opencode-openai-codex-auth-multi 4.3.0-multiaccount.1 → 4.5.0

package/dist/index.js

@@ -19,22 +19,24 @@
  *
  * @license MIT with Usage Disclaimer (see LICENSE file)
  * @author numman-ali
- * @repository https://github.com/ndycode/opencode-openai-codex-auth-multiaccount
+ * @repository https://github.com/ndycode/opencode-openai-codex-auth-multi
 
  */
 import { tool } from "@opencode-ai/plugin";
 import { createAuthorizationFlow, exchangeAuthorizationCode, parseAuthorizationInput, REDIRECT_URI, } from "./lib/auth/auth.js";
+import { queuedRefresh } from "./lib/refresh-queue.js";
 import { openBrowserUrl } from "./lib/auth/browser.js";
 import { startLocalOAuthServer } from "./lib/auth/server.js";
 import { promptAddAnotherAccount, promptLoginMode } from "./lib/cli.js";
-import { getCodexMode, loadPluginConfig } from "./lib/config.js";
-import { AUTH_LABELS, CODEX_BASE_URL, DUMMY_API_KEY, LOG_STAGES, PLUGIN_NAME, PROVIDER_ID, } from "./lib/constants.js";
+import { getCodexMode, getRateLimitToastDebounceMs, getRetryAllAccountsMaxRetries, getRetryAllAccountsMaxWaitMs, getRetryAllAccountsRateLimited, getTokenRefreshSkewMs, loadPluginConfig, } from "./lib/config.js";
+import { AUTH_LABELS, CODEX_BASE_URL, DUMMY_API_KEY, LOG_STAGES, PLUGIN_NAME, PROVIDER_ID, ACCOUNT_LIMITS, } from "./lib/constants.js";
 import { logRequest, logDebug } from "./lib/logger.js";
-import { AccountManager, extractAccountId, formatAccountLabel, formatCooldown, formatWaitTime, } from "./lib/accounts.js";
+import { checkAndNotify } from "./lib/auto-update-checker.js";
+import { AccountManager, extractAccountEmail, extractAccountId, formatAccountLabel, formatCooldown, formatWaitTime, sanitizeEmail, } from "./lib/accounts.js";
 import { getStoragePath, loadAccounts, saveAccounts } from "./lib/storage.js";
 import { createCodexHeaders, extractRequestUrl, handleErrorResponse, handleSuccessResponse, refreshAndUpdateToken, rewriteUrlForCodex, shouldRefreshToken, transformRequestForCodex, } from "./lib/request/fetch-helpers.js";
-const MAX_OAUTH_ACCOUNTS = 10;
-const AUTH_FAILURE_COOLDOWN_MS = 30_000;
+import { getRateLimitBackoff, RATE_LIMIT_SHORT_RETRY_THRESHOLD_MS, resetRateLimitBackoff, } from "./lib/request/rate-limit-backoff.js";
+import { getModelFamily, MODEL_FAMILIES } from "./lib/prompts/codex.js";
 /**
  * OpenAI Codex OAuth authentication plugin for opencode
  *
@@ -45,7 +47,7 @@ const AUTH_FAILURE_COOLDOWN_MS = 30_000;
  * @example
  * ```json
  * {
- *   "plugin": ["opencode-openai-codex-auth-multiaccount"],
+ *   "plugin": ["opencode-openai-codex-auth-multi"],
 
  *   "model": "openai/gpt-5-codex"
  * }
@@ -60,7 +62,7 @@ export const OpenAIAuthPlugin = async ({ client }) => {
         callback: async (input) => {
             const parsed = parseAuthorizationInput(input);
             if (!parsed.code) {
-                return { type: "failed" };
+                return { type: "failed", reason: "invalid_response", message: "No authorization code provided" };
             }
             const tokens = await exchangeAuthorizationCode(parsed.code, pkce.verifier, REDIRECT_URI);
             if (tokens?.type === "success" && onSuccess) {
@@ -82,7 +84,7 @@ export const OpenAIAuthPlugin = async ({ client }) => {
             rl.close();
         }
     };
-    const runManualOAuthFlow = async (pkce, url) => {
+    const runManualOAuthFlow = async (pkce, _url) => {
         console.log("1. Open the URL above in your browser and sign in.");
         console.log("2. After approving, copy the full redirect URL.");
         console.log("3. Paste it back here.\n");
@@ -93,8 +95,8 @@ export const OpenAIAuthPlugin = async ({ client }) => {
         }
         return await exchangeAuthorizationCode(parsed.code, pkce.verifier, REDIRECT_URI);
     };
-    const runOAuthFlow = async (useManualMode) => {
-        const { pkce, state, url } = await createAuthorizationFlow();
+    const runOAuthFlow = async (useManualMode, forceNewLogin = false) => {
+        const { pkce, state, url } = await createAuthorizationFlow({ forceNewLogin });
         console.log("\nOAuth URL:\n" + url + "\n");
         if (useManualMode) {
             openBrowserUrl(url);
@@ -104,7 +106,8 @@ export const OpenAIAuthPlugin = async ({ client }) => {
         try {
             serverInfo = await startLocalOAuthServer({ state });
         }
-        catch {
+        catch (err) {
+            logDebug(`[${PLUGIN_NAME}] Failed to start OAuth server: ${err?.message ?? String(err)}`);
             serverInfo = null;
         }
         openBrowserUrl(url);
@@ -115,7 +118,7 @@ export const OpenAIAuthPlugin = async ({ client }) => {
         const result = await serverInfo.waitForCode(state);
         serverInfo.close();
         if (!result) {
