opencode-openai-codex-multi-auth 4.5.6 → 4.5.10

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAQ,KAAK,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AA4G1E;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,gBAAgB,EAAE,MAu5B9B,CAAC;AAEF,eAAe,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAQ,KAAK,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AA+H1E;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,gBAAgB,EAAE,MA+sC9B,CAAC;AAEF,eAAe,gBAAgB,CAAC"}

package/dist/index.js

@@ -22,7 +22,7 @@
  * @repository https://github.com/numman-ali/opencode-openai-codex-auth
  */
 import { tool } from "@opencode-ai/plugin";
-import { createAuthorizationFlow, exchangeAuthorizationCode, parseAuthorizationInput, REDIRECT_URI, } from "./lib/auth/auth.js";
+import { createAuthorizationFlow, exchangeAuthorizationCode, parseAuthorizationInputForFlow, REDIRECT_URI, } from "./lib/auth/auth.js";
 import { openBrowserUrl } from "./lib/auth/browser.js";
 import { startLocalOAuthServer } from "./lib/auth/server.js";
 import { getAccountSelectionStrategy, getCodexMode, getDefaultRetryAfterMs, getMaxBackoffMs, getMaxCacheFirstWaitSeconds, getPidOffsetEnabled, getQuietMode, getRateLimitDedupWindowMs, getRateLimitStateResetMs, getRateLimitToastDebounceMs, getRequestJitterMaxMs, getRetryAllAccountsMaxRetries, getRetryAllAccountsMaxWaitMs, getRetryAllAccountsRateLimited, getSchedulingMode, getSwitchOnFirstRateLimit, getTokenRefreshSkewMs, loadPluginConfig, } from "./lib/config.js";
@@ -30,14 +30,17 @@ import { AUTH_LABELS, CODEX_BASE_URL, DUMMY_API_KEY, HTTP_STATUS, LOG_STAGES, PL
 import { logRequest, logDebug } from "./lib/logger.js";
 import { createCodexHeaders, extractRequestUrl, handleErrorResponse, handleSuccessResponse, rewriteUrlForCodex, transformRequestForCodex, } from "./lib/request/fetch-helpers.js";
 import { AccountManager, extractAccountEmail, extractAccountId, extractAccountPlan, formatAccountLabel, formatWaitTime, isOAuthAuth, needsIdentityHydration, sanitizeEmail, } from "./lib/accounts.js";
-import { promptAddAnotherAccount, promptLoginMode, promptManageAccounts, promptOAuthCallbackValue, } from "./lib/cli.js";
+import { promptAddAnotherAccount, promptLoginMode, promptManageAccounts, promptOAuthCallbackValue, promptRepairAccounts, } from "./lib/cli.js";
 import { withTerminalModeRestored } from "./lib/terminal.js";
-import { getStoragePath, loadAccounts, saveAccounts, toggleAccountEnabled } from "./lib/storage.js";
+import { configureStorageForCurrentCwd, configureStorageForPluginConfig, } from "./lib/storage-scope.js";
+import { getStoragePath, getStorageScope, autoQuarantineCorruptAccountsFile, inspectAccountsFile, loadAccounts, quarantineAccounts, quarantineCorruptFile, replaceAccountsFile, saveAccounts, toggleAccountEnabled, writeQuarantineFile, } from "./lib/storage.js";
 import { findAccountMatchIndex } from "./lib/account-matching.js";
 import { getModelFamily, MODEL_FAMILIES } from "./lib/prompts/codex.js";
 import { getHealthTracker, getTokenTracker } from "./lib/rotation.js";
 import { RateLimitTracker, decideRateLimitAction, parseRateLimitReason } from "./lib/rate-limit.js";
+import { codexStatus } from "./lib/codex-status.js";
 import { ProactiveRefreshQueue, createRefreshScheduler, } from "./lib/refresh-queue.js";
+import { formatToastMessage } from "./lib/formatting.js";
 const RATE_LIMIT_SHORT_RETRY_THRESHOLD_MS = 5_000;
 const AUTH_FAILURE_COOLDOWN_MS = 60_000;
 const MAX_ACCOUNTS = 10;
@@ -83,22 +86,26 @@ function parseRetryAfterMs(headers) {
 export const OpenAIAuthPlugin = async ({ client }) => {
     let cachedAccountManager = null;
     let proactiveRefreshScheduler = null;
+    configureStorageForPluginConfig(loadPluginConfig(), process.cwd());
     const showToast = async (message, variant = "info", quietMode = false) => {
         if (quietMode)
             return;
         try {
-            await client.tui.showToast({ body: { message, variant } });
+            await client.tui.showToast({ body: { message: formatToastMessage(message), variant } });
         }
         catch {
             // ignore (non-TUI contexts)
         }
     };
-    const buildManualOAuthFlow = (pkce, url, onSuccess) => ({
+    const buildManualOAuthFlow = (pkce, expectedState, url, onSuccess) => ({
         url,
         method: "code",
         instructions: AUTH_LABELS.INSTRUCTIONS_MANUAL,
         callback: async (input) => {
-            const parsed = parseAuthorizationInput(input);
+            const parsed = parseAuthorizationInputForFlow(input, expectedState);
+            if (parsed.stateStatus === "mismatch") {
+                return { type: "failed" };
+            }
             if (!parsed.code) {
                 return { type: "failed" };
             }
@@ -181,9 +188,16 @@ export const OpenAIAuthPlugin = async ({ client }) => {
                 if (!isOAuthAuth(auth)) {
                     return {};
                 }
