@remodex/rmx 1.0.2

package/src/codex/prompt-lock.ts

@@ -0,0 +1,143 @@
+/**
+ * prompt-lock.ts — advisory cross-process lock for prompt-layer mutations.
+ *
+ * An in-process mutex only serialises browser tabs behind one service. A CLI
+ * invocation, a second service, or a stale process can all reach the same
+ * files, so the lock lives on disk.
+ *
+ * STALE TAKEOVER IS A RENAME, NOT AN UNLINK. Naive breaking is racy: A judges
+ * the lock stale, B removes it and acquires its own, then A unlinks *B's live
+ * lock* and both proceed. Unlinking a path you did not verify is the bug. Here
+ * the contender renames the observed stale lock to a token-quarantined name —
+ * an atomic operation exactly one contender can win — and only the winner
+ * creates the real lock.
+ *
+ * RELEASE ONLY DELETES A LOCK WHOSE TOKEN IS STILL OURS. A mismatch means we
+ * were superseded, and deleting it would hand the critical section to two
+ * writers at once.
+ *
+ * This does NOT cover Codex, which knows nothing about our lock. That residual
+ * is handled by the per-target byte checks in the write path, and the rename
+ * window itself is documented as irreducible from user space.
+ */
+import { existsSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+import { randomBytes } from "node:crypto";
+
+const FILE_MODE = 0o600;
+
+/** A lock younger than this is respected even if its pid looks gone. */
+export const STALE_AFTER_MS = 10_000;
+
+export interface LockRecord {
+  token: string;
+  pid: number;
+  acquiredAt: number;
+}
+
+export interface LockHandle {
+  path: string;
+  token: string;
+}
+
+export type AcquireResult =
+  | { ok: true; handle: LockHandle }
+  | { ok: false; error: "locked" };
+
+export interface LockDeps {
+  /** Injectable so tests can simulate a live or dead owner. */
+  isProcessAlive: (pid: number) => boolean;
+  now: () => number;
+}
+
+const defaultDeps: LockDeps = {
+  isProcessAlive: pid => {
+    try {
+      process.kill(pid, 0);
+      return true;
+    } catch (error) {
+      // EPERM means it exists but belongs to another user.
+      return (error as NodeJS.ErrnoException).code === "EPERM";
+    }
+  },
+  now: () => Date.now(),
+};
+
+function readRecord(path: string): LockRecord | null {
+  try {
+    const parsed = JSON.parse(readFileSync(path, "utf8")) as LockRecord;
+    if (typeof parsed?.token !== "string" || typeof parsed?.pid !== "number") return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+
+/** True when the holder is gone AND the lock is older than the grace window. */
+function isStale(record: LockRecord | null, deps: LockDeps): boolean {
+  if (record === null) return true; // unparseable: treat as debris
+  if (deps.isProcessAlive(record.pid)) return false;
+  return deps.now() - record.acquiredAt > STALE_AFTER_MS;
+}
+
+/**
+ * One attempt. The caller decides whether to retry — a loser must go back to
+ * re-reading the lock rather than assuming its quarantine still applies.
+ */
+export function tryAcquire(path: string, deps: LockDeps = defaultDeps): AcquireResult {
+  const token = randomBytes(8).toString("hex");
+  const record: LockRecord = { token, pid: process.pid, acquiredAt: deps.now() };
+  const body = JSON.stringify(record);
+
+  try {
+    writeFileSync(path, body, { encoding: "utf8", mode: FILE_MODE, flag: "wx" });
+    return { ok: true, handle: { path, token } };
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code !== "EEXIST") throw error;
+  }
+
+  if (!isStale(readRecord(path), deps)) return { ok: false, error: "locked" };
+
+  // Quarantine by rename: atomic, and exactly one contender wins it.
+  const quarantine = `${path}.stale-${token}`;
+  try {
+    renameSync(path, quarantine);
+  } catch {
+    // Someone else won the rename, or the owner released between our checks.
+    // Either way we do NOT touch the path — retry from the top.
+    return { ok: false, error: "locked" };
+  }
+
+  try {
+    writeFileSync(path, body, { encoding: "utf8", mode: FILE_MODE, flag: "wx" });
+  } catch (error) {
+    // A successor acquired the real lock between our rename and this create.
