oc-codex-multi-auth 6.20.0 → 6.21.0

package/README.md

@@ -20,7 +20,7 @@ Use it when you want OpenCode to run Codex-style coding workflows from your own
 ## What You Get
 
 - OpenCode plugin support for ChatGPT Plus/Pro OAuth and Codex/GPT-5 coding workflows
-- GPT-6 Astra and GPT-5.6 Sol/Terra/Luna (responses-lite path) plus GPT-5.5, GPT-5.5 Fast, GPT-5.4 Mini, GPT-5.4 Nano, GPT-5.1, and Codex model templates
+- GPT-6 Astra, GPT-5.6 Sol/Terra/Luna, and the Daybreak Blue/Red cyber tiers on the responses-lite request path, plus GPT-5.5, GPT-5.5 Fast, GPT-5.4 Mini, GPT-5.4 Nano, GPT-5.1, and Codex model templates
 - Routing for the Daybreak-gated cyber tiers (`gpt-daybreak-blue-latest`, `gpt-daybreak-red-latest`, `gpt-5.6-cyber`), deliberately kept out of the shipped templates since they need program approval
 - Compact modern OpenCode config with 13 base families and 59 variant presets; explicit legacy selector IDs when needed
 - Stateless Codex-compatible request handling with `store: false` and `reasoning.encrypted_content`
@@ -50,7 +50,7 @@ Use it when you want OpenCode to run Codex-style coding workflows from your own
 | `oc-codex-multi-auth` | npm CLI; explicit install modes manage OpenCode provider/TUI config, while `update` only clears the managed package cache. Also runs standalone commands: `doctor`, `status`, `list`, `limits`, `dashboard`, `health`, `diag`, `warm` |
 | OpenCode plugin entry (`index.ts`) | auth loader, OAuth login modes, provider fetch pipeline, account rotation, retry/failover, and `codex-*` tool registry |
 | OpenCode TUI plugin (`tui.ts`) | prompt quota status, quota details, shared quota cache, and active-account-aware display |
-| 24 `codex-*` tools | setup, help, status, list, switch, warm, limits, health, metrics, doctor, dashboard, pool, backup, keychain, diagnostics, and recovery actions |
+| 24 `codex-*` tools | setup, help, status, list, switch, warm, limits, health, metrics, doctor, dashboard, pool, backup, keychain, diagnostics, and repair actions |
 
 The plugin does not replace OpenCode. OpenCode remains the host; this package installs provider/TUI config and supplies the OAuth-backed Codex request pipeline that OpenCode calls.
 
@@ -128,7 +128,7 @@ opencode debug config
 opencode auth login
 ```
 
-The default installer only normalizes the plugin entry in `~/.config/opencode/opencode.json`, enables the TUI status plugin in `~/.config/opencode/tui.json`, and clears the cached plugin copy. Catalog modes additionally merge their selected `provider.openai` definitions. Changed config files are backed up before writing.
+The default installer only normalizes the plugin entry in `~/.config/opencode/opencode.json`, enables the TUI status plugin in `~/.config/opencode/tui.json`, and clears the cached plugin copy. Catalog modes also merge their selected `provider.openai` definitions. Changed config files are backed up before writing.
 
 ### Standalone CLI (no agent / no token cost)
 
@@ -225,10 +225,10 @@ If browser launch is blocked, use the alternate login paths in [docs/getting-sta
 | `codex-status` | Which account, model family, and routing state are active? |
 | `codex-limits` | What quota or rate-limit state is visible now? |
 | `codex-reset` | Do I have a banked rate-limit reset credit, and how do I redeem it? |
-| `codex-dashboard` | Can I manage accounts from one interactive surface? |
+| `codex-dashboard` | What does a read-only snapshot of account eligibility, retry budgets, and refresh queue health show? |
 | `codex-pool` | Which accounts are preferred for each model, and how do I change them? |
 
-Most of these also run as a **direct CLI** with no agent/model involvement (no token cost) — e.g. `oc-codex-multi-auth warm`, `oc-codex-multi-auth status`, or `npx -y oc-codex-multi-auth@latest warm`. Use `oc-codex-multi-auth warm` to open every enabled account's usage window at the start of a session and stagger the rolling quota cooldowns. Add `--json` for scriptable output.
+Most of these also run as a **direct CLI** with no agent or model involvement, so there is no token cost. Examples are `oc-codex-multi-auth warm`, `oc-codex-multi-auth status`, or `npx -y oc-codex-multi-auth@latest warm`. Use `oc-codex-multi-auth warm` to open every enabled account's usage window at the start of a session and stagger the rolling quota cooldowns. Add `--json` for scriptable output.
 
 ### Account management
 
@@ -238,7 +238,7 @@ Most of these also run as a **direct CLI** with no agent/model involvement (no t
 | `codex-tag` | How do I group accounts with tags? |
 | `codex-note` | How do I attach a private note to an account? |
 | `codex-remove` | How do I remove a saved account safely? |
-| `codex-refresh` | How do I refresh or re-login an account? |
+| `codex-refresh` | How do I refresh the OAuth tokens of every saved account to verify they are still valid? |
 
 ### Diagnostics and backup
 
@@ -266,7 +266,7 @@ Most of these also run as a **direct CLI** with no agent/model involvement (no t
 - TUI quota status follows the account/workspace used by the latest request
 - Business workspace memberships and Personal accounts keep separate usage and quota windows. Business members sharing one workspace are distinguished by their member/seat identity, so their usage is not collapsed into one row.
