Persist codex auth files and track codexHomePath

Add codexHomePath to CodexAccount and include it in coding/initialization so accounts can reference a local Codex home. Extend AccountStore with codexHomesDirectory and codexHomeURL(for:) to compute stable per-account home directories. Add makeAuthJSON(...) and persistAuthFile(...) in CodexAPIService to generate a normalized auth.json (pretty/sorted JSON with ISO8601 last_refresh) and write it to the account's codexHomePath (attempts to set 0o600 permissions). Update token refresh result to populate codexHomePath and codexAuthJSON.

Update AccountsViewModel to normalize loaded accounts (parse token claims for canonical email/accountId), assign codexHomePath, generate/persist auth JSON on load, deduplicate duplicate accounts preferring healthy/recent validations, and always operate on normalized/canonical accounts when merging or importing. Minor fixes: expose storeDirectory as non-private and persist accounts after setup. These changes ensure local auth files are maintained and account identities are normalized/deduplicated on load.

Author: sameerbajaj

CLAUDE.md

@@ -40,14 +40,15 @@ Always report build status explicitly (`BUILD SUCCEEDED` or failure reason) in h
 
 ### Key Data Flow
 
-**Startup:** `viewModel.setup()` → `AccountStore.load()` → start auto-refresh timer + token keep-alive (every 10 min)
+**Startup:** `viewModel.setup()` → `AccountStore.load()` → normalize each account into its isolated Codex home → start auto-refresh timer + token keep-alive
 
 **Refresh cycle:** `refreshAccount()` → `CodexAPIService.fetchUsageWithRefresh()` → on 401, auto-calls `refreshToken()` → updates `usageData`/`accountStatuses` → persists tokens
 
-**Add account:** `startAddingAccount()` starts `AuthFileWatcher` polling `~/.codex/auth.json` every 2s → detects modification after `codex auth` → parses JWT claims via `JWTParser` → saves to `AccountStore`
+**Add account:** `startAddingAccount()` starts `AuthFileWatcher` polling isolated import home `~/.codex-accounts-import/auth.json` every 2s → detects modification after `codex login` → parses JWT claims via `JWTParser` → saves to `AccountStore` → writes canonical auth to `~/Library/Application Support/CodexAccounts/CodexHomes/<account>/auth.json`
 
 ### Persistence
 - Accounts: `~/Library/Application Support/CodexAccounts/accounts.json` (atomic writes)
+- Per-account Codex homes: `~/Library/Application Support/CodexAccounts/CodexHomes/<account>/auth.json` (canonical auth file per tracked account)
 - Preferences (sort mode, display mode, refresh interval): `UserDefaults` as **stored** `var` properties with `didSet` — never computed getters (breaks `@Observable` reactivity)
 - Watched file: `~/.codex/auth.json` (read-only)
 

CodexAccounts/Models/CodexAccount.swift

@@ -71,6 +71,7 @@ struct CodexAccount: Identifiable, Codable, Hashable {
     var refreshToken: String
     var idToken: String?
     var accountId: String?
+    var codexHomePath: String?
     var codexAuthJSON: String?
     var lastTokenRefresh: Date?
     var lastSuccessfulUsageAt: Date?
@@ -92,7 +93,7 @@ struct CodexAccount: Identifiable, Codable, Hashable {
 
     enum CodingKeys: String, CodingKey {
         case id, email, planType, accessToken, refreshToken
-        case idToken, accountId, codexAuthJSON, lastTokenRefresh
+        case idToken, accountId, codexHomePath, codexAuthJSON, lastTokenRefresh
         case lastSuccessfulUsageAt, lastSuccessfulTokenRefreshAt
         case lastRefreshAttemptAt, lastRefreshFailureAt
         case consecutiveRefreshFailures, authState
@@ -110,6 +111,7 @@ struct CodexAccount: Identifiable, Codable, Hashable {
         refreshToken: String,
         idToken: String? = nil,
         accountId: String? = nil,
+        codexHomePath: String? = nil,
         codexAuthJSON: String? = nil,
         lastTokenRefresh: Date? = nil,
         lastSuccessfulUsageAt: Date? = nil,
@@ -136,6 +138,7 @@ struct CodexAccount: Identifiable, Codable, Hashable {
         self.refreshToken = refreshToken
         self.idToken = idToken
         self.accountId = accountId
+        self.codexHomePath = codexHomePath
         self.codexAuthJSON = codexAuthJSON
         self.lastTokenRefresh = lastTokenRefresh
         self.lastSuccessfulUsageAt = lastSuccessfulUsageAt
@@ -165,6 +168,7 @@ struct CodexAccount: Identifiable, Codable, Hashable {
         refreshToken = try c.decode(String.self, forKey: .refreshToken)
         idToken = try c.decodeIfPresent(String.self, forKey: .idToken)
         accountId = try c.decodeIfPresent(String.self, forKey: .accountId)
+        codexHomePath = try c.decodeIfPresent(String.self, forKey: .codexHomePath)
         codexAuthJSON = try c.decodeIfPresent(String.self, forKey: .codexAuthJSON)
         lastTokenRefresh = try c.decodeIfPresent(Date.self, forKey: .lastTokenRefresh)
         lastSuccessfulUsageAt = try c.decodeIfPresent(Date.self, forKey: .lastSuccessfulUsageAt)

