oc-codex-multi-auth 6.1.2 → 6.1.3

package/README.md

@@ -14,10 +14,10 @@ Use your ChatGPT Plus/Pro subscription inside OpenCode with OAuth login, GPT-5/C
 
 ## What This Project Does
 
-- Adds an OpenCode plugin that authenticates with ChatGPT Plus/Pro through official OAuth
-- Ships ready-to-use GPT-5.5 release templates, explicit `gpt-5.5-medium` / `gpt-5.5-high` selectors, `gpt-5-codex`, and related GPT-5 families
-- Routes requests through a stateless Codex-compatible request pipeline with automatic token refresh
-- Supports multi-account rotation, per-project account storage, and guided onboarding commands
+- Adds an OpenCode plugin that authenticates with ChatGPT Plus/Pro through official OAuth
+- Ships ready-to-use GPT-5.5 templates, explicit `gpt-5.5-medium` / `gpt-5.5-high` selectors, `gpt-5-codex`, and related GPT-5 families
+- Routes requests through a stateless Codex-compatible request pipeline with automatic token refresh
+- Supports multi-account rotation, per-project account storage, and guided onboarding commands
 
 ## Quick Start
 
@@ -25,12 +25,12 @@ Use your ChatGPT Plus/Pro subscription inside OpenCode with OAuth login, GPT-5/C
 # 1. Install or refresh the plugin config
 npx -y oc-codex-multi-auth@latest
 
-# 2. Sign in with ChatGPT Plus/Pro
-opencode auth login
-
-# 3. Run a prompt in OpenCode
-opencode run "Explain this repository" --model=openai/gpt-5.5-medium
-```
+# 2. Sign in with ChatGPT Plus/Pro
+opencode auth login
+
+# 3. Run a prompt in OpenCode
+opencode run "Explain this repository" --model=openai/gpt-5.5-medium
+```
 
 What the installer does:
 
@@ -39,20 +39,20 @@ What the installer does:
 - normalizes the plugin entry to `"oc-codex-multi-auth"`
 - clears the cached plugin copy so OpenCode reinstalls the latest package
 
-By default, the installer now writes a full catalog config that includes both:
-- modern base model entries such as `gpt-5.5` for `--variant` workflows
-- explicit preset entries such as `gpt-5.5-medium` / `gpt-5.5-high` so the shipped catalog is visible directly in model pickers
-
-Tested live on OpenCode `1.14.22`: explicit GPT-5.5 model IDs like `openai/gpt-5.5-medium` and `openai/gpt-5.5-high` work directly. Some OpenCode releases still reject bare `openai/gpt-5.5` on the CLI even when the base config entry exists in the effective config.
+By default, the installer now writes a full catalog config that includes both:
+- modern base model entries such as `gpt-5.5` for `--variant` workflows
+- explicit preset entries such as `gpt-5.5-medium` / `gpt-5.5-high` so the shipped catalog is visible directly in model pickers
+
+Tested live on OpenCode `1.14.22`: explicit GPT-5.5 model IDs like `openai/gpt-5.5-medium` and `openai/gpt-5.5-high` work directly. Some OpenCode releases still reject bare `openai/gpt-5.5` on the CLI even when the base config entry exists in the effective config.
 
 ## Example Usage
 
 ```bash
-# General GPT-5 workflow
-opencode run "Summarize the failing test and suggest a fix" --model=openai/gpt-5.5-medium
-
-# Codex-focused workflow
-opencode run "Refactor the retry logic and update the tests" --model=openai/gpt-5-codex --variant=high
+# General GPT-5 workflow
+opencode run "Summarize the failing test and suggest a fix" --model=openai/gpt-5.5-medium
+
+# Codex-focused workflow
+opencode run "Refactor the retry logic and update the tests" --model=openai/gpt-5-codex --variant=high
 ```
 
