oc-codex-multi-auth 6.0.0 → 6.1.0

package/dist/index.js

@@ -18,15 +18,14 @@
  * For production applications, use the OpenAI Platform API: https://platform.openai.com/
  *
  * @license MIT (see LICENSE file)
- * @author numman-ali
+ * @author ndycode
  * @repository https://github.com/ndycode/oc-codex-multi-auth
 
  */
-import { tool } from "@opencode-ai/plugin/tool";
 import { createAuthorizationFlow, exchangeAuthorizationCode, parseAuthorizationInput, REDIRECT_URI, } from "./lib/auth/auth.js";
 import { buildDeviceCodeInstructions, completeDeviceCodeSession, createDeviceCodeSession, } from "./lib/auth/device-code.js";
 import { applyAccountSelectionFallbacks, persistResolvedAccountSelection, persistAccountPool, resolveAndPersistAccountSelection, resolveAccountSelection, } from "./lib/auth/login-runner.js";
-import { queuedRefresh, getRefreshQueueMetrics } from "./lib/refresh-queue.js";
+import { queuedRefresh } from "./lib/refresh-queue.js";
 import { openBrowserUrl } from "./lib/auth/browser.js";
 import { startLocalOAuthServer } from "./lib/auth/server.js";
 import { promptAddAnotherAccount, promptLoginMode } from "./lib/cli.js";
@@ -35,34 +34,24 @@ import { AUTH_LABELS, CODEX_BASE_URL, DUMMY_API_KEY, LOG_STAGES, PLUGIN_NAME, PR
 import { initLogger, logRequest, logDebug, logInfo, logWarn, logError, setCorrelationId, clearCorrelationId, } from "./lib/logger.js";
 import { checkAndNotify } from "./lib/auto-update-checker.js";
 import { handleContextOverflow } from "./lib/context-overflow.js";
-import { AccountManager, extractAccountEmail, extractAccountId, formatAccountLabel, formatCooldown, formatWaitTime, sanitizeEmail, shouldUpdateAccountIdFromToken, resolveRequestAccountId, parseRateLimitReason, lookupCodexCliTokensByEmail, } from "./lib/accounts.js";
-import { getStoragePath, loadAccounts, saveAccounts, withAccountStorageTransaction, clearAccounts, setStoragePath, exportAccounts, importAccounts, previewImportAccounts, createTimestampedBackupPath, loadFlaggedAccounts, saveFlaggedAccounts, withFlaggedAccountStorageTransaction, clearFlaggedAccounts, getWorkspaceIdentityKey, StorageError, formatStorageErrorHint, } from "./lib/storage.js";
+import { AccountManager, extractAccountEmail, extractAccountId, formatAccountLabel, formatWaitTime, sanitizeEmail, shouldUpdateAccountIdFromToken, resolveRequestAccountId, parseRateLimitReason, lookupCodexCliTokensByEmail, } from "./lib/accounts.js";
+import { getStoragePath, loadAccounts, saveAccounts, clearAccounts, setStoragePath, loadFlaggedAccounts, saveFlaggedAccounts, withFlaggedAccountStorageTransaction, clearFlaggedAccounts, getWorkspaceIdentityKey, StorageError, formatStorageErrorHint, } from "./lib/storage.js";
 import { createCodexHeaders, extractRequestUrl, handleErrorResponse, handleSuccessResponse, isDeactivatedWorkspaceError, getUnsupportedCodexModelInfo, resolveUnsupportedCodexFallbackModel, refreshAndUpdateToken, rewriteUrlForCodex, shouldRefreshToken, transformRequestForCodex, } from "./lib/request/fetch-helpers.js";
-import { createDeactivatedWorkspaceError, createUsageRequestTimeoutError, DEACTIVATED_WORKSPACE_ERROR_CODE, isDeactivatedWorkspaceErrorMessage, } from "./lib/runtime-contracts.js";
+import { createDeactivatedWorkspaceError, DEACTIVATED_WORKSPACE_ERROR_CODE, isDeactivatedWorkspaceErrorMessage, } from "./lib/error-sentinels.js";
 import { applyFastSessionDefaults } from "./lib/request/request-transformer.js";
 import { getRateLimitBackoff, RATE_LIMIT_SHORT_RETRY_THRESHOLD_MS, resetRateLimitBackoff, } from "./lib/request/rate-limit-backoff.js";
 import { isEmptyResponse } from "./lib/request/response-handler.js";
+import { getCircuitBreaker } from "./lib/circuit-breaker.js";
 import { RetryBudgetTracker, resolveRetryBudgetLimits, } from "./lib/request/retry-budget.js";
 import { addJitter } from "./lib/rotation.js";
-import { buildTableHeader, buildTableRow } from "./lib/table-formatter.js";
 import { setUiRuntimeOptions } from "./lib/ui/runtime.js";
-import { paintUiText, formatUiBadge, formatUiHeader, formatUiItem, formatUiKeyValue, formatUiSection } from "./lib/ui/format.js";
-import { buildBeginnerChecklist, buildBeginnerDoctorFindings, formatPromptCacheSnapshot, recommendBeginnerNextAction, summarizeBeginnerAccounts, } from "./lib/ui/beginner.js";
+import { formatUiBadge, formatUiHeader, formatUiItem, formatUiKeyValue, formatUiSection } from "./lib/ui/format.js";
+import { buildBeginnerChecklist, recommendBeginnerNextAction, summarizeBeginnerAccounts, } from "./lib/ui/beginner.js";
 import { getModelFamily, getCodexInstructions, MODEL_FAMILIES, prewarmCodexInstructions, } from "./lib/prompts/codex.js";
 import { prewarmOpenCodeCodexPrompt } from "./lib/prompts/opencode-codex.js";
 import { createSessionRecoveryHook, isRecoverableError, detectErrorType, getRecoveryToastContent, } from "./lib/recovery.js";
-function matchesWorkspaceIdentity(account, identityKey) {
-    return getWorkspaceIdentityKey(account) === identityKey;
-}
-function upsertFlaggedAccountRecord(accounts, record) {
-    const identityKey = getWorkspaceIdentityKey(record);
-    const existingIndex = accounts.findIndex((flagged) => matchesWorkspaceIdentity(flagged, identityKey));
-    if (existingIndex >= 0) {
-        accounts[existingIndex] = record;
-        return;
-    }
-    accounts.push(record);
-}
+import { matchesWorkspaceIdentity, upsertFlaggedAccountRecord, createRetryBudgetUsage, serializeSelectionExplainability, formatRoutingValue, formatExplainabilitySummary, } from "./lib/runtime.js";
+import { createToolRegistry, } from "./lib/tools/index.js";
 /**
  * OpenAI Codex OAuth authentication plugin for opencode
  *
@@ -89,14 +78,6 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
     let startupPreflightShown = false;
     let beginnerSafeModeEnabled = false;
     const MIN_BACKOFF_MS = 100;
-    const createRetryBudgetUsage = () => ({
-        authRefresh: 0,
-        network: 0,
-        server: 0,
-        rateLimitShort: 0,
-        rateLimitGlobal: 0,
-        emptyResponse: 0,
-    });
     const runtimeMetrics = {
         startedAt: Date.now(),
         totalRequests: 0,
@@ -125,36 +106,6 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
         lastQuotaKey: null,
         lastSelectionSnapshot: null,
     };
-    const toolOutputFormatSchema = () => tool.schema
-        .string()
-        .optional()
-        .describe('Output format: "text" (default) or "json".');
-    const toolSensitiveJsonSchema = () => tool.schema
-        .boolean()
-        .optional()
-        .describe("Include raw account labels, emails, and account IDs in JSON output. Defaults to false.");
-    const normalizeToolOutputFormat = (format) => {
-        if (format === undefined)
-            return "text";
-        if (format === "text" || format === "json")
-            return format;
-        throw new Error(`Invalid format "${format}". Expected "text" or "json".`);
-    };
-    const renderJsonOutput = (payload) => JSON.stringify(payload, null, 2);
-    const serializeSelectionExplainability = (entries) => entries.map((entry) => ({
-        index: entry.index + 1,
-        zeroBasedIndex: entry.index,
-        enabled: entry.enabled,
-        isCurrentForFamily: entry.isCurrentForFamily,
-        eligible: entry.eligible,
-        reasons: [...entry.reasons],
-        healthScore: entry.healthScore,
-        tokensAvailable: entry.tokensAvailable,
-        rateLimitedUntil: typeof entry.rateLimitedUntil === "number" ? entry.rateLimitedUntil : null,
-        coolingDownUntil: typeof entry.coolingDownUntil === "number" ? entry.coolingDownUntil : null,
-        cooldownReason: entry.cooldownReason ?? null,
-        lastUsed: entry.lastUsed,
-    }));
     const buildRoutingVisibilitySnapshot = (options = {}) => {
         const snapshot = runtimeMetrics.lastSelectionSnapshot;
         const rawSelectedAccountIndex = options.selectedAccountIndex ??
@@ -177,14 +128,6 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
             selectionExplainability: serializeSelectionExplainability(options.selectionExplainability ?? snapshot?.explainability ?? []),
         };
     };
-    const formatRoutingValue = (value) => {
-        if (typeof value === "boolean")
-            return value ? "yes" : "no";
-        if (value === null || value === undefined || value === "")
-            return "-";
-        return String(value);
-    };
-    const formatExplainabilitySummary = (entry) => `Account ${entry.index}: ${entry.eligible ? "eligible" : "blocked"} | health=${Math.round(entry.healthScore)} | tokens=${entry.tokensAvailable.toFixed(1)} | ${entry.reasons.join(", ")}`;
     const buildJsonAccountIdentity = (index, options = {}) => ({
         index: index + 1,
         zeroBasedIndex: index,
@@ -453,10 +396,10 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
     const getStatusMarker = (ui, status) => {
         if (!ui.v2Enabled) {
             if (status === "ok")
-                return "✓";
+                return "✓";
             if (status === "warning")
                 return "!";
-            return "✗";
+            return "✗";
         }
         if (status === "ok")
             return ui.theme.glyphs.check;
@@ -851,6 +794,56 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
     };
     // Initialize runtime UI settings once on plugin load; auth/tools refresh this dynamically.
     resolveUiRuntime();
+    // Build the shared ToolContext consumed by every codex-* tool factory.
+    // Mutable refs proxy plugin-closure `let` bindings so tool writes to
+    // `.current` propagate to the outer closure without exposing the raw
+    // variables (RC-1 Phase 2; see lib/tools/index.ts).
+    const ctx = {
+        cachedAccountManagerRef: {
+            get current() {
+                return cachedAccountManager;
+            },
+            set current(value) {
+                cachedAccountManager = value;
+            },
+        },
+        accountManagerPromiseRef: {
+            get current() {
+                return accountManagerPromise;
+            },
+            set current(value) {
+                accountManagerPromise = value;
+            },
+        },
+        runtimeMetrics,
+        beginnerSafeModeRef: {
+            get current() {
+                return beginnerSafeModeEnabled;
+            },
+        },
+        resolveUiRuntime,
+        getStatusMarker,
+        formatCommandAccountLabel,
+        normalizeAccountTags,
+        supportsInteractiveMenus,
+        promptAccountIndexSelection,
+        resolveActiveIndex,
+        getRateLimitResetTimeForFamily,
+        formatRateLimitEntry,
+        buildJsonAccountIdentity,
+        buildRoutingVisibilitySnapshot,
+        appendRoutingVisibilityText,
+        appendRoutingVisibilityUi,
+        toBeginnerAccountSnapshots,
+        getBeginnerRuntimeSnapshot,
+        formatDoctorSeverity,
+        formatDoctorSeverityText,
+        buildSetupChecklistState,
+        renderSetupChecklistOutput,
+        runSetupWizard,
+        invalidateAccountManagerCache,
+        upsertFlaggedAccountRecord,
+    };
     return {
         event: eventHandler,
         auth: {
@@ -1244,7 +1237,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                             runtimeMetrics.accountRotations++;
                                             runtimeMetrics.lastError = err?.message ?? String(err);
                                             runtimeMetrics.lastErrorCategory = "auth-refresh";
-                                            const failures = accountManager.incrementAuthFailures(account);
+                                            const failures = await accountManager.incrementAuthFailures(account);
                                             const accountLabel = formatAccountLabel(account, account.index);
                                             if (failures >= ACCOUNT_LIMITS.MAX_AUTH_FAILURES_BEFORE_REMOVAL) {
                                                 const removedCount = accountManager.removeAccountsWithSameRefreshToken(account);
@@ -1307,9 +1300,31 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                             logWarn(`Skipping account ${account.index + 1}: local token bucket depleted for ${modelFamily}${model ? `:${model}` : ""}`);
                                             break;
                                         }
+                                        // RC-8: per-(account, family) circuit-breaker key. The breaker gates
+                                        // upstream calls so that repeated failures short-circuit to the
+                                        // rotation path instead of hammering a degraded endpoint.
+                                        const circuitBreakerKey = `${accountId}:${modelFamily}`;
+                                        const circuitBreaker = getCircuitBreaker(circuitBreakerKey);
                                         while (true) {
                                             let response;
                                             const fetchStart = performance.now();
+                                            // RC-8: consult the breaker BEFORE firing upstream. When the gate is
+                                            // closed every call passes through unchanged. When the gate denies
+                                            // (open within cooldown, or half-open with a probe already in
+                                            // flight) we short-circuit to the rotation path instead of
+                                            // retrying here. We classify the short-circuit as `circuit-open`
+                                            // so observability traces and the runtime metrics agree with the
+                                            // `CircuitOpenError` type exported from `lib/errors.ts`.
+                                            const breakerCheck = circuitBreaker.canAttempt();
+                                            if (!breakerCheck.allowed) {
+                                                const shortCircuitMessage = `Circuit ${breakerCheck.state} for ${circuitBreakerKey}`;
+                                                logWarn(`[circuit-breaker] ${shortCircuitMessage} (reason=${breakerCheck.reason ?? "denied"}). Rotating account.`);
+                                                accountManager.refundToken(account, modelFamily, model);
+                                                runtimeMetrics.accountRotations++;
+                                                runtimeMetrics.lastError = shortCircuitMessage;
+                                                runtimeMetrics.lastErrorCategory = "circuit-open";
+                                                break;
+                                            }
                                             // Merge user AbortSignal with timeout (Node 18 compatible - no AbortSignal.any)
                                             const fetchController = new AbortController();
                                             const requestTimeoutMs = fetchTimeoutMs;
@@ -1366,6 +1381,10 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                                 runtimeMetrics.lastErrorCategory = "network";
                                                 accountManager.refundToken(account, modelFamily, model);
                                                 accountManager.recordFailure(account, modelFamily, model);
+                                                // RC-8: network failures feed the breaker so a degraded upstream
+                                                // trips the gate for this (account, family) key after N hits
+                                                // inside the failure window.
+                                                circuitBreaker.recordFailure();
                                                 break;
                                             }
                                             finally {
@@ -1573,6 +1592,11 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                                     runtimeMetrics.lastErrorCategory = "server";
                                                     accountManager.refundToken(account, modelFamily, model);
                                                     accountManager.recordFailure(account, modelFamily, model);
+                                                    // RC-8: 5xx responses are treated the same as network failures by
+                                                    // the breaker — they indicate an upstream fault rather than a
+                                                    // client-side classifier decision (401/403/404/429 are handled
+                                                    // upstream and do not feed the breaker).
+                                                    circuitBreaker.recordFailure();
                                                     if (!consumeRetryBudget("server", `Server error ${response.status} on account ${account.index + 1}`)) {
                                                         return errorResponse;
                                                     }
@@ -1646,6 +1670,9 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                                 }
                                             }
                                             accountManager.recordSuccess(account, modelFamily, model);
+                                            // RC-8: closes a half-open gate or prunes the failure window so a
+                                            // sequence of successes keeps the breaker healthy.
