codex-team 0.0.8 → 0.0.9

package/README.md

@@ -36,6 +36,8 @@ Use `--json` on query and mutation commands when you need machine-readable outpu
 4. Switch between saved accounts with `codexm switch <name>` or let the tool choose with `codexm switch --auto`.
 5. Refresh and inspect quota usage with `codexm list`.
 
+For ChatGPT auth snapshots, `codex-team` can save and switch different users under the same ChatGPT account/workspace as separate managed entries when the local login tokens distinguish them.
+
 ## Development
 
 ```bash

package/dist/cli.cjs

@@ -13,7 +13,7 @@ var __webpack_modules__ = {
         const utc_js_namespaceObject = require("dayjs/plugin/utc.js");
         var utc_js_default = /*#__PURE__*/ __webpack_require__.n(utc_js_namespaceObject);
         var package_namespaceObject = {
-            rE: "0.0.8"
+            rE: "0.0.9"
         };
         const external_node_crypto_namespaceObject = require("node:crypto");
         const promises_namespaceObject = require("node:fs/promises");
@@ -48,10 +48,44 @@ var __webpack_modules__ = {
             const normalized = normalizeAuthMode(authMode);
             return "chatgpt" === normalized || "chatgpt_auth_tokens" === normalized;
         }
+        function extractAuthClaim(payload) {
+            const value = payload["https://api.openai.com/auth"];
+            return isRecord(value) ? value : void 0;
+        }
+        function extractStringClaim(payload, key) {
+            const value = payload[key];
+            return "string" == typeof value && "" !== value.trim() ? value : void 0;
+        }
+        function extractSnapshotJwtPayloads(snapshot) {
+            const tokens = snapshot.tokens ?? {};
+            const payloads = [];
+            for (const tokenName of [
+                "id_token",
+                "access_token"
+            ]){
+                const token = tokens[tokenName];
+                if ("string" == typeof token && "" !== token.trim()) try {
+                    payloads.push(decodeJwtPayload(token));
+                } catch  {}
+            }
+            return payloads;
+        }
+        function getSnapshotUserId(snapshot) {
+            for (const payload of extractSnapshotJwtPayloads(snapshot)){
+                const authClaim = extractAuthClaim(payload);
+                const chatGPTUserId = authClaim?.chatgpt_user_id;
+                if ("string" == typeof chatGPTUserId && "" !== chatGPTUserId.trim()) return chatGPTUserId;
+                const userId = extractStringClaim(payload, "user_id");
+                if (userId) return userId;
+            }
+        }
         function fingerprintApiKey(apiKey) {
             return (0, external_node_crypto_namespaceObject.createHash)("sha256").update(apiKey).digest("hex").slice(0, 16);
         }
-        function getSnapshotIdentity(snapshot) {
+        function composeIdentity(accountId, userId) {
+            return "string" == typeof userId && "" !== userId.trim() ? `${accountId}:${userId}` : accountId;
+        }
+        function getSnapshotAccountId(snapshot) {
             if (isApiKeyAuthMode(snapshot.auth_mode)) {
                 const apiKey = snapshot.OPENAI_API_KEY;
                 if ("string" != typeof apiKey || "" === apiKey.trim()) throw new Error('Field "OPENAI_API_KEY" must be a non-empty string for apikey auth.');
@@ -61,6 +95,12 @@ var __webpack_modules__ = {
             if ("string" != typeof accountId || "" === accountId.trim()) throw new Error('Field "tokens.account_id" must be a non-empty string.');
             return accountId;
         }
+        function getSnapshotIdentity(snapshot) {
+            return composeIdentity(getSnapshotAccountId(snapshot), isSupportedChatGPTAuthMode(snapshot.auth_mode) ? getSnapshotUserId(snapshot) : void 0);
+        }
+        function getMetaIdentity(meta) {
+            return composeIdentity(meta.account_id, meta.user_id);
+        }
         function defaultQuotaSnapshot() {
             return {
                 status: "stale"
@@ -138,7 +178,8 @@ var __webpack_modules__ = {
             return {
                 name,
                 auth_mode: snapshot.auth_mode,
-                account_id: getSnapshotIdentity(snapshot),
+                account_id: getSnapshotAccountId(snapshot),
+                user_id: isSupportedChatGPTAuthMode(snapshot.auth_mode) ? getSnapshotUserId(snapshot) : void 0,
                 created_at: existingCreatedAt ?? timestamp,
                 updated_at: timestamp,
                 last_switched_at: null,
@@ -159,6 +200,7 @@ var __webpack_modules__ = {
                 name: asNonEmptyString(parsed.name, "name"),
                 auth_mode: asNonEmptyString(parsed.auth_mode, "auth_mode"),
                 account_id: asNonEmptyString(parsed.account_id, "account_id"),
+                user_id: asOptionalString(parsed.user_id, "user_id"),
                 created_at: asNonEmptyString(parsed.created_at, "created_at"),
                 updated_at: asNonEmptyString(parsed.updated_at, "updated_at"),
                 last_switched_at: lastSwitchedAt,
@@ -187,11 +229,11 @@ var __webpack_modules__ = {
         function quota_client_isRecord(value) {
             return "object" == typeof value && null !== value && !Array.isArray(value);
         }
-        function extractAuthClaim(payload) {
+        function quota_client_extractAuthClaim(payload) {
             const value = payload["https://api.openai.com/auth"];
             return quota_client_isRecord(value) ? value : void 0;
         }
-        function extractStringClaim(payload, key) {
+        function quota_client_extractStringClaim(payload, key) {
             const value = payload[key];
             return "string" == typeof value && "" !== value.trim() ? value : void 0;
         }
@@ -204,7 +246,7 @@ var __webpack_modules__ = {
                 const token = tokens[tokenName];
                 if ("string" == typeof token && "" !== token.trim()) try {
                     const payload = decodeJwtPayload(token);
-                    const authClaim = extractAuthClaim(payload);
+                    const authClaim = quota_client_extractAuthClaim(payload);
                     const planType = authClaim?.chatgpt_plan_type;
                     if ("string" == typeof planType && "" !== planType.trim()) return planType;
                 } catch  {}
@@ -228,7 +270,7 @@ var __webpack_modules__ = {
                 const token = tokens[tokenName];
                 if ("string" == typeof token && "" !== token.trim()) try {
                     const payload = decodeJwtPayload(token);
-                    const authClaim = extractAuthClaim(payload);
+                    const authClaim = quota_client_extractAuthClaim(payload);
                     if (!accountId) {
                         const maybeAccountId = authClaim?.chatgpt_account_id;
                         if ("string" == typeof maybeAccountId && "" !== maybeAccountId.trim()) accountId = maybeAccountId;
@@ -237,8 +279,8 @@ var __webpack_modules__ = {
                         const maybePlanType = authClaim?.chatgpt_plan_type;
                         if ("string" == typeof maybePlanType && "" !== maybePlanType.trim()) planType = maybePlanType;
                     }
-                    issuer ??= extractStringClaim(payload, "iss");
-                    clientId ??= extractStringClaim(payload, "client_id") ?? extractStringClaim(payload, "azp") ?? ("string" == typeof payload.aud ? payload.aud : void 0);
+                    issuer ??= quota_client_extractStringClaim(payload, "iss");
+                    clientId ??= quota_client_extractStringClaim(payload, "client_id") ?? quota_client_extractStringClaim(payload, "azp") ?? ("string" == typeof payload.aud ? payload.aud : void 0);
                 } catch  {}
             }
             if (!supported) return {
@@ -508,6 +550,13 @@ var __webpack_modules__ = {
         async function readJsonFile(path) {
             return (0, promises_namespaceObject.readFile)(path, "utf8");
         }
+        function canAutoMigrateLegacyChatGPTMeta(meta, snapshot) {
+            if (!isSupportedChatGPTAuthMode(meta.auth_mode) || !isSupportedChatGPTAuthMode(snapshot.auth_mode)) return false;
+            if ("string" == typeof meta.user_id && "" !== meta.user_id.trim()) return false;
+            const snapshotUserId = getSnapshotUserId(snapshot);
+            if (!snapshotUserId) return false;
+            return meta.account_id === getSnapshotAccountId(snapshot);
+        }
         async function detectRunningCodexProcesses() {
             try {
                 const { stdout } = await execFile("ps", [
@@ -605,6 +654,8 @@ var __webpack_modules__ = {
                 return {
                     name: account.name,
                     account_id: account.account_id,
