clauderipple 0.3.1 → 0.4.1

package/dist/router/src/providers/chatgpt/index.js

@@ -2,7 +2,8 @@
 // Codex backend (OpenAI Responses over SSE) and streaming the translated answer back.
 import crypto from "node:crypto";
 import http from "node:http";
-import { CredentialStore } from "./auth.js";
+import { CredentialPool, retryAfterMs } from "../../pool.js";
+import { ChatGptAccountPool } from "./accounts.js";
 import { SseParser } from "./sse.js";
 import { fetchWithRetry } from "../retry.js";
 import { looksLikeAuth } from "../openai/index.js";
@@ -124,20 +125,163 @@ export function rateLimitsFromUsage(body) {
         at: Date.now(),
     };
 }
+/**
+ * The request headers of Codex's that the backend reads, and nothing else: its protocol and
+ * session metadata. The caller's credential is not among them — the account decides that.
+ */
+const CODEX_FORWARD_HEADERS = [
+    "content-type", "content-encoding", "accept", "openai-beta", "originator", "version", "user-agent",
+    "session_id", "session-id", "thread-id", "x-client-request-id",
+    "x-codex-beta-features", "x-codex-installation-id", "x-codex-parent-thread-id", "x-codex-turn-metadata",
+    "x-codex-turn-state", "x-codex-window-id", "x-oai-attestation", "x-openai-subagent", "x-responsesapi-include-timing-metrics",
+];
+export function codexForwardHeaders(headers) {
+    const out = {};
+    for (const name of CODEX_FORWARD_HEADERS) {
+        const v = headers[name];
+        if (typeof v === "string")
+            out[name] = v;
+        else if (Array.isArray(v))
+            out[name] = v.join(", ");
+    }
+    out.originator ??= "codex_cli_rs";
+    return out;
+}
+function sendOpenAiError(res, status, type, message, note, resetsInSeconds) {
+    const body = JSON.stringify({ error: { type, message, ...(resetsInSeconds ? { resets_in_seconds: resetsInSeconds } : {}) } });
+    if (!res.headersSent)
+        res.writeHead(status, { "content-type": "application/json", ...(resetsInSeconds ? { "retry-after": String(resetsInSeconds) } : {}) }).end(body);
+    return { status, bytes: Buffer.byteLength(body), note };
+}
+/** When a window is back, in ms from now: its own countdown, else its reset time (epoch seconds). */
+function windowResetMs(w, now) {
+    if (typeof w.reset_after_seconds === "number" && w.reset_after_seconds >= 0)
+        return w.reset_after_seconds * 1000;
+    if (typeof w.reset_at === "number") {
+        // Epoch seconds as measured; a value already in milliseconds would otherwise park the account
+        // for decades (bounded to hours by the pool, still hours for nothing).
+        const at = w.reset_at > 1e12 ? w.reset_at : w.reset_at * 1000;
+        if (at > now)
+            return at - now;
+    }
+    return undefined;
+}
+/**
+ * How long an account is out, from a rate-limit snapshot: the latest reset among the windows it
+ * has used up, since it is usable only once every full window has reset. Undefined when no window
+ * is full — the account is not out, whatever else the snapshot says.
+ */
+export function exhaustedForMs(snapshot, now = Date.now()) {
+    const limits = (snapshot?.rate_limits ?? null);
+    let out;
+    for (const w of [limits?.primary, limits?.secondary]) {
+        if (!w || typeof w.used_percent !== "number" || w.used_percent < 100)
+            continue;
+        const ms = windowResetMs(w, now) ?? 60_000;
+        out = Math.max(out ?? 0, ms);
+    }
+    return out;
+}
 export class ChatGptAdapter {
     name;
     cfg;
-    creds;
+    accounts;
+    /** Cooldowns and conversation stickiness, shared with the proxy's other credential pools. */
+    pool;
     log;
-    lastRateLimits = null;
-    constructor(name, cfg, home, log) {
+    /** Latest quota per account (owner id), from response headers or `/wham/usage`. */
+    rateLimitsByAccount = new Map();
+    /** The account that answered last: the one whose quota the single-number readers see. */
+    activeOwner = null;
+    constructor(name, cfg, home, log, pool = new CredentialPool(), fetchImpl) {
         this.name = name;
         this.cfg = cfg;
         this.log = log;
-        this.creds = new CredentialStore(home, cfg.auth ?? "auto");
+        this.pool = pool;
+        this.accounts = new ChatGptAccountPool({ home, mode: cfg.auth ?? "auto", log, ...(fetchImpl ? { fetch: fetchImpl } : {}) });
+    }
+    /**
+     * The quota of the account in use, in the shape it always had. Readers that want one number
+     * (the tray, the health line, other tools reading `/api/status`) keep getting one; the
+     * per-account view is `accountStatus()`.