+                                            circuitBreaker.recordSuccess();
                                             runtimeMetrics.successfulRequests++;
                                             runtimeMetrics.lastError = null;
                                             runtimeMetrics.lastErrorCategory = null;
@@ -2551,2456 +2578,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                 },
             ],
         },
-        tool: {
-            "codex-list": tool({
-                description: "List all Codex OAuth accounts and the current active index.",
-                args: {
-                    tag: tool.schema
-                        .string()
-                        .optional()
-                        .describe("Optional tag filter (e.g., work, personal, team-a)."),
-                    format: toolOutputFormatSchema(),
-                    includeSensitive: toolSensitiveJsonSchema(),
-                },
-                async execute({ tag, format, includeSensitive } = {}) {
-                    const ui = resolveUiRuntime();
-                    const storage = await loadAccounts();
-                    const storePath = getStoragePath();
-                    const outputFormat = normalizeToolOutputFormat(format);
-                    const includeSensitiveOutput = includeSensitive === true;
-                    const normalizedTag = tag?.trim().toLowerCase() ?? "";
-                    const commandHints = [
-                        "opencode auth login",
-                        "codex-status",
-                        "codex-dashboard",
-                        "codex-metrics",
-                        "codex-doctor",
-                        "codex-setup",
-                        "codex-next",
-                        "codex-label",
-                        "codex-tag",
-                        "codex-note",
-                        "codex-help",
-                    ];
-                    if (!storage || storage.accounts.length === 0) {
-                        if (outputFormat === "json") {
-                            return renderJsonOutput({
-                                message: "No Codex accounts configured. Run: opencode auth login",
-                                storagePath: storePath,
-                                filterTag: normalizedTag || null,
-                                totalAccounts: 0,
-                                totalStoredAccounts: 0,
-                                activeIndex: null,
-                                accounts: [],
-                                commands: commandHints,
-                            });
-                        }
-                        if (ui.v2Enabled) {
-                            return [
-                                ...formatUiHeader(ui, "Codex accounts"),
-                                "",
-                                formatUiItem(ui, "No accounts configured.", "warning"),
-                                formatUiItem(ui, "Run: opencode auth login", "accent"),
-                                formatUiItem(ui, "Setup checklist: codex-setup"),
-                                formatUiItem(ui, "Command guide: codex-help"),
-                                formatUiKeyValue(ui, "Storage", storePath, "muted"),
-                            ].join("\n");
-                        }
-                        return [
-                            "No Codex accounts configured.",
-                            "",
-                            "Add accounts:",
-                            "  opencode auth login",
-                            "  codex-setup",
-                            "  codex-help",
-                            "",
-                            `Storage: ${storePath}`,
-                        ].join("\n");
-                    }
-                    const now = Date.now();
-                    const activeIndex = resolveActiveIndex(storage, "codex");
-                    const filteredEntries = storage.accounts
-                        .map((account, index) => ({ account, index }))
-                        .filter(({ account }) => {
-                        if (!normalizedTag)
-                            return true;
-                        const tags = Array.isArray(account.accountTags)
-                            ? account.accountTags.map((entry) => entry.trim().toLowerCase())
-                            : [];
-                        return tags.includes(normalizedTag);
-                    });
-                    if (normalizedTag && filteredEntries.length === 0) {
-                        if (outputFormat === "json") {
-                            return renderJsonOutput({
-                                message: `No accounts found for tag: ${normalizedTag}`,
-                                storagePath: storePath,
-                                filterTag: normalizedTag,
-                                totalAccounts: 0,
-                                totalStoredAccounts: storage.accounts.length,
-                                activeIndex: activeIndex + 1,
-                                accounts: [],
-                                commands: commandHints,
-                            });
-                        }
-                        if (ui.v2Enabled) {
-                            return [
-                                ...formatUiHeader(ui, "Codex accounts"),
-                                "",
-                                formatUiItem(ui, `No accounts found for tag: ${normalizedTag}`, "warning"),
-                                formatUiItem(ui, "Use codex-tag index=2 tags=\"work,team-a\" to add tags.", "accent"),
-                            ].join("\n");
-                        }
-                        return `No accounts found for tag: ${normalizedTag}\n\nUse codex-tag index=2 tags="work,team-a" to add tags.`;
-                    }
-                    if (outputFormat === "json") {
-                        return renderJsonOutput({
-                            totalAccounts: filteredEntries.length,
-                            totalStoredAccounts: storage.accounts.length,
-                            activeIndex: activeIndex + 1,
-                            filterTag: normalizedTag || null,
-                            storagePath: storePath,
-                            accounts: filteredEntries.map(({ account, index }) => {
-                                const rateLimit = formatRateLimitEntry(account, now);
-                                const cooldown = formatCooldown(account, now);
-                                const statuses = [];
-                                if (index === activeIndex)
-                                    statuses.push("active");
-                                if (account.enabled === false)
-                                    statuses.push("disabled");
-                                if (rateLimit)
-                                    statuses.push("rate-limited");
-                                if (cooldown)
-                                    statuses.push("cooldown");
-                                if (statuses.length === 0)
-                                    statuses.push("ok");
-                                return {
-                                    ...buildJsonAccountIdentity(index, {
-                                        includeSensitive: includeSensitiveOutput,
-                                        account,
-                                    }),
-                                    enabled: account.enabled !== false,
-                                    isActive: index === activeIndex,
-                                    rateLimit: rateLimit ?? null,
-                                    cooldown: cooldown ?? null,
-                                    tags: Array.isArray(account.accountTags) ? [...account.accountTags] : [],
-                                    note: account.accountNote ?? null,
-                                    statuses,
-                                };
-                            }),
-                            commands: commandHints,
-                        });
-                    }
-                    if (ui.v2Enabled) {
-                        const lines = [
-                            ...formatUiHeader(ui, "Codex accounts"),
-                            formatUiKeyValue(ui, "Total", String(filteredEntries.length)),
-                            normalizedTag
-                                ? formatUiKeyValue(ui, "Filter tag", normalizedTag, "accent")
-                                : formatUiKeyValue(ui, "Filter tag", "none", "muted"),
-                            formatUiKeyValue(ui, "Storage", storePath, "muted"),
-                            "",
-                            ...formatUiSection(ui, "Accounts"),
-                        ];
-                        filteredEntries.forEach(({ account, index }) => {
-                            const label = formatCommandAccountLabel(account, index);
-                            const badges = [];
-                            if (index === activeIndex)
-                                badges.push(formatUiBadge(ui, "current", "accent"));
-                            if (account.enabled === false)
-                                badges.push(formatUiBadge(ui, "disabled", "danger"));
-                            const rateLimit = formatRateLimitEntry(account, now);
-                            if (rateLimit)
-                                badges.push(formatUiBadge(ui, "rate-limited", "warning"));
-                            if (typeof account.coolingDownUntil === "number" &&
-                                account.coolingDownUntil > now) {
-                                badges.push(formatUiBadge(ui, "cooldown", "warning"));
-                            }
-                            if (badges.length === 0) {
-                                badges.push(formatUiBadge(ui, "ok", "success"));
-                            }
-                            lines.push(formatUiItem(ui, `${label} ${badges.join(" ")}`.trim()));
-                            if (rateLimit) {
-                                lines.push(`  ${paintUiText(ui, `rate limit: ${rateLimit}`, "muted")}`);
-                            }
-                        });
-                        lines.push("");
-                        lines.push(...formatUiSection(ui, "Commands"));
-                        lines.push(formatUiItem(ui, "Add account: opencode auth login", "accent"));
-                        lines.push(formatUiItem(ui, "Switch account: codex-switch index=2"));
-                        lines.push(formatUiItem(ui, "Detailed status: codex-status"));
-                        lines.push(formatUiItem(ui, "Live dashboard: codex-dashboard"));
-                        lines.push(formatUiItem(ui, "Runtime metrics: codex-metrics"));
-                        lines.push(formatUiItem(ui, "Set account tags: codex-tag index=2 tags=\"work,team-a\""));
-                        lines.push(formatUiItem(ui, "Set account note: codex-note index=2 note=\"weekday primary\""));
-                        lines.push(formatUiItem(ui, "Doctor checks: codex-doctor"));
-                        lines.push(formatUiItem(ui, "Onboarding checklist: codex-setup"));
-                        lines.push(formatUiItem(ui, "Guided setup wizard: codex-setup --wizard"));
-                        lines.push(formatUiItem(ui, "Best next action: codex-next"));
-                        lines.push(formatUiItem(ui, "Rename account label: codex-label index=2 label=\"Work\""));
-                        lines.push(formatUiItem(ui, "Command guide: codex-help"));
-                        return lines.join("\n");
-                    }
-                    const listTableOptions = {
-                        columns: [
-                            { header: "#", width: 3 },
-                            { header: "Label", width: 42 },
-                            { header: "Status", width: 20 },
-                        ],
-                    };
-                    const lines = [
-                        `Codex Accounts (${filteredEntries.length}):`,
-                        "",
-                        ...buildTableHeader(listTableOptions),
-                    ];
-                    filteredEntries.forEach(({ account, index }) => {
-                        const label = formatCommandAccountLabel(account, index);
-                        const statuses = [];
-                        const rateLimit = formatRateLimitEntry(account, now);
-                        if (index === activeIndex)
-                            statuses.push("active");
-                        if (rateLimit)
-                            statuses.push("rate-limited");
-                        if (typeof account.coolingDownUntil ===
-                            "number" &&
-                            account.coolingDownUntil > now) {
-                            statuses.push("cooldown");
-                        }
-                        const statusText = statuses.length > 0 ? statuses.join(", ") : "ok";
-                        lines.push(buildTableRow([String(index + 1), label, statusText], listTableOptions));
-                    });
-                    lines.push("");
-                    lines.push(`Storage: ${storePath}`);
-                    if (normalizedTag) {
-                        lines.push(`Filter tag: ${normalizedTag}`);
-                    }
-                    lines.push("");
-                    lines.push("Commands:");
-                    lines.push("  - Add account: opencode auth login");
-                    lines.push("  - Switch account: codex-switch");
-                    lines.push("  - Status details: codex-status");
-                    lines.push("  - Live dashboard: codex-dashboard");
-                    lines.push("  - Runtime metrics: codex-metrics");
-                    lines.push("  - Set account tags: codex-tag");
-                    lines.push("  - Set account note: codex-note");
-                    lines.push("  - Doctor checks: codex-doctor");
-                    lines.push("  - Setup checklist: codex-setup");
-                    lines.push("  - Guided setup wizard: codex-setup --wizard");
-                    lines.push("  - Best next action: codex-next");
-                    lines.push("  - Rename account label: codex-label");
-                    lines.push("  - Command guide: codex-help");
-                    return lines.join("\n");
-                },
-            }),
-            "codex-switch": tool({
-                description: "Switch active Codex account by index (1-based) or interactive picker when index is omitted.",
-                args: {
-                    index: tool.schema.number().optional().describe("Account number to switch to (1-based, e.g., 1 for first account)"),
-                },
-                async execute({ index } = {}) {
-                    const ui = resolveUiRuntime();
-                    const storage = await loadAccounts();
-                    if (!storage || storage.accounts.length === 0) {
-                        if (ui.v2Enabled) {
-                            return [
-                                ...formatUiHeader(ui, "Switch account"),
-                                "",
-                                formatUiItem(ui, "No accounts configured.", "warning"),
-                                formatUiItem(ui, "Run: opencode auth login", "accent"),
-                            ].join("\n");
-                        }
-                        return "No Codex accounts configured. Run: opencode auth login";
-                    }
-                    let resolvedIndex = index;
-                    if (resolvedIndex === undefined) {
-                        const selectedIndex = await promptAccountIndexSelection(ui, storage, "Switch account");
-                        if (selectedIndex === null) {
-                            if (supportsInteractiveMenus()) {
-                                if (ui.v2Enabled) {
-                                    return [
-                                        ...formatUiHeader(ui, "Switch account"),
-                                        "",
-                                        formatUiItem(ui, "No account selected.", "warning"),
-                                        formatUiItem(ui, "Run again and pick an account, or pass codex-switch index=2.", "muted"),
-                                    ].join("\n");
-                                }
-                                return "No account selected.";
-                            }
-                            if (ui.v2Enabled) {
-                                return [
-                                    ...formatUiHeader(ui, "Switch account"),
-                                    "",
-                                    formatUiItem(ui, "Missing account number.", "warning"),
-                                    formatUiItem(ui, "Use: codex-switch index=2", "accent"),
-                                ].join("\n");
-                            }
-                            return "Missing account number. Use: codex-switch index=2";
-                        }
-                        resolvedIndex = selectedIndex + 1;
-                    }
-                    const targetIndex = Math.floor((resolvedIndex ?? 0) - 1);
-                    if (!Number.isFinite(targetIndex) ||
-                        targetIndex < 0 ||
-                        targetIndex >= storage.accounts.length) {
-                        if (ui.v2Enabled) {
-                            return [
-                                ...formatUiHeader(ui, "Switch account"),
-                                "",
-                                formatUiItem(ui, `Invalid account number: ${resolvedIndex}`, "danger"),
-                                formatUiKeyValue(ui, "Valid range", `1-${storage.accounts.length}`, "muted"),
-                            ].join("\n");
-                        }
-                        return `Invalid account number: ${resolvedIndex}\n\nValid range: 1-${storage.accounts.length}`;
-                    }
-                    const now = Date.now();
-                    const account = storage.accounts[targetIndex];
-                    if (account) {
-                        account.lastUsed = now;
-                        account.lastSwitchReason = "rotation";
-                    }
-                    storage.activeIndex = targetIndex;
-                    storage.activeIndexByFamily = storage.activeIndexByFamily ?? {};
-                    for (const family of MODEL_FAMILIES) {
-                        storage.activeIndexByFamily[family] = targetIndex;
-                    }
-                    try {
-                        await saveAccounts(storage);
-                    }
-                    catch (saveError) {
-                        logWarn("Failed to save account switch", { error: String(saveError) });
-                        const label = formatCommandAccountLabel(account, targetIndex);
-                        if (ui.v2Enabled) {
-                            return [
-                                ...formatUiHeader(ui, "Switch account"),
-                                "",
-                                formatUiItem(ui, `Switched to ${label}`, "warning"),
-                                formatUiItem(ui, "Failed to persist change. It may be lost on restart.", "danger"),
-                            ].join("\n");
-                        }
-                        return `Switched to ${label} but failed to persist. Changes may be lost on restart.`;
-                    }
-                    if (cachedAccountManager) {
-                        const reloadedManager = await AccountManager.loadFromDisk();
-                        cachedAccountManager = reloadedManager;
-                        accountManagerPromise = Promise.resolve(reloadedManager);
-                    }
-                    const label = formatCommandAccountLabel(account, targetIndex);
-                    if (ui.v2Enabled) {
-                        return [
-                            ...formatUiHeader(ui, "Switch account"),
-                            "",
-                            formatUiItem(ui, `${getStatusMarker(ui, "ok")} Switched to ${label}`, "success"),
-                        ].join("\n");
-                    }
-                    return `Switched to account: ${label}`;
-                },
-            }),
-            "codex-status": tool({
-                description: "Show detailed status of Codex accounts and rate limits.",
-                args: {
-                    format: toolOutputFormatSchema(),
-                    includeSensitive: toolSensitiveJsonSchema(),
-                },
-                async execute({ format, includeSensitive } = {}) {
-                    const ui = resolveUiRuntime();
-                    const outputFormat = normalizeToolOutputFormat(format);
-                    const includeSensitiveOutput = includeSensitive === true;
-                    const storage = await loadAccounts();
-                    if (!storage || storage.accounts.length === 0) {
-                        if (outputFormat === "json") {
-                            return renderJsonOutput({
-                                message: "No Codex accounts configured. Run: opencode auth login",
-                                totalAccounts: 0,
-                                accounts: [],
-                                activeIndexByFamily: {},
-                                rateLimitsByModelFamily: [],
-                                routingVisibility: buildRoutingVisibilitySnapshot(),
-                                recommendedNextAction: "Run opencode auth login",
-                            });
-                        }
-                        if (ui.v2Enabled) {
-                            return [
-                                ...formatUiHeader(ui, "Account status"),
-                                "",
-                                formatUiItem(ui, "No accounts configured.", "warning"),
-                                formatUiItem(ui, "Run: opencode auth login", "accent"),
-                            ].join("\n");
-                        }
-                        return "No Codex accounts configured. Run: opencode auth login";
-                    }
-                    const now = Date.now();
-                    const activeIndex = resolveActiveIndex(storage, "codex");
-                    const explainabilityFamily = runtimeMetrics.lastSelectionSnapshot?.family ?? "codex";
-                    const explainabilityModel = runtimeMetrics.lastSelectionSnapshot?.effectiveModel ??
-                        runtimeMetrics.lastSelectionSnapshot?.model ??
