@pure01fx/dsh-openai-codex-auth 0.8.0 → 0.10.0

package/lib/index.js

@@ -14,6 +14,9 @@ export { CODEX_PROVIDER, NATIVE_CODEX_PROVIDER } from './native-adapter.js';
 import { NativeCodexCatalog } from './catalog.js';
 import { NativeCodexHttpTransport } from './native-http.js';
 import { NativeCodexWebSocketTransport } from './native-websocket.js';
+import { NativeCodexCloudClient } from './cloud-http.js';
+import { registerCodexImageTools } from './cloud-tools.js';
+import { registerCodexWeb } from './cloud-web-tool.js';
 import { mergeDirectUsage, normalizeUsage } from './usage.js';
 export { normalizeUsage } from './usage.js';
 export { CODEX_CLIENT_VERSION, TRACKED_CODEX_COMMIT, TRACKED_CODEX_RELEASE, TRACKED_CODEX_REPOSITORY, } from './upstream.js';
@@ -39,6 +42,10 @@ const TOKEN_REF = credentialRef('DSH_OPENAI_CODEX_TOKEN');
 const USAGE_URL = 'https://chatgpt.com/backend-api/wham/usage';
 const MAX_ERROR_BODY_LENGTH = 1_024;
 const MAX_REQUEST_BODY_LENGTH = 8_192;
+const ACCOUNT_USAGE_REQUEST_TIMEOUT_MS = 10_000;
+const TOKEN_REFRESH_REQUEST_TIMEOUT_MS = 30_000;
+const ACCOUNT_REFRESH_LOCK_WAIT_MS = 35_000;
+const CREDENTIAL_REFRESH_PERSIST_WAIT_MS = 500;
 class DeviceCodeUnavailableError extends Error {
     code = 'device_code_unavailable';
 }
@@ -48,12 +55,30 @@ class CredentialNotWritableError extends Error {
 }
 class AccountNotFoundError extends Error {
 }
+class CredentialRefreshUncertainError extends Error {
+    constructor(cause) {
+        super('OpenAI credential refresh outcome is uncertain; sign in to this account again', { cause });
+    }
+}
 const PERMANENT_REFRESH_CODES = new Set([
     'refresh_token_expired',
     'refresh_token_reused',
     'refresh_token_invalidated',
     'invalid_grant',
 ]);
+const DEFINITIVE_OAUTH_REFRESH_CODES = new Set([
+    ...PERMANENT_REFRESH_CODES,
+    'access_denied',
+    'invalid_client',
+    'invalid_request',
+    'invalid_scope',
+    'server_error',
+    'slow_down',
+    'temporarily_unavailable',
+    'temporary_failure',
+    'unauthorized_client',
+    'unsupported_grant_type',
+]);
 class OAuthEndpointError extends Error {
     status;
     oauthCode;
@@ -70,6 +95,33 @@ function base64Url(value) {
 function messageOf(error) {
     return error instanceof Error ? error.message : String(error);
 }
+function isTimeoutAbort(signal) {
+    return signal?.aborted === true
+        && signal.reason instanceof DOMException
+        && signal.reason.name === 'TimeoutError';
+}
+function boundedAccountUsageSignal(signal) {
+    const timeout = AbortSignal.timeout(ACCOUNT_USAGE_REQUEST_TIMEOUT_MS);
+    return signal === undefined ? timeout : AbortSignal.any([signal, timeout]);
+}
+function isFileLockTimeout(error) {
+    return error instanceof Error
+        && error.message.startsWith('atomic-write: timed out waiting for the writer lock at ');
+}
+function waitForSignal(promise, signal) {
+    if (signal === undefined)
+        return promise;
+    if (signal.aborted)
+        return Promise.reject(signal.reason instanceof Error ? signal.reason : new Error('Request cancelled'));
+    return new Promise((resolveWait, rejectWait) => {
+        const onAbort = () => {
+            signal.removeEventListener('abort', onAbort);
+            rejectWait(signal.reason instanceof Error ? signal.reason : new Error('Request cancelled'));
+        };
+        signal.addEventListener('abort', onAbort, { once: true });
+        promise.then((value) => { signal.removeEventListener('abort', onAbort); resolveWait(value); }, (error) => { signal.removeEventListener('abort', onAbort); rejectWait(error); });
+    });
+}
 function throwIfCancelled(signal) {
     if (!signal?.aborted)
         return;
@@ -143,6 +195,12 @@ function isPermanentRefreshError(error) {
         && (error.status === 401
             || (error.oauthCode !== undefined && PERMANENT_REFRESH_CODES.has(error.oauthCode.toLowerCase())));
 }
+function isDefinitiveOAuthRefreshError(error) {
+    return error instanceof OAuthEndpointError
+        && (error.status === 400 || error.status === 401)
+        && error.oauthCode !== undefined
+        && DEFINITIVE_OAUTH_REFRESH_CODES.has(error.oauthCode.toLowerCase());
+}
 function validateCredential(value, filename) {
     const credential = value;
     if (credential === null || typeof credential !== 'object'
@@ -258,7 +316,7 @@ async function tokenRequest(init, previous, signal) {
     }
     catch (error) {
         if (signal?.aborted)
-            throw new Error('OpenAI login cancelled');
+            throw new Error(isTimeoutAbort(signal) ? 'OpenAI token request timed out' : 'OpenAI login cancelled');
         throw error;
     }
     if (!response.ok) {
@@ -643,6 +701,17 @@ export class OpenAICodexAuth extends Service {
         nativeAdapter: z.boolean().default(true),
         nativeCompatibilityRoute: z.boolean().default(false),
         nativeWebSocket: z.boolean().default(true),
+        cloudTools: z.object({
+            enabled: z.boolean().default(true),
+            search: z.boolean().default(true),
+            imageGeneration: z.boolean().default(true),
+            imageEditing: z.boolean().default(true),
+            imageInspection: z.boolean().default(true),
+            searchModel: z.string(), visionModel: z.string(),
