oc-codex-multi-auth 6.21.0 → 6.23.0

package/dist/index.js

@@ -39,15 +39,17 @@ import { buildDeviceCodeInstructions, completeDeviceCodeSession, createDeviceCod
 import { applyAccountSelectionFallbacks, persistResolvedAccountSelection, persistAccountPool, resolveAndPersistAccountSelection, resolveAccountSelection, } from "./lib/auth/login-runner.js";
 import { coordinateFlaggedPersistedRefresh, coordinatePersistedRefresh, } from "./lib/storage/coordinated-refresh.js";
 import { promptAddAnotherAccount, promptLoginMode } from "./lib/cli.js";
-import { getCodexMode, getRequestTransformMode, getFastSession, getFastSessionStrategy, getFastSessionMaxInputItems, getRetryProfile, getRetryBudgetOverrides, getRateLimitToastDebounceMs, getRetryAllAccountsMaxRetries, getRetryAllAccountsMaxWaitMs, getRetryAllAccountsRateLimited, getFallbackToGpt52OnUnsupportedGpt53, getUnsupportedCodexPolicy, getUnsupportedCodexFallbackChain, getTokenRefreshSkewMs, getSessionRecovery, getAutoResume, getAutoUpdate, getToastDurationMs, getAccountToastsEnabled, getPerProjectAccounts, getEmptyResponseMaxRetries, getEmptyResponseRetryDelayMs, getPidOffsetEnabled, getRotationStrategy, getModelAccountPool, getModelAccountPoolMode, getFetchTimeoutMs, getStreamStallTimeoutMs, getCodexTuiV2, getCodexTuiColorProfile, getCodexTuiGlyphMode, getBeginnerSafeMode, getCodexTuiMaskEmail, loadPluginConfig, } from "./lib/config.js";
-import { AUTH_LABELS, CODEX_BASE_URL, DUMMY_API_KEY, LOG_STAGES, PLUGIN_NAME, PROVIDER_ID, ACCOUNT_LIMITS, } from "./lib/constants.js";
+import { getCodexMode, getRequestTransformMode, getFastSession, getFastSessionStrategy, getFastSessionMaxInputItems, getRetryProfile, getRetryBudgetOverrides, getRateLimitToastDebounceMs, getRetryAllAccountsMaxRetries, getRetryAllAccountsMaxWaitMs, getRetryAllAccountsRateLimited, getFallbackToGpt52OnUnsupportedGpt53, getUnsupportedCodexPolicy, getUnsupportedCodexFallbackChain, getTokenRefreshSkewMs, getSessionRecovery, getAutoResume, getAutoUpdate, getToastDurationMs, getAccountToastsEnabled, getPerProjectAccounts, getEmptyResponseMaxRetries, getEmptyResponseRetryDelayMs, getPidOffsetEnabled, getRotationStrategy, getModelAccountPool, getModelAccountPoolMode, getFetchTimeoutMs, getStreamStallTimeoutMs, getCodexTuiV2, getCodexTuiColorProfile, getCodexTuiGlyphMode, getBeginnerSafeMode, getCodexTuiMaskEmail, getQuotaDisplay, loadPluginConfig, } from "./lib/config.js";
+import { AUTH_LABELS, CODEX_BASE_URL, DUMMY_API_KEY, LOG_STAGES, PLUGIN_NAME, PROVIDER_ID, ACCOUNT_LIMITS, MAX_QUOTA_FALLBACK_SWITCHES, } from "./lib/constants.js";
 import { initLogger, logRequest, logDebug, logInfo, logWarn, logError, setCorrelationId, clearCorrelationId, } from "./lib/logger.js";
 import { createQuotaMonitor } from "./lib/quota-notifications.js";
 import { checkAndNotify } from "./lib/auto-update-checker.js";
+import { describePluginOrigin, getPluginOrigin, recordPluginOrigin } from "./lib/plugin-origin.js";
 import { handleContextOverflow } from "./lib/context-overflow.js";
 import { AccountManager, extractAccountEmail, extractAccountId, formatAccountLabel, formatWaitTime, sanitizeEmail, shouldUpdateAccountIdFromToken, resolveRequestAccountId, parseRateLimitReason, lookupCodexCliTokensByEmail, } from "./lib/accounts.js";
 import { getModelPoolAccountKey, matchesModelPoolAccountKey, } from "./lib/accounts/pool-identity.js";
-import { resolveDisplayEmail } from "./lib/account-display.js";
+import { formatSeatSuffix, maskIdentityValue, resolveDisplayEmail, seatIsDisclosable, } from "./lib/account-display.js";
+import { extractAccountUserId } from "./lib/auth/token-utils.js";
 import { CodexAuthError } from "./lib/errors.js";
 import { getStoragePath, loadAccounts, withAccountStorageTransaction, clearAccounts, setStoragePath, loadFlaggedAccounts, withFlaggedAccountStorageTransaction, clearFlaggedAccounts, StorageError, formatStorageErrorHint, } from "./lib/storage.js";
 import { getWorkspaceIdentityKey } from "./lib/storage/identity.js";
@@ -185,9 +187,19 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
     let accountManagerPromise = null;
     let loaderMutex = null;
     let startupPrewarmTriggered = false;
+    let startupOriginRecorded = false;
     let startupPreflightShown = false;
     let beginnerSafeModeEnabled = false;
     const MIN_BACKOFF_MS = 100;
+    // An all-accounts rate-limit wait can run for days, and the local accounts
