codex-multi-auth 2.1.13-beta.2 → 2.2.1

package/dist/lib/runtime-rotation-proxy.js

@@ -1,18 +1,58 @@
-import { createHash, timingSafeEqual } from "node:crypto";
-import { existsSync, readFileSync } from "node:fs";
+import { createHash, randomUUID, timingSafeEqual } from "node:crypto";
+import { existsSync, readFileSync, statSync } from "node:fs";
 import { createServer } from "node:http";
 import { AccountManager, extractAccountId, } from "./accounts.js";
+import { withRoutingMutex } from "./routing-mutex.js";
 import { getStoragePath } from "./storage.js";
-import { getFetchTimeoutMs, getNetworkErrorCooldownMs, getRetryAllAccountsMaxRetries, getServerErrorCooldownMs, getSessionAffinity, getSessionAffinityMaxEntries, getSessionAffinityTtlMs, getStreamStallTimeoutMs, getMinRotationIntervalMs, getTokenInvalidationCooldownMs, getTokenRefreshSkewMs, loadPluginConfig, } from "./config.js";
+import { getFetchTimeoutMs, getNetworkErrorCooldownMs, getRetryAllAccountsMaxRetries, getServerErrorCooldownMs, getSessionAffinity, getSessionAffinityMaxEntries, getSessionAffinityTtlMs, getStreamStallTimeoutMs, getMinRotationIntervalMs, getTokenInvalidationCooldownMs, getTokenRefreshSkewMs, getPidOffsetEnabled, getRoutingMutexMode, loadPluginConfig, } from "./config.js";
 import { CODEX_BASE_URL, HTTP_STATUS, OPENAI_HEADERS, OPENAI_HEADER_VALUES, URL_PATHS, } from "./constants.js";
 import { getModelFamily } from "./prompts/codex.js";
+import { CURRENT_CODEX_MODEL } from "./request/helpers/model-map.js";
 import { queuedRefresh } from "./refresh-queue.js";
 import { mutateRuntimeObservabilitySnapshot, recordRuntimePoolExhaustion, recordRuntimeReload, recordRuntimeReset, } from "./runtime/runtime-observability.js";
 import { createRuntimeUsageRecorder, evaluateRuntimePolicy, loadRuntimePolicyState, } from "./policy/runtime-policy.js";
 import { isWorkspaceDisabledError } from "./request/fetch-helpers.js";
+import { createLogger, maskString, runWithCorrelationId } from "./logger.js";
 import { SessionAffinityStore } from "./session-affinity.js";
 import { isRecord } from "./utils.js";
 const DEFAULT_HOST = "127.0.0.1";
+function isLoopbackHost(host) {
+    const normalized = host.trim().toLowerCase();
+    return (normalized === "127.0.0.1" ||
+        normalized === "localhost" ||
+        normalized === "::1" ||
+        normalized === "[::1]");
+}
+// IPv6 literals must be presented in two distinct forms and the proxy
+// previously conflated them (runtime-proxy IPv6 bug). Node's
+// net.Server.listen(port, host) requires the RAW literal ("::1"); a bracketed
+// literal ("[::1]") makes the bind fail or behave wrong. Conversely a URL
+// authority requires the BRACKETED literal ("[::1]") so "http://[::1]:port"
+// parses unambiguously — the raw form yields the unparseable "http://::1:port".
+// Normalize each form ONCE at startup so concurrent rotation paths never race
+// on inconsistent host string representations.
+function stripIpv6Brackets(host) {
+    const trimmed = host.trim();
+    if (trimmed.startsWith("[") && trimmed.endsWith("]")) {
+        return trimmed.slice(1, -1);
+    }
+    return trimmed;
+}
+// Raw literal suitable for server.listen: "[::1]" -> "::1", others unchanged.
+function toBindHost(host) {
+    return stripIpv6Brackets(host);
+}
+// URL authority host: IPv6 literals are bracketed ("::1" -> "[::1]") while
+// IPv4 addresses and hostnames (no embedded colon) pass through unchanged.
