@bitkyc08/opencodex 2.69.0 → 2.70.0

package/src/codex/auth-api/pool-quota-probe.ts

@@ -1,3 +1,5 @@
+import { fetchCodexUsage } from "../quota-query-backoff";
+import type { CodexUsageOwner } from "../quota-query-backoff";
 import { capturePoolQuotaWriter, getValidCodexToken, isCodexAccountGenerationLive, forceRefreshCodexPoolToken, markCodexAccountValidated, markCodexAccountValidationFailed, readCodexAccountRecord, isTerminalCodexPoolRefreshFailure, CodexCredentialGenerationConflictError, CodexCredentialRefreshLockTimeoutError, CodexCredentialRefreshBusyError, CodexCredentialRefreshStaleError, TokenRefreshError } from "../account-store";
 import type { PoolQuotaWriter } from "../quota-types";
 import { isValidWhamHistoryObservation, getAccountQuota, isCompleteCodexQuotaRecoverySnapshot, parseUsageQuota, setAccountQuotaFromParsed } from "../quota";
@@ -101,7 +103,9 @@ export function withQuotaProbeEvidence(
   result: PoolQuotaResult,
   evidence: PoolQuotaProbeEvidence,
 ): PoolQuotaResult {
-  return evidence.attempted ? { ...result, quotaProbeAttempted: evidence.attempted } : result;
+  return evidence.attempted
+    && (result.quotaProbeAttempted?.dispatchSequence ?? 0) < evidence.attempted.dispatchSequence
+    ? { ...result, quotaProbeAttempted: evidence.attempted } : result;
 }
 
 export interface PoolQuotaRefreshFlight {
@@ -167,6 +171,7 @@ export async function recoverPoolQuotaFrom401(ctx: {
   resp: Response;
   quotaProbeEvidence: PoolQuotaProbeEvidence;
   onCredentialGeneration?: (generation: number) => void;
+  recoveryProbeNow?: number;
 }): Promise<PoolQuotaResult> {
   const { accountId, existing, configuredPlan, rejectedAccessToken, rejectedGeneration, resp } = ctx;
 
@@ -252,37 +257,61 @@ export async function recoverPoolQuotaFrom401(ctx: {
   ctx.onCredentialGeneration?.(refreshed.generation);
 
