@juspay/neurolink 12.7.3 → 12.7.4

package/dist/server/routes/claudeProxyRoutes.js

@@ -15,7 +15,7 @@ import { join } from "node:path";
 import { Agent } from "undici";
 import { buildStableClaudeCodeBillingHeader, CLAUDE_CLI_USER_AGENT, CLAUDE_CODE_OAUTH_BETAS, getOrCreateClaudeCodeIdentity, parseClaudeCodeUserId, } from "../../auth/anthropicOAuth.js";
 import { clearAccountCooldown, loadAccountCooldowns, saveAccountCooldown, } from "../../proxy/accountCooldown.js";
-import { anthropicAccountKeysEqual, ENV_ANTHROPIC_ACCOUNT_KEY, isAccountAllowed, LEGACY_ANTHROPIC_ACCOUNT_KEY, shouldLoadFallbackCredential, } from "../../proxy/accountSelection.js";
+import { anthropicAccountKeysEqual, ENV_ANTHROPIC_ACCOUNT_KEY, isAccountAllowed, LEGACY_ANTHROPIC_ACCOUNT_KEY, normalizeAnthropicAccountKey, shouldLoadFallbackCredential, } from "../../proxy/accountSelection.js";
 import { getUnifiedRateLimitStatus, isQuotaOverageAvailable, loadAccountQuotas, mergeQuotaSnapshot, modelFamilyToken, parseQuotaHeaders, saveAccountQuota, } from "../../proxy/accountQuota.js";
 import { fetchAccountUsage, listAnthropicAccountsForUsage, usageToQuota, } from "../../proxy/accountUsage.js";
 import { AccountQuotaRefreshCoordinator } from "../../proxy/accountQuotaRefreshCoordinator.js";
@@ -72,6 +72,30 @@ const BLOCKED_UPSTREAM_HEADERS = new Set([
 ]);
 const PROXY_INTERNAL_ACCOUNT_LABEL = "proxy/internal";
 const PROXY_INTERNAL_ACCOUNT_TYPE = "internal";
+function resolveRequestLogAccountIdentity(accountLabel, accountType) {
+    if (!accountLabel) {
+        return {};
+    }
+    if (accountType === "codex-oauth") {
+        return {
+            accountKey: accountLabel.startsWith("codex:")
+                ? accountLabel
+                : `codex:${accountLabel}`,
+            provider: "openai",
+        };
+    }
+    if (accountType === "oauth" ||
+        accountType === "api_key" ||
+        accountType === "passthrough") {
+        return {
+            accountKey: accountType === "passthrough"
+                ? accountLabel
+                : normalizeAnthropicAccountKey(accountLabel),
+            provider: "anthropic",
+        };
+    }
+    return {};
+}
 // ---------------------------------------------------------------------------
 // Module-level state
 // ---------------------------------------------------------------------------
@@ -634,7 +658,8 @@ function reconcileCooldownFromQuota(state, quota, now, policy = overagePolicy) {
 }
 /**
  * Seed each account's runtime quota from the persisted snapshots in
- * ~/.neurolink/account-quotas.json (keyed by label). Runtime state is
+ * ~/.neurolink/account-quotas.json (keyed by provider-qualified account key).
+ * Runtime state is
  * in-memory only, so without this the quota-aware ordering is blind after a
  * proxy restart: all accounts tie, selection falls back to token-store
  * enumeration order, and the first account served becomes self-reinforcing
@@ -652,8 +677,13 @@ async function seedRuntimeQuotasFromDisk(accounts) {
         const now = Date.now();
         for (const account of accounts) {
             const state = getOrCreateRuntimeState(account.key);
-            if (!state.quota && persistedQuotas[account.label]) {
-                state.quota = persistedQuotas[account.label];
+            if (!state.quota) {
+                // Before provider identity was introduced, Anthropic snapshots were
+                // written under the bare display label. Keep that reading as an
+                // upgrade bridge, but never write new data back under the ambiguous
+                // key: a Codex login can legitimately use the same email.