-                        undefined;
-                    const managerForExplainability = cachedAccountManager ?? (await AccountManager.loadFromDisk());
-                    const explainability = managerForExplainability.getSelectionExplainability(explainabilityFamily, explainabilityModel, now);
-                    const selectionQuotaKey = explainabilityModel
-                        ? `${explainabilityFamily}:${explainabilityModel}`
-                        : explainabilityFamily;
-                    const routingVisibility = buildRoutingVisibilitySnapshot({
-                        modelFamily: explainabilityFamily,
-                        effectiveModel: explainabilityModel ?? null,
-                        quotaKey: selectionQuotaKey,
-                        selectedAccountIndex: activeIndex,
-                        selectionExplainability: explainability,
-                    });
-                    const explainabilityByIndex = new Map(explainability.map((entry) => [entry.index, entry]));
-                    const recommendedNextAction = recommendBeginnerNextAction({
-                        accounts: toBeginnerAccountSnapshots(storage, activeIndex, now),
-                        now,
-                        runtime: getBeginnerRuntimeSnapshot(),
-                    });
-                    if (outputFormat === "json") {
-                        return renderJsonOutput({
-                            totalAccounts: storage.accounts.length,
-                            selectionView: {
-                                modelFamily: explainabilityFamily,
-                                effectiveModel: explainabilityModel ?? null,
-                                label: explainabilityModel
-                                    ? `${explainabilityFamily}:${explainabilityModel}`
-                                    : explainabilityFamily,
-                            },
-                            accounts: storage.accounts.map((account, index) => ({
-                                ...buildJsonAccountIdentity(index, {
-                                    includeSensitive: includeSensitiveOutput,
-                                    account,
-                                }),
-                                enabled: account.enabled !== false,
-                                isActive: index === activeIndex,
-                                rateLimit: formatRateLimitEntry(account, now) ?? null,
-                                cooldown: formatCooldown(account, now) ?? null,
-                                lastUsedAgeMs: typeof account.lastUsed === "number" && account.lastUsed > 0
-                                    ? Math.max(0, now - account.lastUsed)
-                                    : null,
-                            })),
-                            activeIndexByFamily: Object.fromEntries(MODEL_FAMILIES.map((family) => [
-                                family,
-                                typeof storage.activeIndexByFamily?.[family] === "number"
-                                    ? (storage.activeIndexByFamily?.[family] ?? 0) + 1
-                                    : null,
-                            ])),
-                            rateLimitsByModelFamily: storage.accounts.map((account, index) => ({
-                                ...buildJsonAccountIdentity(index, {
-                                    includeSensitive: includeSensitiveOutput,
-                                    account,
-                                }),
-                                families: Object.fromEntries(MODEL_FAMILIES.map((family) => {
-                                    const resetAt = getRateLimitResetTimeForFamily(account, now, family);
-                                    return [
-                                        family,
-                                        typeof resetAt === "number"
-                                            ? {
-                                                resetAtMs: resetAt,
-                                                wait: formatWaitTime(resetAt - now),
-                                            }
-                                            : null,
-                                    ];
-                                })),
-                            })),
-                            routingVisibility,
-                            recommendedNextAction,
-                        });
-                    }
-                    if (ui.v2Enabled) {
-                        const lines = [
-                            ...formatUiHeader(ui, "Account status"),
-                            formatUiKeyValue(ui, "Total", String(storage.accounts.length)),
-                            formatUiKeyValue(ui, "Selection view", explainabilityModel
-                                ? `${explainabilityFamily}:${explainabilityModel}`
-                                : explainabilityFamily, "muted"),
-                            "",
-                            ...formatUiSection(ui, "Accounts"),
-                        ];
-                        storage.accounts.forEach((account, index) => {
-                            const label = formatCommandAccountLabel(account, index);
-                            const badges = [];
-                            if (index === activeIndex)
-                                badges.push(formatUiBadge(ui, "active", "accent"));
-                            if (account.enabled === false)
-                                badges.push(formatUiBadge(ui, "disabled", "danger"));
-                            const rateLimit = formatRateLimitEntry(account, now) ?? "none";
-                            const cooldown = formatCooldown(account, now) ?? "none";
-                            if (rateLimit !== "none")
-                                badges.push(formatUiBadge(ui, "rate-limited", "warning"));
-                            if (cooldown !== "none")
-                                badges.push(formatUiBadge(ui, "cooldown", "warning"));
-                            if (badges.length === 0)
-                                badges.push(formatUiBadge(ui, "ok", "success"));
-                            lines.push(formatUiItem(ui, `${label} ${badges.join(" ")}`.trim()));
-                            lines.push(`  ${formatUiKeyValue(ui, "rate limit", rateLimit, rateLimit === "none" ? "muted" : "warning")}`);
-                            lines.push(`  ${formatUiKeyValue(ui, "cooldown", cooldown, cooldown === "none" ? "muted" : "warning")}`);
-                        });
-                        lines.push("");
-                        lines.push(...formatUiSection(ui, "Active index by model family"));
-                        for (const family of MODEL_FAMILIES) {
-                            const idx = storage.activeIndexByFamily?.[family];
-                            const familyIndexLabel = typeof idx === "number" && Number.isFinite(idx) ? String(idx + 1) : "-";
-                            lines.push(formatUiItem(ui, `${family}: ${familyIndexLabel}`));
-                        }
-                        lines.push("");
-                        lines.push(...formatUiSection(ui, "Rate limits by model family (per account)"));
-                        storage.accounts.forEach((account, index) => {
-                            const statuses = MODEL_FAMILIES.map((family) => {
-                                const resetAt = getRateLimitResetTimeForFamily(account, now, family);
-                                if (typeof resetAt !== "number")
-                                    return `${family}=ok`;
-                                return `${family}=${formatWaitTime(resetAt - now)}`;
-                            });
-                            lines.push(formatUiItem(ui, `Account ${index + 1}: ${statuses.join(" | ")}`));
-                        });
-                        lines.push("");
-                        appendRoutingVisibilityUi(ui, lines, routingVisibility);
-                        lines.push("");
-                        lines.push(...formatUiSection(ui, "Selection explainability"));
-                        for (const entry of explainability) {
-                            const state = entry.eligible ? "eligible" : "blocked";
-                            const reasons = entry.reasons.join(", ");
-                            lines.push(formatUiItem(ui, `Account ${entry.index + 1}: ${state} | health=${Math.round(entry.healthScore)} | tokens=${entry.tokensAvailable.toFixed(1)} | ${reasons}`));
-                        }
-                        lines.push("");
-                        lines.push(...formatUiSection(ui, "Recommended next step"));
-                        lines.push(formatUiItem(ui, recommendedNextAction, "accent"));
-                        return lines.join("\n");
-                    }
-                    const statusTableOptions = {
-                        columns: [
-                            { header: "#", width: 3 },
-                            { header: "Label", width: 42 },
-                            { header: "Active", width: 6 },
-                            { header: "Rate Limit", width: 16 },
-                            { header: "Cooldown", width: 16 },
-                            { header: "Last Used", width: 16 },
-                        ],
-                    };
-                    const lines = [
-                        `Account Status (${storage.accounts.length} total):`,
-                        "",
-                        ...buildTableHeader(statusTableOptions),
-                    ];
-                    storage.accounts.forEach((account, index) => {
-                        const label = formatCommandAccountLabel(account, index);
-                        const active = index === activeIndex ? "Yes" : "No";
-                        const rateLimit = formatRateLimitEntry(account, now) ?? "None";
-                        const cooldown = formatCooldown(account, now) ?? "No";
-                        const lastUsed = typeof account.lastUsed === "number" && account.lastUsed > 0
-                            ? `${formatWaitTime(now - account.lastUsed)} ago`
-                            : "-";
-                        lines.push(buildTableRow([String(index + 1), label, active, rateLimit, cooldown, lastUsed], statusTableOptions));
-                    });
-                    lines.push("");
-                    lines.push("Active index by model family:");
-                    for (const family of MODEL_FAMILIES) {
-                        const idx = storage.activeIndexByFamily?.[family];
-                        const familyIndexLabel = typeof idx === "number" && Number.isFinite(idx) ? String(idx + 1) : "-";
-                        lines.push(`  ${family}: ${familyIndexLabel}`);
-                    }
-                    lines.push("");
-                    lines.push("Rate limits by model family (per account):");
-                    storage.accounts.forEach((account, index) => {
-                        const statuses = MODEL_FAMILIES.map((family) => {
-                            const resetAt = getRateLimitResetTimeForFamily(account, now, family);
-                            if (typeof resetAt !== "number")
-                                return `${family}=ok`;
-                            return `${family}=${formatWaitTime(resetAt - now)}`;
-                        });
-                        lines.push(`  Account ${index + 1}: ${statuses.join(" | ")}`);
-                    });
-                    lines.push("");
-                    appendRoutingVisibilityText(lines, routingVisibility);
-                    lines.push("");
-                    lines.push(`Selection explainability (${explainabilityModel ? `${explainabilityFamily}:${explainabilityModel}` : explainabilityFamily}):`);
-                    for (const [index] of storage.accounts.entries()) {
-                        const details = explainabilityByIndex.get(index);
-                        if (!details)
-                            continue;
-                        const state = details.eligible ? "eligible" : "blocked";
-                        lines.push(`  Account ${index + 1}: ${state} | health=${Math.round(details.healthScore)} | tokens=${details.tokensAvailable.toFixed(1)} | ${details.reasons.join(", ")}`);
-                    }
-                    lines.push("");
-                    lines.push(`Recommended next step: ${recommendedNextAction}`);
-                    return lines.join("\n");
-                },
-            }),
-            "codex-limits": tool({
-                description: "Show live 5-hour and weekly Codex usage limits for all accounts.",
-                args: {
-                    format: toolOutputFormatSchema(),
-                    includeSensitive: toolSensitiveJsonSchema(),
-                },
-                async execute({ format, includeSensitive } = {}) {
-                    const ui = resolveUiRuntime();
-                    const outputFormat = normalizeToolOutputFormat(format);
-                    const includeSensitiveOutput = includeSensitive === true;
-                    const storage = await loadAccounts();
-                    if (!storage || storage.accounts.length === 0) {
-                        if (outputFormat === "json") {
-                            return renderJsonOutput({
-                                message: "No Codex accounts configured. Run: opencode auth login",
-                                totalAccounts: 0,
-                                uniqueCredentialCount: 0,
-                                activeIndex: null,
-                                accounts: [],
-                            });
-                        }
-                        if (ui.v2Enabled) {
-                            return [
-                                ...formatUiHeader(ui, "Codex limits"),
-                                "",
-                                formatUiItem(ui, "No accounts configured.", "warning"),
-                                formatUiItem(ui, "Run: opencode auth login", "accent"),
-                            ].join("\n");
-                        }
-                        return "No Codex accounts configured. Run: opencode auth login";
-                    }
-                    const formatWindowLabel = (windowMinutes) => {
-                        if (!windowMinutes || !Number.isFinite(windowMinutes) || windowMinutes <= 0) {
-                            return "quota";
-                        }
-                        if (windowMinutes % 1440 === 0)
-                            return `${windowMinutes / 1440}d`;
-                        if (windowMinutes % 60 === 0)
-                            return `${windowMinutes / 60}h`;
-                        return `${windowMinutes}m`;
-                    };
-                    const formatReset = (resetAtMs) => {
-                        if (!resetAtMs || !Number.isFinite(resetAtMs) || resetAtMs <= 0)
-                            return undefined;
-                        const date = new Date(resetAtMs);
-                        if (!Number.isFinite(date.getTime()))
-                            return undefined;
-                        const now = new Date();
-                        const sameDay = now.getFullYear() === date.getFullYear() &&
-                            now.getMonth() === date.getMonth() &&
-                            now.getDate() === date.getDate();
-                        const time = date.toLocaleTimeString(undefined, {
-                            hour: "2-digit",
-                            minute: "2-digit",
-                            hour12: false,
-                        });
-                        if (sameDay)
-                            return time;
-                        const day = date.toLocaleDateString(undefined, { month: "short", day: "2-digit" });
-                        return `${time} on ${day}`;
-                    };
-                    const mapWindow = (window) => {
-                        if (!window)
-                            return {};
-                        return {
-                            usedPercent: typeof window.used_percent === "number" && Number.isFinite(window.used_percent)
-                                ? window.used_percent
-                                : undefined,
-                            windowMinutes: typeof window.limit_window_seconds === "number" && Number.isFinite(window.limit_window_seconds)
-                                ? Math.max(1, Math.ceil(window.limit_window_seconds / 60))
-                                : undefined,
-                            resetAtMs: typeof window.reset_at === "number" && window.reset_at > 0
-                                ? window.reset_at * 1000
-                                : typeof window.reset_after_seconds === "number" && window.reset_after_seconds > 0
-                                    ? Date.now() + window.reset_after_seconds * 1000
-                                    : undefined,
-                        };
-                    };
-                    const formatLimitTitle = (windowMinutes, fallback = "quota") => {
-                        if (windowMinutes === 300)
-                            return "5h limit";
-                        if (windowMinutes === 10080)
-                            return "Weekly limit";
-                        if (fallback !== "quota")
-                            return fallback;
-                        return `${formatWindowLabel(windowMinutes)} limit`;
-                    };
-                    const formatLimitSummary = (window) => {
-                        const used = window.usedPercent;
-                        const left = typeof used === "number" && Number.isFinite(used)
-                            ? Math.max(0, Math.min(100, Math.round(100 - used)))
-                            : undefined;
-                        const reset = formatReset(window.resetAtMs);
-                        if (left !== undefined && reset)
-                            return `${left}% left (resets ${reset})`;
-                        if (left !== undefined)
-                            return `${left}% left`;
-                        if (reset)
-                            return `resets ${reset}`;
-                        return "unavailable";
-                    };
-                    const toLimitPayload = (name, window) => ({
-                        name,
-                        windowMinutes: window.windowMinutes ?? null,
-                        usedPercent: typeof window.usedPercent === "number" ? window.usedPercent : null,
-                        leftPercent: typeof window.usedPercent === "number"
-                            ? Math.max(0, Math.min(100, Math.round(100 - window.usedPercent)))
-                            : null,
-                        resetAtMs: window.resetAtMs ?? null,
-                        summary: formatLimitSummary(window),
-                    });
-                    const formatCredits = (credits) => {
-                        if (!credits)
-                            return undefined;
-                        if (credits.unlimited)
-                            return "unlimited";
-                        if (typeof credits.balance === "string" && credits.balance.trim()) {
-                            return credits.balance.trim();
-                        }
-                        if (credits.has_credits)
-                            return "available";
-                        return undefined;
-                    };
-                    const formatExtraName = (name) => {
-                        if (!name)
-                            return "Additional limit";
-                        if (name === "code_review_rate_limit")
-                            return "Code review";
-                        return name.replace(/[_-]+/g, " ").replace(/\b\w/g, (match) => match.toUpperCase());
-                    };
-                    const sanitizeUsageErrorMessage = (status, bodyText) => {
-                        const normalized = bodyText.replace(/\s+/g, " ").trim();
-                        const redacted = normalized
-                            .replace(/Bearer\s+\S+/gi, "Bearer [redacted]")
-                            .replace(/eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g, "[redacted-token]")
-                            .replace(/\bsk-[A-Za-z0-9][A-Za-z0-9._:-]{19,}\b/gi, "[redacted-token]")
-                            .replace(/\b[a-f0-9]{40,}\b/gi, "[redacted-token]");
-                        return redacted ? `HTTP ${status}: ${redacted.slice(0, 200)}` : `HTTP ${status}`;
-                    };
-                    const isAbortError = (error) => (error instanceof Error && error.name === "AbortError") ||
-                        (typeof DOMException !== "undefined" && error instanceof DOMException && error.name === "AbortError");
-                    const applyRefreshedCredentials = (target, result) => {
-                        target.refreshToken = result.refresh;
-                        target.accessToken = result.access;
-                        target.expiresAt = result.expires;
-                    };
-                    const usageErrorBodyMaxChars = 4096;
-                    const persistRefreshedCredentials = async (params) => {
-                        return await withAccountStorageTransaction(async (current, persist) => {
-                            const latestStorage = current ??