 ## Usage Notice
@@ -86,7 +86,7 @@ OpenCode users often want the same GPT-5 and Codex model experience they use in
 
 ## Common Workflows
 
-- Personal coding sessions in OpenCode using `gpt-5.5-medium`, `gpt-5.5-high`, or `gpt-5-codex`
+- Personal coding sessions in OpenCode using `gpt-5.5-medium`, `gpt-5.5-high`, or `gpt-5-codex`
 - Switching between personal and workspace-linked ChatGPT accounts
 - Keeping separate account pools per project or monorepo
 - Recovering from unsupported-model, auth, or rate-limit issues with guided commands

package/config/README.md

@@ -35,13 +35,13 @@ opencode --version
 
 OpenCode v1.0.210+ added model `variants`, so one model entry can expose multiple reasoning levels. That keeps modern config much smaller while preserving the same effective presets.
 
-Both templates include:
-- GPT-5.5, GPT-5.5 Pro, GPT-5.4 Mini, GPT-5.4 Nano, GPT-5 Codex, GPT-5.1, GPT-5.1 Codex, GPT-5.1 Codex Max, GPT-5.1 Codex Mini
-- Reasoning variants per model family
-- `store: false` and `include: ["reasoning.encrypted_content"]`
-- Context metadata (`gpt-5.5`/`gpt-5.5-pro`: 1,050,000; `gpt-5.4-mini`/`gpt-5.4-nano`/Codex models: 400,000; `gpt-5.1`: 272,000; all output: 128,000)
-
-Use `opencode debug config` to verify that these template entries were merged into your effective config. On tested OpenCode `1.14.22`, `opencode models openai` exposes explicit GPT-5.5 entries such as `gpt-5.5-medium` / `gpt-5.5-high`, while bare `gpt-5.5` may still be omitted or rejected by provider lookup even when it exists in the effective config.
+Both templates include:
+- GPT-5.5, GPT-5.5 Pro, GPT-5.4 Mini, GPT-5.4 Nano, GPT-5 Codex, GPT-5.1, GPT-5.1 Codex, GPT-5.1 Codex Max, GPT-5.1 Codex Mini
+- Reasoning variants per model family
+- `store: false` and `include: ["reasoning.encrypted_content"]`
+- Context metadata (`gpt-5.5`/`gpt-5.5-pro`: 1,050,000; `gpt-5.4-mini`/`gpt-5.4-nano`/Codex models: 400,000; `gpt-5.1`: 272,000; all output: 128,000)
+
+Use `opencode debug config` to verify that these template entries were merged into your effective config. On tested OpenCode `1.14.22`, `opencode models openai` exposes explicit GPT-5.5 entries such as `gpt-5.5-medium` / `gpt-5.5-high`, while bare `gpt-5.5` may still be omitted or rejected by provider lookup even when it exists in the effective config.
 
 If your OpenCode runtime supports global compaction tuning, you can also set:
 - `model_context_window = 1050000`
@@ -55,18 +55,18 @@ If your workspace is entitled, you can add Spark model IDs manually.
 
 ## Usage examples
 
-Recommended real-session selectors (tested on OpenCode `1.14.22`):
-
-```bash
-opencode run "task" --model=openai/gpt-5.5-medium
-opencode run "task" --model=openai/gpt-5-codex --variant=high
-```
-
-If your OpenCode release already exposes bare GPT-5.5 base entries, the compact modern template also supports:
-
-```bash
-opencode run "task" --model=openai/gpt-5.5 --variant=medium
-```
+Recommended real-session selectors (tested on OpenCode `1.14.22`):
+
+```bash
+opencode run "task" --model=openai/gpt-5.5-medium
+opencode run "task" --model=openai/gpt-5-codex --variant=high
+```
+
+If your OpenCode release already exposes bare GPT-5.5 base entries, the compact modern template also supports:
+
+```bash
+opencode run "task" --model=openai/gpt-5.5 --variant=medium
+```
 
 ## Minimal config (advanced)
 
@@ -76,19 +76,19 @@ A barebones debug template is available at [`minimal-opencode.json`](./minimal-o
 
