oc-codex-multi-auth 6.20.0 → 6.22.0

package/dist/index.js

@@ -23,6 +23,12 @@
 
  */
 import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { watchFile, unwatchFile } from "node:fs";
+import { consumeLastWrittenAccountsDigest } from "./lib/storage/load-save.js";
+import { subscribeToStoragePathChanges } from "./lib/storage/state.js";
+import { isKeychainOptInEnabled } from "./lib/storage/keychain.js";
+import { AnyAccountStorageSchema } from "./lib/schemas.js";
+import { registerCleanup, unregisterCleanup } from "./lib/shutdown.js";
 import { createHash } from "node:crypto";
 import { homedir } from "node:os";
 import { join } from "node:path";
@@ -33,15 +39,17 @@ import { buildDeviceCodeInstructions, completeDeviceCodeSession, createDeviceCod
 import { applyAccountSelectionFallbacks, persistResolvedAccountSelection, persistAccountPool, resolveAndPersistAccountSelection, resolveAccountSelection, } from "./lib/auth/login-runner.js";
 import { coordinateFlaggedPersistedRefresh, coordinatePersistedRefresh, } from "./lib/storage/coordinated-refresh.js";
 import { promptAddAnotherAccount, promptLoginMode } from "./lib/cli.js";
-import { getCodexMode, getRequestTransformMode, getFastSession, getFastSessionStrategy, getFastSessionMaxInputItems, getRetryProfile, getRetryBudgetOverrides, getRateLimitToastDebounceMs, getRetryAllAccountsMaxRetries, getRetryAllAccountsMaxWaitMs, getRetryAllAccountsRateLimited, getFallbackToGpt52OnUnsupportedGpt53, getUnsupportedCodexPolicy, getUnsupportedCodexFallbackChain, getTokenRefreshSkewMs, getSessionRecovery, getAutoResume, getAutoUpdate, getToastDurationMs, getAccountToastsEnabled, getPerProjectAccounts, getEmptyResponseMaxRetries, getEmptyResponseRetryDelayMs, getPidOffsetEnabled, getRotationStrategy, getModelAccountPool, getModelAccountPoolMode, getFetchTimeoutMs, getStreamStallTimeoutMs, getCodexTuiV2, getCodexTuiColorProfile, getCodexTuiGlyphMode, getBeginnerSafeMode, getCodexTuiMaskEmail, loadPluginConfig, } from "./lib/config.js";
+import { getCodexMode, getRequestTransformMode, getFastSession, getFastSessionStrategy, getFastSessionMaxInputItems, getRetryProfile, getRetryBudgetOverrides, getRateLimitToastDebounceMs, getRetryAllAccountsMaxRetries, getRetryAllAccountsMaxWaitMs, getRetryAllAccountsRateLimited, getFallbackToGpt52OnUnsupportedGpt53, getUnsupportedCodexPolicy, getUnsupportedCodexFallbackChain, getTokenRefreshSkewMs, getSessionRecovery, getAutoResume, getAutoUpdate, getToastDurationMs, getAccountToastsEnabled, getPerProjectAccounts, getEmptyResponseMaxRetries, getEmptyResponseRetryDelayMs, getPidOffsetEnabled, getRotationStrategy, getModelAccountPool, getModelAccountPoolMode, getFetchTimeoutMs, getStreamStallTimeoutMs, getCodexTuiV2, getCodexTuiColorProfile, getCodexTuiGlyphMode, getBeginnerSafeMode, getCodexTuiMaskEmail, getQuotaDisplay, loadPluginConfig, } from "./lib/config.js";
 import { AUTH_LABELS, CODEX_BASE_URL, DUMMY_API_KEY, LOG_STAGES, PLUGIN_NAME, PROVIDER_ID, ACCOUNT_LIMITS, } from "./lib/constants.js";
 import { initLogger, logRequest, logDebug, logInfo, logWarn, logError, setCorrelationId, clearCorrelationId, } from "./lib/logger.js";
 import { createQuotaMonitor } from "./lib/quota-notifications.js";
 import { checkAndNotify } from "./lib/auto-update-checker.js";
+import { describePluginOrigin, getPluginOrigin, recordPluginOrigin } from "./lib/plugin-origin.js";
 import { handleContextOverflow } from "./lib/context-overflow.js";
 import { AccountManager, extractAccountEmail, extractAccountId, formatAccountLabel, formatWaitTime, sanitizeEmail, shouldUpdateAccountIdFromToken, resolveRequestAccountId, parseRateLimitReason, lookupCodexCliTokensByEmail, } from "./lib/accounts.js";
 import { getModelPoolAccountKey, matchesModelPoolAccountKey, } from "./lib/accounts/pool-identity.js";
-import { resolveDisplayEmail } from "./lib/account-display.js";
+import { formatSeatSuffix, maskIdentityValue, resolveDisplayEmail, seatIsDisclosable, } from "./lib/account-display.js";
+import { extractAccountUserId } from "./lib/auth/token-utils.js";
 import { CodexAuthError } from "./lib/errors.js";
 import { getStoragePath, loadAccounts, withAccountStorageTransaction, clearAccounts, setStoragePath, loadFlaggedAccounts, withFlaggedAccountStorageTransaction, clearFlaggedAccounts, StorageError, formatStorageErrorHint, } from "./lib/storage.js";
 import { getWorkspaceIdentityKey } from "./lib/storage/identity.js";
@@ -179,9 +187,19 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
     let accountManagerPromise = null;
     let loaderMutex = null;
     let startupPrewarmTriggered = false;
+    let startupOriginRecorded = false;
     let startupPreflightShown = false;
     let beginnerSafeModeEnabled = false;
     const MIN_BACKOFF_MS = 100;
+    // An all-accounts rate-limit wait can run for days, and the local accounts
+    // file is its only wake-up. A quota reset granted server-side leaves that file
+    // untouched, so such a wait would be slept straight through. Long waits
+    // therefore re-probe upstream: first after a minute, doubling to a quarter
+    // hour, so a multi-day sleep costs a handful of usage requests rather than one
+    // per countdown tick.