+    // file is its only wake-up. A quota reset granted server-side leaves that file
+    // untouched, so such a wait would be slept straight through. Long waits
+    // therefore re-probe upstream: first after a minute, doubling to a quarter
+    // hour, so a multi-day sleep costs a handful of usage requests rather than one
+    // per countdown tick.
+    const UPSTREAM_REPROBE_MIN_WAIT_MS = 60_000;
+    const UPSTREAM_REPROBE_FIRST_DELAY_MS = 60_000;
+    const UPSTREAM_REPROBE_MAX_DELAY_MS = 15 * 60_000;
     const runtimeMetrics = {
         startedAt: Date.now(),
         totalRequests: 0,
@@ -240,17 +252,33 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
             selectionExplainability: serializeSelectionExplainability(options.selectionExplainability ?? snapshot?.explainability ?? []),
         };
     };
-    const buildJsonAccountIdentity = (index, options = {}) => ({
-        index: index + 1,
-        zeroBasedIndex: index,
-        ...(options.includeSensitive
-            ? {
-                label: options.label ?? formatCommandAccountLabel(options.account, index),
-                email: options.account?.email ?? null,
-                accountId: options.account?.accountId ?? null,
-            }
-            : {}),
-    });
+    const buildJsonAccountIdentity = (index, options = {}) => {
+        const includeSensitive = options.includeSensitive ?? false;
+        const accountUserId = options.account?.accountUserId?.trim() || undefined;
+        return {
+            index: index + 1,
+            zeroBasedIndex: index,
+            ...(includeSensitive
+                ? {
+                    label: options.label ??
+                        formatCommandAccountLabel(options.account, index, {
+                            peerAccounts: options.peerAccounts,
+                        }),
+                    email: options.account?.email ?? null,
+                    accountId: options.account?.accountId ?? null,
+                }
+                : {}),
+            // Members of one Business workspace share `accountId`, so the seat is
+            // the field a JSON consumer can tell them apart by. It rides in both
+            // modes - the member id masked when sensitive output is off, and the
+            // suffix withheld when the id is too short to excerpt without
+            // disclosing it - under the same field names the standalone CLI emits.
+            accountUserId: maskIdentityValue(accountUserId, includeSensitive) ?? null,
+            seatSuffix: seatIsDisclosable(accountUserId, includeSensitive)
+                ? (formatSeatSuffix(accountUserId, options.peerAccounts?.map((peer) => peer?.accountUserId)) ?? null)
+                : null,
+        };
+    };
     const appendRoutingVisibilityText = (lines, routing, options = {}) => {
         lines.push("Routing visibility:");
         lines.push(`  Requested model: ${formatRoutingValue(routing.requestedModel)}`);
@@ -449,14 +477,16 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
             logDebug(`[${PLUGIN_NAME}] Failed to clear TUI quota cache: ${error instanceof Error ? error.message : String(error)}`);
         }
     };
-    const recordPromptQuotaHeaders = async (response, account, accountCount) => {
+    const recordPromptQuotaHeaders = async (response, account, accountCount, peerAccounts) => {
         try {
             const snapshot = parseTuiQuotaSnapshotFromHeaders(response.headers, {
                 fingerprint: createUsageAccountFingerprint(account),
                 accountIndex: account.index + 1,
                 accountCount,
                 accountEmail: account.email?.trim() || undefined,
-                accountLabel: formatAccountLabel(account, account.index),
+                accountLabel: formatAccountLabel(account, account.index, {
+                    peerAccounts,
+                }),
             });
             if (!snapshot)
                 return;
@@ -812,6 +842,12 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
         const email = resolveDisplayEmail(account?.email, options.maskEmail ?? false);
         const workspace = account?.accountLabel?.trim();
         const accountId = formatAccountIdForDisplay(account?.accountId);
+        // `omitSeat` is for a caller that renders the seat itself in a place
+        // a long email cannot push it out of - a table column of its own.