 Current defaults are strict entitlement handling:
 - `unsupportedCodexPolicy: "strict"` returns entitlement errors directly
-- set `unsupportedCodexPolicy: "fallback"` (or `CODEX_AUTH_UNSUPPORTED_MODEL_POLICY=fallback`) to enable automatic fallback retries
-- `fallbackToGpt52OnUnsupportedGpt53: true` keeps the legacy `gpt-5.3-codex -> gpt-5.2-codex` edge inside fallback mode
-- `gpt-5.5 -> gpt-5.4` is included by default for current ChatGPT-account entitlement gaps
-- `gpt-5.5-pro -> gpt-5.5-20260423` is included by default in fallback mode
-- `gpt-5.4-pro -> gpt-5.4` remains available for older manual configs
-- `unsupportedCodexFallbackChain` lets you override fallback order per model
-
-Default fallback chain (when policy is `fallback`):
-- `gpt-5.5 -> gpt-5.4`
-- `gpt-5.5-pro -> gpt-5.5-20260423`
-- `gpt-5.4-pro -> gpt-5.4` (if you manually select `gpt-5.4-pro`)
-- `gpt-5.3-codex -> gpt-5-codex -> gpt-5.2-codex`
-- `gpt-5.3-codex-spark -> gpt-5-codex -> gpt-5.3-codex -> gpt-5.2-codex` (only relevant if Spark IDs are added manually)
+- set `unsupportedCodexPolicy: "fallback"` (or `CODEX_AUTH_UNSUPPORTED_MODEL_POLICY=fallback`) to enable automatic fallback retries
+- `fallbackToGpt52OnUnsupportedGpt53: true` keeps the legacy `gpt-5.3-codex -> gpt-5.2-codex` edge inside fallback mode
+- `gpt-5.5 -> gpt-5.4` is included by default for accounts/workspaces that do not yet expose GPT-5.5
+- `gpt-5.5-pro -> gpt-5.5` is included by default in fallback mode
+- `gpt-5.4-pro -> gpt-5.4` remains available for older manual configs
+- `unsupportedCodexFallbackChain` lets you override fallback order per model
+
+Default fallback chain (when policy is `fallback`):
+- `gpt-5.5 -> gpt-5.4`
+- `gpt-5.5-pro -> gpt-5.5`
+- `gpt-5.4-pro -> gpt-5.4` (if you manually select `gpt-5.4-pro`)
+- `gpt-5.3-codex -> gpt-5-codex -> gpt-5.2-codex`
+- `gpt-5.3-codex-spark -> gpt-5-codex -> gpt-5.3-codex -> gpt-5.2-codex` (only relevant if Spark IDs are added manually)
 - `gpt-5.2-codex -> gpt-5-codex`
 - `gpt-5.1-codex -> gpt-5-codex`
 

