codex-multi-auth 2.15.0 → 2.17.0

package/dist/lib/codex-manager/repair-commands.js

@@ -6,6 +6,7 @@ import { extractAccountEmail, extractAccountId, formatAccountLabel, sanitizeEmai
 import { loadQuotaCache, saveQuotaCache } from "../quota-cache.js";
 import { fetchCodexQuotaSnapshot, CODEX_UNAVAILABLE_PROBE_NOTE, } from "../quota-probe.js";
 import { isCodexUnavailableError } from "../errors.js";
+import { codexAuthAccountIdsMatch, codexCliAccountIdFor, codexCliActiveIdentity, isOpenAiOrgId, } from "../auth/token-utils.js";
 import { queuedRefresh } from "../refresh-queue.js";
 import { findMatchingAccountIndex, getStoragePath, loadAccounts, loadFlaggedAccounts, setStoragePath, withAccountStorageTransaction, withAccountAndFlaggedStorageTransaction, withFlaggedStorageTransaction, } from "../storage.js";
 import { getCodexCliAuthPath, getCodexCliConfigPath, loadCodexCliState, } from "../codex-cli/state.js";
@@ -28,6 +29,7 @@ function printFixUsage() {
         "  - Refreshes tokens for enabled accounts",
         "  - Disables hard-failed accounts (never deletes)",
         "  - Recommends a better current account when needed",
+        "  - With --live, rebinds an org workspace id the backend no longer authorizes",
     ].join("\n"));
 }
 function printVerifyFlaggedUsage() {
@@ -160,7 +162,8 @@ function summarizeFixReports(reports) {
             healthy += 1;
         else if (report.outcome === "disabled-hard-failure")
             disabled += 1;
-        else if (report.outcome === "warning-soft-failure")
+        else if (report.outcome === "warning-soft-failure" ||
+            report.outcome === "rebound-unauthorized-workspace")
             warnings += 1;
         else
             skipped += 1;
@@ -186,7 +189,11 @@ function hasAccountStorageMutation(before, after) {
         || before.email !== after.email
         || before.accountId !== after.accountId
         || before.accountIdSource !== after.accountIdSource
-        || before.enabled !== after.enabled);
+        || before.enabled !== after.enabled
+        || before.accountLabel !== after.accountLabel
+        || before.currentWorkspaceIndex !== after.currentWorkspaceIndex
+        || JSON.stringify(before.workspaces) !== JSON.stringify(after.workspaces)
+        || JSON.stringify(before.codexCliMirror) !== JSON.stringify(after.codexCliMirror));
 }
 function collectAccountStorageMutations(beforeAccounts, afterAccounts) {
     const mutations = [];
@@ -224,6 +231,33 @@ function applyAccountStorageMutations(storage, mutations) {
         target.accountId = mutation.after.accountId;
         target.accountIdSource = mutation.after.accountIdSource;
         target.enabled = mutation.after.enabled;
+        // Only the workspace rebind in `fix --live` moves these; copying them
+        // unconditionally would clobber a label/workspace change made on disk
+        // since this run loaded storage.
+        if (mutation.before.accountLabel !== mutation.after.accountLabel) {
+            target.accountLabel = mutation.after.accountLabel;
+        }
+        if (JSON.stringify(mutation.before.codexCliMirror) !==
+            JSON.stringify(mutation.after.codexCliMirror)) {
+            target.codexCliMirror = mutation.after.codexCliMirror;
+            if (!target.codexCliMirror)
+                delete target.codexCliMirror;
+        }
+        // The pointer indexes the list, so the two move together: copying only
+        // the list would keep a pointer moved on disk meanwhile, possibly out
+        // of range of the new list.
+        if (mutation.before.currentWorkspaceIndex !== mutation.after.currentWorkspaceIndex ||
+            JSON.stringify(mutation.before.workspaces) !==
+                JSON.stringify(mutation.after.workspaces)) {
+            const workspaces = mutation.after.workspaces;
+            const pointer = mutation.after.currentWorkspaceIndex;
+            target.workspaces = workspaces;
+            target.currentWorkspaceIndex =
+                !workspaces ||
+                    (typeof pointer === "number" && pointer >= 0 && pointer < workspaces.length)
+                    ? pointer
+                    : Math.max(0, workspaces.findIndex((workspace) => workspace.id === mutation.after.accountId));
+        }
     }
 }
 function findExistingAccountIndexForFlagged(storage, flagged, nextRefreshToken, nextAccountId, nextEmail) {
@@ -866,6 +900,29 @@ export async function runFix(args, deps) {
     const reports = [];
     const refreshFailures = new Map();
     const hardDisabledIndexes = [];
+    // A rebind mutates the account before its live probe, so a later rebind
+    // attempt on the refresh path sees a `token` source and reports nothing.
+    // Tracking it per index keeps the note on whichever report ends up final.
+    const reboundIndexes = new Set();
+    // Explicit accounts whose CodexCliMirror this run set or cleared. Checked
+    // once per account even when the refresh path runs after a failed probe.
+    const mirrorUpdates = new Map();
+    const checkMirror = async (index, accessToken) => {
+        const account = storage.accounts[index];
+        if (!account || mirrorUpdates.has(index))
+            return;
+        const update = await deps.refreshCodexCliMirror(account, accessToken);
