codex-team 0.0.5 → 0.0.7

package/dist/cli.cjs

@@ -13,8 +13,9 @@ var __webpack_modules__ = {
         const utc_js_namespaceObject = require("dayjs/plugin/utc.js");
         var utc_js_default = /*#__PURE__*/ __webpack_require__.n(utc_js_namespaceObject);
         var package_namespaceObject = {
-            rE: "0.0.5"
+            rE: "0.0.7"
         };
+        const external_node_crypto_namespaceObject = require("node:crypto");
         const promises_namespaceObject = require("node:fs/promises");
         function isRecord(value) {
             return "object" == typeof value && null !== value && !Array.isArray(value);
@@ -37,6 +38,29 @@ var __webpack_modules__ = {
             if ("number" != typeof value || Number.isNaN(value)) throw new Error(`Field "${fieldName}" must be a number.`);
             return value;
         }
+        function normalizeAuthMode(authMode) {
+            return authMode.trim().toLowerCase();
+        }
+        function isApiKeyAuthMode(authMode) {
+            return "apikey" === normalizeAuthMode(authMode);
+        }
+        function isSupportedChatGPTAuthMode(authMode) {
+            const normalized = normalizeAuthMode(authMode);
+            return "chatgpt" === normalized || "chatgpt_auth_tokens" === normalized;
+        }
+        function fingerprintApiKey(apiKey) {
+            return (0, external_node_crypto_namespaceObject.createHash)("sha256").update(apiKey).digest("hex").slice(0, 16);
+        }
+        function getSnapshotIdentity(snapshot) {
+            if (isApiKeyAuthMode(snapshot.auth_mode)) {
+                const apiKey = snapshot.OPENAI_API_KEY;
+                if ("string" != typeof apiKey || "" === apiKey.trim()) throw new Error('Field "OPENAI_API_KEY" must be a non-empty string for apikey auth.');
+                return `key_${fingerprintApiKey(apiKey)}`;
+            }
+            const accountId = snapshot.tokens?.account_id;
+            if ("string" != typeof accountId || "" === accountId.trim()) throw new Error('Field "tokens.account_id" must be a non-empty string.');
+            return accountId;
+        }
         function defaultQuotaSnapshot() {
             return {
                 status: "stale"
@@ -81,15 +105,28 @@ var __webpack_modules__ = {
             }
             if (!isRecord(parsed)) throw new Error("Auth snapshot must be a JSON object.");
             const authMode = asNonEmptyString(parsed.auth_mode, "auth_mode");
-            if (!isRecord(parsed.tokens)) throw new Error('Field "tokens" must be an object.');
-            const accountId = asNonEmptyString(parsed.tokens.account_id, "tokens.account_id");
+            const tokens = parsed.tokens;
+            if (null != tokens && !isRecord(tokens)) throw new Error('Field "tokens" must be an object.');
+            const apiKeyMode = isApiKeyAuthMode(authMode);
+            const normalizedApiKey = null === parsed.OPENAI_API_KEY || void 0 === parsed.OPENAI_API_KEY ? parsed.OPENAI_API_KEY : asNonEmptyString(parsed.OPENAI_API_KEY, "OPENAI_API_KEY");
+            if (apiKeyMode) {
+                if ("string" != typeof normalizedApiKey || "" === normalizedApiKey.trim()) throw new Error('Field "OPENAI_API_KEY" must be a non-empty string for apikey auth.');
+            } else {
+                if (!isRecord(tokens)) throw new Error('Field "tokens" must be an object.');
+                asNonEmptyString(tokens.account_id, "tokens.account_id");
+            }
             return {
                 ...parsed,
                 auth_mode: authMode,
-                tokens: {
-                    ...parsed.tokens,
-                    account_id: accountId
-                }
+                OPENAI_API_KEY: normalizedApiKey,
+                ...isRecord(tokens) ? {
+                    tokens: {
+                        ...tokens,
+                        ..."string" == typeof tokens.account_id && "" !== tokens.account_id.trim() ? {
+                            account_id: tokens.account_id
+                        } : {}
+                    }
+                } : {}
             };
         }
         async function readAuthSnapshotFile(filePath) {
@@ -101,7 +138,7 @@ var __webpack_modules__ = {
             return {
                 name,
                 auth_mode: snapshot.auth_mode,
-                account_id: snapshot.tokens.account_id,
+                account_id: getSnapshotIdentity(snapshot),
                 created_at: existingCreatedAt ?? timestamp,
                 updated_at: timestamp,
                 last_switched_at: null,
@@ -158,16 +195,13 @@ var __webpack_modules__ = {
             const value = payload[key];
             return "string" == typeof value && "" !== value.trim() ? value : void 0;
         }
-        function isSupportedChatGPTMode(authMode) {
-            const normalized = authMode.trim().toLowerCase();
-            return "chatgpt" === normalized || "chatgpt_auth_tokens" === normalized;
-        }
         function parsePlanType(snapshot) {
+            const tokens = snapshot.tokens ?? {};
             for (const tokenName of [
                 "id_token",
                 "access_token"
             ]){
-                const token = snapshot.tokens[tokenName];
+                const token = tokens[tokenName];
                 if ("string" == typeof token && "" !== token.trim()) try {
                     const payload = decodeJwtPayload(token);
                     const authClaim = extractAuthClaim(payload);
@@ -178,10 +212,11 @@ var __webpack_modules__ = {
         }
         function extractChatGPTAuth(snapshot) {
             const authMode = snapshot.auth_mode ?? "";
-            const supported = isSupportedChatGPTMode(authMode);
-            const accessTokenValue = snapshot.tokens.access_token;
-            const refreshTokenValue = snapshot.tokens.refresh_token;
-            const directAccountId = snapshot.tokens.account_id;
+            const supported = isSupportedChatGPTAuthMode(authMode);
+            const tokens = snapshot.tokens ?? {};
+            const accessTokenValue = tokens.access_token;
+            const refreshTokenValue = tokens.refresh_token;
+            const directAccountId = tokens.account_id;
             let accountId = "string" == typeof directAccountId && "" !== directAccountId.trim() ? directAccountId : void 0;
             let planType;
             let issuer;
@@ -190,7 +225,7 @@ var __webpack_modules__ = {
                 "id_token",
                 "access_token"
             ]){
-                const token = snapshot.tokens[tokenName];
+                const token = tokens[tokenName];
                 if ("string" == typeof token && "" !== token.trim()) try {
                     const payload = decodeJwtPayload(token);
                     const authClaim = extractAuthClaim(payload);
@@ -372,7 +407,7 @@ var __webpack_modules__ = {
                 ...snapshot,
                 last_refresh: (options.now ?? new Date()).toISOString(),
                 tokens: {
-                    ...snapshot.tokens,
+                    ...snapshot.tokens ?? {},
                     access_token: payload.access_token,
                     id_token: payload.id_token,
                     refresh_token: payload.refresh_token ?? extracted.refreshToken,
@@ -421,6 +456,7 @@ var __webpack_modules__ = {