-                                {
-                                    version: 3,
-                                    accounts: [],
-                                    activeIndex: 0,
-                                    activeIndexByFamily: {},
-                                };
-                            const uniqueMatch = (matches) => matches.length === 1 ? matches[0] : undefined;
-                            let updated = false;
-                            if (params.previousRefreshToken) {
-                                for (const storedAccount of latestStorage.accounts) {
-                                    if (storedAccount.refreshToken === params.previousRefreshToken) {
-                                        applyRefreshedCredentials(storedAccount, params.refreshResult);
-                                        updated = true;
-                                    }
-                                }
-                            }
-                            if (!updated) {
-                                const normalizedOrganizationId = params.organizationId?.trim() ?? "";
-                                const normalizedEmail = params.email?.trim().toLowerCase();
-                                const orgScopedMatches = params.accountId
-                                    ? latestStorage.accounts.filter((storedAccount) => storedAccount.accountId === params.accountId &&
-                                        (storedAccount.organizationId?.trim() ?? "") === normalizedOrganizationId)
-                                    : [];
-                                const accountIdMatches = params.accountId
-                                    ? latestStorage.accounts.filter((storedAccount) => storedAccount.accountId === params.accountId)
-                                    : [];
-                                const emailMatches = normalizedEmail && !params.accountId
-                                    ? latestStorage.accounts.filter((storedAccount) => storedAccount.email?.trim().toLowerCase() === normalizedEmail)
-                                    : [];
-                                const fallbackTarget = uniqueMatch(orgScopedMatches) ??
-                                    uniqueMatch(accountIdMatches) ??
-                                    uniqueMatch(emailMatches);
-                                if (fallbackTarget) {
-                                    applyRefreshedCredentials(fallbackTarget, params.refreshResult);
-                                    updated = true;
-                                }
-                            }
-                            if (updated) {
-                                await persist(latestStorage);
-                            }
-                            if (!updated) {
-                                logWarn(`[${PLUGIN_NAME}] persistRefreshedCredentials could not find a matching stored account. Refreshed credentials remain in-memory for this invocation only.`, {
-                                    accountId: params.accountId,
-                                    organizationId: params.organizationId,
-                                });
-                            }
-                            return updated;
-                        });
-                    };
-                    const usageFetchTimeoutMs = getFetchTimeoutMs(loadPluginConfig());
-                    const fetchUsage = async (params) => {
-                        const headers = createCodexHeaders(undefined, params.accountId, params.accessToken, {
-                            organizationId: params.organizationId,
-                        });
-                        headers.set("accept", "application/json");
-                        const controller = new AbortController();
-                        const timeout = setTimeout(() => controller.abort(), usageFetchTimeoutMs);
-                        try {
-                            const response = await fetch(`${CODEX_BASE_URL}/wham/usage`, {
-                                method: "GET",
-                                headers,
-                                signal: controller.signal,
-                            });
-                            if (!response.ok) {
-                                let bodyText = "";
-                                try {
-                                    bodyText = (await response.text()).slice(0, usageErrorBodyMaxChars);
-                                }
-                                catch (error) {
-                                    if (isAbortError(error) || controller.signal.aborted) {
-                                        throw createUsageRequestTimeoutError();
-                                    }
-                                    throw error;
-                                }
-                                if (controller.signal.aborted) {
-                                    throw createUsageRequestTimeoutError();
-                                }
-                                throw new Error(sanitizeUsageErrorMessage(response.status, bodyText));
-                            }
-                            return (await response.json());
-                        }
-                        catch (error) {
-                            if (isAbortError(error)) {
-                                throw createUsageRequestTimeoutError();
-                            }
-                            throw error;
-                        }
-                        finally {
-                            clearTimeout(timeout);
-                        }
-                    };
-                    // Deduplicate accounts by refreshToken (same credential = same limits)
-                    const seenTokens = new Set();
-                    const uniqueIndices = [];
-                    for (let i = 0; i < storage.accounts.length; i++) {
-                        const acct = storage.accounts[i];
-                        if (!acct)
-                            continue;
-                        const refreshToken = typeof acct.refreshToken === "string" ? acct.refreshToken.trim() : "";
-                        if (refreshToken && seenTokens.has(refreshToken))
-                            continue;
-                        if (refreshToken)
-                            seenTokens.add(refreshToken);
-                        uniqueIndices.push(i);
-                    }
-                    const lines = ui.v2Enabled
-                        ? [...formatUiHeader(ui, "Codex limits"), ""]
-                        : [`Codex limits (${uniqueIndices.length} account${uniqueIndices.length === 1 ? "" : "s"}):`, ""];
-                    const activeIndex = resolveActiveIndex(storage, "codex");
-                    const activeRefreshToken = typeof activeIndex === "number" && activeIndex >= 0 && activeIndex < storage.accounts.length
-                        ? storage.accounts[activeIndex]?.refreshToken?.trim() || undefined
-                        : undefined;
-                    let storageChanged = false;
-                    const jsonAccounts = [];
-                    for (const i of uniqueIndices) {
-                        const account = storage.accounts[i];
-                        if (!account)
-                            continue;
-                        const sharesActiveCredential = !!activeRefreshToken && account.refreshToken === activeRefreshToken;
-                        const displayIndex = sharesActiveCredential && typeof activeIndex === "number" ? activeIndex : i;
-                        const displayAccount = storage.accounts[displayIndex];
-                        if (sharesActiveCredential && !displayAccount) {
-                            logWarn(`[${PLUGIN_NAME}] active account entry missing for index ${displayIndex}, falling back to account ${i}`);
-                        }
-                        const effectiveDisplayAccount = displayAccount ?? account;
-                        const label = formatCommandAccountLabel(effectiveDisplayAccount, displayIndex);
-                        const isActive = i === activeIndex || sharesActiveCredential;
-                        const activeSuffix = isActive ? (ui.v2Enabled ? ` ${formatUiBadge(ui, "active", "accent")}` : " [active]") : "";
-                        try {
-                            let accessToken = account.accessToken;
-                            if (typeof accessToken !== "string" ||
-                                !accessToken ||
-                                typeof account.expiresAt !== "number" ||
-                                account.expiresAt <= Date.now() + 30_000) {
-                                const previousRefreshToken = account.refreshToken;
-                                if (!previousRefreshToken) {
-                                    throw new Error("Cannot refresh: account has no refresh token");
-                                }
-                                const refreshResult = await queuedRefresh(previousRefreshToken);
-                                if (refreshResult.type !== "success") {
-                                    throw new Error(refreshResult.message ?? refreshResult.reason);
-                                }
-                                let refreshedCount = 0;
-                                for (const storedAccount of storage.accounts) {
-                                    if (!storedAccount)
-                                        continue;
-                                    if (storedAccount.refreshToken === previousRefreshToken) {
-                                        applyRefreshedCredentials(storedAccount, refreshResult);
-                                        refreshedCount += 1;
-                                    }
-                                }
-                                if (refreshedCount === 0) {
-                                    applyRefreshedCredentials(account, refreshResult);
-                                }
-                                const persistedRefresh = await persistRefreshedCredentials({
-                                    previousRefreshToken,
-                                    accountId: account.accountId,
-                                    organizationId: account.organizationId,
-                                    email: account.email,
-                                    refreshResult,
-                                });
-                                accessToken = refreshResult.access;
-                                storageChanged = storageChanged || persistedRefresh;
-                            }
-                            const effectiveAccount = sharesActiveCredential ? effectiveDisplayAccount : account;
-                            const accountId = effectiveAccount.accountId ?? extractAccountId(accessToken);
-                            if (!accountId) {
-                                throw new Error("Missing account id");
-                            }
-                            const payload = await fetchUsage({
-                                accountId,
-                                accessToken,
-                                organizationId: effectiveAccount.organizationId,
-                            });
-                            const primary = mapWindow(payload.rate_limit?.primary_window ?? null);
-                            const secondary = mapWindow(payload.rate_limit?.secondary_window ?? null);
-                            const codeReviewRateLimit = payload.code_review_rate_limit ??
-                                payload.additional_rate_limits?.find((entry) => entry.limit_name === "code_review_rate_limit")?.rate_limit ??
-                                null;
-                            const codeReview = mapWindow(codeReviewRateLimit?.primary_window ?? null);
-                            const credits = formatCredits(payload.credits ?? null);
-                            const additionalLimits = (payload.additional_rate_limits ?? []).filter((entry) => entry.limit_name !== "code_review_rate_limit");
-                            const limits = [
-                                toLimitPayload(formatLimitTitle(primary.windowMinutes), primary),
-                                toLimitPayload(formatLimitTitle(secondary.windowMinutes), secondary),
-                            ];
-                            if (codeReview.windowMinutes ||
-                                typeof codeReview.usedPercent === "number" ||
-                                codeReview.resetAtMs) {
-                                limits.push(toLimitPayload("Code review", codeReview));
-                            }
-                            for (const limit of additionalLimits) {
-                                const extraWindow = mapWindow(limit.rate_limit?.primary_window ?? null);
-                                limits.push(toLimitPayload(formatExtraName(limit.limit_name ?? limit.metered_feature), extraWindow));
-                            }
-                            jsonAccounts.push({
-                                ...buildJsonAccountIdentity(displayIndex, {
-                                    includeSensitive: includeSensitiveOutput,
-                                    account: effectiveDisplayAccount,
-                                    label,
-                                }),
-                                isActive,
-                                sharesActiveCredential,
-                                planType: payload.plan_type ?? null,
-                                credits: credits ?? null,
-                                limits,
-                            });
-                            if (ui.v2Enabled) {
-                                lines.push(formatUiItem(ui, `${label}${activeSuffix}`));
-                                lines.push(`  ${formatUiKeyValue(ui, formatLimitTitle(primary.windowMinutes), formatLimitSummary(primary), "muted")}`);
-                                lines.push(`  ${formatUiKeyValue(ui, formatLimitTitle(secondary.windowMinutes), formatLimitSummary(secondary), "muted")}`);
-                                if (codeReview.windowMinutes || typeof codeReview.usedPercent === "number" || codeReview.resetAtMs) {
-                                    lines.push(`  ${formatUiKeyValue(ui, "Code review", formatLimitSummary(codeReview), "muted")}`);
-                                }
-                                for (const limit of additionalLimits) {
-                                    const extraWindow = mapWindow(limit.rate_limit?.primary_window ?? null);
-                                    lines.push(`  ${formatUiKeyValue(ui, formatExtraName(limit.limit_name ?? limit.metered_feature), formatLimitSummary(extraWindow), "muted")}`);
-                                }
-                                if (payload.plan_type) {
-                                    lines.push(`  ${formatUiKeyValue(ui, "Plan", payload.plan_type, "muted")}`);
-                                }
-                                if (credits) {
-                                    lines.push(`  ${formatUiKeyValue(ui, "Credits", credits, "muted")}`);
-                                }
-                            }
-                            else {
-                                lines.push(`${label}${activeSuffix}:`);
-                                lines.push(`  ${formatLimitTitle(primary.windowMinutes)}: ${formatLimitSummary(primary)}`);
-                                lines.push(`  ${formatLimitTitle(secondary.windowMinutes)}: ${formatLimitSummary(secondary)}`);
-                                if (codeReview.windowMinutes || typeof codeReview.usedPercent === "number" || codeReview.resetAtMs) {
-                                    lines.push(`  Code review: ${formatLimitSummary(codeReview)}`);
-                                }
-                                for (const limit of additionalLimits) {
-                                    const extraWindow = mapWindow(limit.rate_limit?.primary_window ?? null);
-                                    lines.push(`  ${formatExtraName(limit.limit_name ?? limit.metered_feature)}: ${formatLimitSummary(extraWindow)}`);
-                                }
-                                if (payload.plan_type) {
-                                    lines.push(`  Plan: ${payload.plan_type}`);
-                                }
-                                if (credits) {
-                                    lines.push(`  Credits: ${credits}`);
-                                }
-                            }
-                        }
-                        catch (error) {
-                            const message = error instanceof Error ? error.message : String(error);
-                            jsonAccounts.push({
-                                ...buildJsonAccountIdentity(displayIndex, {
-                                    includeSensitive: includeSensitiveOutput,
-                                    account: effectiveDisplayAccount,
-                                    label,
-                                }),
-                                isActive,
-                                sharesActiveCredential,
-                                error: message.slice(0, 160),
-                            });
-                            if (ui.v2Enabled) {
-                                lines.push(formatUiItem(ui, `${label}${activeSuffix}`));
-                                lines.push(`  ${formatUiKeyValue(ui, "Error", message.slice(0, 160), "danger")}`);
-                            }
-                            else {
-                                lines.push(`${label}${activeSuffix}:`);
-                                lines.push(`  Error: ${message.slice(0, 160)}`);
-                            }
-                        }
-                        lines.push("");
-                    }
-                    if (storageChanged) {
-                        invalidateAccountManagerCache();
-                    }
-                    if (outputFormat === "json") {
-                        return renderJsonOutput({
-                            totalAccounts: storage.accounts.length,
-                            uniqueCredentialCount: uniqueIndices.length,
-                            activeIndex: activeIndex + 1,
-                            accounts: jsonAccounts,
-                        });
-                    }
-                    while (lines.length > 0 && lines[lines.length - 1] === "") {
-                        lines.pop();
-                    }
-                    return lines.join("\n");
-                },
-            }),
-            "codex-metrics": tool({
-                description: "Show runtime request metrics for this plugin process.",
-                args: {
-                    format: toolOutputFormatSchema(),
-                },
-                execute({ format } = {}) {
-                    const ui = resolveUiRuntime();
-                    const outputFormat = normalizeToolOutputFormat(format);
-                    const now = Date.now();
-                    const uptimeMs = Math.max(0, now - runtimeMetrics.startedAt);
-                    const total = runtimeMetrics.totalRequests;
-                    const successful = runtimeMetrics.successfulRequests;
-                    const refreshMetrics = getRefreshQueueMetrics();
-                    const successRate = total > 0 ? ((successful / total) * 100).toFixed(1) : "0.0";
-                    const avgLatencyMs = successful > 0
-                        ? Math.round(runtimeMetrics.cumulativeLatencyMs / successful)
-                        : 0;
-                    const lastRequest = runtimeMetrics.lastRequestAt !== null
-                        ? `${formatWaitTime(now - runtimeMetrics.lastRequestAt)} ago`
-                        : "never";
-                    const routingVisibility = buildRoutingVisibilitySnapshot();
-                    if (outputFormat === "json") {
-                        return Promise.resolve(renderJsonOutput({
-                            uptimeMs,
-                            totalRequests: total,
-                            successfulResponses: successful,
-                            failedResponses: runtimeMetrics.failedRequests,
-                            successRatePercent: Number(successRate),
-                            averageSuccessfulLatencyMs: avgLatencyMs,
-                            rateLimitedResponses: runtimeMetrics.rateLimitedResponses,
-                            serverErrors: runtimeMetrics.serverErrors,
-                            networkErrors: runtimeMetrics.networkErrors,
-                            authRefreshFailures: runtimeMetrics.authRefreshFailures,
-                            accountRotations: runtimeMetrics.accountRotations,
-                            emptyResponseRetries: runtimeMetrics.emptyResponseRetries,
-                            retryProfile: runtimeMetrics.retryProfile,
-                            beginnerSafeMode: beginnerSafeModeEnabled,
-                            retryBudgetExhaustions: runtimeMetrics.retryBudgetExhaustions,
-                            retryBudgetUsage: { ...runtimeMetrics.retryBudgetUsage },
-                            retryBudgetLimits: { ...runtimeMetrics.retryBudgetLimits },
-                            refreshQueue: { ...refreshMetrics },
-                            lastRequestAt: runtimeMetrics.lastRequestAt,
-                            lastRequestAgeMs: runtimeMetrics.lastRequestAt !== null
-                                ? Math.max(0, now - runtimeMetrics.lastRequestAt)
-                                : null,
-                            lastError: runtimeMetrics.lastError,
-                            lastErrorCategory: runtimeMetrics.lastErrorCategory,
-                            lastSelectedAccountIndex: runtimeMetrics.lastSelectedAccountIndex === null
-                                ? null
-                                : runtimeMetrics.lastSelectedAccountIndex + 1,
-                            lastQuotaKey: runtimeMetrics.lastQuotaKey,
-                            lastBudgetExhaustion: runtimeMetrics.lastRetryBudgetExhaustedClass === null