+     */
+    get lastRateLimits() {
+        const credentials = this.accounts.peekCredentials();
+        const active = credentials.find((c) => c.ownerId === this.activeOwner);
+        if (active && this.pool.hasUsable(this.name, [active]) && this.rateLimitsByAccount.has(active.ownerId))
+            return this.rateLimitsByAccount.get(active.ownerId);
+        // Otherwise the account the next turn would go to: a spent account's 100% is not what is left.
+        const next = credentials.find((c) => this.pool.hasUsable(this.name, [c]) && this.rateLimitsByAccount.has(c.ownerId))
+            ?? credentials.find((c) => this.rateLimitsByAccount.has(c.ownerId));
+        return next ? this.rateLimitsByAccount.get(next.ownerId) : null;
+    }
+    /** Record a snapshot for an account; a full window takes it out of rotation until that window resets. */
+    noteRateLimits(credential, snapshot) {
+        if (!snapshot)
+            return;
+        this.rateLimitsByAccount.set(credential.ownerId, snapshot);
+        const outMs = exhaustedForMs(snapshot);
+        if (outMs !== undefined)
+            this.pool.penalise(this.name, credential.id, 429, outMs);
     }
     describeAuth() {
-        return this.creds.describe();
+        const all = this.accounts.summaries();
+        const usable = this.accounts.peekCredentials().filter((c) => this.pool.hasUsable(this.name, [c])).length;
+        return `accounts=${all.length} usable=${usable} mode=${this.cfg.auth ?? "auto"}`;
+    }
+    /** Whether any account could answer now, for the proxy's choice between this provider and a fallback. */
+    hasUsable() {
+        return this.pool.hasUsable(this.name, this.accounts.peekCredentials());
+    }
+    signedIn() {
+        return this.accounts.signedIn();
+    }
+    /** Every account with its rotation state and last known quota. Metadata only — no token leaves. */
+    accountStatus() {
+        const credentials = this.accounts.peekCredentials();
+        const reports = new Map(this.pool.report(this.name, credentials).map((r) => [r.id, r]));
+        return this.accounts.summaries().map((summary) => {
+            const credential = credentials.find((c) => c.ownerId === summary.id);
+            const report = credential ? reports.get(credential.id) : undefined;
+            const state = summary.paused ? "paused" : !credential ? "needs-login" : report?.state ?? "ready";
+            return {
+                ...summary,
+                state,
+                ...(report?.cooldownSeconds ? { cooldownSeconds: report.cooldownSeconds } : {}),
+                quota: this.rateLimitsByAccount.get(summary.id) ?? null,
+                active: summary.id === this.activeOwner,
+            };
+        });
+    }
+    /** Put a cooling account back into rotation now (dashboard action). */
+    clearCooldown(ownerId) {
+        for (const c of this.accounts.peekCredentials())
+            if (c.ownerId === ownerId)
+                this.pool.clear(this.name, c.id);
+    }
+    /**
+     * An account for one turn: the conversation's own while it is healthy, else the first usable one.
+     * "none" when nothing is signed in; null when every account is cooling or already tried.
+     */
+    async pick(conversation, tried = new Set()) {
+        const all = await this.accounts.credentials();
+        if (all.length === 0)
+            return "none";
+        const rest = all.filter((c) => !tried.has(c.ownerId));
+        return this.pool.pick(this.name, rest, conversation);
+    }
+    /** For side calls (search, catalogue, quota) with no conversation: a usable account, else any. */
+    async anyCredential() {
+        const all = await this.accounts.credentials();
+        if (all.length === 0)
+            return new Error("no ChatGPT credentials: run `clauderipple login`, or sign in to the Codex CLI once");
+        return this.pool.pick(this.name, all) ?? all[0];
+    }
+    /** The soonest any account is back, for the message when all of them are out. */
+    soonestBackMs() {
+        const reports = this.pool.report(this.name, this.accounts.peekCredentials());
+        const cooling = reports.filter((r) => r.state === "cooling" && r.cooldownSeconds).map((r) => r.cooldownSeconds * 1000);
+        return cooling.length ? Math.min(...cooling) : undefined;
     }
     /**
      * Hosted web search through the same Codex backend and credential as ordinary ChatGPT turns.