+            imageModel: z.string().default('gpt-image-2'),
+            searchMode: z.union([z.const('cached'), z.const('indexed'), z.const('live')]).default('live'),
+            visionDetail: z.union([z.const('auto'), z.const('low'), z.const('high'), z.const('original')]).default('auto'),
+        }),
     });
     static inject = ['credentials', 'webServer', 'webRuntime'];
     filename;
@@ -655,6 +724,8 @@ export class OpenAICodexAuth extends Service {
     usageError;
     usageRefresh;
     usageGeneration = 0;
+    accountUsageRequestGeneration = 0;
+    accountUsageCredentialRefreshes = new Map();
     directUsageSequence = 0;
     directUsageAccountId;
     usageHasDirectDefault = false;
@@ -671,29 +742,29 @@ export class OpenAICodexAuth extends Service {
             nativeCompatibilityRoute: config.nativeCompatibilityRoute ?? false,
             nativeWebSocket: config.nativeWebSocket ?? true,
         };
+        const catalog = new NativeCodexCatalog({
+            resolveCredential: signal => this.resolveNativeCredential(signal),
+            warn: message => { ctx.logger.warn(message); },
+        });
+        const transportOptions = {
+            resolveCredential: signal => this.resolveNativeCredential(signal),
+            recoverCredential: (previous, signal) => this.recoverNativeCredential(previous, signal),
+            readImage: async (attachment, signal) => {
+                const store = ctx.get('attachments');
+                if (store === undefined) {
+                    throw new LlmError('native Codex image input requires the attachment service', 'UNSUPPORTED');
+                }
+                return store.readImage(attachment, signal);
+            },
+            onRateLimits: observation => {
+                this.acceptRateLimits(observation.accountId, observation.updates);
+            },
+            onResponseUsage: observation => {
+                this.acceptResponseUsage(observation);
+            },
+            warn: message => { ctx.logger.warn(message); },
+        };
         if (this.routeConfig.nativeAdapter) {
-            const catalog = new NativeCodexCatalog({
-                resolveCredential: signal => this.resolveNativeCredential(signal),
-                warn: message => { ctx.logger.warn(message); },
-            });
-            const transportOptions = {
-                resolveCredential: signal => this.resolveNativeCredential(signal),
-                recoverCredential: (previous, signal) => this.recoverNativeCredential(previous, signal),
-                readImage: async (attachment, signal) => {
-                    const store = ctx.get('attachments');
-                    if (store === undefined) {
-                        throw new LlmError('native Codex image input requires the attachment service', 'UNSUPPORTED');
-                    }
-                    return store.readImage(attachment, signal);
-                },
-                onRateLimits: observation => {
-                    this.acceptRateLimits(observation.accountId, observation.updates);
-                },
-                onResponseUsage: observation => {
-                    this.acceptResponseUsage(observation);
-                },
-                warn: message => { ctx.logger.warn(message); },
-            };
             const transport = this.routeConfig.nativeWebSocket
                 ? new NativeCodexWebSocketTransport(transportOptions)
                 : new NativeCodexHttpTransport(transportOptions);
@@ -707,6 +778,15 @@ export class OpenAICodexAuth extends Service {
                 ], new NativeCodexAdapter(catalog, transport));
             });
         }
+        if (config.cloudTools?.enabled !== false) {
+            const cloudClient = new NativeCodexCloudClient(transportOptions);
+            ctx.inject(['tools'], toolCtx => {
+                const cloudConfig = config.cloudTools ?? {};
+                if (cloudConfig.search !== false)
+                    registerCodexWeb(toolCtx, { client: cloudClient, catalog, config: cloudConfig });
+                registerCodexImageTools(toolCtx, { client: cloudClient, catalog, transport: transportOptions, config: cloudConfig });
+            });
+        }
         ctx.effect(async () => {
             try {
                 await this.bearerToken();
@@ -755,6 +835,7 @@ export class OpenAICodexAuth extends Service {
                 register('/openai-codex/browser/complete', (req, res) => this.handleBrowserComplete(req, res));
                 register('/openai-codex/cancel', (req, res) => this.handleCancel(req, res));
                 register('/openai-codex/accounts/current', (req, res) => this.handleSetCurrentAccount(req, res));
+                register('/openai-codex/accounts/usage', (req, res) => this.handleAccountUsage(req, res));
                 register('/openai-codex/accounts/logout', (req, res) => this.handleAccountLogout(req, res));
                 register('/openai-codex/logout', (req, res) => this.handleLogout(req, res));
             }
@@ -800,7 +881,7 @@ export class OpenAICodexAuth extends Service {
             return;
         this.responseUsage = {
             accountId: observation.accountId,
-            amount: observation.metadata.amount,
+            metadata: observation.metadata,
             observedAt: Date.now(),
