codex-multi-auth 2.16.0 → 2.17.2

package/dist/lib/runtime/automatic-account-checks.d.ts

@@ -0,0 +1,35 @@
+import { type AccountPolicyStore } from "../account-policy.js";
+import type { AccountMetadataV3, AccountStorageV3 } from "../storage.js";
+export declare const AUTOMATIC_CHECK_INTERVAL_MS: number;
+/** First tick after router start, so a short CLI session still gets its check. */
+export declare const AUTOMATIC_CHECK_INITIAL_DELAY_MS = 5000;
+export interface AutomaticAccountCheckOptions {
+    path: string;
+    loadAccounts: () => Promise<AccountStorageV3 | null>;
+    loadPolicies: () => Promise<AccountPolicyStore>;
+    check: (storage: AccountStorageV3, index: number, signal: AbortSignal) => Promise<void>;
+    now?: () => number;
+    signal?: AbortSignal;
+}
+/** Honor the saved selection; a disabled/invalid selection must not fall back to a sibling. */
+export declare function automaticCheckWorkspaceId(account: AccountMetadataV3): string | undefined;
+/** Policy keys can be shared by organization members; attempt limits must never be. */
+export declare function automaticAccountCheckKey(account: AccountMetadataV3): string;
+/** A durable attempt precedes network I/O, so failures and competing routers cannot double-prime. */
+export declare function runAutomaticAccountChecks(options: AutomaticAccountCheckOptions): Promise<void>;
+/**
+ * No overlapping ticks; shutdown cancels the active probe and waits for its cleanup.
+ * The first tick runs shortly after start, off the startup path; the durable
+ * per-account attempts in runAutomaticAccountChecks keep it from repeating work
+ * this or another router did recently, and it does nothing without an opt-in.
+ *
+ * Each later tick is scheduled one interval after the previous run finishes.
+ * A run records its attempts before it finishes, so the next tick is never
+ * inside the durable per-account limit. A fixed setInterval ticked just inside
+ * it (by the initial delay plus the run's own duration), skipped every
+ * account, and stretched the cadence to two intervals.
+ */
+export declare function startAutomaticAccountChecks(run: (signal: AbortSignal) => Promise<void>): {
+    stop(): Promise<void>;
+};
+//# sourceMappingURL=automatic-account-checks.d.ts.map

package/dist/lib/runtime/automatic-account-checks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"automatic-account-checks.d.ts","sourceRoot":"","sources":["../../../lib/runtime/automatic-account-checks.ts"],"names":[],"mappings":"AAKA,OAAO,EAAuB,KAAK,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AACpF,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAKzE,eAAO,MAAM,2BAA2B,QAAa,CAAC;AACtD,kFAAkF;AAClF,eAAO,MAAM,gCAAgC,OAAO,CAAC;AAKrD,MAAM,WAAW,4BAA4B;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACrD,YAAY,EAAE,MAAM,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAChD,KAAK,EAAE,CAAC,OAAO,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxF,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,WAAW,CAAC;CACxB;AACD,+FAA+F;AAC/F,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,GAAG,SAAS,CAMxF;AAED,uFAAuF;AACvF,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAE3E;AAkCD,qGAAqG;AACrG,wBAAsB,yBAAyB,CAAC,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,IAAI,CAAC,CAyCpG;AACD;;;;;;;;;;;GAWG;AACH,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC;;EAwBtF"}