+                    user_id: account.user_id ?? null,
+                    identity: account.identity,
                     plan_type: planType,
                     credits_balance: account.quota.credits_balance ?? null,
                     status: account.quota.status,
@@ -645,11 +696,21 @@ var __webpack_modules__ = {
                     readJsonFile(metaPath),
                     readAuthSnapshotFile(authPath)
                 ]);
-                const meta = parseSnapshotMeta(rawMeta);
+                let meta = parseSnapshotMeta(rawMeta);
                 if (meta.name !== name) throw new Error(`Account metadata name mismatch for "${name}".`);
-                if (meta.account_id !== getSnapshotIdentity(snapshot)) throw new Error(`Account metadata account_id mismatch for "${name}".`);
+                const snapshotIdentity = getSnapshotIdentity(snapshot);
+                if (getMetaIdentity(meta) !== snapshotIdentity) if (canAutoMigrateLegacyChatGPTMeta(meta, snapshot)) {
+                    meta = {
+                        ...meta,
+                        account_id: getSnapshotAccountId(snapshot),
+                        user_id: getSnapshotUserId(snapshot)
+                    };
+                    await this.writeAccountMeta(name, meta);
+                } else throw new Error(`Account metadata account_id mismatch for "${name}".`);
+                if (getMetaIdentity(meta) !== snapshotIdentity) throw new Error(`Account metadata account_id mismatch for "${name}".`);
                 return {
                     ...meta,
+                    identity: getMetaIdentity(meta),
                     authPath,
                     metaPath,
                     configPath: await pathExists(this.accountConfigPath(name)) ? this.accountConfigPath(name) : null,
@@ -669,12 +730,12 @@ var __webpack_modules__ = {
                     warnings.push(`Account "${entry.name}" is invalid: ${error.message}`);
                 }
                 const counts = new Map();
-                for (const account of accounts)counts.set(account.account_id, (counts.get(account.account_id) ?? 0) + 1);
+                for (const account of accounts)counts.set(account.identity, (counts.get(account.identity) ?? 0) + 1);
                 accounts.sort((left, right)=>left.name.localeCompare(right.name));
                 return {
                     accounts: accounts.map((account)=>({
                             ...account,
-                            duplicateAccountId: (counts.get(account.account_id) ?? 0) > 1
+                            duplicateAccountId: (counts.get(account.identity) ?? 0) > 1
                         })),
                     warnings
                 };
@@ -685,6 +746,8 @@ var __webpack_modules__ = {
                     exists: false,
                     auth_mode: null,
                     account_id: null,
+                    user_id: null,
+                    identity: null,
                     matched_accounts: [],
                     managed: false,
                     duplicate_match: false,
@@ -692,11 +755,15 @@ var __webpack_modules__ = {
                 };
                 const snapshot = await readAuthSnapshotFile(this.paths.currentAuthPath);
                 const currentIdentity = getSnapshotIdentity(snapshot);
-                const matchedAccounts = accounts.filter((account)=>account.account_id === currentIdentity).map((account)=>account.name);
+                const currentAccountId = getSnapshotAccountId(snapshot);
+                const currentUserId = getSnapshotUserId(snapshot) ?? null;
+                const matchedAccounts = accounts.filter((account)=>account.identity === currentIdentity).map((account)=>account.name);
                 return {
                     exists: true,
                     auth_mode: snapshot.auth_mode,
-                    account_id: currentIdentity,
+                    account_id: currentAccountId,
+                    user_id: currentUserId,
+                    identity: currentIdentity,
                     matched_accounts: matchedAccounts,
                     managed: matchedAccounts.length > 0,
                     duplicate_match: matchedAccounts.length > 1,
@@ -719,7 +786,7 @@ var __webpack_modules__ = {
                 const existingMeta = accountExists && await pathExists(metaPath) ? parseSnapshotMeta(await readJsonFile(metaPath)) : void 0;
                 if (accountExists && !force) throw new Error(`Account "${name}" already exists. Use --force to overwrite it.`);
                 const { accounts } = await this.listAccounts();
-                const duplicateIdentityAccounts = accounts.filter((account)=>account.name !== name && account.account_id === identity);
+                const duplicateIdentityAccounts = accounts.filter((account)=>account.name !== name && account.identity === identity);
                 if (duplicateIdentityAccounts.length > 0) {
                     const joinedNames = duplicateIdentityAccounts.map((account)=>`"${account.name}"`).join(", ");
                     throw new Error(`Identity ${identity} is already managed by ${joinedNames}.`);
@@ -794,7 +861,7 @@ var __webpack_modules__ = {
                     await atomicWriteFile(this.paths.currentConfigPath, this.sanitizeConfigForAccountAuth(currentRawConfig));
                 }
                 const writtenSnapshot = await readAuthSnapshotFile(this.paths.currentAuthPath);
-                if (getSnapshotIdentity(writtenSnapshot) !== account.account_id) throw new Error(`Switch verification failed for account "${name}".`);
+                if (getSnapshotIdentity(writtenSnapshot) !== account.identity) throw new Error(`Switch verification failed for account "${name}".`);
                 const meta = parseSnapshotMeta(await readJsonFile(account.metaPath));
                 meta.last_switched_at = new Date().toISOString();
                 meta.updated_at = meta.last_switched_at;
@@ -838,7 +905,8 @@ var __webpack_modules__ = {
                         await this.syncCurrentAuthIfMatching(result.authSnapshot);
                     }
                     meta.auth_mode = result.authSnapshot.auth_mode;
-                    meta.account_id = getSnapshotIdentity(result.authSnapshot);
+                    meta.account_id = getSnapshotAccountId(result.authSnapshot);
+                    meta.user_id = getSnapshotUserId(result.authSnapshot);
                     meta.updated_at = now.toISOString();
                     meta.quota = result.quota;
                     await this.writeAccountMeta(name, meta);
@@ -951,7 +1019,7 @@ var __webpack_modules__ = {
                     if ((511 & authStat.mode) !== FILE_MODE) issues.push(`Account "${account.name}" auth permissions must be 600.`);
                     if ((511 & metaStat.mode) !== FILE_MODE) issues.push(`Account "${account.name}" metadata permissions must be 600.`);
                     if ("apikey" === account.auth_mode && !account.configPath) issues.push(`Account "${account.name}" is missing config.toml snapshot required for apikey auth.`);
-                    if (account.duplicateAccountId) warnings.push(`Account "${account.name}" shares identity ${account.account_id} with another saved account.`);
+                    if (account.duplicateAccountId) warnings.push(`Account "${account.name}" shares identity ${account.identity} with another saved account.`);
                 }
                 let currentAuthPresent = false;
                 if (await pathExists(this.paths.currentAuthPath)) {
@@ -1032,7 +1100,7 @@ Account names must match /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.
             if (status.exists) {
                 lines.push("Current auth: present");
                 lines.push(`Auth mode: ${status.auth_mode}`);
-                lines.push(`Identity: ${maskAccountId(status.account_id ?? "")}`);
+                lines.push(`Identity: ${maskAccountId(status.identity ?? "")}`);
                 if (0 === status.matched_accounts.length) lines.push("Managed account: no (unmanaged)");
                 else if (1 === status.matched_accounts.length) lines.push(`Managed account: ${status.matched_accounts[0]}`);
                 else lines.push(`Managed account: multiple (${status.matched_accounts.join(", ")})`);
@@ -1085,6 +1153,7 @@ Account names must match /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.
             return {
                 name: account.name,
                 account_id: account.account_id,
+                identity: account.identity,
                 plan_type: account.plan_type,
                 available: computeAvailability(account),
                 refresh_status: "ok",
@@ -1117,7 +1186,7 @@ Account names must match /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.
