oc-chatgpt-multi-auth 5.4.2 → 5.4.4

package/config/README.md

@@ -1,88 +1,92 @@
-# Configuration
-
-This directory contains the official OpenCode config templates for the ChatGPT Codex OAuth plugin.
-
-## Required: choose the right config file
-
-| File | OpenCode version | Description |
-|------|------------------|-------------|
-| [`opencode-modern.json`](./opencode-modern.json) | **v1.0.210+** | Variant-based config: 6 base models with 21 total presets |
-| [`opencode-legacy.json`](./opencode-legacy.json) | **v1.0.209 and below** | Legacy explicit entries: 21 individual model definitions |
-
-## Quick pick
-
-If your OpenCode version is v1.0.210 or newer:
-
-```bash
-cp config/opencode-modern.json ~/.config/opencode/opencode.json
-```
-
-If your OpenCode version is v1.0.209 or older:
-
-```bash
-cp config/opencode-legacy.json ~/.config/opencode/opencode.json
-```
-
-Check your version with:
-
-```bash
-opencode --version
-```
-
-## Why there are two templates
-
-OpenCode v1.0.210+ added model `variants`, so one model entry can expose multiple reasoning levels. That keeps modern config much smaller while preserving the same effective presets.
-
-Both templates include:
-- GPT-5.4, GPT-5 Codex, GPT-5.1, GPT-5.1 Codex, GPT-5.1 Codex Max, GPT-5.1 Codex Mini
-- Reasoning variants per model family
-- `store: false` and `include: ["reasoning.encrypted_content"]`
-- Context metadata (272k context / 128k output)
-
-## Spark model note
-
-The templates intentionally do **not** include `gpt-5.3-codex-spark` by default. Spark is often entitlement-gated at the account/workspace level, so shipping it by default causes avoidable startup failures for many users.
-
-If your workspace is entitled, you can add Spark model IDs manually.
-
-## Usage examples
-
-Modern template (v1.0.210+):
-
-```bash
-opencode run "task" --model=openai/gpt-5.4 --variant=medium
-opencode run "task" --model=openai/gpt-5-codex --variant=high
-```
-
-Legacy template (v1.0.209 and below):
-
-```bash
-opencode run "task" --model=openai/gpt-5.4-medium
-opencode run "task" --model=openai/gpt-5-codex-high
-```
-
-## Minimal config (advanced)
-
-A barebones debug template is available at [`minimal-opencode.json`](./minimal-opencode.json). It omits the full preset catalog.
-
-## Unsupported-model behavior
-
-Current defaults are strict entitlement handling:
-- `unsupportedCodexPolicy: "strict"` returns entitlement errors directly
-- set `unsupportedCodexPolicy: "fallback"` (or `CODEX_AUTH_UNSUPPORTED_MODEL_POLICY=fallback`) to enable automatic fallback retries
-- `fallbackToGpt52OnUnsupportedGpt53: true` keeps the legacy `gpt-5.3-codex -> gpt-5.2-codex` edge inside fallback mode
-- `gpt-5.4-pro -> gpt-5.4` is included by default in fallback mode (relevant only if you add `gpt-5.4-pro` manually)
-- `unsupportedCodexFallbackChain` lets you override fallback order per model
-
-Default fallback chain (when policy is `fallback`):
-- `gpt-5.4-pro -> gpt-5.4` (if you manually select `gpt-5.4-pro`)
-- `gpt-5.3-codex -> gpt-5-codex -> gpt-5.2-codex`
-- `gpt-5.3-codex-spark -> gpt-5-codex -> gpt-5.3-codex -> gpt-5.2-codex` (only relevant if Spark IDs are added manually)
-- `gpt-5.2-codex -> gpt-5-codex`
-- `gpt-5.1-codex -> gpt-5-codex`
-
-## Additional docs
-
-- Main config reference: [`docs/configuration.md`](../docs/configuration.md)
-- Getting started: [`docs/getting-started.md`](../docs/getting-started.md)
-- Troubleshooting: [`docs/troubleshooting.md`](../docs/troubleshooting.md)
+# Configuration
+
+This directory contains the official OpenCode config templates for the ChatGPT Codex OAuth plugin.
