codex-multi-auth 2.12.0 → 2.14.0

package/dist/lib/runtime-rotation-proxy.d.ts

@@ -8,11 +8,34 @@ export { chooseAccount } from "./runtime/rotation-account-selection.js";
 export { maybeInvalidateAffinityFromDisk, readPinnedAccountIndexFromDisk, readStorageMetaFromDisk, resetPinCacheForTesting, } from "./runtime/rotation-storage-meta.js";
 export type { StorageMeta } from "./runtime/rotation-storage-meta.js";
 /** @internal Stable identity key for in-memory quota snapshots across reloads. */
+/**
+ * Quota-scheduler key prefix identifying ONE account across every family and
+ * model key it owns.
+ *
+ * The trailing separator is part of the contract: without it the prefix
+ * `account:email:foo` also matches `account:email:foobar:codex`, so clearing
+ * one account's observations would silently clear a neighbour's.
+ */
+export declare function buildQuotaScheduleAccountPrefix(account: Pick<ManagedAccount, "accountId" | "email" | "refreshToken"> & {
+    /** Stable per-record discriminator retained across token/account-id updates. */
+    addedAt?: number;
+    recordId?: string;
+}): string;
 export declare function buildQuotaScheduleKey(account: Pick<ManagedAccount, "accountId" | "email" | "refreshToken"> & {
     /** Stable per-record discriminator retained across token/account-id updates. */
     addedAt?: number;
     recordId?: string;
 }, family: ModelFamily, model?: string | null): string;
+/**
+ * Total time one request may spend waiting out model capacity.
+ *
+ * `0` disables the behaviour entirely and restores the pre-#689 handling, where
+ * a capacity response rotates the pool and 503s. Anything unparseable falls
+ * back to the default rather than disabling, so a typo does not silently turn
+ * the feature off.
+ */
+export declare function normalizeModelCapacityRetryMs(value: unknown): number;
+export declare function resolveModelCapacityRetryMs(env?: NodeJS.ProcessEnv): number;
 /**
  * Coerce a forced-account pin from an option (number) or the launcher's env
  * string into a normalized 0-based index, or null when absent/invalid. Invalid

package/dist/lib/runtime-rotation-proxy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-rotation-proxy.d.ts","sourceRoot":"","sources":["../../lib/runtime-rotation-proxy.ts"],"names":[],"mappings":"AAGA,OAAO,EAIN,KAAK,cAAc,EACnB,MAAM,eAAe,CAAC;AAkCvB,OAAO,EAAkB,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAkDtE,OAAO,KAAK,EAKX,2BAA2B,EAC3B,0BAA0B,EAE1B,MAAM,oCAAoC,CAAC;AAe5C,YAAY,EACX,2BAA2B,EAC3B,0BAA0B,EAC1B,0BAA0B,GAC1B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACN,+BAA+B,EAC/B,0BAA0B,GAC1B,MAAM,kCAAkC,CAAC;AAC1C,YAAY,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AACnF,OAAO,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAC;AACxE,OAAO,EACN,+BAA+B,EAC/B,8BAA8B,EAC9B,uBAAuB,EACvB,uBAAuB,GACvB,MAAM,oCAAoC,CAAC;AAC5C,YAAY,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAC;AA8DtE,kFAAkF;AAClF,wBAAgB,qBAAqB,CACpC,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,GAAG;IACvE,gFAAgF;IAChF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB,EACD,MAAM,EAAE,WAAW,EACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GACnB,MAAM,CAmBR;AA8gBD;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAC1C,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,GACvC,MAAM,GAAG,IAAI,CAUf;AAED,wBAAsB,yBAAyB,CAC9C,OAAO,EAAE,2BAA2B,GAClC,OAAO,CAAC,0BAA0B,CAAC,CAmLrC"}
+{"version":3,"file":"runtime-rotation-proxy.d.ts","sourceRoot":"","sources":["../../lib/runtime-rotation-proxy.ts"],"names":[],"mappings":"AAGA,OAAO,EAIN,KAAK,cAAc,EACnB,MAAM,eAAe,CAAC;AAkCvB,OAAO,EAAkB,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAqDtE,OAAO,KAAK,EAKX,2BAA2B,EAC3B,0BAA0B,EAE1B,MAAM,oCAAoC,CAAC;AAe5C,YAAY,EACX,2BAA2B,EAC3B,0BAA0B,EAC1B,0BAA0B,GAC1B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACN,+BAA+B,EAC/B,0BAA0B,GAC1B,MAAM,kCAAkC,CAAC;AAC1C,YAAY,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AACnF,OAAO,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAC;AACxE,OAAO,EACN,+BAA+B,EAC/B,8BAA8B,EAC9B,uBAAuB,EACvB,uBAAuB,GACvB,MAAM,oCAAoC,CAAC;AAC5C,YAAY,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAC;AA8DtE,kFAAkF;AAClF;;;;;;;GAOG;AACH,wBAAgB,+BAA+B,CAC9C,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,GAAG;IACvE,gFAAgF;IAChF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB,GACC,MAAM,CAmBR;AAED,wBAAgB,qBAAqB,CACpC,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,GAAG;IACvE,gFAAgF;IAChF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB,EACD,MAAM,EAAE,WAAW,EACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GACnB,MAAM,CAER;AA0ED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAKpE;AAED,wBAAgB,2BAA2B,CAC1C,GAAG,GAAE,MAAM,CAAC,UAAwB,GAClC,MAAM,CAQR;AAueD;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAC1C,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,GACvC,MAAM,GAAG,IAAI,CAUf;AAED,wBAAsB,yBAAyB,CAC9C,OAAO,EAAE,2BAA2B,GAClC,OAAO,CAAC,0BAA0B,CAAC,CA6LrC"}

