Auth token invalidated error does not fail over to next healthy account

[ndj888]

Bug Description

When one stored OAuth account returns:

Your authentication token has been invalidated. Please try signing in again. (run `opencode auth login` if this persists)

oc-codex-multi-auth appears to keep selecting that account for the requested model family instead of cooling it down/removing it or failing over to another valid stored account.

In this case, re-running opencode auth login did not fix the normal plugin path because the persisted family routing still pointed at the bad account slot. Manually switching activeIndex and every activeIndexByFamily entry from account slot 0 to account slot 1 immediately restored normal operation.

Steps to Reproduce

1. Configure oc-codex-multi-auth with two OpenAI OAuth accounts.
2. Have account slot 0 selected in ~/.opencode/oc-codex-multi-auth-accounts.json:

{
  "activeIndex": 0,
  "activeIndexByFamily": {
    "gpt-5.4-mini": 0,
    "gpt-5.4": 0,
    "codex": 0
  }
}

3. Account slot 0 starts returning the OpenAI/Codex auth error:

Your authentication token has been invalidated. Please try signing in again. (run `opencode auth login` if this persists)

4. Run a normal request through the plugin:

opencode run -m openai/gpt-5.4-mini "Reply exactly: OK"

5. Compare with --pure, which bypasses the plugin:

opencode --pure run -m openai/gpt-5.4-mini "Reply exactly: OK"
opencode --pure run -m openai/gpt-5.5-fast "Reply exactly: OK"

Expected Behavior

When a selected account returns this token-invalidated auth error, the plugin should treat it as an auth/account health failure and either:

• refresh/re-authenticate that account if possible,
• mark the account or refresh-token group as cooling down/unhealthy,
• remove it after the configured auth failure threshold,
• or at least fail over to the next healthy account in the account pool for that request/model family.

codex-health / codex-doctor --fix should also be able to surface or repair this state without requiring manual JSON edits.

Actual Behavior

Normal plugin mode failed repeatedly with:

Error: Your authentication token has been invalidated. Please try signing in again. (run `opencode auth login` if this persists)

The failure persisted after re-login because the plugin continued routing the model family to account slot 0.

At the same time, bypassing the plugin worked:

opencode --pure run -m openai/gpt-5.4-mini "Reply exactly: OK"
# OK

opencode --pure run -m openai/gpt-5.5-fast "Reply exactly: OK"
# OK

After manually changing the multi-account routing to account slot 1, normal plugin mode worked again:

opencode run -m openai/gpt-5.4-mini "Reply exactly: OK"
# OK

opencode run -m openai/gpt-5.5-fast "Reply exactly: OK"
# OK

Environment

• opencode version: 1.17.3
• oc-codex-multi-auth version: 6.3.2
• OS: macOS 26.2
• Node.js: v26.0.0
• Account pool: 2 OpenAI OAuth accounts

Notes / Possible Cause

This looks related to the request/stream error path rather than the token refresh path:

• the plugin already has auth refresh failure handling, cooldown, and removal thresholds;
• rate limits, server errors, unsupported models, and deactivated workspaces appear to have rotation paths;
• but this token-invalidated AI_APICallError appears to bubble out as a normal request failure and does not mark the selected account unhealthy or try the next account.

Related but not identical to #156. That issue covered duplicate accounts / disabled valid logins. This case had two stored accounts and was fixed by moving family routing from the invalidated slot to the healthy slot.

Compliance Checklist

• I'm using this plugin for personal development only
• I have an active ChatGPT Plus/Pro subscription
• This issue is not related to attempting commercial use or TOS violations
• I've reviewed the FAQ and Troubleshooting sections

[coderabbitai]

🔗 Related PRs

#64 - fix: preserve multi-org accounts and prevent cascading auth-removal [merged]
#85 - fix: gracefully handle deactivated_workspace — remove only the dead workspace, preserve siblings [merged]
#142 - fix(routing): drop gpt-5.5-pro (ChatGPT-only) and add gpt-5.5-fast + scoped auto-fallback [merged]
#154 - fix: handle normalized codex fallback [merged]
#158 - fix: resolve open oauth diagnostics issues [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[ndj888]

Additional datapoint from the same machine: after the first manual repair, the plugin state reverted back to activeIndex: 0 and every activeIndexByFamily entry back to 0. Normal plugin mode failed again with the same token-invalidated error, while --pure still succeeded.

A more stable workaround was to quarantine the bad slot in ~/.opencode/oc-codex-multi-auth-accounts.json:

{
  "accounts": [
    { "enabled": false },
    { "enabled": true }
  ],
  "activeIndex": 1,
  "activeIndexByFamily": {
    "gpt-5.4-mini": 1,
    "gpt-5.4": 1,
    "codex": 1
  }
}

After disabling slot 0 and routing all families to slot 1, normal plugin mode succeeded again for both:

opencode run -m openai/gpt-5.4-mini "Reply exactly: OK"
# OK

opencode run -m openai/gpt-5.5-fast "Reply exactly: OK"
# OK

This suggests the plugin can reselect/persist the invalidated account slot unless it is explicitly disabled, which reinforces that token-invalidated stream/API errors should mark the selected account unhealthy and fail over automatically.