-                                ? null
-                                : {
-                                    budgetClass: runtimeMetrics.lastRetryBudgetExhaustedClass,
-                                    reason: runtimeMetrics.lastRetryBudgetReason,
-                                },
-                            routingVisibility,
-                        }));
-                    }
-                    const lines = [
-                        "Codex Plugin Metrics:",
-                        "",
-                        `Uptime: ${formatWaitTime(uptimeMs)}`,
-                        `Total upstream requests: ${total}`,
-                        `Successful responses: ${successful}`,
-                        `Failed responses: ${runtimeMetrics.failedRequests}`,
-                        `Success rate: ${successRate}%`,
-                        `Average successful latency: ${avgLatencyMs}ms`,
-                        `Rate-limited responses: ${runtimeMetrics.rateLimitedResponses}`,
-                        `Server errors (5xx): ${runtimeMetrics.serverErrors}`,
-                        `Network errors: ${runtimeMetrics.networkErrors}`,
-                        `Auth refresh failures: ${runtimeMetrics.authRefreshFailures}`,
-                        `Account rotations: ${runtimeMetrics.accountRotations}`,
-                        `Empty-response retries: ${runtimeMetrics.emptyResponseRetries}`,
-                        `Retry profile: ${runtimeMetrics.retryProfile}`,
-                        `Beginner safe mode: ${beginnerSafeModeEnabled ? "on" : "off"}`,
-                        `Retry budget exhaustions: ${runtimeMetrics.retryBudgetExhaustions}`,
-                        `Retry budget usage (auth/network/server/short/global/empty): ` +
-                            `${runtimeMetrics.retryBudgetUsage.authRefresh}/` +
-                            `${runtimeMetrics.retryBudgetUsage.network}/` +
-                            `${runtimeMetrics.retryBudgetUsage.server}/` +
-                            `${runtimeMetrics.retryBudgetUsage.rateLimitShort}/` +
-                            `${runtimeMetrics.retryBudgetUsage.rateLimitGlobal}/` +
-                            `${runtimeMetrics.retryBudgetUsage.emptyResponse}`,
-                        `Refresh queue (started/success/failed/pending): ` +
-                            `${refreshMetrics.started}/` +
-                            `${refreshMetrics.succeeded}/` +
-                            `${refreshMetrics.failed}/` +
-                            `${refreshMetrics.pending}`,
-                        `Last upstream request: ${lastRequest}`,
-                    ];
-                    if (runtimeMetrics.lastError) {
-                        lines.push(`Last error: ${runtimeMetrics.lastError}`);
-                    }
-                    if (runtimeMetrics.lastErrorCategory) {
-                        lines.push(`Last error category: ${runtimeMetrics.lastErrorCategory}`);
-                    }
-                    if (runtimeMetrics.lastSelectedAccountIndex !== null) {
-                        lines.push(`Last selected account: ${runtimeMetrics.lastSelectedAccountIndex + 1}`);
-                    }
-                    if (runtimeMetrics.lastQuotaKey) {
-                        lines.push(`Last quota key: ${runtimeMetrics.lastQuotaKey}`);
-                    }
-                    if (runtimeMetrics.lastRetryBudgetExhaustedClass) {
-                        lines.push(`Last budget exhaustion: ${runtimeMetrics.lastRetryBudgetExhaustedClass}` +
-                            (runtimeMetrics.lastRetryBudgetReason
-                                ? ` (${runtimeMetrics.lastRetryBudgetReason})`
-                                : ""));
-                    }
-                    lines.push("");
-                    appendRoutingVisibilityText(lines, routingVisibility, {
-                        includeExplainability: true,
-                    });
-                    if (ui.v2Enabled) {
-                        const styled = [
-                            ...formatUiHeader(ui, "Codex plugin metrics"),
-                            formatUiKeyValue(ui, "Uptime", formatWaitTime(uptimeMs)),
-                            formatUiKeyValue(ui, "Total upstream requests", String(total)),
-                            formatUiKeyValue(ui, "Successful responses", String(successful), "success"),
-                            formatUiKeyValue(ui, "Failed responses", String(runtimeMetrics.failedRequests), "danger"),
-                            formatUiKeyValue(ui, "Success rate", `${successRate}%`, "accent"),
-                            formatUiKeyValue(ui, "Average successful latency", `${avgLatencyMs}ms`),
-                            formatUiKeyValue(ui, "Rate-limited responses", String(runtimeMetrics.rateLimitedResponses), "warning"),
-                            formatUiKeyValue(ui, "Server errors (5xx)", String(runtimeMetrics.serverErrors), "danger"),
-                            formatUiKeyValue(ui, "Network errors", String(runtimeMetrics.networkErrors), "danger"),
-                            formatUiKeyValue(ui, "Auth refresh failures", String(runtimeMetrics.authRefreshFailures), "warning"),
-                            formatUiKeyValue(ui, "Account rotations", String(runtimeMetrics.accountRotations), "accent"),
-                            formatUiKeyValue(ui, "Empty-response retries", String(runtimeMetrics.emptyResponseRetries), "warning"),
-                            formatUiKeyValue(ui, "Retry profile", runtimeMetrics.retryProfile, "muted"),
-                            formatUiKeyValue(ui, "Beginner safe mode", beginnerSafeModeEnabled ? "on" : "off", beginnerSafeModeEnabled ? "accent" : "muted"),
-                            formatUiKeyValue(ui, "Retry budget exhaustions", String(runtimeMetrics.retryBudgetExhaustions), "warning"),
-                            formatUiKeyValue(ui, "Retry budget usage", `A${runtimeMetrics.retryBudgetUsage.authRefresh} N${runtimeMetrics.retryBudgetUsage.network} S${runtimeMetrics.retryBudgetUsage.server} RS${runtimeMetrics.retryBudgetUsage.rateLimitShort} RG${runtimeMetrics.retryBudgetUsage.rateLimitGlobal} E${runtimeMetrics.retryBudgetUsage.emptyResponse}`, "muted"),
-                            formatUiKeyValue(ui, "Retry budget limits", `A${runtimeMetrics.retryBudgetLimits.authRefresh} N${runtimeMetrics.retryBudgetLimits.network} S${runtimeMetrics.retryBudgetLimits.server} RS${runtimeMetrics.retryBudgetLimits.rateLimitShort} RG${runtimeMetrics.retryBudgetLimits.rateLimitGlobal} E${runtimeMetrics.retryBudgetLimits.emptyResponse}`, "muted"),
-                            formatUiKeyValue(ui, "Refresh queue", `started=${refreshMetrics.started} dedup=${refreshMetrics.deduplicated} reuse=${refreshMetrics.rotationReused} success=${refreshMetrics.succeeded} failed=${refreshMetrics.failed} pending=${refreshMetrics.pending}`, "muted"),
-                            formatUiKeyValue(ui, "Last upstream request", lastRequest, "muted"),
-                        ];
-                        if (runtimeMetrics.lastError) {
-                            styled.push(formatUiKeyValue(ui, "Last error", runtimeMetrics.lastError, "danger"));
-                        }
-                        if (runtimeMetrics.lastErrorCategory) {
-                            styled.push(formatUiKeyValue(ui, "Last error category", runtimeMetrics.lastErrorCategory, "warning"));
-                        }
-                        if (runtimeMetrics.lastSelectedAccountIndex !== null) {
-                            styled.push(formatUiKeyValue(ui, "Last selected account", String(runtimeMetrics.lastSelectedAccountIndex + 1), "accent"));
-                        }
-                        if (runtimeMetrics.lastQuotaKey) {
-                            styled.push(formatUiKeyValue(ui, "Last quota key", runtimeMetrics.lastQuotaKey, "muted"));
-                        }
-                        if (runtimeMetrics.lastRetryBudgetExhaustedClass) {
-                            styled.push(formatUiKeyValue(ui, "Last budget exhaustion", runtimeMetrics.lastRetryBudgetReason
-                                ? `${runtimeMetrics.lastRetryBudgetExhaustedClass} (${runtimeMetrics.lastRetryBudgetReason})`
-                                : runtimeMetrics.lastRetryBudgetExhaustedClass, "warning"));
-                        }
-                        styled.push("");
-                        appendRoutingVisibilityUi(ui, styled, routingVisibility, {
-                            includeExplainability: true,
-                        });
-                        return Promise.resolve(styled.join("\n"));
-                    }
-                    return Promise.resolve(lines.join("\n"));
-                },
-            }),
-            "codex-help": tool({
-                description: "Beginner-friendly command guide with quickstart and troubleshooting flows.",
-                args: {
-                    topic: tool.schema
-                        .string()
-                        .optional()
-                        .describe("Optional topic: setup, switch, health, backup, dashboard, metrics."),
-                },
-                async execute({ topic }) {
-                    const ui = resolveUiRuntime();
-                    await Promise.resolve();
-                    const normalizedTopic = (topic ?? "").trim().toLowerCase();
-                    const sections = [
-                        {
-                            key: "setup",
-                            title: "Quickstart",
-                            lines: [
-                                "1) Add account: opencode auth login",
-                                "2) Verify account health: codex-health",
-                                "3) View account list: codex-list",
-                                "4) Run checklist: codex-setup",
-                                "5) Use guided wizard: codex-setup --wizard",
-                                "6) Start requests and monitor: codex-dashboard",
-                            ],
-                        },
-                        {
-                            key: "switch",
-                            title: "Daily account operations",
-                            lines: [
-                                "List accounts: codex-list",
-                                "Switch active account: codex-switch index=2",
-                                "Show detailed status: codex-status",
-                                "Set account label: codex-label index=2 label=\"Work\"",
-                                "Set account tags: codex-tag index=2 tags=\"work,team-a\"",
-                                "Set account note: codex-note index=2 note=\"weekday primary\"",
-                                "Filter by tag: codex-list tag=\"work\"",
-                                "Remove account: codex-remove index=2",
-                            ],
-                        },
-                        {
-                            key: "health",
-                            title: "Health and recovery",
-                            lines: [
-                                "Verify token health: codex-health",
-                                "Refresh all tokens: codex-refresh",
-                                "Run diagnostics: codex-doctor",
-                                "Run diagnostics with fixes: codex-doctor --fix",
-                                "Show best next action: codex-next",
-                                "Run guided wizard: codex-setup --wizard",
-                            ],
-                        },
-                        {
-                            key: "dashboard",
-                            title: "Monitoring",
-                            lines: [
-                                "Live dashboard: codex-dashboard",
-                                "Runtime metrics: codex-metrics",
-                                "Per-account status detail: codex-status",
-                            ],
-                        },
-                        {
-                            key: "backup",
-                            title: "Backup and migration",
-                            lines: [
-                                "Export accounts: codex-export <path>",
-                                "Auto backup export: codex-export",
-                                "Import preview: codex-import <path> --dryRun",
-                                "Import apply: codex-import <path>",
-                                "Setup checklist: codex-setup",
-                            ],
-                        },
-                    ];
-                    const visibleSections = normalizedTopic.length === 0
-                        ? sections
-                        : sections.filter((section) => section.key.includes(normalizedTopic));
-                    if (visibleSections.length === 0) {
-                        const available = sections.map((section) => section.key).join(", ");
-                        if (ui.v2Enabled) {
-                            return [
-                                ...formatUiHeader(ui, "Codex help"),
-                                "",
-                                formatUiItem(ui, `Unknown topic: ${normalizedTopic}`, "warning"),
-                                formatUiItem(ui, `Available topics: ${available}`, "muted"),
-                            ].join("\n");
-                        }
-                        return `Unknown topic: ${normalizedTopic}\n\nAvailable topics: ${available}`;
-                    }
-                    if (ui.v2Enabled) {
-                        const lines = [...formatUiHeader(ui, "Codex help"), ""];
-                        for (const section of visibleSections) {
-                            lines.push(...formatUiSection(ui, section.title));
-                            for (const line of section.lines) {
-                                lines.push(formatUiItem(ui, line));
-                            }
-                            lines.push("");
-                        }
-                        lines.push(...formatUiSection(ui, "Tips"));
-                        lines.push(formatUiItem(ui, "Run codex-setup after adding accounts."));
-                        lines.push(formatUiItem(ui, "Use codex-setup --wizard for menu-driven onboarding."));
-                        lines.push(formatUiItem(ui, "Use codex-doctor when request failures increase."));
-                        return lines.join("\n").trimEnd();
-                    }
-                    const lines = ["Codex Help:", ""];
-                    for (const section of visibleSections) {
-                        lines.push(`${section.title}:`);
-                        for (const line of section.lines) {
-                            lines.push(`  - ${line}`);
-                        }
-                        lines.push("");
-                    }
-                    lines.push("Tips:");
-                    lines.push("  - Run codex-setup after adding accounts.");
-                    lines.push("  - Use codex-setup --wizard for menu-driven onboarding.");
-                    lines.push("  - Use codex-doctor when request failures increase.");
-                    return lines.join("\n");
-                },
-            }),
-            "codex-setup": tool({
-                description: "Beginner checklist for first-time setup and account readiness.",
-                args: {
-                    wizard: tool.schema
-                        .boolean()
-                        .optional()
-                        .describe("Launch menu-driven setup wizard when terminal supports it."),
-                },
-                async execute({ wizard } = {}) {
-                    const ui = resolveUiRuntime();
-                    const state = await buildSetupChecklistState();
-                    if (wizard) {
-                        return runSetupWizard(ui, state);
-                    }
-                    return renderSetupChecklistOutput(ui, state);
-                },
-            }),
-            "codex-doctor": tool({
-                description: "Run beginner-friendly diagnostics with clear fixes.",
-                args: {
-                    deep: tool.schema
-                        .boolean()
-                        .optional()
-                        .describe("Include technical snapshot details (default: false)."),
-                    fix: tool.schema
-                        .boolean()
-                        .optional()
-                        .describe("Apply safe automated fixes (refresh tokens and switch to healthiest eligible account)."),
-                    format: toolOutputFormatSchema(),
-                },
-                async execute({ deep, fix, format } = {}) {
-                    const ui = resolveUiRuntime();
-                    const outputFormat = normalizeToolOutputFormat(format);
-                    const storage = await loadAccounts();
-                    const now = Date.now();
-                    const activeIndex = storage && storage.accounts.length > 0
-                        ? resolveActiveIndex(storage, "codex")
-                        : 0;
-                    const snapshots = storage
-                        ? toBeginnerAccountSnapshots(storage, activeIndex, now)
-                        : [];
-                    const runtime = getBeginnerRuntimeSnapshot();
-                    const summary = summarizeBeginnerAccounts(snapshots, now);
-                    const findings = buildBeginnerDoctorFindings({
-                        accounts: snapshots,
-                        now,
-                        runtime,
-                    });
-                    const nextAction = recommendBeginnerNextAction({ accounts: snapshots, now, runtime });
-                    let routingVisibility = null;
-                    const appliedFixes = [];
-                    const fixErrors = [];
-                    if (fix && storage && storage.accounts.length > 0) {
-                        let changedByRefresh = false;
-                        let refreshedCount = 0;
-                        for (const account of storage.accounts) {
-                            try {
-                                const refreshResult = await queuedRefresh(account.refreshToken);
-                                if (refreshResult.type === "success") {
-                                    account.refreshToken = refreshResult.refresh;
-                                    account.accessToken = refreshResult.access;
-                                    account.expiresAt = refreshResult.expires;
-                                    changedByRefresh = true;
-                                    refreshedCount += 1;
-                                }
-                            }
-                            catch (error) {
-                                fixErrors.push(error instanceof Error ? error.message : String(error));
-                            }
-                        }
-                        if (changedByRefresh) {
-                            try {
-                                await saveAccounts(storage);
-                                appliedFixes.push(`Refreshed ${refreshedCount} account token(s).`);
-                            }
-                            catch (error) {
-                                fixErrors.push(`Failed to persist refresh updates: ${error instanceof Error ? error.message : String(error)}`);
-                            }
-                        }
-                        try {
-                            const managerForFix = await AccountManager.loadFromDisk();
-                            const explainability = managerForFix.getSelectionExplainability("codex", undefined, Date.now());
-                            const eligible = explainability
-                                .filter((entry) => entry.eligible)
-                                .sort((a, b) => {
-                                if (b.healthScore !== a.healthScore)
-                                    return b.healthScore - a.healthScore;
-                                return b.tokensAvailable - a.tokensAvailable;
-                            });
-                            const best = eligible[0];
-                            if (best) {
-                                const currentActive = resolveActiveIndex(storage, "codex");
-                                if (best.index !== currentActive) {
-                                    storage.activeIndex = best.index;
-                                    storage.activeIndexByFamily = storage.activeIndexByFamily ?? {};
-                                    for (const family of MODEL_FAMILIES) {
-                                        storage.activeIndexByFamily[family] = best.index;
-                                    }
-                                    await saveAccounts(storage);
-                                    appliedFixes.push(`Switched active account to ${best.index + 1} (best eligible).`);
-                                }
-                            }
-                            else {
-                                appliedFixes.push("No eligible account available for auto-switch.");
-                            }
-                        }
-                        catch (error) {
-                            fixErrors.push(`Auto-switch evaluation failed: ${error instanceof Error ? error.message : String(error)}`);
-                        }
-                        if (cachedAccountManager) {
-                            const reloadedManager = await AccountManager.loadFromDisk();
-                            cachedAccountManager = reloadedManager;
-                            accountManagerPromise = Promise.resolve(reloadedManager);
-                        }
-                    }
-                    if (deep) {
-                        const managerForRouting = cachedAccountManager ?? (await AccountManager.loadFromDisk());
-                        const routingFamily = runtimeMetrics.lastSelectionSnapshot?.family ?? "codex";
-                        const routingModel = runtimeMetrics.lastSelectionSnapshot?.effectiveModel ??
