codex-team 0.0.6 → 0.0.8

package/README.md

@@ -24,8 +24,6 @@ codexm switch <name>
 codexm switch --auto --dry-run
 codexm remove <name> --yes
 codexm rename <old> <new>
-codexm quota refresh [name]
-codexm doctor
 ```
 
 Use `--json` on query and mutation commands when you need machine-readable output.
@@ -36,7 +34,7 @@ Use `--json` on query and mutation commands when you need machine-readable outpu
 2. Save the current auth snapshot with `codexm save <name>`.
 3. Repeat for other accounts.
 4. Switch between saved accounts with `codexm switch <name>` or let the tool choose with `codexm switch --auto`.
-5. Refresh and inspect quota usage with `codexm list` or `codexm quota refresh`.
+5. Refresh and inspect quota usage with `codexm list`.
 
 ## Development
 

package/dist/cli.cjs

@@ -13,7 +13,7 @@ var __webpack_modules__ = {
         const utc_js_namespaceObject = require("dayjs/plugin/utc.js");
         var utc_js_default = /*#__PURE__*/ __webpack_require__.n(utc_js_namespaceObject);
         var package_namespaceObject = {
-            rE: "0.0.6"
+            rE: "0.0.8"
         };
         const external_node_crypto_namespaceObject = require("node:crypto");
         const promises_namespaceObject = require("node:fs/promises");
@@ -456,6 +456,7 @@ var __webpack_modules__ = {
                 codexDir,
                 codexTeamDir,
                 currentAuthPath: (0, external_node_path_namespaceObject.join)(codexDir, "auth.json"),
+                currentConfigPath: (0, external_node_path_namespaceObject.join)(codexDir, "config.toml"),
                 accountsDir: (0, external_node_path_namespaceObject.join)(codexTeamDir, "accounts"),
                 backupsDir: (0, external_node_path_namespaceObject.join)(codexTeamDir, "backups"),
                 statePath: (0, external_node_path_namespaceObject.join)(codexTeamDir, "state.json")
@@ -548,12 +549,44 @@ var __webpack_modules__ = {
             accountMetaPath(name) {
                 return (0, external_node_path_namespaceObject.join)(this.accountDirectory(name), "meta.json");
             }
+            accountConfigPath(name) {
+                return (0, external_node_path_namespaceObject.join)(this.accountDirectory(name), "config.toml");
+            }
             async writeAccountAuthSnapshot(name, snapshot) {
                 await atomicWriteFile(this.accountAuthPath(name), stringifyJson(snapshot));
             }
             async writeAccountMeta(name, meta) {
                 await atomicWriteFile(this.accountMetaPath(name), stringifyJson(meta));
             }
+            validateConfigSnapshot(name, snapshot, rawConfig) {
+                if ("apikey" !== snapshot.auth_mode) return;
+                if (!rawConfig) throw new Error(`Current ~/.codex/config.toml is required to save apikey account "${name}".`);
+                if (!/^\s*model_provider\s*=\s*["'][^"']+["']/mu.test(rawConfig)) throw new Error(`Current ~/.codex/config.toml is missing model_provider for apikey account "${name}".`);
+                if (!/^\s*base_url\s*=\s*["'][^"']+["']/mu.test(rawConfig)) throw new Error(`Current ~/.codex/config.toml is missing base_url for apikey account "${name}".`);
+            }
+            sanitizeConfigForAccountAuth(rawConfig) {
+                const lines = rawConfig.split(/\r?\n/u);
+                const result = [];
+                let skippingProviderSection = false;
+                for (const line of lines){
+                    const trimmed = line.trim();
+                    if (trimmed.startsWith("[") && trimmed.endsWith("]")) {
+                        skippingProviderSection = /^\[model_providers\.[^\]]+\]$/u.test(trimmed);
+                        if (skippingProviderSection) continue;
+                    }
+                    if (!skippingProviderSection) {
+                        if (!/^\s*model_provider\s*=/u.test(line)) {
+                            if (!/^\s*preferred_auth_method\s*=\s*["']apikey["']\s*$/u.test(line)) result.push(line);
+                        }
+                    }
+                }
+                return `${result.join("\n").replace(/\n{3,}/gu, "\n\n").trimEnd()}\n`;
+            }
+            async ensureEmptyAccountConfigSnapshot(name) {
+                const configPath = this.accountConfigPath(name);
+                await atomicWriteFile(configPath, "");
+                return configPath;
+            }
             async syncCurrentAuthIfMatching(snapshot) {
                 if (!await pathExists(this.paths.currentAuthPath)) return;
                 try {
@@ -619,6 +652,7 @@ var __webpack_modules__ = {
                     ...meta,
                     authPath,
                     metaPath,