package/config/opencode-legacy.json

@@ -16,7 +16,7 @@
       },
       "models": {
         "gpt-5.5-none": {
-          "name": "GPT 5.5 20260423 None (OAuth)",
+          "name": "GPT 5.5 None (OAuth)",
           "limit": {
             "context": 1050000,
             "output": 128000
@@ -41,7 +41,7 @@
           }
         },
         "gpt-5.5-low": {
-          "name": "GPT 5.5 20260423 Low (OAuth)",
+          "name": "GPT 5.5 Low (OAuth)",
           "limit": {
             "context": 1050000,
             "output": 128000
@@ -66,7 +66,7 @@
           }
         },
         "gpt-5.5-medium": {
-          "name": "GPT 5.5 20260423 Medium (OAuth)",
+          "name": "GPT 5.5 Medium (OAuth)",
           "limit": {
             "context": 1050000,
             "output": 128000
@@ -91,7 +91,7 @@
           }
         },
         "gpt-5.5-high": {
-          "name": "GPT 5.5 20260423 High (OAuth)",
+          "name": "GPT 5.5 High (OAuth)",
           "limit": {
             "context": 1050000,
             "output": 128000
@@ -116,7 +116,7 @@
           }
         },
         "gpt-5.5-xhigh": {
-          "name": "GPT 5.5 20260423 Extra High (OAuth)",
+          "name": "GPT 5.5 Extra High (OAuth)",
           "limit": {
             "context": 1050000,
             "output": 128000
@@ -265,81 +265,6 @@
             "store": false
           }
         },
-        "gpt-5.5-pro-medium": {
-          "name": "GPT 5.5 Pro 20260423 Medium (OAuth)",
-          "limit": {
-            "context": 1050000,
-            "output": 128000
-          },
-          "modalities": {
-            "input": [
-              "text",
-              "image"
-            ],
-            "output": [
-              "text"
-            ]
-          },
-          "options": {
-            "reasoningEffort": "medium",
-            "reasoningSummary": "detailed",
-            "textVerbosity": "medium",
-            "include": [
-              "reasoning.encrypted_content"
-            ],
-            "store": false
-          }
-        },
-        "gpt-5.5-pro-high": {
-          "name": "GPT 5.5 Pro 20260423 High (OAuth)",
-          "limit": {
-            "context": 1050000,
-            "output": 128000
-          },
-          "modalities": {
-            "input": [
-              "text",
-              "image"
-            ],
-            "output": [
-              "text"
-            ]
-          },
-          "options": {
-            "reasoningEffort": "high",
-            "reasoningSummary": "detailed",
-            "textVerbosity": "medium",
-            "include": [
-              "reasoning.encrypted_content"
-            ],
-            "store": false
-          }
-        },
-        "gpt-5.5-pro-xhigh": {
-          "name": "GPT 5.5 Pro 20260423 Extra High (OAuth)",
-          "limit": {
-            "context": 1050000,
-            "output": 128000
-          },
-          "modalities": {
-            "input": [
-              "text",
-              "image"
-            ],
-            "output": [
-              "text"
-            ]
-          },
-          "options": {
-            "reasoningEffort": "xhigh",
-            "reasoningSummary": "detailed",
-            "textVerbosity": "medium",
-            "include": [
-              "reasoning.encrypted_content"
-            ],
-            "store": false
-          }
-        },
         "gpt-5.4-nano-none": {
           "name": "GPT 5.4 Nano None (OAuth)",
           "limit": {

package/config/opencode-modern.json

@@ -16,7 +16,7 @@
       },
       "models": {
         "gpt-5.5": {
-          "name": "GPT 5.5 20260423 (OAuth)",
+          "name": "GPT 5.5 (OAuth)",
           "limit": {
             "context": 1050000,
             "output": 128000
@@ -58,39 +58,6 @@
             }
           }
         },
-        "gpt-5.5-pro": {
-          "name": "GPT 5.5 Pro 20260423 (OAuth)",
-          "limit": {
-            "context": 1050000,
-            "output": 128000
-          },
-          "modalities": {
-            "input": [
-              "text",
-              "image"
-            ],
-            "output": [
-              "text"
-            ]
-          },
-          "variants": {
-            "medium": {
-              "reasoningEffort": "medium",
-              "reasoningSummary": "detailed",
-              "textVerbosity": "medium"
-            },
-            "high": {
-              "reasoningEffort": "high",
-              "reasoningSummary": "detailed",
-              "textVerbosity": "medium"
-            },
-            "xhigh": {
-              "reasoningEffort": "xhigh",
-              "reasoningSummary": "detailed",
-              "textVerbosity": "medium"
-            }
-          }
-        },
         "gpt-5.4-mini": {
           "name": "GPT 5.4 Mini (OAuth)",
           "limit": {

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAe,MAAM,qBAAqB,CAAC;AAwL/D;;;;;;;;;;;;;;;GAeG;AAEH,eAAO,MAAM,iBAAiB,EAAE,MAmrG/B,CAAC;AAEF,eAAO,MAAM,gBAAgB,QAAoB,CAAC;AAElD,eAAe,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAKH,OAAO,KAAK,EAAE,MAAM,EAAe,MAAM,qBAAqB,CAAC;AA2L/D;;;;;;;;;;;;;;;GAeG;AAEH,eAAO,MAAM,iBAAiB,EAAE,MA60G/B,CAAC;AAEF,eAAO,MAAM,gBAAgB,QAAoB,CAAC;AAElD,eAAe,iBAAiB,CAAC"}

