oc-codex-multi-auth 6.13.0 → 6.14.0

package/README.md

@@ -257,6 +257,7 @@ Most of these also run as a **direct CLI** with no agent/model involvement (no t
 - `reasoning.encrypted_content` is preserved for multi-turn continuity
 - GPT-5.6 tiers use the responses-lite request shape and default client identity `opencode`; other models default to `codex_cli_rs`
 - account rotation is health-aware (`rotationStrategy` default `hybrid`) and avoids repeatedly selecting cooling accounts
+- same-host OpenCode processes sharing an account file serialize refresh-token exchange and commit so one current single-use token is exchanged once
 - 5xx bursts, network failures, and quota responses penalize account health
 - token refresh is queued to avoid refresh races
 - unsupported-model handling is strict by default, with opt-in fallback controls
@@ -356,6 +357,8 @@ Selected runtime/environment overrides:
 
 | Variable | Effect |
 | --- | --- |
+| `OPENAI_BASE_URL=https://gateway.example/v1` | OpenAI-compatible OAuth inference gateway; requires `CODEX_AUTH_ALLOW_OPENAI_BASE_URL=1` |
+| `CODEX_AUTH_ALLOW_OPENAI_BASE_URL=1` | Explicitly allow the trusted gateway to receive the ChatGPT OAuth access token; remote gateways require HTTPS, while HTTP is accepted only on literal loopback IPs |
 | `CODEX_AUTH_REQUEST_TRANSFORM_MODE=legacy` | Re-enable legacy Codex request rewriting |
 | `CODEX_MODE=0/1` | Disable/enable bridge prompt behavior |
 | `CODEX_TUI_V2=0/1` | Disable/enable codex-style tool output |

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAMH,OAAO,KAAK,EAAE,MAAM,EAAe,MAAM,qBAAqB,CAAC;AAyN/D;;;;;;;;;;;;;;;GAeG;AAEH,eAAO,MAAM,iBAAiB,EAAE,MAypH/B,CAAC;AAEF,eAAO,MAAM,gBAAgB,QAAoB,CAAC;AAElD,eAAe,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAMH,OAAO,KAAK,EAAE,MAAM,EAAe,MAAM,qBAAqB,CAAC;AA8S/D;;;;;;;;;;;;;;;GAeG;AAEH,eAAO,MAAM,iBAAiB,EAAE,MAg2H/B,CAAC;AAEF,eAAO,MAAM,gBAAgB,QAAoB,CAAC;AAElD,eAAe,iBAAiB,CAAC"}

package/dist/index.js

@@ -29,7 +29,7 @@ import { join } from "node:path";
 import { createAuthorizationFlow, exchangeAuthorizationCode, parseAuthorizationInput, REDIRECT_URI, } from "./lib/auth/auth.js";
 import { buildDeviceCodeInstructions, completeDeviceCodeSession, createDeviceCodeSession, } from "./lib/auth/device-code.js";
 import { applyAccountSelectionFallbacks, persistResolvedAccountSelection, persistAccountPool, resolveAndPersistAccountSelection, resolveAccountSelection, } from "./lib/auth/login-runner.js";
-import { queuedRefresh } from "./lib/refresh-queue.js";
+import { coordinateFlaggedPersistedRefresh, coordinatePersistedRefresh, } from "./lib/storage/coordinated-refresh.js";
 import { openBrowserUrl } from "./lib/auth/browser.js";
 import { startLocalOAuthServer } from "./lib/auth/server.js";
 import { promptAddAnotherAccount, promptLoginMode } from "./lib/cli.js";
@@ -42,7 +42,7 @@ import { AccountManager, extractAccountEmail, extractAccountId, formatAccountLab
 import { matchesModelPoolAccountKey } from "./lib/accounts/pool-identity.js";
 import { resolveDisplayEmail } from "./lib/account-display.js";
 import { CodexAuthError } from "./lib/errors.js";