package/dist/lib/runtime/automatic-account-checks.js

@@ -0,0 +1,140 @@
+import { createHash } from "node:crypto";
+import { promises as fs } from "node:fs";
+import { z } from "zod";
+import { resolveAccountRecordId } from "../accounts.js";
+import { extractAccountId } from "../auth/token-utils.js";
+import { getAccountPolicyKey } from "../account-policy.js";
+import { withFileTransactionLock } from "../storage/file-lock.js";
+import { withRetry } from "../fs-retry.js";
+import { tempPathFor } from "../temp-path.js";
+import { logWarn } from "../logger.js";
+export const AUTOMATIC_CHECK_INTERVAL_MS = 15 * 60000;
+/** First tick after router start, so a short CLI session still gets its check. */
+export const AUTOMATIC_CHECK_INITIAL_DELAY_MS = 5000;
+/** An attempt stamped further ahead than this predates a backwards clock step: treat it as expired. */
+const FUTURE_SKEW_MS = 5 * 60000;
+const schema = z.record(z.string().regex(/^sha256:[a-f0-9]{64}$/), z.number().finite().nonnegative());
+const retry = { maxAttempts: 6, backoffMs: 25 };
+/** Honor the saved selection; a disabled/invalid selection must not fall back to a sibling. */
+export function automaticCheckWorkspaceId(account) {
+    if (account.workspaces?.length) {
+        const selected = account.workspaces[account.currentWorkspaceIndex ?? 0];
+        return selected?.enabled === false ? undefined : selected?.id.trim() || undefined;
+    }
+    return account.accountId?.trim() || extractAccountId(account.accessToken) || undefined;
+}
+/** Policy keys can be shared by organization members; attempt limits must never be. */
+export function automaticAccountCheckKey(account) {
+    return workspaceAttemptKey(account, automaticCheckWorkspaceId(account) ?? "");
+}
+/** Build the same key for inactive workspaces while pruning the attempt journal. */
+function workspaceAttemptKey(account, workspaceId) {
+    return `sha256:${createHash("sha256").update(JSON.stringify([
+        "automatic-check-v2", resolveAccountRecordId(account), workspaceId,
+    ])).digest("hex")}`;
+}
+/** Reject unreadable or oversized history rather than silently allowing duplicate probes. */
+async function readAttempts(path) {
+    try {
+        const raw = await withRetry(() => fs.readFile(path, "utf8"), retry);
+        if (Buffer.byteLength(raw) > 1024 * 1024)
+            throw Error("Automatic-check history exceeds its size limit");
+        return schema.parse(JSON.parse(raw));
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return {};
+        throw error;
+    }
+}
+/** Atomically persist attempt timestamps before any billable network request. */
+async function saveAttempts(path, attempts) {
+    const temp = tempPathFor(path);
+    try {
+        await fs.writeFile(temp, JSON.stringify(attempts) + "\n", { mode: 0o600, flag: "wx" });
+        await withRetry(() => fs.rename(temp, path), retry);
+    }
+    finally {
+        await withRetry(() => fs.rm(temp, { force: true }), retry);
+    }
+}
+/** A durable attempt precedes network I/O, so failures and competing routers cannot double-prime. */
+export async function runAutomaticAccountChecks(options) {
+    const signal = options.signal ?? new AbortController().signal;
+    if (signal.aborted || !Object.values((await options.loadPolicies()).accounts).some(p => p.autoPrime))
+        return;
+    await withFileTransactionLock(options.path, async () => {
+        const policies = await options.loadPolicies();
+        const storage = await options.loadAccounts();
+        if (!storage || signal.aborted)
+            return;
+        const attempts = await readAttempts(options.path);
+        // Keep every still-saved workspace's throttle, including temporarily disabled selections.
+        const keys = new Set(storage.accounts.flatMap(account => [
+            automaticAccountCheckKey(account),
+            ...(account.workspaces ?? []).map(workspace => workspaceAttemptKey(account, workspace.id.trim())),
+        ]));
+        for (const key of Object.keys(attempts))
+            if (!keys.has(key))
+                delete attempts[key];
+        for (let index = 0; index < storage.accounts.length; index++) {
+            if (signal.aborted)
+                break;
+            const account = storage.accounts[index];
+            if (!account)
+                continue;
+            const key = automaticAccountCheckKey(account), policy = policies.accounts[getAccountPolicyKey(account)], now = options.now?.() ?? Date.now();
+            if (!policy?.autoPrime || policy.paused || policy.drained || account.enabled === false || account.authInvalidatedAt || (account.coolingDownUntil ?? 0) > now)
+                continue;
+            const lastAttempt = attempts[key];
+            if (lastAttempt !== undefined && lastAttempt <= now + FUTURE_SKEW_MS && now - lastAttempt < AUTOMATIC_CHECK_INTERVAL_MS)
+                continue;
+            attempts[key] = now;
+            await saveAttempts(options.path, attempts);
+            try {
+                await options.check(storage, index, signal);
+            }
+            catch {
+                if (!signal.aborted)
+                    logWarn("Automatic subscription check failed; retry deferred until the next interval.");
+            }
+        }
+    }, { waitMs: 0 });
+}
+/**
+ * No overlapping ticks; shutdown cancels the active probe and waits for its cleanup.
+ * The first tick runs shortly after start, off the startup path; the durable
+ * per-account attempts in runAutomaticAccountChecks keep it from repeating work
+ * this or another router did recently, and it does nothing without an opt-in.
+ *
+ * Each later tick is scheduled one interval after the previous run finishes.
+ * A run records its attempts before it finishes, so the next tick is never
+ * inside the durable per-account limit. A fixed setInterval ticked just inside
+ * it (by the initial delay plus the run's own duration), skipped every
+ * account, and stretched the cadence to two intervals.
+ */
+export function startAutomaticAccountChecks(run) {
+    const controller = new AbortController();
+    let pending;
+    let timer;
+    const schedule = (delayMs) => {
+        if (controller.signal.aborted)
+            return;
+        timer = setTimeout(tick, delayMs);
+        timer.unref();
+    };
+    const tick = () => {
+        timer = undefined;
+        if (controller.signal.aborted)
+            return;
+        pending = run(controller.signal).catch(() => {
+            if (!controller.signal.aborted)
+                logWarn("Automatic subscription checks unavailable; no unchecked retry was started.");
+        }).finally(() => {
+            pending = undefined;
+            schedule(AUTOMATIC_CHECK_INTERVAL_MS);
+        });
+    };
+    schedule(AUTOMATIC_CHECK_INITIAL_DELAY_MS);
+    return { async stop() { clearTimeout(timer); controller.abort(); await pending; } };
+}