+
+## Required: choose the right config file
+
+| File | OpenCode version | Description |
+|------|------------------|-------------|
+| [`opencode-modern.json`](./opencode-modern.json) | **v1.0.210+** | Variant-based config: 6 base models with 21 total presets |
+| [`opencode-legacy.json`](./opencode-legacy.json) | **v1.0.209 and below** | Legacy explicit entries: 21 individual model definitions |
+
+## Quick pick
+
+If your OpenCode version is v1.0.210 or newer:
+
+```bash
+cp config/opencode-modern.json ~/.config/opencode/opencode.json
+```
+
+If your OpenCode version is v1.0.209 or older:
+
+```bash
+cp config/opencode-legacy.json ~/.config/opencode/opencode.json
+```
+
+Check your version with:
+
+```bash
+opencode --version
+```
+
+## Why there are two templates
+
+OpenCode v1.0.210+ added model `variants`, so one model entry can expose multiple reasoning levels. That keeps modern config much smaller while preserving the same effective presets.
+
+Both templates include:
+- GPT-5.4, GPT-5 Codex, GPT-5.1, GPT-5.1 Codex, GPT-5.1 Codex Max, GPT-5.1 Codex Mini
+- Reasoning variants per model family
+- `store: false` and `include: ["reasoning.encrypted_content"]`
+- Context metadata (`gpt-5.4*`: 1,000,000 context / 128,000 output; other shipped models: 272,000 / 128,000)
+
+If your OpenCode runtime supports global compaction tuning, you can also set:
+- `model_context_window = 1000000`
+- `model_auto_compact_token_limit = 900000`
+
+## Spark model note
+
+The templates intentionally do **not** include `gpt-5.3-codex-spark` by default. Spark is often entitlement-gated at the account/workspace level, so shipping it by default causes avoidable startup failures for many users.
+
+If your workspace is entitled, you can add Spark model IDs manually.
+
+## Usage examples
+
+Modern template (v1.0.210+):
+
+```bash
+opencode run "task" --model=openai/gpt-5.4 --variant=medium
+opencode run "task" --model=openai/gpt-5-codex --variant=high
+```
+
+Legacy template (v1.0.209 and below):
+
+```bash
+opencode run "task" --model=openai/gpt-5.4-medium
+opencode run "task" --model=openai/gpt-5-codex-high
+```
+
+## Minimal config (advanced)
+
+A barebones debug template is available at [`minimal-opencode.json`](./minimal-opencode.json). It omits the full preset catalog.
+
+## Unsupported-model behavior
+
+Current defaults are strict entitlement handling:
+- `unsupportedCodexPolicy: "strict"` returns entitlement errors directly
+- set `unsupportedCodexPolicy: "fallback"` (or `CODEX_AUTH_UNSUPPORTED_MODEL_POLICY=fallback`) to enable automatic fallback retries
+- `fallbackToGpt52OnUnsupportedGpt53: true` keeps the legacy `gpt-5.3-codex -> gpt-5.2-codex` edge inside fallback mode
+- `gpt-5.4-pro -> gpt-5.4` is included by default in fallback mode (relevant only if you add `gpt-5.4-pro` manually)
+- `unsupportedCodexFallbackChain` lets you override fallback order per model
+
+Default fallback chain (when policy is `fallback`):
+- `gpt-5.4-pro -> gpt-5.4` (if you manually select `gpt-5.4-pro`)
+- `gpt-5.3-codex -> gpt-5-codex -> gpt-5.2-codex`
+- `gpt-5.3-codex-spark -> gpt-5-codex -> gpt-5.3-codex -> gpt-5.2-codex` (only relevant if Spark IDs are added manually)
+- `gpt-5.2-codex -> gpt-5-codex`
+- `gpt-5.1-codex -> gpt-5-codex`
+
+## Additional docs
+
+- Main config reference: [`docs/configuration.md`](../docs/configuration.md)
+- Getting started: [`docs/getting-started.md`](../docs/getting-started.md)
+- Troubleshooting: [`docs/troubleshooting.md`](../docs/troubleshooting.md)

package/config/opencode-legacy.json

@@ -18,7 +18,7 @@
         "gpt-5.4-none": {
           "name": "GPT 5.4 None (OAuth)",
           "limit": {
-            "context": 272000,
+            "context": 1000000,
             "output": 128000
           },
           "modalities": {
@@ -43,7 +43,7 @@
         "gpt-5.4-low": {
           "name": "GPT 5.4 Low (OAuth)",
           "limit": {
-            "context": 272000,
+            "context": 1000000,
             "output": 128000
           },
           "modalities": {
@@ -68,7 +68,7 @@
         "gpt-5.4-medium": {
           "name": "GPT 5.4 Medium (OAuth)",
           "limit": {
-            "context": 272000,
+            "context": 1000000,
             "output": 128000
           },
           "modalities": {
@@ -93,7 +93,7 @@
         "gpt-5.4-high": {
           "name": "GPT 5.4 High (OAuth)",
           "limit": {
-            "context": 272000,
+            "context": 1000000,
             "output": 128000
           },
           "modalities": {
@@ -118,7 +118,7 @@
         "gpt-5.4-xhigh": {
           "name": "GPT 5.4 Extra High (OAuth)",
           "limit": {
-            "context": 272000,
+            "context": 1000000,
             "output": 128000
           },
           "modalities": {

package/config/opencode-modern.json

@@ -18,7 +18,7 @@
         "gpt-5.4": {
           "name": "GPT 5.4 (OAuth)",
