAe,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAe,MAAM,kBAAkB,CAAC;AAoW5D;;;;;;;;;;;;;;;GAeG;AAEH,eAAO,MAAM,iBAAiB,EAAE,MAuwI/B,CAAC;AAEF,eAAO,MAAM,gBAAgB,KAAoB,CAAC;AAElD,eAAe,iBAAiB,CAAC"}

package/dist/index.js

@@ -38,6 +38,14 @@ import { LiveAccountSync } from "./lib/live-account-sync.js";
 import { clearCorrelationId, initLogger, logDebug, logError, logInfo, logRequest, logWarn, setCorrelationId, } from "./lib/logger.js";
 import { PreemptiveQuotaScheduler, readQuotaSchedulerSnapshot, } from "./lib/preemptive-quota-scheduler.js";
 import { createRuntimeUsageRecorder, evaluateRuntimePolicy, loadRuntimePolicyState, } from "./lib/policy/runtime-policy.js";
+import { createStreamUsageDeferral } from "./lib/usage/stream-usage-deferral.js";
+/**
+ * How long a streaming request's usage-ledger row may wait for the upstream
+ * `usage` event before it is written without token counts. Long enough not to
+ * truncate a genuinely slow completion; the timer is unref'd so it never holds
+ * the process open. See createStreamUsageDeferral.
+ */
+const USAGE_STREAM_RECORD_FALLBACK_MS = 15 * 60_000;
 import { getModelFamily, MODEL_FAMILIES, prewarmCodexInstructions, } from "./lib/prompts/codex.js";
 import { prewarmHostCodexPrompt } from "./lib/prompts/host-codex-prompt.js";
 import { fetchCodexQuotaSnapshot, formatQuotaSnapshotLine, } from "./lib/quota-probe.js";
@@ -546,6 +554,18 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                         async fetch(input, init) {
                             let usageRecorder = null;
                             let usageCompletion = null;
+                            // A non-streaming response reports its token counts while
+                            // handleSuccessResponse is still assembling the body, so they
+                            // are folded straight into usageCompletion below. A streaming
+                            // one reports them only as the client drains the body, long
+                            // after the `finally` that writes the row — so that row is
+                            // handed to the deferral instead of written empty.
+                            const usageDeferral = createStreamUsageDeferral({
+                                record: (completion) => {
+                                    void usageRecorder?.record(completion);
+                                },
+                                fallbackMs: USAGE_STREAM_RECORD_FALLBACK_MS,
+                            });
                             try {
                                 if (cachedAccountManager &&
                                     cachedAccountManager !== accountManager) {
@@ -1594,6 +1614,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                                     sessionAffinityStore?.updateLastResponseId(sessionAffinityKey, responseId, Date.now(), sessionAffinityVersion);
                                                     storedResponseIdForSuccess = true;
                                                 },
+                                                onUsage: usageDeferral.onUsage,
                                                 streamStallTimeoutMs,
                                             });
                                             if (!isStreaming && emptyResponseMaxRetries > 0) {
@@ -1679,7 +1700,20 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                                     accountId: successAccountForResponse.accountId ?? null,
                                                     email: successAccountForResponse.email ?? null,
                                                 },
+                                                // Already known for a non-streaming response, which
+                                                // reported its usage while the body was being
+                                                // assembled above.
+                                                ...(usageDeferral.captured() ?? {}),
                                             };
+                                            if (isStreaming && !usageDeferral.captured()) {
+                                                // Writing the row in the `finally` below would stamp
+                                                // zero tokens — the client has not read a byte yet —
+                                                // and the ledger is append-only, so the real counts
+                                                // could never correct it. Zero tokens is exactly what
+                                                // left maxTokens / maxCostUsd unenforceable here.
+                                                usageDeferral.defer(usageCompletion);
+                                                usageCompletion = null;
+                                            }
                                             if (lastCodexCliActiveSyncIndex !==
                                                 successAccountForResponse.index) {
                                                 void accountManager.syncCodexCliActiveSelectionForIndex(successAccountForResponse.index);

package/dist/lib/account-policy.d.ts

@@ -13,7 +13,9 @@ export interface AccountPolicyStore {
     accounts: Record<string, AccountPolicy>;
 }
 export declare function getAccountPolicyPath(): string;
-export declare function getAccountPolicyKey(account: Pick<AccountMetadataV3, "accountId" | "email">, _index?: number): string;
+export declare function getAccountPolicyKey(account: Pick<AccountMetadataV3, "accountId" | "email"> & {
+    refreshToken?: string | null;
+}, _index?: number): string;
 export declare function loadAccountPolicyStore(): Promise<AccountPolicyStore>;
 export declare function saveAccountPolicyStore(store: AccountPolicyStore): Promise<void>;
 export declare function upsertAccountPolicy(store: AccountPolicyStore, accountKey: string, mutate: (policy: AccountPolicy) => void, now?: number): AccountPolicy;

package/dist/lib/account-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account-policy.d.ts","sourceRoot":"","sources":["../../lib/account-policy.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAItD,MAAM,WAAW,aAAa;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IAClC,OAAO,EAAE,CAAC,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;CACxC;AAkFD,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAED,wBAAgB,mBAAmB,CAClC,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,WAAW,GAAG,OAAO,CAAC,EACvD,MAAM,CAAC,EAAE,MAAM,GACb,MAAM,CAMR;AAED,wBAAsB,sBAAsB,IAAI,OAAO,CAAC,kBAAkB,CAAC,CAa1E;AAED,wBAAsB,sBAAsB,CAC3C,KAAK,EAAE,kBAAkB,GACvB,OAAO,CAAC,IAAI,CAAC,CAsCf;AAED,wBAAgB,mBAAmB,CAClC,KAAK,EAAE,kBAAkB,EACzB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,IAAI,EACvC,GAAG,SAAa,GACd,aAAa,CAgBf;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAEtE;AAED,wBAAgB,oCAAoC,IAAI,IAAI,CAE3D"}
+{"version":3,"file":"account-policy.d.ts","sourceRoot":"","sources":["../../lib/account-policy.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAItD,MAAM,WAAW,aAAa;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IAClC,OAAO,EAAE,CAAC,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;CACxC;AAkFD,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAED,wBAAgB,mBAAmB,CAClC,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,WAAW,GAAG,OAAO,CAAC,GAAG;IACzD,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B,EACD,MAAM,CAAC,EAAE,MAAM,GACb,MAAM,CAmBR;AAED,wBAAsB,sBAAsB,IAAI,OAAO,CAAC,kBAAkB,CAAC,CAa1E;AAED,wBAAsB,sBAAsB,CAC3C,KAAK,EAAE,kBAAkB,GACvB,OAAO,CAAC,IAAI,CAAC,CAsCf;AAED,wBAAgB,mBAAmB,CAClC,KAAK,EAAE,kBAAkB,EACzB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,IAAI,EACvC,GAAG,SAAa,GACd,aAAa,CAgBf;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAEtE;AAED,wBAAgB,oCAAoC,IAAI,IAAI,CAE3D"}

