oc-chatgpt-multi-auth 4.12.1 → 4.12.3

package/dist/index.js

@@ -27,17 +27,18 @@ import { createAuthorizationFlow, exchangeAuthorizationCode, parseAuthorizationI
 import { queuedRefresh } from "./lib/refresh-queue.js";
 import { openBrowserUrl } from "./lib/auth/browser.js";
 import { startLocalOAuthServer } from "./lib/auth/server.js";
-import { promptAccountSelection, promptLoginMode } from "./lib/cli.js";
+import { promptLoginMode } from "./lib/cli.js";
 import { getCodexMode, getRateLimitToastDebounceMs, getRetryAllAccountsMaxRetries, getRetryAllAccountsMaxWaitMs, getRetryAllAccountsRateLimited, getTokenRefreshSkewMs, getSessionRecovery, getAutoResume, getToastDurationMs, getPerProjectAccounts, loadPluginConfig, } from "./lib/config.js";
 import { AUTH_LABELS, CODEX_BASE_URL, DUMMY_API_KEY, LOG_STAGES, PLUGIN_NAME, PROVIDER_ID, ACCOUNT_LIMITS, } from "./lib/constants.js";
 import { initLogger, logRequest, logDebug, logInfo, logWarn, logError } from "./lib/logger.js";
 import { checkAndNotify } from "./lib/auto-update-checker.js";
 import { handleContextOverflow } from "./lib/context-overflow.js";
-import { AccountManager, getAccountIdCandidates, extractAccountEmail, extractAccountId, formatAccountLabel, formatCooldown, formatWaitTime, sanitizeEmail, shouldUpdateAccountIdFromToken, } from "./lib/accounts.js";
+import { AccountManager, getAccountIdCandidates, extractAccountEmail, extractAccountId, formatAccountLabel, formatCooldown, formatWaitTime, sanitizeEmail, shouldUpdateAccountIdFromToken, parseRateLimitReason, } from "./lib/accounts.js";
 import { getStoragePath, loadAccounts, saveAccounts, setStoragePath, exportAccounts, importAccounts, StorageError, formatStorageErrorHint } from "./lib/storage.js";
 import { createCodexHeaders, extractRequestUrl, handleErrorResponse, handleSuccessResponse, refreshAndUpdateToken, rewriteUrlForCodex, shouldRefreshToken, transformRequestForCodex, } from "./lib/request/fetch-helpers.js";
 import { getRateLimitBackoff, RATE_LIMIT_SHORT_RETRY_THRESHOLD_MS, resetRateLimitBackoff, } from "./lib/request/rate-limit-backoff.js";
 import { addJitter } from "./lib/rotation.js";
+import { buildTableHeader, buildTableRow } from "./lib/table-formatter.js";
 import { getModelFamily, MODEL_FAMILIES } from "./lib/prompts/codex.js";
 import { createSessionRecoveryHook, isRecoverableError, detectErrorType, getRecoveryToastContent, } from "./lib/recovery.js";
 /**
@@ -56,10 +57,14 @@ import { createSessionRecoveryHook, isRecoverableError, detectErrorType, getReco
  * }
  * ```
  */
+// eslint-disable-next-line @typescript-eslint/require-await
 export const OpenAIOAuthPlugin = async ({ client }) => {
     initLogger(client);
     let cachedAccountManager = null;
-    const resolveAccountSelection = async (tokens) => {
+    let accountManagerPromise = null;
+    let loaderMutex = null;
+    const MIN_BACKOFF_MS = 100;
+    const resolveAccountSelection = (tokens) => {
         const override = (process.env.CODEX_AUTH_ACCOUNT_ID ?? "").trim();
         if (override) {
             const suffix = override.length > 6 ? override.slice(-6) : override;
@@ -76,28 +81,31 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
             return tokens;
         }
         if (candidates.length === 1) {
-            const candidate = candidates[0];
-            return {
-                ...tokens,
-                accountIdOverride: candidate.accountId,
-                accountIdSource: candidate.source,
-                accountLabel: candidate.label,
-            };
+            const [candidate] = candidates;
+            if (candidate) {
+                return {
+                    ...tokens,
+                    accountIdOverride: candidate.accountId,
+                    accountIdSource: candidate.source,
+                    accountLabel: candidate.label,
+                };
+            }
         }
-        const defaultIndex = (() => {
-            const orgDefaultIndex = candidates.findIndex((candidate) => candidate.isDefault && candidate.source === "org");
-            if (orgDefaultIndex >= 0)
-                return orgDefaultIndex;
-            const tokenIndex = candidates.findIndex((candidate) => candidate.source === "token");
-            if (tokenIndex >= 0)
-                return tokenIndex;
-            return 0;
+        // Auto-select the default candidate without prompting
+        // The user already selected their workspace on OpenAI's auth page
+        // Prompting again breaks TUI mode and is redundant
+        const choice = (() => {
+            // Prefer org-level default
+            const orgDefault = candidates.find((candidate) => candidate.isDefault && candidate.source === "org");
+            if (orgDefault)
+                return orgDefault;
+            // Fall back to token-derived account
+            const tokenAccount = candidates.find((candidate) => candidate.source === "token");
+            if (tokenAccount)
+                return tokenAccount;
+            // Otherwise first candidate
+            return candidates[0];
         })();
-        const selected = await promptAccountSelection(candidates, {
-            defaultIndex,
-            title: "Multiple workspaces detected for this account:",
-        });
-        const choice = selected ?? candidates[defaultIndex];
         if (!choice)
             return tokens;
         return {
@@ -111,6 +119,13 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
         url,
         method: "code",
         instructions: AUTH_LABELS.INSTRUCTIONS_MANUAL,
+        validate: (input) => {
+            const parsed = parseAuthorizationInput(input);
+            if (!parsed.code) {
+                return "No authorization code found. Paste the full callback URL (e.g., http://localhost:1455/auth/callback?code=...)";
+            }
+            return undefined;
+        },
         callback: async (input) => {
             const parsed = parseAuthorizationInput(input);
             if (!parsed.code) {
@@ -118,7 +133,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
             }
             const tokens = await exchangeAuthorizationCode(parsed.code, pkce.verifier, REDIRECT_URI);
             if (tokens?.type === "success") {
-                const resolved = await resolveAccountSelection(tokens);
+                const resolved = resolveAccountSelection(tokens);
                 if (onSuccess) {
                     await onSuccess(resolved);
                 }
@@ -302,7 +317,8 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
             process.env.OPENCODE_SKIP_EMAIL_HYDRATE === "1";
         if (skipHydrate)
             return storage;
-        const accountsToHydrate = storage.accounts.filter((account) => account && !account.email);
+        const accountsCopy = storage.accounts.map((account) => account ? { ...account } : account);
+        const accountsToHydrate = accountsCopy.filter((account) => account && !account.email);
         if (accountsToHydrate.length === 0)
             return storage;
         let changed = false;
@@ -330,10 +346,11 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                 }
             }
             catch {
-                logDebug(`[${PLUGIN_NAME}] Failed to hydrate email for account`);
+                logWarn(`[${PLUGIN_NAME}] Failed to hydrate email for account`);
             }
         }));