           "limit": {
-            "context": 272000,
+            "context": 1000000,
             "output": 128000
           },
           "modalities": {

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAe,MAAM,qBAAqB,CAAC;AA+J/D;;;;;;;;;;;;;;;GAeG;AAEH,eAAO,MAAM,iBAAiB,EAAE,MAyuK/B,CAAC;AAEF,eAAO,MAAM,gBAAgB,QAAoB,CAAC;AAElD,eAAe,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAe,MAAM,qBAAqB,CAAC;AA+J/D;;;;;;;;;;;;;;;GAeG;AAEH,eAAO,MAAM,iBAAiB,EAAE,MA6rL/B,CAAC;AAEF,eAAO,MAAM,gBAAgB,QAAoB,CAAC;AAElD,eAAe,iBAAiB,CAAC"}

package/dist/index.js

@@ -1407,7 +1407,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                 const originalUrl = extractRequestUrl(input);
                                 const url = rewriteUrlForCodex(originalUrl);
                                 // Step 3: Transform request body with model-specific Codex instructions
-                                // Instructions are fetched per model family (codex-max, codex, gpt-5.1)
+                                // Instructions are fetched per model family (codex-max, codex, gpt-5.4, etc.)
                                 // Capture original stream value before transformation
                                 // generateText() sends no stream field, streamText() sends stream=true
                                 const normalizeRequestInit = async (requestInput, requestInit) => {
@@ -1473,7 +1473,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                 let transformedBody = transformation?.body;
                                 const promptCacheKey = transformedBody?.prompt_cache_key;
                                 let model = transformedBody?.model;
-                                let modelFamily = model ? getModelFamily(model) : "gpt-5.1";
+                                let modelFamily = model ? getModelFamily(model) : "gpt-5.4";
                                 let quotaKey = model ? `${modelFamily}:${model}` : modelFamily;
                                 const threadIdCandidate = (process.env.CODEX_THREAD_ID ?? promptCacheKey ?? "")
                                     .toString()
@@ -3215,6 +3215,372 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                     return lines.join("\n");
                 },
             }),
+            "codex-limits": tool({
+                description: "Show live 5-hour and weekly Codex usage limits for all accounts.",
+                args: {},
+                async execute() {
+                    const ui = resolveUiRuntime();
+                    const storage = await loadAccounts();
+                    if (!storage || storage.accounts.length === 0) {
+                        if (ui.v2Enabled) {
+                            return [
+                                ...formatUiHeader(ui, "Codex limits"),
+                                "",
+                                formatUiItem(ui, "No accounts configured.", "warning"),
+                                formatUiItem(ui, "Run: opencode auth login", "accent"),
+                            ].join("\n");
+                        }
+                        return "No Codex accounts configured. Run: opencode auth login";
+                    }
+                    const formatWindowLabel = (windowMinutes) => {
+                        if (!windowMinutes || !Number.isFinite(windowMinutes) || windowMinutes <= 0) {
+                            return "quota";
+                        }
+                        if (windowMinutes % 1440 === 0)
+                            return `${windowMinutes / 1440}d`;
+                        if (windowMinutes % 60 === 0)
+                            return `${windowMinutes / 60}h`;
+                        return `${windowMinutes}m`;
+                    };
+                    const formatReset = (resetAtMs) => {
+                        if (!resetAtMs || !Number.isFinite(resetAtMs) || resetAtMs <= 0)
+                            return undefined;
+                        const date = new Date(resetAtMs);
+                        if (!Number.isFinite(date.getTime()))
+                            return undefined;
+                        const now = new Date();
+                        const sameDay = now.getFullYear() === date.getFullYear() &&
+                            now.getMonth() === date.getMonth() &&
+                            now.getDate() === date.getDate();
+                        const time = date.toLocaleTimeString(undefined, {
+                            hour: "2-digit",
+                            minute: "2-digit",
+                            hour12: false,
+                        });
+                        if (sameDay)
+                            return time;
+                        const day = date.toLocaleDateString(undefined, { month: "short", day: "2-digit" });
+                        return `${time} on ${day}`;
+                    };
