codex-multi-auth 2.9.0 → 2.9.1

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-multi-auth",
-	"version": "2.9.0",
+	"version": "2.9.1",
   "description": "Install and operate codex-multi-auth for the official @openai/codex CLI with multi-account OAuth rotation, switching, health checks, and recovery tools.",
   "interface": {
     "composerIcon": "./assets/codex-multi-auth-icon.svg"

package/README.md

@@ -161,6 +161,19 @@ codex-multi-auth forecast --live
 
 If browser launch is blocked, use the alternate login paths in [docs/getting-started.md](docs/getting-started.md#alternate-login-paths).
 For remote or headless shells, prefer `codex-multi-auth login --device-auth`.
+To refresh one saved account without changing the active selection or manual
+pin, run:
+
+```bash
+codex-multi-auth login --account <index|email|account_id> --preserve-selection
+```
+
+Add `--device-auth` on a remote shell. The refreshed OAuth identity must match
+the requested saved account or nothing is written. Refreshing the account Codex
+is currently using still publishes its new tokens to the native CLI; refreshing
+any other account leaves the active selection and the manual pin untouched. A
+disabled account stays disabled. `--account` cannot be combined with `--org`,
+which would rebind the row to a different workspace.
 
 ---
 
@@ -392,7 +405,7 @@ codex-multi-auth doctor --json
 
 ## Release Notes
 
-- Current stable: [docs/releases/v2.9.0.md](docs/releases/v2.9.0.md) — install via `npm i -g codex-multi-auth`
+- Current stable: [docs/releases/v2.9.1.md](docs/releases/v2.9.1.md) — install via `npm i -g codex-multi-auth`
 - Previous stable: [docs/releases/v2.8.3.md](docs/releases/v2.8.3.md)
 - Previous stable: [docs/releases/v2.8.2.md](docs/releases/v2.8.2.md)
 - Previous stable: [docs/releases/v2.7.1.md](docs/releases/v2.7.1.md)

package/dist/lib/budget-guard.d.ts

@@ -21,6 +21,7 @@ export interface BudgetGuardEvaluation {
         requests: number;
         totalTokens: number;
         costUsd: number;
+        unpricedRequests: number;
     };
     limits: {
         maxRequests: number | null;

package/dist/lib/budget-guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"budget-guard.d.ts","sourceRoot":"","sources":["../../lib/budget-guard.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAIrD,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,OAAO,CAAC;AAE7D,MAAM,WAAW,WAAW;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,YAAY,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAChC,OAAO,EAAE,CAAC,CAAC;IACX,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,qBAAqB;IACrC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,YAAY,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,EAAE;QACN,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,OAAO,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,MAAM,EAAE;QACP,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;KAC1B,CAAC;CACF;AA6ED,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAE/D;AAED,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAatE;AAED,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsCjF;AAED,wBAAgB,iBAAiB,CAChC,KAAK,EAAE,gBAAgB,EACvB,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,EACrC,GAAG,SAAa,GACd,WAAW,CAOb;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,SAAa,GAAG,MAAM,CAoBnF;AAED,wBAAgB,mBAAmB,CAClC,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE,YAAY,GACnB,qBAAqB,CAsCvB;AAED,wBAAgB,kCAAkC,IAAI,IAAI,CAEzD"}
+{"version":3,"file":"budget-guard.d.ts","sourceRoot":"","sources":["../../lib/budget-guard.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAIrD,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,OAAO,CAAC;AAE7D,MAAM,WAAW,WAAW;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,YAAY,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAChC,OAAO,EAAE,CAAC,CAAC;IACX,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,qBAAqB;IACrC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,YAAY,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,EAAE;QACN,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,OAAO,EAAE,MAAM,CAAC;QAChB,gBAAgB,EAAE,MAAM,CAAC;KACzB,CAAC;IACF,MAAM,EAAE;QACP,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;KAC1B,CAAC;CACF;AA6ED,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAE/D;AAED,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAatE;AAED,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsCjF;AAED,wBAAgB,iBAAiB,CAChC,KAAK,EAAE,gBAAgB,EACvB,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,EACrC,GAAG,SAAa,GACd,WAAW,CAOb;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,SAAa,GAAG,MAAM,CAoBnF;AAED,wBAAgB,mBAAmB,CAClC,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE,YAAY,GACnB,qBAAqB,CA+CvB;AAED,wBAAgB,kCAAkC,IAAI,IAAI,CAEzD"}

package/dist/lib/budget-guard.js

@@ -175,9 +175,18 @@ export function evaluateBudgetGuard(limit, summary) {
         summary.totals.totalTokens >= limit.maxTokens) {
         reasons.push(`token limit reached (${summary.totals.totalTokens}/${limit.maxTokens})`);
     }
-    if (typeof limit.maxCostUsd === "number" &&
-        summary.totals.costUsd >= limit.maxCostUsd) {
-        reasons.push(`cost limit reached (${summary.totals.costUsd.toFixed(6)}/${limit.maxCostUsd.toFixed(6)})`);
+    if (typeof limit.maxCostUsd === "number") {
+        if (summary.totals.costUsd >= limit.maxCostUsd) {
+            reasons.push(`cost limit reached (${summary.totals.costUsd.toFixed(6)}/${limit.maxCostUsd.toFixed(6)})`);
+        }
+        else if ((summary.totals.unpricedRequests ?? 0) > 0) {
+            // The window contains token usage we have no rate for, so `costUsd` is
+            // an under-count by an unknown amount and this limit cannot be
+            // evaluated. Counting unknown cost as zero is what made a cost budget
+            // silently unenforceable for every unpriced model; an unevaluable spend
+            // limit fails closed instead. Priced models are unaffected.
+            reasons.push(`cost limit cannot be evaluated: ${summary.totals.unpricedRequests} request(s) in this window used a model with no known price, so recorded cost (${summary.totals.costUsd.toFixed(6)}) is incomplete. Price the model in lib/usage/pricing.ts, or budget on --requests/--tokens instead of --cost.`);
+        }
     }
     return {
         key: limit.key,
@@ -188,6 +197,7 @@ export function evaluateBudgetGuard(limit, summary) {
             requests: summary.totals.requests,
             totalTokens: summary.totals.totalTokens,
             costUsd: summary.totals.costUsd,
+            unpricedRequests: summary.totals.unpricedRequests,
         },
         limits: {
             maxRequests: limit.maxRequests ?? null,

package/dist/lib/codex-manager/account-pool-write.d.ts

@@ -30,6 +30,14 @@ export interface ResolvedAccountWrite {
     accessToken?: string;
     expiresAt?: number;
     workspaces?: Workspace[];
+    /**
+     * Keep the saved row's `enabled` flag instead of re-enabling it. A targeted
+     * re-authentication only tops up credentials for a row the user named, so it
+     * must not pull a deliberately disabled account back into rotation behind
+     * their back. A plain login still re-enables: signing in is the user asking
+     * for that account to be usable again.
+     */
+    preserveEnabledState?: boolean;
     now: number;
 }
 /**

