codex-multi-auth 2.15.0 → 2.17.0

package/dist/lib/accounts.js

@@ -1,7 +1,9 @@
+import { mergeAccountCooldown, mergeAccountSnapshot, mergeAccountRuntimeObservations } from "./storage/snapshot-merge.js";
 import { createHash } from "node:crypto";
+import { existsSync } from "node:fs";
 import { saveAccountsWithRetry } from "./storage/save-retry.js";
 import { createLogger } from "./logger.js";
-import { getStoragePath, loadAccounts, readPinAndGenFromDisk, saveAccounts, findMatchingAccountIndex, withAccountStorageTransaction, } from "./storage.js";
+import { getStoragePath, loadAccounts, readPinAndGenFromDisk, saveAccounts, findMatchingAccountIndex, withAccountStorageTransaction, ACCOUNT_STORAGE_UNREADABLE, recordPendingAuth, } from "./storage.js";
 import { MODEL_FAMILIES } from "./request/helpers/model-map.js";
 import { getHealthTracker, getTokenTracker, resetTrackers, selectHybridAccount, } from "./rotation.js";
 import { withRoutingMutex, } from "./routing-mutex.js";
@@ -17,7 +19,7 @@ import { getStoragePathState, runWithStoragePathState, } from "./storage/path-st
 export { extractAccountId, extractAccountEmail, getAccountIdCandidates, selectBestAccountCandidate, resolveRuntimeRequestIdentity, shouldUpdateAccountIdFromToken, resolveRequestAccountId, sanitizeEmail, } from "./auth/token-utils.js";
 export { parseRateLimitReason, getQuotaKey, clampNonNegativeInt, clearExpiredRateLimits, clearAllRateLimits, isRateLimitedForQuotaKey, isRateLimitedForFamily, formatWaitTime, } from "./accounts/rate-limits.js";
 export { lookupCodexCliTokensByEmail, isCodexCliSyncEnabled, } from "./codex-cli/state.js";
-import { extractAccountId, extractAccountEmail, shouldUpdateAccountIdFromToken, sanitizeEmail, } from "./auth/token-utils.js";
+import { codexCliAccountIdFor, extractAccountId, extractAccountEmail, shouldUpdateAccountIdFromToken, sanitizeEmail, } from "./auth/token-utils.js";
 import { clampNonNegativeInt, getQuotaKey, clearExpiredRateLimits, clearAllRateLimits, isRateLimitedForFamily, formatWaitTime, } from "./accounts/rate-limits.js";
 const log = createLogger("accounts");
 let nextRuntimeCircuitKeyId = 0;
@@ -37,7 +39,7 @@ function deriveAccountRecordId(account) {
     ].join("\u0000");
     return `record:${createHash("sha256").update(seed).digest("hex")}`;
 }
-function resolveAccountRecordId(account) {
+export function resolveAccountRecordId(account) {
     const stored = account.recordId?.trim();
     return stored || deriveAccountRecordId(account);
 }
@@ -147,7 +149,11 @@ export const MAX_DEBOUNCED_SAVE_RETRIES = 5;
 /** Ceiling for the debounced-save retry backoff. */
 export const MAX_SAVE_RETRY_DELAY_MS = 8_000;
 export class AccountManager {
+    persistenceBaseline = null;
     accounts = [];
+    persistedWorkspaceSelections = new WeakMap();
+    persistedWorkspaces = new WeakMap();
+    hadPersistedStorage = false;
     cursorByFamily = initFamilyState(0);
     currentAccountIndexByFamily = initFamilyState(-1);
     lastToastAccountIndex = -1;
@@ -272,6 +278,7 @@ export class AccountManager {
     }
     constructor(authFallback, stored) {
         this.storagePathState = { ...getStoragePathState() };
+        this.hadPersistedStorage = existsSync(this.resolveSelectionStoragePath());
         const fallbackAccountId = extractAccountId(authFallback?.access)?.trim() || undefined;
         const fallbackAccountEmail = sanitizeEmail(extractAccountEmail(authFallback?.access));
         // Hydrate pin/gen from the stored snapshot. Validation (range, integer)
@@ -333,7 +340,7 @@ export class AccountManager {
                     : account.refreshToken;
                 return {
                     index,
-                    recordId: resolveAccountRecordId({ ...account, refreshToken }),
+                    recordId: resolveAccountRecordId(account),
                     accountId: matchesFallback
