oc-chatgpt-multi-auth 5.1.0 → 5.2.0

package/README.md

@@ -5,7 +5,7 @@
 [![Tests](https://github.com/ndycode/oc-chatgpt-multi-auth/actions/workflows/ci.yml/badge.svg)](https://github.com/ndycode/oc-chatgpt-multi-auth/actions)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
 
-OAuth plugin for OpenCode that lets you use ChatGPT Plus/Pro rate limits with models like `gpt-5.2`, `gpt-5.3-codex`, and `gpt-5.1-codex-max`.
+OAuth plugin for OpenCode that lets you use ChatGPT Plus/Pro rate limits with models like `gpt-5.2`, `gpt-5.3-codex`, and `gpt-5.1-codex-max` (plus optional `gpt-5.3-codex-spark` IDs when entitled).
 
 > [!NOTE]
 > **Renamed from `opencode-openai-codex-auth-multi`** — If you were using the old package, update your config to use `oc-chatgpt-multi-auth` instead. The rename was necessary because OpenCode blocks plugins containing `opencode-openai-codex-auth` in the name.
@@ -18,7 +18,7 @@ OAuth plugin for OpenCode that lets you use ChatGPT Plus/Pro rate limits with mo
 - **Click-to-switch** — Switch accounts directly from the OpenCode TUI
 - **Strict tool validation** — Automatically cleans schemas for compatibility with strict models
 - **Auto-update notifications** — Get notified when a new version is available
-- **22 model presets** — Full variant system with reasoning levels (none/low/medium/high/xhigh)
+- **22 template model presets** — Full variant system with reasoning levels (none/low/medium/high/xhigh)
 - **Prompt caching** — Session-based caching for faster multi-turn conversations
 - **Usage-aware errors** — Friendly messages with rate limit reset timing
 - **Plugin compatible** — Works alongside other OpenCode plugins (oh-my-opencode, dcp, etc.)
@@ -131,11 +131,14 @@ opencode run "Hello" --model=openai/gpt-5.2 --variant=medium
 |-------|----------|-------|
 | `gpt-5.2` | none, low, medium, high, xhigh | Latest GPT-5.2 with reasoning levels |
 | `gpt-5.3-codex` | low, medium, high, xhigh | Latest GPT-5.3 Codex for code generation (default: xhigh) |
+| `gpt-5.3-codex-spark` | low, medium, high, xhigh | Spark IDs are supported by the plugin, but access is entitlement-gated by account/workspace |
 | `gpt-5.1-codex-max` | low, medium, high, xhigh | Maximum context Codex |
 | `gpt-5.1-codex` | low, medium, high | Standard Codex |
 | `gpt-5.1-codex-mini` | medium, high | Lightweight Codex |
 | `gpt-5.1` | none, low, medium, high | GPT-5.1 base model |
 
+Config templates intentionally omit Spark model IDs by default to reduce entitlement failures on unsupported accounts. Add Spark manually only if your workspace is entitled.
+
 **Using variants:**
 ```bash
 # Modern OpenCode (v1.0.210+)
@@ -238,6 +241,21 @@ Add this to your `~/.config/opencode/opencode.json`:
 }
 ```
 
+Optional Spark model block (manual add only when entitled):
+```json
+"gpt-5.3-codex-spark": {
+  "name": "GPT 5.3 Codex Spark (OAuth)",
+  "limit": { "context": 272000, "output": 128000 },
+  "modalities": { "input": ["text", "image", "pdf"], "output": ["text"] },
+  "variants": {
+    "low": { "reasoningEffort": "low" },
+    "medium": { "reasoningEffort": "medium" },
+    "high": { "reasoningEffort": "high" },
+    "xhigh": { "reasoningEffort": "xhigh" }
+  }
+}
+```
+
 For legacy OpenCode (v1.0.209 and below), use `config/opencode-legacy.json` which has individual model entries like `gpt-5.2-low`, `gpt-5.2-medium`, etc.
 
 </details>
@@ -557,6 +575,42 @@ OpenCode uses `~/.config/opencode/` on **all platforms** including Windows.
 