         if (changed) {
+            storage.accounts = accountsCopy;
             await saveAccounts(storage);
         }
         return storage;
@@ -368,29 +385,34 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
     };
     // Event handler for session recovery and account selection
     const eventHandler = async (input) => {
-        const { event } = input;
-        // Handle TUI account selection events
-        // Accepts generic selection events with an index property
-        if (event.type === "account.select" ||
-            event.type === "openai.account.select") {
-            const props = event.properties;
-            // Filter by provider if specified
-            if (props.provider && props.provider !== "openai" && props.provider !== PROVIDER_ID) {
-                return;
-            }
-            const index = props.index ?? props.accountIndex;
-            if (typeof index === "number" && cachedAccountManager) {
-                // Convert 1-based index (UI) to 0-based index (internal) if needed,
-                // or handle 0-based directly. Usually UI lists are 0-based in code but 1-based in display.
-                // AccountManager.setActiveIndex expects 0-based index.
-                // Assuming the event passes the raw index from the list.
-                const account = cachedAccountManager.setActiveIndex(index);
-                if (account) {
-                    await cachedAccountManager.saveToDisk();
-                    await showToast(`Switched to account ${index + 1}`, "info");
+        try {
+            const { event } = input;
+            // Handle TUI account selection events
+            // Accepts generic selection events with an index property
+            if (event.type === "account.select" ||
+                event.type === "openai.account.select") {
+                const props = event.properties;
+                // Filter by provider if specified
+                if (props.provider && props.provider !== "openai" && props.provider !== PROVIDER_ID) {
+                    return;
+                }
+                const index = props.index ?? props.accountIndex;
+                if (typeof index === "number" && cachedAccountManager) {
+                    // Convert 1-based index (UI) to 0-based index (internal) if needed,
+                    // or handle 0-based directly. Usually UI lists are 0-based in code but 1-based in display.
+                    // AccountManager.setActiveIndex expects 0-based index.
+                    // Assuming the event passes the raw index from the list.
+                    const account = cachedAccountManager.setActiveIndex(index);
+                    if (account) {
+                        await cachedAccountManager.saveToDisk();
+                        await showToast(`Switched to account ${index + 1}`, "info");
+                    }
                 }
             }
         }
+        catch (error) {
+            logDebug(`[${PLUGIN_NAME}] Event handler error: ${error instanceof Error ? error.message : String(error)}`);
+        }
     };
     return {
         event: eventHandler,
@@ -423,270 +445,332 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                     logDebug(`[${PLUGIN_NAME}] Auth is not multi-account, skipping loader`);
                     return {};
                 }
-                const accountManager = await AccountManager.loadFromDisk(auth);
-                cachedAccountManager = accountManager;
-                const refreshToken = auth.type === "oauth" ? auth.refresh : "";
-                const needsPersist = refreshToken &&
-                    !accountManager.hasRefreshToken(refreshToken);
-                if (needsPersist) {
-                    await accountManager.saveToDisk();
+                // Acquire mutex for thread-safe initialization
+                // Use while loop to handle multiple concurrent waiters correctly
+                while (loaderMutex) {
+                    await loaderMutex;
                 }
-                if (accountManager.getAccountCount() === 0) {
-                    logDebug(`[${PLUGIN_NAME}] No OAuth accounts available (run opencode auth login)`);
-                    return {};
-                }
-                // Extract user configuration (global + per-model options)
-                const providerConfig = provider;
-                const userConfig = {
-                    global: providerConfig?.options || {},
-                    models: providerConfig?.models || {},
-                };
-                // Load plugin configuration and determine CODEX_MODE
-                // Priority: CODEX_MODE env var > config file > default (true)
-                const pluginConfig = loadPluginConfig();
-                const codexMode = getCodexMode(pluginConfig);
-                const tokenRefreshSkewMs = getTokenRefreshSkewMs(pluginConfig);
-                const rateLimitToastDebounceMs = getRateLimitToastDebounceMs(pluginConfig);
-                const retryAllAccountsRateLimited = getRetryAllAccountsRateLimited(pluginConfig);
-                const retryAllAccountsMaxWaitMs = getRetryAllAccountsMaxWaitMs(pluginConfig);
-                const retryAllAccountsMaxRetries = getRetryAllAccountsMaxRetries(pluginConfig);
-                const toastDurationMs = getToastDurationMs(pluginConfig);
-                const perProjectAccounts = getPerProjectAccounts(pluginConfig);
-                if (perProjectAccounts) {
-                    setStoragePath(process.cwd());
-                }
-                const sessionRecoveryEnabled = getSessionRecovery(pluginConfig);
-                const autoResumeEnabled = getAutoResume(pluginConfig);
-                const recoveryHook = sessionRecoveryEnabled
-                    ? createSessionRecoveryHook({ client, directory: process.cwd() }, { sessionRecovery: true, autoResume: autoResumeEnabled })
-                    : null;
-                checkAndNotify(async (message, variant) => {
-                    await showToast(message, variant);
-                }).catch(() => { });
-                // Return SDK configuration
-                return {
-                    apiKey: DUMMY_API_KEY,
-                    baseURL: CODEX_BASE_URL,
-                    /**
-                     * Custom fetch implementation for Codex API
-                     *
-                     * Handles:
-                     * - Token refresh when expired
-                     * - URL rewriting for Codex backend
-                     * - Request body transformation
-                     * - OAuth header injection
-                     * - SSE to JSON conversion for non-tool requests
-                     * - Error handling and logging
-                     *
-                     * @param input - Request URL or Request object
-                     * @param init - Request options
-                     * @returns Response from Codex API
-                     */
-                    async fetch(input, init) {
-                        // Step 1: Extract and rewrite URL for Codex backend
-                        const originalUrl = extractRequestUrl(input);
-                        const url = rewriteUrlForCodex(originalUrl);
-                        // Step 3: Transform request body with model-specific Codex instructions
