opencode-openai-codex-multi-auth 4.5.5 → 4.5.9

package/dist/index.js

@@ -22,20 +22,23 @@
  * @repository https://github.com/numman-ali/opencode-openai-codex-auth
  */
 import { tool } from "@opencode-ai/plugin";
-import { createAuthorizationFlow, exchangeAuthorizationCode, parseAuthorizationInput, REDIRECT_URI, refreshAccessToken, } from "./lib/auth/auth.js";
+import { createAuthorizationFlow, exchangeAuthorizationCode, parseAuthorizationInputForFlow, REDIRECT_URI, } from "./lib/auth/auth.js";
 import { openBrowserUrl } from "./lib/auth/browser.js";
 import { startLocalOAuthServer } from "./lib/auth/server.js";
-import { getAccountSelectionStrategy, getCodexMode, getPidOffsetEnabled, getQuietMode, getRateLimitToastDebounceMs, getRetryAllAccountsMaxRetries, getRetryAllAccountsMaxWaitMs, getRetryAllAccountsRateLimited, getTokenRefreshSkewMs, loadPluginConfig, } from "./lib/config.js";
+import { getAccountSelectionStrategy, getCodexMode, getDefaultRetryAfterMs, getMaxBackoffMs, getMaxCacheFirstWaitSeconds, getPidOffsetEnabled, getQuietMode, getRateLimitDedupWindowMs, getRateLimitStateResetMs, getRateLimitToastDebounceMs, getRequestJitterMaxMs, getRetryAllAccountsMaxRetries, getRetryAllAccountsMaxWaitMs, getRetryAllAccountsRateLimited, getSchedulingMode, getSwitchOnFirstRateLimit, getTokenRefreshSkewMs, loadPluginConfig, } from "./lib/config.js";
 import { AUTH_LABELS, CODEX_BASE_URL, DUMMY_API_KEY, HTTP_STATUS, LOG_STAGES, PLUGIN_NAME, PROVIDER_ID, } from "./lib/constants.js";
 import { logRequest, logDebug } from "./lib/logger.js";
 import { createCodexHeaders, extractRequestUrl, handleErrorResponse, handleSuccessResponse, rewriteUrlForCodex, transformRequestForCodex, } from "./lib/request/fetch-helpers.js";
-import { AccountManager, extractAccountEmail, extractAccountId, extractAccountPlan, formatAccountLabel, formatWaitTime, isOAuthAuth, sanitizeEmail, } from "./lib/accounts.js";
-import { promptAddAnotherAccount, promptLoginMode, promptOAuthCallbackValue } from "./lib/cli.js";
+import { AccountManager, extractAccountEmail, extractAccountId, extractAccountPlan, formatAccountLabel, formatWaitTime, isOAuthAuth, needsIdentityHydration, sanitizeEmail, } from "./lib/accounts.js";
+import { promptAddAnotherAccount, promptLoginMode, promptManageAccounts, promptOAuthCallbackValue, promptRepairAccounts, } from "./lib/cli.js";
 import { withTerminalModeRestored } from "./lib/terminal.js";
-import { getStoragePath, loadAccounts, saveAccounts } from "./lib/storage.js";
+import { getStoragePath, autoQuarantineCorruptAccountsFile, inspectAccountsFile, loadAccounts, quarantineAccounts, quarantineCorruptFile, replaceAccountsFile, saveAccounts, toggleAccountEnabled, writeQuarantineFile, } from "./lib/storage.js";
 import { findAccountMatchIndex } from "./lib/account-matching.js";
 import { getModelFamily, MODEL_FAMILIES } from "./lib/prompts/codex.js";
 import { getHealthTracker, getTokenTracker } from "./lib/rotation.js";
+import { RateLimitTracker, decideRateLimitAction, parseRateLimitReason } from "./lib/rate-limit.js";
+import { ProactiveRefreshQueue, createRefreshScheduler, } from "./lib/refresh-queue.js";
+import { formatRateLimitStatusMessage, formatToastMessage } from "./lib/formatting.js";
 const RATE_LIMIT_SHORT_RETRY_THRESHOLD_MS = 5_000;
 const AUTH_FAILURE_COOLDOWN_MS = 60_000;
 const MAX_ACCOUNTS = 10;
@@ -80,22 +83,26 @@ function parseRetryAfterMs(headers) {
  */
 export const OpenAIAuthPlugin = async ({ client }) => {
     let cachedAccountManager = null;
+    let proactiveRefreshScheduler = null;
     const showToast = async (message, variant = "info", quietMode = false) => {
         if (quietMode)
             return;
         try {
-            await client.tui.showToast({ body: { message, variant } });
+            await client.tui.showToast({ body: { message: formatToastMessage(message), variant } });
         }
         catch {
             // ignore (non-TUI contexts)
         }
     };
-    const buildManualOAuthFlow = (pkce, url, onSuccess) => ({
+    const buildManualOAuthFlow = (pkce, expectedState, url, onSuccess) => ({
         url,
         method: "code",
         instructions: AUTH_LABELS.INSTRUCTIONS_MANUAL,
         callback: async (input) => {
-            const parsed = parseAuthorizationInput(input);
+            const parsed = parseAuthorizationInputForFlow(input, expectedState);
+            if (parsed.stateStatus === "mismatch") {
+                return { type: "failed" };
+            }
             if (!parsed.code) {
                 return { type: "failed" };
             }
@@ -114,6 +121,9 @@ export const OpenAIAuthPlugin = async ({ client }) => {
         const accountId = extractAccountId(token.access);
         const email = sanitizeEmail(extractAccountEmail(token.idToken ?? token.access));
         const plan = extractAccountPlan(token.idToken ?? token.access);
+        if (!accountId || !email || !plan) {
+            debugAuth("[PersistAccount] Missing account identity fields; persisting legacy entry");
+        }