         };
     }
@@ -821,8 +902,7 @@ export class OpenAICodexAuth extends Service {
         const sameUsageAccount = this.usageAccountId === accountId;
         if (!sameUsageAccount)
             this.usageHasDirectDefault = false;
-        if (hasDefaultQuota)
-            this.usageGeneration += 1;
+        this.usageGeneration += 1;
         this.usageCache = mergeDirectUsage(sameUsageAccount ? this.usageCache : undefined, accepted);
         this.usageAccountId = accountId;
         this.usageError = undefined;
@@ -855,7 +935,7 @@ export class OpenAICodexAuth extends Service {
     }
     async performUsageRefresh(generation) {
         try {
-            const credential = await withFileLock(this.filename, () => this.resolveManagedCredentialLocked());
+            const credential = await this.managedCredential();
             if (credential === undefined) {
                 if (this.usageGeneration === generation) {
                     this.usageCache = undefined;
@@ -1004,56 +1084,73 @@ export class OpenAICodexAuth extends Service {
         const document = parsed?.document ?? { version: 2, currentAccountId: null, accounts: [] };
         await this.commitDocument(this.upsertCurrentCredential(document, credential));
     }
-    async resolveManagedCredentialLocked(signal) {
-        throwIfCancelled(signal);
-        const parsed = await readCredentialDocument(this.filename);
-        const document = parsed?.document;
-        const current = currentCredential(document);
+    /** Return the current managed bearer token, refreshing and migrating it when needed. */
+    async bearerToken(signal) {
         throwIfCancelled(signal);
-        if (current === undefined) {
-            this.setCredentialAccount(undefined);
-            return undefined;
-        }
-        if (current.expires > Date.now() + TOKEN_REFRESH_PREEMPT_MS) {
-            if (parsed?.migrated)
-                await this.commitDocument(document, signal);
-            else
-                await this.publishCredentialToken(current.access, signal);
-            this.setCredentialAccount(current.accountId);
-            return current;
-        }
-        await this.assertCredentialWritable();
-        let next;
-        try {
-            next = await refreshToken(current, signal);
-        }
-        catch (error) {
-            throwIfCancelled(signal);
-            if (!isPermanentRefreshError(error) && current.expires > Date.now()) {
+        while (true) {
+            const prepared = await withFileLock(this.filename, async () => {
+                throwIfCancelled(signal);
+                const parsed = await readCredentialDocument(this.filename);
+                const document = parsed?.document;
+                const current = currentCredential(document);
+                if (current === undefined) {
+                    this.setCredentialAccount(undefined);
+                    return undefined;
+                }
+                if (current.expires > Date.now() + TOKEN_REFRESH_PREEMPT_MS) {
+                    if (parsed?.migrated)
+                        await this.commitDocument(document, signal);
+                    else
+                        await this.publishCredentialToken(current.access, signal);
+                    this.setCredentialAccount(current.accountId);
+                    return { credential: current, ready: true };
+                }
+                return { credential: current, ready: false };
+            });
+            if (prepared === undefined)
+                return undefined;
+            if (prepared.ready)
+                return prepared.credential.access;
+            let refreshed;
+            try {
+                refreshed = await waitForSignal(this.refreshManagedAccount(prepared.credential, true), signal);
+            }
+            catch (error) {
+                throwIfCancelled(signal);
+                throw error;
+            }
+            if (refreshed === undefined)
+                continue;
+            const access = await withFileLock(this.filename, async () => {
+                throwIfCancelled(signal);
+                const parsed = await readCredentialDocument(this.filename);
+                const document = parsed?.document;
+                const current = currentCredential(document);
+                if (current === undefined || current.accountId !== prepared.credential.accountId)
+                    return undefined;
+                if (current.expires <= Date.now())
+                    throw new Error('OpenAI Codex access token has expired');
                 if (parsed?.migrated)
                     await this.commitDocument(document, signal);
                 else
                     await this.publishCredentialToken(current.access, signal);
                 this.setCredentialAccount(current.accountId);
-                return current;
-            }
-            throw error;
-        }
-        throwIfCancelled(signal);
-        if (next.accountId !== current.accountId) {
-            throw new Error('OpenAI refresh changed the ChatGPT account identity');
+                return current.access;
+            });
+            if (access !== undefined)
+                return access;
         }
