@yu_robotics/remote-cli 1.6.117 → 1.6.128

package/dist/executor/dsh/DshAccountUsage.d.ts

@@ -0,0 +1,12 @@
+import { spawn } from 'child_process';
+export declare const DSH_ACCOUNT_USAGE_PREFIX = "REMOTE_CLI_DSH_ACCOUNT_USAGE:";
+export interface DshAccountUsageDependencies {
+    spawnProcess?: typeof spawn;
+    timeoutMs?: number;
+    killGraceMs?: number;
+}
+/** Project only wallet amounts; never expose profile fields or coerce decimal strings. */
+export declare function formatDshAccountBalance(value: unknown): string | null;
+/** Read the native account service without an ACP session, model turn, or Web server. */
+export declare function queryDshAccountUsage(command: string, cwd: string, dependencies?: DshAccountUsageDependencies): Promise<string | null>;
+//# sourceMappingURL=DshAccountUsage.d.ts.map

package/dist/executor/dsh/DshAccountUsage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DshAccountUsage.d.ts","sourceRoot":"","sources":["../../../src/executor/dsh/DshAccountUsage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAqB,MAAM,eAAe,CAAC;AAMzD,eAAO,MAAM,wBAAwB,kCAAkC,CAAC;AAIxE,MAAM,WAAW,2BAA2B;IAC1C,YAAY,CAAC,EAAE,OAAO,KAAK,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,0FAA0F;AAC1F,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAiBrE;AAED,yFAAyF;AACzF,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EACrE,YAAY,GAAE,2BAAgC,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAuExE"}

package/dist/executor/dsh/DshAccountUsage.js

@@ -0,0 +1,134 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DSH_ACCOUNT_USAGE_PREFIX = void 0;
+exports.formatDshAccountBalance = formatDshAccountBalance;
+exports.queryDshAccountUsage = queryDshAccountUsage;
+const child_process_1 = require("child_process");
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const url_1 = require("url");
+const DshPrivacy_1 = require("./DshPrivacy");
+exports.DSH_ACCOUNT_USAGE_PREFIX = 'REMOTE_CLI_DSH_ACCOUNT_USAGE:';
+const MAX_OUTPUT_BYTES = 64 * 1024;
+const MAX_RESULT_LENGTH = 4096;
+/** Project only wallet amounts; never expose profile fields or coerce decimal strings. */
+function formatDshAccountBalance(value) {
+    if (!value || typeof value !== 'object')
+        return null;
+    const snapshot = value;
+    if (snapshot.status !== 'ready')
+        return null;
+    const lines = [];
+    for (const [key, label] of [['value', 'Recharge balance'], ['bonusWallets', 'Bonus balance']]) {
+        const wallets = snapshot[key];
+        if (!Array.isArray(wallets) || wallets.length > 32)
+            return null;
+        for (const wallet of wallets) {
+            if (!wallet || !['CNY', 'USD'].includes(wallet.currency)
+                || typeof wallet.balance !== 'string' || wallet.balance.length > 128
+                || !/^[+-]?(?:\d+(?:\.\d*)?|\.\d+)(?:[eE][+-]?\d+)?$/.test(wallet.balance))
+                return null;
+            lines.push(`- ${label}: ${wallet.currency} ${wallet.balance}`);
+        }
+    }
+    const output = lines.join('\n');
+    return output && output.length <= MAX_RESULT_LENGTH ? output : null;
+}
+/** Read the native account service without an ACP session, model turn, or Web server. */
+async function queryDshAccountUsage(command, cwd, dependencies = {}) {
+    let launch;
+    let child;
+    try {
+        launch = (0, DshPrivacy_1.createDshPrivacyLaunch)();
+        const plugin = (0, url_1.pathToFileURL)(path_1.default.join(__dirname, 'DshAccountUsagePlugin.js')).href;
+        fs_1.default.appendFileSync(launch.args[3], [
+            '- insert:',
+            '    - id: remote-cli-dsh-account-usage',
+            `      name: ${JSON.stringify(plugin)}`,
+            '      config:',
+            `        version: ${JSON.stringify(require('../../../package.json').version)}`,
+            '        locale: en-US',
+            `        timezoneOffsetSeconds: ${-new Date().getTimezoneOffset() * 60}`,
+            '',
+        ].join('\n'));
+        child = (dependencies.spawnProcess ?? child_process_1.spawn)(command, launch.args, { cwd, env: launch.env, stdio: ['pipe', 'pipe', 'ignore'] });
+    }
+    catch {
+        try {
+            launch?.dispose();
+        }
+        catch { /* Cleanup must not disclose native diagnostics. */ }
+        return null;
+    }
+    return new Promise(resolve => {
+        let settled = false;
+        let completed = false;
+        let result = null;
+        let pending = '';
+        let bytes = 0;
+        let killTimer;
+        const timeout = setTimeout(() => settle(null), dependencies.timeoutMs ?? 12_000);
+        const complete = () => {
+            if (completed)
+                return;
+            completed = true;
+            clearTimeout(timeout);
+            clearTimeout(killTimer);
+            try {
+                launch?.dispose();
+            }
+            catch { /* Do not relay private native errors. */ }
+            resolve(result);
+        };
+        const settle = (output) => {
+            if (settled || completed)
+                return;
+            settled = true;
+            result = output;
+            clearTimeout(timeout);
+            killTimer = setTimeout(() => {
+                try {
+                    child.kill('SIGKILL');
+                }
+                catch { /* The owned process may have exited. */ }
+                complete();
+            }, dependencies.killGraceMs ?? 2000);
+            try {
+                child.kill('SIGTERM');
+            }
+            catch { /* The kill deadline still bounds cleanup. */ }
+        };
+        child.once('error', () => settle(null));
+        child.once('exit', complete);
+        child.stdout?.on('data', (chunk) => {
+            if (settled || completed)
+                return;
+            bytes += chunk.length;
+            if (bytes > MAX_OUTPUT_BYTES) {
+                settle(null);
+                return;
+            }
+            pending += chunk.toString('utf8');
+            let newline;
+            while ((newline = pending.indexOf('\n')) !== -1) {
+                const line = pending.slice(0, newline);
+                pending = pending.slice(newline + 1);
+                if (!line.startsWith(exports.DSH_ACCOUNT_USAGE_PREFIX))
+                    continue;
+                try {
+                    const message = JSON.parse(line.slice(exports.DSH_ACCOUNT_USAGE_PREFIX.length));
+                    settle(typeof message?.output === 'string' && message.output.length <= MAX_RESULT_LENGTH
+                        ? message.output : null);
+                }
+                catch {
+                    settle(null);
+                }
+                return;
+            }
+        });
+    });
+}
+//# sourceMappingURL=DshAccountUsage.js.map