+function toUrlHost(host) {
+    const bare = stripIpv6Brackets(host);
+    return bare.includes(":") ? `[${bare}]` : bare;
+}
+// Structured logger for the default-on runtime proxy (errors-logging-01,
+// runtime-proxy-04). Previously the 1900-LOC proxy had zero logger integration;
+// failures surfaced only as a last-write-wins status.lastError string. Logs are
+// level-gated and carry the per-request correlation id set in handleRequest.
+const proxyLog = createLogger("runtime-proxy");
 const DEFAULT_QUOTA_REMAINING_THRESHOLD = 10;
 const DEFAULT_AUTH_FAILURE_COOLDOWN_MS = 30_000;
 const DEFAULT_MAX_RUNTIME_ACCOUNT_ATTEMPTS = 4;
@@ -105,6 +145,10 @@ function createOutboundHeaders(incoming, account, accessToken, accountId) {
     }
     headers.delete("host");
     headers.delete("x-api-key");
+    // Never forward inbound client credentials upstream: a Cookie / proxy-auth
+    // header would ride along with the managed OAuth Bearer to OpenAI.
+    headers.delete("cookie");
+    headers.delete("proxy-authorization");
     headers.set("authorization", `Bearer ${accessToken}`);
     headers.set(OPENAI_HEADERS.ACCOUNT_ID, accountId);
     headers.set(OPENAI_HEADERS.BETA, OPENAI_HEADER_VALUES.BETA_RESPONSES);
@@ -161,6 +205,17 @@ function recordLastRuntimeAccount(status, identity) {
 // vitest workers (each pointing at their own temp storage file) cannot
 // corrupt each other's snapshots. See issue #474.
 const STORAGE_META_CACHE = new Map();
+// The mtime+size short-circuit (L3) may only be trusted once the cached
+// mtime is far enough in the past that no *subsequent* write could share the
+// same coarse mtime tick. Filesystems report mtime at wildly different
+// granularities (ext4 ns, FAT 2s, some network/Windows volumes ~1s, and CI
+// containers occasionally coarser), and our writers use atomic rename, so two
+// rapid CLI bumps can land on an identical mtimeMs. Within this settle window
+// we therefore ignore mtime equality and fall back to the read + sha1 path
+// (the real source of truth). Outside it, the file has been quiescent long
+// enough that mtime equality provably means "unchanged", so we skip the read.
+// 2s comfortably exceeds the coarsest mtime granularity we expect in practice.
+const MTIME_SHORTCIRCUIT_SETTLE_MS = 2_000;
 function hashStorageBytes(bytes) {
     return createHash("sha1").update(bytes).digest("hex");
 }
@@ -171,7 +226,11 @@ function metaFromSnapshot(snapshot) {
     };
 }
 /**
- * Cheap, hot-path-safe single read with mtime-cache short-circuit. Transient
+ * Cheap, hot-path-safe single read with mtime-cache short-circuit. When the
+ * file's `mtimeMs` and `size` match the cached snapshot for this path we
+ * return the cached value WITHOUT reading or hashing the file. Only when
+ * mtime/size differ (or were never cached) do we `readFileSync` + sha1 and,
+ * if the content hash still matches, skip the `JSON.parse`. Transient
  * failures (EBUSY/EPERM/EACCES/EAGAIN, partial-write SyntaxError) fall through
  * to the last cached value for this path; defaults are only returned when the
  * file has never been successfully read.
@@ -187,11 +246,36 @@ export function readStorageMetaFromDisk(storagePath = getStoragePath()) {
         return { pinnedAccountIndex: null, affinityGeneration: 0 };
     }
     try {
+        // mtime+size short-circuit (L3): when neither has changed since the last
+        // successful read AND the cached mtime has settled (see
+        // MTIME_SHORTCIRCUIT_SETTLE_MS) we return the cached snapshot without
+        // reading or hashing the file. During the settle window we deliberately
+        // fall through to the read + sha1 path below, which stays the source of
+        // truth and protects against the coarse-mtime collision described on
+        // StorageMetaSnapshot. So this is a pure fast path for the common
+        // "file quiescent, proxy polling every request" case.