package/dist/lib/codex-manager/account-pool-write.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account-pool-write.d.ts","sourceRoot":"","sources":["../../../lib/codex-manager/account-pool-write.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAEpE;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,uBAAuB,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;AAEzE;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACpC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;IACvD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;IACzB,GAAG,EAAE,MAAM,CAAC;CACZ;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACxC,UAAU,EAAE,SAAS,EAAE,EACvB,SAAS,EAAE,MAAM,GAAG,SAAS,GAC3B,MAAM,CAWR;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACrC,QAAQ,EAAE,IAAI,CAAC,iBAAiB,EAAE,YAAY,CAAC,EAC/C,QAAQ,EAAE,SAAS,EAAE,GAAG,SAAS,GAC/B,SAAS,EAAE,GAAG,SAAS,CAYzB;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAC3C,QAAQ,EAAE,IAAI,CAAC,iBAAiB,EAAE,YAAY,GAAG,uBAAuB,CAAC,EACzE,gBAAgB,EAAE,SAAS,EAAE,GAAG,SAAS,GACvC,MAAM,GAAG,SAAS,CAwBpB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CACnC,KAAK,EAAE,oBAAoB,GACzB;IAAE,OAAO,EAAE,iBAAiB,CAAC;IAAC,OAAO,EAAE,UAAU,CAAA;CAAE,CAwBrD;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAClC,QAAQ,EAAE,iBAAiB,EAC3B,KAAK,EAAE,oBAAoB,GACzB;IAAE,OAAO,EAAE,iBAAiB,CAAC;IAAC,OAAO,EAAE,SAAS,GAAG,SAAS,CAAA;CAAE,CA+ChE;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE;IAC/C,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,wBAAwB,EAAE,CACzB,QAAQ,EAAE,iBAAiB,EAAE,EAC7B,QAAQ,EAAE;QACT,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,YAAY,CAAC,EAAE,MAAM,CAAC;KACtB,EACD,OAAO,EAAE;QAAE,wCAAwC,EAAE,OAAO,CAAA;KAAE,KAC1D,MAAM,GAAG,SAAS,CAAC;CACxB,GAAG;IACH,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,uBAAuB,GAAG,IAAI,CAAC;CACxC,CA6CA"}
+{"version":3,"file":"account-pool-write.d.ts","sourceRoot":"","sources":["../../../lib/codex-manager/account-pool-write.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAEpE;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,uBAAuB,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;AAEzE;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACpC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;IACvD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;IACzB;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,GAAG,EAAE,MAAM,CAAC;CACZ;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACxC,UAAU,EAAE,SAAS,EAAE,EACvB,SAAS,EAAE,MAAM,GAAG,SAAS,GAC3B,MAAM,CAWR;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACrC,QAAQ,EAAE,IAAI,CAAC,iBAAiB,EAAE,YAAY,CAAC,EAC/C,QAAQ,EAAE,SAAS,EAAE,GAAG,SAAS,GAC/B,SAAS,EAAE,GAAG,SAAS,CAYzB;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAC3C,QAAQ,EAAE,IAAI,CAAC,iBAAiB,EAAE,YAAY,GAAG,uBAAuB,CAAC,EACzE,gBAAgB,EAAE,SAAS,EAAE,GAAG,SAAS,GACvC,MAAM,GAAG,SAAS,CAwBpB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CACnC,KAAK,EAAE,oBAAoB,GACzB;IAAE,OAAO,EAAE,iBAAiB,CAAC;IAAC,OAAO,EAAE,UAAU,CAAA;CAAE,CAwBrD;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAClC,QAAQ,EAAE,iBAAiB,EAC3B,KAAK,EAAE,oBAAoB,GACzB;IAAE,OAAO,EAAE,iBAAiB,CAAC;IAAC,OAAO,EAAE,SAAS,GAAG,SAAS,CAAA;CAAE,CA+ChE;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE;IAC/C,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,wBAAwB,EAAE,CACzB,QAAQ,EAAE,iBAAiB,EAAE,EAC7B,QAAQ,EAAE;QACT,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,YAAY,CAAC,EAAE,MAAM,CAAC;KACtB,EACD,OAAO,EAAE;QAAE,wCAAwC,EAAE,OAAO,CAAA;KAAE,KAC1D,MAAM,GAAG,SAAS,CAAC;CACxB,GAAG;IACH,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,uBAAuB,GAAG,IAAI,CAAC;CACxC,CA6CA"}

package/dist/lib/codex-manager/account-pool-write.js

@@ -115,7 +115,7 @@ export function buildUpdatedAccount(existing, write) {
             refreshToken: write.refreshToken,
             accessToken: write.accessToken,
             expiresAt: write.expiresAt,
-            enabled: true,
+            enabled: write.preserveEnabledState ? existing.enabled : true,
             authInvalidatedAt: undefined,
             authInvalidationErrorCode: undefined,
             lastUsed: write.now,

package/dist/lib/codex-manager/help.d.ts

@@ -2,7 +2,9 @@ export declare function printUsage(): void;
 export type AuthLoginOptions = {
     manual: boolean;
     deviceAuth: boolean;
+    preserveSelection?: boolean;
     org?: string;
+    account?: string;
 };
 export type ParsedAuthLoginArgs = {
     ok: true;

package/dist/lib/codex-manager/help.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"help.d.ts","sourceRoot":"","sources":["../../../lib/codex-manager/help.ts"],"names":[],"mappings":"AAIA,wBAAgB,UAAU,IAAI,IAAI,CAsDjC;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC9B,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAC5B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,gBAAgB,CAAA;CAAE,GACvC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC7B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,mBAAmB,CAgEtE;AAED,UAAU,cAAc;IACvB,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,MAAM,cAAc,GACvB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,cAAc,CAAA;CAAE,GACrC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC7B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnD,wBAAgB,cAAc,IAAI,IAAI,CAgBrC;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,cAAc,CAyD5D"}
+{"version":3,"file":"help.d.ts","sourceRoot":"","sources":["../../../lib/codex-manager/help.ts"],"names":[],"mappings":"AAIA,wBAAgB,UAAU,IAAI,IAAI,CAsDjC;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC9B,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;IACpB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAC5B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,gBAAgB,CAAA;CAAE,GACvC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC7B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,mBAAmB,CAuGtE;AAED,UAAU,cAAc;IACvB,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,MAAM,cAAc,GACvB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,cAAc,CAAA;CAAE,GACrC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC7B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnD,wBAAgB,cAAc,IAAI,IAAI,CAgBrC;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,cAAc,CAyD5D"}

package/dist/lib/codex-manager/help.js

@@ -5,7 +5,7 @@ export function printUsage() {
         "Codex Multi-Auth CLI",
         "",
         "Start here:",
-        "  codex-multi-auth login [--device-auth|--manual|--no-browser] [--org <org_id>]",
+        "  codex-multi-auth login [--device-auth|--manual|--no-browser] [--org <org_id>] [--preserve-selection] [--account <index|email|account_id>]",
         "  codex-multi-auth status [--json]   (list is the same command)",
         "  codex-multi-auth check            (always live-probes)",
         "",
@@ -72,6 +72,33 @@ export function parseAuthLoginArgs(args) {
             options.deviceAuth = true;
             continue;
         }
+        if (arg === "--preserve-selection") {
+            options.preserveSelection = true;
+            continue;
+        }
+        if (arg === "--account" || arg?.startsWith("--account=")) {
+            let value;
+            if (arg === "--account") {
+                value = args[i + 1];
+                i += 1;
+            }
+            else {
+                value = arg.slice("--account=".length);
+            }
+            const trimmed = value?.trim();
+            if (!trimmed || trimmed.startsWith("--")) {
+                return {
+                    ok: false,
+                    reason: "error",
+                    message: "Missing value for --account. Usage: codex-multi-auth login --account <index|email|account_id>",
+                };
+            }
+            options.account = trimmed;
+            // A targeted re-auth must never select the refreshed account as a
+            // side effect, even if the caller omits the redundant safety flag.
+            options.preserveSelection = true;
+            continue;
+        }
         if (arg === "--org" || arg?.startsWith("--org=")) {
             // Bind this login to a specific workspace/org id (issue #491). Reuses
             // the CODEX_AUTH_ACCOUNT_ID override mechanism so the same email's
@@ -112,6 +139,16 @@ export function parseAuthLoginArgs(args) {
             message: `Cannot combine --device-auth with ${conflict}`,
         };
     }
+    // --org rebinds a login to a different workspace, which is exactly the
+    // identity change a targeted re-auth is built to refuse. Rejecting the pair
+    // up front beats failing after the user has already completed a sign-in.
+    if (options.account && options.org) {
+        return {
+            ok: false,
+            reason: "error",
+            message: "Cannot combine --account with --org. Re-authenticate the saved account on its own workspace, or register the other workspace with --org on its own.",
+        };
+    }
     return { ok: true, options };
 }
 export function printBestUsage() {

package/dist/lib/codex-manager/login-flow.d.ts

@@ -1,3 +1,4 @@
+import { type AccountMetadataV3, type AccountStorageV3 } from "../storage.js";
 import { type RepairCommandDeps } from "./repair-commands.js";
 /**
  * Interactive control loop for the `login` command: the account dashboard menu
@@ -13,5 +14,7 @@ export interface LoginFlowDeps {
     createRepairCommandDeps(): RepairCommandDeps;
 }
 /** @internal */
+export declare function resolveLoginAccountTarget(storage: AccountStorageV3, identifier: string): AccountMetadataV3 | null;
+/** @internal */
 export declare function runAuthLogin(args: string[], deps: LoginFlowDeps): Promise<number>;
 //# sourceMappingURL=login-flow.d.ts.map

