codex-multi-auth 2.11.0 → 2.13.0

package/dist/lib/usage/usage-extraction.js

@@ -66,18 +66,58 @@ export function extractUsageTokenCounts(usage) {
         totalTokens: providedTotal,
     };
 }
+/**
+ * Read the billed service tier off a Responses payload.
+ *
+ * `service_tier` sits on the response object, not inside `usage`, and a stream
+ * event wraps that object one level down. An unrecognised value becomes
+ * `unknown` rather than being dropped, because dropping it would price the row
+ * at standard rates and under-count a more expensive tier.
+ */
+function extractServiceTier(payload) {
+    const raw = payload.service_tier ??
+        (isRecord(payload.response) ? payload.response.service_tier : undefined);
+    if (typeof raw !== "string")
+        return undefined;
+    const normalized = raw.trim().toLowerCase();
+    if (normalized.length === 0)
+        return undefined;
+    // `default` is what the API calls the standard tier on the wire.
+    if (normalized === "default" || normalized === "standard")
+        return "standard";
+    // The upstream catalog names this tier `priority` with the display name
+    // "Fast", and lists `fast` in `additional_speed_tiers`, so a response can
+    // report either spelling. Without this it becomes `unknown`, which prices
+    // as unpriced and fails a cost budget closed on a tier we DO have a rate
+    // for.
+    if (normalized === "fast")
+        return "priority";
+    if (normalized === "priority" ||
+        normalized === "flex" ||
+        normalized === "batch" ||
+        normalized === "scale") {
+        return normalized;
+    }
+    return "unknown";
+}
 /**
  * Pull the `usage` object out of a Responses payload, whether it arrived as a
- * bare response object (non-streaming) or wrapped in a stream event envelope.
+ * bare response object (non-streaming) or wrapped in a stream event envelope,
+ * and attach the tier it was billed at.
  */
 export function extractResponsesUsage(payload) {
     if (!isRecord(payload))
         return null;
+    const serviceTier = extractServiceTier(payload);
     const direct = extractUsageTokenCounts(payload.usage);
-    if (direct)
-        return direct;
+    if (direct) {
+        return serviceTier ? { ...direct, serviceTier } : direct;
+    }
     if (isRecord(payload.response)) {
-        return extractUsageTokenCounts(payload.response.usage);
+        const nested = extractUsageTokenCounts(payload.response.usage);
+        if (!nested)
+            return null;
+        return serviceTier ? { ...nested, serviceTier } : nested;
     }
     return null;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "codex-multi-auth",
-	"version": "2.11.0",
+	"version": "2.13.0",
 	"description": "Codex CLI multi-account OAuth manager with account switching, health checks, runtime rotation, diagnostics, and recovery tools for @openai/codex",
 	"main": "./dist/index.js",
 	"types": "./dist/index.d.ts",

package/scripts/codex-routing.js

@@ -2,6 +2,7 @@ const AUTH_SUBCOMMANDS = new Set([
 	"login",
 	"list",
 	"status",
+	"limits",
 	"switch",
 	"unpin",
 	"workspace",

package/scripts/codex.js

@@ -78,6 +78,8 @@ const APP_RUNTIME_HELPER_USE_CANONICAL_HOME_ENV =
 	"CODEX_MULTI_AUTH_APP_ROTATION_USE_CANONICAL_HOME";
 const APP_RUNTIME_HELPER_INSTALL_APP_SERVER_SHIM_ENV =
 	"CODEX_MULTI_AUTH_APP_ROTATION_INSTALL_APP_SERVER_SHIM";
+const RUNTIME_ROTATION_PROXY_UPSTREAM_BASE_URL_ENV =
+	"CODEX_MULTI_AUTH_RUNTIME_PROXY_UPSTREAM_BASE_URL";
 const APP_SERVER_CONFIG_ARGS_ENV =
 	"CODEX_MULTI_AUTH_APP_SERVER_CONFIG_ARGS_JSON";
 const APP_RUNTIME_HELPER_STATUS_FILE =
@@ -168,6 +170,95 @@ let warnedShadowHomeSqliteLinkFailure = false;
 const warnedShadowHomeLinkOnlyDirectoryFailures = new Set();
 const warnedShadowHomeSqliteSidecarPlaceholderFailures = new Set();
 