+                state.quota =
+                    persistedQuotas[account.key] ?? persistedQuotas[account.label];
             }
             const persistedCooldown = persistedCooldowns[account.key];
             if (persistedCooldown?.coolingUntil > now &&
@@ -708,7 +738,7 @@ async function applyAccountUsageResult(account, fetchResult, observedAt, prior)
             // Non-fatal: the next successful response will reconcile again.
         });
     }
-    await saveAccountQuota(account.label, quota).catch(() => {
+    await saveAccountQuota(account.key, quota).catch(() => {
         // Non-fatal: quota persistence is best-effort.
     });
     return quota;
@@ -759,7 +789,11 @@ async function refreshAccountLimits(options = {}) {
             key: account.key,
             type: account.type,
             status,
-            quota: quota ?? state?.quota ?? persisted[account.label] ?? null,
+            quota: quota ??
+                state?.quota ??
+                persisted[account.key] ??
+                persisted[account.label] ??
+                null,
         };
         if (error !== undefined) {
             result.error = error;
@@ -815,7 +849,7 @@ async function refreshAccountLimits(options = {}) {
                     results[index] = buildResult(account, "error", null, fetchResult.error);
                     continue;
                 }
-                const quota = await applyAccountUsageResult(account, fetchResult, refresh.startedAt, persisted[account.label] ?? null);
+                const quota = await applyAccountUsageResult(account, fetchResult, refresh.startedAt, persisted[account.key] ?? persisted[account.label] ?? null);
                 if (!quota) {
                     results[index] = buildResult(account, "error", null, "usage payload had no recognizable limit windows");
                     continue;
@@ -2832,7 +2866,7 @@ async function auditCompleteShareHeartbeat(grant, reportedCoins) {
         return { paused: false, detail: "no provisioned account recorded" };
     }
     const state = accountRuntimeState.get(`anthropic:${accountLabel}`);
-    const stats = getAccountStats(accountLabel);
+    const stats = getAccountStats(accountLabel, "oauth");
     const { verdict, shouldPause } = await recordAuditObservation({
         grantId: grant.id,
         accountLabel,
@@ -3453,6 +3487,7 @@ async function executeClaudeCodexFallback(args) {
         query: {},
         params: {},
         body: convertClaudeRequestToCodex(body, model),
+        metadata: { ...ctx.metadata, "neurolink.codexFallback": true },
         // Keep the child attribution isolated until its stream has passed
         // validation. A failed Codex attempt must not look like a served request.
         responseHeaders: {},
@@ -4059,7 +4094,7 @@ async function handleAnthropicSuccessfulResponse(args) {
                 // Non-fatal: the next successful response will reconcile again.
             });
         }
-        saveAccountQuota(account.label, quota).catch(() => {
+        saveAccountQuota(account.key, quota).catch(() => {
             // Non-fatal: quota persistence is best-effort
         });
     }
@@ -4725,7 +4760,7 @@ async function handleAnthropicSuccessfulNonStreamRetryResponse(args) {
                 // Non-fatal: the next successful response will reconcile again.
             });
         }
-        saveAccountQuota(account.label, retryQuota).catch((error) => {
+        saveAccountQuota(account.key, retryQuota).catch((error) => {
             logger.debug("[proxy] Failed to persist account quota after auth retry", {
                 account: account.label,
                 error: error instanceof Error ? error.message : String(error),
@@ -5016,7 +5051,7 @@ async function handleAnthropicAuthRetry(args) {
                     accountState.coolingReason = retryPlan.reason;
                 }
                 if (retryQuota429) {
-                    saveAccountQuota(account.label, retryQuota429).catch(() => {
+                    saveAccountQuota(account.key, retryQuota429).catch(() => {
                         // Non-fatal: routing already has the in-memory snapshot.
