oc-codex-multi-auth 6.1.10 → 6.3.0

package/README.md

@@ -249,6 +249,8 @@ Selected runtime/environment overrides:
 | `CODEX_TUI_V2=0/1` | Disable/enable codex-style tool output |
 | `CODEX_TUI_COLOR_PROFILE=truecolor|ansi256|ansi16` | Force terminal color profile |
 | `CODEX_TUI_GLYPHS=ascii|unicode|auto` | Force terminal glyph style |
+| `CODEX_TUI_MASK_EMAIL=0/1` | Hide account email in TUI quota status only |
+| `CODEX_TUI_MASK_EMAIL_DETAILS=0/1` | Also hide account email in quota details when prompt masking is enabled |
 | `CODEX_AUTH_PER_PROJECT_ACCOUNTS=0/1` | Disable/enable per-project account pools |
 | `CODEX_AUTH_AUTO_UPDATE=0/1` | Disable/enable daily npm update check and cache refresh |
 | `CODEX_AUTH_UNSUPPORTED_MODEL_POLICY=strict|fallback` | Control unsupported-model retry behavior |

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAKH,OAAO,KAAK,EAAE,MAAM,EAAe,MAAM,qBAAqB,CAAC;AAkM/D;;;;;;;;;;;;;;;GAeG;AAEH,eAAO,MAAM,iBAAiB,EAAE,MA03G/B,CAAC;AAEF,eAAO,MAAM,gBAAgB,QAAoB,CAAC;AAElD,eAAe,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAKH,OAAO,KAAK,EAAE,MAAM,EAAe,MAAM,qBAAqB,CAAC;AAsM/D;;;;;;;;;;;;;;;GAeG;AAEH,eAAO,MAAM,iBAAiB,EAAE,MAojH/B,CAAC;AAEF,eAAO,MAAM,gBAAgB,QAAoB,CAAC;AAElD,eAAe,iBAAiB,CAAC"}

package/dist/index.js

@@ -32,13 +32,15 @@ import { queuedRefresh } from "./lib/refresh-queue.js";
 import { openBrowserUrl } from "./lib/auth/browser.js";
 import { startLocalOAuthServer } from "./lib/auth/server.js";
 import { promptAddAnotherAccount, promptLoginMode } from "./lib/cli.js";
-import { getCodexMode, getRequestTransformMode, getFastSession, getFastSessionStrategy, getFastSessionMaxInputItems, getRetryProfile, getRetryBudgetOverrides, getRateLimitToastDebounceMs, getRetryAllAccountsMaxRetries, getRetryAllAccountsMaxWaitMs, getRetryAllAccountsRateLimited, getFallbackToGpt52OnUnsupportedGpt53, getUnsupportedCodexPolicy, getUnsupportedCodexFallbackChain, getTokenRefreshSkewMs, getSessionRecovery, getAutoResume, getAutoUpdate, getToastDurationMs, getPerProjectAccounts, getEmptyResponseMaxRetries, getEmptyResponseRetryDelayMs, getPidOffsetEnabled, getFetchTimeoutMs, getStreamStallTimeoutMs, getCodexTuiV2, getCodexTuiColorProfile, getCodexTuiGlyphMode, getBeginnerSafeMode, loadPluginConfig, } from "./lib/config.js";
+import { getCodexMode, getRequestTransformMode, getFastSession, getFastSessionStrategy, getFastSessionMaxInputItems, getRetryProfile, getRetryBudgetOverrides, getRateLimitToastDebounceMs, getRetryAllAccountsMaxRetries, getRetryAllAccountsMaxWaitMs, getRetryAllAccountsRateLimited, getFallbackToGpt52OnUnsupportedGpt53, getUnsupportedCodexPolicy, getUnsupportedCodexFallbackChain, getTokenRefreshSkewMs, getSessionRecovery, getAutoResume, getAutoUpdate, getToastDurationMs, getPerProjectAccounts, getEmptyResponseMaxRetries, getEmptyResponseRetryDelayMs, getPidOffsetEnabled, getFetchTimeoutMs, getStreamStallTimeoutMs, getCodexTuiV2, getCodexTuiColorProfile, getCodexTuiGlyphMode, getBeginnerSafeMode, getCodexTuiMaskEmail, loadPluginConfig, } from "./lib/config.js";