                 codexDir,
                 codexTeamDir,
                 currentAuthPath: (0, external_node_path_namespaceObject.join)(codexDir, "auth.json"),
+                currentConfigPath: (0, external_node_path_namespaceObject.join)(codexDir, "config.toml"),
                 accountsDir: (0, external_node_path_namespaceObject.join)(codexTeamDir, "accounts"),
                 backupsDir: (0, external_node_path_namespaceObject.join)(codexTeamDir, "backups"),
                 statePath: (0, external_node_path_namespaceObject.join)(codexTeamDir, "state.json")
@@ -513,17 +549,49 @@ var __webpack_modules__ = {
             accountMetaPath(name) {
                 return (0, external_node_path_namespaceObject.join)(this.accountDirectory(name), "meta.json");
             }
+            accountConfigPath(name) {
+                return (0, external_node_path_namespaceObject.join)(this.accountDirectory(name), "config.toml");
+            }
             async writeAccountAuthSnapshot(name, snapshot) {
                 await atomicWriteFile(this.accountAuthPath(name), stringifyJson(snapshot));
             }
             async writeAccountMeta(name, meta) {
                 await atomicWriteFile(this.accountMetaPath(name), stringifyJson(meta));
             }
+            validateConfigSnapshot(name, snapshot, rawConfig) {
+                if ("apikey" !== snapshot.auth_mode) return;
+                if (!rawConfig) throw new Error(`Current ~/.codex/config.toml is required to save apikey account "${name}".`);
+                if (!/^\s*model_provider\s*=\s*["'][^"']+["']/mu.test(rawConfig)) throw new Error(`Current ~/.codex/config.toml is missing model_provider for apikey account "${name}".`);
+                if (!/^\s*base_url\s*=\s*["'][^"']+["']/mu.test(rawConfig)) throw new Error(`Current ~/.codex/config.toml is missing base_url for apikey account "${name}".`);
+            }
+            sanitizeConfigForAccountAuth(rawConfig) {
+                const lines = rawConfig.split(/\r?\n/u);
+                const result = [];
+                let skippingProviderSection = false;
+                for (const line of lines){
+                    const trimmed = line.trim();
+                    if (trimmed.startsWith("[") && trimmed.endsWith("]")) {
+                        skippingProviderSection = /^\[model_providers\.[^\]]+\]$/u.test(trimmed);
+                        if (skippingProviderSection) continue;
+                    }
+                    if (!skippingProviderSection) {
+                        if (!/^\s*model_provider\s*=/u.test(line)) {
+                            if (!/^\s*preferred_auth_method\s*=\s*["']apikey["']\s*$/u.test(line)) result.push(line);
+                        }
+                    }
+                }
+                return `${result.join("\n").replace(/\n{3,}/gu, "\n\n").trimEnd()}\n`;
+            }
+            async ensureEmptyAccountConfigSnapshot(name) {
+                const configPath = this.accountConfigPath(name);
+                await atomicWriteFile(configPath, "");
+                return configPath;
+            }
             async syncCurrentAuthIfMatching(snapshot) {
                 if (!await pathExists(this.paths.currentAuthPath)) return;
                 try {
                     const currentSnapshot = await readAuthSnapshotFile(this.paths.currentAuthPath);
-                    if (currentSnapshot.tokens.account_id !== snapshot.tokens.account_id) return;
+                    if (getSnapshotIdentity(currentSnapshot) !== getSnapshotIdentity(snapshot)) return;
                     await atomicWriteFile(this.paths.currentAuthPath, stringifyJson(snapshot));
                 } catch  {}
             }
@@ -579,11 +647,12 @@ var __webpack_modules__ = {
                 ]);
                 const meta = parseSnapshotMeta(rawMeta);
                 if (meta.name !== name) throw new Error(`Account metadata name mismatch for "${name}".`);
-                if (meta.account_id !== snapshot.tokens.account_id) throw new Error(`Account metadata account_id mismatch for "${name}".`);
+                if (meta.account_id !== getSnapshotIdentity(snapshot)) throw new Error(`Account metadata account_id mismatch for "${name}".`);
                 return {
                     ...meta,
                     authPath,
                     metaPath,
+                    configPath: await pathExists(this.accountConfigPath(name)) ? this.accountConfigPath(name) : null,
                     duplicateAccountId: false
                 };
             }
@@ -622,11 +691,12 @@ var __webpack_modules__ = {
                     warnings
                 };
                 const snapshot = await readAuthSnapshotFile(this.paths.currentAuthPath);
-                const matchedAccounts = accounts.filter((account)=>account.account_id === snapshot.tokens.account_id).map((account)=>account.name);
+                const currentIdentity = getSnapshotIdentity(snapshot);
+                const matchedAccounts = accounts.filter((account)=>account.account_id === currentIdentity).map((account)=>account.name);
                 return {
                     exists: true,
                     auth_mode: snapshot.auth_mode,
-                    account_id: snapshot.tokens.account_id,
+                    account_id: currentIdentity,
                     matched_accounts: matchedAccounts,
                     managed: matchedAccounts.length > 0,
                     duplicate_match: matchedAccounts.length > 1,
@@ -639,14 +709,21 @@ var __webpack_modules__ = {
                 if (!await pathExists(this.paths.currentAuthPath)) throw new Error("Current ~/.codex/auth.json does not exist.");
                 const rawSnapshot = await readJsonFile(this.paths.currentAuthPath);
                 const snapshot = parseAuthSnapshot(rawSnapshot);
+                const rawConfig = await pathExists(this.paths.currentConfigPath) ? await readJsonFile(this.paths.currentConfigPath) : null;
                 const accountDir = this.accountDirectory(name);
                 const authPath = this.accountAuthPath(name);
                 const metaPath = this.accountMetaPath(name);
+                const configPath = this.accountConfigPath(name);
                 const accountExists = await pathExists(accountDir);
                 const existingMeta = accountExists && await pathExists(metaPath) ? parseSnapshotMeta(await readJsonFile(metaPath)) : void 0;
                 if (accountExists && !force) throw new Error(`Account "${name}" already exists. Use --force to overwrite it.`);
+                this.validateConfigSnapshot(name, snapshot, rawConfig);
                 await ensureDirectory(accountDir, DIRECTORY_MODE);
                 await atomicWriteFile(authPath, `${rawSnapshot.trimEnd()}\n`);
+                if ("apikey" === snapshot.auth_mode && rawConfig) await atomicWriteFile(configPath, rawConfig.endsWith("\n") ? rawConfig : `${rawConfig}\n`);
+                else if (await pathExists(configPath)) await (0, promises_namespaceObject.rm)(configPath, {
+                    force: true
+                });
                 const meta = createSnapshotMeta(name, snapshot, new Date(), existingMeta?.created_at);
                 meta.last_switched_at = existingMeta?.last_switched_at ?? null;