+    const UPSTREAM_REPROBE_MIN_WAIT_MS = 60_000;
+    const UPSTREAM_REPROBE_FIRST_DELAY_MS = 60_000;
+    const UPSTREAM_REPROBE_MAX_DELAY_MS = 15 * 60_000;
     const runtimeMetrics = {
         startedAt: Date.now(),
         totalRequests: 0,
@@ -234,17 +252,33 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
             selectionExplainability: serializeSelectionExplainability(options.selectionExplainability ?? snapshot?.explainability ?? []),
         };
     };
-    const buildJsonAccountIdentity = (index, options = {}) => ({
-        index: index + 1,
-        zeroBasedIndex: index,
-        ...(options.includeSensitive
-            ? {
-                label: options.label ?? formatCommandAccountLabel(options.account, index),
-                email: options.account?.email ?? null,
-                accountId: options.account?.accountId ?? null,
-            }
-            : {}),
-    });
+    const buildJsonAccountIdentity = (index, options = {}) => {
+        const includeSensitive = options.includeSensitive ?? false;
+        const accountUserId = options.account?.accountUserId?.trim() || undefined;
+        return {
+            index: index + 1,
+            zeroBasedIndex: index,
+            ...(includeSensitive
+                ? {
+                    label: options.label ??
+                        formatCommandAccountLabel(options.account, index, {
+                            peerAccounts: options.peerAccounts,
+                        }),
+                    email: options.account?.email ?? null,
+                    accountId: options.account?.accountId ?? null,
+                }
+                : {}),
+            // Members of one Business workspace share `accountId`, so the seat is
+            // the field a JSON consumer can tell them apart by. It rides in both
+            // modes - the member id masked when sensitive output is off, and the
+            // suffix withheld when the id is too short to excerpt without
+            // disclosing it - under the same field names the standalone CLI emits.
+            accountUserId: maskIdentityValue(accountUserId, includeSensitive) ?? null,
+            seatSuffix: seatIsDisclosable(accountUserId, includeSensitive)
+                ? (formatSeatSuffix(accountUserId, options.peerAccounts?.map((peer) => peer?.accountUserId)) ?? null)
+                : null,
+        };
+    };
     const appendRoutingVisibilityText = (lines, routing, options = {}) => {
         lines.push("Routing visibility:");
         lines.push(`  Requested model: ${formatRoutingValue(routing.requestedModel)}`);
@@ -443,14 +477,16 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
             logDebug(`[${PLUGIN_NAME}] Failed to clear TUI quota cache: ${error instanceof Error ? error.message : String(error)}`);
         }
     };
-    const recordPromptQuotaHeaders = async (response, account, accountCount) => {
+    const recordPromptQuotaHeaders = async (response, account, accountCount, peerAccounts) => {
         try {
             const snapshot = parseTuiQuotaSnapshotFromHeaders(response.headers, {
                 fingerprint: createUsageAccountFingerprint(account),
                 accountIndex: account.index + 1,
                 accountCount,
                 accountEmail: account.email?.trim() || undefined,
-                accountLabel: formatAccountLabel(account, account.index),
+                accountLabel: formatAccountLabel(account, account.index, {
+                    peerAccounts,
+                }),
             });
             if (!snapshot)
                 return;
@@ -806,6 +842,12 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
         const email = resolveDisplayEmail(account?.email, options.maskEmail ?? false);
         const workspace = account?.accountLabel?.trim();
         const accountId = formatAccountIdForDisplay(account?.accountId);
+        // `omitSeat` is for a caller that renders the seat itself in a place
+        // a long email cannot push it out of - a table column of its own.
+        // Leaving it in the label too would print the seat twice.
+        const seat = options.omitSeat
+            ? undefined
+            : formatSeatSuffix(account?.accountUserId, options.peerAccounts?.map((peer) => peer?.accountUserId));
         const tags = Array.isArray(account?.accountTags)
             ? account.accountTags
                 .filter((tag) => typeof tag === "string")
@@ -819,6 +861,8 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
             details.push(`workspace:${workspace}`);
         if (accountId)
             details.push(`id:${accountId}`);
+        if (seat)
+            details.push(`seat:${seat}`);
         if (tags.length > 0)
             details.push(`tags:${tags.join(",")}`);
         if (details.length === 0) {
@@ -833,6 +877,8 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
             .filter((entry) => entry.length > 0)));
     };
     const supportsInteractiveMenus = () => {
+        if (process.env.FORCE_INTERACTIVE_MODE === "1")
+            return true;
         if (!process.stdin.isTTY || !process.stdout.isTTY)
             return false;
         if (process.env.OPENCODE_TUI === "1")
@@ -841,6 +887,8 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
             return false;
         if (process.env.TERM_PROGRAM === "opencode")
             return false;
+        if (process.env.ELECTRON_RUN_AS_NODE === "1")
+            return false;
         return true;
     };
     const promptAccountIndexSelection = async (ui, storage, title) => {
@@ -850,7 +898,10 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
             const { select } = await import("./lib/ui/select.js");
             const maskEmail = resolveMaskEmail();
             const selected = await select(storage.accounts.map((account, index) => ({
-                label: formatCommandAccountLabel(account, index, { maskEmail }),
+                label: formatCommandAccountLabel(account, index, {
+                    maskEmail,
+                    peerAccounts: storage.accounts,
+                }),
                 value: index,
             })), {
                 message: title,
@@ -869,7 +920,9 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
     const toBeginnerAccountSnapshots = (storage, activeIndex, now) => {
         return storage.accounts.map((account, index) => ({
             index,
-            label: formatCommandAccountLabel(account, index),
+            label: formatCommandAccountLabel(account, index, {
+                peerAccounts: storage.accounts,
+            }),
             accountLabel: account.accountLabel,
             enabled: account.enabled !== false,
             isActive: index === activeIndex,
@@ -1112,25 +1165,59 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
             logDebug(`[${PLUGIN_NAME}] Startup preflight skipped: ${error instanceof Error ? error.message : String(error)}`);
         }
     };
-    const invalidateAccountManagerCache = () => {
-        // Dispose the outgoing manager so we don't leak its shutdown handler
-        // into the global cleanup queue or leave a pending debounce timer
-        // pointing at a stale instance. Flush first (best-effort, in the
-        // background) so any queued debounced save is not silently dropped.
+    const invalidateAccountManagerCache = (clearedSnapshots) => {
+        // Retire before flushing: keep disk membership authoritative while
+        // publishing queued rate-limit evidence through the volatile merge.
         const previous = cachedAccountManager;
         cachedAccountManager = null;
         accountManagerPromise = null;
         if (previous) {
+            previous.disposeShutdownHandler(false, clearedSnapshots);
             void previous
                 .flushPendingSave()
                 .catch((error) => {
                 logWarn(`Failed to flush pending save while invalidating account manager: ${error instanceof Error ? error.message : String(error)}`);
-            })
-                .finally(() => {
-                previous.disposeShutdownHandler();
             });
         }
     };
+    /**
+     * `loadAccounts()` reports a read or parse failure the same way it reports
+     * an absent file - by returning null - and a null load builds a manager
+     * holding zero accounts. Installing that over a working pool makes this
+     * process answer "No Codex accounts configured" while the accounts file on
+     * disk is intact, which cross-process lock contention makes reachable.
