@juspay/neurolink 11.2.0 → 11.2.2

package/dist/cli/commands/auth.d.ts

@@ -26,6 +26,16 @@ import type { AccountQuota, AuthCommandArgs } from "../../lib/types/index.js";
  * (e.g., "anthropic:alice") to support multi-account pools.
  */
 export declare function handleLogin(argv: AuthCommandArgs): Promise<void>;
+/**
+ * Handle Codex (ChatGPT) login by importing the current credential from
+ * `~/.codex/auth.json` into the account pool under a `codex:<label>` key.
+ *
+ * To add multiple ChatGPT accounts: `codex login` as account A, then
+ * `neurolink auth login codex --label a`; repeat for account B, etc. The proxy
+ * then pools all imported accounts and rotates automatically — no manual
+ * account switching during use.
+ */
+export declare function handleCodexLogin(argv: AuthCommandArgs): Promise<void>;
 /**
  * Format the dynamic per-plan limit windows (model-scoped weeklies such as
  * Fable, plus any future kinds) as extra display lines. `session` and
@@ -64,14 +74,6 @@ export declare function handleStatus(argv: AuthCommandArgs): Promise<void>;
  * `neurolink auth refresh <provider>`
  */
 export declare function handleRefresh(argv: AuthCommandArgs): Promise<void>;
-/**
- * Handle the cleanup subcommand
- * `neurolink auth cleanup [--force]`
- *
- * Removes stale accounts from the token store:
- *   1. Expired entries with no refresh token (via pruneExpired)
- *   2. Permanently disabled entries (after confirmation)
- */
 export declare function handleCleanup(argv: AuthCommandArgs): Promise<void>;
 /**
  * Handle the enable subcommand
@@ -80,6 +82,14 @@ export declare function handleCleanup(argv: AuthCommandArgs): Promise<void>;
  * Re-enables a previously disabled account so it can be used by the proxy pool again.
  */
 export declare function handleEnable(argv: AuthCommandArgs): Promise<void>;
+export declare function handleDisable(argv: AuthCommandArgs): Promise<void>;
+/**
+ * Inspect or clear the per-account rate-limit cooldowns the proxy persists.
+ *
+ * Without this there is no way to see why an account vanished from the pool, or
+ * to release one parked by a bad reset timestamp.
+ */
+export declare function handleCooldown(argv: AuthCommandArgs): Promise<void>;
 /**
  * Handle the set-primary subcommand
  * `neurolink auth set-primary <email> [--config <path>]`
@@ -89,6 +99,15 @@ export declare function handleEnable(argv: AuthCommandArgs): Promise<void>;
  * Does not touch the token store.
  */
 export declare function handleSetPrimary(argv: AuthCommandArgs): Promise<void>;
+/**
+ * Handle the overage subcommand
+ * `neurolink auth overage <status|auto|always|never> [--config <path>]`
+ *
+ * Controls whether the pool may keep serving on paid extra usage once an
+ * account's subscription window is spent. Only `never` overrides the provider:
+ * nothing here can switch on extra usage that Anthropic reports as disabled.
+ */
+export declare function handleOverage(argv: AuthCommandArgs): Promise<void>;
 /**
  * Handle the get-primary subcommand
  * `neurolink auth get-primary [--config <path>]`

package/dist/cli/commands/auth.js

@@ -29,6 +29,8 @@ import { defaultTokenStore } from "../../lib/auth/tokenStore.js";
 import { CLAUDE_CODE_CLIENT_ID, ANTHROPIC_AUTH_URL, ANTHROPIC_TOKEN_URL, ANTHROPIC_REDIRECT_URI, CLAUDE_CLI_USER_AGENT, OAUTH_BETA_HEADERS, } from "../../lib/auth/anthropicOAuth.js";
 import { flushAccountQuotas, loadAccountQuotas, saveAccountQuota, } from "../../lib/proxy/accountQuota.js";
 import { fetchAccountUsage, listAnthropicAccountsForUsage, usageToQuota, } from "../../lib/proxy/accountUsage.js";
+import { importCodexAuthFile } from "../../lib/auth/codexOAuth.js";
+import { fetchCodexAccountUsage, listCodexAccountsForUsage, } from "../../lib/proxy/codexAccountUsage.js";
 // =============================================================================
 // CONSTANTS
 // =============================================================================
@@ -62,7 +64,7 @@ const ANTHROPIC_CONSOLE_OAUTH_CONFIG = {
     createApiKeyUrl: "https://api.anthropic.com/api/oauth/claude_cli/create_api_key",
 };
 // Supported providers
-const SUPPORTED_PROVIDERS = ["anthropic"];
+const SUPPORTED_PROVIDERS = ["anthropic", "codex"];
 // =============================================================================
 // SUBCOMMAND HANDLERS
 // =============================================================================
@@ -81,6 +83,12 @@ export async function handleLogin(argv) {
             logger.error(chalk.red(`Unsupported provider: ${provider}. Supported: ${SUPPORTED_PROVIDERS.join(", ")}`));
             process.exit(1);
         }
+        // Codex has a dedicated import-based login path (imports the current
+        // ChatGPT credential from ~/.codex/auth.json into the pool).