+                    const mapWindow = (window) => {
+                        if (!window)
+                            return {};
+                        return {
+                            usedPercent: typeof window.used_percent === "number" && Number.isFinite(window.used_percent)
+                                ? window.used_percent
+                                : undefined,
+                            windowMinutes: typeof window.limit_window_seconds === "number" && Number.isFinite(window.limit_window_seconds)
+                                ? Math.max(1, Math.ceil(window.limit_window_seconds / 60))
+                                : undefined,
+                            resetAtMs: typeof window.reset_at === "number" && window.reset_at > 0
+                                ? window.reset_at * 1000
+                                : typeof window.reset_after_seconds === "number" && window.reset_after_seconds > 0
+                                    ? Date.now() + window.reset_after_seconds * 1000
+                                    : undefined,
+                        };
+                    };
+                    const formatLimitTitle = (windowMinutes, fallback = "quota") => {
+                        if (windowMinutes === 300)
+                            return "5h limit";
+                        if (windowMinutes === 10080)
+                            return "Weekly limit";
+                        if (fallback !== "quota")
+                            return fallback;
+                        return `${formatWindowLabel(windowMinutes)} limit`;
+                    };
+                    const formatLimitSummary = (window) => {
+                        const used = window.usedPercent;
+                        const left = typeof used === "number" && Number.isFinite(used)
+                            ? Math.max(0, Math.min(100, Math.round(100 - used)))
+                            : undefined;
+                        const reset = formatReset(window.resetAtMs);
+                        if (left !== undefined && reset)
+                            return `${left}% left (resets ${reset})`;
+                        if (left !== undefined)
+                            return `${left}% left`;
+                        if (reset)
+                            return `resets ${reset}`;
+                        return "unavailable";
+                    };
+                    const formatCredits = (credits) => {
+                        if (!credits)
+                            return undefined;
+                        if (credits.unlimited)
+                            return "unlimited";
+                        if (typeof credits.balance === "string" && credits.balance.trim()) {
+                            return credits.balance.trim();
+                        }
+                        if (credits.has_credits)
+                            return "available";
+                        return undefined;
+                    };
+                    const formatExtraName = (name) => {
+                        if (!name)
+                            return "Additional limit";
+                        if (name === "code_review_rate_limit")
+                            return "Code review";
+                        return name.replace(/[_-]+/g, " ").replace(/\b\w/g, (match) => match.toUpperCase());
+                    };
+                    const sanitizeUsageErrorMessage = (status, bodyText) => {
+                        const normalized = bodyText.replace(/\s+/g, " ").trim();
+                        const redacted = normalized
+                            .replace(/Bearer\s+\S+/gi, "Bearer [redacted]")
+                            .replace(/eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g, "[redacted-token]")
+                            .replace(/\bsk-[A-Za-z0-9][A-Za-z0-9._:-]{19,}\b/gi, "[redacted-token]")
+                            .replace(/\b[a-f0-9]{40,}\b/gi, "[redacted-token]");
+                        return redacted ? `HTTP ${status}: ${redacted.slice(0, 200)}` : `HTTP ${status}`;
+                    };
+                    const isAbortError = (error) => (error instanceof Error && error.name === "AbortError") ||
+                        (typeof DOMException !== "undefined" && error instanceof DOMException && error.name === "AbortError");
+                    const applyRefreshedCredentials = (target, result) => {
+                        target.refreshToken = result.refresh;
+                        target.accessToken = result.access;
+                        target.expiresAt = result.expires;
+                    };
+                    const usageErrorBodyMaxChars = 4096;
+                    const persistRefreshedCredentials = async (params) => {
+                        return await withAccountStorageTransaction(async (current, persist) => {
+                            const latestStorage = current ??