+     *
+     * Emptying the pool for real always goes through an explicit action
+     * (`codex-remove`, logout, a storage-mode switch); each installs its own
+     * manager rather than arriving here, so refusing the shrink costs a genuine
+     * deletion nothing.
+     */
+    const isUntrustworthyEmptyReload = (incumbent, reloaded) => incumbent !== null &&
+        incumbent !== reloaded &&
+        reloaded.getAccountCount() === 0 &&
+        incumbent.getAccountCount() > 0;
+    const EMPTY_RELOAD_RETRY_DELAY_MS = 2000;
+    const EMPTY_RELOAD_MAX_RETRIES = 3;
+    let emptyReloadRetries = 0;
+    let emptyReloadRetryTimer;
+    const cancelEmptyReloadRetry = () => {
+        clearTimeout(emptyReloadRetryTimer);
+        emptyReloadRetryTimer = undefined;
+        emptyReloadRetries = 0;
+    };
+    const scheduleEmptyReloadRetry = (retry) => {
+        if (emptyReloadRetries >= EMPTY_RELOAD_MAX_RETRIES) {
+            emptyReloadRetries = 0;
+            return;
+        }
+        emptyReloadRetries += 1;
+        clearTimeout(emptyReloadRetryTimer);
+        emptyReloadRetryTimer = setTimeout(() => {
+            emptyReloadRetryTimer = undefined;
+            void retry();
+        }, EMPTY_RELOAD_RETRY_DELAY_MS);
+        emptyReloadRetryTimer.unref();
+    };
     const reloadCachedAccountManager = async () => {
         if (!cachedAccountManager)
             return;
@@ -1149,6 +1236,13 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
         }
         try {
             const reloadedManager = await AccountManager.loadFromDisk();
+            if (isUntrustworthyEmptyReload(previous, reloadedManager)) {
+                reloadedManager.disposeShutdownHandler();
+                logWarn(`[${PLUGIN_NAME}] Account reload returned no accounts while ${previous.getAccountCount()} are held; keeping the loaded pool and retrying`);
+                scheduleEmptyReloadRetry(reloadCachedAccountManager);
+                return;
+            }
+            cancelEmptyReloadRetry();
             cachedAccountManager = reloadedManager;
             accountManagerPromise = Promise.resolve(reloadedManager);
             // Dispose only after the replacement is installed so we never leak
@@ -1160,6 +1254,197 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
             logWarn(`Failed to reload account manager: ${error instanceof Error ? error.message : String(error)}`);
         }
     };
+    /**
+     * Refills the cache after the fetch path refused an empty reload.
+     * `reloadCachedAccountManager` cannot serve here - it compares against
+     * the cached incumbent, which is exactly what is missing - so the
+     * incumbent the refusing request kept serving is passed in instead.
+     */
+    const repopulateAccountManagerCache = async (incumbent) => {
+        try {
+            const reloaded = await AccountManager.loadFromDisk();
+            if (cachedAccountManager) {
+                // Another actor repopulated first; the late load is stale and
+                // retires for the same reason the fetch path retires it.
+                if (cachedAccountManager !== reloaded)
+                    reloaded.disposeShutdownHandler();
+                return;
+            }
+            if (isUntrustworthyEmptyReload(incumbent, reloaded)) {
+                reloaded.disposeShutdownHandler();
+                scheduleEmptyReloadRetry(() => repopulateAccountManagerCache(incumbent));
+                return;
+            }
+            cancelEmptyReloadRetry();
+            cachedAccountManager = reloaded;
+            accountManagerPromise = Promise.resolve(reloaded);
+        }
+        catch (error) {
+            logWarn(`Failed to reload account manager: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    };
+    let watchedAccountsPath;
+    let observedAccountsDigest;
+    let accountsReloadTimer;
+    let accountsWatcherDisposed = false;
+    let accountsWatchGeneration = 0;
+    let unsubscribeAccountsPath;
+    const stopAccountsWatcher = () => {
+        accountsWatchGeneration += 1;
+        if (watchedAccountsPath)
+            unwatchFile(watchedAccountsPath, onAccountsStatChanged);
+        watchedAccountsPath = undefined;
+        observedAccountsDigest = undefined;
+        clearTimeout(accountsReloadTimer);
+        accountsReloadTimer = undefined;
+    };
+    const disposeAccountsWatcher = () => {
+        accountsWatcherDisposed = true;
+        unsubscribeAccountsPath?.();
+        stopAccountsWatcher();
+        cancelEmptyReloadRetry();
+        unregisterCleanup(disposeAccountsWatcher);
+    };
+    const readAccountsFileState = async (path) => {
+        try {
+            const content = await readFile(path, "utf8");
+            const data = JSON.parse(content);
+            if (!AnyAccountStorageSchema.safeParse(data).success)
+                return;
+            // Counted off the raw document rather than the parsed union so the
+            // count is the same for every storage version.
+            const accounts = data.accounts;
+            return {
+                digest: createHash("sha256").update(content).digest("hex"),
+                accountCount: Array.isArray(accounts) ? accounts.length : 0,
+            };
+        }
+        catch {
+            return;
+        }
+    };
+    const reloadForExternalAccountsChange = async (path, generation, attempt = 0, retired) => {
+        const observed = await readAccountsFileState(path);
+        if (generation !== accountsWatchGeneration || !observed || path !== getStoragePath())
+            return;
+        const digest = observed.digest;
+        if (digest === consumeLastWrittenAccountsDigest(path))
+            return;
+        const retryLater = () => {
+            if (attempt < 2 && generation === accountsWatchGeneration && !accountsWatcherDisposed) {
+                accountsReloadTimer = setTimeout(() => {
+                    accountsReloadTimer = undefined;
+                    void reloadForExternalAccountsChange(path, generation, attempt + 1, retired);
+                }, 1500);
+                accountsReloadTimer.unref();
+            }
+        };
+        const previous = cachedAccountManager;
+        try {
+            // A null cache means an invalidation retired the incumbent; the
+            // reload still must adopt the external change. Bailing here would
+            // strand it: onAccountsFileChanged already marked this digest
+            // observed, and an in-flight load started before the write can
+            // still resolve and install a pre-change snapshot whose
+            // full-membership save then deletes the imported accounts.