-import { getStoragePath, loadAccounts, saveAccounts, withAccountStorageTransaction, clearAccounts, setStoragePath, loadFlaggedAccounts, saveFlaggedAccounts, withFlaggedAccountStorageTransaction, clearFlaggedAccounts, StorageError, formatStorageErrorHint, } from "./lib/storage.js";
+import { getStoragePath, loadAccounts, withAccountStorageTransaction, clearAccounts, setStoragePath, loadFlaggedAccounts, withFlaggedAccountStorageTransaction, clearFlaggedAccounts, StorageError, formatStorageErrorHint, } from "./lib/storage.js";
 import { getWorkspaceIdentityKey } from "./lib/storage/identity.js";
 import { createCodexHeaders, extractRequestUrl, handleErrorResponse, handleSuccessResponse, isDeactivatedWorkspaceError, isInvalidatedAuthTokenError, createAbortError, getUnsupportedCodexModelInfo, resolveUnsupportedCodexFallbackModel, refreshAndUpdateToken, rewriteUrlForCodex, shouldRefreshToken, transformRequestForCodex, } from "./lib/request/fetch-helpers.js";
 import { shapeBodyForModel } from "./lib/request/helpers/responses-lite.js";
@@ -64,6 +64,83 @@ import { createToolRegistry, } from "./lib/tools/index.js";
 import { createUsageAccountFingerprint, fetchCodexUsage, formatUsageLimitSummary, formatUsageLimitTitle, hasUsageWindow, parseCodexUsagePayload, } from "./lib/codex-usage.js";
 import { getQuotaExhaustedResetAtMs } from "./lib/quota-windows.js";
 import { clearTuiQuotaSnapshot, parseTuiQuotaSnapshotFromHeaders, writeTuiQuotaSnapshot, } from "./lib/tui-quota-cache.js";
+/**
+ * IPv6 loopback literal. WHATWG URL parsing compresses every equivalent
+ * spelling (`0:0:0:0:0:0:0:1` -> `::1`), so only the canonical form is listed.
+ */
+const LOOPBACK_GATEWAY_HOSTS = new Set(["::1"]);
+const IPV4_LITERAL_PATTERN = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/;
+/**
+ * IPv4-mapped IPv6, which WHATWG serializes in hex rather than dotted form:
+ * `::ffff:127.0.0.1` -> `::ffff:7f00:1`, `::ffff:127.1.1.1` -> `::ffff:7f01:101`.
+ * The high byte of the first group is the first IPv4 octet.
+ */
+const IPV4_MAPPED_PATTERN = /^::ffff:([0-9a-f]{1,4}):[0-9a-f]{1,4}$/;
+/**
+ * Cleartext HTTP is only safe for a peer that cannot leave the host, so the check
+ * is deliberately restricted to *literal* loopback addresses. Hostnames such as
+ * `localhost` are rejected even though they usually resolve to 127.0.0.1: a host
+ * file or resolver can point them at a remote peer, which would leak the ChatGPT
+ * OAuth access token over the wire.
+ *
+ * The whole 127.0.0.0/8 range is accepted, not just 127.0.0.1 — running several
+ * local services on 127.0.0.2, 127.0.1.1, and friends is a common pattern, and
+ * every address in the block is equally unroutable.
+ */
+function isLoopbackGatewayHost(hostname) {
+    const ipv4 = IPV4_LITERAL_PATTERN.exec(hostname);
+    if (ipv4) {
+        const octets = ipv4.slice(1).map((part) => Number(part));
+        if (octets.some((octet) => !Number.isInteger(octet) || octet > 255))
+            return false;
+        return octets[0] === 127;
+    }
+    const mapped = IPV4_MAPPED_PATTERN.exec(hostname);
+    if (mapped?.[1]) {
+        // `::ffff:7f00:2` is 127.0.0.2 — just as unroutable as the dotted
+        // spelling, so rejecting it would be an inconsistency, not a safeguard.