         debugAuth(`[PersistAccount] Account details - accountId: ${accountId}, email: ${email}, plan: ${plan}, existing accounts: ${accounts.length}`);
         const existingIndex = findAccountMatchIndex(accounts, { accountId, plan, email });
         debugAuth(`[PersistAccount] Match index: ${existingIndex}`);
@@ -124,6 +134,7 @@ export const OpenAIAuthPlugin = async ({ client }) => {
                 accountId,
                 email,
                 plan,
+                enabled: true,
                 addedAt: now,
                 lastUsed: now,
             });
@@ -136,6 +147,8 @@ export const OpenAIAuthPlugin = async ({ client }) => {
                 existing.accountId = accountId ?? existing.accountId;
                 existing.email = email ?? existing.email;
                 existing.plan = plan ?? existing.plan;
+                if (typeof existing.enabled !== "boolean")
+                    existing.enabled = true;
                 existing.lastUsed = now;
             }
         }
@@ -172,9 +185,15 @@ export const OpenAIAuthPlugin = async ({ client }) => {
                 if (!isOAuthAuth(auth)) {
                     return {};
                 }
+                const pluginConfig = loadPluginConfig();
+                const quietMode = getQuietMode(pluginConfig);
                 const accountManager = await AccountManager.loadFromDisk(auth);
                 cachedAccountManager = accountManager;
                 if (accountManager.getAccountCount() === 0) {
+                    const quarantinePath = await autoQuarantineCorruptAccountsFile();
+                    if (quarantinePath) {
+                        await showToast("Accounts file was corrupted and has been quarantined. Run `opencode auth login`.", "warning", quietMode);
+                    }
                     logDebug(`[${PLUGIN_NAME}] No OAuth accounts available (run opencode auth login)`);
                     return {};
                 }
@@ -184,16 +203,85 @@ export const OpenAIAuthPlugin = async ({ client }) => {
                     global: providerConfig?.options || {},
                     models: providerConfig?.models || {},
                 };
-                const pluginConfig = loadPluginConfig();
                 const codexMode = getCodexMode(pluginConfig);
                 const accountSelectionStrategy = getAccountSelectionStrategy(pluginConfig);
                 const pidOffsetEnabled = getPidOffsetEnabled(pluginConfig);
-                const quietMode = getQuietMode(pluginConfig);
                 const tokenRefreshSkewMs = getTokenRefreshSkewMs(pluginConfig);
+                const proactiveRefreshEnabled = (() => {
+                    const rawConfig = pluginConfig;
+                    const configFlag = rawConfig["proactive_token_refresh"] ?? rawConfig["proactiveTokenRefresh"];
+                    const envFlag = process.env.CODEX_AUTH_PROACTIVE_TOKEN_REFRESH;
+                    if (envFlag === "1" || envFlag === "true")
+                        return true;
+                    if (envFlag === "0" || envFlag === "false")
+                        return false;
+                    return Boolean(configFlag);
+                })();
                 const toastDebounceMs = getRateLimitToastDebounceMs(pluginConfig);
                 const retryAllAccountsRateLimited = getRetryAllAccountsRateLimited(pluginConfig);
                 const retryAllAccountsMaxWaitMs = getRetryAllAccountsMaxWaitMs(pluginConfig);
                 const retryAllAccountsMaxRetries = getRetryAllAccountsMaxRetries(pluginConfig);
+                const schedulingMode = getSchedulingMode(pluginConfig);
+                const maxCacheFirstWaitSeconds = getMaxCacheFirstWaitSeconds(pluginConfig);
+                const switchOnFirstRateLimit = getSwitchOnFirstRateLimit(pluginConfig);
+                const rateLimitDedupWindowMs = getRateLimitDedupWindowMs(pluginConfig);
+                const rateLimitStateResetMs = getRateLimitStateResetMs(pluginConfig);
+                const defaultRetryAfterMs = getDefaultRetryAfterMs(pluginConfig);
+                const maxBackoffMs = getMaxBackoffMs(pluginConfig);
+                const requestJitterMaxMs = getRequestJitterMaxMs(pluginConfig);
+                const maxCacheFirstWaitMs = Math.max(0, Math.floor(maxCacheFirstWaitSeconds * 1000));
+                const proactiveRefreshQueue = proactiveRefreshEnabled
+                    ? new ProactiveRefreshQueue({ bufferMs: tokenRefreshSkewMs, intervalMs: 250 })
+                    : null;
+                if (proactiveRefreshScheduler) {
+                    proactiveRefreshScheduler.stop();
+                    proactiveRefreshScheduler = null;
+                }
+                if (proactiveRefreshQueue) {
+                    proactiveRefreshScheduler = createRefreshScheduler({
+                        intervalMs: 1000,
+                        queue: proactiveRefreshQueue,
+                        getTasks: () => {
+                            const tasks = [];
+                            for (const account of accountManager.getAccountsSnapshot()) {
+                                if (account.enabled === false)
