@alan-ai-hq/agent-manager-linux-arm64 0.1.145 → 0.1.146

package/alan-holder.cjs

@@ -20506,7 +20506,9 @@ var init_machine_identity = __esm({
     runCodexCredentialSchema = external_exports.object({
       accessToken: external_exports.string().min(1),
       chatgptAccountId: external_exports.string().min(1),
-      chatgptPlanType: external_exports.string().nullable()
+      chatgptPlanType: external_exports.string().nullable(),
+      credentialId: external_exports.uuid().optional(),
+      providerUserId: external_exports.string().min(1).optional()
     });
     runCodexCredentialRefreshRequestSchema = external_exports.object({
       /** sha256 hex of the access token Codex was refused with; a newer stored token is returned instead of rotating. */
@@ -20515,7 +20517,7 @@ var init_machine_identity = __esm({
     runProviderCredentialSchema = external_exports.object({
       /** Environment variables for the agent CLI, e.g. ANTHROPIC_API_KEY; empty when the CLI's own login is used. */
       env: external_exports.record(external_exports.string(), external_exports.string()),
-      /** The team's Codex login for a cloud sandbox; absent where the CLI's own login is used. */
+      /** The bound Codex login for a cloud sandbox; absent where the CLI's own login is used. */
       codex: runCodexCredentialSchema.optional()
     });
   }
@@ -20930,16 +20932,50 @@ var init_problem = __esm({
   }
 });
 
+// ../shared/dist/cli-usage.js
+var usagePercentSchema, usageTimestampSchema, cliUsageWindowPatchSchema, cliUsageWindowSchema, cliUsageBucketSchema, cliUsageSnapshotSchema;
+var init_cli_usage = __esm({
+  "../shared/dist/cli-usage.js"() {
+    "use strict";
+    init_zod();
+    usagePercentSchema = external_exports.number().min(0).max(100);
+    usageTimestampSchema = external_exports.iso.datetime();
+    cliUsageWindowPatchSchema = external_exports.object({
+      usedPercent: usagePercentSchema.nullable().optional(),
+      windowMinutes: external_exports.number().positive().nullable().optional(),
+      resetsAt: usageTimestampSchema.nullable().optional()
+    });
+    cliUsageWindowSchema = external_exports.object({
+      usedPercent: usagePercentSchema.optional(),
+      windowMinutes: external_exports.number().positive().optional(),
+      resetsAt: usageTimestampSchema.optional(),
+      observedAt: usageTimestampSchema,
+      receivedAt: usageTimestampSchema,
+      sourceId: external_exports.string().min(1),
+      sequence: external_exports.number().int().nonnegative()
+    });
+    cliUsageBucketSchema = external_exports.object({
+      primary: cliUsageWindowSchema.optional(),
+      secondary: cliUsageWindowSchema.optional(),
+      planType: external_exports.string().min(1).nullable().optional()
+    });
+    cliUsageSnapshotSchema = external_exports.object({
+      buckets: external_exports.record(external_exports.string().min(1), cliUsageBucketSchema)
+    });
+  }
+});
+
 // ../shared/dist/runtime-v2/run-log.js
 function isRunLifecycleKind(sessionUpdate) {
   return RUN_LIFECYCLE_KINDS.has(sessionUpdate);
 }
-var runAcceptedUpdateSchema, runStartedUpdateSchema, runWorkspaceRelocatedUpdateSchema, runOutcomeSchema, runRejectionCodeSchema, runEndedUpdateSchema, runLifecycleUpdateSchema, RUN_LIFECYCLE_KINDS, runLogRecordSchema;
+var runAcceptedUpdateSchema, runStartedUpdateSchema, runCodexRateLimitsUpdateSchema, runWorkspaceRelocatedUpdateSchema, runOutcomeSchema, runRejectionCodeSchema, runEndedUpdateSchema, runLifecycleUpdateSchema, RUN_LIFECYCLE_KINDS, runLogRecordSchema;
 var init_run_log = __esm({
   "../shared/dist/runtime-v2/run-log.js"() {
     "use strict";
     init_zod();
     init_problem();
+    init_cli_usage();
     init_ids();
     runAcceptedUpdateSchema = external_exports.object({
       sessionUpdate: external_exports.literal("_alan/run.accepted"),
@@ -20951,6 +20987,16 @@ var init_run_log = __esm({
       providerSessionId: external_exports.string().min(1).optional(),
       pid: external_exports.number().int().positive().optional()
     });
+    runCodexRateLimitsUpdateSchema = external_exports.object({
+      sessionUpdate: external_exports.literal("_alan/codex.rate_limits"),
+      limitId: external_exports.string().min(1),
+      primary: cliUsageWindowPatchSchema.nullable().optional(),
+      secondary: cliUsageWindowPatchSchema.nullable().optional(),
+      planType: external_exports.string().min(1).nullable().optional(),
+      observedAt: external_exports.iso.datetime(),
+      sourceId: external_exports.string().min(1),
+      sequence: external_exports.number().int().nonnegative()
+    });
     runWorkspaceRelocatedUpdateSchema = external_exports.object({
       sessionUpdate: external_exports.literal("_alan/run.workspace_relocated"),
       previousPath: external_exports.string().min(1).max(4096),
@@ -21013,7 +21059,7 @@ var init_holder_protocol = __esm({