 - An account identifies itself by its own ChatGPT email and the last 6 characters of its account id, with the email masked when `maskEmail` is on. The OAuth id_token also lists the API-platform organizations the login belongs to; those are not ChatGPT workspaces and are never used to name an account, so logging in clears a label left behind by one. A label you set with `codex-label` is always kept.
-- The ChatGPT plan (`Free`, `Plus`, `Pro`, `Business`, `Business Premium`) is read from the access token, refreshed on every token refresh, and shown by `codex-list` and `codex-status`. `codex-limits` and the TUI read the plan live from the usage endpoint and name it the same way. An unrecognized plan is reported verbatim rather than renamed.
+- The ChatGPT plan (`Free`, `Plus`, `Pro`, `Business`, `Business Premium`, `Enterprise`) is read from the access token, refreshed on every token refresh, and shown by `codex-list` and `codex-status`. `codex-limits` and the TUI read the plan live from the usage endpoint and name it the same way. An unrecognized plan is reported verbatim rather than renamed.
 
 ---
 
@@ -280,10 +280,10 @@ Most of these also run as a **direct CLI** with no agent/model involvement (no t
 | Plugin config | `~/.opencode/openai-codex-auth-config.json` |
 | Global account storage | `~/.opencode/oc-codex-multi-auth-accounts.json` |
 | Per-project accounts | `~/.opencode/projects/<project-key>/oc-codex-multi-auth-accounts.json` |
-| Flagged accounts | `~/.opencode/oc-codex-multi-auth-flagged-accounts.json` |
+| Flagged accounts | `oc-codex-multi-auth-flagged-accounts.json`, written beside the active accounts file (per-project path when `perProjectAccounts` is on) |
 | Backups | `~/.opencode/backups/` or `~/.opencode/projects/<project-key>/backups/` |
 | Logs | `~/.opencode/logs/codex-plugin/` |
-| TUI quota cache | OpenCode state path plus `~/.opencode/oc-codex-multi-auth-tui-quota.json` fallback |
+| TUI quota cache | OpenCode state dir plus `oc-codex-multi-auth-tui-quota.json`, else `$OPENCODE_STATE_DIR/oc-codex-multi-auth-tui-quota.json` or `~/.local/state/opencode/oc-codex-multi-auth-tui-quota.json` |
 
 Per-project storage is enabled by default. The plugin walks up from the current directory to find a project root, then stores account pools under the project-specific key. If no project root is found, it falls back to global storage.
 
@@ -430,6 +430,9 @@ Selected runtime/environment overrides:
 | `ENABLE_PLUGIN_REQUEST_LOGGING=1` | Enable request metadata logs |
 | `CODEX_PLUGIN_LOG_BODIES=1` | Include raw request/response bodies in logs; sensitive |
 | `CODEX_KEYCHAIN=1` | Opt in to OS-native keychain account storage |
+| `CODEX_AUTH_QUOTA_NOTIFICATIONS=1` | Enable desktop quota notifications (macOS only) |
+| `CODEX_AUTH_AUTO_PROTECT_CREDITS=0/1` | Disable/enable the quota guard that keeps rotation off paid Credits after a spent subscription window (default on) |
+| `CODEX_AUTH_QUOTA_NOTIFICATIONS_INTERVAL_MS=<ms>` | Override the quota poll interval (default 1800000, minimum 30000) |
 
 Boolean env overrides are truthy only for the literal string `"1"`.
 
@@ -467,9 +470,9 @@ Set `CODEX_KEYCHAIN=1` to store account pools in the OS keychain instead:
 Manage the backend from OpenCode:
 
 ```text
-codex-keychain status
-codex-keychain migrate
-codex-keychain rollback
+codex-keychain command="status"
+codex-keychain command="migrate"
+codex-keychain command="rollback"
 ```
 
 If the keychain is unavailable, the plugin logs a warning and falls back to JSON storage for that operation. Credentials are never silently deleted.

package/config/README.md

@@ -87,7 +87,7 @@ If your OpenCode runtime supports global compaction tuning, you can also set val
 
 - Served over the **responses-lite** path. Astra's catalog entry landed in openai/codex commit `ed391d4d` (2026-09-03) and reads `use_responses_lite: true`, `tool_mode: "code_mode_only"`, `multi_agent_version: "v2"`, so the shape is read rather than inferred. The `CODEX_AUTH_ASTRA_RESPONSES_LITE` switch that 6.17.0 carried while this was unverifiable has been removed.
 - Rollout gate: Astra reached a limited set of organizations first, so accounts outside it auto-fallback  
-  `gpt-6-astra → gpt-5.6-sol → gpt-5.6-terra → gpt-5.6-luna → gpt-5.5`  
+  `gpt-6-astra → gpt-5.6-sol → gpt-5.6-terra → gpt-5.6-luna → gpt-5.5 → gpt-5.2`  
   (disable with `CODEX_AUTH_DISABLE_GPT6_AUTO_FALLBACK=1`).