+        if (provider === "codex") {
+            await handleCodexLogin(argv);
+            return;
+        }
         // If method is specified, use it directly
         // Each handler returns true when credentials were written to a file,
         // false for .env-only or "keep existing" paths.
@@ -115,6 +123,92 @@ export async function handleLogin(argv) {
         process.exit(1);
     }
 }
+/**
+ * Handle Codex (ChatGPT) login by importing the current credential from
+ * `~/.codex/auth.json` into the account pool under a `codex:<label>` key.
+ *
+ * To add multiple ChatGPT accounts: `codex login` as account A, then
+ * `neurolink auth login codex --label a`; repeat for account B, etc. The proxy
+ * then pools all imported accounts and rotates automatically — no manual
+ * account switching during use.
+ */
+export async function handleCodexLogin(argv) {
+    const spinner = ora("Importing Codex (ChatGPT) credential…").start();
+    try {
+        const credential = await importCodexAuthFile();
+        const rawLabel = argv.label ??
+            credential.email ??
+            credential.accountId?.slice(0, 8) ??
+            Date.now().toString(36).slice(-6);
+        const label = rawLabel.trim();
+        const compoundKey = `codex:${label}`;
+        const scopeParts = ["codex"];
+        if (credential.planType) {
+            scopeParts.push(`plan:${credential.planType}`);
+        }
+        if (credential.email) {
+            scopeParts.push(`email:${credential.email}`);
+        }
+        if (credential.accountId) {
+            scopeParts.push(`account:${credential.accountId}`);
+        }
+        await defaultTokenStore.saveTokens(compoundKey, {
+            accessToken: credential.accessToken,
+            refreshToken: credential.refreshToken,
+            expiresAt: credential.expiresAt ?? Date.now() + 3_600_000,
+            tokenType: "Bearer",
+            scope: scopeParts.join(" "),
+        });
+        await defaultTokenStore.markEnabled(compoundKey);
+        spinner.succeed(`Codex account added to pool: ${chalk.cyan(compoundKey)}`);
+        if (credential.planType) {
+            logger.always(chalk.gray(`  plan: ${credential.planType}`));
+        }
+        if (credential.email) {
+            logger.always(chalk.gray(`  email: ${credential.email}`));
+        }
+        logger.always(chalk.gray("  Add more accounts: `codex login` (new account) then `neurolink auth login codex --label <name>`"));
+    }
+    catch (error) {
+        spinner.fail("Codex login failed");
+        logger.error(chalk.red(error instanceof Error ? error.message : String(error)));
+        process.exit(1);
+    }
+}
+// ---------------------------------------------------------------------------
+// Pool-state display helpers
+// ---------------------------------------------------------------------------
+/**
+ * One line per account explaining why the proxy is or isn't routing to it.
+ *
+ * The proxy skips accounts on two independent grounds — a persisted `disabled`
+ * flag and an active cooldown — and neither was previously visible from
+ * `auth list`, so an account could silently drop out of rotation.
