codex-multi-auth 1.3.2 → 2.0.1

package/dist/lib/runtime-rotation-proxy.js

@@ -0,0 +1,828 @@
+import { timingSafeEqual } from "node:crypto";
+import { createServer } from "node:http";
+import { AccountManager, extractAccountId, } from "./accounts.js";
+import { getFetchTimeoutMs, getNetworkErrorCooldownMs, getRetryAllAccountsMaxRetries, getServerErrorCooldownMs, getSessionAffinity, getSessionAffinityMaxEntries, getSessionAffinityTtlMs, getStreamStallTimeoutMs, getTokenRefreshSkewMs, loadPluginConfig, } from "./config.js";
+import { CODEX_BASE_URL, HTTP_STATUS, OPENAI_HEADERS, OPENAI_HEADER_VALUES, URL_PATHS, } from "./constants.js";
+import { getModelFamily } from "./prompts/codex.js";
+import { queuedRefresh } from "./refresh-queue.js";
+import { mutateRuntimeObservabilitySnapshot } from "./runtime/runtime-observability.js";
+import { SessionAffinityStore } from "./session-affinity.js";
+import { isRecord } from "./utils.js";
+const DEFAULT_HOST = "127.0.0.1";
+const DEFAULT_QUOTA_REMAINING_THRESHOLD = 10;
+const DEFAULT_AUTH_FAILURE_COOLDOWN_MS = 30_000;
+const DEFAULT_MAX_RUNTIME_ACCOUNT_ATTEMPTS = 4;
+const MAX_REQUEST_BODY_BYTES = 64 * 1024 * 1024;
+const HOP_BY_HOP_HEADERS = new Set([
+    "connection",
+    "content-length",
+    "expect",
+    "keep-alive",
+    "proxy-authenticate",
+    "proxy-authorization",
+    "te",
+    "trailer",
+    "transfer-encoding",
+    "upgrade",
+]);
+const PRIVATE_CLIENT_RESPONSE_HEADERS = new Set([
+    "x-codex-multi-auth-account-index",
+    "x-codex-multi-auth-account-label",
+    "x-codex-multi-auth-account-email",
+    "x-codex-multi-auth-account-id",
+]);
+const DECODED_UPSTREAM_RESPONSE_HEADERS = new Set([
+    // Node fetch returns decoded bytes while preserving the upstream encoding header.
+    "content-encoding",
+]);
+const ALLOWED_RESPONSES_PATHS = new Set([
+    URL_PATHS.RESPONSES,
+    URL_PATHS.CODEX_RESPONSES,
+    `/v1${URL_PATHS.RESPONSES}`,
+    `/v1${URL_PATHS.CODEX_RESPONSES}`,
+]);
+const ALLOWED_MODELS_PATHS = new Set([
+    URL_PATHS.MODELS,
+    `/v1${URL_PATHS.MODELS}`,
+]);
+function isResponsesPath(pathname) {
+    return ALLOWED_RESPONSES_PATHS.has(pathname);
+}
+function isModelsPath(pathname) {
+    return ALLOWED_MODELS_PATHS.has(pathname);
+}
+function headersFromIncoming(req) {
+    const headers = new Headers();
+    for (const [key, value] of Object.entries(req.headers)) {
+        if (value === undefined)
+            continue;
+        if (Array.isArray(value)) {
+            for (const item of value) {
+                headers.append(key, item);
+            }
+            continue;
+        }
+        headers.set(key, value);
+    }
+    return headers;
+}
+function createOutboundHeaders(incoming, account, accessToken, accountId) {
+    const headers = new Headers(incoming);
+    for (const name of HOP_BY_HOP_HEADERS) {
+        headers.delete(name);
+    }
+    headers.delete("host");
+    headers.delete("x-api-key");
+    headers.set("authorization", `Bearer ${accessToken}`);
+    headers.set(OPENAI_HEADERS.ACCOUNT_ID, accountId);
+    headers.set(OPENAI_HEADERS.BETA, OPENAI_HEADER_VALUES.BETA_RESPONSES);
+    headers.set(OPENAI_HEADERS.ORIGINATOR, OPENAI_HEADER_VALUES.ORIGINATOR_CODEX);
+    return headers;
+}
+function isAuthorizedClient(headers, clientApiKey) {
+    const authorization = headers.get("authorization") ?? "";
+    const bearerMatch = authorization.match(/^Bearer\s+(.+)$/i);
+    const bearer = bearerMatch?.[1]?.trim();
+    if (bearer && safeEqual(bearer, clientApiKey))
+        return true;
+    const apiKey = headers.get("x-api-key");
+    return typeof apiKey === "string" && safeEqual(apiKey, clientApiKey);
+}
+function safeEqual(left, right) {
+    const leftBuffer = Buffer.from(left, "utf8");
+    const rightBuffer = Buffer.from(right, "utf8");
