Fix imported account refresh authority and reused-token recovery

codex-rs/cli/src/account_cmd.rs

@@ -95,11 +95,11 @@ fn print_accounts(accounts: Vec<AccountProfile>) {
         return;
     }
 
-    println!("ID  Label  Enabled  Priority");
+    println!("ID  Label  Enabled  Login required  Priority");
     for account in accounts {
         println!(
-            "{}  {}  {}  {}",
-            account.id, account.label, account.enabled, account.priority
+            "{}  {}  {}  {}  {}",
+            account.id, account.label, account.enabled, account.login_required, account.priority
         );
     }
 }

codex-rs/cli/src/doctor.rs

@@ -370,13 +370,17 @@ async fn build_report(
                 reachability_check,
             ) = tokio::join!(
                 async { run_sync_check("config", progress.clone(), || config_check(config)) },
-                async { run_sync_check("auth", progress.clone(), || auth_check(config)) },
+                async {
+                    run_sync_check("auth", progress.clone(), || {
+                        auth_check(config, auth_manager.as_ref())
+                    })
+                },
                 async { run_sync_check("updates", progress.clone(), || updates_check(config)) },
                 async { run_sync_check("network", progress.clone(), network_check) },
                 run_async_check(
                     "websocket",
                     progress.clone(),
-                    websocket_reachability_check(config, Some(auth_manager)),
+                    websocket_reachability_check(config, Some(Arc::clone(&auth_manager))),
                 ),
                 run_async_check("MCP", progress.clone(), mcp_check(config)),
                 async {
@@ -1172,7 +1176,7 @@ fn config_toml_details(config: &Config, details: &mut Vec<String>) {
     }
 }
 
-fn auth_check(config: &Config) -> DoctorCheck {
+fn auth_check(config: &Config, auth_manager: &AuthManager) -> DoctorCheck {
     let mut details = Vec::new();
     let auth_path = config.codex_home.join("auth.json");
     details.push(format!(
@@ -1218,7 +1222,19 @@ fn auth_check(config: &Config) -> DoctorCheck {
                 "stored agent identity: {}",
                 auth.agent_identity.is_some()
             ));
-            let auth_issues = stored_auth_issues(&auth, env_var_present);
+            let imported_auth_is_usable = auth_manager.active_account_id().is_some()
+                && auth_manager
+                    .auth_cached()
+                    .and_then(|auth| auth.get_token_data().ok())
+                    .is_some_and(|tokens| {
+                        !tokens.access_token.trim().is_empty()
+                            && !tokens.refresh_token.trim().is_empty()
+                    });
+            let auth_issues = if imported_auth_is_usable {
+                Vec::new()
+            } else {
+                stored_auth_issues(&auth, env_var_present)
+            };
             details.extend(
                 auth_issues
                     .iter()

codex-rs/cli/src/login.rs

@@ -10,6 +10,7 @@
 use codex_config::types::AuthCredentialsStoreMode;
 use codex_core::config::Config;
 use codex_login::AuthKeyringBackendKind;
+use codex_login::AuthManager;
 use codex_login::AuthRouteConfig;
 use codex_login::CLIENT_ID;
 use codex_login::CodexAuth;
@@ -428,6 +429,7 @@ pub async fn run_login_status(cli_config_overrides: CliConfigOverrides) -> ! {
     match CodexAuth::from_auth_storage(
         &config.codex_home,
         config.cli_auth_credentials_store_mode,
+        config.forced_chatgpt_workspace_id.as_deref(),
         Some(&config.chatgpt_base_url),
         config.auth_keyring_backend_kind(),
         auth_route_config.as_ref(),
@@ -478,16 +480,10 @@ pub async fn run_login_status(cli_config_overrides: CliConfigOverrides) -> ! {
 
 pub async fn run_logout(cli_config_overrides: CliConfigOverrides) -> ! {
     let config = load_config_or_exit(cli_config_overrides).await;
-    let auth_route_config = config.auth_route_config();
+    let auth_manager =
+        AuthManager::shared_from_config(&config, /*enable_codex_api_key_env*/ false).await;
 
-    match logout_with_revoke(
-        &config.codex_home,
-        config.cli_auth_credentials_store_mode,
-        config.auth_keyring_backend_kind(),
-        auth_route_config.as_ref(),
-    )
-    .await
-    {
+    match auth_manager.logout_with_revoke().await {
         Ok(true) => {
             eprintln!("Successfully logged out");
             std::process::exit(0);

codex-rs/cli/src/plugin_cmd.rs

@@ -608,6 +608,7 @@ pub(crate) async fn load_cli_auth_mode(config: &Config) -> Option<AuthMode> {
     CodexAuth::from_auth_storage(
         &config.codex_home,
         config.cli_auth_credentials_store_mode,
+        config.forced_chatgpt_workspace_id.as_deref(),
         Some(&config.chatgpt_base_url),
         config.auth_keyring_backend_kind(),
         auth_route_config.as_ref(),

codex-rs/core/tests/suite/client.rs

@@ -1554,6 +1554,7 @@ async fn prefers_apikey_when_config_prefers_apikey_even_with_chatgpt_tokens() {
     let auth = CodexAuth::from_auth_storage(
         codex_home.path(),
         AuthCredentialsStoreMode::File,
+        /*forced_chatgpt_workspace_id*/ None,
         /*chatgpt_base_url*/ None,
         AuthKeyringBackendKind::default(),
         /*auth_route_config*/ None,