@juspay/neurolink 12.9.2 → 12.9.4

package/dist/server/routes/claudeProxyRoutes.js

@@ -18,6 +18,8 @@ import { clearAccountCooldown, loadAccountCooldowns, saveAccountCooldown, } from
 import { anthropicAccountKeysEqual, ENV_ANTHROPIC_ACCOUNT_KEY, isAccountAllowed, LEGACY_ANTHROPIC_ACCOUNT_KEY, normalizeAnthropicAccountKey, shouldLoadFallbackCredential, } from "../../proxy/accountSelection.js";
 import { getUnifiedRateLimitStatus, isQuotaOverageAvailable, loadAccountQuotas, mergeQuotaSnapshot, modelFamilyToken, parseQuotaHeaders, saveAccountQuota, } from "../../proxy/accountQuota.js";
 import { fetchAccountUsage, listAnthropicAccountsForUsage, usageToQuota, } from "../../proxy/accountUsage.js";
+import { tokenStore } from "../../auth/tokenStore.js";
+import { fetchCodexAccountUsage, listCodexAccountsForUsage, resolveProxyStatusAccountIdentity, } from "../../proxy/codexAccountUsage.js";
 import { AccountQuotaRefreshCoordinator } from "../../proxy/accountQuotaRefreshCoordinator.js";
 import { ProviderTransportCoordinator } from "../../proxy/providerTransportCoordinator.js";
 import { MAX_COOLDOWN_MS_BY_REASON } from "../../proxy/routingEvidence.js";
@@ -107,6 +109,15 @@ let lastKnownAccountCount = 0;
 const MAX_AUTH_RETRIES = 5;
 const MAX_TRANSIENT_SAME_ACCOUNT_RETRIES = 2;
 const TRANSIENT_SAME_ACCOUNT_RETRY_DELAYS_MS = [250, 1_000];
+/**
+ * Retry budget for failures that happened before any request byte was sent
+ * (a SYN lost on a lossy uplink). Nothing was dispatched, so each retry is
+ * free of duplicate-work risk; on a link losing one connect in five, four
+ * retries take the per-request failure rate from about 20% to under 1%.
+ * Delays follow TRANSIENT_SAME_ACCOUNT_RETRY_DELAYS_MS, clamped to its last
+ * entry.
+ */
+const MAX_CONNECT_PHASE_SAME_ACCOUNT_RETRIES = 4;
 const OVERLOAD_ACCOUNT_ROTATION_DELAYS_MS = [250, 500, 1_000, 2_000];
 const MAX_FALLBACK_NETWORK_RETRIES = 1;
 const FALLBACK_STREAM_IDLE_TIMEOUT_MS = 2 * 60 * 1000;
@@ -780,6 +791,45 @@ async function refreshAccountQuotaInBackground(account, trigger) {
     }
     await applyAccountUsageResult(account, refresh.result, refresh.startedAt);
 }
+/**
+ * The logins the account-exposing routes enumerate, per engine, plus every
+ * key the token store holds at all (disabled ones included). Overridable by
+ * the suite because the token store is a singleton bound to the real home at
+ * import — a case cannot point it elsewhere, and reading the operator's own
+ * logins inside a fixture test is exactly how a phantom would hide.
+ */
+let accountDirectoryOverride = null;
+async function listRoutableAccountsByEngine(allowlist) {
+    if (accountDirectoryOverride) {
+        return {
+            anthropic: accountDirectoryOverride.anthropic,
+            codex: accountDirectoryOverride.codex,
+        };
+    }
+    // The allowlist is an Anthropic routing concept, keyed by anthropic:
+    // prefixes; applying it to Codex keys would exclude every Codex login.
+    const [anthropic, codex] = await Promise.all([
+        listAnthropicAccountsForUsage(allowlist),
+        listCodexAccountsForUsage(),
+    ]);
+    return { anthropic, codex };
+}
+/**
+ * Every login the token store knows, routable or not. This is what separates
+ * a DISABLED login (still here, shown as unrouted) from a REMOVED one (gone,
+ * and not shown): usage counters and quota snapshots outlive a logout, and
+ * without this check a deleted login renders as an unrouted account forever.
