[bug] history between accounts not shared

[pickuperast]

Summary

Feels like history is not being shared accross accounts.

Reproduction

1. turn on auto rotation of tokens
2. enter into codex via "codex --yolo"
3. open history "/resume"

Expected Behavior

All previous history branches should be opened

Actual Behavior

I cal load History only produced by selected account

Environment

• codex --version: v0.140.0
• codex-multi-auth status output summary:

Accounts (3)
Storage: C:\Users\Snt\.codex\multi-auth\openai-codex-accounts.json
Selection reason: account 3 (Lowest risk ready account (low, score 0).)
Storage health: healthy
Runtime: responses=0, refresh=0, probes=10, budgetExhaustions=0
Last runtime account: Account 3
Runtime in use: account 3 (app-bind)

1. Account 1 (Personal (role:owner) [id:Zey***], [Token account [id:2d6***]], s.se***@gmail.com, id:Zey***) used 3m 27s ago
   workspaces:
     * 1. [Token account [id:2d6***]] id:2d60e5 (active)
     - 2. [Personal (role:owner) [id:Zey***]] id:Zey***
2. Account 2 (Personal (role:owner) [id:bxz***], [Token account [id:369***]], m***@gmail.com, id:bxzU27) used 3m 27s ago
   workspaces:
     * 1. [Token account [id:369***]] id:369*** (active)
     - 2. [Personal (role:owner) [id:bxz***]] id:bxz***
3. Account 3 (Personal (role:owner) [id:amJ***], sana***@gmail.com, id:amJ***) [current] used 1s ago
   workspaces:
     - 1. [Token account [id:11***]] id:11f***
     * 2. [Personal (role:owner) [id:amJ***]] id:amJ*** (active)

• codex-multi-auth rotation status output summary, if runtime rotation is involved:
• npm ls -g codex-multi-auth: 2.3.0
• OS: Windows
• Node.js: 24

Compliance Confirmation

• [+ ] I am using this project for personal development workflows.
• [ +] This report does not request policy bypasses or prohibited usage.
• [ +] I removed any secrets/tokens from this report.

[coderabbitai]

Coding Plan

Summary

• root cause is codex cli's provider-name filtering combined with potential server-side per-account session scoping
• phase 1 documents the limitation and workarounds clearly since this is partially upstream behavior
• phase 2 provides a local utility to list all sessions bypassing provider filtering
• phase 3 is optional and depends on api availability for true cross-account aggregation

Design Choices

Design Choice 1: is the session filtering happening at the local codex cli level (provider name matching) or at the openai api level (per-account server-side storage)?

Options Considered:

1. local-only filtering: codex cli reads rollout files and filters by provider. fix by normalizing provider metadata.
2. server-side scoping: openai api returns only sessions belonging to the authenticated account. fix requires cross-account api aggregation.
3. both: combination of local provider filtering and server-side account scoping.

Chosen Option: 3

Rationale: both layers likely contribute. documentation should address both causes. a workaround can address local filtering, but server-side scoping requires a new cross-account listing feature.

💡 User Tips

Regenerate the plan with different choices with @coderabbitai <feedback>.

Implementation Steps

Phase 1: Documentation Enhancement

update troubleshooting.md and related docs to clearly explain why history appears account-scoped and provide actionable workarounds.

Task 1: Expand Troubleshooting Entry for History Visibility

describe the root cause (provider filtering + server-side account scoping) and provide step-by-step workarounds.

• update docs/troubleshooting.md line 82 to expand the existing entry with:
  • root cause 1: codex cli filters local sessions by model_provider in rollout metadata
  • root cause 2: openai api may scope session history per-account server-side
  • workaround: run codex-multi-auth rotation unbind-app or codex-multi-auth rotation disable before browsing history
  • workaround: use codex-multi-auth switch <n> to manually select the account whose history you want to browse
• add cross-reference in docs/reference/commands.md under the rotation section

Task 2: Add Known Limitations Section to README

surface this limitation prominently so users understand the tradeoff.

• add a "known limitations" section to README.md explaining that multi-account rotation scatters history across accounts and providers
• link to troubleshooting.md for detailed workarounds

🤖 Prompt for AI agents

this phase is purely documentation — update existing markdown files to surface
root causes and workarounds for the history visibility bug.