package/dist/lib/account-policy.js

@@ -81,9 +81,22 @@ export function getAccountPolicyPath() {
     return join(getCodexMultiAuthDir(), ACCOUNT_POLICY_FILE_NAME);
 }
 export function getAccountPolicyKey(account, _index) {
+    // The key must be stable across processes and independent of the account's
+    // slot (policy state is persisted and survives reordering), so it is derived
+    // from identity, never from `_index`.
+    //
+    // An account whose accountId AND email are both missing — freshly imported,
+    // or not yet hydrated from its token — used to hash the literal "unknown",
+    // which gave EVERY such account the same key: pausing, draining or tagging
+    // one silently applied to all of them. Fall back to the refresh token
+    // instead, which every account has and no two accounts share. It is
+    // namespaced before hashing so a token value can never collide with an
+    // email or accountId of the same text, and only its digest is persisted.
+    // Mirrors getAccountIdentityKey's `allowRefreshFallback`.
+    const refreshFallback = account.refreshToken?.trim();
     const identity = account.accountId?.trim() ||
         account.email?.trim().toLowerCase() ||
-        "unknown";
+        (refreshFallback ? `refresh:${refreshFallback}` : "unknown");
     return `sha256:${createHash("sha256").update(identity).digest("hex")}`;
 }
 export async function loadAccountPolicyStore() {

package/dist/lib/budget-guard.d.ts

@@ -21,6 +21,7 @@ export interface BudgetGuardEvaluation {
         requests: number;
         totalTokens: number;
         costUsd: number;
+        unpricedRequests: number;
     };
     limits: {
         maxRequests: number | null;

package/dist/lib/budget-guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"budget-guard.d.ts","sourceRoot":"","sources":["../../lib/budget-guard.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAIrD,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,OAAO,CAAC;AAE7D,MAAM,WAAW,WAAW;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,YAAY,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAChC,OAAO,EAAE,CAAC,CAAC;IACX,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,qBAAqB;IACrC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,YAAY,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,EAAE;QACN,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,OAAO,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,MAAM,EAAE;QACP,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;KAC1B,CAAC;CACF;AA6ED,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAE/D;AAED,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAatE;AAED,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsCjF;AAED,wBAAgB,iBAAiB,CAChC,KAAK,EAAE,gBAAgB,EACvB,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,EACrC,GAAG,SAAa,GACd,WAAW,CAOb;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,SAAa,GAAG,MAAM,CAoBnF;AAED,wBAAgB,mBAAmB,CAClC,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE,YAAY,GACnB,qBAAqB,CAsCvB;AAED,wBAAgB,kCAAkC,IAAI,IAAI,CAEzD"}
+{"version":3,"file":"budget-guard.d.ts","sourceRoot":"","sources":["../../lib/budget-guard.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAIrD,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,OAAO,CAAC;AAE7D,MAAM,WAAW,WAAW;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,YAAY,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAChC,OAAO,EAAE,CAAC,CAAC;IACX,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,qBAAqB;IACrC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,YAAY,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,EAAE;QACN,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,OAAO,EAAE,MAAM,CAAC;QAChB,gBAAgB,EAAE,MAAM,CAAC;KACzB,CAAC;IACF,MAAM,EAAE;QACP,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;KAC1B,CAAC;CACF;AA6ED,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAE/D;AAED,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAatE;AAED,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsCjF;AAED,wBAAgB,iBAAiB,CAChC,KAAK,EAAE,gBAAgB,EACvB,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,EACrC,GAAG,SAAa,GACd,WAAW,CAOb;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,SAAa,GAAG,MAAM,CAoBnF;AAED,wBAAgB,mBAAmB,CAClC,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE,YAAY,GACnB,qBAAqB,CA+CvB;AAED,wBAAgB,kCAAkC,IAAI,IAAI,CAEzD"}

package/dist/lib/budget-guard.js

@@ -175,9 +175,18 @@ export function evaluateBudgetGuard(limit, summary) {
         summary.totals.totalTokens >= limit.maxTokens) {
         reasons.push(`token limit reached (${summary.totals.totalTokens}/${limit.maxTokens})`);
     }
-    if (typeof limit.maxCostUsd === "number" &&
-        summary.totals.costUsd >= limit.maxCostUsd) {
-        reasons.push(`cost limit reached (${summary.totals.costUsd.toFixed(6)}/${limit.maxCostUsd.toFixed(6)})`);
+    if (typeof limit.maxCostUsd === "number") {
+        if (summary.totals.costUsd >= limit.maxCostUsd) {
+            reasons.push(`cost limit reached (${summary.totals.costUsd.toFixed(6)}/${limit.maxCostUsd.toFixed(6)})`);
+        }
+        else if ((summary.totals.unpricedRequests ?? 0) > 0) {
+            // The window contains token usage we have no rate for, so `costUsd` is
+            // an under-count by an unknown amount and this limit cannot be
+            // evaluated. Counting unknown cost as zero is what made a cost budget
+            // silently unenforceable for every unpriced model; an unevaluable spend
+            // limit fails closed instead. Priced models are unaffected.
+            reasons.push(`cost limit cannot be evaluated: ${summary.totals.unpricedRequests} request(s) in this window used a model with no known price, so recorded cost (${summary.totals.costUsd.toFixed(6)}) is incomplete. Price the model in lib/usage/pricing.ts, or budget on --requests/--tokens instead of --cost.`);
+        }
     }
     return {
         key: limit.key,
@@ -188,6 +197,7 @@ export function evaluateBudgetGuard(limit, summary) {
             requests: summary.totals.requests,
             totalTokens: summary.totals.totalTokens,
             costUsd: summary.totals.costUsd,
+            unpricedRequests: summary.totals.unpricedRequests,
         },
         limits: {
             maxRequests: limit.maxRequests ?? null,