@@ -156,7 +300,7 @@ export class ChatGptAdapter {
         // would violate the caller's request; fail visibly so the proxy can choose another backend.
         if (query.blockedDomains?.length)
             throw new Error("ChatGPT web search does not support blocked_domains");
-        const tokens = await this.creds.get();
+        const tokens = await this.anyCredential();
         if (tokens instanceof Error)
             throw tokens;
         const id = crypto.randomUUID();
@@ -199,13 +343,11 @@ export class ChatGptAdapter {
             body: JSON.stringify(body),
             signal: requestSignal,
         });
-        const rateLimits = rateLimitsFromHeaders(res.headers);
-        if (rateLimits)
-            this.lastRateLimits = rateLimits;
+        this.noteRateLimits(tokens, rateLimitsFromHeaders(res.headers));
         if (!res.ok || !res.body) {
             const text = await res.text().catch(() => "");
             if (res.status === 401)
-                this.creds.invalidate();
+                void this.accounts.forceRefresh(tokens.ownerId);
             throw new Error(`ChatGPT web search: HTTP ${res.status}${text ? ` ${redactErrorText(text, [tokens.accessToken], 200)}` : ""}`);
         }
         const parser = new SseParser();
@@ -258,22 +400,28 @@ export class ChatGptAdapter {
      * Ask the backend for the current quota instead of waiting for a request to carry it in the
      * response headers. Without this, `/api/status` shows the last time GPT traffic flowed — 11
      * hours stale in one measurement (2026-09-20) — and the product's GPT budget read is wrong.
-     * Never throws and never clears a good snapshot; returns the new one, or null on failure.
+     * Every account is asked, so the dashboard can show each one and an account that is already
+     * spent leaves rotation before a turn finds out the hard way. Never throws and never clears a
+     * good snapshot; returns the active account's new one, or null when none could be read.
      */
     fetchRateLimits() {
         if (this.rateLimitsInFlight)
             return this.rateLimitsInFlight;
-        this.rateLimitsInFlight = this.fetchRateLimitsOnce().finally(() => {
+        this.rateLimitsInFlight = this.fetchAllRateLimits().finally(() => {
             this.rateLimitsInFlight = null;
         });
         return this.rateLimitsInFlight;
     }
-    async fetchRateLimitsOnce() {
-        const tokens = await this.creds.get();
-        if (tokens instanceof Error) {
-            this.log.warn(`chatgpt ${this.name}: rate-limit fetch skipped: ${tokens.message}`);
+    async fetchAllRateLimits() {
+        const all = await this.accounts.credentials();
+        if (all.length === 0) {
+            this.log.warn(`chatgpt ${this.name}: rate-limit fetch skipped: no ChatGPT credentials`);
             return null;
         }
+        const results = await Promise.all(all.map((c) => this.fetchRateLimitsOnce(c)));
+        return results.some(Boolean) ? this.lastRateLimits : null;
+    }
+    async fetchRateLimitsOnce(tokens, replayed = false) {
         const ac = new AbortController();
         const timer = setTimeout(() => ac.abort(), USAGE_TIMEOUT_MS);
         let res;
@@ -297,9 +445,14 @@ export class ChatGptAdapter {
             clearTimeout(timer);
         }
         if (!res.ok) {
-            if (res.status === 401)
-                this.creds.invalidate();
-            this.log.warn(`chatgpt ${this.name}: rate-limit fetch HTTP ${res.status}`);
+            // A bare 401 here is usually a token that went stale early: one refresh and one replay, and
+            // no more — asking again and again with a dead grant is the loop to avoid.
+            if (res.status === 401 && !replayed && await this.accounts.forceRefresh(tokens.ownerId)) {
+                const fresh = this.accounts.peekCredentials().find((c) => c.ownerId === tokens.ownerId);
+                if (fresh)
+                    return this.fetchRateLimitsOnce(fresh, true);
+            }
+            this.log.warn(`chatgpt ${this.name}: rate-limit fetch HTTP ${res.status} (account ${tokens.ownerId.slice(0, 8)})`);
             return null;
         }
         const parsed = rateLimitsFromUsage(await res.json().catch(() => null));
@@ -307,7 +460,7 @@ export class ChatGptAdapter {
             this.log.warn(`chatgpt ${this.name}: rate-limit fetch returned no primary window`);
             return null;
         }
-        this.lastRateLimits = parsed;
+        this.noteRateLimits(tokens, parsed);
         return parsed;
     }
     /** One in-flight catalogue lookup shared by every caller, and the last good list for an hour. */
@@ -332,7 +485,7 @@ export class ChatGptAdapter {
         return this.modelsInFlight;
     }
     async fetchModelsOnce() {
-        const tokens = await this.creds.get();
+        const tokens = await this.anyCredential();
         if (tokens instanceof Error) {
             this.log.warn(`chatgpt ${this.name}: model-catalog fetch skipped: ${tokens.message}`);
             return null;
@@ -362,7 +515,7 @@ export class ChatGptAdapter {
         if (!res.ok) {
             // The status only: the body can echo the request, and the token rides on it.