                 meta.quota = existingMeta?.quota ?? meta.quota;
@@ -662,9 +739,15 @@ var __webpack_modules__ = {
                 const name = current.matched_accounts[0];
                 const currentRawSnapshot = await readJsonFile(this.paths.currentAuthPath);
                 const currentSnapshot = parseAuthSnapshot(currentRawSnapshot);
+                const currentRawConfig = await pathExists(this.paths.currentConfigPath) ? await readJsonFile(this.paths.currentConfigPath) : null;
                 const metaPath = this.accountMetaPath(name);
                 const existingMeta = parseSnapshotMeta(await readJsonFile(metaPath));
+                this.validateConfigSnapshot(name, currentSnapshot, currentRawConfig);
                 await atomicWriteFile(this.accountAuthPath(name), `${currentRawSnapshot.trimEnd()}\n`);
+                if ("apikey" === currentSnapshot.auth_mode && currentRawConfig) await atomicWriteFile(this.accountConfigPath(name), currentRawConfig.endsWith("\n") ? currentRawConfig : `${currentRawConfig}\n`);
+                else if (await pathExists(this.accountConfigPath(name))) await (0, promises_namespaceObject.rm)(this.accountConfigPath(name), {
+                    force: true
+                });
                 await atomicWriteFile(metaPath, stringifyJson({
                     ...createSnapshotMeta(name, currentSnapshot, new Date(), existingMeta.created_at),
                     last_switched_at: existingMeta.last_switched_at,
@@ -686,10 +769,25 @@ var __webpack_modules__ = {
                     await (0, promises_namespaceObject.copyFile)(this.paths.currentAuthPath, backupPath);
                     await chmodIfPossible(backupPath, FILE_MODE);
                 }
+                if (await pathExists(this.paths.currentConfigPath)) {
+                    const configBackupPath = (0, external_node_path_namespaceObject.join)(this.paths.backupsDir, "last-active-config.toml");
+                    await (0, promises_namespaceObject.copyFile)(this.paths.currentConfigPath, configBackupPath);
+                    await chmodIfPossible(configBackupPath, FILE_MODE);
+                }
                 const rawAuth = await readJsonFile(account.authPath);
                 await atomicWriteFile(this.paths.currentAuthPath, `${rawAuth.trimEnd()}\n`);
+                if ("apikey" === account.auth_mode && account.configPath) {
+                    const rawConfig = await readJsonFile(account.configPath);
+                    await atomicWriteFile(this.paths.currentConfigPath, rawConfig.endsWith("\n") ? rawConfig : `${rawConfig}\n`);
+                } else if ("apikey" === account.auth_mode) {
+                    await this.ensureEmptyAccountConfigSnapshot(name);
+                    warnings.push(`Saved apikey account "${name}" was missing config.toml snapshot. Created an empty snapshot; configure baseUrl manually if needed.`);
+                } else if (await pathExists(this.paths.currentConfigPath)) {
+                    const currentRawConfig = await readJsonFile(this.paths.currentConfigPath);
+                    await atomicWriteFile(this.paths.currentConfigPath, this.sanitizeConfigForAccountAuth(currentRawConfig));
+                }
                 const writtenSnapshot = await readAuthSnapshotFile(this.paths.currentAuthPath);
-                if (writtenSnapshot.tokens.account_id !== account.account_id) throw new Error(`Switch verification failed for account "${name}".`);
+                if (getSnapshotIdentity(writtenSnapshot) !== account.account_id) throw new Error(`Switch verification failed for account "${name}".`);
                 const meta = parseSnapshotMeta(await readJsonFile(account.metaPath));
                 meta.last_switched_at = new Date().toISOString();
                 meta.updated_at = meta.last_switched_at;
@@ -733,7 +831,7 @@ var __webpack_modules__ = {
                         await this.syncCurrentAuthIfMatching(result.authSnapshot);
                     }
                     meta.auth_mode = result.authSnapshot.auth_mode;
-                    meta.account_id = result.authSnapshot.tokens.account_id;
+                    meta.account_id = getSnapshotIdentity(result.authSnapshot);
                     meta.updated_at = now.toISOString();
                     meta.quota = result.quota;
                     await this.writeAccountMeta(name, meta);
@@ -845,7 +943,8 @@ var __webpack_modules__ = {
                     const metaStat = await (0, promises_namespaceObject.stat)(account.metaPath);
                     if ((511 & authStat.mode) !== FILE_MODE) issues.push(`Account "${account.name}" auth permissions must be 600.`);
                     if ((511 & metaStat.mode) !== FILE_MODE) issues.push(`Account "${account.name}" metadata permissions must be 600.`);
-                    if (account.duplicateAccountId) warnings.push(`Account "${account.name}" shares account_id ${account.account_id} with another saved account.`);
+                    if ("apikey" === account.auth_mode && !account.configPath) issues.push(`Account "${account.name}" is missing config.toml snapshot required for apikey auth.`);
+                    if (account.duplicateAccountId) warnings.push(`Account "${account.name}" shares identity ${account.account_id} with another saved account.`);
                 }
                 let currentAuthPresent = false;
                 if (await pathExists(this.paths.currentAuthPath)) {
@@ -928,7 +1027,7 @@ Account names must match /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.
             if (status.exists) {
                 lines.push("Current auth: present");
                 lines.push(`Auth mode: ${status.auth_mode}`);
-                lines.push(`Account ID: ${maskAccountId(status.account_id ?? "")}`);
+                lines.push(`Identity: ${maskAccountId(status.account_id ?? "")}`);
                 if (0 === status.matched_accounts.length) lines.push("Managed account: no (unmanaged)");
                 else if (1 === status.matched_accounts.length) lines.push(`Managed account: ${status.matched_accounts[0]}`);
                 else lines.push(`Managed account: multiple (${status.matched_accounts.join(", ")})`);
@@ -1061,7 +1160,7 @@ Account names must match /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.
                 },
                 {
                     key: "account_id",
-                    label: "ACCOUNT ID"
+                    label: "IDENTITY"
                 },
                 {
                     key: "plan_type",

package/dist/main.cjs

@@ -43,8 +43,9 @@ var timezone_js_default = /*#__PURE__*/ __webpack_require__.n(timezone_js_namesp
 const utc_js_namespaceObject = require("dayjs/plugin/utc.js");
 var utc_js_default = /*#__PURE__*/ __webpack_require__.n(utc_js_namespaceObject);
 var package_namespaceObject = {
-    rE: "0.0.5"
+    rE: "0.0.7"
 };
+const external_node_crypto_namespaceObject = require("node:crypto");
 const promises_namespaceObject = require("node:fs/promises");
 function isRecord(value) {
     return "object" == typeof value && null !== value && !Array.isArray(value);
@@ -67,6 +68,29 @@ function asOptionalNumber(value, fieldName) {
     if ("number" != typeof value || Number.isNaN(value)) throw new Error(`Field "${fieldName}" must be a number.`);
     return value;