 - Efforts are low through `ultra`, per OpenAI's Codex model list. `ultra` is sent as `max` on the wire, as with 5.6.
 - Bare `gpt-6` is a plugin-side alias. `gpt-6-astra-pro` is not a Codex-routable id and collapses onto `gpt-6-astra`.
@@ -95,21 +95,21 @@ If your OpenCode runtime supports global compaction tuning, you can also set val
 ## Cyber tier notes (Daybreak-gated)
 
 - `gpt-daybreak-blue-latest` (defensive) and `gpt-daybreak-red-latest` (cyber-permissive, for authorized security research) are catalog-verified cyber-specialty models, served over the responses-lite path. `gpt-5.6-cyber` is OpenAI's published alias fronting them, and belongs to the 5.6 generation rather than GPT-6.
-- All three need Daybreak program approval, and Blue/Red are `visibility: "hide"` in the catalog, so they are **not** in the shipped templates — same policy as `gpt-5.3-codex-spark` below. The plugin routes them fully; entitled users add the ids by hand.
-- None has a fallback chain on purpose — a cyber-specialty request must not be silently answered by a general model.
+- All three need Daybreak program approval, and Blue/Red are `visibility: "hide"` in the catalog, so they are **not** in the shipped templates, the same policy as `gpt-5.3-codex-spark` below. The plugin routes them fully; entitled users add the ids by hand.
+- None has a fallback chain on purpose, because a cyber-specialty request must not be silently answered by a general model.
 
 ## GPT-5.6 notes
 
 - Served over the **responses-lite** path (`use_responses_lite`).
 - Preview entitlement: accounts without access auto-fallback  
-  `gpt-5.6-sol → gpt-5.6-terra → gpt-5.6-luna → gpt-5.5`  
+  `gpt-5.6-sol → gpt-5.6-terra → gpt-5.6-luna → gpt-5.5 → gpt-5.2`  
   (disable with `CODEX_AUTH_DISABLE_GPT56_AUTO_FALLBACK=1`).
 - Default client identity for every responses-lite model (5.6, GPT-6 Astra, Daybreak) is host/opencode (`originator: opencode`); other families default to Codex CLI identity.
 - `ultra` is accepted as a client-side alias and sent as `max` on the wire (no subagent orchestration in this plugin).
 
 ## Spark model note
 
-The templates intentionally do **not** include `gpt-5.3-codex-spark` by default. Spark is often entitlement-gated at the account/workspace level, so shipping it by default causes avoidable startup failures for many users.
+The templates intentionally do **not** include `gpt-5.3-codex-spark` by default. Spark is a distinct backend model id, not an alias of `gpt-5-codex`, and it is often entitlement-gated at the account/workspace level, so shipping it by default causes avoidable startup failures for many users.
 
 If your workspace is entitled, you can add Spark model IDs manually.
 
@@ -147,12 +147,12 @@ Current defaults are strict entitlement handling except for common default-selec
 - set `unsupportedCodexPolicy: "fallback"` (or `CODEX_AUTH_UNSUPPORTED_MODEL_POLICY=fallback`) to enable the full fallback chain for manual/legacy selectors
 - `fallbackToGpt52OnUnsupportedGpt53: true` keeps the legacy `gpt-5.3-codex -> gpt-5.2-codex` edge inside fallback mode
 - user-typed `gpt-5.5-pro*` is canonicalized to `gpt-5.5` before fallback because GPT-5.5 Pro is ChatGPT-only, not a Codex-routable model; `gpt-6-astra-pro*` is canonicalized to `gpt-6-astra` for the same reason
-- legacy Codex selectors such as `gpt-5.2-codex`, `gpt-5.3-codex`, and `gpt-5.3-codex-spark` normalize to canonical `gpt-5-codex`; if that canonical Codex model is gated, the default auto-fallback can retry through `gpt-5.6-terra`, `gpt-5.5`, then `gpt-5.2`
+- legacy Codex selector `gpt-5.1-codex` normalizes to canonical `gpt-5-codex`, while `gpt-5.2-codex` and `gpt-5.3-codex` route as distinct backend model IDs; if canonical Codex or a gated model fails entitlement, default auto-fallback can retry through `gpt-5.6-terra`, `gpt-5.5`, then `gpt-5.2`
 - set `CODEX_AUTH_DISABLE_GPT6_AUTO_FALLBACK=1` to disable GPT-6 Astra auto-fallback
 - set `CODEX_AUTH_DISABLE_GPT56_AUTO_FALLBACK=1` to disable GPT-5.6 auto-fallback
 - set `CODEX_AUTH_DISABLE_GPT55_AUTO_FALLBACK=1` to disable GPT-5.5 auto-fallback
 - set `CODEX_AUTH_DISABLE_CODEX_AUTO_FALLBACK=1` to disable canonical Codex/GPT-5.4-family auto-fallback
-- `gpt-5.4-pro -> gpt-5.4` remains available for older manual configs
+- `gpt-5.4-pro -> gpt-5.6-terra -> gpt-5.5 -> gpt-5.2` applies when you manually select `gpt-5.4-pro`
 - `unsupportedCodexFallbackChain` lets you override fallback order per model
 
 Default chains when generic fallback policy is enabled (and empty override map):
@@ -163,7 +163,7 @@ Default chains when generic fallback policy is enabled (and empty override map):
 - `gpt-5-codex → gpt-5.6-terra → gpt-5.5 → gpt-5.2`
 
 > GPT-5.4 and GPT-5.4 Mini were retired from Codex on 2026-08-31; the catalog marks both `visibility: "hide"` and names their replacements (`gpt-5.4` -> `gpt-5.6-terra`, `gpt-5.4-mini` -> `gpt-5.6-luna`), and `gpt-5.4-nano` has no catalog entry. The default chains therefore end at live models rather than leading with retired ones.