package/dist/lib/runtime-rotation-proxy.js

@@ -9,7 +9,7 @@ import { CURRENT_CODEX_MODEL } from "./request/helpers/model-map.js";
 import { mutateRuntimeObservabilitySnapshot, recordRuntimeAccountRecovery, recordRuntimePoolExhaustion, } from "./runtime/runtime-observability.js";
 import { createRuntimeUsageRecorder, evaluateRuntimePolicy, loadRuntimePolicyState, } from "./policy/runtime-policy.js";
 import { createUsageStreamScanner } from "./usage/usage-extraction.js";
-import { isWorkspaceDisabledError } from "./request/fetch-helpers.js";
+import { isModelAtCapacityError, isWorkspaceDisabledError, } from "./request/fetch-helpers.js";
 import { PreemptiveQuotaScheduler, readQuotaSchedulerSnapshot, } from "./preemptive-quota-scheduler.js";
 import { ContextBudgetGuard } from "./context-budget-guard.js";
 import { buildContextBudgetHeaders, createContextBudgetPauseResponse, } from "./context-budget-response.js";
@@ -80,7 +80,15 @@ const PINNED_PERMANENT_SKIP_REASONS = new Set([
 ]);
 const DEFAULT_QUOTA_REMAINING_THRESHOLD = 10;
 /** @internal Stable identity key for in-memory quota snapshots across reloads. */
-export function buildQuotaScheduleKey(account, family, model) {
+/**
+ * Quota-scheduler key prefix identifying ONE account across every family and
+ * model key it owns.
+ *
+ * The trailing separator is part of the contract: without it the prefix
+ * `account:email:foo` also matches `account:email:foobar:codex`, so clearing
+ * one account's observations would silently clear a neighbour's.
+ */
+export function buildQuotaScheduleAccountPrefix(account) {
     const emailKey = normalizeEmailKey(account.email);
     const accountId = account.accountId?.trim();
     const refreshToken = account.refreshToken?.trim() ?? "";
@@ -97,7 +105,10 @@ export function buildQuotaScheduleKey(account, family, model) {
             : accountId
                 ? `id:${accountId}${recordDiscriminator}`
                 : `refresh:${createHash("sha256").update(refreshToken).digest("hex")}${recordDiscriminator}`;
-    return `account:${accountIdentity}:${model ?? family}`;
+    return `account:${accountIdentity}:`;
+}
+export function buildQuotaScheduleKey(account, family, model) {
+    return `${buildQuotaScheduleAccountPrefix(account)}${model ?? family}`;
 }
 const DEFAULT_MAX_RUNTIME_ACCOUNT_ATTEMPTS = 4;
 // This is a hard safety ceiling over every pinned selection pass, including
@@ -133,6 +144,58 @@ function pinnedRetryBackoffMs(attempt) {
     const index = Math.min(Math.max(0, attempt - 1), PINNED_RETRY_BACKOFF_STEPS_MS.length - 1);
     return PINNED_RETRY_BACKOFF_STEPS_MS[index] ?? 0;
 }
+/**
+ * Backoff schedule for a model-capacity wait (issue #689).
+ *
+ * Deliberately much longer than `PINNED_RETRY_BACKOFF_STEPS_MS`. That schedule
+ * spaces out re-sends of a request whose account might already be fine;
+ * capacity pressure is upstream and measured in minutes, so re-sending every
+ * 250ms would just be a tight poll against a busy backend. The last step
+ * repeats for every attempt past the table.
+ */
+const CAPACITY_RETRY_BACKOFF_STEPS_MS = [
+    2_000, 5_000, 15_000, 30_000, 60_000,
+];
+/**
+ * Default wall-clock ceiling on capacity waiting for ONE request.
+ *
+ * The reporter's case is a long-running task started before stepping away, so
+ * the default has to be long enough to outlast a real capacity blip. It is
+ * still a hard ceiling: the request ends with the normal pool-exhausted 503
+ * rather than hanging forever.
+ */
+const DEFAULT_MODEL_CAPACITY_RETRY_MS = 10 * 60_000;
+const MAX_MODEL_CAPACITY_RETRY_MS = 60 * 60_000;
+const MODEL_CAPACITY_RETRY_ENV = "CODEX_MULTI_AUTH_MODEL_CAPACITY_RETRY_MS";
+function capacityRetryBackoffMs(attempt) {
+    const index = Math.min(Math.max(0, attempt - 1), CAPACITY_RETRY_BACKOFF_STEPS_MS.length - 1);
+    return CAPACITY_RETRY_BACKOFF_STEPS_MS[index] ?? 0;
+}
+/**
+ * Total time one request may spend waiting out model capacity.
+ *
+ * `0` disables the behaviour entirely and restores the pre-#689 handling, where
+ * a capacity response rotates the pool and 503s. Anything unparseable falls
+ * back to the default rather than disabling, so a typo does not silently turn
+ * the feature off.
+ */
+export function normalizeModelCapacityRetryMs(value) {
+    if (typeof value !== "number" || !Number.isFinite(value) || value < 0) {
+        return DEFAULT_MODEL_CAPACITY_RETRY_MS;
+    }
+    return Math.min(Math.floor(value), MAX_MODEL_CAPACITY_RETRY_MS);
+}
+export function resolveModelCapacityRetryMs(env = process.env) {
+    const raw = (env[MODEL_CAPACITY_RETRY_ENV] ?? "").trim();
+    if (!raw)
+        return DEFAULT_MODEL_CAPACITY_RETRY_MS;
+    // An explicit 0 is the documented kill switch and must survive normalization,
+    // which otherwise treats "not a usable number" as "use the default".