                     });
                 }
@@ -5580,9 +5615,13 @@ function createClaudeRequestRuntimeContext(args) {
             : status >= 400
                 ? PROXY_INTERNAL_ACCOUNT_TYPE
                 : undefined;
+        const finalAccountIdentity = resolveRequestLogAccountIdentity(finalAccountLabel, finalAccountType);
         if (status >= 400) {
             recordFinalError(status, finalAccountLabel, finalAccountType, {
                 requestId: ctx.requestId,
+                ...(finalAccountIdentity.accountKey
+                    ? { accountKey: finalAccountIdentity.accountKey }
+                    : {}),
                 errorType,
                 terminalOutcome: errorType === "client_cancelled"
                     ? "client_cancelled"
@@ -5606,7 +5645,13 @@ function createClaudeRequestRuntimeContext(args) {
             stream: !!body.stream,
             toolCount: Array.isArray(body.tools) ? body.tools.length : 0,
             account: finalAccountLabel ?? "",
+            ...(finalAccountIdentity.accountKey
+                ? { accountKey: finalAccountIdentity.accountKey }
+                : {}),
             accountType: finalAccountType ?? "",
+            ...(finalAccountIdentity.provider
+                ? { provider: finalAccountIdentity.provider }
+                : {}),
             ...buildClientAttribution(ctx.headers),
             responseStatus: status,
             responseTimeMs: Date.now() - requestStartTime,
@@ -5669,6 +5714,7 @@ function createClaudeRequestRuntimeContext(args) {
 function createAnthropicAttemptLogger(args) {
     const { ctx, body, toolCount, requestStart, tracer, account, attemptNumber } = args;
     const attemptStartedAt = Date.now();
+    const accountIdentity = resolveRequestLogAccountIdentity(account.label, account.type);
     return (status, errorType, errorMessage, extra) => {
         const attemptCompletedAt = Date.now();
         const traceCtx = tracer?.getTraceContext();
@@ -5682,7 +5728,11 @@ function createAnthropicAttemptLogger(args) {
             stream: !!body.stream,
             toolCount,
             account: account.label,
+            accountKey: account.key,
             accountType: account.type,
+            ...(accountIdentity.provider
+                ? { provider: accountIdentity.provider }
+                : {}),
             responseStatus: status,
             responseTimeMs: attemptCompletedAt - requestStart,
             attemptDurationMs: extra?.attemptDurationMs ?? attemptCompletedAt - attemptStartedAt,
@@ -6335,7 +6385,7 @@ async function handleAnthropicRoutedClaudeRequest(args) {
                         // Refresh the account's quota snapshot for proactive selection.
                         if (fetchResult.quota) {
                             accountState.quota = mergeQuotaSnapshot(accountState.quota, fetchResult.quota);
-                            saveAccountQuota(account.label, fetchResult.quota).catch(() => {
+                            saveAccountQuota(account.key, fetchResult.quota).catch(() => {
                                 // Non-fatal: routing already has the in-memory snapshot.
                             });
                         }

package/dist/server/routes/codexProxyRoutes.d.ts

@@ -17,7 +17,12 @@
  * never collides with anthropic entries) and does pre-commit rotation only, not
  * the full transient-budget / admission machinery.