 import { AUTH_LABELS, CODEX_BASE_URL, DUMMY_API_KEY, LOG_STAGES, PLUGIN_NAME, PROVIDER_ID, ACCOUNT_LIMITS, } from "./lib/constants.js";
 import { initLogger, logRequest, logDebug, logInfo, logWarn, logError, setCorrelationId, clearCorrelationId, } from "./lib/logger.js";
 import { checkAndNotify } from "./lib/auto-update-checker.js";
 import { handleContextOverflow } from "./lib/context-overflow.js";
 import { AccountManager, extractAccountEmail, extractAccountId, formatAccountLabel, formatWaitTime, sanitizeEmail, shouldUpdateAccountIdFromToken, resolveRequestAccountId, parseRateLimitReason, lookupCodexCliTokensByEmail, } from "./lib/accounts.js";
-import { getStoragePath, loadAccounts, saveAccounts, clearAccounts, setStoragePath, loadFlaggedAccounts, saveFlaggedAccounts, withFlaggedAccountStorageTransaction, clearFlaggedAccounts, getWorkspaceIdentityKey, StorageError, formatStorageErrorHint, } from "./lib/storage.js";
+import { resolveDisplayEmail } from "./lib/account-display.js";
+import { CodexAuthError } from "./lib/errors.js";
+import { getStoragePath, loadAccounts, saveAccounts, withAccountStorageTransaction, clearAccounts, setStoragePath, loadFlaggedAccounts, saveFlaggedAccounts, withFlaggedAccountStorageTransaction, clearFlaggedAccounts, getWorkspaceIdentityKey, StorageError, formatStorageErrorHint, } from "./lib/storage.js";
 import { createCodexHeaders, extractRequestUrl, handleErrorResponse, handleSuccessResponse, isDeactivatedWorkspaceError, getUnsupportedCodexModelInfo, resolveUnsupportedCodexFallbackModel, refreshAndUpdateToken, rewriteUrlForCodex, shouldRefreshToken, transformRequestForCodex, } from "./lib/request/fetch-helpers.js";
 import { createDeactivatedWorkspaceError, DEACTIVATED_WORKSPACE_ERROR_CODE, isDeactivatedWorkspaceErrorMessage, } from "./lib/error-sentinels.js";
 import { applyFastSessionDefaults, upsertBackendModelIdentityMessage, } from "./lib/request/request-transformer.js";
@@ -399,15 +401,22 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
         if (accountsToHydrate.length === 0)
             return storage;
         let changed = false;
+        // Record hydrated field updates keyed by the account's ORIGINAL
+        // refresh token (captured before the network call) so we can
+        // re-apply them onto a freshly-loaded snapshot inside a storage
+        // transaction — avoiding a lost-update race with concurrent saves.