     init_ids();
     init_link();
     init_run_log();
-    HOLDER_PROTOCOL = 1;
+    HOLDER_PROTOCOL = 2;
     holderAbortOutcomeSchema = external_exports.enum(["aborted", "interrupted"]);
     holderRequestSchema = external_exports.discriminatedUnion("type", [
       external_exports.object({ type: external_exports.literal("auth"), token: external_exports.string().min(1) }),
@@ -24141,7 +24187,18 @@ var init_chunk_SBT5W7L4 = __esm({
   }
 });
 
-// ../agent-core/dist/chunk-54ZRJOQP.js
+// ../agent-core/dist/chunk-HBIPWAUI.js
+function readCapReset(text2) {
+  const epoch = EPOCH_RESET.exec(text2);
+  if (epoch) return { resetsAt: new Date(Number(epoch[1]) * 1e3).toISOString() };
+  const codex = CODEX_RESET.exec(text2);
+  if (codex) {
+    const milliseconds = Date.parse(codex[1].replace(/(\d)(?:st|nd|rd|th)\b/gi, "$1"));
+    if (Number.isFinite(milliseconds)) return { resetsAt: new Date(milliseconds).toISOString() };
+  }
+  const worded = WORDED_RESET.exec(text2);
+  return worded ? { resetHint: worded[1].trim() } : {};
+}
 function specForErrorKind(errorKind) {
   const spec = ERROR_SPECS[errorKind];
   return { message: spec.message, errorKind, recoveryClass: spec.recoveryClass };
@@ -24202,15 +24259,6 @@ function normalizeCodexCliErrorMessage(message) {
   }
   return message;
 }
-function readCapReset(text2) {
-  const epoch = EPOCH_RESET.exec(text2);
-  if (epoch) {
-    const seconds = Number(epoch[1]);
-    return { resetsAt: new Date(seconds * 1e3).toISOString() };
-  }
-  const worded = WORDED_RESET.exec(text2);
-  return worded ? { resetHint: worded[1].trim() } : {};
-}
 function lineMatching(text2, pattern) {
   return text2.split("\n").map((line) => line.trim()).find((line) => pattern.test(line));
 }
@@ -24222,10 +24270,11 @@ function withCapReset(classified, text2) {
   if (classified.errorKind !== "usage_limit") return classified;
   const reset = readCapReset(text2);
   if (reset.resetsAt) {
+    const own22 = lineMatching(text2, /\btry again at\b/i);
     return {
       ...classified,
       ...reset,
-      message: `Provider usage limit reached. It resets at ${reset.resetsAt}; switch model or wait, then retry.`
+      message: own22 ?? `Provider usage limit reached. It resets at ${reset.resetsAt}; switch model or wait, then retry.`
     };
   }
   const own2 = lineMatching(text2, /usage limit/i);
@@ -24344,13 +24393,16 @@ function createCliProblem(observed, options) {
     ...classified.resetsAt ? { resetsAt: classified.resetsAt } : {}
   });
 }
-var import_crypto2, ERROR_SPECS, AGENT_ERROR_KINDS, AGENT_SIGN_IN_BY_HARNESS, STATUS_PREFIX, TEXT_RULES, CODEX_TIMEOUT_MESSAGE, CODEX_EXPIRED_MESSAGE, EPOCH_RESET, WORDED_RESET, COMMAND_NOT_FOUND, CODE_RULES, TEXT_REFINES, STATUS_LEAD, CLI_PROBLEM_CODE_BY_ERROR_KIND, KEY_REJECTION_KINDS;
-var init_chunk_54ZRJOQP = __esm({
-  "../agent-core/dist/chunk-54ZRJOQP.js"() {
+var import_crypto2, EPOCH_RESET, WORDED_RESET, CODEX_RESET, ERROR_SPECS, AGENT_ERROR_KINDS, AGENT_SIGN_IN_BY_HARNESS, STATUS_PREFIX, TEXT_RULES, CODEX_TIMEOUT_MESSAGE, CODEX_EXPIRED_MESSAGE, COMMAND_NOT_FOUND, CODE_RULES, TEXT_REFINES, STATUS_LEAD, CLI_PROBLEM_CODE_BY_ERROR_KIND, KEY_REJECTION_KINDS;
+var init_chunk_HBIPWAUI = __esm({
+  "../agent-core/dist/chunk-HBIPWAUI.js"() {
     "use strict";
     init_chunk_YXWJW7I5();
     import_crypto2 = require("crypto");
     init_agent2();
+    EPOCH_RESET = /\|\s*(\d{10})\b/;
+    WORDED_RESET = /\bresets?\s+(?:at\s+)?([^.\n]{1,60}?)\s*(?:$|[.\n])/i;
+    CODEX_RESET = /\btry again at\s+([A-Za-z]{3,9}\s+\d{1,2}(?:st|nd|rd|th)?,?\s+\d{4}\s+\d{1,2}:\d{2}\s*[AP]M(?:\s+(?:UTC|GMT)(?:[+-]\d{1,2}(?::?\d{2})?)?)?)/i;
     ERROR_SPECS = {
       model_mismatch: {
         message: "The selected model isn't available, or you don't have access to it. Pick a different model, then send your message again.",
@@ -24504,7 +24556,7 @@ var init_chunk_54ZRJOQP = __esm({
       // #44604), or a trailing assistant message (opencode #19517).
       {
         kind: "history_rejected",
-        pattern: /\btext content blocks must be non-empty\b|\bcontent field in the message object\b|\bids were found without `?tool_result`? blocks\b|\bunexpected `?tool_use_id`?|\btool use concurrency issues\b|\bno tool output found for\b|\bdoes not support assistant message prefill\b/
+        pattern: /\btext content blocks must be non-empty\b|\bcontent field in the message object\b|\bids were found without `?tool_result`? blocks\b|\bunexpected `?tool_use_id`?|\btool use concurrency issues\b|\bno tool output found for\b|\bdoes not support assistant message prefill\b|\binvalid_encrypted_content\b|organization_id did not match the target organization/
       },
       // Claude: "No conversation found with session ID"; Codex: "no rollout found for thread id";
       // Copilot: "No session, task, or name matched"; Kimi/Cursor ACP: `Session "<id>" not found`.