                         ? (fallbackAccountId ?? account.accountId)
                         : account.accountId,
@@ -360,6 +367,7 @@ export class AccountManager {
                     authInvalidationErrorCode: account.authInvalidationErrorCode,
                     workspaces: account.workspaces,
                     currentWorkspaceIndex: account.currentWorkspaceIndex,
+                    codexCliMirror: account.codexCliMirror,
                 };
             })
                 .filter((account) => account !== null);
@@ -396,6 +404,8 @@ export class AccountManager {
                     this.cursorByFamily[family] = nextIndex;
                 }
             }
+            this.persistenceBaseline = stored ? structuredClone(stored) : null;
+            this.rememberWorkspaceSelections();
             return;
         }
         if (authFallback) {
@@ -427,6 +437,64 @@ export class AccountManager {
                 this.cursorByFamily[family] = 0;
             }
         }
+        this.persistenceBaseline = stored ? structuredClone(stored) : null;
+        this.rememberWorkspaceSelections();
+    }
+    /** Reconcile external workspace policy by ID, preserving health changes not superseded on disk. */
+    syncWorkspaceSelections(current) {
+        if (!current)
+            return false;
+        let changed = false;
+        for (const account of this.accounts) {
+            const matches = current.accounts.filter(disk => disk.recordId && disk.recordId === account.recordId);
+            const key = getAccountIdentityKey(account);
+            const candidates = matches.length ? matches : current.accounts.filter(disk => key && getAccountIdentityKey(disk) === key);
+            if (candidates.length !== 1)
+                continue;
+            const disk = candidates[0];
+            if (!disk)
+                continue;
+            const localSelectedId = account.workspaces?.[account.currentWorkspaceIndex ?? 0]?.id;
+            const baseline = this.persistedWorkspaces.get(account);
+            if (JSON.stringify(disk.workspaces) !== JSON.stringify(baseline)) {
+                account.workspaces = disk.workspaces?.map(workspace => {
+                    const previous = baseline?.find(item => item.id === workspace.id);
+                    const local = account.workspaces?.find(item => item.id === workspace.id);
+                    return previous && local && workspace.enabled === previous.enabled && workspace.disabledAt === previous.disabledAt
+                        ? { ...workspace, enabled: local.enabled, disabledAt: local.disabledAt }
+                        : { ...workspace };
+                });
+                this.persistedWorkspaces.set(account, structuredClone(disk.workspaces));
+                changed = true;
+            }
+            const selectedId = disk.workspaces?.[disk.currentWorkspaceIndex ?? 0]?.id;
+            const preferredId = selectedId !== this.persistedWorkspaceSelections.get(account) ? selectedId : localSelectedId;
+            let index = account.workspaces?.findIndex(workspace => workspace.id === preferredId) ?? -1;
+            if (index < 0)
+                index = account.workspaces?.findIndex(workspace => workspace.id === selectedId) ?? -1;
+            if (index < 0)
+                index = 0;
+            if (account.workspaces?.length && account.currentWorkspaceIndex !== index) {
+                account.currentWorkspaceIndex = index;
+                changed = true;
+            }
+            this.persistedWorkspaceSelections.set(account, selectedId);
+        }
+        return changed;
+    }
+    rememberWorkspaceSelections(snapshot) {
+        this.accounts.forEach(account => {
+            // recordId first; the identity key only when defined and unique, since
+            // duplicate identities (or two missing ones) would pick another row's baseline.
