@yansigit/opencodex 2.31.0

package/src/providers/codex-capacity.ts

@@ -0,0 +1,292 @@
+import { codexPlanKey, codexPlanValue } from "../codex/plan";
+
+export const CODEX_CONFIGURED_CAPACITY_WEIGHTS = {
+  plus: 1,
+  team: 1,
+  business: 1,
+  prolite: 5,
+  pro: 20,
+} as const;
+
+/** Match the provider-report last-good freshness bound. */
+export const CODEX_CAPACITY_MAX_QUOTA_AGE_MS = 30 * 60_000;
+
+export type CodexCapacityQuota = {
+  fiveHourPercent?: number;
+  fiveHourResetAt?: number;
+  weeklyPercent?: number;
+  weeklyResetAt?: number;
+  monthlyPercent?: number;
+  monthlyResetAt?: number;
+  customWindows?: Array<{ label: string; percent: number; resetAt?: number }>;
+  updatedAt: number;
+};
+
+export interface CodexCapacityAccount {
+  isMain: boolean;
+  active?: boolean;
+  plan?: unknown;
+  paused: boolean;
+  needsReauth?: boolean;
+  quota: CodexCapacityQuota | null;
+}
+
+export interface CodexCapacityWindowAggregation {
+  usedPercent: number;
+  includedAccounts: number;
+  excludedAccounts: number;
+  incomplete: boolean;
+  /** Internal calculation evidence; stripped from the management API response. */
+  totalWeight?: number;
+  /** Internal calculation evidence; stripped from the management API response. */
+  consumedWeight?: number;
+  /** Internal calculation evidence; stripped from the management API response. */
+  remainingWeight?: number;
+  updatedAt: number;
+  nextRecoveryAt?: number;
+  nextRecoveryPercent?: number;
+}
+
+export interface CodexCapacityAggregation {
+  kind: "capacity-weighted-v1";
+  scope: "routable-known";
+  includedAccounts: number;
+  excludedAccounts: number;
+  unknownPlanAccounts: number;
+  missingQuotaAccounts: number;
+  pausedAccounts: number;
+  reauthAccounts: number;
+  staleQuotaAccounts: number;
+  partialWindowAccounts: number;
+  incomplete: boolean;
+  presentation?: "aggregate" | "effective-account-fallback" | "coverage-only";
+  fiveHour?: CodexCapacityWindowAggregation;
+  weekly?: CodexCapacityWindowAggregation;
+  monthly?: CodexCapacityWindowAggregation;
+  customWindows?: Array<CodexCapacityWindowAggregation & { label: string }>;
+  currentAccount?: {
+    isMain: boolean;
+    plan?: string | null;
+    quota: CodexCapacityQuota | null;
+  };
+}
+
+export interface CodexCapacityResult {
+  quota: CodexCapacityQuota | null;
+  aggregation: CodexCapacityAggregation | null;
+  currentAccount?: CodexCapacityAggregation["currentAccount"];
+}
+
+type MutableWindow = {
+  totalWeight: number;
+  consumedWeight: number;
+  includedAccounts: number;
+  recoveries: Map<number, number>;
+  oldestUpdatedAt: number;
+};
+
+function configuredWeight(plan: unknown): number | undefined {
+  const normalized = codexPlanKey(plan);
+  return normalized && Object.hasOwn(CODEX_CONFIGURED_CAPACITY_WEIGHTS, normalized)
+    ? CODEX_CONFIGURED_CAPACITY_WEIGHTS[normalized as keyof typeof CODEX_CONFIGURED_CAPACITY_WEIGHTS]
+    : undefined;
+}
+
+function normalizedPercent(value: unknown): number | undefined {
+  return typeof value === "number" && Number.isFinite(value)
+    ? Math.max(0, Math.min(100, value))
+    : undefined;
+}
+
+function futureResetMs(value: unknown, now: number): number | undefined {
+  if (typeof value !== "number" || !Number.isFinite(value)) return undefined;
+  const milliseconds = value > 10_000_000_000 ? value : value * 1000;
+  return milliseconds > now ? milliseconds : undefined;
+}
+
