@juspay/neurolink 12.7.2 → 12.7.4

package/dist/server/routes/codexProxyRoutes.d.ts

@@ -17,7 +17,12 @@
  * never collides with anthropic entries) and does pre-commit rotation only, not
  * the full transient-budget / admission machinery.
  */
-import type { AccountCoolingReason, AccountQuota, CodexRuntimeAccount, RouteGroup } from "../../types/index.js";
+import type { AccountQuota, CodexRefreshTokenStore, CodexRuntimeAccount, CodexTokenRefresher, RateLimitCoolingReason, RouteGroup, ServerContext } from "../../types/index.js";
+declare function refreshCodexTokenOnceWithDependencies(key: string, refreshToken: string, store: CodexRefreshTokenStore, refresh: CodexTokenRefresher): Promise<{
+    accessToken: string;
+    refreshToken: string;
+    expiresAt?: number;
+}>;
 /** Refresh an account's token at most once at a time. */
 declare function refreshCodexTokenOnce(key: string, refreshToken: string): Promise<{
     accessToken: string;
@@ -44,8 +49,10 @@ declare function buildCodexUpstreamHeaders(clientHeaders: Record<string, string>
  */
 declare function planCodexCooldown(quota: AccountQuota | null, retryAfterMs: number, now: number): {
     coolingUntil: number;
-    reason: AccountCoolingReason;
+    reason: RateLimitCoolingReason;
 };
+/** Core pooled handler for POST /backend-api/codex/responses. */
+export declare function handleCodexResponsesRequest(ctx: ServerContext): Promise<Response>;
 /**
  * Create Codex proxy routes.
  *
@@ -59,6 +66,7 @@ export declare const __testHooks: {
     buildCodexUpstreamHeaders: typeof buildCodexUpstreamHeaders;
     planCodexCooldown: typeof planCodexCooldown;
     refreshCodexTokenOnce: typeof refreshCodexTokenOnce;
+    refreshCodexTokenOnceWithDependencies: typeof refreshCodexTokenOnceWithDependencies;
     codexRefreshInFlightSize: () => number;
 };
 export {};