package/dist/executor/dsh/DshAccountUsage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DshAccountUsage.js","sourceRoot":"","sources":["../../../src/executor/dsh/DshAccountUsage.ts"],"names":[],"mappings":";;;;;;AAiBA,0DAiBC;AAGD,oDAwEC;AA7GD,iDAAyD;AACzD,4CAAoB;AACpB,gDAAwB;AACxB,6BAAoC;AACpC,6CAAsD;AAEzC,QAAA,wBAAwB,GAAG,+BAA+B,CAAC;AACxE,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,CAAC;AACnC,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAQ/B,0FAA0F;AAC1F,SAAgB,uBAAuB,CAAC,KAAc;IACpD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACrD,MAAM,QAAQ,GAAG,KAAgC,CAAC;IAClD,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC7C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,kBAAkB,CAAC,EAAE,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC,EAAE,CAAC;QAC9F,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,EAAE;YAAE,OAAO,IAAI,CAAC;QAChE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC;mBACnD,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,GAAG;mBACjE,CAAC,iDAAiD,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC1F,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,KAAK,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,OAAO,MAAM,IAAI,MAAM,CAAC,MAAM,IAAI,iBAAiB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AACtE,CAAC;AAED,yFAAyF;AAClF,KAAK,UAAU,oBAAoB,CAAC,OAAe,EAAE,GAAW,EACrE,eAA4C,EAAE;IAC9C,IAAI,MAA6D,CAAC;IAClE,IAAI,KAAmB,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,GAAG,IAAA,mCAAsB,GAAE,CAAC;QAClC,MAAM,MAAM,GAAG,IAAA,mBAAa,EAAC,cAAI,CAAC,IAAI,CAAC,SAAS,EAAE,0BAA0B,CAAC,CAAC,CAAC,IAAI,CAAC;QACpF,YAAE,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;YAChC,WAAW;YACX,wCAAwC;YACxC,eAAe,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE;YACvC,eAAe;YACf,oBAAoB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC,OAAO,CAAC,EAAE;YAC9E,uBAAuB;YACvB,kCAAkC,CAAC,IAAI,IAAI,EAAE,CAAC,iBAAiB,EAAE,GAAG,EAAE,EAAE;YACxE,EAAE;SACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACd,KAAK,GAAG,CAAC,YAAY,CAAC,YAAY,IAAI,qBAAK,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,EAC/D,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC;YAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,mDAAmD,CAAC,CAAC;QACxF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE;QAC3B,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,IAAI,MAAM,GAAkB,IAAI,CAAC;QACjC,IAAI,OAAO,GAAG,EAAE,CAAC;QACjB,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,SAAqC,CAAC;QAC1C,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC,SAAS,IAAI,MAAM,CAAC,CAAC;QACjF,MAAM,QAAQ,GAAG,GAAG,EAAE;YACpB,IAAI,SAAS;gBAAE,OAAO;YACtB,SAAS,GAAG,IAAI,CAAC;YACjB,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,YAAY,CAAC,SAAS,CAAC,CAAC;YACxB,IAAI,CAAC;gBAAC,MAAM,EAAE,OAAO,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,yCAAyC,CAAC,CAAC;YAC9E,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC,CAAC;QACF,MAAM,MAAM,GAAG,CAAC,MAAqB,EAAE,EAAE;YACvC,IAAI,OAAO,IAAI,SAAS;gBAAE,OAAO;YACjC,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,GAAG,MAAM,CAAC;YAChB,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC1B,IAAI,CAAC;oBAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,wCAAwC,CAAC,CAAC;gBACjF,QAAQ,EAAE,CAAC;YACb,CAAC,EAAE,YAAY,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC;YACrC,IAAI,CAAC;gBAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,6CAA6C,CAAC,CAAC;QACxF,CAAC,CAAC;QACF,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACxC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC7B,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,IAAI,OAAO,IAAI,SAAS;gBAAE,OAAO;YACjC,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;YACtB,IAAI,KAAK,GAAG,gBAAgB,EAAE,CAAC;gBAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YACvD,OAAO,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAClC,IAAI,OAAe,CAAC;YACpB,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBAChD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;gBACvC,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;gBACrC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,gCAAwB,CAAC;oBAAE,SAAS;gBACzD,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,gCAAwB,CAAC,MAAM,CAAC,CAAC,CAAC;oBACxE,MAAM,CAAC,OAAO,OAAO,EAAE,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,iBAAiB;wBACtF,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC7B,CAAC;gBAAC,MAAM,CAAC;oBAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBAAC,CAAC;gBACzB,OAAO;YACT,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/executor/dsh/DshAccountUsagePlugin.d.ts