package/dist/lib/runtime/automatic-subscription-checks.d.ts

@@ -0,0 +1,7 @@
+import { type AccountMetadataV3 } from "../storage.js";
+import { type CodexQuotaSnapshot } from "../quota-probe.js";
+type Observer = (account: AccountMetadataV3, snapshot: CodexQuotaSnapshot, accounts: AccountMetadataV3[], workspaceId: string) => Promise<void> | void;
+/** Captures this router's pool; reads only verified primary credentials, never API/ZDR entries. */
+export declare function createAutomaticSubscriptionCheck(observe?: Observer): (signal: AbortSignal) => Promise<void>;
+export {};
+//# sourceMappingURL=automatic-subscription-checks.d.ts.map

package/dist/lib/runtime/automatic-subscription-checks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"automatic-subscription-checks.d.ts","sourceRoot":"","sources":["../../../lib/runtime/automatic-subscription-checks.ts"],"names":[],"mappings":"AAGA,OAAO,EAAkB,KAAK,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAA2B,KAAK,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAOrF,KAAK,QAAQ,GAAG,CAAC,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,kBAAkB,EAAE,QAAQ,EAAE,iBAAiB,EAAE,EAAE,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AACvJ,mGAAmG;AACnG,wBAAgB,gCAAgC,CAAC,OAAO,CAAC,EAAE,QAAQ,IASvD,QAAQ,WAAW,mBAgC9B"}