package/dist/index.js

@@ -22,6 +22,9 @@
  * @repository https://github.com/ndycode/oc-codex-multi-auth
 
  */
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
 import { createAuthorizationFlow, exchangeAuthorizationCode, parseAuthorizationInput, REDIRECT_URI, } from "./lib/auth/auth.js";
 import { buildDeviceCodeInstructions, completeDeviceCodeSession, createDeviceCodeSession, } from "./lib/auth/device-code.js";
 import { applyAccountSelectionFallbacks, persistResolvedAccountSelection, persistAccountPool, resolveAndPersistAccountSelection, resolveAccountSelection, } from "./lib/auth/login-runner.js";
@@ -38,7 +41,7 @@ import { AccountManager, extractAccountEmail, extractAccountId, formatAccountLab
 import { getStoragePath, loadAccounts, saveAccounts, clearAccounts, setStoragePath, loadFlaggedAccounts, saveFlaggedAccounts, withFlaggedAccountStorageTransaction, clearFlaggedAccounts, getWorkspaceIdentityKey, StorageError, formatStorageErrorHint, } from "./lib/storage.js";
 import { createCodexHeaders, extractRequestUrl, handleErrorResponse, handleSuccessResponse, isDeactivatedWorkspaceError, getUnsupportedCodexModelInfo, resolveUnsupportedCodexFallbackModel, refreshAndUpdateToken, rewriteUrlForCodex, shouldRefreshToken, transformRequestForCodex, } from "./lib/request/fetch-helpers.js";
 import { createDeactivatedWorkspaceError, DEACTIVATED_WORKSPACE_ERROR_CODE, isDeactivatedWorkspaceErrorMessage, } from "./lib/error-sentinels.js";
-import { applyFastSessionDefaults } from "./lib/request/request-transformer.js";
+import { applyFastSessionDefaults, upsertBackendModelIdentityMessage, } from "./lib/request/request-transformer.js";
 import { getRateLimitBackoff, RATE_LIMIT_SHORT_RETRY_THRESHOLD_MS, resetRateLimitBackoff, } from "./lib/request/rate-limit-backoff.js";
 import { isEmptyResponse } from "./lib/request/response-handler.js";
 import { getCircuitBreaker } from "./lib/circuit-breaker.js";
@@ -68,7 +71,6 @@ import { createToolRegistry, } from "./lib/tools/index.js";
  * }
  * ```
  */
-// eslint-disable-next-line @typescript-eslint/require-await
 export const OpenAIOAuthPlugin = async ({ client }) => {
     initLogger(client);
     let cachedAccountManager = null;
@@ -252,7 +254,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
         openBrowserUrl(url);
         if (!serverInfo || !serverInfo.ready) {
             serverInfo?.close();
-            const message = `OAuth callback server failed to start on http://127.0.0.1:1455. ` +
+            const message = `OAuth callback server failed to start on localhost loopback port 1455. ` +
                 `Retry with "${AUTH_LABELS.OAUTH_DEVICE_CODE}" or "${AUTH_LABELS.OAUTH_MANUAL}".`;
             logWarn(`\n[${PLUGIN_NAME}] ${message}\n`);
             return {
@@ -296,6 +298,67 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
         const raw = Number.isFinite(rawCandidate) ? rawCandidate : 0;
         return Math.max(0, Math.min(raw, total - 1));
     };
+    const backfillHostOpenAIAuthFromPool = async () => {
+        const authPath = join(homedir(), ".local", "share", "opencode", "auth.json");
+        let authStore = {};
+        try {
+            const authRaw = await readFile(authPath, "utf8");
+            const parsed = JSON.parse(authRaw);
+            if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+                authStore = parsed;
+            }
+        }
+        catch (error) {
+            const errorCode = error?.code;
+            if (errorCode !== "ENOENT") {
+                logWarn(`[${PLUGIN_NAME}] Failed to read host auth store for OpenAI backfill: ${error?.message ?? String(error)}`);
+                return;
+            }
+        }
+        const existing = authStore[PROVIDER_ID];
+        const hasExistingOAuth = existing?.type === "oauth" &&
+            typeof existing.access === "string" &&
+            existing.access.trim().length > 0 &&
+            typeof existing.refresh === "string" &&
+            existing.refresh.trim().length > 0 &&
+            typeof existing.expires === "number" &&
+            Number.isFinite(existing.expires);
+        if (hasExistingOAuth) {
+            return;
+        }
+        const storage = await loadAccounts();
+        if (!storage || storage.accounts.length === 0) {
+            return;
+        }
+        const hasUsableTokens = (account) => typeof account?.accessToken === "string" &&
+            account.accessToken.trim().length > 0 &&
+            typeof account?.refreshToken === "string" &&
+            account.refreshToken.trim().length > 0 &&
+            typeof account?.expiresAt === "number" &&
+            Number.isFinite(account.expiresAt);
+        const activeIndex = resolveActiveIndex(storage, "codex");
+        const activeAccount = storage.accounts[activeIndex];
+        const candidate = hasUsableTokens(activeAccount)
+            ? activeAccount
+            : storage.accounts.find(hasUsableTokens);
+        if (!candidate || !hasUsableTokens(candidate)) {