+                    configPath: await pathExists(this.accountConfigPath(name)) ? this.accountConfigPath(name) : null,
                     duplicateAccountId: false
                 };
             }
@@ -675,14 +709,28 @@ var __webpack_modules__ = {
                 if (!await pathExists(this.paths.currentAuthPath)) throw new Error("Current ~/.codex/auth.json does not exist.");
                 const rawSnapshot = await readJsonFile(this.paths.currentAuthPath);
                 const snapshot = parseAuthSnapshot(rawSnapshot);
+                const rawConfig = await pathExists(this.paths.currentConfigPath) ? await readJsonFile(this.paths.currentConfigPath) : null;
                 const accountDir = this.accountDirectory(name);
                 const authPath = this.accountAuthPath(name);
                 const metaPath = this.accountMetaPath(name);
+                const configPath = this.accountConfigPath(name);
+                const identity = getSnapshotIdentity(snapshot);
                 const accountExists = await pathExists(accountDir);
                 const existingMeta = accountExists && await pathExists(metaPath) ? parseSnapshotMeta(await readJsonFile(metaPath)) : void 0;
                 if (accountExists && !force) throw new Error(`Account "${name}" already exists. Use --force to overwrite it.`);
+                const { accounts } = await this.listAccounts();
+                const duplicateIdentityAccounts = accounts.filter((account)=>account.name !== name && account.account_id === identity);
+                if (duplicateIdentityAccounts.length > 0) {
+                    const joinedNames = duplicateIdentityAccounts.map((account)=>`"${account.name}"`).join(", ");
+                    throw new Error(`Identity ${identity} is already managed by ${joinedNames}.`);
+                }
+                this.validateConfigSnapshot(name, snapshot, rawConfig);
                 await ensureDirectory(accountDir, DIRECTORY_MODE);
                 await atomicWriteFile(authPath, `${rawSnapshot.trimEnd()}\n`);
+                if ("apikey" === snapshot.auth_mode && rawConfig) await atomicWriteFile(configPath, rawConfig.endsWith("\n") ? rawConfig : `${rawConfig}\n`);
+                else if (await pathExists(configPath)) await (0, promises_namespaceObject.rm)(configPath, {
+                    force: true
+                });
                 const meta = createSnapshotMeta(name, snapshot, new Date(), existingMeta?.created_at);
                 meta.last_switched_at = existingMeta?.last_switched_at ?? null;
                 meta.quota = existingMeta?.quota ?? meta.quota;
@@ -698,9 +746,15 @@ var __webpack_modules__ = {
                 const name = current.matched_accounts[0];
                 const currentRawSnapshot = await readJsonFile(this.paths.currentAuthPath);
                 const currentSnapshot = parseAuthSnapshot(currentRawSnapshot);
+                const currentRawConfig = await pathExists(this.paths.currentConfigPath) ? await readJsonFile(this.paths.currentConfigPath) : null;
                 const metaPath = this.accountMetaPath(name);
                 const existingMeta = parseSnapshotMeta(await readJsonFile(metaPath));
+                this.validateConfigSnapshot(name, currentSnapshot, currentRawConfig);
                 await atomicWriteFile(this.accountAuthPath(name), `${currentRawSnapshot.trimEnd()}\n`);
+                if ("apikey" === currentSnapshot.auth_mode && currentRawConfig) await atomicWriteFile(this.accountConfigPath(name), currentRawConfig.endsWith("\n") ? currentRawConfig : `${currentRawConfig}\n`);
+                else if (await pathExists(this.accountConfigPath(name))) await (0, promises_namespaceObject.rm)(this.accountConfigPath(name), {
+                    force: true
+                });
                 await atomicWriteFile(metaPath, stringifyJson({
                     ...createSnapshotMeta(name, currentSnapshot, new Date(), existingMeta.created_at),
                     last_switched_at: existingMeta.last_switched_at,
@@ -722,8 +776,23 @@ var __webpack_modules__ = {
                     await (0, promises_namespaceObject.copyFile)(this.paths.currentAuthPath, backupPath);
                     await chmodIfPossible(backupPath, FILE_MODE);
                 }
+                if (await pathExists(this.paths.currentConfigPath)) {
+                    const configBackupPath = (0, external_node_path_namespaceObject.join)(this.paths.backupsDir, "last-active-config.toml");
+                    await (0, promises_namespaceObject.copyFile)(this.paths.currentConfigPath, configBackupPath);
+                    await chmodIfPossible(configBackupPath, FILE_MODE);
+                }
                 const rawAuth = await readJsonFile(account.authPath);