-- `gpt-5.4-pro → gpt-5.4` (if you manually select `gpt-5.4-pro`)
+- `gpt-5.4-pro → gpt-5.6-terra → gpt-5.5 → gpt-5.2` (if you manually select `gpt-5.4-pro`)
 - `gpt-5.3-codex → gpt-5-codex → gpt-5.2-codex`
 - `gpt-5.3-codex-spark → gpt-5-codex → gpt-5.3-codex → gpt-5.2-codex` (only if Spark IDs are added manually)
 - `gpt-5.2-codex → gpt-5-codex`

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAMH,OAAO,KAAK,EAAE,MAAM,EAAe,MAAM,qBAAqB,CAAC;AA6U/D;;;;;;;;;;;;;;;GAeG;AAEH,eAAO,MAAM,iBAAiB,EAAE,MA6rI/B,CAAC;AAEF,eAAO,MAAM,gBAAgB,QAAoB,CAAC;AAElD,eAAe,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAYH,OAAO,KAAK,EAAE,MAAM,EAAe,MAAM,qBAAqB,CAAC;AA6U/D;;;;;;;;;;;;;;;GAeG;AAEH,eAAO,MAAM,iBAAiB,EAAE,MAg4I/B,CAAC;AAEF,eAAO,MAAM,gBAAgB,QAAoB,CAAC;AAElD,eAAe,iBAAiB,CAAC"}

package/dist/index.js

@@ -23,6 +23,12 @@
 
  */
 import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { watchFile, unwatchFile } from "node:fs";
+import { consumeLastWrittenAccountsDigest } from "./lib/storage/load-save.js";
+import { subscribeToStoragePathChanges } from "./lib/storage/state.js";
+import { isKeychainOptInEnabled } from "./lib/storage/keychain.js";
+import { AnyAccountStorageSchema } from "./lib/schemas.js";
+import { registerCleanup, unregisterCleanup } from "./lib/shutdown.js";
 import { createHash } from "node:crypto";
 import { homedir } from "node:os";
 import { join } from "node:path";
@@ -833,6 +839,8 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
             .filter((entry) => entry.length > 0)));
     };
     const supportsInteractiveMenus = () => {
+        if (process.env.FORCE_INTERACTIVE_MODE === "1")
+            return true;
         if (!process.stdin.isTTY || !process.stdout.isTTY)
             return false;
         if (process.env.OPENCODE_TUI === "1")
@@ -841,6 +849,8 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
             return false;
         if (process.env.TERM_PROGRAM === "opencode")
             return false;
+        if (process.env.ELECTRON_RUN_AS_NODE === "1")
+            return false;
         return true;
     };
     const promptAccountIndexSelection = async (ui, storage, title) => {
@@ -1112,22 +1122,18 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
             logDebug(`[${PLUGIN_NAME}] Startup preflight skipped: ${error instanceof Error ? error.message : String(error)}`);
         }
     };
-    const invalidateAccountManagerCache = () => {
-        // Dispose the outgoing manager so we don't leak its shutdown handler
-        // into the global cleanup queue or leave a pending debounce timer
-        // pointing at a stale instance. Flush first (best-effort, in the
-        // background) so any queued debounced save is not silently dropped.
+    const invalidateAccountManagerCache = (clearedSnapshots) => {
+        // Retire before flushing: keep disk membership authoritative while
+        // publishing queued rate-limit evidence through the volatile merge.