+        const stats = statSync(storagePath);
+        const cachedByStat = STORAGE_META_CACHE.get(storagePath);
+        if (cachedByStat &&
+            cachedByStat.mtimeMs === stats.mtimeMs &&
+            cachedByStat.size === stats.size &&
+            Date.now() - stats.mtimeMs > MTIME_SHORTCIRCUIT_SETTLE_MS) {
+            return metaFromSnapshot(cachedByStat);
+        }
         const bytes = readFileSync(storagePath);
         const contentHash = hashStorageBytes(bytes);
         const cached = STORAGE_META_CACHE.get(storagePath);
         if (cached && cached.contentHash === contentHash) {
-            return metaFromSnapshot(cached);
+            // Content is byte-identical despite the mtime/size change (e.g. an
+            // atomic-rename rewrite of the same bytes). Refresh the stat fields so
+            // the next request takes the fast path, but skip the JSON.parse.
+            const refreshed = {
+                ...cached,
+                mtimeMs: stats.mtimeMs,
+                size: stats.size,
+            };
+            STORAGE_META_CACHE.set(storagePath, refreshed);
+            return metaFromSnapshot(refreshed);
         }
         const parsed = JSON.parse(bytes.toString("utf8"));
         const pinnedAccountIndex = typeof parsed.pinnedAccountIndex === "number" &&
@@ -205,6 +289,8 @@ export function readStorageMetaFromDisk(storagePath = getStoragePath()) {
             ? parsed.affinityGeneration
             : 0;
         const snapshot = {
+            mtimeMs: stats.mtimeMs,
+            size: stats.size,
             contentHash,
             pinnedAccountIndex,
             affinityGeneration,
@@ -264,7 +350,26 @@ async function persistRuntimeActiveAccount(accountManager, account, family, isPi
         return;
     }
     try {
-        accountManager.markSwitched(account, "rotation", family);
+        // accounts-01/08: serialize the cursor mutation through the routing mutex
+        // (when routingMutex="enabled") because this commit spans an await
+        // (syncCodexCliActiveSelectionForIndex), which is the lost-update window the
+        // mutex exists to close. In legacy mode markSwitchedLocked runs inline, so
+        // behavior is unchanged by default.
+        //
+        // L4 fix: in "enabled" mode the SELECTION path already committed the cursor
+        // for this account inside the routing mutex (atomic select+commit, see the
+        // hot-path caller). Re-running markSwitchedLocked here — after the upstream
+        // fetch, in a *separate* critical section — would redundantly re-advance the
+        // cursor and could clobber a concurrent request's atomic advance that landed
+        // while this request was awaiting upstream. So only do the locked cursor
+        // commit in legacy mode, where selection does NOT commit under a lock and
+        // this remains the sole commit site (preserving legacy behavior exactly).
+        // `saveToDiskDebounced` + CLI sync still run in both modes: they snapshot the
+        // current in-memory state / mirror the CLI selection and do not advance the
+        // in-memory rotation cursor.
+        if (accountManager.getRoutingMutexMode() !== "enabled") {
+            await accountManager.markSwitchedLocked(account, "rotation", family);
+        }
         accountManager.saveToDiskDebounced();
         await accountManager.syncCodexCliActiveSelectionForIndex(account.index);
     }
@@ -392,7 +497,11 @@ function buildResponsesRequestContext(req, body) {
         method: "POST",
         upstreamPath: URL_PATHS.CODEX_RESPONSES,
         model,
-        family: getModelFamily(model ?? "gpt-5.3-codex"),
+        // The /codex/responses path is codex-family. A model-less request must
+        // bucket into the codex family (rotation/cooldown/budget), so fall back to
+        // the current codex model — NOT the general DEFAULT_MODEL (gpt-5.5), whose
+        // family is gpt-5.2 and would mis-account a pass-through codex request.
+        family: getModelFamily(model ?? CURRENT_CODEX_MODEL),
         stream: parsedBody?.stream === true,
         sessionKey: resolveSessionKey(headers, parsedBody),
     };
@@ -583,9 +692,57 @@ function parseRetryAfterBodyMs(bodyText, now) {
     }
     return null;
 }
-async function readErrorBody(response) {
+async function readErrorBody(response, timeoutMs, maxBytes = 1024 * 1024) {
+    // The outbound fetch's abort timer is cleared once headers arrive, so a
+    // stalled error body would otherwise hang this handler forever (the success
+    // path is per-chunk stall-bounded; the error path was not). Read the body via
+    // a reader, bound it by an idle timeout AND a size cap, and cancel the stream
+    // on timeout/overflow so the socket is released.
