oc-chatgpt-multi-auth 5.2.0 → 5.2.3

package/dist/index.js

@@ -28,13 +28,13 @@ import { queuedRefresh } from "./lib/refresh-queue.js";
 import { openBrowserUrl } from "./lib/auth/browser.js";
 import { startLocalOAuthServer } from "./lib/auth/server.js";
 import { promptAddAnotherAccount, promptLoginMode } from "./lib/cli.js";
-import { getCodexMode, getFastSession, getFastSessionStrategy, getFastSessionMaxInputItems, getRateLimitToastDebounceMs, getRetryAllAccountsMaxRetries, getRetryAllAccountsMaxWaitMs, getRetryAllAccountsRateLimited, getFallbackToGpt52OnUnsupportedGpt53, getUnsupportedCodexPolicy, getUnsupportedCodexFallbackChain, getTokenRefreshSkewMs, getSessionRecovery, getAutoResume, getToastDurationMs, getPerProjectAccounts, getEmptyResponseMaxRetries, getEmptyResponseRetryDelayMs, getPidOffsetEnabled, getFetchTimeoutMs, getStreamStallTimeoutMs, getCodexTuiV2, getCodexTuiColorProfile, getCodexTuiGlyphMode, loadPluginConfig, } from "./lib/config.js";
+import { getCodexMode, getRequestTransformMode, getFastSession, getFastSessionStrategy, getFastSessionMaxInputItems, getRateLimitToastDebounceMs, getRetryAllAccountsMaxRetries, getRetryAllAccountsMaxWaitMs, getRetryAllAccountsRateLimited, getFallbackToGpt52OnUnsupportedGpt53, getUnsupportedCodexPolicy, getUnsupportedCodexFallbackChain, getTokenRefreshSkewMs, getSessionRecovery, getAutoResume, getToastDurationMs, getPerProjectAccounts, getEmptyResponseMaxRetries, getEmptyResponseRetryDelayMs, getPidOffsetEnabled, getFetchTimeoutMs, getStreamStallTimeoutMs, getCodexTuiV2, getCodexTuiColorProfile, getCodexTuiGlyphMode, loadPluginConfig, } from "./lib/config.js";
 import { AUTH_LABELS, CODEX_BASE_URL, DUMMY_API_KEY, LOG_STAGES, PLUGIN_NAME, PROVIDER_ID, ACCOUNT_LIMITS, } from "./lib/constants.js";
 import { initLogger, logRequest, logDebug, logInfo, logWarn, logError, setCorrelationId, clearCorrelationId, } from "./lib/logger.js";
 import { checkAndNotify } from "./lib/auto-update-checker.js";
 import { handleContextOverflow } from "./lib/context-overflow.js";
-import { AccountManager, getAccountIdCandidates, extractAccountEmail, extractAccountId, formatAccountLabel, formatCooldown, formatWaitTime, sanitizeEmail, selectBestAccountCandidate, shouldUpdateAccountIdFromToken, resolveRequestAccountId, parseRateLimitReason, } from "./lib/accounts.js";
-import { getStoragePath, loadAccounts, saveAccounts, clearAccounts, setStoragePath, exportAccounts, importAccounts, loadFlaggedAccounts, saveFlaggedAccounts, clearFlaggedAccounts, StorageError, formatStorageErrorHint, } from "./lib/storage.js";
+import { AccountManager, getAccountIdCandidates, extractAccountEmail, extractAccountId, formatAccountLabel, formatCooldown, formatWaitTime, sanitizeEmail, selectBestAccountCandidate, shouldUpdateAccountIdFromToken, resolveRequestAccountId, parseRateLimitReason, lookupCodexCliTokensByEmail, } from "./lib/accounts.js";
+import { getStoragePath, loadAccounts, saveAccounts, withAccountStorageTransaction, clearAccounts, setStoragePath, exportAccounts, importAccounts, loadFlaggedAccounts, saveFlaggedAccounts, clearFlaggedAccounts, StorageError, formatStorageErrorHint, } from "./lib/storage.js";
 import { createCodexHeaders, extractRequestUrl, handleErrorResponse, handleSuccessResponse, getUnsupportedCodexModelInfo, resolveUnsupportedCodexFallbackModel, refreshAndUpdateToken, rewriteUrlForCodex, shouldRefreshToken, transformRequestForCodex, } from "./lib/request/fetch-helpers.js";
 import { applyFastSessionDefaults } from "./lib/request/request-transformer.js";
 import { getRateLimitBackoff, RATE_LIMIT_SHORT_RETRY_THRESHOLD_MS, resetRateLimitBackoff, } from "./lib/request/rate-limit-backoff.js";
@@ -43,7 +43,7 @@ import { addJitter } from "./lib/rotation.js";
 import { buildTableHeader, buildTableRow } from "./lib/table-formatter.js";
 import { setUiRuntimeOptions } from "./lib/ui/runtime.js";
 import { paintUiText, formatUiBadge, formatUiHeader, formatUiItem, formatUiKeyValue, formatUiSection } from "./lib/ui/format.js";
-import { getModelFamily, MODEL_FAMILIES, prewarmCodexInstructions, } from "./lib/prompts/codex.js";
+import { getModelFamily, getCodexInstructions, MODEL_FAMILIES, prewarmCodexInstructions, } from "./lib/prompts/codex.js";
 import { prewarmOpenCodeCodexPrompt } from "./lib/prompts/opencode-codex.js";
 import { createSessionRecoveryHook, isRecoverableError, detectErrorType, getRecoveryToastContent, } from "./lib/recovery.js";
 /**
@@ -124,7 +124,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
             accountLabel: choice.label,
         };
     };
-    const buildManualOAuthFlow = (pkce, url, onSuccess) => ({
+    const buildManualOAuthFlow = (pkce, url, expectedState, onSuccess) => ({
         url,
         method: "code",
         instructions: AUTH_LABELS.INSTRUCTIONS_MANUAL,
@@ -133,12 +133,29 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
             if (!parsed.code) {
                 return "No authorization code found. Paste the full callback URL (e.g., http://localhost:1455/auth/callback?code=...)";
             }
+            if (!parsed.state) {
+                return "Missing OAuth state. Paste the full callback URL including both code and state parameters.";
+            }
+            if (parsed.state !== expectedState) {
+                return "OAuth state mismatch. Restart login and paste the callback URL generated for this login attempt.";
+            }
             return undefined;
         },
         callback: async (input) => {
             const parsed = parseAuthorizationInput(input);
-            if (!parsed.code) {
-                return { type: "failed", reason: "invalid_response", message: "No authorization code provided" };
+            if (!parsed.code || !parsed.state) {
+                return {
+                    type: "failed",
+                    reason: "invalid_response",
+                    message: "Missing authorization code or OAuth state",
+                };
+            }
+            if (parsed.state !== expectedState) {
+                return {
+                    type: "failed",
+                    reason: "invalid_response",
+                    message: "OAuth state mismatch. Restart login and try again.",
+                };
             }
             const tokens = await exchangeAuthorizationCode(parsed.code, pkce.verifier, REDIRECT_URI);
             if (tokens?.type === "success") {
@@ -182,117 +199,123 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
     const persistAccountPool = async (results, replaceAll = false) => {
         if (results.length === 0)
             return;
-        const now = Date.now();