CodexAccounts/Services/AccountStore.swift

@@ -8,18 +8,31 @@
 import Foundation
 
 enum AccountStore {
-    private static var storeDirectory: URL {
+    static var storeDirectory: URL {
         let appSupport = FileManager.default.urls(
             for: .applicationSupportDirectory,
             in: .userDomainMask
         ).first!
         return appSupport.appendingPathComponent("CodexAccounts")
     }
 
+    static var codexHomesDirectory: URL {
+        storeDirectory.appendingPathComponent("CodexHomes")
+    }
+
     private static var storeURL: URL {
         storeDirectory.appendingPathComponent("accounts.json")
     }
 
+    static func codexHomeURL(for account: CodexAccount) -> URL {
+        let stableID = account.accountId?.isEmpty == false ? account.accountId! : account.id
+        let safeID = stableID
+            .replacingOccurrences(of: "/", with: "_")
+            .replacingOccurrences(of: ":", with: "_")
+            .replacingOccurrences(of: " ", with: "_")
+        return codexHomesDirectory.appendingPathComponent(safeID, isDirectory: true)
+    }
+
     static func load() -> [CodexAccount] {
         guard let data = try? Data(contentsOf: storeURL) else { return [] }
         let decoder = JSONDecoder()

CodexAccounts/Services/CodexAPIService.swift

@@ -347,9 +347,56 @@ enum CodexAPIService {
         updated.lastRefreshFailureAt = nil
         updated.consecutiveRefreshFailures = 0
         updated.authState = .healthy
+        updated.codexAuthJSON = makeAuthJSON(for: updated, lastRefresh: now)
+        persistAuthFile(for: updated)
         return updated
     }
 
+    static func persistAuthFile(for account: CodexAccount) {
+        guard let codexHomePath = account.codexHomePath, !codexHomePath.isEmpty else { return }
+
+        let authURL = URL(fileURLWithPath: codexHomePath).appendingPathComponent("auth.json")
+        do {
+            try FileManager.default.createDirectory(
+                at: authURL.deletingLastPathComponent(),
+                withIntermediateDirectories: true
+            )
+            let authJSON = account.codexAuthJSON ?? makeAuthJSON(for: account)
+            try authJSON.write(to: authURL, atomically: true, encoding: .utf8)
+            try? FileManager.default.setAttributes([.posixPermissions: 0o600], ofItemAtPath: authURL.path)
+        } catch {
+            print("CodexAPIService: Failed to persist auth file: \(error)")
+        }
+    }
+
+    static func makeAuthJSON(for account: CodexAccount, lastRefresh: Date? = nil) -> String {
+        var tokens: [String: Any] = [
+            "access_token": account.accessToken,
+            "refresh_token": account.refreshToken,
+        ]
+        if let idToken = account.idToken, !idToken.isEmpty {
+            tokens["id_token"] = idToken
+        }
+        if let accountId = account.accountId, !accountId.isEmpty {
+            tokens["account_id"] = accountId
+        }
+
+        let formatter = ISO8601DateFormatter()
+        formatter.formatOptions = [.withInternetDateTime, .withFractionalSeconds]
+        let auth: [String: Any] = [
+            "auth_mode": "chatgpt",
+            "tokens": tokens,
+            "last_refresh": formatter.string(from: lastRefresh ?? account.lastTokenRefresh ?? Date()),
+        ]
+
+        guard let data = try? JSONSerialization.data(withJSONObject: auth, options: [.prettyPrinted, .sortedKeys]),
+              let text = String(data: data, encoding: .utf8)
+        else {
+            return "{\"auth_mode\":\"chatgpt\",\"tokens\":{}}\n"
+        }
+        return text + "\n"
+    }
+
     private static func responseErrorText(from data: Data) -> String? {
         guard !data.isEmpty else { return nil }
 
@@ -459,6 +506,7 @@ enum CodexAPIService {
             refreshToken: refreshToken,
             idToken: tokens.idToken,
             accountId: tokens.accountId ?? claims.accountId,
+            codexHomePath: codexHome,
             codexAuthJSON: String(data: data, encoding: .utf8),
             lastTokenRefresh: lastRefresh,
             lastSuccessfulTokenRefreshAt: lastRefresh,