package/dist/lib/codex-manager/login-flow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login-flow.d.ts","sourceRoot":"","sources":["../../../lib/codex-manager/login-flow.ts"],"names":[],"mappings":"AAmDA,OAAO,EACN,KAAK,iBAAiB,EAGtB,MAAM,sBAAsB,CAAC;AAM9B;;;;;;;GAOG;AAEH,gBAAgB;AAChB,MAAM,WAAW,aAAa;IAC7B,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7C,uBAAuB,IAAI,iBAAiB,CAAC;CAC7C;AAkCD,gBAAgB;AAChB,wBAAsB,YAAY,CACjC,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,EAAE,aAAa,GACjB,OAAO,CAAC,MAAM,CAAC,CAqBjB"}
+{"version":3,"file":"login-flow.d.ts","sourceRoot":"","sources":["../../../lib/codex-manager/login-flow.ts"],"names":[],"mappings":"AAQA,OAAO,EACN,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EAUrB,MAAM,eAAe,CAAC;AAmCvB,OAAO,EACN,KAAK,iBAAiB,EAGtB,MAAM,sBAAsB,CAAC;AAM9B;;;;;;;GAOG;AAEH,gBAAgB;AAChB,MAAM,WAAW,aAAa;IAC7B,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7C,uBAAuB,IAAI,iBAAiB,CAAC;CAC7C;AAkCD,gBAAgB;AAChB,wBAAgB,yBAAyB,CACxC,OAAO,EAAE,gBAAgB,EACzB,UAAU,EAAE,MAAM,GAChB,iBAAiB,GAAG,IAAI,CAkB1B;AAED,gBAAgB;AAChB,wBAAsB,YAAY,CACjC,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,EAAE,aAAa,GACjB,OAAO,CAAC,MAAM,CAAC,CAqBjB"}

package/dist/lib/codex-manager/login-flow.js

@@ -1,3 +1,4 @@
+import { sanitizeEmail } from "../accounts.js";
 import { isBrowserLaunchSuppressed } from "../auth/browser.js";
 import { promptAddAnotherAccount, promptLoginMode } from "../cli.js";
 import { ACCOUNT_LIMITS } from "../constants.js";
@@ -6,6 +7,7 @@ import { createLogger } from "../logger.js";
 import { loadQuotaCache } from "../quota-cache.js";
 import { resolveActiveIndex } from "../runtime/account-status.js";
 import { clearAccounts, formatStorageErrorHint, getNamedBackups, loadAccounts, loadFlaggedAccounts, restoreAccountsFromBackup, setStoragePath, StorageError, } from "../storage.js";
+import { CodexValidationError } from "../errors.js";
 import { UI_COPY } from "../ui/ui-copy.js";
 import { confirm } from "../ui/confirm.js";
 import { stylePromptText } from "./formatters/index.js";
@@ -38,6 +40,23 @@ async function clearAccountsAndReset() {
     await clearAccounts();
 }
 /** @internal */
+export function resolveLoginAccountTarget(storage, identifier) {
+    if (/^[1-9]\d*$/.test(identifier)) {
+        const byIndex = storage.accounts[Number(identifier) - 1];
+        return byIndex ?? null;
+    }
+    const byAccountId = storage.accounts.filter((account) => account.accountId === identifier);
+    if (byAccountId.length === 1)
+        return byAccountId[0] ?? null;
+    if (byAccountId.length > 1)
+        return null;
+    const email = sanitizeEmail(identifier);
+    if (!email)
+        return null;
+    const byEmail = storage.accounts.filter((account) => sanitizeEmail(account.email) === email);
+    return byEmail.length === 1 ? (byEmail[0] ?? null) : null;
+}
+/** @internal */
 export async function runAuthLogin(args, deps) {
     const parsedArgs = parseAuthLoginArgs(args);
     if (!parsedArgs.ok) {
@@ -197,7 +216,10 @@ async function runAuthLoginFlow(loginOptions, deps) {
     // (--device-auth, --manual, --no-browser), they want to add a new account
     // directly. Skipping the dashboard menu keeps `login --device-auth`
     // usable from scripts and matches the documented behavior of the help text.
-    const explicitSignInMode = loginOptions.deviceAuth || loginOptions.manual;
+    const explicitSignInMode = loginOptions.deviceAuth ||
+        loginOptions.manual ||
+        loginOptions.preserveSelection ||
+        Boolean(loginOptions.account);
     loginFlow: while (true) {
         const existingStorage = await loadAccounts();
         if (!explicitSignInMode &&
@@ -210,6 +232,23 @@ async function runAuthLoginFlow(loginOptions, deps) {
         }
         const refreshedStorage = await loadAccounts();
         let existingCount = refreshedStorage?.accounts.length ?? 0;
+        const expectedAccount = loginOptions.account
+            ? refreshedStorage
+                ? resolveLoginAccountTarget(refreshedStorage, loginOptions.account)
+                : null
+            : undefined;
+        if (loginOptions.account && !expectedAccount) {
+            console.error("The requested Codex account is missing or ambiguous. No login was started.");
+            return 1;
+        }
+        // Positional hint for the write, re-verified (never trusted) inside the
+        // storage transaction. resolveLoginAccountTarget hands back a row out of
+        // this very array, so indexOf is an exact identity lookup.
+        const expectedAccountIndex = expectedAccount && refreshedStorage
+            ? refreshedStorage.accounts.indexOf(expectedAccount)
+            : -1;
+        // A non-empty pool already forces a fresh sign-in, and a resolved target
+        // implies the pool was non-empty, so it adds no condition of its own.
         let forceNewLogin = existingCount > 0;
         let onboardingBackupDiscoveryWarning = null;
         const loadNamedBackupsForOnboarding = async () => {
@@ -346,9 +385,31 @@ async function runAuthLoginFlow(loginOptions, deps) {
                 console.error(`Login failed: ${tokenResult.message ?? tokenResult.reason ?? "unknown error"}`);
                 return 1;
             }
-            const resolved = resolveAccountSelection(tokenResult, loginOptions.org);
-            const persistOutcome = await persistAccountPool([resolved], false);
-            await syncSelectionToCodex(resolved);
+            const resolved = resolveAccountSelection(tokenResult, loginOptions.org, expectedAccount?.accountId);
+            let persistResult;
+            try {
+                persistResult = await persistAccountPool([resolved], false, {
+                    preserveSelection: loginOptions.preserveSelection,
+                    expectedAccount: expectedAccount ?? undefined,
+                    expectedAccountIndex: expectedAccountIndex >= 0 ? expectedAccountIndex : undefined,
+                });
+            }
+            catch (error) {
+                if (error instanceof CodexValidationError) {
+                    console.error(`Re-authentication failed: ${error.message}`);
+                    return 1;
+                }
+                throw error;
+            }
+            // Publish to ~/.codex/auth.json exactly when this write owns the
+            // selection. Skipping the sync whenever --preserve-selection was passed
+            // stranded the native CLI on the expired tokens of the very account the
+            // user had just refreshed, and nothing downstream repaired it: the
+            // drift check compares identity, not tokens, so a same-identity refresh
+            // never looks like drift.
+            if (!persistResult || persistResult.isActiveAccount) {
+                await syncSelectionToCodex(resolved);
+            }
             const latestStorage = await loadAccounts();
             const count = latestStorage?.accounts.length ?? 1;
             existingCount = count;
@@ -357,16 +418,22 @@ async function runAuthLoginFlow(loginOptions, deps) {
             // Only claim a new saved slot when one was actually appended. A
             // same-email login that maps onto an existing entry updates or
             // rebinds it instead of growing the pool (issue #512).
-            const outcomeMessage = persistOutcome === "rebound"
+            const outcomeMessage = persistResult?.outcome === "rebound"
                 ? `Rebound workspace for existing account. Total: ${count}`
-                : persistOutcome === "updated"
+                : persistResult?.outcome === "updated"
                     ? `Updated existing account. Total: ${count}`
                     : `Added account. Total: ${count}`;
             console.log(outcomeMessage);
+            if (persistResult && !persistResult.accountEnabled) {
+                console.log(`Account ${persistResult.accountIndex + 1} is still disabled and stays out of rotation. Re-enable it from the manage menu in "codex-multi-auth login".`);
+            }
             console.log("Next steps:");
             console.log("  codex-multi-auth status  Check that the wrapper is active.");
             console.log("  codex-multi-auth check   Confirm your saved accounts look healthy.");
             console.log("  codex-multi-auth list    Review saved accounts before switching.");
+            if (loginOptions.preserveSelection) {
+                return 0;
+            }
             if (count >= ACCOUNT_LIMITS.MAX_ACCOUNTS) {
                 console.log(`Reached maximum account limit (${ACCOUNT_LIMITS.MAX_ACCOUNTS}).`);
                 // Same reasoning as the addAnother=false branch below: in