 }
+function normalizeAuthMode(authMode) {
+    return authMode.trim().toLowerCase();
+}
+function isApiKeyAuthMode(authMode) {
+    return "apikey" === normalizeAuthMode(authMode);
+}
+function isSupportedChatGPTAuthMode(authMode) {
+    const normalized = normalizeAuthMode(authMode);
+    return "chatgpt" === normalized || "chatgpt_auth_tokens" === normalized;
+}
+function fingerprintApiKey(apiKey) {
+    return (0, external_node_crypto_namespaceObject.createHash)("sha256").update(apiKey).digest("hex").slice(0, 16);
+}
+function getSnapshotIdentity(snapshot) {
+    if (isApiKeyAuthMode(snapshot.auth_mode)) {
+        const apiKey = snapshot.OPENAI_API_KEY;
+        if ("string" != typeof apiKey || "" === apiKey.trim()) throw new Error('Field "OPENAI_API_KEY" must be a non-empty string for apikey auth.');
+        return `key_${fingerprintApiKey(apiKey)}`;
+    }
+    const accountId = snapshot.tokens?.account_id;
+    if ("string" != typeof accountId || "" === accountId.trim()) throw new Error('Field "tokens.account_id" must be a non-empty string.');
+    return accountId;
+}
 function defaultQuotaSnapshot() {
     return {
         status: "stale"
@@ -111,15 +135,28 @@ function parseAuthSnapshot(raw) {
     }
     if (!isRecord(parsed)) throw new Error("Auth snapshot must be a JSON object.");
     const authMode = asNonEmptyString(parsed.auth_mode, "auth_mode");
-    if (!isRecord(parsed.tokens)) throw new Error('Field "tokens" must be an object.');
-    const accountId = asNonEmptyString(parsed.tokens.account_id, "tokens.account_id");
+    const tokens = parsed.tokens;
+    if (null != tokens && !isRecord(tokens)) throw new Error('Field "tokens" must be an object.');
+    const apiKeyMode = isApiKeyAuthMode(authMode);
+    const normalizedApiKey = null === parsed.OPENAI_API_KEY || void 0 === parsed.OPENAI_API_KEY ? parsed.OPENAI_API_KEY : asNonEmptyString(parsed.OPENAI_API_KEY, "OPENAI_API_KEY");
+    if (apiKeyMode) {
+        if ("string" != typeof normalizedApiKey || "" === normalizedApiKey.trim()) throw new Error('Field "OPENAI_API_KEY" must be a non-empty string for apikey auth.');
+    } else {
+        if (!isRecord(tokens)) throw new Error('Field "tokens" must be an object.');
+        asNonEmptyString(tokens.account_id, "tokens.account_id");
+    }
     return {
         ...parsed,
         auth_mode: authMode,
-        tokens: {
-            ...parsed.tokens,
-            account_id: accountId
-        }
+        OPENAI_API_KEY: normalizedApiKey,
+        ...isRecord(tokens) ? {
+            tokens: {
+                ...tokens,
+                ..."string" == typeof tokens.account_id && "" !== tokens.account_id.trim() ? {
+                    account_id: tokens.account_id
+                } : {}
+            }
+        } : {}
     };
 }
 async function readAuthSnapshotFile(filePath) {
@@ -131,7 +168,7 @@ function createSnapshotMeta(name, snapshot, now, existingCreatedAt) {
     return {
         name,
         auth_mode: snapshot.auth_mode,
-        account_id: snapshot.tokens.account_id,
+        account_id: getSnapshotIdentity(snapshot),
         created_at: existingCreatedAt ?? timestamp,
         updated_at: timestamp,
         last_switched_at: null,
@@ -188,16 +225,13 @@ function extractStringClaim(payload, key) {
     const value = payload[key];
     return "string" == typeof value && "" !== value.trim() ? value : void 0;
 }
-function isSupportedChatGPTMode(authMode) {
-    const normalized = authMode.trim().toLowerCase();
-    return "chatgpt" === normalized || "chatgpt_auth_tokens" === normalized;
-}
 function parsePlanType(snapshot) {
+    const tokens = snapshot.tokens ?? {};
     for (const tokenName of [
         "id_token",
         "access_token"
     ]){
-        const token = snapshot.tokens[tokenName];
+        const token = tokens[tokenName];
         if ("string" == typeof token && "" !== token.trim()) try {
             const payload = decodeJwtPayload(token);
             const authClaim = extractAuthClaim(payload);
@@ -208,10 +242,11 @@ function parsePlanType(snapshot) {
 }
 function extractChatGPTAuth(snapshot) {
     const authMode = snapshot.auth_mode ?? "";
-    const supported = isSupportedChatGPTMode(authMode);
-    const accessTokenValue = snapshot.tokens.access_token;
-    const refreshTokenValue = snapshot.tokens.refresh_token;
-    const directAccountId = snapshot.tokens.account_id;
+    const supported = isSupportedChatGPTAuthMode(authMode);
+    const tokens = snapshot.tokens ?? {};
+    const accessTokenValue = tokens.access_token;
+    const refreshTokenValue = tokens.refresh_token;
+    const directAccountId = tokens.account_id;
     let accountId = "string" == typeof directAccountId && "" !== directAccountId.trim() ? directAccountId : void 0;
     let planType;
     let issuer;
@@ -220,7 +255,7 @@ function extractChatGPTAuth(snapshot) {
         "id_token",
         "access_token"
     ]){
-        const token = snapshot.tokens[tokenName];
+        const token = tokens[tokenName];
         if ("string" == typeof token && "" !== token.trim()) try {
             const payload = decodeJwtPayload(token);
             const authClaim = extractAuthClaim(payload);
@@ -402,7 +437,7 @@ async function refreshChatGPTAuthTokens(snapshot, options) {
         ...snapshot,
         last_refresh: (options.now ?? new Date()).toISOString(),
         tokens: {
-            ...snapshot.tokens,
+            ...snapshot.tokens ?? {},
             access_token: payload.access_token,
             id_token: payload.id_token,
             refresh_token: payload.refresh_token ?? extracted.refreshToken,
@@ -451,6 +486,7 @@ function defaultPaths(homeDir = (0, external_node_os_namespaceObject.homedir)())
         codexDir,
         codexTeamDir,
         currentAuthPath: (0, external_node_path_namespaceObject.join)(codexDir, "auth.json"),
+        currentConfigPath: (0, external_node_path_namespaceObject.join)(codexDir, "config.toml"),
         accountsDir: (0, external_node_path_namespaceObject.join)(codexTeamDir, "accounts"),
         backupsDir: (0, external_node_path_namespaceObject.join)(codexTeamDir, "backups"),
         statePath: (0, external_node_path_namespaceObject.join)(codexTeamDir, "state.json")
@@ -543,17 +579,49 @@ class AccountStore {
     accountMetaPath(name) {
         return (0, external_node_path_namespaceObject.join)(this.accountDirectory(name), "meta.json");
     }
+    accountConfigPath(name) {
+        return (0, external_node_path_namespaceObject.join)(this.accountDirectory(name), "config.toml");
+    }
     async writeAccountAuthSnapshot(name, snapshot) {
         await atomicWriteFile(this.accountAuthPath(name), stringifyJson(snapshot));
     }
     async writeAccountMeta(name, meta) {
         await atomicWriteFile(this.accountMetaPath(name), stringifyJson(meta));
     }
+    validateConfigSnapshot(name, snapshot, rawConfig) {
+        if ("apikey" !== snapshot.auth_mode) return;
+        if (!rawConfig) throw new Error(`Current ~/.codex/config.toml is required to save apikey account "${name}".`);
+        if (!/^\s*model_provider\s*=\s*["'][^"']+["']/mu.test(rawConfig)) throw new Error(`Current ~/.codex/config.toml is missing model_provider for apikey account "${name}".`);
