oc-codex-multi-auth 6.13.0 → 6.14.1

package/dist/index.js

@@ -29,7 +29,7 @@ import { join } from "node:path";
 import { createAuthorizationFlow, exchangeAuthorizationCode, parseAuthorizationInput, REDIRECT_URI, } from "./lib/auth/auth.js";
 import { buildDeviceCodeInstructions, completeDeviceCodeSession, createDeviceCodeSession, } from "./lib/auth/device-code.js";
 import { applyAccountSelectionFallbacks, persistResolvedAccountSelection, persistAccountPool, resolveAndPersistAccountSelection, resolveAccountSelection, } from "./lib/auth/login-runner.js";
-import { queuedRefresh } from "./lib/refresh-queue.js";
+import { coordinateFlaggedPersistedRefresh, coordinatePersistedRefresh, } from "./lib/storage/coordinated-refresh.js";
 import { openBrowserUrl } from "./lib/auth/browser.js";
 import { startLocalOAuthServer } from "./lib/auth/server.js";
 import { promptAddAnotherAccount, promptLoginMode } from "./lib/cli.js";
@@ -39,10 +39,10 @@ import { initLogger, logRequest, logDebug, logInfo, logWarn, logError, setCorrel
 import { checkAndNotify } from "./lib/auto-update-checker.js";
 import { handleContextOverflow } from "./lib/context-overflow.js";
 import { AccountManager, extractAccountEmail, extractAccountId, formatAccountLabel, formatWaitTime, sanitizeEmail, shouldUpdateAccountIdFromToken, resolveRequestAccountId, parseRateLimitReason, lookupCodexCliTokensByEmail, } from "./lib/accounts.js";
-import { matchesModelPoolAccountKey } from "./lib/accounts/pool-identity.js";
+import { getModelPoolAccountKey, matchesModelPoolAccountKey, } from "./lib/accounts/pool-identity.js";
 import { resolveDisplayEmail } from "./lib/account-display.js";
 import { CodexAuthError } from "./lib/errors.js";
-import { getStoragePath, loadAccounts, saveAccounts, withAccountStorageTransaction, clearAccounts, setStoragePath, loadFlaggedAccounts, saveFlaggedAccounts, withFlaggedAccountStorageTransaction, clearFlaggedAccounts, StorageError, formatStorageErrorHint, } from "./lib/storage.js";
+import { getStoragePath, loadAccounts, withAccountStorageTransaction, clearAccounts, setStoragePath, loadFlaggedAccounts, withFlaggedAccountStorageTransaction, clearFlaggedAccounts, StorageError, formatStorageErrorHint, } from "./lib/storage.js";
 import { getWorkspaceIdentityKey } from "./lib/storage/identity.js";
 import { createCodexHeaders, extractRequestUrl, handleErrorResponse, handleSuccessResponse, isDeactivatedWorkspaceError, isInvalidatedAuthTokenError, createAbortError, getUnsupportedCodexModelInfo, resolveUnsupportedCodexFallbackModel, refreshAndUpdateToken, rewriteUrlForCodex, shouldRefreshToken, transformRequestForCodex, } from "./lib/request/fetch-helpers.js";
 import { shapeBodyForModel } from "./lib/request/helpers/responses-lite.js";
@@ -64,6 +64,109 @@ import { createToolRegistry, } from "./lib/tools/index.js";
 import { createUsageAccountFingerprint, fetchCodexUsage, formatUsageLimitSummary, formatUsageLimitTitle, hasUsageWindow, parseCodexUsagePayload, } from "./lib/codex-usage.js";
 import { getQuotaExhaustedResetAtMs } from "./lib/quota-windows.js";
 import { clearTuiQuotaSnapshot, parseTuiQuotaSnapshotFromHeaders, writeTuiQuotaSnapshot, } from "./lib/tui-quota-cache.js";
+/**
+ * IPv6 loopback literal. WHATWG URL parsing compresses every equivalent
+ * spelling (`0:0:0:0:0:0:0:1` -> `::1`), so only the canonical form is listed.
+ */
+const LOOPBACK_GATEWAY_HOSTS = new Set(["::1"]);
+const IPV4_LITERAL_PATTERN = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/;
+/**
+ * IPv4-mapped IPv6, which WHATWG serializes in hex rather than dotted form:
+ * `::ffff:127.0.0.1` -> `::ffff:7f00:1`, `::ffff:127.1.1.1` -> `::ffff:7f01:101`.
+ * The high byte of the first group is the first IPv4 octet.
+ */
+const IPV4_MAPPED_PATTERN = /^::ffff:([0-9a-f]{1,4}):[0-9a-f]{1,4}$/;
+/**
+ * Cleartext HTTP is only safe for a peer that cannot leave the host, so the check
+ * is deliberately restricted to *literal* loopback addresses. Hostnames such as
+ * `localhost` are rejected even though they usually resolve to 127.0.0.1: a host
+ * file or resolver can point them at a remote peer, which would leak the ChatGPT
+ * OAuth access token over the wire.