+            const rows = snapshot?.accounts ?? [];
+            const byRecord = account.recordId ? rows.filter(row => row.recordId === account.recordId) : [];
+            const key = getAccountIdentityKey(account);
+            const matches = byRecord.length ? byRecord : key ? rows.filter(row => getAccountIdentityKey(row) === key) : [];
+            const saved = (matches.length === 1 ? matches[0] : undefined) ?? account;
+            this.persistedWorkspaceSelections.set(account, saved.workspaces?.[saved.currentWorkspaceIndex ?? 0]?.id);
+            this.persistedWorkspaces.set(account, structuredClone(saved.workspaces));
+        });
+        this.hadPersistedStorage ||= existsSync(this.resolveSelectionStoragePath());
     }
     getAccountCount() {
         return this.accounts.length;
@@ -615,7 +683,7 @@ export class AccountManager {
         if (!account)
             return;
         await setCodexCliActiveSelection({
-            accountId: account.accountId,
+            accountId: codexCliAccountIdFor(account, account.access),
             email: account.email,
             accessToken: account.access,
             refreshToken: account.refreshToken,
@@ -1281,6 +1349,7 @@ export class AccountManager {
                         : undefined,
                     workspaces: account.workspaces,
                     currentWorkspaceIndex: account.currentWorkspaceIndex,
+                    codexCliMirror: account.codexCliMirror,
                 };
             }),
             activeIndex,
@@ -1299,13 +1368,16 @@ export class AccountManager {
         const nextEmail = sanitizeEmail(extractAccountEmail(auth.access));
         try {
             return await withAccountStorageTransaction(async (_current, persist) => {
+                if (!_current && this.hadPersistedStorage)
+                    throw Object.assign(new Error("Account storage was removed; reload before saving."), { code: "ESTALE" });
+                this.syncWorkspaceSelections(_current);
                 // Snapshot the live in-memory pool under the storage lock so refresh
                 // persistence merges against the latest account state. Reconcile the
                 // selection first for the same reason `saveToDisk` does: this write
                 // carries `pinnedAccountIndex`/`affinityGeneration` too, so a stale
                 // pair here would clobber a `switch` that landed since the last save.
                 this.reconcileSelectionFromDisk();
-                const nextStorage = structuredClone(this.buildStorageSnapshot());
+                const nextStorage = structuredClone(this.reconcileTokensFromDisk(this.buildStorageSnapshot(), _current));
                 const storageIndex = findAccountIndexByIdentity(nextStorage.accounts, source, auth);
                 if (storageIndex === undefined) {
                     log.warn("Unable to resolve refreshed account for persistence", {
@@ -1354,7 +1426,8 @@ export class AccountManager {
                     this.clearAccountCooldown(liveAccount);
                     this.clearAuthFailures(liveAccount);
                     try {
-                        await persist(nextStorage);
+                        await this.persistSnapshot(_current, nextStorage, persist, storedAccount);
+                        this.rememberWorkspaceSelections(nextStorage);
                     }
                     catch (error) {
                         liveAccount.access = previousLiveAccountState.access;
@@ -1399,7 +1472,8 @@ export class AccountManager {
                     }
                     return liveAccount;
                 }
-                await persist(nextStorage);
+                await this.persistSnapshot(_current, nextStorage, persist, storedAccount);
+                this.rememberWorkspaceSelections(nextStorage);
                 log.warn("Unable to resolve refreshed live account after persistence", {
                     sourceIndex: source.index,
                 });
@@ -1407,6 +1481,51 @@ export class AccountManager {
             });
         }
         catch (error) {
+            // The refresh already rotated the token upstream; the old one is spent.
+            // A locked or unreadable accounts file must not discard the only valid
+            // credential, so keep it live and let the retrying debounced save
+            // persist it once the file can be read.
+            // A write that still fails after the storage retries (e.g. a Windows lock)
+            // spends the old token just the same, so it is rescued like an unreadable file.
+            const live = [ACCOUNT_STORAGE_UNREADABLE, "ELOCKED", "EACCES"].includes(error.code ?? "") || isRetryableAuthPersistenceError(error)
+                ? this.getAccountByIdentity(source, auth)
+                : null;
+            if (live) {
+                const priorRefreshToken = live.refreshToken;
+                this.updateFromAuth(live, auth);
+                live.enabled = true;
+                if (live.cooldownReason === "auth-failure")
+                    this.clearAccountCooldown(live);
+                this.clearAuthFailures(live);
+                // The debounced save needs this process to survive and the file to
+                // unlock. Journal the rotated credential beside the pool so the next
+                // load (any process) applies it even if neither happens.
+                try {
+                    await runWithStoragePathState(this.storagePathState, () => recordPendingAuth(getStoragePath(), {
+                        priorRefreshToken,
+                        refreshToken: auth.refresh,
+                        accessToken: auth.access,
+                        expiresAt: auth.expires,
+                        at: nowMs(),
+                    }));
+                    // Loads now see the journaled token, so it is the persisted state
+                    // that later merges (and a further rotation) compare against.