package/dist/server/routes/codexProxyRoutes.js

@@ -24,8 +24,10 @@ import { loadAccountQuotas, saveAccountQuota, } from "../../proxy/accountQuota.j
 import { createCodexUsageTap } from "../../proxy/codexUsage.js";
 import { CODEX_ACCOUNT_PREFIX, parseCodexRateLimitHeaders, } from "../../proxy/codexAccountUsage.js";
 import { buildClientAttribution } from "../../proxy/clientAttribution.js";
-import { logRequest } from "../../proxy/requestLogger.js";
+import { trackProxyResponse } from "../../proxy/proxyActivity.js";
+import { logRequest, logRequestAttempt } from "../../proxy/requestLogger.js";
 import { parseRetryAfterMs } from "../../proxy/routingPolicy.js";
+import { recordAttempt, recordAttemptError, recordFinalError, recordFinalSuccess, } from "../../proxy/usageStats.js";
 import { sanitizeForLog } from "../../utils/logSanitize.js";
 import { logger } from "../../utils/logger.js";
 const CODEX_UPSTREAM_TIMEOUT_MS = 15 * 60 * 1000; // 15 min, matches Claude path
@@ -33,6 +35,32 @@ const DEFAULT_TRANSIENT_COOLDOWN_MS = 60_000;
 const MAX_TRANSIENT_COOLDOWN_MS = 15 * 60 * 1000;
 /** Brief park after a refresh attempt that never reached a verdict. */
 const CODEX_AUTH_COOLDOWN_MS = 60_000;
+const CODEX_ACCOUNT_TYPE = "codex-oauth";
+const CODEX_FALLBACK_METADATA_KEY = "neurolink.codexFallback";
+function getCodexTransportErrorCode(error) {
+    if (!error || typeof error !== "object") {
+        return undefined;
+    }
+    const directCode = error.code;
+    if (typeof directCode === "string") {
+        return directCode;
+    }
+    const cause = error.cause;
+    if (!cause || typeof cause !== "object") {
+        return undefined;
+    }
+    const causeCode = cause.code;
+    return typeof causeCode === "string" ? causeCode : undefined;
+}
+function codexTransportScope(error) {
+    const code = getCodexTransportErrorCode(error);
+    return code === "ENOTFOUND" || code === "EAI_AGAIN"
+        ? "shared_provider_transport"
+        : "connection_transport";
+}
+function summarizeCodexUpstreamError(errorText, fallback) {
+    return sanitizeForLog(errorText).slice(0, 200) || fallback;
+}
 /**
  * In-flight proactive refreshes, keyed by account.
  *
@@ -43,8 +71,7 @@ const CODEX_AUTH_COOLDOWN_MS = 60_000;
  * that is perfectly healthy.
  */
 const codexRefreshInFlight = new Map();
-/** Refresh an account's token at most once at a time. */
-async function refreshCodexTokenOnce(key, refreshToken) {
+async function refreshCodexTokenOnceWithDependencies(key, refreshToken, store, refresh) {
     const existing = codexRefreshInFlight.get(key);
     if (existing) {
         return existing;
@@ -54,20 +81,36 @@ async function refreshCodexTokenOnce(key, refreshToken) {
         // request that captured the pool just before a previous refresh completed
         // holds a token that has since been rotated; using it would spend a real
         // attempt on a grant the server has already invalidated.
-        const latest = await tokenStore.peekTokens(key).catch(() => null);
+        const latest = await store.peekTokens(key).catch(() => null);
         const current = latest?.refreshToken ?? refreshToken;
-        const refreshed = await refreshCodexToken(current);
-        return {
+        const refreshed = await refresh(current);
+        const resolved = {
             accessToken: refreshed.accessToken,
             refreshToken: refreshed.refreshToken ?? current,
-            expiresAt: refreshed.expiresAt,
+            expiresAt: refreshed.expiresAt ?? latest?.expiresAt ?? Date.now() + 3_600_000,
         };
+        // Hold the single-flight slot through persistence. Releasing it after the
+        // OAuth response but before this write lets a third request read the old
+        // rotating refresh token, receive an invalid_grant, and disable an account
+        // another request has already healed.
+        if (latest) {
+            await store.saveTokens(key, {
+                ...resolved,
+                tokenType: "Bearer",
+                ...(latest.scope ? { scope: latest.scope } : {}),
+            });
+        }
+        return resolved;
     })().finally(() => {
         codexRefreshInFlight.delete(key);
     });
     codexRefreshInFlight.set(key, pending);
     return pending;
 }
+/** Refresh an account's token at most once at a time. */
+async function refreshCodexTokenOnce(key, refreshToken) {
+    return refreshCodexTokenOnceWithDependencies(key, refreshToken, tokenStore, refreshCodexToken);
+}
 // Headers we never forward upstream (hop-by-hop, client creds, or things we
 // re-derive). The client's own auth is replaced with the pooled account's.
 const BLOCKED_UPSTREAM_HEADERS = new Set([
@@ -114,13 +157,6 @@ async function loadCodexProxyAccounts() {
                 const refreshed = await refreshCodexTokenOnce(key, tokens.refreshToken);
                 accessToken = refreshed.accessToken;
                 expiresAt = refreshed.expiresAt ?? expiresAt;
-                await tokenStore.saveTokens(key, {
-                    accessToken,
-                    refreshToken: refreshed.refreshToken,
-                    expiresAt: expiresAt ?? Date.now() + 3_600_000,
-                    tokenType: "Bearer",
-                    scope: tokens.scope,
-                });
             }
             catch (error) {
                 // Keep the stale token; a 401 upstream will trigger rotation.