+            return;
+        }
+        authStore[PROVIDER_ID] = {
+            type: "oauth",
+            access: candidate.accessToken,
+            refresh: candidate.refreshToken,
+            expires: candidate.expiresAt,
+        };
+        try {
+            await mkdir(join(homedir(), ".local", "share", "opencode"), { recursive: true });
+            await writeFile(authPath, `${JSON.stringify(authStore, null, 2)}\n`, "utf8");
+            logInfo(`[${PLUGIN_NAME}] Restored missing host OpenAI auth entry from stored account pool`);
+        }
+        catch (error) {
+            logWarn(`[${PLUGIN_NAME}] Failed to backfill host OpenAI auth entry: ${error?.message ?? String(error)}`);
+        }
+    };
     const hydrateEmails = async (storage) => {
         if (!storage)
             return storage;
@@ -339,6 +402,10 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                         account.expiresAt = refreshed.expires;
                         changed = true;
                     }
+                    if (refreshed.scope && refreshed.scope !== account.oauthScope) {
+                        account.oauthScope = refreshed.scope;
+                        changed = true;
+                    }
                     if (refreshed.refresh && refreshed.refresh !== account.refreshToken) {
                         account.refreshToken = refreshed.refresh;
                         changed = true;
@@ -844,6 +911,10 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
         invalidateAccountManagerCache,
         upsertFlaggedAccountRecord,
     };
+    const startupPluginConfig = loadPluginConfig();
+    const startupPerProjectAccounts = getPerProjectAccounts(startupPluginConfig);
+    setStoragePath(startupPerProjectAccounts ? process.cwd() : null);
+    await backfillHostOpenAIAuthFromPool();
     return {
         event: eventHandler,
         auth: {
@@ -900,9 +971,17 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                     if (needsPersist) {
                         await accountManager.saveToDisk();
                     }
-                    if (accountManager.getAccountCount() === 0) {
-                        logDebug(`[${PLUGIN_NAME}] No Codex accounts available (run opencode auth login)`);
-                        return {};
+                    const accountCount = accountManager.getAccountCount();
+                    const storagePath = getStoragePath();
+                    logDebug(`[${PLUGIN_NAME}] Loader auth bootstrap`, {
+                        authType: auth.type,
+                        authHasRefresh: !!authFallback?.refresh,
+                        authHasMultiAccount: !!authWithMulti?.multiAccount,
+                        accountCount,
+                        storagePath,
+                    });
+                    if (accountCount === 0) {
+                        logWarn(`[${PLUGIN_NAME}] No Codex accounts available (run opencode auth login)`);
                     }
                     // Extract user configuration (global + per-model options)
                     const providerConfig = provider;
@@ -1500,15 +1579,31 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                                     fallbackFrom = previousModel;
                                                     fallbackTo = model;
                                                     fallbackReason = "fallback-unsupported-model-entitlement";
+                                                    const fallbackInstructions = await getCodexInstructions(model);
                                                     if (transformedBody && typeof transformedBody === "object") {
-                                                        transformedBody = { ...transformedBody, model };
+                                                        transformedBody = {
+                                                            ...transformedBody,
+                                                            model,
+                                                            instructions: fallbackInstructions,
+                                                            input: upsertBackendModelIdentityMessage(transformedBody.input, model),
+                                                        };
                                                     }
                                                     else {
-                                                        let fallbackBody = { model };
+                                                        let fallbackBody = {
+                                                            model,
+                                                            instructions: fallbackInstructions,
+                                                        };
                                                         if (requestInit?.body && typeof requestInit.body === "string") {
                                                             try {