-            return { type: "failed" };
+            return { type: "failed", reason: "unknown", message: "OAuth callback timeout or cancelled" };
         }
         return await exchangeAuthorizationCode(result.code, pkce.verifier, REDIRECT_URI);
     };
@@ -127,6 +130,7 @@ export const OpenAIAuthPlugin = async ({ client }) => {
         const accounts = stored?.accounts ? [...stored.accounts] : [];
         const indexByRefreshToken = new Map();
         const indexByAccountId = new Map();
+        const indexByEmail = new Map();
         for (let i = 0; i < accounts.length; i += 1) {
             const account = accounts[i];
             if (!account)
@@ -137,18 +141,26 @@ export const OpenAIAuthPlugin = async ({ client }) => {
             if (account.accountId) {
                 indexByAccountId.set(account.accountId, i);
             }
+            if (account.email) {
+                indexByEmail.set(account.email, i);
+            }
         }
         for (const result of results) {
             const accountId = extractAccountId(result.access);
+            const accountEmail = sanitizeEmail(extractAccountEmail(result.access));
+            const existingByEmail = accountEmail && indexByEmail.has(accountEmail)
+                ? indexByEmail.get(accountEmail)
+                : undefined;
             const existingById = accountId && indexByAccountId.has(accountId)
                 ? indexByAccountId.get(accountId)
                 : undefined;
             const existingByToken = indexByRefreshToken.get(result.refresh);
-            const existingIndex = existingById ?? existingByToken;
+            const existingIndex = existingById ?? existingByEmail ?? existingByToken;
             if (existingIndex === undefined) {
                 const newIndex = accounts.length;
                 accounts.push({
                     accountId,
+                    email: accountEmail,
                     refreshToken: result.refresh,
                     addedAt: now,
                     lastUsed: now,
@@ -157,15 +169,21 @@ export const OpenAIAuthPlugin = async ({ client }) => {
                 if (accountId) {
                     indexByAccountId.set(accountId, newIndex);
                 }
+                if (accountEmail) {
+                    indexByEmail.set(accountEmail, newIndex);
+                }
                 continue;
             }
             const existing = accounts[existingIndex];
             if (!existing)
                 continue;
             const oldToken = existing.refreshToken;
+            const oldEmail = existing.email;
+            const nextEmail = accountEmail ?? existing.email;
             accounts[existingIndex] = {
                 ...existing,
                 accountId: accountId ?? existing.accountId,
+                email: nextEmail,
                 refreshToken: result.refresh,
                 lastUsed: now,
             };
@@ -176,6 +194,12 @@ export const OpenAIAuthPlugin = async ({ client }) => {
             if (accountId) {
                 indexByAccountId.set(accountId, existingIndex);
             }
+            if (oldEmail && oldEmail !== nextEmail) {
+                indexByEmail.delete(oldEmail);
+            }
+            if (nextEmail) {
+                indexByEmail.set(nextEmail, existingIndex);
+            }
         }
         if (accounts.length === 0)
             return;
@@ -184,10 +208,22 @@ export const OpenAIAuthPlugin = async ({ client }) => {
             : typeof stored?.activeIndex === "number" && Number.isFinite(stored.activeIndex)
                 ? stored.activeIndex
                 : 0;
+        const clampedActiveIndex = Math.max(0, Math.min(activeIndex, accounts.length - 1));
+        const activeIndexByFamily = {};
+        for (const family of MODEL_FAMILIES) {
+            const storedFamilyIndex = stored?.activeIndexByFamily?.[family];
+            const rawFamilyIndex = replaceAll
+                ? 0
+                : typeof storedFamilyIndex === "number" && Number.isFinite(storedFamilyIndex)
+                    ? storedFamilyIndex
+                    : clampedActiveIndex;
+            activeIndexByFamily[family] = Math.max(0, Math.min(Math.floor(rawFamilyIndex), accounts.length - 1));
+        }
         await saveAccounts({
-            version: 1,
+            version: 3,
             accounts,
-            activeIndex: Math.max(0, Math.min(activeIndex, accounts.length - 1)),
+            activeIndex: clampedActiveIndex,
+            activeIndexByFamily,
         });
     };
     const showToast = async (message, variant = "success") => {
@@ -203,17 +239,79 @@ export const OpenAIAuthPlugin = async ({ client }) => {
             // Ignore when TUI is not available.