@@ -234,14 +270,18 @@ function publishCodexHeaders(ctx, account, attempt, quota) {
     }
 }
 /** Core pooled handler for POST /backend-api/codex/responses. */
-async function handleCodexResponsesRequest(ctx) {
+export async function handleCodexResponsesRequest(ctx) {
     const requestStartTime = Date.now();
     const body = ctx.body ?? {};
     const bodyStr = JSON.stringify(body);
     const model = typeof body.model === "string"
         ? body.model
         : "-";
-    const writeLog = (account, responseStatus, extra = {}) => logRequest({
+    // A Codex call made as an inner Anthropic fallback is an upstream attempt,
+    // not an independently final client request. The parent fallback owns the
+    // final status and can still recover with a later provider.
+    const isFallbackRequest = ctx.metadata?.[CODEX_FALLBACK_METADATA_KEY] === true;
+    const writeFinalLog = (account, responseStatus, extra = {}) => logRequest({
         timestamp: new Date().toISOString(),
         requestId: ctx.requestId,
         method: ctx.method,
@@ -251,16 +291,63 @@ async function handleCodexResponsesRequest(ctx) {
         toolCount: Array.isArray(body.tools)
             ? body.tools.length
             : 0,
-        account,
-        accountType: "codex-oauth",
+        account: account?.label ?? "",
+        ...(account ? { accountKey: account.key } : {}),
+        accountType: account ? CODEX_ACCOUNT_TYPE : "",
+        // This is the cost provider. accountKey and the response header identify
+        // the actual Codex pool that supplied the credential.
+        provider: "openai",
         ...buildClientAttribution(ctx.headers),
         responseStatus,
         responseTimeMs: Date.now() - requestStartTime,
         ...extra,
     });
+    let finalOutcomeRecorded = false;
+    const recordFinalOutcome = async (account, responseStatus, extra = {}) => {
+        if (isFallbackRequest || finalOutcomeRecorded) {
+            return;
+        }
+        finalOutcomeRecorded = true;
+        if (responseStatus >= 400) {
+            recordFinalError(responseStatus, account?.label, account ? CODEX_ACCOUNT_TYPE : undefined, {
+                requestId: ctx.requestId,
+                ...(account ? { accountKey: account.key } : {}),
+                errorType: extra.errorType,
+                terminalOutcome: extra.terminalOutcome ?? "handler_error",
+                message: extra.errorMessage,
+                errorCode: extra.errorCode,
+            });
+        }
+        else {
+            recordFinalSuccess(account?.label, account ? CODEX_ACCOUNT_TYPE : undefined);
+        }
+        await writeFinalLog(account, responseStatus, extra);
+    };
+    const writeAttempt = (account, attempt, startedAt, responseStatus, extra = {}) => {
+        void logRequestAttempt({
+            timestamp: new Date().toISOString(),
+            requestId: ctx.requestId,
+            attempt,
+            method: ctx.method,
+            path: ctx.path,
+            model,
+            stream: true,
+            toolCount: Array.isArray(body.tools)
+                ? body.tools.length
+                : 0,
+            account: account.label,
+            accountKey: account.key,
+            accountType: CODEX_ACCOUNT_TYPE,
+            provider: "openai",
+            responseStatus,
+            responseTimeMs: Date.now() - requestStartTime,
+            attemptDurationMs: Date.now() - startedAt,
+            ...extra,
+        }).catch(() => undefined);
+    };
     const accounts = await loadCodexProxyAccounts();
     if (accounts.length === 0) {
-        await writeLog("", 401, {
+        await recordFinalOutcome(undefined, 401, {
             errorType: "no_accounts",
             errorMessage: "No Codex accounts",
         });
@@ -280,7 +367,7 @@ async function handleCodexResponsesRequest(ctx) {
         const retryAfterSec = soonest
             ? Math.max(1, Math.ceil((soonest - now) / 1000))
             : 60;
-        await writeLog("", 429, {
+        await recordFinalOutcome(undefined, 429, {
             errorType: "all_accounts_cooling",
             errorMessage: "All Codex accounts are rate-limited",
         });
@@ -300,11 +387,15 @@ async function handleCodexResponsesRequest(ctx) {
     let attempt = 0;
     let lastErrorMessage = "All Codex accounts failed";
     let lastErrorStatus = 502;
+    let lastAttemptedAccount;
     for (const account of eligible) {
-        attempt += 1;
         let authRetried = false;
         // Same-account loop only re-runs once, for a post-401 token refresh.
         for (;;) {
+            attempt += 1;
+            const attemptStartedAt = Date.now();
+            lastAttemptedAccount = account;
+            recordAttempt(account.label, CODEX_ACCOUNT_TYPE);
             let upstream;
             try {
                 upstream = await fetch(CODEX_RESPONSES_URL, {
@@ -320,6 +411,17 @@ async function handleCodexResponsesRequest(ctx) {
                 // can act on. Keep the detail in the log and return a fixed string, so
                 // internal topology never reaches the client.
                 logger.debug(`Codex upstream fetch failed (${account.label}): ${sanitizeForLog(error instanceof Error ? error.message : String(error))}`);
+                const errorMessage = summarizeCodexUpstreamError(error instanceof Error ? error.message : String(error), "Codex upstream request failed");
+                const errorCode = getCodexTransportErrorCode(error);