-                        // Instructions are fetched per model family (codex-max, codex, gpt-5.1)
-                        // Capture original stream value before transformation
-                        // generateText() sends no stream field, streamText() sends stream=true
-                        const originalBody = init?.body ? JSON.parse(init.body) : {};
-                        const isStreaming = originalBody.stream === true;
-                        const transformation = await transformRequestForCodex(init, url, userConfig, codexMode);
-                        const requestInit = transformation?.updatedInit ?? init;
-                        const promptCacheKey = transformation?.body?.prompt_cache_key;
-                        const model = transformation?.body.model;
-                        const modelFamily = model ? getModelFamily(model) : "gpt-5.1";
-                        const quotaKey = model ? `${modelFamily}:${model}` : modelFamily;
-                        const abortSignal = requestInit?.signal ?? init?.signal ?? null;
-                        const sleep = (ms) => new Promise((resolve, reject) => {
-                            if (abortSignal?.aborted) {
-                                reject(new Error("Aborted"));
-                                return;
-                            }
-                            const timeout = setTimeout(() => {
-                                cleanup();
-                                resolve();
-                            }, ms);
-                            const onAbort = () => {
-                                cleanup();
-                                reject(new Error("Aborted"));
-                            };
-                            const cleanup = () => {
-                                clearTimeout(timeout);
-                                abortSignal?.removeEventListener("abort", onAbort);
-                            };
-                            abortSignal?.addEventListener("abort", onAbort, { once: true });
-                        });
-                        const sleepWithCountdown = async (totalMs, message, intervalMs = 5000) => {
-                            const startTime = Date.now();
-                            const endTime = startTime + totalMs;
-                            while (Date.now() < endTime) {
-                                if (abortSignal?.aborted) {
-                                    throw new Error("Aborted");
-                                }
-                                const remaining = Math.max(0, endTime - Date.now());
-                                const waitLabel = formatWaitTime(remaining);
-                                await showToast(`${message} (${waitLabel} remaining)`, "warning", { duration: Math.min(intervalMs + 1000, toastDurationMs) });
-                                const sleepTime = Math.min(intervalMs, remaining);
-                                if (sleepTime > 0) {
-                                    await sleep(sleepTime);
+                let resolveMutex;
+                loaderMutex = new Promise((resolve) => {
+                    resolveMutex = resolve;
+                });
+                try {
+                    if (!accountManagerPromise) {
+                        accountManagerPromise = AccountManager.loadFromDisk(auth);
+                    }
+                    const accountManager = await accountManagerPromise;
+                    cachedAccountManager = accountManager;
+                    const refreshToken = auth.type === "oauth" ? auth.refresh : "";
+                    const needsPersist = refreshToken &&
+                        !accountManager.hasRefreshToken(refreshToken);
+                    if (needsPersist) {
+                        await accountManager.saveToDisk();
+                    }
+                    if (accountManager.getAccountCount() === 0) {
+                        logDebug(`[${PLUGIN_NAME}] No OAuth accounts available (run opencode auth login)`);
+                        return {};
+                    }
+                    // Extract user configuration (global + per-model options)
+                    const providerConfig = provider;
+                    const userConfig = {
+                        global: providerConfig?.options || {},
+                        models: providerConfig?.models || {},
+                    };
+                    // Load plugin configuration and determine CODEX_MODE
+                    // Priority: CODEX_MODE env var > config file > default (true)
+                    const pluginConfig = loadPluginConfig();
+                    const codexMode = getCodexMode(pluginConfig);
+                    const tokenRefreshSkewMs = getTokenRefreshSkewMs(pluginConfig);
+                    const rateLimitToastDebounceMs = getRateLimitToastDebounceMs(pluginConfig);
+                    const retryAllAccountsRateLimited = getRetryAllAccountsRateLimited(pluginConfig);
+                    const retryAllAccountsMaxWaitMs = getRetryAllAccountsMaxWaitMs(pluginConfig);
+                    const retryAllAccountsMaxRetries = getRetryAllAccountsMaxRetries(pluginConfig);
+                    const toastDurationMs = getToastDurationMs(pluginConfig);
+                    const perProjectAccounts = getPerProjectAccounts(pluginConfig);
+                    if (perProjectAccounts) {
+                        setStoragePath(process.cwd());
+                    }
+                    const sessionRecoveryEnabled = getSessionRecovery(pluginConfig);
+                    const autoResumeEnabled = getAutoResume(pluginConfig);
+                    const recoveryHook = sessionRecoveryEnabled
+                        ? createSessionRecoveryHook({ client, directory: process.cwd() }, { sessionRecovery: true, autoResume: autoResumeEnabled })
+                        : null;
+                    checkAndNotify(async (message, variant) => {
+                        await showToast(message, variant);
+                    }).catch((err) => {
+                        logDebug(`Update check failed: ${err instanceof Error ? err.message : String(err)}`);
+                    });
+                    // Return SDK configuration
+                    return {
+                        apiKey: DUMMY_API_KEY,
+                        baseURL: CODEX_BASE_URL,
+                        /**
+                         * Custom fetch implementation for Codex API
+                         *
+                         * Handles:
+                         * - Token refresh when expired
+                         * - URL rewriting for Codex backend
+                         * - Request body transformation
+                         * - OAuth header injection
+                         * - SSE to JSON conversion for non-tool requests
+                         * - Error handling and logging
+                         *
+                         * @param input - Request URL or Request object
+                         * @param init - Request options
+                         * @returns Response from Codex API
+                         */
+                        async fetch(input, init) {
+                            // Step 1: Extract and rewrite URL for Codex backend
+                            const originalUrl = extractRequestUrl(input);
+                            const url = rewriteUrlForCodex(originalUrl);