@@ -0,0 +1,16 @@
+export declare const name = "remote-cli-dsh-account-usage";
+export declare const inject: string[];
+interface AccountMetadata {
+    version: string;
+    locale: string;
+    timezoneOffsetSeconds: number;
+}
+interface AccountContext {
+    deepseekAccount: {
+        getBalance(metadata: AccountMetadata): Promise<unknown>;
+    };
+}
+/** A one-shot native DSH plugin. Only the sanitized balance projection reaches stdout. */
+export declare function apply(context: AccountContext, metadata: AccountMetadata): Promise<void>;
+export {};
+//# sourceMappingURL=DshAccountUsagePlugin.d.ts.map

package/dist/executor/dsh/DshAccountUsagePlugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DshAccountUsagePlugin.d.ts","sourceRoot":"","sources":["../../../src/executor/dsh/DshAccountUsagePlugin.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,IAAI,iCAAiC,CAAC;AACnD,eAAO,MAAM,MAAM,UAAsB,CAAC;AAE1C,UAAU,eAAe;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,qBAAqB,EAAE,MAAM,CAAC;CAC/B;AAED,UAAU,cAAc;IACtB,eAAe,EAAE;QAAE,UAAU,CAAC,QAAQ,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC;CAC9E;AAED,0FAA0F;AAC1F,wBAAsB,KAAK,CAAC,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAM7F"}

package/dist/executor/dsh/DshAccountUsagePlugin.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.inject = exports.name = void 0;
+exports.apply = apply;
+const DshAccountUsage_1 = require("./DshAccountUsage");
+exports.name = 'remote-cli-dsh-account-usage';
+exports.inject = ['deepseekAccount'];
+/** A one-shot native DSH plugin. Only the sanitized balance projection reaches stdout. */
+async function apply(context, metadata) {
+    let output = null;
+    try {
+        output = (0, DshAccountUsage_1.formatDshAccountBalance)(await context.deepseekAccount.getBalance(metadata));
+    }
+    catch {
+        // Missing authentication, quota-service failures, and provider details stay private.
+    }
+    process.stdout.write(`${DshAccountUsage_1.DSH_ACCOUNT_USAGE_PREFIX}${JSON.stringify({ output })}\n`);
+}
+//# sourceMappingURL=DshAccountUsagePlugin.js.map

package/dist/executor/dsh/DshAccountUsagePlugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DshAccountUsagePlugin.js","sourceRoot":"","sources":["../../../src/executor/dsh/DshAccountUsagePlugin.ts"],"names":[],"mappings":";;;AAgBA,sBAMC;AAtBD,uDAAsF;AAEzE,QAAA,IAAI,GAAG,8BAA8B,CAAC;AACtC,QAAA,MAAM,GAAG,CAAC,iBAAiB,CAAC,CAAC;AAY1C,0FAA0F;AACnF,KAAK,UAAU,KAAK,CAAC,OAAuB,EAAE,QAAyB;IAC5E,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,IAAI,CAAC;QAAC,MAAM,GAAG,IAAA,yCAAuB,EAAC,MAAM,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QACnG,qFAAqF;IACvF,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,0CAAwB,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;AACrF,CAAC"}

package/dist/maintenance/CodexStatusProbe.d.ts

@@ -0,0 +1,26 @@
+import { type CodexAppServerClientOptions } from '../executor/CodexAppServerClient';
+import type { ExecutorConfig } from '../types/config';
+import { type WeeklyObservation } from './CodexWeekly';
+export interface StatusProbeClient {
+    request(method: string, params?: unknown): Promise<any>;
+    stop(): Promise<void>;
+    onMessage(handler: (message: any) => void): () => void;
+    respondError(id: string | number, message: string): void;
+}
+interface ProbeOptions {
+    config: () => ExecutorConfig | undefined;
+    nativeHome?: () => string;
+    createClient?: (options: CodexAppServerClientOptions) => StatusProbeClient;
+    now?: () => number;
+    deadlineMs?: number;
+}
+/** Status only: existing native tokens are read locally, loaded ephemerally, and never refreshed or written by this feature. */
+export declare class CodexStatusProbe {
+    private readonly options;
+    private readonly createClient;
+    private readonly now;
+    constructor(options: ProbeOptions);
+    inspect(signal: AbortSignal): Promise<WeeklyObservation | undefined>;
+}
+export {};
+//# sourceMappingURL=CodexStatusProbe.d.ts.map

package/dist/maintenance/CodexStatusProbe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CodexStatusProbe.d.ts","sourceRoot":"","sources":["../../src/maintenance/CodexStatusProbe.ts"],"names":[],"mappings":"AAGA,OAAO,EAAwB,KAAK,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAE1G,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAA0B,KAAK,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAE/E,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACxD,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,SAAS,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;IACvD,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1D;AACD,UAAU,YAAY;IACpB,MAAM,EAAE,MAAM,cAAc,GAAG,SAAS,CAAC;IACzC,UAAU,CAAC,EAAE,MAAM,MAAM,CAAC;IAC1B,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,2BAA2B,KAAK,iBAAiB,CAAC;IAC3E,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,gIAAgI;AAChI,qBAAa,gBAAgB;IAGf,OAAO,CAAC,QAAQ,CAAC,OAAO;IAFpC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA4C;IACzE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBACN,OAAO,EAAE,YAAY;IAK5C,OAAO,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC;CAoE3E"}