@@ -24553,8 +24605,6 @@ var init_chunk_54ZRJOQP = __esm({
     ];
     CODEX_TIMEOUT_MESSAGE = "Codex connection to OpenAI timed out while waiting for the turn to continue. Retry the message; if it repeats, check network/API latency or reduce slow MCP/tool calls in the turn.";
     CODEX_EXPIRED_MESSAGE = "Codex CLI connection expired. Re-authenticate the Codex CLI on this computer (run `codex login`) or reconnect it in Cloud settings, then retry.";
-    EPOCH_RESET = /\|\s*(\d{10})\b/;
-    WORDED_RESET = /\bresets?\s+(?:at\s+)?([^.\n]{1,60}?)\s*(?:$|[.\n])/i;
     COMMAND_NOT_FOUND = /\bcommand not found\b|\bno such file or directory\b/i;
     CODE_RULES = [
       { pattern: /model_not_found|model_not_available/, kind: "model_mismatch" },
@@ -24609,7 +24659,7 @@ var init_chunk_54ZRJOQP = __esm({
   }
 });
 
-// ../agent-core/dist/chunk-72NSEYHK.js
+// ../agent-core/dist/chunk-4G77APXN.js
 function detectImageMimeType(buffer) {
   if (buffer.length >= 8 && buffer.subarray(0, 8).equals(PNG_SIGNATURE)) return "image/png";
   if (buffer.length >= 3 && buffer[0] === 255 && buffer[1] === 216 && buffer[2] === 255) {
@@ -24993,11 +25043,11 @@ function silentStartError(name, timeoutMs) {
   };
 }
 var import_crypto3, import_fs4, import_path3, PNG_SIGNATURE, IMAGE_MIME_BY_EXT, VIDEO_MIME_BY_EXT, IMAGE_EXTENSIONS, VIDEO_EXTENSIONS, MAX_IMAGE_BYTES, MAX_VIDEO_BYTES, AGENT_BROWSER_MENTION, LocalMediaReader, SessionOpenRefusal, JsonRpcError, ACP_PROTOCOL_VERSION, ACP_ERROR, STDERR_TAIL_LINES, RESULT_EXIT_GRACE_MS, PerTurnSession;
-var init_chunk_72NSEYHK = __esm({
-  "../agent-core/dist/chunk-72NSEYHK.js"() {
+var init_chunk_4G77APXN = __esm({
+  "../agent-core/dist/chunk-4G77APXN.js"() {
     "use strict";
     init_chunk_XC5676SG();
-    init_chunk_54ZRJOQP();
+    init_chunk_HBIPWAUI();
     init_chunk_M6YHY2EZ();
     init_chunk_YXWJW7I5();
     import_crypto3 = require("crypto");
@@ -26904,9 +26954,9 @@ var init_claude = __esm({
   "../agent-core/dist/providers/claude.js"() {
     "use strict";
     init_chunk_SBT5W7L4();
-    init_chunk_72NSEYHK();
+    init_chunk_4G77APXN();
     init_chunk_XC5676SG();
-    init_chunk_54ZRJOQP();
+    init_chunk_HBIPWAUI();
     init_chunk_J2KTV5FP();
     init_chunk_M6YHY2EZ();
     init_chunk_FPGAN4XO();
@@ -28208,6 +28258,29 @@ function imageKey(update) {
   const image = asRecord(update.image);
   return asString(image?.sourceHash) || asString(image?.id) || void 0;
 }
+function windowPatch(value) {
+  if (value === null) return null;
+  const record2 = asRecord(value);
+  if (!record2) return void 0;
+  const patch = {};
+  const usedPercent = asFiniteNumber(record2.usedPercent);
+  if (usedPercent !== void 0 && usedPercent >= 0 && usedPercent <= 100) {
+    patch.usedPercent = usedPercent;
+  } else if (record2.usedPercent === null) {
+    patch.usedPercent = null;
+  }
+  const duration3 = asFiniteNumber(record2.windowDurationMins);
+  if (duration3 !== void 0 && duration3 > 0) patch.windowMinutes = duration3;
+  else if (record2.windowDurationMins === null) patch.windowMinutes = null;
+  const seconds = asFiniteNumber(record2.resetsAt);
+  if (seconds !== void 0 && seconds >= 0) {
+    const reset = new Date(seconds * 1e3);
+    if (Number.isFinite(reset.getTime())) patch.resetsAt = reset.toISOString();
+  } else if (record2.resetsAt === null) {
+    patch.resetsAt = null;
+  }
+  return patch;
+}
 function isApprovalRequest(method) {
   return COMMAND_OR_FILE.has(method) || LEGACY.has(method);
 }
@@ -28619,7 +28692,10 @@ function classifyCodexError(error61) {
   const message = asString(error61?.message);
   const known = typeof info === "string" ? INFO_KINDS.get(info) : void 0;
   const own2 = normalizeCodexCliErrorMessage(message.trim());
-  if (known) return own2 ? { ...specForErrorKind(known), message: own2 } : specForErrorKind(known);
+  if (known) {
+    const classified = own2 ? { ...specForErrorKind(known), message: own2 } : specForErrorKind(known);
+    return known === "usage_limit" ? { ...classified, ...readCapReset(message) } : classified;
+  }
   const status = httpStatusOf(info);
   return classifyProviderError(message, status === void 0 ? {} : { status });
 }
@@ -28703,7 +28779,7 @@ async function handshake(session, spec, log) {
   }
   await session.rpc.notify("initialized");
 }
-async function preflight(session, spec) {
+async function preflight(session, spec, log) {
   if (spec.externalAuth) {
     const tokens2 = await spec.externalAuth.current();
     await session.rpc.request("account/login/start", {
@@ -28721,6 +28797,13 @@ async function preflight(session, spec) {
       specForErrorKind("not_logged_in")
     );
   }
+  if (spec.externalAuth) {
+    try {
+      session.observeRateLimits(await session.rpc.request("account/rateLimits/read", {}));
+    } catch {
+      log.warn("codex.rate_limits_unavailable", {});
+    }
+  }
 }
 function threadOf(result) {
   const thread = asRecord(asRecord(result)?.thread);
@@ -28782,7 +28865,7 @@ function createCodexDriver(options = {}) {
       try {
         const opening = (async () => {
           await handshake(session, spec, resolved.log);
-          await preflight(session, spec);
+          await preflight(session, spec, resolved.log);
           return openThread(session, spec, resolved.log);