-                            runtimeMetrics.lastSelectionSnapshot?.model ??
-                            null;
-                        const routingExplainability = managerForRouting.getSelectionExplainability(routingFamily, routingModel ?? undefined, Date.now());
-                        const routingActiveIndex = storage && storage.accounts.length > 0
-                            ? resolveActiveIndex(storage, routingFamily)
-                            : null;
-                        routingVisibility = buildRoutingVisibilitySnapshot({
-                            modelFamily: routingFamily,
-                            effectiveModel: routingModel,
-                            quotaKey: routingModel ? `${routingFamily}:${routingModel}` : routingFamily,
-                            selectedAccountIndex: routingActiveIndex,
-                            selectionExplainability: routingExplainability,
-                        });
-                    }
-                    if (outputFormat === "json") {
-                        return renderJsonOutput({
-                            summary: {
-                                totalAccounts: summary.total,
-                                healthyAccounts: summary.healthy,
-                                blockedAccounts: summary.blocked,
-                                failureRatePercent: runtime.totalRequests > 0
-                                    ? Math.round((runtime.failedRequests / runtime.totalRequests) * 100)
-                                    : 0,
-                            },
-                            findings: findings.map((finding) => ({
-                                severity: finding.severity,
-                                summary: finding.summary,
-                                action: finding.action,
-                            })),
-                            recommendedNextAction: nextAction,
-                            autoFix: fix
-                                ? {
-                                    appliedFixes,
-                                    errors: fixErrors,
-                                }
-                                : null,
-                            technicalSnapshot: deep
-                                ? {
-                                    storagePath: getStoragePath(),
-                                    runtimeFailures: {
-                                        failedRequests: runtime.failedRequests,
-                                        rateLimitedResponses: runtime.rateLimitedResponses,
-                                        authRefreshFailures: runtime.authRefreshFailures,
-                                        serverErrors: runtime.serverErrors,
-                                        networkErrors: runtime.networkErrors,
-                                    },
-                                    promptCache: {
-                                        enabledRequests: runtime.promptCacheEnabledRequests,
-                                        missingRequests: runtime.promptCacheMissingRequests,
-                                        lastPromptCacheKey: runtime.lastPromptCacheKey,
-                                        summary: formatPromptCacheSnapshot(runtime),
-                                    },
-                                    routingVisibility,
-                                }
-                                : null,
-                        });
-                    }
-                    if (ui.v2Enabled) {
-                        const lines = [
-                            ...formatUiHeader(ui, "Codex doctor"),
-                            formatUiKeyValue(ui, "Accounts", String(summary.total)),
-                            formatUiKeyValue(ui, "Healthy", String(summary.healthy), summary.healthy > 0 ? "success" : "warning"),
-                            formatUiKeyValue(ui, "Blocked", String(summary.blocked), summary.blocked > 0 ? "warning" : "muted"),
-                            formatUiKeyValue(ui, "Failure rate", runtime.totalRequests > 0 ? `${Math.round((runtime.failedRequests / runtime.totalRequests) * 100)}%` : "0%"),
-                            "",
-                            ...formatUiSection(ui, "Findings"),
-                        ];
-                        for (const finding of findings) {
-                            const tone = finding.severity === "ok"
-                                ? "success"
-                                : finding.severity === "warning"
-                                    ? "warning"
-                                    : "danger";
-                            lines.push(formatUiItem(ui, `${formatDoctorSeverity(ui, finding.severity)} ${finding.summary}`, tone));
-                            lines.push(`  ${formatUiKeyValue(ui, "fix", finding.action, "muted")}`);
-                        }
-                        lines.push("");
-                        lines.push(...formatUiSection(ui, "Recommended next step"));
-                        lines.push(formatUiItem(ui, nextAction, "accent"));
-                        if (fix) {
-                            lines.push("");
-                            lines.push(...formatUiSection(ui, "Auto-fix"));
-                            if (appliedFixes.length === 0) {
-                                lines.push(formatUiItem(ui, "No safe fixes were applied.", "muted"));
-                            }
-                            else {
-                                for (const entry of appliedFixes) {
-                                    lines.push(formatUiItem(ui, entry, "success"));
-                                }
-                            }
-                            for (const error of fixErrors) {
-                                lines.push(formatUiItem(ui, error, "warning"));
-                            }
-                        }
-                        if (deep) {
-                            lines.push("");
-                            lines.push(...formatUiSection(ui, "Technical snapshot"));
-                            lines.push(formatUiKeyValue(ui, "Storage", getStoragePath(), "muted"));
-                            lines.push(formatUiKeyValue(ui, "Runtime failures", `failed=${runtime.failedRequests}, rateLimited=${runtime.rateLimitedResponses}, authRefreshFailed=${runtime.authRefreshFailures}, server=${runtime.serverErrors}, network=${runtime.networkErrors}`, "muted"));
-                            lines.push(formatUiKeyValue(ui, "Prompt cache", formatPromptCacheSnapshot(runtime), "muted"));
-                            if (routingVisibility) {
-                                lines.push("");
-                                appendRoutingVisibilityUi(ui, lines, routingVisibility, {
-                                    includeExplainability: true,
-                                });
-                            }
-                        }
-                        return lines.join("\n");
-                    }
-                    const lines = [
-                        "Codex Doctor:",
-                        `Accounts: ${summary.total} (healthy=${summary.healthy}, blocked=${summary.blocked})`,
-                        `Failure rate: ${runtime.totalRequests > 0 ? Math.round((runtime.failedRequests / runtime.totalRequests) * 100) : 0}%`,
-                        "",
-                        "Findings:",
-                    ];
-                    for (const finding of findings) {
-                        lines.push(`  ${formatDoctorSeverityText(finding.severity)} ${finding.summary}`);
-                        lines.push(`      fix: ${finding.action}`);
-                    }
-                    lines.push("");
-                    lines.push(`Recommended next step: ${nextAction}`);
-                    if (fix) {
-                        lines.push("");
-                        lines.push("Auto-fix:");
-                        if (appliedFixes.length === 0) {
-                            lines.push("  - No safe fixes were applied.");
-                        }
-                        else {
-                            for (const entry of appliedFixes) {
-                                lines.push(`  - ${entry}`);
-                            }
-                        }
-                        for (const error of fixErrors) {
-                            lines.push(`  - warning: ${error}`);
-                        }
-                    }
-                    if (deep) {
-                        lines.push("");
-                        lines.push("Technical snapshot:");
-                        lines.push(`  Storage: ${getStoragePath()}`);
-                        lines.push(`  Runtime failures: failed=${runtime.failedRequests}, rateLimited=${runtime.rateLimitedResponses}, authRefreshFailed=${runtime.authRefreshFailures}, server=${runtime.serverErrors}, network=${runtime.networkErrors}`);
-                        lines.push(`  Prompt cache: ${formatPromptCacheSnapshot(runtime)}`);
-                        if (routingVisibility) {
-                            appendRoutingVisibilityText(lines, routingVisibility, {
-                                includeExplainability: true,
-                            });
-                        }
-                    }
-                    return lines.join("\n");
-                },
-            }),
-            "codex-next": tool({
-                description: "Show the single most recommended next action for beginners.",
-                args: {
-                    format: toolOutputFormatSchema(),
-                },
-                async execute({ format } = {}) {
-                    const ui = resolveUiRuntime();
-                    const outputFormat = normalizeToolOutputFormat(format);
-                    const storage = await loadAccounts();
-                    const now = Date.now();
-                    const activeIndex = storage && storage.accounts.length > 0
-                        ? resolveActiveIndex(storage, "codex")
-                        : 0;
-                    const snapshots = storage
-                        ? toBeginnerAccountSnapshots(storage, activeIndex, now)
-                        : [];
-                    const action = recommendBeginnerNextAction({
-                        accounts: snapshots,
-                        now,
-                        runtime: getBeginnerRuntimeSnapshot(),
-                    });
-                    if (outputFormat === "json") {
-                        return renderJsonOutput({
-                            recommendedNextAction: action,
-                            totalAccounts: snapshots.length,
-                            activeIndex: storage && storage.accounts.length > 0 ? activeIndex + 1 : null,
-                        });
-                    }
-                    if (ui.v2Enabled) {
-                        return [
-                            ...formatUiHeader(ui, "Recommended next action"),
-                            "",
-                            formatUiItem(ui, action, "accent"),
-                        ].join("\n");
-                    }
-                    return `Recommended next action:\n${action}`;
-                },
-            }),
-            "codex-label": tool({
-                description: "Set or clear a beginner-friendly display label for an account (interactive picker when index is omitted).",
-                args: {
-                    index: tool.schema.number().optional().describe("Account number to update (1-based, e.g., 1 for first account)"),
-                    label: tool.schema.string().describe("Display label. Use an empty string to clear (e.g., Work, Personal, Team A)"),
-                },
-                async execute({ index, label }) {
-                    const ui = resolveUiRuntime();
-                    const storage = await loadAccounts();
-                    if (!storage || storage.accounts.length === 0) {
-                        if (ui.v2Enabled) {
-                            return [
-                                ...formatUiHeader(ui, "Set account label"),
-                                "",
-                                formatUiItem(ui, "No accounts configured.", "warning"),
-                                formatUiItem(ui, "Run: opencode auth login", "accent"),
-                            ].join("\n");
-                        }
-                        return "No Codex accounts configured. Run: opencode auth login";
-                    }
-                    let resolvedIndex = index;
-                    if (resolvedIndex === undefined) {
-                        const selectedIndex = await promptAccountIndexSelection(ui, storage, "Set account label");
-                        if (selectedIndex === null) {
-                            if (supportsInteractiveMenus()) {
-                                if (ui.v2Enabled) {
-                                    return [
-                                        ...formatUiHeader(ui, "Set account label"),
-                                        "",
-                                        formatUiItem(ui, "No account selected.", "warning"),
-                                        formatUiItem(ui, "Run again and pick an account, or pass codex-label index=2 label=\"Work\".", "muted"),
-                                    ].join("\n");
-                                }
-                                return "No account selected.";
-                            }
-                            if (ui.v2Enabled) {
-                                return [
-                                    ...formatUiHeader(ui, "Set account label"),
-                                    "",
-                                    formatUiItem(ui, "Missing account number.", "warning"),
-                                    formatUiItem(ui, "Use: codex-label index=2 label=\"Work\"", "accent"),
-                                ].join("\n");
-                            }
-                            return "Missing account number. Use: codex-label index=2 label=\"Work\"";
-                        }
-                        resolvedIndex = selectedIndex + 1;
-                    }
-                    const targetIndex = Math.floor((resolvedIndex ?? 0) - 1);
-                    if (!Number.isFinite(targetIndex) ||
-                        targetIndex < 0 ||
-                        targetIndex >= storage.accounts.length) {
-                        if (ui.v2Enabled) {
-                            return [
-                                ...formatUiHeader(ui, "Set account label"),
-                                "",
-                                formatUiItem(ui, `Invalid account number: ${resolvedIndex}`, "danger"),
-                                formatUiKeyValue(ui, "Valid range", `1-${storage.accounts.length}`, "muted"),
-                            ].join("\n");
-                        }
-                        return `Invalid account number: ${resolvedIndex}\n\nValid range: 1-${storage.accounts.length}`;
-                    }
-                    const normalizedLabel = (label ?? "").trim().replace(/\s+/g, " ");
-                    if (normalizedLabel.length > 60) {
-                        if (ui.v2Enabled) {
-                            return [
-                                ...formatUiHeader(ui, "Set account label"),
-                                "",
-                                formatUiItem(ui, "Label is too long (max 60 characters).", "danger"),
-                            ].join("\n");
-                        }
-                        return "Label is too long (max 60 characters).";
-                    }
-                    const account = storage.accounts[targetIndex];
-                    if (!account) {
-                        return `Account ${resolvedIndex} not found.`;
-                    }
-                    const previousLabel = account.accountLabel?.trim() ?? "";
-                    if (normalizedLabel.length === 0) {
-                        delete account.accountLabel;
-                    }
-                    else {
-                        account.accountLabel = normalizedLabel;
-                    }
-                    try {
-                        await saveAccounts(storage);
-                    }
-                    catch (saveError) {
-                        logWarn("Failed to save account label update", { error: String(saveError) });
-                        if (ui.v2Enabled) {
-                            return [
-                                ...formatUiHeader(ui, "Set account label"),
-                                "",
-                                formatUiItem(ui, "Label updated in memory but failed to persist.", "danger"),
-                            ].join("\n");
-                        }
-                        return "Label updated in memory but failed to persist. Changes may be lost on restart.";
-                    }
-                    if (cachedAccountManager) {
-                        const reloadedManager = await AccountManager.loadFromDisk();
-                        cachedAccountManager = reloadedManager;
-                        accountManagerPromise = Promise.resolve(reloadedManager);
-                    }
-                    const accountLabel = formatCommandAccountLabel(account, targetIndex);
-                    if (ui.v2Enabled) {
-                        const statusText = normalizedLabel.length === 0
-                            ? `Cleared label for ${accountLabel}`
-                            : `Set label for ${accountLabel} to "${normalizedLabel}"`;
-                        const previousText = previousLabel.length > 0
-                            ? formatUiKeyValue(ui, "Previous label", previousLabel, "muted")
-                            : formatUiKeyValue(ui, "Previous label", "none", "muted");
-                        return [
-                            ...formatUiHeader(ui, "Set account label"),
-                            "",
-                            formatUiItem(ui, `${getStatusMarker(ui, "ok")} ${statusText}`, "success"),
-                            previousText,
-                        ].join("\n");
-                    }
-                    if (normalizedLabel.length === 0) {
-                        return `Cleared label for ${accountLabel}`;
-                    }
-                    return `Set label for ${accountLabel} to "${normalizedLabel}"`;
-                },
-            }),
-            "codex-tag": tool({
-                description: "Set or clear account tags for filtering and grouping.",
-                args: {
-                    index: tool.schema.number().optional().describe("Account number to update (1-based, e.g., 1 for first account)"),
-                    tags: tool.schema.string().describe("Comma-separated tags (e.g., work,team-a). Empty string clears tags."),
-                },
-                async execute({ index, tags }) {
-                    const ui = resolveUiRuntime();
-                    const storage = await loadAccounts();
-                    if (!storage || storage.accounts.length === 0) {
-                        if (ui.v2Enabled) {
-                            return [
-                                ...formatUiHeader(ui, "Set account tags"),
-                                "",
-                                formatUiItem(ui, "No accounts configured.", "warning"),
-                                formatUiItem(ui, "Run: opencode auth login", "accent"),
-                            ].join("\n");
-                        }
-                        return "No Codex accounts configured. Run: opencode auth login";
-                    }
-                    let resolvedIndex = index;
-                    if (resolvedIndex === undefined) {
-                        const selectedIndex = await promptAccountIndexSelection(ui, storage, "Set account tags");
-                        if (selectedIndex === null) {
-                            if (supportsInteractiveMenus()) {
-                                return ui.v2Enabled
-                                    ? [
-                                        ...formatUiHeader(ui, "Set account tags"),
-                                        "",
-                                        formatUiItem(ui, "No account selected.", "warning"),
-                                    ].join("\n")
-                                    : "No account selected.";
-                            }
-                            return "Missing account number. Use: codex-tag index=2 tags=\"work,team-a\"";
-                        }
-                        resolvedIndex = selectedIndex + 1;
-                    }
-                    const targetIndex = Math.floor((resolvedIndex ?? 0) - 1);
-                    if (!Number.isFinite(targetIndex) ||
-                        targetIndex < 0 ||
-                        targetIndex >= storage.accounts.length) {
-                        return `Invalid account number: ${resolvedIndex}\n\nValid range: 1-${storage.accounts.length}`;
-                    }