+    const parsed = Number(raw);
+    if (parsed === 0)
+        return 0;
+    return normalizeModelCapacityRetryMs(parsed);
+}
 const MAX_REQUEST_BODY_BYTES = 64 * 1024 * 1024;
 const MAX_THREAD_GOAL_FALLBACKS = 512;
 const ALLOWED_RESPONSES_PATHS = new Set([
@@ -597,6 +660,14 @@ export async function startRuntimeRotationProxy(options) {
     const tokenRefreshSkewMs = getTokenRefreshSkewMs(pluginConfig);
     const networkErrorCooldownMs = getNetworkErrorCooldownMs(pluginConfig);
     const serverErrorCooldownMs = getServerErrorCooldownMs(pluginConfig);
+    // Normalize the explicit option as well as the env var: a caller passing a
+    // negative or multi-hour value would otherwise bypass the documented cap.
+    // `0` stays 0, since it is the documented kill switch.
+    const modelCapacityRetryMs = options.modelCapacityRetryMs === 0
+        ? 0
+        : options.modelCapacityRetryMs === undefined
+            ? resolveModelCapacityRetryMs()
+            : normalizeModelCapacityRetryMs(options.modelCapacityRetryMs);
     const tokenInvalidationCooldownMs = getTokenInvalidationCooldownMs(pluginConfig);
     const minRotationIntervalMs = getMinRotationIntervalMs(pluginConfig);
     const pidOffsetEnabled = getPidOffsetEnabled(pluginConfig);
@@ -643,6 +714,7 @@ export async function startRuntimeRotationProxy(options) {
         tokenRefreshSkewMs,
         networkErrorCooldownMs,
         serverErrorCooldownMs,
+        modelCapacityRetryMs,
         tokenInvalidationCooldownMs,
         minRotationIntervalMs,
         pidOffsetEnabled,
@@ -852,6 +924,24 @@ async function handleRequestInner(state, req, res, traceId) {
         let transientAttemptLimit = Math.max(1, Math.min(accountCount, state.maxRuntimeAccountAttempts));
         let transientAttempts = 0;
         let transientExhaustionReason = null;
+        // Capacity waits are counted separately from `transientAttempts` and from
+        // the pinned selection cap. Both of those bound how many DIFFERENT
+        // accounts or re-sends a failing request may burn; a capacity wait is not
+        // a failure of any account, it is the same request pausing for an
+        // upstream that is busy, and it has its own wall-clock ceiling. See #689.
+        let capacityRetries = 0;
+        // A wall-clock deadline, not a sum of sleeps. The upstream request and
+        // the error-body read also consume the budget, so summing only the
+        // planned sleeps let a slow capacity response push one request past the
+        // documented ceiling. Request-local, so concurrent requests never share
+        // a deadline.
+        let capacityDeadlineAt = null;
+        // Only the RESPONSE tells us the caller is still there. `req` is an
+        // IncomingMessage whose stream Node destroys once the request body has
+        // been fully read, which this proxy does up front, so `req.destroyed` is
+        // routinely true on a perfectly healthy request and must not be read as a
+        // disconnect.
+        const clientGone = () => res.destroyed || res.writableEnded;
         const accountSkipReasons = new Map();
         let reloadedAfterNoAccount = false;
         // Read the manual pin and affinity generation from disk (mtime-cached)
@@ -862,7 +952,37 @@ async function handleRequestInner(state, req, res, traceId) {
         // otherwise glue an in-flight chat thread to the previously selected
         // account. The proxy itself never bumps the generation, so its own
         // debounced disk writes do not clear affinity. See issue #474.
-        const storageMeta = readStorageMetaFromDisk();
+        /** Reconcile once before selection or recording a new upstream observation. */
+        const reconcileManualSelection = () => {
+            const meta = readStorageMetaFromDisk();
+            for (const manager of state.knownAccountManagers) {
+                manager.applyManualSelection(meta);
+            }
+            if (meta.affinityGeneration > state.lastObservedAffinityGeneration) {
+                const switchedAccount = meta.pinnedAccountIndex === null
+                    ? null
+                    : accountManager.getAccountByIndex(meta.pinnedAccountIndex);
+                if (switchedAccount) {
+                    state.preemptiveQuotaScheduler.clearByPrefix(buildQuotaScheduleAccountPrefix(switchedAccount));
+                }
+                else if (meta.pinnedAccountIndex !== null) {
+                    // A pin we cannot resolve: this long-lived proxy re-reads only
+                    // pin/gen, never the account list, so a `login` that appended an
+                    // account before the `switch` leaves the new index out of range
+                    // here. The generation only bumps on the NEXT user-initiated
+                    // switch, so skipping the clear and advancing anyway would strand
+                    // the pre-switch quota observation forever, which is the exact
+                    // deferral this reconciliation exists to end. Drop every cached
+                    // observation instead: it only costs a re-probe, and real 429
+                    // windows live on the accounts themselves, not in this cache.
