oc-codex-multi-auth 6.1.1 → 6.1.3

package/README.md

@@ -15,7 +15,7 @@ Use your ChatGPT Plus/Pro subscription inside OpenCode with OAuth login, GPT-5/C
 ## What This Project Does
 
 - Adds an OpenCode plugin that authenticates with ChatGPT Plus/Pro through official OAuth
-- Ships ready-to-use model templates for `gpt-5.4`, `gpt-5-codex`, and related GPT-5 families
+- Ships ready-to-use GPT-5.5 templates, explicit `gpt-5.5-medium` / `gpt-5.5-high` selectors, `gpt-5-codex`, and related GPT-5 families
 - Routes requests through a stateless Codex-compatible request pipeline with automatic token refresh
 - Supports multi-account rotation, per-project account storage, and guided onboarding commands
 
@@ -29,7 +29,7 @@ npx -y oc-codex-multi-auth@latest
 opencode auth login
 
 # 3. Run a prompt in OpenCode
-opencode run "Explain this repository" --model=openai/gpt-5.4 --variant=medium
+opencode run "Explain this repository" --model=openai/gpt-5.5-medium
 ```
 
 What the installer does:
@@ -40,14 +40,16 @@ What the installer does:
 - clears the cached plugin copy so OpenCode reinstalls the latest package
 
 By default, the installer now writes a full catalog config that includes both:
-- modern base model entries such as `gpt-5.4` for `--variant` workflows
-- explicit preset entries such as `gpt-5.4-high` so the shipped catalog is visible directly in model pickers
+- modern base model entries such as `gpt-5.5` for `--variant` workflows
+- explicit preset entries such as `gpt-5.5-medium` / `gpt-5.5-high` so the shipped catalog is visible directly in model pickers
+
+Tested live on OpenCode `1.14.22`: explicit GPT-5.5 model IDs like `openai/gpt-5.5-medium` and `openai/gpt-5.5-high` work directly. Some OpenCode releases still reject bare `openai/gpt-5.5` on the CLI even when the base config entry exists in the effective config.
 
 ## Example Usage
 
 ```bash
 # General GPT-5 workflow
-opencode run "Summarize the failing test and suggest a fix" --model=openai/gpt-5.4 --variant=medium
+opencode run "Summarize the failing test and suggest a fix" --model=openai/gpt-5.5-medium
 
 # Codex-focused workflow
 opencode run "Refactor the retry logic and update the tests" --model=openai/gpt-5-codex --variant=high
@@ -84,7 +86,7 @@ OpenCode users often want the same GPT-5 and Codex model experience they use in
 
 ## Common Workflows
 
-- Personal coding sessions in OpenCode using `gpt-5.4` or `gpt-5-codex`
+- Personal coding sessions in OpenCode using `gpt-5.5-medium`, `gpt-5.5-high`, or `gpt-5-codex`
 - Switching between personal and workspace-linked ChatGPT accounts
 - Keeping separate account pools per project or monorepo
 - Recovering from unsupported-model, auth, or rate-limit issues with guided commands

package/config/README.md

@@ -36,12 +36,12 @@ opencode --version
 OpenCode v1.0.210+ added model `variants`, so one model entry can expose multiple reasoning levels. That keeps modern config much smaller while preserving the same effective presets.
 
 Both templates include:
-- GPT-5.4, GPT-5.4 Pro, GPT-5.4 Mini, GPT-5.4 Nano, GPT-5 Codex, GPT-5.1, GPT-5.1 Codex, GPT-5.1 Codex Max, GPT-5.1 Codex Mini
+- GPT-5.5, GPT-5.5 Pro, GPT-5.4 Mini, GPT-5.4 Nano, GPT-5 Codex, GPT-5.1, GPT-5.1 Codex, GPT-5.1 Codex Max, GPT-5.1 Codex Mini
 - Reasoning variants per model family
 - `store: false` and `include: ["reasoning.encrypted_content"]`
-- Context metadata (`gpt-5.4`/`gpt-5.4-pro`: 1,050,000; `gpt-5.4-mini`/`gpt-5.4-nano`/Codex models: 400,000; `gpt-5.1`: 272,000; all output: 128,000)
+- Context metadata (`gpt-5.5`/`gpt-5.5-pro`: 1,050,000; `gpt-5.4-mini`/`gpt-5.4-nano`/Codex models: 400,000; `gpt-5.1`: 272,000; all output: 128,000)
 