+ *
+ * The whole 127.0.0.0/8 range is accepted, not just 127.0.0.1 — running several
+ * local services on 127.0.0.2, 127.0.1.1, and friends is a common pattern, and
+ * every address in the block is equally unroutable.
+ */
+function isLoopbackGatewayHost(hostname) {
+    const ipv4 = IPV4_LITERAL_PATTERN.exec(hostname);
+    if (ipv4) {
+        const octets = ipv4.slice(1).map((part) => Number(part));
+        if (octets.some((octet) => !Number.isInteger(octet) || octet > 255))
+            return false;
+        return octets[0] === 127;
+    }
+    const mapped = IPV4_MAPPED_PATTERN.exec(hostname);
+    if (mapped?.[1]) {
+        // `::ffff:7f00:2` is 127.0.0.2 — just as unroutable as the dotted
+        // spelling, so rejecting it would be an inconsistency, not a safeguard.
+        return Number.parseInt(mapped[1], 16) >>> 8 === 0x7f;
+    }
+    return LOOPBACK_GATEWAY_HOSTS.has(hostname);
+}
+/**
+ * Stable per-account identity for the terminal-error diagnostics counters.
+ *
+ * `account.index` is not usable here: `AccountManager.removeAccount` reindexes
+ * the survivors, so an index recorded before a mid-traversal removal silently
+ * refers to a different account afterwards. The model-pool identity survives
+ * that reindex; the refresh token is the last-resort fallback for records that
+ * have not resolved an account id yet.
+ */
+function getAccountDiagnosticsKey(account) {
+    return getModelPoolAccountKey(account) ?? `refresh:${account.refreshToken}`;
+}
+/**
+ * How many live accounts the configured pool keys actually resolve to.
+ *
+ * Pool keys and accounts are not 1:1 — a legacy `accountId` key matches every
+ * Business seat in that workspace, and two keys can resolve to the same seat —
+ * so pool size must be counted over accounts, never over `poolKeys.length`.
+ */
+function countResolvedPoolAccounts(accounts, poolKeys) {
+    return accounts.filter((account) => poolKeys.some((key) => matchesModelPoolAccountKey(account, key))).length;
+}
+/** Configured pool keys matching no live account (typo, or account removed). */
+function countUnresolvedPoolKeys(accounts, poolKeys) {
+    return poolKeys.filter((key) => !accounts.some((account) => matchesModelPoolAccountKey(account, key))).length;
+}
+function invalidBaseURL(reason) {
+    return new Error(`[oc-codex-multi-auth] OPENAI_BASE_URL is invalid: ${reason}. Fix the value, or unset ` +
+        "CODEX_AUTH_ALLOW_OPENAI_BASE_URL to fall back to the default ChatGPT Codex endpoint.");
+}
+function resolveOpenAIBaseURL() {
+    if (process.env.CODEX_AUTH_ALLOW_OPENAI_BASE_URL !== "1")
+        return undefined;
+    const raw = process.env.OPENAI_BASE_URL?.trim();
+    if (!raw)
+        return undefined;
+    let parsed;
+    try {
+        parsed = new URL(raw);
+    }
+    catch {
+        // `new URL()` throws a bare `TypeError: Invalid URL` that names neither the
+        // plugin nor the variable, which is useless when it surfaces out of the
+        // auth loader. A scheme-less value such as `gateway.example/v1` is the
+        // common way to hit this. The value itself is NOT echoed: it can carry a
+        // token in a query string, and this message reaches a toast.
+        throw invalidBaseURL("the value is not a valid absolute URL (an explicit https:// or http:// scheme is required)");
+    }
+    if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+        throw invalidBaseURL("it must use http:// or https://");
+    }
+    if (parsed.username || parsed.password) {
+        throw invalidBaseURL("it must not embed credentials");
+    }
+    if (parsed.search || parsed.hash || raw.includes("?") || raw.includes("#")) {
+        throw invalidBaseURL("it must not include a query string or fragment");
+    }
+    const hostname = parsed.hostname.toLowerCase().replace(/^\[|\]$/g, "");
+    if (parsed.protocol === "http:" && !isLoopbackGatewayHost(hostname)) {
+        throw invalidBaseURL(`https:// is required for non-loopback host "${hostname}" so the ChatGPT OAuth ` +
+            "access token is never sent in cleartext");
+    }
+    return parsed.toString().replace(/\/+$/, "");
+}
 /**
  * OpenAI Codex OAuth authentication plugin for opencode
  *
@@ -82,6 +185,8 @@ import { clearTuiQuotaSnapshot, parseTuiQuotaSnapshotFromHeaders, writeTuiQuotaS
  */
 export const OpenAIOAuthPlugin = async ({ client }) => {
     initLogger(client);
+    let customBaseURLWarningShown = false;
+    let customBaseURLErrorShown = false;
     let cachedAccountManager = null;
     let accountManagerPromise = null;
     let loaderMutex = null;
@@ -440,16 +545,15 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
             process.env.OPENCODE_SKIP_EMAIL_HYDRATE === "1";
         if (skipHydrate)
             return storage;
-        const accountsCopy = storage.accounts.map((account) => account ? { ...account } : account);
+        let accountsCopy = storage.accounts.map((account) => account ? { ...account } : account);
         const accountsToHydrate = accountsCopy.filter((account) => account && !account.email);
         if (accountsToHydrate.length === 0)
             return storage;
         let changed = false;
-        // Record hydrated field updates keyed by the account's ORIGINAL
-        // refresh token (captured before the network call) so we can
-        // re-apply them onto a freshly-loaded snapshot inside a storage
-        // transaction — avoiding a lost-update race with concurrent saves.