+                                {
+                                    version: 3,
+                                    accounts: [],
+                                    activeIndex: 0,
+                                    activeIndexByFamily: {},
+                                };
+                            const uniqueMatch = (matches) => matches.length === 1 ? matches[0] : undefined;
+                            let updated = false;
+                            if (params.previousRefreshToken) {
+                                for (const storedAccount of latestStorage.accounts) {
+                                    if (storedAccount.refreshToken === params.previousRefreshToken) {
+                                        applyRefreshedCredentials(storedAccount, params.refreshResult);
+                                        updated = true;
+                                    }
+                                }
+                            }
+                            if (!updated) {
+                                const normalizedOrganizationId = params.organizationId?.trim() ?? "";
+                                const normalizedEmail = params.email?.trim().toLowerCase();
+                                const orgScopedMatches = params.accountId
+                                    ? latestStorage.accounts.filter((storedAccount) => storedAccount.accountId === params.accountId &&
+                                        (storedAccount.organizationId?.trim() ?? "") === normalizedOrganizationId)
+                                    : [];
+                                const accountIdMatches = params.accountId
+                                    ? latestStorage.accounts.filter((storedAccount) => storedAccount.accountId === params.accountId)
+                                    : [];
+                                const emailMatches = normalizedEmail && !params.accountId
+                                    ? latestStorage.accounts.filter((storedAccount) => storedAccount.email?.trim().toLowerCase() === normalizedEmail)
+                                    : [];
+                                const fallbackTarget = uniqueMatch(orgScopedMatches) ??
+                                    uniqueMatch(accountIdMatches) ??
+                                    uniqueMatch(emailMatches);
+                                if (fallbackTarget) {
+                                    applyRefreshedCredentials(fallbackTarget, params.refreshResult);
+                                    updated = true;
+                                }
+                            }
+                            if (updated) {
+                                await persist(latestStorage);
+                            }
+                            if (!updated) {
+                                logWarn(`[${PLUGIN_NAME}] persistRefreshedCredentials could not find a matching stored account. Refreshed credentials remain in-memory for this invocation only.`, {
+                                    accountId: params.accountId,
+                                    organizationId: params.organizationId,
+                                });
+                            }
+                            return updated;
+                        });
+                    };
+                    const usageFetchTimeoutMs = getFetchTimeoutMs(loadPluginConfig());
+                    const fetchUsage = async (params) => {
+                        const headers = createCodexHeaders(undefined, params.accountId, params.accessToken, {
+                            organizationId: params.organizationId,
+                        });
+                        headers.set("accept", "application/json");
+                        const controller = new AbortController();
+                        const timeout = setTimeout(() => controller.abort(), usageFetchTimeoutMs);
+                        try {
+                            const response = await fetch(`${CODEX_BASE_URL}/wham/usage`, {
+                                method: "GET",
+                                headers,
+                                signal: controller.signal,
+                            });
+                            if (!response.ok) {
+                                let bodyText = "";
+                                try {
+                                    bodyText = (await response.text()).slice(0, usageErrorBodyMaxChars);
+                                }
+                                catch (error) {
+                                    if (isAbortError(error) || controller.signal.aborted) {
+                                        throw new Error("Usage request timed out");
+                                    }
+                                    throw error;
+                                }
+                                if (controller.signal.aborted) {
+                                    throw new Error("Usage request timed out");
+                                }
+                                throw new Error(sanitizeUsageErrorMessage(response.status, bodyText));
+                            }
+                            return (await response.json());
+                        }
+                        catch (error) {
+                            if (isAbortError(error)) {
+                                throw new Error("Usage request timed out");
+                            }
+                            throw error;
+                        }
+                        finally {
+                            clearTimeout(timeout);
+                        }
+                    };
+                    // Deduplicate accounts by refreshToken (same credential = same limits)
+                    const seenTokens = new Set();