   const writerGeneration = captureConfigGeneration();
-  markQuotaProbeAttempted(ctx.quotaProbeEvidence, refreshed.generation);
   const poolWriter = capturePoolQuotaWriter(accountId, refreshed);
-  const replay = await fetch("https://chatgpt.com/backend-api/wham/usage", {
+  const replayRead = await fetchCodexUsage<PoolQuotaResult>(`pool:${accountId}:${writerGeneration}:${refreshed.generation}`, {
     headers: {
       Authorization: `Bearer ${refreshed.accessToken}`,
       "ChatGPT-Account-Id": refreshed.chatgptAccountId,
     },
     signal: AbortSignal.timeout(WHAM_REQUEST_TIMEOUT_MS),
-  });
-  if (!replay.ok) {
-    if (replay.status === 401 && await isTerminalPoolAuthResponse(replay)) {
-      // The refresh already settled this claim non-terminally, so the record alone would
-      // let the next poll call a dead credential healthy. The evidence is about the
-      // REFRESHED credential, which is what the replay used.
-      markAccountNeedsReauth(accountId, writerGeneration, refreshed.generation);
-      return { quota: existing ?? null, needsReauth: true, reauthReason: "quota_unauthorized", credentialGeneration: refreshed.generation };
+  }, () => markQuotaProbeAttempted(ctx.quotaProbeEvidence, refreshed.generation),
+  ctx.recoveryProbeNow === undefined ? { poolAccountId: accountId }
+    : { poolAccountId: accountId, recoveryProbe: true, now: () => ctx.recoveryProbeNow! });
+  if (!replayRead) return { quota: existing ?? null, needsReauth: false, credentialGeneration: refreshed.generation, quotaProbeSkipped: true };
+  if (replayRead.kind === "joined") {
+    if (!isCodexAccountGenerationLive(accountId, refreshed.generation)
+      || ctx.quotaProbeEvidence.mayPublish?.() === false) {
+      return { quota: getAccountQuota(accountId), needsReauth: false, credentialGeneration: refreshed.generation };
     }
-    return { quota: existing ?? null, needsReauth: false, credentialGeneration: refreshed.generation };
+    const joined = replayRead.result;
+    return joined.freshCredentialGeneration === refreshed.generation ? {
+      ...joined,
+      resetRefreshLineage: {
+        fromGeneration: rejectedGeneration, toGeneration: refreshed.generation,
+        provenance: refreshed.provenance,
+      },
+    } : joined;
   }
-  const result = await commitPoolQuotaResponse(replay, {
-    accountId, existing, configuredPlan, generation: refreshed.generation, writerGeneration, poolWriter,
-    mayPublish: ctx.quotaProbeEvidence.mayPublish,
-  });
-  return result.freshCredentialGeneration === refreshed.generation ? {
-    ...result,
-    resetRefreshLineage: {
-      fromGeneration: rejectedGeneration,
-      toGeneration: refreshed.generation,
-      provenance: refreshed.provenance,
-    },
-  } : result;
+  let usableReplay = false;
+  const finishReplay = async (): Promise<PoolQuotaResult> => {
+    const replay = replayRead.response;
+    if (!replay.ok) {
+      if (replay.status === 401 && await isTerminalPoolAuthResponse(replay)) {
+        // The refresh already settled this claim non-terminally, so the record alone would
+        // let the next poll call a dead credential healthy. The evidence is about the
+        // REFRESHED credential, which is what the replay used.
+        markAccountNeedsReauth(accountId, writerGeneration, refreshed.generation);
+        return { quota: existing ?? null, needsReauth: true, reauthReason: "quota_unauthorized", credentialGeneration: refreshed.generation };
+      }
+      return { quota: existing ?? null, needsReauth: false, credentialGeneration: refreshed.generation };
+    }
+    const result = await commitPoolQuotaResponse(replay, {
+      accountId, existing, configuredPlan, generation: refreshed.generation, writerGeneration, poolWriter,
+      mayPublish: ctx.quotaProbeEvidence.mayPublish,
+    });
+    usableReplay = result.freshQuota !== undefined;
+    return result.freshCredentialGeneration === refreshed.generation ? {
+      ...result,
+      resetRefreshLineage: {
+        fromGeneration: rejectedGeneration,
+        toGeneration: refreshed.generation,
+        provenance: refreshed.provenance,
+      },
+    } : result;
+  };
+  let replayOutcome: PoolQuotaResult | undefined;
+  try { replayOutcome = await finishReplay(); return replayOutcome; }
+  finally { replayRead.settle(usableReplay, replayOutcome); }
 }
 