+        return Number.parseInt(mapped[1], 16) >>> 8 === 0x7f;
+    }
+    return LOOPBACK_GATEWAY_HOSTS.has(hostname);
+}
+function invalidBaseURL(reason) {
+    return new Error(`[oc-codex-multi-auth] OPENAI_BASE_URL is invalid: ${reason}. Fix the value, or unset ` +
+        "CODEX_AUTH_ALLOW_OPENAI_BASE_URL to fall back to the default ChatGPT Codex endpoint.");
+}
+function resolveOpenAIBaseURL() {
+    if (process.env.CODEX_AUTH_ALLOW_OPENAI_BASE_URL !== "1")
+        return undefined;
+    const raw = process.env.OPENAI_BASE_URL?.trim();
+    if (!raw)
+        return undefined;
+    let parsed;
+    try {
+        parsed = new URL(raw);
+    }
+    catch {
+        // `new URL()` throws a bare `TypeError: Invalid URL` that names neither the
+        // plugin nor the variable, which is useless when it surfaces out of the
+        // auth loader. A scheme-less value such as `gateway.example/v1` is the
+        // common way to hit this. The value itself is NOT echoed: it can carry a
+        // token in a query string, and this message reaches a toast.
+        throw invalidBaseURL("the value is not a valid absolute URL (an explicit https:// or http:// scheme is required)");
+    }
+    if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+        throw invalidBaseURL("it must use http:// or https://");
+    }
+    if (parsed.username || parsed.password) {
+        throw invalidBaseURL("it must not embed credentials");
+    }
+    if (parsed.search || parsed.hash || raw.includes("?") || raw.includes("#")) {
+        throw invalidBaseURL("it must not include a query string or fragment");
+    }
+    const hostname = parsed.hostname.toLowerCase().replace(/^\[|\]$/g, "");
+    if (parsed.protocol === "http:" && !isLoopbackGatewayHost(hostname)) {
+        throw invalidBaseURL(`https:// is required for non-loopback host "${hostname}" so the ChatGPT OAuth ` +
+            "access token is never sent in cleartext");
+    }
+    return parsed.toString().replace(/\/+$/, "");
+}
 /**
  * OpenAI Codex OAuth authentication plugin for opencode
  *
@@ -82,6 +159,8 @@ import { clearTuiQuotaSnapshot, parseTuiQuotaSnapshotFromHeaders, writeTuiQuotaS
  */
 export const OpenAIOAuthPlugin = async ({ client }) => {
     initLogger(client);
+    let customBaseURLWarningShown = false;
+    let customBaseURLErrorShown = false;
     let cachedAccountManager = null;
     let accountManagerPromise = null;
     let loaderMutex = null;
@@ -440,16 +519,15 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
             process.env.OPENCODE_SKIP_EMAIL_HYDRATE === "1";
         if (skipHydrate)
             return storage;
-        const accountsCopy = storage.accounts.map((account) => account ? { ...account } : account);
+        let accountsCopy = storage.accounts.map((account) => account ? { ...account } : account);
         const accountsToHydrate = accountsCopy.filter((account) => account && !account.email);
         if (accountsToHydrate.length === 0)
             return storage;
         let changed = false;
-        // Record hydrated field updates keyed by the account's ORIGINAL
-        // refresh token (captured before the network call) so we can
-        // re-apply them onto a freshly-loaded snapshot inside a storage
-        // transaction — avoiding a lost-update race with concurrent saves.
         const hydrationUpdates = new Map();
+        // Keyed by stable workspace identity rather than by refresh token, for
+        // accounts whose token the coordinator rotated on disk mid-loop.