+    const compareLength = Math.max(leftBuffer.length, rightBuffer.length, 1);
+    const paddedLeft = Buffer.alloc(compareLength);
+    const paddedRight = Buffer.alloc(compareLength);
+    leftBuffer.copy(paddedLeft);
+    rightBuffer.copy(paddedRight);
+    return timingSafeEqual(paddedLeft, paddedRight) && leftBuffer.length === rightBuffer.length;
+}
+function readTrimmedString(value) {
+    if (typeof value !== "string")
+        return null;
+    const trimmed = value.trim();
+    return trimmed.length > 0 ? trimmed : null;
+}
+function accountIdentityFromAccount(account, updatedAt) {
+    return {
+        index: account.index,
+        label: `Account ${account.index + 1}`,
+        accountId: readTrimmedString(account.accountId),
+        updatedAt,
+    };
+}
+function recordLastRuntimeAccount(status, identity) {
+    status.lastAccountIndex = identity.index;
+    status.lastAccountLabel = identity.label;
+    status.lastAccountId = identity.accountId;
+    status.lastAccountUpdatedAt = identity.updatedAt;
+    mutateRuntimeObservabilitySnapshot((snapshot) => {
+        snapshot.lastAccountIndex = identity.index;
+        snapshot.lastAccountLabel = identity.label;
+        snapshot.lastAccountEmail = null;
+        snapshot.lastAccountId = identity.accountId;
+        snapshot.lastAccountUpdatedAt = identity.updatedAt;
+    });
+}
+async function persistRuntimeActiveAccount(accountManager, account, family) {
+    try {
+        accountManager.markSwitched(account, "rotation", family);
+        accountManager.saveToDiskDebounced();
+        await accountManager.syncCodexCliActiveSelectionForIndex(account.index);
+    }
+    catch {
+        // Runtime forwarding must not fail after a valid upstream response just
+        // because the local status mirrors are temporarily locked.
+    }
+}
+function responseHeadersForClient(upstreamHeaders) {
+    const headers = {};
+    for (const [key, value] of upstreamHeaders.entries()) {
+        const normalizedKey = key.toLowerCase();
+        if (HOP_BY_HOP_HEADERS.has(normalizedKey))
+            continue;
+        if (PRIVATE_CLIENT_RESPONSE_HEADERS.has(normalizedKey))
+            continue;
+        if (DECODED_UPSTREAM_RESPONSE_HEADERS.has(normalizedKey))
+            continue;
+        headers[key] = value;
+    }
+    return headers;
+}
+function createRuntimeProxyHttpError(message, statusCode, code) {
+    return Object.assign(new Error(message), { statusCode, code });
+}
+function isRuntimeProxyHttpError(error) {
+    return (error instanceof Error &&
+        "statusCode" in error &&
+        typeof error.statusCode === "number" &&
+        "code" in error &&
+        typeof error.code === "string");
+}
+async function readRequestBody(req, maxBytes = MAX_REQUEST_BODY_BYTES) {
+    const chunks = [];
+    let totalBytes = 0;
+    for await (const chunk of req) {
+        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        totalBytes += buffer.byteLength;
+        if (totalBytes > maxBytes) {
+            throw createRuntimeProxyHttpError("Runtime rotation proxy request body is too large.", HTTP_STATUS.PAYLOAD_TOO_LARGE, "runtime_rotation_proxy_payload_too_large");
+        }
+        chunks.push(buffer);
+    }
+    return Buffer.concat(chunks);
+}
+function parseRequestBody(body) {
+    if (body.length === 0)
+        return null;
+    try {
+        const parsed = JSON.parse(body.toString("utf8"));
+        return isRecord(parsed) ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+function readStringRecordValue(record, key) {
+    const value = record[key];
+    return typeof value === "string" && value.trim().length > 0
+        ? value.trim()
+        : null;
+}
+function resolveSessionKey(headers, parsedBody) {
+    const headerKey = headers.get(OPENAI_HEADERS.SESSION_ID) ??