 /** Backoff after a refresh failure that proved nothing about the credential. */
@@ -338,8 +367,9 @@ export async function commitPoolQuotaResponse(
   if (!isCodexAccountGenerationLive(accountId, generation)) {
     return { quota: null, needsReauth: false, credentialGeneration: generation };
   }
-  setAccountQuotaFromParsed(accountId, quota, writerGeneration, undefined, quota,
-    ctx.poolWriter && isValidWhamHistoryObservation(data) ? { writer: ctx.poolWriter, observedAt, source: "wham", raw: quota } : undefined);
+  const validPolicyObservation = isValidWhamHistoryObservation(data);
+  setAccountQuotaFromParsed(accountId, quota, writerGeneration, undefined, validPolicyObservation ? quota : null,
+    ctx.poolWriter && validPolicyObservation ? { writer: ctx.poolWriter, observedAt, source: "wham", raw: quota } : undefined);
   return {
     quota: getAccountQuota(accountId),
     needsReauth: false,
@@ -358,81 +388,100 @@ export async function fetchFreshPoolAccountQuota(
   onCredentialGeneration?: (generation: number) => void,
   getValidToken: typeof getValidCodexToken = getValidCodexToken,
   quotaProbeEvidence: PoolQuotaProbeEvidence = {},
+  afterDispatchSequence?: number,
+  recoveryProbeNow?: number,
 ): Promise<PoolQuotaResult> {
   const writerGeneration = captureConfigGeneration();
   let requestCredentialGeneration = readCodexAccountRecord(accountId)?.generation;
-  try {
-    const { accessToken, chatgptAccountId, generation } = await getValidToken(accountId);
-    const poolWriter = capturePoolQuotaWriter(accountId, { accessToken, chatgptAccountId, generation });
-    requestCredentialGeneration = generation;
-    onCredentialGeneration?.(generation);
-    markQuotaProbeAttempted(quotaProbeEvidence, generation);
-    const resp = await fetch("https://chatgpt.com/backend-api/wham/usage", {
-      headers: { Authorization: `Bearer ${accessToken}`, "ChatGPT-Account-Id": chatgptAccountId },
-      signal: AbortSignal.timeout(8000),
-    });
-    if (!resp.ok) {
-      if (resp.status !== 401) {
-        return withQuotaProbeEvidence(
-          { quota: existing ?? null, needsReauth: false, credentialGeneration: generation },
+  const readState: { owner?: CodexUsageOwner<PoolQuotaResult>; usable: boolean } = { usable: false };
+  const read = async (): Promise<PoolQuotaResult> => {
+    try {
+      const { accessToken, chatgptAccountId, generation } = await getValidToken(accountId);
+      const poolWriter = capturePoolQuotaWriter(accountId, { accessToken, chatgptAccountId, generation });
+      requestCredentialGeneration = generation;
+      onCredentialGeneration?.(generation);
+      const admission = await fetchCodexUsage<PoolQuotaResult>(
+        `pool:${accountId}:${writerGeneration}:${generation}${afterDispatchSequence === undefined ? "" : `:post-reset:${afterDispatchSequence}`}`, {
+        headers: { Authorization: `Bearer ${accessToken}`, "ChatGPT-Account-Id": chatgptAccountId },
+        signal: AbortSignal.timeout(8000),
+      }, () => markQuotaProbeAttempted(quotaProbeEvidence, generation),
+      recoveryProbeNow === undefined ? { poolAccountId: accountId }
+        : { poolAccountId: accountId, recoveryProbe: true, now: () => recoveryProbeNow });
+      if (!admission) return { quota: existing ?? null, needsReauth: false, credentialGeneration: generation, quotaProbeSkipped: true };
+      if (admission.kind === "joined") return isCodexAccountGenerationLive(accountId, generation)
+        && quotaProbeEvidence.mayPublish?.() !== false
+        ? admission.result
+        : { quota: getAccountQuota(accountId), needsReauth: false, credentialGeneration: generation };
+      readState.owner = admission;
+      const resp = admission.response;
+      if (!resp.ok) {
+        if (resp.status !== 401) {
+          return withQuotaProbeEvidence(
+            { quota: existing ?? null, needsReauth: false, credentialGeneration: generation },
+            quotaProbeEvidence,
+          );
+        }
+        // A bare 401 is what a stale-but-refreshable bearer produces after a plan change, so
+        // quarantining on it tells the operator to re-authenticate an account that was fine
+        // (#3019). Refresh once, replay once, and only then decide.
+        const recovered = await recoverPoolQuotaFrom401({
+          accountId,
+          existing,
+          configuredPlan,
+          rejectedAccessToken: accessToken,
+          rejectedGeneration: generation,
+          resp,
           quotaProbeEvidence,
-        );
+          onCredentialGeneration,
+          recoveryProbeNow,
+        });
+        return withQuotaProbeEvidence(recovered, quotaProbeEvidence);
       }
-      // A bare 401 is what a stale-but-refreshable bearer produces after a plan change, so
-      // quarantining on it tells the operator to re-authenticate an account that was fine