+            if (previous) {
+                if (previous !== retired) {
+                    previous.disposeShutdownHandler(true);
+                    retired = previous;
+                }
+                await previous.flushPendingSave();
+            }
+            const reloaded = await AccountManager.loadFromDisk();
+            if (generation !== accountsWatchGeneration || accountsWatcherDisposed || path !== getStoragePath()) {
+                reloaded.disposeShutdownHandler();
+                return;
+            }
+            // The file this reload observed carried accounts but the load
+            // produced none, so `loadAccounts()` failed to read it rather than
+            // the accounts having gone away - a failure it reports as an empty
+            // result, never as a throw, so the catch below cannot see it.
+            // Adopting it would answer "No Codex accounts configured" against an
+            // intact file; the retired incumbent still serves its accounts until
+            // a retry lands a real one.
+            if (observed.accountCount > 0 && reloaded.getAccountCount() === 0) {
+                reloaded.disposeShutdownHandler();
+                logWarn(`[${PLUGIN_NAME}] Externally changed accounts file holds ${observed.accountCount} account(s) but loaded as empty; keeping the current pool and retrying`);
+                retryLater();
+                return;
+            }
+            const outgoing = cachedAccountManager;
+            if (outgoing && outgoing !== retired) {
+                // Another actor replaced the cached manager while this reload
+                // was in flight (concurrent fetch reload or tool mutation).
+                // Retire the incumbent with the same external-reload
+                // semantics, or its queued membership save can clobber the
+                // external change this reload is about to adopt.
+                outgoing.disposeShutdownHandler(true);
+                retired = outgoing;
+            }
+            cachedAccountManager = reloaded;
+            accountManagerPromise = Promise.resolve(reloaded);
+            observedAccountsDigest = digest;
+        }
+        catch {
+            logWarn("Could not reload externally updated account storage");
+            retryLater();
+            return;
+        }
+        logDebug("Reloaded cached account manager after external accounts file change");
+    };
+    const onAccountsFileChanged = async () => {
+        if (accountsWatcherDisposed)
+            return;
+        if (watchedAccountsPath !== getStoragePath()) {
+            await ensureAccountsWatcher();
+            return;
+        }
+        const path = watchedAccountsPath;
+        if (!path)
+            return;
+        const generation = accountsWatchGeneration;
+        const observed = await readAccountsFileState(path);
+        if (generation !== accountsWatchGeneration || !observed || observed.digest === observedAccountsDigest)
+            return;
+        const digest = observed.digest;
+        observedAccountsDigest = digest;
+        clearTimeout(accountsReloadTimer);
+        accountsReloadTimer = undefined;
+        if (digest === consumeLastWrittenAccountsDigest(path))
+            return;
+        accountsReloadTimer = setTimeout(() => {
+            accountsReloadTimer = undefined;
+            void reloadForExternalAccountsChange(path, generation);
+        }, 500);
+        accountsReloadTimer.unref();
+    };
+    const onAccountsStatChanged = () => {
+        void onAccountsFileChanged();
+    };
+    const ensureAccountsWatcher = async () => {
+        if (accountsWatcherDisposed)
+            return;
+        const path = getStoragePath();
+        if (path === watchedAccountsPath)
+            return;
+        stopAccountsWatcher();
+        if (isKeychainOptInEnabled())
+            return;
+        unsubscribeAccountsPath ??= subscribeToStoragePathChanges(() => {
+            void ensureAccountsWatcher();
+        });
+        watchedAccountsPath = path;
+        const generation = accountsWatchGeneration;
+        const initial = await readAccountsFileState(path);
+        if (generation !== accountsWatchGeneration)
+            return;
+        observedAccountsDigest = initial?.digest;
+        // Stat polling follows the path across the storage writer's temp-file rename.
+        watchFile(path, { interval: 1500, persistent: false }, onAccountsStatChanged);
+        unregisterCleanup(disposeAccountsWatcher);
+        registerCleanup(disposeAccountsWatcher);
+    };
     const persistAuthenticatedSelections = async (results, replaceAll) => {
         try {
             await persistAccountPool(results, replaceAll);
@@ -1192,6 +1477,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
             const { event } = input;
             if (event.type === "server.instance.disposed") {
                 quotaMonitor.dispose();
+                disposeAccountsWatcher();
                 return;
             }
             // Handle TUI account selection events
@@ -1346,7 +1632,9 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                     });
                 }
                 applyUiRuntimeFromConfig(pluginConfig);
-                const perProjectAccounts = getPerProjectAccounts(pluginConfig);
+                let perProjectAccounts = getPerProjectAccounts(pluginConfig);
+                let storageTransition;
+                const activeFetches = new Set();
                 setStoragePath(perProjectAccounts ? process.cwd() : null);
                 const authFallback = auth.type === "oauth" ? auth : undefined;
                 // Prefer multi-account auth metadata when available, but still handle
@@ -1386,8 +1674,19 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                             }
                         });
                     }
-                    let accountManager = await accountManagerPromise;
-                    cachedAccountManager = accountManager;
+                    const loadedManager = await accountManagerPromise;
+                    if (cachedAccountManager && cachedAccountManager !== loadedManager) {
+                        // An external reload replaced the cache while this load was
+                        // in flight. The loaded snapshot is stale; retiring it keeps
+                        // its debounced save from writing full membership over the
+                        // successor's state.