+        mirrorUpdates.set(index, update);
+        if (update)
+            accountStorageChanged = true;
+    };
+    const noteRebound = (index) => {
+        reboundIndexes.add(index);
+        accountStorageChanged = true;
+        if (workingQuotaCache) {
+            quotaEmailFallbackState = deps.buildQuotaEmailFallbackState(storage.accounts);
+        }
+    };
     for (let i = 0; i < storage.accounts.length; i += 1) {
         const account = storage.accounts[i];
         if (!account)
@@ -884,6 +941,12 @@ export async function runFix(args, deps) {
             let refreshAfterLiveProbeFailure = false;
             if (options.live) {
                 const currentAccessToken = account.accessToken;
+                if (currentAccessToken &&
+                    (await deps.reboundUnauthorizedAccountIdentity(account, currentAccessToken))) {
+                    noteRebound(i);
+                }
+                if (currentAccessToken)
+                    await checkMirror(i, currentAccessToken);
                 const probeAccountId = currentAccessToken
                     ? account.accountId ?? extractAccountId(currentAccessToken)
                     : undefined;
@@ -962,6 +1025,10 @@ export async function runFix(args, deps) {
                     deps.pruneUnsafeQuotaEmailCacheEntry(workingQuotaCache, previousEmail, storage.accounts, quotaEmailFallbackState) || quotaCacheChanged;
             }
             if (options.live) {
+                if (await deps.reboundUnauthorizedAccountIdentity(account, refreshResult.access)) {
+                    noteRebound(i);
+                }
+                await checkMirror(i, refreshResult.access);
                 const probeAccountId = account.accountId ?? nextAccountId;
                 if (probeAccountId) {
                     try {
@@ -1068,8 +1135,32 @@ export async function runFix(args, deps) {
         refreshFailure: refreshFailures.get(index),
     })));
     const recommendation = recommendForecastAccount(forecastResults);
+    for (const report of reports) {
+        const mirrorUpdate = mirrorUpdates.get(report.index);
+        if (mirrorUpdate === "set") {
+            report.message = `explicit workspace is not authorized for these credentials; Codex CLI auth uses the backend default. ${report.message}`;
+        }
+        else if (mirrorUpdate === "cleared") {
+            report.message = `explicit workspace is authorized again; Codex CLI auth uses it. ${report.message}`;
+        }
+        if (!reboundIndexes.has(report.index))
+            continue;
+        report.label = formatAccountLabel(storage.accounts[report.index], report.index);
+        report.message = `workspace was not authorized for these credentials; rebound to the account's default identity. ${report.message}`;
+        if (report.outcome === "healthy") {
+            report.outcome = "rebound-unauthorized-workspace";
+        }
+    }
     const reportSummary = summarizeFixReports(reports);
     const accountMutations = collectAccountStorageMutations(originalAccounts, storage.accounts);
+    // ~/.codex/auth.json still carries the rejected id for the active account,
+    // and Codex CLI keeps refusing it until something rewrites that file. The
+    // mirror is taken from the committed snapshot, not this run's in-memory
+    // view, and written while the storage lock is still held: another process
+    // may switch the active account around this run, and a sync outside the
+    // lock could put the old selection back into auth.json.
+    let codexActiveSynced = null;
+    let committedActiveIndex = activeIndex;
     if (accountStorageChanged && !options.dryRun) {
         await withAccountStorageTransaction(async (loadedStorage, persist) => {
             const nextStorage = loadedStorage
@@ -1077,6 +1168,28 @@ export async function runFix(args, deps) {
                 : createEmptyAccountStorage();
             applyAccountStorageMutations(nextStorage, accountMutations);
             await persist(nextStorage);
+            committedActiveIndex = deps.resolveActiveIndex(nextStorage, "codex");
+            const committedActive = nextStorage.accounts[committedActiveIndex];
+            const syncIndexes = [
+                ...reboundIndexes,
+                ...[...mirrorUpdates].filter(([, update]) => update).map(([index]) => index),
+            ];
+            const isRebound = committedActive !== undefined &&
+                syncIndexes.some((index) => {
+                    const rebound = storage.accounts[index];
+                    return (rebound !== undefined &&
+                        rebound.accountId === committedActive.accountId &&
+                        rebound.refreshToken === committedActive.refreshToken);
+                });
+            if (isRebound && committedActive.enabled !== false) {
+                codexActiveSynced = await setCodexCliActiveSelection({
+                    accountId: codexCliAccountIdFor(committedActive, committedActive.accessToken),
+                    email: committedActive.email,
+                    accessToken: committedActive.accessToken,
+                    refreshToken: committedActive.refreshToken,
+                    expiresAt: committedActive.expiresAt,