-        await this.commitDocument(this.upsertCurrentCredential(document, next, current.accountId), signal);
-        this.setCredentialAccount(next.accountId);
-        return next;
     }
-    /** Return the current managed bearer token, refreshing and migrating it when needed. */
-    async bearerToken(signal) {
-        throwIfCancelled(signal);
-        return withFileLock(this.filename, async () => {
-            const credential = await this.resolveManagedCredentialLocked(signal);
-            return credential?.access;
-        });
+    async managedCredential(signal) {
+        while (true) {
+            const access = await this.bearerToken(signal);
+            if (access === undefined)
+                return undefined;
+            const current = currentCredential((await readCredentialDocument(this.filename))?.document);
+            if (current?.access === access)
+                return current;
+            throwIfCancelled(signal);
+        }
     }
     externalNativeCredential(accessToken) {
         let accountId;
@@ -1073,23 +1170,20 @@ export class OpenAICodexAuth extends Service {
     async resolveNativeCredential(signal) {
         try {
             throwIfCancelled(signal);
-            return await withFileLock(this.filename, async () => {
-                throwIfCancelled(signal);
-                const managed = await this.resolveManagedCredentialLocked(signal);
-                if (managed !== undefined) {
-                    throwIfCancelled(signal);
-                    return { accessToken: managed.access, accountId: managed.accountId };
-                }
-                const external = await this.ctx.credentials.resolve(TOKEN_REF);
+            const managed = await this.managedCredential(signal);
+            if (managed !== undefined) {
                 throwIfCancelled(signal);
-                if (external === undefined) {
-                    throw new LlmError('native Codex credential is not configured', 'MISSING_CREDENTIAL');
-                }
-                const credential = this.externalNativeCredential(external.value);
-                throwIfCancelled(signal);
-                this.setCredentialAccount(credential.accountId);
-                return credential;
-            });
+                return { accessToken: managed.access, accountId: managed.accountId };
+            }
+            const external = await this.ctx.credentials.resolve(TOKEN_REF);
+            throwIfCancelled(signal);
+            if (external === undefined) {
+                throw new LlmError('native Codex credential is not configured', 'MISSING_CREDENTIAL');
+            }
+            const credential = this.externalNativeCredential(external.value);
+            throwIfCancelled(signal);
+            this.setCredentialAccount(credential.accountId);
+            return credential;
         }
         catch (error) {
             if (error instanceof LlmError)
@@ -1101,9 +1195,12 @@ export class OpenAICodexAuth extends Service {
         }
     }
     nativeRecoveryError(error) {
+        const cause = error instanceof CredentialRefreshUncertainError && error.cause !== undefined
+            ? error.cause
+            : error;
         const options = {
-            cause: error,
-            ...(error instanceof OAuthEndpointError ? { status: error.status } : {}),
+            cause,
+            ...(cause instanceof OAuthEndpointError ? { status: cause.status } : {}),
         };
         if (error instanceof CredentialNotWritableError || isPermanentRefreshError(error)) {
             return new LlmError('native Codex managed credential cannot be refreshed', INVALID_CREDENTIAL_CODE, options);
@@ -1113,44 +1210,46 @@ export class OpenAICodexAuth extends Service {
     async recoverNativeCredential(previous, signal) {
         try {
             throwIfCancelled(signal);
-            return await withFileLock(this.filename, async () => {
-                throwIfCancelled(signal);
-                const parsed = await readCredentialDocument(this.filename);
-                const document = parsed?.document;
-                const current = currentCredential(document);
+            const prepared = await withFileLock(this.filename, async () => {
                 throwIfCancelled(signal);
+                const current = currentCredential((await readCredentialDocument(this.filename))?.document);
                 if (current === undefined) {
                     const external = await this.ctx.credentials.resolve(TOKEN_REF);
                     throwIfCancelled(signal);
                     if (external === undefined)
-                        return false;
+                        return { result: false };
                     const credential = this.externalNativeCredential(external.value);
                     throwIfCancelled(signal);
                     if (credential.accountId !== previous.accountId)
-                        return false;
+                        return { result: false };
                     this.setCredentialAccount(credential.accountId);
-                    return credential.accessToken !== previous.accessToken;
+                    return { result: credential.accessToken !== previous.accessToken };
                 }
                 // A request that started under A must never recover by replaying under B.