CodexAccounts/ViewModels/AccountsViewModel.swift

@@ -318,13 +318,14 @@ final class AccountsViewModel {
         guard !hasSetup else { return }
         hasSetup = true
 
-        accounts = AccountStore.load().map(normalizedAccountOnLoad)
+        accounts = deduplicatedAccounts(AccountStore.load().map(normalizedAccountOnLoad))
         normalizePinnedOrder()
         applyAccountStates()
+        persistAccounts()
         syncCurrentAuthFile()
 
         if accounts.isEmpty, let account = CodexAPIService.readAuthFile() {
-            accounts.append(account)
+            accounts.append(normalizedAccountOnLoad(account))
             persistAccounts()
             detectedUntrackedEmail = nil
         }
@@ -594,12 +595,14 @@ final class AccountsViewModel {
         guard let authAccount = CodexAPIService.readAuthFile() else { return }
         let existingIds = Set(accounts.map(\.id))
 
-        if !existingIds.contains(authAccount.id) {
+        let canonicalAuthAccount = normalizedAccountOnLoad(authAccount)
+
+        if !existingIds.contains(canonicalAuthAccount.id) {
             detectedUntrackedEmail = authAccount.email
             return
         }
 
-        let merged = mergeAuthSnapshot(authAccount)
+        let merged = mergeAuthSnapshot(canonicalAuthAccount)
         detectedUntrackedEmail = nil
 
         if trigger == .authFileSync {
@@ -683,12 +686,13 @@ final class AccountsViewModel {
 
     func addDetectedAccount() {
         guard let account = CodexAPIService.readAuthFile() else { return }
-        if !accounts.contains(where: { $0.id == account.id }) {
-            accounts.append(account)
+        let canonicalAccount = normalizedAccountOnLoad(account)
+        if !accounts.contains(where: { $0.id == canonicalAccount.id }) {
+            accounts.append(canonicalAccount)
             persistAccounts()
-            Task { await refreshAccount(account, trigger: .authFileSync) }
+            Task { await refreshAccount(canonicalAccount, trigger: .authFileSync) }
         } else {
-            _ = mergeAuthSnapshot(account)
+            _ = mergeAuthSnapshot(canonicalAccount)
         }
         detectedUntrackedEmail = nil
     }
@@ -752,10 +756,11 @@ final class AccountsViewModel {
     private func handleAddAccountAuthFileChange() {
         Task {
             try? await Task.sleep(for: .milliseconds(500))
-            guard let account = CodexAPIService.readAuthFile(codexHome: importCodexHome) else {
+            guard let importedAccount = CodexAPIService.readAuthFile(codexHome: importCodexHome) else {
                 addAccountStatus = .error("Could not read auth file. Try again.")
                 return
             }
+            let account = normalizedAccountOnLoad(importedAccount)
 
             if let pendingReauthAccountID,
                pendingReauthAccountID != account.id,
@@ -1382,6 +1387,44 @@ final class AccountsViewModel {
 
     private func normalizedAccountOnLoad(_ account: CodexAccount) -> CodexAccount {
         var normalized = account
+        if let claims = JWTParser.parse(normalized.idToken ?? normalized.accessToken),
+           let tokenEmail = claims.email,
+           tokenEmail.caseInsensitiveCompare(normalized.email) != .orderedSame
+        {
+            normalized = CodexAccount(
+                email: tokenEmail,
+                planType: claims.planType ?? normalized.planType,
+                accessToken: normalized.accessToken,
+                refreshToken: normalized.refreshToken,
+                idToken: normalized.idToken,
+                accountId: claims.accountId ?? normalized.accountId,
+                codexHomePath: normalized.codexHomePath,
+                codexAuthJSON: normalized.codexAuthJSON,
+                lastTokenRefresh: normalized.lastTokenRefresh,
+                lastSuccessfulUsageAt: normalized.lastSuccessfulUsageAt,
+                lastSuccessfulTokenRefreshAt: normalized.lastSuccessfulTokenRefreshAt,
+                lastRefreshAttemptAt: normalized.lastRefreshAttemptAt,
+                lastRefreshFailureAt: normalized.lastRefreshFailureAt,
+                consecutiveRefreshFailures: normalized.consecutiveRefreshFailures,
+                authState: normalized.authState,
+                addedAt: normalized.addedAt,
+                isPinned: normalized.isPinned,
+                pinnedOrder: normalized.pinnedOrder,
+                weeklyAutoKickOverride: normalized.weeklyAutoKickOverride,
+                lastObservedWeeklyResetAt: normalized.lastObservedWeeklyResetAt,
+                lastWeeklyAutoKickCycleID: normalized.lastWeeklyAutoKickCycleID,
+                lastWeeklyAutoKickAttemptAt: normalized.lastWeeklyAutoKickAttemptAt,
+                lastWeeklyAutoKickSuccessAt: normalized.lastWeeklyAutoKickSuccessAt,
+                lastWeeklyAutoKickFailure: normalized.lastWeeklyAutoKickFailure,
+                weeklyAutoKickAttemptCount: normalized.weeklyAutoKickAttemptCount
+            )
+        }
+        let codexHomeURL = AccountStore.codexHomeURL(for: normalized)
+        normalized.codexHomePath = codexHomeURL.path
+        if normalized.codexAuthJSON == nil {
+            normalized.codexAuthJSON = CodexAPIService.makeAuthJSON(for: normalized)
+        }
+        CodexAPIService.persistAuthFile(for: normalized)
         if normalized.lastSuccessfulTokenRefreshAt == nil {
             normalized.lastSuccessfulTokenRefreshAt = normalized.lastTokenRefresh
         }
@@ -1395,6 +1438,32 @@ final class AccountsViewModel {
         return normalized
     }
 