+                const pluginConfig = loadPluginConfig();
+                configureStorageForPluginConfig(pluginConfig, process.cwd());
+                const quietMode = getQuietMode(pluginConfig);
                 const accountManager = await AccountManager.loadFromDisk(auth);
                 cachedAccountManager = accountManager;
                 if (accountManager.getAccountCount() === 0) {
+                    const quarantinePath = await autoQuarantineCorruptAccountsFile();
+                    if (quarantinePath) {
+                        await showToast("Accounts file was corrupted and has been quarantined. Run `opencode auth login`.", "warning", quietMode);
+                    }
                     logDebug(`[${PLUGIN_NAME}] No OAuth accounts available (run opencode auth login)`);
                     return {};
                 }
@@ -193,11 +207,9 @@ export const OpenAIAuthPlugin = async ({ client }) => {
                     global: providerConfig?.options || {},
                     models: providerConfig?.models || {},
                 };
-                const pluginConfig = loadPluginConfig();
                 const codexMode = getCodexMode(pluginConfig);
                 const accountSelectionStrategy = getAccountSelectionStrategy(pluginConfig);
                 const pidOffsetEnabled = getPidOffsetEnabled(pluginConfig);
-                const quietMode = getQuietMode(pluginConfig);
                 const tokenRefreshSkewMs = getTokenRefreshSkewMs(pluginConfig);
                 const proactiveRefreshEnabled = (() => {
                     const rawConfig = pluginConfig;
@@ -236,6 +248,8 @@ export const OpenAIAuthPlugin = async ({ client }) => {
                         getTasks: () => {
                             const tasks = [];
                             for (const account of accountManager.getAccountsSnapshot()) {
+                                if (account.enabled === false)
+                                    continue;
                                 if (!Number.isFinite(account.expires))
                                     continue;
                                 tasks.push({
@@ -243,7 +257,7 @@ export const OpenAIAuthPlugin = async ({ client }) => {
                                     expires: account.expires ?? 0,
                                     refresh: async () => {
                                         const live = accountManager.getAccountByIndex(account.index);
-                                        if (!live)
+                                        if (!live || live.enabled === false)
                                             return { type: "failed" };
                                         const refreshed = await accountManager.refreshAccountWithFallback(live);
                                         if (refreshed.type !== "success")
@@ -327,8 +341,36 @@ export const OpenAIAuthPlugin = async ({ client }) => {
                             abortSignal?.addEventListener("abort", onAbort, { once: true });
                         });
                         let allRateLimitedRetries = 0;
+                        let autoRepairAttempted = false;
                         while (true) {
                             const accountCount = accountManager.getAccountCount();
+                            if (!autoRepairAttempted && accountCount === 0) {
+                                const legacyAccounts = accountManager.getLegacyAccounts();
+                                if (legacyAccounts.length > 0) {
+                                    autoRepairAttempted = true;
+                                    const repair = await accountManager.repairLegacyAccounts();
+                                    const snapshot = accountManager.getStorageSnapshot();
+                                    let quarantinePath = null;
+                                    if (repair.quarantined.length > 0) {
+                                        const quarantinedTokens = new Set(repair.quarantined.map((account) => account.refreshToken));
+                                        const quarantineEntries = snapshot.accounts.filter((account) => quarantinedTokens.has(account.refreshToken));
+                                        const quarantineResult = await quarantineAccounts(snapshot, quarantineEntries, "legacy-auto-repair-failed");
+                                        quarantinePath = quarantineResult.quarantinePath;
+                                        accountManager.removeAccountsByRefreshToken(quarantinedTokens);
+                                    }
+                                    else {
+                                        await replaceAccountsFile(snapshot);
+                                    }
+                                    if (repair.quarantined.length > 0 && quarantinePath) {
+                                        logDebug(`[${PLUGIN_NAME}] Auto-repair quarantined: ${quarantinePath}`);