         }
         function describeAutoSwitchSelection(candidate, dryRun, backupPath, warnings) {
             const lines = [
-                dryRun ? `Best account: "${candidate.name}" (${maskAccountId(candidate.account_id)}).` : `Auto-switched to "${candidate.name}" (${maskAccountId(candidate.account_id)}).`,
+                dryRun ? `Best account: "${candidate.name}" (${maskAccountId(candidate.identity)}).` : `Auto-switched to "${candidate.name}" (${maskAccountId(candidate.identity)}).`,
                 `Score: ${candidate.effective_score}`,
                 `5H remaining: ${candidate.remain_5h}%`,
                 `1W remaining (5H-equivalent): ${candidate.remain_1w_eq_5h}%`
@@ -1128,7 +1197,7 @@ Account names must match /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.
         }
         function describeAutoSwitchNoop(candidate, warnings) {
             const lines = [
-                `Current account "${candidate.name}" (${maskAccountId(candidate.account_id)}) is already the best available account.`,
+                `Current account "${candidate.name}" (${maskAccountId(candidate.identity)}) is already the best available account.`,
                 `Score: ${candidate.effective_score}`,
                 `5H remaining: ${candidate.remain_5h}%`,
                 `1W remaining (5H-equivalent): ${candidate.remain_1w_eq_5h}%`
@@ -1140,7 +1209,7 @@ Account names must match /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.
             if (0 === accounts.length) return 0 === warnings.length ? "No saved accounts." : warnings.map((warning)=>`Warning: ${warning}`).join("\n");
             const table = formatTable(accounts.map((account)=>({
                     name: account.name,
-                    account_id: maskAccountId(account.account_id),
+                    account_id: maskAccountId(account.identity),
                     plan_type: account.plan_type ?? "-",
                     available: computeAvailability(account) ?? "-",
                     five_hour: formatUsagePercent(account.five_hour),
@@ -1265,11 +1334,13 @@ Account names must match /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.
                                 account: {
                                     name: account.name,
                                     account_id: account.account_id,
+                                    user_id: account.user_id ?? null,
+                                    identity: account.identity,
                                     auth_mode: account.auth_mode
                                 }
                             };
                             if (json) writeJson(streams.stdout, payload);
-                            else streams.stdout.write(`Saved account "${account.name}" (${maskAccountId(account.account_id)}).\n`);
+                            else streams.stdout.write(`Saved account "${account.name}" (${maskAccountId(account.identity)}).\n`);
                             return 0;
                         }
                     case "update":
@@ -1291,6 +1362,8 @@ Account names must match /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.
                                 account: {
                                     name: result.account.name,
                                     account_id: result.account.account_id,
+                                    user_id: result.account.user_id ?? null,
+                                    identity: result.account.identity,
                                     auth_mode: result.account.auth_mode
                                 },
                                 quota,
@@ -1298,7 +1371,7 @@ Account names must match /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.
                             };
                             if (json) writeJson(streams.stdout, payload);
                             else {
-                                streams.stdout.write(`Updated managed account "${result.account.name}" (${maskAccountId(result.account.account_id)}).\n`);
+                                streams.stdout.write(`Updated managed account "${result.account.name}" (${maskAccountId(result.account.identity)}).\n`);
                                 for (const warning of warnings)streams.stdout.write(`Warning: ${warning}\n`);
                             }
                             return 0;
@@ -1341,7 +1414,8 @@ Account names must match /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.
                                         reason: "already_current_best",
                                         account: {
                                             name: selected.name,
-                                            account_id: selected.account_id
+                                            account_id: selected.account_id,
+                                            identity: selected.identity
                                         },
                                         selected,
                                         candidates,
@@ -1361,6 +1435,8 @@ Account names must match /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.
                                     account: {
                                         name: result.account.name,
                                         account_id: result.account.account_id,
+                                        user_id: result.account.user_id ?? null,
+                                        identity: result.account.identity,
                                         auth_mode: result.account.auth_mode
                                     },
                                     selected,
@@ -1390,6 +1466,8 @@ Account names must match /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.
                                 account: {
                                     name: result.account.name,
                                     account_id: result.account.account_id,
+                                    user_id: result.account.user_id ?? null,
+                                    identity: result.account.identity,
                                     auth_mode: result.account.auth_mode
                                 },
                                 quota,
@@ -1398,7 +1476,7 @@ Account names must match /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.
                             };
                             if (json) writeJson(streams.stdout, payload);
                             else {
-                                streams.stdout.write(`Switched to "${result.account.name}" (${maskAccountId(result.account.account_id)}).\n`);
+                                streams.stdout.write(`Switched to "${result.account.name}" (${maskAccountId(result.account.identity)}).\n`);
                                 if (result.backup_path) streams.stdout.write(`Backup: ${result.backup_path}\n`);
                                 for (const warning of result.warnings)streams.stdout.write(`Warning: ${warning}\n`);
                             }
@@ -1440,6 +1518,8 @@ Account names must match /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.
                                 account: {
                                     name: account.name,
                                     account_id: account.account_id,
+                                    user_id: account.user_id ?? null,
+                                    identity: account.identity,
                                     auth_mode: account.auth_mode
                                 }
                             });

package/dist/main.cjs

@@ -43,7 +43,7 @@ var timezone_js_default = /*#__PURE__*/ __webpack_require__.n(timezone_js_namesp
 const utc_js_namespaceObject = require("dayjs/plugin/utc.js");
 var utc_js_default = /*#__PURE__*/ __webpack_require__.n(utc_js_namespaceObject);
 var package_namespaceObject = {
-    rE: "0.0.8"
+    rE: "0.0.9"
 };
 const external_node_crypto_namespaceObject = require("node:crypto");
 const promises_namespaceObject = require("node:fs/promises");
@@ -78,10 +78,44 @@ function isSupportedChatGPTAuthMode(authMode) {
     const normalized = normalizeAuthMode(authMode);
     return "chatgpt" === normalized || "chatgpt_auth_tokens" === normalized;
 }
+function extractAuthClaim(payload) {
+    const value = payload["https://api.openai.com/auth"];
+    return isRecord(value) ? value : void 0;
+}
+function extractStringClaim(payload, key) {
+    const value = payload[key];