+                    state.preemptiveQuotaScheduler.clearAll();
+                }
+                state.sessionAffinityStore?.clearAll();
+                state.lastObservedAffinityGeneration = meta.affinityGeneration;
+            }
+            return meta;
+        };
+        const storageMeta = reconcileManualSelection();
         // The ephemeral --account pin (issue #623) takes precedence over the
         // persisted `switch` pin for this invocation, without ever mutating disk
         // state. Use `??` (not `||`) so a forced index of 0 is honored. When set,
@@ -899,15 +1019,79 @@ async function handleRequestInner(state, req, res, traceId) {
         if (isPinned) {
             transientAttemptLimit = Math.max(1, Math.min(state.maxRuntimeAccountAttempts, MAX_PINNED_TRANSIENT_ATTEMPTS));
         }
-        if (storageMeta.affinityGeneration > state.lastObservedAffinityGeneration) {
-            state.sessionAffinityStore?.clearAll();
-            state.lastObservedAffinityGeneration = storageMeta.affinityGeneration;
-        }
+        /**
+         * Wait out a "selected model is at capacity" response, then let the loop
+         * re-send the request (issue #689).
+         *
+         * Capacity is a property of the MODEL, not of an account, so the normal
+         * handling is actively wrong for it: rotating spends the pool's transient
+         * budget against accounts that will all fail identically, and the request
+         * ends as a pool-exhausted 503 within seconds. That is what kills a
+         * long-running task started before the user stepped away.
+         *
+         * The responding account is left completely unpenalized: its pool token is
+         * refunded, it is not marked rate limited, not cooled down, and it is
+         * removed from `attemptedIndexes` so it stays selectable. Selection then
+         * runs normally on the next pass, which may pick a different account. That
+         * is deliberate: with capacity being model-wide, no account is a better bet,
+         * and forcing a request-local pin here would duplicate the pinning path for
+         * no gain.
+         *
+         * @param retryAfterMs Upstream hint when one was actually sent, else `null`
+         * so the backoff table is used. Do NOT pass a synthesized default.
+         * @param account Account that just saw the capacity response.
+         * @returns `"retry"` to re-send, `"give-up"` to fall through to normal
+         * handling, `"client-gone"` when the caller must abandon the request.
+         */
+        const waitOutModelCapacity = async (retryAfterMs, account) => {
+            const budgetMs = state.modelCapacityRetryMs;
+            if (!Number.isFinite(budgetMs) || budgetMs <= 0)
+                return "give-up";
+            if (capacityDeadlineAt === null) {
+                capacityDeadlineAt = state.now() + budgetMs;
+            }
+            const remainingMs = capacityDeadlineAt - state.now();
+            if (remainingMs <= 0)
+                return "give-up";
+            if (clientGone())
+                return "client-gone";
+            const hinted = retryAfterMs !== null &&
+                Number.isFinite(retryAfterMs) &&
+                retryAfterMs > 0
+                ? retryAfterMs
+                : capacityRetryBackoffMs(capacityRetries + 1);
+            const waitMs = Math.min(Math.max(0, Math.floor(hinted)), remainingMs);
+            if (waitMs <= 0)
+                return "give-up";
+            capacityRetries += 1;
+            state.status.retries += 1;
+            proxyLog.warn("model at capacity; waiting before re-sending", {
+                traceId,
+                waitMs,
+                attempt: capacityRetries,
+                remainingMs,
+                budgetMs,
+            });
+            // The attempt debited a pool token before the upstream call. The account
+            // did not fail, so refund it: without this a sustained capacity event
+            // drains healthy accounts and later requests are refused admission with
+            // `token-exhausted` well before the retry budget expires.
+            refundConsumedPoolToken(account);
+            attemptedIndexes.delete(account.index);
+            await sleep(waitMs);
+            // A capacity wait runs for tens of seconds. Re-sending an authenticated
+            // upstream request for a response nobody is reading wastes upstream
+            // capacity and extends how long the token is in flight.
+            if (clientGone())
+                return "client-gone";
+            return "retry";
+        };
         let runtimeSelectionIterations = 0;
         while ((isPinned || attemptedIndexes.size < accountCount) &&
             transientAttempts < transientAttemptLimit &&
             (!isPinned ||
-                runtimeSelectionIterations < MAX_PINNED_SELECTION_ITERATIONS)) {
+                runtimeSelectionIterations - capacityRetries <
+                    MAX_PINNED_SELECTION_ITERATIONS)) {
             // Space out same-account re-sends. The loop has no other delay in it,
             // and the pinned retry deliberately waives the account's own cooldown
             // (below), so without this two copies of the same non-idempotent
@@ -1153,15 +1337,39 @@ async function handleRequestInner(state, req, res, traceId) {
                 noteRotation();
                 continue;
             }
+            reconcileManualSelection();
             const quotaSnapshot = readQuotaSchedulerSnapshot(upstream.headers, upstream.status, state.now());
             if (quotaSnapshot) {
                 state.preemptiveQuotaScheduler.update(quotaScheduleKey, quotaSnapshot);
             }
             if (upstream.status === HTTP_STATUS.TOO_MANY_REQUESTS) {
                 const bodyText = await readErrorBody(upstream, state.streamStallTimeoutMs);
-                const retryAfterMs = parseRetryAfterHeaderMs(upstream.headers, state.now()) ??
-                    parseRetryAfterBodyMs(bodyText, state.now()) ??
-                    60_000;
+                // Keep the upstream HINT separate from the 60s fallback. Passing the
+                // synthesized default into the capacity wait would make every
+                // hint-less capacity 429 sleep a full minute and leave the 2s/5s/15s
+                // backoff table dead on this path.
+                const retryAfterHintMs = parseRetryAfterHeaderMs(upstream.headers, state.now()) ??
+                    parseRetryAfterBodyMs(bodyText, state.now());
+                const retryAfterMs = retryAfterHintMs ?? 60_000;
+                // Reading the body awaited I/O; a switch may have landed meanwhile.