                                                                 const parsed = JSON.parse(requestInit.body);
-                                                                fallbackBody = { ...parsed, model };
+                                                                fallbackBody = {
+                                                                    ...parsed,
+                                                                    model,
+                                                                    instructions: fallbackInstructions,
+                                                                };
+                                                                if (Array.isArray(fallbackBody.input)) {
+                                                                    fallbackBody.input = upsertBackendModelIdentityMessage(fallbackBody.input, model);
+                                                                }
                                                             }
                                                             catch {
                                                                 // Keep minimal fallback body if parsing fails.
@@ -1715,14 +1810,28 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                         continue;
                                     }
                                     const waitLabel = waitMs > 0 ? formatWaitTime(waitMs) : "a bit";
+                                    const wasEntitlementExhaustion = runtimeMetrics.lastErrorCategory === "unsupported-model";
+                                    const entitlementModel = typeof runtimeMetrics.lastError === "string"
+                                        ? runtimeMetrics.lastError.replace(/^Unsupported model.*?:\s*/i, "").trim()
+                                        : "";
+                                    const entitlementDetail = entitlementModel.length > 0
+                                        ? ` The backend rejected '${entitlementModel}' as not entitled for Codex OAuth on every pooled account.`
+                                        : "";
                                     const message = count === 0
                                         ? "No Codex accounts configured. Run `opencode auth login`."
                                         : waitMs > 0
                                             ? `All ${count} account(s) are rate-limited. Try again in ${waitLabel} or add another account with \`opencode auth login\`.`
-                                            : `All ${count} account(s) failed (server errors or auth issues). Check account health with \`codex-health\`.`;
+                                            : wasEntitlementExhaustion
+                                                ? `All ${count} account(s) returned 'model not supported' for the requested model.${entitlementDetail} If this is a GPT-5.5 request during the rollout period, set \`unsupportedCodexPolicy: "fallback"\` (or \`CODEX_AUTH_UNSUPPORTED_MODEL_POLICY=fallback\`) to auto-fallback to gpt-5.4. See \`codex-health\` for per-account details.`
+                                                : `All ${count} account(s) failed (server errors or auth issues). Check account health with \`codex-health\`.`;
                                     runtimeMetrics.failedRequests++;
                                     runtimeMetrics.lastError = message;
-                                    runtimeMetrics.lastErrorCategory = waitMs > 0 ? "rate-limit" : "account-failure";
+                                    runtimeMetrics.lastErrorCategory =
+                                        waitMs > 0
+                                            ? "rate-limit"
+                                            : wasEntitlementExhaustion
+                                                ? "unsupported-model"
+                                                : "account-failure";
                                     return new Response(JSON.stringify({ error: { message } }), {
                                         status: waitMs > 0 ? 429 : 503,
                                         headers: {
@@ -2127,6 +2236,10 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                             account.expiresAt = refreshResult.expires;
                                             storageChanged = true;
                                         }
+                                        if (refreshResult.scope && refreshResult.scope !== account.oauthScope) {
+                                            account.oauthScope = refreshResult.scope;
+                                            storageChanged = true;
+                                        }
                                         const hydratedEmail = sanitizeEmail(extractAccountEmail(refreshResult.access, refreshResult.idToken));
                                         if (hydratedEmail && hydratedEmail !== account.email) {
                                             account.email = hydratedEmail;