+                });
+            }
         });
     }
     let quotaCacheSaveError = null;
@@ -1103,6 +1216,7 @@ export async function runFix(args, deps) {
             changed,
             quotaCacheChanged,
             quotaCacheSaveError,
+            codexActiveSynced,
             summary: reportSummary,
             recommendation,
             recommendedSwitchCommand: recommendation.recommendedIndex !== null
@@ -1129,6 +1243,9 @@ export async function runFix(args, deps) {
     if (quotaCacheSaveError) {
         console.log(deps.stylePromptText(`Warning: quota cache save failed (${quotaCacheSaveError}); account fixes were saved.`, "warning"));
     }
+    if (codexActiveSynced === false) {
+        console.log(deps.stylePromptText(`Warning: the rebound active account could not be synced into Codex auth state; run \`codex-multi-auth switch ${committedActiveIndex + 1}\` to retry.`, "warning"));
+    }
     if (display.showPerAccountRows) {
         console.log("");
         for (const report of reports) {
@@ -1136,14 +1253,16 @@ export async function runFix(args, deps) {
                 ? "✓"
                 : report.outcome === "disabled-hard-failure"
                     ? "✗"
-                    : report.outcome === "warning-soft-failure"
+                    : report.outcome === "warning-soft-failure" ||
+                        report.outcome === "rebound-unauthorized-workspace"
                         ? "!"
                         : "-";
             const tone = report.outcome === "healthy"
                 ? "success"
                 : report.outcome === "disabled-hard-failure"
                     ? "danger"
-                    : report.outcome === "warning-soft-failure"
+                    : report.outcome === "warning-soft-failure" ||
+                        report.outcome === "rebound-unauthorized-workspace"
                         ? "warning"
                         : "muted";
             console.log(`${deps.stylePromptText(prefix, tone)} ${deps.stylePromptText(`${report.index + 1}. ${report.label}`, "accent")} ${deps.stylePromptText("|", "muted")} ${deps.styleAccountDetailText(report.message, tone === "success" ? "muted" : tone)}`);
@@ -1233,6 +1352,7 @@ export async function runDoctor(args, deps) {
     const codexConfigFileExists = existsSync(codexConfigPath);
     let codexAuthEmail;
     let codexAuthAccountId;
+    let codexAuthFileAccountId;
     addCheck({
         key: "codex-auth-file",
         severity: codexAuthFileExists ? "ok" : "warn",
@@ -1269,6 +1389,7 @@ export async function runDoctor(args, deps) {
                     : undefined;
                 const emailFromFile = typeof payload.email === "string" ? payload.email : undefined;
                 codexAuthEmail = sanitizeEmail(emailFromFile ?? extractAccountEmail(accessToken, idToken));
+                codexAuthFileAccountId = accountIdFromFile;
                 codexAuthAccountId = accountIdFromFile ?? extractAccountId(accessToken);
                 addCheck({
                     key: "codex-auth-readable",
@@ -1553,9 +1674,23 @@ export async function runDoctor(args, deps) {
             const isEmailMismatch = !!managerActiveEmail
                 && !!codexActiveEmail
                 && managerActiveEmail !== codexActiveEmail;
-            const isAccountIdMismatch = !!managerActiveAccountId
-                && !!codexActiveAccountId
-                && managerActiveAccountId !== codexActiveAccountId;
+            // A stored "org-..." id is written to auth.json as the token's
+            // workspace id, while the legacy accounts.json keeps the raw id (#700).
+            const codexActiveIdentity = codexCliState?.activeAccountId
+                ? codexCliActiveIdentity(codexCliState)
+                : { accountId: codexActiveAccountId };
+            // An org account_id in auth.json itself (written before #700) is
+            // rejected by Codex CLI 0.156+, so it is never aligned.
+            const isAccountIdMismatch = isOpenAiOrgId(codexAuthFileAccountId)
+                || (!!managerActiveAccountId
+                    && !!codexActiveAccountId
+                    && !codexAuthAccountIdsMatch({
+                        // As the writer would write it (CodexCliMirror applied).
+                        accountId: activeAccount
+                            ? codexCliAccountIdFor(activeAccount, activeAccount.accessToken)
+                            : managerActiveAccountId,
+                        accessToken: activeAccount?.accessToken,
+                    }, codexActiveIdentity));
             addCheck({
                 key: "active-selection-sync",
                 severity: isEmailMismatch || isAccountIdMismatch ? "warn" : "ok",
@@ -1627,7 +1762,7 @@ export async function runDoctor(args, deps) {
                 }
                 if (!options.dryRun && canSyncActiveAccount) {
                     pendingCodexActiveSync = {
-                        accountId: activeAccount.accountId,
+                        accountId: codexCliAccountIdFor(activeAccount, syncAccessToken, syncIdToken),
                         email: activeAccount.email,
                         accessToken: syncAccessToken,
                         refreshToken: syncRefreshToken,