+ */
+async function listKnownAccountKeys() {
+    if (accountDirectoryOverride) {
+        return accountDirectoryOverride.knownKeys;
+    }
+    const [anthropic, codex] = await Promise.all([
+        tokenStore.listByPrefix("anthropic:"),
+        tokenStore.listByPrefix("codex:"),
+    ]);
+    return new Set([...anthropic.map(normalizeAnthropicAccountKey), ...codex]);
+}
 /**
  * Fetch fresh limits from Anthropic's usage endpoint for every eligible OAuth
  * account and write them through the exact same chain the passive header
@@ -789,24 +839,38 @@ async function refreshAccountQuotaInBackground(account, trigger) {
  */
 async function refreshAccountLimits(options = {}) {
     const fetchedAt = Date.now();
-    const allAccounts = await listAnthropicAccountsForUsage(options.accountAllowlist);
+    const directory = await listRoutableAccountsByEngine(options.accountAllowlist);
+    const allAccounts = [
+        ...directory.anthropic.map((account) => ({
+            account,
+            provider: "anthropic",
+        })),
+        ...directory.codex.map((account) => ({
+            account,
+            provider: "codex",
+        })),
+    ];
     const accounts = options.accountFilter
-        ? allAccounts.filter((account) => account.label === options.accountFilter ||
+        ? allAccounts.filter(({ account }) => account.label === options.accountFilter ||
             account.key === options.accountFilter)
         : allAccounts;
     const persisted = await loadAccountQuotas().catch(() => ({}));
-    const buildResult = (account, status, quota, error) => {
+    const buildResult = (account, provider, status, quota, error) => {
         const state = accountRuntimeState.get(account.key);
+        // The quota store keys Anthropic snapshots by bare label for historical
+        // reasons (see CLAUDE.md) and Codex snapshots by full key. A Codex login
+        // must never fall back to the bare label: with one email on both engines
+        // that label holds the ANTHROPIC account's windows.
+        const persistedQuota = provider === "anthropic"
+            ? (persisted[account.key] ?? persisted[account.label] ?? null)
+            : (persisted[account.key] ?? null);
         const result = {
             account: account.label,
             key: account.key,
+            provider,
             type: account.type,
             status,
-            quota: quota ??
-                state?.quota ??
-                persisted[account.key] ??
-                persisted[account.label] ??
-                null,
+            quota: quota ?? state?.quota ?? persistedQuota,
         };
         if (error !== undefined) {
             result.error = error;
@@ -823,7 +887,7 @@ async function refreshAccountLimits(options = {}) {
         return {
             fetchedAt,
             snapshot: true,
-            results: accounts.map((account) => buildResult(account, "snapshot", null)),
+            results: accounts.map(({ account, provider }) => buildResult(account, provider, "snapshot", null)),
             refreshMetrics: accountQuotaRefreshCoordinator.getMetrics(),
         };
     }
@@ -835,23 +899,41 @@ async function refreshAccountLimits(options = {}) {
             if (index >= accounts.length) {
                 return;
             }
-            const account = accounts[index];
+            const { account, provider } = accounts[index];
             if (account.type !== "oauth") {
-                results[index] = buildResult(account, "skipped_api_key", null);
+                results[index] = buildResult(account, provider, "skipped_api_key", null);
                 continue;
             }
             const lastFetch = lastUsageFetchAt.get(account.key) ?? 0;
             if (Date.now() - lastFetch < MIN_USAGE_REFETCH_INTERVAL_MS) {
-                results[index] = buildResult(account, "throttled", null);
+                results[index] = buildResult(account, provider, "throttled", null);
                 continue;
             }
             lastUsageFetchAt.set(account.key, Date.now());
+            if (provider === "codex") {
+                // Codex has its own usage endpoint and no overage/cooldown
+                // reconciliation to run; the snapshot is written under the full key,
+                // which is the only key the Codex engine ever reads it back by.