+    // Its lock is live and is not ours to remove.
+    try { unlinkSync(quarantine); } catch { /* debris */ }
+    if ((error as NodeJS.ErrnoException).code === "EEXIST") return { ok: false, error: "locked" };
+    throw error;
+  }
+
+  try { unlinkSync(quarantine); } catch { /* debris */ }
+  return { ok: true, handle: { path, token } };
+}
+
+/**
+ * Release. Deletes nothing unless the on-disk token is still ours; returns false
+ * when we were superseded, which the caller surfaces as `write_superseded`.
+ */
+export function release(handle: LockHandle): boolean {
+  const record = readRecord(handle.path);
+  if (record === null || record.token !== handle.token) return false;
+  try {
+    unlinkSync(handle.path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/** True when the on-disk lock is still the one this handle acquired. */
+export function stillHeld(handle: LockHandle): boolean {
+  if (!existsSync(handle.path)) return false;
+  return readRecord(handle.path)?.token === handle.token;
+}

package/src/codex/provider-adoption.ts

@@ -0,0 +1,242 @@
+import {
+  mutatePersistedConfig,
+  providerBaseUrlConfigError,
+  type PersistedConfigMutationOutcome,
+} from "../config";
+import { existsSync, readFileSync } from "node:fs";
+import { providerDestinationConfigError } from "../lib/destination-policy";
+import type { OcxConfig, OcxProviderConfig } from "../types";
+import { rootTomlString } from "./injected-marker";
+import { CODEX_CONFIG_PATH } from "./paths";
+
+/** The one external Desktop provider Remodex can adopt without guessing its wire contract. */
+export const CODEX_LB_PROVIDER_ID = "codex-lb";
+
+const ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+
+export interface CodexLbDescriptor {
+  id: typeof CODEX_LB_PROVIDER_ID;
+  baseUrl: string;
+  envKey: string;
+  wireApi: "responses";
+  requiresOpenAiAuth: boolean;
+}
+
+export type CodexLbInspection =
+  | { kind: "inactive" }
+  | { kind: "adoptable"; descriptor: CodexLbDescriptor }
+  | { kind: "refused"; reason: string };
+
+export type CodexLbAdoptionResult =
+  | { kind: "inactive" }
+  | {
+      kind: "adopted" | "already-managed";
+      descriptor: CodexLbDescriptor;
+      provider: OcxProviderConfig;
+    }
+  | { kind: "refused" | "unavailable"; reason: string };
+
+type PersistMutation = typeof mutatePersistedConfig;
+
+function plainRecord(value: unknown): Record<string, unknown> | null {
+  return value !== null && typeof value === "object" && !Array.isArray(value)
+    ? value as Record<string, unknown>
+    : null;
+}
+
+function normalizedHostname(value: string): string {
+  return value.trim().toLowerCase().replace(/^\[|\]$/g, "").replace(/\.$/, "");
+}
+
+function endpointPort(url: URL): number {
+  if (url.port) return Number(url.port);
+  return url.protocol === "https:" ? 443 : 80;
+}
+
+/**
+ * Reject a literal route back into this Remodex process. Destination policy separately rejects
+ * localhost, loopback, private, metadata, and link-local addresses; this comparison also covers a
+ * concrete hostname used as the Remodex bind target.
+ */
+function isConfiguredRemodexEndpoint(baseUrl: string, config: Readonly<OcxConfig>): boolean {
+  let url: URL;
+  try {
+    url = new URL(baseUrl);
+  } catch {
+    return false;
+  }
+  const targetHost = normalizedHostname(url.hostname);
+  const configuredHost = normalizedHostname(config.hostname ?? "127.0.0.1");
+  if (!targetHost || targetHost !== configuredHost) return false;
+  const ports = new Set([config.port ?? 10100]);
+  if (config.unauthenticatedLoopbackListener?.enabled) {
+    ports.add(config.unauthenticatedLoopbackListener.port);
+  }
+  return ports.has(endpointPort(url));
+}
+
+/**
+ * Parse only the active `codex-lb` provider from Codex Desktop's TOML. The resolved environment
+ * value is deliberately never read: Remodex stores and routes with the reference `${NAME}`.