-Use `opencode debug config` to verify that these template entries were merged into your effective config. `opencode models openai` currently shows OpenCode's built-in provider catalog and can omit config-defined entries such as `gpt-5.4-mini`.
+Use `opencode debug config` to verify that these template entries were merged into your effective config. On tested OpenCode `1.14.22`, `opencode models openai` exposes explicit GPT-5.5 entries such as `gpt-5.5-medium` / `gpt-5.5-high`, while bare `gpt-5.5` may still be omitted or rejected by provider lookup even when it exists in the effective config.
 
 If your OpenCode runtime supports global compaction tuning, you can also set:
 - `model_context_window = 1050000`
@@ -55,18 +55,17 @@ If your workspace is entitled, you can add Spark model IDs manually.
 
 ## Usage examples
 
-Modern template (v1.0.210+):
+Recommended real-session selectors (tested on OpenCode `1.14.22`):
 
 ```bash
-opencode run "task" --model=openai/gpt-5.4 --variant=medium
+opencode run "task" --model=openai/gpt-5.5-medium
 opencode run "task" --model=openai/gpt-5-codex --variant=high
 ```
 
-Legacy template (v1.0.209 and below):
+If your OpenCode release already exposes bare GPT-5.5 base entries, the compact modern template also supports:
 
 ```bash
-opencode run "task" --model=openai/gpt-5.4-medium
-opencode run "task" --model=openai/gpt-5-codex-high
+opencode run "task" --model=openai/gpt-5.5 --variant=medium
 ```
 
 ## Minimal config (advanced)
@@ -79,10 +78,14 @@ Current defaults are strict entitlement handling:
 - `unsupportedCodexPolicy: "strict"` returns entitlement errors directly
 - set `unsupportedCodexPolicy: "fallback"` (or `CODEX_AUTH_UNSUPPORTED_MODEL_POLICY=fallback`) to enable automatic fallback retries
 - `fallbackToGpt52OnUnsupportedGpt53: true` keeps the legacy `gpt-5.3-codex -> gpt-5.2-codex` edge inside fallback mode
-- `gpt-5.4-pro -> gpt-5.4` is included by default in fallback mode (relevant only if you add `gpt-5.4-pro` manually)
+- `gpt-5.5 -> gpt-5.4` is included by default for accounts/workspaces that do not yet expose GPT-5.5
+- `gpt-5.5-pro -> gpt-5.5` is included by default in fallback mode
+- `gpt-5.4-pro -> gpt-5.4` remains available for older manual configs
 - `unsupportedCodexFallbackChain` lets you override fallback order per model
 
 Default fallback chain (when policy is `fallback`):
+- `gpt-5.5 -> gpt-5.4`
+- `gpt-5.5-pro -> gpt-5.5`
 - `gpt-5.4-pro -> gpt-5.4` (if you manually select `gpt-5.4-pro`)
 - `gpt-5.3-codex -> gpt-5-codex -> gpt-5.2-codex`
 - `gpt-5.3-codex-spark -> gpt-5-codex -> gpt-5.3-codex -> gpt-5.2-codex` (only relevant if Spark IDs are added manually)