package/dist/lib/codex-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codex-manager.d.ts","sourceRoot":"","sources":["../../lib/codex-manager.ts"],"names":[],"mappings":"AA4DA,OAAO,EAIN,yBAAyB,EACzB,MAAM,eAAe,CAAC;AA6BvB,OAAO,EAEN,mBAAmB,EAMnB,sBAAsB,EAGtB,MAAM,qCAAqC,CAAC;AA+B7C,OAAO,EAEN,KAAK,gBAAgB,EAWrB,MAAM,cAAc,CAAC;AAKtB,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,CAAC;AA4IvD,wBAAsB,4BAA4B,IAAI,OAAO,CAAC,OAAO,CAAC,CAuGrE;AACD,mFAAmF;AACnF,wBAAgB,wBAAwB,IAAI,CAC3C,OAAO,EAAE,gBAAgB,KACrB,OAAO,CAAC,UAAU,CAAC,OAAO,yBAAyB,CAAC,CAAC,CAwEzD;AA8PD,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA4C7E"}
+{"version":3,"file":"codex-manager.d.ts","sourceRoot":"","sources":["../../lib/codex-manager.ts"],"names":[],"mappings":"AAsEA,OAAO,EAIN,yBAAyB,EACzB,MAAM,eAAe,CAAC;AA8BvB,OAAO,EAEN,mBAAmB,EAMnB,sBAAsB,EAGtB,MAAM,qCAAqC,CAAC;AA+B7C,OAAO,EAEN,KAAK,gBAAgB,EAWrB,MAAM,cAAc,CAAC;AAKtB,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,CAAC;AA8IvD,wBAAsB,4BAA4B,IAAI,OAAO,CAAC,OAAO,CAAC,CAyGrE;AACD,mFAAmF;AACnF,wBAAgB,wBAAwB,IAAI,CAC3C,OAAO,EAAE,gBAAgB,KACrB,OAAO,CAAC,UAAU,CAAC,OAAO,yBAAyB,CAAC,CAAC,CAwEzD;AAyQD,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA4C7E"}