             if (res.status === 401)
-                this.creds.invalidate();
+                void this.accounts.forceRefresh(tokens.ownerId);
             this.log.warn(`chatgpt ${this.name}: model-catalog fetch HTTP ${res.status}`);
             return null;
         }
@@ -401,7 +554,7 @@ export class ChatGptAdapter {
             const dir = path.join(homeDir(), "debug");
             fs.mkdirSync(dir, { recursive: true });
             const file = path.join(dir, `upstream-${new Date().toISOString().replace(/[:.]/g, "-")}-${status}.json`);
-            fs.writeFileSync(file, JSON.stringify({ status, upstream: upstreamText, request: upstreamReq, anthropic }, null, 1));
+            fs.writeFileSync(file, JSON.stringify({ status, upstream: upstreamText, request: upstreamReq, anthropic }, null, 1), { mode: 0o600 });
             const files = fs.readdirSync(dir).filter((f) => f.startsWith("upstream-")).sort();
             for (const f of files.slice(0, Math.max(0, files.length - 60)))
                 fs.rmSync(path.join(dir, f), { force: true });
@@ -410,6 +563,250 @@ export class ChatGptAdapter {
             this.log.warn(`chatgpt ${this.name}: debug dump failed: ${e.message}`);
         }
     }
+    /**
+     * Send one turn, moving to the next account while nothing has reached the client:
+     *
+     * - 401, or a 403 that reads as a credential refusal: one refresh of that account and a replay;
+     *   refused again, the account is quarantined (and marked for sign-in when it is ours).
+     * - 429 and 402: the account rests until its window resets, from `retry-after` or the
+     *   `x-codex-*` reset the backend reports, and the next account takes the turn.
+     * - Any other 403, 5xx, or no connection at all: a short rest, and the next account.
+     * - Anything else is the request's fault; another account would refuse it the same way.
+     *
+     * Each account is tried at most once per turn (a refreshed token is the same account). The
+     * caller supplies everything but the credential, and turns a failure into its client's wire.
+     */
+    async sendToAnAccount(spec) {
+        const tried = new Set();
+        const replayed = new Set();
+        const refreshed = new Set();
+        let last = null;
+        let lastThrown = null;
+        for (;;) {
+            const credential = await this.pick(spec.conversation, tried);
+            if (credential === "none")
+                return { kind: "no-account" };
+            if (credential === null) {
+                if (last)
+                    return last;
+                if (lastThrown)
+                    return { kind: "unreachable", error: lastThrown };
+                // Every account was already resting when the turn arrived.
+                const backMs = this.soonestBackMs();
+                return { kind: "all-resting", ...(backMs ? { backMs } : {}) };
+            }
+            const upstreamHeaders = { ...spec.headers(credential), ...credential.headers };
+            let upstream;
+            try {
+                // Retried here on the same account, before any status or byte reaches the client, so a
+                // relay's hiccup is absorbed inside the turn instead of arriving as an error to retry by hand.
+                upstream = await fetchWithRetry(`${(this.cfg.url ?? DEFAULT_BASE).replace(/\/$/, "")}${spec.path}`, {
+                    method: spec.method ?? "POST",
+                    headers: upstreamHeaders,
+                    ...(spec.body !== undefined ? { body: spec.body } : {}),
+                    signal: spec.signal,
+                }, { log: (line) => this.log.info(`chatgpt ${this.name}: ${line}`) });
+            }
+            catch (e) {
+                if (spec.signal.aborted)
+                    return { kind: "aborted" };
+                this.pool.penalise(this.name, credential.id, 0);
+                tried.add(credential.ownerId);
+                lastThrown = e;
+                this.log.info(`chatgpt ${this.name}: account ${credential.ownerId.slice(0, 8)} unreachable (${e.message}); trying another`);
+                continue;
+            }
+            this.noteRateLimits(credential, rateLimitsFromHeaders(upstream.headers));
+            if (upstream.ok && upstream.body) {
+                this.pool.succeed(this.name, credential.id);
+                this.activeOwner = credential.ownerId;
+                return { kind: "ok", upstream, credential };
+            }
+            const text = await upstream.text().catch(() => "");
+            // The workspace id is masked too: the dashboard never shows it, and an echoing error body must not either.