-        const stored = replaceAll ? null : await loadAccounts();
-        const accounts = stored?.accounts ? [...stored.accounts] : [];
-        const indexByRefreshToken = new Map();
-        const indexByAccountId = new Map();
-        const indexByEmail = new Map();
-        for (let i = 0; i < accounts.length; i += 1) {
-            const account = accounts[i];
-            if (!account)
-                continue;
-            if (account.refreshToken) {
-                indexByRefreshToken.set(account.refreshToken, i);
-            }
-            if (account.accountId) {
-                indexByAccountId.set(account.accountId, i);
-            }
-            if (account.email) {
-                indexByEmail.set(account.email, i);
+        await withAccountStorageTransaction(async (loadedStorage, persist) => {
+            const now = Date.now();
+            const stored = replaceAll ? null : loadedStorage;
+            const accounts = stored?.accounts ? [...stored.accounts] : [];
+            const indexByRefreshToken = new Map();
+            const indexByAccountId = new Map();
+            const indexByEmail = new Map();
+            for (let i = 0; i < accounts.length; i += 1) {
+                const account = accounts[i];
+                if (!account)
+                    continue;
+                if (account.refreshToken) {
+                    indexByRefreshToken.set(account.refreshToken, i);
+                }
+                if (account.accountId) {
+                    indexByAccountId.set(account.accountId, i);
+                }
+                if (account.email) {
+                    indexByEmail.set(account.email, i);
+                }
             }
-        }
-        for (const result of results) {
-            const accountId = result.accountIdOverride ?? extractAccountId(result.access);
-            const accountIdSource = accountId
-                ? result.accountIdSource ??
-                    (result.accountIdOverride ? "manual" : "token")
-                : undefined;
-            const accountLabel = result.accountLabel;
-            const accountEmail = sanitizeEmail(extractAccountEmail(result.access, result.idToken));
-            const existingByEmail = accountEmail && indexByEmail.has(accountEmail)
-                ? indexByEmail.get(accountEmail)
-                : undefined;
-            const existingById = accountId && indexByAccountId.has(accountId)
-                ? indexByAccountId.get(accountId)
-                : undefined;
-            const existingByToken = indexByRefreshToken.get(result.refresh);
-            const existingIndex = existingById ?? existingByEmail ?? existingByToken;
-            if (existingIndex === undefined) {
-                const newIndex = accounts.length;
-                accounts.push({
-                    accountId,
-                    accountIdSource,
-                    accountLabel,
-                    email: accountEmail,
+            for (const result of results) {
+                const accountId = result.accountIdOverride ?? extractAccountId(result.access);
+                const accountIdSource = accountId
+                    ? result.accountIdSource ??
+                        (result.accountIdOverride ? "manual" : "token")
+                    : undefined;
+                const accountLabel = result.accountLabel;
+                const accountEmail = sanitizeEmail(extractAccountEmail(result.access, result.idToken));
+                const existingByEmail = accountEmail && indexByEmail.has(accountEmail)
+                    ? indexByEmail.get(accountEmail)
+                    : undefined;
+                const existingById = accountId && indexByAccountId.has(accountId)
+                    ? indexByAccountId.get(accountId)
+                    : undefined;
+                const existingByToken = indexByRefreshToken.get(result.refresh);
+                const existingIndex = existingById ?? existingByEmail ?? existingByToken;
+                if (existingIndex === undefined) {
+                    const newIndex = accounts.length;
+                    accounts.push({
+                        accountId,
+                        accountIdSource,
+                        accountLabel,
+                        email: accountEmail,
+                        refreshToken: result.refresh,
+                        accessToken: result.access,
+                        expiresAt: result.expires,
+                        addedAt: now,
+                        lastUsed: now,
+                    });
+                    indexByRefreshToken.set(result.refresh, newIndex);
+                    if (accountId) {
+                        indexByAccountId.set(accountId, newIndex);
+                    }
+                    if (accountEmail) {
+                        indexByEmail.set(accountEmail, newIndex);
+                    }
+                    continue;
+                }
+                const existing = accounts[existingIndex];
+                if (!existing)
+                    continue;
+                const oldToken = existing.refreshToken;
+                const oldEmail = existing.email;
+                const nextEmail = accountEmail ?? existing.email;
+                const nextAccountId = accountId ?? existing.accountId;
+                const nextAccountIdSource = accountId ? accountIdSource ?? existing.accountIdSource : existing.accountIdSource;
+                const nextAccountLabel = accountLabel ?? existing.accountLabel;
+                accounts[existingIndex] = {
+                    ...existing,
+                    accountId: nextAccountId,
+                    accountIdSource: nextAccountIdSource,
+                    accountLabel: nextAccountLabel,
+                    email: nextEmail,
                     refreshToken: result.refresh,
-                    addedAt: now,
+                    accessToken: result.access,
+                    expiresAt: result.expires,
                     lastUsed: now,
-                });
-                indexByRefreshToken.set(result.refresh, newIndex);
+                };
+                if (oldToken !== result.refresh) {
+                    indexByRefreshToken.delete(oldToken);
+                    indexByRefreshToken.set(result.refresh, existingIndex);
+                }
                 if (accountId) {
-                    indexByAccountId.set(accountId, newIndex);
+                    indexByAccountId.set(accountId, existingIndex);
                 }
-                if (accountEmail) {
-                    indexByEmail.set(accountEmail, newIndex);