package/dist/lib/codex-manager.js

@@ -1,4 +1,11 @@
+import { runResetsCommand } from "./codex-manager/commands/resets.js";
+import { loadResetCreditState } from "./runtime/account-reset-credits.js";
+import { loadApiRoutes } from "./api-route-store.js";
+import { loadInferenceRequestTimes } from "./runtime/inference-activity.js";
+import { loadModelInventory, refreshAndPrintModelInventory } from "./runtime/model-discovery-status.js";
 import { AUTH_INVALIDATION_MARKER, AccountManager, extractAccountEmail, extractAccountId, formatAccountLabel, formatWaitTime, sanitizeEmail, } from "./accounts.js";
+import { reboundUnauthorizedAccountIdentity, refreshCodexCliMirror, } from "./auth/account-access.js";
+import { codexCliAccountIdFor } from "./auth/token-utils.js";
 import { loadCodexCliState } from "./codex-cli/state.js";
 import { setCodexCliActiveSelection } from "./codex-cli/writer.js";
 import { parseBestArgs, printBestUsage, runBestCommand, } from "./codex-manager/commands/best.js";
@@ -27,6 +34,7 @@ import { evaluateRuntimePolicy, loadRuntimePolicyState, } from "./policy/runtime
 import { CURRENT_CODEX_MODEL } from "./request/helpers/model-map.js";
 import { runDoctor as runRepairDoctor, runFix as runRepairFix, runVerifyFlagged as runRepairVerifyFlagged, } from "./codex-manager/repair-commands.js";
 import { runUninstallCommand } from "./codex-manager/commands/uninstall.js";
+import { clearAccountsAndCredentialSidecars } from "./storage/credential-sidecars.js";
 import { runForecastCommand } from "./codex-manager/commands/forecast.js";
 import { runInitConfigCommand } from "./codex-manager/commands/init-config.js";
 import { runReportCommand } from "./codex-manager/commands/report.js";
@@ -73,6 +81,8 @@ function createRepairCommandDeps() {
         formatCompactQuotaSnapshot,
         resolveStoredAccountIdentity,
         applyTokenAccountIdentity,
+        reboundUnauthorizedAccountIdentity,
+        refreshCodexCliMirror,
     };
 }
 const IMPLEMENTED_FEATURES = [
@@ -210,7 +220,6 @@ export async function autoSyncActiveAccountToCodex() {
     let syncRefreshToken = account.refreshToken;
     let syncExpiresAt = account.expiresAt;
     let syncIdToken;
-    let syncAccountId = account.accountId;
     let syncEmail = account.email;
     let changed = false;
     let nextStoredAccount = null;
@@ -245,7 +254,6 @@ export async function autoSyncActiveAccountToCodex() {
         syncRefreshToken = refreshResult.refresh;
         syncExpiresAt = refreshResult.expires;
         syncIdToken = refreshResult.idToken;
-        syncAccountId = nextStoredAccount.accountId;
         syncEmail = nextStoredAccount.email;
     }
     if (changed && nextStoredAccount) {
@@ -273,7 +281,7 @@ export async function autoSyncActiveAccountToCodex() {
         }
     }
     return setCodexCliActiveSelection({
-        accountId: syncAccountId,
+        accountId: codexCliAccountIdFor(nextStoredAccount ?? account, syncAccessToken, syncIdToken),
         email: syncEmail,
         accessToken: syncAccessToken,
         refreshToken: syncRefreshToken,
@@ -349,6 +357,10 @@ export function buildSelectAccountTraced() {
  * Shared handler for `list` and `status` (aliases of the same view).
  */
 const runListOrStatusCommand = (rest) => runStatusCommand({
+    loadApiRoutes,
+    loadResetCreditState,
+    loadInferenceRequestTimes,
+    loadModelInventory,
     setStoragePath,
     getStoragePath,
     loadAccounts,
@@ -357,7 +369,7 @@ const runListOrStatusCommand = (rest) => runStatusCommand({
     formatRateLimitEntry,
     loadRuntimeObservabilitySnapshot: loadPersistedRuntimeObservabilitySnapshot,
     loadAppBindStatus: async () => getAppBindStatus()
-        .then((status) => (status.running ? status.router : null))
+        .then((status) => (status.running && status.router ? { ...status.router, nativeOpenai: status.state?.nativeOpenai === true } : null))
         .catch(() => null),
     loadAppHelperStatus: readAppRuntimeHelperAccountSignal,
     loadQuotaCache,
@@ -413,7 +425,11 @@ const CLI_COMMAND_HANDLERS = new Map([
             saveAccounts,
         }),
     ],
-    ["check", () => runCheckCommand({ runHealthCheck })],
+    ["check", (rest) => runCheckCommand({
+            runHealthCheck,
+            runResetCheck: () => runResetsCommand(["list", "--refresh"]),
+            runCapabilityCheck: () => refreshAndPrintModelInventory(console.log, { forceProbes: true }),
+        }, rest)],
     [
         "features",
         () => runFeaturesCommand({ implementedFeatures: IMPLEMENTED_FEATURES }),
@@ -468,6 +484,7 @@ const CLI_COMMAND_HANDLERS = new Map([
         }),
     ],
     ["usage", (rest) => runUsageCommand(rest)],
+    ["resets", (rest) => runResetsCommand(rest)],
     [
         "rotation",
         (rest) => runRotationCommand(rest, {
@@ -531,7 +548,9 @@ const CLI_COMMAND_HANDLERS = new Map([
     ],
     ["fix", (rest) => runRepairFix(rest, createRepairCommandDeps())],
     ["doctor", (rest) => runRepairDoctor(rest, createRepairCommandDeps())],
-    ["uninstall", (rest) => runUninstallCommand(rest, { clearAccounts })],
+    ["uninstall", (rest) => runUninstallCommand(rest, {
+            clearAccounts: () => clearAccountsAndCredentialSidecars(clearAccounts),
+        })],
     [
         "config",
         (rest) => {