+                try {
+                    const fetched = await fetchCodexAccountUsage(account);
+                    if (fetched.ok === false) {
+                        results[index] = buildResult(account, provider, "error", null, `codex usage fetch failed: ${fetched.reason}`);
+                        continue;
+                    }
+                    await saveAccountQuota(account.key, fetched.quota);
+                    results[index] = buildResult(account, provider, "refreshed", fetched.quota);
+                }
+                catch (err) {
+                    results[index] = buildResult(account, provider, "error", null, err instanceof Error ? err.message : String(err));
+                }
+                continue;
+            }
             // Isolate failures per account: an unexpected rejection must not abort
             // the Promise.all sweep and turn the whole /limits response into a 502.
             try {
                 const refresh = await accountQuotaRefreshCoordinator.run(account, `manual:${account.key}`, fetchValidatedAccountUsage, { force: true });
                 if (refresh.kind !== "completed") {
-                    results[index] = buildResult(account, "throttled", null);
+                    results[index] = buildResult(account, provider, "throttled", null);
                     continue;
                 }
                 const fetchResult = refresh.result;
@@ -859,18 +941,18 @@ async function refreshAccountLimits(options = {}) {
                 // file without strictNullChecks, where negated boolean-discriminant
                 // narrowing does not apply.
                 if (fetchResult.ok === false) {
-                    results[index] = buildResult(account, "error", null, fetchResult.error);
+                    results[index] = buildResult(account, provider, "error", null, fetchResult.error);
                     continue;
                 }
                 const quota = await applyAccountUsageResult(account, fetchResult, refresh.startedAt, persisted[account.key] ?? persisted[account.label] ?? null);
                 if (!quota) {
-                    results[index] = buildResult(account, "error", null, "usage payload had no recognizable limit windows");
+                    results[index] = buildResult(account, provider, "error", null, "usage payload had no recognizable limit windows");
                     continue;
                 }
-                results[index] = buildResult(account, "refreshed", quota);
+                results[index] = buildResult(account, provider, "refreshed", quota);
             }
             catch (err) {
-                results[index] = buildResult(account, "error", null, err instanceof Error ? err.message : String(err));
+                results[index] = buildResult(account, provider, "error", null, err instanceof Error ? err.message : String(err));
             }
         }
     };
@@ -5768,6 +5850,9 @@ function createAnthropicAttemptLogger(args) {
                 ? { cacheReadTokens: extra.cacheReadTokens }
                 : {}),
             ...(extra?.retryable !== undefined ? { retryable: extra.retryable } : {}),
+            ...(extra?.connectPhase !== undefined
+                ? { connectPhase: extra.connectPhase }
+                : {}),
             ...(extra?.rateLimitKind ? { rateLimitKind: extra.rateLimitKind } : {}),
             ...(extra?.cooldownReason
                 ? { cooldownReason: extra.cooldownReason }
@@ -5971,6 +6056,7 @@ async function fetchAnthropicAccountResponse(args) {
     }
     catch (fetchErr) {
         const retryable = isRetryableNetworkError(fetchErr);
+        const connectPhase = isConnectPhaseNetworkError(fetchErr);
         const transportScope = classifyNetworkTransportScope(fetchErr);
         // Every dispatched upstream request is an attempt, including terminal
         // transport failures. Record it once before preserving the throw behavior.