                 await atomicWriteFile(this.paths.currentAuthPath, `${rawAuth.trimEnd()}\n`);
+                if ("apikey" === account.auth_mode && account.configPath) {
+                    const rawConfig = await readJsonFile(account.configPath);
+                    await atomicWriteFile(this.paths.currentConfigPath, rawConfig.endsWith("\n") ? rawConfig : `${rawConfig}\n`);
+                } else if ("apikey" === account.auth_mode) {
+                    await this.ensureEmptyAccountConfigSnapshot(name);
+                    warnings.push(`Saved apikey account "${name}" was missing config.toml snapshot. Created an empty snapshot; configure baseUrl manually if needed.`);
+                } else if (await pathExists(this.paths.currentConfigPath)) {
+                    const currentRawConfig = await readJsonFile(this.paths.currentConfigPath);
+                    await atomicWriteFile(this.paths.currentConfigPath, this.sanitizeConfigForAccountAuth(currentRawConfig));
+                }
                 const writtenSnapshot = await readAuthSnapshotFile(this.paths.currentAuthPath);
                 if (getSnapshotIdentity(writtenSnapshot) !== account.account_id) throw new Error(`Switch verification failed for account "${name}".`);
                 const meta = parseSnapshotMeta(await readJsonFile(account.metaPath));
@@ -881,6 +950,7 @@ var __webpack_modules__ = {
                     const metaStat = await (0, promises_namespaceObject.stat)(account.metaPath);
                     if ((511 & authStat.mode) !== FILE_MODE) issues.push(`Account "${account.name}" auth permissions must be 600.`);
                     if ((511 & metaStat.mode) !== FILE_MODE) issues.push(`Account "${account.name}" metadata permissions must be 600.`);
+                    if ("apikey" === account.auth_mode && !account.configPath) issues.push(`Account "${account.name}" is missing config.toml snapshot required for apikey auth.`);
                     if (account.duplicateAccountId) warnings.push(`Account "${account.name}" shares identity ${account.account_id} with another saved account.`);
                 }
                 let currentAuthPresent = false;
@@ -949,12 +1019,10 @@ Usage:
   codexm list [name] [--json]
   codexm save <name> [--force] [--json]
   codexm update [--json]
-  codexm quota refresh [name] [--json]
   codexm switch <name> [--json]
   codexm switch --auto [--dry-run] [--json]
   codexm remove <name> [--yes] [--json]
   codexm rename <old> <new> [--json]
-  codexm doctor [--json]
 
 Account names must match /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.
 `);
@@ -972,16 +1040,6 @@ Account names must match /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.
             for (const warning of status.warnings)lines.push(`Warning: ${warning}`);
             return lines.join("\n");
         }
-        function describeDoctor(report) {
-            const lines = [
-                report.healthy ? "Doctor checks passed." : "Doctor checks found issues.",
-                `Saved accounts: ${report.account_count}`,
-                `Current auth present: ${report.current_auth_present ? "yes" : "no"}`
-            ];
-            for (const issue of report.issues)lines.push(`Issue: ${issue}`);
-            for (const warning of report.warnings)lines.push(`Warning: ${warning}`);
-            return lines.join("\n");
-        }
         function formatUsagePercent(window) {
             if (!window) return "-";
             return `${window.used_percent}%`;
@@ -1245,18 +1303,6 @@ Account names must match /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.
                             }
                             return 0;
                         }
-                    case "quota":
-                        {
-                            const quotaCommand = parsed.positionals[0];
-                            if ("refresh" === quotaCommand) {
-                                const targetName = parsed.positionals[1];
-                                const result = await store.refreshAllQuotas(targetName);
-                                if (json) writeJson(streams.stdout, toCliQuotaRefreshResult(result));
-                                else streams.stdout.write(`${describeQuotaRefresh(result)}\n`);
-                                return 0 === result.failures.length ? 0 : 1;
-                            }
-                            throw new Error("Usage: codexm quota refresh [name] [--json]");
-                        }
                     case "switch":
                         {
                             const auto = parsed.flags.has("--auto");
@@ -1400,13 +1446,6 @@ Account names must match /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.