         const hydrationUpdates = new Map();
+        // Keyed by stable workspace identity rather than by refresh token, for
+        // accounts whose token the coordinator rotated on disk mid-loop.
+        const hydrationUpdatesByIdentity = new Map();
         // process in chunks of 3 to avoid auth0 rate limits (429) on startup
         const chunkSize = 3;
         for (let i = 0; i < accountsToHydrate.length; i += chunkSize) {
@@ -457,7 +561,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
             await Promise.all(chunk.map(async (account) => {
                 const originalRefreshToken = account.refreshToken;
                 try {
-                    const refreshed = await queuedRefresh(account.refreshToken);
+                    const refreshed = await coordinatePersistedRefresh(account);
                     if (refreshed.type !== "success")
                         return;
                     const update = hydrationUpdates.get(originalRefreshToken) ?? {};
@@ -497,8 +601,25 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                         update.refreshToken = refreshed.refresh;
                         changed = true;
                     }
+                    const rotatedAt = refreshed.rotatedAt ?? account.tokenRotatedAt;
+                    if (typeof rotatedAt === "number") {
+                        account.tokenRotatedAt = rotatedAt;
+                        update.tokenRotatedAt = rotatedAt;
+                    }
                     if (Object.keys(update).length > 0) {
                         hydrationUpdates.set(originalRefreshToken, update);
+                        // The coordinator has already committed the rotated token to
+                        // disk, so matching this update by refresh token alone would
+                        // miss this account and — worse — hit any SIBLING whose token
+                        // was rotated in place to the same value. Siblings can belong
+                        // to distinct orgs, so that would hand one workspace another
+                        // workspace's access token. Register the update under this
+                        // account's stable workspace identity instead; that key is
+                        // built from org/account/member ids and does not rotate.
+                        const identityKey = getWorkspaceIdentityKey(account);
+                        if (!identityKey.startsWith("refreshToken:")) {
+                            hydrationUpdatesByIdentity.set(identityKey, update);
+                        }
                     }
                 }
                 catch {
@@ -515,7 +636,14 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                 if (!current)
                     return;
                 for (const acc of current.accounts) {
-                    const update = hydrationUpdates.get(acc.refreshToken);
+                    // Identity first: it survives a rotation the coordinator already
+                    // committed. The refresh-token key is the fallback for records
+                    // that carry no org/account/member id at all.
+                    const identityKey = getWorkspaceIdentityKey(acc);
+                    const update = (identityKey.startsWith("refreshToken:")
+                        ? undefined
+                        : hydrationUpdatesByIdentity.get(identityKey)) ??
+                        hydrationUpdates.get(acc.refreshToken);
                     if (!update)
                         continue;
                     if (update.accountId !== undefined)
@@ -524,18 +652,32 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                         acc.accountIdSource = update.accountIdSource;
                     if (update.email !== undefined)
                         acc.email = update.email;
-                    if (update.accessToken !== undefined)
-                        acc.accessToken = update.accessToken;
-                    if (update.expiresAt !== undefined)
-                        acc.expiresAt = update.expiresAt;
                     if (update.oauthScope !== undefined)
                         acc.oauthScope = update.oauthScope;
-                    // Apply the rotated refresh token LAST so the map key
-                    // (original token) still matches above.
-                    if (update.refreshToken !== undefined)
-                        acc.refreshToken = update.refreshToken;
+                    // The credential triple is single-use. This transaction runs after
+                    // the whole (multi-second) hydration loop, so a concurrent process
+                    // may have rotated the account in the meantime; writing our older
+                    // tuple back would restore a consumed token and cost a re-login.
+                    const updateRotatedAt = update.tokenRotatedAt ?? 0;
+                    const diskRotatedAt = acc.tokenRotatedAt ?? 0;
+                    if (updateRotatedAt >= diskRotatedAt) {
+                        if (update.accessToken !== undefined)
+                            acc.accessToken = update.accessToken;
+                        if (update.expiresAt !== undefined)
+                            acc.expiresAt = update.expiresAt;
+                        // Apply the rotated refresh token LAST so the map key
+                        // (original token) still matches above.