+                            // Step 3: Transform request body with model-specific Codex instructions
+                            // Instructions are fetched per model family (codex-max, codex, gpt-5.1)
+                            // Capture original stream value before transformation
+                            // generateText() sends no stream field, streamText() sends stream=true
+                            let originalBody = {};
+                            if (init?.body) {
+                                try {
+                                    originalBody = JSON.parse(init.body);
                                 }
-                                else {
-                                    break;
+                                catch {
+                                    logWarn("Failed to parse request body, using empty object");
                                 }
                             }
-                        };
-                        let allRateLimitedRetries = 0;
-                        while (true) {
-                            const accountCount = accountManager.getAccountCount();
-                            const attempted = new Set();
-                            while (attempted.size < Math.max(1, accountCount)) {
-                                const account = accountManager.getCurrentOrNextForFamilyHybrid(modelFamily, model);
-                                if (!account || attempted.has(account.index)) {
-                                    break;
+                            const isStreaming = originalBody.stream === true;
+                            const transformation = await transformRequestForCodex(init, url, userConfig, codexMode, originalBody);
+                            const requestInit = transformation?.updatedInit ?? init;
+                            const promptCacheKey = transformation?.body?.prompt_cache_key;
+                            const model = transformation?.body.model;
+                            const modelFamily = model ? getModelFamily(model) : "gpt-5.1";
+                            const quotaKey = model ? `${modelFamily}:${model}` : modelFamily;
+                            const abortSignal = requestInit?.signal ?? init?.signal ?? null;
+                            const sleep = (ms) => new Promise((resolve, reject) => {
+                                if (abortSignal?.aborted) {
+                                    reject(new Error("Aborted"));
+                                    return;
                                 }
-                                attempted.add(account.index);
-                                // Log account selection for debugging rotation
-                                logDebug(`Using account ${account.index + 1}/${accountCount}: ${account.email ?? "unknown"} for ${modelFamily}`);
-                                let accountAuth = accountManager.toAuthDetails(account);
-                                try {
-                                    if (shouldRefreshToken(accountAuth, tokenRefreshSkewMs)) {
-                                        accountAuth = (await refreshAndUpdateToken(accountAuth, client));
-                                        accountManager.updateFromAuth(account, accountAuth);
-                                        accountManager.clearAuthFailures(account);
-                                        accountManager.saveToDiskDebounced();
+                                const timeout = setTimeout(() => {
+                                    cleanup();
+                                    resolve();
+                                }, ms);
+                                const onAbort = () => {
+                                    cleanup();
+                                    reject(new Error("Aborted"));
+                                };
+                                const cleanup = () => {
+                                    clearTimeout(timeout);
+                                    abortSignal?.removeEventListener("abort", onAbort);
+                                };
+                                abortSignal?.addEventListener("abort", onAbort, { once: true });
+                            });
+                            const sleepWithCountdown = async (totalMs, message, intervalMs = 5000) => {
+                                const startTime = Date.now();
+                                const endTime = startTime + totalMs;
+                                while (Date.now() < endTime) {
+                                    if (abortSignal?.aborted) {
+                                        throw new Error("Aborted");
+                                    }
+                                    const remaining = Math.max(0, endTime - Date.now());
+                                    const waitLabel = formatWaitTime(remaining);
+                                    await showToast(`${message} (${waitLabel} remaining)`, "warning", { duration: Math.min(intervalMs + 1000, toastDurationMs) });
+                                    const sleepTime = Math.min(intervalMs, remaining);
+                                    if (sleepTime > 0) {
+                                        await sleep(sleepTime);
+                                    }
+                                    else {
+                                        break;
                                     }
                                 }
-                                catch (err) {
-                                    logDebug(`[${PLUGIN_NAME}] Auth refresh failed for account: ${err?.message ?? String(err)}`);
-                                    const failures = accountManager.incrementAuthFailures(account);
-                                    const accountLabel = formatAccountLabel(account, account.index);
-                                    if (failures >= ACCOUNT_LIMITS.MAX_AUTH_FAILURES_BEFORE_REMOVAL) {
-                                        accountManager.removeAccount(account);
+                            };
+                            let allRateLimitedRetries = 0;
+                            while (true) {
+                                const accountCount = accountManager.getAccountCount();
+                                const attempted = new Set();
+                                while (attempted.size < Math.max(1, accountCount)) {
+                                    const account = accountManager.getCurrentOrNextForFamilyHybrid(modelFamily, model);
+                                    if (!account || attempted.has(account.index)) {
+                                        break;
+                                    }
+                                    attempted.add(account.index);
+                                    // Log account selection for debugging rotation
+                                    logDebug(`Using account ${account.index + 1}/${accountCount}: ${account.email ?? "unknown"} for ${modelFamily}`);
+                                    let accountAuth = accountManager.toAuthDetails(account);
+                                    try {
+                                        if (shouldRefreshToken(accountAuth, tokenRefreshSkewMs)) {
+                                            accountAuth = (await refreshAndUpdateToken(accountAuth, client));
+                                            accountManager.updateFromAuth(account, accountAuth);