+                                        await showToast(`Auto-repair failed for ${repair.quarantined.length} account(s).`, "warning", quietMode);
+                                    }
+                                    else if (repair.repaired.length > 0) {
+                                        await showToast(`Auto-repaired ${repair.repaired.length} account(s).`, "success", quietMode);
+                                    }
+                                    continue;
+                                }
+                            }
                             const attempted = new Set();
                             while (attempted.size < Math.max(1, accountCount)) {
                                 const account = accountManager.getCurrentOrNextForFamily(modelFamily, model, accountSelectionStrategy, usePidOffset);
@@ -407,6 +449,14 @@ export const OpenAIAuthPlugin = async ({ client }) => {
                                     let res;
                                     try {
                                         res = await fetch(url, { ...requestInit, headers });
+                                        // Update Codex rate limit snapshot from response headers
+                                        const codexHeaders = {};
+                                        res.headers.forEach((val, key) => {
+                                            if (key.toLowerCase().startsWith("x-codex-")) {
+                                                codexHeaders[key] = val;
+                                            }
+                                        });
+                                        codexStatus.updateFromHeaders(account, codexHeaders);
                                     }
                                     catch (err) {
                                         if (tokenConsumed) {
@@ -497,12 +547,35 @@ export const OpenAIAuthPlugin = async ({ client }) => {
                                 await sleep(waitMs);
                                 continue;
                             }
-                            const storePath = getStoragePath();
-                            const waitLabel = waitMs > 0 ? formatWaitTime(waitMs) : "a bit";
-                            const message = accountManager.getAccountCount() === 0
-                                ? "No OpenAI accounts configured. Run `opencode auth login`."
-                                : `All ${accountManager.getAccountCount()} account(s) are rate-limited. Try again in ${waitLabel} or add another account with \`opencode auth login\`. (Storage: ${storePath})`;
-                            return new Response(JSON.stringify({ error: { message } }), {
+                            // Build detailed inline error message
+                            const now = Date.now();
+                            const accounts = accountManager.getAccountsSnapshot();
+                            const statusLines = [
+                                `All ${accountManager.getAccountCount()} account(s) are currently unavailable.`,
+                                `Next reset in approximately ${formatWaitTime(waitMs)}.`,
+                                "",
+                                "Account Status:",
+                            ];
+                            accounts.forEach((acc, idx) => {
+                                if (acc.enabled === false)
+                                    return;
+                                const label = formatAccountLabel(acc, idx);
+                                const rateLimited = acc.rateLimitResetTimes &&
+                                    Object.values(acc.rateLimitResetTimes).some((t) => typeof t === "number" && t > now);
+                                const coolingDown = typeof acc.coolingDownUntil === "number" && acc.coolingDownUntil > now;
+                                let status = "ok";
+                                if (rateLimited)
+                                    status = "rate-limited";
+                                else if (coolingDown)
+                                    status = "cooldown";
+                                statusLines.push(`- ${label} [${status}]`);
+                                const codexLines = codexStatus.renderStatus(acc);
+                                if (codexLines.length > 0 && !codexLines[0]?.includes("No Codex status")) {
+                                    statusLines.push(...codexLines.map((l) => "  " + l.trim()));
+                                }
+                            });
+                            statusLines.push("", "Run `opencode auth login` to add more accounts.");
+                            return new Response(JSON.stringify({ error: { message: statusLines.join("\n") } }), {
                                 status: 429,
                                 headers: { "content-type": "application/json; charset=utf-8" },
                             });