+        const hydrationUpdates = new Map();
         // process in chunks of 3 to avoid auth0 rate limits (429) on startup
         const chunkSize = 3;
         for (let i = 0; i < accountsToHydrate.length; i += chunkSize) {
             const chunk = accountsToHydrate.slice(i, i + chunkSize);
             await Promise.all(chunk.map(async (account) => {
+                const originalRefreshToken = account.refreshToken;
                 try {
                     const refreshed = await queuedRefresh(account.refreshToken);
                     if (refreshed.type !== "success")
                         return;
+                    const update = hydrationUpdates.get(originalRefreshToken) ?? {};
                     const id = extractAccountId(refreshed.access);
                     const email = sanitizeEmail(extractAccountEmail(refreshed.access, refreshed.idToken));
                     if (id &&
@@ -415,28 +424,38 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                         shouldUpdateAccountIdFromToken(account.accountIdSource, account.accountId)) {
                         account.accountId = id;
                         account.accountIdSource = "token";
+                        update.accountId = id;
+                        update.accountIdSource = "token";
                         changed = true;
                     }
                     if (email && email !== account.email) {
                         account.email = email;
+                        update.email = email;
                         changed = true;
                     }
                     if (refreshed.access && refreshed.access !== account.accessToken) {
                         account.accessToken = refreshed.access;
+                        update.accessToken = refreshed.access;
                         changed = true;
                     }
                     if (typeof refreshed.expires === "number" && refreshed.expires !== account.expiresAt) {
                         account.expiresAt = refreshed.expires;
+                        update.expiresAt = refreshed.expires;
                         changed = true;
                     }
                     if (refreshed.scope && refreshed.scope !== account.oauthScope) {
                         account.oauthScope = refreshed.scope;
+                        update.oauthScope = refreshed.scope;
                         changed = true;
                     }
                     if (refreshed.refresh && refreshed.refresh !== account.refreshToken) {
                         account.refreshToken = refreshed.refresh;
+                        update.refreshToken = refreshed.refresh;
                         changed = true;
                     }
+                    if (Object.keys(update).length > 0) {
+                        hydrationUpdates.set(originalRefreshToken, update);
+                    }
                 }
                 catch {
                     logWarn(`[${PLUGIN_NAME}] Failed to hydrate email for account`);
@@ -444,8 +463,37 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
             }));
         }
         if (changed) {
+            // Persist under the storage lock against a fresh snapshot so a
+            // concurrent save during the (potentially multi-second) hydration
+            // network loop is not clobbered. Match accounts by their original
+            // refresh token.
+            await withAccountStorageTransaction(async (current, persist) => {
+                if (!current)
+                    return;
+                for (const acc of current.accounts) {
+                    const update = hydrationUpdates.get(acc.refreshToken);
+                    if (!update)
+                        continue;
+                    if (update.accountId !== undefined)
+                        acc.accountId = update.accountId;
+                    if (update.accountIdSource !== undefined)
+                        acc.accountIdSource = update.accountIdSource;
+                    if (update.email !== undefined)
+                        acc.email = update.email;
+                    if (update.accessToken !== undefined)
+                        acc.accessToken = update.accessToken;
+                    if (update.expiresAt !== undefined)
+                        acc.expiresAt = update.expiresAt;
+                    if (update.oauthScope !== undefined)
+                        acc.oauthScope = update.oauthScope;
+                    // Apply the rotated refresh token LAST so the map key
+                    // (original token) still matches above.
+                    if (update.refreshToken !== undefined)
+                        acc.refreshToken = update.refreshToken;
+                }
+                await persist(current);
+            });
             storage.accounts = accountsCopy;
-            await saveAccounts(storage);
         }
         return storage;
     };
@@ -487,6 +535,9 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
     const resolveUiRuntime = () => {
         return applyUiRuntimeFromConfig(loadPluginConfig());
     };
+    const resolveMaskEmail = () => {
+        return getCodexTuiMaskEmail(loadPluginConfig());
+    };
     const getStatusMarker = (ui, status) => {
         if (!ui.v2Enabled) {
             if (status === "ok")
@@ -509,8 +560,8 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
             return normalized;
         return `${normalized.slice(0, 8)}...${normalized.slice(-6)}`;
     };
-    const formatCommandAccountLabel = (account, index) => {
-        const email = account?.email?.trim();
+    const formatCommandAccountLabel = (account, index, options = {}) => {
+        const email = resolveDisplayEmail(account?.email, options.maskEmail ?? false);
         const workspace = account?.accountLabel?.trim();
         const accountId = formatAccountIdForDisplay(account?.accountId);
         const tags = Array.isArray(account?.accountTags)
@@ -555,8 +606,9 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
             return null;
         try {
             const { select } = await import("./lib/ui/select.js");
+            const maskEmail = resolveMaskEmail();
             const selected = await select(storage.accounts.map((account, index) => ({
-                label: formatCommandAccountLabel(account, index),
+                label: formatCommandAccountLabel(account, index, { maskEmail }),
                 value: index,
             })), {
                 message: title,
@@ -819,8 +871,23 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
         }
     };
     const invalidateAccountManagerCache = () => {
+        // Dispose the outgoing manager so we don't leak its shutdown handler
+        // into the global cleanup queue or leave a pending debounce timer
+        // pointing at a stale instance. Flush first (best-effort, in the
+        // background) so any queued debounced save is not silently dropped.