  */
-import type { AccountCoolingReason, AccountQuota, CodexRuntimeAccount, RouteGroup, ServerContext } from "../../types/index.js";
+import type { AccountQuota, CodexRefreshTokenStore, CodexRuntimeAccount, CodexTokenRefresher, RateLimitCoolingReason, RouteGroup, ServerContext } from "../../types/index.js";
+declare function refreshCodexTokenOnceWithDependencies(key: string, refreshToken: string, store: CodexRefreshTokenStore, refresh: CodexTokenRefresher): Promise<{
+    accessToken: string;
+    refreshToken: string;
+    expiresAt?: number;
+}>;
 /** Refresh an account's token at most once at a time. */
 declare function refreshCodexTokenOnce(key: string, refreshToken: string): Promise<{
     accessToken: string;
@@ -44,7 +49,7 @@ declare function buildCodexUpstreamHeaders(clientHeaders: Record<string, string>
  */
 declare function planCodexCooldown(quota: AccountQuota | null, retryAfterMs: number, now: number): {
     coolingUntil: number;
-    reason: AccountCoolingReason;
+    reason: RateLimitCoolingReason;
 };
 /** Core pooled handler for POST /backend-api/codex/responses. */
 export declare function handleCodexResponsesRequest(ctx: ServerContext): Promise<Response>;
@@ -61,6 +66,7 @@ export declare const __testHooks: {
     buildCodexUpstreamHeaders: typeof buildCodexUpstreamHeaders;
     planCodexCooldown: typeof planCodexCooldown;
     refreshCodexTokenOnce: typeof refreshCodexTokenOnce;
+    refreshCodexTokenOnceWithDependencies: typeof refreshCodexTokenOnceWithDependencies;
     codexRefreshInFlightSize: () => number;
 };
 export {};

package/dist/server/routes/codexProxyRoutes.js

@@ -24,8 +24,10 @@ import { loadAccountQuotas, saveAccountQuota, } from "../../proxy/accountQuota.j
 import { createCodexUsageTap } from "../../proxy/codexUsage.js";
 import { CODEX_ACCOUNT_PREFIX, parseCodexRateLimitHeaders, } from "../../proxy/codexAccountUsage.js";
 import { buildClientAttribution } from "../../proxy/clientAttribution.js";
-import { logRequest } from "../../proxy/requestLogger.js";
+import { trackProxyResponse } from "../../proxy/proxyActivity.js";
+import { logRequest, logRequestAttempt } from "../../proxy/requestLogger.js";
 import { parseRetryAfterMs } from "../../proxy/routingPolicy.js";
+import { recordAttempt, recordAttemptError, recordFinalError, recordFinalSuccess, } from "../../proxy/usageStats.js";
 import { sanitizeForLog } from "../../utils/logSanitize.js";
 import { logger } from "../../utils/logger.js";
 const CODEX_UPSTREAM_TIMEOUT_MS = 15 * 60 * 1000; // 15 min, matches Claude path
@@ -33,6 +35,32 @@ const DEFAULT_TRANSIENT_COOLDOWN_MS = 60_000;
 const MAX_TRANSIENT_COOLDOWN_MS = 15 * 60 * 1000;
 /** Brief park after a refresh attempt that never reached a verdict. */
 const CODEX_AUTH_COOLDOWN_MS = 60_000;
+const CODEX_ACCOUNT_TYPE = "codex-oauth";
+const CODEX_FALLBACK_METADATA_KEY = "neurolink.codexFallback";
+function getCodexTransportErrorCode(error) {
+    if (!error || typeof error !== "object") {
+        return undefined;
+    }
+    const directCode = error.code;
+    if (typeof directCode === "string") {
+        return directCode;
+    }
+    const cause = error.cause;
+    if (!cause || typeof cause !== "object") {
+        return undefined;
+    }
+    const causeCode = cause.code;
+    return typeof causeCode === "string" ? causeCode : undefined;
+}
+function codexTransportScope(error) {
+    const code = getCodexTransportErrorCode(error);
+    return code === "ENOTFOUND" || code === "EAI_AGAIN"
+        ? "shared_provider_transport"
+        : "connection_transport";
+}
+function summarizeCodexUpstreamError(errorText, fallback) {
+    return sanitizeForLog(errorText).slice(0, 200) || fallback;
+}
 /**
  * In-flight proactive refreshes, keyed by account.
  *
@@ -43,8 +71,7 @@ const CODEX_AUTH_COOLDOWN_MS = 60_000;
  * that is perfectly healthy.
  */
 const codexRefreshInFlight = new Map();
-/** Refresh an account's token at most once at a time. */
-async function refreshCodexTokenOnce(key, refreshToken) {
+async function refreshCodexTokenOnceWithDependencies(key, refreshToken, store, refresh) {
     const existing = codexRefreshInFlight.get(key);
     if (existing) {
         return existing;
@@ -54,20 +81,36 @@ async function refreshCodexTokenOnce(key, refreshToken) {
         // request that captured the pool just before a previous refresh completed
         // holds a token that has since been rotated; using it would spend a real
         // attempt on a grant the server has already invalidated.