@@ -528,8 +601,75 @@ export const OpenAIAuthPlugin = async ({ client }) => {
                      */
                     authorize: async (inputs) => {
                         const pluginConfig = loadPluginConfig();
+                        configureStorageForPluginConfig(pluginConfig, process.cwd());
                         const quietMode = getQuietMode(pluginConfig);
                         const isCliFlow = Boolean(inputs);
+                        const notifyRepairResult = async (message) => {
+                            if (isCliFlow) {
+                                console.log(`\n${message}\n`);
+                                return;
+                            }
+                            await showToast(message, "info", quietMode);
+                        };
+                        const maybeRepairAccounts = async () => {
+                            const inspection = await inspectAccountsFile();
+                            if (inspection.status === "missing" || inspection.status === "ok") {
+                                return null;
+                            }
+                            const corruptCount = inspection.status === "corrupt-file"
+                                ? 1
+                                : inspection.corruptEntries.length;
+                            const legacyCount = inspection.status === "needs-repair" ? inspection.legacyEntries.length : 0;
+                            const shouldRepair = await promptRepairAccounts({
+                                legacyCount,
+                                corruptCount,
+                            });
+                            if (!shouldRepair)
+                                return null;
+                            const quarantinePaths = [];
+                            if (inspection.status === "corrupt-file") {
+                                const quarantinePath = await quarantineCorruptFile();
+                                if (quarantinePath) {
+                                    quarantinePaths.push(quarantinePath);
+                                    logDebug(`[${PLUGIN_NAME}] Accounts file quarantined: ${quarantinePath}`);
+                                    await notifyRepairResult("Accounts file was corrupted and quarantined.");
+                                }
+                                return await loadAccounts();
+                            }
+                            if (inspection.corruptEntries.length > 0) {
+                                const quarantinePath = await writeQuarantineFile(inspection.corruptEntries, "corrupt-entry");
+                                quarantinePaths.push(quarantinePath);
+                            }
+                            const storage = await loadAccounts();
+                            if (!storage) {
+                                await notifyRepairResult("Repair skipped: no valid accounts found.");
+                                return null;
+                            }
+                            const manager = new AccountManager(undefined, storage);
+                            const repair = await manager.repairLegacyAccounts();
+                            const snapshot = manager.getStorageSnapshot();
+                            let updatedStorage = snapshot;
+                            if (repair.quarantined.length > 0) {
+                                const quarantinedTokens = new Set(repair.quarantined.map((account) => account.refreshToken));
+                                const quarantineEntries = snapshot.accounts.filter((account) => quarantinedTokens.has(account.refreshToken));
+                                const quarantineResult = await quarantineAccounts(snapshot, quarantineEntries, "legacy-repair-failed");
+                                updatedStorage = quarantineResult.storage;
+                                quarantinePaths.push(quarantineResult.quarantinePath);
+                            }
+                            else {
+                                await replaceAccountsFile(snapshot);
+                            }
+                            const summaryParts = [
+                                `Repaired ${repair.repaired.length}`,
+                                `quarantined ${repair.quarantined.length}`,
+                            ];
+                            if (quarantinePaths.length > 0) {
+                                logDebug(`[${PLUGIN_NAME}] Repair quarantine paths: ${quarantinePaths.join(", ")}`);
+                            }
+                            await notifyRepairResult(`Account repair complete. ${summaryParts.join(", ")}.`);
+                            return updatedStorage;
+                        };
+                        const repairedStorage = await maybeRepairAccounts();
                         // CLI flow (`opencode auth login`) passes inputs; TUI does not.