package/config/opencode-legacy.json

@@ -15,8 +15,8 @@
         "store": false
       },
       "models": {
-        "gpt-5.4-none": {
-          "name": "GPT 5.4 None (OAuth)",
+        "gpt-5.5-none": {
+          "name": "GPT 5.5 None (OAuth)",
           "limit": {
             "context": 1050000,
             "output": 128000
@@ -40,8 +40,8 @@
             "store": false
           }
         },
-        "gpt-5.4-low": {
-          "name": "GPT 5.4 Low (OAuth)",
+        "gpt-5.5-low": {
+          "name": "GPT 5.5 Low (OAuth)",
           "limit": {
             "context": 1050000,
             "output": 128000
@@ -65,8 +65,8 @@
             "store": false
           }
         },
-        "gpt-5.4-medium": {
-          "name": "GPT 5.4 Medium (OAuth)",
+        "gpt-5.5-medium": {
+          "name": "GPT 5.5 Medium (OAuth)",
           "limit": {
             "context": 1050000,
             "output": 128000
@@ -90,8 +90,8 @@
             "store": false
           }
         },
-        "gpt-5.4-high": {
-          "name": "GPT 5.4 High (OAuth)",
+        "gpt-5.5-high": {
+          "name": "GPT 5.5 High (OAuth)",
           "limit": {
             "context": 1050000,
             "output": 128000
@@ -115,8 +115,8 @@
             "store": false
           }
         },
-        "gpt-5.4-xhigh": {
-          "name": "GPT 5.4 Extra High (OAuth)",
+        "gpt-5.5-xhigh": {
+          "name": "GPT 5.5 Extra High (OAuth)",
           "limit": {
             "context": 1050000,
             "output": 128000
@@ -265,81 +265,6 @@
             "store": false
           }
         },
-        "gpt-5.4-pro-medium": {
-          "name": "GPT 5.4 Pro Medium (OAuth)",
-          "limit": {
-            "context": 1050000,
-            "output": 128000
-          },
-          "modalities": {
-            "input": [
-              "text",
-              "image"
-            ],
-            "output": [
-              "text"
-            ]
-          },
-          "options": {
-            "reasoningEffort": "medium",
-            "reasoningSummary": "detailed",
-            "textVerbosity": "medium",
-            "include": [
-              "reasoning.encrypted_content"
-            ],
-            "store": false
-          }
-        },
-        "gpt-5.4-pro-high": {
-          "name": "GPT 5.4 Pro High (OAuth)",
-          "limit": {
-            "context": 1050000,
-            "output": 128000
-          },
-          "modalities": {
-            "input": [
-              "text",
-              "image"
-            ],
-            "output": [
-              "text"
-            ]
-          },
-          "options": {
-            "reasoningEffort": "high",
-            "reasoningSummary": "detailed",
-            "textVerbosity": "medium",
-            "include": [
-              "reasoning.encrypted_content"
-            ],
-            "store": false
-          }
-        },
-        "gpt-5.4-pro-xhigh": {
-          "name": "GPT 5.4 Pro Extra High (OAuth)",
-          "limit": {
-            "context": 1050000,
-            "output": 128000
-          },
-          "modalities": {
-            "input": [
-              "text",
-              "image"
-            ],
-            "output": [
-              "text"
-            ]
-          },
-          "options": {
-            "reasoningEffort": "xhigh",
-            "reasoningSummary": "detailed",
-            "textVerbosity": "medium",
-            "include": [
-              "reasoning.encrypted_content"
-            ],
-            "store": false
-          }
-        },
         "gpt-5.4-nano-none": {
           "name": "GPT 5.4 Nano None (OAuth)",
           "limit": {

package/config/opencode-modern.json

@@ -15,8 +15,8 @@
         "store": false
       },
       "models": {
-        "gpt-5.4": {
-          "name": "GPT 5.4 (OAuth)",
+        "gpt-5.5": {
+          "name": "GPT 5.5 (OAuth)",
           "limit": {
             "context": 1050000,
             "output": 128000
@@ -58,39 +58,6 @@
             }
           }
         },
-        "gpt-5.4-pro": {
-          "name": "GPT 5.4 Pro (OAuth)",
-          "limit": {
-            "context": 1050000,
-            "output": 128000
-          },
-          "modalities": {
-            "input": [
-              "text",
-              "image"
-            ],
-            "output": [
-              "text"
-            ]
-          },
-          "variants": {
-            "medium": {
-              "reasoningEffort": "medium",
-              "reasoningSummary": "detailed",
-              "textVerbosity": "medium"
-            },
-            "high": {
-              "reasoningEffort": "high",
-              "reasoningSummary": "detailed",
-              "textVerbosity": "medium"
-            },
-            "xhigh": {
-              "reasoningEffort": "xhigh",
-              "reasoningSummary": "detailed",
-              "textVerbosity": "medium"
-            }
-          }
-        },
         "gpt-5.4-mini": {
           "name": "GPT 5.4 Mini (OAuth)",
           "limit": {