+        if (!/^\s*base_url\s*=\s*["'][^"']+["']/mu.test(rawConfig)) throw new Error(`Current ~/.codex/config.toml is missing base_url for apikey account "${name}".`);
+    }
+    sanitizeConfigForAccountAuth(rawConfig) {
+        const lines = rawConfig.split(/\r?\n/u);
+        const result = [];
+        let skippingProviderSection = false;
+        for (const line of lines){
+            const trimmed = line.trim();
+            if (trimmed.startsWith("[") && trimmed.endsWith("]")) {
+                skippingProviderSection = /^\[model_providers\.[^\]]+\]$/u.test(trimmed);
+                if (skippingProviderSection) continue;
+            }
+            if (!skippingProviderSection) {
+                if (!/^\s*model_provider\s*=/u.test(line)) {
+                    if (!/^\s*preferred_auth_method\s*=\s*["']apikey["']\s*$/u.test(line)) result.push(line);
+                }
+            }
+        }
+        return `${result.join("\n").replace(/\n{3,}/gu, "\n\n").trimEnd()}\n`;
+    }
+    async ensureEmptyAccountConfigSnapshot(name) {
+        const configPath = this.accountConfigPath(name);
+        await atomicWriteFile(configPath, "");
+        return configPath;
+    }
     async syncCurrentAuthIfMatching(snapshot) {
         if (!await pathExists(this.paths.currentAuthPath)) return;
         try {
             const currentSnapshot = await readAuthSnapshotFile(this.paths.currentAuthPath);
-            if (currentSnapshot.tokens.account_id !== snapshot.tokens.account_id) return;
+            if (getSnapshotIdentity(currentSnapshot) !== getSnapshotIdentity(snapshot)) return;
             await atomicWriteFile(this.paths.currentAuthPath, stringifyJson(snapshot));
         } catch  {}
     }
@@ -609,11 +677,12 @@ class AccountStore {
         ]);
         const meta = parseSnapshotMeta(rawMeta);
         if (meta.name !== name) throw new Error(`Account metadata name mismatch for "${name}".`);
-        if (meta.account_id !== snapshot.tokens.account_id) throw new Error(`Account metadata account_id mismatch for "${name}".`);
+        if (meta.account_id !== getSnapshotIdentity(snapshot)) throw new Error(`Account metadata account_id mismatch for "${name}".`);
         return {
             ...meta,
             authPath,
             metaPath,
+            configPath: await pathExists(this.accountConfigPath(name)) ? this.accountConfigPath(name) : null,
             duplicateAccountId: false
         };
     }
@@ -652,11 +721,12 @@ class AccountStore {
             warnings
         };
         const snapshot = await readAuthSnapshotFile(this.paths.currentAuthPath);
-        const matchedAccounts = accounts.filter((account)=>account.account_id === snapshot.tokens.account_id).map((account)=>account.name);
+        const currentIdentity = getSnapshotIdentity(snapshot);
+        const matchedAccounts = accounts.filter((account)=>account.account_id === currentIdentity).map((account)=>account.name);
         return {
             exists: true,
             auth_mode: snapshot.auth_mode,
-            account_id: snapshot.tokens.account_id,
+            account_id: currentIdentity,
             matched_accounts: matchedAccounts,
             managed: matchedAccounts.length > 0,
             duplicate_match: matchedAccounts.length > 1,
@@ -669,14 +739,21 @@ class AccountStore {
         if (!await pathExists(this.paths.currentAuthPath)) throw new Error("Current ~/.codex/auth.json does not exist.");
         const rawSnapshot = await readJsonFile(this.paths.currentAuthPath);
         const snapshot = parseAuthSnapshot(rawSnapshot);
+        const rawConfig = await pathExists(this.paths.currentConfigPath) ? await readJsonFile(this.paths.currentConfigPath) : null;
         const accountDir = this.accountDirectory(name);
         const authPath = this.accountAuthPath(name);
         const metaPath = this.accountMetaPath(name);
+        const configPath = this.accountConfigPath(name);
         const accountExists = await pathExists(accountDir);
         const existingMeta = accountExists && await pathExists(metaPath) ? parseSnapshotMeta(await readJsonFile(metaPath)) : void 0;
         if (accountExists && !force) throw new Error(`Account "${name}" already exists. Use --force to overwrite it.`);
+        this.validateConfigSnapshot(name, snapshot, rawConfig);
         await ensureDirectory(accountDir, DIRECTORY_MODE);
         await atomicWriteFile(authPath, `${rawSnapshot.trimEnd()}\n`);
+        if ("apikey" === snapshot.auth_mode && rawConfig) await atomicWriteFile(configPath, rawConfig.endsWith("\n") ? rawConfig : `${rawConfig}\n`);
+        else if (await pathExists(configPath)) await (0, promises_namespaceObject.rm)(configPath, {
+            force: true
+        });
         const meta = createSnapshotMeta(name, snapshot, new Date(), existingMeta?.created_at);
         meta.last_switched_at = existingMeta?.last_switched_at ?? null;
         meta.quota = existingMeta?.quota ?? meta.quota;
@@ -692,9 +769,15 @@ class AccountStore {
         const name = current.matched_accounts[0];
         const currentRawSnapshot = await readJsonFile(this.paths.currentAuthPath);
         const currentSnapshot = parseAuthSnapshot(currentRawSnapshot);
+        const currentRawConfig = await pathExists(this.paths.currentConfigPath) ? await readJsonFile(this.paths.currentConfigPath) : null;
         const metaPath = this.accountMetaPath(name);
         const existingMeta = parseSnapshotMeta(await readJsonFile(metaPath));
+        this.validateConfigSnapshot(name, currentSnapshot, currentRawConfig);
         await atomicWriteFile(this.accountAuthPath(name), `${currentRawSnapshot.trimEnd()}\n`);
+        if ("apikey" === currentSnapshot.auth_mode && currentRawConfig) await atomicWriteFile(this.accountConfigPath(name), currentRawConfig.endsWith("\n") ? currentRawConfig : `${currentRawConfig}\n`);
+        else if (await pathExists(this.accountConfigPath(name))) await (0, promises_namespaceObject.rm)(this.accountConfigPath(name), {
+            force: true
+        });
         await atomicWriteFile(metaPath, stringifyJson({
             ...createSnapshotMeta(name, currentSnapshot, new Date(), existingMeta.created_at),
             last_switched_at: existingMeta.last_switched_at,
@@ -716,10 +799,25 @@ class AccountStore {
             await (0, promises_namespaceObject.copyFile)(this.paths.currentAuthPath, backupPath);
             await chmodIfPossible(backupPath, FILE_MODE);
         }
+        if (await pathExists(this.paths.currentConfigPath)) {
+            const configBackupPath = (0, external_node_path_namespaceObject.join)(this.paths.backupsDir, "last-active-config.toml");
+            await (0, promises_namespaceObject.copyFile)(this.paths.currentConfigPath, configBackupPath);
+            await chmodIfPossible(configBackupPath, FILE_MODE);
+        }
         const rawAuth = await readJsonFile(account.authPath);
         await atomicWriteFile(this.paths.currentAuthPath, `${rawAuth.trimEnd()}\n`);
+        if ("apikey" === account.auth_mode && account.configPath) {
+            const rawConfig = await readJsonFile(account.configPath);
+            await atomicWriteFile(this.paths.currentConfigPath, rawConfig.endsWith("\n") ? rawConfig : `${rawConfig}\n`);
+        } else if ("apikey" === account.auth_mode) {
+            await this.ensureEmptyAccountConfigSnapshot(name);