+function hasKnownQuotaWindow(quota: CodexCapacityQuota | null): quota is CodexCapacityQuota {
+  if (!quota) return false;
+  return normalizedPercent(quota.fiveHourPercent) !== undefined
+    || normalizedPercent(quota.weeklyPercent) !== undefined
+    || normalizedPercent(quota.monthlyPercent) !== undefined
+    || !!quota.customWindows?.some(window => normalizedPercent(window.percent) !== undefined);
+}
+
+function currentQuotaForDisplay(account: CodexCapacityAccount, now: number): CodexCapacityQuota | null {
+  const quota = account.quota;
+  const fresh = !!quota
+    && Number.isFinite(quota.updatedAt)
+    && now - quota.updatedAt <= CODEX_CAPACITY_MAX_QUOTA_AGE_MS;
+  return !account.paused && !account.needsReauth && fresh && hasKnownQuotaWindow(quota) ? quota : null;
+}
+
+function addWindow(
+  windows: Map<string, MutableWindow>,
+  key: string,
+  weight: number,
+  percent: number,
+  resetAt: number | undefined,
+  updatedAt: number,
+): void {
+  const window = windows.get(key) ?? {
+    totalWeight: 0,
+    consumedWeight: 0,
+    includedAccounts: 0,
+    recoveries: new Map<number, number>(),
+    oldestUpdatedAt: updatedAt,
+  };
+  const consumed = weight * percent / 100;
+  window.totalWeight += weight;
+  window.consumedWeight += consumed;
+  window.includedAccounts += 1;
+  window.oldestUpdatedAt = Math.min(window.oldestUpdatedAt, updatedAt);
+  if (resetAt !== undefined && consumed > 0) {
+    window.recoveries.set(resetAt, (window.recoveries.get(resetAt) ?? 0) + consumed);
+  }
+  windows.set(key, window);
+}
+
+function finalizeWindow(window: MutableWindow, totalAccounts: number): CodexCapacityWindowAggregation {
+  const nextRecoveryAt = [...window.recoveries.keys()].sort((a, b) => a - b)[0];
+  const recovered = nextRecoveryAt === undefined ? undefined : window.recoveries.get(nextRecoveryAt);
+  return {
+    usedPercent: window.consumedWeight / window.totalWeight * 100,
+    includedAccounts: window.includedAccounts,
+    excludedAccounts: totalAccounts - window.includedAccounts,
+    incomplete: window.includedAccounts < totalAccounts,
+    totalWeight: window.totalWeight,
+    consumedWeight: window.consumedWeight,
+    remainingWeight: window.totalWeight - window.consumedWeight,
+    updatedAt: window.oldestUpdatedAt,
+    ...(nextRecoveryAt !== undefined ? { nextRecoveryAt } : {}),
+    ...(recovered !== undefined ? { nextRecoveryPercent: recovered / window.totalWeight * 100 } : {}),
+  };
+}
+
+/** Display-only configured-weight estimate. It never participates in account selection or routing. */
+export function aggregateCodexPoolCapacity(
+  accounts: readonly CodexCapacityAccount[],
+  now = Date.now(),
+): CodexCapacityResult {
+  const current = accounts.find(account => account.active)
+    ?? accounts.find(account => account.isMain)
+    ?? accounts[0];
+  const currentPlan = codexPlanValue(current?.plan);
+  const currentAccount = current ? {
+    isMain: current.isMain,
+    ...(currentPlan !== undefined ? { plan: currentPlan } : {}),
+    quota: currentQuotaForDisplay(current, now),
+  } : undefined;
+  const windows = new Map<string, MutableWindow>();
+  const included = new Set<CodexCapacityAccount>();
+  const contributions = new Map<CodexCapacityAccount, Set<string>>();
+  let unknownPlanAccounts = 0;
+  let missingQuotaAccounts = 0;
+  let pausedAccounts = 0;
+  let reauthAccounts = 0;
+  let staleQuotaAccounts = 0;
+
+  for (const account of accounts) {
