fix(storage): wrap remaining saveAccounts call sites with retry helper

lib/accounts.ts

@@ -1,4 +1,5 @@
 import type { Auth } from "@codex-ai/sdk";
+import { saveAccountsWithRetry } from "./codex-manager/forecast-report-shared.js";
 import { createLogger } from "./logger.js";
 import {
 	loadAccounts,
@@ -286,7 +287,7 @@ export class AccountManager {
 		const sourceOfTruthStorage = synced.storage ?? stored;
 		if (synced.changed && sourceOfTruthStorage) {
 			try {
-				await saveAccounts(sourceOfTruthStorage);
+				await saveAccountsWithRetry(sourceOfTruthStorage, saveAccounts);
 			} catch (error) {
 				log.debug("Failed to persist Codex CLI source-of-truth sync", {
 					error: String(error),

lib/codex-manager.ts

@@ -38,6 +38,7 @@ import {
 } from "./codex-manager/commands/best.js";
 import { runCheckCommand } from "./codex-manager/commands/check.js";
 import { runConfigExplainCommand } from "./codex-manager/commands/config-explain.js";
+import { saveAccountsWithRetry } from "./codex-manager/forecast-report-shared.js";
 import { runDebugBundleCommand } from "./codex-manager/commands/debug-bundle.js";
 import {
 	parseWhySelectedArgs,
@@ -2358,7 +2359,7 @@ async function runHealthCheck(options: HealthCheckOptions = {}): Promise<void> {
 	}
 
 	if (changed) {
-		await saveAccounts(storage);
+		await saveAccountsWithRetry(storage, saveAccounts);
 	}
 
 	if (
@@ -3207,7 +3208,7 @@ async function persistAndSyncSelectedAccount({
 
 	account.lastUsed = switchNow;
 	account.lastSwitchReason = switchReason;
-	await saveAccounts(storage);
+	await saveAccountsWithRetry(storage, saveAccounts);
 
 	const synced = await setCodexCliActiveSelection({
 		accountId: account.accountId,

test/accounts-edge.test.ts

@@ -122,9 +122,56 @@ describe("accounts edge branches", () => {
     const manager = await AccountManager.loadFromDisk();
 
     expect(manager.getAccountCount()).toBe(1);
+    // Non-retryable error (no errno code) → single attempt, then debug-logged.
     expect(mockSaveAccounts).toHaveBeenCalledTimes(1);
   });
 
+  it("loadFromDisk retries source-of-truth persist on transient EBUSY", async () => {
+    const stored = buildStored([
+      buildStoredAccount({ refreshToken: "stored-1" }),
+    ]);
+    mockLoadAccounts.mockResolvedValue(stored);
+    mockSyncAccountStorageFromCodexCli.mockResolvedValue({
+      storage: stored,
+      changed: true,
+    });
+    const ebusy = Object.assign(new Error("file busy"), { code: "EBUSY" });
+    mockSaveAccounts.mockRejectedValueOnce(ebusy);
+    mockSaveAccounts.mockResolvedValueOnce(undefined);
+    mockLoadCodexCliState.mockResolvedValue({ accounts: [] });
+
+    const { AccountManager } = await importAccountsModule();
+    const manager = await AccountManager.loadFromDisk();
+
+    expect(manager.getAccountCount()).toBe(1);
+    // First attempt EBUSY, second succeeds — retry helper should have called twice.
+    expect(mockSaveAccounts).toHaveBeenCalledTimes(2);
+  });
+
+  it("loadFromDisk exhausts retries on persistent EPERM and continues", async () => {
+    const stored = buildStored([
+      buildStoredAccount({ refreshToken: "stored-1" }),
+    ]);
+    mockLoadAccounts.mockResolvedValue(stored);
+    mockSyncAccountStorageFromCodexCli.mockResolvedValue({
+      storage: stored,
+      changed: true,
+    });
+    const eperm = Object.assign(new Error("permission denied"), {
+      code: "EPERM",
+    });
+    mockSaveAccounts.mockRejectedValue(eperm);
+    mockLoadCodexCliState.mockResolvedValue({ accounts: [] });
+
+    const { AccountManager } = await importAccountsModule();
+    const manager = await AccountManager.loadFromDisk();
+
+    expect(manager.getAccountCount()).toBe(1);
+    // Persistent EPERM exhausts the retry budget (initial + 3 retries = 4
+    // attempts) before lib/accounts.ts catches and continues.
+    expect(mockSaveAccounts).toHaveBeenCalledTimes(4);
+  });
+
   it("hydrates from Codex CLI cache and catches save failures", async () => {
     const now = Date.now();
     const stored = buildStored([

test/codex-manager-cli.test.ts

@@ -3215,9 +3215,10 @@ describe("codex manager cli commands", () => {
 			],
 		});
 		loadQuotaCacheMock.mockResolvedValueOnce(originalQuotaCache);
-		saveAccountsMock.mockRejectedValueOnce(
-			makeErrnoError("save failed", "EBUSY"),
-		);
+		// Use mockRejectedValue (unbounded) so saveAccountsWithRetry's EBUSY retries
+		// also fail; the test asserts the rejection path and that we never silently
+		// drop the error.
+		saveAccountsMock.mockRejectedValue(makeErrnoError("save failed", "EBUSY"));
 		const { runCodexMultiAuthCli } = await import("../lib/codex-manager.js");
 
 		await expect(runCodexMultiAuthCli(["auth", "check"])).rejects.toMatchObject(
@@ -3226,6 +3227,9 @@ describe("codex manager cli commands", () => {
 				message: "save failed",
 			},
 		);
+		// saveAccountsWithRetry must have retried beyond a single attempt; if a
+		// regression replaces it with a raw saveAccounts call, this drops to 1.
+		expect(saveAccountsMock.mock.calls.length).toBeGreaterThan(1);
 		expect(originalQuotaCache).toEqual({
 			byAccountId: {},
 			byEmail: {},
@@ -3541,6 +3545,116 @@ describe("codex manager cli commands", () => {
 		);
 	});
 