         const previous = cachedAccountManager;
         cachedAccountManager = null;
         accountManagerPromise = null;
         if (previous) {
+            previous.disposeShutdownHandler(false, clearedSnapshots);
             void previous
                 .flushPendingSave()
                 .catch((error) => {
                 logWarn(`Failed to flush pending save while invalidating account manager: ${error instanceof Error ? error.message : String(error)}`);
-            })
-                .finally(() => {
-                previous.disposeShutdownHandler();
             });
         }
     };
@@ -1160,6 +1166,142 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
             logWarn(`Failed to reload account manager: ${error instanceof Error ? error.message : String(error)}`);
         }
     };
+    let watchedAccountsPath;
+    let observedAccountsDigest;
+    let accountsReloadTimer;
+    let accountsWatcherDisposed = false;
+    let accountsWatchGeneration = 0;
+    let unsubscribeAccountsPath;
+    const stopAccountsWatcher = () => {
+        accountsWatchGeneration += 1;
+        if (watchedAccountsPath)
+            unwatchFile(watchedAccountsPath, onAccountsStatChanged);
+        watchedAccountsPath = undefined;
+        observedAccountsDigest = undefined;
+        clearTimeout(accountsReloadTimer);
+        accountsReloadTimer = undefined;
+    };
+    const disposeAccountsWatcher = () => {
+        accountsWatcherDisposed = true;
+        unsubscribeAccountsPath?.();
+        stopAccountsWatcher();
+        unregisterCleanup(disposeAccountsWatcher);
+    };
+    const readAccountsDigest = async (path) => {
+        try {
+            const content = await readFile(path, "utf8");
+            if (!AnyAccountStorageSchema.safeParse(JSON.parse(content)).success)
+                return;
+            return createHash("sha256").update(content).digest("hex");
+        }
+        catch {
+            return;
+        }
+    };
+    const reloadForExternalAccountsChange = async (path, generation, attempt = 0, retired) => {
+        const digest = await readAccountsDigest(path);
+        if (generation !== accountsWatchGeneration || !digest || path !== getStoragePath())
+            return;
+        if (digest === consumeLastWrittenAccountsDigest(path))
+            return;
+        const previous = cachedAccountManager;
+        try {
+            // A null cache means an invalidation retired the incumbent; the
+            // reload still must adopt the external change. Bailing here would
+            // strand it: onAccountsFileChanged already marked this digest
+            // observed, and an in-flight load started before the write can
+            // still resolve and install a pre-change snapshot whose
+            // full-membership save then deletes the imported accounts.
+            if (previous) {
+                if (previous !== retired) {
+                    previous.disposeShutdownHandler(true);
+                    retired = previous;
+                }
+                await previous.flushPendingSave();
+            }
+            const reloaded = await AccountManager.loadFromDisk();
+            if (generation !== accountsWatchGeneration || accountsWatcherDisposed || path !== getStoragePath()) {
+                reloaded.disposeShutdownHandler();
+                return;
+            }
+            const outgoing = cachedAccountManager;
+            if (outgoing && outgoing !== retired) {
+                // Another actor replaced the cached manager while this reload
+                // was in flight (concurrent fetch reload or tool mutation).
+                // Retire the incumbent with the same external-reload
+                // semantics, or its queued membership save can clobber the
+                // external change this reload is about to adopt.
+                outgoing.disposeShutdownHandler(true);
+                retired = outgoing;
+            }
+            cachedAccountManager = reloaded;
+            accountManagerPromise = Promise.resolve(reloaded);
+            observedAccountsDigest = digest;
+        }
+        catch {
+            logWarn("Could not reload externally updated account storage");
+            if (attempt < 2 && generation === accountsWatchGeneration && !accountsWatcherDisposed) {
+                accountsReloadTimer = setTimeout(() => {
+                    accountsReloadTimer = undefined;
+                    void reloadForExternalAccountsChange(path, generation, attempt + 1, retired);
+                }, 1500);
+                accountsReloadTimer.unref();
+            }
+            return;
+        }
+        logDebug("Reloaded cached account manager after external accounts file change");
+    };
+    const onAccountsFileChanged = async () => {
+        if (accountsWatcherDisposed)
+            return;
+        if (watchedAccountsPath !== getStoragePath()) {
+            await ensureAccountsWatcher();
+            return;
+        }
+        const path = watchedAccountsPath;
+        if (!path)
+            return;
+        const generation = accountsWatchGeneration;
+        const digest = await readAccountsDigest(path);
+        if (generation !== accountsWatchGeneration || !digest || digest === observedAccountsDigest)
+            return;
+        observedAccountsDigest = digest;
+        clearTimeout(accountsReloadTimer);
+        accountsReloadTimer = undefined;
+        if (digest === consumeLastWrittenAccountsDigest(path))
+            return;
+        accountsReloadTimer = setTimeout(() => {
+            accountsReloadTimer = undefined;
+            void reloadForExternalAccountsChange(path, generation);
+        }, 500);
+        accountsReloadTimer.unref();
+    };
+    const onAccountsStatChanged = () => {
+        void onAccountsFileChanged();
+    };
+    const ensureAccountsWatcher = async () => {
+        if (accountsWatcherDisposed)
+            return;
+        const path = getStoragePath();
+        if (path === watchedAccountsPath)
+            return;
+        stopAccountsWatcher();
+        if (isKeychainOptInEnabled())
+            return;
+        unsubscribeAccountsPath ??= subscribeToStoragePathChanges(() => {
+            void ensureAccountsWatcher();
+        });
+        watchedAccountsPath = path;
+        const generation = accountsWatchGeneration;
+        const initialDigest = await readAccountsDigest(path);
+        if (generation !== accountsWatchGeneration)
+            return;
+        observedAccountsDigest = initialDigest;
+        // Stat polling follows the path across the storage writer's temp-file rename.