+    const body = response.body;
+    if (!body || typeof body.getReader !== "function") {
+        // Fallback for impls without a streamable body: race text() against a timer.
+        try {
+            return await withTimeout(response.text(), timeoutMs, () => undefined, "error body stalled");
+        }
+        catch {
+            return "";
+        }
+    }
+    const reader = body.getReader();
+    const chunks = [];
+    let total = 0;
     try {
-        return await response.text();
+        for (;;) {
+            let idleTimer;
+            const idle = new Promise((_resolve, reject) => {
+                idleTimer = setTimeout(() => reject(new Error("error body stalled")), Math.max(1, timeoutMs));
+            });
+            let result;
+            try {
+                result = await Promise.race([reader.read(), idle]);
+            }
+            finally {
+                if (idleTimer)
+                    clearTimeout(idleTimer);
+            }
+            if (result.done)
+                break;
+            if (result.value) {
+                total += result.value.byteLength;
+                if (total > maxBytes)
+                    break; // cap: enough for diagnostics, no OOM
+                chunks.push(result.value);
+            }
+        }
+    }
+    catch {
+        // stalled or errored — fall through with whatever we have
+    }
+    finally {
+        await reader.cancel().catch(() => undefined);
+    }
+    try {
+        return Buffer.concat(chunks).toString("utf8");
     }
     catch {
         return "";
@@ -684,8 +841,26 @@ function getQuotaNearExhaustionWaitMs(headers, remainingThreshold, now) {
     }
     return candidates.length > 0 ? Math.max(...candidates) : 0;
 }
+/**
+ * `chooseAccount` is a SYNC selector that internally advances the rotation
+ * cursor (the session-affinity-preferred branch and the round-robin fallback
+ * both call `accountManager.markSwitched(...)`, and the hybrid selector advances
+ * its own cursor). It does NOT acquire the routing mutex itself.
+ *
+ * Concurrency (L4): when `routingMutex === "enabled"`, the proxy hot path runs
+ * this whole call AND the subsequent `markSwitchedLocked` commit inside a single
+ * `withRoutingMutex` acquisition, so concurrent requests serialize selection +
+ * cursor advance and cannot stampede the same account. `withRoutingMutex` is
+ * reentrant (AsyncLocalStorage), so the nested `markSwitchedLocked` — and the
+ * later one in `persistRuntimeActiveAccount` — run inline without re-acquiring
+ * the non-reentrant FIFO queue (no deadlock). In legacy mode the inline
+ * `markSwitched` calls below are used unchanged and no lock is taken, so default
+ * behavior and perf are identical. See the hot-path caller in
+ * `startRuntimeRotationProxy` and the regression in
+ * `test/runtime-rotation-proxy.test.ts`.
+ */
 export function chooseAccount(params) {
-    const { accountManager, sessionAffinityStore, sessionKey, family, model, attemptedIndexes, now, policy, pinnedIndex, skipReasons, stickyBoostByAccount, } = params;
+    const { accountManager, sessionAffinityStore, sessionKey, family, model, attemptedIndexes, now, policy, pinnedIndex, skipReasons, stickyBoostByAccount, pidOffsetEnabled, } = params;
     // Manual pin (from `codex-multi-auth switch <n>`) overrides every other
     // selection signal. We do NOT call markSwitched here — the proxy must not
     // clobber the pin set by the CLI. See issue #474.
@@ -725,6 +900,7 @@ export function chooseAccount(params) {
                 skipReasons?.set(preferred.index, reason);
             }
             else {
+                // L4 (deferred): unlocked cursor mutation — see chooseAccount header.
                 accountManager.markSwitched(preferred, "rotation", family);
                 return preferred;
             }
@@ -735,6 +911,10 @@ export function chooseAccount(params) {
             ...(policy?.scoreBoostByAccount ?? {}),
             ...(stickyBoostByAccount ?? {}),
         },
+        // accounts-05: carry the PID-offset distribution into the default-on proxy
+        // path too (index.ts already does). Without it, parallel proxy processes can
+        // stampede the same account instead of spreading across the pool.