+            const safeText = redactErrorText(text, [...credentialHeaderValues(Object.entries(upstreamHeaders)), credential.accountId]);
+            const status = upstream.status;
+            this.log.warn(`chatgpt ${this.name}: account ${credential.ownerId.slice(0, 8)} answered ${status}: ${safeText.slice(0, 400)}`);
+            const credentialRefused = status === 401 || (status === 403 && looksLikeAuth(text));
+            if (credentialRefused) {
+                if (!replayed.has(credential.ownerId)) {
+                    replayed.add(credential.ownerId);
+                    if (await this.accounts.forceRefresh(credential.ownerId)) {
+                        refreshed.add(credential.ownerId);
+                        this.log.info(`chatgpt ${this.name}: account ${credential.ownerId.slice(0, 8)} refreshed after ${status}; replaying`);
+                        continue;
+                    }
+                }
+                else if (refreshed.has(credential.ownerId) && status === 401) {
+                    // A token minted a moment ago and refused with a 401 anyway: the account itself is refused.
+                    // Only a 401 says that — a 403 that merely mentions a token is often about the request, and
+                    // would otherwise sign every account out in one turn. A refresh that failed to reach
+                    // OpenAI proves nothing either way and leaves the account alone.
+                    this.accounts.reject(credential);
+                }
+            }
+            const headerRecord = Object.fromEntries(upstream.headers.entries());
+            const snapshot = rateLimitsFromHeaders(upstream.headers);
+            const retryHeader = headerRecord["retry-after"] ? retryAfterMs({ "retry-after": headerRecord["retry-after"] }) : undefined;
+            const waitMs = retryHeader ?? exhaustedForMs(snapshot) ?? retryAfterMs(headerRecord);
+            // A refusal here is a rest, never a pool quarantine: "sign in again" is the store's to say
+            // (needsReauth, above), and a quarantine would outlive the new token a sign-in brings.
+            const verdict = this.pool.penalise(this.name, credential.id, credentialRefused ? 403 : status, waitMs, text);
+            last = { kind: "refused", status, text: safeText, headers: upstream.headers, ...(status === 429 && waitMs ? { retryAfterSeconds: Math.ceil(waitMs / 1000) } : {}) };
+            if (!verdict.retryable)
+                return last;
+            tried.add(credential.ownerId);
+        }
+    }
+    /** Which account issued each turn-state token Codex echoes back, so a moved conversation drops a foreign one. */
+    turnStateIssuer = new Map();
+    /**
+     * Codex's own ChatGPT traffic, passed through unchanged except for the account: Codex already
+     * speaks the backend's wire (Responses, `store: false`, its session headers), so the body and its
+     * protocol headers go as they are and only `authorization` / `chatgpt-account-id` are chosen here.
+     * That is what lets Codex keep working on account 2 when account 1 runs out, without signing out.
+     *
+     * With no account of ours signed in, or every one of them resting, the caller's own login — the
+     * one Codex sent — is used as it is, so pointing Codex here never leaves it worse off.
+     */
+    async passthrough(req, res, subPath, body, conversation, 
+    /** `onCompleted` fires at `response.completed`: Codex hangs up right after it, and that is a finished turn. */
+    opts = {}) {
+        const ac = new AbortController();
+        const onClose = () => ac.abort();
+        res.on("close", onClose);
+        const forwarded = codexForwardHeaders(req.headers);
+        // Codex's body goes out as it came, compressed; a rewritten one does not carry the old encoding.
+        if (!opts.bodyEncoded || !body)
+            delete forwarded["content-encoding"];
+        const clientTurnState = forwarded["x-codex-turn-state"];
+        const method = req.method ?? "POST";
+        const sent = await this.sendToAnAccount({
+            conversation,
+            path: `/codex${subPath}`,
+            method,
+            ...(body ? { body } : {}),
+            signal: ac.signal,
+            headers: (credential) => {
+                const out = { ...forwarded };
+                // A token another account issued means nothing to this one (a conversation that moved).
+                const issuer = clientTurnState ? this.turnStateIssuer.get(clientTurnState) : undefined;
+                if (clientTurnState && issuer && issuer !== credential.ownerId)
+                    delete out["x-codex-turn-state"];
+                return out;
+            },
+        });
+        let upstream;
+        let owner = null;
+        if (sent.kind === "ok") {
+            upstream = sent.upstream;
+            owner = sent.credential.ownerId;
+        }
+        else if (sent.kind === "aborted") {
+            res.off("close", onClose);
+            return { status: 0, bytes: 0, note: "client closed" };
+        }
+        else {
+            const callerAuth = typeof req.headers.authorization === "string" && typeof req.headers["chatgpt-account-id"] === "string";
+            // Out of accounts — none signed in, all resting, or the last one just ran out on this turn.