                 if (current.accountId !== previous.accountId)
-                    return false;
+                    return { result: false };
                 if (current.access !== previous.accessToken) {
                     await this.publishCredentialToken(current.access, signal);
                     throwIfCancelled(signal);
                     this.setCredentialAccount(current.accountId);
-                    return true;
+                    return { result: true };
                 }
-                await this.assertCredentialWritable();
-                throwIfCancelled(signal);
-                const next = await refreshToken(current, signal);
+                return { credential: current };
+            });
+            if (prepared.result !== undefined)
+                return prepared.result;
+            const refreshed = await waitForSignal(this.refreshManagedAccount(prepared.credential, true, true), signal);
+            if (refreshed === undefined)
+                return false;
+            return withFileLock(this.filename, async () => {
                 throwIfCancelled(signal);
-                if (next.accountId !== previous.accountId) {
-                    throw new Error('OpenAI refresh changed the ChatGPT account identity');
-                }
-                await this.commitDocument(this.upsertCurrentCredential(document, next, current.accountId), signal);
+                const current = currentCredential((await readCredentialDocument(this.filename))?.document);
+                if (current === undefined || current.accountId !== previous.accountId)
+                    return false;
+                await this.publishCredentialToken(current.access, signal);
                 throwIfCancelled(signal);
-                this.setCredentialAccount(next.accountId);
-                return next.access !== previous.accessToken;
+                this.setCredentialAccount(current.accountId);
+                return current.access !== previous.accessToken;
             });
         }
         catch (error) {
@@ -1165,18 +1264,22 @@ export class OpenAICodexAuth extends Service {
     async finishCredential(credential, signal) {
         await this.assertCredentialWritable();
         throwIfCancelled(signal);
-        await withFileLock(this.filename, async () => {
+        await this.withAccountRefreshLock(credential.accountId, async () => {
             throwIfCancelled(signal);
-            await this.commitCredential(credential);
-            this.setCredentialAccount(credential.accountId);
-            this.usageGeneration += 1;
-            if (this.usageRefresh !== undefined)
-                this.usageRefresh.queued = true;
-            this.usageCache = undefined;
-            this.usageAccountId = undefined;
-            this.directUsageAccountId = undefined;
-            this.usageHasDirectDefault = false;
-            this.usageError = undefined;
+            await withFileLock(this.filename, async () => {
+                throwIfCancelled(signal);
+                await this.commitCredential(credential);
+                this.setCredentialAccount(credential.accountId);
+                this.usageGeneration += 1;
+                if (this.usageRefresh !== undefined)
+                    this.usageRefresh.queued = true;
+                this.usageCache = undefined;
+                this.usageAccountId = undefined;
+                this.directUsageAccountId = undefined;
+                this.usageHasDirectDefault = false;
+                this.usageError = undefined;
+            });
+            await this.clearAccountRefreshJournal(credential.accountId);
         });
         this.lastLoginError = undefined;
     }
@@ -1406,24 +1509,23 @@ export class OpenAICodexAuth extends Service {
         this.lastLoginError = undefined;
     }
     async setCurrentAccount(accountId) {
-        await withFileLock(this.filename, async () => {
-            const document = (await readCredentialDocument(this.filename))?.document;
-            if (document === undefined || !document.accounts.some(account => account.accountId === accountId)) {
-                throw new AccountNotFoundError('OpenAI Codex account was not found');
-            }
-            if (document.currentAccountId !== accountId) {
-                await this.assertCredentialWritable();
-                await this.commitDocument({ ...document, currentAccountId: accountId });
-            }
-            this.resetCurrentAccountState(accountId);
+        await this.withAccountRefreshLock(accountId, async () => {
+            await this.reconcileAccountRefreshJournal(accountId);
+            await withFileLock(this.filename, async () => {
+                const document = (await readCredentialDocument(this.filename))?.document;
+                if (document === undefined || !document.accounts.some(account => account.accountId === accountId)) {
+                    throw new AccountNotFoundError('OpenAI Codex account was not found');
+                }
+                if (document.currentAccountId !== accountId) {
+                    await this.assertCredentialWritable();
+                    await this.commitDocument({ ...document, currentAccountId: accountId });
+                }
+                this.resetCurrentAccountState(accountId);
+            });
         });
     }
-    async logout(accountId) {
-        if (accountId === undefined)
-            await this.cancelLogin(true);
-        let nextAccountId;
-        let removedCurrent = false;
-        await withFileLock(this.filename, async () => {
+    async logoutAttempt(accountId, expectedPromotion) {
+        return withFileLock(this.filename, async () => {
             let parsed;
             try {
                 parsed = await readCredentialDocument(this.filename);
@@ -1440,9 +1542,8 @@ export class OpenAICodexAuth extends Service {
                 catch (failure) {
                     return this.failAfterPublicationRollback(previous, undefined, failure);
                 }
-                removedCurrent = true;
                 this.resetCurrentAccountState(undefined);
-                return;
+                return true;
             }
             const document = parsed?.document;
             const target = accountId ?? document?.currentAccountId ?? undefined;
@@ -1450,22 +1551,54 @@ export class OpenAICodexAuth extends Service {
                 || !document.accounts.some(account => account.accountId === target)) {
                 if (accountId !== undefined)
                     throw new AccountNotFoundError('OpenAI Codex account was not found');