                             else streams.stdout.write(`Renamed "${oldName}" to "${newName}".\n`);
                             return 0;
                         }
-                    case "doctor":
-                        {
-                            const report = await store.doctor();
-                            if (json) writeJson(streams.stdout, report);
-                            else streams.stdout.write(`${describeDoctor(report)}\n`);
-                            return report.healthy ? 0 : 1;
-                        }
                     default:
                         throw new Error(`Unknown command "${parsed.command}".`);
                 }

package/dist/main.cjs

@@ -43,7 +43,7 @@ var timezone_js_default = /*#__PURE__*/ __webpack_require__.n(timezone_js_namesp
 const utc_js_namespaceObject = require("dayjs/plugin/utc.js");
 var utc_js_default = /*#__PURE__*/ __webpack_require__.n(utc_js_namespaceObject);
 var package_namespaceObject = {
-    rE: "0.0.6"
+    rE: "0.0.8"
 };
 const external_node_crypto_namespaceObject = require("node:crypto");
 const promises_namespaceObject = require("node:fs/promises");
@@ -486,6 +486,7 @@ function defaultPaths(homeDir = (0, external_node_os_namespaceObject.homedir)())
         codexDir,
         codexTeamDir,
         currentAuthPath: (0, external_node_path_namespaceObject.join)(codexDir, "auth.json"),
+        currentConfigPath: (0, external_node_path_namespaceObject.join)(codexDir, "config.toml"),
         accountsDir: (0, external_node_path_namespaceObject.join)(codexTeamDir, "accounts"),
         backupsDir: (0, external_node_path_namespaceObject.join)(codexTeamDir, "backups"),
         statePath: (0, external_node_path_namespaceObject.join)(codexTeamDir, "state.json")
@@ -578,12 +579,44 @@ class AccountStore {
     accountMetaPath(name) {
         return (0, external_node_path_namespaceObject.join)(this.accountDirectory(name), "meta.json");
     }
+    accountConfigPath(name) {
+        return (0, external_node_path_namespaceObject.join)(this.accountDirectory(name), "config.toml");
+    }
     async writeAccountAuthSnapshot(name, snapshot) {
         await atomicWriteFile(this.accountAuthPath(name), stringifyJson(snapshot));
     }
     async writeAccountMeta(name, meta) {
         await atomicWriteFile(this.accountMetaPath(name), stringifyJson(meta));
     }
+    validateConfigSnapshot(name, snapshot, rawConfig) {
+        if ("apikey" !== snapshot.auth_mode) return;
+        if (!rawConfig) throw new Error(`Current ~/.codex/config.toml is required to save apikey account "${name}".`);
+        if (!/^\s*model_provider\s*=\s*["'][^"']+["']/mu.test(rawConfig)) throw new Error(`Current ~/.codex/config.toml is missing model_provider for apikey account "${name}".`);
+        if (!/^\s*base_url\s*=\s*["'][^"']+["']/mu.test(rawConfig)) throw new Error(`Current ~/.codex/config.toml is missing base_url for apikey account "${name}".`);
+    }
+    sanitizeConfigForAccountAuth(rawConfig) {
+        const lines = rawConfig.split(/\r?\n/u);
+        const result = [];
+        let skippingProviderSection = false;
+        for (const line of lines){
+            const trimmed = line.trim();
+            if (trimmed.startsWith("[") && trimmed.endsWith("]")) {
+                skippingProviderSection = /^\[model_providers\.[^\]]+\]$/u.test(trimmed);
+                if (skippingProviderSection) continue;
+            }
+            if (!skippingProviderSection) {
+                if (!/^\s*model_provider\s*=/u.test(line)) {
+                    if (!/^\s*preferred_auth_method\s*=\s*["']apikey["']\s*$/u.test(line)) result.push(line);
+                }
+            }
+        }
+        return `${result.join("\n").replace(/\n{3,}/gu, "\n\n").trimEnd()}\n`;
+    }
+    async ensureEmptyAccountConfigSnapshot(name) {
+        const configPath = this.accountConfigPath(name);
+        await atomicWriteFile(configPath, "");
+        return configPath;
+    }
     async syncCurrentAuthIfMatching(snapshot) {
         if (!await pathExists(this.paths.currentAuthPath)) return;
         try {
@@ -649,6 +682,7 @@ class AccountStore {
             ...meta,
             authPath,
             metaPath,
+            configPath: await pathExists(this.accountConfigPath(name)) ? this.accountConfigPath(name) : null,
             duplicateAccountId: false
         };
     }
@@ -705,14 +739,28 @@ class AccountStore {
         if (!await pathExists(this.paths.currentAuthPath)) throw new Error("Current ~/.codex/auth.json does not exist.");
         const rawSnapshot = await readJsonFile(this.paths.currentAuthPath);
         const snapshot = parseAuthSnapshot(rawSnapshot);
+        const rawConfig = await pathExists(this.paths.currentConfigPath) ? await readJsonFile(this.paths.currentConfigPath) : null;
         const accountDir = this.accountDirectory(name);
         const authPath = this.accountAuthPath(name);
         const metaPath = this.accountMetaPath(name);
+        const configPath = this.accountConfigPath(name);
+        const identity = getSnapshotIdentity(snapshot);
         const accountExists = await pathExists(accountDir);
         const existingMeta = accountExists && await pathExists(metaPath) ? parseSnapshotMeta(await readJsonFile(metaPath)) : void 0;
         if (accountExists && !force) throw new Error(`Account "${name}" already exists. Use --force to overwrite it.`);
+        const { accounts } = await this.listAccounts();