-      // (#3019). Refresh once, replay once, and only then decide.
-      const recovered = await recoverPoolQuotaFrom401({
-        accountId,
-        existing,
-        configuredPlan,
-        rejectedAccessToken: accessToken,
-        rejectedGeneration: generation,
-        resp,
-        quotaProbeEvidence,
-        onCredentialGeneration,
+      const committed = await commitPoolQuotaResponse(resp, {
+        accountId, existing, configuredPlan, generation, writerGeneration, poolWriter,
+        mayPublish: quotaProbeEvidence.mayPublish,
       });
-      return withQuotaProbeEvidence(recovered, quotaProbeEvidence);
-    }
-    const committed = await commitPoolQuotaResponse(resp, {
-      accountId, existing, configuredPlan, generation, writerGeneration, poolWriter,
-      mayPublish: quotaProbeEvidence.mayPublish,
-    });
-    return withQuotaProbeEvidence(committed, quotaProbeEvidence);
-  } catch (e) {
-    if (e instanceof CodexCredentialGenerationConflictError || e instanceof CodexCredentialRefreshLockTimeoutError
-      || e instanceof CodexCredentialRefreshBusyError || e instanceof CodexCredentialRefreshStaleError) {
-      return withQuotaProbeEvidence({
-        quota: existing ?? null,
-        needsReauth: false,
-        credentialGeneration: requestCredentialGeneration,
-        quotaProbeSkipped: true,
-      }, quotaProbeEvidence);
-    }
-    // Terminal means the grant itself is dead or missing; an `unknown` refresh failure (a
-    // token-endpoint 5xx, a transport blip) may clear, so it reports transient like the
-    // 401-recovery path instead of quarantining a healthy account (#2887). A revoked or
-    // expired grant is also written to the record as a terminal validation failure, the same
-    // verdict the token guardian persists: the in-memory mark dies with this process, and
-    // the stored verdict is what keeps a cached listing from calling the dead grant healthy
-    // after a restart.
-    if (isTerminalCodexPoolRefreshFailure(e)) {
-      if (e instanceof TokenRefreshError && isTerminalRefreshError(e)) {
-        markCodexAccountValidationFailed(accountId, `refresh_${e.reason}`, {
-          expectedGeneration: requestCredentialGeneration,
-          terminal: true,
-        });
+      readState.usable = committed.freshQuota !== undefined;
+      return withQuotaProbeEvidence(committed, quotaProbeEvidence);
+    } catch (e) {
+      if (e instanceof CodexCredentialGenerationConflictError || e instanceof CodexCredentialRefreshLockTimeoutError
+        || e instanceof CodexCredentialRefreshBusyError || e instanceof CodexCredentialRefreshStaleError) {
+        return withQuotaProbeEvidence({
+          quota: existing ?? null,
+          needsReauth: false,
+          credentialGeneration: requestCredentialGeneration,
+          quotaProbeSkipped: true,
+        }, quotaProbeEvidence);
+      }
+      // Terminal means the grant itself is dead or missing; an `unknown` refresh failure (a
+      // token-endpoint 5xx, a transport blip) may clear, so it reports transient like the
+      // 401-recovery path instead of quarantining a healthy account (#2887). A revoked or
+      // expired grant is also written to the record as a terminal validation failure, the same
+      // verdict the token guardian persists: the in-memory mark dies with this process, and
+      // the stored verdict is what keeps a cached listing from calling the dead grant healthy
+      // after a restart.
+      if (isTerminalCodexPoolRefreshFailure(e)) {
+        if (e instanceof TokenRefreshError && isTerminalRefreshError(e)) {
+          markCodexAccountValidationFailed(accountId, `refresh_${e.reason}`, {
+            expectedGeneration: requestCredentialGeneration,
+            terminal: true,
+          });
+        }
+        markAccountNeedsReauth(accountId, captureConfigGeneration(), requestCredentialGeneration);
+        return withQuotaProbeEvidence(
+          { quota: existing ?? null, needsReauth: true, reauthReason: "refresh_failed", credentialGeneration: requestCredentialGeneration },
+          quotaProbeEvidence,
+        );
       }
-      markAccountNeedsReauth(accountId, captureConfigGeneration(), requestCredentialGeneration);
       return withQuotaProbeEvidence(
-        { quota: existing ?? null, needsReauth: true, reauthReason: "refresh_failed", credentialGeneration: requestCredentialGeneration },
+        { quota: existing ?? null, needsReauth: false, credentialGeneration: requestCredentialGeneration },
         quotaProbeEvidence,
       );
     }
-    return withQuotaProbeEvidence(
-      { quota: existing ?? null, needsReauth: false, credentialGeneration: requestCredentialGeneration },
-      quotaProbeEvidence,
-    );
-  }
+  };
+  let outcome: PoolQuotaResult | undefined;
+  try { outcome = await read(); return outcome; }
+  finally { readState.owner?.settle(readState.usable, outcome); }
 }
 