package/dist/lib/concurrency.d.ts

@@ -0,0 +1,3 @@
+/** Bounded independent work, refilling free slots immediately and preserving result order. */
+export declare function mapWithConcurrency<T, R>(items: readonly T[], limit: number, worker: (item: T, index: number) => Promise<R>): Promise<R[]>;
+//# sourceMappingURL=concurrency.d.ts.map

package/dist/lib/concurrency.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"concurrency.d.ts","sourceRoot":"","sources":["../../lib/concurrency.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,wBAAsB,kBAAkB,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,CA6B/I"}

package/dist/lib/concurrency.js

@@ -0,0 +1,31 @@
+/** Bounded independent work, refilling free slots immediately and preserving result order. */
+export async function mapWithConcurrency(items, limit, worker) {
+    if (!Number.isInteger(limit) || limit < 1)
+        throw new RangeError("Concurrency must be a positive integer");
+    const results = new Array(items.length);
+    let next = 0;
+    let failed = false;
+    let failure;
+    await Promise.all(Array.from({ length: Math.min(limit, items.length) }, async () => {
+        while (!failed) {
+            const index = next++;
+            if (index >= items.length)
+                return;
+            const item = items[index];
+            if (item === undefined)
+                continue;
+            try {
+                results[index] = await worker(item, index);
+            }
+            catch (error) {
+                if (!failed)
+                    failure = error;
+                failed = true;
+            }
+        }
+    }));
+    // Drain active work before returning an error, so no detached writes survive the caller.
+    if (failed)
+        throw failure;
+    return results;
+}