package/dist/lib/codex-manager/login-menu-actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login-menu-actions.d.ts","sourceRoot":"","sources":["../../../lib/codex-manager/login-menu-actions.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAEjD,OAAO,EAEN,KAAK,gBAAgB,EAKrB,KAAK,kBAAkB,EAGvB,MAAM,eAAe,CAAC;AASvB,OAAO,EACN,KAAK,eAAe,EAKpB,MAAM,kBAAkB,CAAC;AAG1B;;;;;GAKG;AAEH,gBAAgB;AAChB,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;AAE7D,gBAAgB;AAChB,wBAAsB,qBAAqB,CAC1C,YAAY,EAAE,kBAAkB,GAAG,IAAI,EACvC,sBAAsB,GAAE,MAAM,GAAG,IAAW,GAC1C,OAAO,CAAC,eAAe,CAAC,CA6D1B;AAED,gBAAgB;AAChB,wBAAsB,uBAAuB,CAC5C,YAAY,EAAE,kBAAkB,GAC9B,OAAO,CAAC,iBAAiB,CAAC,CA0C5B;AAED,gBAAgB;AAChB,wBAAsB,2BAA2B,CAChD,OAAO,EAAE,kBAAkB,EAAE,GAC3B,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAkCpC;AA8GD,gBAAgB;AAChB,wBAAsB,kBAAkB,CACvC,OAAO,EAAE,gBAAgB,EACzB,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,eAAe,CAAC,CAAC,GACrD,OAAO,CAAC,IAAI,CAAC,CAgIf"}
+{"version":3,"file":"login-menu-actions.d.ts","sourceRoot":"","sources":["../../../lib/codex-manager/login-menu-actions.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAGjD,OAAO,EAEN,KAAK,gBAAgB,EAKrB,KAAK,kBAAkB,EAGvB,MAAM,eAAe,CAAC;AASvB,OAAO,EACN,KAAK,eAAe,EAKpB,MAAM,kBAAkB,CAAC;AAG1B;;;;;GAKG;AAEH,gBAAgB;AAChB,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;AAE7D,gBAAgB;AAChB,wBAAsB,qBAAqB,CAC1C,YAAY,EAAE,kBAAkB,GAAG,IAAI,EACvC,sBAAsB,GAAE,MAAM,GAAG,IAAW,GAC1C,OAAO,CAAC,eAAe,CAAC,CA6D1B;AAED,gBAAgB;AAChB,wBAAsB,uBAAuB,CAC5C,YAAY,EAAE,kBAAkB,GAC9B,OAAO,CAAC,iBAAiB,CAAC,CA0C5B;AAED,gBAAgB;AAChB,wBAAsB,2BAA2B,CAChD,OAAO,EAAE,kBAAkB,EAAE,GAC3B,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAkCpC;AA8GD,gBAAgB;AAChB,wBAAsB,kBAAkB,CACvC,OAAO,EAAE,gBAAgB,EACzB,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,eAAe,CAAC,CAAC,GACrD,OAAO,CAAC,IAAI,CAAC,CAkKf"}

package/dist/lib/codex-manager/login-menu-actions.js

@@ -1,5 +1,6 @@
 import { stdin as input, stdout as output } from "node:process";
 import { sanitizeEmail } from "../accounts.js";
+import { CodexValidationError } from "../errors.js";
 import { MODEL_FAMILIES } from "../prompts/codex.js";
 import { bumpStorageAffinityGeneration, findMatchingAccountIndex, loadAccounts, reconcilePinnedAccountIndex, setStoragePath, withAccountStorageTransaction, } from "../storage.js";
 import { UI_COPY } from "../ui/ui-copy.js";
@@ -312,9 +313,38 @@ export async function handleManageAction(storage, menuResult) {
             console.error(`Refresh failed: ${tokenResult.message ?? tokenResult.reason ?? "unknown error"}`);
             return;
         }
-        const resolved = resolveAccountSelection(tokenResult);
-        await persistAccountPool([resolved], false);
-        await syncSelectionToCodex(resolved);
-        console.log(`Refreshed account ${idx + 1}.`);
+        const resolved = resolveAccountSelection(tokenResult, undefined, existing.accountId);
+        let persistResult;
+        try {
+            persistResult = await persistAccountPool([resolved], false, {
+                preserveSelection: true,
+                expectedAccount: existing,
+                expectedAccountIndex: idx,
+            });
+        }
+        catch (error) {
+            // A mismatched sign-in (the user picked a different ChatGPT account in
+            // the browser) is a refusal, not a crash. Nothing between here and the
+            // process entrypoint catches this, so an uncaught throw would take the
+            // whole interactive dashboard down with a raw stack trace.
+            if (error instanceof CodexValidationError) {
+                console.error(`Refresh failed: ${error.message}`);
+                return;
+            }
+            throw error;
+        }
+        // Refreshing the account Codex is currently using must publish its new
+        // tokens; refreshing any other row must leave the selection alone.
+        if (!persistResult || persistResult.isActiveAccount) {
+            await syncSelectionToCodex(resolved);
+        }
+        // Report the row that was actually written. The pool can shift between the
+        // dashboard render and this transaction, so the menu index may name a
+        // different account by now.
+        const refreshedIndex = persistResult?.accountIndex ?? idx;
+        console.log(`Refreshed account ${refreshedIndex + 1}.`);
+        if (persistResult && !persistResult.accountEnabled) {
+            console.log(`Account ${refreshedIndex + 1} is still disabled and stays out of rotation. Toggle it from this menu to bring it back.`);
+        }
     }
 }

package/dist/lib/codex-manager/login-oauth.d.ts

@@ -1,4 +1,5 @@
 import { type Workspace } from "../accounts.js";
+import { type AccountMetadataV3 } from "../storage.js";
 import type { AccountIdSource, TokenResult } from "../types.js";
 import { type AccountPoolWriteOutcome } from "./account-pool-write.js";
 /**
@@ -35,7 +36,7 @@ export declare function isAbortError(error: unknown): boolean;
  *
  * @internal
  */
-export declare function resolveAccountSelection(tokens: TokenSuccess, orgOverride?: string): TokenSuccessWithAccount;
+export declare function resolveAccountSelection(tokens: TokenSuccess, orgOverride?: string, targetAccountId?: string): TokenSuccessWithAccount;
 /** @internal */
 export type OAuthSignInMode = "browser" | "manual" | "device" | "restore-backup" | "cancel";
 /** @internal */
@@ -49,7 +50,42 @@ export declare function runSignInFlow(forceNewLogin: boolean, signInMode: Extrac
 /** @internal */
 export type PersistAccountPoolOutcome = AccountPoolWriteOutcome;
 /** @internal */
-export declare function persistAccountPool(results: TokenSuccessWithAccount[], replaceAll: boolean): Promise<PersistAccountPoolOutcome | null>;
+export interface PersistAccountPoolResult {
+    /** How the pool absorbed this login (appended, refreshed, or rebound). */
+    outcome: PersistAccountPoolOutcome;
+    /** Index of the row the login actually wrote. */
+    accountIndex: number;
+    /** Global selection index after the write. */
+    activeIndex: number;
+    /**
+     * Whether the written row is the one plain `codex` will use. Callers gate the
+     * ~/.codex/auth.json sync on this: refreshing the active account must publish
+     * its new tokens, and refreshing any other row must not steal the selection.
+     */
+    isActiveAccount: boolean;
+    /** Whether the written row is enabled for rotation after the write. */
+    accountEnabled: boolean;
+}
+/** @internal */
+export type ExpectedLoginAccount = Pick<AccountMetadataV3, "recordId" | "accountId" | "email" | "refreshToken">;
+/** @internal */
+export interface PersistAccountPoolOptions {
+    /** Keep every global/model-family selection on its pre-login identity. */
+    preserveSelection?: boolean;
+    /** Refuse the write unless the OAuth result is this saved account. */
+    expectedAccount?: ExpectedLoginAccount;
+    /**
+     * Position {@link expectedAccount} occupied when the caller resolved it.
+     * Treated as a hint that is verified against the row actually sitting there,
+     * never trusted: the pool can change between the caller's read and this
+     * transaction. It exists so an unambiguous positional request such as
+     * `login --account 2` stays deterministic when several saved rows share an
+     * identity, which identity matching alone cannot tell apart.
+     */
+    expectedAccountIndex?: number;
+}
+/** @internal */
+export declare function persistAccountPool(results: TokenSuccessWithAccount[], replaceAll: boolean, options?: PersistAccountPoolOptions): Promise<PersistAccountPoolResult | null>;
 /** @internal */
 export declare function syncSelectionToCodex(tokens: TokenSuccessWithAccount): Promise<void>;
 //# sourceMappingURL=login-oauth.d.ts.map