+ */
+async function collectAccountPoolState(accountKeys) {
+    const notes = {};
+    try {
+        const { loadAccountCooldowns } = await import("../../lib/proxy/accountCooldown.js");
+        const cooldowns = await loadAccountCooldowns();
+        const now = Date.now();
+        for (const key of accountKeys) {
+            if (await defaultTokenStore.isDisabled(key)) {
+                const reason = (await defaultTokenStore.getDisabledReason(key)) ?? "";
+                notes[key] = chalk.red(`disabled${reason ? ` (${reason})` : ""} — re-enable: neurolink auth enable ${key}`);
+                continue;
+            }
+            const cooldown = cooldowns[key];
+            if (cooldown && cooldown.coolingUntil > now) {
+                const minutes = Math.max(1, Math.round((cooldown.coolingUntil - now) / 60000));
+                notes[key] = chalk.yellow(`cooling (${cooldown.reason}) for ~${minutes}m`);
+            }
+        }
+    }
+    catch {
+        // Pool state is advisory — never block the listing on it.
+    }
+    return notes;
+}
 // ---------------------------------------------------------------------------
 // Quota display helpers
 // ---------------------------------------------------------------------------
@@ -286,6 +380,39 @@ async function refreshAccountLimitsForList() {
             // saves never reach disk.
             await flushAccountQuotas().catch(() => undefined);
         }
+        // Codex accounts: fetch the ChatGPT usage windows. Keyed by the full
+        // `codex:` account key so quota never collides with an anthropic account
+        // that shares a bare label.
+        try {
+            const codexAccounts = await listCodexAccountsForUsage();
+            for (const account of codexAccounts) {
+                if (account.type !== "oauth") {
+                    continue;
+                }
+                try {
+                    const result = await fetchCodexAccountUsage(account);
+                    if (!result.ok) {
+                        errors.push(`${account.label}: codex usage ${result.reason}`);
+                        continue;
+                    }
+                    await saveAccountQuota(account.key, result.quota);
+                    quotas[account.key] = result.quota;
+                }
+                catch (err) {
+                    errors.push(`${account.label}: ${err instanceof Error ? err.message : String(err)}`);
+                }
+            }
+        }
+        catch (err) {
+            // Enumeration can throw before the per-account guard is reached. Without
+            // this the failure escapes to the outer handler and the Anthropic quotas
+            // fetched just above are dropped, reporting a total failure for a
+            // Codex-only problem.
+            errors.push(`codex accounts: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        finally {
+            await flushAccountQuotas().catch(() => undefined);
+        }
         return { via: "direct", quotas, errors };
     }
     catch (err) {
@@ -407,7 +534,7 @@ export async function handleList(argv) {
         if (argv.format === "json") {
             // Merge quota data into each account object for JSON output
             const withQuota = enrichedAccounts.map((acct) => {
-                const quotaKey = acct.label ?? acct.key;
+                const quotaKey = acct.provider === "codex" ? acct.key : (acct.label ?? acct.key);
                 const quota = quotas[quotaKey] ?? null;
                 return { ...acct, quota };
             });
@@ -437,10 +564,13 @@ export async function handleList(argv) {
             logger.always(chalk.bold("\nAuthenticated Accounts:\n"));
             // Check if any account has quota data to decide column layout
             const hasQuota = enrichedAccounts.some((acct) => {
-                const quotaKey = acct.label ?? acct.key;
+                const quotaKey = acct.provider === "codex" ? acct.key : (acct.label ?? acct.key);
                 return quotas[quotaKey] !== undefined;
             });
             // Table header
+            // Why an account is (or isn't) in the proxy pool. Without this a
+            // disabled or parked account simply vanishes from routing with no clue.