package/dist/lib/codex-manager/account-pool-write.d.ts

@@ -30,6 +30,14 @@ export interface ResolvedAccountWrite {
     accessToken?: string;
     expiresAt?: number;
     workspaces?: Workspace[];
+    /**
+     * Keep the saved row's `enabled` flag instead of re-enabling it. A targeted
+     * re-authentication only tops up credentials for a row the user named, so it
+     * must not pull a deliberately disabled account back into rotation behind
+     * their back. A plain login still re-enables: signing in is the user asking
+     * for that account to be usable again.
+     */
+    preserveEnabledState?: boolean;
     now: number;
 }
 /**

package/dist/lib/codex-manager/account-pool-write.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account-pool-write.d.ts","sourceRoot":"","sources":["../../../lib/codex-manager/account-pool-write.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAEpE;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,uBAAuB,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;AAEzE;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACpC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;IACvD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;IACzB,GAAG,EAAE,MAAM,CAAC;CACZ;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACxC,UAAU,EAAE,SAAS,EAAE,EACvB,SAAS,EAAE,MAAM,GAAG,SAAS,GAC3B,MAAM,CAWR;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACrC,QAAQ,EAAE,IAAI,CAAC,iBAAiB,EAAE,YAAY,CAAC,EAC/C,QAAQ,EAAE,SAAS,EAAE,GAAG,SAAS,GAC/B,SAAS,EAAE,GAAG,SAAS,CAYzB;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAC3C,QAAQ,EAAE,IAAI,CAAC,iBAAiB,EAAE,YAAY,GAAG,uBAAuB,CAAC,EACzE,gBAAgB,EAAE,SAAS,EAAE,GAAG,SAAS,GACvC,MAAM,GAAG,SAAS,CAwBpB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CACnC,KAAK,EAAE,oBAAoB,GACzB;IAAE,OAAO,EAAE,iBAAiB,CAAC;IAAC,OAAO,EAAE,UAAU,CAAA;CAAE,CAwBrD;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAClC,QAAQ,EAAE,iBAAiB,EAC3B,KAAK,EAAE,oBAAoB,GACzB;IAAE,OAAO,EAAE,iBAAiB,CAAC;IAAC,OAAO,EAAE,SAAS,GAAG,SAAS,CAAA;CAAE,CA+ChE;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE;IAC/C,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,wBAAwB,EAAE,CACzB,QAAQ,EAAE,iBAAiB,EAAE,EAC7B,QAAQ,EAAE;QACT,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,YAAY,CAAC,EAAE,MAAM,CAAC;KACtB,EACD,OAAO,EAAE;QAAE,wCAAwC,EAAE,OAAO,CAAA;KAAE,KAC1D,MAAM,GAAG,SAAS,CAAC;CACxB,GAAG;IACH,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,uBAAuB,GAAG,IAAI,CAAC;CACxC,CA6CA"}
+{"version":3,"file":"account-pool-write.d.ts","sourceRoot":"","sources":["../../../lib/codex-manager/account-pool-write.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAEpE;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,uBAAuB,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;AAEzE;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACpC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;IACvD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;IACzB;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,GAAG,EAAE,MAAM,CAAC;CACZ;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACxC,UAAU,EAAE,SAAS,EAAE,EACvB,SAAS,EAAE,MAAM,GAAG,SAAS,GAC3B,MAAM,CAWR;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACrC,QAAQ,EAAE,IAAI,CAAC,iBAAiB,EAAE,YAAY,CAAC,EAC/C,QAAQ,EAAE,SAAS,EAAE,GAAG,SAAS,GAC/B,SAAS,EAAE,GAAG,SAAS,CAYzB;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAC3C,QAAQ,EAAE,IAAI,CAAC,iBAAiB,EAAE,YAAY,GAAG,uBAAuB,CAAC,EACzE,gBAAgB,EAAE,SAAS,EAAE,GAAG,SAAS,GACvC,MAAM,GAAG,SAAS,CAwBpB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CACnC,KAAK,EAAE,oBAAoB,GACzB;IAAE,OAAO,EAAE,iBAAiB,CAAC;IAAC,OAAO,EAAE,UAAU,CAAA;CAAE,CAwBrD;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAClC,QAAQ,EAAE,iBAAiB,EAC3B,KAAK,EAAE,oBAAoB,GACzB;IAAE,OAAO,EAAE,iBAAiB,CAAC;IAAC,OAAO,EAAE,SAAS,GAAG,SAAS,CAAA;CAAE,CA+ChE;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE;IAC/C,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,wBAAwB,EAAE,CACzB,QAAQ,EAAE,iBAAiB,EAAE,EAC7B,QAAQ,EAAE;QACT,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,YAAY,CAAC,EAAE,MAAM,CAAC;KACtB,EACD,OAAO,EAAE;QAAE,wCAAwC,EAAE,OAAO,CAAA;KAAE,KAC1D,MAAM,GAAG,SAAS,CAAC;CACxB,GAAG;IACH,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,uBAAuB,GAAG,IAAI,CAAC;CACxC,CA6CA"}

package/dist/lib/codex-manager/account-pool-write.js

@@ -115,7 +115,7 @@ export function buildUpdatedAccount(existing, write) {
             refreshToken: write.refreshToken,
             accessToken: write.accessToken,
             expiresAt: write.expiresAt,
-            enabled: true,
+            enabled: write.preserveEnabledState ? existing.enabled : true,
             authInvalidatedAt: undefined,
             authInvalidationErrorCode: undefined,
             lastUsed: write.now,

package/dist/lib/codex-manager/help.d.ts

@@ -2,7 +2,9 @@ export declare function printUsage(): void;
 export type AuthLoginOptions = {
     manual: boolean;
     deviceAuth: boolean;
+    preserveSelection?: boolean;
     org?: string;
+    account?: string;
 };
 export type ParsedAuthLoginArgs = {
     ok: true;