+                    const baselineRow = this.persistenceBaseline?.accounts.find(row => row.refreshToken === priorRefreshToken);
+                    if (baselineRow)
+                        Object.assign(baselineRow, { refreshToken: auth.refresh, accessToken: auth.access, expiresAt: auth.expires });
+                    log.warn("Account storage could not be read or written; rotated credential journaled until it can be saved", {
+                        sourceIndex: source.index,
+                    });
+                }
+                catch (journalError) {
+                    log.error("Account storage could not be read or written and the rotated credential could not be journaled; it is only in memory. Keep this process running until the accounts file is readable, or the account will need a re-login.", {
+                        sourceIndex: source.index,
+                        code: typeof journalError.code === "string" && /^[A-Z_]{1,40}$/.test(journalError.code ?? "") ? journalError.code : "INVALID_PENDING_AUTH",
+                    });
+                }
+                this.saveToDiskDebounced();
+                return live;
+            }
             throw new CodexAuthError(ERROR_MESSAGES.TOKEN_REFRESH_FAILED, {
                 retryable: isRetryableAuthPersistenceError(error),
                 cause: error,
@@ -1671,14 +1790,93 @@ export class AccountManager {
         }
         return account;
     }
-    async saveToDisk() {
+    async persistSnapshot(current, proposed, persist, refreshed, runtimeOnConflict = false) {
+        // Preserve initial/missing-store creation. An intentionally cleared store has
+        // distinct metadata and must still win over this manager's stale inventory.
+        let merged;
+        let rescuedBaseline;
+        try {
+            merged = current ? mergeAccountSnapshot(this.persistenceBaseline, current, proposed) : proposed;
+        }
+        catch (error) {
+            if (runtimeOnConflict && error.code === "ESTALE" && current && this.persistenceBaseline) {
+                await persist(mergeAccountRuntimeObservations(this.persistenceBaseline, current, proposed));
+                log.warn("Saved runtime observations; conflicting account edits remain pending and require reload or reconciliation.");
+                return;
+            }
+            if (error.code !== "ESTALE" || !refreshed?.recordId || !current)
+                throw error;
+            // A rotated credential must not be discarded because an unrelated user edit
+            // conflicts. Persist only its auth delta under this same transaction lock.
+            const matches = (row) => resolveAccountRecordId(row) === refreshed.recordId;
+            const prior = this.persistenceBaseline?.accounts.find(matches);
+            const index = current.accounts.findIndex(matches);
+            const disk = current.accounts[index];
+            if (!prior || !disk || disk.refreshToken !== prior.refreshToken || disk.enabled === false || disk.authInvalidatedAt)
+                throw error;
+            merged = structuredClone(current);
+            const row = merged.accounts[index];
+            if (!row || !this.persistenceBaseline)
+                throw error;
+            rescuedBaseline = structuredClone(this.persistenceBaseline);
+            const baselineRow = rescuedBaseline.accounts.find(matches);
+            if (!baselineRow)
+                throw error;
+            const cooldown = mergeAccountCooldown(prior, disk, refreshed);
+            // Persist the stable identity before rotating a legacy row's identity material.
+            row.recordId = refreshed.recordId;
+            baselineRow.recordId = refreshed.recordId;
+            // Only authentication was committed. Pending additions, removals and user
+            // edits must still differ from their old baseline on the next save. The
+            // refresh can also move the identity and clears auth blockers; a restart
+            // must not bring the old identity or cooldown back.
+            for (const field of ["accessToken", "refreshToken", "expiresAt", "accountId", "accountIdSource", "email", "authInvalidatedAt", "authInvalidationErrorCode", "coolingDownUntil", "cooldownReason"]) {
+                const value = refreshed[field];
+                if (value === undefined) {
+                    delete row[field];
+                    delete baselineRow[field];
+                }
+                else {
+                    Object.assign(row, { [field]: value });
+                    Object.assign(baselineRow, { [field]: value });
+                }
+            }
+            Object.assign(row, cooldown);
+        }
+        await persist(merged);
+        if (refreshed) {
+            const saved = merged.accounts.find(row => row.recordId === refreshed.recordId);
+            const live = this.accounts.find(row => row.recordId === refreshed.recordId);
+            // A successful refresh must retain blockers learned by another request,
+            // including an observation made while the storage write was pending.
+            if (saved && live)
+                Object.assign(live, mergeAccountCooldown(refreshed, saved, live));
+        }
+        // Keep the baseline in this manager's inventory/intent space. Adopting added
+        // disk records here would misread their absence in the next save as deletion.