+            const poolState = await collectAccountPoolState(enrichedAccounts.map((acct) => acct.key));
             const colKey = "LABEL".padEnd(20);
             const colEmail = "EMAIL".padEnd(28);
             const colStatus = "TOKEN STATUS".padEnd(14);
@@ -463,8 +593,9 @@ export async function handleList(argv) {
                 else {
                     statusText = chalk.yellow("unknown".padEnd(14));
                 }
-                const quotaKey = acct.label ?? acct.key;
+                const quotaKey = acct.provider === "codex" ? acct.key : (acct.label ?? acct.key);
                 const quota = quotas[quotaKey];
+                const poolNote = poolState[acct.key];
                 if (hasQuota && quota) {
                     const qc = formatQuotaColumns(quota);
                     logger.always(`  ${chalk.cyan(displayLabel)} ${displayProvider} ${displayEmail} ${statusText} ${qc.sessionText.padEnd(10)} ${qc.weeklyText.padEnd(10)}`);
@@ -477,12 +608,18 @@ export async function handleList(argv) {
                     for (const windowRow of formatQuotaWindowRows(quota)) {
                         logger.always(`${indent}${windowRow}`);
                     }
+                    if (poolNote) {
+                        logger.always(`${indent}${poolNote}`);
+                    }
                 }
                 else {
                     const apiKeyNote = refreshOutcome && acct.tokenType && acct.tokenType !== "Bearer"
                         ? chalk.gray("  (api key — not refreshed)")
                         : "";
                     logger.always(`  ${chalk.cyan(displayLabel)} ${displayProvider} ${displayEmail} ${statusText}${hasQuota ? "  -          -" : ""}${apiKeyNote}`);
+                    if (poolNote) {
+                        logger.always(`  ${poolNote}`);
+                    }
                 }
             }
             logger.always("");
@@ -702,6 +839,51 @@ export async function handleStatus(argv) {
         process.exit(1);
     }
 }
+/**
+ * Refresh every pooled Codex account in place.
+ *
+ * Unlike the Anthropic path there is no single credentials file to rewrite:
+ * accounts live under `codex:<label>` in the token store, so each is refreshed
+ * and saved back individually. A failure on one account never stops the rest.
+ */
+async function handleCodexRefresh(argv) {
+    const { refreshCodexToken } = await import("../../lib/auth/codexOAuth.js");
+    const keys = await defaultTokenStore.listByPrefix("codex:");
+    if (keys.length === 0) {
+        logger.error(chalk.red("No Codex accounts found. Run 'codex login', then 'neurolink auth login codex --label <name>'."));
+        process.exit(1);
+    }
+    logger.always(chalk.blue(`\nRefreshing ${keys.length} Codex account(s)...\n`));
+    let failed = 0;
+    for (const key of keys) {
+        const label = key.slice("codex:".length) || key;
+        const spinner = argv.quiet ? null : ora(`${label}`).start();
+        try {
+            const tokens = await defaultTokenStore.peekTokens(key);
+            if (!tokens?.refreshToken) {
+                throw new Error("no refresh token stored");
+            }
+            const refreshed = await refreshCodexToken(tokens.refreshToken);
+            await defaultTokenStore.saveTokens(key, {
+                accessToken: refreshed.accessToken,
+                refreshToken: refreshed.refreshToken ?? tokens.refreshToken,
+                expiresAt: refreshed.expiresAt ?? Date.now() + 3_600_000,
+                tokenType: "Bearer",
+                ...(tokens.scope ? { scope: tokens.scope } : {}),
+            });
+            spinner?.succeed(`${label} refreshed`);
+        }
+        catch (error) {
+            failed += 1;
+            spinner?.fail(`${label}: ${error instanceof Error ? error.message : "refresh failed"}`);
+        }
+    }
+    if (failed > 0) {
+        logger.always(chalk.yellow(`\n${failed} account(s) need re-import: codex login, then neurolink auth login codex --label <name>\n`));
+        process.exit(1);
+    }
+    logger.always(chalk.green("\nAll Codex accounts refreshed.\n"));
+}
 /**
  * Handle the refresh subcommand
  * `neurolink auth refresh <provider>`
@@ -714,6 +896,12 @@ export async function handleRefresh(argv) {
             logger.error(chalk.red(`Unsupported provider: ${provider}. Supported: ${SUPPORTED_PROVIDERS.join(", ")}`));
             process.exit(1);
         }
+        // Codex credentials live only in the pooled token store — there is no
+        // `codex-credentials.json` for the shared path below to read.
+        if (provider === "codex") {
+            await handleCodexRefresh(argv);
+            return;
+        }
         logger.always(chalk.blue(`\nRefreshing ${provider} OAuth tokens...\n`));
         const spinner = argv.quiet ? null : ora("Reading stored tokens...").start();
         try {
@@ -828,6 +1016,22 @@ export async function handleRefresh(argv) {
  *   1. Expired entries with no refresh token (via pruneExpired)
  *   2. Permanently disabled entries (after confirmation)
  */
+/**
+ * Disable reasons whose credential is still valid — the account is out of the
+ * pool because of an external condition, not because the login broke. Cleanup
+ * must not delete these.