 export async function fetchPoolAccountQuota(
@@ -442,6 +491,7 @@ export async function fetchPoolAccountQuota(
   getValidToken: typeof getValidCodexToken = getValidCodexToken,
   validatePending = false,
   afterDispatchSequence?: number,
+  recoveryProbeNow?: number,
 ): Promise<PoolQuotaResult> {
   const existing = getAccountQuota(accountId);
   if (afterDispatchSequence === undefined && !forceRefresh && existing && Date.now() - existing.updatedAt < POOL_CACHE_TTL) {
@@ -489,6 +539,8 @@ export async function fetchPoolAccountQuota(
       onDispatch: sequence => { state.dispatchSequence = sequence; },
       mayPublish: () => state.superseded !== true,
     },
+    afterDispatchSequence,
+    recoveryProbeNow,
   ).then(async result => {
     // A passive flight has consumed its validation decision. Remove it before
     // promise settlement queues other continuations, so a late explicit caller

package/src/codex/auth-api/reset-credit-service.ts

@@ -225,7 +225,7 @@ async function refreshAfterManualReset(
     if (!manualResetAuthStillLive(accountId, auth)) return undefined;
     if (auth.isMain) {
       const result = await fetchMainAccountInfoAttempt(true, 1, auth.nativeMainLease,
-        auth.nativeMainSharedClaimHeld === true, false);
+        auth.nativeMainSharedClaimHeld === true, false, didReset, config);
       const proof = result.resetRecoveryProof;
       const recovered = didReset && manualResetAuthStillLive(accountId, auth)
         && !!proof && !!auth.mainProof

package/src/codex/catalog/gather-capture.ts

@@ -531,6 +531,7 @@ function providerCatalogFingerprint(name: string, prov: OcxProviderConfig): Reco
     defaultModel: prov.defaultModel ?? null,
     ctx: prov.contextWindow ?? null,
     ctxW: prov.modelContextWindows ?? null,
+    ctxTier: prov.modelContextTiers ?? null,
     maxIn: prov.modelMaxInputTokens ?? null,
     maxOut: prov.modelMaxOutputTokens ?? null,
     autoCompact: prov.modelAutoCompactTokenLimits ?? null,