+                if (oldEmail && oldEmail !== nextEmail) {
+                    indexByEmail.delete(oldEmail);
+                }
+                if (nextEmail) {
+                    indexByEmail.set(nextEmail, existingIndex);
                 }
-                continue;
-            }
-            const existing = accounts[existingIndex];
-            if (!existing)
-                continue;
-            const oldToken = existing.refreshToken;
-            const oldEmail = existing.email;
-            const nextEmail = accountEmail ?? existing.email;
-            const nextAccountId = accountId ?? existing.accountId;
-            const nextAccountIdSource = accountId ? accountIdSource ?? existing.accountIdSource : existing.accountIdSource;
-            const nextAccountLabel = accountLabel ?? existing.accountLabel;
-            accounts[existingIndex] = {
-                ...existing,
-                accountId: nextAccountId,
-                accountIdSource: nextAccountIdSource,
-                accountLabel: nextAccountLabel,
-                email: nextEmail,
-                refreshToken: result.refresh,
-                lastUsed: now,
-            };
-            if (oldToken !== result.refresh) {
-                indexByRefreshToken.delete(oldToken);
-                indexByRefreshToken.set(result.refresh, existingIndex);
-            }
-            if (accountId) {
-                indexByAccountId.set(accountId, existingIndex);
-            }
-            if (oldEmail && oldEmail !== nextEmail) {
-                indexByEmail.delete(oldEmail);
-            }
-            if (nextEmail) {
-                indexByEmail.set(nextEmail, existingIndex);
             }
-        }
-        if (accounts.length === 0)
-            return;
-        const activeIndex = replaceAll
-            ? 0
-            : typeof stored?.activeIndex === "number" && Number.isFinite(stored.activeIndex)
-                ? stored.activeIndex
-                : 0;
-        const clampedActiveIndex = Math.max(0, Math.min(activeIndex, accounts.length - 1));
-        const activeIndexByFamily = {};
-        for (const family of MODEL_FAMILIES) {
-            const storedFamilyIndex = stored?.activeIndexByFamily?.[family];
-            const rawFamilyIndex = replaceAll
+            if (accounts.length === 0)
+                return;
+            const activeIndex = replaceAll
                 ? 0
-                : typeof storedFamilyIndex === "number" && Number.isFinite(storedFamilyIndex)
-                    ? storedFamilyIndex
-                    : clampedActiveIndex;
-            activeIndexByFamily[family] = Math.max(0, Math.min(Math.floor(rawFamilyIndex), accounts.length - 1));
-        }
-        await saveAccounts({
-            version: 3,
-            accounts,
-            activeIndex: clampedActiveIndex,
-            activeIndexByFamily,
+                : typeof stored?.activeIndex === "number" && Number.isFinite(stored.activeIndex)
+                    ? stored.activeIndex
+                    : 0;
+            const clampedActiveIndex = Math.max(0, Math.min(activeIndex, accounts.length - 1));
+            const activeIndexByFamily = {};
+            for (const family of MODEL_FAMILIES) {
+                const storedFamilyIndex = stored?.activeIndexByFamily?.[family];
+                const rawFamilyIndex = replaceAll
+                    ? 0
+                    : typeof storedFamilyIndex === "number" && Number.isFinite(storedFamilyIndex)
+                        ? storedFamilyIndex
+                        : clampedActiveIndex;
+                activeIndexByFamily[family] = Math.max(0, Math.min(Math.floor(rawFamilyIndex), accounts.length - 1));
+            }
+            await persist({
+                version: 3,
+                accounts,
+                activeIndex: clampedActiveIndex,
+                activeIndexByFamily,
+            });
         });
     };
     const showToast = async (message, variant = "success", options) => {
@@ -349,6 +372,14 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                     account.email = email;
                     changed = true;
                 }
+                if (refreshed.access && refreshed.access !== account.accessToken) {
+                    account.accessToken = refreshed.access;
+                    changed = true;
+                }
+                if (typeof refreshed.expires === "number" && refreshed.expires !== account.expiresAt) {
+                    account.expiresAt = refreshed.expires;
+                    changed = true;
+                }
                 if (refreshed.refresh && refreshed.refresh !== account.refreshToken) {
                     account.refreshToken = refreshed.refresh;
                     changed = true;
@@ -434,16 +465,31 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                     return;
                 }
                 const index = props.index ?? props.accountIndex;
-                if (typeof index === "number" && cachedAccountManager) {
-                    // Convert 1-based index (UI) to 0-based index (internal) if needed,
-                    // or handle 0-based directly. Usually UI lists are 0-based in code but 1-based in display.
-                    // AccountManager.setActiveIndex expects 0-based index.
-                    // Assuming the event passes the raw index from the list.
-                    const account = cachedAccountManager.setActiveIndex(index);
+                if (typeof index === "number") {
+                    const storage = await loadAccounts();
+                    if (!storage || index < 0 || index >= storage.accounts.length) {
+                        return;
+                    }
+                    const now = Date.now();
+                    const account = storage.accounts[index];
                     if (account) {
-                        await cachedAccountManager.saveToDisk();
-                        await showToast(`Switched to account ${index + 1}`, "info");
+                        account.lastUsed = now;
+                        account.lastSwitchReason = "rotation";
+                    }
+                    storage.activeIndex = index;
+                    storage.activeIndexByFamily = storage.activeIndexByFamily ?? {};
+                    for (const family of MODEL_FAMILIES) {
+                        storage.activeIndexByFamily[family] = index;
+                    }
+                    await saveAccounts(storage);
+                    // Reload manager from disk so we don't overwrite newer rotated
+                    // refresh tokens with stale in-memory state.