+            const outOfAccounts = sent.kind === "no-account" || sent.kind === "all-resting" || (sent.kind === "refused" && (sent.status === 429 || sent.status === 402));
+            if (outOfAccounts && callerAuth) {
+                // Codex's own login, exactly as it sent it. Not refreshed or stored: it is Codex's. A turn
+                // token one of our accounts issued means nothing to it.
+                const callerHeaders = { ...forwarded };
+                if (clientTurnState && this.turnStateIssuer.has(clientTurnState))
+                    delete callerHeaders["x-codex-turn-state"];
+                try {
+                    upstream = await fetch(`${(this.cfg.url ?? DEFAULT_BASE).replace(/\/$/, "")}/codex${subPath}`, {
+                        method,
+                        headers: { ...callerHeaders, authorization: String(req.headers.authorization), "chatgpt-account-id": String(req.headers["chatgpt-account-id"]) },
+                        ...(body ? { body } : {}),
+                        signal: ac.signal,
+                    });
+                }
+                catch (e) {
+                    res.off("close", onClose);
+                    if (ac.signal.aborted)
+                        return { status: 0, bytes: 0, note: "client closed" };
+                    return sendOpenAiError(res, 502, "api_error", `ChatGPT backend unreachable: ${e.message}`, "caller login unreachable");
+                }
+            }
+            else {
+                res.off("close", onClose);
+                if (sent.kind === "unreachable")
+                    return sendOpenAiError(res, 502, "api_error", `ChatGPT backend unreachable: ${sent.error.message}`, "unreachable");
+                if (sent.kind === "no-account")
+                    return sendOpenAiError(res, 401, "invalid_request_error", "no ChatGPT account: run `clauderipple login`", "no credentials");
+                if (sent.kind === "all-resting") {
+                    // The shape the backend itself uses, so Codex shows its own "usage limit" message and wait.
+                    const seconds = sent.backMs ? Math.ceil(sent.backMs / 1000) : undefined;
+                    return sendOpenAiError(res, 429, "usage_limit_reached", "Every ChatGPT account signed in to ClaudeRipple has reached its usage limit.", "all accounts resting", seconds);
+                }
+                // The backend's own refusal, as Codex would have seen it without us (secrets masked).
+                const text = sent.text || JSON.stringify({ error: { message: `HTTP ${sent.status}` } });
+                res.writeHead(sent.status, { "content-type": sent.headers.get("content-type") ?? "application/json", ...(sent.retryAfterSeconds ? { "retry-after": String(sent.retryAfterSeconds) } : {}) }).end(text);
+                return { status: sent.status, bytes: Buffer.byteLength(text), note: `upstream ${sent.status}` };
+            }
+        }
+        const issued = upstream.headers.get("x-codex-turn-state");
+        if (issued && owner) {
+            this.turnStateIssuer.set(issued, owner);
+            if (this.turnStateIssuer.size > 1000)
+                this.turnStateIssuer.delete(this.turnStateIssuer.keys().next().value);
+        }
+        // Relay status, the protocol headers Codex reads (rate limits, turn state, request ids) and the
+        // body byte for byte. The body is read alongside for the request log's token counts.
+        const outHeaders = {};
+        for (const [k, v] of upstream.headers) {
+            if (k === "content-type" || k === "cache-control" || k === "retry-after" || k.startsWith("x-codex-") || k.startsWith("openai-") || k === "x-request-id" || k === "x-oai-request-id")
+                outHeaders[k] = v;
+        }
+        res.writeHead(upstream.status, outHeaders);
+        const parser = new SseParser();
+        const decoder = new TextDecoder();
+        let bytes = 0;
+        let usage;
+        // The backend answers Codex's streaming turns with no content-type at all (measured 2026-09-24),
+        // so anything not declared JSON is read as the event stream it is.