         }
     };
-    const resolveActiveIndex = (storage) => {
+    const resolveActiveIndex = (storage, family = "codex") => {
         const total = storage.accounts.length;
         if (total === 0)
             return 0;
-        const raw = Number.isFinite(storage.activeIndex) ? storage.activeIndex : 0;
+        const rawCandidate = storage.activeIndexByFamily?.[family] ?? storage.activeIndex;
+        const raw = Number.isFinite(rawCandidate) ? rawCandidate : 0;
         return Math.max(0, Math.min(raw, total - 1));
     };
-    const formatRateLimitEntry = (account, now) => {
-        if (typeof account.rateLimitResetTime !== "number")
+    const hydrateEmails = async (storage) => {
+        if (!storage)
+            return storage;
+        const skipHydrate = process.env.VITEST_WORKER_ID !== undefined ||
+            process.env.NODE_ENV === "test" ||
+            process.env.OPENCODE_SKIP_EMAIL_HYDRATE === "1";
+        if (skipHydrate)
+            return storage;
+        const accountsToHydrate = storage.accounts.filter((account) => account && !account.email);
+        if (accountsToHydrate.length === 0)
+            return storage;
+        let changed = false;
+        await Promise.all(accountsToHydrate.map(async (account) => {
+            try {
+                const refreshed = await queuedRefresh(account.refreshToken);
+                if (refreshed.type !== "success")
+                    return;
+                const id = extractAccountId(refreshed.access);
+                const email = sanitizeEmail(extractAccountEmail(refreshed.access));
+                if (id && id !== account.accountId) {
+                    account.accountId = id;
+                    changed = true;
+                }
+                if (email && email !== account.email) {
+                    account.email = email;
+                    changed = true;
+                }
+                if (refreshed.refresh && refreshed.refresh !== account.refreshToken) {
+                    account.refreshToken = refreshed.refresh;
+                    changed = true;
+                }
+            }
+            catch {
+                logDebug(`[${PLUGIN_NAME}] Failed to hydrate email for account`);
+            }
+        }));
+        if (changed) {
+            await saveAccounts(storage);
+        }
+        return storage;
+    };
+    const getRateLimitResetTimeForFamily = (account, now, family) => {
+        const times = account.rateLimitResetTimes;
+        if (!times)
             return null;
-        const remaining = account.rateLimitResetTime - now;
+        let minReset = null;
+        const prefix = `${family}:`;
+        for (const [key, value] of Object.entries(times)) {
+            if (typeof value !== "number")
+                continue;
+            if (value <= now)
+                continue;
+            if (key !== family && !key.startsWith(prefix))
+                continue;
+            if (minReset === null || value < minReset) {
+                minReset = value;
+            }
+        }
+        return minReset;
+    };
+    const formatRateLimitEntry = (account, now, family = "codex") => {
+        const resetAt = getRateLimitResetTimeForFamily(account, now, family);
+        if (typeof resetAt !== "number")
+            return null;
+        const remaining = resetAt - now;
         if (remaining <= 0)
             return null;
         return `resets in ${formatWaitTime(remaining)}`;
@@ -243,13 +341,9 @@ export const OpenAIAuthPlugin = async ({ client }) => {
                 }
                 const accountManager = await AccountManager.loadFromDisk(auth);
                 cachedAccountManager = accountManager;
-                const storedSnapshot = await loadAccounts();
                 const refreshToken = auth.type === "oauth" ? auth.refresh : "";
-                const needsPersist = !storedSnapshot ||
-                    storedSnapshot.accounts.length !==
-                        accountManager.getAccountCount() ||
-                    (refreshToken &&
-                        !storedSnapshot.accounts.some((account) => account.refreshToken === refreshToken));
+                const needsPersist = refreshToken &&
+                    !accountManager.hasRefreshToken(refreshToken);
                 if (needsPersist) {
                     await accountManager.saveToDisk();
                 }
@@ -267,6 +361,14 @@ export const OpenAIAuthPlugin = async ({ client }) => {
                 // Priority: CODEX_MODE env var > config file > default (true)
                 const pluginConfig = loadPluginConfig();
                 const codexMode = getCodexMode(pluginConfig);
+                const tokenRefreshSkewMs = getTokenRefreshSkewMs(pluginConfig);
+                const rateLimitToastDebounceMs = getRateLimitToastDebounceMs(pluginConfig);
+                const retryAllAccountsRateLimited = getRetryAllAccountsRateLimited(pluginConfig);
+                const retryAllAccountsMaxWaitMs = getRetryAllAccountsMaxWaitMs(pluginConfig);
+                const retryAllAccountsMaxRetries = getRetryAllAccountsMaxRetries(pluginConfig);
+                checkAndNotify(async (message, variant) => {
+                    await showToast(message, variant);
+                }).catch(() => { });
                 // Return SDK configuration
                 return {
                     apiKey: DUMMY_API_KEY,
@@ -300,83 +402,138 @@ export const OpenAIAuthPlugin = async ({ client }) => {
                         const requestInit = transformation?.updatedInit ?? init;
                         const promptCacheKey = transformation?.body?.prompt_cache_key;
                         const model = transformation?.body.model;
-                        const accountCount = accountManager.getAccountCount();
-                        const attempted = new Set();
-                        while (attempted.size < Math.max(1, accountCount)) {
-                            const account = accountManager.getCurrentOrNext();
-                            if (!account || attempted.has(account.index)) {
-                                break;
+                        const modelFamily = model ? getModelFamily(model) : "gpt-5.1";