+        // Leaving it in the label too would print the seat twice.
+        const seat = options.omitSeat
+            ? undefined
+            : formatSeatSuffix(account?.accountUserId, options.peerAccounts?.map((peer) => peer?.accountUserId));
         const tags = Array.isArray(account?.accountTags)
             ? account.accountTags
                 .filter((tag) => typeof tag === "string")
@@ -825,6 +861,8 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
             details.push(`workspace:${workspace}`);
         if (accountId)
             details.push(`id:${accountId}`);
+        if (seat)
+            details.push(`seat:${seat}`);
         if (tags.length > 0)
             details.push(`tags:${tags.join(",")}`);
         if (details.length === 0) {
@@ -860,7 +898,10 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
             const { select } = await import("./lib/ui/select.js");
             const maskEmail = resolveMaskEmail();
             const selected = await select(storage.accounts.map((account, index) => ({
-                label: formatCommandAccountLabel(account, index, { maskEmail }),
+                label: formatCommandAccountLabel(account, index, {
+                    maskEmail,
+                    peerAccounts: storage.accounts,
+                }),
                 value: index,
             })), {
                 message: title,
@@ -879,7 +920,9 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
     const toBeginnerAccountSnapshots = (storage, activeIndex, now) => {
         return storage.accounts.map((account, index) => ({
             index,
-            label: formatCommandAccountLabel(account, index),
+            label: formatCommandAccountLabel(account, index, {
+                peerAccounts: storage.accounts,
+            }),
             accountLabel: account.accountLabel,
             enabled: account.enabled !== false,
             isActive: index === activeIndex,
@@ -1137,6 +1180,44 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
             });
         }
     };
+    /**
+     * `loadAccounts()` reports a read or parse failure the same way it reports
+     * an absent file - by returning null - and a null load builds a manager
+     * holding zero accounts. Installing that over a working pool makes this
+     * process answer "No Codex accounts configured" while the accounts file on
+     * disk is intact, which cross-process lock contention makes reachable.
+     *
+     * Emptying the pool for real always goes through an explicit action
+     * (`codex-remove`, logout, a storage-mode switch); each installs its own
+     * manager rather than arriving here, so refusing the shrink costs a genuine
+     * deletion nothing.
+     */
+    const isUntrustworthyEmptyReload = (incumbent, reloaded) => incumbent !== null &&
+        incumbent !== reloaded &&
+        reloaded.getAccountCount() === 0 &&
+        incumbent.getAccountCount() > 0;
+    const EMPTY_RELOAD_RETRY_DELAY_MS = 2000;
+    const EMPTY_RELOAD_MAX_RETRIES = 3;
+    let emptyReloadRetries = 0;
+    let emptyReloadRetryTimer;
+    const cancelEmptyReloadRetry = () => {
+        clearTimeout(emptyReloadRetryTimer);
+        emptyReloadRetryTimer = undefined;
+        emptyReloadRetries = 0;
+    };
+    const scheduleEmptyReloadRetry = (retry) => {
+        if (emptyReloadRetries >= EMPTY_RELOAD_MAX_RETRIES) {
+            emptyReloadRetries = 0;
+            return;
+        }
+        emptyReloadRetries += 1;
+        clearTimeout(emptyReloadRetryTimer);
+        emptyReloadRetryTimer = setTimeout(() => {
+            emptyReloadRetryTimer = undefined;
+            void retry();
+        }, EMPTY_RELOAD_RETRY_DELAY_MS);
+        emptyReloadRetryTimer.unref();
+    };
     const reloadCachedAccountManager = async () => {
         if (!cachedAccountManager)
             return;
@@ -1155,6 +1236,13 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
         }
         try {
             const reloadedManager = await AccountManager.loadFromDisk();
+            if (isUntrustworthyEmptyReload(previous, reloadedManager)) {
+                reloadedManager.disposeShutdownHandler();
+                logWarn(`[${PLUGIN_NAME}] Account reload returned no accounts while ${previous.getAccountCount()} are held; keeping the loaded pool and retrying`);
+                scheduleEmptyReloadRetry(reloadCachedAccountManager);
+                return;
+            }
+            cancelEmptyReloadRetry();
             cachedAccountManager = reloadedManager;
             accountManagerPromise = Promise.resolve(reloadedManager);
             // Dispose only after the replacement is installed so we never leak
@@ -1166,6 +1254,35 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
             logWarn(`Failed to reload account manager: ${error instanceof Error ? error.message : String(error)}`);
         }
     };
+    /**
+     * Refills the cache after the fetch path refused an empty reload.