package/dist/lib/codex-manager/help.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"help.d.ts","sourceRoot":"","sources":["../../../lib/codex-manager/help.ts"],"names":[],"mappings":"AAIA,wBAAgB,UAAU,IAAI,IAAI,CAsDjC;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC9B,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAC5B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,gBAAgB,CAAA;CAAE,GACvC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC7B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,mBAAmB,CAgEtE;AAED,UAAU,cAAc;IACvB,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,MAAM,cAAc,GACvB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,cAAc,CAAA;CAAE,GACrC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC7B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnD,wBAAgB,cAAc,IAAI,IAAI,CAgBrC;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,cAAc,CAyD5D"}
+{"version":3,"file":"help.d.ts","sourceRoot":"","sources":["../../../lib/codex-manager/help.ts"],"names":[],"mappings":"AAIA,wBAAgB,UAAU,IAAI,IAAI,CAsDjC;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC9B,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;IACpB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAC5B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,gBAAgB,CAAA;CAAE,GACvC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC7B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,mBAAmB,CAuGtE;AAED,UAAU,cAAc;IACvB,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,MAAM,cAAc,GACvB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,cAAc,CAAA;CAAE,GACrC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC7B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnD,wBAAgB,cAAc,IAAI,IAAI,CAgBrC;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,cAAc,CAyD5D"}

package/dist/lib/codex-manager/help.js

@@ -5,7 +5,7 @@ export function printUsage() {
         "Codex Multi-Auth CLI",
         "",
         "Start here:",
-        "  codex-multi-auth login [--device-auth|--manual|--no-browser] [--org <org_id>]",
+        "  codex-multi-auth login [--device-auth|--manual|--no-browser] [--org <org_id>] [--preserve-selection] [--account <index|email|account_id>]",
         "  codex-multi-auth status [--json]   (list is the same command)",
         "  codex-multi-auth check            (always live-probes)",
         "",
@@ -72,6 +72,33 @@ export function parseAuthLoginArgs(args) {
             options.deviceAuth = true;
             continue;
         }
+        if (arg === "--preserve-selection") {
+            options.preserveSelection = true;
+            continue;
+        }
+        if (arg === "--account" || arg?.startsWith("--account=")) {
+            let value;
+            if (arg === "--account") {
+                value = args[i + 1];
+                i += 1;
+            }
+            else {
+                value = arg.slice("--account=".length);
+            }
+            const trimmed = value?.trim();
+            if (!trimmed || trimmed.startsWith("--")) {
+                return {
+                    ok: false,
+                    reason: "error",
+                    message: "Missing value for --account. Usage: codex-multi-auth login --account <index|email|account_id>",
+                };
+            }
+            options.account = trimmed;
+            // A targeted re-auth must never select the refreshed account as a
+            // side effect, even if the caller omits the redundant safety flag.
+            options.preserveSelection = true;
+            continue;
+        }
         if (arg === "--org" || arg?.startsWith("--org=")) {
             // Bind this login to a specific workspace/org id (issue #491). Reuses
             // the CODEX_AUTH_ACCOUNT_ID override mechanism so the same email's
@@ -112,6 +139,16 @@ export function parseAuthLoginArgs(args) {
             message: `Cannot combine --device-auth with ${conflict}`,
         };
     }
+    // --org rebinds a login to a different workspace, which is exactly the
+    // identity change a targeted re-auth is built to refuse. Rejecting the pair
+    // up front beats failing after the user has already completed a sign-in.
+    if (options.account && options.org) {
+        return {
+            ok: false,
+            reason: "error",
+            message: "Cannot combine --account with --org. Re-authenticate the saved account on its own workspace, or register the other workspace with --org on its own.",
+        };
+    }
     return { ok: true, options };
 }
 export function printBestUsage() {

package/dist/lib/codex-manager/login-flow.d.ts

@@ -1,3 +1,4 @@
+import { type AccountMetadataV3, type AccountStorageV3 } from "../storage.js";
 import { type RepairCommandDeps } from "./repair-commands.js";
 /**
  * Interactive control loop for the `login` command: the account dashboard menu
@@ -13,5 +14,7 @@ export interface LoginFlowDeps {
     createRepairCommandDeps(): RepairCommandDeps;
 }
 /** @internal */
+export declare function resolveLoginAccountTarget(storage: AccountStorageV3, identifier: string): AccountMetadataV3 | null;
+/** @internal */
 export declare function runAuthLogin(args: string[], deps: LoginFlowDeps): Promise<number>;
 //# sourceMappingURL=login-flow.d.ts.map

package/dist/lib/codex-manager/login-flow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login-flow.d.ts","sourceRoot":"","sources":["../../../lib/codex-manager/login-flow.ts"],"names":[],"mappings":"AAmDA,OAAO,EACN,KAAK,iBAAiB,EAGtB,MAAM,sBAAsB,CAAC;AAM9B;;;;;;;GAOG;AAEH,gBAAgB;AAChB,MAAM,WAAW,aAAa;IAC7B,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7C,uBAAuB,IAAI,iBAAiB,CAAC;CAC7C;AAkCD,gBAAgB;AAChB,wBAAsB,YAAY,CACjC,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,EAAE,aAAa,GACjB,OAAO,CAAC,MAAM,CAAC,CAqBjB"}
+{"version":3,"file":"login-flow.d.ts","sourceRoot":"","sources":["../../../lib/codex-manager/login-flow.ts"],"names":[],"mappings":"AAQA,OAAO,EACN,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EAUrB,MAAM,eAAe,CAAC;AAmCvB,OAAO,EACN,KAAK,iBAAiB,EAGtB,MAAM,sBAAsB,CAAC;AAM9B;;;;;;;GAOG;AAEH,gBAAgB;AAChB,MAAM,WAAW,aAAa;IAC7B,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7C,uBAAuB,IAAI,iBAAiB,CAAC;CAC7C;AAkCD,gBAAgB;AAChB,wBAAgB,yBAAyB,CACxC,OAAO,EAAE,gBAAgB,EACzB,UAAU,EAAE,MAAM,GAChB,iBAAiB,GAAG,IAAI,CAkB1B;AAED,gBAAgB;AAChB,wBAAsB,YAAY,CACjC,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,EAAE,aAAa,GACjB,OAAO,CAAC,MAAM,CAAC,CAqBjB"}