+        const hydrationUpdatesByIdentity = new Map();
         // process in chunks of 3 to avoid auth0 rate limits (429) on startup
         const chunkSize = 3;
         for (let i = 0; i < accountsToHydrate.length; i += chunkSize) {
@@ -457,7 +535,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
             await Promise.all(chunk.map(async (account) => {
                 const originalRefreshToken = account.refreshToken;
                 try {
-                    const refreshed = await queuedRefresh(account.refreshToken);
+                    const refreshed = await coordinatePersistedRefresh(account);
                     if (refreshed.type !== "success")
                         return;
                     const update = hydrationUpdates.get(originalRefreshToken) ?? {};
@@ -497,8 +575,25 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                         update.refreshToken = refreshed.refresh;
                         changed = true;
                     }
+                    const rotatedAt = refreshed.rotatedAt ?? account.tokenRotatedAt;
+                    if (typeof rotatedAt === "number") {
+                        account.tokenRotatedAt = rotatedAt;
+                        update.tokenRotatedAt = rotatedAt;
+                    }
                     if (Object.keys(update).length > 0) {
                         hydrationUpdates.set(originalRefreshToken, update);
+                        // The coordinator has already committed the rotated token to
+                        // disk, so matching this update by refresh token alone would
+                        // miss this account and — worse — hit any SIBLING whose token
+                        // was rotated in place to the same value. Siblings can belong
+                        // to distinct orgs, so that would hand one workspace another
+                        // workspace's access token. Register the update under this
+                        // account's stable workspace identity instead; that key is
+                        // built from org/account/member ids and does not rotate.
+                        const identityKey = getWorkspaceIdentityKey(account);
+                        if (!identityKey.startsWith("refreshToken:")) {
+                            hydrationUpdatesByIdentity.set(identityKey, update);
+                        }
                     }
                 }
                 catch {
@@ -515,7 +610,14 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                 if (!current)
                     return;
                 for (const acc of current.accounts) {
-                    const update = hydrationUpdates.get(acc.refreshToken);
+                    // Identity first: it survives a rotation the coordinator already
+                    // committed. The refresh-token key is the fallback for records
+                    // that carry no org/account/member id at all.
+                    const identityKey = getWorkspaceIdentityKey(acc);
+                    const update = (identityKey.startsWith("refreshToken:")
+                        ? undefined
+                        : hydrationUpdatesByIdentity.get(identityKey)) ??
+                        hydrationUpdates.get(acc.refreshToken);
                     if (!update)
                         continue;
                     if (update.accountId !== undefined)
@@ -524,18 +626,32 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                         acc.accountIdSource = update.accountIdSource;
                     if (update.email !== undefined)
                         acc.email = update.email;
-                    if (update.accessToken !== undefined)
-                        acc.accessToken = update.accessToken;
-                    if (update.expiresAt !== undefined)
-                        acc.expiresAt = update.expiresAt;
                     if (update.oauthScope !== undefined)
                         acc.oauthScope = update.oauthScope;
-                    // Apply the rotated refresh token LAST so the map key
-                    // (original token) still matches above.
-                    if (update.refreshToken !== undefined)
-                        acc.refreshToken = update.refreshToken;
+                    // The credential triple is single-use. This transaction runs after
+                    // the whole (multi-second) hydration loop, so a concurrent process
+                    // may have rotated the account in the meantime; writing our older
+                    // tuple back would restore a consumed token and cost a re-login.
+                    const updateRotatedAt = update.tokenRotatedAt ?? 0;
+                    const diskRotatedAt = acc.tokenRotatedAt ?? 0;
+                    if (updateRotatedAt >= diskRotatedAt) {
+                        if (update.accessToken !== undefined)
+                            acc.accessToken = update.accessToken;
+                        if (update.expiresAt !== undefined)
+                            acc.expiresAt = update.expiresAt;
+                        // Apply the rotated refresh token LAST so the map key
+                        // (original token) still matches above.
+                        if (update.refreshToken !== undefined)
+                            acc.refreshToken = update.refreshToken;
+                        if (update.tokenRotatedAt !== undefined)
+                            acc.tokenRotatedAt = update.tokenRotatedAt;
+                    }
                 }
                 await persist(current);
+                // Return what actually landed on disk, not the in-memory copy: a
+                // credential we declined to write above must not resurface through
+                // the returned storage either.
