v0.2.12 regression: valid Codex accounts repeatedly marked unauthorized due to refresh_token_invalidated

[Bl0ck154]

After updating to v0.2.12, multiple accounts that are still fully valid and working in Codex are repeatedly shown as unauthorized in Codex Switcher.

This has already happened twice within one day across all accounts.

The error shown by Codex Switcher is:

Token refresh failed: 401 Unauthorized - {
  "error": {
    "message": "Your session has ended. Please log in again.",
    "type": "invalid_request_error",
    "param": null,
    "code": "refresh_token_invalidated"
  }
}

However, the same accounts remain authenticated and continue to work normally in Codex. So the Switcher UI is reporting them as invalid even though the live Codex sessions are valid.

This looks like a regression introduced by the new auth logic in v0.2.12. In particular, the new code treats an expired or malformed id_token as requiring a token refresh even when the access_token is still valid, and usage fetching calls ensure_chatgpt_tokens_fresh(). That means simply refreshing account usage can trigger OAuth refresh attempts for stored accounts.

For multi-account setups this is risky because refresh tokens are rotated/single-use and the stored token may already be stale compared with the live token currently used by Codex. A failed refresh then marks the account as unauthorized even though the actual Codex session is still healthy.

Expected behavior:

• Do not mark an account unauthorized solely because a stored refresh token fails if the live Codex session/access token is still valid.
• Avoid refreshing OAuth tokens just to fetch usage when the current access token is still accepted.
• Prefer/reconcile live credentials from ~/.codex/auth.json whenever they correspond to the same ChatGPT account.
• A stale/invalidated stored refresh token should not make the UI claim that the whole account is logged out when Codex is still authenticated.

This started immediately after upgrading to v0.2.12 and did not behave this way before.

[Bl0ck154]

Also, independently of the auth regression itself: the current error presentation really needs improvement.

Showing users the raw backend JSON response, for example:

Token refresh failed: 401 Unauthorized - { "error": { "message": "Your session has ended. Please log in again.", "type": "invalid_request_error", "param": null, "code": "refresh_token_invalidated" } }

is not a good UX for a desktop application. At this point it would be much better to map known auth errors to clear, human-readable messages and keep the raw JSON/details behind an expandable "Details" section or in logs.

For example, refresh_token_invalidated could be presented as something like: "Codex Switcher's stored refresh token is no longer valid. Your Codex session may still be active. Re-authentication in Switcher may be required."

That would also avoid falsely giving users the impression that their entire Codex account/session is invalid when the problem may only be with Switcher's stored credential state.