+                                    continue;
+                                if (!Number.isFinite(account.expires))
+                                    continue;
+                                tasks.push({
+                                    key: `account-${account.index}`,
+                                    expires: account.expires ?? 0,
+                                    refresh: async () => {
+                                        const live = accountManager.getAccountByIndex(account.index);
+                                        if (!live || live.enabled === false)
+                                            return { type: "failed" };
+                                        const refreshed = await accountManager.refreshAccountWithFallback(live);
+                                        if (refreshed.type !== "success")
+                                            return refreshed;
+                                        const refreshedAuth = {
+                                            type: "oauth",
+                                            access: refreshed.access,
+                                            refresh: refreshed.refresh,
+                                            expires: refreshed.expires,
+                                        };
+                                        accountManager.updateFromAuth(live, refreshedAuth);
+                                        await accountManager.saveToDisk();
+                                        return refreshed;
+                                    },
+                                });
+                            }
+                            return tasks;
+                        },
+                    });
+                    proactiveRefreshScheduler.start();
+                }
+                const rateLimitTracker = new RateLimitTracker({
+                    dedupWindowMs: rateLimitDedupWindowMs,
+                    resetMs: rateLimitStateResetMs,
+                    defaultRetryMs: defaultRetryAfterMs,
+                    maxBackoffMs,
+                    jitterMaxMs: requestJitterMaxMs,
+                });
                 // Return SDK configuration
                 return {
                     apiKey: DUMMY_API_KEY,
@@ -249,8 +337,35 @@ export const OpenAIAuthPlugin = async ({ client }) => {
                             abortSignal?.addEventListener("abort", onAbort, { once: true });
                         });
                         let allRateLimitedRetries = 0;
+                        let autoRepairAttempted = false;
                         while (true) {
                             const accountCount = accountManager.getAccountCount();
+                            if (!autoRepairAttempted && accountCount === 0) {
+                                const legacyAccounts = accountManager.getLegacyAccounts();
+                                if (legacyAccounts.length > 0) {
+                                    autoRepairAttempted = true;
+                                    const repair = await accountManager.repairLegacyAccounts();
+                                    const snapshot = accountManager.getStorageSnapshot();
+                                    let quarantinePath = null;
+                                    if (repair.quarantined.length > 0) {
+                                        const quarantinedTokens = new Set(repair.quarantined.map((account) => account.refreshToken));
+                                        const quarantineEntries = snapshot.accounts.filter((account) => quarantinedTokens.has(account.refreshToken));
+                                        const quarantineResult = await quarantineAccounts(snapshot, quarantineEntries, "legacy-auto-repair-failed");
+                                        quarantinePath = quarantineResult.quarantinePath;
+                                        accountManager.removeAccountsByRefreshToken(quarantinedTokens);
+                                    }
+                                    else {
+                                        await replaceAccountsFile(snapshot);
+                                    }
+                                    if (repair.quarantined.length > 0 && quarantinePath) {
+                                        await showToast(`Auto-repair failed for ${repair.quarantined.length} account(s). Quarantined: ${quarantinePath}`, "warning", quietMode);
+                                    }
+                                    else if (repair.repaired.length > 0) {
+                                        await showToast(`Auto-repaired ${repair.repaired.length} account(s).`, "success", quietMode);
+                                    }
+                                    continue;
+                                }
+                            }
                             const attempted = new Set();
                             while (attempted.size < Math.max(1, accountCount)) {
                                 const account = accountManager.getCurrentOrNextForFamily(modelFamily, model, accountSelectionStrategy, usePidOffset);
