codex-multi-auth 1.2.1 → 1.2.4

package/README.md

@@ -308,9 +308,9 @@ codex auth doctor --json
 
 ## Release Notes
 
-- Current stable: [docs/releases/v1.1.10.md](docs/releases/v1.1.10.md)
-- Previous stable: [docs/releases/v0.1.9.md](docs/releases/v0.1.9.md)
-- Earlier stable: [docs/releases/v0.1.8.md](docs/releases/v0.1.8.md)
+- Current stable: [docs/releases/v1.2.4.md](docs/releases/v1.2.4.md)
+- Previous stable: [docs/releases/v1.2.2.md](docs/releases/v1.2.2.md)
+- Earlier stable: [docs/releases/v1.2.1.md](docs/releases/v1.2.1.md)
 - Archived prerelease: [docs/releases/v0.1.0-beta.0.md](docs/releases/v0.1.0-beta.0.md)
 
 ## License

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAe,MAAM,kBAAkB,CAAC;AAmQ5D;;;;;;;;;;;;;;;GAeG;AAEH,eAAO,MAAM,iBAAiB,EAAE,MAyqH/B,CAAC;AAEF,eAAO,MAAM,gBAAgB,KAAoB,CAAC;AAElD,eAAe,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAe,MAAM,kBAAkB,CAAC;AAqQ5D;;;;;;;;;;;;;;;GAeG;AAEH,eAAO,MAAM,iBAAiB,EAAE,MAgvH/B,CAAC;AAEF,eAAO,MAAM,gBAAgB,KAAoB,CAAC;AAElD,eAAe,iBAAiB,CAAC"}