@@ -5982,6 +6068,7 @@ async function fetchAnthropicAccountResponse(args) {
         logger.always(`[proxy] fetch error account=${account.label} code=${errorCode} (${retryable ? "retryable" : "terminal"}): ${errorMessage}`);
         logAttempt(502, "network_error", errorMessage, {
             retryable,
+            connectPhase,
             errorCode,
             transportScope,
         });
@@ -5998,6 +6085,7 @@ async function fetchAnthropicAccountResponse(args) {
             retrySameAccount: true,
             transportScope,
             errorCode,
+            connectPhase,
             lastError,
             sawRateLimit,
             sawNetworkError,
@@ -6267,6 +6355,20 @@ async function handleAnthropicRoutedClaudeRequest(args) {
                     transportPermit.errorCode ?? undefined;
                 loopState.lastTransportScope = transportPermit.transportScope;
                 loopState.lastError = `Anthropic transport recovery probe failed (${transportPermit.errorCode ?? "unknown"})`;
+                // The probe that failed was another request's attempt; this one has
+                // sent nothing. Give it the same bounded same-account budget a direct
+                // transport failure gets, instead of failing every queued request the
+                // moment one probe times out.
+                const probeRetryBudget = transportPermit.connectPhase
+                    ? MAX_CONNECT_PHASE_SAME_ACCOUNT_RETRIES
+                    : MAX_TRANSIENT_SAME_ACCOUNT_RETRIES;
+                if (transientSameAccountRetries < probeRetryBudget) {
+                    transientSameAccountRetries += 1;
+                    const delayMs = getTransientSameAccountRetryDelayMs(transientSameAccountRetries);
+                    logger.always(`[proxy] retrying same account=${account.label} after failed transport recovery probe (${transientSameAccountRetries}/${probeRetryBudget}) in ${delayMs}ms`);
+                    await sleep(delayMs);
+                    continue;
+                }
                 break accountLoop;
             }
             loopState.attemptNumber += 1;
@@ -6368,7 +6470,7 @@ async function handleAnthropicRoutedClaudeRequest(args) {
                     throw error;
                 }
                 if (fetchResult.transportScope) {
-                    providerTransportCoordinator.reportTransportFailure(fetchResult.errorCode, fetchResult.transportScope, transportPermit);
+                    providerTransportCoordinator.reportTransportFailure(fetchResult.errorCode, fetchResult.transportScope, transportPermit, fetchResult.connectPhase === true);
                 }
                 else {
                     providerTransportCoordinator.reportSuccess(transportPermit);
@@ -6445,12 +6547,16 @@ async function handleAnthropicRoutedClaudeRequest(args) {
                         }
                         continue accountLoop;
                     }
-                    // Transient error retry (network errors, 529 overloaded)
+                    // Transient error retry (network errors, 529 overloaded). A failure
+                    // from the connect phase sent nothing, so it earns the larger budget.
+                    const sameAccountRetryBudget = fetchResult.connectPhase
+                        ? MAX_CONNECT_PHASE_SAME_ACCOUNT_RETRIES
+                        : MAX_TRANSIENT_SAME_ACCOUNT_RETRIES;
                     if (fetchResult.retrySameAccount &&
-                        transientSameAccountRetries < MAX_TRANSIENT_SAME_ACCOUNT_RETRIES) {
+                        transientSameAccountRetries < sameAccountRetryBudget) {
                         transientSameAccountRetries += 1;
                         const delayMs = getTransientSameAccountRetryDelayMs(transientSameAccountRetries);
-                        logger.always(`[proxy] retrying same account=${account.label} after transient network error (${transientSameAccountRetries}/${MAX_TRANSIENT_SAME_ACCOUNT_RETRIES}) in ${delayMs}ms`);
+                        logger.always(`[proxy] retrying same account=${account.label} after transient network error (${transientSameAccountRetries}/${sameAccountRetryBudget}) in ${delayMs}ms`);
                         await sleep(delayMs);
                         continue;
                     }
@@ -6769,11 +6875,6 @@ function buildEarlyClaudeRequestError(args) {
  * millisecond fields tens of thousands of years into the future, so only the
  * seconds fields are converted, and 0 becomes null rather than epoch zero.
  */
-/**
- * Account types that represent a real credential rather than proxy plumbing.
- * Mirrors the Anthropic pool's own account types.