+        const duplicateIdentityAccounts = accounts.filter((account)=>account.name !== name && account.account_id === identity);
+        if (duplicateIdentityAccounts.length > 0) {
+            const joinedNames = duplicateIdentityAccounts.map((account)=>`"${account.name}"`).join(", ");
+            throw new Error(`Identity ${identity} is already managed by ${joinedNames}.`);
+        }
+        this.validateConfigSnapshot(name, snapshot, rawConfig);
         await ensureDirectory(accountDir, DIRECTORY_MODE);
         await atomicWriteFile(authPath, `${rawSnapshot.trimEnd()}\n`);
+        if ("apikey" === snapshot.auth_mode && rawConfig) await atomicWriteFile(configPath, rawConfig.endsWith("\n") ? rawConfig : `${rawConfig}\n`);
+        else if (await pathExists(configPath)) await (0, promises_namespaceObject.rm)(configPath, {
+            force: true
+        });
         const meta = createSnapshotMeta(name, snapshot, new Date(), existingMeta?.created_at);
         meta.last_switched_at = existingMeta?.last_switched_at ?? null;
         meta.quota = existingMeta?.quota ?? meta.quota;
@@ -728,9 +776,15 @@ class AccountStore {
         const name = current.matched_accounts[0];
         const currentRawSnapshot = await readJsonFile(this.paths.currentAuthPath);
         const currentSnapshot = parseAuthSnapshot(currentRawSnapshot);
+        const currentRawConfig = await pathExists(this.paths.currentConfigPath) ? await readJsonFile(this.paths.currentConfigPath) : null;
         const metaPath = this.accountMetaPath(name);
         const existingMeta = parseSnapshotMeta(await readJsonFile(metaPath));
+        this.validateConfigSnapshot(name, currentSnapshot, currentRawConfig);
         await atomicWriteFile(this.accountAuthPath(name), `${currentRawSnapshot.trimEnd()}\n`);
+        if ("apikey" === currentSnapshot.auth_mode && currentRawConfig) await atomicWriteFile(this.accountConfigPath(name), currentRawConfig.endsWith("\n") ? currentRawConfig : `${currentRawConfig}\n`);
+        else if (await pathExists(this.accountConfigPath(name))) await (0, promises_namespaceObject.rm)(this.accountConfigPath(name), {
+            force: true
+        });
         await atomicWriteFile(metaPath, stringifyJson({
             ...createSnapshotMeta(name, currentSnapshot, new Date(), existingMeta.created_at),
             last_switched_at: existingMeta.last_switched_at,
@@ -752,8 +806,23 @@ class AccountStore {
             await (0, promises_namespaceObject.copyFile)(this.paths.currentAuthPath, backupPath);
             await chmodIfPossible(backupPath, FILE_MODE);
         }
+        if (await pathExists(this.paths.currentConfigPath)) {
+            const configBackupPath = (0, external_node_path_namespaceObject.join)(this.paths.backupsDir, "last-active-config.toml");
+            await (0, promises_namespaceObject.copyFile)(this.paths.currentConfigPath, configBackupPath);
+            await chmodIfPossible(configBackupPath, FILE_MODE);
+        }
         const rawAuth = await readJsonFile(account.authPath);
         await atomicWriteFile(this.paths.currentAuthPath, `${rawAuth.trimEnd()}\n`);
+        if ("apikey" === account.auth_mode && account.configPath) {
+            const rawConfig = await readJsonFile(account.configPath);
+            await atomicWriteFile(this.paths.currentConfigPath, rawConfig.endsWith("\n") ? rawConfig : `${rawConfig}\n`);
+        } else if ("apikey" === account.auth_mode) {
+            await this.ensureEmptyAccountConfigSnapshot(name);
+            warnings.push(`Saved apikey account "${name}" was missing config.toml snapshot. Created an empty snapshot; configure baseUrl manually if needed.`);
+        } else if (await pathExists(this.paths.currentConfigPath)) {
+            const currentRawConfig = await readJsonFile(this.paths.currentConfigPath);
+            await atomicWriteFile(this.paths.currentConfigPath, this.sanitizeConfigForAccountAuth(currentRawConfig));
+        }
         const writtenSnapshot = await readAuthSnapshotFile(this.paths.currentAuthPath);
         if (getSnapshotIdentity(writtenSnapshot) !== account.account_id) throw new Error(`Switch verification failed for account "${name}".`);
         const meta = parseSnapshotMeta(await readJsonFile(account.metaPath));
@@ -911,6 +980,7 @@ class AccountStore {
             const metaStat = await (0, promises_namespaceObject.stat)(account.metaPath);
             if ((511 & authStat.mode) !== FILE_MODE) issues.push(`Account "${account.name}" auth permissions must be 600.`);
             if ((511 & metaStat.mode) !== FILE_MODE) issues.push(`Account "${account.name}" metadata permissions must be 600.`);
+            if ("apikey" === account.auth_mode && !account.configPath) issues.push(`Account "${account.name}" is missing config.toml snapshot required for apikey auth.`);
             if (account.duplicateAccountId) warnings.push(`Account "${account.name}" shares identity ${account.account_id} with another saved account.`);
         }
         let currentAuthPresent = false;
@@ -979,12 +1049,10 @@ Usage:
   codexm list [name] [--json]
   codexm save <name> [--force] [--json]
   codexm update [--json]
-  codexm quota refresh [name] [--json]
   codexm switch <name> [--json]
   codexm switch --auto [--dry-run] [--json]
   codexm remove <name> [--yes] [--json]
   codexm rename <old> <new> [--json]
-  codexm doctor [--json]
 
 Account names must match /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.