+     * `reloadCachedAccountManager` cannot serve here - it compares against
+     * the cached incumbent, which is exactly what is missing - so the
+     * incumbent the refusing request kept serving is passed in instead.
+     */
+    const repopulateAccountManagerCache = async (incumbent) => {
+        try {
+            const reloaded = await AccountManager.loadFromDisk();
+            if (cachedAccountManager) {
+                // Another actor repopulated first; the late load is stale and
+                // retires for the same reason the fetch path retires it.
+                if (cachedAccountManager !== reloaded)
+                    reloaded.disposeShutdownHandler();
+                return;
+            }
+            if (isUntrustworthyEmptyReload(incumbent, reloaded)) {
+                reloaded.disposeShutdownHandler();
+                scheduleEmptyReloadRetry(() => repopulateAccountManagerCache(incumbent));
+                return;
+            }
+            cancelEmptyReloadRetry();
+            cachedAccountManager = reloaded;
+            accountManagerPromise = Promise.resolve(reloaded);
+        }
+        catch (error) {
+            logWarn(`Failed to reload account manager: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    };
     let watchedAccountsPath;
     let observedAccountsDigest;
     let accountsReloadTimer;
@@ -1185,25 +1302,43 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
         accountsWatcherDisposed = true;
         unsubscribeAccountsPath?.();
         stopAccountsWatcher();
+        cancelEmptyReloadRetry();
         unregisterCleanup(disposeAccountsWatcher);
     };
-    const readAccountsDigest = async (path) => {
+    const readAccountsFileState = async (path) => {
         try {
             const content = await readFile(path, "utf8");
-            if (!AnyAccountStorageSchema.safeParse(JSON.parse(content)).success)
+            const data = JSON.parse(content);
+            if (!AnyAccountStorageSchema.safeParse(data).success)
                 return;
-            return createHash("sha256").update(content).digest("hex");
+            // Counted off the raw document rather than the parsed union so the
+            // count is the same for every storage version.
+            const accounts = data.accounts;
+            return {
+                digest: createHash("sha256").update(content).digest("hex"),
+                accountCount: Array.isArray(accounts) ? accounts.length : 0,
+            };
         }
         catch {
             return;
         }
     };
     const reloadForExternalAccountsChange = async (path, generation, attempt = 0, retired) => {
-        const digest = await readAccountsDigest(path);
-        if (generation !== accountsWatchGeneration || !digest || path !== getStoragePath())
+        const observed = await readAccountsFileState(path);
+        if (generation !== accountsWatchGeneration || !observed || path !== getStoragePath())
             return;
+        const digest = observed.digest;
         if (digest === consumeLastWrittenAccountsDigest(path))
             return;
+        const retryLater = () => {
+            if (attempt < 2 && generation === accountsWatchGeneration && !accountsWatcherDisposed) {
+                accountsReloadTimer = setTimeout(() => {
+                    accountsReloadTimer = undefined;
+                    void reloadForExternalAccountsChange(path, generation, attempt + 1, retired);
+                }, 1500);
+                accountsReloadTimer.unref();
+            }
+        };
         const previous = cachedAccountManager;
         try {
             // A null cache means an invalidation retired the incumbent; the
@@ -1224,6 +1359,19 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                 reloaded.disposeShutdownHandler();
                 return;
             }
+            // The file this reload observed carried accounts but the load
+            // produced none, so `loadAccounts()` failed to read it rather than
+            // the accounts having gone away - a failure it reports as an empty
+            // result, never as a throw, so the catch below cannot see it.
+            // Adopting it would answer "No Codex accounts configured" against an
+            // intact file; the retired incumbent still serves its accounts until
+            // a retry lands a real one.