         })();
         const thread = await withDeadline(
@@ -28933,7 +29016,7 @@ function createCodexExecDriver(options = {}) {
   };
 }
 function envDigest2(env) {
-  const hash2 = (0, import_crypto9.createHash)("sha256");
+  const hash2 = (0, import_crypto10.createHash)("sha256");
   for (const key of Object.keys(env).sort()) hash2.update(`${key}\0${env[key]}\0`);
   return hash2.digest("hex");
 }
@@ -28974,7 +29057,7 @@ function planCodexExecSession(run, context) {
   };
 }
 function envDigest22(env) {
-  const hash2 = (0, import_crypto10.createHash)("sha256");
+  const hash2 = (0, import_crypto11.createHash)("sha256");
   for (const key of Object.keys(env).sort()) hash2.update(`${key}\0${env[key]}\0`);
   return hash2.digest("hex");
 }
@@ -29043,14 +29126,14 @@ function codexTurnInput(run, context) {
     ...images.length ? { imagePaths: images.map((image) => image.path) } : {}
   };
 }
-var import_fs6, import_path6, import_crypto8, import_crypto9, import_crypto10, TokenRefresher, MCP_STARTUP_TIMEOUT_SEC, FIELD_TYPES, YES_NO, ACCEPT_DECLINE, MAX_INLINE_GENERATED_IMAGE_BYTES, PNG_SIGNATURE2, JPEG_NON_FRAME_MARKERS, IMAGE_GEN_CALL, PROMPT_LITERAL, RELOCATE_EVERY_MS, CodexImageGenerationFold, CodexRolloutImages, USER_INPUT_METHOD, PERMISSIONS_METHOD, ELICITATION_METHOD, COMMAND_OR_FILE, LEGACY, DECISIONS, COORDINATION_TOOLS, SETTLED_AGENT, STATUS, CHANGE_OPERATIONS, SILENT_ON_START, IGNORED_ITEMS, PLAN_STATUS, WORKER_LIFECYCLE, INFO_KINDS, SILENT, CodexTurn, STDERR_TAIL_LINES3, MAX_BETWEEN_UPDATES, UNSUPPORTED_REQUEST, DECLINED_ELICITATION, IMAGE_CATCH_UP_MS, IMAGE_POLL_MS, CodexSession, CODEX_MIN_VERSION, CODEX_REQUIREMENT, CODEX_TESTED_LINE, DEFAULTS2, CLIENT_INFO, STATUS2, EXITED_WITHOUT_RESPONSE, CodexExecTurn, DEFAULTS22, CodexExecSession;
+var import_fs6, import_path6, import_crypto8, import_crypto9, import_crypto10, import_crypto11, TokenRefresher, MCP_STARTUP_TIMEOUT_SEC, FIELD_TYPES, YES_NO, ACCEPT_DECLINE, MAX_INLINE_GENERATED_IMAGE_BYTES, PNG_SIGNATURE2, JPEG_NON_FRAME_MARKERS, IMAGE_GEN_CALL, PROMPT_LITERAL, RELOCATE_EVERY_MS, CodexImageGenerationFold, CodexRolloutImages, CodexRateLimits, USER_INPUT_METHOD, PERMISSIONS_METHOD, ELICITATION_METHOD, COMMAND_OR_FILE, LEGACY, DECISIONS, COORDINATION_TOOLS, SETTLED_AGENT, STATUS, CHANGE_OPERATIONS, SILENT_ON_START, IGNORED_ITEMS, PLAN_STATUS, WORKER_LIFECYCLE, INFO_KINDS, SILENT, CodexTurn, STDERR_TAIL_LINES3, MAX_BETWEEN_UPDATES, UNSUPPORTED_REQUEST, DECLINED_ELICITATION, IMAGE_CATCH_UP_MS, IMAGE_POLL_MS, CodexSession, CODEX_MIN_VERSION, CODEX_REQUIREMENT, CODEX_TESTED_LINE, DEFAULTS2, CLIENT_INFO, STATUS2, EXITED_WITHOUT_RESPONSE, CodexExecTurn, DEFAULTS22, CodexExecSession;
 var init_codex = __esm({
   "../agent-core/dist/providers/codex.js"() {
     "use strict";
     init_chunk_SBT5W7L4();
-    init_chunk_72NSEYHK();
+    init_chunk_4G77APXN();
     init_chunk_XC5676SG();
-    init_chunk_54ZRJOQP();
+    init_chunk_HBIPWAUI();
     init_chunk_J2KTV5FP();
     init_chunk_M6YHY2EZ();
     init_chunk_FPGAN4XO();
@@ -29059,10 +29142,12 @@ var init_codex = __esm({
     import_path6 = require("path");
     init_effort();
     import_crypto8 = require("crypto");
-    init_agent2();
     import_crypto9 = require("crypto");
+    init_runtime_v2();
     init_agent2();
     import_crypto10 = require("crypto");
+    init_agent2();
+    import_crypto11 = require("crypto");
     init_effort();
     TokenRefresher = class {
       #auth;
@@ -29246,6 +29331,46 @@ var init_codex = __esm({
         return this.#cursor;
       }
     };
+    CodexRateLimits = class {
+      #clock;
+      #sourceId;
+      #sequence = 0;
+      constructor(clock, sourceId = (0, import_crypto9.randomUUID)()) {
+        this.#clock = clock;
+        this.#sourceId = sourceId;
+      }
+      read(value) {
+        const response = asRecord(value);
+        const buckets = asRecord(response?.rateLimitsByLimitId);
+        if (buckets) {
+          return Object.entries(buckets).flatMap(
+            ([limitId, snapshot2]) => this.#update(snapshot2, limitId)
+          );
+        }
+        return this.#update(response?.rateLimits);
+      }
+      notification(params) {
+        return this.#update(params.rateLimits);
+      }
+      #update(value, bucketId) {
+        const snapshot2 = asRecord(value);
+        if (!snapshot2) return [];
+        const primary = windowPatch(snapshot2.primary);
+        const secondary = windowPatch(snapshot2.secondary);
+        const planType = snapshot2.planType === null ? null : asString(snapshot2.planType) || void 0;
+        const parsed = runCodexRateLimitsUpdateSchema.safeParse({
+          sessionUpdate: "_alan/codex.rate_limits",
+          limitId: bucketId ?? (asString(snapshot2.limitId) || "codex"),
+          ...primary === void 0 ? {} : { primary },
+          ...secondary === void 0 ? {} : { secondary },
+          ...planType === void 0 ? {} : { planType },
+          observedAt: new Date(this.#clock.now()).toISOString(),
+          sourceId: this.#sourceId,
+          sequence: this.#sequence++
+        });
+        return parsed.success ? [parsed.data] : [];
+      }
+    };
     USER_INPUT_METHOD = "item/tool/requestUserInput";
     PERMISSIONS_METHOD = "item/permissions/requestApproval";