+                        const quotaKey = model ? `${modelFamily}:${model}` : modelFamily;
+                        const abortSignal = requestInit?.signal ?? init?.signal ?? null;
+                        const sleep = (ms) => new Promise((resolve, reject) => {
+                            if (abortSignal?.aborted) {
+                                reject(new Error("Aborted"));
+                                return;
                             }
-                            attempted.add(account.index);
-                            let accountAuth = accountManager.toAuthDetails(account);
-                            try {
-                                if (shouldRefreshToken(accountAuth)) {
-                                    accountAuth = (await refreshAndUpdateToken(accountAuth, client));
-                                    accountManager.updateFromAuth(account, accountAuth);
-                                    await accountManager.saveToDisk();
+                            const timeout = setTimeout(() => {
+                                cleanup();
+                                resolve();
+                            }, ms);
+                            const onAbort = () => {
+                                cleanup();
+                                reject(new Error("Aborted"));
+                            };
+                            const cleanup = () => {
+                                clearTimeout(timeout);
+                                abortSignal?.removeEventListener("abort", onAbort);
+                            };
+                            abortSignal?.addEventListener("abort", onAbort, { once: true });
+                        });
+                        let allRateLimitedRetries = 0;
+                        while (true) {
+                            const accountCount = accountManager.getAccountCount();
+                            const attempted = new Set();
+                            while (attempted.size < Math.max(1, accountCount)) {
+                                const account = accountManager.getCurrentOrNextForFamilyHybrid(modelFamily, model);
+                                if (!account || attempted.has(account.index)) {
+                                    break;
                                 }
-                            }
-                            catch (error) {
-                                accountManager.markAccountCoolingDown(account, AUTH_FAILURE_COOLDOWN_MS, "auth-failure");
-                                await accountManager.saveToDisk();
-                                continue;
-                            }
-                            const accountId = account.accountId ?? extractAccountId(accountAuth.access);
-                            if (!accountId) {
-                                accountManager.markAccountCoolingDown(account, AUTH_FAILURE_COOLDOWN_MS, "auth-failure");
-                                await accountManager.saveToDisk();
-                                continue;
-                            }
-                            account.accountId = accountId;
-                            if (accountCount > 1 &&
-                                accountManager.shouldShowAccountToast(account.index)) {
-                                const accountLabel = formatAccountLabel(account.accountId, account.index);
-                                await showToast(`Using ${accountLabel} (${account.index + 1}/${accountCount})`, "info");
-                                accountManager.markToastShown(account.index);
-                            }
-                            const headers = createCodexHeaders(requestInit, accountId, accountAuth.access, {
-                                model,
-                                promptCacheKey,
-                            });
-                            const response = await fetch(url, {
-                                ...requestInit,
-                                headers,
-                            });
-                            logRequest(LOG_STAGES.RESPONSE, {
-                                status: response.status,
-                                ok: response.ok,
-                                statusText: response.statusText,
-                                headers: Object.fromEntries(response.headers.entries()),
-                            });
-                            if (!response.ok) {
-                                const { response: errorResponse, rateLimit } = await handleErrorResponse(response);
-                                if (rateLimit) {
-                                    accountManager.markRateLimited(account, rateLimit.retryAfterMs);
-                                    accountManager.markSwitched(account, "rate-limit");
-                                    await accountManager.saveToDisk();
-                                    if (accountManager.getAccountCount() > 1 &&
-                                        accountManager.shouldShowAccountToast(account.index)) {
-                                        await showToast("Rate limit reached. Switching accounts.", "warning");
-                                        accountManager.markToastShown(account.index);
+                                attempted.add(account.index);
+                                let accountAuth = accountManager.toAuthDetails(account);
+                                try {
+                                    if (shouldRefreshToken(accountAuth, tokenRefreshSkewMs)) {
+                                        accountAuth = (await refreshAndUpdateToken(accountAuth, client));
+                                        accountManager.updateFromAuth(account, accountAuth);
+                                        accountManager.saveToDiskDebounced();
                                     }
+                                }
+                                catch (err) {
+                                    logDebug(`[${PLUGIN_NAME}] Auth refresh failed for account: ${err?.message ?? String(err)}`);
+                                    accountManager.markAccountCoolingDown(account, ACCOUNT_LIMITS.AUTH_FAILURE_COOLDOWN_MS, "auth-failure");