@@ -258,27 +373,48 @@ export const OpenAIAuthPlugin = async ({ client }) => {
                                     break;
                                 attempted.add(account.index);
                                 let accountAuth = accountManager.toAuthDetails(account);
-                                if (shouldRefreshToken(accountAuth, tokenRefreshSkewMs)) {
-                                    const refreshed = await refreshAccessToken(account.refreshToken);
-                                    if (refreshed.type !== "success") {
-                                        accountManager.markAccountCoolingDown(account, AUTH_FAILURE_COOLDOWN_MS, "auth-failure");
-                                        await accountManager.saveToDisk();
-                                        await showToast(`Auth refresh failed. Cooling down ${formatAccountLabel(account, account.index)}.`, "warning", quietMode);
-                                        continue;
-                                    }
-                                    accountAuth = {
+                                const tokenExpired = !accountAuth.access || accountAuth.expires <= Date.now();
+                                const runRefresh = async () => {
+                                    const refreshed = await accountManager.refreshAccountWithFallback(account);
+                                    if (refreshed.type !== "success")
+                                        return refreshed;
+                                    const refreshedAuth = {
                                         type: "oauth",
                                         access: refreshed.access,
                                         refresh: refreshed.refresh,
                                         expires: refreshed.expires,
                                     };
-                                    accountManager.updateFromAuth(account, accountAuth);
+                                    accountManager.updateFromAuth(account, refreshedAuth);
                                     await accountManager.saveToDisk();
-                                    // Keep OpenCode's stored auth aligned with the last-used account.
                                     await client.auth.set({
                                         path: { id: PROVIDER_ID },
-                                        body: accountAuth,
+                                        body: refreshedAuth,
                                     });
+                                    return refreshed;
+                                };
+                                if (shouldRefreshToken(accountAuth, tokenRefreshSkewMs)) {
+                                    if (proactiveRefreshQueue && !tokenExpired) {
+                                        void proactiveRefreshQueue.enqueue({
+                                            key: `account-${account.index}`,
+                                            expires: accountAuth.expires,
+                                            refresh: runRefresh,
+                                        });
+                                    }
+                                    else {
+                                        const refreshed = await runRefresh();
+                                        if (refreshed.type !== "success") {
+                                            accountManager.markAccountCoolingDown(account, AUTH_FAILURE_COOLDOWN_MS, "auth-failure");
+                                            await accountManager.saveToDisk();
+                                            await showToast(`Auth refresh failed. Cooling down ${formatAccountLabel(account, account.index)}.`, "warning", quietMode);
+                                            continue;
+                                        }
+                                        accountAuth = {
+                                            type: "oauth",
+                                            access: refreshed.access,
+                                            refresh: refreshed.refresh,
+                                            expires: refreshed.expires,
+                                        };
+                                    }
                                 }
                                 const accountId = account.accountId ?? extractAccountId(accountAuth.access);
                                 if (!accountId) {
@@ -331,6 +467,7 @@ export const OpenAIAuthPlugin = async ({ client }) => {
                                         if (accountSelectionStrategy === "hybrid") {
                                             getHealthTracker().recordSuccess(account.index);
                                         }
+                                        accountManager.markAccountUsed(account.index);
                                         return await handleSuccessResponse(res, isStreaming);
                                     }
                                     const handled = await handleErrorResponse(res);
@@ -340,7 +477,25 @@ export const OpenAIAuthPlugin = async ({ client }) => {