 `);
@@ -1002,16 +1070,6 @@ function describeCurrentStatus(status) {
     for (const warning of status.warnings)lines.push(`Warning: ${warning}`);
     return lines.join("\n");
 }
-function describeDoctor(report) {
-    const lines = [
-        report.healthy ? "Doctor checks passed." : "Doctor checks found issues.",
-        `Saved accounts: ${report.account_count}`,
-        `Current auth present: ${report.current_auth_present ? "yes" : "no"}`
-    ];
-    for (const issue of report.issues)lines.push(`Issue: ${issue}`);
-    for (const warning of report.warnings)lines.push(`Warning: ${warning}`);
-    return lines.join("\n");
-}
 function formatUsagePercent(window) {
     if (!window) return "-";
     return `${window.used_percent}%`;
@@ -1275,18 +1333,6 @@ async function runCli(argv, options = {}) {
                     }
                     return 0;
                 }
-            case "quota":
-                {
-                    const quotaCommand = parsed.positionals[0];
-                    if ("refresh" === quotaCommand) {
-                        const targetName = parsed.positionals[1];
-                        const result = await store.refreshAllQuotas(targetName);
-                        if (json) writeJson(streams.stdout, toCliQuotaRefreshResult(result));
-                        else streams.stdout.write(`${describeQuotaRefresh(result)}\n`);
-                        return 0 === result.failures.length ? 0 : 1;
-                    }
-                    throw new Error("Usage: codexm quota refresh [name] [--json]");
-                }
             case "switch":
                 {
                     const auto = parsed.flags.has("--auto");
@@ -1430,13 +1476,6 @@ async function runCli(argv, options = {}) {
                     else streams.stdout.write(`Renamed "${oldName}" to "${newName}".\n`);
                     return 0;
                 }
-            case "doctor":
-                {
-                    const report = await store.doctor();
-                    if (json) writeJson(streams.stdout, report);
-                    else streams.stdout.write(`${describeDoctor(report)}\n`);
-                    return report.healthy ? 0 : 1;
-                }
             default:
                 throw new Error(`Unknown command "${parsed.command}".`);
         }

package/dist/main.js

@@ -9,7 +9,7 @@ import { basename, dirname, join } from "node:path";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 var package_namespaceObject = {
-    rE: "0.0.6"
+    rE: "0.0.8"
 };
 function isRecord(value) {
     return "object" == typeof value && null !== value && !Array.isArray(value);
@@ -446,6 +446,7 @@ function defaultPaths(homeDir = homedir()) {
         codexDir,
         codexTeamDir,
         currentAuthPath: join(codexDir, "auth.json"),
+        currentConfigPath: join(codexDir, "config.toml"),
         accountsDir: join(codexTeamDir, "accounts"),
         backupsDir: join(codexTeamDir, "backups"),
         statePath: join(codexTeamDir, "state.json")
@@ -538,12 +539,44 @@ class AccountStore {
     accountMetaPath(name) {
         return join(this.accountDirectory(name), "meta.json");
     }
+    accountConfigPath(name) {
+        return join(this.accountDirectory(name), "config.toml");
+    }
     async writeAccountAuthSnapshot(name, snapshot) {
         await atomicWriteFile(this.accountAuthPath(name), stringifyJson(snapshot));
     }
     async writeAccountMeta(name, meta) {
         await atomicWriteFile(this.accountMetaPath(name), stringifyJson(meta));
     }
+    validateConfigSnapshot(name, snapshot, rawConfig) {
+        if ("apikey" !== snapshot.auth_mode) return;
+        if (!rawConfig) throw new Error(`Current ~/.codex/config.toml is required to save apikey account "${name}".`);
+        if (!/^\s*model_provider\s*=\s*["'][^"']+["']/mu.test(rawConfig)) throw new Error(`Current ~/.codex/config.toml is missing model_provider for apikey account "${name}".`);
+        if (!/^\s*base_url\s*=\s*["'][^"']+["']/mu.test(rawConfig)) throw new Error(`Current ~/.codex/config.toml is missing base_url for apikey account "${name}".`);
+    }
+    sanitizeConfigForAccountAuth(rawConfig) {
+        const lines = rawConfig.split(/\r?\n/u);
+        const result = [];
+        let skippingProviderSection = false;
+        for (const line of lines){
+            const trimmed = line.trim();
+            if (trimmed.startsWith("[") && trimmed.endsWith("]")) {
+                skippingProviderSection = /^\[model_providers\.[^\]]+\]$/u.test(trimmed);
+                if (skippingProviderSection) continue;
+            }
+            if (!skippingProviderSection) {
+                if (!/^\s*model_provider\s*=/u.test(line)) {
+                    if (!/^\s*preferred_auth_method\s*=\s*["']apikey["']\s*$/u.test(line)) result.push(line);