+                const transportScope = codexTransportScope(error);
+                recordAttemptError(account.label, CODEX_ACCOUNT_TYPE, 502);
+                writeAttempt(account, attempt, attemptStartedAt, 502, {
+                    errorType: "network_error",
+                    errorMessage,
+                    ...(errorCode ? { errorCode } : {}),
+                    transportScope,
+                    retryable: true,
+                });
                 lastErrorMessage = "Codex upstream request failed";
                 lastErrorStatus = 502;
                 break; // rotate to next account
@@ -336,50 +438,72 @@ async function handleCodexResponsesRequest(ctx) {
                     clearAccountCooldown(account.key, account.expiredCooldownUntil).catch(() => undefined);
                 }
                 publishCodexHeaders(ctx, account, attempt, quota);
-                await writeLog(account.label, upstream.status);
+                writeAttempt(account, attempt, attemptStartedAt, upstream.status);
                 const headers = {
                     "content-type": upstream.headers.get("content-type") ?? "text/event-stream",
                     "cache-control": "no-cache",
                     connection: "keep-alive",
                     ...(ctx.responseHeaders ?? {}),
                 };
-                // Tap the relay for token usage. The log above is written first and
-                // unconditionally so a request is never lost when a client hangs up
-                // mid-stream; this emits a second record for the same requestId
-                // carrying the counts, which proxyAnalysis merges. If the stream shape
-                // is not recognised, usage resolves null and nothing extra is written —
-                // i.e. exactly the previous behaviour.
                 if (!upstream.body) {
+                    await recordFinalOutcome(account, upstream.status, {
+                        terminalOutcome: "bodyless",
+                    });
                     return new Response(upstream.body, {
                         status: upstream.status,
                         headers,
                     });
                 }
                 const { stream: usageTap, usage: usageSeen } = createCodexUsageTap();
-                usageSeen
-                    .then((usage) => {
-                    if (!usage) {
-                        return;
-                    }
-                    return writeLog(account.label, upstream.status, {
-                        provider: "openai",
-                        inputTokens: usage.inputTokens,
-                        outputTokens: usage.outputTokens,
-                        cacheReadTokens: usage.cacheReadTokens,
-                        cacheCreationTokens: usage.cacheCreationTokens,
-                    });
-                })
-                    .catch(() => undefined);
-                return new Response(upstream.body.pipeThrough(usageTap), {
+                const relay = new Response(upstream.body.pipeThrough(usageTap), {
                     status: upstream.status,
                     headers,
                 });
+                return trackProxyResponse(relay, () => undefined, {
+                    onTerminal: ({ outcome }) => {
+                        void usageSeen
+                            .then((usage) => {
+                            const usageExtra = usage
+                                ? {
+                                    inputTokens: usage.inputTokens,
+                                    outputTokens: usage.outputTokens,
+                                    cacheReadTokens: usage.cacheReadTokens,
+                                    cacheCreationTokens: usage.cacheCreationTokens,
+                                }
+                                : {};
+                            if (outcome === "completed" || outcome === "bodyless") {
+                                return recordFinalOutcome(account, upstream.status, {
+                                    terminalOutcome: outcome,
+                                    ...usageExtra,
+                                });
+                            }
+                            return recordFinalOutcome(account, outcome === "client_cancelled" ? 499 : 502, {
+                                errorType: outcome === "client_cancelled"
+                                    ? "client_cancelled"
+                                    : "stream_error",
+                                errorMessage: outcome === "client_cancelled"
+                                    ? "Client cancelled Codex stream"
+                                    : "Codex upstream stream failed",
+                                terminalOutcome: outcome,
+                                ...usageExtra,
+                            });
+                        })
+                            .catch(() => undefined);
+                    },
+                });
             }
             const errText = await upstream.text().catch(() => "");
             // 401/403 → try a forced token refresh once, then rotate.
             if ((upstream.status === 401 || upstream.status === 403) &&
                 !authRetried &&
                 account.refreshToken) {
+                const errorMessage = summarizeCodexUpstreamError(errText, "Codex authentication rejected upstream");