+    const weight = configuredWeight(account.plan);
+    if (weight === undefined) unknownPlanAccounts += 1;
+    if (account.paused) pausedAccounts += 1;
+    if (account.needsReauth) reauthAccounts += 1;
+    const quota = account.quota;
+    const quotaFresh = !!quota
+      && Number.isFinite(quota.updatedAt)
+      && now - quota.updatedAt <= CODEX_CAPACITY_MAX_QUOTA_AGE_MS;
+    if (quota && !quotaFresh) staleQuotaAccounts += 1;
+    const standard = quota ? [
+      ["fiveHour", quota.fiveHourPercent, quota.fiveHourResetAt],
+      ["weekly", quota.weeklyPercent, quota.weeklyResetAt],
+      ["monthly", quota.monthlyPercent, quota.monthlyResetAt],
+    ] as const : [];
+    const custom = quota?.customWindows ?? [];
+    const hasQuota = hasKnownQuotaWindow(quota);
+    if (!hasQuota) missingQuotaAccounts += 1;
+    if (account.paused || account.needsReauth || weight === undefined || !quota || !hasQuota || !quotaFresh) continue;
+
+    let contributed = false;
+    const contributionKeys = new Set<string>();
+    for (const [key, rawPercent, rawReset] of standard) {
+      const percent = normalizedPercent(rawPercent);
+      if (percent === undefined) continue;
+      addWindow(windows, key, weight, percent, futureResetMs(rawReset, now), quota.updatedAt);
+      contributionKeys.add(key);
+      contributed = true;
+    }
+    for (const customWindow of custom) {
+      const percent = normalizedPercent(customWindow.percent);
+      if (percent === undefined) continue;
+      addWindow(windows, `custom:${customWindow.label}`, weight, percent, futureResetMs(customWindow.resetAt, now), quota.updatedAt);
+      contributionKeys.add(`custom:${customWindow.label}`);
+      contributed = true;
+    }
+    if (contributed) {
+      included.add(account);
+      contributions.set(account, contributionKeys);
+    }
+  }
+
+  if (windows.size === 0) {
+    if (accounts.length === 0) return { quota: null, aggregation: null, ...(currentAccount ? { currentAccount } : {}) };
+    const aggregation: CodexCapacityAggregation = {
+      kind: "capacity-weighted-v1",
+      scope: "routable-known",
+      includedAccounts: 0,
+      excludedAccounts: accounts.length,
+      unknownPlanAccounts,
+      missingQuotaAccounts,
+      pausedAccounts,
+      reauthAccounts,
+      staleQuotaAccounts,
+      partialWindowAccounts: 0,
+      incomplete: true,
+      ...(currentAccount ? { currentAccount } : {}),
+    };
+    return { quota: null, aggregation, ...(currentAccount ? { currentAccount } : {}) };
+  }
+  const fiveHour = windows.get("fiveHour") ? finalizeWindow(windows.get("fiveHour")!, accounts.length) : undefined;
+  const weekly = windows.get("weekly") ? finalizeWindow(windows.get("weekly")!, accounts.length) : undefined;
+  const monthly = windows.get("monthly") ? finalizeWindow(windows.get("monthly")!, accounts.length) : undefined;
+  const customWindows = [...windows.entries()].flatMap(([key, window]) => key.startsWith("custom:")
+    ? [{ label: key.slice("custom:".length), ...finalizeWindow(window, accounts.length) }]
+    : []);
+  const quota: CodexCapacityQuota = {
+    ...(fiveHour ? { fiveHourPercent: fiveHour.usedPercent } : {}),
+    ...(weekly ? { weeklyPercent: weekly.usedPercent } : {}),
+    ...(monthly ? { monthlyPercent: monthly.usedPercent } : {}),
+    ...(customWindows.length > 0 ? {
+      customWindows: customWindows.map(window => ({ label: window.label, percent: window.usedPercent })),