+                    const uniqueIndices = [];
+                    for (let i = 0; i < storage.accounts.length; i++) {
+                        const acct = storage.accounts[i];
+                        if (!acct)
+                            continue;
+                        const refreshToken = typeof acct.refreshToken === "string" ? acct.refreshToken.trim() : "";
+                        if (refreshToken && seenTokens.has(refreshToken))
+                            continue;
+                        if (refreshToken)
+                            seenTokens.add(refreshToken);
+                        uniqueIndices.push(i);
+                    }
+                    const lines = ui.v2Enabled
+                        ? [...formatUiHeader(ui, "Codex limits"), ""]
+                        : [`Codex limits (${uniqueIndices.length} account${uniqueIndices.length === 1 ? "" : "s"}):`, ""];
+                    const activeIndex = resolveActiveIndex(storage, "codex");
+                    const activeRefreshToken = typeof activeIndex === "number" && activeIndex >= 0 && activeIndex < storage.accounts.length
+                        ? storage.accounts[activeIndex]?.refreshToken?.trim() || undefined
+                        : undefined;
+                    let storageChanged = false;
+                    for (const i of uniqueIndices) {
+                        const account = storage.accounts[i];
+                        if (!account)
+                            continue;
+                        const sharesActiveCredential = !!activeRefreshToken && account.refreshToken === activeRefreshToken;
+                        const displayIndex = sharesActiveCredential && typeof activeIndex === "number" ? activeIndex : i;
+                        const displayAccount = storage.accounts[displayIndex];
+                        if (sharesActiveCredential && !displayAccount) {
+                            logWarn(`[${PLUGIN_NAME}] active account entry missing for index ${displayIndex}, falling back to account ${i}`);
+                        }
+                        const effectiveDisplayAccount = displayAccount ?? account;
+                        const label = formatCommandAccountLabel(effectiveDisplayAccount, displayIndex);
+                        const isActive = i === activeIndex || sharesActiveCredential;
+                        const activeSuffix = isActive ? (ui.v2Enabled ? ` ${formatUiBadge(ui, "active", "accent")}` : " [active]") : "";
+                        try {
+                            let accessToken = account.accessToken;
+                            if (typeof accessToken !== "string" ||
+                                !accessToken ||
+                                typeof account.expiresAt !== "number" ||
+                                account.expiresAt <= Date.now() + 30_000) {
+                                const previousRefreshToken = account.refreshToken;
+                                if (!previousRefreshToken) {
+                                    throw new Error("Cannot refresh: account has no refresh token");
+                                }
+                                const refreshResult = await queuedRefresh(previousRefreshToken);
+                                if (refreshResult.type !== "success") {
+                                    throw new Error(refreshResult.message ?? refreshResult.reason);
+                                }
+                                let refreshedCount = 0;
+                                for (const storedAccount of storage.accounts) {
+                                    if (!storedAccount)
+                                        continue;
+                                    if (storedAccount.refreshToken === previousRefreshToken) {
+                                        applyRefreshedCredentials(storedAccount, refreshResult);
+                                        refreshedCount += 1;
+                                    }
+                                }
+                                if (refreshedCount === 0) {
+                                    applyRefreshedCredentials(account, refreshResult);
+                                }
+                                const persistedRefresh = await persistRefreshedCredentials({
+                                    previousRefreshToken,
+                                    accountId: account.accountId,
+                                    organizationId: account.organizationId,
+                                    email: account.email,
+                                    refreshResult,
+                                });
+                                accessToken = refreshResult.access;
+                                storageChanged = storageChanged || persistedRefresh;
+                            }
+                            const effectiveAccount = sharesActiveCredential ? effectiveDisplayAccount : account;
+                            const accountId = effectiveAccount.accountId ?? extractAccountId(accessToken);
+                            if (!accountId) {
+                                throw new Error("Missing account id");
+                            }
+                            const payload = await fetchUsage({
+                                accountId,
+                                accessToken,
+                                organizationId: effectiveAccount.organizationId,
+                            });
+                            const primary = mapWindow(payload.rate_limit?.primary_window ?? null);
+                            const secondary = mapWindow(payload.rate_limit?.secondary_window ?? null);
+                            const codeReviewRateLimit = payload.code_review_rate_limit ??