+ */
+export function inspectActiveCodexLbProvider(
+  content: string,
+  config: Readonly<OcxConfig>,
+): CodexLbInspection {
+  if (rootTomlString(content, "model_provider") !== CODEX_LB_PROVIDER_ID) {
+    return { kind: "inactive" };
+  }
+
+  let document: Record<string, unknown>;
+  try {
+    document = plainRecord(Bun.TOML.parse(content.replace(/^\uFEFF/, ""))) ?? {};
+  } catch {
+    return { kind: "refused", reason: "Codex config.toml is not valid TOML" };
+  }
+  const providers = plainRecord(document.model_providers);
+  const table = plainRecord(providers?.[CODEX_LB_PROVIDER_ID]);
+  if (!table) {
+    return { kind: "refused", reason: "active codex-lb has no [model_providers.codex-lb] table" };
+  }
+
+  const baseUrl = typeof table.base_url === "string" ? table.base_url.trim().replace(/\/+$/, "") : "";
+  const wireApi = typeof table.wire_api === "string" ? table.wire_api.trim().toLowerCase() : "";
+  const envKey = typeof table.env_key === "string" ? table.env_key.trim() : "";
+  if (!baseUrl) return { kind: "refused", reason: "codex-lb base_url is missing" };
+  if (wireApi !== "responses") {
+    return { kind: "refused", reason: "codex-lb can be adopted only when wire_api is responses" };
+  }
+  if (!ENV_NAME.test(envKey)) {
+    return { kind: "refused", reason: "codex-lb env_key is missing or invalid" };
+  }
+  const baseUrlError = providerBaseUrlConfigError(baseUrl);
+  if (baseUrlError) return { kind: "refused", reason: `codex-lb ${baseUrlError}` };
+  const destinationError = providerDestinationConfigError(CODEX_LB_PROVIDER_ID, { baseUrl });
+  if (destinationError) return { kind: "refused", reason: `codex-lb ${destinationError}` };
+  if (isConfiguredRemodexEndpoint(baseUrl, config)) {
+    return { kind: "refused", reason: "codex-lb base_url points back to this Remodex server" };
+  }
+  if (table.requires_openai_auth !== undefined && typeof table.requires_openai_auth !== "boolean") {
+    return { kind: "refused", reason: "codex-lb requires_openai_auth must be a boolean" };
+  }
+
+  return {
+    kind: "adoptable",
+    descriptor: {
+      id: CODEX_LB_PROVIDER_ID,
+      baseUrl,
+      envKey,
+      wireApi: "responses",
+      requiresOpenAiAuth: table.requires_openai_auth === true,
+    },
+  };
+}
+
+export function providerForCodexLb(descriptor: CodexLbDescriptor): OcxProviderConfig {
+  return {
+    adapter: "openai-responses",
+    baseUrl: descriptor.baseUrl,
+    responsesPath: "/responses",
+    authMode: "key",
+    apiKey: `\${${descriptor.envKey}}`,
+    liveModels: true,
+    note: "Imported automatically from Codex Desktop's codex-lb provider.",
+  };
+}
+
+function sameEndpoint(left: string, right: string): boolean {
+  return left.trim().replace(/\/+$/, "") === right.trim().replace(/\/+$/, "");
+}
+
+function mergeManagedProvider(
+  existing: OcxProviderConfig | undefined,
+  expected: OcxProviderConfig,
+): { kind: "changed" | "unchanged"; provider: OcxProviderConfig } | { kind: "conflict" } {
+  if (!existing) return { kind: "changed", provider: expected };
+  if (
+    existing.adapter !== "openai-responses"
+    || !sameEndpoint(existing.baseUrl, expected.baseUrl)
+    || (existing.responsesPath !== undefined && existing.responsesPath !== "/responses")
+    || (existing.authMode !== undefined && existing.authMode !== "key")
+  ) {
+    return { kind: "conflict" };
+  }
+
+  // A user-managed credential already attached to the exact same upstream wins. Otherwise retain
+  // the environment reference imported from Codex Desktop. Never resolve or copy the env value.