package/dist/lib/context-budget/model-context-windows.d.ts

@@ -6,7 +6,7 @@
  * behavior (see the v2.5.0 release notes) closely enough to launch that no
  * estimate here has been reviewed for it yet.
  */
-export declare const UNESTIMATED_ROUTABLE_MODELS: readonly ["gpt-5.6-sol", "gpt-5.6-terra", "gpt-5.6-luna", "gpt-6-astra", "gpt-6-astra-aeon", "gpt-daybreak-blue-latest", "gpt-daybreak-red-latest"];
+export declare const UNESTIMATED_ROUTABLE_MODELS: readonly ["gpt-5.6-sol", "gpt-5.6-terra", "gpt-5.6-luna", "gpt-6-astra", "gpt-6-astra-aeon", "gpt-6-sol", "gpt-6-luna", "gpt-daybreak-blue-latest", "gpt-daybreak-red-latest"];
 export interface EffectiveContextWindow {
     tokens: number;
     source: "override" | "estimate";

package/dist/lib/context-budget/model-context-windows.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"model-context-windows.d.ts","sourceRoot":"","sources":["../../../lib/context-budget/model-context-windows.ts"],"names":[],"mappings":"AAyCA;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,qJAgB9B,CAAC;AAgCX,MAAM,WAAW,sBAAsB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,UAAU,GAAG,UAAU,CAAC;CAChC;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACxC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,GAC3C,sBAAsB,GAAG,IAAI,CA0B/B;AAED,wBAAgB,gCAAgC,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAEzE"}
+{"version":3,"file":"model-context-windows.d.ts","sourceRoot":"","sources":["../../../lib/context-budget/model-context-windows.ts"],"names":[],"mappings":"AAoCA;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,gLAoB9B,CAAC;AAgCX,MAAM,WAAW,sBAAsB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,UAAU,GAAG,UAAU,CAAC;CAChC;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACxC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,GAC3C,sBAAsB,GAAG,IAAI,CA0B/B;AAED,wBAAgB,gCAAgC,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAEzE"}

package/dist/lib/context-budget/model-context-windows.js

@@ -22,19 +22,14 @@ import { getNormalizedModel } from "../request/helpers/model-map.js";
  * in doubt about a model's real ceiling, leave it out of this table and add
  * it to UNESTIMATED_ROUTABLE_MODELS instead.
  */
+//
+// Retired models (`gpt-5.1` through `gpt-5.4-*`, `gpt-5-mini`/`nano`, the codex
+// models) are deliberately absent. Their ids now route to a replacement, and
+// estimating the window from the retired name would evaluate a request against
+// a model it no longer runs on.
 const ESTIMATED_MODEL_CONTEXT_WINDOWS = {
-    "gpt-5.1": 260_000,
-    "gpt-5.2": 260_000,
-    "gpt-5.2-pro": 260_000,
-    "gpt-5.3-codex": 260_000,
-    "gpt-5.4": 260_000,
-    "gpt-5.4-mini": 260_000,
-    "gpt-5.4-nano": 260_000,
-    "gpt-5.4-pro": 260_000,
     "gpt-5.5": 260_000,
     "gpt-5.5-pro": 260_000,
-    "gpt-5-mini": 260_000,
-    "gpt-5-nano": 260_000,
 };
 /**
  * Routable models this guard consciously does not estimate a window for.
@@ -58,6 +53,10 @@ export const UNESTIMATED_ROUTABLE_MODELS = [
     // `contextBudgetGuardModelWindowOverrides` once you know your real ceiling.
     "gpt-6-astra",
     "gpt-6-astra-aeon",
+    // Sol and Luna carry the same 272K Codex / 872K max split in the upstream
+    // catalog as Astra, so the same reasoning keeps them unestimated.
+    "gpt-6-sol",
+    "gpt-6-luna",
     "gpt-daybreak-blue-latest",
     "gpt-daybreak-red-latest",
 ];