+        watchFile(path, { interval: 1500, persistent: false }, onAccountsStatChanged);
+        unregisterCleanup(disposeAccountsWatcher);
+        registerCleanup(disposeAccountsWatcher);
+    };
     const persistAuthenticatedSelections = async (results, replaceAll) => {
         try {
             await persistAccountPool(results, replaceAll);
@@ -1192,6 +1334,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
             const { event } = input;
             if (event.type === "server.instance.disposed") {
                 quotaMonitor.dispose();
+                disposeAccountsWatcher();
                 return;
             }
             // Handle TUI account selection events
@@ -1346,7 +1489,9 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                     });
                 }
                 applyUiRuntimeFromConfig(pluginConfig);
-                const perProjectAccounts = getPerProjectAccounts(pluginConfig);
+                let perProjectAccounts = getPerProjectAccounts(pluginConfig);
+                let storageTransition;
+                const activeFetches = new Set();
                 setStoragePath(perProjectAccounts ? process.cwd() : null);
                 const authFallback = auth.type === "oauth" ? auth : undefined;
                 // Prefer multi-account auth metadata when available, but still handle
@@ -1386,8 +1531,19 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                             }
                         });
                     }
-                    let accountManager = await accountManagerPromise;
-                    cachedAccountManager = accountManager;
+                    const loadedManager = await accountManagerPromise;
+                    if (cachedAccountManager && cachedAccountManager !== loadedManager) {
+                        // An external reload replaced the cache while this load was
+                        // in flight. The loaded snapshot is stale; retiring it keeps
+                        // its debounced save from writing full membership over the
+                        // successor's state.
+                        loadedManager.disposeShutdownHandler();
+                    }
+                    else {
+                        cachedAccountManager = loadedManager;
+                    }
+                    const accountManager = cachedAccountManager ?? loadedManager;
+                    await ensureAccountsWatcher();
                     const refreshToken = authFallback?.refresh ?? "";
                     const needsPersist = refreshToken &&
                         !accountManager.hasRefreshToken(refreshToken);
@@ -1412,77 +1568,37 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                         global: providerConfig?.options || {},
                         models: providerConfig?.models || {},
                     };
-                    // Load plugin configuration and determine CODEX_MODE
-                    // Priority: CODEX_MODE env var > config file > default (true)
-                    const codexMode = getCodexMode(pluginConfig);
-                    const requestTransformMode = getRequestTransformMode(pluginConfig);
-                    const useLegacyRequestTransform = requestTransformMode === "legacy";
-                    const fastSessionEnabled = getFastSession(pluginConfig);
-                    const fastSessionStrategy = getFastSessionStrategy(pluginConfig);
-                    const fastSessionMaxInputItems = getFastSessionMaxInputItems(pluginConfig);
-                    const beginnerSafeMode = getBeginnerSafeMode(pluginConfig);
-                    beginnerSafeModeEnabled = beginnerSafeMode;
-                    const maskEmailEnabled = getCodexTuiMaskEmail(pluginConfig);
-                    const retryProfile = beginnerSafeMode
-                        ? "conservative"
-                        : getRetryProfile(pluginConfig);
-                    const retryBudgetOverrides = beginnerSafeMode
-                        ? {}
-                        : getRetryBudgetOverrides(pluginConfig);
-                    const retryBudgetLimits = resolveRetryBudgetLimits(retryProfile, retryBudgetOverrides);
-                    runtimeMetrics.retryProfile = retryProfile;
-                    runtimeMetrics.retryBudgetLimits = { ...retryBudgetLimits };
-                    const tokenRefreshSkewMs = getTokenRefreshSkewMs(pluginConfig);
-                    const rateLimitToastDebounceMs = getRateLimitToastDebounceMs(pluginConfig);
-                    const retryAllAccountsRateLimited = beginnerSafeMode
-                        ? false
-                        : getRetryAllAccountsRateLimited(pluginConfig);
-                    const retryAllAccountsMaxWaitMs = getRetryAllAccountsMaxWaitMs(pluginConfig);
-                    const retryAllAccountsMaxRetries = beginnerSafeMode
-                        ? Math.min(1, getRetryAllAccountsMaxRetries(pluginConfig))
-                        : getRetryAllAccountsMaxRetries(pluginConfig);
-                    const unsupportedCodexPolicy = getUnsupportedCodexPolicy(pluginConfig);
-                    const fallbackOnUnsupportedCodexModel = unsupportedCodexPolicy === "fallback";
-                    const fallbackToGpt52OnUnsupportedGpt53 = getFallbackToGpt52OnUnsupportedGpt53(pluginConfig);
-                    const unsupportedCodexFallbackChain = getUnsupportedCodexFallbackChain(pluginConfig);
-                    const toastDurationMs = getToastDurationMs(pluginConfig);
-                    const accountToastsEnabled = getAccountToastsEnabled(pluginConfig);
-                    const fetchTimeoutMs = getFetchTimeoutMs(pluginConfig);
-                    const streamStallTimeoutMs = getStreamStallTimeoutMs(pluginConfig);
                     const sessionRecoveryEnabled = getSessionRecovery(pluginConfig);
+                    beginnerSafeModeEnabled = getBeginnerSafeMode(pluginConfig);