     ELICITATION_METHOD = "mcpServer/elicitation/request";
@@ -29315,7 +29440,6 @@ var init_codex = __esm({
       "thread/closed",
       "hook/started",
       "hook/completed",
-      "account/rateLimits/updated",
       "account/updated",
       "account/login/completed",
       "remoteControl/status/changed",
@@ -29510,6 +29634,7 @@ var init_codex = __esm({
       #listeners = createListeners();
       #options;
       #memory;
+      #rateLimits;
       #stderr = [];
       #approvals = /* @__PURE__ */ new Map();
       /** Session-level updates (thread start warnings, MCP startup) that open the next turn's log. */
@@ -29526,6 +29651,7 @@ var init_codex = __esm({
       constructor(child, tree, memory, options) {
         this.#options = options;
         this.#memory = memory;
+        this.#rateLimits = new CodexRateLimits(options.clock);
         this.#lastTurn = new CodexTurn(memory, options.clock);
         this.#host = hostProcess(
           child,
@@ -29560,6 +29686,9 @@ var init_codex = __esm({
       configure(config2) {
         this.#config = config2;
       }
+      observeRateLimits(response) {
+        this.#recordRateLimits(this.#rateLimits.read(response));
+      }
       attachThread(threadId, rolloutPath) {
         if (threadId === this.#threadId) return;
         this.#threadId = threadId;
@@ -29726,6 +29855,10 @@ var init_codex = __esm({
         return known === void 0 || known === turnId ? active : void 0;
       }
       #onNotification(notification) {
+        if (notification.method === "account/rateLimits/updated") {
+          this.#recordRateLimits(this.#rateLimits.notification(notification.params));
+          return;
+        }
         if (notification.method === "serverRequest/resolved") this.#dropResolved(notification);
         const active = this.#ownerOf(notification);
         const reader = active?.turn ?? this.#lastTurn;
@@ -29752,6 +29885,14 @@ var init_codex = __esm({
           void this.#stopTurn(active);
         }
       }
+      #recordRateLimits(updates) {
+        const active = this.#current;
+        if (active) this.#emitUpdates(active, updates);
+        else {
+          this.#between.push(...updates);
+          this.#between.splice(0, Math.max(0, this.#between.length - MAX_BETWEEN_UPDATES));
+        }
+      }
       #emitUpdates(active, updates) {
         for (const update of updates) this.#emit({ type: "update", turnId: active.id, update });
       }
@@ -30405,9 +30546,9 @@ function alanCodeEngineEnv(input2) {
   };
 }
 async function writePlugin(directory, apiOrigin) {
-  const origin = (0, import_crypto11.createHash)("sha256").update(apiOrigin).digest("hex").slice(0, 12);
+  const origin = (0, import_crypto12.createHash)("sha256").update(apiOrigin).digest("hex").slice(0, 12);
   const target = (0, import_path8.join)(directory, `engine-plugin-v${ALAN_CODE_ENGINE_PLUGIN_VERSION}-${origin}.mjs`);
-  const temporary = `${target}.${(0, import_crypto11.randomUUID)()}.tmp`;
+  const temporary = `${target}.${(0, import_crypto12.randomUUID)()}.tmp`;
   await (0, import_promises15.mkdir)(directory, { recursive: true, mode: 448 });
   await (0, import_promises15.writeFile)(temporary, alanCodeEnginePluginSource(apiOrigin), { mode: 384 });
   await (0, import_promises15.rename)(temporary, target);
@@ -30439,7 +30580,7 @@ function alanCodeSystemPrompt(alanSystemPrompt) {
 
 ${instructions}` : ALAN_CODE_TOOL_NAMING_PROMPT;
 }
-var import_http3, import_https, import_fs7, import_path7, import_crypto11, import_promises15, import_path8, import_url, ALAN_CODE_BASELINE_PROMPT, ALAN_CODE_ENGINE_PROVIDER_ID, DEFAULT_CONTEXT_WINDOW, DEFAULT_MAX_OUTPUT_TOKENS, ALAN_CODE_API_KEY_ENV, ALAN_CODE_CONVERSATION_ID_ENV, ALAN_CODE_PROXY_PATH, ALAN_CODE_WEBSEARCH_PATH, ALAN_CODE_CATALOG_PATH, CATALOG_TIMEOUT_MS, MAX_CATALOG_BYTES, ACTIVATION_WAIT_MS, ACTIVATION_POLL_MS, CatalogResponseError, ALAN_CODE_ENGINE_PATH_ENV, ALAN_CODE_ENGINE_COMMAND, ALAN_CODE_ENGINE_NAME, WINDOWS_RUNNABLE_EXTENSION, ALAN_CODE_ENGINE_PLUGIN_VERSION, ALAN_CODE_TOOL_NAMING_PROMPT;
+var import_http3, import_https, import_fs7, import_path7, import_crypto12, import_promises15, import_path8, import_url, ALAN_CODE_BASELINE_PROMPT, ALAN_CODE_ENGINE_PROVIDER_ID, DEFAULT_CONTEXT_WINDOW, DEFAULT_MAX_OUTPUT_TOKENS, ALAN_CODE_API_KEY_ENV, ALAN_CODE_CONVERSATION_ID_ENV, ALAN_CODE_PROXY_PATH, ALAN_CODE_WEBSEARCH_PATH, ALAN_CODE_CATALOG_PATH, CATALOG_TIMEOUT_MS, MAX_CATALOG_BYTES, ACTIVATION_WAIT_MS, ACTIVATION_POLL_MS, CatalogResponseError, ALAN_CODE_ENGINE_PATH_ENV, ALAN_CODE_ENGINE_COMMAND, ALAN_CODE_ENGINE_NAME, WINDOWS_RUNNABLE_EXTENSION, ALAN_CODE_ENGINE_PLUGIN_VERSION, ALAN_CODE_TOOL_NAMING_PROMPT;
 var init_alan_code = __esm({
   "../agent-core/dist/providers/alan-code.js"() {
     "use strict";
@@ -30452,7 +30593,7 @@ var init_alan_code = __esm({
     import_fs7 = require("fs");
     import_path7 = require("path");
     init_runtime_v2();
-    import_crypto11 = require("crypto");
+    import_crypto12 = require("crypto");
     import_promises15 = require("fs/promises");
     import_path8 = require("path");
     import_url = require("url");
@@ -37822,9 +37963,9 @@ var require_dist = __commonJS({
 var init_dist = __esm({
   "../agent-core/dist/index.js"() {
     "use strict";