+                                            accountManager.clearAuthFailures(account);
+                                            accountManager.saveToDiskDebounced();
+                                        }
+                                    }
+                                    catch (err) {
+                                        logDebug(`[${PLUGIN_NAME}] Auth refresh failed for account: ${err?.message ?? String(err)}`);
+                                        const failures = accountManager.incrementAuthFailures(account);
+                                        const accountLabel = formatAccountLabel(account, account.index);
+                                        if (failures >= ACCOUNT_LIMITS.MAX_AUTH_FAILURES_BEFORE_REMOVAL) {
+                                            accountManager.removeAccount(account);
+                                            accountManager.saveToDiskDebounced();
+                                            await showToast(`Removed ${accountLabel} after ${failures} consecutive auth failures. Run 'opencode auth login' to re-add.`, "error", { duration: toastDurationMs * 2 });
+                                            continue;
+                                        }
+                                        accountManager.markAccountCoolingDown(account, ACCOUNT_LIMITS.AUTH_FAILURE_COOLDOWN_MS, "auth-failure");
                                         accountManager.saveToDiskDebounced();
-                                        await showToast(`Removed ${accountLabel} after ${failures} consecutive auth failures. Run 'opencode auth login' to re-add.`, "error", { duration: toastDurationMs * 2 });
                                         continue;
                                     }
-                                    accountManager.markAccountCoolingDown(account, ACCOUNT_LIMITS.AUTH_FAILURE_COOLDOWN_MS, "auth-failure");
-                                    accountManager.saveToDiskDebounced();
-                                    continue;
-                                }
-                                const hadAccountId = !!account.accountId;
-                                // Prefer fresh token-derived ID over stored ID (fixes Business plan workspace issues)
-                                const accountId = extractAccountId(accountAuth.access) ?? account.accountId;
-                                if (!accountId) {
-                                    accountManager.markAccountCoolingDown(account, ACCOUNT_LIMITS.AUTH_FAILURE_COOLDOWN_MS, "auth-failure");
-                                    accountManager.saveToDiskDebounced();
-                                    continue;
-                                }
-                                account.accountId = accountId;
-                                if (!hadAccountId) {
-                                    account.accountIdSource = account.accountIdSource ?? "token";
-                                }
-                                account.email =
-                                    extractAccountEmail(accountAuth.access) ?? account.email;
-                                if (accountCount > 1 &&
-                                    accountManager.shouldShowAccountToast(account.index, rateLimitToastDebounceMs)) {
-                                    const accountLabel = formatAccountLabel(account, account.index);
-                                    await showToast(`Using ${accountLabel} (${account.index + 1}/${accountCount})`, "info");
-                                    accountManager.markToastShown(account.index);
-                                }
-                                const headers = createCodexHeaders(requestInit, accountId, accountAuth.access, {
-                                    model,
-                                    promptCacheKey,
-                                });
-                                while (true) {
-                                    let response;
-                                    const fetchStart = performance.now();
-                                    try {
-                                        response = await fetch(url, {
-                                            ...requestInit,
-                                            headers,
-                                        });
+                                    const hadAccountId = !!account.accountId;
+                                    // Prefer fresh token-derived ID over stored ID (fixes Business plan workspace issues)
+                                    const accountId = extractAccountId(accountAuth.access) ?? account.accountId;
+                                    if (!accountId) {
+                                        accountManager.markAccountCoolingDown(account, ACCOUNT_LIMITS.AUTH_FAILURE_COOLDOWN_MS, "auth-failure");
+                                        accountManager.saveToDiskDebounced();
+                                        continue;
                                     }
-                                    catch (networkError) {
-                                        const errorMsg = networkError instanceof Error ? networkError.message : String(networkError);
-                                        logWarn(`Network error for account ${account.index + 1}: ${errorMsg}`);
-                                        accountManager.recordFailure(account, modelFamily, model);
-                                        break;
+                                    account.accountId = accountId;
+                                    if (!hadAccountId) {
+                                        account.accountIdSource = account.accountIdSource ?? "token";
+                                    }
+                                    account.email =
+                                        extractAccountEmail(accountAuth.access) ?? account.email;
+                                    if (accountCount > 1 &&
+                                        accountManager.shouldShowAccountToast(account.index, rateLimitToastDebounceMs)) {
+                                        const accountLabel = formatAccountLabel(account, account.index);
+                                        await showToast(`Using ${accountLabel} (${account.index + 1}/${accountCount})`, "info");
+                                        accountManager.markToastShown(account.index);
                                     }
-                                    const fetchLatencyMs = Math.round(performance.now() - fetchStart);
-                                    logRequest(LOG_STAGES.RESPONSE, {
-                                        status: response.status,
-                                        ok: response.ok,
-                                        statusText: response.statusText,
-                                        latencyMs: fetchLatencyMs,
-                                        headers: Object.fromEntries(response.headers.entries()),
+                                    const headers = createCodexHeaders(requestInit, accountId, accountAuth.access, {
+                                        model,
+                                        promptCacheKey,
                                     });
-                                    if (!response.ok) {
-                                        const contextOverflowResult = await handleContextOverflow(response, model);