+                        loadedManager.disposeShutdownHandler();
+                    }
+                    else {
+                        cachedAccountManager = loadedManager;
+                    }
+                    const accountManager = cachedAccountManager ?? loadedManager;
+                    await ensureAccountsWatcher();
                     const refreshToken = authFallback?.refresh ?? "";
                     const needsPersist = refreshToken &&
                         !accountManager.hasRefreshToken(refreshToken);
@@ -1412,86 +1711,60 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                         global: providerConfig?.options || {},
                         models: providerConfig?.models || {},
                     };
-                    // Load plugin configuration and determine CODEX_MODE
-                    // Priority: CODEX_MODE env var > config file > default (true)
-                    const codexMode = getCodexMode(pluginConfig);
-                    const requestTransformMode = getRequestTransformMode(pluginConfig);
-                    const useLegacyRequestTransform = requestTransformMode === "legacy";
-                    const fastSessionEnabled = getFastSession(pluginConfig);
-                    const fastSessionStrategy = getFastSessionStrategy(pluginConfig);
-                    const fastSessionMaxInputItems = getFastSessionMaxInputItems(pluginConfig);
-                    const beginnerSafeMode = getBeginnerSafeMode(pluginConfig);
-                    beginnerSafeModeEnabled = beginnerSafeMode;
-                    const maskEmailEnabled = getCodexTuiMaskEmail(pluginConfig);
-                    const retryProfile = beginnerSafeMode
-                        ? "conservative"
-                        : getRetryProfile(pluginConfig);
-                    const retryBudgetOverrides = beginnerSafeMode
-                        ? {}
-                        : getRetryBudgetOverrides(pluginConfig);
-                    const retryBudgetLimits = resolveRetryBudgetLimits(retryProfile, retryBudgetOverrides);
-                    runtimeMetrics.retryProfile = retryProfile;
-                    runtimeMetrics.retryBudgetLimits = { ...retryBudgetLimits };
-                    const tokenRefreshSkewMs = getTokenRefreshSkewMs(pluginConfig);
-                    const rateLimitToastDebounceMs = getRateLimitToastDebounceMs(pluginConfig);
-                    const retryAllAccountsRateLimited = beginnerSafeMode
-                        ? false
-                        : getRetryAllAccountsRateLimited(pluginConfig);
-                    const retryAllAccountsMaxWaitMs = getRetryAllAccountsMaxWaitMs(pluginConfig);
-                    const retryAllAccountsMaxRetries = beginnerSafeMode
-                        ? Math.min(1, getRetryAllAccountsMaxRetries(pluginConfig))
-                        : getRetryAllAccountsMaxRetries(pluginConfig);
-                    const unsupportedCodexPolicy = getUnsupportedCodexPolicy(pluginConfig);
-                    const fallbackOnUnsupportedCodexModel = unsupportedCodexPolicy === "fallback";
-                    const fallbackToGpt52OnUnsupportedGpt53 = getFallbackToGpt52OnUnsupportedGpt53(pluginConfig);
-                    const unsupportedCodexFallbackChain = getUnsupportedCodexFallbackChain(pluginConfig);
-                    const toastDurationMs = getToastDurationMs(pluginConfig);
-                    const accountToastsEnabled = getAccountToastsEnabled(pluginConfig);
-                    const fetchTimeoutMs = getFetchTimeoutMs(pluginConfig);
-                    const streamStallTimeoutMs = getStreamStallTimeoutMs(pluginConfig);
                     const sessionRecoveryEnabled = getSessionRecovery(pluginConfig);
+                    beginnerSafeModeEnabled = getBeginnerSafeMode(pluginConfig);
+                    const initialRetryProfile = beginnerSafeModeEnabled ? "conservative" : getRetryProfile(pluginConfig);
+                    runtimeMetrics.retryProfile = initialRetryProfile;
+                    runtimeMetrics.retryBudgetLimits = resolveRetryBudgetLimits(initialRetryProfile, beginnerSafeModeEnabled ? {} : getRetryBudgetOverrides(pluginConfig));
                     const autoResumeEnabled = getAutoResume(pluginConfig);
                     const autoUpdateEnabled = getAutoUpdate(pluginConfig);
-                    const emptyResponseMaxRetries = getEmptyResponseMaxRetries(pluginConfig);
-                    const emptyResponseRetryDelayMs = getEmptyResponseRetryDelayMs(pluginConfig);
-                    const pidOffsetEnabled = getPidOffsetEnabled(pluginConfig);
-                    const rotationStrategy = getRotationStrategy(pluginConfig);
-                    const effectiveUserConfig = fastSessionEnabled
-                        ? applyFastSessionDefaults(userConfig)
-                        : userConfig;
-                    if (fastSessionEnabled) {
+                    if (getFastSession(pluginConfig)) {
                         logDebug("Fast session mode enabled", {
                             reasoningEffort: "none/low",
                             reasoningSummary: "auto",
                             textVerbosity: "low",
-                            fastSessionStrategy,
-                            fastSessionMaxInputItems,
+                            fastSessionStrategy: getFastSessionStrategy(pluginConfig),
+                            fastSessionMaxInputItems: getFastSessionMaxInputItems(pluginConfig),
                         });
                     }
-                    if (beginnerSafeMode) {
+                    if (getBeginnerSafeMode(pluginConfig)) {
                         logInfo("Beginner safe mode enabled", {
-                            retryProfile,
-                            retryAllAccountsRateLimited,
-                            retryAllAccountsMaxRetries,
+                            retryProfile: "conservative",
+                            retryAllAccountsRateLimited: false,
+                            retryAllAccountsMaxRetries: Math.min(1, getRetryAllAccountsMaxRetries(pluginConfig)),
                         });
                     }
-                    const prewarmEnabled = process.env.CODEX_AUTH_PREWARM !== "0" &&
-                        process.env.VITEST !== "true" &&
-                        process.env.NODE_ENV !== "test";
-                    if (!startupPrewarmTriggered && prewarmEnabled && useLegacyRequestTransform) {
+                    const underTestRunner = process.env.VITEST === "true" || process.env.NODE_ENV === "test";
+                    const prewarmEnabled = process.env.CODEX_AUTH_PREWARM !== "0" && !underTestRunner;
+                    if (!startupPrewarmTriggered && prewarmEnabled && getRequestTransformMode(pluginConfig) === "legacy") {
                         startupPrewarmTriggered = true;
                         const configuredModels = Object.keys(userConfig.models ?? {});
                         prewarmCodexInstructions(configuredModels);
-                        if (codexMode) {
+                        if (getCodexMode(pluginConfig)) {
                             prewarmOpenCodeCodexPrompt();
                         }
                     }
                     const recoveryHook = sessionRecoveryEnabled
                         ? createSessionRecoveryHook({ client, directory: process.cwd() }, { sessionRecovery: true, autoResume: autoResumeEnabled })
                         : null;
+                    const pluginOrigin = getPluginOrigin();
+                    if (pluginOrigin && !startupOriginRecorded) {
+                        startupOriginRecorded = true;
+                        if (pluginOrigin.isLocalCheckout) {
+                            logInfo(`Running from ${describePluginOrigin(pluginOrigin)}`);
+                        }
+                        if (!underTestRunner) {
+                            recordPluginOrigin(pluginOrigin).catch((err) => {
+                                logDebug(`Failed to record plugin origin: ${err instanceof Error ? err.message : String(err)}`);
+                            });
+                        }
+                    }
                     checkAndNotify(async (message, variant) => {
                         await showToast(message, variant);
-                    }, { autoUpdate: autoUpdateEnabled }).catch((err) => {
+                    }, {
+                        autoUpdate: autoUpdateEnabled,
+                        localCheckout: pluginOrigin?.isLocalCheckout ?? false,
+                    }).catch((err) => {
                         logDebug(`Update check failed: ${err instanceof Error ? err.message : String(err)}`);
                     });
                     await runStartupPreflight();
@@ -1515,10 +1788,79 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                          * @returns Response from Codex API
                          */
                         async fetch(input, init) {
+                            let finishFetch;
+                            let pendingFetch;
                             try {
-                                if (cachedAccountManager && cachedAccountManager !== accountManager) {
-                                    accountManager = cachedAccountManager;
+                                const pluginConfig = loadPluginConfig();
+                                const currentPerProjectAccounts = getPerProjectAccounts(pluginConfig);
+                                while (storageTransition)
+                                    await storageTransition;
+                                if (currentPerProjectAccounts !== perProjectAccounts) {
+                                    storageTransition = (async () => {
+                                        await Promise.all(activeFetches);
+                                        // Drain the old pool's pending write before changing the global path.