                         if (isCliFlow) {
                             debugAuth("[OAuthAuthorize] Starting OAuth flow in CLI mode");
@@ -541,8 +681,15 @@ export const OpenAIAuthPlugin = async ({ client }) => {
                                     const { pkce, state, url } = await createAuthorizationFlow();
                                     console.log("\nOAuth URL:\n" + url + "\n");
                                     if (noBrowser) {
-                                        const callbackInput = await promptOAuthCallbackValue("Paste the redirect URL (or just the code) here: ");
-                                        const parsed = parseAuthorizationInput(callbackInput);
+                                        const callbackInput = await promptOAuthCallbackValue("Paste the full redirect URL (recommended). You can also paste code#state or just the code: ");
+                                        const parsed = parseAuthorizationInputForFlow(callbackInput, state);
+                                        if (parsed.stateStatus === "mismatch") {
+                                            console.log("\nOAuth state mismatch. Paste the redirect URL from this login session (the one shown above).\n");
+                                            return { type: "failed" };
+                                        }
+                                        if (parsed.stateStatus === "missing") {
+                                            console.log("\nWarning: redirect state not provided. For best security, paste the full redirect URL.\n");
+                                        }
                                         if (!parsed.code)
                                             return { type: "failed" };
                                         return await exchangeAuthorizationCode(parsed.code, pkce.verifier, REDIRECT_URI);
@@ -557,8 +704,15 @@ export const OpenAIAuthPlugin = async ({ client }) => {
                                     openBrowserUrl(url);
                                     if (!serverInfo || !serverInfo.ready) {
                                         serverInfo?.close();
-                                        const callbackInput = await promptOAuthCallbackValue("Paste the redirect URL (or just the code) here: ");
-                                        const parsed = parseAuthorizationInput(callbackInput);
+                                        const callbackInput = await promptOAuthCallbackValue("Paste the full redirect URL (recommended). You can also paste code#state or just the code: ");
+                                        const parsed = parseAuthorizationInputForFlow(callbackInput, state);
+                                        if (parsed.stateStatus === "mismatch") {
+                                            console.log("\nOAuth state mismatch. Paste the redirect URL from this login session (the one shown above).\n");
+                                            return { type: "failed" };
+                                        }
+                                        if (parsed.stateStatus === "missing") {
+                                            console.log("\nWarning: redirect state not provided. For best security, paste the full redirect URL.\n");
+                                        }
                                         if (!parsed.code)
                                             return { type: "failed" };
                                         return await exchangeAuthorizationCode(parsed.code, pkce.verifier, REDIRECT_URI);
@@ -571,7 +725,7 @@ export const OpenAIAuthPlugin = async ({ client }) => {
                                 };
                                 const authenticated = [];
                                 let startFresh = true;
-                                let existingStorage = await loadAccounts();
+                                let existingStorage = repairedStorage ?? (await loadAccounts());
                                 if (existingStorage && existingStorage.accounts.length > 0) {
                                     const needsHydration = needsIdentityHydration(existingStorage.accounts);
                                     if (needsHydration) {
@@ -609,7 +763,7 @@ export const OpenAIAuthPlugin = async ({ client }) => {
                                                 break;
                                             const toggled = toggleAccountEnabled(updatedStorage, toggleIndex);
                                             if (toggled) {
-                                                await saveAccounts(toggled);
+                                                await saveAccounts(toggled, { preserveRefreshTokens: true });
                                                 updatedStorage = toggled;
                                             }
                                         }
@@ -631,7 +785,7 @@ export const OpenAIAuthPlugin = async ({ client }) => {
                                         accounts: [],
                                         activeIndex: 0,
                                         activeIndexByFamily: {},
-                                    });
+                                    }, { replace: true });
                                 }
                                 while (authenticated.length < MAX_ACCOUNTS) {
                                     console.log(`\n=== OpenAI OAuth (Account ${authenticated.length + 1}) ===`);
@@ -684,7 +838,7 @@ export const OpenAIAuthPlugin = async ({ client }) => {
                             process.env.SSH_TTY ||
                             process.env.OPENCODE_HEADLESS);
                         const useManualFlow = isHeadless || process.env.OPENCODE_NO_BROWSER === "1";