+/**
+ * True only for a NUMERIC loopback literal, as `new URL().hostname` reports it.
+ *
+ * A name is deliberately not enough. `localhost` is resolved by the OS at
+ * connect time, so an /etc/hosts or Windows hosts entry can point it at a
+ * routable address, and the upstream request carries the managed OAuth bearer
+ * token and the request body. WHATWG URL always reports an IPv6 host in its
+ * bracketed form, so `::1` is only ever seen here as `[::1]`.
+ */
+function isLoopbackUrlHostname(hostname) {
+	if (hostname === "[::1]") {
+		return true;
+	}
+	const ipv4 = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(hostname);
+	if (!ipv4) {
+		return false;
+	}
+	const octets = ipv4.slice(1).map((part) => Number(part));
+	if (octets.some((octet) => !Number.isInteger(octet) || octet > 255)) {
+		return false;
+	}
+	// The whole 127.0.0.0/8 block is loopback, not just 127.0.0.1.
+	return octets[0] === 127;
+}
+
+/**
+ * Whether the raw URL text carries an explicit `:port`.
+ *
+ * `new URL()` erases a port that matches the scheme default, so
+ * `http://127.0.0.1:80/x` reports `parsed.port === ""` and a `!parsed.port`
+ * check would reject a perfectly valid, explicitly-ported loopback URL.
+ */
+function hasExplicitUrlPort(raw) {
+	const withoutScheme = raw.replace(/^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//, "");
+	const authority = withoutScheme.split(/[/?#]/, 1)[0] ?? "";
+	// Strip userinfo first, or a password containing ':' reads as a port.
+	const hostAndPort = authority.slice(authority.lastIndexOf("@") + 1);
+	if (hostAndPort.startsWith("[")) {
+		const close = hostAndPort.indexOf("]");
+		return close !== -1 && /^:\d+$/.test(hostAndPort.slice(close + 1));
+	}
+	const colon = hostAndPort.indexOf(":");
+	return colon !== -1 && /^:\d+$/.test(hostAndPort.slice(colon));
+}
+
+function resolveRuntimeRotationProxyUpstreamBaseUrl(env = process.env) {
+	const raw = (env[RUNTIME_ROTATION_PROXY_UPSTREAM_BASE_URL_ENV] ?? "").trim();
+	if (!raw) {
+		return undefined;
+	}
+
+	let parsed;
+	try {
+		parsed = new URL(raw);
+	} catch {
+		throw new Error(
+			`${RUNTIME_ROTATION_PROXY_UPSTREAM_BASE_URL_ENV} must be an absolute loopback HTTP URL.`,
+		);
+	}
+
+	if (
+		parsed.protocol !== "http:" ||
+		!isLoopbackUrlHostname(parsed.hostname.toLowerCase()) ||
+		!(parsed.port || hasExplicitUrlPort(raw)) ||
+		parsed.username ||
+		parsed.password ||
+		parsed.search ||
+		parsed.hash
+	) {
+		throw new Error(
+			`${RUNTIME_ROTATION_PROXY_UPSTREAM_BASE_URL_ENV} must use HTTP with a numeric loopback host (127.0.0.0/8 or [::1]; a name such as "localhost" is not accepted because it can resolve off-host), an explicit port, and no credentials, query, or fragment.`,
+		);
+	}
+
+	return parsed.toString().replace(/\/$/, "");
+}
+
+/**
+ * @param clientApiKey Shared secret the wrapper and proxy authenticate with.
+ * @param upstreamBaseUrl Already-resolved upstream, or undefined for the
+ * default backend. Callers pass the value they resolved rather than the env, so
+ * one launch never parses (and never re-reports) the same variable twice.
+ */
+function createRuntimeRotationProxyOptions(clientApiKey, upstreamBaseUrl) {
+	return upstreamBaseUrl
+		? { clientApiKey, upstreamBaseUrl }
+		: { clientApiKey };
+}
+
 async function loadRuntimeConstants() {
 	const fallback = {
 		RUNTIME_ROTATION_PROXY_PROVIDER_ID: `${APP_SERVER_ACCOUNT_DISPLAY_NAME}-runtime-proxy`,
@@ -4711,7 +4802,12 @@ async function runRuntimeRotationAppHelper(identityToken = "") {
 			throw new Error("runtime rotation config helpers are unavailable");
 		}
 		const clientApiKey = createRuntimeRotationProxyClientApiKey();
-		proxyServer = await proxyModule.startRuntimeRotationProxy({ clientApiKey });
+		proxyServer = await proxyModule.startRuntimeRotationProxy(
+			createRuntimeRotationProxyOptions(
+				clientApiKey,
+				resolveRuntimeRotationProxyUpstreamBaseUrl(),
+			),
+		);
 		const useCanonicalHome =
 			(process.env[APP_RUNTIME_HELPER_USE_CANONICAL_HOME_ENV] ?? "").trim() ===
 			"1";
@@ -5112,13 +5208,52 @@ async function createRuntimeRotationProxyContextIfEnabled(
 	baseContext,
 	rawArgs,
 ) {
+	// Resolve the configured upstream BEFORE the enabled gate. Every path that
+	// leaves this function with `baseContext` forwards Responses traffic, and its
+	// managed OAuth bearer token, straight to the real backend. An explicit
+	// upstream is a routing requirement rather than a rotation preference, so
+	// `CODEX_MULTI_AUTH_RUNTIME_ROTATION_PROXY=0`, `CODEX_MULTI_AUTH_BYPASS=1`, a
+	// missing `dist/lib/config.js` or a disabled setting must all fail closed
+	// here instead of silently reaching chatgpt.com.
+	let configuredUpstreamBaseUrl;
+	try {
+		configuredUpstreamBaseUrl =
+			resolveRuntimeRotationProxyUpstreamBaseUrl(baseContext.env);
+	} catch (error) {
+		baseContext.cleanup?.();
+		return {
+			startupError: `codex-multi-auth runtime rotation upstream is invalid: ${
+				error instanceof Error ? error.message : String(error)
+			}`,
+		};
+	}
+	// The one exception is a subcommand that never reaches the backend at all
+	// (`--version`, `login`, ...): there is no traffic to misroute, so it passes
+	// through with the upstream simply unused.
+	const requireConfiguredUpstream =
+		configuredUpstreamBaseUrl !== undefined &&
+		shouldUseRuntimeRoutingForForwardedArgs(rawArgs);
+
 	const enabled = await isRuntimeRotationProxyEnabled(rawArgs, baseContext.env);
 	if (!enabled) {
+		if (requireConfiguredUpstream) {
+			baseContext.cleanup?.();
+			return {
+				startupError: `codex-multi-auth runtime rotation is disabled, so ${RUNTIME_ROTATION_PROXY_UPSTREAM_BASE_URL_ENV} cannot be honored and requests would go to the direct backend instead. Enable runtime rotation or unset that variable.`,
+			};
+		}
 		return baseContext;
 	}
 