-                                        if (contextOverflowResult.handled) {
-                                            return contextOverflowResult.response;
+                                    // Consume a token before making the request for proactive rate limiting
+                                    accountManager.consumeToken(account, modelFamily, model);
+                                    while (true) {
+                                        let response;
+                                        const fetchStart = performance.now();
+                                        // Merge user AbortSignal with timeout (Node 18 compatible - no AbortSignal.any)
+                                        const fetchController = new AbortController();
+                                        const fetchTimeoutMs = 60000;
+                                        const fetchTimeoutId = setTimeout(() => fetchController.abort(new Error("Request timeout")), fetchTimeoutMs);
+                                        const onUserAbort = abortSignal
+                                            ? () => fetchController.abort(abortSignal.reason ?? new Error("Aborted by user"))
+                                            : null;
+                                        if (abortSignal?.aborted) {
+                                            clearTimeout(fetchTimeoutId);
+                                            fetchController.abort(abortSignal.reason ?? new Error("Aborted by user"));
+                                        }
+                                        else if (abortSignal && onUserAbort) {
+                                            abortSignal.addEventListener("abort", onUserAbort, { once: true });
                                         }
-                                        const { response: errorResponse, rateLimit, errorBody } = await handleErrorResponse(response);
-                                        if (recoveryHook && errorBody && isRecoverableError(errorBody)) {
-                                            const errorType = detectErrorType(errorBody);
-                                            const toastContent = getRecoveryToastContent(errorType);
-                                            await showToast(`${toastContent.title}: ${toastContent.message}`, "warning", { duration: toastDurationMs });
-                                            logDebug(`[${PLUGIN_NAME}] Recoverable error detected: ${errorType}`);
+                                        try {
+                                            response = await fetch(url, {
+                                                ...requestInit,
+                                                headers,
+                                                signal: fetchController.signal,
+                                            });
                                         }
-                                        if (rateLimit) {
-                                            const { attempt, delayMs } = getRateLimitBackoff(account.index, quotaKey, rateLimit.retryAfterMs);
-                                            const waitLabel = formatWaitTime(delayMs);
-                                            if (delayMs <= RATE_LIMIT_SHORT_RETRY_THRESHOLD_MS) {
-                                                if (accountManager.shouldShowAccountToast(account.index, rateLimitToastDebounceMs)) {
-                                                    await showToast(`Rate limited. Retrying in ${waitLabel} (attempt ${attempt})...`, "warning", { duration: toastDurationMs });
+                                        catch (networkError) {
+                                            const errorMsg = networkError instanceof Error ? networkError.message : String(networkError);
+                                            logWarn(`Network error for account ${account.index + 1}: ${errorMsg}`);
+                                            accountManager.refundToken(account, modelFamily, model);
+                                            accountManager.recordFailure(account, modelFamily, model);
+                                            break;
+                                        }
+                                        finally {
+                                            clearTimeout(fetchTimeoutId);
+                                            if (abortSignal && onUserAbort) {
+                                                abortSignal.removeEventListener("abort", onUserAbort);
+                                            }
+                                        }
+                                        const fetchLatencyMs = Math.round(performance.now() - fetchStart);
+                                        logRequest(LOG_STAGES.RESPONSE, {
+                                            status: response.status,
+                                            ok: response.ok,
+                                            statusText: response.statusText,
+                                            latencyMs: fetchLatencyMs,
+                                            headers: Object.fromEntries(response.headers.entries()),
+                                        });
+                                        if (!response.ok) {
+                                            const contextOverflowResult = await handleContextOverflow(response, model);
+                                            if (contextOverflowResult.handled) {
+                                                return contextOverflowResult.response;
+                                            }
+                                            const { response: errorResponse, rateLimit, errorBody } = await handleErrorResponse(response);
+                                            if (recoveryHook && errorBody && isRecoverableError(errorBody)) {
+                                                const errorType = detectErrorType(errorBody);
+                                                const toastContent = getRecoveryToastContent(errorType);
+                                                await showToast(`${toastContent.title}: ${toastContent.message}`, "warning", { duration: toastDurationMs });
+                                                logDebug(`[${PLUGIN_NAME}] Recoverable error detected: ${errorType}`);
+                                            }
+                                            // Handle 5xx server errors by rotating to another account
+                                            if (response.status >= 500 && response.status < 600) {
+                                                logWarn(`Server error ${response.status} for account ${account.index + 1}. Rotating to next account.`);
+                                                accountManager.refundToken(account, modelFamily, model);
+                                                accountManager.recordFailure(account, modelFamily, model);
+                                                break;
+                                            }
+                                            if (rateLimit) {
+                                                const { attempt, delayMs } = getRateLimitBackoff(account.index, quotaKey, rateLimit.retryAfterMs);
+                                                const waitLabel = formatWaitTime(delayMs);
