fix(gui): show verified Claude account in provider overview

docs-site/src/content/docs/guides/claude-code.md

@@ -79,7 +79,9 @@ The dashboard shows Pro, Max 5x, or Ultra beside Claude account quotas, using su
 metadata from the authenticated profile. Both `ultra` and `claude_max_20x` display as Ultra
 (the existing `ultra` and `max_20x` tier aliases are retained). Unfamiliar validated tiers retain their original name without
 failing the usage read. Claude account rows prefer your alias, then a masked email, and
-fall back to a numbered label when no safe identity is available.
+fall back to a numbered label when no safe identity is available. The provider Overview shows the
+same label as a separate current-account field when its account list is verified. Email labels stay
+masked even when `privacy.maskEmails` is false.
 
 You can log in multiple Claude accounts via the Providers dashboard (`ocx login anthropic` /
 add-account). By default every request uses the **active** account only.

docs-site/src/content/docs/guides/providers.md

@@ -13,6 +13,9 @@ These links preserve the preset's referral parameters. Sponsor information is sh
 the configured provider name, adapter and endpoint match the preset; it never changes routing,
 account selection or defaults.
 
+While a provider login is in progress, its Accounts panel offers **Cancel** once sign-in
+instructions appear.
+
 ## OpenAI account modes
 
 | Provider id | Use | Credential/account rule |

docs-site/src/content/docs/guides/web-dashboard.md

@@ -164,6 +164,10 @@ to save an incomplete snapshot; choose another order or repair the history befor
 
 ### Account selection
 
+For a provider's OAuth accounts, finish the current sign-in or account removal before starting
+the other operation. If the account list and sign-in status cannot be refreshed, the status remains
+unverified and **Log out** is available to explicitly retry recovery.
+
 Account selection is shared with request routing. Selecting an OAuth account takes effect on the
 next request even when a pool is enabled. A healthy selection is not replaced merely because
 another generic OAuth account has more unused quota. If the account returns 429, automatic
@@ -539,6 +543,8 @@ them. Both switches apply immediately; **Save** never changes them. When interce
 
 Claude/Anthropic accounts are managed only on **Providers > Anthropic > Accounts**: login and the browser option, the account roster with switch, pause, remove, and reauthentication, the paste-code field, account pool settings, and quota. Claude no longer has an Account sub-tab. Provider-level controls such as the default provider, removal, and the enabled switch stay on Providers.
 
+If an account change is still in progress, wait for it to finish before retrying logout. After an account removal, the dashboard rechecks the provider's login status; if it cannot verify the result, refresh the account list before retrying the removal.
+
 The bookmarks `#claude` and `#claude/code` open this page, and the former `#claude/settings` redirects to `#claude/code`; `#claude/desktop` selects the separate Claude Desktop tab. The old `#claude/account` bookmark redirects to `#providers?provider=anthropic&tab=accounts`. Legacy `#integrations/claude` and `#integrations/claude/desktop` bookmarks still redirect to `#claude/code` and `#claude/desktop`, respectively. Arrow keys move between tabs; Home and End select the first and last tab.
 
 

docs-site/src/content/docs/reference/configuration/server.md

@@ -463,13 +463,16 @@ use `ssh -g -L`, broad container publishing, or forwarding modes that expose the
 
 ## Account email masking (`privacy`)
 
-Stored account emails are masked everywhere they leave the proxy — the dashboard account lists,
+Stored account emails are masked by default wherever they leave the proxy — the dashboard account lists,
 `GET /api/codex-auth/accounts`, `GET /api/oauth/status`, and the `ocx status` logins section all
 show `p***n@example.com` rather than the address on file.
 
 | Field | Type | Default | Meaning |
 | --- | --- | --- | --- |
-| `privacy.maskEmails?` | `boolean` | `true` | Set to `false` to show stored account emails in full. Absent, `true`, and any malformed value all keep masking, so only a deliberate `false` reveals an address. |
+| `privacy.maskEmails?` | `boolean` | `true` | Set to `false` to reveal stored account emails in projected email fields. Absent, `true`, and any malformed value keep masking, so only a deliberate `false` reveals an address. |
+
+Claude dashboard account labels remain masked even when this flag is `false`; an account alias
+takes precedence over the masked label. The active account uses the same label in Overview.
 
 Turn it off when you run many accounts on a machine you control and cannot tell them apart from
 masked forms. Read the flag as a disclosure decision rather than a display preference: management

gui/src/components/provider-workspace/ProviderAuthPanel.tsx

@@ -331,7 +331,8 @@ export default function ProviderAuthPanel({
       setManualCodeBusy(false);
     }
   };
-  const loggedIn = accounts.length > 0 || oauth?.loggedIn === true;
+  const loggedIn = (accountLoadState === "ready" && accounts.length > 0) || oauth?.loggedIn === true;
+  const canLogout = loggedIn || (accountLoadState === "error" && oauth?.loggedIn !== false);
   const activeReauthAccount = accounts.find(a => a.active && a.needsReauth);
   const activeNeedsReauth = Boolean(activeReauthAccount);
   const quotaRows = isOauth ? accounts : keys;
@@ -488,15 +489,15 @@ export default function ProviderAuthPanel({
               <span className="pwi-auth-status-text">
                 {loggedIn
                   ? t("pws.loggedInTitle")
-                  : (oauth?.error || t("pws.notLoggedInTitle"))}
+                  : (oauth?.error || (oauth?.loggedIn === false ? t("pws.notLoggedInTitle") : t("startup.unverified")))}
               </span>
               <span className="pwi-auth-actions">
                 {activeReauthAccount && (
                   <button type="button" className="btn btn-primary btn-sm" disabled={busy} onClick={() => void authHandlers.onReauth(item.name, activeReauthAccount.id)}>
                     {t("pws.reauthenticate")}
                   </button>
                 )}
-                {loggedIn ? (
+                {canLogout ? (
                   <button type="button" className="btn btn-ghost btn-sm" onClick={() => void authHandlers.onLogout(item.name)}>{t("prov.logout")}</button>
                 ) : (
                   <button ref={item.name === "kiro" ? kiroLoginTriggerRef : undefined} type="button" className="btn btn-primary btn-sm" disabled={busy || (item.name === "kiro" && Boolean(kiroChooser))} onClick={() => openLogin(false)}>