+                    const initialRetryProfile = beginnerSafeModeEnabled ? "conservative" : getRetryProfile(pluginConfig);
+                    runtimeMetrics.retryProfile = initialRetryProfile;
+                    runtimeMetrics.retryBudgetLimits = resolveRetryBudgetLimits(initialRetryProfile, beginnerSafeModeEnabled ? {} : getRetryBudgetOverrides(pluginConfig));
                     const autoResumeEnabled = getAutoResume(pluginConfig);
                     const autoUpdateEnabled = getAutoUpdate(pluginConfig);
-                    const emptyResponseMaxRetries = getEmptyResponseMaxRetries(pluginConfig);
-                    const emptyResponseRetryDelayMs = getEmptyResponseRetryDelayMs(pluginConfig);
-                    const pidOffsetEnabled = getPidOffsetEnabled(pluginConfig);
-                    const rotationStrategy = getRotationStrategy(pluginConfig);
-                    const effectiveUserConfig = fastSessionEnabled
-                        ? applyFastSessionDefaults(userConfig)
-                        : userConfig;
-                    if (fastSessionEnabled) {
+                    if (getFastSession(pluginConfig)) {
                         logDebug("Fast session mode enabled", {
                             reasoningEffort: "none/low",
                             reasoningSummary: "auto",
                             textVerbosity: "low",
-                            fastSessionStrategy,
-                            fastSessionMaxInputItems,
+                            fastSessionStrategy: getFastSessionStrategy(pluginConfig),
+                            fastSessionMaxInputItems: getFastSessionMaxInputItems(pluginConfig),
                         });
                     }
-                    if (beginnerSafeMode) {
+                    if (getBeginnerSafeMode(pluginConfig)) {
                         logInfo("Beginner safe mode enabled", {
-                            retryProfile,
-                            retryAllAccountsRateLimited,
-                            retryAllAccountsMaxRetries,
+                            retryProfile: "conservative",
+                            retryAllAccountsRateLimited: false,
+                            retryAllAccountsMaxRetries: Math.min(1, getRetryAllAccountsMaxRetries(pluginConfig)),
                         });
                     }
                     const prewarmEnabled = process.env.CODEX_AUTH_PREWARM !== "0" &&
                         process.env.VITEST !== "true" &&
                         process.env.NODE_ENV !== "test";
-                    if (!startupPrewarmTriggered && prewarmEnabled && useLegacyRequestTransform) {
+                    if (!startupPrewarmTriggered && prewarmEnabled && getRequestTransformMode(pluginConfig) === "legacy") {
                         startupPrewarmTriggered = true;
                         const configuredModels = Object.keys(userConfig.models ?? {});
                         prewarmCodexInstructions(configuredModels);
-                        if (codexMode) {
+                        if (getCodexMode(pluginConfig)) {
                             prewarmOpenCodeCodexPrompt();
                         }
                     }
@@ -1515,10 +1631,79 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                          * @returns Response from Codex API
                          */
                         async fetch(input, init) {
+                            let finishFetch;
+                            let pendingFetch;
                             try {
-                                if (cachedAccountManager && cachedAccountManager !== accountManager) {
-                                    accountManager = cachedAccountManager;
+                                const pluginConfig = loadPluginConfig();
+                                const currentPerProjectAccounts = getPerProjectAccounts(pluginConfig);
+                                while (storageTransition)
+                                    await storageTransition;
+                                if (currentPerProjectAccounts !== perProjectAccounts) {
+                                    storageTransition = (async () => {
+                                        await Promise.all(activeFetches);
+                                        // Drain the old pool's pending write before changing the global path.
+                                        await cachedAccountManager?.flushPendingSave();
+                                        setStoragePath(currentPerProjectAccounts ? process.cwd() : null);
+                                        invalidateAccountManagerCache();
+                                        perProjectAccounts = currentPerProjectAccounts;
+                                    })().finally(() => { storageTransition = undefined; });
+                                    await storageTransition;
+                                }
+                                pendingFetch = new Promise((resolve) => { finishFetch = resolve; });
+                                activeFetches.add(pendingFetch);
+                                if (!accountManagerPromise) {
+                                    const pending = AccountManager.loadFromDisk();
+                                    accountManagerPromise = pending;
+                                    void pending.catch(() => {
+                                        if (accountManagerPromise === pending)
+                                            accountManagerPromise = null;
+                                    });
                                 }
+                                if (!cachedAccountManager) {
+                                    const loadedManager = await accountManagerPromise;
+                                    if (cachedAccountManager && cachedAccountManager !== loadedManager) {
+                                        // External reload won the race while this load was in
+                                        // flight: adopt the cache and retire the stale load.