+        headers.get(OPENAI_HEADERS.CONVERSATION_ID) ??
+        null;
+    if (headerKey && headerKey.trim().length > 0)
+        return headerKey.trim();
+    if (!parsedBody)
+        return null;
+    if (typeof parsedBody.prompt_cache_key === "string") {
+        const key = parsedBody.prompt_cache_key.trim();
+        if (key.length > 0)
+            return key;
+    }
+    if (typeof parsedBody.previous_response_id === "string") {
+        const key = parsedBody.previous_response_id.trim();
+        if (key.length > 0)
+            return key;
+    }
+    const metadata = parsedBody.metadata;
+    if (isRecord(metadata)) {
+        return (readStringRecordValue(metadata, "session_id") ??
+            readStringRecordValue(metadata, "conversation_id") ??
+            readStringRecordValue(metadata, "thread_id"));
+    }
+    return null;
+}
+function buildResponsesRequestContext(req, body) {
+    const headers = headersFromIncoming(req);
+    const parsedBody = parseRequestBody(body);
+    const model = typeof parsedBody?.model === "string" && parsedBody.model.trim().length > 0
+        ? parsedBody.model.trim()
+        : null;
+    return {
+        body,
+        headers,
+        method: "POST",
+        upstreamPath: URL_PATHS.CODEX_RESPONSES,
+        model,
+        family: getModelFamily(model ?? "gpt-5.3-codex"),
+        stream: parsedBody?.stream === true,
+        sessionKey: resolveSessionKey(headers, parsedBody),
+    };
+}
+function buildModelsRequestContext(req) {
+    return {
+        body: Buffer.alloc(0),
+        headers: headersFromIncoming(req),
+        method: "GET",
+        upstreamPath: URL_PATHS.MODELS,
+        model: null,
+        family: "codex",
+        stream: false,
+        sessionKey: null,
+    };
+}
+function buildUpstreamUrl(req, upstreamBaseUrl, upstreamPath) {
+    const incomingUrl = new URL(req.url ?? "/", "http://127.0.0.1");
+    const upstream = new URL(upstreamBaseUrl);
+    const basePath = upstream.pathname.replace(/\/+$/, "");
+    upstream.pathname = `${basePath}${upstreamPath}`;
+    upstream.search = incomingUrl.search;
+    return upstream.toString();
+}
+function hasUsableAccessToken(account, now, skewMs) {
+    return (typeof account.access === "string" &&
+        account.access.trim().length > 0 &&
+        typeof account.expires === "number" &&
+        account.expires > now + Math.max(0, skewMs));
+}
+function isTokenRefreshRetryable(result) {
+    if (result.reason === "network_error" || result.reason === "unknown")
+        return true;
+    if (result.reason === "invalid_response")
+        return true;
+    if (result.reason === "http_error") {
+        return !(result.statusCode === HTTP_STATUS.BAD_REQUEST ||
+            result.statusCode === HTTP_STATUS.UNAUTHORIZED ||
+            result.statusCode === HTTP_STATUS.FORBIDDEN);
+    }
+    return false;
+}
+const runtimeRefreshCommitQueues = new WeakMap();
+async function commitRefreshedAuthOnce(accountManager, account, auth) {
+    const key = [
+        account.index,
+        account.accountId ?? "",
+        account.email ?? "",
+        account.refreshToken,
+    ].join("\0");
+    let queue = runtimeRefreshCommitQueues.get(accountManager);
+    if (!queue) {
+        queue = new Map();
+        runtimeRefreshCommitQueues.set(accountManager, queue);
+    }
+    const existing = queue.get(key);
+    if (existing)
+        return existing;
+    const pending = accountManager
+        .commitRefreshedAuth(account, auth)
+        .finally(() => queue?.delete(key));
+    queue.set(key, pending);
+    return pending;
+}
+async function ensureFreshAccessToken(params) {
+    const { accountManager, account, family, model, now, tokenRefreshSkewMs } = params;
+    if (hasUsableAccessToken(account, now, tokenRefreshSkewMs)) {
+        return { ok: true, accessToken: account.access ?? "", account };
+    }
+    const refreshResult = await queuedRefresh(account.refreshToken);
+    if (refreshResult.type === "failed") {
+        accountManager.recordFailure(account, family, model);
+        accountManager.incrementAuthFailures(account);