+                    if (cachedAccountManager) {
+                        const reloadedManager = await AccountManager.loadFromDisk();
+                        cachedAccountManager = reloadedManager;
+                        accountManagerPromise = Promise.resolve(reloadedManager);
                     }
+                    await showToast(`Switched to account ${index + 1}`, "info");
                 }
             }
         }
@@ -473,6 +519,10 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
              */
             async loader(getAuth, provider) {
                 const auth = await getAuth();
+                const pluginConfig = loadPluginConfig();
+                applyUiRuntimeFromConfig(pluginConfig);
+                const perProjectAccounts = getPerProjectAccounts(pluginConfig);
+                setStoragePath(perProjectAccounts ? process.cwd() : null);
                 // Only handle OAuth auth type, skip API key auth
                 if (auth.type !== "oauth") {
                     return {};
@@ -497,7 +547,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                     if (!accountManagerPromise) {
                         accountManagerPromise = AccountManager.loadFromDisk(auth);
                     }
-                    const accountManager = await accountManagerPromise;
+                    let accountManager = await accountManagerPromise;
                     cachedAccountManager = accountManager;
                     const refreshToken = auth.type === "oauth" ? auth.refresh : "";
                     const needsPersist = refreshToken &&
@@ -517,9 +567,9 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                     };
                     // Load plugin configuration and determine CODEX_MODE
                     // Priority: CODEX_MODE env var > config file > default (true)
-                    const pluginConfig = loadPluginConfig();
-                    applyUiRuntimeFromConfig(pluginConfig);
                     const codexMode = getCodexMode(pluginConfig);
+                    const requestTransformMode = getRequestTransformMode(pluginConfig);
+                    const useLegacyRequestTransform = requestTransformMode === "legacy";
                     const fastSessionEnabled = getFastSession(pluginConfig);
                     const fastSessionStrategy = getFastSessionStrategy(pluginConfig);
                     const fastSessionMaxInputItems = getFastSessionMaxInputItems(pluginConfig);
@@ -533,12 +583,8 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                     const fallbackToGpt52OnUnsupportedGpt53 = getFallbackToGpt52OnUnsupportedGpt53(pluginConfig);
                     const unsupportedCodexFallbackChain = getUnsupportedCodexFallbackChain(pluginConfig);
                     const toastDurationMs = getToastDurationMs(pluginConfig);
-                    const perProjectAccounts = getPerProjectAccounts(pluginConfig);
                     const fetchTimeoutMs = getFetchTimeoutMs(pluginConfig);
                     const streamStallTimeoutMs = getStreamStallTimeoutMs(pluginConfig);
-                    if (perProjectAccounts) {
-                        setStoragePath(process.cwd());
-                    }
                     const sessionRecoveryEnabled = getSessionRecovery(pluginConfig);
                     const autoResumeEnabled = getAutoResume(pluginConfig);
                     const emptyResponseMaxRetries = getEmptyResponseMaxRetries(pluginConfig);
@@ -559,7 +605,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                     const prewarmEnabled = process.env.CODEX_AUTH_PREWARM !== "0" &&
                         process.env.VITEST !== "true" &&
                         process.env.NODE_ENV !== "test";
-                    if (!startupPrewarmTriggered && prewarmEnabled) {
+                    if (!startupPrewarmTriggered && prewarmEnabled && useLegacyRequestTransform) {
                         startupPrewarmTriggered = true;
                         const configuredModels = Object.keys(userConfig.models ?? {});
                         prewarmCodexInstructions(configuredModels);
@@ -596,6 +642,9 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                          */
                         async fetch(input, init) {
                             try {
+                                if (cachedAccountManager && cachedAccountManager !== accountManager) {
+                                    accountManager = cachedAccountManager;
+                                }
                                 // Step 1: Extract and rewrite URL for Codex backend
                                 const originalUrl = extractRequestUrl(input);
                                 const url = rewriteUrlForCodex(originalUrl);
@@ -660,6 +709,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                     fastSession: fastSessionEnabled,
                                     fastSessionStrategy,
                                     fastSessionMaxInputItems,
+                                    requestTransformMode,
                                 });
                                 let requestInit = transformation?.updatedInit ?? baseInit;
                                 let transformedBody = transformation?.body;
@@ -720,6 +770,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                 while (true) {
                                     const accountCount = accountManager.getAccountCount();
                                     const attempted = new Set();
+                                    let restartAccountTraversalWithFallback = false;
                                     while (attempted.size < Math.max(1, accountCount)) {
                                         const account = accountManager.getCurrentOrNextForFamilyHybrid(modelFamily, model, { pidOffsetEnabled });
                                         if (!account || attempted.has(account.index)) {
@@ -775,12 +826,20 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                             await showToast(`Using ${accountLabel} (${account.index + 1}/${accountCount})`, "info");
                                             accountManager.markToastShown(account.index);
                                         }
-                                        let headers = createCodexHeaders(requestInit, accountId, accountAuth.access, {
+                                        const headers = createCodexHeaders(requestInit, accountId, accountAuth.access, {
                                             model,
                                             promptCacheKey,
                                         });
                                         // Consume a token before making the request for proactive rate limiting
-                                        accountManager.consumeToken(account, modelFamily, model);
+                                        const tokenConsumed = accountManager.consumeToken(account, modelFamily, model);
+                                        if (!tokenConsumed) {
+                                            accountManager.recordRateLimit(account, modelFamily, model);
+                                            runtimeMetrics.accountRotations++;
+                                            runtimeMetrics.lastError =
+                                                `Local token bucket depleted for account ${account.index + 1} (${modelFamily}${model ? `:${model}` : ""})`;
+                                            logWarn(`Skipping account ${account.index + 1}: local token bucket depleted for ${modelFamily}${model ? `:${model}` : ""}`);
+                                            break;
+                                        }
                                         while (true) {
                                             let response;
                                             const fetchStart = performance.now();
@@ -868,7 +927,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                                     customChain: unsupportedCodexFallbackChain,
                                                 });
                                                 if (fallbackModel) {
-                                                    const previousModel = model ?? "gpt-5.3-codex";
+                                                    const previousModel = model ?? "gpt-5-codex";
                                                     const previousModelFamily = modelFamily;
                                                     attemptedUnsupportedFallbackModels.add(previousModel);
                                                     attemptedUnsupportedFallbackModels.add(fallbackModel);
@@ -896,11 +955,6 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                                         ...(requestInit ?? {}),
                                                         body: JSON.stringify(transformedBody),
                                                     };
-                                                    headers = createCodexHeaders(requestInit, accountId, accountAuth.access, {
-                                                        model,
-                                                        promptCacheKey,
-                                                    });
-                                                    accountManager.consumeToken(account, modelFamily, model);
                                                     runtimeMetrics.lastError = `Model fallback: ${previousModel} -> ${model}`;
                                                     logWarn(`Model ${previousModel} is unsupported for this ChatGPT account. Falling back to ${model}.`, {
                                                         unsupportedCodexPolicy,