 </details>
 
+<details>
+<summary><b>Unsupported Codex Model for ChatGPT Account</b></summary>
+
+**Error example:** `Bad Request: {"detail":"The 'gpt-5.3-codex-spark' model is not supported when using Codex with a ChatGPT account."}`
+
+**Cause:** Active workspace/account is not entitled for the requested Codex model.
+
+**Solutions:**
+1. Re-auth to refresh workspace selection (most common Spark fix):
+   ```bash
+   opencode auth login
+   ```
+2. Add another entitled account/workspace. The plugin will try remaining accounts/workspaces before model fallback.
+3. Enable automatic fallback only if you want degraded-model retries when Spark is not entitled:
+   ```bash
+   CODEX_AUTH_UNSUPPORTED_MODEL_POLICY=fallback opencode
+   ```
+4. Use custom fallback chain in `~/.opencode/openai-codex-auth-config.json`:
+   ```json
+   {
+     "unsupportedCodexPolicy": "fallback",
+     "fallbackOnUnsupportedCodexModel": true,
+     "unsupportedCodexFallbackChain": {
+       "gpt-5.3-codex": ["gpt-5.2-codex"],
+       "gpt-5.3-codex-spark": ["gpt-5.3-codex", "gpt-5.2-codex"]
+     }
+   }
+   ```
+5. Verify effective upstream model when needed:
+   ```bash
+   ENABLE_PLUGIN_REQUEST_LOGGING=1 opencode run "ping" --model=openai/gpt-5.3-codex-spark
+   ```
+   The UI can keep showing your selected model while fallback is applied internally.
+
+</details>
+
 <details>
 <summary><b>Rate Limit Exceeded</b></summary>
 
@@ -659,7 +713,7 @@ Create `~/.opencode/openai-codex-auth-config.json` for optional settings:
 | `codexTuiV2` | `true` | Enables Codex-style terminal UI output (set `false` for legacy output) |
 | `codexTuiColorProfile` | `truecolor` | Terminal color profile for Codex UI (`truecolor`, `ansi256`, `ansi16`) |
 | `codexTuiGlyphMode` | `ascii` | Glyph mode for Codex UI (`ascii`, `unicode`, `auto`) |
-| `fastSession` | `false` | Forces low-latency settings per request (`reasoningEffort=none/low`, `reasoningSummary=off`, `textVerbosity=low`) |
+| `fastSession` | `false` | Forces low-latency settings per request (`reasoningEffort=none/low`, `reasoningSummary=auto`, `textVerbosity=low`) |
 | `fastSessionStrategy` | `hybrid` | `hybrid` speeds simple turns but keeps full-depth on complex prompts; `always` forces fast tuning on every turn |
 | `fastSessionMaxInputItems` | `30` | Max input items kept when fast tuning is applied |
 
@@ -677,10 +731,17 @@ Create `~/.opencode/openai-codex-auth-config.json` for optional settings:
 | `retryAllAccountsRateLimited` | `true` | Wait and retry when all accounts are rate-limited |
 | `retryAllAccountsMaxWaitMs` | `0` | Max wait time (0 = unlimited) |
 | `retryAllAccountsMaxRetries` | `Infinity` | Max retry attempts |
-| `fallbackToGpt52OnUnsupportedGpt53` | `true` | Automatically retry once with `gpt-5.2-codex` when `gpt-5.3-codex` is rejected for ChatGPT Codex OAuth entitlement |
+| `unsupportedCodexPolicy` | `strict` | Unsupported-model behavior: `strict` (return entitlement error) or `fallback` (retry next model in fallback chain) |
+| `fallbackOnUnsupportedCodexModel` | `false` | Legacy fallback toggle mapped to `unsupportedCodexPolicy` (prefer using `unsupportedCodexPolicy`) |
+| `fallbackToGpt52OnUnsupportedGpt53` | `true` | Legacy compatibility toggle for the `gpt-5.3-codex -> gpt-5.2-codex` edge when generic fallback is enabled |
+| `unsupportedCodexFallbackChain` | `{}` | Optional per-model fallback-chain override (map of `model -> [fallback1, fallback2, ...]`) |
 | `fetchTimeoutMs` | `60000` | Request timeout to Codex backend (ms) |
 | `streamStallTimeoutMs` | `45000` | Abort non-stream parsing if SSE stalls (ms) |
 