+        const previous = cachedAccountManager;
         cachedAccountManager = null;
         accountManagerPromise = null;
+        if (previous) {
+            void previous
+                .flushPendingSave()
+                .catch((error) => {
+                logWarn(`Failed to flush pending save while invalidating account manager: ${error instanceof Error ? error.message : String(error)}`);
+            })
+                .finally(() => {
+                previous.disposeShutdownHandler();
+            });
+        }
     };
     const persistAuthenticatedSelections = async (results, replaceAll) => {
         try {
@@ -919,6 +986,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
         resolveUiRuntime,
         getStatusMarker,
         formatCommandAccountLabel,
+        resolveMaskEmail,
         normalizeAccountTags,
         supportsInteractiveMenus,
         promptAccountIndexSelection,
@@ -1027,6 +1095,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                     const fastSessionMaxInputItems = getFastSessionMaxInputItems(pluginConfig);
                     const beginnerSafeMode = getBeginnerSafeMode(pluginConfig);
                     beginnerSafeModeEnabled = beginnerSafeMode;
+                    const maskEmailEnabled = getCodexTuiMaskEmail(pluginConfig);
                     const retryProfile = beginnerSafeMode
                         ? "conservative"
                         : getRetryProfile(pluginConfig);
@@ -1345,8 +1414,24 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                             runtimeMetrics.accountRotations++;
                                             runtimeMetrics.lastError = err?.message ?? String(err);
                                             runtimeMetrics.lastErrorCategory = "auth-refresh";
+                                            // Transient refresh failures (network blip / upstream 5xx) must NOT
+                                            // count toward permanent account removal — the credentials are still
+                                            // valid and a flaky network or outage would otherwise silently delete
+                                            // them. Cool the account down briefly and rotate instead.
+                                            const isTransientRefreshFailure = err instanceof CodexAuthError && err.retryable === true;
+                                            if (isTransientRefreshFailure) {
+                                                const cooledCount = accountManager.markAccountsWithRefreshTokenCoolingDown(account.refreshToken, ACCOUNT_LIMITS.AUTH_FAILURE_COOLDOWN_MS, "auth-failure");
+                                                if (cooledCount <= 0) {
+                                                    accountManager.markAccountCoolingDown(account, ACCOUNT_LIMITS.AUTH_FAILURE_COOLDOWN_MS, "auth-failure");
+                                                }
+                                                accountManager.saveToDiskDebounced();
+                                                logWarn(`[${PLUGIN_NAME}] Transient auth refresh failure for account ${account.index + 1} (${err.refreshFailureReason ?? "unknown"}${err.statusCode ? ` ${err.statusCode}` : ""}); cooling down without counting toward removal.`);
+                                                continue;
+                                            }
                                             const failures = await accountManager.incrementAuthFailures(account);
-                                            const accountLabel = formatAccountLabel(account, account.index);
+                                            const accountLabel = formatAccountLabel(account, account.index, {
+                                                maskEmail: maskEmailEnabled,
+                                            });
                                             if (failures >= ACCOUNT_LIMITS.MAX_AUTH_FAILURES_BEFORE_REMOVAL) {
                                                 const removedCount = accountManager.removeAccountsWithSameRefreshToken(account);
                                                 if (removedCount <= 0) {
@@ -1392,7 +1477,9 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                         accountManager.saveToDiskDebounced();
                                         if (accountCount > 1 &&
                                             accountManager.shouldShowAccountToast(account.index, rateLimitToastDebounceMs)) {
-                                            const accountLabel = formatAccountLabel(account, account.index);
+                                            const accountLabel = formatAccountLabel(account, account.index, {
+                                                maskEmail: maskEmailEnabled,
+                                            });
                                             await showToast(`Using ${accountLabel} (${account.index + 1}/${accountCount})`, "info");
                                             accountManager.markToastShown(account.index);
                                         }
@@ -1410,7 +1497,11 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                                 `Local token bucket depleted for account ${account.index + 1} (${modelFamily}${model ? `:${model}` : ""})`;
                                             runtimeMetrics.lastErrorCategory = "rate-limit-local";
                                             logWarn(`Skipping account ${account.index + 1}: local token bucket depleted for ${modelFamily}${model ? `:${model}` : ""}`);
-                                            break;
+                                            // Skip THIS account and rotate to the next one. `account.index` is
+                                            // already in `attempted` (added above), so the traversal loop guard
+                                            // prevents reselecting it and terminates once all are exhausted.