+  const provider: OcxProviderConfig = {
+    ...existing,
+    responsesPath: existing.responsesPath ?? "/responses",
+    authMode: existing.authMode ?? "key",
+    apiKey: existing.apiKey?.trim() ? existing.apiKey : expected.apiKey,
+  };
+  const changed = JSON.stringify(provider) !== JSON.stringify(existing);
+  return { kind: changed ? "changed" : "unchanged", provider };
+}
+
+/**
+ * Import an active Codex Desktop codex-lb descriptor into the protected Remodex config. The
+ * mutation rebases under the shared config lock, so a concurrent provider edit is never silently
+ * overwritten. The caller's live config is updated only after a committed/unchanged result.
+ */
+export function adoptActiveCodexLbProvider(
+  content: string,
+  config: OcxConfig,
+  mutate: PersistMutation = mutatePersistedConfig,
+): CodexLbAdoptionResult {
+  const inspection = inspectActiveCodexLbProvider(content, config);
+  if (inspection.kind !== "adoptable") return inspection;
+  const expected = providerForCodexLb(inspection.descriptor);
+  type MutationValue =
+    | { kind: "managed"; provider: OcxProviderConfig; changed: boolean }
+    | { kind: "conflict" };
+  const outcome: PersistedConfigMutationOutcome<MutationValue> = mutate<MutationValue>((persisted) => {
+    const merged = mergeManagedProvider(persisted.providers[CODEX_LB_PROVIDER_ID], expected);
+    if (merged.kind === "conflict") {
+      return { changed: false, value: { kind: "conflict" } };
+    }
+    if (merged.kind === "changed") persisted.providers[CODEX_LB_PROVIDER_ID] = merged.provider;
+    return {
+      changed: merged.kind === "changed",
+      value: { kind: "managed", provider: merged.provider, changed: merged.kind === "changed" },
+    };
+  });
+
+  if (outcome.status === "unavailable") {
+    return { kind: "unavailable", reason: `Remodex provider config is ${outcome.reason}` };
+  }
+  if (outcome.value.kind === "conflict") {
+    return {
+      kind: "refused",
+      reason: "Remodex already has an incompatible codex-lb provider; it was not overwritten",
+    };
+  }
+  config.providers[CODEX_LB_PROVIDER_ID] = structuredClone(outcome.value.provider);
+  return {
+    kind: outcome.status === "committed" && outcome.value.changed ? "adopted" : "already-managed",
+    descriptor: inspection.descriptor,
+    provider: outcome.value.provider,
+  };
+}
+
+export function adoptCurrentCodexLbProvider(
+  config: OcxConfig,
+  mutate: PersistMutation = mutatePersistedConfig,
+): CodexLbAdoptionResult {
+  if (!existsSync(CODEX_CONFIG_PATH)) return { kind: "inactive" };
+  return adoptActiveCodexLbProvider(readFileSync(CODEX_CONFIG_PATH, "utf8"), config, mutate);
+}
+
+/** Read-only admission predicate: true only when the active Desktop descriptor is already managed. */
+export function isManagedActiveCodexLbProvider(
+  content: string,
+  config: Readonly<OcxConfig>,
+): boolean {
+  const inspection = inspectActiveCodexLbProvider(content, config);
+  if (inspection.kind !== "adoptable") return false;
+  const merged = mergeManagedProvider(
+    config.providers[CODEX_LB_PROVIDER_ID],
+    providerForCodexLb(inspection.descriptor),
+  );
+  return merged.kind !== "conflict" && merged.kind === "unchanged";
+}

package/src/codex/quota-rejection.ts

@@ -0,0 +1,224 @@
+import { readBoundedResponseBody } from "../lib/bounded-body";
+
+const RESET_ELIGIBLE_CODE_VALUES = [
+  "usage_limit_exceeded",
+  "insufficient_quota",
+] as const;
+
+export type CodexResetEligibleExhaustionCode =
+  (typeof RESET_ELIGIBLE_CODE_VALUES)[number];
+
+export type CodexPreStreamRejectionKind =
+  | "reset-eligible-exhaustion"
+  | "generic-rate-limit"
+  | "unverified-billing-or-quota"
+  | "transient-server-error"
+  | "authentication-error"
+  | "permission-error"
+  | "other";
+
+export interface CodexPreStreamRejection {
+  kind: CodexPreStreamRejectionKind;
+  status: number;
+  alternateRetryEligible: boolean;
+  resetCreditEligible: boolean;
+  semanticCode?: CodexResetEligibleExhaustionCode;
+}
+
+const RESET_ELIGIBLE_CODES: ReadonlySet<string> = new Set(RESET_ELIGIBLE_CODE_VALUES);
+
+const TRANSIENT_SERVER_STATUSES = new Set([500, 502, 503, 504, 520, 521, 522]);