+                reconcileManualSelection();
+                // A capacity 429 is not this account's quota. Marking it rate
+                // limited would take a healthy account out of the pool for the
+                // retry-after window on an outage that affects every account.
+                if (isModelAtCapacityError(upstream.status, bodyText)) {
+                    const outcome = await waitOutModelCapacity(retryAfterHintMs, refreshed.account);
+                    if (outcome === "client-gone") {
+                        await usageRecorder.record({
+                            outcome: "failure",
+                            statusCode: upstream.status,
+                            errorCode: "client_disconnected_during_capacity_wait",
+                            account: refreshed.account,
+                        });
+                        return;
+                    }
+                    if (outcome === "retry")
+                        continue;
+                }
                 state.preemptiveQuotaScheduler.markRateLimited(quotaScheduleKey, retryAfterMs, state.now());
                 // A 429 is the upstream quota signal for the attempted account, so
                 // keep the consumed runtime token drained.
@@ -1300,7 +1508,23 @@ async function handleRequestInner(state, req, res, traceId) {
                 continue;
             }
             if (upstream.status >= 500) {
-                await readErrorBody(upstream, state.streamStallTimeoutMs);
+                const bodyText = await readErrorBody(upstream, state.streamStallTimeoutMs);
+                // A capacity 5xx is upstream load, not a broken account, so it
+                // must not cool the account down or count against the pool.
+                if (isModelAtCapacityError(upstream.status, bodyText)) {
+                    const outcome = await waitOutModelCapacity(parseRetryAfterHeaderMs(upstream.headers, state.now()), refreshed.account);
+                    if (outcome === "client-gone") {
+                        await usageRecorder.record({
+                            outcome: "failure",
+                            statusCode: upstream.status,
+                            errorCode: "client_disconnected_during_capacity_wait",
+                            account: refreshed.account,
+                        });
+                        return;
+                    }
+                    if (outcome === "retry")
+                        continue;
+                }
                 refundConsumedPoolToken(refreshed.account);
                 accountManager.recordFailure(refreshed.account, context.family, context.model);
                 accountManager.markAccountCoolingDown(refreshed.account, state.serverErrorCooldownMs, "server-error");

package/dist/lib/storage.d.ts

@@ -109,9 +109,27 @@ export declare function bumpStorageAffinityGeneration(storage: {
  * persisting routine state (rate-limit hits, cooldowns, etc.) so a CLI
  * `switch`/`unpin` that landed between proxy startup and the save is not
  * clobbered. Returns `pinnedAccountIndex: undefined` and
- * `affinityGeneration: 0` on any failure. See issue #474.
+ * `affinityGeneration: 0` on any failure by default. See issue #474.
+ *
+ * `strict` callers additionally need to know when the metadata could not be
+ * OBSERVED AT ALL, because persisting a stale in-memory pin over a newer disk
+ * pin is exactly the #474 regression. Strict mode therefore throws for the two
+ * cases where a newer selection may be hiding behind the failure:
+ *   - the file exists but cannot be read (EBUSY/EPERM/EACCES: on Windows an AV
+ *     scanner or indexer can hold accounts.json open), and
+ *   - the bytes are not valid JSON (a torn read of a concurrent atomic write).
+ *
+ * A MISSING file and a successfully parsed file with INVALID field values are
+ * deliberately not failures, in either mode. Neither can be concealing a newer
+ * pin (there is no file, or we can see the whole file and the field is
+ * unusable), and both are self-repaired by the very write that follows. Making
+ * them throw would wedge persistence permanently, since recreating or repairing
+ * storage goes through the same save path, and it would take every rate-limit
+ * window, cooldown and rotated refresh token in memory down with it.
  */
-export declare function readPinAndGenFromDisk(path: string): {
+export declare function readPinAndGenFromDisk(path: string, options?: {
+    strict?: boolean;
+}): {
     pinnedAccountIndex: number | undefined;
     affinityGeneration: number;
 };