+                recordAttemptError(account.label, CODEX_ACCOUNT_TYPE, upstream.status);
+                writeAttempt(account, attempt, attemptStartedAt, upstream.status, {
+                    errorType: "authentication_error",
+                    errorMessage,
+                    retryable: true,
+                });
                 authRetried = true;
                 const staleTokens = {
                     accessToken: account.token,
@@ -387,17 +511,11 @@ async function handleCodexResponsesRequest(ctx) {
                     expiresAt: account.expiresAt ?? 0,
                 };
                 try {
-                    const refreshed = await refreshCodexToken(account.refreshToken);
+                    const refreshed = await refreshCodexTokenOnce(account.key, account.refreshToken);
                     account.token = refreshed.accessToken;
                     account.refreshToken = refreshed.refreshToken ?? account.refreshToken;
                     account.expiresAt = refreshed.expiresAt ?? account.expiresAt;
                     account.accountId = resolveCodexAccountId(refreshed.accessToken);
-                    await tokenStore.saveTokens(account.key, {
-                        accessToken: account.token,
-                        refreshToken: account.refreshToken,
-                        expiresAt: account.expiresAt ?? Date.now() + 3_600_000,
-                        tokenType: "Bearer",
-                    });
                     continue; // retry same account with the fresh token
                 }
                 catch (error) {
@@ -432,6 +550,16 @@ async function handleCodexResponsesRequest(ctx) {
                 const retryAfterMs = parseRetryAfterMs(upstream.headers.get("retry-after"));
                 const plan = planCodexCooldown(quota, retryAfterMs, Date.now());
                 await saveAccountCooldown(account.key, plan.coolingUntil, plan.reason).catch(() => undefined);
+                const rateLimitKind = plan.reason === "transient" ? "transient" : "quota";
+                const errorMessage = summarizeCodexUpstreamError(errText, "Codex account rate-limited");
+                recordAttemptError(account.label, CODEX_ACCOUNT_TYPE, upstream.status, rateLimitKind);
+                writeAttempt(account, attempt, attemptStartedAt, upstream.status, {
+                    errorType: "rate_limit_error",
+                    errorMessage,
+                    retryable: true,
+                    rateLimitKind,
+                    cooldownReason: plan.reason,
+                });
                 lastErrorStatus = 429;
                 lastErrorMessage = "Codex account rate-limited";
                 break; // rotate
@@ -443,12 +571,22 @@ async function handleCodexResponsesRequest(ctx) {
                 // of letting it stay first in line with unknown quota.
                 await saveAccountCooldown(account.key, Date.now() + CODEX_AUTH_COOLDOWN_MS, "auth").catch(() => undefined);
             }
+            const errorMessage = summarizeCodexUpstreamError(errText, "Codex error");
+            const errorType = upstream.status === 401 || upstream.status === 403
+                ? "authentication_error"
+                : "api_error";
+            recordAttemptError(account.label, CODEX_ACCOUNT_TYPE, upstream.status);
+            writeAttempt(account, attempt, attemptStartedAt, upstream.status, {
+                errorType,
+                errorMessage,
+                retryable: upstream.status >= 500,
+            });
             lastErrorStatus = upstream.status >= 500 ? 502 : upstream.status;
-            lastErrorMessage = sanitizeForLog(errText).slice(0, 200) || "Codex error";
+            lastErrorMessage = errorMessage;
             break; // rotate
         }
     }
-    await writeLog("", lastErrorStatus, {
+    await recordFinalOutcome(lastAttemptedAccount, lastErrorStatus, {
         errorType: "all_accounts_failed",
         errorMessage: lastErrorMessage,
     });
@@ -529,18 +667,12 @@ async function handleCodexModelsRequest(ctx) {
                 if (!authRetried && account.refreshToken) {
                     authRetried = true;
                     try {
-                        const refreshed = await refreshCodexToken(account.refreshToken);
+                        const refreshed = await refreshCodexTokenOnce(account.key, account.refreshToken);
                         account.token = refreshed.accessToken;
                         account.refreshToken =
                             refreshed.refreshToken ?? account.refreshToken;
                         account.expiresAt = refreshed.expiresAt ?? account.expiresAt;
                         account.accountId = resolveCodexAccountId(refreshed.accessToken);
-                        await tokenStore.saveTokens(account.key, {
-                            accessToken: account.token,
-                            refreshToken: account.refreshToken,
-                            expiresAt: account.expiresAt ?? Date.now() + 3_600_000,
-                            tokenType: "Bearer",
-                        });
                         continue; // retry this account with the fresh token
                     }
                     catch {
@@ -605,5 +737,6 @@ export const __testHooks = {
     buildCodexUpstreamHeaders,
     planCodexCooldown,
     refreshCodexTokenOnce,
+    refreshCodexTokenOnceWithDependencies,
     codexRefreshInFlightSize: () => codexRefreshInFlight.size,
 };