+                                    accountManager.saveToDiskDebounced();
                                     continue;
                                 }
-                                return errorResponse;
+                                const accountId = account.accountId ?? extractAccountId(accountAuth.access);
+                                if (!accountId) {
+                                    accountManager.markAccountCoolingDown(account, ACCOUNT_LIMITS.AUTH_FAILURE_COOLDOWN_MS, "auth-failure");
+                                    accountManager.saveToDiskDebounced();
+                                    continue;
+                                }
+                                account.accountId = accountId;
+                                account.email =
+                                    extractAccountEmail(accountAuth.access) ?? account.email;
+                                if (accountCount > 1 &&
+                                    accountManager.shouldShowAccountToast(account.index, rateLimitToastDebounceMs)) {
+                                    const accountLabel = formatAccountLabel(account, account.index);
+                                    await showToast(`Using ${accountLabel} (${account.index + 1}/${accountCount})`, "info");
+                                    accountManager.markToastShown(account.index);
+                                }
+                                const headers = createCodexHeaders(requestInit, accountId, accountAuth.access, {
+                                    model,
+                                    promptCacheKey,
+                                });
+                                while (true) {
+                                    const response = await fetch(url, {
+                                        ...requestInit,
+                                        headers,
+                                    });
+                                    logRequest(LOG_STAGES.RESPONSE, {
+                                        status: response.status,
+                                        ok: response.ok,
+                                        statusText: response.statusText,
+                                        headers: Object.fromEntries(response.headers.entries()),
+                                    });
+                                    if (!response.ok) {
+                                        const { response: errorResponse, rateLimit } = await handleErrorResponse(response);
+                                        if (rateLimit) {
+                                            const { attempt, delayMs } = getRateLimitBackoff(account.index, quotaKey, rateLimit.retryAfterMs);
+                                            const waitLabel = formatWaitTime(delayMs);
+                                            if (delayMs <= RATE_LIMIT_SHORT_RETRY_THRESHOLD_MS) {
+                                                if (accountManager.shouldShowAccountToast(account.index, rateLimitToastDebounceMs)) {
+                                                    await showToast(`Rate limited. Retrying in ${waitLabel} (attempt ${attempt})...`, "warning");
+                                                    accountManager.markToastShown(account.index);
+                                                }
+                                                await sleep(delayMs);
+                                                continue;
+                                            }
+                                            accountManager.markRateLimited(account, delayMs, modelFamily, model);
+                                            accountManager.recordRateLimit(account, modelFamily, model);
+                                            account.lastSwitchReason = "rate-limit";
+                                            accountManager.saveToDiskDebounced();
+                                            if (accountManager.getAccountCount() > 1 &&
+                                                accountManager.shouldShowAccountToast(account.index, rateLimitToastDebounceMs)) {
+                                                await showToast(`Rate limited. Switching accounts (retry in ${waitLabel}).`, "warning");
+                                                accountManager.markToastShown(account.index);
+                                            }
+                                            break;
+                                        }
+                                        return errorResponse;
+                                    }
+                                    resetRateLimitBackoff(account.index, quotaKey);
+                                    accountManager.recordSuccess(account, modelFamily, model);
+                                    return await handleSuccessResponse(response, isStreaming);
+                                }
+                            }
+                            const waitMs = accountManager.getMinWaitTimeForFamily(modelFamily, model);
+                            const count = accountManager.getAccountCount();
+                            if (retryAllAccountsRateLimited &&
+                                count > 0 &&
+                                waitMs > 0 &&
+                                (retryAllAccountsMaxWaitMs === 0 ||
+                                    waitMs <= retryAllAccountsMaxWaitMs) &&
+                                allRateLimitedRetries < retryAllAccountsMaxRetries) {
+                                const waitLabel = formatWaitTime(waitMs);
+                                await showToast(`All ${count} account(s) are rate-limited. Waiting ${waitLabel}...`, "warning");
+                                allRateLimitedRetries++;
+                                await sleep(waitMs);
+                                continue;
                             }
-                            return await handleSuccessResponse(response, isStreaming);
+                            const waitLabel = waitMs > 0 ? formatWaitTime(waitMs) : "a bit";
+                            const message = count === 0
+                                ? "No OpenAI accounts configured. Run `opencode auth login`."