+                                        await cachedAccountManager?.flushPendingSave();
+                                        setStoragePath(currentPerProjectAccounts ? process.cwd() : null);
+                                        invalidateAccountManagerCache();
+                                        perProjectAccounts = currentPerProjectAccounts;
+                                    })().finally(() => { storageTransition = undefined; });
+                                    await storageTransition;
+                                }
+                                pendingFetch = new Promise((resolve) => { finishFetch = resolve; });
+                                activeFetches.add(pendingFetch);
+                                if (!accountManagerPromise) {
+                                    const pending = AccountManager.loadFromDisk();
+                                    accountManagerPromise = pending;
+                                    void pending.catch(() => {
+                                        if (accountManagerPromise === pending)
+                                            accountManagerPromise = null;
+                                    });
                                 }
+                                if (!cachedAccountManager) {
+                                    const loadedManager = await accountManagerPromise;
+                                    if (cachedAccountManager && cachedAccountManager !== loadedManager) {
+                                        // External reload won the race while this load was in
+                                        // flight: adopt the cache and retire the stale load.
+                                        loadedManager.disposeShutdownHandler();
+                                    }
+                                    else if (!cachedAccountManager) {
+                                        cachedAccountManager = loadedManager;
+                                    }
+                                }
+                                const codexMode = getCodexMode(pluginConfig);
+                                const requestTransformMode = getRequestTransformMode(pluginConfig);
+                                const fastSessionEnabled = getFastSession(pluginConfig);
+                                const fastSessionStrategy = getFastSessionStrategy(pluginConfig);
+                                const fastSessionMaxInputItems = getFastSessionMaxInputItems(pluginConfig);
+                                const beginnerSafeMode = getBeginnerSafeMode(pluginConfig);
+                                beginnerSafeModeEnabled = beginnerSafeMode;
+                                const maskEmailEnabled = getCodexTuiMaskEmail(pluginConfig);
+                                const retryProfile = beginnerSafeMode ? "conservative" : getRetryProfile(pluginConfig);
+                                const retryBudgetOverrides = beginnerSafeMode ? {} : getRetryBudgetOverrides(pluginConfig);
+                                const retryBudgetLimits = resolveRetryBudgetLimits(retryProfile, retryBudgetOverrides);
+                                runtimeMetrics.retryProfile = retryProfile;
+                                runtimeMetrics.retryBudgetLimits = { ...retryBudgetLimits };
+                                const tokenRefreshSkewMs = getTokenRefreshSkewMs(pluginConfig);
+                                const rateLimitToastDebounceMs = getRateLimitToastDebounceMs(pluginConfig);
+                                const retryAllAccountsRateLimited = beginnerSafeMode ? false : getRetryAllAccountsRateLimited(pluginConfig);
+                                const retryAllAccountsMaxWaitMs = getRetryAllAccountsMaxWaitMs(pluginConfig);
+                                const retryAllAccountsMaxRetries = beginnerSafeMode
+                                    ? Math.min(1, getRetryAllAccountsMaxRetries(pluginConfig))
+                                    : getRetryAllAccountsMaxRetries(pluginConfig);
+                                const unsupportedCodexPolicy = getUnsupportedCodexPolicy(pluginConfig);
+                                const fallbackOnUnsupportedCodexModel = unsupportedCodexPolicy === "fallback";
+                                const fallbackToGpt52OnUnsupportedGpt53 = getFallbackToGpt52OnUnsupportedGpt53(pluginConfig);
+                                const unsupportedCodexFallbackChain = getUnsupportedCodexFallbackChain(pluginConfig);
+                                const toastDurationMs = getToastDurationMs(pluginConfig);
+                                const accountToastsEnabled = getAccountToastsEnabled(pluginConfig);
+                                const fetchTimeoutMs = getFetchTimeoutMs(pluginConfig);
+                                const streamStallTimeoutMs = getStreamStallTimeoutMs(pluginConfig);
+                                const emptyResponseMaxRetries = getEmptyResponseMaxRetries(pluginConfig);
+                                const emptyResponseRetryDelayMs = getEmptyResponseRetryDelayMs(pluginConfig);
+                                const pidOffsetEnabled = getPidOffsetEnabled(pluginConfig);
+                                const rotationStrategy = getRotationStrategy(pluginConfig);
+                                const effectiveUserConfig = fastSessionEnabled ? applyFastSessionDefaults(userConfig) : userConfig;
+                                let accountManager = cachedAccountManager;
                                 // Step 1: Extract and rewrite URL for Codex backend
                                 const originalUrl = extractRequestUrl(input);
                                 const url = openAIBaseURL ? originalUrl : rewriteUrlForCodex(originalUrl);
@@ -1609,9 +1951,18 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                     runtimeMetrics.promptCacheMissingRequests++;
                                 }
                                 const retryBudget = new RetryBudgetTracker(retryBudgetLimits);
-                                const consumeRetryBudget = (bucket, reason) => {
-                                    if (retryBudget.consume(bucket)) {
-                                        runtimeMetrics.retryBudgetUsage[bucket] += 1;
+                                const consumeRetryBudget = (bucket, reason, waitMs) => {
+                                    // Pass the wait so the charge scales with how long the retry
+                                    // blocks. Metrics follow the tracker's own counter rather than
+                                    // assuming one unit, or a free sub-second wait would report
+                                    // budget it never spent.