package/dist/lib/codex-manager/login-oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login-oauth.d.ts","sourceRoot":"","sources":["../../../lib/codex-manager/login-oauth.ts"],"names":[],"mappings":"AAEA,OAAO,EAON,KAAK,SAAS,EACd,MAAM,gBAAgB,CAAC;AAsBxB,OAAO,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEhE,OAAO,EACN,KAAK,uBAAuB,EAG5B,MAAM,yBAAyB,CAAC;AAOjC;;;;;GAKG;AAEH,gBAAgB;AAChB,MAAM,MAAM,YAAY,GAAG,OAAO,CAAC,WAAW,EAAE;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,CAAC,CAAC;AACrE,gBAAgB;AAChB,MAAM,MAAM,uBAAuB,GAAG,YAAY,GAAG;IACpD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;CACzB,CAAC;AAIF,gBAAgB;AAChB,wBAAgB,mBAAmB,CAClC,MAAM,EAAE,OAAO,CAAC,WAAW,EAAE;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,CAAC,GAC/C,OAAO,CAGT;AAED,gBAAgB;AAChB,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAIpD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CACtC,MAAM,EAAE,YAAY,EACpB,WAAW,CAAC,EAAE,MAAM,GAClB,uBAAuB,CA+DzB;AA0FD,gBAAgB;AAChB,MAAM,MAAM,eAAe,GACxB,SAAS,GACT,QAAQ,GACR,QAAQ,GACR,gBAAgB,GAChB,QAAQ,CAAC;AACZ,gBAAgB;AAChB,MAAM,MAAM,iBAAiB,GAAG;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,gBAAgB;AAChB,wBAAsB,YAAY,CACjC,aAAa,EAAE,OAAO,EACtB,UAAU,EAAE,OAAO,CAAC,eAAe,EAAE,SAAS,GAAG,QAAQ,CAAC,GACxD,OAAO,CAAC,WAAW,CAAC,CA6ItB;AAED,gBAAgB;AAChB,wBAAsB,aAAa,CAClC,aAAa,EAAE,OAAO,EACtB,UAAU,EAAE,OAAO,CAAC,eAAe,EAAE,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAC,EACrE,OAAO,GAAE,iBAAsB,GAC7B,OAAO,CAAC,WAAW,CAAC,CAetB;AAED,gBAAgB;AAChB,MAAM,MAAM,yBAAyB,GAAG,uBAAuB,CAAC;AAEhE,gBAAgB;AAChB,wBAAsB,kBAAkB,CACvC,OAAO,EAAE,uBAAuB,EAAE,EAClC,UAAU,EAAE,OAAO,GACjB,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC,CAuD3C;AAED,gBAAgB;AAChB,wBAAsB,oBAAoB,CACzC,MAAM,EAAE,uBAAuB,GAC7B,OAAO,CAAC,IAAI,CAAC,CAkBf"}
+{"version":3,"file":"login-oauth.d.ts","sourceRoot":"","sources":["../../../lib/codex-manager/login-oauth.ts"],"names":[],"mappings":"AAEA,OAAO,EAON,KAAK,SAAS,EACd,MAAM,gBAAgB,CAAC;AAkBxB,OAAO,EACN,KAAK,iBAAiB,EAGtB,MAAM,eAAe,CAAC;AAGvB,OAAO,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEhE,OAAO,EACN,KAAK,uBAAuB,EAG5B,MAAM,yBAAyB,CAAC;AAOjC;;;;;GAKG;AAEH,gBAAgB;AAChB,MAAM,MAAM,YAAY,GAAG,OAAO,CAAC,WAAW,EAAE;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,CAAC,CAAC;AACrE,gBAAgB;AAChB,MAAM,MAAM,uBAAuB,GAAG,YAAY,GAAG;IACpD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;CACzB,CAAC;AAIF,gBAAgB;AAChB,wBAAgB,mBAAmB,CAClC,MAAM,EAAE,OAAO,CAAC,WAAW,EAAE;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,CAAC,GAC/C,OAAO,CAGT;AAED,gBAAgB;AAChB,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAIpD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CACtC,MAAM,EAAE,YAAY,EACpB,WAAW,CAAC,EAAE,MAAM,EACpB,eAAe,CAAC,EAAE,MAAM,GACtB,uBAAuB,CAiGzB;AA0FD,gBAAgB;AAChB,MAAM,MAAM,eAAe,GACxB,SAAS,GACT,QAAQ,GACR,QAAQ,GACR,gBAAgB,GAChB,QAAQ,CAAC;AACZ,gBAAgB;AAChB,MAAM,MAAM,iBAAiB,GAAG;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,gBAAgB;AAChB,wBAAsB,YAAY,CACjC,aAAa,EAAE,OAAO,EACtB,UAAU,EAAE,OAAO,CAAC,eAAe,EAAE,SAAS,GAAG,QAAQ,CAAC,GACxD,OAAO,CAAC,WAAW,CAAC,CA6ItB;AAED,gBAAgB;AAChB,wBAAsB,aAAa,CAClC,aAAa,EAAE,OAAO,EACtB,UAAU,EAAE,OAAO,CAAC,eAAe,EAAE,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAC,EACrE,OAAO,GAAE,iBAAsB,GAC7B,OAAO,CAAC,WAAW,CAAC,CAetB;AAED,gBAAgB;AAChB,MAAM,MAAM,yBAAyB,GAAG,uBAAuB,CAAC;AAEhE,gBAAgB;AAChB,MAAM,WAAW,wBAAwB;IACxC,0EAA0E;IAC1E,OAAO,EAAE,yBAAyB,CAAC;IACnC,iDAAiD;IACjD,YAAY,EAAE,MAAM,CAAC;IACrB,8CAA8C;IAC9C,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,eAAe,EAAE,OAAO,CAAC;IACzB,uEAAuE;IACvE,cAAc,EAAE,OAAO,CAAC;CACxB;AAED,gBAAgB;AAChB,MAAM,MAAM,oBAAoB,GAAG,IAAI,CACtC,iBAAiB,EACjB,UAAU,GAAG,WAAW,GAAG,OAAO,GAAG,cAAc,CACnD,CAAC;AAEF,gBAAgB;AAChB,MAAM,WAAW,yBAAyB;IACzC,0EAA0E;IAC1E,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,sEAAsE;IACtE,eAAe,CAAC,EAAE,oBAAoB,CAAC;IACvC;;;;;;;OAOG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAuGD,gBAAgB;AAChB,wBAAsB,kBAAkB,CACvC,OAAO,EAAE,uBAAuB,EAAE,EAClC,UAAU,EAAE,OAAO,EACnB,OAAO,GAAE,yBAA8B,GACrC,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC,CAuJ1C;AAED,gBAAgB;AAChB,wBAAsB,oBAAoB,CACzC,MAAM,EAAE,uBAAuB,GAC7B,OAAO,CAAC,IAAI,CAAC,CAkBf"}