                                         }
                                         return handled;
                                     }
-                                    const retryAfterMs = parseRetryAfterMs(handled.headers) ?? 60_000;
+                                    const retryAfterMs = parseRetryAfterMs(handled.headers);
+                                    let responseText = "";
+                                    try {
+                                        responseText = await handled.clone().text();
+                                    }
+                                    catch {
+                                        responseText = "";
+                                    }
+                                    const reason = parseRateLimitReason(handled.status, responseText);
+                                    const trackerKey = `${account.index}:${modelFamily}:${model ?? ""}`;
+                                    const backoff = rateLimitTracker.getBackoff(trackerKey, reason, retryAfterMs);
+                                    const decision = decideRateLimitAction({
+                                        schedulingMode,
+                                        accountCount,
+                                        maxCacheFirstWaitMs,
+                                        switchOnFirstRateLimit,
+                                        shortRetryThresholdMs: RATE_LIMIT_SHORT_RETRY_THRESHOLD_MS,
+                                        backoff,
+                                    });
                                     if (tokenConsumed) {
                                         getTokenTracker().refund(account.index);
                                         tokenConsumed = false;
@@ -348,19 +503,27 @@ export const OpenAIAuthPlugin = async ({ client }) => {
                                     if (accountSelectionStrategy === "hybrid") {
                                         getHealthTracker().recordRateLimit(account.index);
                                     }
-                                    if (retryAfterMs <= RATE_LIMIT_SHORT_RETRY_THRESHOLD_MS) {
-                                        await showToast(`Rate limited. Retrying in ${formatWaitTime(retryAfterMs)}...`, "warning", quietMode);
-                                        await sleep(retryAfterMs);
+                                    accountManager.markRateLimited(account, backoff.delayMs, modelFamily, model);
+                                    const shouldPersistRateLimit = !backoff.isDuplicate;
+                                    if (decision.action === "wait") {
+                                        if (shouldPersistRateLimit) {
+                                            await accountManager.saveToDisk();
+                                            await showToast(`Rate limited. Retrying in ${formatWaitTime(decision.delayMs)}...`, "warning", quietMode);
+                                        }
+                                        if (decision.delayMs > 0) {
+                                            await sleep(decision.delayMs);
+                                        }
                                         continue;
                                     }
-                                    accountManager.markRateLimited(account, retryAfterMs, modelFamily, model);
                                     accountManager.markSwitched(account, "rate-limit", modelFamily);
-                                    await accountManager.saveToDisk();
-                                    await showToast(`Rate limited. Switching accounts (retry in ${formatWaitTime(retryAfterMs)}).`, "warning", quietMode);
+                                    if (shouldPersistRateLimit) {
+                                        await accountManager.saveToDisk();
+                                        await showToast(`Rate limited. Switching accounts (retry in ${formatWaitTime(decision.delayMs)}).`, "warning", quietMode);
+                                    }
                                     break;
                                 }
                             }
-                            const waitMs = accountManager.getMinWaitTimeForFamily(modelFamily, model);
+                            const waitMs = await accountManager.getMinWaitTimeForFamilyWithHydration(modelFamily, model);
                             if (retryAllAccountsRateLimited &&
                                 accountManager.getAccountCount() > 0 &&
                                 waitMs > 0 &&
@@ -371,11 +534,11 @@ export const OpenAIAuthPlugin = async ({ client }) => {
                                 await sleep(waitMs);
                                 continue;
                             }
-                            const storePath = getStoragePath();
-                            const waitLabel = waitMs > 0 ? formatWaitTime(waitMs) : "a bit";
-                            const message = accountManager.getAccountCount() === 0
-                                ? "No OpenAI accounts configured. Run `opencode auth login`."