+                                    const usedBefore = retryBudget.getUsage()[bucket];
+                                    const granted = waitMs === undefined
+                                        ? retryBudget.consume(bucket)
+                                        : retryBudget.consumeWait(bucket, waitMs);
+                                    if (granted) {
+                                        runtimeMetrics.retryBudgetUsage[bucket] +=
+                                            retryBudget.getUsage()[bucket] - usedBefore;
                                         return true;
                                     }
                                     runtimeMetrics.retryBudgetExhaustions += 1;
@@ -1652,25 +2003,69 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                     };
                                     abortSignal?.addEventListener("abort", onAbort, { once: true });
                                 });
-                                const sleepWithCountdown = async (totalMs, message, intervalMs = 5000) => {
+                                const sleepWithCountdown = async (totalMs, message, intervalMs = 5000, probeUpstream) => {
                                     const startTime = Date.now();
                                     const endTime = startTime + totalMs;
+                                    let probeDelayMs = UPSTREAM_REPROBE_FIRST_DELAY_MS;
+                                    let nextProbeAt = probeUpstream && totalMs >= UPSTREAM_REPROBE_MIN_WAIT_MS
+                                        ? startTime + probeDelayMs
+                                        : Number.POSITIVE_INFINITY;
                                     while (Date.now() < endTime) {
+                                        if (cachedAccountManager !== accountManager)
+                                            return;
                                         if (abortSignal?.aborted) {
                                             throw abortError();
                                         }
+                                        if (probeUpstream && Date.now() >= nextProbeAt) {
+                                            if (await probeUpstream())
+                                                return;
+                                            if (cachedAccountManager !== accountManager)
+                                                return;
+                                            if (abortSignal?.aborted) {
+                                                throw abortError();
+                                            }
+                                            probeDelayMs = Math.min(probeDelayMs * 2, UPSTREAM_REPROBE_MAX_DELAY_MS);
+                                            // Measured from the end of the probe, so a slow usage
+                                            // request cannot schedule the next one in the past and
+                                            // collapse the countdown sleep below to zero.
+                                            nextProbeAt = Date.now() + probeDelayMs;
+                                        }
                                         const remaining = Math.max(0, endTime - Date.now());
                                         const waitLabel = formatWaitTime(remaining);
                                         await showToast(`${message} (${waitLabel} remaining)`, "warning", { duration: Math.min(intervalMs + 1000, toastDurationMs) });
-                                        const sleepTime = Math.min(intervalMs, remaining);
+                                        const sleepTime = Math.min(intervalMs, remaining, nextProbeAt - Date.now());
                                         if (sleepTime > 0) {
                                             await sleep(sleepTime);
                                         }
                                         else {
-                                            break;
+                                            continue;
                                         }
                                     }
                                 };
+                                /**
+                                 * True when an all-accounts wait can stop early.
+                                 *
+                                 * `runNow` refreshes `/wham/usage` for every account and persists
+                                 * whatever it finds, so a reset that never touched local disk
+                                 * becomes visible here. Persisting a recovery also drops the cached
+                                 * manager, which is what makes the enclosing retry loop re-resolve
+                                 * one that no longer reports a block.
+                                 */
+                                const probeUpstreamBlockLifted = async () => {
+                                    try {
+                                        await quotaMonitor.runNow();
+                                    }
+                                    catch (error) {
+                                        logDebug(`[${PLUGIN_NAME}] Upstream quota re-probe failed: ${error instanceof Error ? error.message : String(error)}`);
+                                        return false;
+                                    }
+                                    if (cachedAccountManager !== accountManager)
+                                        return true;
+                                    const manager = accountManager;
+                                    if (!manager)
+                                        return false;
+                                    return manager.getMinWaitTimeForFamily(modelFamily, model) === 0;
+                                };
                                 let allRateLimitedRetries = 0;
                                 let emptyResponseRetries = 0;
                                 const attemptedUnsupportedFallbackModels = new Set();
@@ -1758,6 +2153,58 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                 const MAX_QUOTA_FALLBACK_SWITCHES = 3;
                                 let quotaFallbackSwitches = 0;
                                 while (true) {
+                                    if (cachedAccountManager && cachedAccountManager !== accountManager) {
+                                        accountManager = cachedAccountManager;
+                                    }
+                                    else if (!cachedAccountManager) {
+                                        // Reload through the shared accountManagerPromise so
+                                        // concurrent requests (and the startup path above)
+                                        // share one load. Racing independent loadFromDisk()
+                                        // calls here can orphan the slower manager while an
+                                        // in-flight request still holds it, and an orphaned
+                                        // manager is never retired, so its next save would
+                                        // write full membership and drop externally imported
+                                        // accounts.
+                                        if (accountManagerPromise === null) {
+                                            const pending = AccountManager.loadFromDisk();
+                                            accountManagerPromise = pending;
+                                            void pending.catch(() => {
+                                                if (accountManagerPromise === pending)
+                                                    accountManagerPromise = null;
+                                            });
+                                        }
+                                        const loading = accountManagerPromise;
+                                        const reloaded = await loading;
+                                        if (cachedAccountManager) {
+                                            if (cachedAccountManager !== reloaded) {
+                                                // The cache was repopulated while this load was in
+                                                // flight (external reload after an invalidation).
+                                                // The loaded manager is stale; retire it so its
+                                                // debounced save cannot write full membership over
+                                                // accounts imported after its snapshot was taken.
+                                                reloaded.disposeShutdownHandler();
+                                            }
+                                            accountManager = cachedAccountManager;
+                                        }
+                                        else if (accountManager && isUntrustworthyEmptyReload(accountManager, reloaded)) {
+                                            // The incumbent this request holds still has accounts, so
+                                            // the empty result is a failed `loadAccounts()` read rather
+                                            // than a real removal (same refusal as
+                                            // reloadCachedAccountManager). Keep serving the incumbent
+                                            // and drop the resolved promise so the next pass re-reads
+                                            // disk instead of adopting this same empty manager.