+            if (observed.accountCount > 0 && reloaded.getAccountCount() === 0) {
+                reloaded.disposeShutdownHandler();
+                logWarn(`[${PLUGIN_NAME}] Externally changed accounts file holds ${observed.accountCount} account(s) but loaded as empty; keeping the current pool and retrying`);
+                retryLater();
+                return;
+            }
             const outgoing = cachedAccountManager;
             if (outgoing && outgoing !== retired) {
                 // Another actor replaced the cached manager while this reload
@@ -1240,13 +1388,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
         }
         catch {
             logWarn("Could not reload externally updated account storage");
-            if (attempt < 2 && generation === accountsWatchGeneration && !accountsWatcherDisposed) {
-                accountsReloadTimer = setTimeout(() => {
-                    accountsReloadTimer = undefined;
-                    void reloadForExternalAccountsChange(path, generation, attempt + 1, retired);
-                }, 1500);
-                accountsReloadTimer.unref();
-            }
+            retryLater();
             return;
         }
         logDebug("Reloaded cached account manager after external accounts file change");
@@ -1262,9 +1404,10 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
         if (!path)
             return;
         const generation = accountsWatchGeneration;
-        const digest = await readAccountsDigest(path);
-        if (generation !== accountsWatchGeneration || !digest || digest === observedAccountsDigest)
+        const observed = await readAccountsFileState(path);
+        if (generation !== accountsWatchGeneration || !observed || observed.digest === observedAccountsDigest)
             return;
+        const digest = observed.digest;
         observedAccountsDigest = digest;
         clearTimeout(accountsReloadTimer);
         accountsReloadTimer = undefined;
@@ -1293,10 +1436,10 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
         });
         watchedAccountsPath = path;
         const generation = accountsWatchGeneration;
-        const initialDigest = await readAccountsDigest(path);
+        const initial = await readAccountsFileState(path);
         if (generation !== accountsWatchGeneration)
             return;
-        observedAccountsDigest = initialDigest;
+        observedAccountsDigest = initial?.digest;
         // Stat polling follows the path across the storage writer's temp-file rename.
         watchFile(path, { interval: 1500, persistent: false }, onAccountsStatChanged);
         unregisterCleanup(disposeAccountsWatcher);
@@ -1591,9 +1734,8 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                             retryAllAccountsMaxRetries: Math.min(1, getRetryAllAccountsMaxRetries(pluginConfig)),
                         });
                     }
-                    const prewarmEnabled = process.env.CODEX_AUTH_PREWARM !== "0" &&
-                        process.env.VITEST !== "true" &&
-                        process.env.NODE_ENV !== "test";
+                    const underTestRunner = process.env.VITEST === "true" || process.env.NODE_ENV === "test";
+                    const prewarmEnabled = process.env.CODEX_AUTH_PREWARM !== "0" && !underTestRunner;
                     if (!startupPrewarmTriggered && prewarmEnabled && getRequestTransformMode(pluginConfig) === "legacy") {
                         startupPrewarmTriggered = true;
                         const configuredModels = Object.keys(userConfig.models ?? {});
@@ -1605,9 +1747,24 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                     const recoveryHook = sessionRecoveryEnabled
                         ? createSessionRecoveryHook({ client, directory: process.cwd() }, { sessionRecovery: true, autoResume: autoResumeEnabled })
                         : null;
+                    const pluginOrigin = getPluginOrigin();
+                    if (pluginOrigin && !startupOriginRecorded) {
+                        startupOriginRecorded = true;
+                        if (pluginOrigin.isLocalCheckout) {
+                            logInfo(`Running from ${describePluginOrigin(pluginOrigin)}`);
+                        }
+                        if (!underTestRunner) {
+                            recordPluginOrigin(pluginOrigin).catch((err) => {
+                                logDebug(`Failed to record plugin origin: ${err instanceof Error ? err.message : String(err)}`);
+                            });
+                        }
+                    }
                     checkAndNotify(async (message, variant) => {
                         await showToast(message, variant);
-                    }, { autoUpdate: autoUpdateEnabled }).catch((err) => {
+                    }, {
+                        autoUpdate: autoUpdateEnabled,
+                        localCheckout: pluginOrigin?.isLocalCheckout ?? false,
+                    }).catch((err) => {
                         logDebug(`Update check failed: ${err instanceof Error ? err.message : String(err)}`);
                     });
                     await runStartupPreflight();
@@ -1794,9 +1951,18 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                     runtimeMetrics.promptCacheMissingRequests++;
                                 }
                                 const retryBudget = new RetryBudgetTracker(retryBudgetLimits);
-                                const consumeRetryBudget = (bucket, reason) => {
-                                    if (retryBudget.consume(bucket)) {
-                                        runtimeMetrics.retryBudgetUsage[bucket] += 1;
+                                const consumeRetryBudget = (bucket, reason, waitMs) => {
+                                    // Pass the wait so the charge scales with how long the retry
+                                    // blocks. Metrics follow the tracker's own counter rather than
+                                    // assuming one unit, or a free sub-second wait would report
+                                    // budget it never spent.