-        const latest = await tokenStore.peekTokens(key).catch(() => null);
+        const latest = await store.peekTokens(key).catch(() => null);
         const current = latest?.refreshToken ?? refreshToken;
-        const refreshed = await refreshCodexToken(current);
-        return {
+        const refreshed = await refresh(current);
+        const resolved = {
             accessToken: refreshed.accessToken,
             refreshToken: refreshed.refreshToken ?? current,
-            expiresAt: refreshed.expiresAt,
+            expiresAt: refreshed.expiresAt ?? latest?.expiresAt ?? Date.now() + 3_600_000,
         };
+        // Hold the single-flight slot through persistence. Releasing it after the
+        // OAuth response but before this write lets a third request read the old
+        // rotating refresh token, receive an invalid_grant, and disable an account
+        // another request has already healed.
+        if (latest) {
+            await store.saveTokens(key, {
+                ...resolved,
+                tokenType: "Bearer",
+                ...(latest.scope ? { scope: latest.scope } : {}),
+            });
+        }
+        return resolved;
     })().finally(() => {
         codexRefreshInFlight.delete(key);
     });
     codexRefreshInFlight.set(key, pending);
     return pending;
 }
+/** Refresh an account's token at most once at a time. */
+async function refreshCodexTokenOnce(key, refreshToken) {
+    return refreshCodexTokenOnceWithDependencies(key, refreshToken, tokenStore, refreshCodexToken);
+}
 // Headers we never forward upstream (hop-by-hop, client creds, or things we
 // re-derive). The client's own auth is replaced with the pooled account's.
 const BLOCKED_UPSTREAM_HEADERS = new Set([
@@ -114,13 +157,6 @@ async function loadCodexProxyAccounts() {
                 const refreshed = await refreshCodexTokenOnce(key, tokens.refreshToken);
                 accessToken = refreshed.accessToken;
                 expiresAt = refreshed.expiresAt ?? expiresAt;
-                await tokenStore.saveTokens(key, {
-                    accessToken,
-                    refreshToken: refreshed.refreshToken,
-                    expiresAt: expiresAt ?? Date.now() + 3_600_000,
-                    tokenType: "Bearer",
-                    scope: tokens.scope,
-                });
             }
             catch (error) {
                 // Keep the stale token; a 401 upstream will trigger rotation.
@@ -241,7 +277,11 @@ export async function handleCodexResponsesRequest(ctx) {
     const model = typeof body.model === "string"
         ? body.model
         : "-";
-    const writeLog = (account, responseStatus, extra = {}) => logRequest({
+    // A Codex call made as an inner Anthropic fallback is an upstream attempt,
+    // not an independently final client request. The parent fallback owns the
+    // final status and can still recover with a later provider.
+    const isFallbackRequest = ctx.metadata?.[CODEX_FALLBACK_METADATA_KEY] === true;
+    const writeFinalLog = (account, responseStatus, extra = {}) => logRequest({
         timestamp: new Date().toISOString(),
         requestId: ctx.requestId,
         method: ctx.method,
@@ -251,16 +291,63 @@ export async function handleCodexResponsesRequest(ctx) {
         toolCount: Array.isArray(body.tools)
             ? body.tools.length
             : 0,
-        account,
-        accountType: "codex-oauth",
+        account: account?.label ?? "",
+        ...(account ? { accountKey: account.key } : {}),
+        accountType: account ? CODEX_ACCOUNT_TYPE : "",
+        // This is the cost provider. accountKey and the response header identify
+        // the actual Codex pool that supplied the credential.