package/dist/types/claudeProxy.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Shared internal types for the Anthropic-compatible proxy route.
+ */
+/** A deterministic upstream validation failure that must reach the caller. */
+export type AnthropicInvalidRequestFailure = {
+    status: number;
+    body: string;
+    contentType?: string;
+};
+/** A credential failure deferred until peer and provider fallbacks are tried. */
+export type DeferredClaudeAccountFailure = {
+    status: number;
+    message: string;
+    errorType: string;
+    responseHeaders?: Record<string, string>;
+};

package/dist/types/claudeProxy.js

@@ -0,0 +1,4 @@
+/**
+ * Shared internal types for the Anthropic-compatible proxy route.
+ */
+export {};

package/dist/types/cli.d.ts

@@ -11,7 +11,7 @@ import type { PPTGenerationResult } from "./ppt.js";
 import type { AvatarResult } from "./avatar.js";
 import type { MusicResult } from "./music.js";
 import type { OAuthTokens } from "./auth.js";
-import type { AccountQuota } from "./proxy.js";
+import type { AccountQuota, ProxyPassthroughAccount } from "./proxy.js";
 import type { ClaudeSubscriptionTier } from "./subscription.js";
 import type { ServerFramework } from "./server.js";
 import type { AuthProviderType } from "./auth.js";
@@ -954,7 +954,7 @@ export type AuthCommandArgs = BaseCommandArgs & {
     label?: string;
     account?: string;
     force?: boolean;
-    /** `auth list --refresh`: fetch fresh limits from Anthropic before listing */
+    /** `auth list --refresh`: fetch fresh provider limits before listing */
     refresh?: boolean;
     /** Path to the proxy config YAML, used by set-/get-/clear-primary */
     config?: string;
@@ -969,12 +969,44 @@ export type AuthCommandArgs = BaseCommandArgs & {
     /** Yargs positional arguments */
     _?: (string | number)[];
 };
+/** Refresh state for a provider-qualified account. */
+export type AuthListRefreshStatus = "refreshed" | "snapshot" | "unavailable" | "not_supported";
+/** Fresh-limit result for one provider-qualified account. */
+export type AuthListRefreshAccountResult = {
+    /** Provider prefix parsed from the configured account key. */
+    provider: string;
+    /** A missing limit is explicit rather than being rendered as an unexplained dash. */
+    status: AuthListRefreshStatus;
+    error?: string;
+};
+/** One direct quota-adapter result used by `auth list --refresh`. */
+export type AuthListDirectQuotaRefreshResult = {
+    status: "refreshed";
+    quota: AccountQuota;
+} | {
+    status: "unavailable" | "not_supported";
+    error?: string;
+};
+/** Provider-specific quota capability used by the generic auth-list refresh. */
+export type AuthListQuotaRefreshAdapter = {
+    /** A successful local proxy `/limits` response is authoritative for this provider. */
+    supportsProxyRefresh?: boolean;
+    listAccounts: () => Promise<ProxyPassthroughAccount[]>;
+    priorQuotaKeys: (account: ProxyPassthroughAccount) => readonly string[];
+    refreshAccount: (account: ProxyPassthroughAccount, options: {
+        prior: AccountQuota | null;
+    }) => Promise<AuthListDirectQuotaRefreshResult>;
+};
+/** Applies one account's explicit auth-list refresh state. */
+export type AuthListRefreshResultSetter = (key: string, status: AuthListRefreshStatus, error?: string) => void;
 /** Outcome of the `auth list --refresh` fresh-limit fetch. */
 export type AuthListRefreshOutcome = {
     /** How the fresh limits were obtained ("none" when every path failed). */
-    via: "proxy" | "direct" | "none";
-    /** Freshly fetched quotas keyed by account label; null when none fetched. */
+    via: "proxy" | "direct" | "mixed" | "none";
+    /** Freshly fetched quotas keyed by provider-qualified account key. */
     quotas: Record<string, AccountQuota> | null;
+    /** Per-account refresh status, also keyed by provider-qualified account key. */
+    accounts: Record<string, AuthListRefreshAccountResult>;
     /** Per-account and transport errors, already formatted for display. */
     errors: string[];
 };
@@ -1220,7 +1252,7 @@ export type ProviderSetupConfig = {
     endpoint?: string;
     isReconfiguring?: boolean;
 };
-/** Providers supported by the `neurolink auth` command. */
+/** Providers with first-class credential flows implemented by `neurolink auth`. */
 export type SupportedProvider = "anthropic" | "codex";
 /** Arguments for `neurolink autoresearch init`. */
 export type AutoresearchInitArgs = {