+                                        loadedManager.disposeShutdownHandler();
+                                    }
+                                    else if (!cachedAccountManager) {
+                                        cachedAccountManager = loadedManager;
+                                    }
+                                }
+                                const codexMode = getCodexMode(pluginConfig);
+                                const requestTransformMode = getRequestTransformMode(pluginConfig);
+                                const fastSessionEnabled = getFastSession(pluginConfig);
+                                const fastSessionStrategy = getFastSessionStrategy(pluginConfig);
+                                const fastSessionMaxInputItems = getFastSessionMaxInputItems(pluginConfig);
+                                const beginnerSafeMode = getBeginnerSafeMode(pluginConfig);
+                                beginnerSafeModeEnabled = beginnerSafeMode;
+                                const maskEmailEnabled = getCodexTuiMaskEmail(pluginConfig);
+                                const retryProfile = beginnerSafeMode ? "conservative" : getRetryProfile(pluginConfig);
+                                const retryBudgetOverrides = beginnerSafeMode ? {} : getRetryBudgetOverrides(pluginConfig);
+                                const retryBudgetLimits = resolveRetryBudgetLimits(retryProfile, retryBudgetOverrides);
+                                runtimeMetrics.retryProfile = retryProfile;
+                                runtimeMetrics.retryBudgetLimits = { ...retryBudgetLimits };
+                                const tokenRefreshSkewMs = getTokenRefreshSkewMs(pluginConfig);
+                                const rateLimitToastDebounceMs = getRateLimitToastDebounceMs(pluginConfig);
+                                const retryAllAccountsRateLimited = beginnerSafeMode ? false : getRetryAllAccountsRateLimited(pluginConfig);
+                                const retryAllAccountsMaxWaitMs = getRetryAllAccountsMaxWaitMs(pluginConfig);
+                                const retryAllAccountsMaxRetries = beginnerSafeMode
+                                    ? Math.min(1, getRetryAllAccountsMaxRetries(pluginConfig))
+                                    : getRetryAllAccountsMaxRetries(pluginConfig);
+                                const unsupportedCodexPolicy = getUnsupportedCodexPolicy(pluginConfig);
+                                const fallbackOnUnsupportedCodexModel = unsupportedCodexPolicy === "fallback";
+                                const fallbackToGpt52OnUnsupportedGpt53 = getFallbackToGpt52OnUnsupportedGpt53(pluginConfig);
+                                const unsupportedCodexFallbackChain = getUnsupportedCodexFallbackChain(pluginConfig);
+                                const toastDurationMs = getToastDurationMs(pluginConfig);
+                                const accountToastsEnabled = getAccountToastsEnabled(pluginConfig);
+                                const fetchTimeoutMs = getFetchTimeoutMs(pluginConfig);
+                                const streamStallTimeoutMs = getStreamStallTimeoutMs(pluginConfig);
+                                const emptyResponseMaxRetries = getEmptyResponseMaxRetries(pluginConfig);
+                                const emptyResponseRetryDelayMs = getEmptyResponseRetryDelayMs(pluginConfig);
+                                const pidOffsetEnabled = getPidOffsetEnabled(pluginConfig);
+                                const rotationStrategy = getRotationStrategy(pluginConfig);
+                                const effectiveUserConfig = fastSessionEnabled ? applyFastSessionDefaults(userConfig) : userConfig;
+                                let accountManager = cachedAccountManager;
                                 // Step 1: Extract and rewrite URL for Codex backend
                                 const originalUrl = extractRequestUrl(input);
                                 const url = openAIBaseURL ? originalUrl : rewriteUrlForCodex(originalUrl);
@@ -1656,6 +1841,8 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                     const startTime = Date.now();
                                     const endTime = startTime + totalMs;
                                     while (Date.now() < endTime) {
+                                        if (cachedAccountManager !== accountManager)
+                                            return;
                                         if (abortSignal?.aborted) {
                                             throw abortError();
                                         }
@@ -1758,6 +1945,43 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                 const MAX_QUOTA_FALLBACK_SWITCHES = 3;
                                 let quotaFallbackSwitches = 0;
                                 while (true) {
+                                    if (cachedAccountManager && cachedAccountManager !== accountManager) {
+                                        accountManager = cachedAccountManager;
+                                    }
+                                    else if (!cachedAccountManager) {
+                                        // Reload through the shared accountManagerPromise so
+                                        // concurrent requests (and the startup path above)
+                                        // share one load. Racing independent loadFromDisk()
+                                        // calls here can orphan the slower manager while an
+                                        // in-flight request still holds it, and an orphaned
+                                        // manager is never retired, so its next save would
+                                        // write full membership and drop externally imported
+                                        // accounts.
+                                        if (accountManagerPromise === null) {
+                                            const pending = AccountManager.loadFromDisk();
+                                            accountManagerPromise = pending;
+                                            void pending.catch(() => {
+                                                if (accountManagerPromise === pending)
+                                                    accountManagerPromise = null;
+                                            });
+                                        }
+                                        const reloaded = await accountManagerPromise;
+                                        if (cachedAccountManager) {
+                                            if (cachedAccountManager !== reloaded) {
+                                                // The cache was repopulated while this load was in
+                                                // flight (external reload after an invalidation).
+                                                // The loaded manager is stale; retire it so its
+                                                // debounced save cannot write full membership over
+                                                // accounts imported after its snapshot was taken.
+                                                reloaded.disposeShutdownHandler();
+                                            }
+                                            accountManager = cachedAccountManager;
+                                        }
+                                        else {
+                                            cachedAccountManager = reloaded;
+                                            accountManager = reloaded;
+                                        }
+                                    }
                                     let accountCount = accountManager.getAccountCount();
                                     const attempted = new Set();
                                     // Diagnostics for the terminal error message below. The composite key keeps
@@ -2657,6 +2881,9 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                 }
                             }
                             finally {
+                                if (pendingFetch)
+                                    activeFetches.delete(pendingFetch);
+                                finishFetch?.();
                                 clearCorrelationId();
                             }
                         },