+                                payload.additional_rate_limits?.find((entry) => entry.limit_name === "code_review_rate_limit")?.rate_limit ??
+                                null;
+                            const codeReview = mapWindow(codeReviewRateLimit?.primary_window ?? null);
+                            const credits = formatCredits(payload.credits ?? null);
+                            const additionalLimits = (payload.additional_rate_limits ?? []).filter((entry) => entry.limit_name !== "code_review_rate_limit");
+                            if (ui.v2Enabled) {
+                                lines.push(formatUiItem(ui, `${label}${activeSuffix}`));
+                                lines.push(`  ${formatUiKeyValue(ui, formatLimitTitle(primary.windowMinutes), formatLimitSummary(primary), "muted")}`);
+                                lines.push(`  ${formatUiKeyValue(ui, formatLimitTitle(secondary.windowMinutes), formatLimitSummary(secondary), "muted")}`);
+                                if (codeReview.windowMinutes || typeof codeReview.usedPercent === "number" || codeReview.resetAtMs) {
+                                    lines.push(`  ${formatUiKeyValue(ui, "Code review", formatLimitSummary(codeReview), "muted")}`);
+                                }
+                                for (const limit of additionalLimits) {
+                                    const extraWindow = mapWindow(limit.rate_limit?.primary_window ?? null);
+                                    lines.push(`  ${formatUiKeyValue(ui, formatExtraName(limit.limit_name ?? limit.metered_feature), formatLimitSummary(extraWindow), "muted")}`);
+                                }
+                                if (payload.plan_type) {
+                                    lines.push(`  ${formatUiKeyValue(ui, "Plan", payload.plan_type, "muted")}`);
+                                }
+                                if (credits) {
+                                    lines.push(`  ${formatUiKeyValue(ui, "Credits", credits, "muted")}`);
+                                }
+                            }
+                            else {
+                                lines.push(`${label}${activeSuffix}:`);
+                                lines.push(`  ${formatLimitTitle(primary.windowMinutes)}: ${formatLimitSummary(primary)}`);
+                                lines.push(`  ${formatLimitTitle(secondary.windowMinutes)}: ${formatLimitSummary(secondary)}`);
+                                if (codeReview.windowMinutes || typeof codeReview.usedPercent === "number" || codeReview.resetAtMs) {
+                                    lines.push(`  Code review: ${formatLimitSummary(codeReview)}`);
+                                }
+                                for (const limit of additionalLimits) {
+                                    const extraWindow = mapWindow(limit.rate_limit?.primary_window ?? null);
+                                    lines.push(`  ${formatExtraName(limit.limit_name ?? limit.metered_feature)}: ${formatLimitSummary(extraWindow)}`);
+                                }
+                                if (payload.plan_type) {
+                                    lines.push(`  Plan: ${payload.plan_type}`);
+                                }
+                                if (credits) {
+                                    lines.push(`  Credits: ${credits}`);
+                                }
+                            }
+                        }
+                        catch (error) {
+                            const message = error instanceof Error ? error.message : String(error);
+                            if (ui.v2Enabled) {
+                                lines.push(formatUiItem(ui, `${label}${activeSuffix}`));
+                                lines.push(`  ${formatUiKeyValue(ui, "Error", message.slice(0, 160), "danger")}`);
+                            }
+                            else {
+                                lines.push(`${label}${activeSuffix}:`);
+                                lines.push(`  Error: ${message.slice(0, 160)}`);
+                            }
+                        }
+                        lines.push("");
+                    }
+                    if (storageChanged) {
+                        invalidateAccountManagerCache();
+                    }
+                    while (lines.length > 0 && lines[lines.length - 1] === "") {
+                        lines.pop();
+                    }
+                    return lines.join("\n");
+                },
+            }),
             "codex-metrics": tool({
                 description: "Show runtime request metrics for this plugin process.",
                 args: {},