-                                : `All ${accountManager.getAccountCount()} account(s) are rate-limited. Try again in ${waitLabel} or add another account with \`opencode auth login\`. (Storage: ${storePath})`;
+                            const message = formatRateLimitStatusMessage({
+                                accountCount: accountManager.getAccountCount(),
+                                waitMs,
+                                storagePath: getStoragePath(),
+                            });
                             return new Response(JSON.stringify({ error: { message } }), {
                                 status: 429,
                                 headers: { "content-type": "application/json; charset=utf-8" },
@@ -404,6 +567,71 @@ export const OpenAIAuthPlugin = async ({ client }) => {
                         const pluginConfig = loadPluginConfig();
                         const quietMode = getQuietMode(pluginConfig);
                         const isCliFlow = Boolean(inputs);
+                        const notifyRepairResult = async (message) => {
+                            if (isCliFlow) {
+                                console.log(`\n${message}\n`);
+                                return;
+                            }
+                            await showToast(message, "info", quietMode);
+                        };
+                        const maybeRepairAccounts = async () => {
+                            const inspection = await inspectAccountsFile();
+                            if (inspection.status === "missing" || inspection.status === "ok") {
+                                return null;
+                            }
+                            const corruptCount = inspection.status === "corrupt-file"
+                                ? 1
+                                : inspection.corruptEntries.length;
+                            const legacyCount = inspection.status === "needs-repair" ? inspection.legacyEntries.length : 0;
+                            const shouldRepair = await promptRepairAccounts({
+                                legacyCount,
+                                corruptCount,
+                            });
+                            if (!shouldRepair)
+                                return null;
+                            const quarantinePaths = [];
+                            if (inspection.status === "corrupt-file") {
+                                const quarantinePath = await quarantineCorruptFile();
+                                if (quarantinePath) {
+                                    quarantinePaths.push(quarantinePath);
+                                    await notifyRepairResult(`Accounts file was corrupted. Quarantined to ${quarantinePath}.`);
+                                }
+                                return await loadAccounts();
+                            }
+                            if (inspection.corruptEntries.length > 0) {
+                                const quarantinePath = await writeQuarantineFile(inspection.corruptEntries, "corrupt-entry");
+                                quarantinePaths.push(quarantinePath);
+                            }
+                            const storage = await loadAccounts();
+                            if (!storage) {
+                                await notifyRepairResult("Repair skipped: no valid accounts found.");
+                                return null;
+                            }
+                            const manager = new AccountManager(undefined, storage);
+                            const repair = await manager.repairLegacyAccounts();
+                            const snapshot = manager.getStorageSnapshot();
+                            let updatedStorage = snapshot;
+                            if (repair.quarantined.length > 0) {
+                                const quarantinedTokens = new Set(repair.quarantined.map((account) => account.refreshToken));
+                                const quarantineEntries = snapshot.accounts.filter((account) => quarantinedTokens.has(account.refreshToken));
+                                const quarantineResult = await quarantineAccounts(snapshot, quarantineEntries, "legacy-repair-failed");
+                                updatedStorage = quarantineResult.storage;
+                                quarantinePaths.push(quarantineResult.quarantinePath);
+                            }
+                            else {
+                                await replaceAccountsFile(snapshot);
+                            }
+                            const summaryParts = [
+                                `Repaired ${repair.repaired.length}`,
+                                `quarantined ${repair.quarantined.length}`,
+                            ];
+                            const detail = quarantinePaths.length
+                                ? ` Quarantine: ${quarantinePaths.join(", ")}.`
+                                : "";
+                            await notifyRepairResult(`Account repair complete. ${summaryParts.join(", ")}.${detail}`);
+                            return updatedStorage;
+                        };
+                        const repairedStorage = await maybeRepairAccounts();
                         // CLI flow (`opencode auth login`) passes inputs; TUI does not.