package/dist/lib/storage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../lib/storage.ts"],"names":[],"mappings":"AA+BA,OAAO,EACN,KAAK,cAAc,EAGnB,KAAK,iBAAiB,EAEtB,MAAM,8BAA8B,CAAC;AAkBtC,OAAO,EAEN,KAAK,oBAAoB,EACzB,MAAM,qBAAqB,CAAC;AAe7B,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EACN,sBAAsB,EACtB,cAAc,GACd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACN,qBAAqB,EACrB,iBAAiB,GACjB,MAAM,uBAAuB,CAAC;AAa/B,OAAO,KAAK,EACX,iBAAiB,EACjB,gBAAgB,EAChB,cAAc,EACd,wBAAwB,EACxB,uBAAuB,EACvB,gBAAgB,EAChB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAEN,KAAK,kBAAkB,EACvB,MAAM,4BAA4B,CAAC;AA2CpC,YAAY,EACX,oBAAoB,EACpB,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,wBAAwB,EACxB,uBAAuB,EACvB,cAAc,EACd,iBAAiB,EACjB,kBAAkB,GAClB,CAAC;AAcF,KAAK,WAAW,GAAG;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAiBF,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAE9D;AAuWD,wBAAgB,4BAA4B,IAAI,MAAM,CAErD;AAED,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CA4C/D;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAO9D;AAED;;;GAGG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAMvC;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAarE;AAED,wBAAsB,yBAAyB,CAC9C,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAC7B,OAAO,CAAC,gBAAgB,CAAC,CAe3B;AAED,wBAAsB,iBAAiB,CACtC,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAC3B,OAAO,CAAC,MAAM,CAAC,CAQjB;AAED,wBAAgB,sBAAsB,IAAI,MAAM,CAE/C;AA6LD,KAAK,mBAAmB,GAAG;IAC1B,wCAAwC,CAAC,EAAE,OAAO,CAAC;CACnD,CAAC;AA8IF,wBAAgB,wBAAwB,CACvC,CAAC,SAAS,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,EAEnE,QAAQ,EAAE,SAAS,CAAC,EAAE,EACtB,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,EACpE,OAAO,GAAE,mBAAwB,GAC/B,MAAM,GAAG,SAAS,CAkBpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAC1C,aAAa,EACV,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,GACzD,SAAS,EACZ,YAAY,EAAE,SAAS,IAAI,CAC1B,WAAW,EACX,WAAW,GAAG,OAAO,GAAG,cAAc,CACtC,EAAE,GACD,MAAM,GAAG,SAAS,CAGpB;AAED,wBAAgB,4BAA4B,CAC3C,CAAC,SAAS,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,EAEnE,QAAQ,EAAE,SAAS,CAAC,EAAE,EACtB,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,EACpE,aAAa,SAAI,GACf,MAAM,CAOR;AAsCD;;;GAGG;AACH,wBAAgB,mBAAmB,CAClC,CAAC,SAAS;IACT,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB,EACA,QAAQ,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,CAEpB;AAED,wBAAgB,0BAA0B,CACzC,CAAC,SAAS;IACT,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB,EACA,QAAQ,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,CAEpB;AAoBD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACtC,IAAI,EAAE,OAAO,GACX,gBAAgB,GAAG,IAAI,CAoJzB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAoBnE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,6BAA6B,CAC5C,OAAO,EAAE;IAAE,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAAE,EACxC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,GACzB,MAAM,CAaR;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG;IACpD,kBAAkB,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,kBAAkB,EAAE,MAAM,CAAC;CAC3B,CA8BA;AAED;;;;GAIG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAErE;AAED,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,cAAc,CAAC,CAajE;AAED,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,iBAAiB,CAAC,CASvE;AAED,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,oBAAoB,CAAC,CAiG1E;AAyaD,wBAAsB,6BAA6B,CAAC,CAAC,EACpD,OAAO,EAAE,CACR,OAAO,EAAE,gBAAgB,GAAG,IAAI,EAChC,OAAO,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,KACjD,OAAO,CAAC,CAAC,CAAC,GACb,OAAO,CAAC,CAAC,CAAC,CAMZ;AAED,wBAAsB,uCAAuC,CAAC,CAAC,EAC9D,OAAO,EAAE,CACR,OAAO,EAAE,gBAAgB,GAAG,IAAI,EAChC,OAAO,EAAE,CACR,cAAc,EAAE,gBAAgB,EAChC,cAAc,EAAE,uBAAuB,KACnC,OAAO,CAAC,IAAI,CAAC,EAClB,cAAc,EAAE,uBAAuB,KACnC,OAAO,CAAC,CAAC,CAAC,GACb,OAAO,CAAC,CAAC,CAAC,CAgDZ;AAED,wBAAsB,6BAA6B,CAAC,CAAC,EACpD,OAAO,EAAE,CACR,OAAO,EAAE,uBAAuB,EAChC,OAAO,EAAE,CAAC,OAAO,EAAE,uBAAuB,KAAK,OAAO,CAAC,IAAI,CAAC,KACxD,OAAO,CAAC,CAAC,CAAC,GACb,OAAO,CAAC,CAAC,CAAC,CAiCZ;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAM3E;AAED;;;GAGG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAcnD;AAED,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,uBAAuB,CAAC,CAgD5E;AAyBD,wBAAsB,mBAAmB,CACxC,OAAO,EAAE,uBAAuB,GAC9B,OAAO,CAAC,IAAI,CAAC,CAMf;AAED,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,IAAI,CAAC,CAa1D;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CACnC,QAAQ,EAAE,MAAM,EAChB,KAAK,UAAO,EACZ,YAAY,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,GAC3D,OAAO,CAAC,IAAI,CAAC,CAgBf;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CACnC,QAAQ,EAAE,MAAM,GACd,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAe/D"}
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../lib/storage.ts"],"names":[],"mappings":"AA+BA,OAAO,EACN,KAAK,cAAc,EAGnB,KAAK,iBAAiB,EAEtB,MAAM,8BAA8B,CAAC;AAkBtC,OAAO,EAEN,KAAK,oBAAoB,EACzB,MAAM,qBAAqB,CAAC;AAe7B,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EACN,sBAAsB,EACtB,cAAc,GACd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACN,qBAAqB,EACrB,iBAAiB,GACjB,MAAM,uBAAuB,CAAC;AAa/B,OAAO,KAAK,EACX,iBAAiB,EACjB,gBAAgB,EAChB,cAAc,EACd,wBAAwB,EACxB,uBAAuB,EACvB,gBAAgB,EAChB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAEN,KAAK,kBAAkB,EACvB,MAAM,4BAA4B,CAAC;AA2CpC,YAAY,EACX,oBAAoB,EACpB,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,wBAAwB,EACxB,uBAAuB,EACvB,cAAc,EACd,iBAAiB,EACjB,kBAAkB,GAClB,CAAC;AAcF,KAAK,WAAW,GAAG;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAiBF,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAE9D;AAuWD,wBAAgB,4BAA4B,IAAI,MAAM,CAErD;AAED,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CA4C/D;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAO9D;AAED;;;GAGG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAMvC;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAarE;AAED,wBAAsB,yBAAyB,CAC9C,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAC7B,OAAO,CAAC,gBAAgB,CAAC,CAe3B;AAED,wBAAsB,iBAAiB,CACtC,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAC3B,OAAO,CAAC,MAAM,CAAC,CAQjB;AAED,wBAAgB,sBAAsB,IAAI,MAAM,CAE/C;AA6LD,KAAK,mBAAmB,GAAG;IAC1B,wCAAwC,CAAC,EAAE,OAAO,CAAC;CACnD,CAAC;AA8IF,wBAAgB,wBAAwB,CACvC,CAAC,SAAS,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,EAEnE,QAAQ,EAAE,SAAS,CAAC,EAAE,EACtB,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,EACpE,OAAO,GAAE,mBAAwB,GAC/B,MAAM,GAAG,SAAS,CAkBpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAC1C,aAAa,EACV,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,GACzD,SAAS,EACZ,YAAY,EAAE,SAAS,IAAI,CAC1B,WAAW,EACX,WAAW,GAAG,OAAO,GAAG,cAAc,CACtC,EAAE,GACD,MAAM,GAAG,SAAS,CAGpB;AAED,wBAAgB,4BAA4B,CAC3C,CAAC,SAAS,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,EAEnE,QAAQ,EAAE,SAAS,CAAC,EAAE,EACtB,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,EACpE,aAAa,SAAI,GACf,MAAM,CAOR;AAsCD;;;GAGG;AACH,wBAAgB,mBAAmB,CAClC,CAAC,SAAS;IACT,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB,EACA,QAAQ,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,CAEpB;AAED,wBAAgB,0BAA0B,CACzC,CAAC,SAAS;IACT,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB,EACA,QAAQ,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,CAEpB;AAoBD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACtC,IAAI,EAAE,OAAO,GACX,gBAAgB,GAAG,IAAI,CAqJzB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAwBnE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,6BAA6B,CAC5C,OAAO,EAAE;IAAE,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAAE,EACxC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,GACzB,MAAM,CAmBR;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,qBAAqB,CACpC,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,GAC5B;IACF,kBAAkB,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,kBAAkB,EAAE,MAAM,CAAC;CAC3B,CA6CA;AAED;;;;GAIG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAErE;AAED,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,cAAc,CAAC,CAajE;AAED,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,iBAAiB,CAAC,CASvE;AAED,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,oBAAoB,CAAC,CAiG1E;AAyaD,wBAAsB,6BAA6B,CAAC,CAAC,EACpD,OAAO,EAAE,CACR,OAAO,EAAE,gBAAgB,GAAG,IAAI,EAChC,OAAO,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,KACjD,OAAO,CAAC,CAAC,CAAC,GACb,OAAO,CAAC,CAAC,CAAC,CAMZ;AAED,wBAAsB,uCAAuC,CAAC,CAAC,EAC9D,OAAO,EAAE,CACR,OAAO,EAAE,gBAAgB,GAAG,IAAI,EAChC,OAAO,EAAE,CACR,cAAc,EAAE,gBAAgB,EAChC,cAAc,EAAE,uBAAuB,KACnC,OAAO,CAAC,IAAI,CAAC,EAClB,cAAc,EAAE,uBAAuB,KACnC,OAAO,CAAC,CAAC,CAAC,GACb,OAAO,CAAC,CAAC,CAAC,CAgDZ;AAED,wBAAsB,6BAA6B,CAAC,CAAC,EACpD,OAAO,EAAE,CACR,OAAO,EAAE,uBAAuB,EAChC,OAAO,EAAE,CAAC,OAAO,EAAE,uBAAuB,KAAK,OAAO,CAAC,IAAI,CAAC,KACxD,OAAO,CAAC,CAAC,CAAC,GACb,OAAO,CAAC,CAAC,CAAC,CAiCZ;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAM3E;AAED;;;GAGG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAcnD;AAED,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,uBAAuB,CAAC,CAgD5E;AAyBD,wBAAsB,mBAAmB,CACxC,OAAO,EAAE,uBAAuB,GAC9B,OAAO,CAAC,IAAI,CAAC,CAMf;AAED,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,IAAI,CAAC,CAa1D;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CACnC,QAAQ,EAAE,MAAM,EAChB,KAAK,UAAO,EACZ,YAAY,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,GAC3D,OAAO,CAAC,IAAI,CAAC,CAgBf;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CACnC,QAAQ,EAAE,MAAM,GACd,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAe/D"}

package/dist/lib/storage.js

@@ -898,7 +898,8 @@ export function normalizeAccountStorage(data) {
             return undefined;
         if (typeof raw !== "number" ||
             !Number.isFinite(raw) ||
-            !Number.isInteger(raw) ||
+            // See readAffinityGenerationFromDisk: an unsafe integer wedges the bump.
+            !Number.isSafeInteger(raw) ||
             raw < 0) {
             log.warn("Dropping invalid affinityGeneration from storage", {
                 value: raw,
@@ -941,7 +942,11 @@ export function readAffinityGenerationFromDisk(path) {
         const generation = parsed.affinityGeneration;
         if (typeof generation === "number" &&
             Number.isFinite(generation) &&
-            Number.isInteger(generation) &&
+            // Safe, not merely integral: past 2^53 `Math.max(gen, disk) + 1 === gen`,
+            // so `bumpStorageAffinityGeneration` silently stops advancing and no
+            // running proxy ever observes another `switch`. Rejecting the value
+            // lets the next bump write 1 and repair the file.