+                        if (update.refreshToken !== undefined)
+                            acc.refreshToken = update.refreshToken;
+                        if (update.tokenRotatedAt !== undefined)
+                            acc.tokenRotatedAt = update.tokenRotatedAt;
+                    }
                 }
                 await persist(current);
+                // Return what actually landed on disk, not the in-memory copy: a
+                // credential we declined to write above must not resurface through
+                // the returned storage either.
+                accountsCopy = current.accounts.map((acc) => ({ ...acc }));
             });
             storage.accounts = accountsCopy;
         }
@@ -1001,16 +1143,25 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                     }
                     const now = Date.now();
                     const account = storage.accounts[index];
-                    if (account) {
-                        account.lastUsed = now;
-                        account.lastSwitchReason = "rotation";
-                    }
-                    storage.activeIndex = index;
-                    storage.activeIndexByFamily = storage.activeIndexByFamily ?? {};
-                    for (const family of MODEL_FAMILIES) {
-                        storage.activeIndexByFamily[family] = index;
-                    }
-                    await saveAccounts(storage);
+                    if (!account)
+                        return;
+                    const identityKey = getWorkspaceIdentityKey(account);
+                    await withAccountStorageTransaction(async (current, persist) => {
+                        if (!current)
+                            return;
+                        const currentIndex = current.accounts.findIndex((candidate) => getWorkspaceIdentityKey(candidate) === identityKey);
+                        const currentAccount = current.accounts[currentIndex];
+                        if (!currentAccount || currentIndex < 0)
+                            return;
+                        currentAccount.lastUsed = now;
+                        currentAccount.lastSwitchReason = "rotation";
+                        current.activeIndex = currentIndex;
+                        current.activeIndexByFamily = current.activeIndexByFamily ?? {};
+                        for (const family of MODEL_FAMILIES) {
+                            current.activeIndexByFamily[family] = currentIndex;
+                        }
+                        await persist(current);
+                    });
                     await clearPromptQuotaCache();
                     // Reload manager from disk so we don't overwrite newer rotated
                     // refresh tokens with stale in-memory state.
@@ -1102,6 +1253,28 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
             async loader(getAuth, provider) {
                 const auth = await getAuth();
                 const pluginConfig = loadPluginConfig();
+                let openAIBaseURL;
+                try {
+                    openAIBaseURL = resolveOpenAIBaseURL();
+                }
+                catch (err) {
+                    // Fail closed rather than silently falling back to the default
+                    // endpoint: the operator asked for a gateway, so quietly bypassing
+                    // it would send ChatGPT traffic somewhere they did not choose.
+                    // Surface the reason the same way storage failures are surfaced.
+                    const message = err instanceof Error ? err.message : String(err);
+                    if (!customBaseURLErrorShown) {
+                        customBaseURLErrorShown = true;
+                        await showToast(message, "error");
+                    }
+                    throw err;
+                }
+                if (openAIBaseURL && !customBaseURLWarningShown) {
+                    customBaseURLWarningShown = true;
+                    logWarn("Routing ChatGPT OAuth inference through OPENAI_BASE_URL", {
+                        origin: new URL(openAIBaseURL).origin,
+                    });
+                }
                 applyUiRuntimeFromConfig(pluginConfig);
                 const perProjectAccounts = getPerProjectAccounts(pluginConfig);
                 setStoragePath(perProjectAccounts ? process.cwd() : null);
@@ -1255,7 +1428,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                     // Return SDK configuration
                     return {
                         apiKey: DUMMY_API_KEY,
-                        baseURL: CODEX_BASE_URL,
+                        baseURL: openAIBaseURL ?? CODEX_BASE_URL,
                         /**
                          * Custom fetch implementation for Codex API
                          *
@@ -1278,7 +1451,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                 }
                                 // Step 1: Extract and rewrite URL for Codex backend
                                 const originalUrl = extractRequestUrl(input);
-                                const url = rewriteUrlForCodex(originalUrl);
+                                const url = openAIBaseURL ? originalUrl : rewriteUrlForCodex(originalUrl);
                                 // Step 3: Transform request body with model-specific Codex instructions
                                 // Instructions are fetched per model family (codex-max, codex, gpt-5.4, etc.)
                                 // Capture original stream value before transformation
@@ -1437,6 +1610,13 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                 while (true) {
                                     let accountCount = accountManager.getAccountCount();
                                     const attempted = new Set();
+                                    // Diagnostics for the terminal error message below. Keyed on a stable
+                                    // account identity, not `account.index`, so the two `attempted.clear()`
+                                    // sites that follow a mid-traversal account removal cannot desync them.
+                                    // Deliberately scoped to this traversal: a fallback restart re-enters
+                                    // the loop with a different model, and the message names that model.