package/src/codex/catalog/model-hints.ts

@@ -45,6 +45,7 @@ import type { FastPolicyAuthority } from "../../providers/fastwire";
 import { effectiveGoogleMode, getProviderRegistryEntry, providerMatchesRegistryTransport, registryEntryForProviderDestination } from "../../providers/registry";
 import { parseAntigravityAvailableModels, registerAntigravityDiscoveredWireModels } from "../../providers/antigravity-models";
 import { applyProviderContextCap, providerContextCap, resolveUnknownRoutedContextWindow } from "../../providers/context-cap";
+import { githubCopilotCatalogContextWindow } from "../../providers/github-copilot-context";
 import { clampAutoCompactTokenLimit } from "../../providers/auto-compact-budget";
 import { effectiveModelAliases } from "../../providers/default-aliases";
 import { routedSlug, slugEquals, slugEquivalenceKey, slugsEquivalent } from "../../providers/slug-codec";
@@ -310,9 +311,8 @@ export function applyProviderConfigHints(
     ...modelWithoutServiceTier
   } = model;
   // 已发现窗口只允许被配置值压低；缺窗口时，已开的 Context cap 就是实际窗口。
-  const discoveredWindow = typeof model.contextWindow === "number" && model.contextWindow > 0
-    ? model.contextWindow
-    : undefined;
+  const discoveredWindow = githubCopilotCatalogContextWindow(name, prov, model.id,
+    typeof model.contextWindow === "number" && model.contextWindow > 0 ? model.contextWindow : undefined);
   const projectedLimits = clampObservedModelLimits(staticPolicy.model, {
     ...(discoveredWindow !== undefined ? { contextWindow: discoveredWindow } : {}),
     ...(typeof model.maxInputTokens === "number" && model.maxInputTokens > 0 ? { maxInputTokens: model.maxInputTokens } : {}),

package/src/codex/catalog/provider-models.ts

@@ -424,6 +424,8 @@ export async function fetchProviderModelsWithAuth(
           // away, and every client that keys an effort control off this field —
           // the Pi-shaped exports — renders no control at all.
           ...(liveResult.efforts[id]?.length ? { reasoningEfforts: liveResult.efforts[id] } : {}),
+          // The family's effective enabled default, matching an unset effort at request time.
+          ...(liveResult.defaultEfforts[id] ? { defaultReasoningEffort: liveResult.defaultEfforts[id] } : {}),
           // The account catalog's per-base supportsImages vote collapses to one
           // modalities value. It spreads before the hints so exact
           // modelCapabilities declarations, the legacy modelInputModalities

package/src/codex/low-quota-events.ts

@@ -0,0 +1,28 @@
+/** Bounded event projection owned by one live low-quota registration. */
+export type LowQuotaEvent = {
+  accountId: string;
+  window: "short" | "weekly";
+  percentUsed: number;
+  resetAt: number | null;
+  timestamp: number;
+  status: "pending" | "logged" | "delivered" | "succeeded" | "failed" | "cancelled";
+  delivery: "notice" | "pause-save";
+};
+
+const CAPACITY = 100;
+
+export function createLowQuotaEventLedger(): {
+  publish(event: LowQuotaEvent): void;
+  list(limit?: number): LowQuotaEvent[];
+} {
+  const events: LowQuotaEvent[] = [];
+  return {
+    publish(event) {
+      events.unshift({ ...event });
+      if (events.length > CAPACITY) events.length = CAPACITY;
+    },
+    list(limit = 20) {
+      return events.slice(0, Math.max(0, Math.min(CAPACITY, limit))).map(event => ({ ...event }));
+    },
+  };
+}

package/src/codex/low-quota-observer.ts

@@ -0,0 +1,23 @@
+import type { StoredAccountQuota } from "./quota-types";
+
+type Observer = (accountId: string, quota: Omit<StoredAccountQuota, "updatedAt">) => void;
+const observers = new Map<symbol, Observer>();
+
+/** The composition root owns the live config; quota writers know only this synchronous slot. */
+export function registerLowQuotaObserver(observer: Observer): () => void {
+  const owner = Symbol();
+  observers.set(owner, observer);
+  return () => { observers.delete(owner); };
+}
+
+/** Only newly accepted evidence belongs here, never carried or disk-hydrated windows. */
+export function observeCodexLowQuota(accountId: string, quota: Omit<StoredAccountQuota, "updatedAt">): void {
+  for (const observer of observers.values()) {
+    try {
+      observer(accountId, quota);
+    } catch {
+      // One server's optional policy cannot suppress another server's observation.
+      console.warn("[codex-low-quota] protection action failed");
+    }
+  }
+}