- in `docs/troubleshooting.md` at line 82, expand the existing known limitation
entry:
- document root cause 1: codex cli filters local sessions by `model_provider` in
rollout metadata (referencing `scripts/codex.js:4276` behavior)
- document root cause 2: openai api may scope session history per-account
server-side
- add workaround: run `codex-multi-auth rotation unbind-app` or
`codex-multi-auth rotation disable` before browsing history
- add workaround: use `codex-multi-auth switch <n>` to manually select the
account whose history you want to browse
- in `docs/reference/commands.md`, add a cross-reference under the rotation
section pointing to the troubleshooting entry
- in `README.md`, add a "known limitations" section explaining that
multi-account rotation scatters history across accounts and providers, with a
link to `docs/troubleshooting.md` for detailed workarounds

Phase 2: Local Session Index Utility

provide a command to list all local sessions regardless of provider filtering, giving users visibility into their complete local session history.

Task 1: Add `history` Subcommand to codex-manager

create a new command that reads local session files directly, bypassing codex cli's provider filtering.

• create lib/codex-manager/commands/history.ts implementing a list subcommand
• read ~/.codex/session_index.jsonl directly using the existing pattern from scripts/codex.js:4372
• display all indexed sessions with their id, thread_name, and updated_at
• add optional --json flag for machine-readable output
• register the command in lib/codex-manager/account-manager-commands.ts

Task 2: Add Session Detail Lookup

allow users to inspect individual sessions and understand which provider created them.

• extend lib/codex-manager/commands/history.ts with a show <session-id> subcommand
• parse the corresponding rollout file from ~/.codex/sessions/ using the pattern from scripts/codex.js:4276
• extract and display provider metadata if present in the rollout jsonl records
• display the session's first few messages for context

🤖 Prompt for AI agents

this phase adds a new `history` subcommand to codex-manager that reads local
session data directly, bypassing codex cli's provider-name filtering.

- create `lib/codex-manager/commands/history.ts`:
- implement a `list` subcommand that reads `~/.codex/session_index.jsonl`
directly, following the existing read pattern from `scripts/codex.js:4372`
- display all indexed sessions with `id`, `thread_name`, and `updated_at` fields
  - add an optional `--json` flag to output machine-readable json
  - implement a `show <session-id>` subcommand that:
- locates and parses the corresponding rollout jsonl file from
`~/.codex/sessions/` using the pattern from `scripts/codex.js:4276`
- extracts and displays `model_provider` metadata if present in the rollout
jsonl records
    - displays the session's first few messages for context
- register the new `history` command in
`lib/codex-manager/account-manager-commands.ts`
- flag: ensure file reads handle missing or malformed jsonl lines gracefully —
missing regression tests and windows path edge cases (`~` expansion on win32)
should be explicitly called out

Phase 3: (Optional) Cross-Account API Session Listing

if the server-side scoping is confirmed as a significant contributor, implement api-based session aggregation across all accounts in the pool.

Task 1: Implement Multi-Account Session Fetch

query session lists from all healthy accounts and merge the results.

• create lib/history/cross-account.ts with a function to iterate all accounts in the pool
• for each account, refresh its token and query the session listing api (if such an endpoint exists)
• merge results, deduplicating by session id
• sort by updated_at descending
• note: this task depends on discovering whether a session listing api endpoint exists — may be blocked if no such endpoint is available

Task 2: Integrate Cross-Account Listing into history Command

surface the aggregated view in the cli.

• add --all-accounts flag to codex-multi-auth history list
• when flag is present, call the cross-account fetch function from task 3.1
• clearly indicate which account each session belongs to in the output
• warn about potential latency when querying multiple accounts

🤖 Prompt for AI agents

this phase is optional and gated on confirming a usable session listing api
endpoint exists. it implements cross-account api session aggregation.