package/dist/lib/codex-manager/login-oauth.js

@@ -11,6 +11,8 @@ import { setCodexCliActiveSelection } from "../codex-cli/writer.js";
 import { createLogger } from "../logger.js";
 import { MODEL_FAMILIES } from "../prompts/codex.js";
 import { findMatchingAccountIndex, withAccountStorageTransaction, } from "../storage.js";
+import { cloneAccountStorageForPersistence } from "../storage/account-persistence.js";
+import { CodexValidationError } from "../errors.js";
 import { UI_COPY } from "../ui/ui-copy.js";
 import { applyAccountPoolResults, } from "./account-pool-write.js";
 import { stylePromptText } from "./formatters/index.js";
@@ -39,7 +41,7 @@ export function isAbortError(error) {
  *
  * @internal
  */
-export function resolveAccountSelection(tokens, orgOverride) {
+export function resolveAccountSelection(tokens, orgOverride, targetAccountId) {
     const candidates = getAccountIdCandidates(tokens.access, tokens.idToken);
     // Surface every workspace/organization exposed by the token so the saved
     // account can track them (issue #491/#512). Without this, same-email
@@ -54,18 +56,50 @@ export function resolveAccountSelection(tokens, orgOverride) {
             isDefault: candidate.isDefault,
         }))
         : undefined;
-    const override = resolveOrgOverride(orgOverride);
-    if (override) {
-        // Prefer the token candidate's human label for the chosen org so the
-        // saved row is identifiable, falling back to a bare manual binding.
-        const matched = candidates.find((candidate) => candidate.accountId === override);
-        return {
-            ...tokens,
-            accountIdOverride: override,
-            accountIdSource: "manual",
-            accountLabel: matched?.label,
-            workspaces,
-        };
+    // A targeted re-authentication names one saved row, which is a stricter and
+    // more specific instruction than the ambient CODEX_AUTH_ACCOUNT_ID env var
+    // that resolveOrgOverride also honours. Consulting the override first let an
+    // unrelated exported org id hijack `login --account <n>` and then fail the
+    // identity guard with a misleading "does not match" message. An explicit
+    // `--org` cannot reach here alongside a target: parseAuthLoginArgs rejects
+    // that combination outright.
+    if (targetAccountId) {
+        const targetedCandidate = candidates.find((candidate) => candidate.accountId === targetAccountId);
+        if (targetedCandidate) {
+            return {
+                ...tokens,
+                accountIdOverride: targetedCandidate.accountId,
+                // `id_token` candidates auto-follow the access token inside
+                // resolveRequestAccountId, which would rewrite this binding back to
+                // the access-token account and make the caller's own identity guard
+                // reject the write. Pin those as an explicit selection; a `token`
+                // candidate already IS the access-token account, and an `org`
+                // candidate never auto-follows, so both keep their source.
+                accountIdSource: targetedCandidate.source === "id_token"
+                    ? "manual"
+                    : targetedCandidate.source,
+                accountLabel: targetedCandidate.label,
+                workspaces,
+            };
+        }
+        // The user signed in as somebody else. Fall through to the generic
+        // selection so persistAccountPool refuses the write with the precise
+        // identity-mismatch message instead of a confusing override error.
+    }
+    else {
+        const override = resolveOrgOverride(orgOverride);
+        if (override) {
+            // Prefer the token candidate's human label for the chosen org so the
+            // saved row is identifiable, falling back to a bare manual binding.
+            const matched = candidates.find((candidate) => candidate.accountId === override);
+            return {
+                ...tokens,
+                accountIdOverride: override,
+                accountIdSource: "manual",
+                accountLabel: matched?.label,
+                workspaces,
+            };
+        }
     }
     if (candidates.length === 0) {
         return tokens;
@@ -300,8 +334,81 @@ export async function runSignInFlow(forceNewLogin, signInMode, options = {}) {
     }
     return runOAuthFlow(forceNewLogin, signInMode);
 }
+function sameExpectedLoginIdentity(write, expected) {
+    const expectedAccountId = expected.accountId?.trim();
+    const incomingAccountId = write.accountId?.trim();
+    const expectedEmail = sanitizeEmail(expected.email);
+    const incomingEmail = sanitizeEmail(write.email);
+    // When the saved row already carries the provider identity it is
+    // authoritative and the incoming login must match it: the id survives an
+    // email change, and falling back to a shared email across workspaces would
+    // let a targeted re-auth overwrite the wrong saved account.
+    if (expectedAccountId) {
+        return incomingAccountId === expectedAccountId;
+    }
+    // A pre-#491 row saved before workspace tracking carries no account id at
+    // all. Fresh tokens essentially always carry one, so demanding the id on both
+    // sides made every legacy row permanently un-refreshable through --account.
+    // Email is the only identity such a row has, and the caller already resolved
+    // it to a single unambiguous row before starting the sign-in.
+    return Boolean(expectedEmail && incomingEmail === expectedEmail);
+}
+function matchesExpectedAccount(account, expected) {
+    if (!account)
+        return false;
+    if (expected.recordId && account.recordId) {
+        return account.recordId === expected.recordId;
+    }
+    const expectedAccountId = expected.accountId?.trim();
+    const candidateAccountId = account.accountId?.trim();
+    if (expectedAccountId || candidateAccountId) {
+        return Boolean(expectedAccountId &&
+            candidateAccountId &&
+            expectedAccountId === candidateAccountId);
+    }
+    const expectedEmail = sanitizeEmail(expected.email);
+    const candidateEmail = sanitizeEmail(account.email);
+    if (expectedEmail || candidateEmail) {
+        return Boolean(expectedEmail && candidateEmail === expectedEmail);
+    }
+    return account.refreshToken === expected.refreshToken;
+}
+/**
+ * Locate the saved row a targeted re-authentication must write.
+ *
+ * Resolution is deliberately identity-first and refresh-token-last. The runtime
+ * rotation proxy rewrites a stored refreshToken whenever it refreshes an account
+ * (AccountManager.commitRefreshedAuth), so a sign-in that overlaps a live codex
+ * session would otherwise "lose" its own target and throw away a completed
+ * OAuth. `recordId` is exact when both sides have one, the caller's position is
+ * honoured only while the row sitting there is still the same identity, and
+ * findMatchingAccountIndex supplies the same composite/email/refresh-token
+ * ladder the rest of the pool already resolves identities with.
+ */
+function resolveExpectedAccountIndex(accounts, expected, hintedIndex) {
+    if (expected.recordId) {
+        const byRecordId = accounts.findIndex((account) => account?.recordId === expected.recordId);
+        if (byRecordId >= 0)
+            return byRecordId;
+    }
+    if (validSelectionIndex(hintedIndex, accounts) &&
+        matchesExpectedAccount(accounts[hintedIndex], expected)) {
+        return hintedIndex;
+    }
+    return findMatchingAccountIndex(accounts, {
+        accountId: expected.accountId,
+        email: expected.email,
+        refreshToken: expected.refreshToken,
+    }, { allowUniqueAccountIdFallbackWithoutEmail: true });
+}
+function validSelectionIndex(index, accounts) {
+    return (typeof index === "number" &&
+        Number.isInteger(index) &&
+        index >= 0 &&
+        index < accounts.length);
+}
 /** @internal */
-export async function persistAccountPool(results, replaceAll) {
+export async function persistAccountPool(results, replaceAll, options = {}) {
     if (results.length === 0)
         return null;
     return await withAccountStorageTransaction(async (loadedStorage, persist) => {
@@ -324,26 +431,101 @@ export async function persistAccountPool(results, replaceAll) {
                 accessToken: result.access,
                 expiresAt: result.expires,
                 workspaces: result.workspaces,
+                // A targeted re-auth only tops up credentials for the row the user
+                // named; it must not silently re-enable an account they disabled.
+                preserveEnabledState: Boolean(options.expectedAccount),
                 now,
             };
         });
+        if (options.expectedAccount && writes.length !== 1) {
+            throw new CodexValidationError("Targeted re-authentication accepts exactly one OAuth result. No saved credentials were changed.");
+        }
+        const expectedAccountIndex = options.expectedAccount && stored
+            ? resolveExpectedAccountIndex(stored.accounts, options.expectedAccount, options.expectedAccountIndex)
+            : undefined;
+        if (options.expectedAccount && expectedAccountIndex === undefined) {
+            throw new CodexValidationError("The requested Codex account is no longer present. No saved credentials were changed.");
+        }
+        const expectedAccount = options.expectedAccount;
+        if (expectedAccount &&
+            writes.some((write) => !sameExpectedLoginIdentity(write, expectedAccount))) {
+            throw new CodexValidationError("The authenticated Codex identity does not match the account requested for re-authentication. No saved credentials were changed.");
+        }
         const { accounts, activeIndex, outcome } = applyAccountPoolResults({
             existing,
             writes,
             priorActiveIndex: stored?.activeIndex,
-            findMatchingAccountIndex,
+            findMatchingAccountIndex: expectedAccountIndex === undefined
+                ? findMatchingAccountIndex
+                : () => expectedAccountIndex,
         });
+        const nextActiveIndex = options.preserveSelection &&
+            validSelectionIndex(stored?.activeIndex, accounts)
+            ? stored.activeIndex
+            : activeIndex;
+        const priorActiveIndex = stored?.activeIndex;
         const activeIndexByFamily = {};
         for (const family of MODEL_FAMILIES) {
-            activeIndexByFamily[family] = activeIndex;
+            const storedFamilyIndex = stored?.activeIndexByFamily?.[family];
+            const priorFamilyIndex = storedFamilyIndex ?? priorActiveIndex;
+            if (!validSelectionIndex(priorFamilyIndex, accounts)) {
+                activeIndexByFamily[family] = nextActiveIndex;
+                continue;
+            }
+            if (options.preserveSelection) {
+                activeIndexByFamily[family] = priorFamilyIndex;
+                continue;
+            }
+            // A family the user deliberately pointed at a DIFFERENT account than
+            // the global selection is a setting of its own, and a plain login must
+            // not silently drag it onto the account just signed in: adding a third
+            // account used to move a deliberate `codex-max -> account 2` binding
+            // onto account 3. Families that were merely following the global
+            // selection keep following it, which is what makes a plain login still
+            // feel like "this new account is now the one in use".
+            //
+            // Indices stay meaningful here because login only updates a row in
+            // place or appends one; it never reorders or removes the pool.
+            const followedGlobalSelection = storedFamilyIndex === undefined || storedFamilyIndex === priorActiveIndex;
+            activeIndexByFamily[family] = followedGlobalSelection
+                ? nextActiveIndex
+                : priorFamilyIndex;
         }
-        await persist({
-            version: 3,
-            accounts,
-            activeIndex,
-            activeIndexByFamily,
-        });
-        return outcome;
+        // Reuse the shared persistence clone so the pin/affinity carry-over rule
+        // (issue #474) keeps living in exactly one place instead of being
+        // re-derived at every write site with a slightly different validity check.
+        const nextStorage = cloneAccountStorageForPersistence(stored);
+        nextStorage.accounts = accounts;
+        nextStorage.activeIndex = nextActiveIndex;
+        nextStorage.activeIndexByFamily = activeIndexByFamily;
+        // A selection-preserving login leaves the pool exactly where it was, so a
+        // manual `switch <n>` pin survives it: login only updates a row in place
+        // or appends one and never reorders, so the raw position still points at
+        // the row the user pinned even when two rows share an identity.
+        //
+        // A plain login is the opposite. It moves activeIndex onto the account
+        // just signed in and publishes that account to ~/.codex/auth.json.
+        // Carrying an old pin through it would leave storage claiming one account
+        // is active while the runtime proxy routes every request to another
+        // (runtime-rotation-proxy resolves pinnedAccountIndex first) -- the
+        // contradiction `status` reports as "runtime using N but pin requests M".
+        if (!options.preserveSelection ||
+            !validSelectionIndex(nextStorage.pinnedAccountIndex, accounts)) {
+            delete nextStorage.pinnedAccountIndex;
+        }
+        await persist(nextStorage);
+        if (outcome === null)
+            return null;
+        return {
+            outcome,
+            accountIndex: activeIndex,
+            activeIndex: nextActiveIndex,
+            // The Codex CLI reads the `codex` family selection, so that -- not the
+            // bare global index -- decides whether this write owns the native
+            // ~/.codex/auth.json credentials.
+            isActiveAccount: activeIndex === (activeIndexByFamily.codex ?? nextActiveIndex),
+            accountEnabled: accounts[activeIndex]?.enabled !== false,
+        };
     });
 }
 /** @internal */