+                accountsCopy = current.accounts.map((acc) => ({ ...acc }));
             });
             storage.accounts = accountsCopy;
         }
@@ -1001,16 +1117,25 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                     }
                     const now = Date.now();
                     const account = storage.accounts[index];
-                    if (account) {
-                        account.lastUsed = now;
-                        account.lastSwitchReason = "rotation";
-                    }
-                    storage.activeIndex = index;
-                    storage.activeIndexByFamily = storage.activeIndexByFamily ?? {};
-                    for (const family of MODEL_FAMILIES) {
-                        storage.activeIndexByFamily[family] = index;
-                    }
-                    await saveAccounts(storage);
+                    if (!account)
+                        return;
+                    const identityKey = getWorkspaceIdentityKey(account);
+                    await withAccountStorageTransaction(async (current, persist) => {
+                        if (!current)
+                            return;
+                        const currentIndex = current.accounts.findIndex((candidate) => getWorkspaceIdentityKey(candidate) === identityKey);
+                        const currentAccount = current.accounts[currentIndex];
+                        if (!currentAccount || currentIndex < 0)
+                            return;
+                        currentAccount.lastUsed = now;
+                        currentAccount.lastSwitchReason = "rotation";
+                        current.activeIndex = currentIndex;
+                        current.activeIndexByFamily = current.activeIndexByFamily ?? {};
+                        for (const family of MODEL_FAMILIES) {
+                            current.activeIndexByFamily[family] = currentIndex;
+                        }
+                        await persist(current);
+                    });
                     await clearPromptQuotaCache();
                     // Reload manager from disk so we don't overwrite newer rotated
                     // refresh tokens with stale in-memory state.
@@ -1102,6 +1227,28 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
             async loader(getAuth, provider) {
                 const auth = await getAuth();
                 const pluginConfig = loadPluginConfig();
+                let openAIBaseURL;
+                try {
+                    openAIBaseURL = resolveOpenAIBaseURL();
+                }
+                catch (err) {
+                    // Fail closed rather than silently falling back to the default
+                    // endpoint: the operator asked for a gateway, so quietly bypassing
+                    // it would send ChatGPT traffic somewhere they did not choose.
+                    // Surface the reason the same way storage failures are surfaced.
+                    const message = err instanceof Error ? err.message : String(err);
+                    if (!customBaseURLErrorShown) {
+                        customBaseURLErrorShown = true;
+                        await showToast(message, "error");
+                    }
+                    throw err;
+                }
+                if (openAIBaseURL && !customBaseURLWarningShown) {
+                    customBaseURLWarningShown = true;
+                    logWarn("Routing ChatGPT OAuth inference through OPENAI_BASE_URL", {
+                        origin: new URL(openAIBaseURL).origin,
+                    });
+                }
                 applyUiRuntimeFromConfig(pluginConfig);
                 const perProjectAccounts = getPerProjectAccounts(pluginConfig);
                 setStoragePath(perProjectAccounts ? process.cwd() : null);
@@ -1255,7 +1402,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                     // Return SDK configuration
                     return {
                         apiKey: DUMMY_API_KEY,
-                        baseURL: CODEX_BASE_URL,
+                        baseURL: openAIBaseURL ?? CODEX_BASE_URL,
                         /**
                          * Custom fetch implementation for Codex API
                          *
@@ -1278,7 +1425,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                 }
                                 // Step 1: Extract and rewrite URL for Codex backend
                                 const originalUrl = extractRequestUrl(input);
-                                const url = rewriteUrlForCodex(originalUrl);
+                                const url = openAIBaseURL ? originalUrl : rewriteUrlForCodex(originalUrl);
                                 // Step 3: Transform request body with model-specific Codex instructions
                                 // Instructions are fetched per model family (codex-max, codex, gpt-5.4, etc.)