gui/src/components/provider-workspace/ProviderDetails.tsx

@@ -8,7 +8,7 @@ import type { WorkspaceItem } from "../../provider-workspace/catalog";
 import { formatProviderDisplayName } from "../../provider-icons";
 import { isAccountProvider, isFreeProvider } from "../../provider-workspace/catalog";
 import { isLocalProvider } from "../../provider-workspace/kind";
-import { providerAuthSurface } from "../../provider-workspace/auth";
+import { oauthAccountDisplayLabel, providerAuthSurface } from "../../provider-workspace/auth";
 import { ProviderIcon } from "./ProviderRail";
 import { Switch } from "../../ui";
 import { IconChevron, IconTrash } from "../../icons";
@@ -136,6 +136,7 @@ export default function ProviderDetails({
   const free = useMemo(() => isFreeProvider(item), [item]);
   const local = useMemo(() => isLocalProvider(item), [item]);
   const authSurface = useMemo(() => providerAuthSurface(item), [item]);
+  const activeOAuthAccount = accounts?.find(account => account.active);
   const currentQuotaReading = authSurface === "oauth-accounts"
     ? accounts?.find(account => account.active)
     : authSurface === "api-keys" ? keys?.find(entry => entry.active) : undefined;
@@ -372,6 +373,8 @@ export default function ProviderDetails({
             currentQuotaReading={currentQuotaReading}
             onRefreshQuota={onRefreshQuota}
             oauthEmail={oauthEmail}
+            currentAccountLabel={authSurface === "oauth-accounts" && accountLoadState === "ready" && activeOAuthAccount
+              ? oauthAccountDisplayLabel(accounts ?? [], activeOAuthAccount, t) : undefined}
             oauth={oauth}
             onEditSettings={() => switchTab("settings")}
             onViewUsage={() => switchTab("usage")}

gui/src/components/provider-workspace/ProviderOverview.tsx

@@ -37,7 +37,7 @@ type ConnectionTestState = {
 };
 
 export default function ProviderOverview({
-  item, preset, usageTotals, quotaReport, currentQuotaReading, onRefreshQuota, oauthEmail, oauth,
+  item, preset, usageTotals, quotaReport, currentQuotaReading, onRefreshQuota, oauthEmail, currentAccountLabel, oauth,
   apiBase, connectionIdentity, probeController, availableModels = [], selectedModels, modelRows, modelRowsReady = false,
   modelsLoading = false, modelsLoadFailed = false, onRetryModels, onOpenAccounts, onOpenModelsTab, onOpenModels, onOpenConnect,
   onEditSettings, onViewUsage, onUpdateProvider,
@@ -51,6 +51,7 @@ export default function ProviderOverview({
   currentQuotaReading?: AccountQuotaReading;
   onRefreshQuota?: () => Promise<boolean>;
   oauthEmail?: string;
+  currentAccountLabel?: string;
   /** Login state for OAuth summaries that carry no email (e.g. Cursor/Kimi). */
   oauth?: { loggedIn?: boolean; needsReauth?: boolean };
   apiBase?: string;
@@ -246,6 +247,7 @@ export default function ProviderOverview({
             ? t("pws.firstResponse.probeReverify", { model: reverifyModel })
             : t("pws.firstResponse.probeUntested");
   const displayEmail = isAnthropicInstanceId(item.name) && anthropicInstanceRowShapeMatches(item.name, item) ? undefined : oauthEmail;
+  const currentClaudeAccount = isAnthropicInstanceId(item.name) && anthropicInstanceRowShapeMatches(item.name, item) ? currentAccountLabel : undefined;
   const openModelsAction = onOpenModelsTab ?? onOpenModels;
   const fixCredentialsAction = onOpenAccounts ?? onEditSettings;
 
@@ -274,6 +276,9 @@ export default function ProviderOverview({
             <dt>{t("pws.cell.auth")}</dt>
             <dd>{displayEmail ? `${authModeLabel(item, t)} · ${displayEmail}` : authModeLabel(item, t)}</dd>
           </div>
+          {currentClaudeAccount && <div className="pws-kv-row">
+            <dt>{t("pws.accountCurrent")}</dt><dd>{currentClaudeAccount}</dd>
+          </div>}
           <div className="pws-kv-row">
             <dt>{t("modal.defaultModel")}</dt>
             <dd>{item.defaultModel ?? <span className="muted">—</span>}</dd>
@@ -448,9 +453,9 @@ export default function ProviderOverview({
                 : item.authMode === "oauth"
                   ? (displayEmail
                     ? t("pws.loggedInAs", { email: displayEmail })
-                    : oauth?.loggedIn
+                    : oauth?.loggedIn === true
                       ? t("pws.loggedInTitle")
-                      : t("pws.notLoggedIn"))
+                      : oauth?.loggedIn === false ? t("pws.notLoggedIn") : t("startup.unverified"))
                   : item.hasApiKey
                     ? t("pws.apiKeyConfigured")
                     : authModeLabel(item, t)}