- */
-const REAL_ACCOUNT_TYPES = new Set(["oauth", "api_key"]);
 function toMillis(value) {
     return typeof value === "number" && Number.isFinite(value) && value > 0
         ? Math.round(value * 1000)
@@ -7498,9 +7599,31 @@ export function createClaudeProxyRoutes(modelRouter, basePath = "", accountStrat
                         // Usage is the optional half; quota and status must still render.
                         usageError = error instanceof Error ? error.message : String(error);
                     }
-                    const statsByLabel = new Map();
-                    for (const entry of Object.values(statsAccounts)) {
-                        statsByLabel.set(entry.label, entry);
+                    // Joined by provider-qualified KEY, never by label. One email can
+                    // be logged in to both engines; joined by label, the Codex login was
+                    // swallowed by the Anthropic row (and its counters could land on
+                    // that row, last write winning). Legacy stats entries that predate
+                    // the key carry only a label and a type, which is enough to derive
+                    // it; a keyed entry for the same login wins over a legacy one.
+                    const statsByKey = new Map();
+                    for (const [mapKey, entry] of Object.entries(statsAccounts)) {
+                        const identity = resolveProxyStatusAccountIdentity(entry.label, entry.type, entry.key ?? mapKey);
+                        const identityKey = identity.key ?? mapKey;
+                        const existing = statsByKey.get(identityKey);
+                        if (!existing || (entry.key && !existing.key)) {
+                            statsByKey.set(identityKey, { ...entry, identityKey });
+                        }
+                    }
+                    // Which logins exist at all, disabled ones included. A stats entry
+                    // with no login behind it is a REMOVED account, not an unrouted one.
+                    // If the store cannot be read, err towards showing rows: hiding a
+                    // real login is the worse mistake, and the old behaviour.
+                    let knownKeys;
+                    try {
+                        knownKeys = await listKnownAccountKeys();
+                    }
+                    catch {
+                        knownKeys = null;
                     }
                     const rows = [];
                     const claimed = new Set();
@@ -7509,13 +7632,14 @@ export function createClaudeProxyRoutes(modelRouter, basePath = "", accountStrat
                     // today, which is exactly when an operator most wants to see it.
                     for (const result of limits.results) {
                         const label = result.account;
-                        claimed.add(label);
-                        const stat = statsByLabel.get(label);
+                        claimed.add(result.key);
+                        const stat = statsByKey.get(result.key);
                         const quota = normalizeQuotaForAccounts(result.quota);
                         const cooling = isCooling(result.key ?? null);
                         rows.push({
                             label,
                             key: result.key ?? null,
+                            provider: result.provider,
                             kind: "account",
                             type: result.type ?? stat?.type ?? "oauth",
                             // result.status describes how the quota was obtained
@@ -7549,39 +7673,53 @@ export function createClaudeProxyRoutes(modelRouter, basePath = "", accountStrat
                                     weeklyHealth: quotaHealth(quota.weeklyStatus),
                                 }
                                 : null,
-                            usage: usageByAccount.get(label) ?? null,
+                            usage: usageByAccount.get(result.key) ?? null,
                         });
                     }
                     // Plumbing rows are still reported, but tagged, so a consumer can
                     // show or hide them rather than rendering them as credentials.
                     //
-                    // A real login can land here too: listAnthropicAccountsForUsage
-                    // skips accounts the token store has disabled or the allowlist
-                    // excludes, so an account with real usage history but no current
-                    // route is absent from limits.results. Tagging that as plumbing hid
-                    // the one account an operator is looking for when they ask why
-                    // traffic stopped — the docs tell consumers to filter internal rows
-                    // out. It stays kind "account", with a status saying why it has no
-                    // quota block.