+    return "string" == typeof value && "" !== value.trim() ? value : void 0;
+}
+function extractSnapshotJwtPayloads(snapshot) {
+    const tokens = snapshot.tokens ?? {};
+    const payloads = [];
+    for (const tokenName of [
+        "id_token",
+        "access_token"
+    ]){
+        const token = tokens[tokenName];
+        if ("string" == typeof token && "" !== token.trim()) try {
+            payloads.push(decodeJwtPayload(token));
+        } catch  {}
+    }
+    return payloads;
+}
+function getSnapshotUserId(snapshot) {
+    for (const payload of extractSnapshotJwtPayloads(snapshot)){
+        const authClaim = extractAuthClaim(payload);
+        const chatGPTUserId = authClaim?.chatgpt_user_id;
+        if ("string" == typeof chatGPTUserId && "" !== chatGPTUserId.trim()) return chatGPTUserId;
+        const userId = extractStringClaim(payload, "user_id");
+        if (userId) return userId;
+    }
+}
 function fingerprintApiKey(apiKey) {
     return (0, external_node_crypto_namespaceObject.createHash)("sha256").update(apiKey).digest("hex").slice(0, 16);
 }
-function getSnapshotIdentity(snapshot) {
+function composeIdentity(accountId, userId) {
+    return "string" == typeof userId && "" !== userId.trim() ? `${accountId}:${userId}` : accountId;
+}
+function getSnapshotAccountId(snapshot) {
     if (isApiKeyAuthMode(snapshot.auth_mode)) {
         const apiKey = snapshot.OPENAI_API_KEY;
         if ("string" != typeof apiKey || "" === apiKey.trim()) throw new Error('Field "OPENAI_API_KEY" must be a non-empty string for apikey auth.');
@@ -91,6 +125,12 @@ function getSnapshotIdentity(snapshot) {
     if ("string" != typeof accountId || "" === accountId.trim()) throw new Error('Field "tokens.account_id" must be a non-empty string.');
     return accountId;
 }
+function getSnapshotIdentity(snapshot) {
+    return composeIdentity(getSnapshotAccountId(snapshot), isSupportedChatGPTAuthMode(snapshot.auth_mode) ? getSnapshotUserId(snapshot) : void 0);
+}
+function getMetaIdentity(meta) {
+    return composeIdentity(meta.account_id, meta.user_id);
+}
 function defaultQuotaSnapshot() {
     return {
         status: "stale"
@@ -168,7 +208,8 @@ function createSnapshotMeta(name, snapshot, now, existingCreatedAt) {
     return {
         name,
         auth_mode: snapshot.auth_mode,
-        account_id: getSnapshotIdentity(snapshot),
+        account_id: getSnapshotAccountId(snapshot),
+        user_id: isSupportedChatGPTAuthMode(snapshot.auth_mode) ? getSnapshotUserId(snapshot) : void 0,
         created_at: existingCreatedAt ?? timestamp,
         updated_at: timestamp,
         last_switched_at: null,
@@ -189,6 +230,7 @@ function parseSnapshotMeta(raw) {
         name: asNonEmptyString(parsed.name, "name"),
         auth_mode: asNonEmptyString(parsed.auth_mode, "auth_mode"),
         account_id: asNonEmptyString(parsed.account_id, "account_id"),
+        user_id: asOptionalString(parsed.user_id, "user_id"),
         created_at: asNonEmptyString(parsed.created_at, "created_at"),
         updated_at: asNonEmptyString(parsed.updated_at, "updated_at"),
         last_switched_at: lastSwitchedAt,
@@ -217,11 +259,11 @@ const USER_AGENT = "codexm/0.1";
 function quota_client_isRecord(value) {
     return "object" == typeof value && null !== value && !Array.isArray(value);
 }
-function extractAuthClaim(payload) {
+function quota_client_extractAuthClaim(payload) {
     const value = payload["https://api.openai.com/auth"];
     return quota_client_isRecord(value) ? value : void 0;
 }
-function extractStringClaim(payload, key) {
+function quota_client_extractStringClaim(payload, key) {
     const value = payload[key];
     return "string" == typeof value && "" !== value.trim() ? value : void 0;
 }
@@ -234,7 +276,7 @@ function parsePlanType(snapshot) {
         const token = tokens[tokenName];
         if ("string" == typeof token && "" !== token.trim()) try {
             const payload = decodeJwtPayload(token);
-            const authClaim = extractAuthClaim(payload);
+            const authClaim = quota_client_extractAuthClaim(payload);
             const planType = authClaim?.chatgpt_plan_type;
             if ("string" == typeof planType && "" !== planType.trim()) return planType;
         } catch  {}
@@ -258,7 +300,7 @@ function extractChatGPTAuth(snapshot) {
         const token = tokens[tokenName];
         if ("string" == typeof token && "" !== token.trim()) try {
             const payload = decodeJwtPayload(token);
-            const authClaim = extractAuthClaim(payload);
+            const authClaim = quota_client_extractAuthClaim(payload);
             if (!accountId) {
                 const maybeAccountId = authClaim?.chatgpt_account_id;
                 if ("string" == typeof maybeAccountId && "" !== maybeAccountId.trim()) accountId = maybeAccountId;
@@ -267,8 +309,8 @@ function extractChatGPTAuth(snapshot) {
                 const maybePlanType = authClaim?.chatgpt_plan_type;
                 if ("string" == typeof maybePlanType && "" !== maybePlanType.trim()) planType = maybePlanType;
             }
-            issuer ??= extractStringClaim(payload, "iss");
-            clientId ??= extractStringClaim(payload, "client_id") ?? extractStringClaim(payload, "azp") ?? ("string" == typeof payload.aud ? payload.aud : void 0);
+            issuer ??= quota_client_extractStringClaim(payload, "iss");
+            clientId ??= quota_client_extractStringClaim(payload, "client_id") ?? quota_client_extractStringClaim(payload, "azp") ?? ("string" == typeof payload.aud ? payload.aud : void 0);
         } catch  {}
     }
     if (!supported) return {
@@ -538,6 +580,13 @@ async function pathExists(path) {
 async function readJsonFile(path) {
     return (0, promises_namespaceObject.readFile)(path, "utf8");
 }
+function canAutoMigrateLegacyChatGPTMeta(meta, snapshot) {
+    if (!isSupportedChatGPTAuthMode(meta.auth_mode) || !isSupportedChatGPTAuthMode(snapshot.auth_mode)) return false;
+    if ("string" == typeof meta.user_id && "" !== meta.user_id.trim()) return false;
+    const snapshotUserId = getSnapshotUserId(snapshot);
+    if (!snapshotUserId) return false;
+    return meta.account_id === getSnapshotAccountId(snapshot);
+}
 async function detectRunningCodexProcesses() {
     try {
         const { stdout } = await execFile("ps", [
@@ -635,6 +684,8 @@ class AccountStore {
         return {
             name: account.name,
             account_id: account.account_id,
+            user_id: account.user_id ?? null,
+            identity: account.identity,
             plan_type: planType,
             credits_balance: account.quota.credits_balance ?? null,
             status: account.quota.status,
@@ -675,11 +726,21 @@ class AccountStore {
             readJsonFile(metaPath),
             readAuthSnapshotFile(authPath)
         ]);
-        const meta = parseSnapshotMeta(rawMeta);
+        let meta = parseSnapshotMeta(rawMeta);
         if (meta.name !== name) throw new Error(`Account metadata name mismatch for "${name}".`);
-        if (meta.account_id !== getSnapshotIdentity(snapshot)) throw new Error(`Account metadata account_id mismatch for "${name}".`);
+        const snapshotIdentity = getSnapshotIdentity(snapshot);
+        if (getMetaIdentity(meta) !== snapshotIdentity) if (canAutoMigrateLegacyChatGPTMeta(meta, snapshot)) {
+            meta = {
+                ...meta,
+                account_id: getSnapshotAccountId(snapshot),
+                user_id: getSnapshotUserId(snapshot)
+            };
+            await this.writeAccountMeta(name, meta);
+        } else throw new Error(`Account metadata account_id mismatch for "${name}".`);
+        if (getMetaIdentity(meta) !== snapshotIdentity) throw new Error(`Account metadata account_id mismatch for "${name}".`);
         return {
             ...meta,
+            identity: getMetaIdentity(meta),
             authPath,
             metaPath,
             configPath: await pathExists(this.accountConfigPath(name)) ? this.accountConfigPath(name) : null,
@@ -699,12 +760,12 @@ class AccountStore {
             warnings.push(`Account "${entry.name}" is invalid: ${error.message}`);
         }
         const counts = new Map();
-        for (const account of accounts)counts.set(account.account_id, (counts.get(account.account_id) ?? 0) + 1);
+        for (const account of accounts)counts.set(account.identity, (counts.get(account.identity) ?? 0) + 1);