+                                                if (delayMs <= RATE_LIMIT_SHORT_RETRY_THRESHOLD_MS) {
+                                                    if (accountManager.shouldShowAccountToast(account.index, rateLimitToastDebounceMs)) {
+                                                        await showToast(`Rate limited. Retrying in ${waitLabel} (attempt ${attempt})...`, "warning", { duration: toastDurationMs });
+                                                        accountManager.markToastShown(account.index);
+                                                    }
+                                                    await sleep(addJitter(Math.max(MIN_BACKOFF_MS, delayMs), 0.2));
+                                                    continue;
+                                                }
+                                                accountManager.markRateLimitedWithReason(account, delayMs, modelFamily, parseRateLimitReason(rateLimit.code), model);
+                                                accountManager.recordRateLimit(account, modelFamily, model);
+                                                account.lastSwitchReason = "rate-limit";
+                                                accountManager.saveToDiskDebounced();
+                                                logWarn(`Rate limited. Rotating account ${account.index + 1} (${account.email ?? "unknown"}).`);
+                                                if (accountManager.getAccountCount() > 1 &&
+                                                    accountManager.shouldShowAccountToast(account.index, rateLimitToastDebounceMs)) {
+                                                    await showToast(`Rate limited. Switching accounts (retry in ${waitLabel}).`, "warning", { duration: toastDurationMs });
                                                     accountManager.markToastShown(account.index);
                                                 }
-                                                await sleep(addJitter(delayMs, 0.2));
-                                                continue;
+                                                break;
                                             }
-                                            accountManager.markRateLimited(account, delayMs, modelFamily, model);
-                                            accountManager.recordRateLimit(account, modelFamily, model);
-                                            account.lastSwitchReason = "rate-limit";
-                                            accountManager.saveToDiskDebounced();
-                                            logWarn(`Rate limited. Rotating account ${account.index + 1} (${account.email ?? "unknown"}).`);
-                                            if (accountManager.getAccountCount() > 1 &&
-                                                accountManager.shouldShowAccountToast(account.index, rateLimitToastDebounceMs)) {
-                                                await showToast(`Rate limited. Switching accounts (retry in ${waitLabel}).`, "warning", { duration: toastDurationMs });
-                                                accountManager.markToastShown(account.index);
-                                            }
-                                            break;
+                                            return errorResponse;
                                         }
-                                        return errorResponse;
+                                        resetRateLimitBackoff(account.index, quotaKey);
+                                        const successResponse = await handleSuccessResponse(response, isStreaming);
+                                        accountManager.recordSuccess(account, modelFamily, model);
+                                        return successResponse;
                                     }
-                                    resetRateLimitBackoff(account.index, quotaKey);
-                                    accountManager.recordSuccess(account, modelFamily, model);
-                                    return await handleSuccessResponse(response, isStreaming);
                                 }
+                                const waitMs = accountManager.getMinWaitTimeForFamily(modelFamily, model);
+                                const count = accountManager.getAccountCount();
+                                if (retryAllAccountsRateLimited &&
+                                    count > 0 &&
+                                    waitMs > 0 &&
+                                    (retryAllAccountsMaxWaitMs === 0 ||
+                                        waitMs <= retryAllAccountsMaxWaitMs) &&
+                                    allRateLimitedRetries < retryAllAccountsMaxRetries) {
+                                    const countdownMessage = `All ${count} account(s) rate-limited. Waiting`;
+                                    await sleepWithCountdown(addJitter(waitMs, 0.2), countdownMessage);
+                                    allRateLimitedRetries++;
+                                    continue;
+                                }
+                                const waitLabel = waitMs > 0 ? formatWaitTime(waitMs) : "a bit";
+                                const message = count === 0
+                                    ? "No Codex accounts configured. Run `opencode auth login`."
+                                    : waitMs > 0
+                                        ? `All ${count} account(s) are rate-limited. Try again in ${waitLabel} or add another account with \`opencode auth login\`.`
+                                        : `All ${count} account(s) failed (server errors or auth issues). Check account health with \`codex-health\`.`;
+                                return new Response(JSON.stringify({ error: { message } }), {
+                                    status: waitMs > 0 ? 429 : 503,
+                                    headers: {
+                                        "content-type": "application/json; charset=utf-8",
+                                    },
+                                });
                             }
-                            const waitMs = accountManager.getMinWaitTimeForFamily(modelFamily, model);
-                            const count = accountManager.getAccountCount();
-                            if (retryAllAccountsRateLimited &&
-                                count > 0 &&
-                                waitMs > 0 &&
-                                (retryAllAccountsMaxWaitMs === 0 ||
-                                    waitMs <= retryAllAccountsMaxWaitMs) &&
-                                allRateLimitedRetries < retryAllAccountsMaxRetries) {
-                                const countdownMessage = `All ${count} account(s) rate-limited. Waiting`;
-                                await sleepWithCountdown(addJitter(waitMs, 0.2), countdownMessage);
-                                allRateLimitedRetries++;
-                                continue;
-                            }
-                            const waitLabel = waitMs > 0 ? formatWaitTime(waitMs) : "a bit";
-                            const message = count === 0
-                                ? "No Codex accounts configured. Run `opencode auth login`."
