feat(history): add provider-agnostic local session browser (#612)

docs/reference/commands.md

@@ -80,6 +80,7 @@ Compatibility forms are supported for migrations and wrapper-routed environments
 | `codex-multi-auth models` | Inspect local model/account capability views |
 | `codex-multi-auth monitor` | Aggregate runtime, usage, policy, quota, model, and project state |
 | `codex-multi-auth why-selected [--now|--last]` | Explain which account the selector picks now or via the last persisted runtime snapshot |
+| `codex-multi-auth history [list\|show <id>]` | List every local Codex session across all providers, bypassing the `model_provider` filtering that hides threads in `codex resume` while runtime rotation / app bind is active |
 | `codex-multi-auth rotation enable\|disable\|status\|bind-app\|unbind-app` | Manage the default-on runtime Responses proxy for live Codex account rotation |
 
 ---
@@ -90,7 +91,7 @@ Compatibility forms are supported for migrations and wrapper-routed environments
 | --- | --- | --- |
 | `--device-auth` | login | Use the OpenAI Codex device-code flow for remote/headless login (mutually exclusive with `--manual` / `--no-browser`) |
 | `--manual`, `--no-browser` | login | Skip browser launch and use manual callback flow (mutually exclusive with `--device-auth`) |
-| `--json` | verify-flagged, verify, why-selected, best, forecast, report, usage, budget, models, monitor, integrations, fix, doctor, config explain, debug bundle | Print machine-readable output |
+| `--json` | verify-flagged, verify, why-selected, best, forecast, report, usage, budget, models, monitor, integrations, fix, doctor, config explain, debug bundle, history | Print machine-readable output |
 | `--csv` | usage | Print or write CSV bucket output |
 | `--explain` | forecast, report | Include reasoning details (forecast text/JSON, report text) |
 | `--live` | best, forecast, report, fix | Use live probe before decisions/output |
@@ -227,6 +228,35 @@ Generated snippets use `CODEX_MULTI_AUTH_LOCAL_KEY`. The Python snippet uses
 
 ---
 
+## `codex-multi-auth history`
+
+Lists local Codex sessions by reading the rollout files under
+`<codex-home>/sessions` (default `~/.codex/sessions`, honoring `CODEX_HOME`)
+directly. Codex's own `codex resume` view filters threads by the `model_provider`
+recorded in each session; while runtime rotation or app bind is active that
+provider is `codex-multi-auth-runtime-proxy`, so sessions created under the
+native `openai` provider (or vice versa) are hidden from `resume` even though
+the files are still present. This command shows every session regardless of
+provider, which is the fix for "history not shared across accounts" reports —
+the split is by provider name, not by account.
+
+Usage:
+
+```bash
+codex-multi-auth history [list] [--json]
+codex-multi-auth history show <session-id> [--json]
+```
+
+`list` (the default when no subcommand is given) prints each session's
+`updated_at`, `model_provider`, id, thread name, and cwd, most-recent first.
+`show <id>` prints the provider/originator metadata and the first few user
+messages for a single session. Reopen any session with `codex resume <id>`.
+
+This command is read-only, performs no network calls, and never mutates Codex or
+multi-auth state.
+
+---
+
 ## `codex-multi-auth why-selected`
 
 Explains which account the rotation selector would pick right now, with

docs/troubleshooting.md

@@ -79,7 +79,7 @@ The package does not publish a global `codex` binary. `codex-multi-auth ...` is
 | Accounts progressively lose OAuth tokens while the proxy is active | Rapid account rotation triggers OpenAI's anti-abuse detection, which invalidates tokens in sequence | The proxy detects explicit token-invalidation responses and stops rotating; re-login any invalidated accounts and ensure `minRotationIntervalMs` is at least `60000` (default) |
 | Microsoft/Outlook SSO account gets invalidated on every first request through the proxy | Microsoft OAuth tokens may be invalidated when the proxy presents them from a different IP or device context than where they were issued | The proxy now detects invalidation at both the upstream request and the token-refresh stage; if the problem persists, set `CODEX_AUTH_TOKEN_INVALIDATION_COOLDOWN_MS=600000` (10 min) and re-login, or keep the Microsoft account disabled from the rotation pool via `codex-multi-auth rotation status` |
 | Packaged app still uses normal Codex routing | App bind was not installed or was removed | Run `codex-multi-auth rotation bind-app`, then reopen the app |
-| Codex Desktop history disappears after app bind | Current Codex Desktop builds can filter local threads by the active provider, and app bind switches the real config to `codex-multi-auth-runtime-proxy` | The data is normally still under `~/.codex`; run `codex-multi-auth rotation unbind-app` or `codex-multi-auth rotation disable` to restore the original provider/config before browsing old history |
+| Codex history disappears after app bind, or `/resume` shows only some sessions | Current Codex Desktop and CLI builds filter local threads by the active `model_provider`; app bind / runtime rotation switch the real config to `codex-multi-auth-runtime-proxy`, so threads recorded under the native `openai` provider (or vice versa) are hidden. The split is by provider name, not by account — sessions are not actually scattered per account | The rollout files are all still under `~/.codex/sessions`. Run `codex-multi-auth history` to list every local session across all providers (and `codex-multi-auth history show <id>` for details), then `codex resume <id>` to reopen one. To restore the native `/resume` view, run `codex-multi-auth rotation unbind-app` or `codex-multi-auth rotation disable` |
 | Model speed controls are not visible with rotation | Speed/reasoning controls remain owned by Codex config or CLI flags; the app bind only routes Responses traffic | Set `model_reasoning_effort` in `~/.codex/config.toml` or pass `-c model_reasoning_effort=<level>` for wrapper-launched CLI sessions |
 | App bind needs to be removed | You want the official app config restored | Run `codex-multi-auth rotation unbind-app` or `codex-multi-auth rotation disable` |
 

lib/codex-manager.ts

@@ -78,6 +78,7 @@ import {
 } from "./codex-manager/commands/status.js";
 import { loadPersistedRuntimeObservabilitySnapshot } from "./runtime/runtime-observability.js";
 import { runSwitchCommand } from "./codex-manager/commands/switch.js";
+import { runHistoryCommand } from "./codex-manager/commands/history.js";
 import { runUnpinCommand } from "./codex-manager/commands/unpin.js";
 import { runWorkspaceCommand } from "./codex-manager/commands/workspace.js";
 import { runUsageCommand } from "./codex-manager/commands/usage.js";
@@ -591,6 +592,7 @@ const CLI_COMMAND_HANDLERS: ReadonlyMap<string, CliCommandHandler> = new Map<
 				sanitizeEmail,
 			}),
 	],
+	["history", (rest) => runHistoryCommand(rest)],
 	[
 		"verify",
 		(rest) =>

lib/codex-manager/account-manager-commands.ts

@@ -36,6 +36,7 @@ export const ACCOUNT_MANAGER_COMMANDS = new Set([
 	"monitor",
 	"rotation",
 	"why-selected",
+	"history",
 	"config",
 	"init-config",
 	"debug",