         accounts.sort((left, right)=>left.name.localeCompare(right.name));
         return {
             accounts: accounts.map((account)=>({
                     ...account,
-                    duplicateAccountId: (counts.get(account.account_id) ?? 0) > 1
+                    duplicateAccountId: (counts.get(account.identity) ?? 0) > 1
                 })),
             warnings
         };
@@ -715,6 +776,8 @@ class AccountStore {
             exists: false,
             auth_mode: null,
             account_id: null,
+            user_id: null,
+            identity: null,
             matched_accounts: [],
             managed: false,
             duplicate_match: false,
@@ -722,11 +785,15 @@ class AccountStore {
         };
         const snapshot = await readAuthSnapshotFile(this.paths.currentAuthPath);
         const currentIdentity = getSnapshotIdentity(snapshot);
-        const matchedAccounts = accounts.filter((account)=>account.account_id === currentIdentity).map((account)=>account.name);
+        const currentAccountId = getSnapshotAccountId(snapshot);
+        const currentUserId = getSnapshotUserId(snapshot) ?? null;
+        const matchedAccounts = accounts.filter((account)=>account.identity === currentIdentity).map((account)=>account.name);
         return {
             exists: true,
             auth_mode: snapshot.auth_mode,
-            account_id: currentIdentity,
+            account_id: currentAccountId,
+            user_id: currentUserId,
+            identity: currentIdentity,
             matched_accounts: matchedAccounts,
             managed: matchedAccounts.length > 0,
             duplicate_match: matchedAccounts.length > 1,
@@ -749,7 +816,7 @@ class AccountStore {
         const existingMeta = accountExists && await pathExists(metaPath) ? parseSnapshotMeta(await readJsonFile(metaPath)) : void 0;
         if (accountExists && !force) throw new Error(`Account "${name}" already exists. Use --force to overwrite it.`);
         const { accounts } = await this.listAccounts();
-        const duplicateIdentityAccounts = accounts.filter((account)=>account.name !== name && account.account_id === identity);
+        const duplicateIdentityAccounts = accounts.filter((account)=>account.name !== name && account.identity === identity);
         if (duplicateIdentityAccounts.length > 0) {
             const joinedNames = duplicateIdentityAccounts.map((account)=>`"${account.name}"`).join(", ");
             throw new Error(`Identity ${identity} is already managed by ${joinedNames}.`);
@@ -824,7 +891,7 @@ class AccountStore {
             await atomicWriteFile(this.paths.currentConfigPath, this.sanitizeConfigForAccountAuth(currentRawConfig));
         }
         const writtenSnapshot = await readAuthSnapshotFile(this.paths.currentAuthPath);
-        if (getSnapshotIdentity(writtenSnapshot) !== account.account_id) throw new Error(`Switch verification failed for account "${name}".`);
+        if (getSnapshotIdentity(writtenSnapshot) !== account.identity) throw new Error(`Switch verification failed for account "${name}".`);
         const meta = parseSnapshotMeta(await readJsonFile(account.metaPath));
         meta.last_switched_at = new Date().toISOString();
         meta.updated_at = meta.last_switched_at;
@@ -868,7 +935,8 @@ class AccountStore {
                 await this.syncCurrentAuthIfMatching(result.authSnapshot);
             }
             meta.auth_mode = result.authSnapshot.auth_mode;
-            meta.account_id = getSnapshotIdentity(result.authSnapshot);
+            meta.account_id = getSnapshotAccountId(result.authSnapshot);
+            meta.user_id = getSnapshotUserId(result.authSnapshot);
             meta.updated_at = now.toISOString();
             meta.quota = result.quota;
             await this.writeAccountMeta(name, meta);
@@ -981,7 +1049,7 @@ class AccountStore {
             if ((511 & authStat.mode) !== FILE_MODE) issues.push(`Account "${account.name}" auth permissions must be 600.`);
             if ((511 & metaStat.mode) !== FILE_MODE) issues.push(`Account "${account.name}" metadata permissions must be 600.`);
             if ("apikey" === account.auth_mode && !account.configPath) issues.push(`Account "${account.name}" is missing config.toml snapshot required for apikey auth.`);
-            if (account.duplicateAccountId) warnings.push(`Account "${account.name}" shares identity ${account.account_id} with another saved account.`);
+            if (account.duplicateAccountId) warnings.push(`Account "${account.name}" shares identity ${account.identity} with another saved account.`);
         }
         let currentAuthPresent = false;
         if (await pathExists(this.paths.currentAuthPath)) {
@@ -1062,7 +1130,7 @@ function describeCurrentStatus(status) {
     if (status.exists) {
         lines.push("Current auth: present");
         lines.push(`Auth mode: ${status.auth_mode}`);
-        lines.push(`Identity: ${maskAccountId(status.account_id ?? "")}`);
+        lines.push(`Identity: ${maskAccountId(status.identity ?? "")}`);
         if (0 === status.matched_accounts.length) lines.push("Managed account: no (unmanaged)");
         else if (1 === status.matched_accounts.length) lines.push(`Managed account: ${status.matched_accounts[0]}`);
         else lines.push(`Managed account: multiple (${status.matched_accounts.join(", ")})`);
@@ -1115,6 +1183,7 @@ function toAutoSwitchCandidate(account) {
     return {
         name: account.name,
         account_id: account.account_id,
+        identity: account.identity,
         plan_type: account.plan_type,
         available: computeAvailability(account),
         refresh_status: "ok",
@@ -1147,7 +1216,7 @@ function rankAutoSwitchCandidates(accounts) {
 }
 function describeAutoSwitchSelection(candidate, dryRun, backupPath, warnings) {
     const lines = [
-        dryRun ? `Best account: "${candidate.name}" (${maskAccountId(candidate.account_id)}).` : `Auto-switched to "${candidate.name}" (${maskAccountId(candidate.account_id)}).`,
+        dryRun ? `Best account: "${candidate.name}" (${maskAccountId(candidate.identity)}).` : `Auto-switched to "${candidate.name}" (${maskAccountId(candidate.identity)}).`,
         `Score: ${candidate.effective_score}`,
         `5H remaining: ${candidate.remain_5h}%`,
         `1W remaining (5H-equivalent): ${candidate.remain_1w_eq_5h}%`
@@ -1158,7 +1227,7 @@ function describeAutoSwitchSelection(candidate, dryRun, backupPath, warnings) {
 }
 function describeAutoSwitchNoop(candidate, warnings) {
     const lines = [
-        `Current account "${candidate.name}" (${maskAccountId(candidate.account_id)}) is already the best available account.`,
+        `Current account "${candidate.name}" (${maskAccountId(candidate.identity)}) is already the best available account.`,
         `Score: ${candidate.effective_score}`,
         `5H remaining: ${candidate.remain_5h}%`,
         `1W remaining (5H-equivalent): ${candidate.remain_1w_eq_5h}%`
@@ -1170,7 +1239,7 @@ function describeQuotaAccounts(accounts, warnings) {
     if (0 === accounts.length) return 0 === warnings.length ? "No saved accounts." : warnings.map((warning)=>`Warning: ${warning}`).join("\n");
     const table = formatTable(accounts.map((account)=>({
             name: account.name,
-            account_id: maskAccountId(account.account_id),
+            account_id: maskAccountId(account.identity),
             plan_type: account.plan_type ?? "-",
             available: computeAvailability(account) ?? "-",
             five_hour: formatUsagePercent(account.five_hour),
@@ -1295,11 +1364,13 @@ async function runCli(argv, options = {}) {
                         account: {
                             name: account.name,
                             account_id: account.account_id,
+                            user_id: account.user_id ?? null,
+                            identity: account.identity,
                             auth_mode: account.auth_mode
                         }
                     };
                     if (json) writeJson(streams.stdout, payload);
-                    else streams.stdout.write(`Saved account "${account.name}" (${maskAccountId(account.account_id)}).\n`);
+                    else streams.stdout.write(`Saved account "${account.name}" (${maskAccountId(account.identity)}).\n`);
                     return 0;
                 }
             case "update":
@@ -1321,6 +1392,8 @@ async function runCli(argv, options = {}) {