package/dist/maintenance/CodexStatusProbe.js

@@ -0,0 +1,124 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CodexStatusProbe = void 0;
+const promises_1 = __importDefault(require("fs/promises"));
+const path_1 = __importDefault(require("path"));
+const os_1 = __importDefault(require("os"));
+const CodexAppServerClient_1 = require("../executor/CodexAppServerClient");
+const BackendCommand_1 = require("../utils/BackendCommand");
+const CodexWeekly_1 = require("./CodexWeekly");
+/** Status only: existing native tokens are read locally, loaded ephemerally, and never refreshed or written by this feature. */
+class CodexStatusProbe {
+    options;
+    createClient;
+    now;
+    constructor(options) {
+        this.options = options;
+        this.createClient = options.createClient ?? (opts => new CodexAppServerClient_1.CodexAppServerClient(opts));
+        this.now = options.now ?? Date.now;
+    }
+    async inspect(signal) {
+        let temporary;
+        let client;
+        let timedOut = false;
+        let timer;
+        const ensureActive = () => { if (timedOut || signal.aborted)
+            throw new Error('Status probe cancelled.'); };
+        let abort;
+        try {
+            const deadline = new Promise((_, reject) => {
+                abort = () => { timedOut = true; reject(new Error('Status probe cancelled.')); };
+                signal.addEventListener('abort', abort, { once: true });
+                timer = setTimeout(() => { timedOut = true; reject(new Error('Status probe deadline reached.')); }, this.options.deadlineMs ?? 15_000);
+                timer.unref?.();
+            });
+            const operation = (async () => {
+                ensureActive();
+                const nativeHome = this.options.nativeHome?.() ?? process.env.CODEX_HOME ?? path_1.default.join(os_1.default.homedir(), '.codex');
+                const authPath = path_1.default.join(nativeHome, 'auth.json');
+                const stat = await promises_1.default.stat(authPath);
+                ensureActive();
+                if (!stat.isFile() || stat.size > 64 * 1024)
+                    return;
+                const auth = JSON.parse(await promises_1.default.readFile(authPath, 'utf8'));
+                ensureActive();
+                // API-key/keyring/custom auth is unsupported, never substituted for a native ChatGPT account.
+                const token = auth?.tokens?.access_token, accountId = auth?.tokens?.account_id;
+                if (auth?.auth_mode === 'apikey' || typeof token !== 'string' || !token || token.length > 20000
+                    || typeof accountId !== 'string' || !accountId || accountId.length > 200)
+                    return;
+                const credentialGeneration = `${stat.ino}:${stat.size}:${stat.mtimeMs}`;
+                temporary = await promises_1.default.mkdtemp(path_1.default.join(os_1.default.tmpdir(), 'remote-cli-status-'));
+                ensureActive();
+                await promises_1.default.chmod(temporary, 0o700);
+                ensureActive();
+                const env = {};
+                for (const name of ['PATH', 'HOME', 'USERPROFILE', 'SYSTEMROOT', 'SystemRoot', 'WINDIR', 'TMP', 'TEMP', 'TMPDIR', 'LANG', 'LC_ALL', 'SSL_CERT_FILE', 'SSL_CERT_DIR', 'NODE_EXTRA_CA_CERTS']) {
+                    if (process.env[name] !== undefined)
+                        env[name] = process.env[name];
+                }
+                env.CODEX_HOME = temporary;
+                env.RUST_LOG = 'error';
+                const overrides = ['cli_auth_credentials_store="ephemeral"', 'model_provider="openai"', 'forced_login_method="chatgpt"',
+                    'analytics.enabled=false', 'feedback.enabled=false', 'history.persistence="none"', 'web_search="disabled"',
+                    'features.shell_tool=false', 'features.apps=false', 'features.multi_agent=false'];
+                client = this.createClient({ command: (0, BackendCommand_1.getBackendCommand)('codex', this.options.config()), cwd: temporary, env,
+                    launchArgs: overrides.flatMap(v => ['-c', v]), requestTimeoutMs: 5000, killEscalationMs: 1000 });
+                client.onMessage(message => {
+                    // A probe never executes server-requested integrations or token refresh callbacks.
+                    if (message.id != null && message.method)
+                        client?.respondError(message.id, 'Maintenance probes do not handle this request.');
+                });
+                // Unknown native versions or managed overrides must not silently turn ephemeral auth into a disk write.
+                const configured = await Promise.race([client.request('config/read', { includeLayers: false }), deadline]);
+                ensureActive();
+                const effective = configured?.config;
+                if (effective?.cli_auth_credentials_store !== 'ephemeral' || effective.model_provider !== 'openai'
+                    || effective.analytics?.enabled !== false || effective.feedback?.enabled !== false
+                    || Object.values(effective.mcp_servers ?? {}).some((server) => server?.enabled !== false))
+                    return;
+                const login = await Promise.race([client.request('account/login/start', { type: 'chatgptAuthTokens', accessToken: token, chatgptAccountId: accountId }), deadline]);
+                ensureActive();
+                if (login?.type !== 'chatgptAuthTokens')
+                    return;
+                const raw = await Promise.race([client.request('account/rateLimits/read', { excludeResetCreditDetails: true }), deadline]);
+                ensureActive();
+                const after = await promises_1.default.stat(authPath);
+                ensureActive();
+                if (`${after.ino}:${after.size}:${after.mtimeMs}` !== credentialGeneration)
+                    return;
+                return (0, CodexWeekly_1.codexWeeklyObservation)(raw, accountId, credentialGeneration, this.now());
+            })();
+            // Wait for setup to settle before cleanup, even if a local filesystem operation finishes after the deadline.
+            try {
+                return await Promise.race([operation, deadline]);
+            }
+            finally {
+                timedOut = true;
+                await operation.catch(() => { });
+            }
+        }
+        catch {
+            return;
+        }
+        finally {
+            if (timer)
+                clearTimeout(timer);
+            if (abort)
+                signal.removeEventListener('abort', abort);
+            try {
+                await client?.stop();
+            }
+            catch { /* Never delete a credential-free temporary home while its process exit is unconfirmed. */
+                temporary = undefined;
+            }
+            if (temporary)
+                await promises_1.default.rm(temporary, { recursive: true, force: true });
+        }
+    }
+}
+exports.CodexStatusProbe = CodexStatusProbe;
+//# sourceMappingURL=CodexStatusProbe.js.map