 	const configTomlModule = await loadRuntimeConfigTomlModule();
 	if (!configTomlModule) {
+		if (requireConfiguredUpstream) {
+			baseContext.cleanup?.();
+			return {
+				startupError:
+					"codex-multi-auth runtime rotation config helpers are unavailable; configured upstream routing cannot continue.",
+			};
+		}
 		console.error(
 			"codex-multi-auth runtime rotation config helpers are unavailable; continuing without runtime rotation.",
 		);
@@ -5188,6 +5323,13 @@ async function createRuntimeRotationProxyContextIfEnabled(
 
 	const proxyModule = await loadRuntimeRotationProxyModule();
 	if (!proxyModule) {
+		if (requireConfiguredUpstream) {
+			baseContext.cleanup?.();
+			return {
+				startupError:
+					"codex-multi-auth runtime rotation proxy is unavailable; configured upstream routing cannot continue.",
+			};
+		}
 		console.error(
 			"codex-multi-auth runtime rotation proxy is unavailable; continuing without runtime rotation.",
 		);
@@ -5198,7 +5340,12 @@ async function createRuntimeRotationProxyContextIfEnabled(
 	let shadowContext;
 	try {
 		const clientApiKey = createRuntimeRotationProxyClientApiKey();
-		proxyServer = await proxyModule.startRuntimeRotationProxy({ clientApiKey });
+		proxyServer = await proxyModule.startRuntimeRotationProxy(
+			createRuntimeRotationProxyOptions(
+				clientApiKey,
+				configuredUpstreamBaseUrl,
+			),
+		);
 		shadowContext = createRuntimeRotationProxyCodexHome(
 			baseContext.env,
 			proxyServer.baseUrl,
@@ -5211,6 +5358,14 @@ async function createRuntimeRotationProxyContextIfEnabled(
 		} catch {
 			// Best-effort cleanup only.
 		}
+		if (requireConfiguredUpstream) {
+			baseContext.cleanup?.();
+			return {
+				startupError: `codex-multi-auth runtime rotation proxy failed to start with configured upstream: ${
+					error instanceof Error ? error.message : String(error)
+				}`,
+			};
+		}
 		console.error(
 			`codex-multi-auth runtime rotation proxy failed to start; continuing without runtime rotation: ${error instanceof Error ? error.message : String(error)}`,
 		);