                         account: {
                             name: result.account.name,
                             account_id: result.account.account_id,
+                            user_id: result.account.user_id ?? null,
+                            identity: result.account.identity,
                             auth_mode: result.account.auth_mode
                         },
                         quota,
@@ -1328,7 +1401,7 @@ async function runCli(argv, options = {}) {
                     };
                     if (json) writeJson(streams.stdout, payload);
                     else {
-                        streams.stdout.write(`Updated managed account "${result.account.name}" (${maskAccountId(result.account.account_id)}).\n`);
+                        streams.stdout.write(`Updated managed account "${result.account.name}" (${maskAccountId(result.account.identity)}).\n`);
                         for (const warning of warnings)streams.stdout.write(`Warning: ${warning}\n`);
                     }
                     return 0;
@@ -1371,7 +1444,8 @@ async function runCli(argv, options = {}) {
                                 reason: "already_current_best",
                                 account: {
                                     name: selected.name,
-                                    account_id: selected.account_id
+                                    account_id: selected.account_id,
+                                    identity: selected.identity
                                 },
                                 selected,
                                 candidates,
@@ -1391,6 +1465,8 @@ async function runCli(argv, options = {}) {
                             account: {
                                 name: result.account.name,
                                 account_id: result.account.account_id,
+                                user_id: result.account.user_id ?? null,
+                                identity: result.account.identity,
                                 auth_mode: result.account.auth_mode
                             },
                             selected,
@@ -1420,6 +1496,8 @@ async function runCli(argv, options = {}) {
                         account: {
                             name: result.account.name,
                             account_id: result.account.account_id,
+                            user_id: result.account.user_id ?? null,
+                            identity: result.account.identity,
                             auth_mode: result.account.auth_mode
                         },
                         quota,
@@ -1428,7 +1506,7 @@ async function runCli(argv, options = {}) {
                     };
                     if (json) writeJson(streams.stdout, payload);
                     else {
-                        streams.stdout.write(`Switched to "${result.account.name}" (${maskAccountId(result.account.account_id)}).\n`);
+                        streams.stdout.write(`Switched to "${result.account.name}" (${maskAccountId(result.account.identity)}).\n`);
                         if (result.backup_path) streams.stdout.write(`Backup: ${result.backup_path}\n`);
                         for (const warning of result.warnings)streams.stdout.write(`Warning: ${warning}\n`);
                     }
@@ -1470,6 +1548,8 @@ async function runCli(argv, options = {}) {
                         account: {
                             name: account.name,
                             account_id: account.account_id,
+                            user_id: account.user_id ?? null,
+                            identity: account.identity,
                             auth_mode: account.auth_mode
                         }
                     });

package/dist/main.js

@@ -9,7 +9,7 @@ import { basename, dirname, join } from "node:path";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 var package_namespaceObject = {
-    rE: "0.0.8"
+    rE: "0.0.9"
 };
 function isRecord(value) {
     return "object" == typeof value && null !== value && !Array.isArray(value);
@@ -42,10 +42,44 @@ function isSupportedChatGPTAuthMode(authMode) {
     const normalized = normalizeAuthMode(authMode);
     return "chatgpt" === normalized || "chatgpt_auth_tokens" === normalized;
 }
+function extractAuthClaim(payload) {
+    const value = payload["https://api.openai.com/auth"];
+    return isRecord(value) ? value : void 0;
+}
+function extractStringClaim(payload, key) {
+    const value = payload[key];
+    return "string" == typeof value && "" !== value.trim() ? value : void 0;
+}
+function extractSnapshotJwtPayloads(snapshot) {
+    const tokens = snapshot.tokens ?? {};
+    const payloads = [];
+    for (const tokenName of [
+        "id_token",
+        "access_token"
+    ]){
+        const token = tokens[tokenName];
+        if ("string" == typeof token && "" !== token.trim()) try {
+            payloads.push(decodeJwtPayload(token));
+        } catch  {}
+    }
+    return payloads;
+}
+function getSnapshotUserId(snapshot) {
+    for (const payload of extractSnapshotJwtPayloads(snapshot)){
+        const authClaim = extractAuthClaim(payload);
+        const chatGPTUserId = authClaim?.chatgpt_user_id;
+        if ("string" == typeof chatGPTUserId && "" !== chatGPTUserId.trim()) return chatGPTUserId;
+        const userId = extractStringClaim(payload, "user_id");
+        if (userId) return userId;
+    }
+}
 function fingerprintApiKey(apiKey) {
     return createHash("sha256").update(apiKey).digest("hex").slice(0, 16);
 }
-function getSnapshotIdentity(snapshot) {
+function composeIdentity(accountId, userId) {
+    return "string" == typeof userId && "" !== userId.trim() ? `${accountId}:${userId}` : accountId;
+}
+function getSnapshotAccountId(snapshot) {
     if (isApiKeyAuthMode(snapshot.auth_mode)) {
         const apiKey = snapshot.OPENAI_API_KEY;
         if ("string" != typeof apiKey || "" === apiKey.trim()) throw new Error('Field "OPENAI_API_KEY" must be a non-empty string for apikey auth.');
@@ -55,6 +89,12 @@ function getSnapshotIdentity(snapshot) {
     if ("string" != typeof accountId || "" === accountId.trim()) throw new Error('Field "tokens.account_id" must be a non-empty string.');
     return accountId;
 }
+function getSnapshotIdentity(snapshot) {
+    return composeIdentity(getSnapshotAccountId(snapshot), isSupportedChatGPTAuthMode(snapshot.auth_mode) ? getSnapshotUserId(snapshot) : void 0);
+}
+function getMetaIdentity(meta) {
+    return composeIdentity(meta.account_id, meta.user_id);
+}
 function defaultQuotaSnapshot() {
     return {
         status: "stale"
@@ -132,7 +172,8 @@ function createSnapshotMeta(name, snapshot, now, existingCreatedAt) {
     return {
         name,
         auth_mode: snapshot.auth_mode,
-        account_id: getSnapshotIdentity(snapshot),
+        account_id: getSnapshotAccountId(snapshot),
+        user_id: isSupportedChatGPTAuthMode(snapshot.auth_mode) ? getSnapshotUserId(snapshot) : void 0,
         created_at: existingCreatedAt ?? timestamp,
         updated_at: timestamp,
         last_switched_at: null,
@@ -153,6 +194,7 @@ function parseSnapshotMeta(raw) {
         name: asNonEmptyString(parsed.name, "name"),
         auth_mode: asNonEmptyString(parsed.auth_mode, "auth_mode"),
         account_id: asNonEmptyString(parsed.account_id, "account_id"),
+        user_id: asOptionalString(parsed.user_id, "user_id"),
         created_at: asNonEmptyString(parsed.created_at, "created_at"),
         updated_at: asNonEmptyString(parsed.updated_at, "updated_at"),
         last_switched_at: lastSwitchedAt,
@@ -177,11 +219,11 @@ const USER_AGENT = "codexm/0.1";
 function quota_client_isRecord(value) {
     return "object" == typeof value && null !== value && !Array.isArray(value);
 }
-function extractAuthClaim(payload) {
+function quota_client_extractAuthClaim(payload) {
     const value = payload["https://api.openai.com/auth"];
     return quota_client_isRecord(value) ? value : void 0;
 }
-function extractStringClaim(payload, key) {
+function quota_client_extractStringClaim(payload, key) {
     const value = payload[key];
     return "string" == typeof value && "" !== value.trim() ? value : void 0;
 }
@@ -194,7 +236,7 @@ function parsePlanType(snapshot) {
         const token = tokens[tokenName];
         if ("string" == typeof token && "" !== token.trim()) try {
             const payload = decodeJwtPayload(token);