package/dist/maintenance/CodexStatusProbe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CodexStatusProbe.js","sourceRoot":"","sources":["../../src/maintenance/CodexStatusProbe.ts"],"names":[],"mappings":";;;;;;AAAA,2DAA6B;AAC7B,gDAAwB;AACxB,4CAAoB;AACpB,2EAA0G;AAC1G,4DAA4D;AAE5D,+CAA+E;AAgB/E,gIAAgI;AAChI,MAAa,gBAAgB;IAGE;IAFZ,YAAY,CAA4C;IACxD,GAAG,CAAe;IACnC,YAA6B,OAAqB;QAArB,YAAO,GAAP,OAAO,CAAc;QAChD,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,2CAAoB,CAAC,IAAI,CAAC,CAAC,CAAC;QACrF,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,MAAmB;QAC/B,IAAI,SAA6B,CAAC;QAClC,IAAI,MAAqC,CAAC;QAC1C,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,KAAgD,CAAC;QACrD,MAAM,YAAY,GAAG,GAAG,EAAE,GAAG,IAAI,QAAQ,IAAI,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3G,IAAI,KAA+B,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;gBAChD,KAAK,GAAG,GAAG,EAAE,GAAG,QAAQ,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACjF,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBACxD,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,QAAQ,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,MAAM,CAAC,CAAC;gBACvI,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;YAClB,CAAC,CAAC,CAAC;YACH,MAAM,SAAS,GAAG,CAAC,KAAK,IAAI,EAAE;gBAC5B,YAAY,EAAE,CAAC;gBACf,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,cAAI,CAAC,IAAI,CAAC,YAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;gBAC9G,MAAM,QAAQ,GAAG,cAAI,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;gBACpD,MAAM,IAAI,GAAG,MAAM,kBAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAAC,YAAY,EAAE,CAAC;gBACrD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,EAAE,GAAG,IAAI;oBAAE,OAAO;gBACpD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,kBAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;gBAAC,YAAY,EAAE,CAAC;gBAC7E,8FAA8F;gBAC9F,MAAM,KAAK,GAAG,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,GAAG,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC;gBAC/E,IAAI,IAAI,EAAE,SAAS,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,KAAK;uBAC1F,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,GAAG;oBAAE,OAAO;gBACnF,MAAM,oBAAoB,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBACxE,SAAS,GAAG,MAAM,kBAAE,CAAC,OAAO,CAAC,cAAI,CAAC,IAAI,CAAC,YAAE,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;gBAAC,YAAY,EAAE,CAAC;gBAC3F,MAAM,kBAAE,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;gBAAC,YAAY,EAAE,CAAC;gBACjD,MAAM,GAAG,GAAsB,EAAE,CAAC;gBAClC,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,cAAc,EAAE,qBAAqB,CAAC,EAAE,CAAC;oBAC5L,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,SAAS;wBAAE,GAAG,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACrE,CAAC;gBACD,GAAG,CAAC,UAAU,GAAG,SAAS,CAAC;gBAC3B,GAAG,CAAC,QAAQ,GAAG,OAAO,CAAC;gBACvB,MAAM,SAAS,GAAG,CAAC,wCAAwC,EAAE,yBAAyB,EAAE,+BAA+B;oBACrH,yBAAyB,EAAE,wBAAwB,EAAE,4BAA4B,EAAE,uBAAuB;oBAC1G,2BAA2B,EAAE,qBAAqB,EAAE,4BAA4B,CAAC,CAAC;gBACpF,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,IAAA,kCAAiB,EAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG;oBAC1G,UAAU,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;gBACnG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE;oBACzB,mFAAmF;oBACnF,IAAI,OAAO,CAAC,EAAE,IAAI,IAAI,IAAI,OAAO,CAAC,MAAM;wBAAE,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,EAAE,gDAAgD,CAAC,CAAC;gBAC/H,CAAC,CAAC,CAAC;gBACH,wGAAwG;gBACxG,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;gBAAC,YAAY,EAAE,CAAC;gBAC3H,MAAM,SAAS,GAAG,UAAU,EAAE,MAAM,CAAC;gBACrC,IAAI,SAAS,EAAE,0BAA0B,KAAK,WAAW,IAAI,SAAS,CAAC,cAAc,KAAK,QAAQ;uBAC7F,SAAS,CAAC,SAAS,EAAE,OAAO,KAAK,KAAK,IAAI,SAAS,CAAC,QAAQ,EAAE,OAAO,KAAK,KAAK;uBAC/E,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAW,EAAE,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,KAAK,CAAC;oBAAE,OAAO;gBACzG,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,qBAAqB,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,WAAW,EAAE,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;gBAAC,YAAY,EAAE,CAAC;gBACpL,IAAI,KAAK,EAAE,IAAI,KAAK,mBAAmB;oBAAE,OAAO;gBAChD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,yBAAyB,EAAE,EAAE,yBAAyB,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;gBAAC,YAAY,EAAE,CAAC;gBAC3I,MAAM,KAAK,GAAG,MAAM,kBAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAAC,YAAY,EAAE,CAAC;gBACtD,IAAI,GAAG,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,EAAE,KAAK,oBAAoB;oBAAE,OAAO;gBACnF,OAAO,IAAA,oCAAsB,EAAC,GAAG,EAAE,SAAS,EAAE,oBAAoB,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAClF,CAAC,CAAC,EAAE,CAAC;YACL,6GAA6G;YAC7G,IAAI,CAAC;gBAAC,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;YAAC,CAAC;oBACjD,CAAC;gBAAC,QAAQ,GAAG,IAAI,CAAC;gBAAC,MAAM,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAAC,CAAC;QAC/D,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO;QAAC,CAAC;gBACX,CAAC;YACP,IAAI,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;YAC/B,IAAI,KAAK;gBAAE,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACtD,IAAI,CAAC;gBAAC,MAAM,MAAM,EAAE,IAAI,EAAE,CAAC;YAAC,CAAC;YAC7B,MAAM,CAAC,CAAC,0FAA0F;gBAAC,SAAS,GAAG,SAAS,CAAC;YAAC,CAAC;YAC3H,IAAI,SAAS;gBAAE,MAAM,kBAAE,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;CACF;AA5ED,4CA4EC"}