package/dist/index.js

@@ -51,6 +51,7 @@ import { normalizeRequestInit, parseRequestBodyFromInit, } from "./lib/request/r
 import { applyFastSessionDefaults } from "./lib/request/request-transformer.js";
 import { applyResponseCompaction } from "./lib/request/response-compaction.js";
 import { isEmptyResponse } from "./lib/request/response-handler.js";
+import { CodexAuthError } from "./lib/errors.js";
 import { parseRetryAfterHintMs, sanitizeResponseHeadersForLog, } from "./lib/request/response-metadata.js";
 import { withStreamingFailover } from "./lib/request/stream-failover.js";
 import { createAbortableSleep, sleepWithCountdown, } from "./lib/request/wait-utils.js";
@@ -80,7 +81,7 @@ import { applyUiRuntimeFromConfig, getStatusMarker, } from "./lib/runtime/ui-run
 import { verifyRuntimeFlaggedAccounts } from "./lib/runtime/verify-flagged.js";
 import { SessionAffinityStore } from "./lib/session-affinity.js";
 import { registerCleanup } from "./lib/shutdown.js";
-import { clearAccounts, clearFlaggedAccounts, exportAccounts, findMatchingAccountIndex, formatStorageErrorHint, getStoragePath, importAccounts, loadAccounts, loadFlaggedAccounts, StorageError, saveAccounts, saveFlaggedAccounts, setStorageBackupEnabled, setStoragePath, withAccountStorageTransaction, } from "./lib/storage.js";
+import { clearAccounts, clearFlaggedAccounts, exportAccounts, findMatchingAccountIndex, formatStorageErrorHint, getStoragePath, importAccounts, loadAccounts, loadFlaggedAccounts, StorageError, saveAccounts, saveFlaggedAccounts, setStorageBackupEnabled, setStoragePath, withAccountAndFlaggedStorageTransaction, withAccountStorageTransaction, } from "./lib/storage.js";
 import { buildTableHeader, buildTableRow, } from "./lib/table-formatter.js";
 import { createHashlineEditTool, createHashlineReadTool, } from "./lib/tools/hashline-tools.js";
 import { formatUiBadge, formatUiHeader, formatUiItem, formatUiKeyValue, formatUiSection, paintUiText, } from "./lib/ui/format.js";
@@ -168,6 +169,20 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
         findMatchingAccountIndex,
         modelFamilies: MODEL_FAMILIES,
     });
+    const persistAccountPoolAndFlagged = async (results, flaggedStorage, replaceAll = false) => withAccountAndFlaggedStorageTransaction(async (loadedStorage, persist) => {
+        await persistAccountPoolResults({
+            results,
+            replaceAll,
+            modelFamilies: MODEL_FAMILIES,
+            withAccountStorageTransaction: async (handler) => handler(loadedStorage, async (storage) => {
+                await persist(storage, flaggedStorage);
+            }),
+            findMatchingAccountIndex,
+            extractAccountId,
+            extractAccountEmail,
+            sanitizeEmail,
+        });
+    });
     const accountManagerCacheInvalidationDeps = {
         setCachedAccountManager: (value) => {
             cachedAccountManager = value;
@@ -585,9 +600,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                         try {
                                             if (shouldRefreshToken(accountAuth, tokenRefreshSkewMs)) {
                                                 accountAuth = (await refreshAndUpdateToken(accountAuth, client));
-                                                accountManager.updateFromAuth(account, accountAuth);
-                                                accountManager.clearAuthFailures(account);
-                                                accountManager.saveToDiskDebounced();
+                                                await accountManager.commitRefreshedAuth(account, accountAuth);
                                             }
                                         }
                                         catch (err) {
@@ -597,13 +610,27 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                             runtimeMetrics.accountRotations++;
                                             runtimeMetrics.lastError =
                                                 err?.message ?? String(err);
-                                            const failures = accountManager.incrementAuthFailures(account);
+                                            const isRetryableRefreshError = err instanceof CodexAuthError && err.retryable;
                                             const accountLabel = formatAccountLabel(account, account.index);
+                                            sessionAffinityStore?.forgetSession(sessionAffinityKey);
+                                            if (isRetryableRefreshError) {
+                                                runtimeMetrics.networkErrors++;
+                                                const retryableRefreshPolicy = evaluateFailurePolicy({ kind: "network", failoverMode }, { networkCooldownMs: networkErrorCooldownMs });
+                                                if (retryableRefreshPolicy.recordFailure) {
+                                                    accountManager.recordFailure(account, modelFamily, model);
+                                                }
+                                                if (typeof retryableRefreshPolicy.cooldownMs === "number" &&
+                                                    retryableRefreshPolicy.cooldownReason) {
+                                                    accountManager.markAccountCoolingDown(account, retryableRefreshPolicy.cooldownMs, retryableRefreshPolicy.cooldownReason);
+                                                    accountManager.saveToDiskDebounced();
+                                                }
+                                                continue;
+                                            }
+                                            const failures = accountManager.incrementAuthFailures(account);
                                             const authFailurePolicy = evaluateFailurePolicy({
                                                 kind: "auth-refresh",
                                                 consecutiveAuthFailures: failures,
                                             });
-                                            sessionAffinityStore?.forgetSession(sessionAffinityKey);
                                             if (authFailurePolicy.removeAccount) {
                                                 const removedIndex = account.index;
                                                 sessionAffinityStore?.forgetAccount(removedIndex);
@@ -1045,20 +1072,22 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                                     sessionAffinityStore?.forgetSession(sessionAffinityKey);
                                                     break;
                                                 }
-                                                if (rateLimit) {
+                                                if (response.status === 429) {
                                                     runtimeMetrics.rateLimitedResponses++;
-                                                    const { attempt, delayMs } = getRateLimitBackoff(account.index, quotaKey, rateLimit.retryAfterMs);
-                                                    preemptiveQuotaScheduler.markRateLimited(quotaScheduleKey, delayMs);
-                                                    const waitLabel = formatWaitTime(delayMs);
-                                                    if (delayMs <= RATE_LIMIT_SHORT_RETRY_THRESHOLD_MS) {
+                                                    const retryAfterMs = rateLimit?.retryAfterMs ?? 60_000;