-            const authClaim = extractAuthClaim(payload);
+            const authClaim = quota_client_extractAuthClaim(payload);
             const planType = authClaim?.chatgpt_plan_type;
             if ("string" == typeof planType && "" !== planType.trim()) return planType;
         } catch  {}
@@ -218,7 +260,7 @@ function extractChatGPTAuth(snapshot) {
         const token = tokens[tokenName];
         if ("string" == typeof token && "" !== token.trim()) try {
             const payload = decodeJwtPayload(token);
-            const authClaim = extractAuthClaim(payload);
+            const authClaim = quota_client_extractAuthClaim(payload);
             if (!accountId) {
                 const maybeAccountId = authClaim?.chatgpt_account_id;
                 if ("string" == typeof maybeAccountId && "" !== maybeAccountId.trim()) accountId = maybeAccountId;
@@ -227,8 +269,8 @@ function extractChatGPTAuth(snapshot) {
                 const maybePlanType = authClaim?.chatgpt_plan_type;
                 if ("string" == typeof maybePlanType && "" !== maybePlanType.trim()) planType = maybePlanType;
             }
-            issuer ??= extractStringClaim(payload, "iss");
-            clientId ??= extractStringClaim(payload, "client_id") ?? extractStringClaim(payload, "azp") ?? ("string" == typeof payload.aud ? payload.aud : void 0);
+            issuer ??= quota_client_extractStringClaim(payload, "iss");
+            clientId ??= quota_client_extractStringClaim(payload, "client_id") ?? quota_client_extractStringClaim(payload, "azp") ?? ("string" == typeof payload.aud ? payload.aud : void 0);
         } catch  {}
     }
     if (!supported) return {
@@ -498,6 +540,13 @@ async function pathExists(path) {
 async function readJsonFile(path) {
     return readFile(path, "utf8");
 }
+function canAutoMigrateLegacyChatGPTMeta(meta, snapshot) {
+    if (!isSupportedChatGPTAuthMode(meta.auth_mode) || !isSupportedChatGPTAuthMode(snapshot.auth_mode)) return false;
+    if ("string" == typeof meta.user_id && "" !== meta.user_id.trim()) return false;
+    const snapshotUserId = getSnapshotUserId(snapshot);
+    if (!snapshotUserId) return false;
+    return meta.account_id === getSnapshotAccountId(snapshot);
+}
 async function detectRunningCodexProcesses() {
     try {
         const { stdout } = await account_store_execFile("ps", [
@@ -595,6 +644,8 @@ class AccountStore {
         return {
             name: account.name,
             account_id: account.account_id,
+            user_id: account.user_id ?? null,
+            identity: account.identity,
             plan_type: planType,
             credits_balance: account.quota.credits_balance ?? null,
             status: account.quota.status,
@@ -635,11 +686,21 @@ class AccountStore {
             readJsonFile(metaPath),
             readAuthSnapshotFile(authPath)
         ]);
-        const meta = parseSnapshotMeta(rawMeta);
+        let meta = parseSnapshotMeta(rawMeta);
         if (meta.name !== name) throw new Error(`Account metadata name mismatch for "${name}".`);
-        if (meta.account_id !== getSnapshotIdentity(snapshot)) throw new Error(`Account metadata account_id mismatch for "${name}".`);
+        const snapshotIdentity = getSnapshotIdentity(snapshot);
+        if (getMetaIdentity(meta) !== snapshotIdentity) if (canAutoMigrateLegacyChatGPTMeta(meta, snapshot)) {
+            meta = {
+                ...meta,
+                account_id: getSnapshotAccountId(snapshot),
+                user_id: getSnapshotUserId(snapshot)
+            };
+            await this.writeAccountMeta(name, meta);
+        } else throw new Error(`Account metadata account_id mismatch for "${name}".`);
+        if (getMetaIdentity(meta) !== snapshotIdentity) throw new Error(`Account metadata account_id mismatch for "${name}".`);
         return {
             ...meta,
+            identity: getMetaIdentity(meta),
             authPath,
             metaPath,
             configPath: await pathExists(this.accountConfigPath(name)) ? this.accountConfigPath(name) : null,
@@ -659,12 +720,12 @@ class AccountStore {
             warnings.push(`Account "${entry.name}" is invalid: ${error.message}`);
         }
         const counts = new Map();
-        for (const account of accounts)counts.set(account.account_id, (counts.get(account.account_id) ?? 0) + 1);
+        for (const account of accounts)counts.set(account.identity, (counts.get(account.identity) ?? 0) + 1);
         accounts.sort((left, right)=>left.name.localeCompare(right.name));
         return {
             accounts: accounts.map((account)=>({
                     ...account,
-                    duplicateAccountId: (counts.get(account.account_id) ?? 0) > 1
+                    duplicateAccountId: (counts.get(account.identity) ?? 0) > 1
                 })),
             warnings
         };
@@ -675,6 +736,8 @@ class AccountStore {
             exists: false,
             auth_mode: null,
             account_id: null,
+            user_id: null,
+            identity: null,
             matched_accounts: [],
             managed: false,
             duplicate_match: false,
@@ -682,11 +745,15 @@ class AccountStore {
         };
         const snapshot = await readAuthSnapshotFile(this.paths.currentAuthPath);
         const currentIdentity = getSnapshotIdentity(snapshot);
-        const matchedAccounts = accounts.filter((account)=>account.account_id === currentIdentity).map((account)=>account.name);
+        const currentAccountId = getSnapshotAccountId(snapshot);
+        const currentUserId = getSnapshotUserId(snapshot) ?? null;
+        const matchedAccounts = accounts.filter((account)=>account.identity === currentIdentity).map((account)=>account.name);
         return {
             exists: true,
             auth_mode: snapshot.auth_mode,
-            account_id: currentIdentity,
+            account_id: currentAccountId,
+            user_id: currentUserId,
+            identity: currentIdentity,
             matched_accounts: matchedAccounts,
             managed: matchedAccounts.length > 0,
             duplicate_match: matchedAccounts.length > 1,
@@ -709,7 +776,7 @@ class AccountStore {
         const existingMeta = accountExists && await pathExists(metaPath) ? parseSnapshotMeta(await readJsonFile(metaPath)) : void 0;
         if (accountExists && !force) throw new Error(`Account "${name}" already exists. Use --force to overwrite it.`);
         const { accounts } = await this.listAccounts();
-        const duplicateIdentityAccounts = accounts.filter((account)=>account.name !== name && account.account_id === identity);
+        const duplicateIdentityAccounts = accounts.filter((account)=>account.name !== name && account.identity === identity);
         if (duplicateIdentityAccounts.length > 0) {
             const joinedNames = duplicateIdentityAccounts.map((account)=>`"${account.name}"`).join(", ");
             throw new Error(`Identity ${identity} is already managed by ${joinedNames}.`);
@@ -784,7 +851,7 @@ class AccountStore {
             await atomicWriteFile(this.paths.currentConfigPath, this.sanitizeConfigForAccountAuth(currentRawConfig));
         }
         const writtenSnapshot = await readAuthSnapshotFile(this.paths.currentAuthPath);
-        if (getSnapshotIdentity(writtenSnapshot) !== account.account_id) throw new Error(`Switch verification failed for account "${name}".`);
+        if (getSnapshotIdentity(writtenSnapshot) !== account.identity) throw new Error(`Switch verification failed for account "${name}".`);
         const meta = parseSnapshotMeta(await readJsonFile(account.metaPath));
         meta.last_switched_at = new Date().toISOString();
         meta.updated_at = meta.last_switched_at;
@@ -828,7 +895,8 @@ class AccountStore {
                 await this.syncCurrentAuthIfMatching(result.authSnapshot);
             }
             meta.auth_mode = result.authSnapshot.auth_mode;
-            meta.account_id = getSnapshotIdentity(result.authSnapshot);
+            meta.account_id = getSnapshotAccountId(result.authSnapshot);
+            meta.user_id = getSnapshotUserId(result.authSnapshot);
             meta.updated_at = now.toISOString();
             meta.quota = result.quota;
             await this.writeAccountMeta(name, meta);
@@ -941,7 +1009,7 @@ class AccountStore {
             if ((511 & authStat.mode) !== FILE_MODE) issues.push(`Account "${account.name}" auth permissions must be 600.`);