-                return;
+                return true;
             }
-            removedCurrent = document.currentAccountId === target;
+            const removedCurrent = document.currentAccountId === target;
             const targetIndex = document.accounts.findIndex(account => account.accountId === target);
             const accounts = document.accounts.filter(account => account.accountId !== target);
             const currentAccountId = removedCurrent
                 ? accounts[targetIndex]?.accountId ?? accounts[0]?.accountId ?? null
                 : document.currentAccountId;
+            const promotion = removedCurrent ? currentAccountId ?? undefined : undefined;
+            if (promotion !== expectedPromotion)
+                return false;
             if (removedCurrent)
                 await this.assertCredentialWritable();
             await this.commitDocument({ version: 2, currentAccountId, accounts });
-            nextAccountId = currentAccountId ?? undefined;
+            await this.clearAccountRefreshJournal(target);
             if (removedCurrent)
-                this.resetCurrentAccountState(nextAccountId);
+                this.resetCurrentAccountState(currentAccountId ?? undefined);
+            return true;
         });
     }
+    async logout(accountId) {
+        if (accountId === undefined)
+            await this.cancelLogin(true);
+        while (true) {
+            let target;
+            let expectedPromotion;
+            try {
+                const document = (await readCredentialDocument(this.filename))?.document;
+                target = accountId ?? document?.currentAccountId ?? undefined;
+                if (document !== undefined && target !== undefined && document.currentAccountId === target) {
+                    const targetIndex = document.accounts.findIndex(account => account.accountId === target);
+                    const accounts = document.accounts.filter(account => account.accountId !== target);
+                    expectedPromotion = accounts[targetIndex]?.accountId ?? accounts[0]?.accountId;
+                }
+            }
+            catch { }
+            const lockIds = [target, expectedPromotion].filter((value) => value !== undefined);
+            const done = lockIds.length === 0
+                ? await this.logoutAttempt(accountId, undefined)
+                : await this.withAccountRefreshLocks(lockIds, async () => {
+                    if (expectedPromotion !== undefined)
+                        await this.reconcileAccountRefreshJournal(expectedPromotion);
+                    return this.logoutAttempt(accountId, expectedPromotion);
+                });
+            if (done)
+                return;
+        }
+    }
     async status(refresh, callbackUrl) {
         let document;
         let credential;
@@ -1532,7 +1665,7 @@ export class OpenAICodexAuth extends Service {
                     ? {} : { usage: this.usageCache },
                 ...this.responseUsage === undefined || this.responseUsage.accountId !== credential.accountId
                     ? {} : { responseUsage: {
-                        amount: this.responseUsage.amount,
+                        ...this.responseUsage.metadata,
                         observedAt: this.responseUsage.observedAt,
                     } },
                 ...this.usageError === undefined ? {} : { usageError: this.usageError },
@@ -1540,16 +1673,310 @@ export class OpenAICodexAuth extends Service {
             csrf: this.csrf,
         };
     }
-    async fetchUsage(credential) {
-        const response = await fetch(USAGE_URL, {
-            redirect: 'error',
-            headers: {
-                accept: 'application/json',
-                authorization: `Bearer ${credential.access}`,
-                'chatgpt-account-id': credential.accountId,
-                'user-agent': 'dsh-openai-codex-auth/0.5.0',
-            },
+    accountRefreshJournalFilename(accountId) {
+        const key = createHash('sha256').update(accountId).digest('hex').slice(0, 24);
+        return `${this.filename}.account-${key}-refresh.json`;
+    }
+    async readAccountRefreshJournal(accountId) {
+        const filename = this.accountRefreshJournalFilename(accountId);
+        let value;
+        try {
+            value = JSON.parse(await readFile(filename, 'utf8'));
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return undefined;
+            throw error;
+        }
+        const journal = value;
+        if (journal === null || typeof journal !== 'object' || journal.version !== 1
+            || journal.accountId !== accountId || typeof journal.startedAt !== 'number'
+            || !Number.isFinite(journal.startedAt)
+            || (journal.phase !== 'pending' && journal.phase !== 'uncertain' && journal.phase !== 'refreshed')) {
+            throw new Error(`openai-codex-auth: invalid credential refresh journal ${filename}`);
+        }
+        const stored = validateCredential(journal.stored, filename);
+        if (stored.accountId !== accountId)
+            throw new Error(`openai-codex-auth: invalid credential refresh journal ${filename}`);
+        if (journal.phase === 'refreshed') {
+            const refreshed = validateCredential(journal.refreshed, filename);
+            if (refreshed.accountId !== accountId)
+                throw new Error(`openai-codex-auth: invalid credential refresh journal ${filename}`);
+            return { version: 1, accountId, startedAt: journal.startedAt, phase: 'refreshed', stored, refreshed };
+        }
+        return { version: 1, accountId, startedAt: journal.startedAt, phase: journal.phase, stored };
+    }
+    writeAccountRefreshJournal(journal) {
+        return writeFileAtomic(this.accountRefreshJournalFilename(journal.accountId), JSON.stringify(journal), { mode: 0o600 });
+    }
+    async clearAccountRefreshJournal(accountId) {
+        try {
+            await unlink(this.accountRefreshJournalFilename(accountId));
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+    }
+    async removeDeadFileLock(filename) {
+        const lockFilename = `${filename}.lock`;
+        let owner;
+        try {
+            const text = (await readFile(lockFilename, 'utf8')).trim();
+            owner = Number(text);
+            if (!Number.isSafeInteger(owner) || owner <= 0)
+                return false;
+        }
+        catch (error) {
+            return error.code === 'ENOENT';
+        }
+        try {
+            process.kill(owner, 0);
+            return false;
+        }