+    } : {}),
+    updatedAt: Math.min(
+      ...[fiveHour, weekly, monthly, ...customWindows]
+        .flatMap(window => window ? [window.updatedAt] : []),
+    ),
+  };
+  const visibleWindowKeys = [...windows.keys()];
+  const partialWindowAccounts = accounts.filter(account => {
+    const keys = contributions.get(account);
+    return !!keys && visibleWindowKeys.some(key => !keys.has(key));
+  }).length;
+  const excludedAccounts = accounts.length - included.size;
+  const aggregation: CodexCapacityAggregation = {
+    kind: "capacity-weighted-v1",
+    scope: "routable-known",
+    includedAccounts: included.size,
+    excludedAccounts,
+    unknownPlanAccounts,
+    missingQuotaAccounts,
+    pausedAccounts,
+    reauthAccounts,
+    staleQuotaAccounts,
+    partialWindowAccounts,
+    incomplete: excludedAccounts > 0 || partialWindowAccounts > 0,
+    ...(fiveHour ? { fiveHour } : {}),
+    ...(weekly ? { weekly } : {}),
+    ...(monthly ? { monthly } : {}),
+    ...(customWindows.length > 0 ? { customWindows } : {}),
+    ...(currentAccount ? { currentAccount } : {}),
+  };
+  return { quota, aggregation, ...(currentAccount ? { currentAccount } : {}) };
+}

package/src/providers/command-code-efforts.ts

@@ -0,0 +1,144 @@
+import { readBoundedResponseBody } from "../lib/bounded-body";
+
+const COMMAND_CODE_MODEL_EFFORTS = {
+  "deepseek/deepseek-v4-pro": {
+    efforts: ["high", "max"],
+    profileUrl: "https://commandcode.ai/models/deepseek-v4-pro",
+  },
+  "deepseek/deepseek-v4-flash": {
+    efforts: ["high", "max"],
+    profileUrl: "https://commandcode.ai/models/deepseek-v4-flash",
+  },
+  // Ox Alpha (stealth preview, added in Command Code v1.31.0): free 1M-context
+  // reasoning model on every plan. The profile does not publish an effort ladder,
+  // so mirror the OpenRouter contract (reasoning mandatory; max/high/low).
+  "stealth/ox-alpha": {
+    efforts: ["low", "high", "max"],
+    profileUrl: "https://commandcode.ai/models/ox-alpha",
+  },
+  // Keys must match the EXACT upstream /provider/v1/models ids (GLM ships as
+  // `zai-org/GLM-5.3`, not `zai-org/glm-5.3`). The table doubles as the router's
+  // known-ids decode source (via `knownModelIdsForProvider`), so a case mismatch
+  // makes the Codex-facing slug `commandcode/zai-org-GLM-5.3` pass through
+  // undecoded and upstream rejects it with `unsupported_model`.
+  "zai-org/GLM-5": {
+    efforts: ["high", "max"],
+    profileUrl: "https://commandcode.ai/models/glm-5",
+  },
+  "zai-org/GLM-5.1": {
+    efforts: ["high", "max"],
+    profileUrl: "https://commandcode.ai/models/glm-5-1",
+  },
+  "zai-org/GLM-5.2": {
+    efforts: ["high", "max"],
+    profileUrl: "https://commandcode.ai/models/glm-5-2",
+  },
+  "zai-org/GLM-5.2-Fast": {
+    efforts: ["high", "max"],
+    profileUrl: "https://commandcode.ai/models/glm-5-2-fast",
+  },
+  "zai-org/GLM-5.3": {
+    efforts: ["low", "high", "max"],
+    profileUrl: "https://commandcode.ai/models/glm-5-3",
+  },
+  // Muse Spark: CLI currently prints "has no adjustable reasoning effort" and
+  // blocks --effort locally, but the upstream /alpha/generate endpoint accepts
+  // reasoning_effort low..max for meta/muse-spark-1.2-contributor (verified
+  // 2026-08-13: direct upstream POST with low/medium/high/xhigh/max all 200,
+  // ultra 400; reasoningTokens differentiated 114..253; proxy previously stripped
+  // the field so effort changes had no effect).