@@ -910,7 +964,8 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                                         fallbackReason: "unsupported-model-entitlement",
                                                     });
                                                     await showToast(`Model ${previousModel} is not available for this account. Retrying with ${model}.`, "warning", { duration: toastDurationMs });
-                                                    continue;
+                                                    restartAccountTraversalWithFallback = true;
+                                                    break;
                                                 }
                                                 if (unsupportedModelInfo.isUnsupported && !fallbackOnUnsupportedCodexModel) {
                                                     const blockedModel = unsupportedModelInfo.unsupportedModel ?? model ?? "requested model";
@@ -975,6 +1030,11 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                             const successResponse = await handleSuccessResponse(response, isStreaming, {
                                                 streamStallTimeoutMs,
                                             });
+                                            if (!successResponse.ok) {
+                                                runtimeMetrics.failedRequests++;
+                                                runtimeMetrics.lastError = `HTTP ${successResponse.status}`;
+                                                return successResponse;
+                                            }
                                             if (!isStreaming && emptyResponseMaxRetries > 0) {
                                                 const clonedResponse = successResponse.clone();
                                                 try {
@@ -1003,6 +1063,12 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                             runtimeMetrics.lastError = null;
                                             return successResponse;
                                         }
+                                        if (restartAccountTraversalWithFallback) {
+                                            break;
+                                        }
+                                    }
+                                    if (restartAccountTraversalWithFallback) {
+                                        continue;
                                     }
                                     const waitMs = accountManager.getMinWaitTimeForFamily(modelFamily, model);
                                     const count = accountManager.getAccountCount();
@@ -1052,9 +1118,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                         const authPluginConfig = loadPluginConfig();
                         applyUiRuntimeFromConfig(authPluginConfig);
                         const authPerProjectAccounts = getPerProjectAccounts(authPluginConfig);
-                        if (authPerProjectAccounts) {
-                            setStoragePath(process.cwd());
-                        }
+                        setStoragePath(authPerProjectAccounts ? process.cwd() : null);
                         const accounts = [];
                         const noBrowser = inputs?.noBrowser === "true" ||
                             inputs?.["no-browser"] === "true";
@@ -1091,6 +1155,211 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                 message.includes("invalid refresh") ||
                                 message.includes("token has been revoked"));
                         };
+                        const parseFiniteNumberHeader = (headers, name) => {
+                            const raw = headers.get(name);
+                            if (!raw)
+                                return undefined;
+                            const parsed = Number(raw);
+                            return Number.isFinite(parsed) ? parsed : undefined;
+                        };
+                        const parseFiniteIntHeader = (headers, name) => {
+                            const raw = headers.get(name);
+                            if (!raw)
+                                return undefined;
+                            const parsed = Number.parseInt(raw, 10);
+                            return Number.isFinite(parsed) ? parsed : undefined;
+                        };
+                        const parseResetAtMs = (headers, prefix) => {
+                            const resetAfterSeconds = parseFiniteIntHeader(headers, `${prefix}-reset-after-seconds`);
+                            if (typeof resetAfterSeconds === "number" &&
+                                Number.isFinite(resetAfterSeconds) &&
+                                resetAfterSeconds > 0) {
+                                return Date.now() + resetAfterSeconds * 1000;
+                            }
+                            const resetAtRaw = headers.get(`${prefix}-reset-at`);
+                            if (!resetAtRaw)
+                                return undefined;
+                            const trimmed = resetAtRaw.trim();
+                            if (/^\d+$/.test(trimmed)) {
+                                const parsedNumber = Number.parseInt(trimmed, 10);
+                                if (Number.isFinite(parsedNumber) && parsedNumber > 0) {
+                                    // Upstream sometimes returns seconds since epoch.
+                                    return parsedNumber < 10_000_000_000 ? parsedNumber * 1000 : parsedNumber;
+                                }
+                            }
+                            const parsedDate = Date.parse(trimmed);
+                            return Number.isFinite(parsedDate) ? parsedDate : undefined;
+                        };
+                        const hasCodexQuotaHeaders = (headers) => {
+                            const keys = [
+                                "x-codex-primary-used-percent",
+                                "x-codex-primary-window-minutes",
+                                "x-codex-primary-reset-at",
+                                "x-codex-primary-reset-after-seconds",
+                                "x-codex-secondary-used-percent",
+                                "x-codex-secondary-window-minutes",
+                                "x-codex-secondary-reset-at",
+                                "x-codex-secondary-reset-after-seconds",
+                            ];
+                            return keys.some((key) => headers.get(key) !== null);
+                        };
+                        const parseCodexQuotaSnapshot = (headers, status) => {
+                            if (!hasCodexQuotaHeaders(headers))
+                                return null;
+                            const primaryPrefix = "x-codex-primary";
+                            const secondaryPrefix = "x-codex-secondary";
+                            const primary = {
+                                usedPercent: parseFiniteNumberHeader(headers, `${primaryPrefix}-used-percent`),
+                                windowMinutes: parseFiniteIntHeader(headers, `${primaryPrefix}-window-minutes`),
+                                resetAtMs: parseResetAtMs(headers, primaryPrefix),
+                            };
+                            const secondary = {
+                                usedPercent: parseFiniteNumberHeader(headers, `${secondaryPrefix}-used-percent`),
+                                windowMinutes: parseFiniteIntHeader(headers, `${secondaryPrefix}-window-minutes`),
+                                resetAtMs: parseResetAtMs(headers, secondaryPrefix),
+                            };
+                            const planTypeRaw = headers.get("x-codex-plan-type");
+                            const planType = planTypeRaw && planTypeRaw.trim() ? planTypeRaw.trim() : undefined;
+                            const activeLimit = parseFiniteIntHeader(headers, "x-codex-active-limit");
+                            return { status, planType, activeLimit, primary, secondary };
+                        };
+                        const formatQuotaWindowLabel = (windowMinutes) => {
+                            if (!windowMinutes || !Number.isFinite(windowMinutes) || windowMinutes <= 0) {
+                                return "quota";
+                            }
+                            if (windowMinutes % 1440 === 0)
+                                return `${windowMinutes / 1440}d`;
+                            if (windowMinutes % 60 === 0)
+                                return `${windowMinutes / 60}h`;
+                            return `${windowMinutes}m`;
+                        };
+                        const formatResetAt = (resetAtMs) => {
+                            if (!resetAtMs || !Number.isFinite(resetAtMs) || resetAtMs <= 0)
+                                return undefined;
+                            const date = new Date(resetAtMs);
+                            if (!Number.isFinite(date.getTime()))
+                                return undefined;
+                            const now = new Date();
+                            const sameDay = now.getFullYear() === date.getFullYear() &&
+                                now.getMonth() === date.getMonth() &&
+                                now.getDate() === date.getDate();
+                            const time = date.toLocaleTimeString(undefined, {
+                                hour: "2-digit",
+                                minute: "2-digit",
+                                hour12: false,
+                            });
+                            if (sameDay)
+                                return time;
+                            const day = date.toLocaleDateString(undefined, { month: "short", day: "2-digit" });