+                                                    const { attempt, delayMs } = getRateLimitBackoff(account.index, quotaKey, retryAfterMs);
+                                                    const cooldownMs = Math.max(delayMs, retryAfterMs);
+                                                    preemptiveQuotaScheduler.markRateLimited(quotaScheduleKey, cooldownMs);
+                                                    const waitLabel = formatWaitTime(cooldownMs);
+                                                    if (cooldownMs <= RATE_LIMIT_SHORT_RETRY_THRESHOLD_MS) {
                                                         if (accountManager.shouldShowAccountToast(account.index, rateLimitToastDebounceMs)) {
                                                             await showRuntimeToast(client, `Rate limited. Retrying in ${waitLabel} (attempt ${attempt})...`, "warning", { duration: toastDurationMs });
                                                             accountManager.markToastShown(account.index);
                                                         }
-                                                        await sleep(addJitter(Math.max(MIN_BACKOFF_MS, delayMs), 0.2));
+                                                        await sleep(addJitter(Math.max(MIN_BACKOFF_MS, cooldownMs), 0.2));
                                                         continue;
                                                     }
-                                                    accountManager.markRateLimitedWithReason(account, delayMs, modelFamily, parseRateLimitReason(rateLimit.code), model);
+                                                    accountManager.markRateLimitedWithReason(account, cooldownMs, modelFamily, parseRateLimitReason(rateLimit?.code), model);
                                                     accountManager.recordRateLimit(account, modelFamily, model);
                                                     account.lastSwitchReason = "rate-limit";
                                                     sessionAffinityStore?.forgetSession(sessionAffinityKey);
@@ -1111,9 +1140,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                                         try {
                                                             if (shouldRefreshToken(fallbackAuth, tokenRefreshSkewMs)) {
                                                                 fallbackAuth = (await refreshAndUpdateToken(fallbackAuth, client));
-                                                                accountManager.updateFromAuth(fallbackAccount, fallbackAuth);
-                                                                accountManager.clearAuthFailures(fallbackAccount);
-                                                                accountManager.saveToDiskDebounced();
+                                                                await accountManager.commitRefreshedAuth(fallbackAccount, fallbackAuth);
                                                             }
                                                         }
                                                         catch (refreshError) {
@@ -1195,21 +1222,27 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                                                 preemptiveQuotaScheduler.update(`${fallbackEntitlementAccountKey}:${model ?? modelFamily}`, fallbackSnapshot);
                                                             }
                                                             if (!fallbackResponse.ok) {
+                                                                const { response: handledFallbackResponse, rateLimit: fallbackRateLimit } = await handleErrorResponse(fallbackResponse);
                                                                 try {
                                                                     await fallbackResponse.body?.cancel();
                                                                 }
                                                                 catch {
-                                                                    // Best effort cleanup before trying next fallback account.
+                                                                    // Best-effort only; the error body has already been read.
                                                                 }
-                                                                if (fallbackResponse.status === 429) {
-                                                                    const retryAfterMs = parseRetryAfterHintMs(fallbackResponse.headers) ?? 60_000;
-                                                                    accountManager.markRateLimitedWithReason(fallbackAccount, retryAfterMs, modelFamily, "quota", model);
+                                                                if (handledFallbackResponse.status === 429) {
+                                                                    const retryAfterMs = fallbackRateLimit?.retryAfterMs ?? 60_000;
+                                                                    const fallbackQuotaKey = model ? `${modelFamily}:${model}` : modelFamily;
+                                                                    const { delayMs } = getRateLimitBackoff(fallbackAccount.index, fallbackQuotaKey, retryAfterMs);
+                                                                    const cooldownMs = Math.max(delayMs, retryAfterMs);
+                                                                    preemptiveQuotaScheduler.markRateLimited(`${fallbackEntitlementAccountKey}:${model ?? modelFamily}`, cooldownMs);
+                                                                    accountManager.markRateLimitedWithReason(fallbackAccount, cooldownMs, modelFamily, "quota", model);
                                                                     accountManager.recordRateLimit(fallbackAccount, modelFamily, model);
+                                                                    accountManager.saveToDiskDebounced();
                                                                 }
                                                                 else {
                                                                     accountManager.recordFailure(fallbackAccount, modelFamily, model);
+                                                                    capabilityPolicyStore.recordFailure(fallbackEntitlementAccountKey, capabilityModelKey);
                                                                 }
-                                                                capabilityPolicyStore.recordFailure(fallbackEntitlementAccountKey, capabilityModelKey);
                                                                 continue;
                                                             }
                                                             successAccountForResponse = fallbackAccount;
@@ -1521,6 +1554,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                         queuedRefresh,
                                         resolveTokenSuccessAccount,
                                         persistAccounts: persistAccountPool,
+                                        persistAccountsAndFlagged: persistAccountPoolAndFlagged,
                                         invalidateAccountManagerCache: () => invalidateRuntimeAccountManagerCache(accountManagerCacheInvalidationDeps),
                                         saveFlaggedAccounts,
                                         showLine: (message) => console.log(message),