+                                            // Using `break` here would abandon every other healthy account.
+                                            continue;
                                         }
                                         // RC-8: per-(account, family) circuit-breaker key. The breaker gates
                                         // upstream calls so that repeated failures short-circuit to the
@@ -1525,7 +1616,9 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                                 });
                                                 const workspaceDeactivated = isDeactivatedWorkspaceError(errorBody, response.status);
                                                 if (workspaceDeactivated) {
-                                                    const accountLabel = formatAccountLabel(account, account.index);
+                                                    const accountLabel = formatAccountLabel(account, account.index, {
+                                                        maskEmail: maskEmailEnabled,
+                                                    });
                                                     accountManager.refundToken(account, modelFamily, model);
                                                     accountManager.recordFailure(account, modelFamily, model);
                                                     account.lastSwitchReason = "rotation";
@@ -1552,12 +1645,13 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                                     catch (flagError) {
                                                         logWarn(`Failed to persist deactivated workspace flag for ${accountLabel}: ${flagError instanceof Error ? flagError.message : String(flagError)}`);
                                                     }
-                                                    // Keep deactivated workspace cleanup aligned with the existing
-                                                    // refresh-token removal path. saveToDiskDebounced reuses the
-                                                    // storage temp-file + EPERM/EBUSY retry path covered in
-                                                    // test/storage.test.ts, and surfaced persistence failures stay
-                                                    // sanitized by the redaction checks in test/login-runner.test.ts.
-                                                    const removedCount = accountManager.removeAccountsWithSameRefreshToken(account);
+                                                    // Remove ONLY the deactivated workspace, scoped by workspace
+                                                    // identity (org/account id). A single multi-org OAuth login
+                                                    // produces sibling accounts that share one refresh token but are
+                                                    // independently valid; removing all refresh-token siblings here
+                                                    // would silently drop still-valid workspaces from rotation. The
+                                                    // refresh token itself is still good, so siblings must survive.
+                                                    const removedCount = accountManager.removeAccountsByWorkspaceIdentity(account);
                                                     if (removedCount > 0) {
                                                         accountManager.saveToDiskDebounced();
                                                         restartAccountTraversalAfterWorkspaceDeactivation = true;
@@ -1774,9 +1868,32 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                             }
                                             resetRateLimitBackoff(account.index, quotaKey);
                                             runtimeMetrics.cumulativeLatencyMs += fetchLatencyMs;
-                                            const successResponse = await handleSuccessResponse(response, isStreaming, {
-                                                streamStallTimeoutMs,
-                                            });
+                                            let successResponse;
+                                            try {
+                                                successResponse = await handleSuccessResponse(response, isStreaming, {
+                                                    streamStallTimeoutMs,
+                                                });
+                                            }
+                                            catch (streamError) {
+                                                // A stream stall or SSE-parse failure happened AFTER a token was
+                                                // consumed (line ~token-consume above). Without this catch the
+                                                // exception escaped both loops, leaking the consumed token and
+                                                // skipping account rotation. Refund, mark the breaker/account
+                                                // failed, and rotate to the next account.