                         if (isCliFlow) {
                             debugAuth("[OAuthAuthorize] Starting OAuth flow in CLI mode");
@@ -415,8 +643,15 @@ export const OpenAIAuthPlugin = async ({ client }) => {
                                     const { pkce, state, url } = await createAuthorizationFlow();
                                     console.log("\nOAuth URL:\n" + url + "\n");
                                     if (noBrowser) {
-                                        const callbackInput = await promptOAuthCallbackValue("Paste the redirect URL (or just the code) here: ");
-                                        const parsed = parseAuthorizationInput(callbackInput);
+                                        const callbackInput = await promptOAuthCallbackValue("Paste the full redirect URL (recommended). You can also paste code#state or just the code: ");
+                                        const parsed = parseAuthorizationInputForFlow(callbackInput, state);
+                                        if (parsed.stateStatus === "mismatch") {
+                                            console.log("\nOAuth state mismatch. Paste the redirect URL from this login session (the one shown above).\n");
+                                            return { type: "failed" };
+                                        }
+                                        if (parsed.stateStatus === "missing") {
+                                            console.log("\nWarning: redirect state not provided. For best security, paste the full redirect URL.\n");
+                                        }
                                         if (!parsed.code)
                                             return { type: "failed" };
                                         return await exchangeAuthorizationCode(parsed.code, pkce.verifier, REDIRECT_URI);
@@ -431,8 +666,15 @@ export const OpenAIAuthPlugin = async ({ client }) => {
                                     openBrowserUrl(url);
                                     if (!serverInfo || !serverInfo.ready) {
                                         serverInfo?.close();
-                                        const callbackInput = await promptOAuthCallbackValue("Paste the redirect URL (or just the code) here: ");
-                                        const parsed = parseAuthorizationInput(callbackInput);
+                                        const callbackInput = await promptOAuthCallbackValue("Paste the full redirect URL (recommended). You can also paste code#state or just the code: ");
+                                        const parsed = parseAuthorizationInputForFlow(callbackInput, state);
+                                        if (parsed.stateStatus === "mismatch") {
+                                            console.log("\nOAuth state mismatch. Paste the redirect URL from this login session (the one shown above).\n");
+                                            return { type: "failed" };
+                                        }
+                                        if (parsed.stateStatus === "missing") {
+                                            console.log("\nWarning: redirect state not provided. For best security, paste the full redirect URL.\n");
+                                        }
                                         if (!parsed.code)
                                             return { type: "failed" };
                                         return await exchangeAuthorizationCode(parsed.code, pkce.verifier, REDIRECT_URI);
@@ -445,9 +687,9 @@ export const OpenAIAuthPlugin = async ({ client }) => {
                                 };
                                 const authenticated = [];
                                 let startFresh = true;
-                                let existingStorage = await loadAccounts();
+                                let existingStorage = repairedStorage ?? (await loadAccounts());
                                 if (existingStorage && existingStorage.accounts.length > 0) {
-                                    const needsHydration = existingStorage.accounts.some((a) => !a.email);
+                                    const needsHydration = needsIdentityHydration(existingStorage.accounts);
                                     if (needsHydration) {
                                         try {
                                             console.log("\nRefreshing saved accounts to fill missing emails...\n");
@@ -460,13 +702,43 @@ export const OpenAIAuthPlugin = async ({ client }) => {
                                             // Best-effort; ignore.
                                         }
                                     }
-                                    const existingLabels = (existingStorage?.accounts ?? []).map((a, index) => ({
+                                    let existingLabels = (existingStorage?.accounts ?? []).map((a, index) => ({
                                         index,
                                         email: a.email,
                                         plan: a.plan,
                                         accountId: a.accountId,
+                                        enabled: a.enabled,
                                     }));
-                                    const mode = await promptLoginMode(existingLabels);
+                                    let mode = await promptLoginMode(existingLabels);
+                                    while (mode === "manage") {
+                                        let updatedStorage = existingStorage;
+                                        while (updatedStorage) {
+                                            const labels = (updatedStorage?.accounts ?? []).map((a, index) => ({
+                                                index,
+                                                email: a.email,
+                                                plan: a.plan,
+                                                accountId: a.accountId,
+                                                enabled: a.enabled,
+                                            }));
+                                            const toggleIndex = await promptManageAccounts(labels);
+                                            if (toggleIndex === null)
+                                                break;