-    init_chunk_72NSEYHK();
+    init_chunk_4G77APXN();
     init_chunk_XC5676SG();
-    init_chunk_54ZRJOQP();
+    init_chunk_HBIPWAUI();
     init_chunk_M6YHY2EZ();
     init_chunk_YXWJW7I5();
   }
@@ -38498,7 +38639,7 @@ function isAcpBackendKind(value) {
   return Object.hasOwn(ACP_PROFILES, value);
 }
 function envDigest3(env) {
-  const hash2 = (0, import_crypto12.createHash)("sha256");
+  const hash2 = (0, import_crypto13.createHash)("sha256");
   for (const key of Object.keys(env).sort()) hash2.update(`${key}\0${env[key]}\0`);
   return hash2.digest("hex");
 }
@@ -38565,13 +38706,13 @@ async function acpTurnInput(run, context) {
     ...encoded.length ? { images: encoded, imagePaths: images.map((image) => image.path) } : {}
   };
 }
-var import_promises23, import_path9, import_crypto12, import_promises24, CURSOR_ASK_QUESTION, copilotAcpProfile, cursorAcpProfile, MODEL_REJECTED, MAX_READ_BYTES, FsDenied, ENV_REFERENCE, AcpBackgroundTasks, CURSOR_CREATE_PLAN, STATUSES, READ_KINDS, ALLOW_KINDS, REJECT_KINDS, CANCELLED_PERMISSION, STOP_REASONS, CHUNKS, ECHOES, AcpTurn, STDERR_TAIL_LINES4, MAX_BETWEEN_UPDATES2, AcpSession, DEFAULTS3, CLIENT_INFO2, TASK_BACKGROUNDED, TASK_COMPLETED, SESSION_NOTIFICATION, KILLED_STATUSES, SUCCESS_STATUSES, SUBAGENT_ID, grokTaskDialect, grokAcpProfile, kimiAcpProfile, ACP_PROFILES, ACP_MODES;
+var import_promises23, import_path9, import_crypto13, import_promises24, CURSOR_ASK_QUESTION, copilotAcpProfile, cursorAcpProfile, MODEL_REJECTED, MAX_READ_BYTES, FsDenied, ENV_REFERENCE, AcpBackgroundTasks, CURSOR_CREATE_PLAN, STATUSES, READ_KINDS, ALLOW_KINDS, REJECT_KINDS, CANCELLED_PERMISSION, STOP_REASONS, CHUNKS, ECHOES, AcpTurn, STDERR_TAIL_LINES4, MAX_BETWEEN_UPDATES2, AcpSession, DEFAULTS3, CLIENT_INFO2, TASK_BACKGROUNDED, TASK_COMPLETED, SESSION_NOTIFICATION, KILLED_STATUSES, SUCCESS_STATUSES, SUBAGENT_ID, grokTaskDialect, grokAcpProfile, kimiAcpProfile, ACP_PROFILES, ACP_MODES;
 var init_acp3 = __esm({
   "../agent-core/dist/providers/acp.js"() {
     "use strict";
-    init_chunk_72NSEYHK();
+    init_chunk_4G77APXN();
     init_chunk_XC5676SG();
-    init_chunk_54ZRJOQP();
+    init_chunk_HBIPWAUI();
     init_chunk_J2KTV5FP();
     init_chunk_M6YHY2EZ();
     init_chunk_FPGAN4XO();
@@ -38580,7 +38721,7 @@ var init_acp3 = __esm({
     import_path9 = require("path");
     init_effort();
     init_acp();
-    import_crypto12 = require("crypto");
+    import_crypto13 = require("crypto");
     import_promises24 = require("fs/promises");
     init_agent2();
     CURSOR_ASK_QUESTION = "cursor/ask_question";
@@ -39386,7 +39527,7 @@ var init_acp3 = __esm({
 var init_classify = __esm({
   "../agent-core/dist/classify.js"() {
     "use strict";
-    init_chunk_54ZRJOQP();
+    init_chunk_HBIPWAUI();
     init_chunk_YXWJW7I5();
   }
 });
@@ -39596,7 +39737,10 @@ function createPersistentDriver(provider4, options) {
     return "delivered";
   };
   const openFailed = (error61, spec, sink, signal, inputs) => {
-    if (error61 instanceof SessionOpenRefusal && error61.reason === "unsupported_version" && options.fallback) {
+    if (error61 instanceof SessionOpenRefusal && error61.reason === "unsupported_version" && inputs.codex !== void 0) {
+      return { outcome: "failed", message: error61.message };
+    }
+    if (error61 instanceof SessionOpenRefusal && error61.reason === "unsupported_version" && options.fallback && inputs.codex === void 0) {
       log.warn("holder.persistent_unsupported", {
         harness: provider4.harness,
         message: error61.message
@@ -39613,7 +39757,7 @@ function createPersistentDriver(provider4, options) {
   };
   return {
     runTurn: async (spec, sink, signal, inputs) => {
-      if (live.fallbackOnly && options.fallback)
+      if (live.fallbackOnly && options.fallback && inputs.codex === void 0)
         return options.fallback.runTurn(spec, sink, signal, inputs);
       if (signal.aborted) return { outcome: "aborted" };
       const managedMcp = await managedMcpAccess(signal);
@@ -40203,7 +40347,7 @@ function createOpenCodeDriver(options = {}) {
         await authorization?.remove();
       };
       const spec = { ...planned, env: launchEnv(planned, authorization) };
-      const password = options.password?.() ?? (0, import_crypto13.randomBytes)(24).toString("base64url");
+      const password = options.password?.() ?? (0, import_crypto14.randomBytes)(24).toString("base64url");
       try {
         const session = await openWithRetries(spec, password, resolved);
         void session.exited.then(removeAuthorization).catch((error61) => {
@@ -40218,7 +40362,7 @@ function createOpenCodeDriver(options = {}) {
   };
 }
 function envDigest4(env) {
-  const hash2 = (0, import_crypto14.createHash)("sha256");
+  const hash2 = (0, import_crypto15.createHash)("sha256");
   for (const key of Object.keys(env).sort()) hash2.update(`${key}\0${env[key]}\0`);
   return hash2.digest("hex");
 }
@@ -40299,20 +40443,20 @@ function openCodeTurnInput(run, context) {
     ...images.length ? { imagePaths: images.map((image) => image.path) } : {}
   };
 }
