fix(auth): define reset and delete safety flows

docs/troubleshooting.md

@@ -89,24 +89,52 @@ codex auth doctor --json
 
 ---
 
-## Soft Reset
+## Reset Options
 
-PowerShell:
+- Delete a single saved account: `codex auth login` → pick account → **Delete Account**
+- Delete saved accounts: `codex auth login` → Danger Zone → **Delete Saved Accounts**
+- Reset local state: `codex auth login` → Danger Zone → **Reset Local State**
+
+Exact effects:
+
+| Action | Saved accounts | Flagged/problem accounts | Settings | Codex CLI sync state | Quota cache |
+| --- | --- | --- | --- | --- | --- |
+| Delete Account | Delete the selected saved account | Delete the matching flagged/problem entry for that refresh token | Keep | Keep | Keep |
+| Delete Saved Accounts | Delete all saved accounts | Keep | Keep | Keep | Keep |
+| Reset Local State | Delete all saved accounts | Delete all flagged/problem accounts | Keep | Keep | Clear |
+
+To perform the same actions manually:
+
+Delete saved accounts only:
 
 ```powershell
 Remove-Item "$HOME\.codex\multi-auth\openai-codex-accounts.json" -Force -ErrorAction SilentlyContinue
-Remove-Item "$HOME\.codex\multi-auth\openai-codex-flagged-accounts.json" -Force -ErrorAction SilentlyContinue
-Remove-Item "$HOME\.codex\multi-auth\settings.json" -Force -ErrorAction SilentlyContinue
-codex auth login
+Remove-Item "$HOME\.codex\multi-auth\openai-codex-accounts.json.wal" -Force -ErrorAction SilentlyContinue
+Remove-Item "$HOME\.codex\multi-auth\openai-codex-accounts.json.bak*" -Force -ErrorAction SilentlyContinue
+```
+
+```bash
+rm -f ~/.codex/multi-auth/openai-codex-accounts.json
+rm -f ~/.codex/multi-auth/openai-codex-accounts.json.wal
+rm -f ~/.codex/multi-auth/openai-codex-accounts.json.bak*
 ```
 
-Bash:
+Reset local state (also clears flagged/problem accounts and quota cache; preserves settings and Codex CLI sync state):
+
+```powershell
+Remove-Item "$HOME\.codex\multi-auth\openai-codex-accounts.json" -Force -ErrorAction SilentlyContinue
+Remove-Item "$HOME\.codex\multi-auth\openai-codex-accounts.json.wal" -Force -ErrorAction SilentlyContinue
+Remove-Item "$HOME\.codex\multi-auth\openai-codex-accounts.json.bak*" -Force -ErrorAction SilentlyContinue
+Remove-Item "$HOME\.codex\multi-auth\openai-codex-flagged-accounts.json" -Force -ErrorAction SilentlyContinue
+Remove-Item "$HOME\.codex\multi-auth\quota-cache.json" -Force -ErrorAction SilentlyContinue
+```
 
 ```bash
 rm -f ~/.codex/multi-auth/openai-codex-accounts.json
+rm -f ~/.codex/multi-auth/openai-codex-accounts.json.wal
+rm -f ~/.codex/multi-auth/openai-codex-accounts.json.bak*
 rm -f ~/.codex/multi-auth/openai-codex-flagged-accounts.json
-rm -f ~/.codex/multi-auth/settings.json
-codex auth login
+rm -f ~/.codex/multi-auth/quota-cache.json
 ```
 
 ---

index.ts

@@ -101,6 +101,12 @@ import {
 } from "./lib/logger.js";
 import { checkAndNotify } from "./lib/auto-update-checker.js";
 import { handleContextOverflow } from "./lib/context-overflow.js";
+import {
+	DESTRUCTIVE_ACTION_COPY,
+	deleteAccountAtIndex,
+	deleteSavedAccounts,
+	resetLocalState,
+} from "./lib/destructive-actions.js";
 import {
 	AccountManager,
         getAccountIdCandidates,
@@ -122,13 +128,11 @@ import {
 	loadAccounts,
 	saveAccounts,
 	withAccountStorageTransaction,
-	clearAccounts,
 	setStoragePath,
 	exportAccounts,
 	importAccounts,
 	loadFlaggedAccounts,
 	saveFlaggedAccounts,
-	clearFlaggedAccounts,
 	findMatchingAccountIndex,
 	StorageError,
 	formatStorageErrorHint,
@@ -3101,19 +3105,18 @@ while (attempted.size < Math.max(1, accountCount)) {
 
 									if (menuResult.mode === "manage") {
 										if (typeof menuResult.deleteAccountIndex === "number") {
-											const target = workingStorage.accounts[menuResult.deleteAccountIndex];
-											if (target) {
-												workingStorage.accounts.splice(menuResult.deleteAccountIndex, 1);
-												clampActiveIndices(workingStorage);
-												await saveAccounts(workingStorage);
-												await saveFlaggedAccounts({
-													version: 1,
-													accounts: flaggedStorage.accounts.filter(
-														(flagged) => flagged.refreshToken !== target.refreshToken,
-													),
-												});
+											const deleted = await deleteAccountAtIndex({
+												storage: workingStorage,
+												index: menuResult.deleteAccountIndex,
+											});
+											if (deleted) {
 												invalidateAccountManagerCache();
-												console.log(`\nDeleted ${target.email ?? `Account ${menuResult.deleteAccountIndex + 1}`}.\n`);
+												const label = `Account ${menuResult.deleteAccountIndex + 1}`;
+												const flaggedNote =
+													deleted.removedFlaggedCount > 0
+														? ` Removed ${deleted.removedFlaggedCount} matching problem account${deleted.removedFlaggedCount === 1 ? "" : "s"}.`
+														: "";
+												console.log(`\nDeleted ${label}.${flaggedNote}\n`);
 											}
 											continue;
 										}
@@ -3143,16 +3146,35 @@ while (attempted.size < Math.max(1, accountCount)) {
 									if (menuResult.mode === "fresh") {
 										startFresh = true;
 										if (menuResult.deleteAll) {
-											await clearAccounts();
-											await clearFlaggedAccounts();
+											const result = await deleteSavedAccounts();
 											invalidateAccountManagerCache();
 											console.log(
-												"\nCleared saved accounts from active storage. Recovery snapshots remain available. Starting fresh.\n",
+												`\n${
+													result.accountsCleared
+														? DESTRUCTIVE_ACTION_COPY.deleteSavedAccounts.completed
+														: "Delete saved accounts completed with warnings. Some saved account artifacts could not be removed; see logs."
+												}\n`,
 											);
 										}
 										break;
 									}
 
+									if (menuResult.mode === "reset") {
+										startFresh = true;
+										const result = await resetLocalState();
+										invalidateAccountManagerCache();
+										console.log(
+											`\n${
+												result.accountsCleared &&
+												result.flaggedCleared &&
+												result.quotaCacheCleared
+													? DESTRUCTIVE_ACTION_COPY.resetLocalState.completed
+													: "Reset local state completed with warnings. Some local artifacts could not be removed; see logs."
+											}\n`,
+										);
+										break;
+									}
+
 									startFresh = false;
 									break;
 								}