package/dist/lib/usage/ledger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ledger.d.ts","sourceRoot":"","sources":["../../../lib/usage/ledger.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EACX,sBAAsB,EAEtB,gBAAgB,EAChB,gBAAgB,EAEhB,cAAc,EAEd,YAAY,EAGZ,iBAAiB,EAEjB,MAAM,YAAY,CAAC;AAqOpB,wBAAgB,mBAAmB,IAAI,gBAAgB,CAMtD;AAED,wBAAsB,oBAAoB,CACzC,KAAK,EAAE,sBAAsB,GAC3B,OAAO,CAAC,cAAc,CAAC,CASzB;AA+JD,wBAAsB,mBAAmB,CACxC,KAAK,GAAE,gBAAqB,GAC1B,OAAO,CAAC,cAAc,EAAE,CAAC,CAc3B;AAgDD,wBAAgB,kBAAkB,CACjC,IAAI,EAAE,cAAc,EAAE,EACtB,KAAK,GAAE,iBAAsB,GAC3B,YAAY,CAwBd;AAED,wBAAsB,oBAAoB,CACzC,KAAK,GAAE,iBAAsB,GAC3B,OAAO,CAAC,YAAY,CAAC,CAEvB;AAED,wBAAsB,iBAAiB,CAAC,OAAO,GAAE;IAChD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,iBAAiB,CAAC,EAAE,MAAM,CAAC;CACtB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA2B9B;AAED,wBAAgB,6BAA6B,IAAI,IAAI,CAEpD"}
+{"version":3,"file":"ledger.d.ts","sourceRoot":"","sources":["../../../lib/usage/ledger.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EACX,sBAAsB,EAEtB,gBAAgB,EAChB,gBAAgB,EAEhB,cAAc,EAEd,YAAY,EAGZ,iBAAiB,EAEjB,MAAM,YAAY,CAAC;AAqOpB,wBAAgB,mBAAmB,IAAI,gBAAgB,CAMtD;AAED,wBAAsB,oBAAoB,CACzC,KAAK,EAAE,sBAAsB,GAC3B,OAAO,CAAC,cAAc,CAAC,CASzB;AA+JD,wBAAsB,mBAAmB,CACxC,KAAK,GAAE,gBAAqB,GAC1B,OAAO,CAAC,cAAc,EAAE,CAAC,CAc3B;AAuDD,wBAAgB,kBAAkB,CACjC,IAAI,EAAE,cAAc,EAAE,EACtB,KAAK,GAAE,iBAAsB,GAC3B,YAAY,CAwBd;AAED,wBAAsB,oBAAoB,CACzC,KAAK,GAAE,iBAAsB,GAC3B,OAAO,CAAC,YAAY,CAAC,CAEvB;AAED,wBAAsB,iBAAiB,CAAC,OAAO,GAAE;IAChD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,iBAAiB,CAAC,EAAE,MAAM,CAAC;CACtB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA2B9B;AAED,wBAAgB,6BAA6B,IAAI,IAAI,CAEpD"}

package/dist/lib/usage/ledger.js

@@ -405,6 +405,7 @@ function createBucket(key) {
         reasoningTokens: 0,
         totalTokens: 0,
         costUsd: 0,
+        unpricedRequests: 0,
     };
 }
 function getBucketKey(row, by) {
@@ -437,6 +438,12 @@ function addRowToBucket(bucket, row) {
     bucket.reasoningTokens += row.tokens.reasoningTokens;
     bucket.totalTokens += row.tokens.totalTokens;
     bucket.costUsd = Number((bucket.costUsd + (row.costUsd ?? 0)).toFixed(8));
+    // Only rows that actually consumed tokens count as unpriced spend. A blocked
+    // or cancelled request carries no tokens and no cost, and must not make a
+    // cost budget unevaluable.
+    if (row.costUsd === null && row.tokens.totalTokens > 0) {
+        bucket.unpricedRequests += 1;
+    }
 }
 export function summarizeUsageRows(rows, query = {}) {
     const by = query.by ?? "model";