+        this.persistenceBaseline = rescuedBaseline ?? structuredClone(proposed);
+        if (refreshed) {
+            const saved = merged.accounts.find(row => row.recordId === refreshed.recordId);
+            const baseline = this.persistenceBaseline.accounts.find(row => row.recordId === refreshed.recordId);
+            // The adopted blocker is now known persisted state, so a later explicit
+            // clear must compare against it rather than the pre-refresh clear.
+            if (saved && baseline)
+                Object.assign(baseline, { coolingDownUntil: saved.coolingDownUntil, cooldownReason: saved.cooldownReason });
+        }
+    }
+    async saveToDisk(runtimeOnConflict = false) {
         await runWithStoragePathState(this.storagePathState, async () => {
             await withAccountStorageTransaction(async (current, persist) => {
+                if (!current && this.hadPersistedStorage)
+                    throw Object.assign(new Error("Account storage was removed; reload before saving."), { code: "ESTALE" });
                 // Reconcile against the disk state loaded under the storage lock so a
                 // routine save does not clobber a token another process just rotated
                 // (stress audit H3) or a pin the CLI just wrote (#474).
                 this.reconcileSelectionFromDisk();
-                await persist(this.reconcileTokensFromDisk(this.buildStorageSnapshot(), current));
+                this.syncWorkspaceSelections(current);
+                const snapshot = this.reconcileTokensFromDisk(this.buildStorageSnapshot(), current);
+                await this.persistSnapshot(current, snapshot, persist, undefined, runtimeOnConflict);
+                this.rememberWorkspaceSelections(snapshot);
             });
         });
     }
@@ -1693,7 +1891,7 @@ export class AccountManager {
                     if (this.pendingSave) {
                         await this.pendingSave;
                     }
-                    this.pendingSave = this.saveToDisk().finally(() => {
+                    this.pendingSave = this.saveToDisk(true).finally(() => {
                         this.pendingSave = null;
                     });
                     await this.pendingSave;
@@ -1735,7 +1933,7 @@ export class AccountManager {
             if (this.saveDebounceTimer) {
                 clearTimeout(this.saveDebounceTimer);
                 this.saveDebounceTimer = null;
-                await this.saveToDisk();
+                await this.saveToDisk(true);
             }
             if (this.pendingSave) {
                 await this.pendingSave;
@@ -1754,10 +1952,15 @@ export class AccountManager {
         }
         const resetIndex = account.workspaces.findIndex((workspace) => workspace.isDefault === true);
         for (const workspace of account.workspaces) {
-            workspace.enabled = true;
-            delete workspace.disabledAt;
+            // Only undo runtime health disablement, never an explicit workspace exclusion.
+            if (workspace.disabledAt !== undefined) {
+                workspace.enabled = true;
+                delete workspace.disabledAt;
+            }
+        }
+        if (!account.workspaces[account.currentWorkspaceIndex ?? -1]) {
+            account.currentWorkspaceIndex = resetIndex >= 0 ? resetIndex : 0;
         }
-        account.currentWorkspaceIndex = resetIndex >= 0 ? resetIndex : 0;
     }
     getCurrentWorkspace(account) {
         if (!account.workspaces || account.workspaces.length === 0) {
@@ -1766,6 +1969,15 @@ export class AccountManager {
         const idx = account.currentWorkspaceIndex ?? 0;
         return account.workspaces[idx] ?? null;
     }
+    /** Disable a specific request workspace without changing the interactive selection. */
+    disableWorkspace(account, workspaceId) {
+        const workspace = account.workspaces?.find(item => item.id === workspaceId);
+        if (!workspace || workspace.enabled === false)
+            return false;
+        workspace.enabled = false;
+        workspace.disabledAt = nowMs();
+        return true;
+    }
     disableCurrentWorkspace(account, expectedWorkspaceId) {
         if (!account.workspaces || account.workspaces.length === 0) {
             return false;
@@ -1873,7 +2085,7 @@ export function formatAccountLabel(account, index) {
  * render these (e.g. only when more than one workspace exists) and supply the
  * leading indent.