+                                                accountManager.refundToken(account, modelFamily, model);
+                                                accountManager.recordFailure(account, modelFamily, model);
+                                                circuitBreaker.recordFailure();
+                                                account.lastSwitchReason = "rotation";
+                                                runtimeMetrics.failedRequests++;
+                                                runtimeMetrics.accountRotations++;
+                                                runtimeMetrics.lastError =
+                                                    streamError instanceof Error ? streamError.message : String(streamError);
+                                                runtimeMetrics.lastErrorCategory = "stream";
+                                                logWarn(`Stream/response handling failed for account ${account.index + 1}: ${runtimeMetrics.lastError}. Rotating.`);
+                                                // Account for the server-class retry budget, then rotate.
+                                                consumeRetryBudget("server", "Stream/response handling failure");
+                                                break;
+                                            }
                                             if (!successResponse.ok) {
                                                 runtimeMetrics.failedRequests++;
                                                 runtimeMetrics.lastError = `HTTP ${successResponse.status}`;
@@ -1795,10 +1912,12 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                                             runtimeMetrics.emptyResponseRetries++;
                                                             logWarn(`Empty response received (attempt ${emptyResponseRetries}/${emptyResponseMaxRetries}). Retrying...`);
                                                             await showToast(`Empty response. Retrying (${emptyResponseRetries}/${emptyResponseMaxRetries})...`, "warning", { duration: toastDurationMs });
-                                                            accountManager.refundToken(account, modelFamily, model);
-                                                            accountManager.recordFailure(account, modelFamily, model);
                                                             await sleep(addJitter(emptyResponseRetryDelayMs, 0.2));
-                                                            break;
+                                                            // Re-issue against the SAME account by re-entering the inner
+                                                            // request loop. Using `break` here exited to account rotation,
+                                                            // which is a no-op for single-account pools and surfaced a
+                                                            // misleading "all accounts failed" 503 instead of retrying.
+                                                            continue;
                                                         }
                                                         logWarn(`Empty response after ${emptyResponseMaxRetries} retries. Returning as-is.`);
                                                     }
@@ -2165,12 +2284,15 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                             let ok = 0;
                             let disabled = 0;
                             let errors = 0;
+                            const maskEmailEnabled = getCodexTuiMaskEmail(loadPluginConfig());
                             console.log(`\nChecking ${deepProbe ? "full account health" : "quotas"} for all accounts...\n`);
                             for (let i = 0; i < total; i += 1) {
                                 const account = workingStorage.accounts[i];
                                 if (!account)
                                     continue;
-                                const label = account.email ?? account.accountLabel ?? `Account ${i + 1}`;
+                                const label = account.accountLabel?.trim() ||
+                                    resolveDisplayEmail(account.email, maskEmailEnabled) ||
+                                    `Account ${i + 1}`;
                                 if (account.enabled === false) {
                                     disabled += 1;
                                     console.log(`[${i + 1}/${total}] ${label}: DISABLED`);
@@ -2343,7 +2465,45 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                 storageChanged = true;
                             }
                             if (storageChanged) {
-                                await saveAccounts(workingStorage);
+                                // Persist under the storage lock against a fresh snapshot so
+                                // concurrent saves during the (long) health-check network loop
+                                // are not clobbered. Re-apply this run's per-account quota/state
+                                // updates by workspace identity and re-apply removals.
+                                const workingByIdentity = new Map(workingStorage.accounts.map((account) => [
+                                    getWorkspaceIdentityKey(account),
+                                    account,
+                                ]));
+                                await withAccountStorageTransaction(async (current, persist) => {
+                                    if (!current) {
+                                        // No on-disk state to merge into; fall back to the working copy.