+	it("retries saveAccounts on transient EBUSY when persisting best-account switch", async () => {
+		// Regression for the saveAccountsWithRetry call in
+		// persistAndSyncSelectedAccount (lib/codex-manager.ts:3211): a single
+		// EBUSY must NOT abort the switch — the retry helper should recover.
+		const now = Date.now();
+		let storageState = {
+			version: 3,
+			activeIndex: 0,
+			activeIndexByFamily: { codex: 0 },
+			accounts: [
+				{
+					email: "current@example.com",
+					accountId: "acc_current",
+					refreshToken: "refresh-current",
+					accessToken: "access-current",
+					expiresAt: now + 3_600_000,
+					addedAt: now - 2_000,
+					lastUsed: now - 2_000,
+					coolingDownUntil: now + 60_000,
+					enabled: true,
+				},
+				{
+					email: "next@example.com",
+					accountId: "acc_next",
+					refreshToken: "refresh-next",
+					accessToken: "access-next",
+					expiresAt: now + 3_600_000,
+					addedAt: now - 1_000,
+					lastUsed: now - 1_000,
+					enabled: true,
+				},
+			],
+		};
+		loadAccountsMock.mockImplementation(async () =>
+			structuredClone(storageState),
+		);
+		// First save attempt rejects with EBUSY; second succeeds. Without the
+		// retry wrapper this collapses to a single attempt and the switch fails.
+		saveAccountsMock.mockRejectedValueOnce(makeErrnoError("busy", "EBUSY"));
+		saveAccountsMock.mockImplementationOnce(async (nextStorage) => {
+			storageState = structuredClone(nextStorage);
+		});
+		setCodexCliActiveSelectionMock.mockResolvedValueOnce(true);
+
+		const logSpy = vi.spyOn(console, "log").mockImplementation(() => {});
+		const { runCodexMultiAuthCli } = await import("../lib/codex-manager.js");
+
+		const exitCode = await runCodexMultiAuthCli(["auth", "best"]);
+
+		expect(exitCode).toBe(0);
+		expect(saveAccountsMock).toHaveBeenCalledTimes(2);
+		expect(storageState.activeIndex).toBe(1);
+		expect(setCodexCliActiveSelectionMock).toHaveBeenCalledTimes(1);
+		expect(logSpy).toHaveBeenCalledWith(
+			expect.stringContaining("Switched to best account 2"),
+		);
+	});
+
+	it("propagates persistent EBUSY from persistAndSyncSelectedAccount after retry exhaustion", async () => {
+		// Regression for the saveAccountsWithRetry call in
+		// persistAndSyncSelectedAccount: when EBUSY persists past the retry
+		// budget (initial + 3 retries = 4 attempts), the error must propagate
+		// rather than be silently swallowed, and codex-cli must not be told
+		// about a switch that did not actually persist.
+		const now = Date.now();
+		const storageState = {
+			version: 3,
+			activeIndex: 0,
+			activeIndexByFamily: { codex: 0 },
+			accounts: [
+				{
+					email: "current@example.com",
+					accountId: "acc_current",
+					refreshToken: "refresh-current",
+					accessToken: "access-current",
+					expiresAt: now + 3_600_000,
+					addedAt: now - 2_000,
+					lastUsed: now - 2_000,
+					coolingDownUntil: now + 60_000,
+					enabled: true,
+				},
+				{
+					email: "next@example.com",
+					accountId: "acc_next",
+					refreshToken: "refresh-next",
+					accessToken: "access-next",
+					expiresAt: now + 3_600_000,
+					addedAt: now - 1_000,
+					lastUsed: now - 1_000,
+					enabled: true,
+				},
+			],
+		};
+		loadAccountsMock.mockImplementation(async () =>
+			structuredClone(storageState),
+		);
+		saveAccountsMock.mockRejectedValue(makeErrnoError("busy", "EBUSY"));
+
+		const { runCodexMultiAuthCli } = await import("../lib/codex-manager.js");
+
+		await expect(runCodexMultiAuthCli(["auth", "best"])).rejects.toMatchObject(
+			{
+				code: "EBUSY",
+			},
+		);
+		// Initial attempt + 3 retries = 4 calls before throwing.
+		expect(saveAccountsMock).toHaveBeenCalledTimes(4);
+		expect(setCodexCliActiveSelectionMock).not.toHaveBeenCalled();
+	});
+
 	it("parses --model=value for live best selection", async () => {
 		const now = Date.now();
 		loadAccountsMock.mockResolvedValueOnce({