+                                            const toggled = toggleAccountEnabled(updatedStorage, toggleIndex);
+                                            if (toggled) {
+                                                await saveAccounts(toggled);
+                                                updatedStorage = toggled;
+                                            }
+                                        }
+                                        existingStorage = await loadAccounts();
+                                        existingLabels = (existingStorage?.accounts ?? []).map((a, index) => ({
+                                            index,
+                                            email: a.email,
+                                            plan: a.plan,
+                                            accountId: a.accountId,
+                                            enabled: a.enabled,
+                                        }));
+                                        mode = await promptLoginMode(existingLabels);
+                                    }
                                     startFresh = mode === "fresh";
                                 }
                                 if (startFresh) {
@@ -528,7 +800,7 @@ export const OpenAIAuthPlugin = async ({ client }) => {
                             process.env.SSH_TTY ||
                             process.env.OPENCODE_HEADLESS);
                         const useManualFlow = isHeadless || process.env.OPENCODE_NO_BROWSER === "1";
-                        const existingStorage = await loadAccounts();
+                        const existingStorage = repairedStorage ?? (await loadAccounts());
                         const existingCount = existingStorage?.accounts.length ?? 0;
                         const { pkce, state, url } = await createAuthorizationFlow();
                         let serverInfo = null;
@@ -574,10 +846,14 @@ export const OpenAIAuthPlugin = async ({ client }) => {
                         serverInfo?.close();
                         return {
                             url,
-                            instructions: "Visit the URL above, complete OAuth, then paste either the full redirect URL or the authorization code.",
+                            instructions: "Visit the URL above, complete OAuth, then paste the full redirect URL (recommended) or the authorization code.",
                             method: "code",
                             callback: async (input) => {
-                                const parsed = parseAuthorizationInput(input);
+                                const parsed = parseAuthorizationInputForFlow(input, state);
+                                if (parsed.stateStatus === "mismatch") {
+                                    await showToast("OAuth state mismatch. Paste the redirect URL from this login session.", "error", quietMode);
+                                    return { type: "failed" };
+                                }
                                 if (!parsed.code)
                                     return { type: "failed" };
                                 const tokens = await exchangeAuthorizationCode(parsed.code, pkce.verifier, REDIRECT_URI);
@@ -603,8 +879,8 @@ export const OpenAIAuthPlugin = async ({ client }) => {
                     label: AUTH_LABELS.OAUTH_MANUAL,
                     type: "oauth",
                     authorize: async () => {
-                        const { pkce, url } = await createAuthorizationFlow();
-                        return buildManualOAuthFlow(pkce, url, async (tokens) => {
+                        const { pkce, state, url } = await createAuthorizationFlow();
+                        return buildManualOAuthFlow(pkce, state, url, async (tokens) => {
                             await persistAccount(tokens);
                         });
                     },
@@ -647,6 +923,8 @@ export const OpenAIAuthPlugin = async ({ client }) => {
                         const statuses = [];
                         if (index === activeIndex)
                             statuses.push("active");
+                        if (account.enabled === false)
+                            statuses.push("disabled");
                         const rateLimited = account.rateLimitResetTimes &&
                             Object.values(account.rateLimitResetTimes).some((t) => typeof t === "number" && t > now);
                         if (rateLimited)
@@ -693,6 +971,36 @@ export const OpenAIAuthPlugin = async ({ client }) => {
                     return `Switched to ${formatAccountLabel(account, targetIndex)}`;
                 },
             }),
+            "openai-accounts-toggle": tool({
+                description: "Enable or disable an OpenAI account by index (1-based).",
+                args: {
+                    index: tool.schema.number().describe("Account number (1-based)"),
+                },
+                async execute({ index }) {
+                    const storage = await loadAccounts();
+                    if (!storage || storage.accounts.length === 0) {
+                        return "No OpenAI accounts configured. Run: opencode auth login";
+                    }
+                    const targetIndex = Math.floor((index ?? 0) - 1);
+                    if (targetIndex < 0 || targetIndex >= storage.accounts.length) {
+                        return `Invalid account number: ${index}\nValid range: 1-${storage.accounts.length}`;
+                    }
+                    const updated = toggleAccountEnabled(storage, targetIndex);
+                    if (!updated) {
+                        return `Failed to toggle account number: ${index}`;
+                    }
+                    await saveAccounts(updated);
+                    const account = updated.accounts[targetIndex];
+                    if (cachedAccountManager) {
+                        const live = cachedAccountManager.getAccountByIndex(targetIndex);
+                        if (live)
+                            live.enabled = account?.enabled !== false;
+                    }
+                    const enabled = account?.enabled !== false;
+                    const verb = enabled ? "Enabled" : "Disabled";
+                    return `${verb} ${formatAccountLabel(account, targetIndex)} (${targetIndex + 1}/${updated.accounts.length})`;
+                },
+            }),
         },
     };
 };