-var import_http4, import_crypto13, import_promises25, import_path10, import_path11, import_url2, import_crypto14, IDLE_SOCKET_MS2, OpenCodeHttpError, OpenCodeClient, OPENCODE_CONFIG_ENV, OPENCODE_ENGINE, TEXT_PARTS, STEP_PARTS, STOPPED_BY_USER, OpenCodeSubagents, NAMED_KINDS, OPENCODE_ABORTED_ERROR, PROVIDER_EVENT_META, TASK_TOOL_NAME, TASK_RESULT_TAG, TASK_ERROR_TAG, PERMISSION_DENIED, FILE_OPERATIONS, PartReader, NOTHING, NON_INTERACTIVE_PERMISSIONS, CONTENT_FILTER_FINISHES, OUTPUT_PARTS, OpenCodeTurn, LISTENING, OUTPUT_TAIL_LINES, IMAGE_TYPES, OpenCodeSession, OPENCODE_MIN_VERSION, OPENCODE_REQUIREMENT, OPENCODE_TESTED_LINE, OPENCODE_SUPPORTED_MAJOR, DEFAULTS4, STORE_LOCKED, NON_INTERACTIVE_RULES, TITLE_LENGTH, MAX_VARIANT_LENGTH;
+var import_http4, import_crypto14, import_promises25, import_path10, import_path11, import_url2, import_crypto15, IDLE_SOCKET_MS2, OpenCodeHttpError, OpenCodeClient, OPENCODE_CONFIG_ENV, OPENCODE_ENGINE, TEXT_PARTS, STEP_PARTS, STOPPED_BY_USER, OpenCodeSubagents, NAMED_KINDS, OPENCODE_ABORTED_ERROR, PROVIDER_EVENT_META, TASK_TOOL_NAME, TASK_RESULT_TAG, TASK_ERROR_TAG, PERMISSION_DENIED, FILE_OPERATIONS, PartReader, NOTHING, NON_INTERACTIVE_PERMISSIONS, CONTENT_FILTER_FINISHES, OUTPUT_PARTS, OpenCodeTurn, LISTENING, OUTPUT_TAIL_LINES, IMAGE_TYPES, OpenCodeSession, OPENCODE_MIN_VERSION, OPENCODE_REQUIREMENT, OPENCODE_TESTED_LINE, OPENCODE_SUPPORTED_MAJOR, DEFAULTS4, STORE_LOCKED, NON_INTERACTIVE_RULES, TITLE_LENGTH, MAX_VARIANT_LENGTH;
 var init_opencode = __esm({
   "../agent-core/dist/providers/opencode.js"() {
     "use strict";
-    init_chunk_72NSEYHK();
+    init_chunk_4G77APXN();
     init_chunk_XC5676SG();
-    init_chunk_54ZRJOQP();
+    init_chunk_HBIPWAUI();
     init_chunk_J2KTV5FP();
     init_chunk_M6YHY2EZ();
     init_chunk_FPGAN4XO();
     init_chunk_YXWJW7I5();
     import_http4 = require("http");
     init_runtime_v2();
-    import_crypto13 = require("crypto");
+    import_crypto14 = require("crypto");
     import_promises25 = require("fs/promises");
     import_path10 = require("path");
     init_agent2();
@@ -40320,7 +40464,7 @@ var init_opencode = __esm({
     import_url2 = require("url");
     init_acp();
     init_acp();
-    import_crypto14 = require("crypto");
+    import_crypto15 = require("crypto");
     init_agent2();
     IDLE_SOCKET_MS2 = 4e3;
     OpenCodeHttpError = class extends Error {
@@ -41616,11 +41760,11 @@ function createCodexLogin(broker) {
     }
   };
 }
-function withLogin(planned, externalAuth, accountId) {
+function withLogin(planned, externalAuth, credentialKey) {
   return {
     ...planned,
     spec: { ...planned.spec, externalAuth },
-    key: JSON.stringify([planned.key, accountId])
+    key: JSON.stringify([planned.key, credentialKey])
   };
 }
 function createCodexHolderDriver(options) {
@@ -41642,7 +41786,11 @@ function createCodexHolderDriver(options) {
         });
         if (inputs.codex === void 0) return planned;
         login.forTurn(spec.runId, inputs.codex);
-        return withLogin(planned, login.externalAuth, inputs.codex.chatgptAccountId);
+        return withLogin(
+          planned,
+          login.externalAuth,
+          inputs.codex.credentialId ?? inputs.codex.chatgptAccountId
+        );
       },
       canResume: () => true,
       open: async (spec) => {
@@ -42055,7 +42203,7 @@ function createDroidDriver(options = {}) {
   };
 }
 function envDigest5(env) {
-  const hash2 = (0, import_crypto15.createHash)("sha256");
+  const hash2 = (0, import_crypto16.createHash)("sha256");
   for (const key of Object.keys(env).sort()) hash2.update(`${key}\0${env[key]}\0`);
   return hash2.digest("hex");
 }
@@ -42115,19 +42263,19 @@ async function droidTurnInput(run, context) {
   );
   return { turnId: run.runId, text: text2, ...encoded.length ? { images: encoded } : {} };
 }
-var import_crypto15, import_promises26, FACTORY_API_VERSION, FACTORY_PROTOCOL_VERSION, SUBAGENT_TOOLS, TASK_OUTPUT_TOOLS, TASK_STOP_TOOLS, SILENT2, DroidTurn, STDERR_TAIL_LINES5, UNSUPPORTED_REQUEST2, DroidSession, DEFAULTS5, DROID_REQUIREMENT, DROID_JSONRPC_ARGS;
+var import_crypto16, import_promises26, FACTORY_API_VERSION, FACTORY_PROTOCOL_VERSION, SUBAGENT_TOOLS, TASK_OUTPUT_TOOLS, TASK_STOP_TOOLS, SILENT2, DroidTurn, STDERR_TAIL_LINES5, UNSUPPORTED_REQUEST2, DroidSession, DEFAULTS5, DROID_REQUIREMENT, DROID_JSONRPC_ARGS;
 var init_droid = __esm({
   "../agent-core/dist/providers/droid.js"() {
     "use strict";
-    init_chunk_72NSEYHK();
+    init_chunk_4G77APXN();
     init_chunk_XC5676SG();
-    init_chunk_54ZRJOQP();
+    init_chunk_HBIPWAUI();
     init_chunk_J2KTV5FP();
     init_chunk_M6YHY2EZ();
     init_chunk_FPGAN4XO();
     init_chunk_YXWJW7I5();
     init_runtime_v2();
-    import_crypto15 = require("crypto");
+    import_crypto16 = require("crypto");
     import_promises26 = require("fs/promises");
     init_agent2();
     FACTORY_API_VERSION = "1.0.0";
@@ -43175,7 +43323,7 @@ ${output2.stderr}`).join("\n")
   };
 }
 function envDigest6(env) {
-  const hash2 = (0, import_crypto16.createHash)("sha256");
+  const hash2 = (0, import_crypto17.createHash)("sha256");
   for (const key of Object.keys(env).sort()) hash2.update(`${key}\0${env[key]}\0`);
   return hash2.digest("hex");
 }
@@ -43221,14 +43369,14 @@ function antigravityTurnInput(run, context) {
   });
   return { turnId: run.runId, text: appendImagePathReferences(text2, images) };
 }