package/dist/lib/codex-manager/login-flow.js

@@ -1,3 +1,4 @@
+import { sanitizeEmail } from "../accounts.js";
 import { isBrowserLaunchSuppressed } from "../auth/browser.js";
 import { promptAddAnotherAccount, promptLoginMode } from "../cli.js";
 import { ACCOUNT_LIMITS } from "../constants.js";
@@ -6,6 +7,7 @@ import { createLogger } from "../logger.js";
 import { loadQuotaCache } from "../quota-cache.js";
 import { resolveActiveIndex } from "../runtime/account-status.js";
 import { clearAccounts, formatStorageErrorHint, getNamedBackups, loadAccounts, loadFlaggedAccounts, restoreAccountsFromBackup, setStoragePath, StorageError, } from "../storage.js";
+import { CodexValidationError } from "../errors.js";
 import { UI_COPY } from "../ui/ui-copy.js";
 import { confirm } from "../ui/confirm.js";
 import { stylePromptText } from "./formatters/index.js";
@@ -38,6 +40,23 @@ async function clearAccountsAndReset() {
     await clearAccounts();
 }
 /** @internal */
+export function resolveLoginAccountTarget(storage, identifier) {
+    if (/^[1-9]\d*$/.test(identifier)) {
+        const byIndex = storage.accounts[Number(identifier) - 1];
+        return byIndex ?? null;
+    }
+    const byAccountId = storage.accounts.filter((account) => account.accountId === identifier);
+    if (byAccountId.length === 1)
+        return byAccountId[0] ?? null;
+    if (byAccountId.length > 1)
+        return null;
+    const email = sanitizeEmail(identifier);
+    if (!email)
+        return null;
+    const byEmail = storage.accounts.filter((account) => sanitizeEmail(account.email) === email);
+    return byEmail.length === 1 ? (byEmail[0] ?? null) : null;
+}
+/** @internal */
 export async function runAuthLogin(args, deps) {
     const parsedArgs = parseAuthLoginArgs(args);
     if (!parsedArgs.ok) {
@@ -197,7 +216,10 @@ async function runAuthLoginFlow(loginOptions, deps) {
     // (--device-auth, --manual, --no-browser), they want to add a new account
     // directly. Skipping the dashboard menu keeps `login --device-auth`
     // usable from scripts and matches the documented behavior of the help text.
-    const explicitSignInMode = loginOptions.deviceAuth || loginOptions.manual;
+    const explicitSignInMode = loginOptions.deviceAuth ||
+        loginOptions.manual ||
+        loginOptions.preserveSelection ||
+        Boolean(loginOptions.account);
     loginFlow: while (true) {
         const existingStorage = await loadAccounts();
         if (!explicitSignInMode &&
@@ -210,6 +232,23 @@ async function runAuthLoginFlow(loginOptions, deps) {
         }
         const refreshedStorage = await loadAccounts();
         let existingCount = refreshedStorage?.accounts.length ?? 0;
+        const expectedAccount = loginOptions.account
+            ? refreshedStorage
+                ? resolveLoginAccountTarget(refreshedStorage, loginOptions.account)
+                : null
+            : undefined;
+        if (loginOptions.account && !expectedAccount) {
+            console.error("The requested Codex account is missing or ambiguous. No login was started.");
+            return 1;
+        }
+        // Positional hint for the write, re-verified (never trusted) inside the
+        // storage transaction. resolveLoginAccountTarget hands back a row out of
+        // this very array, so indexOf is an exact identity lookup.
+        const expectedAccountIndex = expectedAccount && refreshedStorage
+            ? refreshedStorage.accounts.indexOf(expectedAccount)
+            : -1;
+        // A non-empty pool already forces a fresh sign-in, and a resolved target
+        // implies the pool was non-empty, so it adds no condition of its own.
         let forceNewLogin = existingCount > 0;
         let onboardingBackupDiscoveryWarning = null;
         const loadNamedBackupsForOnboarding = async () => {
@@ -290,6 +329,13 @@ async function runAuthLoginFlow(loginOptions, deps) {
                             parsed: targetIndex + 1,
                             switchReason: "restore",
                             preserveActiveIndexByFamily: true,
+                            // A restore replaces the whole account list, so every
+                            // index moves. Session affinity remembers accounts BY
+                            // INDEX, so without this a live proxy keeps routing
+                            // in-flight sessions to whatever now occupies the old
+                            // slot. `switch`/`best` already bump for a single
+                            // move; a restore moves everything. See issue #474.
+                            bumpAffinityGeneration: true,
                         });
                         console.log(UI_COPY.oauth.restoreBackupLoaded(selectedBackup.fileName, restoredStorage.accounts.length));
                         if (!synced) {
@@ -339,9 +385,31 @@ async function runAuthLoginFlow(loginOptions, deps) {
                 console.error(`Login failed: ${tokenResult.message ?? tokenResult.reason ?? "unknown error"}`);
                 return 1;
             }
-            const resolved = resolveAccountSelection(tokenResult, loginOptions.org);
-            const persistOutcome = await persistAccountPool([resolved], false);
-            await syncSelectionToCodex(resolved);
+            const resolved = resolveAccountSelection(tokenResult, loginOptions.org, expectedAccount?.accountId);
+            let persistResult;
+            try {
+                persistResult = await persistAccountPool([resolved], false, {
+                    preserveSelection: loginOptions.preserveSelection,
+                    expectedAccount: expectedAccount ?? undefined,
+                    expectedAccountIndex: expectedAccountIndex >= 0 ? expectedAccountIndex : undefined,
+                });
+            }
+            catch (error) {
+                if (error instanceof CodexValidationError) {
+                    console.error(`Re-authentication failed: ${error.message}`);
+                    return 1;
+                }
+                throw error;
+            }
+            // Publish to ~/.codex/auth.json exactly when this write owns the
+            // selection. Skipping the sync whenever --preserve-selection was passed
+            // stranded the native CLI on the expired tokens of the very account the
+            // user had just refreshed, and nothing downstream repaired it: the
+            // drift check compares identity, not tokens, so a same-identity refresh
+            // never looks like drift.
+            if (!persistResult || persistResult.isActiveAccount) {
+                await syncSelectionToCodex(resolved);
+            }
             const latestStorage = await loadAccounts();
             const count = latestStorage?.accounts.length ?? 1;
             existingCount = count;
@@ -350,16 +418,22 @@ async function runAuthLoginFlow(loginOptions, deps) {
             // Only claim a new saved slot when one was actually appended. A
             // same-email login that maps onto an existing entry updates or
             // rebinds it instead of growing the pool (issue #512).
-            const outcomeMessage = persistOutcome === "rebound"
+            const outcomeMessage = persistResult?.outcome === "rebound"
                 ? `Rebound workspace for existing account. Total: ${count}`
-                : persistOutcome === "updated"
+                : persistResult?.outcome === "updated"
                     ? `Updated existing account. Total: ${count}`
                     : `Added account. Total: ${count}`;
             console.log(outcomeMessage);
+            if (persistResult && !persistResult.accountEnabled) {
+                console.log(`Account ${persistResult.accountIndex + 1} is still disabled and stays out of rotation. Re-enable it from the manage menu in "codex-multi-auth login".`);
+            }
             console.log("Next steps:");
             console.log("  codex-multi-auth status  Check that the wrapper is active.");
             console.log("  codex-multi-auth check   Confirm your saved accounts look healthy.");
             console.log("  codex-multi-auth list    Review saved accounts before switching.");
+            if (loginOptions.preserveSelection) {
+                return 0;
+            }
             if (count >= ACCOUNT_LIMITS.MAX_ACCOUNTS) {
                 console.log(`Reached maximum account limit (${ACCOUNT_LIMITS.MAX_ACCOUNTS}).`);
                 // Same reasoning as the addAnother=false branch below: in