+        pidOffsetEnabled,
     });
     if (selected &&
         !attemptedIndexes.has(selected.index) &&
@@ -758,6 +938,7 @@ export function chooseAccount(params) {
             const live = accountManager.getAccountByIndex(account.index);
             if (!live)
                 continue;
+            // L4 (deferred): unlocked cursor mutation — see chooseAccount header.
             accountManager.markSwitched(live, "rotation", family);
             return live;
         }
@@ -888,8 +1069,27 @@ export async function startRuntimeRotationProxy(options) {
     const pluginConfig = loadPluginConfig();
     let activeAccountManager = options.accountManager ?? (await AccountManager.loadFromDisk());
     const knownAccountManagers = new Set([activeAccountManager]);
+    // accounts-01/08: apply the configured routing-mutex mode so the proxy's
+    // async select->commit path (persistRuntimeActiveAccount) can serialize cursor
+    // mutations when routingMutex="enabled". Legacy mode keeps the inline fast path.
+    const routingMutexMode = getRoutingMutexMode(pluginConfig);
+    activeAccountManager.setRoutingMutexMode(routingMutexMode);
     const fetchImpl = options.fetchImpl ?? fetch;
     const host = options.host ?? DEFAULT_HOST;
+    // Defense in depth (runtime-proxy-01): the proxy presents managed OAuth tokens
+    // and must never be reachable off-box. It is loopback-only with NO opt-out —
+    // binding a non-loopback host would expose every managed account to the
+    // network, so it is refused unconditionally.
+    if (!isLoopbackHost(host)) {
+        throw new Error(`Runtime rotation proxy refuses to bind non-loopback host "${host}". ` +
+            "It forwards managed OAuth tokens and is loopback-only.");
+    }
+    // Normalize the validated host into its two representations exactly once so the
+    // listen() bind and the emitted baseUrl can never disagree under concurrent
+    // rotation: bindHost is the raw literal Node's listen() expects ("[::1]"->"::1"),
+    // urlHost is the bracketed form a URL authority requires ("::1"->"[::1]").
+    const bindHost = toBindHost(host);
+    const urlHost = toUrlHost(host);
     const port = options.port ?? 0;
     const upstreamBaseUrl = options.upstreamBaseUrl ?? CODEX_BASE_URL;
     const clientApiKey = typeof options.clientApiKey === "string" &&
@@ -905,6 +1105,7 @@ export async function startRuntimeRotationProxy(options) {
     const serverErrorCooldownMs = getServerErrorCooldownMs(pluginConfig);
     const tokenInvalidationCooldownMs = getTokenInvalidationCooldownMs(pluginConfig);
     const minRotationIntervalMs = getMinRotationIntervalMs(pluginConfig);
+    const pidOffsetEnabled = getPidOffsetEnabled(pluginConfig);
     let lastGlobalAccountIndex = null;
     let lastGlobalSwitchAt = 0;
     const fetchTimeoutMs = options.fetchTimeoutMs ?? getFetchTimeoutMs(pluginConfig);
@@ -953,6 +1154,7 @@ export async function startRuntimeRotationProxy(options) {
             AccountManager.resetVolatileRuntimeState();
             recordRuntimeReset("pool-exhausted-no-account");
             const reloaded = await AccountManager.loadFromDisk();
+            reloaded.setRoutingMutexMode(routingMutexMode);
             activeAccountManager = reloaded;
             knownAccountManagers.add(reloaded);
             lastStaleRuntimeReloadAt = Date.now();
@@ -969,10 +1171,27 @@ export async function startRuntimeRotationProxy(options) {
         return staleRuntimeReloadPromise;
     };
     const handleRequest = async (req, res) => {
+        // Per-request trace id (errors-logging-03): distinct from sessionKey, which
+        // is shared across a thread's requests. Bound to this request's async context
+        // so every proxyLog line and usage row can be correlated to one request.
+        const traceId = randomUUID();
+        return runWithCorrelationId(traceId, () => handleRequestInner(req, res, traceId));
+    };
+    const handleRequestInner = async (req, res, traceId) => {
         let usageRecorder = null;
         let accountManager = activeAccountManager;
         try {
             const incomingUrl = new URL(req.url ?? "/", "http://127.0.0.1");
+            // Authenticate before discriminating path/method so an unauthenticated
+            // caller cannot enumerate which endpoints exist: an unknown caller always
+            // gets 401, never a 404 that would confirm a path is invalid (vs. just
+            // unauthorized). Authorized callers still fall through to the 404 below
+            // when they hit an unsupported path/method.