+Default unsupported-model fallback chain (used when `unsupportedCodexPolicy` is `fallback`):
+- `gpt-5.3-codex -> gpt-5.2-codex`
+- `gpt-5.3-codex-spark -> gpt-5.3-codex -> gpt-5.2-codex` (applies if you manually select Spark model IDs)
+
 ### Environment Variables
 
 ```bash
@@ -695,7 +756,9 @@ CODEX_AUTH_PREWARM=0 opencode                    # Disable startup prewarm (prom
 CODEX_AUTH_FAST_SESSION=1 opencode               # Enable faster response defaults
 CODEX_AUTH_FAST_SESSION_STRATEGY=always opencode # Force fast mode for all prompts
 CODEX_AUTH_FAST_SESSION_MAX_INPUT_ITEMS=24 opencode # Tune fast-mode history window
-CODEX_AUTH_FALLBACK_GPT53_TO_GPT52=0 opencode    # Disable gpt-5.3 -> gpt-5.2 fallback (strict mode)
+CODEX_AUTH_UNSUPPORTED_MODEL_POLICY=fallback opencode # Enable generic unsupported-model fallback
+CODEX_AUTH_FALLBACK_UNSUPPORTED_MODEL=1 opencode # Legacy fallback toggle (prefer policy var above)
+CODEX_AUTH_FALLBACK_GPT53_TO_GPT52=0 opencode    # Disable only the legacy gpt-5.3 -> gpt-5.2 edge
 CODEX_AUTH_FETCH_TIMEOUT_MS=120000 opencode      # Override request timeout
 CODEX_AUTH_STREAM_STALL_TIMEOUT_MS=60000 opencode # Override SSE stall timeout
 ```

package/config/README.md

@@ -1,110 +1,84 @@
 # Configuration
 
-This directory contains the official opencode configuration files for the OpenAI Codex OAuth plugin.
+This directory contains the official OpenCode config templates for the ChatGPT Codex OAuth plugin.
 
-## ⚠️ REQUIRED: Choose the Right Configuration
+## Required: choose the right config file
 
-**Two configuration files are available based on your OpenCode version:**
-
-| File | OpenCode Version | Description |
+| File | OpenCode version | Description |
 |------|------------------|-------------|
-| [`opencode-modern.json`](./opencode-modern.json) | **v1.0.210+ (Jan 2026+)** | Compact config using variants system - 6 models with built-in reasoning level variants |
-| [`opencode-legacy.json`](./opencode-legacy.json) | **v1.0.209 and below** | Extended config with separate model entries for each reasoning level - 20+ individual model definitions |
+| [`opencode-modern.json`](./opencode-modern.json) | **v1.0.210+** | Variant-based config: 6 base models with 22 total presets |
+| [`opencode-legacy.json`](./opencode-legacy.json) | **v1.0.209 and below** | Legacy explicit entries: 22 individual model definitions |
+
+## Quick pick
 
-### Which one should I use?
+If your OpenCode version is v1.0.210 or newer:
 
-**If you have OpenCode v1.0.210 or newer** (check with `opencode --version`):
 ```bash
 cp config/opencode-modern.json ~/.config/opencode/opencode.json
 ```
 
-**If you have OpenCode v1.0.209 or older**:
+If your OpenCode version is v1.0.209 or older:
+
 ```bash
 cp config/opencode-legacy.json ~/.config/opencode/opencode.json
 ```
 
-### Why two configs?
-
-OpenCode v1.0.210+ introduced a **variants system** that allows defining reasoning effort levels as variants under a single model. This reduces config size from 572 lines to ~150 lines while maintaining the same functionality.
-
-**What you get:**
-
-| Config File | Model Families | Reasoning Variants | Total Models |
-|------------|----------------|-------------------|--------------|
-| `opencode-modern.json` | 6 | Built-in variants (low/medium/high/xhigh) | 6 base models with 22 total variants |
-| `opencode-legacy.json` | 6 | Separate model entries | 22 individual model definitions |
-
-Both configs provide:
-- ✅ All supported GPT 5.3/5.2/5.1 variants: gpt-5.2, gpt-5.3-codex, gpt-5.1, gpt-5.1-codex, gpt-5.1-codex-max, gpt-5.1-codex-mini
-- ✅ Proper reasoning effort settings for each variant (including `xhigh` for Codex Max/5.2)
-- ✅ Context limits (272k context / 128k output for all Codex families)
-- ✅ Required options: `store: false`, `include: ["reasoning.encrypted_content"]`
-- ✅ Image input support for all models
-- ✅ All required metadata for OpenCode features
-
-### Modern Config Benefits (v1.0.210+)
+Check your version with:
 