+const JSON_NUMBER_PATTERN = /-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?/y;
+
+function rejection(
+  status: number,
+  kind: CodexPreStreamRejectionKind,
+  options: {
+    alternateRetryEligible?: boolean;
+    semanticCode?: CodexResetEligibleExhaustionCode;
+  } = {},
+): CodexPreStreamRejection {
+  return {
+    kind,
+    status,
+    alternateRetryEligible: options.alternateRetryEligible === true,
+    resetCreditEligible: options.semanticCode !== undefined,
+    ...(options.semanticCode ? { semanticCode: options.semanticCode } : {}),
+  };
+}
+
+function hasOwnField(container: Record<string, unknown>, field: string): boolean {
+  return Object.prototype.hasOwnProperty.call(container, field);
+}
+
+type JsonScanResult = {
+  next: number;
+  duplicate: boolean;
+};
+
+function skipJsonWhitespace(text: string, index: number): number {
+  while (index < text.length && /[\t\n\r ]/.test(text[index] ?? "")) index += 1;
+  return index;
+}
+
+function scanJsonStringEnd(text: string, index: number): number {
+  if (text[index] !== '"') throw new SyntaxError("expected JSON string");
+  for (let cursor = index + 1; cursor < text.length; cursor += 1) {
+    const char = text[cursor];
+    if (char === '"') return cursor + 1;
+    if (char === "\\") cursor += 1;
+  }
+  throw new SyntaxError("unterminated JSON string");
+}
+
+function scanJsonValue(text: string, index: number): JsonScanResult {
+  const start = skipJsonWhitespace(text, index);
+  if (text[start] === "{") return scanJsonObject(text, start);
+  if (text[start] === "[") return scanJsonArray(text, start);
+  if (text[start] === '"') return { next: scanJsonStringEnd(text, start), duplicate: false };
+
+  for (const literal of ["true", "false", "null"]) {
+    if (text.startsWith(literal, start)) {
+      return { next: start + literal.length, duplicate: false };
+    }
+  }
+  JSON_NUMBER_PATTERN.lastIndex = start;
+  const number = JSON_NUMBER_PATTERN.exec(text);
+  if (!number) throw new SyntaxError("expected JSON value");
+  return { next: start + number[0].length, duplicate: false };
+}
+
+function scanJsonObject(text: string, index: number): JsonScanResult {
+  const keys = new Set<string>();
+  let duplicate = false;
+  let cursor = skipJsonWhitespace(text, index + 1);
+  if (text[cursor] === "}") return { next: cursor + 1, duplicate: false };
+
+  while (cursor < text.length) {
+    const keyEnd = scanJsonStringEnd(text, cursor);
+    const key = JSON.parse(text.slice(cursor, keyEnd)) as unknown;
+    if (typeof key !== "string") throw new SyntaxError("invalid JSON object key");
+    if (keys.has(key)) duplicate = true;
+    keys.add(key);
+
+    cursor = skipJsonWhitespace(text, keyEnd);
+    if (text[cursor] !== ":") throw new SyntaxError("expected JSON object colon");
+    const value = scanJsonValue(text, cursor + 1);
+    duplicate ||= value.duplicate;
+    cursor = skipJsonWhitespace(text, value.next);
+    if (text[cursor] === "}") return { next: cursor + 1, duplicate };
+    if (text[cursor] !== ",") throw new SyntaxError("expected JSON object separator");
+    cursor = skipJsonWhitespace(text, cursor + 1);
+  }
+  throw new SyntaxError("unterminated JSON object");
+}
+
+function scanJsonArray(text: string, index: number): JsonScanResult {
+  let duplicate = false;
+  let cursor = skipJsonWhitespace(text, index + 1);
+  if (text[cursor] === "]") return { next: cursor + 1, duplicate: false };
+
+  while (cursor < text.length) {
+    const value = scanJsonValue(text, cursor);
+    duplicate ||= value.duplicate;
+    cursor = skipJsonWhitespace(text, value.next);
+    if (text[cursor] === "]") return { next: cursor + 1, duplicate };
+    if (text[cursor] !== ",") throw new SyntaxError("expected JSON array separator");
+    cursor = skipJsonWhitespace(text, cursor + 1);
+  }
+  throw new SyntaxError("unterminated JSON array");
+}
+
+function isUnsafeJsonDocument(text: string): boolean {
+  try {
+    const result = scanJsonValue(text, 0);
+    return result.duplicate || skipJsonWhitespace(text, result.next) !== text.length;
+  } catch {
+    // Scanner disagreement is untrusted input, just like JSON.parse failure.