+                            return `${time} on ${day}`;
+                        };
+                        const formatCodexQuotaLine = (snapshot) => {
+                            const summarizeWindow = (label, window) => {
+                                const used = window.usedPercent;
+                                const left = typeof used === "number" && Number.isFinite(used)
+                                    ? Math.max(0, Math.min(100, Math.round(100 - used)))
+                                    : undefined;
+                                const reset = formatResetAt(window.resetAtMs);
+                                let summary = label;
+                                if (left !== undefined)
+                                    summary = `${summary} ${left}% left`;
+                                if (reset)
+                                    summary = `${summary} (resets ${reset})`;
+                                return summary;
+                            };
+                            const primaryLabel = formatQuotaWindowLabel(snapshot.primary.windowMinutes);
+                            const secondaryLabel = formatQuotaWindowLabel(snapshot.secondary.windowMinutes);
+                            const parts = [
+                                summarizeWindow(primaryLabel, snapshot.primary),
+                                summarizeWindow(secondaryLabel, snapshot.secondary),
+                            ];
+                            if (snapshot.planType)
+                                parts.push(`plan:${snapshot.planType}`);
+                            if (typeof snapshot.activeLimit === "number" && Number.isFinite(snapshot.activeLimit)) {
+                                parts.push(`active:${snapshot.activeLimit}`);
+                            }
+                            if (snapshot.status === 429)
+                                parts.push("rate-limited");
+                            return parts.join(", ");
+                        };
+                        const fetchCodexQuotaSnapshot = async (params) => {
+                            const QUOTA_PROBE_MODELS = ["gpt-5-codex", "gpt-5.3-codex", "gpt-5.2-codex"];
+                            let lastError = null;
+                            for (const model of QUOTA_PROBE_MODELS) {
+                                try {
+                                    const instructions = await getCodexInstructions(model);
+                                    const probeBody = {
+                                        model,
+                                        stream: true,
+                                        store: false,
+                                        include: ["reasoning.encrypted_content"],
+                                        instructions,
+                                        input: [
+                                            {
+                                                type: "message",
+                                                role: "user",
+                                                content: [{ type: "input_text", text: "quota ping" }],
+                                            },
+                                        ],
+                                        reasoning: { effort: "none", summary: "auto" },
+                                        text: { verbosity: "low" },
+                                    };
+                                    const headers = createCodexHeaders(undefined, params.accountId, params.accessToken, {
+                                        model,
+                                    });
+                                    headers.set("content-type", "application/json; charset=utf-8");
+                                    const controller = new AbortController();
+                                    const timeout = setTimeout(() => controller.abort(), 15_000);
+                                    let response;
+                                    try {
+                                        response = await fetch(`${CODEX_BASE_URL}/codex/responses`, {
+                                            method: "POST",
+                                            headers,
+                                            body: JSON.stringify(probeBody),
+                                            signal: controller.signal,
+                                        });
+                                    }
+                                    finally {
+                                        clearTimeout(timeout);
+                                    }
+                                    const snapshot = parseCodexQuotaSnapshot(response.headers, response.status);
+                                    if (snapshot) {
+                                        // We only need headers; cancel the SSE stream immediately.
+                                        try {
+                                            await response.body?.cancel();
+                                        }
+                                        catch {
+                                            // Ignore cancellation failures.
+                                        }
+                                        return snapshot;
+                                    }
+                                    if (!response.ok) {
+                                        const bodyText = await response.text().catch(() => "");
+                                        let errorBody = undefined;
+                                        try {
+                                            errorBody = bodyText ? JSON.parse(bodyText) : undefined;
+                                        }
+                                        catch {
+                                            errorBody = { error: { message: bodyText } };
+                                        }
+                                        const unsupportedInfo = getUnsupportedCodexModelInfo(errorBody);
+                                        if (unsupportedInfo.isUnsupported) {
+                                            lastError = new Error(unsupportedInfo.message ?? `Model '${model}' unsupported for this account`);
+                                            continue;
+                                        }
+                                        const message = (typeof errorBody?.error?.message === "string"
+                                            ? errorBody.error?.message
+                                            : bodyText) || `HTTP ${response.status}`;
+                                        throw new Error(message);
+                                    }
+                                    lastError = new Error("Codex response did not include quota headers");
+                                }
+                                catch (error) {
+                                    lastError = error instanceof Error ? error : new Error(String(error));
+                                }
+                            }
+                            throw lastError ?? new Error("Failed to fetch quotas");
+                        };
                         const runAccountCheck = async (deepProbe) => {
                             const loadedStorage = await hydrateEmails(await loadAccounts());
                             const workingStorage = loadedStorage
@@ -1114,7 +1383,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                             let ok = 0;
                             let disabled = 0;
                             let errors = 0;
-                            console.log(`\nChecking ${deepProbe ? "full account health" : "quotas (fast refresh)"} for all accounts...\n`);
+                            console.log(`\nChecking ${deepProbe ? "full account health" : "quotas"} for all accounts...\n`);
                             for (let i = 0; i < total; i += 1) {
                                 const account = workingStorage.accounts[i];
                                 if (!account)
@@ -1126,52 +1395,149 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                     continue;
                                 }
                                 try {
-                                    const refreshResult = await queuedRefresh(account.refreshToken);
-                                    if (refreshResult.type !== "success") {
-                                        errors += 1;
-                                        const message = refreshResult.message ?? refreshResult.reason ?? "refresh failed";
-                                        console.log(`[${i + 1}/${total}] ${label}: ERROR (${message})`);
-                                        if (isFlaggableFailure(refreshResult)) {
-                                            const existingIndex = flaggedStorage.accounts.findIndex((flagged) => flagged.refreshToken === account.refreshToken);
-                                            const flaggedRecord = {
-                                                ...account,
-                                                flaggedAt: Date.now(),
-                                                flaggedReason: "token-invalid",
-                                                lastError: message,
-                                            };
-                                            if (existingIndex >= 0) {
-                                                flaggedStorage.accounts[existingIndex] = flaggedRecord;
+                                    // If we already have a valid cached access token, don't force-refresh.
+                                    // This avoids flagging accounts where the refresh token has been burned
+                                    // but the access token is still valid (same behavior as Codex CLI).