+                                    const fetchedAccountKeys = new Set();
+                                    const unsupportedAccountKeys = new Set();
                                     let restartAccountTraversalWithFallback = false;
                                     let restartAccountTraversalAfterWorkspaceDeactivation = false;
                                     const preferredAccountIds = getModelAccountPool(pluginConfig, model);
@@ -1493,7 +1673,11 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                         let accountAuth = accountManager.toAuthDetails(account);
                                         try {
                                             if (shouldRefreshToken(accountAuth, tokenRefreshSkewMs)) {
-                                                accountAuth = (await refreshAndUpdateToken(accountAuth, client));
+                                                accountAuth = (await refreshAndUpdateToken(accountAuth, client, {
+                                                    organizationId: account.organizationId,
+                                                    accountId: account.accountId,
+                                                    accountUserId: account.accountUserId,
+                                                }));
                                                 accountManager.updateFromAuth(account, accountAuth);
                                                 accountManager.clearAuthFailures(account);
                                                 accountManager.saveToDiskDebounced();
@@ -1672,10 +1856,12 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                                 // in-memory only and run on Node's single-threaded event loop, so no
                                                 // filesystem locking or token-redaction concerns are introduced here.
                                                 runtimeMetrics.totalRequests++;
+                                                fetchedAccountKeys.add(getAccountDiagnosticsKey(account));
                                                 response = await fetch(url, {
                                                     ...requestInit,
                                                     headers,
                                                     signal: fetchController.signal,
+                                                    ...(openAIBaseURL ? { redirect: "manual" } : {}),
                                                 });
                                             }
                                             catch (networkError) {
@@ -1721,6 +1907,42 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                                 }
                                             }
                                             const fetchLatencyMs = Math.round(performance.now() - fetchStart);
+                                            // `redirect: "manual"` hands back the raw 3xx instead of following it,
+                                            // so it has to be rejected explicitly. Left alone it would reach
+                                            // ensureContentType/convertSseToJson as an empty-bodied "success" and
+                                            // be reported as a content-type or empty-response error that says
+                                            // nothing about the redirect. Only the Location *origin* is logged;
+                                            // the full target can carry credentials in its query string.
+                                            if (openAIBaseURL && response.status >= 300 && response.status < 400) {
+                                                let redirectTarget = "an unparseable location";
+                                                const location = response.headers.get("location");
+                                                if (location) {
+                                                    try {
+                                                        redirectTarget = new URL(location, url).origin;
+                                                    }
+                                                    catch {
+                                                        // keep the placeholder
+                                                    }
+                                                }
+                                                else {
+                                                    redirectTarget = "no location header";
+                                                }
+                                                logWarn(`OPENAI_BASE_URL gateway attempted a redirect (${response.status}) to ${redirectTarget}`, { origin: new URL(openAIBaseURL).origin });
+                                                accountManager.refundToken(account, modelFamily, model);
+                                                return new Response(JSON.stringify({
+                                                    error: {
+                                                        message: `The OPENAI_BASE_URL gateway responded with a ${response.status} redirect to ` +
+                                                            `${redirectTarget}. Redirects are not followed, because the ChatGPT OAuth ` +
+                                                            "access token must never be replayed to an endpoint that was not explicitly " +
+                                                            "configured. Point OPENAI_BASE_URL at the final endpoint instead.",
+                                                    },
+                                                }), {
+                                                    status: 502,
+                                                    headers: {
+                                                        "content-type": "application/json; charset=utf-8",
+                                                    },
+                                                });
+                                            }
                                             logRequest(LOG_STAGES.RESPONSE, {
                                                 status: response.status,
                                                 ok: response.ok,
@@ -1792,6 +2014,9 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                                     break;
                                                 }
                                                 const unsupportedModelInfo = getUnsupportedCodexModelInfo(errorBody);
+                                                if (unsupportedModelInfo.isUnsupported) {
+                                                    unsupportedAccountKeys.add(getAccountDiagnosticsKey(account));
+                                                }
                                                 const hasRemainingAccounts = attempted.size < Math.max(1, accountCount);
                                                 // Entitlements can differ by account/workspace, so try remaining
                                                 // accounts before degrading the model via fallback.
@@ -2151,14 +2376,37 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                     if (restartAccountTraversalAfterWorkspaceDeactivation) {
                                         continue;
                                     }
+                                    // Shared by both terminal messages below: how many distinct accounts
+                                    // this traversal actually sent upstream, and how many of those the
+                                    // backend rejected as not entitled to the model.