+    return true;
+  }
+}
+
+function exactResetEligibleCode(
+  container: Record<string, unknown>,
+): CodexResetEligibleExhaustionCode | undefined {
+  const hasCode = hasOwnField(container, "code");
+  const hasType = hasOwnField(container, "type");
+  if (!hasCode && !hasType) return undefined;
+
+  const code = hasCode ? container.code : undefined;
+  const type = hasType ? container.type : undefined;
+  if ((hasCode && typeof code !== "string") || (hasType && typeof type !== "string")) {
+    return undefined;
+  }
+  if (hasCode && hasType && code !== type) return undefined;
+
+  const value = hasCode ? code : type;
+  if (typeof value !== "string") return undefined;
+  return RESET_ELIGIBLE_CODES.has(value as CodexResetEligibleExhaustionCode)
+    ? value as CodexResetEligibleExhaustionCode
+    : undefined;
+}
+
+function structuredResetEligibleCode(payload: unknown): CodexResetEligibleExhaustionCode | undefined {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) return undefined;
+  const root = payload as Record<string, unknown>;
+  const hasRootDiscriminator = hasOwnField(root, "code") || hasOwnField(root, "type");
+
+  if (!hasOwnField(root, "error")) return exactResetEligibleCode(root);
+  if (hasRootDiscriminator) return undefined;
+
+  const nested = root.error;
+  if (!nested || typeof nested !== "object" || Array.isArray(nested)) return undefined;
+  return exactResetEligibleCode(nested as Record<string, unknown>);
+}
+
+async function resetEligibleCodeFromResponse(
+  response: Response,
+  signal?: AbortSignal,
+): Promise<CodexResetEligibleExhaustionCode | undefined> {
+  try {
+    const body = await readBoundedResponseBody(response.clone(), { signal, fatalUtf8: true });
+    if (!body.displaySafe || body.truncated || !body.text.trim()) return undefined;
+    const payload = JSON.parse(body.text) as unknown;
+    // JSON.parse silently keeps the last duplicate key, making contradictory
+    // payloads order-dependent. Reject any duplicate at any object depth.
+    if (isUnsafeJsonDocument(body.text)) return undefined;
+    return structuredResetEligibleCode(payload);
+  } catch {
+    // Classification must fail closed. A malformed, oversized, consumed, or
+    // cancelled body cannot authorize an irreversible reset-credit operation.
+    return undefined;
+  }
+}
+
+/**
+ * Classify an upstream Codex rejection before any response event is exposed.
+ *
+ * Only an exact structured exhaustion code on HTTP 429/402 is reset-eligible.
+ * Status alone and message text are intentionally insufficient. The broad
+ * alternate-account retry remains eligible for 429/402 to preserve #584.
+ */
+export async function classifyCodexPreStreamRejection(
+  response: Response,
+  options: { signal?: AbortSignal } = {},
+): Promise<CodexPreStreamRejection> {
+  const status = response.status;
+  if (status === 401) return rejection(status, "authentication-error");
+  if (status === 403) return rejection(status, "permission-error");
+  if (TRANSIENT_SERVER_STATUSES.has(status)) return rejection(status, "transient-server-error");
+  if (status !== 429 && status !== 402) return rejection(status, "other");
+
+  const semanticCode = await resetEligibleCodeFromResponse(response, options.signal);
+  if (semanticCode) {
+    return rejection(status, "reset-eligible-exhaustion", {
+      alternateRetryEligible: true,
+      semanticCode,
+    });
+  }
+  return rejection(
+    status,
+    status === 429 ? "generic-rate-limit" : "unverified-billing-or-quota",
+    { alternateRetryEligible: true },
+  );
+}