+            const incomingHeaders = headersFromIncoming(req);
+            if (!isAuthorizedClient(incomingHeaders, clientApiKey)) {
+                writeUnauthorized(res);
+                return;
+            }
             const isResponsesRequest = req.method === "POST" && isResponsesPath(incomingUrl.pathname);
             const isModelsRequest = req.method === "GET" && isModelsPath(incomingUrl.pathname);
             const isThreadGoalRequest = (req.method === "GET" || req.method === "POST") &&
@@ -981,11 +1200,6 @@ export async function startRuntimeRotationProxy(options) {
                 writeMethodOrPathError(res);
                 return;
             }
-            const incomingHeaders = headersFromIncoming(req);
-            if (!isAuthorizedClient(incomingHeaders, clientApiKey)) {
-                writeUnauthorized(res);
-                return;
-            }
             status.totalRequests += 1;
             const requestBody = isResponsesRequest || (isThreadGoalRequest && req.method === "POST")
                 ? await readRequestBody(req, maxRequestBodyBytes)
@@ -1028,7 +1242,7 @@ export async function startRuntimeRotationProxy(options) {
                         : "responses",
                 model: context.model,
                 projectKey,
-                requestId: context.sessionKey,
+                requestId: traceId,
                 startedAt: requestStartedAt,
             });
             if (policyError) {
@@ -1091,7 +1305,22 @@ export async function startRuntimeRotationProxy(options) {
                     now() - lastGlobalSwitchAt < minRotationIntervalMs
                     ? { [lastGlobalAccountIndex]: 1000 }
                     : {};
-                const selected = chooseAccount({
+                // L4 fix (routing mutex): when `routingMutex === "enabled"`, run the
+                // selection AND the cursor commit inside ONE mutex acquisition so two
+                // concurrent requests cannot read the same cursor and stampede before
+                // the locked commit lands. `chooseAccount` is sync and mutates the
+                // cursor internally (session-affinity `markSwitched`, the hybrid
+                // selector's own advance, and the round-robin fallback `markSwitched`);
+                // holding the mutex across the whole call serializes all of those.
+                // We then `markSwitchedLocked` the winner to (a) re-commit the cursor
+                // under the lock across the await boundary and (b) hand
+                // `persistRuntimeActiveAccount` a cursor that is already correct. That
+                // later `markSwitchedLocked` runs INLINE (reentrant) within this held
+                // section, so there is no double-acquire and no deadlock on the
+                // non-reentrant FIFO queue. In legacy mode the inline `markSwitched`
+                // calls inside `chooseAccount` are used unchanged and no lock is taken,
+                // so default behavior and perf are identical to before.
+                const selectAccount = () => chooseAccount({
                     accountManager,
                     sessionAffinityStore,
                     sessionKey: context.sessionKey,
@@ -1103,7 +1332,22 @@ export async function startRuntimeRotationProxy(options) {
                     pinnedIndex,
                     skipReasons: accountSkipReasons,
                     stickyBoostByAccount: rotationStickyBoost,
+                    pidOffsetEnabled,
                 });
+                const selected = routingMutexMode === "enabled"
+                    ? await withRoutingMutex(routingMutexMode, async () => {
+                        const candidate = selectAccount();
+                        if (candidate && pinnedIndex === null) {
+                            // Re-commit the cursor under the held mutex. Skipped when a
+                            // manual pin is active so the proxy never clobbers the pin
+                            // (see #474); pinned selections are deterministic and need no
+                            // cursor advance. Runs inline via reentrancy — see comment
+                            // above.
+                            await accountManager.markSwitchedLocked(candidate, "rotation", context.family);
+                        }
+                        return candidate;
+                    })
+                    : selectAccount();
                 if (!selected) {
                     if (!reloadedAfterNoAccount &&
                         !isPinned &&
@@ -1212,7 +1456,7 @@ export async function startRuntimeRotationProxy(options) {
                     continue;
                 }
                 if (upstream.status === HTTP_STATUS.TOO_MANY_REQUESTS) {
-                    const bodyText = await readErrorBody(upstream);
+                    const bodyText = await readErrorBody(upstream, streamStallTimeoutMs);
                     const retryAfterMs = parseRetryAfterHeaderMs(upstream.headers, now()) ??