package/dist/lib/codex-manager/login-menu-actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login-menu-actions.d.ts","sourceRoot":"","sources":["../../../lib/codex-manager/login-menu-actions.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAEjD,OAAO,EAEN,KAAK,gBAAgB,EAIrB,KAAK,kBAAkB,EAGvB,MAAM,eAAe,CAAC;AASvB,OAAO,EACN,KAAK,eAAe,EAKpB,MAAM,kBAAkB,CAAC;AAG1B;;;;;GAKG;AAEH,gBAAgB;AAChB,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;AAE7D,gBAAgB;AAChB,wBAAsB,qBAAqB,CAC1C,YAAY,EAAE,kBAAkB,GAAG,IAAI,EACvC,sBAAsB,GAAE,MAAM,GAAG,IAAW,GAC1C,OAAO,CAAC,eAAe,CAAC,CA6D1B;AAED,gBAAgB;AAChB,wBAAsB,uBAAuB,CAC5C,YAAY,EAAE,kBAAkB,GAC9B,OAAO,CAAC,iBAAiB,CAAC,CA0C5B;AAED,gBAAgB;AAChB,wBAAsB,2BAA2B,CAChD,OAAO,EAAE,kBAAkB,EAAE,GAC3B,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAkCpC;AA8GD,gBAAgB;AAChB,wBAAsB,kBAAkB,CACvC,OAAO,EAAE,gBAAgB,EACzB,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,eAAe,CAAC,CAAC,GACrD,OAAO,CAAC,IAAI,CAAC,CA0Hf"}
+{"version":3,"file":"login-menu-actions.d.ts","sourceRoot":"","sources":["../../../lib/codex-manager/login-menu-actions.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAGjD,OAAO,EAEN,KAAK,gBAAgB,EAKrB,KAAK,kBAAkB,EAGvB,MAAM,eAAe,CAAC;AASvB,OAAO,EACN,KAAK,eAAe,EAKpB,MAAM,kBAAkB,CAAC;AAG1B;;;;;GAKG;AAEH,gBAAgB;AAChB,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;AAE7D,gBAAgB;AAChB,wBAAsB,qBAAqB,CAC1C,YAAY,EAAE,kBAAkB,GAAG,IAAI,EACvC,sBAAsB,GAAE,MAAM,GAAG,IAAW,GAC1C,OAAO,CAAC,eAAe,CAAC,CA6D1B;AAED,gBAAgB;AAChB,wBAAsB,uBAAuB,CAC5C,YAAY,EAAE,kBAAkB,GAC9B,OAAO,CAAC,iBAAiB,CAAC,CA0C5B;AAED,gBAAgB;AAChB,wBAAsB,2BAA2B,CAChD,OAAO,EAAE,kBAAkB,EAAE,GAC3B,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAkCpC;AA8GD,gBAAgB;AAChB,wBAAsB,kBAAkB,CACvC,OAAO,EAAE,gBAAgB,EACzB,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,eAAe,CAAC,CAAC,GACrD,OAAO,CAAC,IAAI,CAAC,CAkKf"}