package/dist/maintenance/CodexWeekly.d.ts

@@ -0,0 +1,17 @@
+export declare const WEEK_SECONDS: number;
+export declare const INSPECTION_INTERVAL_MS = 3600000;
+export interface WeeklyObservation {
+    identity: string;
+    /** Stable, local-only account/bucket fingerprint, independent of credential refreshes. */
+    accountKey: string;
+    /** Local sampling time in milliseconds. */
+    observedAt: number;
+    /** Absolute provider reset timestamp in Unix seconds. */
+    resetsAt: number;
+    candidate: boolean;
+}
+/** Parse native numeric fields, never formatted /status text or window length alone. */
+export declare function codexWeeklyObservation(raw: unknown, accountId: string, credentialGeneration: string, observedAt: number): WeeklyObservation | undefined;
+/** Notification eligibility only; advancing timestamps do not prove a quota reset occurred. */
+export declare function floatingWeeklyPair(previous: WeeklyObservation, current: WeeklyObservation): boolean;
+//# sourceMappingURL=CodexWeekly.d.ts.map

package/dist/maintenance/CodexWeekly.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CodexWeekly.d.ts","sourceRoot":"","sources":["../../src/maintenance/CodexWeekly.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,YAAY,QAAY,CAAC;AACtC,eAAO,MAAM,sBAAsB,UAAW,CAAC;AAC/C,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,0FAA0F;IAC1F,UAAU,EAAE,MAAM,CAAC;IACnB,2CAA2C;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,wFAAwF;AACxF,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS,CA8BvJ;AAED,+FAA+F;AAC/F,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,iBAAiB,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAKnG"}

package/dist/maintenance/CodexWeekly.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.INSPECTION_INTERVAL_MS = exports.WEEK_SECONDS = void 0;
+exports.codexWeeklyObservation = codexWeeklyObservation;
+exports.floatingWeeklyPair = floatingWeeklyPair;
+const crypto_1 = require("crypto");
+exports.WEEK_SECONDS = 7 * 86400;
+exports.INSPECTION_INTERVAL_MS = 3600_000;
+/** Parse native numeric fields, never formatted /status text or window length alone. */
+function codexWeeklyObservation(raw, accountId, credentialGeneration, observedAt) {
+    if (!raw || typeof raw !== 'object' || !accountId || !Number.isFinite(observedAt))
+        return;
+    const value = raw;
+    if (value.accountId != null && value.accountId !== accountId)
+        return;
+    let buckets;
+    if (value.rateLimitsByLimitId != null) {
+        if (typeof value.rateLimitsByLimitId !== 'object' || Array.isArray(value.rateLimitsByLimitId))
+            return;
+        buckets = Object.entries(value.rateLimitsByLimitId);
+    }
+    else if (value.rateLimits && typeof value.rateLimits === 'object') {
+        buckets = [[value.rateLimits.limitId ?? 'codex', value.rateLimits]];
+    }
+    else
+        return;
+    const weekly = [];
+    for (const [key, bucket] of buckets) {
+        if (!bucket || typeof bucket !== 'object' || !key || key.length > 200)
+            return;
+        if (bucket.limitId != null && bucket.limitId !== key)
+            return;
+        for (const field of ['primary', 'secondary']) {
+            const window = bucket[field];
+            if (window == null)
+                continue;
+            if (typeof window !== 'object' || !Number.isFinite(window.usedPercent) || window.usedPercent < 0 || window.usedPercent > 100
+                || !Number.isFinite(window.windowDurationMins) || window.windowDurationMins <= 0
+                || !Number.isSafeInteger(window.resetsAt) || window.resetsAt <= 0)
+                return;
+            if (window.windowDurationMins === 10080)
+                weekly.push({ bucket: key, reset: window.resetsAt, used: window.usedPercent });
+        }
+    }
+    // Ambiguous weekly buckets cannot authorize a reminder for a guessed account/window.
+    if (weekly.length !== 1)
+        return;
+    const w = weekly[0];
+    return { identity: JSON.stringify([accountId, credentialGeneration, w.bucket]),
+        accountKey: (0, crypto_1.createHash)('sha256').update(JSON.stringify(['codex', accountId, w.bucket])).digest('hex'), observedAt, resetsAt: w.reset,
+        candidate: w.used === 0 && Math.abs(w.reset - observedAt / 1000 - exports.WEEK_SECONDS) <= 120 };
+}
+/** Notification eligibility only; advancing timestamps do not prove a quota reset occurred. */
+function floatingWeeklyPair(previous, current) {
+    const elapsed = current.observedAt - previous.observedAt;
+    return previous.identity === current.identity && previous.candidate && current.candidate
+        && elapsed >= exports.INSPECTION_INTERVAL_MS - 120_000 && elapsed <= exports.INSPECTION_INTERVAL_MS + 120_000
+        && Math.abs(current.resetsAt - previous.resetsAt - elapsed / 1000) <= 120;
+}
+//# sourceMappingURL=CodexWeekly.js.map