+                                : `All ${count} account(s) are rate-limited. Try again in ${waitLabel} or add another account with \`opencode auth login\`.`;
+                            return new Response(JSON.stringify({ error: { message } }), {
+                                status: 429,
+                                headers: {
+                                    "content-type": "application/json; charset=utf-8",
+                                },
+                            });
                         }
-                        const waitMs = accountManager.getMinWaitTime();
-                        const count = accountManager.getAccountCount();
-                        const waitLabel = waitMs > 0 ? formatWaitTime(waitMs) : "a bit";
-                        const message = count === 0
-                            ? "No OpenAI accounts configured. Run `opencode auth login`."
-                            : `All ${count} account(s) are rate-limited. Try again in ${waitLabel} or add another account with \`opencode auth login\`.`;
-                        return new Response(JSON.stringify({ error: { message } }), {
-                            status: 429,
-                            headers: {
-                                "content-type": "application/json; charset=utf-8",
-                            },
-                        });
                     },
                 };
             },
@@ -403,10 +560,11 @@ export const OpenAIAuthPlugin = async ({ client }) => {
                                 inputs["no-browser"] === "true";
                             const useManualMode = noBrowser;
                             let startFresh = true;
-                            const existingStorage = await loadAccounts();
+                            const existingStorage = await hydrateEmails(await loadAccounts());
                             if (existingStorage && existingStorage.accounts.length > 0) {
                                 const existingAccounts = existingStorage.accounts.map((account, index) => ({
                                     accountId: account.accountId,
+                                    email: account.email,
                                     index,
                                 }));
                                 const loginMode = await promptLoginMode(existingAccounts);
@@ -418,9 +576,23 @@ export const OpenAIAuthPlugin = async ({ client }) => {
                                     console.log("\nAdding to existing accounts.\n");
                                 }
                             }
-                            while (accounts.length < MAX_OAUTH_ACCOUNTS) {
+                            while (accounts.length < ACCOUNT_LIMITS.MAX_ACCOUNTS) {
                                 console.log(`\n=== OpenAI OAuth (Account ${accounts.length + 1}) ===`);
-                                const result = await runOAuthFlow(useManualMode);
+                                const forceNewLogin = accounts.length > 0;
+                                const result = await runOAuthFlow(useManualMode, forceNewLogin);
+                                if (result.type === "success") {
+                                    const email = extractAccountEmail(result.access);
+                                    const accountId = extractAccountId(result.access);
+                                    const label = email || accountId || "Unknown account";
+                                    console.log(`\n✓ Authenticated as: ${label}\n`);
+                                    const isDuplicate = accounts.some((acc) => (accountId && extractAccountId(acc.access) === accountId) ||
+                                        (email && extractAccountEmail(acc.access) === email));
+                                    if (isDuplicate) {
+                                        console.warn(`\n⚠️  WARNING: You authenticated with an account that is already in the list (${label}).`);
+                                        console.warn("This usually happens if you didn't log out or use a different browser profile.");
+                                        console.warn("The duplicate will update the existing entry.\n");
+                                    }
+                                }
                                 if (result.type === "failed") {
                                     if (accounts.length === 0) {
                                         return {
@@ -439,10 +611,10 @@ export const OpenAIAuthPlugin = async ({ client }) => {
                                     const isFirstAccount = accounts.length === 1;
                                     await persistAccountPool([result], isFirstAccount && startFresh);
                                 }
-                                catch {
-                                    // Ignore storage failures
+                                catch (err) {
+                                    logDebug(`[${PLUGIN_NAME}] Failed to persist account pool: ${err?.message ?? String(err)}`);
                                 }
-                                if (accounts.length >= MAX_OAUTH_ACCOUNTS) {
+                                if (accounts.length >= ACCOUNT_LIMITS.MAX_ACCOUNTS) {
                                     break;
                                 }
                                 let currentAccountCount = accounts.length;
@@ -452,8 +624,8 @@ export const OpenAIAuthPlugin = async ({ client }) => {
                                         currentAccountCount = currentStorage.accounts.length;
                                     }
                                 }
-                                catch {
-                                    // Ignore storage read failures
+                                catch (err) {
+                                    logDebug(`[${PLUGIN_NAME}] Failed to load accounts for count: ${err?.message ?? String(err)}`);
                                 }