-                    const account = storage.accounts[targetIndex];
-                    if (!account)
-                        return `Account ${resolvedIndex} not found.`;
-                    const normalizedTags = normalizeAccountTags(tags ?? "");
-                    const previousTags = Array.isArray(account.accountTags)
-                        ? [...account.accountTags]
-                        : [];
-                    if (normalizedTags.length === 0) {
-                        delete account.accountTags;
-                    }
-                    else {
-                        account.accountTags = normalizedTags;
-                    }
-                    try {
-                        await saveAccounts(storage);
-                    }
-                    catch (error) {
-                        logWarn("Failed to save account tag update", { error: String(error) });
-                        return "Tag update failed to persist. Changes may be lost on restart.";
-                    }
-                    if (cachedAccountManager) {
-                        const reloadedManager = await AccountManager.loadFromDisk();
-                        cachedAccountManager = reloadedManager;
-                        accountManagerPromise = Promise.resolve(reloadedManager);
-                    }
-                    const accountLabel = formatCommandAccountLabel(account, targetIndex);
-                    const previousText = previousTags.length > 0 ? previousTags.join(", ") : "none";
-                    const nextText = normalizedTags.length > 0 ? normalizedTags.join(", ") : "none";
-                    if (ui.v2Enabled) {
-                        return [
-                            ...formatUiHeader(ui, "Set account tags"),
-                            "",
-                            formatUiItem(ui, `${getStatusMarker(ui, "ok")} Updated tags for ${accountLabel}`, "success"),
-                            formatUiKeyValue(ui, "Previous tags", previousText, "muted"),
-                            formatUiKeyValue(ui, "Current tags", nextText, normalizedTags.length > 0 ? "accent" : "muted"),
-                        ].join("\n");
-                    }
-                    return `Updated tags for ${accountLabel}\nPrevious tags: ${previousText}\nCurrent tags: ${nextText}`;
-                },
-            }),
-            "codex-note": tool({
-                description: "Set or clear an account note for reminders.",
-                args: {
-                    index: tool.schema.number().optional().describe("Account number to update (1-based, e.g., 1 for first account)"),
-                    note: tool.schema.string().describe("Short note. Empty string clears the note."),
-                },
-                async execute({ index, note }) {
-                    const ui = resolveUiRuntime();
-                    const storage = await loadAccounts();
-                    if (!storage || storage.accounts.length === 0) {
-                        return "No Codex accounts configured. Run: opencode auth login";
-                    }
-                    let resolvedIndex = index;
-                    if (resolvedIndex === undefined) {
-                        const selectedIndex = await promptAccountIndexSelection(ui, storage, "Set account note");
-                        if (selectedIndex === null) {
-                            if (supportsInteractiveMenus())
-                                return "No account selected.";
-                            return "Missing account number. Use: codex-note index=2 note=\"weekday primary\"";
-                        }
-                        resolvedIndex = selectedIndex + 1;
-                    }
-                    const targetIndex = Math.floor((resolvedIndex ?? 0) - 1);
-                    if (!Number.isFinite(targetIndex) ||
-                        targetIndex < 0 ||
-                        targetIndex >= storage.accounts.length) {
-                        return `Invalid account number: ${resolvedIndex}\n\nValid range: 1-${storage.accounts.length}`;
-                    }
-                    const account = storage.accounts[targetIndex];
-                    if (!account)
-                        return `Account ${resolvedIndex} not found.`;
-                    const normalizedNote = (note ?? "").trim();
-                    if (normalizedNote.length > 240) {
-                        return "Note is too long (max 240 characters).";
-                    }
-                    if (normalizedNote.length === 0) {
-                        delete account.accountNote;
-                    }
-                    else {
-                        account.accountNote = normalizedNote;
-                    }
-                    try {
-                        await saveAccounts(storage);
-                    }
-                    catch (error) {
-                        logWarn("Failed to save account note update", { error: String(error) });
-                        return "Note update failed to persist. Changes may be lost on restart.";
-                    }
-                    if (cachedAccountManager) {
-                        const reloadedManager = await AccountManager.loadFromDisk();
-                        cachedAccountManager = reloadedManager;
-                        accountManagerPromise = Promise.resolve(reloadedManager);
-                    }
-                    const accountLabel = formatCommandAccountLabel(account, targetIndex);
-                    if (normalizedNote.length === 0) {
-                        return `Cleared note for ${accountLabel}`;
-                    }
-                    return `Saved note for ${accountLabel}: ${normalizedNote}`;
-                },
-            }),
-            "codex-dashboard": tool({
-                description: "Show a live Codex dashboard: account eligibility, retry budgets, and refresh queue health.",
-                args: {
-                    format: toolOutputFormatSchema(),
-                    includeSensitive: toolSensitiveJsonSchema(),
-                },
-                async execute({ format, includeSensitive } = {}) {
-                    const ui = resolveUiRuntime();
-                    const outputFormat = normalizeToolOutputFormat(format);
-                    const includeSensitiveOutput = includeSensitive === true;
-                    const storage = await loadAccounts();
-                    if (!storage || storage.accounts.length === 0) {
-                        if (outputFormat === "json") {
-                            return renderJsonOutput({
-                                message: "No Codex accounts configured. Run: opencode auth login",
-                                accountCount: 0,
-                                selectionLens: null,
-                                retryProfile: runtimeMetrics.retryProfile,
-                                beginnerSafeMode: beginnerSafeModeEnabled,
-                                retryBudgetUsage: { ...runtimeMetrics.retryBudgetUsage },
-                                refreshQueue: { ...getRefreshQueueMetrics() },
-                                routingVisibility: buildRoutingVisibilitySnapshot(),
-                                accountEligibility: [],
-                                recommendedNextAction: "Run opencode auth login",
-                                lastError: runtimeMetrics.lastError === null
-                                    ? null
-                                    : {
-                                        message: runtimeMetrics.lastError,
-                                        category: runtimeMetrics.lastErrorCategory,
-                                    },
-                            });
-                        }
-                        if (ui.v2Enabled) {
-                            return [
-                                ...formatUiHeader(ui, "Codex dashboard"),
-                                "",
-                                formatUiItem(ui, "No accounts configured.", "warning"),
-                                formatUiItem(ui, "Run: opencode auth login", "accent"),
-                            ].join("\n");
-                        }
-                        return "No Codex accounts configured. Run: opencode auth login";
-                    }
-                    const now = Date.now();
-                    const refreshMetrics = getRefreshQueueMetrics();
-                    const family = runtimeMetrics.lastSelectionSnapshot?.family ?? "codex";
-                    const model = runtimeMetrics.lastSelectionSnapshot?.effectiveModel ??
-                        runtimeMetrics.lastSelectionSnapshot?.model ??
-                        undefined;
-                    const manager = cachedAccountManager ?? (await AccountManager.loadFromDisk());
-                    const explainability = manager.getSelectionExplainability(family, model, now);
-                    const selectionLabel = model ? `${family}:${model}` : family;
-                    const routingVisibility = buildRoutingVisibilitySnapshot({
-                        modelFamily: family,
-                        effectiveModel: model ?? null,
-                        quotaKey: model ? `${family}:${model}` : family,
-                        selectedAccountIndex: resolveActiveIndex(storage, family),
-                        selectionExplainability: explainability,
-                    });
-                    const recommendedNextAction = recommendBeginnerNextAction({
-                        accounts: toBeginnerAccountSnapshots(storage, resolveActiveIndex(storage, "codex"), now),
-                        now,
-                        runtime: getBeginnerRuntimeSnapshot(),
-                    });
-                    if (outputFormat === "json") {
-                        return renderJsonOutput({
-                            accountCount: storage.accounts.length,
-                            selectionLens: selectionLabel,
-                            retryProfile: runtimeMetrics.retryProfile,
-                            beginnerSafeMode: beginnerSafeModeEnabled,
-                            retryBudgetUsage: { ...runtimeMetrics.retryBudgetUsage },
-                            refreshQueue: { ...refreshMetrics },
-                            routingVisibility,
-                            accountEligibility: explainability.map((entry) => ({
-                                ...buildJsonAccountIdentity(entry.index, {
-                                    includeSensitive: includeSensitiveOutput,
-                                    account: storage.accounts[entry.index],
-                                }),
-                                eligible: entry.eligible,
-                                healthScore: entry.healthScore,
-                                tokensAvailable: entry.tokensAvailable,
-                                reasons: [...entry.reasons],
-                            })),
-                            recommendedNextAction,
-                            lastError: runtimeMetrics.lastError === null
-                                ? null
-                                : {
-                                    message: runtimeMetrics.lastError,
-                                    category: runtimeMetrics.lastErrorCategory,
-                                },
-                        });
-                    }
-                    if (ui.v2Enabled) {
-                        const lines = [
-                            ...formatUiHeader(ui, "Codex dashboard"),
-                            formatUiKeyValue(ui, "Accounts", String(storage.accounts.length)),
-                            formatUiKeyValue(ui, "Selection lens", selectionLabel, "muted"),
-                            formatUiKeyValue(ui, "Retry profile", runtimeMetrics.retryProfile, "muted"),
-                            formatUiKeyValue(ui, "Beginner safe mode", beginnerSafeModeEnabled ? "on" : "off", beginnerSafeModeEnabled ? "accent" : "muted"),
-                            formatUiKeyValue(ui, "Retry usage", `A${runtimeMetrics.retryBudgetUsage.authRefresh} N${runtimeMetrics.retryBudgetUsage.network} S${runtimeMetrics.retryBudgetUsage.server} RS${runtimeMetrics.retryBudgetUsage.rateLimitShort} RG${runtimeMetrics.retryBudgetUsage.rateLimitGlobal} E${runtimeMetrics.retryBudgetUsage.emptyResponse}`, "muted"),
-                            formatUiKeyValue(ui, "Refresh queue", `pending=${refreshMetrics.pending}, success=${refreshMetrics.succeeded}, failed=${refreshMetrics.failed}`, "muted"),
-                            "",
-                        ];
-                        appendRoutingVisibilityUi(ui, lines, routingVisibility);
-                        lines.push("");
-                        lines.push(...formatUiSection(ui, "Account eligibility"));
-                        for (const entry of explainability) {
-                            const label = formatCommandAccountLabel(storage.accounts[entry.index], entry.index);
-                            const state = entry.eligible ? formatUiBadge(ui, "eligible", "success") : formatUiBadge(ui, "blocked", "warning");
-                            lines.push(formatUiItem(ui, `${label} ${state} health=${Math.round(entry.healthScore)} tokens=${entry.tokensAvailable.toFixed(1)} reasons=${entry.reasons.join(", ")}`));
-                        }
-                        lines.push("");
-                        lines.push(...formatUiSection(ui, "Recommended next step"));
-                        lines.push(formatUiItem(ui, recommendedNextAction, "accent"));
-                        if (runtimeMetrics.lastError) {
-                            lines.push("");
-                            lines.push(...formatUiSection(ui, "Last error"));
-                            lines.push(formatUiItem(ui, runtimeMetrics.lastError, "danger"));
-                            if (runtimeMetrics.lastErrorCategory) {
-                                lines.push(formatUiKeyValue(ui, "Category", runtimeMetrics.lastErrorCategory, "warning"));
-                            }
-                        }
-                        return lines.join("\n");
-                    }
-                    const lines = [
-                        "Codex Dashboard:",
-                        `Accounts: ${storage.accounts.length}`,
-                        `Selection lens: ${selectionLabel}`,
-                        `Retry profile: ${runtimeMetrics.retryProfile}`,
-                        `Beginner safe mode: ${beginnerSafeModeEnabled ? "on" : "off"}`,
-                        `Retry usage: auth=${runtimeMetrics.retryBudgetUsage.authRefresh}, network=${runtimeMetrics.retryBudgetUsage.network}, server=${runtimeMetrics.retryBudgetUsage.server}, short429=${runtimeMetrics.retryBudgetUsage.rateLimitShort}, global429=${runtimeMetrics.retryBudgetUsage.rateLimitGlobal}, empty=${runtimeMetrics.retryBudgetUsage.emptyResponse}`,
-                        `Refresh queue: pending=${refreshMetrics.pending}, success=${refreshMetrics.succeeded}, failed=${refreshMetrics.failed}`,
-                    ];
-                    lines.push("");
-                    appendRoutingVisibilityText(lines, routingVisibility);
-                    lines.push("");
-                    lines.push("Account eligibility:");
-                    for (const entry of explainability) {
-                        const label = formatCommandAccountLabel(storage.accounts[entry.index], entry.index);
-                        lines.push(`  - ${label}: ${entry.eligible ? "eligible" : "blocked"} | health=${Math.round(entry.healthScore)} | tokens=${entry.tokensAvailable.toFixed(1)} | reasons=${entry.reasons.join(", ")}`);
-                    }
-                    lines.push("");
-                    lines.push(`Recommended next step: ${recommendedNextAction}`);
-                    if (runtimeMetrics.lastError) {
-                        lines.push("");
-                        lines.push(`Last error: ${runtimeMetrics.lastError}`);
-                        if (runtimeMetrics.lastErrorCategory) {
-                            lines.push(`Category: ${runtimeMetrics.lastErrorCategory}`);
-                        }
-                    }
-                    return lines.join("\n");
-                },
-            }),
-            "codex-health": tool({
-                description: "Check health of all Codex accounts by validating refresh tokens.",
-                args: {
-                    format: toolOutputFormatSchema(),
-                    includeSensitive: toolSensitiveJsonSchema(),
-                },
-                async execute({ format, includeSensitive } = {}) {
-                    const ui = resolveUiRuntime();
-                    const outputFormat = normalizeToolOutputFormat(format);
-                    const includeSensitiveOutput = includeSensitive === true;
-                    const storage = await loadAccounts();
-                    if (!storage || storage.accounts.length === 0) {
-                        if (outputFormat === "json") {
-                            return renderJsonOutput({
-                                message: "No Codex accounts configured. Run: opencode auth login",
-                                totalAccounts: 0,
-                                healthyCount: 0,
-                                unhealthyCount: 0,
-                                accounts: [],
-                            });
-                        }
-                        if (ui.v2Enabled) {
-                            return [
-                                ...formatUiHeader(ui, "Health check"),
-                                "",
-                                formatUiItem(ui, "No accounts configured.", "warning"),
-                                formatUiItem(ui, "Run: opencode auth login", "accent"),
-                            ].join("\n");
-                        }
-                        return "No Codex accounts configured. Run: opencode auth login";
-                    }
-                    const results = ui.v2Enabled
-                        ? []
-                        : [`Health Check (${storage.accounts.length} accounts):`, ""];
-                    const jsonAccounts = [];
-                    let healthyCount = 0;
-                    let unhealthyCount = 0;
-                    for (let i = 0; i < storage.accounts.length; i++) {
-                        const account = storage.accounts[i];
-                        if (!account)
-                            continue;
-                        const label = formatCommandAccountLabel(account, i);
-                        try {
-                            const refreshResult = await queuedRefresh(account.refreshToken);
-                            if (refreshResult.type === "success") {
-                                jsonAccounts.push({
-                                    ...buildJsonAccountIdentity(i, {
-                                        includeSensitive: includeSensitiveOutput,
-                                        account,
-                                        label,
-                                    }),
-                                    status: "healthy",
-                                });
-                                results.push(`  ${getStatusMarker(ui, "ok")} ${label}: Healthy`);
-                                healthyCount++;
-                            }
-                            else {
-                                jsonAccounts.push({
-                                    ...buildJsonAccountIdentity(i, {
-                                        includeSensitive: includeSensitiveOutput,
-                                        account,
-                                        label,
-                                    }),
-                                    status: "unhealthy",
-                                    error: refreshResult.message ?? refreshResult.reason,
-                                });
-                                results.push(`  ${getStatusMarker(ui, "error")} ${label}: Token refresh failed`);
-                                unhealthyCount++;
-                            }
-                        }
-                        catch (error) {
-                            const errorMsg = error instanceof Error ? error.message : String(error);
-                            jsonAccounts.push({
-                                ...buildJsonAccountIdentity(i, {
-                                    includeSensitive: includeSensitiveOutput,
-                                    account,
-                                    label,
-                                }),
-                                status: "unhealthy",
-                                error: errorMsg.slice(0, 120),
-                            });
-                            results.push(`  ${getStatusMarker(ui, "error")} ${label}: Error - ${errorMsg.slice(0, 120)}`);
-                            unhealthyCount++;
-                        }
-                    }
-                    results.push("");
-                    results.push(`Summary: ${healthyCount} healthy, ${unhealthyCount} unhealthy`);