+                                    const nowMs = Date.now();
+                                    let accessToken = null;
+                                    let tokenAccountId = undefined;
+                                    let authDetail = "OK";
+                                    if (account.accessToken &&
+                                        (typeof account.expiresAt !== "number" ||
+                                            !Number.isFinite(account.expiresAt) ||
+                                            account.expiresAt > nowMs)) {
+                                        accessToken = account.accessToken;
+                                        authDetail = "OK (cached access)";
+                                        tokenAccountId = extractAccountId(account.accessToken);
+                                        if (tokenAccountId &&
+                                            shouldUpdateAccountIdFromToken(account.accountIdSource, account.accountId) &&
+                                            tokenAccountId !== account.accountId) {
+                                            account.accountId = tokenAccountId;
+                                            account.accountIdSource = "token";
+                                            storageChanged = true;
+                                        }
+                                    }
+                                    // If Codex CLI has a valid cached access token for this email, use it
+                                    // instead of forcing a refresh.
+                                    if (!accessToken) {
+                                        const cached = await lookupCodexCliTokensByEmail(account.email);
+                                        if (cached &&
+                                            (typeof cached.expiresAt !== "number" ||
+                                                !Number.isFinite(cached.expiresAt) ||
+                                                cached.expiresAt > nowMs)) {
+                                            accessToken = cached.accessToken;
+                                            authDetail = "OK (Codex CLI cache)";
+                                            if (cached.refreshToken && cached.refreshToken !== account.refreshToken) {
+                                                account.refreshToken = cached.refreshToken;
+                                                storageChanged = true;
                                             }
-                                            else {
-                                                flaggedStorage.accounts.push(flaggedRecord);
+                                            if (cached.accessToken && cached.accessToken !== account.accessToken) {
+                                                account.accessToken = cached.accessToken;
+                                                storageChanged = true;
+                                            }
+                                            if (cached.expiresAt !== account.expiresAt) {
+                                                account.expiresAt = cached.expiresAt;
+                                                storageChanged = true;
+                                            }
+                                            const hydratedEmail = sanitizeEmail(extractAccountEmail(cached.accessToken));
+                                            if (hydratedEmail && hydratedEmail !== account.email) {
+                                                account.email = hydratedEmail;
+                                                storageChanged = true;
+                                            }
+                                            tokenAccountId = extractAccountId(cached.accessToken);
+                                            if (tokenAccountId &&
+                                                shouldUpdateAccountIdFromToken(account.accountIdSource, account.accountId) &&
+                                                tokenAccountId !== account.accountId) {
+                                                account.accountId = tokenAccountId;
+                                                account.accountIdSource = "token";
+                                                storageChanged = true;
                                             }
-                                            removeFromActive.add(account.refreshToken);
-                                            flaggedChanged = true;
                                         }
-                                        continue;
                                     }
-                                    ok += 1;
-                                    if (refreshResult.refresh !== account.refreshToken) {
-                                        account.refreshToken = refreshResult.refresh;
-                                        storageChanged = true;
+                                    if (!accessToken) {
+                                        const refreshResult = await queuedRefresh(account.refreshToken);
+                                        if (refreshResult.type !== "success") {
+                                            errors += 1;
+                                            const message = refreshResult.message ?? refreshResult.reason ?? "refresh failed";
+                                            console.log(`[${i + 1}/${total}] ${label}: ERROR (${message})`);
+                                            if (deepProbe && isFlaggableFailure(refreshResult)) {
+                                                const existingIndex = flaggedStorage.accounts.findIndex((flagged) => flagged.refreshToken === account.refreshToken);
+                                                const flaggedRecord = {
+                                                    ...account,
+                                                    flaggedAt: Date.now(),
+                                                    flaggedReason: "token-invalid",
+                                                    lastError: message,
+                                                };
+                                                if (existingIndex >= 0) {
+                                                    flaggedStorage.accounts[existingIndex] = flaggedRecord;
+                                                }
+                                                else {
+                                                    flaggedStorage.accounts.push(flaggedRecord);
+                                                }
+                                                removeFromActive.add(account.refreshToken);
+                                                flaggedChanged = true;
+                                            }
+                                            continue;
+                                        }
+                                        accessToken = refreshResult.access;
+                                        authDetail = "OK";
+                                        if (refreshResult.refresh !== account.refreshToken) {
+                                            account.refreshToken = refreshResult.refresh;
+                                            storageChanged = true;
+                                        }
+                                        if (refreshResult.access && refreshResult.access !== account.accessToken) {
+                                            account.accessToken = refreshResult.access;
+                                            storageChanged = true;
+                                        }
+                                        if (typeof refreshResult.expires === "number" &&
+                                            refreshResult.expires !== account.expiresAt) {
+                                            account.expiresAt = refreshResult.expires;
+                                            storageChanged = true;
+                                        }
+                                        const hydratedEmail = sanitizeEmail(extractAccountEmail(refreshResult.access, refreshResult.idToken));
+                                        if (hydratedEmail && hydratedEmail !== account.email) {
+                                            account.email = hydratedEmail;
+                                            storageChanged = true;
+                                        }
+                                        tokenAccountId = extractAccountId(refreshResult.access);
+                                        if (tokenAccountId &&
+                                            shouldUpdateAccountIdFromToken(account.accountIdSource, account.accountId) &&
+                                            tokenAccountId !== account.accountId) {
+                                            account.accountId = tokenAccountId;
+                                            account.accountIdSource = "token";
+                                            storageChanged = true;
+                                        }
                                     }
-                                    const hydratedEmail = sanitizeEmail(extractAccountEmail(refreshResult.access, refreshResult.idToken));
-                                    if (hydratedEmail && hydratedEmail !== account.email) {
-                                        account.email = hydratedEmail;
-                                        storageChanged = true;
+                                    if (!accessToken) {
+                                        throw new Error("Missing access token after refresh");
                                     }
-                                    const tokenAccountId = extractAccountId(refreshResult.access);
-                                    if (tokenAccountId &&
-                                        shouldUpdateAccountIdFromToken(account.accountIdSource, account.accountId) &&
-                                        tokenAccountId !== account.accountId) {
-                                        account.accountId = tokenAccountId;
-                                        account.accountIdSource = "token";
-                                        storageChanged = true;
+                                    if (deepProbe) {
+                                        ok += 1;
+                                        const detail = tokenAccountId
+                                            ? `${authDetail} (id:${tokenAccountId.slice(-6)})`
+                                            : authDetail;
+                                        console.log(`[${i + 1}/${total}] ${label}: ${detail}`);
+                                        continue;
+                                    }
+                                    try {
+                                        const requestAccountId = resolveRequestAccountId(account.accountId, account.accountIdSource, tokenAccountId) ??
+                                            tokenAccountId ??