package/dist/lib/usage/pricing.d.ts

@@ -5,6 +5,21 @@ export interface UsageModelPricing {
     cachedInputUsdPerMillion?: number;
     reasoningUsdPerMillion?: number;
 }
+/**
+ * Models the router can normalize to that have no published rate here yet.
+ *
+ * Their cost is deliberately reported as unknown (`null`) rather than guessed:
+ * a wrong dollar figure is worse than no figure, and it would silently move a
+ * `maxCostUsd` budget's trip point. Nothing may treat an unknown cost as zero —
+ * `evaluateBudgetGuard` refuses a cost budget while unknown-cost usage is in
+ * the window instead of counting it as free (that under-count made cost caps
+ * unenforceable for exactly these models, every `pro` tier among them).
+ *
+ * Add a real rate to MODEL_PRICING and delete the entry here once published;
+ * `test/usage-pricing-coverage.test.ts` fails if a NEW routable model appears
+ * in neither list.
+ */
+export declare const UNPRICED_ROUTABLE_MODELS: readonly ["gpt-5.1", "gpt-5.2-pro", "gpt-5.4-mini", "gpt-5.4-nano", "gpt-5.4-pro", "gpt-5.5-pro", "gpt-5-mini", "gpt-5-nano"];
 export declare function getUsageModelPricing(model: string | null | undefined): UsageModelPricing | null;
 export declare function estimateUsageCostUsd(model: string | null | undefined, tokens: UsageTokenCounts): number | null;
 export declare function listUsageModelPricing(): Record<string, UsageModelPricing>;

package/dist/lib/usage/pricing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pricing.d.ts","sourceRoot":"","sources":["../../../lib/usage/pricing.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEnD,MAAM,WAAW,iBAAiB;IACjC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,sBAAsB,CAAC,EAAE,MAAM,CAAC;CAChC;AAgED,wBAAgB,oBAAoB,CACnC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC9B,iBAAiB,GAAG,IAAI,CAM1B;AAED,wBAAgB,oBAAoB,CACnC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,MAAM,EAAE,gBAAgB,GACtB,MAAM,GAAG,IAAI,CAqBf;AAED,wBAAgB,qBAAqB,IAAI,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAEzE"}
+{"version":3,"file":"pricing.d.ts","sourceRoot":"","sources":["../../../lib/usage/pricing.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEnD,MAAM,WAAW,iBAAiB;IACjC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,sBAAsB,CAAC,EAAE,MAAM,CAAC;CAChC;AA2DD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,wBAAwB,+HAS3B,CAAC;AAOX,wBAAgB,oBAAoB,CACnC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC9B,iBAAiB,GAAG,IAAI,CAM1B;AAED,wBAAgB,oBAAoB,CACnC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,MAAM,EAAE,gBAAgB,GACtB,MAAM,GAAG,IAAI,CAqBf;AAED,wBAAgB,qBAAqB,IAAI,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAEzE"}

package/dist/lib/usage/pricing.js

@@ -54,6 +54,30 @@ const MODEL_PRICING = {
         reasoningUsdPerMillion: 6,
     },
 };
+/**
+ * Models the router can normalize to that have no published rate here yet.
+ *
+ * Their cost is deliberately reported as unknown (`null`) rather than guessed:
+ * a wrong dollar figure is worse than no figure, and it would silently move a
+ * `maxCostUsd` budget's trip point. Nothing may treat an unknown cost as zero —
+ * `evaluateBudgetGuard` refuses a cost budget while unknown-cost usage is in
+ * the window instead of counting it as free (that under-count made cost caps
+ * unenforceable for exactly these models, every `pro` tier among them).
+ *
+ * Add a real rate to MODEL_PRICING and delete the entry here once published;
+ * `test/usage-pricing-coverage.test.ts` fails if a NEW routable model appears
+ * in neither list.
+ */
+export const UNPRICED_ROUTABLE_MODELS = [
+    "gpt-5.1",
+    "gpt-5.2-pro",
+    "gpt-5.4-mini",
+    "gpt-5.4-nano",
+    "gpt-5.4-pro",
+    "gpt-5.5-pro",
+    "gpt-5-mini",
+    "gpt-5-nano",
+];
 function normalizeModelName(model) {
     const trimmed = model?.trim().toLowerCase();
     return trimmed && trimmed.length > 0 ? trimmed : null;

package/dist/lib/usage/types.d.ts

@@ -74,6 +74,12 @@ export interface UsageSummaryBucket {
     reasoningTokens: number;
     totalTokens: number;
     costUsd: number;
+    /**
+     * Requests that consumed tokens but could not be priced, so `costUsd` is an
+     * UNDER-count by an unknown amount. A cost budget cannot be evaluated while
+     * this is above zero; see `evaluateBudgetGuard`.
+     */
+    unpricedRequests: number;
 }
 export interface UsageSummary {
     since: number | null;

package/dist/lib/usage/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../lib/usage/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,iBAAiB,GAC1B,eAAe,GACf,aAAa,GACb,cAAc,GACd,KAAK,GACL,SAAS,CAAC;AAEb,MAAM,MAAM,oBAAoB,GAC7B,WAAW,GACX,QAAQ,GACR,aAAa,GACb,cAAc,GACd,YAAY,GACZ,SAAS,CAAC;AAEb,MAAM,MAAM,kBAAkB,GAC3B,SAAS,GACT,SAAS,GACT,SAAS,GACT,WAAW,CAAC;AAEf,MAAM,WAAW,gBAAgB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,qBAAqB;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC9B,OAAO,EAAE,CAAC,CAAC;IACX,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,iBAAiB,CAAC;IAC1B,SAAS,EAAE,oBAAoB,CAAC;IAChC,OAAO,EAAE,kBAAkB,CAAC;IAC5B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,EAAE,qBAAqB,GAAG,IAAI,CAAC;IACtC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,EAAE,gBAAgB,CAAC;IACzB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,sBAAsB;IACtC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B,SAAS,CAAC,EAAE,oBAAoB,CAAC;IACjC,OAAO,EAAE,kBAAkB,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,MAAM,MAAM,mBAAmB,GAC5B,OAAO,GACP,SAAS,GACT,SAAS,GACT,SAAS,GACT,KAAK,CAAC;AAET,MAAM,WAAW,gBAAgB;IAChC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAAC;IAC/B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAAC;IAC/B,eAAe,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,iBAAkB,SAAQ,gBAAgB;IAC1D,EAAE,CAAC,EAAE,mBAAmB,CAAC;CACzB;AAED,MAAM,WAAW,kBAAkB;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC5B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,EAAE,EAAE,mBAAmB,CAAC;IACxB,MAAM,EAAE,kBAAkB,CAAC;IAC3B,OAAO,EAAE,kBAAkB,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,gBAAgB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;CAChB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../lib/usage/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,iBAAiB,GAC1B,eAAe,GACf,aAAa,GACb,cAAc,GACd,KAAK,GACL,SAAS,CAAC;AAEb,MAAM,MAAM,oBAAoB,GAC7B,WAAW,GACX,QAAQ,GACR,aAAa,GACb,cAAc,GACd,YAAY,GACZ,SAAS,CAAC;AAEb,MAAM,MAAM,kBAAkB,GAC3B,SAAS,GACT,SAAS,GACT,SAAS,GACT,WAAW,CAAC;AAEf,MAAM,WAAW,gBAAgB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,qBAAqB;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC9B,OAAO,EAAE,CAAC,CAAC;IACX,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,iBAAiB,CAAC;IAC1B,SAAS,EAAE,oBAAoB,CAAC;IAChC,OAAO,EAAE,kBAAkB,CAAC;IAC5B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,EAAE,qBAAqB,GAAG,IAAI,CAAC;IACtC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,EAAE,gBAAgB,CAAC;IACzB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,sBAAsB;IACtC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B,SAAS,CAAC,EAAE,oBAAoB,CAAC;IACjC,OAAO,EAAE,kBAAkB,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,MAAM,MAAM,mBAAmB,GAC5B,OAAO,GACP,SAAS,GACT,SAAS,GACT,SAAS,GACT,KAAK,CAAC;AAET,MAAM,WAAW,gBAAgB;IAChC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAAC;IAC/B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAAC;IAC/B,eAAe,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,iBAAkB,SAAQ,gBAAgB;IAC1D,EAAE,CAAC,EAAE,mBAAmB,CAAC;CACzB;AAED,MAAM,WAAW,kBAAkB;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,gBAAgB,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAC5B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,EAAE,EAAE,mBAAmB,CAAC;IACxB,MAAM,EAAE,kBAAkB,CAAC;IAC3B,OAAO,EAAE,kBAAkB,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,gBAAgB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;CAChB"}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "codex-multi-auth",
-	"version": "2.9.0",
+	"version": "2.9.1",
 	"description": "Codex CLI multi-account OAuth manager with account switching, health checks, runtime rotation, diagnostics, and recovery tools for @openai/codex",
 	"main": "./dist/index.js",
 	"types": "./dist/index.d.ts",