+                                        await persist(workingStorage);
+                                        return;
+                                    }
+                                    const merged = [];
+                                    for (const acc of current.accounts) {
+                                        const identity = getWorkspaceIdentityKey(acc);
+                                        if (removeFromActive.has(identity))
+                                            continue;
+                                        const updated = workingByIdentity.get(identity);
+                                        if (updated) {
+                                            // Carry forward ONLY the token/identity fields this health
+                                            // check refreshes. Labels, tags, notes, and rate-limit /
+                                            // cooldown state stay as the fresh snapshot has them so a
+                                            // concurrent edit during the network loop is not reverted.
+                                            acc.accountId = updated.accountId;
+                                            acc.accountIdSource = updated.accountIdSource;
+                                            acc.refreshToken = updated.refreshToken;
+                                            acc.accessToken = updated.accessToken;
+                                            acc.expiresAt = updated.expiresAt;
+                                            acc.oauthScope = updated.oauthScope;
+                                            acc.email = updated.email;
+                                        }
+                                        merged.push(acc);
+                                    }
+                                    current.accounts = merged;
+                                    clampActiveIndices(current);
+                                    await persist(current);
+                                });
                                 invalidateAccountManagerCache();
                             }
                             if (flaggedChanged) {
@@ -2372,13 +2532,16 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                 return;
                             }
                             console.log("\nVerifying flagged accounts...\n");
+                            const maskEmailEnabled = getCodexTuiMaskEmail(loadPluginConfig());
                             const remaining = [];
                             const restored = [];
                             for (let i = 0; i < flaggedStorage.accounts.length; i += 1) {
                                 const flagged = flaggedStorage.accounts[i];
                                 if (!flagged)
                                     continue;
-                                const label = flagged.email ?? flagged.accountLabel ?? `Flagged ${i + 1}`;
+                                const label = flagged.accountLabel?.trim() ||
+                                    resolveDisplayEmail(flagged.email, maskEmailEnabled) ||
+                                    `Flagged ${i + 1}`;
                                 if (flagged.flaggedReason === "workspace-deactivated") {
                                     console.log(`[${i + 1}/${flaggedStorage.accounts.length}] ${label}: STILL FLAGGED (workspace deactivated)`);
                                     remaining.push(flagged);
@@ -2494,8 +2657,10 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                         enabled: account.enabled !== false,
                                     };
                                 });
+                                const maskEmailEnabled = getCodexTuiMaskEmail(loadPluginConfig());
                                 const menuResult = await promptLoginMode(existingAccounts, {
                                     flaggedCount: flaggedStorage.accounts.length,
+                                    maskEmail: maskEmailEnabled,
                                 });
                                 if (menuResult.mode === "cancel") {
                                     return {
@@ -2531,7 +2696,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                                 accounts: flaggedStorage.accounts.filter((flagged) => !matchesWorkspaceIdentity(flagged, getWorkspaceIdentityKey(target))),
                                             });
                                             invalidateAccountManagerCache();
-                                            console.log(`\nDeleted ${target.email ?? `Account ${menuResult.deleteAccountIndex + 1}`}.\n`);
+                                            console.log(`\nDeleted ${resolveDisplayEmail(target.email, maskEmailEnabled) ?? `Account ${menuResult.deleteAccountIndex + 1}`}.\n`);
                                         }
                                         continue;
                                     }
@@ -2541,7 +2706,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                             target.enabled = target.enabled === false ? true : false;
                                             await saveAccounts(workingStorage);
                                             invalidateAccountManagerCache();
-                                            console.log(`\n${target.email ?? `Account ${menuResult.toggleAccountIndex + 1}`} ${target.enabled === false ? "disabled" : "enabled"}.\n`);
+                                            console.log(`\n${resolveDisplayEmail(target.email, maskEmailEnabled) ?? `Account ${menuResult.toggleAccountIndex + 1}`} ${target.enabled === false ? "disabled" : "enabled"}.\n`);
                                         }
                                         continue;
                                     }