  */
-export function formatWorkspaceLines(account, indent = "   ") {
+export function formatWorkspaceLines(account, indent = "   ", selectionLabel = "active") {
     const workspaces = account?.workspaces;
     if (!workspaces || workspaces.length === 0)
         return [];
@@ -1885,7 +2097,7 @@ export function formatWorkspaceLines(account, indent = "   ") {
         const idSuffix = id.length > 6 ? id.slice(-6) : id;
         const tags = [];
         if (isActive)
-            tags.push("active");
+            tags.push(selectionLabel);
         if (workspace.enabled === false)
             tags.push("disabled");
         const tagLabel = tags.length > 0 ? ` (${tags.join(", ")})` : "";

package/dist/lib/api-route-store.d.ts

@@ -0,0 +1,24 @@
+import { z } from "zod";
+declare const routeSchema: z.ZodObject<{
+    id: z.ZodString;
+    label: z.ZodString;
+    kind: z.ZodEnum<{
+        api: "api";
+        zdr: "zdr";
+    }>;
+    apiKey: z.ZodString;
+    enabled: z.ZodBoolean;
+    priority: z.ZodNumber;
+    visibleModels: z.ZodArray<z.ZodString>;
+    knownModels: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    probeCapabilities: z.ZodOptional<z.ZodBoolean>;
+    accessPrograms: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>;
+    modelAccessPrograms: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>>;
+}, z.core.$strip>;
+export type ApiRouteCredential = z.infer<typeof routeSchema>;
+export declare function getApiRoutesPath(): string;
+export declare function loadApiRoutes(path?: string): Promise<ApiRouteCredential[]>;
+export declare function saveApiRoutes(routes: ApiRouteCredential[], path?: string, expected?: ApiRouteCredential[]): Promise<void>;
+export declare function updateApiModelDiscovery(route: ApiRouteCredential, models: string[], path?: string): Promise<ApiRouteCredential>;
+export {};
+//# sourceMappingURL=api-route-store.d.ts.map

package/dist/lib/api-route-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-route-store.d.ts","sourceRoot":"","sources":["../../lib/api-route-store.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAcxB,QAAA,MAAM,WAAW;;;;;;;;;;;;;;;iBAsBf,CAAC;AAKH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAC7D,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAWD,wBAAsB,aAAa,CAClC,IAAI,SAAqB,GACvB,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAwB/B;AACD,wBAAsB,aAAa,CAClC,MAAM,EAAE,kBAAkB,EAAE,EAC5B,IAAI,SAAqB,EACzB,QAAQ,CAAC,EAAE,kBAAkB,EAAE,GAC7B,OAAO,CAAC,IAAI,CAAC,CAgCf;AAKD,wBAAgB,uBAAuB,CACtC,KAAK,EAAE,kBAAkB,EACzB,MAAM,EAAE,MAAM,EAAE,EAChB,IAAI,SAAqB,GACvB,OAAO,CAAC,kBAAkB,CAAC,CAS7B"}

package/dist/lib/api-route-store.js

@@ -0,0 +1,145 @@
+import { promises as fs } from "node:fs";
+import { dirname, join } from "node:path";
+import { z } from "zod";
+import { getCodexMultiAuthDir } from "./runtime-paths.js";
+import { tempPathFor } from "./temp-path.js";
+import { withRetry } from "./fs-retry.js";
+import { withStorageLock } from "./storage/transactions.js";
+import { withFileTransactionLock } from "./storage/file-lock.js";
+const modelId = z
+    .string()
+    .min(1)
+    .max(200)
+    .regex(/^[A-Za-z0-9][A-Za-z0-9._:-]*$/);
+const programId = z.string().min(1).max(80).regex(/^[A-Za-z0-9][A-Za-z0-9._-]*$/);
+const accessPrograms = z.record(programId, z.array(programId).max(32))
+    .refine(value => Object.keys(value).length <= 16);
+const routeSchema = z.object({
+    id: z
+        .string()
+        .min(1)
+        .max(80)
+        .regex(/^[A-Za-z0-9_-]+$/),
+    label: z
+        .string()
+        .min(1)
+        .max(80)
+        .regex(/^[^\x00-\x1f\x7f]+$/),
+    kind: z.enum(["api", "zdr"]),
+    apiKey: z.string().min(1).max(1024).regex(/^\S+$/),
+    enabled: z.boolean(),
+    priority: z.number().int().min(0).max(9),
+    visibleModels: z.array(modelId).max(1000),
+    knownModels: z.array(modelId).max(10000).optional(),
+    probeCapabilities: z.boolean().optional(),
+    /** Administrator-confirmed credential entitlements absent from API model discovery. */
+    accessPrograms: accessPrograms.optional(),
+    modelAccessPrograms: z.record(modelId, accessPrograms)
+        .refine(value => Object.keys(value).length <= 1000).optional(),
+});
+const schema = z.object({