-                    for (const entry of Object.values(statsAccounts)) {
-                        if (claimed.has(entry.label)) {
+                    // A real login can land here too: the listers skip accounts the
+                    // token store has disabled or the allowlist excludes, so a login
+                    // with real usage history but no current route is absent from
+                    // limits.results. Tagging that as plumbing hid the one account an
+                    // operator is looking for when they ask why traffic stopped. It
+                    // stays kind "account", with a status saying why it has no quota
+                    // block — but only while the login still EXISTS. A stats entry whose
+                    // login has been removed from the store is history, not a
+                    // credential, and rendering it as "unrouted" put a phantom account
+                    // on every dashboard for as long as the counters file lived.
+                    for (const entry of statsByKey.values()) {
+                        const identity = resolveProxyStatusAccountIdentity(entry.label, entry.type, entry.identityKey);
+                        if (identity.key !== null && claimed.has(identity.key)) {
+                            continue;
+                        }
+                        const isLogin = identity.provider !== "other";
+                        if (isLogin &&
+                            identity.key !== null &&
+                            knownKeys !== null &&
+                            !knownKeys.has(identity.key)) {
                             continue;
                         }
-                        const isRealAccount = REAL_ACCOUNT_TYPES.has(entry.type);
                         rows.push({
                             label: entry.label,
-                            key: null,
-                            kind: isRealAccount
+                            key: isLogin ? identity.key : null,
+                            ...(isLogin ? { provider: identity.provider } : {}),
+                            kind: isLogin
                                 ? "account"
                                 : entry.type === "translation"
                                     ? "translation"
                                     : "internal",
-                            type: entry.type,
-                            status: isRealAccount ? "unrouted" : null,
+                            // The row's type is the credential kind; the engine is
+                            // `provider`. Stats record Codex logins as "codex-oauth", which
+                            // consumers that only know the credential kinds read as
+                            // plumbing, so it is reported as the OAuth login it is.
+                            type: identity.provider === "codex" ? "oauth" : entry.type,
+                            status: isLogin ? "unrouted" : null,
                             cooling: false,
                             allowed: null,
                             expired: null,
-                            isPrimary: isPrimaryAccount(entry.label),
+                            isPrimary: isLogin ? isPrimaryAccount(identity.key) : false,
                             requests: entry.successCount + entry.errorCount,
                             errors: entry.errorCount,
                             rateLimits: entry.rateLimitCount,
@@ -7593,7 +7731,9 @@ export function createClaudeProxyRoutes(modelRouter, basePath = "", accountStrat
                             // and cost in the ledger — hardcoding null here discarded
                             // exactly the usage an operator is looking for when they ask
                             // why traffic stopped.
-                            usage: usageByAccount.get(entry.label) ?? null,
+                            usage: identity.key !== null
+                                ? (usageByAccount.get(identity.key) ?? null)
+                                : null,
                         });
                     }
                     const response = {
@@ -7776,12 +7916,46 @@ function describeTransportError(error) {
         .join(": ");
     return detail ? `${message} (${detail})` : message;
 }
+/**
+ * Whether a transport failure provably happened while connecting, before any
+ * byte of the request left the process.
+ *
+ * Node tags its connect errors with `syscall: "connect"`; with happy-eyeballs
+ * enabled (the default) the error is an AggregateError whose every entry is
+ * one such attempt, and undici wraps either as `fetch failed` with the
+ * original as `cause`. The code alone cannot make this call: an `ETIMEDOUT`
+ * from the connect timer and an `ETIMEDOUT` from a socket that went quiet
+ * after dispatch look identical by code, and only the first is safe to
+ * retry. Both proxies behind one lossy Wi-Fi uplink returned 116 terminal
+ * 502s in a day on exactly that ambiguity.
+ */
+function isConnectPhaseNetworkError(error) {
+    const seen = new Set();
+    let current = error;
+    while (current && typeof current === "object" && !seen.has(current)) {
+        seen.add(current);
+        const candidate = current;
+        if (candidate.syscall === "connect") {
+            return true;
+        }
+        if (Array.isArray(candidate.errors) && candidate.errors.length > 0) {
+            return candidate.errors.every((entry) => entry !== null &&
+                typeof entry === "object" &&
+                entry.syscall === "connect");
+        }
+        current = candidate.cause;
+    }
+    return false;
+}
 /**
  * Determine whether a POST can be retried without risking duplicate provider
  * work. Only failures that prove connection establishment did not complete are
  * safe; a reset, socket error, or response timeout can happen after dispatch.