+ *
+ * Expressed as the set of reasons that DO mean the credential is broken, so an
+ * unrecognised reason — notably the free text an operator passes to
+ * `auth disable --reason` — is retained rather than deleted. The inverse
+ * allowlist fails open: any reason not enumerated would silently become a
+ * delete.
+ */
+const BROKEN_CREDENTIAL_DISABLE_REASONS = new Set([
+    "missing_refresh_token",
+    "refresh_invalid",
+    "refresh_failed",
+]);
 export async function handleCleanup(argv) {
     try {
         const removed = [];
@@ -839,7 +1043,29 @@ export async function handleCleanup(argv) {
         // Step 2: Find disabled entries (pruneExpired already removes disabled
         // entries, but in case the user runs cleanup with entries that were
         // disabled between the prune call and now, check again)
-        const disabledKeys = await defaultTokenStore.listDisabled();
+        const allDisabledKeys = await defaultTokenStore.listDisabled();
+        // Only credentials the proxy itself gave up on are deletable. A disable that
+        // describes a condition outside the credential — an organization policy, or
+        // an operator taking the account out of rotation — leaves a perfectly good
+        // login that deleting would destroy for a condition someone else can revert.
+        const disabledKeys = [];
+        const retained = [];
+        for (const key of allDisabledKeys) {
+            const reason = (await defaultTokenStore.getDisabledReason(key)) ?? "";
+            if (!BROKEN_CREDENTIAL_DISABLE_REASONS.has(reason)) {
+                retained.push({ key, reason: reason || "unspecified" });
+            }
+            else {
+                disabledKeys.push(key);
+            }
+        }
+        if (retained.length > 0) {
+            logger.always(chalk.blue(`\nKeeping ${retained.length} recoverable disabled account(s):`));
+            for (const entry of retained) {
+                logger.always(`  - ${entry.key} (${entry.reason})`);
+            }
+            logger.always(chalk.gray("  Credentials are still valid. Use 'neurolink auth enable <account>' to restore, or 'auth remove' to delete."));
+        }
         if (disabledKeys.length > 0) {
             let shouldRemove = false;
             if (argv.force || argv.nonInteractive) {
@@ -862,8 +1088,9 @@ export async function handleCleanup(argv) {
             }
             if (shouldRemove) {
                 for (const key of disabledKeys) {
+                    const reason = (await defaultTokenStore.getDisabledReason(key)) ?? "unspecified";
                     await defaultTokenStore.clearTokens(key);
-                    removed.push({ key, reason: "disabled: refresh_failed" });
+                    removed.push({ key, reason: `disabled: ${reason}` });
                 }
             }
         }
@@ -917,6 +1144,115 @@ export async function handleEnable(argv) {
         process.exit(1);
     }
 }
+/**
+ * The proxy re-reads the token store on every request, so a disable takes
+ * effect on the next request with no restart.
+ *
+ * "refresh_failed" is refused deliberately: the proxy treats that exact reason
+ * as a legacy entry and re-enables it automatically, which would silently undo
+ * an operator's disable.
+ */
+const RESERVED_DISABLE_REASON = "refresh_failed";
+export async function handleDisable(argv) {
+    try {
+        const accountKey = argv.account || (argv._ && argv._[2] ? String(argv._[2]) : undefined);
+        if (!accountKey) {
+            logger.error(chalk.red("Missing required argument: <account>"));
+            logger.always(chalk.blue("\nUsage: neurolink auth disable <account>\n" +
+                "Run 'neurolink auth list' to see all accounts.\n"));
+            process.exit(1);
+        }
+        const allKeys = await defaultTokenStore.listProviders();
+        if (!allKeys.includes(accountKey)) {
+            logger.error(chalk.red(`Account not found: ${accountKey}`));
+            logger.always(chalk.blue("\nRun 'neurolink auth list' to see all authenticated accounts.\n"));
+            process.exit(1);
+        }
+        const reason = argv.reason?.trim() || "manual";
+        if (reason === RESERVED_DISABLE_REASON) {
+            logger.error(chalk.red(`Reason "${RESERVED_DISABLE_REASON}" is reserved — the proxy re-enables accounts carrying it. Choose another reason.`));
+            process.exit(1);
+        }
+        await defaultTokenStore.markDisabled(accountKey, reason);
+        logger.always(chalk.yellow(`\nDisabled account: ${accountKey} (${reason})`));
+        logger.always(chalk.gray(`Credentials are kept. Re-enable with: neurolink auth enable ${accountKey}\n`));
+    }
+    catch (error) {
+        logger.error(chalk.red("Failed to disable account:"));
+        logger.error(chalk.red(error instanceof Error ? error.message : "Unknown error"));
+        process.exit(1);
+    }
+}
+/** Compact "in 3h 12m" / "5m" rendering for a future timestamp. */
+function formatDuration(ms) {
+    const totalMinutes = Math.max(0, Math.round(ms / 60000));
+    const hours = Math.floor(totalMinutes / 60);
+    const minutes = totalMinutes % 60;
+    return hours > 0 ? `${hours}h ${minutes}m` : `${minutes}m`;
+}
+/**
+ * Inspect or clear the per-account rate-limit cooldowns the proxy persists.