+                                    const attemptedCount = fetchedAccountKeys.size;
+                                    const unsupportedCount = unsupportedAccountKeys.size;
                                     if (strictAccountPool) {
                                         const poolWaitMs = accountManager.getMinWaitTimeForFamily(modelFamily, model, preferredAccountIds);
                                         const effectiveModel = model ?? requestedModel ?? "requested model";
+                                        const poolAccounts = accountManager.getAccountsSnapshot();
+                                        const poolAccountCount = countResolvedPoolAccounts(poolAccounts, preferredAccountIds);
+                                        const unresolvedKeyCount = countUnresolvedPoolKeys(poolAccounts, preferredAccountIds);
+                                        const unavailableCount = Math.max(0, poolAccountCount - attemptedCount);
                                         const waitDetail = poolWaitMs > 0
                                             ? ` Try again in ${formatWaitTime(poolWaitMs)}.`
                                             : " Check the pooled accounts with `codex-health`.";
+                                        const attemptDetail = unsupportedCount > 0
+                                            ? ` The model was unsupported on ${unsupportedCount} of ${attemptedCount} attempted pooled account(s).`
+                                            : attemptedCount > 0
+                                                ? ` ${attemptedCount} pooled account(s) were attempted without success.`
+                                                : "";
+                                        const unresolvedDetail = unresolvedKeyCount > 0
+                                            ? ` ${unresolvedKeyCount} configured pool key(s) matched no known account.`
+                                            : "";
+                                        const unavailableDetail = unavailableCount > 0
+                                            ? ` ${unavailableCount} pooled account(s) were never attempted (rate-limited, cooling down, or disabled).`
+                                            : "";
                                         const message = `Strict account pool unavailable for ${effectiveModel}. ` +
-                                            `None of its ${preferredAccountIds.length} configured account(s) is selectable.` +
+                                            `${preferredAccountIds.length} configured pool key(s) resolved to ${poolAccountCount} account(s).` +
+                                            attemptDetail +
+                                            unresolvedDetail +
+                                            unavailableDetail +
                                             waitDetail;
                                         if (runtimeMetrics.lastSelectionSnapshot) {
                                             runtimeMetrics.lastSelectionSnapshot = {
@@ -2183,6 +2431,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                     }
                                     const waitMs = accountManager.getMinWaitTimeForFamily(modelFamily, model);
                                     const count = accountManager.getAccountCount();
+                                    const unavailableCount = Math.max(0, count - attemptedCount);
                                     if (retryAllAccountsRateLimited &&
                                         count > 0 &&
                                         waitMs > 0 &&
@@ -2196,19 +2445,24 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                         continue;
                                     }
                                     const waitLabel = waitMs > 0 ? formatWaitTime(waitMs) : "a bit";
-                                    const wasEntitlementExhaustion = runtimeMetrics.lastErrorCategory === "unsupported-model";
+                                    // `runtimeMetrics` is plugin-scoped, so `lastErrorCategory` alone
+                                    // can still hold "unsupported-model" from an *earlier* request.
+                                    // Require an unsupported response from this traversal as well, or
+                                    // a request that never reached an account renders "0 of 0".
+                                    const wasEntitlementExhaustion = unsupportedCount > 0 &&
+                                        runtimeMetrics.lastErrorCategory === "unsupported-model";
                                     const entitlementModel = typeof runtimeMetrics.lastError === "string"
                                         ? runtimeMetrics.lastError.replace(/^Unsupported model.*?:\s*/i, "").trim()
                                         : "";
                                     const entitlementDetail = entitlementModel.length > 0
-                                        ? ` The backend rejected '${entitlementModel}' as not entitled for Codex OAuth on every pooled account.`
+                                        ? ` The backend rejected '${entitlementModel}' as not entitled for Codex OAuth on ${unsupportedCount} of ${attemptedCount} attempted account(s).${unavailableCount > 0 ? ` ${unavailableCount} configured account(s) were unavailable or excluded.` : ""}`
                                         : "";
                                     const message = count === 0
                                         ? "No Codex accounts configured. Run `opencode auth login`."
                                         : waitMs > 0
                                             ? `All ${count} account(s) are rate-limited. Try again in ${waitLabel} or add another account with \`opencode auth login\`.`
                                             : wasEntitlementExhaustion
-                                                ? `All ${count} account(s) returned 'model not supported' for the requested model.${entitlementDetail} Codex model access is account/workspace gated; default gpt-5.6-sol/terra/luna selectors auto-fallback down the 5.6 tiers to gpt-5.5, and gpt-5.5/gpt-5-codex through the GPT-5.4 family when possible. Set \`unsupportedCodexPolicy: "fallback"\` for the full manual fallback chain, or see \`codex-health\` for per-account details.`
+                                                ? `No selectable account succeeded for the requested model across ${count} configured account(s).${entitlementDetail} Codex model access is account/workspace gated; default gpt-5.6-sol/terra/luna selectors auto-fallback down the 5.6 tiers to gpt-5.5, and gpt-5.5/gpt-5-codex through the GPT-5.4 family when possible. Set \`unsupportedCodexPolicy: "fallback"\` for the full manual fallback chain, or see \`codex-health\` for per-account details.`
                                                 : `All ${count} account(s) failed (server errors or auth issues). Check account health with \`codex-health\`.`;
                                     runtimeMetrics.failedRequests++;
                                     runtimeMetrics.lastError = message;
@@ -2401,7 +2655,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                         }
                                     }
                                     if (!accessToken) {
-                                        const refreshResult = await queuedRefresh(account.refreshToken);
+                                        const refreshResult = await coordinatePersistedRefresh(account);
                                         if (refreshResult.type !== "success") {
                                             errors += 1;
                                             const message = refreshResult.message ?? refreshResult.reason ?? "refresh failed";
@@ -2425,6 +2679,14 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                             account.refreshToken = refreshResult.refresh;
                                             storageChanged = true;
                                         }
+                                        // Carry the coordinator's rotation stamp onto the working
+                                        // copy so the merge below can tell this snapshot's token
+                                        // apart from one a concurrent process rotated later.