+        accountManager.markAccountCoolingDown(account, DEFAULT_AUTH_FAILURE_COOLDOWN_MS, "auth-failure");
+        accountManager.saveToDiskDebounced();
+        return { ok: false, retryable: isTokenRefreshRetryable(refreshResult) };
+    }
+    const auth = {
+        type: "oauth",
+        access: refreshResult.access,
+        refresh: refreshResult.refresh,
+        expires: refreshResult.expires,
+    };
+    try {
+        const updatedAccount = (await commitRefreshedAuthOnce(accountManager, account, auth)) ?? account;
+        return {
+            ok: true,
+            accessToken: updatedAccount.access ?? refreshResult.access,
+            account: updatedAccount,
+        };
+    }
+    catch {
+        accountManager.recordFailure(account, family, model);
+        accountManager.markAccountCoolingDown(account, DEFAULT_AUTH_FAILURE_COOLDOWN_MS, "auth-failure");
+        accountManager.saveToDiskDebounced();
+        return { ok: false, retryable: true };
+    }
+}
+function resolveAccountId(account, accessToken) {
+    const stored = account.accountId?.trim();
+    if (stored)
+        return stored;
+    return extractAccountId(accessToken)?.trim() || null;
+}
+function parseRetryAfterHeaderMs(headers, now) {
+    const retryAfterMs = headers.get("retry-after-ms");
+    if (retryAfterMs) {
+        const parsed = Number.parseInt(retryAfterMs, 10);
+        if (Number.isFinite(parsed) && parsed > 0)
+            return parsed;
+    }
+    const retryAfter = headers.get("retry-after");
+    if (!retryAfter)
+        return null;
+    const asSeconds = Number.parseInt(retryAfter, 10);
+    if (Number.isFinite(asSeconds) && asSeconds > 0)
+        return asSeconds * 1000;
+    const asDate = Date.parse(retryAfter);
+    if (Number.isFinite(asDate) && asDate > now)
+        return asDate - now;
+    return null;
+}
+function parseRetryAfterBodyMs(bodyText, now) {
+    if (!bodyText.trim())
+        return null;
+    try {
+        const parsed = JSON.parse(bodyText);
+        if (!isRecord(parsed) || !isRecord(parsed.error))
+            return null;
+        const retryAfterMs = Number(parsed.error.retry_after_ms);
+        if (Number.isFinite(retryAfterMs) && retryAfterMs > 0)
+            return retryAfterMs;
+        const retryAfterSeconds = Number(parsed.error.retry_after);
+        if (Number.isFinite(retryAfterSeconds) && retryAfterSeconds > 0) {
+            return retryAfterSeconds * 1000;
+        }
+        const resetAtRaw = Number(parsed.error.resets_at ?? parsed.error.reset_at);
+        if (Number.isFinite(resetAtRaw) && resetAtRaw > 0) {
+            const resetAtMs = resetAtRaw < 10_000_000_000 ? resetAtRaw * 1000 : resetAtRaw;
+            if (resetAtMs > now)
+                return resetAtMs - now;
+        }
+    }
+    catch {
+        return null;
+    }
+    return null;
+}
+async function readErrorBody(response) {
+    try {
+        return await response.text();
+    }
+    catch {
+        return "";
+    }
+}
+function getQuotaWindowWaitMs(headers, prefix, now) {
+    const resetAfterSeconds = Number.parseInt(headers.get(`${prefix}-reset-after-seconds`) ?? "", 10);
+    if (Number.isFinite(resetAfterSeconds) && resetAfterSeconds > 0) {
+        return resetAfterSeconds * 1000;
+    }
+    const resetAtRaw = headers.get(`${prefix}-reset-at`);
+    if (!resetAtRaw)
+        return 0;
+    const trimmed = resetAtRaw.trim();
+    let resetAtMs = 0;
+    if (/^\d+$/.test(trimmed)) {
+        const parsed = Number.parseInt(trimmed, 10);
+        if (Number.isFinite(parsed) && parsed > 0) {
+            resetAtMs = parsed < 10_000_000_000 ? parsed * 1000 : parsed;
+        }
+    }
+    else {
+        const parsedDate = Date.parse(trimmed);
+        if (Number.isFinite(parsedDate))
+            resetAtMs = parsedDate;
+    }
+    return resetAtMs > now ? resetAtMs - now : 0;
+}
+function getQuotaNearExhaustionWaitMs(headers, remainingThreshold, now) {
+    const usedThreshold = 100 - Math.max(0, Math.min(100, remainingThreshold));
+    const candidates = [];
+    for (const prefix of ["x-codex-primary", "x-codex-secondary"]) {
+        const used = Number(headers.get(`${prefix}-used-percent`) ?? "");