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAe,MAAM,qBAAqB,CAAC;AAwL/D;;;;;;;;;;;;;;;GAeG;AAEH,eAAO,MAAM,iBAAiB,EAAE,MAmrG/B,CAAC;AAEF,eAAO,MAAM,gBAAgB,QAAoB,CAAC;AAElD,eAAe,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAKH,OAAO,KAAK,EAAE,MAAM,EAAe,MAAM,qBAAqB,CAAC;AA2L/D;;;;;;;;;;;;;;;GAeG;AAEH,eAAO,MAAM,iBAAiB,EAAE,MA60G/B,CAAC;AAEF,eAAO,MAAM,gBAAgB,QAAoB,CAAC;AAElD,eAAe,iBAAiB,CAAC"}

package/dist/index.js

@@ -22,6 +22,9 @@
  * @repository https://github.com/ndycode/oc-codex-multi-auth
 
  */
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
 import { createAuthorizationFlow, exchangeAuthorizationCode, parseAuthorizationInput, REDIRECT_URI, } from "./lib/auth/auth.js";
 import { buildDeviceCodeInstructions, completeDeviceCodeSession, createDeviceCodeSession, } from "./lib/auth/device-code.js";
 import { applyAccountSelectionFallbacks, persistResolvedAccountSelection, persistAccountPool, resolveAndPersistAccountSelection, resolveAccountSelection, } from "./lib/auth/login-runner.js";
@@ -38,7 +41,7 @@ import { AccountManager, extractAccountEmail, extractAccountId, formatAccountLab
 import { getStoragePath, loadAccounts, saveAccounts, clearAccounts, setStoragePath, loadFlaggedAccounts, saveFlaggedAccounts, withFlaggedAccountStorageTransaction, clearFlaggedAccounts, getWorkspaceIdentityKey, StorageError, formatStorageErrorHint, } from "./lib/storage.js";
 import { createCodexHeaders, extractRequestUrl, handleErrorResponse, handleSuccessResponse, isDeactivatedWorkspaceError, getUnsupportedCodexModelInfo, resolveUnsupportedCodexFallbackModel, refreshAndUpdateToken, rewriteUrlForCodex, shouldRefreshToken, transformRequestForCodex, } from "./lib/request/fetch-helpers.js";
 import { createDeactivatedWorkspaceError, DEACTIVATED_WORKSPACE_ERROR_CODE, isDeactivatedWorkspaceErrorMessage, } from "./lib/error-sentinels.js";
-import { applyFastSessionDefaults } from "./lib/request/request-transformer.js";
+import { applyFastSessionDefaults, upsertBackendModelIdentityMessage, } from "./lib/request/request-transformer.js";
 import { getRateLimitBackoff, RATE_LIMIT_SHORT_RETRY_THRESHOLD_MS, resetRateLimitBackoff, } from "./lib/request/rate-limit-backoff.js";
 import { isEmptyResponse } from "./lib/request/response-handler.js";
 import { getCircuitBreaker } from "./lib/circuit-breaker.js";
@@ -68,7 +71,6 @@ import { createToolRegistry, } from "./lib/tools/index.js";
  * }
  * ```
  */
-// eslint-disable-next-line @typescript-eslint/require-await
 export const OpenAIOAuthPlugin = async ({ client }) => {
     initLogger(client);
     let cachedAccountManager = null;
@@ -252,7 +254,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
         openBrowserUrl(url);
         if (!serverInfo || !serverInfo.ready) {
             serverInfo?.close();
-            const message = `OAuth callback server failed to start on http://127.0.0.1:1455. ` +
+            const message = `OAuth callback server failed to start on localhost loopback port 1455. ` +
                 `Retry with "${AUTH_LABELS.OAUTH_DEVICE_CODE}" or "${AUTH_LABELS.OAUTH_MANUAL}".`;
             logWarn(`\n[${PLUGIN_NAME}] ${message}\n`);
             return {
@@ -296,6 +298,67 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
         const raw = Number.isFinite(rawCandidate) ? rawCandidate : 0;
         return Math.max(0, Math.min(raw, total - 1));
     };
+    const backfillHostOpenAIAuthFromPool = async () => {
+        const authPath = join(homedir(), ".local", "share", "opencode", "auth.json");
+        let authStore = {};
+        try {
+            const authRaw = await readFile(authPath, "utf8");
+            const parsed = JSON.parse(authRaw);
+            if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+                authStore = parsed;
+            }
+        }
+        catch (error) {
+            const errorCode = error?.code;
+            if (errorCode !== "ENOENT") {
+                logWarn(`[${PLUGIN_NAME}] Failed to read host auth store for OpenAI backfill: ${error?.message ?? String(error)}`);
+                return;
+            }
+        }
+        const existing = authStore[PROVIDER_ID];
+        const hasExistingOAuth = existing?.type === "oauth" &&
+            typeof existing.access === "string" &&
+            existing.access.trim().length > 0 &&
+            typeof existing.refresh === "string" &&
+            existing.refresh.trim().length > 0 &&
+            typeof existing.expires === "number" &&
+            Number.isFinite(existing.expires);
+        if (hasExistingOAuth) {
+            return;
+        }
+        const storage = await loadAccounts();
+        if (!storage || storage.accounts.length === 0) {
+            return;
+        }
+        const hasUsableTokens = (account) => typeof account?.accessToken === "string" &&
+            account.accessToken.trim().length > 0 &&
+            typeof account?.refreshToken === "string" &&
+            account.refreshToken.trim().length > 0 &&
+            typeof account?.expiresAt === "number" &&
+            Number.isFinite(account.expiresAt);
+        const activeIndex = resolveActiveIndex(storage, "codex");