+                                        if (typeof refreshResult.rotatedAt === "number" &&
+                                            refreshResult.rotatedAt !== account.tokenRotatedAt) {
+                                            account.tokenRotatedAt = refreshResult.rotatedAt;
+                                            storageChanged = true;
+                                        }
                                         if (refreshResult.access && refreshResult.access !== account.accessToken) {
                                             account.accessToken = refreshResult.access;
                                             storageChanged = true;
@@ -2551,11 +2813,24 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                             // concurrent edit during the network loop is not reverted.
                                             acc.accountId = updated.accountId;
                                             acc.accountIdSource = updated.accountIdSource;
-                                            acc.refreshToken = updated.refreshToken;
-                                            acc.accessToken = updated.accessToken;
-                                            acc.expiresAt = updated.expiresAt;
                                             acc.oauthScope = updated.oauthScope;
                                             acc.email = updated.email;
+                                            // The credential triple is single-use and must only move
+                                            // backwards-in-time never. `workingStorage` was snapshotted
+                                            // before the (multi-second) network loop, so its token can
+                                            // already be consumed: a sibling's refresh rotates every
+                                            // record sharing that token *on disk*, and a concurrent
+                                            // process can rotate it too. Writing the stale token back
+                                            // would resurrect a dead credential and cost the user a
+                                            // re-login with `refresh_token_reused`.
+                                            const workingRotatedAt = updated.tokenRotatedAt ?? 0;
+                                            const diskRotatedAt = acc.tokenRotatedAt ?? 0;
+                                            if (workingRotatedAt >= diskRotatedAt) {
+                                                acc.refreshToken = updated.refreshToken;
+                                                acc.accessToken = updated.accessToken;
+                                                acc.expiresAt = updated.expiresAt;
+                                                acc.tokenRotatedAt = updated.tokenRotatedAt;
+                                            }
                                         }
                                         merged.push(acc);
                                     }
@@ -2594,6 +2869,15 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                             const maskEmailEnabled = getCodexTuiMaskEmail(loadPluginConfig());
                             const remaining = [];
                             const restored = [];
+                            const processedIdentityKeys = new Set(flaggedStorage.accounts.map((account) => getWorkspaceIdentityKey(account)));
+                            const processedRefreshTokens = new Set(flaggedStorage.accounts.map((account) => account.refreshToken));
+                            // Only a record we positively restored may be deleted below. A record
+                            // can *look* processed without having been restored — its token can be
+                            // rotated in place by a sibling's refresh, so neither replacement
+                            // lookup finds it — and dropping that record would erase the account
+                            // from flagged-accounts.json with no trace anywhere.
+                            const restoredIdentityKeys = new Set();
+                            const restoredRefreshTokens = new Set();
                             for (let i = 0; i < flaggedStorage.accounts.length; i += 1) {
                                 const flagged = flaggedStorage.accounts[i];
                                 if (!flagged)
@@ -2629,10 +2913,12 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                             accountLabel: flagged.accountLabel,
                                         });
                                         restored.push(...resolved.variantsForPersistence);
+                                        restoredIdentityKeys.add(getWorkspaceIdentityKey(flagged));
+                                        restoredRefreshTokens.add(flagged.refreshToken);
                                         console.log(`[${i + 1}/${flaggedStorage.accounts.length}] ${label}: RESTORED (Codex CLI cache)`);
                                         continue;
                                     }
-                                    const refreshResult = await queuedRefresh(flagged.refreshToken);
+                                    const refreshResult = await coordinateFlaggedPersistedRefresh(flagged);
                                     if (refreshResult.type !== "success") {
                                         console.log(`[${i + 1}/${flaggedStorage.accounts.length}] ${label}: STILL FLAGGED (${refreshResult.message ?? refreshResult.reason ?? "refresh failed"})`);
                                         remaining.push(flagged);
@@ -2645,6 +2931,9 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                         accountLabel: flagged.accountLabel,
                                     });
                                     restored.push(...resolved.variantsForPersistence);
+                                    processedRefreshTokens.add(refreshResult.refresh);
+                                    restoredIdentityKeys.add(getWorkspaceIdentityKey(flagged));
+                                    restoredRefreshTokens.add(flagged.refreshToken);
                                     console.log(`[${i + 1}/${flaggedStorage.accounts.length}] ${label}: RESTORED`);
                                 }
                                 catch (error) {
@@ -2660,9 +2949,28 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                 await persistAccountPool(restored, false);
                                 invalidateAccountManagerCache();
                             }
-                            await saveFlaggedAccounts({
-                                version: 1,
-                                accounts: remaining,
+                            const remainingByIdentity = new Map(remaining.map((account) => [getWorkspaceIdentityKey(account), account]));
+                            const remainingByRefreshToken = new Map(remaining.map((account) => [account.refreshToken, account]));
+                            await withFlaggedAccountStorageTransaction(async (current, persist) => {
+                                current.accounts = current.accounts.flatMap((account) => {
+                                    const identityKey = getWorkspaceIdentityKey(account);
+                                    const processed = processedIdentityKeys.has(identityKey) ||
+                                        processedRefreshTokens.has(account.refreshToken);
+                                    if (!processed)
+                                        return [account];
+                                    const replacement = remainingByIdentity.get(identityKey) ??