                                 // Capture original stream value before transformation
@@ -1493,7 +1640,11 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                         let accountAuth = accountManager.toAuthDetails(account);
                                         try {
                                             if (shouldRefreshToken(accountAuth, tokenRefreshSkewMs)) {
-                                                accountAuth = (await refreshAndUpdateToken(accountAuth, client));
+                                                accountAuth = (await refreshAndUpdateToken(accountAuth, client, {
+                                                    organizationId: account.organizationId,
+                                                    accountId: account.accountId,
+                                                    accountUserId: account.accountUserId,
+                                                }));
                                                 accountManager.updateFromAuth(account, accountAuth);
                                                 accountManager.clearAuthFailures(account);
                                                 accountManager.saveToDiskDebounced();
@@ -1676,6 +1827,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                                     ...requestInit,
                                                     headers,
                                                     signal: fetchController.signal,
+                                                    ...(openAIBaseURL ? { redirect: "manual" } : {}),
                                                 });
                                             }
                                             catch (networkError) {
@@ -1721,6 +1873,42 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                                 }
                                             }
                                             const fetchLatencyMs = Math.round(performance.now() - fetchStart);
+                                            // `redirect: "manual"` hands back the raw 3xx instead of following it,
+                                            // so it has to be rejected explicitly. Left alone it would reach
+                                            // ensureContentType/convertSseToJson as an empty-bodied "success" and
+                                            // be reported as a content-type or empty-response error that says
+                                            // nothing about the redirect. Only the Location *origin* is logged;
+                                            // the full target can carry credentials in its query string.
+                                            if (openAIBaseURL && response.status >= 300 && response.status < 400) {
+                                                let redirectTarget = "an unparseable location";
+                                                const location = response.headers.get("location");
+                                                if (location) {
+                                                    try {
+                                                        redirectTarget = new URL(location, url).origin;
+                                                    }
+                                                    catch {
+                                                        // keep the placeholder
+                                                    }
+                                                }
+                                                else {
+                                                    redirectTarget = "no location header";
+                                                }
+                                                logWarn(`OPENAI_BASE_URL gateway attempted a redirect (${response.status}) to ${redirectTarget}`, { origin: new URL(openAIBaseURL).origin });
+                                                accountManager.refundToken(account, modelFamily, model);
+                                                return new Response(JSON.stringify({
+                                                    error: {
+                                                        message: `The OPENAI_BASE_URL gateway responded with a ${response.status} redirect to ` +
+                                                            `${redirectTarget}. Redirects are not followed, because the ChatGPT OAuth ` +
+                                                            "access token must never be replayed to an endpoint that was not explicitly " +
+                                                            "configured. Point OPENAI_BASE_URL at the final endpoint instead.",
+                                                    },
+                                                }), {
+                                                    status: 502,
+                                                    headers: {
+                                                        "content-type": "application/json; charset=utf-8",
+                                                    },
+                                                });
+                                            }
                                             logRequest(LOG_STAGES.RESPONSE, {
                                                 status: response.status,
                                                 ok: response.ok,
@@ -2401,7 +2589,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                         }
                                     }
                                     if (!accessToken) {
-                                        const refreshResult = await queuedRefresh(account.refreshToken);
+                                        const refreshResult = await coordinatePersistedRefresh(account);
                                         if (refreshResult.type !== "success") {
                                             errors += 1;
                                             const message = refreshResult.message ?? refreshResult.reason ?? "refresh failed";
@@ -2425,6 +2613,14 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                             account.refreshToken = refreshResult.refresh;
                                             storageChanged = true;
                                         }
+                                        // Carry the coordinator's rotation stamp onto the working
+                                        // copy so the merge below can tell this snapshot's token
+                                        // apart from one a concurrent process rotated later.
+                                        if (typeof refreshResult.rotatedAt === "number" &&
+                                            refreshResult.rotatedAt !== account.tokenRotatedAt) {
+                                            account.tokenRotatedAt = refreshResult.rotatedAt;
+                                            storageChanged = true;
+                                        }
                                         if (refreshResult.access && refreshResult.access !== account.accessToken) {
                                             account.accessToken = refreshResult.access;
                                             storageChanged = true;
@@ -2551,11 +2747,24 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                             // concurrent edit during the network loop is not reverted.