+            Number.isSafeInteger(generation) &&
             generation >= 0) {
             return generation;
         }
@@ -978,7 +983,12 @@ export function bumpStorageAffinityGeneration(storage, storagePath) {
         // No resolvable storage path (never configured). The in-memory counter
         // is still bumped below; only the lost-update guard is unavailable.
     }
-    const inMemoryGeneration = storage.affinityGeneration ?? 0;
+    // Guard the in-memory side too, not just the disk read. Past 2^53
+    // `Math.max(gen, disk) + 1 === gen`, so an unsafe value here would write the
+    // same generation forever and no running proxy would observe another
+    // `switch`. Treating it as 0 makes the next write repair the counter.
+    const rawInMemory = storage.affinityGeneration ?? 0;
+    const inMemoryGeneration = Number.isSafeInteger(rawInMemory) && rawInMemory >= 0 ? rawInMemory : 0;
     const next = Math.max(inMemoryGeneration, diskGeneration) + 1;
     storage.affinityGeneration = next;
     return next;
@@ -990,34 +1000,68 @@ export function bumpStorageAffinityGeneration(storage, storagePath) {
  * persisting routine state (rate-limit hits, cooldowns, etc.) so a CLI
  * `switch`/`unpin` that landed between proxy startup and the save is not
  * clobbered. Returns `pinnedAccountIndex: undefined` and
- * `affinityGeneration: 0` on any failure. See issue #474.
+ * `affinityGeneration: 0` on any failure by default. See issue #474.
+ *
+ * `strict` callers additionally need to know when the metadata could not be
+ * OBSERVED AT ALL, because persisting a stale in-memory pin over a newer disk
+ * pin is exactly the #474 regression. Strict mode therefore throws for the two
+ * cases where a newer selection may be hiding behind the failure:
+ *   - the file exists but cannot be read (EBUSY/EPERM/EACCES: on Windows an AV
+ *     scanner or indexer can hold accounts.json open), and
+ *   - the bytes are not valid JSON (a torn read of a concurrent atomic write).
+ *
+ * A MISSING file and a successfully parsed file with INVALID field values are
+ * deliberately not failures, in either mode. Neither can be concealing a newer
+ * pin (there is no file, or we can see the whole file and the field is
+ * unusable), and both are self-repaired by the very write that follows. Making
+ * them throw would wedge persistence permanently, since recreating or repairing
+ * storage goes through the same save path, and it would take every rate-limit
+ * window, cooldown and rotated refresh token in memory down with it.
  */
-export function readPinAndGenFromDisk(path) {
+export function readPinAndGenFromDisk(path, options) {
+    const unselected = {
+        pinnedAccountIndex: undefined,
+        affinityGeneration: 0,
+    };
     if (!existsSync(path)) {
-        return { pinnedAccountIndex: undefined, affinityGeneration: 0 };
+        return { ...unselected };
     }
+    let parsed;
     try {
-        const bytes = readFileSync(path);
-        const parsed = JSON.parse(bytes.toString("utf8"));
-        const rawPin = parsed.pinnedAccountIndex;
-        const pinnedAccountIndex = typeof rawPin === "number" &&
-            Number.isFinite(rawPin) &&
-            Number.isInteger(rawPin) &&
-            rawPin >= 0
-            ? rawPin
-            : undefined;
-        const rawGen = parsed.affinityGeneration;
-        const affinityGeneration = typeof rawGen === "number" &&
-            Number.isFinite(rawGen) &&
-            Number.isInteger(rawGen) &&
-            rawGen >= 0
-            ? rawGen
-            : 0;
-        return { pinnedAccountIndex, affinityGeneration };
+        parsed = JSON.parse(readFileSync(path, "utf8"));
     }
-    catch {
-        return { pinnedAccountIndex: undefined, affinityGeneration: 0 };
+    catch (error) {
+        // The file was deleted or renamed between existsSync and the read; same
+        // reasoning as the missing-file branch above.
+        if (error.code === "ENOENT") {
+            return { ...unselected };
+        }
+        if (options?.strict) {
+            throw new Error("Unable to read account selection metadata", {
+                cause: error,
+            });
+        }
+        return { ...unselected };
+    }
+    if (!isRecord(parsed)) {
+        return { ...unselected };
     }
+    const rawPin = parsed.pinnedAccountIndex;
+    const pinnedAccountIndex = typeof rawPin === "number" &&
+        Number.isFinite(rawPin) &&
+        Number.isInteger(rawPin) &&
+        rawPin >= 0
+        ? rawPin
+        : undefined;
+    const rawGen = parsed.affinityGeneration;
+    const affinityGeneration = typeof rawGen === "number" &&
+        Number.isFinite(rawGen) &&
+        // See readAffinityGenerationFromDisk: an unsafe integer wedges the bump.
+        Number.isSafeInteger(rawGen) &&
+        rawGen >= 0
+        ? rawGen
+        : 0;
+    return { pinnedAccountIndex, affinityGeneration };
 }
 /**
  * Loads OAuth accounts from disk storage.

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "codex-multi-auth",
-	"version": "2.12.0",
+	"version": "2.14.0",
 	"description": "Codex CLI multi-account OAuth manager with account switching, health checks, runtime rotation, diagnostics, and recovery tools for @openai/codex",
 	"main": "./dist/index.js",
 	"types": "./dist/index.d.ts",

package/scripts/codex-routing.js

@@ -2,6 +2,7 @@ const AUTH_SUBCOMMANDS = new Set([
 	"login",
 	"list",
 	"status",
+	"limits",
 	"switch",
 	"unpin",
 	"workspace",