+                                    const usedBefore = retryBudget.getUsage()[bucket];
+                                    const granted = waitMs === undefined
+                                        ? retryBudget.consume(bucket)
+                                        : retryBudget.consumeWait(bucket, waitMs);
+                                    if (granted) {
+                                        runtimeMetrics.retryBudgetUsage[bucket] +=
+                                            retryBudget.getUsage()[bucket] - usedBefore;
                                         return true;
                                     }
                                     runtimeMetrics.retryBudgetExhaustions += 1;
@@ -1837,27 +2003,69 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                     };
                                     abortSignal?.addEventListener("abort", onAbort, { once: true });
                                 });
-                                const sleepWithCountdown = async (totalMs, message, intervalMs = 5000) => {
+                                const sleepWithCountdown = async (totalMs, message, intervalMs = 5000, probeUpstream) => {
                                     const startTime = Date.now();
                                     const endTime = startTime + totalMs;
+                                    let probeDelayMs = UPSTREAM_REPROBE_FIRST_DELAY_MS;
+                                    let nextProbeAt = probeUpstream && totalMs >= UPSTREAM_REPROBE_MIN_WAIT_MS
+                                        ? startTime + probeDelayMs
+                                        : Number.POSITIVE_INFINITY;
                                     while (Date.now() < endTime) {
                                         if (cachedAccountManager !== accountManager)
                                             return;
                                         if (abortSignal?.aborted) {
                                             throw abortError();
                                         }
+                                        if (probeUpstream && Date.now() >= nextProbeAt) {
+                                            if (await probeUpstream())
+                                                return;
+                                            if (cachedAccountManager !== accountManager)
+                                                return;
+                                            if (abortSignal?.aborted) {
+                                                throw abortError();
+                                            }
+                                            probeDelayMs = Math.min(probeDelayMs * 2, UPSTREAM_REPROBE_MAX_DELAY_MS);
+                                            // Measured from the end of the probe, so a slow usage
+                                            // request cannot schedule the next one in the past and
+                                            // collapse the countdown sleep below to zero.
+                                            nextProbeAt = Date.now() + probeDelayMs;
+                                        }
                                         const remaining = Math.max(0, endTime - Date.now());
                                         const waitLabel = formatWaitTime(remaining);
                                         await showToast(`${message} (${waitLabel} remaining)`, "warning", { duration: Math.min(intervalMs + 1000, toastDurationMs) });
-                                        const sleepTime = Math.min(intervalMs, remaining);
+                                        const sleepTime = Math.min(intervalMs, remaining, nextProbeAt - Date.now());
                                         if (sleepTime > 0) {
                                             await sleep(sleepTime);
                                         }
                                         else {
-                                            break;
+                                            continue;
                                         }
                                     }
                                 };
+                                /**
+                                 * True when an all-accounts wait can stop early.
+                                 *
+                                 * `runNow` refreshes `/wham/usage` for every account and persists
+                                 * whatever it finds, so a reset that never touched local disk
+                                 * becomes visible here. Persisting a recovery also drops the cached
+                                 * manager, which is what makes the enclosing retry loop re-resolve
+                                 * one that no longer reports a block.
+                                 */
+                                const probeUpstreamBlockLifted = async () => {
+                                    try {
+                                        await quotaMonitor.runNow();
+                                    }
+                                    catch (error) {
+                                        logDebug(`[${PLUGIN_NAME}] Upstream quota re-probe failed: ${error instanceof Error ? error.message : String(error)}`);
+                                        return false;
+                                    }
+                                    if (cachedAccountManager !== accountManager)
+                                        return true;
+                                    const manager = accountManager;
+                                    if (!manager)
+                                        return false;
+                                    return manager.getMinWaitTimeForFamily(modelFamily, model) === 0;
+                                };
                                 let allRateLimitedRetries = 0;
                                 let emptyResponseRetries = 0;
                                 const attemptedUnsupportedFallbackModels = new Set();
@@ -1940,9 +2148,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                     }
                                 };
                                 // A degraded model must not degrade again without bound, even if a
-                                // custom chain is cyclic. The attempted set already prevents
-                                // revisiting a model; this caps the total hops per request.