+        const isSse = !/json/i.test(upstream.headers.get("content-type") ?? "");
+        try {
+            if (upstream.body) {
+                const reader = upstream.body.getReader();
+                for (;;) {
+                    const { done, value } = await reader.read();
+                    if (done)
+                        break;
+                    bytes += value.length;
+                    if (!res.writableEnded && !res.destroyed)
+                        res.write(value);
+                    if (isSse) {
+                        for (const ev of parser.feed(decoder.decode(value, { stream: true }))) {
+                            if (ev.type !== "response.completed")
+                                continue;
+                            const u = ev.response?.usage;
+                            if (u) {
+                                const cached = u.input_tokens_details?.cached_tokens ?? 0;
+                                usage = { input: (u.input_tokens ?? 0) - cached, cached, output: u.output_tokens ?? 0 };
+                            }
+                            opts.onCompleted?.({ status: upstream.status, bytes, ...(usage ? { usage } : {}), note: `codex passthrough account=${owner ? owner.slice(0, 8) : "caller"}` });
+                        }
+                    }
+                }
+            }
+        }
+        catch (e) {
+            if (!ac.signal.aborted)
+                this.log.warn(`chatgpt ${this.name}: codex passthrough interrupted: ${e.message}`);
+            res.destroy();
+            return { status: upstream.status, bytes, note: "stream interrupted" };
+        }
+        finally {
+            res.off("close", onClose);
+        }
+        if (!res.writableEnded)
+            res.end();
+        return { status: upstream.status, bytes, ...(usage ? { usage } : {}), note: `codex passthrough account=${owner ? owner.slice(0, 8) : "caller"}` };
+    }
     /** Handle a fully-read Messages request. `model`/`effort` already resolved by routing. */
     async handle(req, res, path, json, model, effort) {
         if (path.startsWith("/v1/messages/count_tokens")) {
@@ -417,12 +814,6 @@ export class ChatGptAdapter {
             res.writeHead(200, { "content-type": "application/json", "content-length": String(body.length) }).end(body);
             return { status: 200, bytes: body.length, note: "estimated" };
         }
-        const tokens = await this.creds.get();
-        if (tokens instanceof Error) {
-            const e = anthropicError(401, "authentication_error", tokens.message);
-            res.writeHead(e.status, { "content-type": "application/json" }).end(e.body);
-            return { status: e.status, bytes: e.body.length, note: "no credentials" };
-        }
         // Dropping a tool the model was meant to have is worth a line: the alternative to this drop is
         // an empty answer with nothing logged anywhere, which is what made it expensive to find.
         const serverTools = serverToolNames(json.tools);
@@ -441,65 +832,73 @@ export class ChatGptAdapter {
         const ac = new AbortController();
         const onClose = () => ac.abort();
         res.on("close", onClose);
-        const turnState = this.turnStateByKey.get(cacheKey);
-        const upstreamHeaders = {
-            "content-type": "application/json",
-            accept: "text/event-stream",
-            authorization: `Bearer ${tokens.accessToken}`,
-            "chatgpt-account-id": tokens.accountId,
-            "OpenAI-Beta": "responses=experimental",
-            originator: "codex_cli_rs",
-            // The conversation's identity, as the Codex CLI states it. This is what the backend keys
-            // the prompt cache on since mid-September 2026 (see `conversationId` in translate.ts).
-            "session-id": cacheKey,
-            "thread-id": cacheKey,
-            "x-client-request-id": cacheKey,
-            "x-codex-window-id": `${cacheKey}:0`,
-            ...(turnState ? { "x-codex-turn-state": turnState } : {}),
-        };
-        const upstreamSecrets = credentialHeaderValues(Object.entries(upstreamHeaders));
-        let upstream;
-        try {
-            // Retried here, before any status or byte reaches the client, so a relay's hiccup is absorbed
-            // inside the turn instead of arriving as an error the user has to retry by hand.
-            upstream = await fetchWithRetry(`${(this.cfg.url ?? DEFAULT_BASE).replace(/\/$/, "")}/codex/responses`, {
-                method: "POST",
-                headers: upstreamHeaders,
-                body,
-                signal: ac.signal,
-            }, { log: (line) => this.log.info(`chatgpt ${this.name}: ${line}`) });
-        }
-        catch (e) {
+        // One account answers the turn. Which one is decided here, and a refusal before any byte has
+        // reached the client moves the same turn to the next account, so the client is answered on its
+        // first ask. The conversation stays on the account that answered: moving it costs the cache.
+        const sent = await this.sendToAnAccount({
+            conversation: cacheKey,
+            path: "/codex/responses",
+            body,
+            signal: ac.signal,
+            headers: (credential) => {
+                // Turn state is issued per account; another account's would be meaningless to the backend.
+                const turnState = this.turnStateByKey.get(`${credential.ownerId}\0${cacheKey}`);
+                return {
+                    "content-type": "application/json",
+                    accept: "text/event-stream",
+                    "OpenAI-Beta": "responses=experimental",
+                    originator: "codex_cli_rs",
+                    // The conversation's identity, as the Codex CLI states it. This is what the backend keys
+                    // the prompt cache on since mid-September 2026 (see `conversationId` in translate.ts).