+  "meta/muse-spark-1.2": {
+    efforts: ["low", "medium", "high", "xhigh", "max"],
+    profileUrl: "https://commandcode.ai/models/meta-muse-spark-1.2",
+  },
+  "meta/muse-spark-1.2-contributor": {
+    efforts: ["low", "medium", "high", "xhigh", "max"],
+    profileUrl: "https://commandcode.ai/models/meta-muse-spark-1.2-contributor",
+  },
+  "meta/muse-spark-1.1": {
+    efforts: ["low", "medium", "high", "xhigh", "max"],
+    profileUrl: "https://commandcode.ai/models/meta-muse-spark-1.1",
+  },
+} as const;
+
+/**
+ * Official Command Code model-profile facts, not a model catalog. Models remain
+ * account-scoped and come exclusively from the authenticated /provider/v1/models endpoint.
+ */
+export const COMMAND_CODE_MODEL_REASONING_EFFORTS: Record<string, string[]> = Object.fromEntries(
+  Object.entries(COMMAND_CODE_MODEL_EFFORTS).map(([id, row]) => [id, [...row.efforts]]),
+);
+
+const refreshedEfforts = new Map<string, string[]>();
+
+function keyFor(modelId: string): string {
+  return modelId.trim().toLowerCase();
+}
+
+export function commandCodeReasoningEfforts(modelId: string): readonly string[] | undefined {
+  const key = keyFor(modelId);
+  const refreshed = refreshedEfforts.get(key);
+  if (refreshed !== undefined) return refreshed;
+  // Case-insensitive: the table keys match the EXACT upstream ids (e.g. `zai-org/GLM-5.3`),
+  // but callers may pass either case.
+  for (const [id, efforts] of Object.entries(COMMAND_CODE_MODEL_REASONING_EFFORTS)) {
+    if (keyFor(id) === key) return efforts;
+  }
+  return undefined;
+}
+
+function parsedProfileEfforts(page: string): string[] | undefined {
+  const match = page.match(/Reasoning efforts\s+([^.;]+?)\s+are supported;\s*([^.]*)/i);
+  if (!match) return undefined;
+  const listed = match[1]!.toLowerCase().match(/\b(?:low|medium|high|xhigh|max)\b/g) ?? [];
+  const mapped = match[2]!.toLowerCase().match(/\b(?:low|medium|high|xhigh|max)\s+maps to\s+(?:low|medium|high|xhigh|max)\b/g) ?? [];
+  const normalized = new Set(listed);
+  for (const mapping of mapped) {
+    const [, source, target] = mapping.match(/(low|medium|high|xhigh|max)\s+maps to\s+(low|medium|high|xhigh|max)/) ?? [];
+    if (source && target) {
+      normalized.delete(source);
+      normalized.add(target);
+    }
+  }
+  return normalized.size > 0 ? [...normalized] : [];
+}
+
+/**
+ * Refresh one stale effort record only after the upstream rejects an effort request.
+ * A failed or unparseable public profile deliberately leaves the known table unchanged.