+        const activeAccount = storage.accounts[activeIndex];
+        const candidate = hasUsableTokens(activeAccount)
+            ? activeAccount
+            : storage.accounts.find(hasUsableTokens);
+        if (!candidate || !hasUsableTokens(candidate)) {
+            return;
+        }
+        authStore[PROVIDER_ID] = {
+            type: "oauth",
+            access: candidate.accessToken,
+            refresh: candidate.refreshToken,
+            expires: candidate.expiresAt,
+        };
+        try {
+            await mkdir(join(homedir(), ".local", "share", "opencode"), { recursive: true });
+            await writeFile(authPath, `${JSON.stringify(authStore, null, 2)}\n`, "utf8");
+            logInfo(`[${PLUGIN_NAME}] Restored missing host OpenAI auth entry from stored account pool`);
+        }
+        catch (error) {
+            logWarn(`[${PLUGIN_NAME}] Failed to backfill host OpenAI auth entry: ${error?.message ?? String(error)}`);
+        }
+    };
     const hydrateEmails = async (storage) => {
         if (!storage)
             return storage;
@@ -339,6 +402,10 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                         account.expiresAt = refreshed.expires;
                         changed = true;
                     }
+                    if (refreshed.scope && refreshed.scope !== account.oauthScope) {
+                        account.oauthScope = refreshed.scope;
+                        changed = true;
+                    }
                     if (refreshed.refresh && refreshed.refresh !== account.refreshToken) {
                         account.refreshToken = refreshed.refresh;
                         changed = true;
@@ -844,6 +911,10 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
         invalidateAccountManagerCache,
         upsertFlaggedAccountRecord,
     };
+    const startupPluginConfig = loadPluginConfig();
+    const startupPerProjectAccounts = getPerProjectAccounts(startupPluginConfig);
+    setStoragePath(startupPerProjectAccounts ? process.cwd() : null);
+    await backfillHostOpenAIAuthFromPool();
     return {
         event: eventHandler,
         auth: {
@@ -900,9 +971,17 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                     if (needsPersist) {
                         await accountManager.saveToDisk();
                     }
-                    if (accountManager.getAccountCount() === 0) {
-                        logDebug(`[${PLUGIN_NAME}] No Codex accounts available (run opencode auth login)`);
-                        return {};
+                    const accountCount = accountManager.getAccountCount();
+                    const storagePath = getStoragePath();
+                    logDebug(`[${PLUGIN_NAME}] Loader auth bootstrap`, {
+                        authType: auth.type,
+                        authHasRefresh: !!authFallback?.refresh,
+                        authHasMultiAccount: !!authWithMulti?.multiAccount,
+                        accountCount,
+                        storagePath,
+                    });
+                    if (accountCount === 0) {
+                        logWarn(`[${PLUGIN_NAME}] No Codex accounts available (run opencode auth login)`);
                     }
                     // Extract user configuration (global + per-model options)
                     const providerConfig = provider;
@@ -1500,15 +1579,31 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                                     fallbackFrom = previousModel;
                                                     fallbackTo = model;
                                                     fallbackReason = "fallback-unsupported-model-entitlement";
+                                                    const fallbackInstructions = await getCodexInstructions(model);
                                                     if (transformedBody && typeof transformedBody === "object") {
-                                                        transformedBody = { ...transformedBody, model };
+                                                        transformedBody = {
+                                                            ...transformedBody,
+                                                            model,
+                                                            instructions: fallbackInstructions,
+                                                            input: upsertBackendModelIdentityMessage(transformedBody.input, model),
+                                                        };
                                                     }
                                                     else {
-                                                        let fallbackBody = { model };
+                                                        let fallbackBody = {
+                                                            model,
+                                                            instructions: fallbackInstructions,
+                                                        };
                                                         if (requestInit?.body && typeof requestInit.body === "string") {