+ *
+ * Without this there is no way to see why an account vanished from the pool, or
+ * to release one parked by a bad reset timestamp.
+ */
+export async function handleCooldown(argv) {
+    const { loadAccountCooldowns, clearAccountCooldown } = await import("../../lib/proxy/accountCooldown.js");
+    const action = String(argv.action ?? "list");
+    try {
+        if (action !== "list" && action !== "clear") {
+            logger.error(chalk.red(`Unknown action: ${action}. Use list|clear.`));
+            process.exit(1);
+        }
+        const cooldowns = await loadAccountCooldowns();
+        const now = Date.now();
+        if (action === "list") {
+            const active = Object.entries(cooldowns).filter(([, entry]) => entry.coolingUntil > now);
+            if (argv.format === "json") {
+                logger.always(JSON.stringify(active.map(([account, entry]) => ({ account, ...entry })), null, 2));
+                return;
+            }
+            if (active.length === 0) {
+                logger.always(chalk.green("\nNo accounts are cooling.\n"));
+                return;
+            }
+            logger.always(chalk.bold("\nCooling accounts:\n"));
+            for (const [account, entry] of active) {
+                logger.always(`  ${chalk.cyan(account.padEnd(32))} ${chalk.yellow(entry.reason.padEnd(10))} ${chalk.gray(`recovers in ${formatDuration(entry.coolingUntil - now)}`)}`);
+            }
+            logger.always("");
+            return;
+        }
+        const targets = argv.all
+            ? Object.keys(cooldowns)
+            : [argv.account || (argv._?.[3] ? String(argv._[3]) : "")].filter(Boolean);
+        if (targets.length === 0) {
+            logger.error(chalk.red("Specify an account key, or pass --all to clear every one."));
+            process.exit(1);
+        }
+        // Cooldowns are keyed by the full compound key, so a bare label silently
+        // matches nothing. Reporting success for it would send the operator away
+        // believing an account was released when it is still parked.
+        const unknown = targets.filter((target) => !(target in cooldowns));
+        if (unknown.length > 0) {
+            logger.error(chalk.red(`No cooldown found for: ${unknown.join(", ")}`));
+            logger.always(chalk.blue("\nRun 'neurolink auth cooldown list' to see the exact account keys.\n"));
+            process.exit(1);
+        }
+        for (const target of targets) {
+            await clearAccountCooldown(target);
+        }
+        logger.always(chalk.green(`\nCleared ${targets.length} cooldown(s).`));
+        // The running worker keeps its own copy of the cooldown map, loaded once at
+        // startup, so a file-level clear alone would not release the account.
+        logger.always(chalk.gray("Restart the proxy for a running instance to pick this up: neurolink proxy start\n"));
+    }
+    catch (error) {
+        logger.error(chalk.red("Failed to read or clear cooldowns:"));
+        logger.error(chalk.red(error instanceof Error ? error.message : "Unknown error"));
+        process.exit(1);
+    }
+}
 // =============================================================================
 // PRIMARY ACCOUNT (proxy routing.primaryAccount in YAML)
 // =============================================================================
@@ -1118,6 +1454,72 @@ export async function handleSetPrimary(argv) {
         process.exit(1);
     }
 }
+/**
+ * Handle the overage subcommand
+ * `neurolink auth overage <status|auto|always|never> [--config <path>]`
+ *
+ * Controls whether the pool may keep serving on paid extra usage once an
+ * account's subscription window is spent. Only `never` overrides the provider:
+ * nothing here can switch on extra usage that Anthropic reports as disabled.