package/dist/maintenance/CodexWeekly.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CodexWeekly.js","sourceRoot":"","sources":["../../src/maintenance/CodexWeekly.ts"],"names":[],"mappings":";;;AAgBA,wDA8BC;AAGD,gDAKC;AAtDD,mCAAoC;AAEvB,QAAA,YAAY,GAAG,CAAC,GAAG,KAAK,CAAC;AACzB,QAAA,sBAAsB,GAAG,QAAQ,CAAC;AAY/C,wFAAwF;AACxF,SAAgB,sBAAsB,CAAC,GAAY,EAAE,SAAiB,EAAE,oBAA4B,EAAE,UAAkB;IACtH,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO;IAC1F,MAAM,KAAK,GAAG,GAAU,CAAC;IACzB,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO;IACrE,IAAI,OAA6B,CAAC;IAClC,IAAI,KAAK,CAAC,mBAAmB,IAAI,IAAI,EAAE,CAAC;QACtC,IAAI,OAAO,KAAK,CAAC,mBAAmB,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC;YAAE,OAAO;QACtG,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACtD,CAAC;SAAM,IAAI,KAAK,CAAC,UAAU,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QACpE,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,IAAI,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;IACtE,CAAC;;QAAM,OAAO;IACd,MAAM,MAAM,GAA2D,EAAE,CAAC;IAC1E,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACpC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG;YAAE,OAAO;QAC9E,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI,IAAI,MAAM,CAAC,OAAO,KAAK,GAAG;YAAE,OAAO;QAC7D,KAAK,MAAM,KAAK,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,CAAC;YAC7C,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC7B,IAAI,MAAM,IAAI,IAAI;gBAAE,SAAS;YAC7B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,WAAW,GAAG,CAAC,IAAI,MAAM,CAAC,WAAW,GAAG,GAAG;mBACvH,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,kBAAkB,CAAC,IAAI,MAAM,CAAC,kBAAkB,IAAI,CAAC;mBAC7E,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,QAAQ,IAAI,CAAC;gBAAE,OAAO;YAC5E,IAAI,MAAM,CAAC,kBAAkB,KAAK,KAAK;gBAAE,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;QAC1H,CAAC;IACH,CAAC;IACD,qFAAqF;IACrF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAChC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACpB,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,SAAS,EAAE,oBAAoB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;QAC5E,UAAU,EAAE,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK;QACpI,SAAS,EAAE,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,UAAU,GAAG,IAAI,GAAG,oBAAY,CAAC,IAAI,GAAG,EAAE,CAAC;AAC7F,CAAC;AAED,+FAA+F;AAC/F,SAAgB,kBAAkB,CAAC,QAA2B,EAAE,OAA0B;IACxF,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC;IACzD,OAAO,QAAQ,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,IAAI,QAAQ,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS;WACnF,OAAO,IAAI,8BAAsB,GAAG,OAAO,IAAI,OAAO,IAAI,8BAAsB,GAAG,OAAO;WAC1F,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC,QAAQ,GAAG,OAAO,GAAG,IAAI,CAAC,IAAI,GAAG,CAAC;AAC9E,CAAC"}

package/dist/maintenance/MaintenanceClient.d.ts

@@ -0,0 +1,23 @@
+import type { ExecutorConfig } from '../types/config';
+export interface MaintenanceTransport {
+    send(message: object): void;
+    on(event: 'disconnected', handler: () => void): void;
+}
+/** Local service lifecycle, deliberately independent of normal task and updater routing. */
+export declare class MaintenanceClient {
+    private readonly updates?;
+    private readonly subscriptions?;
+    private runningVersion?;
+    private bound;
+    private stopped;
+    private initializing?;
+    constructor(transport: MaintenanceTransport, configDir: string, serverUrl: string, deviceId: string, config: () => ExecutorConfig | undefined, enabled?: {
+        updateNotice?: boolean;
+        subscriptionInspection?: boolean;
+    });
+    started(version: string): Promise<void>;
+    private initialize;
+    handle(message: any): Promise<boolean>;
+    stop(): Promise<void>;
+}
+//# sourceMappingURL=MaintenanceClient.d.ts.map

package/dist/maintenance/MaintenanceClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MaintenanceClient.d.ts","sourceRoot":"","sources":["../../src/maintenance/MaintenanceClient.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACtD,MAAM,WAAW,oBAAoB;IAAG,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,EAAE,CAAC,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,IAAI,GAAG,IAAI,CAAA;CAAE;AAE3H,4FAA4F;AAC5F,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAgB;IACzC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAyB;IACxD,OAAO,CAAC,cAAc,CAAC,CAAS;IAChC,OAAO,CAAC,KAAK,CAAS;IACtB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,YAAY,CAAC,CAAgB;gBACzB,SAAS,EAAE,oBAAoB,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EACjG,MAAM,EAAE,MAAM,cAAc,GAAG,SAAS,EAAE,OAAO,GAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAC;QAAC,sBAAsB,CAAC,EAAE,OAAO,CAAA;KAAO;IAUhH,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK7C,OAAO,CAAC,UAAU;IAQZ,MAAM,CAAC,OAAO,EAAE,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC;IAetC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CAC5B"}