                                 const addAnother = await promptAddAnotherAccount(currentAccountCount);
                                 if (!addAnother) {
@@ -478,8 +650,8 @@ export const OpenAIAuthPlugin = async ({ client }) => {
                                     actualAccountCount = finalStorage.accounts.length;
                                 }
                             }
-                            catch {
-                                // Ignore storage read failures
+                            catch (err) {
+                                logDebug(`[${PLUGIN_NAME}] Failed to load final account count: ${err?.message ?? String(err)}`);
                             }
                             return {
                                 url: "",
@@ -493,7 +665,8 @@ export const OpenAIAuthPlugin = async ({ client }) => {
                         try {
                             serverInfo = await startLocalOAuthServer({ state });
                         }
-                        catch {
+                        catch (err) {
+                            logDebug(`[${PLUGIN_NAME}] Failed to start OAuth server for add flow: ${err?.message ?? String(err)}`);
                             serverInfo = null;
                         }
                         openBrowserUrl(url);
@@ -558,13 +731,15 @@ export const OpenAIAuthPlugin = async ({ client }) => {
                         ].join("\n");
                     }
                     const now = Date.now();
-                    const activeIndex = resolveActiveIndex(storage);
+                    const activeIndex = resolveActiveIndex(storage, "codex");
                     const lines = [
                         `OpenAI Accounts (${storage.accounts.length}):`,
                         "",
+                        " #  Label                                     Status",
+                        "----------------------------------------------- ---------------------",
                     ];
                     storage.accounts.forEach((account, index) => {
-                        const label = formatAccountLabel(account.accountId, index);
+                        const label = formatAccountLabel(account, index);
                         const statuses = [];
                         const rateLimit = formatRateLimitEntry(account, now);
                         if (index === activeIndex)
@@ -576,10 +751,9 @@ export const OpenAIAuthPlugin = async ({ client }) => {
                             account.coolingDownUntil > now) {
                             statuses.push("cooldown");
                         }
-                        const suffix = statuses.length > 0
-                            ? ` (${statuses.join(", ")})`
-                            : "";
-                        lines.push(`  ${index + 1}. ${label}${suffix}`);
+                        const statusText = statuses.length > 0 ? statuses.join(", ") : "ok";
+                        const row = `${String(index + 1).padEnd(3)} ${label.padEnd(40)} ${statusText}`;
+                        lines.push(row);
                     });
                     lines.push("");
                     lines.push(`Storage: ${storePath}`);
@@ -614,51 +788,133 @@ export const OpenAIAuthPlugin = async ({ client }) => {
                         account.lastSwitchReason = "rotation";
                     }
                     storage.activeIndex = targetIndex;
+                    storage.activeIndexByFamily = storage.activeIndexByFamily ?? {};
+                    for (const family of MODEL_FAMILIES) {
+                        storage.activeIndexByFamily[family] = targetIndex;
+                    }
                     await saveAccounts(storage);
                     if (cachedAccountManager) {
                         cachedAccountManager.setActiveIndex(targetIndex);
                         await cachedAccountManager.saveToDisk();
                     }
-                    const label = formatAccountLabel(account?.accountId, targetIndex);
+                    const label = formatAccountLabel(account, targetIndex);
                     return `Switched to account: ${label}`;
                 },
             }),
             "openai-accounts-status": tool({
                 description: "Show detailed status of OpenAI accounts and rate limits.",
-                args: {},
-                async execute() {
+                args: {
+                    json: tool.schema.boolean().optional().describe("Return JSON instead of text"),
+                },
+                async execute({ json }) {
                     const storage = await loadAccounts();
                     if (!storage || storage.accounts.length === 0) {
                         return "No OpenAI accounts configured. Run: opencode auth login";
                     }
                     const now = Date.now();
-                    const activeIndex = resolveActiveIndex(storage);
+                    const activeIndex = resolveActiveIndex(storage, "codex");
+                    if (json) {
+                        return JSON.stringify({
+                            total: storage.accounts.length,
+                            activeIndex,
+                            activeIndexByFamily: storage.activeIndexByFamily ?? null,
+                            storagePath: getStoragePath(),
+                            accounts: storage.accounts.map((account, index) => ({
+                                index,
+                                active: index === activeIndex,
+                                label: formatAccountLabel(account, index),
+                                accountId: account.accountId ?? null,
+                                email: account.email ?? null,
+                                rateLimitResetTimes: account.rateLimitResetTimes ?? null,
+                                coolingDownUntil: typeof account.coolingDownUntil === "number"
+                                    ? account.coolingDownUntil
+                                    : null,