+                    "session-id": cacheKey,
+                    "thread-id": cacheKey,
+                    "x-client-request-id": cacheKey,
+                    "x-codex-window-id": `${cacheKey}:0`,
+                    ...(turnState ? { "x-codex-turn-state": turnState } : {}),
+                };
+            },
+        });
+        if (sent.kind !== "ok") {
             res.off("close", onClose);
-            if (ac.signal.aborted)
+            if (sent.kind === "aborted")
                 return { status: 0, bytes: 0, note: "client closed" };
-            const err = anthropicError(502, "api_error", `ChatGPT backend unreachable: ${e.message}`);
-            if (!res.headersSent)
-                res.writeHead(err.status, { "content-type": "application/json" }).end(err.body);
-            throw e; // let the proxy feed health with the connect error
-        }
-        const fromHeaders = rateLimitsFromHeaders(upstream.headers);
-        if (fromHeaders)
-            this.lastRateLimits = fromHeaders;
+            if (sent.kind === "unreachable") {
+                const err = anthropicError(502, "api_error", `ChatGPT backend unreachable: ${sent.error.message}`);
+                if (!res.headersSent)
+                    res.writeHead(err.status, { "content-type": "application/json" }).end(err.body);
+                throw sent.error; // let the proxy feed health with the connect error
+            }
+            let err;
+            let retryAfterSeconds;
+            let note;
+            if (sent.kind === "no-account") {
+                err = anthropicError(401, "authentication_error", "no ChatGPT credentials: run `clauderipple login`, or sign in to the Codex CLI once");
+                note = "no credentials";
+            }
+            else if (sent.kind === "all-resting") {
+                const when = sent.backMs ? ` The first is usable again at ${new Date(Date.now() + sent.backMs).toLocaleTimeString()}.` : "";
+                err = anthropicError(429, "rate_limit_error", `ChatGPT: every signed-in account is at its usage limit.${when}`);
+                if (sent.backMs)
+                    retryAfterSeconds = Math.ceil(sent.backMs / 1000);
+                note = "all accounts resting";
+            }
+            else {
+                err = mapHttpError(sent.status, sent.text);
+                retryAfterSeconds = sent.retryAfterSeconds;
+                note = `upstream ${sent.status}`;
+                if (this.cfg.debugDump)
+                    this.dump(sent.status, json, upstreamReq, sent.text);
+            }
+            res.writeHead(err.status, { "content-type": "application/json", ...(retryAfterSeconds ? { "retry-after": String(retryAfterSeconds) } : {}) }).end(err.body);
+            return { status: err.status, bytes: err.body.length, note };
+        }
+        const { upstream, credential } = sent;
         const nextTurnState = upstream.headers.get("x-codex-turn-state");
         if (nextTurnState) {
-            this.turnStateByKey.set(cacheKey, nextTurnState);
+            this.turnStateByKey.set(`${credential.ownerId}\0${cacheKey}`, nextTurnState);
             if (this.turnStateByKey.size > 500)
                 this.turnStateByKey.delete(this.turnStateByKey.keys().next().value);
         }
-        if (!upstream.ok || !upstream.body) {
-            const text = await upstream.text().catch(() => "");
-            const safeText = redactErrorText(text, upstreamSecrets);
-            if (upstream.status === 401)
-                this.creds.invalidate();
-            const err = mapHttpError(upstream.status, safeText);
-            this.log.warn(`chatgpt ${this.name}: upstream ${upstream.status} for ${model}: ${safeText.slice(0, 400)}`);
-            if (this.cfg.debugDump)
-                this.dump(upstream.status, json, upstreamReq, safeText);
-            res.off("close", onClose);
-            res.writeHead(err.status, { "content-type": "application/json" }).end(err.body);
-            return { status: err.status, bytes: err.body.length, note: `upstream ${upstream.status}` };
-        }
         if (this.cfg.debugDump === "all")
             this.dump(upstream.status, json, upstreamReq, "");
         const wantStream = json.stream === true;
@@ -525,8 +924,8 @@ export class ChatGptAdapter {
                     break;
                 for (const ev of parser.feed(decoder.decode(value, { stream: true }))) {
                     const outEvents = mapper.feed(ev);
-                    if (mapper.rateLimits)
-                        this.lastRateLimits = mapper.rateLimits;
+                    if (mapper.rateLimits && mapper.rateLimits !== this.rateLimitsByAccount.get(credential.ownerId))
+                        this.noteRateLimits(credential, mapper.rateLimits);
                     this.rememberInput(cacheKey, mapper.usage);
                     if (wantStream)
                         for (const o of outEvents)