-                    if (outputFormat === "json") {
-                        return renderJsonOutput({
-                            totalAccounts: storage.accounts.length,
-                            healthyCount,
-                            unhealthyCount,
-                            accounts: jsonAccounts,
-                        });
-                    }
-                    if (ui.v2Enabled) {
-                        return [
-                            ...formatUiHeader(ui, "Health check"),
-                            "",
-                            ...results.map((line) => paintUiText(ui, line, "normal")),
-                        ].join("\n");
-                    }
-                    return results.join("\n");
-                },
-            }),
-            "codex-remove": tool({
-                description: "Remove one Codex account entry by index (1-based) or interactive picker when index is omitted.",
-                args: {
-                    index: tool.schema.number().optional().describe("Account number to remove (1-based, e.g., 1 for first account)"),
-                },
-                async execute({ index } = {}) {
-                    const ui = resolveUiRuntime();
-                    const storage = await loadAccounts();
-                    if (!storage || storage.accounts.length === 0) {
-                        if (ui.v2Enabled) {
-                            return [
-                                ...formatUiHeader(ui, "Remove account"),
-                                "",
-                                formatUiItem(ui, "No accounts configured.", "warning"),
-                            ].join("\n");
-                        }
-                        return "No Codex accounts configured. Nothing to remove.";
-                    }
-                    let resolvedIndex = index;
-                    if (resolvedIndex === undefined) {
-                        const selectedIndex = await promptAccountIndexSelection(ui, storage, "Remove account");
-                        if (selectedIndex === null) {
-                            if (supportsInteractiveMenus()) {
-                                if (ui.v2Enabled) {
-                                    return [
-                                        ...formatUiHeader(ui, "Remove account"),
-                                        "",
-                                        formatUiItem(ui, "No account selected.", "warning"),
-                                        formatUiItem(ui, "Run again and pick an account, or pass codex-remove index=2.", "muted"),
-                                    ].join("\n");
-                                }
-                                return "No account selected.";
-                            }
-                            if (ui.v2Enabled) {
-                                return [
-                                    ...formatUiHeader(ui, "Remove account"),
-                                    "",
-                                    formatUiItem(ui, "Missing account number.", "warning"),
-                                    formatUiItem(ui, "Use: codex-remove index=2", "accent"),
-                                ].join("\n");
-                            }
-                            return "Missing account number. Use: codex-remove index=2";
-                        }
-                        resolvedIndex = selectedIndex + 1;
-                    }
-                    const targetIndex = Math.floor((resolvedIndex ?? 0) - 1);
-                    if (!Number.isFinite(targetIndex) ||
-                        targetIndex < 0 ||
-                        targetIndex >= storage.accounts.length) {
-                        if (ui.v2Enabled) {
-                            return [
-                                ...formatUiHeader(ui, "Remove account"),
-                                "",
-                                formatUiItem(ui, `Invalid account number: ${resolvedIndex}`, "danger"),
-                                formatUiKeyValue(ui, "Valid range", `1-${storage.accounts.length}`, "muted"),
-                                formatUiItem(ui, "Use codex-list to list all accounts.", "accent"),
-                            ].join("\n");
-                        }
-                        return `Invalid account number: ${resolvedIndex}\n\nValid range: 1-${storage.accounts.length}\n\nUse codex-list to list all accounts.`;
-                    }
-                    const account = storage.accounts[targetIndex];
-                    if (!account) {
-                        return `Account ${resolvedIndex} not found.`;
-                    }
-                    const label = formatCommandAccountLabel(account, targetIndex);
-                    storage.accounts.splice(targetIndex, 1);
-                    if (storage.accounts.length === 0) {
-                        storage.activeIndex = 0;
-                        storage.activeIndexByFamily = {};
-                    }
-                    else {
-                        if (storage.activeIndex >= storage.accounts.length) {
-                            storage.activeIndex = 0;
-                        }
-                        else if (storage.activeIndex > targetIndex) {
-                            storage.activeIndex -= 1;
-                        }
-                        if (storage.activeIndexByFamily) {
-                            for (const family of MODEL_FAMILIES) {
-                                const idx = storage.activeIndexByFamily[family];
-                                if (typeof idx === "number") {
-                                    if (idx >= storage.accounts.length) {
-                                        storage.activeIndexByFamily[family] = 0;
-                                    }
-                                    else if (idx > targetIndex) {
-                                        storage.activeIndexByFamily[family] = idx - 1;
-                                    }
-                                }
-                            }
-                        }
-                    }
-                    try {
-                        await saveAccounts(storage);
-                    }
-                    catch (saveError) {
-                        logWarn("Failed to save account removal", { error: String(saveError) });
-                        if (ui.v2Enabled) {
-                            return [
-                                ...formatUiHeader(ui, "Remove account"),
-                                "",
-                                formatUiItem(ui, `Removed selected entry: ${label}`, "warning"),
-                                formatUiItem(ui, "Only the selected index was changed.", "muted"),
-                                formatUiItem(ui, "Failed to persist. Change may be lost on restart.", "danger"),
-                            ].join("\n");
-                        }
-                        return `Removed selected entry: ${label} from memory, but failed to persist. Only the selected index was changed and this may be lost on restart.`;
-                    }
-                    if (cachedAccountManager) {
-                        const reloadedManager = await AccountManager.loadFromDisk();
-                        cachedAccountManager = reloadedManager;
-                        accountManagerPromise = Promise.resolve(reloadedManager);
-                    }
-                    const remaining = storage.accounts.length;
-                    const matchingEmailRemaining = account.email?.trim()
-                        ? storage.accounts.filter((entry) => entry.email === account.email).length
-                        : 0;
-                    if (ui.v2Enabled) {
-                        const postRemoveHint = matchingEmailRemaining > 0 && account.email
-                            ? formatUiItem(ui, `Other entries for ${account.email} remain: ${matchingEmailRemaining}`, "muted")
-                            : formatUiItem(ui, "Only the selected entry was removed.", "muted");
-                        return [
-                            ...formatUiHeader(ui, "Remove account"),
-                            "",
-                            formatUiItem(ui, `${getStatusMarker(ui, "ok")} Removed selected entry: ${label}`, "success"),
-                            postRemoveHint,
-                            remaining > 0
-                                ? formatUiKeyValue(ui, "Remaining accounts", String(remaining))
-                                : formatUiItem(ui, "No accounts remaining. Run: opencode auth login", "warning"),
-                        ].join("\n");
-                    }
-                    const postRemoveHint = matchingEmailRemaining > 0 && account.email
-                        ? `Other entries for ${account.email} remain: ${matchingEmailRemaining}`
-                        : "Only the selected entry was removed.";
-                    return [
-                        `Removed selected entry: ${label}`,
-                        postRemoveHint,
-                        "",
-                        remaining > 0
-                            ? `Remaining accounts: ${remaining}`
-                            : "No accounts remaining. Run: opencode auth login",
-                    ].join("\n");
-                },
-            }),
-            "codex-refresh": tool({
-                description: "Manually refresh OAuth tokens for all accounts to verify they're still valid.",
-                args: {},
-                async execute() {
-                    const ui = resolveUiRuntime();
-                    const storage = await loadAccounts();
-                    if (!storage || storage.accounts.length === 0) {
-                        if (ui.v2Enabled) {
-                            return [
-                                ...formatUiHeader(ui, "Refresh accounts"),
-                                "",
-                                formatUiItem(ui, "No accounts configured.", "warning"),
-                                formatUiItem(ui, "Run: opencode auth login", "accent"),
-                            ].join("\n");
-                        }
-                        return "No Codex accounts configured. Run: opencode auth login";
-                    }
-                    const results = ui.v2Enabled
-                        ? []
-                        : [`Refreshing ${storage.accounts.length} account(s):`, ""];
-                    let refreshedCount = 0;
-                    let failedCount = 0;
-                    for (let i = 0; i < storage.accounts.length; i++) {
-                        const account = storage.accounts[i];
-                        if (!account)
-                            continue;
-                        const label = formatCommandAccountLabel(account, i);
-                        try {
-                            const refreshResult = await queuedRefresh(account.refreshToken);
-                            if (refreshResult.type === "success") {
-                                account.refreshToken = refreshResult.refresh;
-                                account.accessToken = refreshResult.access;
-                                account.expiresAt = refreshResult.expires;
-                                results.push(`  ${getStatusMarker(ui, "ok")} ${label}: Refreshed`);
-                                refreshedCount++;
-                            }
-                            else {
-                                results.push(`  ${getStatusMarker(ui, "error")} ${label}: Failed - ${refreshResult.message ?? refreshResult.reason}`);
-                                failedCount++;
-                            }
-                        }
-                        catch (error) {
-                            const errorMsg = error instanceof Error ? error.message : String(error);
-                            results.push(`  ${getStatusMarker(ui, "error")} ${label}: Error - ${errorMsg.slice(0, 120)}`);
-                            failedCount++;
-                        }
-                    }
-                    await saveAccounts(storage);
-                    if (cachedAccountManager) {
-                        const reloadedManager = await AccountManager.loadFromDisk();
-                        cachedAccountManager = reloadedManager;
-                        accountManagerPromise = Promise.resolve(reloadedManager);
-                    }
-                    results.push("");
-                    results.push(`Summary: ${refreshedCount} refreshed, ${failedCount} failed`);
-                    if (ui.v2Enabled) {
-                        return [
-                            ...formatUiHeader(ui, "Refresh accounts"),
-                            "",
-                            ...results.map((line) => paintUiText(ui, line, "normal")),
-                        ].join("\n");
-                    }
-                    return results.join("\n");
-                },
-            }),
-            "codex-export": tool({
-                description: "Export accounts to a JSON file for backup or migration. Can auto-generate timestamped backup paths.",
-                args: {
-                    path: tool.schema.string().optional().describe("File path to export to (e.g., ~/codex-backup.json). If omitted, a timestamped backup path is used."),
-                    force: tool.schema.boolean().optional().describe("Overwrite existing file (default: true)"),
-                    timestamped: tool.schema.boolean().optional().describe("When true (default), omitted paths use a timestamped backup filename."),
-                },
-                async execute({ path: filePath, force, timestamped, }) {
-                    const ui = resolveUiRuntime();
-                    const shouldTimestamp = timestamped ?? true;
-                    const resolvedExportPath = filePath && filePath.trim().length > 0
-                        ? filePath
-                        : shouldTimestamp
-                            ? createTimestampedBackupPath()
-                            : "codex-backup.json";
-                    try {
-                        await exportAccounts(resolvedExportPath, force ?? true);
-                        const storage = await loadAccounts();
-                        const count = storage?.accounts.length ?? 0;
-                        if (ui.v2Enabled) {
-                            return [
-                                ...formatUiHeader(ui, "Export accounts"),
-                                "",
-                                formatUiItem(ui, `${getStatusMarker(ui, "ok")} Exported ${count} account(s)`, "success"),
-                                formatUiKeyValue(ui, "Path", resolvedExportPath, "muted"),
-                            ].join("\n");
-                        }
-                        return `Exported ${count} account(s) to: ${resolvedExportPath}`;
-                    }
-                    catch (error) {
-                        const msg = error instanceof Error ? error.message : String(error);
-                        if (ui.v2Enabled) {
-                            return [
-                                ...formatUiHeader(ui, "Export accounts"),
-                                "",
-                                formatUiItem(ui, `${getStatusMarker(ui, "error")} Export failed`, "danger"),
-                                formatUiKeyValue(ui, "Error", msg, "danger"),
-                            ].join("\n");
-                        }
-                        return `Export failed: ${msg}`;
-                    }
-                },
-            }),
-            "codex-import": tool({
-                description: "Import accounts from a JSON file, with dry-run preview and automatic timestamped backup before apply.",
-                args: {
-                    path: tool.schema.string().describe("File path to import from (e.g., ~/codex-backup.json)"),
-                    dryRun: tool.schema.boolean().optional().describe("Preview import impact without applying changes."),
-                },
-                async execute({ path: filePath, dryRun }) {
-                    const ui = resolveUiRuntime();
-                    try {
-                        const preview = await previewImportAccounts(filePath);
-                        if (dryRun) {
-                            if (ui.v2Enabled) {
-                                return [
-                                    ...formatUiHeader(ui, "Import preview"),
-                                    "",
-                                    formatUiItem(ui, "No changes applied (dry run).", "warning"),
-                                    formatUiKeyValue(ui, "Path", filePath, "muted"),
-                                    formatUiKeyValue(ui, "New accounts", String(preview.imported), preview.imported > 0 ? "success" : "muted"),
-                                    formatUiKeyValue(ui, "Duplicates skipped", String(preview.skipped), preview.skipped > 0 ? "warning" : "muted"),
-                                    formatUiKeyValue(ui, "Resulting total", String(preview.total), "accent"),
-                                ].join("\n");
-                            }
-                            return [
-                                "Import preview (dry run):",
-                                `Path: ${filePath}`,
-                                `New accounts: ${preview.imported}`,
-                                `Duplicates skipped: ${preview.skipped}`,
-                                `Resulting total: ${preview.total}`,
-                            ].join("\n");
-                        }
-                        const result = await importAccounts(filePath, {
-                            preImportBackupPrefix: "codex-pre-import-backup",
-                            backupMode: "required",
-                        });
-                        const backupSummary = result.backupStatus === "created"
-                            ? result.backupPath ?? "created"
-                            : result.backupStatus === "failed"
-                                ? `failed (${result.backupError ?? "unknown error"})`
-                                : "skipped (no existing accounts)";
-                        const backupStatus = result.backupStatus === "created" ? "ok" : "warning";
-                        invalidateAccountManagerCache();
-                        const lines = [`Import complete.`, ``];
-                        lines.push(`Preview: +${preview.imported} new, ${preview.skipped} skipped, ${preview.total} total`);
-                        lines.push(`Auto-backup: ${backupSummary}`);
-                        if (result.imported > 0) {
-                            lines.push(`New accounts: ${result.imported}`);
-                        }
-                        if (result.skipped > 0) {
-                            lines.push(`Duplicates skipped: ${result.skipped}`);
-                        }
-                        lines.push(`Total accounts: ${result.total}`);
-                        if (ui.v2Enabled) {
-                            const styled = [
-                                ...formatUiHeader(ui, "Import accounts"),
-                                "",
-                                formatUiItem(ui, `${getStatusMarker(ui, "ok")} Import complete`, "success"),
-                                formatUiKeyValue(ui, "Path", filePath, "muted"),
-                                formatUiKeyValue(ui, "Auto-backup", backupSummary, backupStatus === "ok" ? "muted" : "warning"),
-                                formatUiKeyValue(ui, "Preview", `+${preview.imported}, skipped=${preview.skipped}, total=${preview.total}`, "muted"),
-                                formatUiKeyValue(ui, "New accounts", String(result.imported), result.imported > 0 ? "success" : "muted"),
-                                formatUiKeyValue(ui, "Duplicates skipped", String(result.skipped), result.skipped > 0 ? "warning" : "muted"),
-                                formatUiKeyValue(ui, "Total accounts", String(result.total), "accent"),
-                            ];
-                            return styled.join("\n");
-                        }
-                        return lines.join("\n");
-                    }
-                    catch (error) {
-                        const msg = error instanceof Error ? error.message : String(error);
-                        if (ui.v2Enabled) {
-                            return [
-                                ...formatUiHeader(ui, "Import accounts"),
-                                "",
-                                formatUiItem(ui, `${getStatusMarker(ui, "error")} Import failed`, "danger"),
-                                formatUiKeyValue(ui, "Error", msg, "danger"),
-                            ].join("\n");
-                        }
-                        return `Import failed: ${msg}`;
-                    }
-                },
-            }),
-        },
+        tool: createToolRegistry(ctx),
     };
 };
 export const OpenAIAuthPlugin = OpenAIOAuthPlugin;