+                                        remainingByRefreshToken.get(account.refreshToken);
+                                    if (replacement) {
+                                        return [{ ...account, lastError: replacement.lastError }];
+                                    }
+                                    // Drop only what was positively restored. Anything else that
+                                    // merely looks processed is kept: a stale flagged entry is
+                                    // recoverable, a silently deleted account is not.
+                                    const wasRestored = restoredIdentityKeys.has(identityKey) ||
+                                        restoredRefreshTokens.has(account.refreshToken);
+                                    return wasRestored ? [] : [account];
+                                });
+                                await persist(current);
                             });
                             console.log("");
                             console.log(`Results: ${restored.length} restored, ${remaining.length} still flagged`);
@@ -2747,12 +3055,20 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                     if (typeof menuResult.deleteAccountIndex === "number") {
                                         const target = workingStorage.accounts[menuResult.deleteAccountIndex];
                                         if (target) {
-                                            workingStorage.accounts.splice(menuResult.deleteAccountIndex, 1);
-                                            clampActiveIndices(workingStorage);
-                                            await saveAccounts(workingStorage);
-                                            await saveFlaggedAccounts({
-                                                version: 1,
-                                                accounts: flaggedStorage.accounts.filter((flagged) => !matchesWorkspaceIdentity(flagged, getWorkspaceIdentityKey(target))),
+                                            const identityKey = getWorkspaceIdentityKey(target);
+                                            await withAccountStorageTransaction(async (current, persist) => {
+                                                if (!current)
+                                                    return;
+                                                const currentIndex = current.accounts.findIndex((candidate) => getWorkspaceIdentityKey(candidate) === identityKey);
+                                                if (currentIndex < 0)
+                                                    return;
+                                                current.accounts.splice(currentIndex, 1);
+                                                clampActiveIndices(current);
+                                                await persist(current);
+                                            });
+                                            await withFlaggedAccountStorageTransaction(async (current, persist) => {
+                                                current.accounts = current.accounts.filter((flagged) => !matchesWorkspaceIdentity(flagged, identityKey));
+                                                await persist(current);
                                             });
                                             invalidateAccountManagerCache();
                                             console.log(`\nDeleted ${resolveDisplayEmail(target.email, maskEmailEnabled) ?? `Account ${menuResult.deleteAccountIndex + 1}`}.\n`);
@@ -2762,10 +3078,18 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                     if (typeof menuResult.toggleAccountIndex === "number") {
                                         const target = workingStorage.accounts[menuResult.toggleAccountIndex];
                                         if (target) {
-                                            target.enabled = target.enabled === false ? true : false;
-                                            await saveAccounts(workingStorage);
+                                            const identityKey = getWorkspaceIdentityKey(target);
+                                            let enabled = target.enabled !== false;
+                                            await withAccountStorageTransaction(async (current, persist) => {
+                                                const currentTarget = current?.accounts.find((candidate) => getWorkspaceIdentityKey(candidate) === identityKey);
+                                                if (!current || !currentTarget)
+                                                    return;
+                                                currentTarget.enabled = currentTarget.enabled === false;
+                                                enabled = currentTarget.enabled;
+                                                await persist(current);
+                                            });
                                             invalidateAccountManagerCache();
-                                            console.log(`\n${resolveDisplayEmail(target.email, maskEmailEnabled) ?? `Account ${menuResult.toggleAccountIndex + 1}`} ${target.enabled === false ? "disabled" : "enabled"}.\n`);
+                                            console.log(`\n${resolveDisplayEmail(target.email, maskEmailEnabled) ?? `Account ${menuResult.toggleAccountIndex + 1}`} ${enabled ? "enabled" : "disabled"}.\n`);
                                         }
                                         continue;
                                     }