                                                             try {
                                                                 const parsed = JSON.parse(requestInit.body);
-                                                                fallbackBody = { ...parsed, model };
+                                                                fallbackBody = {
+                                                                    ...parsed,
+                                                                    model,
+                                                                    instructions: fallbackInstructions,
+                                                                };
+                                                                if (Array.isArray(fallbackBody.input)) {
+                                                                    fallbackBody.input = upsertBackendModelIdentityMessage(fallbackBody.input, model);
+                                                                }
                                                             }
                                                             catch {
                                                                 // Keep minimal fallback body if parsing fails.
@@ -1715,14 +1810,28 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                         continue;
                                     }
                                     const waitLabel = waitMs > 0 ? formatWaitTime(waitMs) : "a bit";
+                                    const wasEntitlementExhaustion = runtimeMetrics.lastErrorCategory === "unsupported-model";
+                                    const entitlementModel = typeof runtimeMetrics.lastError === "string"
+                                        ? runtimeMetrics.lastError.replace(/^Unsupported model.*?:\s*/i, "").trim()
+                                        : "";
+                                    const entitlementDetail = entitlementModel.length > 0
+                                        ? ` The backend rejected '${entitlementModel}' as not entitled for Codex OAuth on every pooled account.`
+                                        : "";
                                     const message = count === 0
                                         ? "No Codex accounts configured. Run `opencode auth login`."
                                         : waitMs > 0
                                             ? `All ${count} account(s) are rate-limited. Try again in ${waitLabel} or add another account with \`opencode auth login\`.`
-                                            : `All ${count} account(s) failed (server errors or auth issues). Check account health with \`codex-health\`.`;
+                                            : wasEntitlementExhaustion
+                                                ? `All ${count} account(s) returned 'model not supported' for the requested model.${entitlementDetail} If this is a GPT-5.5 request during the rollout period, set \`unsupportedCodexPolicy: "fallback"\` (or \`CODEX_AUTH_UNSUPPORTED_MODEL_POLICY=fallback\`) to auto-fallback to gpt-5.4. See \`codex-health\` for per-account details.`
+                                                : `All ${count} account(s) failed (server errors or auth issues). Check account health with \`codex-health\`.`;
                                     runtimeMetrics.failedRequests++;
                                     runtimeMetrics.lastError = message;
-                                    runtimeMetrics.lastErrorCategory = waitMs > 0 ? "rate-limit" : "account-failure";
+                                    runtimeMetrics.lastErrorCategory =
+                                        waitMs > 0
+                                            ? "rate-limit"
+                                            : wasEntitlementExhaustion
+                                                ? "unsupported-model"
+                                                : "account-failure";
                                     return new Response(JSON.stringify({ error: { message } }), {
                                         status: waitMs > 0 ? 429 : 503,
                                         headers: {
@@ -2127,6 +2236,10 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                             account.expiresAt = refreshResult.expires;
                                             storageChanged = true;
                                         }
+                                        if (refreshResult.scope && refreshResult.scope !== account.oauthScope) {
+                                            account.oauthScope = refreshResult.scope;
+                                            storageChanged = true;
+                                        }
                                         const hydratedEmail = sanitizeEmail(extractAccountEmail(refreshResult.access, refreshResult.idToken));
                                         if (hydratedEmail && hydratedEmail !== account.email) {
                                             account.email = hydratedEmail;