-                        const existingStorage = await loadAccounts();
+                        const existingStorage = repairedStorage ?? (await loadAccounts());
                         const existingCount = existingStorage?.accounts.length ?? 0;
                         const { pkce, state, url } = await createAuthorizationFlow();
                         let serverInfo = null;
@@ -730,10 +884,14 @@ export const OpenAIAuthPlugin = async ({ client }) => {
                         serverInfo?.close();
                         return {
                             url,
-                            instructions: "Visit the URL above, complete OAuth, then paste either the full redirect URL or the authorization code.",
+                            instructions: "Visit the URL above, complete OAuth, then paste the full redirect URL (recommended) or the authorization code.",
                             method: "code",
                             callback: async (input) => {
-                                const parsed = parseAuthorizationInput(input);
+                                const parsed = parseAuthorizationInputForFlow(input, state);
+                                if (parsed.stateStatus === "mismatch") {
+                                    await showToast("OAuth state mismatch. Paste the redirect URL from this login session.", "error", quietMode);
+                                    return { type: "failed" };
+                                }
                                 if (!parsed.code)
                                     return { type: "failed" };
                                 const tokens = await exchangeAuthorizationCode(parsed.code, pkce.verifier, REDIRECT_URI);
@@ -759,8 +917,8 @@ export const OpenAIAuthPlugin = async ({ client }) => {
                     label: AUTH_LABELS.OAUTH_MANUAL,
                     type: "oauth",
                     authorize: async () => {
-                        const { pkce, url } = await createAuthorizationFlow();
-                        return buildManualOAuthFlow(pkce, url, async (tokens) => {
+                        const { pkce, state, url } = await createAuthorizationFlow();
+                        return buildManualOAuthFlow(pkce, state, url, async (tokens) => {
                             await persistAccount(tokens);
                         });
                     },
@@ -776,27 +934,39 @@ export const OpenAIAuthPlugin = async ({ client }) => {
                 description: "List all configured OpenAI OAuth accounts.",
                 args: {},
                 async execute() {
+                    configureStorageForCurrentCwd();
                     const storage = await loadAccounts();
-                    const storePath = getStoragePath();
+                    const { scope, storagePath } = getStorageScope();
+                    const scopeLabel = scope === "project" ? "project" : "global";
                     if (!storage || storage.accounts.length === 0) {
                         return [
-                            "No OpenAI accounts configured.",
-                            "",
-                            "Add accounts:",
-                            "  opencode auth login",
-                            "",
-                            `Storage: ${storePath}`,
+                            `OpenAI Codex Status`,
+                            ``,
+                            `  Scope: ${scopeLabel}`,
+                            `  Accounts: 0`,
+                            ``,
+                            `Add accounts:`,
+                            `  opencode auth login`,
+                            ``,
+                            `Storage: ${storagePath}`,
                         ].join("\n");
                     }
                     const activeIndex = typeof storage.activeIndex === "number" && Number.isFinite(storage.activeIndex)
                         ? storage.activeIndex
                         : 0;
                     const now = Date.now();
+                    const enabledCount = storage.accounts.filter((a) => a.enabled !== false).length;
+                    const rateLimitedCount = storage.accounts.filter((a) => a.rateLimitResetTimes &&
+                        Object.values(a.rateLimitResetTimes).some((t) => typeof t === "number" && t > now)).length;
                     const lines = [
-                        `OpenAI Accounts (${storage.accounts.length}):`,
-                        "",
-                        " #  Label                                     Status",
-                        "----------------------------------------------- ---------------------",
+                        `OpenAI Codex Status`,
+                        ``,
+                        `  Scope: ${scopeLabel}`,
+                        `  Accounts: ${enabledCount}/${storage.accounts.length} enabled`,
+                        ...(rateLimitedCount > 0 ? [`  Rate-limited: ${rateLimitedCount}`] : []),
+                        ``,
+                        ` #  Label                                     Status`,
+                        `--- ----------------------------------------- ---------------------`,
                     ];
                     storage.accounts.forEach((account, index) => {
                         const label = formatAccountLabel(account, index);
@@ -813,9 +983,47 @@ export const OpenAIAuthPlugin = async ({ client }) => {
                             account.coolingDownUntil > now) {
                             statuses.push("cooldown");
                         }
-                        lines.push(`${String(index + 1).padEnd(3)} ${label.padEnd(40)} ${statuses.length > 0 ? statuses.join(", ") : "ok"}`);