+ */
+export async function refreshCommandCodeReasoningEfforts(
+  modelId: string,
+  fetchFn: typeof globalThis.fetch = globalThis.fetch,
+): Promise<readonly string[] | undefined> {
+  const key = keyFor(modelId);
+  let profile: { efforts: readonly string[]; profileUrl: string } | undefined;
+  for (const [id, row] of Object.entries(COMMAND_CODE_MODEL_EFFORTS)) {
+    if (keyFor(id) === key) {
+      profile = row;
+      break;
+    }
+  }
+  if (!profile) return undefined;
+  try {
+    const response = await fetchFn(profile.profileUrl, {
+      headers: { Accept: "text/html" },
+      signal: AbortSignal.timeout(10_000),
+    });
+    if (!response.ok) return undefined;
+    // Bound the profile page before parsing: a large or malformed page must not
+    // allocate unbounded memory on the request path.
+    const observed = await readBoundedResponseBody(response, { maxBytes: 256 * 1024 });
+    if (!observed.displaySafe) return undefined;
+    const efforts = parsedProfileEfforts(observed.text);
+    if (efforts === undefined) return undefined;
+    refreshedEfforts.set(key, efforts);
+    return efforts;
+  } catch {
+    return undefined;
+  }
+}
+
+export function resetCommandCodeReasoningEffortsForTest(): void {
+  refreshedEfforts.clear();
+}

package/src/providers/context-cap.ts

@@ -0,0 +1,82 @@
+import type { OcxConfig } from "../types";
+
+export const DEFAULT_PROVIDER_CONTEXT_CAP = 350_000;
+
+function isValidContextCap(value: unknown): value is number {
+  return typeof value === "number" && Number.isFinite(value) && value > 0;
+}
+
+export function providerContextCap(config: Pick<OcxConfig, "providerContextCaps">, provider: string): number | undefined {
+  const value = config.providerContextCaps?.[provider];
+  return isValidContextCap(value) ? value : undefined;
+}
+
+export function providerContextCaps(config: Pick<OcxConfig, "providerContextCaps">): Record<string, number> {
+  const caps = config.providerContextCaps;
+  if (!caps || typeof caps !== "object" || Array.isArray(caps)) return {};
+  const out: Record<string, number> = {};
+  for (const [provider, value] of Object.entries(caps)) {
+    if (isValidContextCap(value)) out[provider] = value;
+  }
+  return out;
+}
+
+export function applyProviderContextCap(contextWindow: number | undefined, cap: number | undefined): number | undefined {
+  if (!isValidContextCap(cap)) return contextWindow;
+  if (!isValidContextCap(contextWindow)) return contextWindow;
+  return contextWindow > cap ? cap : contextWindow;
+}
+
+/**
+ * 上游没报窗口时，已开启的 Context cap 就是实际窗口。
+ * 128k 只是 Codex 解析器的兼容底线，不能当成“已发现窗口”再拿去和 cap 做 min。
+ */
+export function resolveUnknownRoutedContextWindow(cap: number | undefined): number {
+  const window = isValidContextCap(cap) ? Math.floor(cap) : 0;
+  return window > 0 ? window : 128_000;
+}
+
+/** Effective global cap value: explicit config value, else the built-in default. */
+export function globalContextCapValue(config: Pick<OcxConfig, "contextCapValue">): number {
+  const value = config.contextCapValue;
+  return isValidContextCap(value) ? Math.floor(value) : DEFAULT_PROVIDER_CONTEXT_CAP;
+}
+
+export function setProviderContextCap(config: OcxConfig, provider: string, enabled: boolean, value?: number): void {
+  const next = providerContextCaps(config);
+  if (enabled) {
+    next[provider] = isValidContextCap(value) ? Math.floor(value) : globalContextCapValue(config);
+  } else {
+    delete next[provider];
+  }
+  if (Object.keys(next).length > 0) config.providerContextCaps = next;
+  else delete config.providerContextCaps;
+}
+
+/**
+ * Set the global cap value (the default used by per-provider toggles and "set all").