  */
 function isRetryableNetworkError(error) {
+    if (isConnectPhaseNetworkError(error)) {
+        return true;
+    }
     const code = getErrorCode(error);
     return (code !== undefined &&
         [
@@ -8001,7 +8175,15 @@ export const __testHooks = {
         limitsRefreshInFlight = null;
         accountQuotaRefreshCoordinator.clear();
     },
+    setAccountDirectoryForTests: (override) => {
+        accountDirectoryOverride = override;
+    },
     isRetryableNetworkError,
+    isConnectPhaseNetworkError,
+    MAX_CONNECT_PHASE_SAME_ACCOUNT_RETRIES,
+    clearProviderTransportCoordinatorForTests: () => {
+        providerTransportCoordinator.clear();
+    },
     isPermanentRefreshFailure,
     getStreamFailureDetails,
     trackUpstreamReadableStream,

package/dist/types/proxy.d.ts

@@ -445,6 +445,8 @@ export type ProxyProviderTransportPermit = {
     allowed: false;
     errorCode: string | null;
     transportScope: ProxyNetworkTransportScope;
+    /** The degrading failure happened before any request byte was sent. */
+    connectPhase: boolean;
 };
 export type ProxyAccountRoutingCandidate = {
     account: string;
@@ -626,6 +628,8 @@ export type RequestAttemptLogEntry = {
     transportScope?: ProxyTransportScope;
     /** Whether this failed attempt may be retried without changing the request. */
     retryable?: boolean;
+    /** The transport failure happened before any request byte was sent. */
+    connectPhase?: boolean;
     /** Distinguishes short-lived admission throttles from exhausted quota windows. */
     rateLimitKind?: "transient" | "quota";
     /** Reset-aware cooldown reason selected for a rate-limited attempt. */
@@ -701,6 +705,8 @@ export type AnthropicAttemptLogger = (status: number, errorType?: string, errorM
     cacheCreationTokens?: number;
     cacheReadTokens?: number;
     retryable?: boolean;
+    /** The transport failure happened before any request byte was sent. */
+    connectPhase?: boolean;
     /** Low-level transport code such as ETIMEDOUT or EADDRNOTAVAIL. */
     errorCode?: string;
     transportScope?: ProxyTransportScope;
@@ -874,6 +880,9 @@ export type AnthropicUpstreamFetchResult = {
     retrySameAccount?: boolean;
     transportScope?: ProxyNetworkTransportScope;
     errorCode?: string;
+    /** The transport failure happened while connecting, before any request
+     *  byte was sent, so retrying it cannot duplicate provider work. */
+    connectPhase?: boolean;
     /** When set, the caller should wait this many ms before retrying (from upstream retry-after). */
     retryAfterMs?: number;
     /** Set on a genuine 429: how long / why to cool this account before rotating. */
@@ -1209,8 +1218,14 @@ export type ProxyQuotaRefreshRunResult = {
 export type ProxyLimitsAccountResult = {
     /** Account label (quota-store key). */
     account: string;
-    /** Token-store key ("anthropic:<label>"). */
+    /** Token-store key ("anthropic:<label>" or "codex:<label>"). */
     key: string;
+    /**
+     * Which pool engine owns this login. Two logins can share a label — an
+     * operator may use one email for both — so the key, not the label, is the
+     * identity, and this names the engine without parsing the key's prefix.