+                }
+            }
+        }
+        return `${result.join("\n").replace(/\n{3,}/gu, "\n\n").trimEnd()}\n`;
+    }
+    async ensureEmptyAccountConfigSnapshot(name) {
+        const configPath = this.accountConfigPath(name);
+        await atomicWriteFile(configPath, "");
+        return configPath;
+    }
     async syncCurrentAuthIfMatching(snapshot) {
         if (!await pathExists(this.paths.currentAuthPath)) return;
         try {
@@ -609,6 +642,7 @@ class AccountStore {
             ...meta,
             authPath,
             metaPath,
+            configPath: await pathExists(this.accountConfigPath(name)) ? this.accountConfigPath(name) : null,
             duplicateAccountId: false
         };
     }
@@ -665,14 +699,28 @@ class AccountStore {
         if (!await pathExists(this.paths.currentAuthPath)) throw new Error("Current ~/.codex/auth.json does not exist.");
         const rawSnapshot = await readJsonFile(this.paths.currentAuthPath);
         const snapshot = parseAuthSnapshot(rawSnapshot);
+        const rawConfig = await pathExists(this.paths.currentConfigPath) ? await readJsonFile(this.paths.currentConfigPath) : null;
         const accountDir = this.accountDirectory(name);
         const authPath = this.accountAuthPath(name);
         const metaPath = this.accountMetaPath(name);
+        const configPath = this.accountConfigPath(name);
+        const identity = getSnapshotIdentity(snapshot);
         const accountExists = await pathExists(accountDir);
         const existingMeta = accountExists && await pathExists(metaPath) ? parseSnapshotMeta(await readJsonFile(metaPath)) : void 0;
         if (accountExists && !force) throw new Error(`Account "${name}" already exists. Use --force to overwrite it.`);
+        const { accounts } = await this.listAccounts();
+        const duplicateIdentityAccounts = accounts.filter((account)=>account.name !== name && account.account_id === identity);
+        if (duplicateIdentityAccounts.length > 0) {
+            const joinedNames = duplicateIdentityAccounts.map((account)=>`"${account.name}"`).join(", ");
+            throw new Error(`Identity ${identity} is already managed by ${joinedNames}.`);
+        }
+        this.validateConfigSnapshot(name, snapshot, rawConfig);
         await ensureDirectory(accountDir, DIRECTORY_MODE);
         await atomicWriteFile(authPath, `${rawSnapshot.trimEnd()}\n`);
+        if ("apikey" === snapshot.auth_mode && rawConfig) await atomicWriteFile(configPath, rawConfig.endsWith("\n") ? rawConfig : `${rawConfig}\n`);
+        else if (await pathExists(configPath)) await rm(configPath, {
+            force: true
+        });
         const meta = createSnapshotMeta(name, snapshot, new Date(), existingMeta?.created_at);
         meta.last_switched_at = existingMeta?.last_switched_at ?? null;
         meta.quota = existingMeta?.quota ?? meta.quota;
@@ -688,9 +736,15 @@ class AccountStore {
         const name = current.matched_accounts[0];
         const currentRawSnapshot = await readJsonFile(this.paths.currentAuthPath);
         const currentSnapshot = parseAuthSnapshot(currentRawSnapshot);
+        const currentRawConfig = await pathExists(this.paths.currentConfigPath) ? await readJsonFile(this.paths.currentConfigPath) : null;
         const metaPath = this.accountMetaPath(name);
         const existingMeta = parseSnapshotMeta(await readJsonFile(metaPath));
+        this.validateConfigSnapshot(name, currentSnapshot, currentRawConfig);
         await atomicWriteFile(this.accountAuthPath(name), `${currentRawSnapshot.trimEnd()}\n`);
+        if ("apikey" === currentSnapshot.auth_mode && currentRawConfig) await atomicWriteFile(this.accountConfigPath(name), currentRawConfig.endsWith("\n") ? currentRawConfig : `${currentRawConfig}\n`);
+        else if (await pathExists(this.accountConfigPath(name))) await rm(this.accountConfigPath(name), {
+            force: true
+        });
         await atomicWriteFile(metaPath, stringifyJson({
             ...createSnapshotMeta(name, currentSnapshot, new Date(), existingMeta.created_at),
             last_switched_at: existingMeta.last_switched_at,
@@ -712,8 +766,23 @@ class AccountStore {
             await copyFile(this.paths.currentAuthPath, backupPath);
             await chmodIfPossible(backupPath, FILE_MODE);
         }
+        if (await pathExists(this.paths.currentConfigPath)) {
+            const configBackupPath = join(this.paths.backupsDir, "last-active-config.toml");
+            await copyFile(this.paths.currentConfigPath, configBackupPath);
+            await chmodIfPossible(configBackupPath, FILE_MODE);
+        }
         const rawAuth = await readJsonFile(account.authPath);
         await atomicWriteFile(this.paths.currentAuthPath, `${rawAuth.trimEnd()}\n`);
+        if ("apikey" === account.auth_mode && account.configPath) {