+        catch (error) {
+            if (error.code !== 'ESRCH')
+                return false;
+            try {
+                await unlink(lockFilename);
+                return true;
+            }
+            catch (unlinkError) {
+                return unlinkError.code === 'ENOENT';
+            }
+        }
+    }
+    async withAccountRefreshLock(accountId, operation) {
+        const filename = this.accountRefreshJournalFilename(accountId);
+        await this.removeDeadFileLock(filename);
+        for (let attempt = 0; attempt < 2; attempt += 1) {
+            try {
+                return await withFileLock(filename, operation, { waitMs: ACCOUNT_REFRESH_LOCK_WAIT_MS });
+            }
+            catch (error) {
+                if (!isFileLockTimeout(error) || attempt > 0 || !await this.removeDeadFileLock(filename))
+                    throw error;
+            }
+        }
+        throw new Error('OpenAI credential refresh lock could not be acquired');
+    }
+    withAccountRefreshLocks(accountIds, operation) {
+        const ordered = [...new Set(accountIds)].sort();
+        const acquire = (index) => index === ordered.length
+            ? operation()
+            : this.withAccountRefreshLock(ordered[index], () => acquire(index + 1));
+        return acquire(0);
+    }
+    async reconcileAccountRefreshJournal(accountId) {
+        const journal = await this.readAccountRefreshJournal(accountId);
+        if (journal === undefined)
+            return undefined;
+        const latest = (await readCredentialDocument(this.filename))?.document.accounts
+            .find(account => account.accountId === accountId);
+        if (latest === undefined
+            || latest.access !== journal.stored.access
+            || latest.refresh !== journal.stored.refresh
+            || latest.expires !== journal.stored.expires) {
+            await this.clearAccountRefreshJournal(accountId);
+            return latest;
+        }
+        if (journal.phase !== 'refreshed')
+            throw new CredentialRefreshUncertainError();
+        try {
+            const credential = await this.persistAccountUsageCredential(journal.stored, journal.refreshed);
+            await this.clearAccountRefreshJournal(accountId);
+            return credential;
+        }
+        catch (error) {
+            if (error instanceof AccountNotFoundError)
+                await this.clearAccountRefreshJournal(accountId);
+            throw error;
+        }
+    }
+    async refreshManagedAccount(stored, requireCurrent, force = false) {
+        return this.withAccountRefreshLock(stored.accountId, async () => {
+            const recovered = await this.reconcileAccountRefreshJournal(stored.accountId);
+            if (recovered !== undefined)
+                return recovered;
+            const prepared = await withFileLock(this.filename, async () => {
+                const document = (await readCredentialDocument(this.filename))?.document;
+                const latest = document?.accounts.find(account => account.accountId === stored.accountId);
+                if (document === undefined || latest === undefined)
+                    return undefined;
+                if (requireCurrent && document.currentAccountId !== latest.accountId)
+                    return undefined;
+                if (latest.access !== stored.access || latest.refresh !== stored.refresh || latest.expires !== stored.expires) {
+                    return { credential: latest, changed: true };
+                }
+                if ((force || latest.expires <= Date.now() + TOKEN_REFRESH_PREEMPT_MS)
+                    && document.currentAccountId === latest.accountId)
+                    await this.assertCredentialWritable();
+                return { credential: latest, changed: false };
+            });
+            if (prepared === undefined || prepared.changed
+                || (!force && prepared.credential.expires > Date.now() + TOKEN_REFRESH_PREEMPT_MS))
+                return prepared?.credential;
+            const credential = prepared.credential;
+            const pending = {
+                version: 1,
+                accountId: credential.accountId,
+                startedAt: Date.now(),
+                phase: 'pending',
+                stored: credential,
+            };
+            await this.writeAccountRefreshJournal(pending);
+            let refreshed;
+            try {
+                refreshed = await refreshToken(credential, AbortSignal.timeout(TOKEN_REFRESH_REQUEST_TIMEOUT_MS));
+            }
+            catch (error) {
+                if (isDefinitiveOAuthRefreshError(error)) {
+                    await this.clearAccountRefreshJournal(credential.accountId);
+                    if (!force && !isPermanentRefreshError(error) && credential.expires > Date.now())
+                        return credential;
+                    throw error;
+                }
+                await this.writeAccountRefreshJournal({ ...pending, phase: 'uncertain' });
+                throw new CredentialRefreshUncertainError(error);
+            }
+            if (refreshed.accountId !== credential.accountId) {
+                await this.writeAccountRefreshJournal({ ...pending, phase: 'uncertain' });
+                throw new Error('OpenAI refresh changed the ChatGPT account identity');
+            }
+            await this.writeAccountRefreshJournal({ ...pending, phase: 'refreshed', refreshed });
+            try {
+                const persisted = await this.persistAccountUsageCredential(credential, refreshed);
+                await this.clearAccountRefreshJournal(credential.accountId);
+                return persisted;
+            }
+            catch (error) {
+                if (error instanceof AccountNotFoundError)
+                    await this.clearAccountRefreshJournal(credential.accountId);
+                throw error;
+            }
+        });
+    }
+    async persistAccountUsageCredential(stored, refreshed) {
+        await this.removeDeadFileLock(this.filename);
+        for (let attempt = 0; attempt < 2; attempt += 1) {
+            try {
+                return await withFileLock(this.filename, async () => {
+                    const document = (await readCredentialDocument(this.filename))?.document;
+                    const latest = document?.accounts.find(account => account.accountId === stored.accountId);
+                    if (document === undefined || latest === undefined) {
+                        throw new AccountNotFoundError('OpenAI Codex account was removed while its quota was refreshing');