+                                            account.accountId;
+                                        if (!requestAccountId) {
+                                            throw new Error("Missing accountId for quota probe");
+                                        }
+                                        const snapshot = await fetchCodexQuotaSnapshot({
+                                            accountId: requestAccountId,
+                                            accessToken,
+                                        });
+                                        ok += 1;
+                                        console.log(`[${i + 1}/${total}] ${label}: ${formatCodexQuotaLine(snapshot)}`);
+                                    }
+                                    catch (error) {
+                                        errors += 1;
+                                        const message = error instanceof Error ? error.message : String(error);
+                                        console.log(`[${i + 1}/${total}] ${label}: ERROR (${message.slice(0, 160)})`);
                                     }
-                                    const deepProbeDetail = deepProbe && tokenAccountId
-                                        ? `OK (id:${tokenAccountId.slice(-6)})`
-                                        : "OK";
-                                    console.log(`[${i + 1}/${total}] ${label}: ${deepProbeDetail}`);
                                 }
                                 catch (error) {
                                     errors += 1;
@@ -1213,6 +1579,33 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                     continue;
                                 const label = flagged.email ?? flagged.accountLabel ?? `Flagged ${i + 1}`;
                                 try {
+                                    const cached = await lookupCodexCliTokensByEmail(flagged.email);
+                                    const now = Date.now();
+                                    if (cached &&
+                                        typeof cached.expiresAt === "number" &&
+                                        Number.isFinite(cached.expiresAt) &&
+                                        cached.expiresAt > now) {
+                                        const refreshToken = typeof cached.refreshToken === "string" && cached.refreshToken.trim()
+                                            ? cached.refreshToken.trim()
+                                            : flagged.refreshToken;
+                                        const resolved = resolveAccountSelection({
+                                            type: "success",
+                                            access: cached.accessToken,
+                                            refresh: refreshToken,
+                                            expires: cached.expiresAt,
+                                            multiAccount: true,
+                                        });
+                                        if (!resolved.accountIdOverride && flagged.accountId) {
+                                            resolved.accountIdOverride = flagged.accountId;
+                                            resolved.accountIdSource = flagged.accountIdSource ?? "manual";
+                                        }
+                                        if (!resolved.accountLabel && flagged.accountLabel) {
+                                            resolved.accountLabel = flagged.accountLabel;
+                                        }
+                                        restored.push(resolved);
+                                        console.log(`[${i + 1}/${flaggedStorage.accounts.length}] ${label}: RESTORED (Codex CLI cache)`);
+                                        continue;
+                                    }
                                     const refreshResult = await queuedRefresh(flagged.refreshToken);
                                     if (refreshResult.type !== "success") {
                                         console.log(`[${i + 1}/${flaggedStorage.accounts.length}] ${label}: STILL FLAGGED (${refreshResult.message ?? refreshResult.reason ?? "refresh failed"})`);
@@ -1398,8 +1791,8 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                             targetCount = 1;
                         }
                         if (useManualMode) {
-                            const { pkce, url } = await createAuthorizationFlow();
-                            return buildManualOAuthFlow(pkce, url, async (tokens) => {
+                            const { pkce, state, url } = await createAuthorizationFlow();
+                            return buildManualOAuthFlow(pkce, url, state, async (tokens) => {
                                 try {
                                     await persistAccountPool([tokens], startFresh);
                                     invalidateAccountManagerCache();
@@ -1524,11 +1917,9 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                         const manualPluginConfig = loadPluginConfig();
                         applyUiRuntimeFromConfig(manualPluginConfig);
                         const manualPerProjectAccounts = getPerProjectAccounts(manualPluginConfig);
-                        if (manualPerProjectAccounts) {
-                            setStoragePath(process.cwd());
-                        }
-                        const { pkce, url } = await createAuthorizationFlow();
-                        return buildManualOAuthFlow(pkce, url, async (tokens) => {
+                        setStoragePath(manualPerProjectAccounts ? process.cwd() : null);
+                        const { pkce, state, url } = await createAuthorizationFlow();
+                        return buildManualOAuthFlow(pkce, url, state, async (tokens) => {
                             try {
                                 await persistAccountPool([tokens], false);
                             }
@@ -1710,8 +2101,9 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                         return `Switched to ${formatAccountLabel(account, targetIndex)} but failed to persist. Changes may be lost on restart.`;
                     }
                     if (cachedAccountManager) {
-                        cachedAccountManager.setActiveIndex(targetIndex);
-                        await cachedAccountManager.saveToDisk();
+                        const reloadedManager = await AccountManager.loadFromDisk();
+                        cachedAccountManager = reloadedManager;
+                        accountManagerPromise = Promise.resolve(reloadedManager);
                     }
                     const label = formatAccountLabel(account, targetIndex);
                     if (ui.v2Enabled) {
@@ -2032,12 +2424,9 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                         return `Removed ${formatAccountLabel(account, targetIndex)} from memory but failed to persist. Changes may be lost on restart.`;
                     }
                     if (cachedAccountManager) {
-                        const managedAccounts = cachedAccountManager.getAccountsSnapshot();
-                        const managedAccount = managedAccounts.find((acc) => acc.refreshToken === account.refreshToken);
-                        if (managedAccount) {
-                            cachedAccountManager.removeAccount(managedAccount);
-                            await cachedAccountManager.saveToDisk();
-                        }
+                        const reloadedManager = await AccountManager.loadFromDisk();
+                        cachedAccountManager = reloadedManager;
+                        accountManagerPromise = Promise.resolve(reloadedManager);
                     }
                     const remaining = storage.accounts.length;
                     if (ui.v2Enabled) {
@@ -2090,6 +2479,8 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                             const refreshResult = await queuedRefresh(account.refreshToken);
                             if (refreshResult.type === "success") {
                                 account.refreshToken = refreshResult.refresh;
+                                account.accessToken = refreshResult.access;
+                                account.expiresAt = refreshResult.expires;
                                 results.push(`  ${getStatusMarker(ui, "ok")} ${label}: Refreshed`);
                                 refreshedCount++;
                             }
@@ -2105,6 +2496,11 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                         }
                     }
                     await saveAccounts(storage);
+                    if (cachedAccountManager) {
+                        const reloadedManager = await AccountManager.loadFromDisk();
+                        cachedAccountManager = reloadedManager;
+                        accountManagerPromise = Promise.resolve(reloadedManager);
+                    }
                     results.push("");
                     results.push(`Summary: ${refreshedCount} refreshed, ${failedCount} failed`);
                     if (ui.v2Enabled) {