+ */
+export async function handleOverage(argv) {
+    const action = String(argv.action ?? (argv._ && argv._[2] ? String(argv._[2]) : "status"));
+    const filePath = argv.config ?? DEFAULT_PROXY_CONFIG_PATH;
+    try {
+        const doc = await readProxyConfigFile(filePath);
+        const routing = getRoutingObject(doc.data);
+        const current = (typeof routing["use-overage"] === "string"
+            ? routing["use-overage"]
+            : typeof routing.useOverage === "string"
+                ? routing.useOverage
+                : undefined) ?? "auto";
+        if (action === "status") {
+            logger.always(chalk.bold(`\nExtra-usage policy: ${chalk.cyan(current)}`));
+            logger.always(chalk.gray("  auto   — follow whatever Anthropic reports per account (default)\n" +
+                "  always — keep serving whenever the provider permits extra usage\n" +
+                "  never  — stop at the subscription limit, never spend credits"));
+            // The provider's own signal is what actually decides, so show it too —
+            // a policy of "always" is inert when the organization has it switched off.
+            const quotas = await loadAccountQuotas();
+            const rows = Object.entries(quotas).filter(([account, quota]) => 
+            // Anthropic only: Codex has no extra-usage concept and stores a
+            // neutral "rejected", which would read here as a real restriction.
+            !account.startsWith("codex:") &&
+                (quota.overageStatus || quota.overageDisabledReason));
+            if (rows.length > 0) {
+                logger.always(chalk.bold("\nProvider extra-usage state:"));
+                for (const [account, quota] of rows) {
+                    const enabled = quota.overageEnabled === true ||
+                        quota.overageStatus?.trim().toLowerCase() === "allowed";
+                    const detail = quota.overageDisabledReason
+                        ? chalk.gray(` (${quota.overageDisabledReason})`)
+                        : "";
+                    logger.always(`  ${chalk.cyan(account.padEnd(32))} ${enabled ? chalk.green("available") : chalk.yellow("unavailable")}${detail}`);
+                }
+            }
+            logger.always("");
+            return;
+        }
+        if (action !== "auto" && action !== "always" && action !== "never") {
+            logger.error(chalk.red(`Unknown action: ${action}. Use status|auto|always|never.`));
+            process.exit(1);
+        }
+        if (doc.hadComments) {
+            logger.always(chalk.yellow(`⚠ Note: existing YAML comments in ${filePath} will not be preserved.`));
+        }
+        delete routing.useOverage;
+        routing["use-overage"] = action;
+        await writeProxyConfigFile(filePath, doc);
+        logger.always(chalk.green(`✓ Extra-usage policy → ${action}`));
+        logger.always(chalk.green(`✓ Saved to ${filePath}`));
+        reportRunningProxyConfigUpdate(filePath);
+    }
+    catch (err) {
+        logger.error(chalk.red("Failed to read or update extra-usage policy:"));
+        logger.error(chalk.red(err instanceof Error ? err.message : "Unknown error"));
+        process.exit(1);
+    }
+}
 /**
  * Handle the get-primary subcommand
  * `neurolink auth get-primary [--config <path>]`
@@ -1863,6 +2265,23 @@ async function getAuthStatus(provider) {
         isAuthenticated: false,
         method: "none",
     };
+    // Codex never writes a credentials file — its accounts exist only as pooled
+    // `codex:<label>` token-store entries, so checking the file alone reports a
+    // fully authenticated pool as "Not Authenticated".
+    if (provider === "codex") {
+        const keys = await defaultTokenStore.listByPrefix("codex:");
+        if (keys.length > 0) {
+            result.isAuthenticated = true;
+            result.method = "oauth";
+            const tokens = await defaultTokenStore.peekTokens(keys[0]);
+            result.hasRefreshToken = !!tokens?.refreshToken;
+            if (tokens?.expiresAt) {
+                result.tokenExpiry = new Date(tokens.expiresAt).toLocaleString();
+                result.needsRefresh = Date.now() >= tokens.expiresAt;
+            }
+        }
+        return result;
+    }
     // Check stored credentials FIRST (OAuth takes priority over API key)
     const stored = await getStoredCredentials(provider);
     if (stored) {