+            const rawConfig = await readJsonFile(account.configPath);
+            await atomicWriteFile(this.paths.currentConfigPath, rawConfig.endsWith("\n") ? rawConfig : `${rawConfig}\n`);
+        } else if ("apikey" === account.auth_mode) {
+            await this.ensureEmptyAccountConfigSnapshot(name);
+            warnings.push(`Saved apikey account "${name}" was missing config.toml snapshot. Created an empty snapshot; configure baseUrl manually if needed.`);
+        } else if (await pathExists(this.paths.currentConfigPath)) {
+            const currentRawConfig = await readJsonFile(this.paths.currentConfigPath);
+            await atomicWriteFile(this.paths.currentConfigPath, this.sanitizeConfigForAccountAuth(currentRawConfig));
+        }
         const writtenSnapshot = await readAuthSnapshotFile(this.paths.currentAuthPath);
         if (getSnapshotIdentity(writtenSnapshot) !== account.account_id) throw new Error(`Switch verification failed for account "${name}".`);
         const meta = parseSnapshotMeta(await readJsonFile(account.metaPath));
@@ -871,6 +940,7 @@ class AccountStore {
             const metaStat = await stat(account.metaPath);
             if ((511 & authStat.mode) !== FILE_MODE) issues.push(`Account "${account.name}" auth permissions must be 600.`);
             if ((511 & metaStat.mode) !== FILE_MODE) issues.push(`Account "${account.name}" metadata permissions must be 600.`);
+            if ("apikey" === account.auth_mode && !account.configPath) issues.push(`Account "${account.name}" is missing config.toml snapshot required for apikey auth.`);
             if (account.duplicateAccountId) warnings.push(`Account "${account.name}" shares identity ${account.account_id} with another saved account.`);
         }
         let currentAuthPresent = false;
@@ -939,12 +1009,10 @@ Usage:
   codexm list [name] [--json]
   codexm save <name> [--force] [--json]
   codexm update [--json]
-  codexm quota refresh [name] [--json]
   codexm switch <name> [--json]
   codexm switch --auto [--dry-run] [--json]
   codexm remove <name> [--yes] [--json]
   codexm rename <old> <new> [--json]
-  codexm doctor [--json]
 
 Account names must match /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.
 `);
@@ -962,16 +1030,6 @@ function describeCurrentStatus(status) {
     for (const warning of status.warnings)lines.push(`Warning: ${warning}`);
     return lines.join("\n");
 }
-function describeDoctor(report) {
-    const lines = [
-        report.healthy ? "Doctor checks passed." : "Doctor checks found issues.",
-        `Saved accounts: ${report.account_count}`,
-        `Current auth present: ${report.current_auth_present ? "yes" : "no"}`
-    ];
-    for (const issue of report.issues)lines.push(`Issue: ${issue}`);
-    for (const warning of report.warnings)lines.push(`Warning: ${warning}`);
-    return lines.join("\n");
-}
 function formatUsagePercent(window) {
     if (!window) return "-";
     return `${window.used_percent}%`;
@@ -1235,18 +1293,6 @@ async function runCli(argv, options = {}) {
                     }
                     return 0;
                 }
-            case "quota":
-                {
-                    const quotaCommand = parsed.positionals[0];
-                    if ("refresh" === quotaCommand) {
-                        const targetName = parsed.positionals[1];
-                        const result = await store.refreshAllQuotas(targetName);
-                        if (json) writeJson(streams.stdout, toCliQuotaRefreshResult(result));
-                        else streams.stdout.write(`${describeQuotaRefresh(result)}\n`);
-                        return 0 === result.failures.length ? 0 : 1;
-                    }
-                    throw new Error("Usage: codexm quota refresh [name] [--json]");
-                }
             case "switch":
                 {
                     const auto = parsed.flags.has("--auto");
@@ -1390,13 +1436,6 @@ async function runCli(argv, options = {}) {
                     else streams.stdout.write(`Renamed "${oldName}" to "${newName}".\n`);
                     return 0;
                 }
-            case "doctor":
-                {
-                    const report = await store.doctor();
-                    if (json) writeJson(streams.stdout, report);
-                    else streams.stdout.write(`${describeDoctor(report)}\n`);
-                    return report.healthy ? 0 : 1;
-                }
             default:
                 throw new Error(`Unknown command "${parsed.command}".`);
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-team",
-  "version": "0.0.6",
+  "version": "0.0.8",
   "description": "Manage multiple Codex ChatGPT auth snapshots and quota usage from the command line.",
   "license": "MIT",
   "type": "module",