+            warnings.push(`Saved apikey account "${name}" was missing config.toml snapshot. Created an empty snapshot; configure baseUrl manually if needed.`);
+        } else if (await pathExists(this.paths.currentConfigPath)) {
+            const currentRawConfig = await readJsonFile(this.paths.currentConfigPath);
+            await atomicWriteFile(this.paths.currentConfigPath, this.sanitizeConfigForAccountAuth(currentRawConfig));
+        }
         const writtenSnapshot = await readAuthSnapshotFile(this.paths.currentAuthPath);
-        if (writtenSnapshot.tokens.account_id !== account.account_id) throw new Error(`Switch verification failed for account "${name}".`);
+        if (getSnapshotIdentity(writtenSnapshot) !== account.account_id) throw new Error(`Switch verification failed for account "${name}".`);
         const meta = parseSnapshotMeta(await readJsonFile(account.metaPath));
         meta.last_switched_at = new Date().toISOString();
         meta.updated_at = meta.last_switched_at;
@@ -763,7 +861,7 @@ class AccountStore {
                 await this.syncCurrentAuthIfMatching(result.authSnapshot);
             }
             meta.auth_mode = result.authSnapshot.auth_mode;
-            meta.account_id = result.authSnapshot.tokens.account_id;
+            meta.account_id = getSnapshotIdentity(result.authSnapshot);
             meta.updated_at = now.toISOString();
             meta.quota = result.quota;
             await this.writeAccountMeta(name, meta);
@@ -875,7 +973,8 @@ class AccountStore {
             const metaStat = await (0, promises_namespaceObject.stat)(account.metaPath);
             if ((511 & authStat.mode) !== FILE_MODE) issues.push(`Account "${account.name}" auth permissions must be 600.`);
             if ((511 & metaStat.mode) !== FILE_MODE) issues.push(`Account "${account.name}" metadata permissions must be 600.`);
-            if (account.duplicateAccountId) warnings.push(`Account "${account.name}" shares account_id ${account.account_id} with another saved account.`);
+            if ("apikey" === account.auth_mode && !account.configPath) issues.push(`Account "${account.name}" is missing config.toml snapshot required for apikey auth.`);
+            if (account.duplicateAccountId) warnings.push(`Account "${account.name}" shares identity ${account.account_id} with another saved account.`);
         }
         let currentAuthPresent = false;
         if (await pathExists(this.paths.currentAuthPath)) {
@@ -958,7 +1057,7 @@ function describeCurrentStatus(status) {
     if (status.exists) {
         lines.push("Current auth: present");
         lines.push(`Auth mode: ${status.auth_mode}`);
-        lines.push(`Account ID: ${maskAccountId(status.account_id ?? "")}`);
+        lines.push(`Identity: ${maskAccountId(status.account_id ?? "")}`);
         if (0 === status.matched_accounts.length) lines.push("Managed account: no (unmanaged)");
         else if (1 === status.matched_accounts.length) lines.push(`Managed account: ${status.matched_accounts[0]}`);
         else lines.push(`Managed account: multiple (${status.matched_accounts.join(", ")})`);
@@ -1091,7 +1190,7 @@ function describeQuotaAccounts(accounts, warnings) {
         },
         {
             key: "account_id",
-            label: "ACCOUNT ID"
+            label: "IDENTITY"
         },
         {
             key: "plan_type",

package/dist/main.js

@@ -2,13 +2,14 @@ import { stderr, stdin, stdout as external_node_process_stdout } from "node:proc
 import dayjs from "dayjs";
 import timezone from "dayjs/plugin/timezone.js";
 import utc from "dayjs/plugin/utc.js";
+import { createHash } from "node:crypto";
 import { chmod, copyFile, mkdir, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { basename, dirname, join } from "node:path";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 var package_namespaceObject = {
-    rE: "0.0.5"
+    rE: "0.0.7"
 };
 function isRecord(value) {
     return "object" == typeof value && null !== value && !Array.isArray(value);
@@ -31,6 +32,29 @@ function asOptionalNumber(value, fieldName) {
     if ("number" != typeof value || Number.isNaN(value)) throw new Error(`Field "${fieldName}" must be a number.`);
     return value;
 }
+function normalizeAuthMode(authMode) {
+    return authMode.trim().toLowerCase();
+}
+function isApiKeyAuthMode(authMode) {
+    return "apikey" === normalizeAuthMode(authMode);
+}
+function isSupportedChatGPTAuthMode(authMode) {
+    const normalized = normalizeAuthMode(authMode);
+    return "chatgpt" === normalized || "chatgpt_auth_tokens" === normalized;
+}
+function fingerprintApiKey(apiKey) {
+    return createHash("sha256").update(apiKey).digest("hex").slice(0, 16);
+}
+function getSnapshotIdentity(snapshot) {
+    if (isApiKeyAuthMode(snapshot.auth_mode)) {
+        const apiKey = snapshot.OPENAI_API_KEY;
+        if ("string" != typeof apiKey || "" === apiKey.trim()) throw new Error('Field "OPENAI_API_KEY" must be a non-empty string for apikey auth.');
+        return `key_${fingerprintApiKey(apiKey)}`;
+    }
+    const accountId = snapshot.tokens?.account_id;
+    if ("string" != typeof accountId || "" === accountId.trim()) throw new Error('Field "tokens.account_id" must be a non-empty string.');
+    return accountId;
+}
 function defaultQuotaSnapshot() {
     return {
         status: "stale"
@@ -75,15 +99,28 @@ function parseAuthSnapshot(raw) {
     }
     if (!isRecord(parsed)) throw new Error("Auth snapshot must be a JSON object.");
     const authMode = asNonEmptyString(parsed.auth_mode, "auth_mode");
-    if (!isRecord(parsed.tokens)) throw new Error('Field "tokens" must be an object.');
-    const accountId = asNonEmptyString(parsed.tokens.account_id, "tokens.account_id");
+    const tokens = parsed.tokens;
+    if (null != tokens && !isRecord(tokens)) throw new Error('Field "tokens" must be an object.');
+    const apiKeyMode = isApiKeyAuthMode(authMode);
+    const normalizedApiKey = null === parsed.OPENAI_API_KEY || void 0 === parsed.OPENAI_API_KEY ? parsed.OPENAI_API_KEY : asNonEmptyString(parsed.OPENAI_API_KEY, "OPENAI_API_KEY");
+    if (apiKeyMode) {
+        if ("string" != typeof normalizedApiKey || "" === normalizedApiKey.trim()) throw new Error('Field "OPENAI_API_KEY" must be a non-empty string for apikey auth.');
+    } else {
+        if (!isRecord(tokens)) throw new Error('Field "tokens" must be an object.');
+        asNonEmptyString(tokens.account_id, "tokens.account_id");
+    }
     return {
         ...parsed,
         auth_mode: authMode,
-        tokens: {
-            ...parsed.tokens,
-            account_id: accountId
-        }
+        OPENAI_API_KEY: normalizedApiKey,
+        ...isRecord(tokens) ? {
+            tokens: {
+                ...tokens,
+                ..."string" == typeof tokens.account_id && "" !== tokens.account_id.trim() ? {
+                    account_id: tokens.account_id
+                } : {}
+            }
+        } : {}
     };
 }
 async function readAuthSnapshotFile(filePath) {
@@ -95,7 +132,7 @@ function createSnapshotMeta(name, snapshot, now, existingCreatedAt) {
     return {
         name,
         auth_mode: snapshot.auth_mode,
-        account_id: snapshot.tokens.account_id,
+        account_id: getSnapshotIdentity(snapshot),