-- **74% smaller**: 150 lines vs 572 lines
-- **DRY**: Common options defined once at provider level
-- **Variant cycling**: Built-in support for `Ctrl+T` to switch reasoning levels
-- **Easier maintenance**: Add new variants without copying model definitions
-
-## Usage
-
-1. **Check your OpenCode version**:
-   ```bash
-   opencode --version
-   ```
+```bash
+opencode --version
+```
 
-2. **Copy the appropriate config** based on your version:
-   ```bash
-   # For v1.0.210+ (recommended):
-   cp config/opencode-modern.json ~/.config/opencode/opencode.json
+## Why there are two templates
 
-   # For older versions:
-   cp config/opencode-legacy.json ~/.config/opencode/opencode.json
-   ```
+OpenCode v1.0.210+ added model `variants`, so one model entry can expose multiple reasoning levels. That keeps modern config much smaller while preserving the same effective presets.
 
-3. **Run opencode**:
-   ```bash
-   # Modern config (v1.0.210+):
-   opencode run "task" --model=openai/gpt-5.2 --variant=medium
-   opencode run "task" --model=openai/gpt-5.2 --variant=high
+Both templates include:
+- GPT-5.2, GPT-5.3 Codex, GPT-5.1, GPT-5.1 Codex, GPT-5.1 Codex Max, GPT-5.1 Codex Mini
+- Reasoning variants per model family
+- `store: false` and `include: ["reasoning.encrypted_content"]`
+- Context metadata (272k context / 128k output)
 
-   # Legacy config:
-   opencode run "task" --model=openai/gpt-5.2-medium
-   opencode run "task" --model=openai/gpt-5.2-high
-   ```
+## Spark model note
 
-> **⚠️ Important**: Use the config file appropriate for your OpenCode version. Using the modern config with an older OpenCode version (v1.0.209 or below) will not work correctly.
+The templates intentionally do **not** include `gpt-5.3-codex-spark` by default. Spark is often entitlement-gated at the account/workspace level, so shipping it by default causes avoidable startup failures for many users.
 
-> **Note**: The config templates use an **unversioned** plugin entry (`oc-chatgpt-multi-auth`) so the installer can always pull the latest release. If you need reproducibility, pin a specific version manually.
+If your workspace is entitled, you can add Spark model IDs manually.
 
-### Minimal config (advanced)
+## Usage examples
 
-A barebones example is available at [`minimal-opencode.json`](./minimal-opencode.json). It’s intended for debugging and does not include the full GPT‑5.x/Codex preset/variant definitions.
+Modern template (v1.0.210+):
 
-For normal usage, prefer `opencode-modern.json` (v1.0.210+) or `opencode-legacy.json` (v1.0.209 and below).
+```bash
+opencode run "task" --model=openai/gpt-5.2 --variant=medium
+opencode run "task" --model=openai/gpt-5.3-codex --variant=high
+```
 
-## Available Models
+Legacy template (v1.0.209 and below):
 
+```bash
+opencode run "task" --model=openai/gpt-5.2-medium
+opencode run "task" --model=openai/gpt-5.3-codex-high
+```
 
-Both configs provide access to the same model families:
+## Minimal config (advanced)
 
-- **gpt-5.2** (none/low/medium/high/xhigh) - Latest GPT 5.2 model with full reasoning support
-- **gpt-5.3-codex** (low/medium/high/xhigh) - Latest GPT 5.3 Codex presets
-- **gpt-5.1-codex-max** (low/medium/high/xhigh) - Codex Max presets
-- **gpt-5.1-codex** (low/medium/high) - Codex model presets
-- **gpt-5.1-codex-mini** (medium/high) - Codex mini tier presets
-- **gpt-5.1** (none/low/medium/high) - General-purpose reasoning presets
+A barebones debug template is available at [`minimal-opencode.json`](./minimal-opencode.json). It omits the full preset catalog.
 
-All appear in the opencode model selector as "GPT 5.1 Codex Low (OAuth)", "GPT 5.1 High (OAuth)", etc.
+## Unsupported-model behavior
 
-## Configuration Options
+Current defaults are strict entitlement handling:
+- `unsupportedCodexPolicy: "strict"` returns entitlement errors directly
+- set `unsupportedCodexPolicy: "fallback"` (or `CODEX_AUTH_UNSUPPORTED_MODEL_POLICY=fallback`) to enable automatic fallback retries
+- `fallbackToGpt52OnUnsupportedGpt53: true` keeps the legacy `gpt-5.3-codex -> gpt-5.2-codex` edge inside fallback mode
+- `unsupportedCodexFallbackChain` lets you override fallback order per model
 