- create `lib/history/cross-account.ts`:
  - export a function that iterates all accounts in the pool
- for each account, refresh its token and query the session listing api endpoint
  - merge results deduplicating by session id
  - sort merged results by `updated_at` descending
- note: concurrency risk — parallel token refreshes across accounts must be
safe; flag if the token refresh logic in the pool is not concurrency-safe
- extend `lib/codex-manager/commands/history.ts`:
  - add `--all-accounts` flag to the `list` subcommand
- when flag is present, invoke the cross-account fetch from
`lib/history/cross-account.ts`
  - clearly label each session with its originating account in the output
  - emit a warning about potential latency when querying multiple accounts
- flag: this entire phase may be blocked if no session listing api endpoint is
available — verify before implementing. also flag missing regression tests for
the deduplication and merge logic.

Research

session history is stored locally at ~/.codex/sessions/ as rollout jsonl files, indexed by ~/.codex/session_index.jsonl. the index contains only {id, thread_name, updated_at} with no account or provider fields (see scripts/codex.js:4276). when runtime rotation is active, the shadow home config.toml sets model_provider = "codex-multi-auth-runtime-proxy" (see lib/runtime/config-toml.ts:234). the codex cli filters history display by current provider, so sessions created under different provider names become invisible. troubleshooting.md already documents this as a known limitation at line 82.

---

🚀 Next Steps

🤖 All AI agent prompts combined

Task: 1

this phase is purely documentation — update existing markdown files to surface
root causes and workarounds for the history visibility bug.

- in `docs/troubleshooting.md` at line 82, expand the existing known limitation
entry:
- document root cause 1: codex cli filters local sessions by `model_provider` in
rollout metadata (referencing `scripts/codex.js:4276` behavior)
- document root cause 2: openai api may scope session history per-account
server-side
- add workaround: run `codex-multi-auth rotation unbind-app` or
`codex-multi-auth rotation disable` before browsing history
- add workaround: use `codex-multi-auth switch <n>` to manually select the
account whose history you want to browse
- in `docs/reference/commands.md`, add a cross-reference under the rotation
section pointing to the troubleshooting entry
- in `README.md`, add a "known limitations" section explaining that
multi-account rotation scatters history across accounts and providers, with a
link to `docs/troubleshooting.md` for detailed workarounds
===============================================================================

Task: 2

this phase adds a new `history` subcommand to codex-manager that reads local
session data directly, bypassing codex cli's provider-name filtering.

- create `lib/codex-manager/commands/history.ts`:
- implement a `list` subcommand that reads `~/.codex/session_index.jsonl`
directly, following the existing read pattern from `scripts/codex.js:4372`
- display all indexed sessions with `id`, `thread_name`, and `updated_at` fields
  - add an optional `--json` flag to output machine-readable json
  - implement a `show <session-id>` subcommand that:
- locates and parses the corresponding rollout jsonl file from
`~/.codex/sessions/` using the pattern from `scripts/codex.js:4276`
- extracts and displays `model_provider` metadata if present in the rollout
jsonl records
    - displays the session's first few messages for context
- register the new `history` command in
`lib/codex-manager/account-manager-commands.ts`
- flag: ensure file reads handle missing or malformed jsonl lines gracefully —
missing regression tests and windows path edge cases (`~` expansion on win32)
should be explicitly called out
===============================================================================

Task: 3

this phase is optional and gated on confirming a usable session listing api
endpoint exists. it implements cross-account api session aggregation.

- create `lib/history/cross-account.ts`:
  - export a function that iterates all accounts in the pool
- for each account, refresh its token and query the session listing api endpoint
  - merge results deduplicating by session id
  - sort merged results by `updated_at` descending
- note: concurrency risk — parallel token refreshes across accounts must be
safe; flag if the token refresh logic in the pool is not concurrency-safe
- extend `lib/codex-manager/commands/history.ts`:
  - add `--all-accounts` flag to the `list` subcommand
- when flag is present, invoke the cross-account fetch from
`lib/history/cross-account.ts`
  - clearly label each session with its originating account in the output
  - emit a warning about potential latency when querying multiple accounts
- flag: this entire phase may be blocked if no session listing api endpoint is
available — verify before implementing. also flag missing regression tests for
the deduplication and merge logic.

💡 Iterate on the plan with: `@coderabbitai` <feedback>

Example Feedback
- `@coderabbitai` You can skip phase 3. Add a simple unit test case for phase 2.
- `@coderabbitai` For design choice 1 go ahead with option 3 and replan.

---

💬 Have feedback or questions? Drop into our discord!