+        if (!Number.isFinite(used) || used < usedThreshold)
+            continue;
+        const waitMs = getQuotaWindowWaitMs(headers, prefix, now);
+        if (waitMs > 0)
+            candidates.push(waitMs);
+    }
+    return candidates.length > 0 ? Math.max(...candidates) : 0;
+}
+function chooseAccount(params) {
+    const { accountManager, sessionAffinityStore, sessionKey, family, model, attemptedIndexes, now, } = params;
+    const preferredIndex = sessionAffinityStore?.getPreferredAccountIndex(sessionKey, now);
+    if (typeof preferredIndex === "number" && !attemptedIndexes.has(preferredIndex)) {
+        const preferred = accountManager.getAccountByIndex(preferredIndex);
+        if (preferred &&
+            accountManager.isAccountAvailableForFamily(preferred.index, family, model)) {
+            accountManager.markSwitched(preferred, "rotation", family);
+            return preferred;
+        }
+    }
+    const selected = accountManager.getCurrentOrNextForFamilyHybrid(family, model);
+    if (selected && !attemptedIndexes.has(selected.index))
+        return selected;
+    for (const account of accountManager.getAccountsSnapshot()) {
+        if (attemptedIndexes.has(account.index))
+            continue;
+        if (accountManager.isAccountAvailableForFamily(account.index, family, model)) {
+            const live = accountManager.getAccountByIndex(account.index);
+            if (!live)
+                continue;
+            accountManager.markSwitched(live, "rotation", family);
+            return live;
+        }
+    }
+    return null;
+}
+function writeJson(res, status, payload) {
+    res.writeHead(status, { "content-type": "application/json; charset=utf-8" });
+    res.end(`${JSON.stringify(payload)}\n`);
+}
+function writeMethodOrPathError(res) {
+    writeJson(res, 404, {
+        error: {
+            message: "Runtime rotation proxy only accepts Responses API and model discovery requests.",
+            code: "runtime_rotation_proxy_not_found",
+        },
+    });
+}
+function writeUnauthorized(res) {
+    writeJson(res, HTTP_STATUS.UNAUTHORIZED, {
+        error: {
+            message: "Runtime rotation proxy rejected an unauthenticated local request.",
+            code: "runtime_rotation_proxy_unauthorized",
+        },
+    });
+}
+function normalizeExhaustionStatus(reason) {
+    return reason === "rate-limit" ? HTTP_STATUS.TOO_MANY_REQUESTS : 503;
+}
+function writePoolExhausted(params) {
+    const { res, accountManager, family, model, reason } = params;
+    const waitMs = accountManager.getMinWaitTimeForFamily(family, model);
+    writeJson(res, normalizeExhaustionStatus(reason), {
+        error: {
+            message: "All managed Codex accounts are temporarily unavailable for this runtime request.",
+            code: "codex_runtime_rotation_pool_exhausted",
+            reason,
+            retry_after_ms: waitMs,
+            hint: "Run `codex auth rotation status` to inspect account state.",
+        },
+    });
+}
+async function withTimeout(promise, timeoutMs, onTimeout, message) {
+    let timeout;
+    try {
+        return await Promise.race([
+            promise,
+            new Promise((_resolve, reject) => {
+                timeout = setTimeout(() => {
+                    onTimeout();
+                    reject(new Error(message));
+                }, Math.max(1, timeoutMs));
+            }),
+        ]);
+    }
+    finally {
+        if (timeout)
+            clearTimeout(timeout);
+    }
+}
+async function forwardStreamingResponse(upstream, res, status, onStreamError, streamStallTimeoutMs) {
+    status.streamsStarted += 1;
+    res.writeHead(upstream.status, responseHeadersForClient(upstream.headers));
+    if (!upstream.body) {
+        res.end();
+        return;
+    }
+    const reader = upstream.body.getReader();
+    res.on("close", () => {
+        if (!res.writableEnded) {
+            void reader.cancel().catch(() => undefined);
+        }
+    });
+    try {
+        while (true) {
+            const { done, value } = await withTimeout(reader.read(), streamStallTimeoutMs, () => {
+                void reader.cancel().catch(() => undefined);