                                             acc.accountId = updated.accountId;
                                             acc.accountIdSource = updated.accountIdSource;
-                                            acc.refreshToken = updated.refreshToken;
-                                            acc.accessToken = updated.accessToken;
-                                            acc.expiresAt = updated.expiresAt;
                                             acc.oauthScope = updated.oauthScope;
                                             acc.email = updated.email;
+                                            // The credential triple is single-use and must only move
+                                            // backwards-in-time never. `workingStorage` was snapshotted
+                                            // before the (multi-second) network loop, so its token can
+                                            // already be consumed: a sibling's refresh rotates every
+                                            // record sharing that token *on disk*, and a concurrent
+                                            // process can rotate it too. Writing the stale token back
+                                            // would resurrect a dead credential and cost the user a
+                                            // re-login with `refresh_token_reused`.
+                                            const workingRotatedAt = updated.tokenRotatedAt ?? 0;
+                                            const diskRotatedAt = acc.tokenRotatedAt ?? 0;
+                                            if (workingRotatedAt >= diskRotatedAt) {
+                                                acc.refreshToken = updated.refreshToken;
+                                                acc.accessToken = updated.accessToken;
+                                                acc.expiresAt = updated.expiresAt;
+                                                acc.tokenRotatedAt = updated.tokenRotatedAt;
+                                            }
                                         }
                                         merged.push(acc);
                                     }
@@ -2594,6 +2803,15 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                             const maskEmailEnabled = getCodexTuiMaskEmail(loadPluginConfig());
                             const remaining = [];
                             const restored = [];
+                            const processedIdentityKeys = new Set(flaggedStorage.accounts.map((account) => getWorkspaceIdentityKey(account)));
+                            const processedRefreshTokens = new Set(flaggedStorage.accounts.map((account) => account.refreshToken));
+                            // Only a record we positively restored may be deleted below. A record
+                            // can *look* processed without having been restored — its token can be
+                            // rotated in place by a sibling's refresh, so neither replacement
+                            // lookup finds it — and dropping that record would erase the account
+                            // from flagged-accounts.json with no trace anywhere.
+                            const restoredIdentityKeys = new Set();
+                            const restoredRefreshTokens = new Set();
                             for (let i = 0; i < flaggedStorage.accounts.length; i += 1) {
                                 const flagged = flaggedStorage.accounts[i];
                                 if (!flagged)
@@ -2629,10 +2847,12 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                             accountLabel: flagged.accountLabel,
                                         });
                                         restored.push(...resolved.variantsForPersistence);
+                                        restoredIdentityKeys.add(getWorkspaceIdentityKey(flagged));
+                                        restoredRefreshTokens.add(flagged.refreshToken);
                                         console.log(`[${i + 1}/${flaggedStorage.accounts.length}] ${label}: RESTORED (Codex CLI cache)`);
                                         continue;
                                     }
-                                    const refreshResult = await queuedRefresh(flagged.refreshToken);
+                                    const refreshResult = await coordinateFlaggedPersistedRefresh(flagged);
                                     if (refreshResult.type !== "success") {
                                         console.log(`[${i + 1}/${flaggedStorage.accounts.length}] ${label}: STILL FLAGGED (${refreshResult.message ?? refreshResult.reason ?? "refresh failed"})`);
                                         remaining.push(flagged);
@@ -2645,6 +2865,9 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                         accountLabel: flagged.accountLabel,
                                     });
                                     restored.push(...resolved.variantsForPersistence);
+                                    processedRefreshTokens.add(refreshResult.refresh);
+                                    restoredIdentityKeys.add(getWorkspaceIdentityKey(flagged));
+                                    restoredRefreshTokens.add(flagged.refreshToken);
                                     console.log(`[${i + 1}/${flaggedStorage.accounts.length}] ${label}: RESTORED`);
                                 }
                                 catch (error) {
@@ -2660,9 +2883,28 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                 await persistAccountPool(restored, false);
                                 invalidateAccountManagerCache();
                             }
-                            await saveFlaggedAccounts({
-                                version: 1,
-                                accounts: remaining,
+                            const remainingByIdentity = new Map(remaining.map((account) => [getWorkspaceIdentityKey(account), account]));
+                            const remainingByRefreshToken = new Map(remaining.map((account) => [account.refreshToken, account]));
+                            await withFlaggedAccountStorageTransaction(async (current, persist) => {
+                                current.accounts = current.accounts.flatMap((account) => {
+                                    const identityKey = getWorkspaceIdentityKey(account);
+                                    const processed = processedIdentityKeys.has(identityKey) ||
+                                        processedRefreshTokens.has(account.refreshToken);
+                                    if (!processed)
+                                        return [account];
+                                    const replacement = remainingByIdentity.get(identityKey) ??