-See the main [README.md](../README.md#configuration) for detailed documentation of all configuration options.
+Default fallback chain (when policy is `fallback`):
+- `gpt-5.3-codex -> gpt-5.2-codex`
+- `gpt-5.3-codex-spark -> gpt-5.3-codex -> gpt-5.2-codex` (only relevant if Spark IDs are added manually)
 
-## Version History
+## Additional docs
 
-- **January 2026 (v1.0.210+)**: Introduced variant system support. Use `opencode-modern.json`
-- **December 2025 and earlier**: Use `opencode-legacy.json`
+- Main config reference: [`docs/configuration.md`](../docs/configuration.md)
+- Getting started: [`docs/getting-started.md`](../docs/getting-started.md)
+- Troubleshooting: [`docs/troubleshooting.md`](../docs/troubleshooting.md)

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAe,MAAM,qBAAqB,CAAC;AAmI/D;;;;;;;;;;;;;;;GAeG;AAEH,eAAO,MAAM,iBAAiB,EAAE,MAs+E/B,CAAC;AAEF,eAAO,MAAM,gBAAgB,QAAoB,CAAC;AAElD,eAAe,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAe,MAAM,qBAAqB,CAAC;AAsI/D;;;;;;;;;;;;;;;GAeG;AAEH,eAAO,MAAM,iBAAiB,EAAE,MA0iF/B,CAAC;AAEF,eAAO,MAAM,gBAAgB,QAAoB,CAAC;AAElD,eAAe,iBAAiB,CAAC"}