+ * Re-points every already-enabled provider only when `applyToAll` is true (the dashboard's
+ * "apply to every routed provider" toggle); otherwise each provider keeps its own cap value.
+ */
+export function setGlobalContextCapValue(config: OcxConfig, value: number, applyToAll: boolean): void {
+  if (!isValidContextCap(value)) return;
+  const next = Math.floor(value);
+  config.contextCapValue = next;
+  if (!applyToAll) return;
+  const caps = providerContextCaps(config);
+  for (const provider of Object.keys(caps)) caps[provider] = next;
+  if (Object.keys(caps).length > 0) config.providerContextCaps = caps;
+}
+
+/** Enable the cap for every named provider at the current value, or clear all caps. */
+export function setAllProviderContextCaps(config: OcxConfig, providerNames: string[], enabled: boolean): void {
+  if (!enabled) {
+    delete config.providerContextCaps;
+    return;
+  }
+  const value = globalContextCapValue(config);
+  const next: Record<string, number> = {};
+  for (const name of providerNames) next[name] = value;
+  if (Object.keys(next).length > 0) config.providerContextCaps = next;
+  else delete config.providerContextCaps;
+}

package/src/providers/cursor-pool.ts

@@ -0,0 +1,72 @@
+/**
+ * Weighted credential routing for Cursor accounts.
+ *
+ * Transfer from yelixir-dev/cursor-ai-proxy-bridge credentials.ts:
+ * weighted round-robin selection with per-credential auth-failure cooldown
+ * and one-retry failover on a different account before surfacing the error.
+ *
+ * OpenCodex already has JWT-based multi-account identification (src/oauth/cursor.ts)
+ * and Anthropic-specific 429 rotation; this module adds Cursor-aware weighted
+ * routing on top of those primitives.
+ */
+
+export interface CursorCredential {
+  readonly id: string;
+  weight: number;
+}
+
+interface CredentialState {
+  readonly credential: CursorCredential;
+  currentWeight: number;
+  disabledUntil: number;
+}
+
+export class NoAvailableCursorCredentialError extends Error {
+  constructor(message = "No available Cursor credentials") { super(message); }
+}
+
+export class CursorCredentialRouter {
+  private states: CredentialState[] = [];
+  private readonly cooldownMs: number;
+
+  constructor(credentials: ReadonlyArray<CursorCredential>, cooldownMs = 300_000) {
+    this.cooldownMs = cooldownMs;
+    this.replace(credentials);
+  }
+
+  replace(credentials: ReadonlyArray<CursorCredential>): void {
+    this.states = credentials.map(c => ({
+      credential: { ...c, weight: Math.max(1, c.weight || 1) },
+      currentWeight: 0,
+      disabledUntil: 0,
+    }));
+  }
+
+  pick(excludeIds: ReadonlySet<string> = new Set()): CursorCredential {
+    const now = Date.now();
+    const candidates = this.states.filter(s =>
+      !excludeIds.has(s.credential.id) && s.disabledUntil <= now,
+    );
+    if (candidates.length === 0) throw new NoAvailableCursorCredentialError();
+    let selected: CredentialState | undefined;
+    let totalWeight = 0;
+    for (const state of candidates) {
+      state.currentWeight += state.credential.weight;
+      totalWeight += state.credential.weight;
+      if (!selected || state.currentWeight > selected.currentWeight) selected = state;
+    }
+    if (!selected) throw new NoAvailableCursorCredentialError();
+    selected.currentWeight -= totalWeight;
+    return { ...selected.credential };
+  }
+
+  disable(id: string): void {
+    const state = this.states.find(s => s.credential.id === id);
+    if (state) state.disabledUntil = Date.now() + this.cooldownMs;
+  }
+
+  get snapshot(): ReadonlyArray<{ id: string; disabled: boolean }> {
+    const now = Date.now();
+    return this.states.map(s => ({ id: s.credential.id, disabled: s.disabledUntil > now }));
+  }
+}