+            }, `upstream stream stalled after ${streamStallTimeoutMs}ms`);
+            if (done)
+                break;
+            if (value && value.byteLength > 0) {
+                res.write(Buffer.from(value));
+            }
+        }
+        res.end();
+    }
+    catch (error) {
+        status.lastError = error instanceof Error ? error.message : String(error);
+        onStreamError();
+        if (!res.destroyed) {
+            res.destroy(error instanceof Error ? error : undefined);
+        }
+    }
+}
+export async function startRuntimeRotationProxy(options) {
+    const pluginConfig = loadPluginConfig();
+    const accountManager = options.accountManager ?? (await AccountManager.loadFromDisk());
+    const fetchImpl = options.fetchImpl ?? fetch;
+    const host = options.host ?? DEFAULT_HOST;
+    const port = options.port ?? 0;
+    const upstreamBaseUrl = options.upstreamBaseUrl ?? CODEX_BASE_URL;
+    const clientApiKey = typeof options.clientApiKey === "string" &&
+        options.clientApiKey.trim().length > 0
+        ? options.clientApiKey.trim()
+        : null;
+    if (!clientApiKey) {
+        throw new Error("Runtime rotation proxy requires a clientApiKey.");
+    }
+    const now = options.now ?? Date.now;
+    const tokenRefreshSkewMs = getTokenRefreshSkewMs(pluginConfig);
+    const networkErrorCooldownMs = getNetworkErrorCooldownMs(pluginConfig);
+    const serverErrorCooldownMs = getServerErrorCooldownMs(pluginConfig);
+    const fetchTimeoutMs = options.fetchTimeoutMs ?? getFetchTimeoutMs(pluginConfig);
+    const streamStallTimeoutMs = options.streamStallTimeoutMs ?? getStreamStallTimeoutMs(pluginConfig);
+    const configuredMaxRetries = getRetryAllAccountsMaxRetries(pluginConfig);
+    const maxRuntimeAccountAttempts = configuredMaxRetries > 0
+        ? configuredMaxRetries + 1
+        : DEFAULT_MAX_RUNTIME_ACCOUNT_ATTEMPTS;
+    const maxRequestBodyBytes = options.maxRequestBodyBytes ?? MAX_REQUEST_BODY_BYTES;
+    const quotaRemainingPercentThreshold = options.quotaRemainingPercentThreshold ?? DEFAULT_QUOTA_REMAINING_THRESHOLD;
+    const sessionAffinityStore = getSessionAffinity(pluginConfig)
+        ? new SessionAffinityStore({
+            ttlMs: getSessionAffinityTtlMs(pluginConfig),
+            maxEntries: getSessionAffinityMaxEntries(pluginConfig),
+        })
+        : null;
+    const status = {
+        startedAt: now(),
+        totalRequests: 0,
+        upstreamRequests: 0,
+        retries: 0,
+        rotations: 0,
+        streamsStarted: 0,
+        lastError: null,
+        lastAccountIndex: null,
+        lastAccountLabel: null,
+        lastAccountId: null,
+        lastAccountUpdatedAt: null,
+    };
+    const handleRequest = async (req, res) => {
+        try {
+            const incomingUrl = new URL(req.url ?? "/", "http://127.0.0.1");
+            const isResponsesRequest = req.method === "POST" && isResponsesPath(incomingUrl.pathname);
+            const isModelsRequest = req.method === "GET" && isModelsPath(incomingUrl.pathname);
+            if (!isResponsesRequest && !isModelsRequest) {
+                writeMethodOrPathError(res);
+                return;
+            }
+            const incomingHeaders = headersFromIncoming(req);
+            if (!isAuthorizedClient(incomingHeaders, clientApiKey)) {
+                writeUnauthorized(res);
+                return;
+            }
+            status.totalRequests += 1;
+            const context = isModelsRequest
+                ? buildModelsRequestContext(req)
+                : buildResponsesRequestContext(req, await readRequestBody(req, maxRequestBodyBytes));
+            const upstreamUrl = buildUpstreamUrl(req, upstreamBaseUrl, context.upstreamPath);
+            const attemptedIndexes = new Set();
+            let exhaustionReason = "no-account";
+            const accountAttemptLimit = Math.max(1, Math.min(accountManager.getAccountCount(), maxRuntimeAccountAttempts));
+            while (attemptedIndexes.size < accountAttemptLimit) {
+                const selected = chooseAccount({
+                    accountManager,
+                    sessionAffinityStore,