package/dist/index.js

@@ -28,14 +28,14 @@ import { queuedRefresh } from "./lib/refresh-queue.js";
 import { openBrowserUrl } from "./lib/auth/browser.js";
 import { startLocalOAuthServer } from "./lib/auth/server.js";
 import { promptAddAnotherAccount, promptLoginMode } from "./lib/cli.js";
-import { getCodexMode, getFastSession, getFastSessionStrategy, getFastSessionMaxInputItems, getRateLimitToastDebounceMs, getRetryAllAccountsMaxRetries, getRetryAllAccountsMaxWaitMs, getRetryAllAccountsRateLimited, getFallbackToGpt52OnUnsupportedGpt53, getTokenRefreshSkewMs, getSessionRecovery, getAutoResume, getToastDurationMs, getPerProjectAccounts, getEmptyResponseMaxRetries, getEmptyResponseRetryDelayMs, getPidOffsetEnabled, getFetchTimeoutMs, getStreamStallTimeoutMs, getCodexTuiV2, getCodexTuiColorProfile, getCodexTuiGlyphMode, loadPluginConfig, } from "./lib/config.js";
+import { getCodexMode, getFastSession, getFastSessionStrategy, getFastSessionMaxInputItems, getRateLimitToastDebounceMs, getRetryAllAccountsMaxRetries, getRetryAllAccountsMaxWaitMs, getRetryAllAccountsRateLimited, getFallbackToGpt52OnUnsupportedGpt53, getUnsupportedCodexPolicy, getUnsupportedCodexFallbackChain, getTokenRefreshSkewMs, getSessionRecovery, getAutoResume, getToastDurationMs, getPerProjectAccounts, getEmptyResponseMaxRetries, getEmptyResponseRetryDelayMs, getPidOffsetEnabled, getFetchTimeoutMs, getStreamStallTimeoutMs, getCodexTuiV2, getCodexTuiColorProfile, getCodexTuiGlyphMode, loadPluginConfig, } from "./lib/config.js";
 import { AUTH_LABELS, CODEX_BASE_URL, DUMMY_API_KEY, LOG_STAGES, PLUGIN_NAME, PROVIDER_ID, ACCOUNT_LIMITS, } from "./lib/constants.js";
 import { initLogger, logRequest, logDebug, logInfo, logWarn, logError, setCorrelationId, clearCorrelationId, } from "./lib/logger.js";
 import { checkAndNotify } from "./lib/auto-update-checker.js";
 import { handleContextOverflow } from "./lib/context-overflow.js";
 import { AccountManager, getAccountIdCandidates, extractAccountEmail, extractAccountId, formatAccountLabel, formatCooldown, formatWaitTime, sanitizeEmail, selectBestAccountCandidate, shouldUpdateAccountIdFromToken, resolveRequestAccountId, parseRateLimitReason, } from "./lib/accounts.js";
 import { getStoragePath, loadAccounts, saveAccounts, clearAccounts, setStoragePath, exportAccounts, importAccounts, loadFlaggedAccounts, saveFlaggedAccounts, clearFlaggedAccounts, StorageError, formatStorageErrorHint, } from "./lib/storage.js";
-import { createCodexHeaders, extractRequestUrl, handleErrorResponse, handleSuccessResponse, shouldFallbackToGpt52OnUnsupportedGpt53, refreshAndUpdateToken, rewriteUrlForCodex, shouldRefreshToken, transformRequestForCodex, } from "./lib/request/fetch-helpers.js";
+import { createCodexHeaders, extractRequestUrl, handleErrorResponse, handleSuccessResponse, getUnsupportedCodexModelInfo, resolveUnsupportedCodexFallbackModel, refreshAndUpdateToken, rewriteUrlForCodex, shouldRefreshToken, transformRequestForCodex, } from "./lib/request/fetch-helpers.js";
 import { applyFastSessionDefaults } from "./lib/request/request-transformer.js";
 import { getRateLimitBackoff, RATE_LIMIT_SHORT_RETRY_THRESHOLD_MS, resetRateLimitBackoff, } from "./lib/request/rate-limit-backoff.js";
 import { isEmptyResponse } from "./lib/request/response-handler.js";
@@ -477,12 +477,12 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                 if (auth.type !== "oauth") {
                     return {};
                 }
-                // Only handle multi-account auth (identified by multiAccount flag)
-                // If auth was created by built-in plugin, let built-in handle it
+                // Prefer multi-account auth metadata when available, but still handle
+                // plain OAuth credentials (for OpenCode versions that inject internal
+                // Codex auth first and omit the multiAccount marker).
                 const authWithMulti = auth;
                 if (!authWithMulti.multiAccount) {
-                    logDebug(`[${PLUGIN_NAME}] Auth is not multi-account, skipping loader`);
-                    return {};
+                    logDebug(`[${PLUGIN_NAME}] Auth is missing multiAccount marker; continuing with single-account compatibility mode`);
                 }
                 // Acquire mutex for thread-safe initialization
                 // Use while loop to handle multiple concurrent waiters correctly
@@ -528,7 +528,10 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                     const retryAllAccountsRateLimited = getRetryAllAccountsRateLimited(pluginConfig);
                     const retryAllAccountsMaxWaitMs = getRetryAllAccountsMaxWaitMs(pluginConfig);
                     const retryAllAccountsMaxRetries = getRetryAllAccountsMaxRetries(pluginConfig);
+                    const unsupportedCodexPolicy = getUnsupportedCodexPolicy(pluginConfig);
+                    const fallbackOnUnsupportedCodexModel = unsupportedCodexPolicy === "fallback";
                     const fallbackToGpt52OnUnsupportedGpt53 = getFallbackToGpt52OnUnsupportedGpt53(pluginConfig);
+                    const unsupportedCodexFallbackChain = getUnsupportedCodexFallbackChain(pluginConfig);
                     const toastDurationMs = getToastDurationMs(pluginConfig);
                     const perProjectAccounts = getPerProjectAccounts(pluginConfig);
                     const fetchTimeoutMs = getFetchTimeoutMs(pluginConfig);
@@ -547,7 +550,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                     if (fastSessionEnabled) {
                         logDebug("Fast session mode enabled", {
                             reasoningEffort: "none/low",
-                            reasoningSummary: "off",
+                            reasoningSummary: "auto",
                             textVerbosity: "low",
                             fastSessionStrategy,
                             fastSessionMaxInputItems,
@@ -710,7 +713,10 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                 };
                                 let allRateLimitedRetries = 0;
                                 let emptyResponseRetries = 0;
-                                let attemptedGpt53Fallback = false;
+                                const attemptedUnsupportedFallbackModels = new Set();
+                                if (model) {
+                                    attemptedUnsupportedFallbackModels.add(model);
+                                }
                                 while (true) {
                                     const accountCount = accountManager.getAccountCount();
                                     const attempted = new Set();
@@ -834,14 +840,40 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                                     requestCorrelationId,
                                                     threadId: threadIdCandidate,
                                                 });
-                                                if (fallbackToGpt52OnUnsupportedGpt53 &&