+                        lines.push(`${String(index + 1).padEnd(3)} ${label.padEnd(41)} ${statuses.length > 0 ? statuses.join(", ") : "ok"}`);
+                        // Add Codex status details
+                        const codexLines = codexStatus.renderStatus(account);
+                        lines.push(...codexLines);
+                        lines.push(""); // Spacer between accounts
+                    });
+                    lines.push(`Storage: ${storagePath}`);
+                    return lines.join("\n");
+                },
+            }),
+            "status-codex": tool({
+                description: "Show a compact inline status of all OpenAI Codex accounts.",
+                args: {},
+                async execute() {
+                    configureStorageForCurrentCwd();
+                    const storage = await loadAccounts();
+                    if (!storage || storage.accounts.length === 0) {
+                        return "No OpenAI accounts configured. Run `opencode auth login`.";
+                    }
+                    const activeIndex = storage.activeIndex ?? 0;
+                    const now = Date.now();
+                    const lines = ["OpenAI Codex Accounts Status:"];
+                    storage.accounts.forEach((account, index) => {
+                        const label = formatAccountLabel(account, index);
+                        const rateLimited = account.rateLimitResetTimes &&
+                            Object.values(account.rateLimitResetTimes).some((t) => typeof t === "number" && t > now);
+                        const coolingDown = typeof account.coolingDownUntil === "number" && account.coolingDownUntil > now;
+                        const disabled = account.enabled === false;
+                        let status = "ok";
+                        if (disabled)
+                            status = "disabled";
+                        else if (rateLimited)
+                            status = "rate-limited";
+                        else if (coolingDown)
+                            status = "cooldown";
+                        lines.push(`${index === activeIndex ? "*" : "-"} ${label} [${status}]`);
+                        const codexLines = codexStatus.renderStatus(account);
+                        if (codexLines.length > 0 && !codexLines[0]?.includes("No Codex status")) {
+                            lines.push(...codexLines);
+                        }
                     });
-                    lines.push("", `Storage: ${storePath}`);
                     return lines.join("\n");
                 },
             }),
@@ -825,6 +1033,7 @@ export const OpenAIAuthPlugin = async ({ client }) => {
                     index: tool.schema.number().describe("Account number (1-based)"),
                 },
                 async execute({ index }) {
+                    configureStorageForCurrentCwd();
                     const storage = await loadAccounts();
                     if (!storage || storage.accounts.length === 0) {
                         return "No OpenAI accounts configured. Run: opencode auth login";
@@ -843,7 +1052,7 @@ export const OpenAIAuthPlugin = async ({ client }) => {
                         account.lastUsed = Date.now();
                         account.lastSwitchReason = "rotation";
                     }
-                    await saveAccounts(storage);
+                    await saveAccounts(storage, { preserveRefreshTokens: true });
                     if (cachedAccountManager) {
                         cachedAccountManager.setActiveIndex(targetIndex);
                         await cachedAccountManager.saveToDisk();
@@ -851,6 +1060,37 @@ export const OpenAIAuthPlugin = async ({ client }) => {
                     return `Switched to ${formatAccountLabel(account, targetIndex)}`;
                 },
             }),
+            "openai-accounts-toggle": tool({
+                description: "Enable or disable an OpenAI account by index (1-based).",
+                args: {
+                    index: tool.schema.number().describe("Account number (1-based)"),
+                },
+                async execute({ index }) {
+                    configureStorageForCurrentCwd();
+                    const storage = await loadAccounts();
+                    if (!storage || storage.accounts.length === 0) {
+                        return "No OpenAI accounts configured. Run: opencode auth login";
+                    }
+                    const targetIndex = Math.floor((index ?? 0) - 1);
+                    if (targetIndex < 0 || targetIndex >= storage.accounts.length) {
+                        return `Invalid account number: ${index}\nValid range: 1-${storage.accounts.length}`;
+                    }
+                    const updated = toggleAccountEnabled(storage, targetIndex);
+                    if (!updated) {
+                        return `Failed to toggle account number: ${index}`;
+                    }
+                    await saveAccounts(updated, { preserveRefreshTokens: true });
+                    const account = updated.accounts[targetIndex];
+                    if (cachedAccountManager) {
+                        const live = cachedAccountManager.getAccountByIndex(targetIndex);
+                        if (live)
+                            live.enabled = account?.enabled !== false;
+                    }
+                    const enabled = account?.enabled !== false;
+                    const verb = enabled ? "Enabled" : "Disabled";
+                    return `${verb} ${formatAccountLabel(account, targetIndex)} (${targetIndex + 1}/${updated.accounts.length})`;
+                },
+            }),
         },
     };
 };