+                                        remainingByRefreshToken.get(account.refreshToken);
+                                    if (replacement) {
+                                        return [{ ...account, lastError: replacement.lastError }];
+                                    }
+                                    // Drop only what was positively restored. Anything else that
+                                    // merely looks processed is kept: a stale flagged entry is
+                                    // recoverable, a silently deleted account is not.
+                                    const wasRestored = restoredIdentityKeys.has(identityKey) ||
+                                        restoredRefreshTokens.has(account.refreshToken);
+                                    return wasRestored ? [] : [account];
+                                });
+                                await persist(current);
                             });
                             console.log("");
                             console.log(`Results: ${restored.length} restored, ${remaining.length} still flagged`);
@@ -2747,12 +2989,20 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                     if (typeof menuResult.deleteAccountIndex === "number") {
                                         const target = workingStorage.accounts[menuResult.deleteAccountIndex];
                                         if (target) {
-                                            workingStorage.accounts.splice(menuResult.deleteAccountIndex, 1);
-                                            clampActiveIndices(workingStorage);
-                                            await saveAccounts(workingStorage);
-                                            await saveFlaggedAccounts({
-                                                version: 1,
-                                                accounts: flaggedStorage.accounts.filter((flagged) => !matchesWorkspaceIdentity(flagged, getWorkspaceIdentityKey(target))),
+                                            const identityKey = getWorkspaceIdentityKey(target);
+                                            await withAccountStorageTransaction(async (current, persist) => {
+                                                if (!current)
+                                                    return;
+                                                const currentIndex = current.accounts.findIndex((candidate) => getWorkspaceIdentityKey(candidate) === identityKey);
+                                                if (currentIndex < 0)
+                                                    return;
+                                                current.accounts.splice(currentIndex, 1);
+                                                clampActiveIndices(current);
+                                                await persist(current);
+                                            });
+                                            await withFlaggedAccountStorageTransaction(async (current, persist) => {
+                                                current.accounts = current.accounts.filter((flagged) => !matchesWorkspaceIdentity(flagged, identityKey));
+                                                await persist(current);
                                             });
                                             invalidateAccountManagerCache();
                                             console.log(`\nDeleted ${resolveDisplayEmail(target.email, maskEmailEnabled) ?? `Account ${menuResult.deleteAccountIndex + 1}`}.\n`);
@@ -2762,10 +3012,18 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                     if (typeof menuResult.toggleAccountIndex === "number") {
                                         const target = workingStorage.accounts[menuResult.toggleAccountIndex];
                                         if (target) {
-                                            target.enabled = target.enabled === false ? true : false;
-                                            await saveAccounts(workingStorage);
+                                            const identityKey = getWorkspaceIdentityKey(target);
+                                            let enabled = target.enabled !== false;
+                                            await withAccountStorageTransaction(async (current, persist) => {
+                                                const currentTarget = current?.accounts.find((candidate) => getWorkspaceIdentityKey(candidate) === identityKey);
+                                                if (!current || !currentTarget)
+                                                    return;
+                                                currentTarget.enabled = currentTarget.enabled === false;
+                                                enabled = currentTarget.enabled;
+                                                await persist(current);
+                                            });
                                             invalidateAccountManagerCache();
-                                            console.log(`\n${resolveDisplayEmail(target.email, maskEmailEnabled) ?? `Account ${menuResult.toggleAccountIndex + 1}`} ${target.enabled === false ? "disabled" : "enabled"}.\n`);
+                                            console.log(`\n${resolveDisplayEmail(target.email, maskEmailEnabled) ?? `Account ${menuResult.toggleAccountIndex + 1}`} ${enabled ? "enabled" : "disabled"}.\n`);
                                         }
                                         continue;
                                     }