-                                                    !attemptedGpt53Fallback &&
-                                                    shouldFallbackToGpt52OnUnsupportedGpt53(model, errorBody)) {
+                                                const unsupportedModelInfo = getUnsupportedCodexModelInfo(errorBody);
+                                                const hasRemainingAccounts = attempted.size < Math.max(1, accountCount);
+                                                // Entitlements can differ by account/workspace, so try remaining
+                                                // accounts before degrading the model via fallback.
+                                                if (unsupportedModelInfo.isUnsupported && hasRemainingAccounts) {
+                                                    const blockedModel = unsupportedModelInfo.unsupportedModel ?? model ?? "requested model";
+                                                    accountManager.refundToken(account, modelFamily, model);
+                                                    accountManager.recordFailure(account, modelFamily, model);
+                                                    account.lastSwitchReason = "rotation";
+                                                    runtimeMetrics.lastError = `Unsupported model on account ${account.index + 1}: ${blockedModel}`;
+                                                    logWarn(`Model ${blockedModel} is unsupported for account ${account.index + 1}. Trying next account/workspace before fallback.`, {
+                                                        unsupportedCodexPolicy,
+                                                        requestedModel: blockedModel,
+                                                        effectiveModel: blockedModel,
+                                                        fallbackApplied: false,
+                                                        fallbackReason: "unsupported-model-entitlement",
+                                                    });
+                                                    break;
+                                                }
+                                                const fallbackModel = resolveUnsupportedCodexFallbackModel({
+                                                    requestedModel: model,
+                                                    errorBody,
+                                                    attemptedModels: attemptedUnsupportedFallbackModels,
+                                                    fallbackOnUnsupportedCodexModel,
+                                                    fallbackToGpt52OnUnsupportedGpt53,
+                                                    customChain: unsupportedCodexFallbackChain,
+                                                });
+                                                if (fallbackModel) {
                                                     const previousModel = model ?? "gpt-5.3-codex";
                                                     const previousModelFamily = modelFamily;
-                                                    attemptedGpt53Fallback = true;
+                                                    attemptedUnsupportedFallbackModels.add(previousModel);
+                                                    attemptedUnsupportedFallbackModels.add(fallbackModel);
                                                     accountManager.refundToken(account, previousModelFamily, previousModel);
-                                                    model = "gpt-5.2-codex";
+                                                    model = fallbackModel;
                                                     modelFamily = getModelFamily(model);
                                                     quotaKey = `${modelFamily}:${model}`;
                                                     if (transformedBody && typeof transformedBody === "object") {
@@ -870,10 +902,28 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                                     });
                                                     accountManager.consumeToken(account, modelFamily, model);
                                                     runtimeMetrics.lastError = `Model fallback: ${previousModel} -> ${model}`;
-                                                    logWarn(`Model ${previousModel} is unsupported for this ChatGPT account. Falling back to ${model}.`);
+                                                    logWarn(`Model ${previousModel} is unsupported for this ChatGPT account. Falling back to ${model}.`, {
+                                                        unsupportedCodexPolicy,
+                                                        requestedModel: previousModel,
+                                                        effectiveModel: model,
+                                                        fallbackApplied: true,
+                                                        fallbackReason: "unsupported-model-entitlement",
+                                                    });
                                                     await showToast(`Model ${previousModel} is not available for this account. Retrying with ${model}.`, "warning", { duration: toastDurationMs });
                                                     continue;
                                                 }
+                                                if (unsupportedModelInfo.isUnsupported && !fallbackOnUnsupportedCodexModel) {
+                                                    const blockedModel = unsupportedModelInfo.unsupportedModel ?? model ?? "requested model";
+                                                    runtimeMetrics.lastError = `Unsupported model (strict): ${blockedModel}`;
+                                                    logWarn(`Model ${blockedModel} is unsupported for this ChatGPT account. Strict policy blocks automatic fallback.`, {
+                                                        unsupportedCodexPolicy,
+                                                        requestedModel: blockedModel,
+                                                        effectiveModel: blockedModel,
+                                                        fallbackApplied: false,
+                                                        fallbackReason: "unsupported-model-entitlement",
+                                                    });
+                                                    await showToast(`Model ${blockedModel} is not available for this account. Strict policy blocked automatic fallback.`, "warning", { duration: toastDurationMs });
+                                                }
                                                 if (recoveryHook && errorBody && isRecoverableError(errorBody)) {
                                                     const errorType = detectErrorType(errorBody);
                                                     const toastContent = getRecoveryToastContent(errorType);