         created_at: existingCreatedAt ?? timestamp,
         updated_at: timestamp,
         last_switched_at: null,
@@ -148,16 +185,13 @@ function extractStringClaim(payload, key) {
     const value = payload[key];
     return "string" == typeof value && "" !== value.trim() ? value : void 0;
 }
-function isSupportedChatGPTMode(authMode) {
-    const normalized = authMode.trim().toLowerCase();
-    return "chatgpt" === normalized || "chatgpt_auth_tokens" === normalized;
-}
 function parsePlanType(snapshot) {
+    const tokens = snapshot.tokens ?? {};
     for (const tokenName of [
         "id_token",
         "access_token"
     ]){
-        const token = snapshot.tokens[tokenName];
+        const token = tokens[tokenName];
         if ("string" == typeof token && "" !== token.trim()) try {
             const payload = decodeJwtPayload(token);
             const authClaim = extractAuthClaim(payload);
@@ -168,10 +202,11 @@ function parsePlanType(snapshot) {
 }
 function extractChatGPTAuth(snapshot) {
     const authMode = snapshot.auth_mode ?? "";
-    const supported = isSupportedChatGPTMode(authMode);
-    const accessTokenValue = snapshot.tokens.access_token;
-    const refreshTokenValue = snapshot.tokens.refresh_token;
-    const directAccountId = snapshot.tokens.account_id;
+    const supported = isSupportedChatGPTAuthMode(authMode);
+    const tokens = snapshot.tokens ?? {};
+    const accessTokenValue = tokens.access_token;
+    const refreshTokenValue = tokens.refresh_token;
+    const directAccountId = tokens.account_id;
     let accountId = "string" == typeof directAccountId && "" !== directAccountId.trim() ? directAccountId : void 0;
     let planType;
     let issuer;
@@ -180,7 +215,7 @@ function extractChatGPTAuth(snapshot) {
         "id_token",
         "access_token"
     ]){
-        const token = snapshot.tokens[tokenName];
+        const token = tokens[tokenName];
         if ("string" == typeof token && "" !== token.trim()) try {
             const payload = decodeJwtPayload(token);
             const authClaim = extractAuthClaim(payload);
@@ -362,7 +397,7 @@ async function refreshChatGPTAuthTokens(snapshot, options) {
         ...snapshot,
         last_refresh: (options.now ?? new Date()).toISOString(),
         tokens: {
-            ...snapshot.tokens,
+            ...snapshot.tokens ?? {},
             access_token: payload.access_token,
             id_token: payload.id_token,
             refresh_token: payload.refresh_token ?? extracted.refreshToken,
@@ -411,6 +446,7 @@ function defaultPaths(homeDir = homedir()) {
         codexDir,
         codexTeamDir,
         currentAuthPath: join(codexDir, "auth.json"),
+        currentConfigPath: join(codexDir, "config.toml"),
         accountsDir: join(codexTeamDir, "accounts"),
         backupsDir: join(codexTeamDir, "backups"),
         statePath: join(codexTeamDir, "state.json")
@@ -503,17 +539,49 @@ class AccountStore {
     accountMetaPath(name) {
         return join(this.accountDirectory(name), "meta.json");
     }
+    accountConfigPath(name) {
+        return join(this.accountDirectory(name), "config.toml");
+    }
     async writeAccountAuthSnapshot(name, snapshot) {
         await atomicWriteFile(this.accountAuthPath(name), stringifyJson(snapshot));
     }
     async writeAccountMeta(name, meta) {
         await atomicWriteFile(this.accountMetaPath(name), stringifyJson(meta));
     }
+    validateConfigSnapshot(name, snapshot, rawConfig) {
+        if ("apikey" !== snapshot.auth_mode) return;
+        if (!rawConfig) throw new Error(`Current ~/.codex/config.toml is required to save apikey account "${name}".`);
+        if (!/^\s*model_provider\s*=\s*["'][^"']+["']/mu.test(rawConfig)) throw new Error(`Current ~/.codex/config.toml is missing model_provider for apikey account "${name}".`);
+        if (!/^\s*base_url\s*=\s*["'][^"']+["']/mu.test(rawConfig)) throw new Error(`Current ~/.codex/config.toml is missing base_url for apikey account "${name}".`);
+    }
+    sanitizeConfigForAccountAuth(rawConfig) {
+        const lines = rawConfig.split(/\r?\n/u);
+        const result = [];
+        let skippingProviderSection = false;
+        for (const line of lines){
+            const trimmed = line.trim();
+            if (trimmed.startsWith("[") && trimmed.endsWith("]")) {
+                skippingProviderSection = /^\[model_providers\.[^\]]+\]$/u.test(trimmed);
+                if (skippingProviderSection) continue;
+            }
+            if (!skippingProviderSection) {
+                if (!/^\s*model_provider\s*=/u.test(line)) {
+                    if (!/^\s*preferred_auth_method\s*=\s*["']apikey["']\s*$/u.test(line)) result.push(line);
+                }
+            }
+        }
+        return `${result.join("\n").replace(/\n{3,}/gu, "\n\n").trimEnd()}\n`;
+    }
+    async ensureEmptyAccountConfigSnapshot(name) {
+        const configPath = this.accountConfigPath(name);
+        await atomicWriteFile(configPath, "");
+        return configPath;
+    }
     async syncCurrentAuthIfMatching(snapshot) {
         if (!await pathExists(this.paths.currentAuthPath)) return;
         try {
             const currentSnapshot = await readAuthSnapshotFile(this.paths.currentAuthPath);
-            if (currentSnapshot.tokens.account_id !== snapshot.tokens.account_id) return;
+            if (getSnapshotIdentity(currentSnapshot) !== getSnapshotIdentity(snapshot)) return;
             await atomicWriteFile(this.paths.currentAuthPath, stringifyJson(snapshot));
         } catch  {}
     }
@@ -569,11 +637,12 @@ class AccountStore {
         ]);
         const meta = parseSnapshotMeta(rawMeta);
         if (meta.name !== name) throw new Error(`Account metadata name mismatch for "${name}".`);
-        if (meta.account_id !== snapshot.tokens.account_id) throw new Error(`Account metadata account_id mismatch for "${name}".`);
+        if (meta.account_id !== getSnapshotIdentity(snapshot)) throw new Error(`Account metadata account_id mismatch for "${name}".`);
         return {
             ...meta,
             authPath,
             metaPath,
+            configPath: await pathExists(this.accountConfigPath(name)) ? this.accountConfigPath(name) : null,
             duplicateAccountId: false
         };
     }
@@ -612,11 +681,12 @@ class AccountStore {
             warnings
         };
         const snapshot = await readAuthSnapshotFile(this.paths.currentAuthPath);
-        const matchedAccounts = accounts.filter((account)=>account.account_id === snapshot.tokens.account_id).map((account)=>account.name);
+        const currentIdentity = getSnapshotIdentity(snapshot);
+        const matchedAccounts = accounts.filter((account)=>account.account_id === currentIdentity).map((account)=>account.name);
         return {
             exists: true,
             auth_mode: snapshot.auth_mode,
-            account_id: snapshot.tokens.account_id,
+            account_id: currentIdentity,
             matched_accounts: matchedAccounts,
             managed: matchedAccounts.length > 0,
             duplicate_match: matchedAccounts.length > 1,
@@ -629,14 +699,21 @@ class AccountStore {
         if (!await pathExists(this.paths.currentAuthPath)) throw new Error("Current ~/.codex/auth.json does not exist.");
         const rawSnapshot = await readJsonFile(this.paths.currentAuthPath);