+                    }
+                    if (latest.access !== stored.access || latest.refresh !== stored.refresh || latest.expires !== stored.expires) {
+                        return latest;
+                    }
+                    const nextDocument = {
+                        ...document,
+                        accounts: document.accounts.map(account => account.accountId === stored.accountId ? refreshed : account),
+                    };
+                    if (document.currentAccountId === stored.accountId) {
+                        await this.assertCredentialWritable();
+                        await this.commitDocument(nextDocument);
+                    }
+                    else {
+                        await this.write(nextDocument);
+                    }
+                    return refreshed;
+                }, { waitMs: CREDENTIAL_REFRESH_PERSIST_WAIT_MS });
+            }
+            catch (error) {
+                if (!isFileLockTimeout(error) || attempt > 0 || !await this.removeDeadFileLock(this.filename))
+                    throw error;
+            }
+        }
+        throw new Error('OpenAI rotated credential could not be persisted');
+    }
+    refreshAccountUsageCredential(stored) {
+        const active = this.accountUsageCredentialRefreshes.get(stored.accountId);
+        if (active !== undefined)
+            return active;
+        const operation = this.refreshManagedAccount(stored, false).then((credential) => {
+            if (credential === undefined) {
+                throw new AccountNotFoundError('OpenAI Codex account was removed while its quota was refreshing');
+            }
+            return credential;
+        });
+        let tracked;
+        tracked = operation.finally(() => {
+            if (this.accountUsageCredentialRefreshes.get(stored.accountId) === tracked) {
+                this.accountUsageCredentialRefreshes.delete(stored.accountId);
+            }
+        });
+        this.accountUsageCredentialRefreshes.set(stored.accountId, tracked);
+        return tracked;
+    }
+    async accountUsageCredential(stored, signal) {
+        if (stored.expires > Date.now() + TOKEN_REFRESH_PREEMPT_MS)
+            return stored;
+        return waitForSignal(this.refreshAccountUsageCredential(stored), signal);
+    }
+    async accountUsages(signal) {
+        const prepared = await withFileLock(this.filename, async () => {
+            const document = (await readCredentialDocument(this.filename))?.document;
+            if (document === undefined)
+                return undefined;
+            return {
+                cacheGeneration: this.usageGeneration,
+                requestGeneration: ++this.accountUsageRequestGeneration,
+                tasks: document.accounts.map(stored => ({
+                    accountId: stored.accountId,
+                    credential: this.accountUsageCredential(stored, signal),
+                })),
+            };
         });
+        if (prepared === undefined)
+            return [];
+        const results = await Promise.all(prepared.tasks.map(async (task) => {
+            try {
+                const credential = await task.credential;
+                return {
+                    accountId: task.accountId,
+                    usage: await this.fetchUsage(credential, boundedAccountUsageSignal(signal)),
+                };
+            }
+            catch (error) {
+                return { accountId: task.accountId, error: messageOf(error) };
+            }
+        }));
+        if (!signal?.aborted) {
+            const currentAccountId = (await readCredentialDocument(this.filename))?.document.currentAccountId;
+            const current = results.find(row => row.accountId === currentAccountId);
+            if (current?.usage !== undefined
+                && this.usageGeneration === prepared.cacheGeneration
+                && this.accountUsageRequestGeneration === prepared.requestGeneration) {
+                this.usageGeneration += 1;
+                this.usageCache = current.usage;
+                this.usageAccountId = currentAccountId ?? undefined;
+                this.usageHasDirectDefault = false;
+                this.usageError = undefined;
+            }
+        }
+        return results;
+    }
+    async fetchUsage(credential, signal) {
+        let response;
+        try {
+            response = await fetch(USAGE_URL, {
+                redirect: 'error',
+                ...signal === undefined ? {} : { signal },
+                headers: {
+                    accept: 'application/json',
+                    authorization: `Bearer ${credential.access}`,
+                    'chatgpt-account-id': credential.accountId,
+                    'user-agent': 'dsh-openai-codex-auth/0.5.0',
+                },
+            });
+        }
+        catch (error) {
+            if (signal?.aborted) {
+                throw new Error(isTimeoutAbort(signal) ? 'Codex usage request timed out' : 'Codex usage request cancelled');
+            }
+            throw error;
+        }
         if (!response.ok)
             throw new Error(`Codex usage request failed (HTTP ${response.status})`);
         return normalizeUsage(await response.json());
@@ -1602,6 +2029,31 @@ export class OpenAICodexAuth extends Service {
             this.sendJson(res, 500, { error: messageOf(error) });
         }
     }
+    async handleAccountUsage(req, res) {
+        if (!this.trustedManagementRequest(req, res))
+            return;
+        if (req.method !== 'POST') {
+            this.sendJson(res, 405, { error: 'POST only' }, { allow: 'POST' });
+            return;
+        }
+        if (!this.requireCsrf(req, res))
+            return;
+        const abort = new AbortController();
+        const onAborted = () => { abort.abort(new Error('Account quota request cancelled')); };
+        const observesAbort = typeof req.once === 'function' && typeof req.off === 'function';
+        if (observesAbort)
+            req.once('aborted', onAborted);
+        try {
+            this.sendJson(res, 200, { accounts: await this.accountUsages(abort.signal) });
+        }
+        catch (error) {
+            this.sendJson(res, error instanceof CredentialNotWritableError ? 409 : 500, { error: messageOf(error) });
+        }
+        finally {
+            if (observesAbort)
+                req.off('aborted', onAborted);
+        }
+    }
     async handleDeviceStart(req, res) {
         if (!this.trustedManagementRequest(req, res))
             return;