+                    sessionKey: context.sessionKey,
+                    family: context.family,
+                    model: context.model,
+                    attemptedIndexes,
+                    now: now(),
+                });
+                if (!selected)
+                    break;
+                attemptedIndexes.add(selected.index);
+                if (!accountManager.consumeToken(selected, context.family, context.model)) {
+                    exhaustionReason = "rate-limit";
+                    continue;
+                }
+                const refreshed = await ensureFreshAccessToken({
+                    accountManager,
+                    account: selected,
+                    family: context.family,
+                    model: context.model,
+                    now: now(),
+                    tokenRefreshSkewMs,
+                });
+                if (!refreshed.ok) {
+                    accountManager.refundToken(selected, context.family, context.model);
+                    exhaustionReason = "auth-failure";
+                    if (!refreshed.retryable)
+                        continue;
+                    status.retries += 1;
+                    status.rotations += 1;
+                    continue;
+                }
+                const accountId = resolveAccountId(refreshed.account, refreshed.accessToken);
+                if (!accountId) {
+                    accountManager.refundToken(refreshed.account, context.family, context.model);
+                    accountManager.recordFailure(refreshed.account, context.family, context.model);
+                    accountManager.markAccountCoolingDown(refreshed.account, DEFAULT_AUTH_FAILURE_COOLDOWN_MS, "auth-failure");
+                    exhaustionReason = "auth-failure";
+                    status.retries += 1;
+                    status.rotations += 1;
+                    continue;
+                }
+                const accountIdentity = accountIdentityFromAccount(refreshed.account, now());
+                recordLastRuntimeAccount(status, accountIdentity);
+                const outboundHeaders = createOutboundHeaders(context.headers, refreshed.account, refreshed.accessToken, accountId);
+                let upstream;
+                try {
+                    status.upstreamRequests += 1;
+                    const fetchAbortController = new AbortController();
+                    const upstreamRequestInit = {
+                        method: context.method,
+                        headers: outboundHeaders,
+                        signal: fetchAbortController.signal,
+                    };
+                    if (context.method === "POST") {
+                        upstreamRequestInit.body = context.body;
+                    }
+                    upstream = await withTimeout(fetchImpl(upstreamUrl, upstreamRequestInit), fetchTimeoutMs, () => fetchAbortController.abort(), `upstream fetch timed out after ${fetchTimeoutMs}ms`);
+                }
+                catch (error) {
+                    status.lastError = error instanceof Error ? error.message : String(error);
+                    accountManager.refundToken(refreshed.account, context.family, context.model);
+                    accountManager.recordFailure(refreshed.account, context.family, context.model);
+                    accountManager.markAccountCoolingDown(refreshed.account, networkErrorCooldownMs, "network-error");
+                    accountManager.saveToDiskDebounced();
+                    exhaustionReason = "network-error";
+                    status.retries += 1;
+                    status.rotations += 1;
+                    continue;
+                }
+                if (upstream.status === HTTP_STATUS.TOO_MANY_REQUESTS) {
+                    const bodyText = await readErrorBody(upstream);
+                    const retryAfterMs = parseRetryAfterHeaderMs(upstream.headers, now()) ??
+                        parseRetryAfterBodyMs(bodyText, now()) ??
+                        60_000;
+                    // A 429 is the upstream quota signal for the attempted account, so
+                    // keep the consumed runtime token drained.