+    version: z.literal(1),
+    routes: z.array(routeSchema).max(100),
+});
+export function getApiRoutesPath() {
+    return join(getCodexMultiAuthDir(), "api-routes.json");
+}
+function validate(value) {
+    const parsed = schema.safeParse(value);
+    if (!parsed.success ||
+        new Set(parsed.data.routes.map((r) => r.id)).size !==
+            parsed.data.routes.length)
+        throw new Error("Invalid API route configuration");
+    return parsed.data.routes;
+}
+export async function loadApiRoutes(path = getApiRoutesPath()) {
+    let raw;
+    try {
+        raw = await withRetry(async () => {
+            const handle = await fs.open(path, "r");
+            try {
+                const buffer = Buffer.alloc(1024 * 1024 + 1);
+                const { bytesRead } = await handle.read(buffer, 0, buffer.length, 0);
+                if (bytesRead > 1024 * 1024)
+                    throw new Error("Invalid API route configuration");
+                return buffer.subarray(0, bytesRead).toString("utf8");
+            }
+            finally {
+                await handle.close();
+            }
+        }, { maxAttempts: 6, backoffMs: 25 });
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return [];
+        throw new Error("Unable to read API route configuration");
+    }
+    try {
+        return validate(JSON.parse(raw));
+    }
+    catch {
+        throw new Error("Invalid API route configuration");
+    }
+}
+export async function saveApiRoutes(routes, path = getApiRoutesPath(), expected) {
+    const validated = validate({ version: 1, routes });
+    const serialized = JSON.stringify({ version: 1, routes: validated }) + "\n";
+    if (Buffer.byteLength(serialized) > 1024 * 1024)
+        throw new Error("API route configuration is too large");
+    await withStorageLock(() => withFileTransactionLock(path, async () => {
+        await fs.mkdir(dirname(path), { recursive: true, mode: 0o700 });
+        const temp = tempPathFor(path);
+        try {
+            if (expected &&
+                JSON.stringify(await loadApiRoutes(path)) !==
+                    JSON.stringify(validate({ version: 1, routes: expected }))) {
+                throw new Error("API route configuration changed; reopen the menu before saving.");
+            }
+            await fs.writeFile(temp, serialized, { mode: 0o600, flag: "wx" });
+            await withRetry(() => fs.rename(temp, path), {
+                maxAttempts: 6,
+                backoffMs: 25,
+            });
+        }
+        finally {
+            await withRetry(() => fs.unlink(temp), {
+                maxAttempts: 6,
+                backoffMs: 25,
+            }).catch((error) => {
+                if (error.code !== "ENOENT")
+                    throw error;
+            });
+        }
+    }));
+}
+/** Persist a discovery baseline and new GPT text IDs without undoing menu edits.
+ * Callers supply IDs already filtered for the Responses endpoint family. */
+let discoveryUpdates = Promise.resolve();
+export function updateApiModelDiscovery(route, models, path = getApiRoutesPath()) {
+    const result = discoveryUpdates.then(() => updateApiModelDiscoverySerial(route, models, path));
+    discoveryUpdates = result.then(() => undefined, () => undefined);
+    return result;
+}
+async function updateApiModelDiscoverySerial(route, models, path = getApiRoutesPath()) {
+    const routes = await loadApiRoutes(path);
+    const current = routes.find((r) => r.id === route.id && r.apiKey === route.apiKey && r.kind === route.kind);
+    if (!current)
+        return { ...route, enabled: false, visibleModels: [] };
+    if (!current.enabled)
+        return current;
+    const known = new Set(current.knownModels ?? models);
+    const visible = new Set(current.visibleModels);
+    for (const id of models) {
+        if (!known.has(id) && /^gpt-/i.test(id))
+            visible.add(id);
+        known.add(id);
+    }
+    const updated = {
+        ...current,
+        knownModels: [...known],
+        visibleModels: [...visible],
+    };
+    if (JSON.stringify(updated) !== JSON.stringify(current))
+        await saveApiRoutes(routes.map((r) => (r.id === current.id ? updated : r)), path, routes);
+    return updated;
+}