package/dist/lib/codex-manager/login-menu-actions.js

@@ -1,7 +1,8 @@
 import { stdin as input, stdout as output } from "node:process";
 import { sanitizeEmail } from "../accounts.js";
+import { CodexValidationError } from "../errors.js";
 import { MODEL_FAMILIES } from "../prompts/codex.js";
-import { findMatchingAccountIndex, loadAccounts, reconcilePinnedAccountIndex, setStoragePath, withAccountStorageTransaction, } from "../storage.js";
+import { bumpStorageAffinityGeneration, findMatchingAccountIndex, loadAccounts, reconcilePinnedAccountIndex, setStoragePath, withAccountStorageTransaction, } from "../storage.js";
 import { UI_COPY } from "../ui/ui-copy.js";
 import { getUiRuntimeOptions } from "../ui/runtime.js";
 import { select } from "../ui/select.js";
@@ -249,6 +250,12 @@ export async function handleManageAction(storage, menuResult) {
                 nextStorage.accounts.splice(nextIndex, 1);
                 resetManageActionSelection(nextStorage, nextIndex);
                 nextStorage.pinnedAccountIndex = reconcilePinnedAccountIndex(pinnedAccount, nextStorage.accounts);
+                // The splice shifts every index above the removed slot, and session
+                // affinity remembers accounts BY INDEX. Without a generation bump a
+                // live proxy keeps routing in-flight sessions to the account that
+                // slid into the old slot. Reconciling the pin is not enough — the
+                // affinity map is separate state. See issue #474.
+                bumpStorageAffinityGeneration(nextStorage);
                 await persist(nextStorage);
                 replaceManageActionStorage(storage, nextStorage);
                 deleted = true;
@@ -306,9 +313,38 @@ export async function handleManageAction(storage, menuResult) {
             console.error(`Refresh failed: ${tokenResult.message ?? tokenResult.reason ?? "unknown error"}`);
             return;
         }
-        const resolved = resolveAccountSelection(tokenResult);
-        await persistAccountPool([resolved], false);
-        await syncSelectionToCodex(resolved);
-        console.log(`Refreshed account ${idx + 1}.`);
+        const resolved = resolveAccountSelection(tokenResult, undefined, existing.accountId);
+        let persistResult;
+        try {
+            persistResult = await persistAccountPool([resolved], false, {
+                preserveSelection: true,
+                expectedAccount: existing,
+                expectedAccountIndex: idx,
+            });
+        }
+        catch (error) {
+            // A mismatched sign-in (the user picked a different ChatGPT account in
+            // the browser) is a refusal, not a crash. Nothing between here and the
+            // process entrypoint catches this, so an uncaught throw would take the
+            // whole interactive dashboard down with a raw stack trace.
+            if (error instanceof CodexValidationError) {
+                console.error(`Refresh failed: ${error.message}`);
+                return;
+            }
+            throw error;
+        }
+        // Refreshing the account Codex is currently using must publish its new
+        // tokens; refreshing any other row must leave the selection alone.
+        if (!persistResult || persistResult.isActiveAccount) {
+            await syncSelectionToCodex(resolved);
+        }
+        // Report the row that was actually written. The pool can shift between the
+        // dashboard render and this transaction, so the menu index may name a
+        // different account by now.
+        const refreshedIndex = persistResult?.accountIndex ?? idx;
+        console.log(`Refreshed account ${refreshedIndex + 1}.`);
+        if (persistResult && !persistResult.accountEnabled) {
+            console.log(`Account ${refreshedIndex + 1} is still disabled and stays out of rotation. Toggle it from this menu to bring it back.`);
+        }
     }
 }

package/dist/lib/codex-manager/login-oauth.d.ts

@@ -1,4 +1,5 @@
 import { type Workspace } from "../accounts.js";
+import { type AccountMetadataV3 } from "../storage.js";
 import type { AccountIdSource, TokenResult } from "../types.js";
 import { type AccountPoolWriteOutcome } from "./account-pool-write.js";
 /**
@@ -35,7 +36,7 @@ export declare function isAbortError(error: unknown): boolean;
  *
  * @internal
  */
-export declare function resolveAccountSelection(tokens: TokenSuccess, orgOverride?: string): TokenSuccessWithAccount;
+export declare function resolveAccountSelection(tokens: TokenSuccess, orgOverride?: string, targetAccountId?: string): TokenSuccessWithAccount;
 /** @internal */
 export type OAuthSignInMode = "browser" | "manual" | "device" | "restore-backup" | "cancel";
 /** @internal */
@@ -49,7 +50,42 @@ export declare function runSignInFlow(forceNewLogin: boolean, signInMode: Extrac
 /** @internal */
 export type PersistAccountPoolOutcome = AccountPoolWriteOutcome;
 /** @internal */
-export declare function persistAccountPool(results: TokenSuccessWithAccount[], replaceAll: boolean): Promise<PersistAccountPoolOutcome | null>;
+export interface PersistAccountPoolResult {
+    /** How the pool absorbed this login (appended, refreshed, or rebound). */
+    outcome: PersistAccountPoolOutcome;
+    /** Index of the row the login actually wrote. */
+    accountIndex: number;
+    /** Global selection index after the write. */
+    activeIndex: number;
+    /**
+     * Whether the written row is the one plain `codex` will use. Callers gate the
+     * ~/.codex/auth.json sync on this: refreshing the active account must publish
+     * its new tokens, and refreshing any other row must not steal the selection.
+     */
+    isActiveAccount: boolean;
+    /** Whether the written row is enabled for rotation after the write. */
+    accountEnabled: boolean;
+}
+/** @internal */
+export type ExpectedLoginAccount = Pick<AccountMetadataV3, "recordId" | "accountId" | "email" | "refreshToken">;
+/** @internal */
+export interface PersistAccountPoolOptions {
+    /** Keep every global/model-family selection on its pre-login identity. */
+    preserveSelection?: boolean;
+    /** Refuse the write unless the OAuth result is this saved account. */
+    expectedAccount?: ExpectedLoginAccount;
+    /**
+     * Position {@link expectedAccount} occupied when the caller resolved it.
+     * Treated as a hint that is verified against the row actually sitting there,
+     * never trusted: the pool can change between the caller's read and this
+     * transaction. It exists so an unambiguous positional request such as
+     * `login --account 2` stays deterministic when several saved rows share an
+     * identity, which identity matching alone cannot tell apart.
+     */
+    expectedAccountIndex?: number;
+}
+/** @internal */
+export declare function persistAccountPool(results: TokenSuccessWithAccount[], replaceAll: boolean, options?: PersistAccountPoolOptions): Promise<PersistAccountPoolResult | null>;
 /** @internal */
 export declare function syncSelectionToCodex(tokens: TokenSuccessWithAccount): Promise<void>;
 //# sourceMappingURL=login-oauth.d.ts.map