+                    accountManager.recordRateLimit(refreshed.account, context.family, context.model);
+                    accountManager.markRateLimitedWithReason(refreshed.account, retryAfterMs, context.family, "quota", context.model);
+                    accountManager.saveToDiskDebounced();
+                    exhaustionReason = "rate-limit";
+                    status.retries += 1;
+                    status.rotations += 1;
+                    continue;
+                }
+                if (upstream.status === HTTP_STATUS.UNAUTHORIZED) {
+                    await readErrorBody(upstream);
+                    accountManager.refundToken(refreshed.account, context.family, context.model);
+                    accountManager.recordFailure(refreshed.account, context.family, context.model);
+                    accountManager.markAccountCoolingDown(refreshed.account, DEFAULT_AUTH_FAILURE_COOLDOWN_MS, "auth-failure");
+                    accountManager.saveToDiskDebounced();
+                    exhaustionReason = "auth-failure";
+                    status.retries += 1;
+                    status.rotations += 1;
+                    continue;
+                }
+                if (upstream.status >= 500) {
+                    await readErrorBody(upstream);
+                    accountManager.refundToken(refreshed.account, context.family, context.model);
+                    accountManager.recordFailure(refreshed.account, context.family, context.model);
+                    accountManager.markAccountCoolingDown(refreshed.account, serverErrorCooldownMs, "server-error");
+                    accountManager.saveToDiskDebounced();
+                    exhaustionReason = "server-error";
+                    status.retries += 1;
+                    status.rotations += 1;
+                    continue;
+                }
+                accountManager.recordSuccess(refreshed.account, context.family, context.model);
+                const nearExhaustionWaitMs = getQuotaNearExhaustionWaitMs(upstream.headers, quotaRemainingPercentThreshold, now());
+                if (nearExhaustionWaitMs > 0) {
+                    accountManager.markRateLimitedWithReason(refreshed.account, nearExhaustionWaitMs, context.family, "quota", context.model);
+                    sessionAffinityStore?.forgetSession(context.sessionKey);
+                    accountManager.saveToDiskDebounced();
+                }
+                else {
+                    sessionAffinityStore?.remember(context.sessionKey, refreshed.account.index, now());
+                }
+                await persistRuntimeActiveAccount(accountManager, refreshed.account, context.family);
+                await forwardStreamingResponse(upstream, res, status, () => {
+                    accountManager.recordFailure(refreshed.account, context.family, context.model);
+                    accountManager.markAccountCoolingDown(refreshed.account, networkErrorCooldownMs, "network-error");
+                    sessionAffinityStore?.forgetSession(context.sessionKey);
+                    accountManager.saveToDiskDebounced();
+                }, streamStallTimeoutMs);
+                return;
+            }
+            if (attemptedIndexes.size >= accountAttemptLimit &&
+                accountAttemptLimit < accountManager.getAccountCount()) {
+                exhaustionReason = "budget";
+            }
+            writePoolExhausted({
+                res,
+                accountManager,
+                family: context.family,
+                model: context.model,
+                reason: exhaustionReason,
+            });
+        }
+        catch (error) {
+            status.lastError = error instanceof Error ? error.message : String(error);
+            if (!res.headersSent) {
+                if (isRuntimeProxyHttpError(error)) {
+                    writeJson(res, error.statusCode, {
+                        error: {
+                            message: error.message,
+                            code: error.code,
+                        },
+                    });
+                    return;
+                }
+                writeJson(res, 500, {
+                    error: {
+                        message: "Runtime rotation proxy failed before forwarding the request.",
+                        code: "codex_runtime_rotation_proxy_error",
+                    },
+                });
+            }
+            else if (!res.destroyed) {
+                res.destroy(error instanceof Error ? error : undefined);
+            }
+        }
+    };
+    const server = createServer((req, res) => {
+        void handleRequest(req, res);
+    });
+    const sockets = new Set();
+    server.on("connection", (socket) => {
+        sockets.add(socket);
+        socket.once("close", () => {
+            sockets.delete(socket);
+        });
+    });
+    const onPostStartupServerError = (error) => {
+        status.lastError = error.message;
+    };
+    await new Promise((resolve, reject) => {
+        const onError = (error) => {
+            server.off("listening", onListening);
+            reject(error);
+        };
+        const onListening = () => {
+            server.off("error", onError);
+            resolve();
+        };
+        server.once("error", onError);
+        server.once("listening", onListening);
+        server.listen(port, host);
+    });
+    server.on("error", onPostStartupServerError);
+    const address = server.address();
+    const resolvedPort = typeof address === "object" && address ? address.port : port;
+    return {
+        host,
+        port: resolvedPort,
+        baseUrl: `http://${host}:${resolvedPort}`,
+        close: async () => {
+            await closeServer(server, sockets);
+            await accountManager.flushPendingSave();
+        },
+        getStatus: () => ({ ...status }),
+    };
+}
+async function closeServer(server, sockets) {
+    if (!server.listening)
+        return;
+    const closed = new Promise((resolve, reject) => {
+        server.close((error) => {
+            if (error) {
+                reject(error);
+                return;
+            }
+            resolve();
+        });
+    });
+    server.closeIdleConnections?.();
+    for (const socket of sockets) {
+        socket.destroy();
+    }
+    await closed;
+}
+//# sourceMappingURL=runtime-rotation-proxy.js.map