+        provider: "openai",
         ...buildClientAttribution(ctx.headers),
         responseStatus,
         responseTimeMs: Date.now() - requestStartTime,
         ...extra,
     });
+    let finalOutcomeRecorded = false;
+    const recordFinalOutcome = async (account, responseStatus, extra = {}) => {
+        if (isFallbackRequest || finalOutcomeRecorded) {
+            return;
+        }
+        finalOutcomeRecorded = true;
+        if (responseStatus >= 400) {
+            recordFinalError(responseStatus, account?.label, account ? CODEX_ACCOUNT_TYPE : undefined, {
+                requestId: ctx.requestId,
+                ...(account ? { accountKey: account.key } : {}),
+                errorType: extra.errorType,
+                terminalOutcome: extra.terminalOutcome ?? "handler_error",
+                message: extra.errorMessage,
+                errorCode: extra.errorCode,
+            });
+        }
+        else {
+            recordFinalSuccess(account?.label, account ? CODEX_ACCOUNT_TYPE : undefined);
+        }
+        await writeFinalLog(account, responseStatus, extra);
+    };
+    const writeAttempt = (account, attempt, startedAt, responseStatus, extra = {}) => {
+        void logRequestAttempt({
+            timestamp: new Date().toISOString(),
+            requestId: ctx.requestId,
+            attempt,
+            method: ctx.method,
+            path: ctx.path,
+            model,
+            stream: true,
+            toolCount: Array.isArray(body.tools)
+                ? body.tools.length
+                : 0,
+            account: account.label,
+            accountKey: account.key,
+            accountType: CODEX_ACCOUNT_TYPE,
+            provider: "openai",
+            responseStatus,
+            responseTimeMs: Date.now() - requestStartTime,
+            attemptDurationMs: Date.now() - startedAt,
+            ...extra,
+        }).catch(() => undefined);
+    };
     const accounts = await loadCodexProxyAccounts();
     if (accounts.length === 0) {
-        await writeLog("", 401, {
+        await recordFinalOutcome(undefined, 401, {
             errorType: "no_accounts",
             errorMessage: "No Codex accounts",
         });
@@ -280,7 +367,7 @@ export async function handleCodexResponsesRequest(ctx) {
         const retryAfterSec = soonest
             ? Math.max(1, Math.ceil((soonest - now) / 1000))
             : 60;
-        await writeLog("", 429, {
+        await recordFinalOutcome(undefined, 429, {
             errorType: "all_accounts_cooling",
             errorMessage: "All Codex accounts are rate-limited",
         });
@@ -300,11 +387,15 @@ export async function handleCodexResponsesRequest(ctx) {
     let attempt = 0;
     let lastErrorMessage = "All Codex accounts failed";
     let lastErrorStatus = 502;
+    let lastAttemptedAccount;
     for (const account of eligible) {
-        attempt += 1;
         let authRetried = false;
         // Same-account loop only re-runs once, for a post-401 token refresh.
         for (;;) {
+            attempt += 1;
+            const attemptStartedAt = Date.now();
+            lastAttemptedAccount = account;
+            recordAttempt(account.label, CODEX_ACCOUNT_TYPE);
             let upstream;
             try {
                 upstream = await fetch(CODEX_RESPONSES_URL, {
@@ -320,6 +411,17 @@ export async function handleCodexResponsesRequest(ctx) {
                 // can act on. Keep the detail in the log and return a fixed string, so
                 // internal topology never reaches the client.
                 logger.debug(`Codex upstream fetch failed (${account.label}): ${sanitizeForLog(error instanceof Error ? error.message : String(error))}`);
+                const errorMessage = summarizeCodexUpstreamError(error instanceof Error ? error.message : String(error), "Codex upstream request failed");
+                const errorCode = getCodexTransportErrorCode(error);
+                const transportScope = codexTransportScope(error);
+                recordAttemptError(account.label, CODEX_ACCOUNT_TYPE, 502);
+                writeAttempt(account, attempt, attemptStartedAt, 502, {
+                    errorType: "network_error",
+                    errorMessage,
+                    ...(errorCode ? { errorCode } : {}),
+                    transportScope,
+                    retryable: true,
+                });
                 lastErrorMessage = "Codex upstream request failed";
                 lastErrorStatus = 502;
                 break; // rotate to next account
@@ -336,50 +438,72 @@ export async function handleCodexResponsesRequest(ctx) {
                     clearAccountCooldown(account.key, account.expiredCooldownUntil).catch(() => undefined);
                 }
                 publishCodexHeaders(ctx, account, attempt, quota);
-                await writeLog(account.label, upstream.status);
+                writeAttempt(account, attempt, attemptStartedAt, upstream.status);
                 const headers = {
                     "content-type": upstream.headers.get("content-type") ?? "text/event-stream",
                     "cache-control": "no-cache",
                     connection: "keep-alive",
                     ...(ctx.responseHeaders ?? {}),
                 };
-                // Tap the relay for token usage. The log above is written first and
-                // unconditionally so a request is never lost when a client hangs up
-                // mid-stream; this emits a second record for the same requestId
-                // carrying the counts, which proxyAnalysis merges. If the stream shape
-                // is not recognised, usage resolves null and nothing extra is written —
-                // i.e. exactly the previous behaviour.