package/dist/types/codex.d.ts

@@ -11,7 +11,7 @@
  * stored through the same AccountQuota shape as Anthropic — its primary window
  * maps onto the session fields and its secondary window onto the weekly fields.
  */
-import type { AccountCoolingReason, AccountQuota } from "./proxy.js";
+import type { AccountCoolingReason, AccountQuota, InternalResult } from "./proxy.js";
 /** Token block inside `~/.codex/auth.json`. */
 export type CodexAuthFileTokens = {
     id_token?: string;
@@ -93,3 +93,64 @@ export type CodexRuntimeAccount = {
      *  spent record — nothing else ever reaps it. */
     expiredCooldownUntil?: number;
 };
+/** Provider-qualified account identity used by proxy status rendering. */
+export type CodexProxyStatusAccountIdentity = {
+    provider: "anthropic";
+    key: string;
+} | {
+    provider: "codex";
+    key: string;
+} | {
+    provider: "other";
+    key: null;
+};
+/** A text or image content part accepted by the Codex Responses backend. */
+export type CodexContentPart = {
+    type: "input_text";
+    text: string;
+} | {
+    type: "output_text";
+    text: string;
+} | {
+    type: "input_image";
+    image_url: string;
+};
+/** A single item in a Codex Responses request. */
+export type CodexResponsesInputItem = {
+    role: "user" | "assistant";
+    content: CodexContentPart[];
+} | {
+    type: "function_call";
+    call_id: string;
+    name: string;
+    arguments: string;
+} | {
+    type: "function_call_output";
+    call_id: string;
+    output: string;
+};
+/** Request shape used to bridge Anthropic Messages traffic to Codex Responses. */
+export type CodexResponsesRequest = {
+    model: string;
+    input: CodexResponsesInputItem[];
+    stream: true;
+    store: false;
+    instructions?: string;
+    tools?: Array<{
+        type: "function";
+        name: string;
+        description?: string;
+        parameters: Record<string, unknown>;
+    }>;
+    tool_choice?: "auto" | "required" | "none" | {
+        type: "function";
+        name: string;
+    };
+};
+/** Fully buffered Codex result rendered back as an Anthropic response. */
+export type CodexFallbackResult = {
+    text: string;
+    toolCalls: NonNullable<InternalResult["toolCalls"]>;
+    usage?: NonNullable<InternalResult["usage"]>;
+    finishReason: "end_turn" | "tool_use";
+};

package/dist/types/index.d.ts

@@ -10,6 +10,7 @@ export * from "./artifact.js";
 export * from "./auth.js";
 export * from "./autoresearch.js";
 export * from "./circuitBreakerErrors.js";
+export * from "./claudeProxy.js";
 export * from "./cli.js";
 export * from "./client.js";
 export * from "./codex.js";

package/dist/types/index.js

@@ -11,6 +11,7 @@ export * from "./artifact.js";
 export * from "./auth.js";
 export * from "./autoresearch.js";
 export * from "./circuitBreakerErrors.js";
+export * from "./claudeProxy.js";
 export * from "./cli.js";
 export * from "./client.js";
 export * from "./codex.js";