package/dist/maintenance/MaintenanceClient.js

@@ -0,0 +1,69 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MaintenanceClient = void 0;
+const UpdateNotices_1 = require("./UpdateNotices");
+const CodexStatusProbe_1 = require("./CodexStatusProbe");
+const SubscriptionInspection_1 = require("./SubscriptionInspection");
+const SubscriptionReminderStore_1 = require("./SubscriptionReminderStore");
+/** Local service lifecycle, deliberately independent of normal task and updater routing. */
+class MaintenanceClient {
+    updates;
+    subscriptions;
+    runningVersion;
+    bound = false;
+    stopped = false;
+    initializing;
+    constructor(transport, configDir, serverUrl, deviceId, config, enabled = {}) {
+        if (enabled.updateNotice !== false)
+            this.updates = new UpdateNotices_1.UpdateNotices(configDir, serverUrl, deviceId, m => transport.send(m));
+        if (enabled.subscriptionInspection !== false) {
+            const probe = new CodexStatusProbe_1.CodexStatusProbe({ config });
+            this.subscriptions = new SubscriptionInspection_1.SubscriptionInspection((0, SubscriptionInspection_1.inspectionAdapters)(signal => probe.inspect(signal)), m => transport.send(m), Date.now, undefined, undefined, new SubscriptionReminderStore_1.SubscriptionReminderStore(configDir, serverUrl, deviceId));
+        }
+        transport.on('disconnected', () => { this.bound = false; this.updates?.disconnected(); this.subscriptions?.disconnected(); });
+    }
+    async started(version) {
+        this.runningVersion = version;
+        await this.initialize();
+    }
+    initialize() {
+        if (this.stopped || !this.bound || !this.runningVersion)
+            return Promise.resolve();
+        return this.initializing ??= (async () => {
+            try {
+                await this.updates?.started(this.runningVersion);
+            }
+            catch {
+                console.warn('[Maintenance] Update notices unavailable; normal messaging is unchanged.');
+            }
+            if (!this.stopped)
+                this.subscriptions?.start();
+        })();
+    }
+    async handle(message) {
+        if (message.type === 'binding_confirm') {
+            this.bound = message.data?.success === true;
+            this.updates?.registered(message.data?.success === true && message.data?.capabilities?.updateNotice === true);
+            this.subscriptions?.registered(message.data?.success === true && message.data?.capabilities?.subscriptionInspection === true);
+            await this.initialize();
+            return false;
+        }
+        if (message.type === 'update_notice_ack' || message.type === 'update_notice_view') {
+            try {
+                await this.updates?.handle(message);
+            }
+            catch {
+                console.warn('[Maintenance] Update notice acknowledgement or paging failed.');
+            }
+            return true;
+        }
+        if (message.type === 'subscription_reminder_ack' || message.type === 'subscription_action') {
+            await this.subscriptions?.handle(message);
+            return true;
+        }
+        return false;
+    }
+    async stop() { this.stopped = true; this.updates?.stop(); await this.subscriptions?.stop(); }
+}
+exports.MaintenanceClient = MaintenanceClient;
+//# sourceMappingURL=MaintenanceClient.js.map

package/dist/maintenance/MaintenanceClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MaintenanceClient.js","sourceRoot":"","sources":["../../src/maintenance/MaintenanceClient.ts"],"names":[],"mappings":";;;AAAA,mDAAgD;AAChD,yDAAsD;AACtD,qEAAsF;AACtF,2EAAwE;AAIxE,4FAA4F;AAC5F,MAAa,iBAAiB;IACX,OAAO,CAAiB;IACxB,aAAa,CAA0B;IAChD,cAAc,CAAU;IACxB,KAAK,GAAG,KAAK,CAAC;IACd,OAAO,GAAG,KAAK,CAAC;IAChB,YAAY,CAAiB;IACrC,YAAY,SAA+B,EAAE,SAAiB,EAAE,SAAiB,EAAE,QAAgB,EACjG,MAAwC,EAAE,UAAwE,EAAE;QACpH,IAAI,OAAO,CAAC,YAAY,KAAK,KAAK;YAAE,IAAI,CAAC,OAAO,GAAG,IAAI,6BAAa,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7H,IAAI,OAAO,CAAC,sBAAsB,KAAK,KAAK,EAAE,CAAC;YAC7C,MAAM,KAAK,GAAG,IAAI,mCAAgB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;YAC/C,IAAI,CAAC,aAAa,GAAG,IAAI,+CAAsB,CAAC,IAAA,2CAAkB,EAAC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EACzH,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,qDAAyB,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;QACnG,CAAC;QACD,SAAS,CAAC,EAAE,CAAC,cAAc,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAChI,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAAe;QAC3B,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC;QAC9B,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;IAC1B,CAAC;IAEO,UAAU;QAChB,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,cAAc;YAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAClF,OAAO,IAAI,CAAC,YAAY,KAAK,CAAC,KAAK,IAAI,EAAE;YACvC,IAAI,CAAC;gBAAC,MAAM,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,cAAe,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,CAAC,IAAI,CAAC,0EAA0E,CAAC,CAAC;YAAC,CAAC;YAC9J,IAAI,CAAC,IAAI,CAAC,OAAO;gBAAE,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,CAAC;QACjD,CAAC,CAAC,EAAE,CAAC;IACP,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAY;QACvB,IAAI,OAAO,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YACvC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;YAC5C,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,IAAI,EAAE,YAAY,EAAE,YAAY,KAAK,IAAI,CAAC,CAAC;YAC9G,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,IAAI,EAAE,YAAY,EAAE,sBAAsB,KAAK,IAAI,CAAC,CAAC;YAC9H,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;YACxB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,mBAAmB,IAAI,OAAO,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;YAClF,IAAI,CAAC;gBAAC,MAAM,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,CAAC,IAAI,CAAC,+DAA+D,CAAC,CAAC;YAAC,CAAC;YACrI,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,2BAA2B,IAAI,OAAO,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;YAAC,MAAM,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;QACvJ,OAAO,KAAK,CAAC;IACf,CAAC;IACD,KAAK,CAAC,IAAI,KAAoB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;CAC7G;AA/CD,8CA+CC"}

package/dist/maintenance/PrivateStore.d.ts

@@ -0,0 +1,10 @@
+/** Small private, atomic state file. Invalid data fails closed, never erases a ledger. */
+export declare class PrivateStore<T> {
+    private readonly filename;
+    private readonly validate;
+    private writes;
+    constructor(filename: string, validate: (value: unknown) => value is T);
+    read(): Promise<T | undefined>;
+    write(value: T): Promise<void>;
+}
+//# sourceMappingURL=PrivateStore.d.ts.map

package/dist/maintenance/PrivateStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PrivateStore.d.ts","sourceRoot":"","sources":["../../src/maintenance/PrivateStore.ts"],"names":[],"mappings":"AAIA,0FAA0F;AAC1F,qBAAa,YAAY,CAAC,CAAC;IAEb,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAAU,OAAO,CAAC,QAAQ,CAAC,QAAQ;IADxE,OAAO,CAAC,MAAM,CAAqB;gBACN,QAAQ,EAAE,MAAM,EAAmB,QAAQ,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,KAAK,IAAI,CAAC;IAElG,IAAI,IAAI,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;IAapC,KAAK,CAAC,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;CAa/B"}