+                                            reloaded.disposeShutdownHandler();
+                                            if (accountManagerPromise === loading)
+                                                accountManagerPromise = null;
+                                            logWarn(`[${PLUGIN_NAME}] Account reload returned no accounts while ${accountManager.getAccountCount()} are held; keeping the loaded pool and retrying`);
+                                            const incumbent = accountManager;
+                                            scheduleEmptyReloadRetry(() => repopulateAccountManagerCache(incumbent));
+                                        }
+                                        else {
+                                            cachedAccountManager = reloaded;
+                                            accountManager = reloaded;
+                                        }
+                                    }
                                     let accountCount = accountManager.getAccountCount();
                                     const attempted = new Set();
                                     // Diagnostics for the terminal error message below. The composite key keeps
@@ -1874,6 +2321,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                             const failures = await accountManager.incrementAuthFailures(account);
                                             const accountLabel = formatAccountLabel(account, account.index, {
                                                 maskEmail: maskEmailEnabled,
+                                                peerAccounts: accountManager.getAccountsSnapshot(),
                                             });
                                             if (failures >= ACCOUNT_LIMITS.MAX_AUTH_FAILURES_BEFORE_REMOVAL) {
                                                 const removedCount = accountManager.removeAccountsWithSameRefreshToken(account);
@@ -1923,6 +2371,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                             accountManager.shouldShowAccountToast(account.index, rateLimitToastDebounceMs)) {
                                             const accountLabel = formatAccountLabel(account, account.index, {
                                                 maskEmail: maskEmailEnabled,
+                                                peerAccounts: accountManager.getAccountsSnapshot(),
                                             });
                                             await showToast(`Using ${accountLabel} (${account.index + 1}/${accountCount})`, "info");
                                             accountManager.markToastShown(account.index);
@@ -2110,7 +2559,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                             // only the block would leave the status line reporting "0% left" for
                                             // an account the router considers healthy.
                                             const recordQuotaHeaders = () => {
-                                                void recordPromptQuotaHeaders(response, account, accountCount);
+                                                void recordPromptQuotaHeaders(response, account, accountCount, accountManager.getAccountsSnapshot());
                                                 return applyQuotaExhaustion(accountManager, response.headers, account, modelFamily, model);
                                             };
                                             if (response.ok) {
@@ -2130,6 +2579,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                                 if (workspaceDeactivated) {
                                                     const accountLabel = formatAccountLabel(account, account.index, {
                                                         maskEmail: maskEmailEnabled,
+                                                        peerAccounts: accountManager.getAccountsSnapshot(),
                                                     });
                                                     accountManager.refundToken(account, modelFamily, model);
                                                     accountManager.recordFailure(account, modelFamily, model);
@@ -2343,6 +2793,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                                 if (isInvalidatedAuthTokenError(errorBody, response.status)) {
                                                     const accountLabel = formatAccountLabel(account, account.index, {
                                                         maskEmail: maskEmailEnabled,
+                                                        peerAccounts: accountManager.getAccountsSnapshot(),
                                                     });
                                                     accountManager.refundToken(account, modelFamily, model);
                                                     accountManager.recordFailure(account, modelFamily, model);
@@ -2614,9 +3065,9 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                         (retryAllAccountsMaxWaitMs === 0 ||
                                             waitMs <= retryAllAccountsMaxWaitMs) &&
                                         allRateLimitedRetries < retryAllAccountsMaxRetries &&
-                                        consumeRetryBudget("rateLimitGlobal", `All accounts rate-limited wait ${waitMs}ms`)) {
+                                        consumeRetryBudget("rateLimitGlobal", `All accounts rate-limited wait ${waitMs}ms`, waitMs)) {
                                         const countdownMessage = `All ${count} account(s) rate-limited. Waiting`;
-                                        await sleepWithCountdown(addJitter(waitMs, 0.2), countdownMessage);
+                                        await sleepWithCountdown(addJitter(waitMs, 0.2), countdownMessage, undefined, probeUpstreamBlockLifted);
                                         allRateLimitedRetries++;
                                         continue;
                                     }
@@ -2657,6 +3108,9 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                 }
                             }
                             finally {
+                                if (pendingFetch)
+                                    activeFetches.delete(pendingFetch);
+                                finishFetch?.();
                                 clearCorrelationId();
                             }
                         },
@@ -2716,19 +3170,20 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                 message.includes("invalid refresh") ||
                                 message.includes("token has been revoked"));
                         };
+                        const authQuotaDisplay = getQuotaDisplay(authPluginConfig);
                         const formatCodexQuotaLine = (usage) => {
                             const parts = [];
                             for (const window of [usage.primary, usage.secondary]) {
                                 if (!hasUsageWindow(window))
                                     continue;
-                                parts.push(`${formatUsageLimitTitle(window.windowMinutes)} ${formatUsageLimitSummary(window)}`);
+                                parts.push(`${formatUsageLimitTitle(window.windowMinutes)} ${formatUsageLimitSummary(window, authQuotaDisplay)}`);
                             }
                             if (hasUsageWindow(usage.codeReview)) {
-                                parts.push(`Code review ${formatUsageLimitSummary(usage.codeReview)}`);
+                                parts.push(`Code review ${formatUsageLimitSummary(usage.codeReview, authQuotaDisplay)}`);
                             }
                             for (const limit of usage.additionalLimits) {
                                 if (hasUsageWindow(limit.window)) {
-                                    parts.push(`${limit.name} ${formatUsageLimitSummary(limit.window)}`);
+                                    parts.push(`${limit.name} ${formatUsageLimitSummary(limit.window, authQuotaDisplay)}`);
                                 }
                             }
                             const planLabel = formatPlanType(usage.planType);
@@ -2900,8 +3355,17 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                     }
                                     if (deepProbe) {
                                         ok += 1;
-                                        const detail = tokenAccountId
-                                            ? `${authDetail} (id:${tokenAccountId.slice(-6)})`
+                                        // Both read from the probed token, so the pair is the seat
+                                        // the credential actually belongs to. The workspace id
+                                        // alone repeats across every member of a Business
+                                        // workspace and cannot confirm which seat answered.
+                                        const tokenSeat = formatSeatSuffix(extractAccountUserId(accessToken), workingStorage.accounts.map((peer) => peer?.accountUserId));
+                                        const identity = [
+                                            tokenAccountId ? `id:${tokenAccountId.slice(-6)}` : undefined,
+                                            tokenSeat ? `seat:${tokenSeat}` : undefined,
+                                        ].filter((part) => part !== undefined);
+                                        const detail = identity.length > 0
+                                            ? `${authDetail} (${identity.join(", ")})`
                                             : authDetail;
                                         console.log(`[${i + 1}/${total}] ${label}: ${detail}`);
                                         continue;
@@ -2919,7 +3383,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                             organizationId: account.organizationId,
                                             normalizeAccountErrors: true,
                                         });
-                                        const usage = parseCodexUsagePayload(payload);
+                                        const usage = parseCodexUsagePayload(payload, authQuotaDisplay);
                                         ok += 1;
                                         console.log(`[${i + 1}/${total}] ${label}: ${formatCodexQuotaLine(usage)}`);
                                     }
@@ -3195,6 +3659,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                     }
                                     return {
                                         accountId: account.accountId,
+                                        accountUserId: account.accountUserId,
                                         accountLabel: account.accountLabel,
                                         email: account.email,
                                         index,