             if ((511 & metaStat.mode) !== FILE_MODE) issues.push(`Account "${account.name}" metadata permissions must be 600.`);
             if ("apikey" === account.auth_mode && !account.configPath) issues.push(`Account "${account.name}" is missing config.toml snapshot required for apikey auth.`);
-            if (account.duplicateAccountId) warnings.push(`Account "${account.name}" shares identity ${account.account_id} with another saved account.`);
+            if (account.duplicateAccountId) warnings.push(`Account "${account.name}" shares identity ${account.identity} with another saved account.`);
         }
         let currentAuthPresent = false;
         if (await pathExists(this.paths.currentAuthPath)) {
@@ -1022,7 +1090,7 @@ function describeCurrentStatus(status) {
     if (status.exists) {
         lines.push("Current auth: present");
         lines.push(`Auth mode: ${status.auth_mode}`);
-        lines.push(`Identity: ${maskAccountId(status.account_id ?? "")}`);
+        lines.push(`Identity: ${maskAccountId(status.identity ?? "")}`);
         if (0 === status.matched_accounts.length) lines.push("Managed account: no (unmanaged)");
         else if (1 === status.matched_accounts.length) lines.push(`Managed account: ${status.matched_accounts[0]}`);
         else lines.push(`Managed account: multiple (${status.matched_accounts.join(", ")})`);
@@ -1075,6 +1143,7 @@ function toAutoSwitchCandidate(account) {
     return {
         name: account.name,
         account_id: account.account_id,
+        identity: account.identity,
         plan_type: account.plan_type,
         available: computeAvailability(account),
         refresh_status: "ok",
@@ -1107,7 +1176,7 @@ function rankAutoSwitchCandidates(accounts) {
 }
 function describeAutoSwitchSelection(candidate, dryRun, backupPath, warnings) {
     const lines = [
-        dryRun ? `Best account: "${candidate.name}" (${maskAccountId(candidate.account_id)}).` : `Auto-switched to "${candidate.name}" (${maskAccountId(candidate.account_id)}).`,
+        dryRun ? `Best account: "${candidate.name}" (${maskAccountId(candidate.identity)}).` : `Auto-switched to "${candidate.name}" (${maskAccountId(candidate.identity)}).`,
         `Score: ${candidate.effective_score}`,
         `5H remaining: ${candidate.remain_5h}%`,
         `1W remaining (5H-equivalent): ${candidate.remain_1w_eq_5h}%`
@@ -1118,7 +1187,7 @@ function describeAutoSwitchSelection(candidate, dryRun, backupPath, warnings) {
 }
 function describeAutoSwitchNoop(candidate, warnings) {
     const lines = [
-        `Current account "${candidate.name}" (${maskAccountId(candidate.account_id)}) is already the best available account.`,
+        `Current account "${candidate.name}" (${maskAccountId(candidate.identity)}) is already the best available account.`,
         `Score: ${candidate.effective_score}`,
         `5H remaining: ${candidate.remain_5h}%`,
         `1W remaining (5H-equivalent): ${candidate.remain_1w_eq_5h}%`
@@ -1130,7 +1199,7 @@ function describeQuotaAccounts(accounts, warnings) {
     if (0 === accounts.length) return 0 === warnings.length ? "No saved accounts." : warnings.map((warning)=>`Warning: ${warning}`).join("\n");
     const table = formatTable(accounts.map((account)=>({
             name: account.name,
-            account_id: maskAccountId(account.account_id),
+            account_id: maskAccountId(account.identity),
             plan_type: account.plan_type ?? "-",
             available: computeAvailability(account) ?? "-",
             five_hour: formatUsagePercent(account.five_hour),
@@ -1255,11 +1324,13 @@ async function runCli(argv, options = {}) {
                         account: {
                             name: account.name,
                             account_id: account.account_id,
+                            user_id: account.user_id ?? null,
+                            identity: account.identity,
                             auth_mode: account.auth_mode
                         }
                     };
                     if (json) writeJson(streams.stdout, payload);
-                    else streams.stdout.write(`Saved account "${account.name}" (${maskAccountId(account.account_id)}).\n`);
+                    else streams.stdout.write(`Saved account "${account.name}" (${maskAccountId(account.identity)}).\n`);
                     return 0;
                 }
             case "update":
@@ -1281,6 +1352,8 @@ async function runCli(argv, options = {}) {
                         account: {
                             name: result.account.name,
                             account_id: result.account.account_id,
+                            user_id: result.account.user_id ?? null,
+                            identity: result.account.identity,
                             auth_mode: result.account.auth_mode
                         },
                         quota,
@@ -1288,7 +1361,7 @@ async function runCli(argv, options = {}) {
                     };
                     if (json) writeJson(streams.stdout, payload);
                     else {
-                        streams.stdout.write(`Updated managed account "${result.account.name}" (${maskAccountId(result.account.account_id)}).\n`);
+                        streams.stdout.write(`Updated managed account "${result.account.name}" (${maskAccountId(result.account.identity)}).\n`);
                         for (const warning of warnings)streams.stdout.write(`Warning: ${warning}\n`);
                     }
                     return 0;
@@ -1331,7 +1404,8 @@ async function runCli(argv, options = {}) {
                                 reason: "already_current_best",
                                 account: {
                                     name: selected.name,
-                                    account_id: selected.account_id
+                                    account_id: selected.account_id,
+                                    identity: selected.identity
                                 },
                                 selected,
                                 candidates,
@@ -1351,6 +1425,8 @@ async function runCli(argv, options = {}) {
                             account: {
                                 name: result.account.name,
                                 account_id: result.account.account_id,
+                                user_id: result.account.user_id ?? null,
+                                identity: result.account.identity,
                                 auth_mode: result.account.auth_mode
                             },
                             selected,
@@ -1380,6 +1456,8 @@ async function runCli(argv, options = {}) {
                         account: {
                             name: result.account.name,
                             account_id: result.account.account_id,
+                            user_id: result.account.user_id ?? null,
+                            identity: result.account.identity,
                             auth_mode: result.account.auth_mode
                         },
                         quota,
@@ -1388,7 +1466,7 @@ async function runCli(argv, options = {}) {
                     };
                     if (json) writeJson(streams.stdout, payload);
                     else {
-                        streams.stdout.write(`Switched to "${result.account.name}" (${maskAccountId(result.account.account_id)}).\n`);
+                        streams.stdout.write(`Switched to "${result.account.name}" (${maskAccountId(result.account.identity)}).\n`);
                         if (result.backup_path) streams.stdout.write(`Backup: ${result.backup_path}\n`);
                         for (const warning of result.warnings)streams.stdout.write(`Warning: ${warning}\n`);
                     }
@@ -1430,6 +1508,8 @@ async function runCli(argv, options = {}) {
                         account: {
                             name: account.name,
                             account_id: account.account_id,
+                            user_id: account.user_id ?? null,
+                            identity: account.identity,
                             auth_mode: account.auth_mode
                         }
                     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-team",
-  "version": "0.0.8",
+  "version": "0.0.9",
   "description": "Manage multiple Codex ChatGPT auth snapshots and quota usage from the command line.",
   "license": "MIT",
   "type": "module",