package/dist/lib/model-route-policy.d.ts

@@ -0,0 +1,52 @@
+/** Model selection is the explicit routing signal; never infer a privacy route from prompt text. */
+export type ModelRouteKind = "oauth" | "api" | "zdr";
+export type RouteModel = Record<string, unknown> & {
+    slug: string;
+};
+export interface RouteCatalog {
+    id: string;
+    kind: ModelRouteKind;
+    priority: number;
+    enabled: boolean;
+    models: RouteModel[];
+    /** API credentials expose nothing until the user chooses an allowlist. */
+    visibleModels: string[] | null;
+}
+export interface ResolvedModelRoute {
+    kind: ModelRouteKind;
+    upstreamModel: string;
+    candidates: RouteCatalog[];
+    serviceTier?: string;
+}
+export declare function parseModelRoute(model: string): {
+    kind: ModelRouteKind;
+    upstreamModel: string;
+    serviceTier?: string;
+};
+export declare function modelServiceTiers(model: RouteModel): Array<{
+    id: string;
+    name: string;
+    description: string;
+}>;
+export declare function canonicalServiceTier(tier: string): string;
+export declare function supportsModelSettings(model: RouteModel, reasoningEffort?: string, serviceTier?: string): boolean;
+export declare function resolveModelRoute(model: string, catalogs: RouteCatalog[], settings?: {
+    reasoningEffort?: string;
+    serviceTier?: string;
+}): ResolvedModelRoute;
+export declare function buildVisibleModelUnion(catalogs: RouteCatalog[]): RouteModel[];
+/** Whitelist capability metadata; never persist model instructions or arbitrary fields. */
+export declare function modelEntitlements(model: RouteModel): {
+    serviceTiers: {
+        id: string;
+        name: string;
+    }[];
+    reasoningLevels: string[];
+    accessPrograms: string[];
+    probes?: {
+        [k: string]: "unsupported" | "verified" | "unverified" | "downgraded";
+    } | undefined;
+    checkedAt?: number | undefined;
+    model: string;
+};
+//# sourceMappingURL=model-route-policy.d.ts.map

package/dist/lib/model-route-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"model-route-policy.d.ts","sourceRoot":"","sources":["../../lib/model-route-policy.ts"],"names":[],"mappings":"AAEA,oGAAoG;AACpG,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,KAAK,GAAG,KAAK,CAAC;AACrD,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AACpE,MAAM,WAAW,YAAY;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,cAAc,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,UAAU,EAAE,CAAC;IACrB,0EAA0E;IAC1E,aAAa,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;CAC/B;AACD,MAAM,WAAW,kBAAkB;IAClC,IAAI,EAAE,cAAc,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,YAAY,EAAE,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB;AACD,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG;IAC/C,IAAI,EAAE,cAAc,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB,CAwBA;AACD,wBAAgB,iBAAiB,CAChC,KAAK,EAAE,UAAU,GACf,KAAK,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,CAY1D;AACD,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEzD;AACD,wBAAgB,qBAAqB,CACpC,KAAK,EAAE,UAAU,EACjB,eAAe,CAAC,EAAE,MAAM,EACxB,WAAW,CAAC,EAAE,MAAM,GAClB,OAAO,CAcT;AAeD,wBAAgB,iBAAiB,CAChC,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,YAAY,EAAE,EACxB,QAAQ,GAAE;IAAE,eAAe,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,GAC/D,kBAAkB,CAuBpB;AACD,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,YAAY,EAAE,GAAG,UAAU,EAAE,CAyC7E;AAED,2FAA2F;AAC3F,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,UAAU;;;;;;;;;;;;EAiDlD"}