                 if (!upstream.body) {
+                    await recordFinalOutcome(account, upstream.status, {
+                        terminalOutcome: "bodyless",
+                    });
                     return new Response(upstream.body, {
                         status: upstream.status,
                         headers,
                     });
                 }
                 const { stream: usageTap, usage: usageSeen } = createCodexUsageTap();
-                usageSeen
-                    .then((usage) => {
-                    if (!usage) {
-                        return;
-                    }
-                    return writeLog(account.label, upstream.status, {
-                        provider: "openai",
-                        inputTokens: usage.inputTokens,
-                        outputTokens: usage.outputTokens,
-                        cacheReadTokens: usage.cacheReadTokens,
-                        cacheCreationTokens: usage.cacheCreationTokens,
-                    });
-                })
-                    .catch(() => undefined);
-                return new Response(upstream.body.pipeThrough(usageTap), {
+                const relay = new Response(upstream.body.pipeThrough(usageTap), {
                     status: upstream.status,
                     headers,
                 });
+                return trackProxyResponse(relay, () => undefined, {
+                    onTerminal: ({ outcome }) => {
+                        void usageSeen
+                            .then((usage) => {
+                            const usageExtra = usage
+                                ? {
+                                    inputTokens: usage.inputTokens,
+                                    outputTokens: usage.outputTokens,
+                                    cacheReadTokens: usage.cacheReadTokens,
+                                    cacheCreationTokens: usage.cacheCreationTokens,
+                                }
+                                : {};
+                            if (outcome === "completed" || outcome === "bodyless") {
+                                return recordFinalOutcome(account, upstream.status, {
+                                    terminalOutcome: outcome,
+                                    ...usageExtra,
+                                });
+                            }
+                            return recordFinalOutcome(account, outcome === "client_cancelled" ? 499 : 502, {
+                                errorType: outcome === "client_cancelled"
+                                    ? "client_cancelled"
+                                    : "stream_error",
+                                errorMessage: outcome === "client_cancelled"
+                                    ? "Client cancelled Codex stream"
+                                    : "Codex upstream stream failed",
+                                terminalOutcome: outcome,
+                                ...usageExtra,
+                            });
+                        })
+                            .catch(() => undefined);
+                    },
+                });
             }
             const errText = await upstream.text().catch(() => "");
             // 401/403 → try a forced token refresh once, then rotate.