+     */
+    provider: ProxyAccountProvider;
     type: ProxyAccountType;
     status: "refreshed" | "throttled" | "skipped_api_key" | "snapshot" | "error";
     /** Fresh quota on "refreshed"; last known snapshot otherwise (may be null). */
@@ -1219,6 +1234,20 @@ export type ProxyLimitsAccountResult = {
     coolingUntil?: number;
     coolingReason?: AccountCoolingReason;
 };
+/** The pool engine a login belongs to, as named on limits and accounts rows. */
+export type ProxyAccountProvider = "anthropic" | "codex";
+/**
+ * Test-only replacement for the token store behind the account-exposing
+ * routes. The token store is a module singleton bound to the real home at
+ * import, so a suite cannot redirect it; this lets a case state which logins
+ * exist (`knownKeys`, including disabled ones) and which are routable per
+ * engine, exactly as the real listers would answer.
+ */
+export type ProxyAccountDirectoryOverride = {
+    knownKeys: Set<string>;
+    anthropic: ProxyPassthroughAccount[];
+    codex: ProxyPassthroughAccount[];
+};
 /** Response body of the proxy's GET /limits endpoint. */
 export type ProxyLimitsRefreshResponse = {
     fetchedAt: number;

package/dist/types/proxyClient.d.ts

@@ -141,10 +141,21 @@ export type CliClientUsageTotals = {
 };
 /** One row of GET /accounts. */
 export type CliAccountsRow = {
-    /** Bare label, e.g. "someone@example.com". The join key across all sources. */
+    /**
+     * Bare label, e.g. "someone@example.com". Display only: two rows can share
+     * it when one email is logged in to both engines. `key` is the identity.
+     */
     label: string;
-    /** Full pool key, e.g. "anthropic:someone@example.com". */
+    /**
+     * Full pool key, e.g. "anthropic:someone@example.com" or
+     * "codex:someone@example.com". Null only for plumbing rows.
+     */
     key: string | null;
+    /**
+     * Which pool engine owns this login. Absent on plumbing rows. Consumers
+     * that key a list by row must key by `key`, not `label` — see above.
+     */
+    provider?: "anthropic" | "codex";
     /**
      * What this row actually is. Only "account" rows are real logins; the proxy
      * also tracks internal and translation pseudo-accounts, which have no quota
@@ -183,6 +194,13 @@ export type CliAccountsResponse = {
 /** One request as recorded in the proxy request log, reduced to what costing needs. */
 export type ProxyLedgerEntry = {
     account: string;
+    /**
+     * Provider-qualified identity, "anthropic:<label>" or "codex:<label>".
+     * Read from the log row when present; derived from `accountType` for rows
+     * written before the pool logged it. This, not `account`, is the join key:
+     * one email can be logged in to both engines.
+     */
+    accountKey: string;
     /** Derived calling CLI; see CliAccountUsageTotals.byClient. */
     clientApp: string;
     accountType: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@juspay/neurolink",
-  "version": "12.9.2",
+  "version": "12.9.4",
   "packageManager": "pnpm@10.15.1",
   "description": "TypeScript AI SDK with 24+ LLM providers behind one consistent API. MCP-native (connect any MCP server), voice TTS/STT/realtime, RAG, agents, memory, context compaction. OpenAI · Anthropic · Gemini · Bedrock · Azure · Ollama · DeepSeek · NVIDIA NIM and more.",
   "author": {
@@ -138,6 +138,7 @@
     "test:local-usage": "pnpm exec tsx test/continuous-test-suite-local-usage.ts",
     "test:dynamic": "pnpm exec tsx test/continuous-test-suite-dynamic.ts",
     "test:proxy": "pnpm exec tsx test/continuous-test-suite-proxy.ts",
+    "test:proxy-connect-retry": "pnpm exec tsx test/continuous-test-suite-proxy-connect-retry.ts",
     "test:codex": "pnpm exec tsx test/continuous-test-suite-codex.ts",
     "test:bugfixes": "pnpm exec tsx test/continuous-test-suite-bugfixes.ts",
     "test:json-e2e": "pnpm exec tsx test/continuous-test-suite-json-e2e.ts",