-                                : `All ${count} account(s) are rate-limited. Try again in ${waitLabel} or add another account with \`opencode auth login\`.`;
-                            return new Response(JSON.stringify({ error: { message } }), {
-                                status: 429,
-                                headers: {
-                                    "content-type": "application/json; charset=utf-8",
-                                },
-                            });
-                        }
-                    },
-                };
+                        },
+                    };
+                }
+                finally {
+                    resolveMutex?.();
+                    loaderMutex = null;
+                }
             },
             methods: [
                 {
@@ -740,6 +824,13 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                      * @returns Authorization flow configuration
                      */
                     authorize: async (inputs) => {
+                        // Initialize storage path based on config BEFORE any account operations
+                        // This ensures accounts are saved to the correct location (per-project or global)
+                        const authPluginConfig = loadPluginConfig();
+                        const authPerProjectAccounts = getPerProjectAccounts(authPluginConfig);
+                        if (authPerProjectAccounts) {
+                            setStoragePath(process.cwd());
+                        }
                         // Always use the multi-account flow regardless of inputs
                         // The inputs parameter is only used for noBrowser flag, not for flow selection
                         const accounts = [];
@@ -783,7 +874,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                 url: "",
                                 instructions: "Account limit reached. Remove an account or start fresh.",
                                 method: "auto",
-                                callback: async () => ({
+                                callback: () => Promise.resolve({
                                     type: "failed",
                                 }),
                             };
@@ -809,7 +900,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                             const result = await runOAuthFlow(forceNewLogin);
                             let resolved = null;
                             if (result.type === "success") {
-                                resolved = await resolveAccountSelection(result);
+                                resolved = resolveAccountSelection(result);
                                 const email = extractAccountEmail(resolved.access, resolved.idToken);
                                 const accountId = resolved.accountIdOverride ?? extractAccountId(resolved.access);
                                 const label = resolved.accountLabel ?? email ?? accountId ?? "Unknown account";
@@ -829,7 +920,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                         url: "",
                                         instructions: "Authentication failed.",
                                         method: "auto",
-                                        callback: async () => result,
+                                        callback: () => Promise.resolve(result),
                                     };
                                 }
                                 logWarn(`[${PLUGIN_NAME}] Skipping failed account ${accounts.length + 1}`);
@@ -861,7 +952,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                 url: "",
                                 instructions: "Authentication cancelled",
                                 method: "auto",
-                                callback: async () => ({
+                                callback: () => Promise.resolve({
                                     type: "failed",
                                 }),
                             };
@@ -874,13 +965,13 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                             }
                         }
                         catch (err) {
-                            logDebug(`[${PLUGIN_NAME}] Failed to load final account count: ${err?.message ?? String(err)}`);
+                            logWarn(`[${PLUGIN_NAME}] Failed to load final account count: ${err?.message ?? String(err)}`);
                         }
                         return {
                             url: "",
                             instructions: `Multi-account setup complete (${actualAccountCount} account(s)).`,
                             method: "auto",
-                            callback: async () => primary,
+                            callback: () => Promise.resolve(primary),
                         };
                     },
                 },
@@ -888,6 +979,13 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                     label: AUTH_LABELS.OAUTH_MANUAL,
                     type: "oauth",
                     authorize: async () => {
+                        // Initialize storage path for manual OAuth flow
+                        // Must happen BEFORE persistAccountPool to ensure correct storage location
+                        const manualPluginConfig = loadPluginConfig();
+                        const manualPerProjectAccounts = getPerProjectAccounts(manualPluginConfig);
+                        if (manualPerProjectAccounts) {
+                            setStoragePath(process.cwd());
+                        }
                         const { pkce, url } = await createAuthorizationFlow();
                         return buildManualOAuthFlow(pkce, url, async (tokens) => {
                             try {
@@ -924,11 +1022,17 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                     }
                     const now = Date.now();
                     const activeIndex = resolveActiveIndex(storage, "codex");
+                    const listTableOptions = {
+                        columns: [
+                            { header: "#", width: 3 },
+                            { header: "Label", width: 42 },
+                            { header: "Status", width: 20 },
+                        ],
+                    };
                     const lines = [
                         `Codex Accounts (${storage.accounts.length}):`,
                         "",
-                        " #  Label                                     Status",
-                        "----------------------------------------------- ---------------------",
+                        ...buildTableHeader(listTableOptions),
                     ];
                     storage.accounts.forEach((account, index) => {
                         const label = formatAccountLabel(account, index);
@@ -944,8 +1048,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                             statuses.push("cooldown");
                         }
                         const statusText = statuses.length > 0 ? statuses.join(", ") : "ok";
-                        const row = `${String(index + 1).padEnd(3)} ${label.padEnd(40)} ${statusText}`;
-                        lines.push(row);
+                        lines.push(buildTableRow([String(index + 1), label, statusText], listTableOptions));
                     });
                     lines.push("");
                     lines.push(`Storage: ${storePath}`);
@@ -1009,22 +1112,30 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                     }
                     const now = Date.now();
                     const activeIndex = resolveActiveIndex(storage, "codex");
+                    const statusTableOptions = {
+                        columns: [
+                            { header: "#", width: 3 },
+                            { header: "Label", width: 42 },
+                            { header: "Active", width: 6 },
+                            { header: "Rate Limit", width: 16 },
+                            { header: "Cooldown", width: 16 },
+                            { header: "Last Used", width: 16 },
+                        ],
+                    };
                     const lines = [
                         `Account Status (${storage.accounts.length} total):`,
                         "",
-                        " #  Label                                     Active  Rate Limit       Cooldown        Last Used",
-                        "----------------------------------------------- ------ ---------------- ---------------- ----------------",
+                        ...buildTableHeader(statusTableOptions),
                     ];
                     storage.accounts.forEach((account, index) => {
-                        const label = formatAccountLabel(account, index).padEnd(42);
+                        const label = formatAccountLabel(account, index);
                         const active = index === activeIndex ? "Yes" : "No";
                         const rateLimit = formatRateLimitEntry(account, now) ?? "None";
                         const cooldown = formatCooldown(account, now) ?? "No";
                         const lastUsed = typeof account.lastUsed === "number" && account.lastUsed > 0
                             ? `${formatWaitTime(now - account.lastUsed)} ago`
                             : "-";
-                        const row = `${String(index + 1).padEnd(3)} ${label} ${active.padEnd(6)} ${rateLimit.padEnd(16)} ${cooldown.padEnd(16)} ${lastUsed}`;
-                        lines.push(row);
+                        lines.push(buildTableRow([String(index + 1), label, active, rateLimit, cooldown, lastUsed], statusTableOptions));
                     });
                     lines.push("");
                     lines.push("Active index by model family:");