                         parseRetryAfterBodyMs(bodyText, now()) ??
                         60_000;
@@ -1229,7 +1473,7 @@ export async function startRuntimeRotationProxy(options) {
                     continue;
                 }
                 if (upstream.status === 402 || upstream.status === HTTP_STATUS.FORBIDDEN) {
-                    const bodyText = await readErrorBody(upstream);
+                    const bodyText = await readErrorBody(upstream, streamStallTimeoutMs);
                     const errorCode = extractErrorCodeFromBody(bodyText);
                     if (isWorkspaceDisabledError(upstream.status, errorCode, bodyText)) {
                         const accountWasEnabled = accountManager.getAccountByIndex(refreshed.account.index)?.enabled !==
@@ -1312,7 +1556,7 @@ export async function startRuntimeRotationProxy(options) {
                     return;
                 }
                 if (upstream.status === HTTP_STATUS.UNAUTHORIZED) {
-                    const bodyText = await readErrorBody(upstream);
+                    const bodyText = await readErrorBody(upstream, streamStallTimeoutMs);
                     accountManager.refundToken(refreshed.account, context.family, context.model);
                     accountManager.recordFailure(refreshed.account, context.family, context.model);
                     if (isTokenInvalidationError(bodyText)) {
@@ -1349,7 +1593,7 @@ export async function startRuntimeRotationProxy(options) {
                     continue;
                 }
                 if (upstream.status >= 500) {
-                    await readErrorBody(upstream);
+                    await readErrorBody(upstream, streamStallTimeoutMs);
                     accountManager.refundToken(refreshed.account, context.family, context.model);
                     accountManager.recordFailure(refreshed.account, context.family, context.model);
                     accountManager.markAccountCoolingDown(refreshed.account, serverErrorCooldownMs, "server-error");
@@ -1462,7 +1706,20 @@ export async function startRuntimeRotationProxy(options) {
             }
         }
         catch (error) {
-            status.lastError = error instanceof Error ? error.message : String(error);
+            const rawErrorMessage = error instanceof Error ? error.message : String(error);
+            // errors-logging-08: redact any email/token material that leaked into a
+            // raw upstream or refresh error string before it reaches status consumers
+            // or the structured log. maskString is a no-op for clean diagnostic text.
+            const maskedErrorMessage = maskString(rawErrorMessage);
+            status.lastError = maskedErrorMessage;
+            // errors-logging-01: surface the failure through the structured logger
+            // (redaction-safe) with the request trace id, instead of only stashing a
+            // last-write-wins status string.
+            proxyLog.error("runtime proxy request failed", {
+                traceId,
+                code: isRuntimeProxyHttpError(error) ? error.code : "codex_runtime_rotation_proxy_error",
+                error: maskedErrorMessage,
+            });
             if (!res.headersSent) {
                 if (isRuntimeProxyHttpError(error)) {
                     await usageRecorder?.record({
@@ -1519,20 +1776,26 @@ export async function startRuntimeRotationProxy(options) {
         };
         server.once("error", onError);
         server.once("listening", onListening);
-        server.listen(port, host);
+        server.listen(port, bindHost);
     });
     server.on("error", onPostStartupServerError);
     const address = server.address();
     const resolvedPort = typeof address === "object" && address ? address.port : port;
     return {
-        host,
+        host: bindHost,
         port: resolvedPort,
-        baseUrl: `http://${host}:${resolvedPort}`,
+        baseUrl: `http://${urlHost}:${resolvedPort}`,
         close: async () => {
             await closeServer(server, sockets);
             await activeAccountManager.flushPendingSave();
         },
-        getStatus: () => ({ ...status }),
+        getStatus: () => ({
+            ...status,
+            // Redact any email/token material that leaked into a raw upstream or
+            // refresh error string before exposing it to status/report consumers
+            // (errors-logging-08). maskString is a no-op for clean diagnostic text.
+            lastError: status.lastError === null ? null : maskString(status.lastError),
+        }),
     };
 }
 async function closeServer(server, sockets) {