+    private func deduplicatedAccounts(_ loadedAccounts: [CodexAccount]) -> [CodexAccount] {
+        var byID: [String: CodexAccount] = [:]
+        for account in loadedAccounts {
+            guard let existing = byID[account.id] else {
+                byID[account.id] = account
+                continue
+            }
+            byID[account.id] = preferredAccount(existing, account)
+        }
+        return loadedAccounts.compactMap { account in
+            guard byID[account.id]?.addedAt == account.addedAt else { return nil }
+            defer { byID.removeValue(forKey: account.id) }
+            return byID[account.id]
+        }
+    }
+
+    private func preferredAccount(_ lhs: CodexAccount, _ rhs: CodexAccount) -> CodexAccount {
+        if lhs.authState != rhs.authState {
+            if lhs.authState == .healthy { return lhs }
+            if rhs.authState == .healthy { return rhs }
+        }
+        let lhsDate = lhs.lastAuthValidationAt ?? lhs.addedAt
+        let rhsDate = rhs.lastAuthValidationAt ?? rhs.addedAt
+        return lhsDate >= rhsDate ? lhs : rhs
+    }
+
     private func syncWeeklyObservation(for accountID: String, usage: AccountUsage) {
         guard let idx = accounts.firstIndex(where: { $0.id == accountID }) else { return }
 
@@ -1560,6 +1629,7 @@ final class AccountsViewModel {
             refreshToken: account.refreshToken,
             idToken: account.idToken,
             accountId: account.accountId,
+            codexHomePath: account.codexHomePath ?? existing.codexHomePath,
             codexAuthJSON: account.codexAuthJSON ?? existing.codexAuthJSON,
             lastTokenRefresh: account.lastTokenRefresh,
             lastSuccessfulUsageAt: account.lastSuccessfulUsageAt,

README.md

@@ -8,7 +8,7 @@ The Codex CLI has two rate limits: a rolling 5-hour window and a weekly window.
 
 Codex Accounts shows the lowest remaining percentage across all your accounts directly in the menu bar. Click the icon to open a popover with a card for each account. Each card has both usage meters with time-to-reset countdowns, credit balance if your plan has one, and the plan type.
 
-The app watches `~/.codex/auth.json`. When you run `codex auth` to switch accounts, it picks up the new account automatically. Tokens are refreshed proactively in the background and again on-demand if a request returns unauthorized.
+The app imports Codex CLI logins, then keeps each account in its own isolated Codex home under `~/Library/Application Support/CodexAccounts/CodexHomes/`. Tokens are refreshed proactively in the background and again on-demand if a request returns unauthorized.
 
 ## Requirements
 
@@ -89,20 +89,19 @@ Output is written to `dist/`.
 
 ## Adding accounts
 
-The app detects your current account from `~/.codex/auth.json` on launch. To add another, click "Add Account" in the popover, then in a terminal run:
+The app detects your current account from `~/.codex/auth.json` on launch. To add another, click "Add Account" in the popover, then sign in through the isolated Codex login window.
 
 ```
-codex logout
-codex auth
+CODEX_HOME="$HOME/.codex-accounts-import" codex login
 ```
 
-The app watches the auth file and adds the new account automatically.
+The app watches the import auth file, adds the account automatically, then copies it into that account's dedicated Codex home.
 
 ## Privacy
 
 The only network requests are to `chatgpt.com/backend-api/wham/usage` to fetch usage numbers and `auth.openai.com/oauth/token` to refresh tokens when they expire. No analytics, no telemetry.
 
-Account data (including tokens) is stored locally in `~/Library/Application Support/CodexAccounts/accounts.json`. Nothing else leaves your machine.
+Account data (including tokens) is stored locally in `~/Library/Application Support/CodexAccounts/accounts.json` and each account's isolated `auth.json` under `~/Library/Application Support/CodexAccounts/CodexHomes/`. Nothing else leaves your machine.
 
 ## License