-                                const MAX_QUOTA_FALLBACK_SWITCHES = 3;
+                                // custom chain is cyclic. See MAX_QUOTA_FALLBACK_SWITCHES.
                                 let quotaFallbackSwitches = 0;
                                 while (true) {
                                     if (cachedAccountManager && cachedAccountManager !== accountManager) {
@@ -1965,7 +2171,8 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                                     accountManagerPromise = null;
                                             });
                                         }
-                                        const reloaded = await accountManagerPromise;
+                                        const loading = accountManagerPromise;
+                                        const reloaded = await loading;
                                         if (cachedAccountManager) {
                                             if (cachedAccountManager !== reloaded) {
                                                 // The cache was repopulated while this load was in
@@ -1977,6 +2184,20 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                             }
                                             accountManager = cachedAccountManager;
                                         }
+                                        else if (accountManager && isUntrustworthyEmptyReload(accountManager, reloaded)) {
+                                            // The incumbent this request holds still has accounts, so
+                                            // the empty result is a failed `loadAccounts()` read rather
+                                            // than a real removal (same refusal as
+                                            // reloadCachedAccountManager). Keep serving the incumbent
+                                            // and drop the resolved promise so the next pass re-reads
+                                            // disk instead of adopting this same empty manager.
+                                            reloaded.disposeShutdownHandler();
+                                            if (accountManagerPromise === loading)
+                                                accountManagerPromise = null;
+                                            logWarn(`[${PLUGIN_NAME}] Account reload returned no accounts while ${accountManager.getAccountCount()} are held; keeping the loaded pool and retrying`);
+                                            const incumbent = accountManager;
+                                            scheduleEmptyReloadRetry(() => repopulateAccountManagerCache(incumbent));
+                                        }
                                         else {
                                             cachedAccountManager = reloaded;
                                             accountManager = reloaded;
@@ -2098,6 +2319,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                             const failures = await accountManager.incrementAuthFailures(account);
                                             const accountLabel = formatAccountLabel(account, account.index, {
                                                 maskEmail: maskEmailEnabled,
+                                                peerAccounts: accountManager.getAccountsSnapshot(),
                                             });
                                             if (failures >= ACCOUNT_LIMITS.MAX_AUTH_FAILURES_BEFORE_REMOVAL) {
                                                 const removedCount = accountManager.removeAccountsWithSameRefreshToken(account);
@@ -2147,6 +2369,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                             accountManager.shouldShowAccountToast(account.index, rateLimitToastDebounceMs)) {
                                             const accountLabel = formatAccountLabel(account, account.index, {
                                                 maskEmail: maskEmailEnabled,
+                                                peerAccounts: accountManager.getAccountsSnapshot(),
                                             });
                                             await showToast(`Using ${accountLabel} (${account.index + 1}/${accountCount})`, "info");
                                             accountManager.markToastShown(account.index);
@@ -2334,7 +2557,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                             // only the block would leave the status line reporting "0% left" for
                                             // an account the router considers healthy.