         const snapshot = parseAuthSnapshot(rawSnapshot);
+        const rawConfig = await pathExists(this.paths.currentConfigPath) ? await readJsonFile(this.paths.currentConfigPath) : null;
         const accountDir = this.accountDirectory(name);
         const authPath = this.accountAuthPath(name);
         const metaPath = this.accountMetaPath(name);
+        const configPath = this.accountConfigPath(name);
         const accountExists = await pathExists(accountDir);
         const existingMeta = accountExists && await pathExists(metaPath) ? parseSnapshotMeta(await readJsonFile(metaPath)) : void 0;
         if (accountExists && !force) throw new Error(`Account "${name}" already exists. Use --force to overwrite it.`);
+        this.validateConfigSnapshot(name, snapshot, rawConfig);
         await ensureDirectory(accountDir, DIRECTORY_MODE);
         await atomicWriteFile(authPath, `${rawSnapshot.trimEnd()}\n`);
+        if ("apikey" === snapshot.auth_mode && rawConfig) await atomicWriteFile(configPath, rawConfig.endsWith("\n") ? rawConfig : `${rawConfig}\n`);
+        else if (await pathExists(configPath)) await rm(configPath, {
+            force: true
+        });
         const meta = createSnapshotMeta(name, snapshot, new Date(), existingMeta?.created_at);
         meta.last_switched_at = existingMeta?.last_switched_at ?? null;
         meta.quota = existingMeta?.quota ?? meta.quota;
@@ -652,9 +729,15 @@ class AccountStore {
         const name = current.matched_accounts[0];
         const currentRawSnapshot = await readJsonFile(this.paths.currentAuthPath);
         const currentSnapshot = parseAuthSnapshot(currentRawSnapshot);
+        const currentRawConfig = await pathExists(this.paths.currentConfigPath) ? await readJsonFile(this.paths.currentConfigPath) : null;
         const metaPath = this.accountMetaPath(name);
         const existingMeta = parseSnapshotMeta(await readJsonFile(metaPath));
+        this.validateConfigSnapshot(name, currentSnapshot, currentRawConfig);
         await atomicWriteFile(this.accountAuthPath(name), `${currentRawSnapshot.trimEnd()}\n`);
+        if ("apikey" === currentSnapshot.auth_mode && currentRawConfig) await atomicWriteFile(this.accountConfigPath(name), currentRawConfig.endsWith("\n") ? currentRawConfig : `${currentRawConfig}\n`);
+        else if (await pathExists(this.accountConfigPath(name))) await rm(this.accountConfigPath(name), {
+            force: true
+        });
         await atomicWriteFile(metaPath, stringifyJson({
             ...createSnapshotMeta(name, currentSnapshot, new Date(), existingMeta.created_at),
             last_switched_at: existingMeta.last_switched_at,
@@ -676,10 +759,25 @@ class AccountStore {
             await copyFile(this.paths.currentAuthPath, backupPath);
             await chmodIfPossible(backupPath, FILE_MODE);
         }
+        if (await pathExists(this.paths.currentConfigPath)) {
+            const configBackupPath = join(this.paths.backupsDir, "last-active-config.toml");
+            await copyFile(this.paths.currentConfigPath, configBackupPath);
+            await chmodIfPossible(configBackupPath, FILE_MODE);
+        }
         const rawAuth = await readJsonFile(account.authPath);
         await atomicWriteFile(this.paths.currentAuthPath, `${rawAuth.trimEnd()}\n`);
+        if ("apikey" === account.auth_mode && account.configPath) {
+            const rawConfig = await readJsonFile(account.configPath);
+            await atomicWriteFile(this.paths.currentConfigPath, rawConfig.endsWith("\n") ? rawConfig : `${rawConfig}\n`);
+        } else if ("apikey" === account.auth_mode) {
+            await this.ensureEmptyAccountConfigSnapshot(name);
+            warnings.push(`Saved apikey account "${name}" was missing config.toml snapshot. Created an empty snapshot; configure baseUrl manually if needed.`);
+        } else if (await pathExists(this.paths.currentConfigPath)) {
+            const currentRawConfig = await readJsonFile(this.paths.currentConfigPath);
+            await atomicWriteFile(this.paths.currentConfigPath, this.sanitizeConfigForAccountAuth(currentRawConfig));
+        }
         const writtenSnapshot = await readAuthSnapshotFile(this.paths.currentAuthPath);
-        if (writtenSnapshot.tokens.account_id !== account.account_id) throw new Error(`Switch verification failed for account "${name}".`);
+        if (getSnapshotIdentity(writtenSnapshot) !== account.account_id) throw new Error(`Switch verification failed for account "${name}".`);
         const meta = parseSnapshotMeta(await readJsonFile(account.metaPath));
         meta.last_switched_at = new Date().toISOString();
         meta.updated_at = meta.last_switched_at;
@@ -723,7 +821,7 @@ class AccountStore {
                 await this.syncCurrentAuthIfMatching(result.authSnapshot);
             }
             meta.auth_mode = result.authSnapshot.auth_mode;
-            meta.account_id = result.authSnapshot.tokens.account_id;
+            meta.account_id = getSnapshotIdentity(result.authSnapshot);
             meta.updated_at = now.toISOString();
             meta.quota = result.quota;
             await this.writeAccountMeta(name, meta);
@@ -835,7 +933,8 @@ class AccountStore {
             const metaStat = await stat(account.metaPath);
             if ((511 & authStat.mode) !== FILE_MODE) issues.push(`Account "${account.name}" auth permissions must be 600.`);
             if ((511 & metaStat.mode) !== FILE_MODE) issues.push(`Account "${account.name}" metadata permissions must be 600.`);
-            if (account.duplicateAccountId) warnings.push(`Account "${account.name}" shares account_id ${account.account_id} with another saved account.`);
+            if ("apikey" === account.auth_mode && !account.configPath) issues.push(`Account "${account.name}" is missing config.toml snapshot required for apikey auth.`);
+            if (account.duplicateAccountId) warnings.push(`Account "${account.name}" shares identity ${account.account_id} with another saved account.`);
         }
         let currentAuthPresent = false;
         if (await pathExists(this.paths.currentAuthPath)) {
@@ -918,7 +1017,7 @@ function describeCurrentStatus(status) {
     if (status.exists) {
         lines.push("Current auth: present");
         lines.push(`Auth mode: ${status.auth_mode}`);
-        lines.push(`Account ID: ${maskAccountId(status.account_id ?? "")}`);
+        lines.push(`Identity: ${maskAccountId(status.account_id ?? "")}`);
         if (0 === status.matched_accounts.length) lines.push("Managed account: no (unmanaged)");
         else if (1 === status.matched_accounts.length) lines.push(`Managed account: ${status.matched_accounts[0]}`);
         else lines.push(`Managed account: multiple (${status.matched_accounts.join(", ")})`);
@@ -1051,7 +1150,7 @@ function describeQuotaAccounts(accounts, warnings) {
         },
         {
             key: "account_id",
-            label: "ACCOUNT ID"
+            label: "IDENTITY"
         },
         {
             key: "plan_type",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-team",
-  "version": "0.0.5",
+  "version": "0.0.7",
   "description": "Manage multiple Codex ChatGPT auth snapshots and quota usage from the command line.",
   "license": "MIT",
   "type": "module",