             if ((upstream.status === 401 || upstream.status === 403) &&
                 !authRetried &&
                 account.refreshToken) {
+                const errorMessage = summarizeCodexUpstreamError(errText, "Codex authentication rejected upstream");
+                recordAttemptError(account.label, CODEX_ACCOUNT_TYPE, upstream.status);
+                writeAttempt(account, attempt, attemptStartedAt, upstream.status, {
+                    errorType: "authentication_error",
+                    errorMessage,
+                    retryable: true,
+                });
                 authRetried = true;
                 const staleTokens = {
                     accessToken: account.token,
@@ -387,17 +511,11 @@ export async function handleCodexResponsesRequest(ctx) {
                     expiresAt: account.expiresAt ?? 0,
                 };
                 try {
-                    const refreshed = await refreshCodexToken(account.refreshToken);
+                    const refreshed = await refreshCodexTokenOnce(account.key, account.refreshToken);
                     account.token = refreshed.accessToken;
                     account.refreshToken = refreshed.refreshToken ?? account.refreshToken;
                     account.expiresAt = refreshed.expiresAt ?? account.expiresAt;
                     account.accountId = resolveCodexAccountId(refreshed.accessToken);
-                    await tokenStore.saveTokens(account.key, {
-                        accessToken: account.token,
-                        refreshToken: account.refreshToken,
-                        expiresAt: account.expiresAt ?? Date.now() + 3_600_000,
-                        tokenType: "Bearer",
-                    });
                     continue; // retry same account with the fresh token
                 }
                 catch (error) {
@@ -432,6 +550,16 @@ export async function handleCodexResponsesRequest(ctx) {
                 const retryAfterMs = parseRetryAfterMs(upstream.headers.get("retry-after"));
                 const plan = planCodexCooldown(quota, retryAfterMs, Date.now());
                 await saveAccountCooldown(account.key, plan.coolingUntil, plan.reason).catch(() => undefined);
+                const rateLimitKind = plan.reason === "transient" ? "transient" : "quota";
+                const errorMessage = summarizeCodexUpstreamError(errText, "Codex account rate-limited");
+                recordAttemptError(account.label, CODEX_ACCOUNT_TYPE, upstream.status, rateLimitKind);
+                writeAttempt(account, attempt, attemptStartedAt, upstream.status, {
+                    errorType: "rate_limit_error",
+                    errorMessage,
+                    retryable: true,
+                    rateLimitKind,
+                    cooldownReason: plan.reason,
+                });
                 lastErrorStatus = 429;
                 lastErrorMessage = "Codex account rate-limited";
                 break; // rotate
@@ -443,12 +571,22 @@ export async function handleCodexResponsesRequest(ctx) {
                 // of letting it stay first in line with unknown quota.
                 await saveAccountCooldown(account.key, Date.now() + CODEX_AUTH_COOLDOWN_MS, "auth").catch(() => undefined);
             }
+            const errorMessage = summarizeCodexUpstreamError(errText, "Codex error");
+            const errorType = upstream.status === 401 || upstream.status === 403
+                ? "authentication_error"
+                : "api_error";
+            recordAttemptError(account.label, CODEX_ACCOUNT_TYPE, upstream.status);
+            writeAttempt(account, attempt, attemptStartedAt, upstream.status, {
+                errorType,
+                errorMessage,
+                retryable: upstream.status >= 500,
+            });
             lastErrorStatus = upstream.status >= 500 ? 502 : upstream.status;
-            lastErrorMessage = sanitizeForLog(errText).slice(0, 200) || "Codex error";
+            lastErrorMessage = errorMessage;
             break; // rotate
         }
     }
-    await writeLog("", lastErrorStatus, {
+    await recordFinalOutcome(lastAttemptedAccount, lastErrorStatus, {
         errorType: "all_accounts_failed",
         errorMessage: lastErrorMessage,
     });
@@ -529,18 +667,12 @@ async function handleCodexModelsRequest(ctx) {
                 if (!authRetried && account.refreshToken) {
                     authRetried = true;
                     try {
-                        const refreshed = await refreshCodexToken(account.refreshToken);
+                        const refreshed = await refreshCodexTokenOnce(account.key, account.refreshToken);
                         account.token = refreshed.accessToken;
                         account.refreshToken =
                             refreshed.refreshToken ?? account.refreshToken;
                         account.expiresAt = refreshed.expiresAt ?? account.expiresAt;
                         account.accountId = resolveCodexAccountId(refreshed.accessToken);
-                        await tokenStore.saveTokens(account.key, {
-                            accessToken: account.token,
-                            refreshToken: account.refreshToken,
-                            expiresAt: account.expiresAt ?? Date.now() + 3_600_000,
-                            tokenType: "Bearer",
-                        });
                         continue; // retry this account with the fresh token
                     }
                     catch {
@@ -605,5 +737,6 @@ export const __testHooks = {
     buildCodexUpstreamHeaders,
     planCodexCooldown,
     refreshCodexTokenOnce,
+    refreshCodexTokenOnceWithDependencies,
     codexRefreshInFlightSize: () => codexRefreshInFlight.size,
 };