                                             const recordQuotaHeaders = () => {
-                                                void recordPromptQuotaHeaders(response, account, accountCount);
+                                                void recordPromptQuotaHeaders(response, account, accountCount, accountManager.getAccountsSnapshot());
                                                 return applyQuotaExhaustion(accountManager, response.headers, account, modelFamily, model);
                                             };
                                             if (response.ok) {
@@ -2354,6 +2577,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                                 if (workspaceDeactivated) {
                                                     const accountLabel = formatAccountLabel(account, account.index, {
                                                         maskEmail: maskEmailEnabled,
+                                                        peerAccounts: accountManager.getAccountsSnapshot(),
                                                     });
                                                     accountManager.refundToken(account, modelFamily, model);
                                                     accountManager.recordFailure(account, modelFamily, model);
@@ -2567,6 +2791,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                                 if (isInvalidatedAuthTokenError(errorBody, response.status)) {
                                                     const accountLabel = formatAccountLabel(account, account.index, {
                                                         maskEmail: maskEmailEnabled,
+                                                        peerAccounts: accountManager.getAccountsSnapshot(),
                                                     });
                                                     accountManager.refundToken(account, modelFamily, model);
                                                     accountManager.recordFailure(account, modelFamily, model);
@@ -2838,9 +3063,9 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                         (retryAllAccountsMaxWaitMs === 0 ||
                                             waitMs <= retryAllAccountsMaxWaitMs) &&
                                         allRateLimitedRetries < retryAllAccountsMaxRetries &&
-                                        consumeRetryBudget("rateLimitGlobal", `All accounts rate-limited wait ${waitMs}ms`)) {
+                                        consumeRetryBudget("rateLimitGlobal", `All accounts rate-limited wait ${waitMs}ms`, waitMs)) {
                                         const countdownMessage = `All ${count} account(s) rate-limited. Waiting`;
-                                        await sleepWithCountdown(addJitter(waitMs, 0.2), countdownMessage);
+                                        await sleepWithCountdown(addJitter(waitMs, 0.2), countdownMessage, undefined, probeUpstreamBlockLifted);
                                         allRateLimitedRetries++;
                                         continue;
                                     }
@@ -2943,19 +3168,20 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                 message.includes("invalid refresh") ||
                                 message.includes("token has been revoked"));
                         };
+                        const authQuotaDisplay = getQuotaDisplay(authPluginConfig);
                         const formatCodexQuotaLine = (usage) => {
                             const parts = [];
                             for (const window of [usage.primary, usage.secondary]) {
                                 if (!hasUsageWindow(window))
                                     continue;
-                                parts.push(`${formatUsageLimitTitle(window.windowMinutes)} ${formatUsageLimitSummary(window)}`);
+                                parts.push(`${formatUsageLimitTitle(window.windowMinutes)} ${formatUsageLimitSummary(window, authQuotaDisplay)}`);
                             }
                             if (hasUsageWindow(usage.codeReview)) {
-                                parts.push(`Code review ${formatUsageLimitSummary(usage.codeReview)}`);
+                                parts.push(`Code review ${formatUsageLimitSummary(usage.codeReview, authQuotaDisplay)}`);
                             }
                             for (const limit of usage.additionalLimits) {
                                 if (hasUsageWindow(limit.window)) {
-                                    parts.push(`${limit.name} ${formatUsageLimitSummary(limit.window)}`);
+                                    parts.push(`${limit.name} ${formatUsageLimitSummary(limit.window, authQuotaDisplay)}`);
                                 }
                             }
                             const planLabel = formatPlanType(usage.planType);
@@ -3127,8 +3353,17 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                     }
                                     if (deepProbe) {
                                         ok += 1;
-                                        const detail = tokenAccountId
-                                            ? `${authDetail} (id:${tokenAccountId.slice(-6)})`
+                                        // Both read from the probed token, so the pair is the seat
+                                        // the credential actually belongs to. The workspace id
+                                        // alone repeats across every member of a Business
+                                        // workspace and cannot confirm which seat answered.
+                                        const tokenSeat = formatSeatSuffix(extractAccountUserId(accessToken), workingStorage.accounts.map((peer) => peer?.accountUserId));
+                                        const identity = [
+                                            tokenAccountId ? `id:${tokenAccountId.slice(-6)}` : undefined,
+                                            tokenSeat ? `seat:${tokenSeat}` : undefined,
+                                        ].filter((part) => part !== undefined);
+                                        const detail = identity.length > 0
+                                            ? `${authDetail} (${identity.join(", ")})`
                                             : authDetail;
                                         console.log(`[${i + 1}/${total}] ${label}: ${detail}`);
                                         continue;
@@ -3146,7 +3381,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                             organizationId: account.organizationId,
                                             normalizeAccountErrors: true,
                                         });
-                                        const usage = parseCodexUsagePayload(payload);
+                                        const usage = parseCodexUsagePayload(payload, authQuotaDisplay);
                                         ok += 1;
                                         console.log(`[${i + 1}/${total}] ${label}: ${formatCodexQuotaLine(usage)}`);
                                     }
@@ -3422,6 +3657,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                     }
                                     return {
                                         accountId: account.accountId,
+                                        accountUserId: account.accountUserId,
                                         accountLabel: account.accountLabel,
                                         email: account.email,
                                         index,