package/dist/lib/codex-manager/login-oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login-oauth.d.ts","sourceRoot":"","sources":["../../../lib/codex-manager/login-oauth.ts"],"names":[],"mappings":"AAEA,OAAO,EAON,KAAK,SAAS,EACd,MAAM,gBAAgB,CAAC;AAsBxB,OAAO,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEhE,OAAO,EACN,KAAK,uBAAuB,EAG5B,MAAM,yBAAyB,CAAC;AAOjC;;;;;GAKG;AAEH,gBAAgB;AAChB,MAAM,MAAM,YAAY,GAAG,OAAO,CAAC,WAAW,EAAE;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,CAAC,CAAC;AACrE,gBAAgB;AAChB,MAAM,MAAM,uBAAuB,GAAG,YAAY,GAAG;IACpD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;CACzB,CAAC;AAIF,gBAAgB;AAChB,wBAAgB,mBAAmB,CAClC,MAAM,EAAE,OAAO,CAAC,WAAW,EAAE;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,CAAC,GAC/C,OAAO,CAGT;AAED,gBAAgB;AAChB,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAIpD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CACtC,MAAM,EAAE,YAAY,EACpB,WAAW,CAAC,EAAE,MAAM,GAClB,uBAAuB,CA+DzB;AA0FD,gBAAgB;AAChB,MAAM,MAAM,eAAe,GACxB,SAAS,GACT,QAAQ,GACR,QAAQ,GACR,gBAAgB,GAChB,QAAQ,CAAC;AACZ,gBAAgB;AAChB,MAAM,MAAM,iBAAiB,GAAG;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,gBAAgB;AAChB,wBAAsB,YAAY,CACjC,aAAa,EAAE,OAAO,EACtB,UAAU,EAAE,OAAO,CAAC,eAAe,EAAE,SAAS,GAAG,QAAQ,CAAC,GACxD,OAAO,CAAC,WAAW,CAAC,CA6ItB;AAED,gBAAgB;AAChB,wBAAsB,aAAa,CAClC,aAAa,EAAE,OAAO,EACtB,UAAU,EAAE,OAAO,CAAC,eAAe,EAAE,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAC,EACrE,OAAO,GAAE,iBAAsB,GAC7B,OAAO,CAAC,WAAW,CAAC,CAetB;AAED,gBAAgB;AAChB,MAAM,MAAM,yBAAyB,GAAG,uBAAuB,CAAC;AAEhE,gBAAgB;AAChB,wBAAsB,kBAAkB,CACvC,OAAO,EAAE,uBAAuB,EAAE,EAClC,UAAU,EAAE,OAAO,GACjB,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC,CAuD3C;AAED,gBAAgB;AAChB,wBAAsB,oBAAoB,CACzC,MAAM,EAAE,uBAAuB,GAC7B,OAAO,CAAC,IAAI,CAAC,CAkBf"}
+{"version":3,"file":"login-oauth.d.ts","sourceRoot":"","sources":["../../../lib/codex-manager/login-oauth.ts"],"names":[],"mappings":"AAEA,OAAO,EAON,KAAK,SAAS,EACd,MAAM,gBAAgB,CAAC;AAkBxB,OAAO,EACN,KAAK,iBAAiB,EAGtB,MAAM,eAAe,CAAC;AAGvB,OAAO,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEhE,OAAO,EACN,KAAK,uBAAuB,EAG5B,MAAM,yBAAyB,CAAC;AAOjC;;;;;GAKG;AAEH,gBAAgB;AAChB,MAAM,MAAM,YAAY,GAAG,OAAO,CAAC,WAAW,EAAE;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,CAAC,CAAC;AACrE,gBAAgB;AAChB,MAAM,MAAM,uBAAuB,GAAG,YAAY,GAAG;IACpD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;CACzB,CAAC;AAIF,gBAAgB;AAChB,wBAAgB,mBAAmB,CAClC,MAAM,EAAE,OAAO,CAAC,WAAW,EAAE;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,CAAC,GAC/C,OAAO,CAGT;AAED,gBAAgB;AAChB,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAIpD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CACtC,MAAM,EAAE,YAAY,EACpB,WAAW,CAAC,EAAE,MAAM,EACpB,eAAe,CAAC,EAAE,MAAM,GACtB,uBAAuB,CAiGzB;AA0FD,gBAAgB;AAChB,MAAM,MAAM,eAAe,GACxB,SAAS,GACT,QAAQ,GACR,QAAQ,GACR,gBAAgB,GAChB,QAAQ,CAAC;AACZ,gBAAgB;AAChB,MAAM,MAAM,iBAAiB,GAAG;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,gBAAgB;AAChB,wBAAsB,YAAY,CACjC,aAAa,EAAE,OAAO,EACtB,UAAU,EAAE,OAAO,CAAC,eAAe,EAAE,SAAS,GAAG,QAAQ,CAAC,GACxD,OAAO,CAAC,WAAW,CAAC,CA6ItB;AAED,gBAAgB;AAChB,wBAAsB,aAAa,CAClC,aAAa,EAAE,OAAO,EACtB,UAAU,EAAE,OAAO,CAAC,eAAe,EAAE,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAC,EACrE,OAAO,GAAE,iBAAsB,GAC7B,OAAO,CAAC,WAAW,CAAC,CAetB;AAED,gBAAgB;AAChB,MAAM,MAAM,yBAAyB,GAAG,uBAAuB,CAAC;AAEhE,gBAAgB;AAChB,MAAM,WAAW,wBAAwB;IACxC,0EAA0E;IAC1E,OAAO,EAAE,yBAAyB,CAAC;IACnC,iDAAiD;IACjD,YAAY,EAAE,MAAM,CAAC;IACrB,8CAA8C;IAC9C,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,eAAe,EAAE,OAAO,CAAC;IACzB,uEAAuE;IACvE,cAAc,EAAE,OAAO,CAAC;CACxB;AAED,gBAAgB;AAChB,MAAM,MAAM,oBAAoB,GAAG,IAAI,CACtC,iBAAiB,EACjB,UAAU,GAAG,WAAW,GAAG,OAAO,GAAG,cAAc,CACnD,CAAC;AAEF,gBAAgB;AAChB,MAAM,WAAW,yBAAyB;IACzC,0EAA0E;IAC1E,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,sEAAsE;IACtE,eAAe,CAAC,EAAE,oBAAoB,CAAC;IACvC;;;;;;;OAOG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAuGD,gBAAgB;AAChB,wBAAsB,kBAAkB,CACvC,OAAO,EAAE,uBAAuB,EAAE,EAClC,UAAU,EAAE,OAAO,EACnB,OAAO,GAAE,yBAA8B,GACrC,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC,CAuJ1C;AAED,gBAAgB;AAChB,wBAAsB,oBAAoB,CACzC,MAAM,EAAE,uBAAuB,GAC7B,OAAO,CAAC,IAAI,CAAC,CAkBf"}