+                                cooldownReason: account.cooldownReason ?? null,
+                                lastUsed: typeof account.lastUsed === "number"
+                                    ? account.lastUsed
+                                    : null,
+                            })),
+                        }, null, 2);
+                    }
                     const lines = [
                         `Account Status (${storage.accounts.length} total):`,
                         "",
+                        " #  Label                                     Active  Rate Limit       Cooldown        Last Used",
+                        "----------------------------------------------- ------ ---------------- ---------------- ----------------",
                     ];
                     storage.accounts.forEach((account, index) => {
-                        const label = formatAccountLabel(account.accountId, index);
-                        lines.push(`${index + 1}. ${label}`);
-                        lines.push(`   Active: ${index === activeIndex ? "Yes" : "No"}`);
-                        const rateLimit = formatRateLimitEntry(account, now);
-                        lines.push(`   Rate Limit: ${rateLimit ?? "None"}`);
-                        const cooldown = formatCooldown(account, now);
-                        if (cooldown) {
-                            lines.push(`   Cooldown: Yes (${cooldown})`);
-                        }
-                        else {
-                            lines.push("   Cooldown: No");
-                        }
-                        if (typeof account.lastUsed === "number" &&
-                            account.lastUsed > 0) {
-                            lines.push(`   Last Used: ${formatWaitTime(now - account.lastUsed)} ago`);
-                        }
-                        lines.push("");
+                        const label = formatAccountLabel(account, index).padEnd(42);
+                        const active = index === activeIndex ? "Yes" : "No";
+                        const rateLimit = formatRateLimitEntry(account, now) ?? "None";
+                        const cooldown = formatCooldown(account, now) ?? "No";
+                        const lastUsed = typeof account.lastUsed === "number" && account.lastUsed > 0
+                            ? `${formatWaitTime(now - account.lastUsed)} ago`
+                            : "-";
+                        const row = `${String(index + 1).padEnd(3)} ${label} ${active.padEnd(6)} ${rateLimit.padEnd(16)} ${cooldown.padEnd(16)} ${lastUsed}`;
+                        lines.push(row);
+                    });
+                    lines.push("");
+                    lines.push("Active index by model family:");
+                    for (const family of MODEL_FAMILIES) {
+                        const idx = storage.activeIndexByFamily?.[family];
+                        const familyIndexLabel = typeof idx === "number" && Number.isFinite(idx) ? String(idx + 1) : "-";
+                        lines.push(`  ${family}: ${familyIndexLabel}`);
+                    }
+                    lines.push("");
+                    lines.push("Rate limits by model family (per account):");
+                    storage.accounts.forEach((account, index) => {
+                        const statuses = MODEL_FAMILIES.map((family) => {
+                            const resetAt = getRateLimitResetTimeForFamily(account, now, family);
+                            if (typeof resetAt !== "number")
+                                return `${family}=ok`;
+                            return `${family}=${formatWaitTime(resetAt - now)}`;
+                        });
+                        lines.push(`  Account ${index + 1}: ${statuses.join(" | ")}`);
                     });
                     return lines.join("\n");
                 },
             }),
+            "openai-accounts-health": tool({
+                description: "Check health of all OpenAI accounts by validating refresh tokens.",
+                args: {},
+                async execute() {
+                    const storage = await loadAccounts();
+                    if (!storage || storage.accounts.length === 0) {
+                        return "No OpenAI accounts configured. Run: opencode auth login";
+                    }
+                    const results = [
+                        `Health Check (${storage.accounts.length} accounts):`,
+                        "",
+                    ];
+                    let healthyCount = 0;
+                    let unhealthyCount = 0;
+                    for (let i = 0; i < storage.accounts.length; i++) {
+                        const account = storage.accounts[i];
+                        if (!account)
+                            continue;
+                        const label = formatAccountLabel(account, i);
+                        try {
+                            const refreshResult = await queuedRefresh(account.refreshToken);
+                            if (refreshResult.type === "success") {
+                                results.push(`  ✓ ${label}: Healthy`);
+                                healthyCount++;
+                            }
+                            else {
+                                results.push(`  ✗ ${label}: Token refresh failed`);
+                                unhealthyCount++;
+                            }
+                        }
+                        catch (error) {
+                            const errorMsg = error instanceof Error ? error.message : String(error);
+                            results.push(`  ✗ ${label}: Error - ${errorMsg.slice(0, 50)}`);
+                            unhealthyCount++;
+                        }
+                    }
+                    results.push("");
+                    results.push(`Summary: ${healthyCount} healthy, ${unhealthyCount} unhealthy`);
+                    return results.join("\n");
+                },
+            }),
         },
     };
 };