-var import_promises27, import_path12, import_fs8, import_path13, import_path14, import_url3, import_crypto16, NO_ANTIGRAVITY_CAPABILITIES, INSTRUCTIONS_FILE, MAX_INSTRUCTION_CHARS, SHORTENED_NOTE, DIFF_BLOCK_START, DIFF_BLOCK_END, HUNK_HEADER, TRANSCRIPT_FILE, FULL_TRANSCRIPT_FILE, LOG_DIRS, TOOL_RESULT_TYPES, BrainTranscript, AntigravityTranscripts, ANTIGRAVITY_GRAMMAR_NAME, AntigravityGrammar, ignored, HANDLERS, SUCCESSFUL_STATUSES, SESSION_START_TYPES, RESULT_TYPES, SUBAGENT_START_TYPES, RESUME_FORKED, EXITED_WITHOUT_RESULT, AntigravityTurn, DEFAULTS6, AntigravitySession, WINDOWS_LINE_MARGIN;
+var import_promises27, import_path12, import_fs8, import_path13, import_path14, import_url3, import_crypto17, NO_ANTIGRAVITY_CAPABILITIES, INSTRUCTIONS_FILE, MAX_INSTRUCTION_CHARS, SHORTENED_NOTE, DIFF_BLOCK_START, DIFF_BLOCK_END, HUNK_HEADER, TRANSCRIPT_FILE, FULL_TRANSCRIPT_FILE, LOG_DIRS, TOOL_RESULT_TYPES, BrainTranscript, AntigravityTranscripts, ANTIGRAVITY_GRAMMAR_NAME, AntigravityGrammar, ignored, HANDLERS, SUCCESSFUL_STATUSES, SESSION_START_TYPES, RESULT_TYPES, SUBAGENT_START_TYPES, RESUME_FORKED, EXITED_WITHOUT_RESULT, AntigravityTurn, DEFAULTS6, AntigravitySession, WINDOWS_LINE_MARGIN;
 var init_antigravity = __esm({
   "../agent-core/dist/providers/antigravity.js"() {
     "use strict";
     init_chunk_SBT5W7L4();
-    init_chunk_72NSEYHK();
+    init_chunk_4G77APXN();
     init_chunk_XC5676SG();
-    init_chunk_54ZRJOQP();
+    init_chunk_HBIPWAUI();
     init_chunk_M6YHY2EZ();
     init_chunk_FPGAN4XO();
     init_chunk_YXWJW7I5();
@@ -43240,7 +43388,7 @@ var init_antigravity = __esm({
     init_effort();
     import_path14 = require("path");
     import_url3 = require("url");
-    import_crypto16 = require("crypto");
+    import_crypto17 = require("crypto");
     init_agent2();
     NO_ANTIGRAVITY_CAPABILITIES = {
       structuredPrint: false,
@@ -43874,7 +44022,7 @@ function createCommandCodeDriver(options = {}) {
   };
 }
 function envDigest7(env) {
-  const hash2 = (0, import_crypto17.createHash)("sha256");
+  const hash2 = (0, import_crypto18.createHash)("sha256");
   for (const key of Object.keys(env).sort()) hash2.update(`${key}\0${env[key]}\0`);
   return hash2.digest("hex");
 }
@@ -43926,13 +44074,13 @@ function commandCodeTurnInput(run, context) {
   });
   return { turnId: run.runId, text: appendImagePathReferences(text2, images) };
 }
-var import_promises28, import_path15, import_crypto17, COMMAND_CODE_GRAMMAR_NAME, SILENT3, CommandCodeGrammar, SHELL_TOOL, STOP_TOOLS, REPORTED_STATUS, SHELL_STATUS, SWEEP_INTERVAL_MS, CommandCodeBackgroundTasks, EXITED_WITHOUT_RESULT2, CommandCodeTurn, COMMAND_CODE_MAX_TURNS, DEFAULTS7, CommandCodeSession;
+var import_promises28, import_path15, import_crypto18, COMMAND_CODE_GRAMMAR_NAME, SILENT3, CommandCodeGrammar, SHELL_TOOL, STOP_TOOLS, REPORTED_STATUS, SHELL_STATUS, SWEEP_INTERVAL_MS, CommandCodeBackgroundTasks, EXITED_WITHOUT_RESULT2, CommandCodeTurn, COMMAND_CODE_MAX_TURNS, DEFAULTS7, CommandCodeSession;
 var init_command_code = __esm({
   "../agent-core/dist/providers/command-code.js"() {
     "use strict";
-    init_chunk_72NSEYHK();
+    init_chunk_4G77APXN();
     init_chunk_XC5676SG();
-    init_chunk_54ZRJOQP();
+    init_chunk_HBIPWAUI();
     init_chunk_J2KTV5FP();
     init_chunk_M6YHY2EZ();
     init_chunk_FPGAN4XO();
@@ -43942,7 +44090,7 @@ var init_command_code = __esm({
     init_agent2();
     init_runtime_v2();
     init_acp();
-    import_crypto17 = require("crypto");
+    import_crypto18 = require("crypto");
     init_agent2();
     COMMAND_CODE_GRAMMAR_NAME = "command_code_cli";
     SILENT3 = /* @__PURE__ */ new Set([
@@ -44933,7 +45081,18 @@ function createHttpTransport() {
 
 // src/api-client/holder-client.ts
 init_runtime_v2();
+init_zod();
 var REQUEST_TIMEOUT_MS = 3e4;
+var credentialRefusalSchema = external_exports.object({ message: external_exports.string().trim().min(1) });
+function credentialFailureMessage(response, fallback) {
+  if (response.status !== 409) return fallback;
+  try {
+    const parsed = credentialRefusalSchema.safeParse(jsonBody(response));
+    return parsed.success ? parsed.data.message : fallback;
+  } catch {
+    return fallback;
+  }
+}
 function createHolderApiClient({
   apiUrl,
   accessToken,
@@ -44966,7 +45125,10 @@ function createHolderApiClient({
       if (!isOk(response)) {
         throw new RuntimeFault(
           "io_failed",
-          `Provider credential request failed: ${response.status}`
+          credentialFailureMessage(
+            response,
+            `Provider credential request failed: ${response.status}`
+          )
         );
       }
       return runProviderCredentialSchema.parse(jsonBody(response));
@@ -44974,7 +45136,10 @@ function createHolderApiClient({
     refreshCodexCredential: async (runId, body, signal) => {
       const response = await request2("POST", runCodexCredentialRefreshPath(runId), signal, body);
       if (!isOk(response)) {
-        throw new RuntimeFault("io_failed", `Codex sign-in refresh failed: ${response.status}`);
+        throw new RuntimeFault(
+          "io_failed",
+          credentialFailureMessage(response, `Codex sign-in refresh failed: ${response.status}`)
+        );
       }
       return runCodexCredentialSchema.parse(jsonBody(response));
     },