package/dist/lib/runtime/automatic-subscription-checks.js

@@ -0,0 +1,54 @@
+import { getStoragePathState, runWithStoragePathState } from "../storage/path-state.js";
+import { AccountManager, resolveAccountRecordId } from "../accounts.js";
+import { getAccountPolicyKey, loadAccountPolicyStore } from "../account-policy.js";
+import { getStoragePath } from "../storage.js";
+import { fetchCodexQuotaSnapshot } from "../quota-probe.js";
+import { loadQuotaCache, saveQuotaCache } from "../quota-cache.js";
+import { updateQuotaCacheForWorkspace } from "../codex-manager/quota-cache-helpers.js";
+import { createNativeAccountStorageReader } from "./native-account-storage.js";
+import { ensureFreshAccessToken } from "./rotation-token-refresh.js";
+import { automaticCheckWorkspaceId, runAutomaticAccountChecks } from "./automatic-account-checks.js";
+import { logWarn } from "../logger.js";
+/** Captures this router's pool; reads only verified primary credentials, never API/ZDR entries. */
+export function createAutomaticSubscriptionCheck(observe) {
+    const path = getStoragePath(), storageState = getStoragePathState();
+    const read = createNativeAccountStorageReader(undefined, path);
+    const onQuota = observe ?? (async (account, snapshot, accounts, workspaceId) => {
+        const cache = await loadQuotaCache();
+        const baseline = structuredClone(cache);
+        updateQuotaCacheForWorkspace(cache, account, workspaceId, snapshot, accounts);
+        await saveQuotaCache(cache, baseline);
+    });
+    return (signal) => runWithStoragePathState(storageState, () => runAutomaticAccountChecks({
+        path: `${path}.automatic-checks.json`, signal, loadPolicies: loadAccountPolicyStore,
+        loadAccounts: async () => { const snapshot = await read(); return snapshot.verified ? snapshot.storage : null; },
+        check: async (storage, index) => {
+            const manager = new AccountManager(undefined, storage);
+            const account = manager.getAccountByIndex(index);
+            const stored = storage.accounts[index];
+            const targetId = stored && automaticCheckWorkspaceId(stored);
+            if (!account || !targetId || signal.aborted)
+                return;
+            const fresh = await ensureFreshAccessToken({ accountManager: manager, account, family: "codex", model: null, now: Date.now(), tokenRefreshSkewMs: 60000, tokenInvalidationCooldownMs: 300000 });
+            try {
+                if (!fresh.ok || signal.aborted)
+                    return;
+                // A refresh is an I/O boundary: revalidate removal, policy, auth and workspace changes.
+                const disk = await read();
+                const current = disk.verified ? disk.storage?.accounts.find(row => resolveAccountRecordId(row) === resolveAccountRecordId(fresh.account)) : undefined;
+                const policy = current ? (await loadAccountPolicyStore()).accounts[getAccountPolicyKey(current)] : undefined;
+                if (!disk.storage || !current || current.refreshToken !== fresh.account.refreshToken || current.accessToken !== fresh.accessToken || !policy?.autoPrime || policy.paused || policy.drained || current.enabled === false || current.authInvalidatedAt || (current.coolingDownUntil ?? 0) > Date.now())
+                    return;
+                if (automaticCheckWorkspaceId(current) !== targetId || signal.aborted)
+                    return;
+                const snapshot = await fetchCodexQuotaSnapshot({ accountId: targetId, accessToken: fresh.accessToken, primeUnusedSubscription: true, signal });
+                if (snapshot.primingFailure)
+                    logWarn("Automatic first-use completion was not confirmed; retry deferred until the next check.");
+                await onQuota(current, snapshot, disk.storage.accounts, targetId);
+            }
+            finally {
+                await manager.flushPendingSave();
+            }
+        },
+    }));
+}

package/dist/lib/runtime/catalog-capabilities.d.ts

@@ -0,0 +1,8 @@
+import type { CatalogModel } from "./account-model-catalog.js";
+/** Aggregate complete source records so advertised controls never invent a pair. */
+export declare function mergeCatalogModels(models: readonly CatalogModel[]): CatalogModel | undefined;
+/** Two-source convenience; multi-account callers must retain all original records. */
+export declare function mergeCatalogModel(a: CatalogModel, b: CatalogModel): CatalogModel;
+export declare function clampCatalogContext(a: CatalogModel, b: CatalogModel): CatalogModel;
+export declare function supportsCatalogSettings(model: CatalogModel, effort?: string, tier?: string): boolean;
+//# sourceMappingURL=catalog-capabilities.d.ts.map

package/dist/lib/runtime/catalog-capabilities.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog-capabilities.d.ts","sourceRoot":"","sources":["../../../lib/runtime/catalog-capabilities.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAG/D,oFAAoF;AACpF,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,GAAG,YAAY,GAAG,SAAS,CA4B5F;AACD,sFAAsF;AACtF,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,YAAY,GAAG,YAAY,CAEhF;AACD,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,YAAY,GAAG,YAAY,CAWlF;AACD,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAMpG"}

package/dist/lib/runtime/catalog-capabilities.js

@@ -0,0 +1,61 @@
+import { isRecord } from "../utils.js";
+const contextLimits = ["context_window", "max_context_window", "auto_compact_token_limit"];
+const canonicalTier = (value) => value === "priority" ? "fast" : value;
+/** Aggregate complete source records so advertised controls never invent a pair. */
+export function mergeCatalogModels(models) {
+    const first = models[0];
+    if (!first)
+        return undefined;
+    let result = { ...first };
+    for (const [field, key] of [["supported_reasoning_levels", "effort"], ["service_tiers", "id"]]) {
+        const options = new Map();
+        for (const model of models)
+            for (const option of Array.isArray(model[field]) ? model[field] : []) {
+                if (isRecord(option) && typeof option[key] === "string")
+                    options.set(field === "service_tiers" ? canonicalTier(option[key]) : option[key], option);
+            }
+        if (options.size)
+            result[field] = [...options.values()];
+    }
+    const efforts = Array.isArray(result.supported_reasoning_levels)
+        ? result.supported_reasoning_levels.flatMap(level => isRecord(level) && typeof level.effort === "string" ? [level.effort] : []) : [];
+    if (Array.isArray(result.service_tiers)) {
+        // Native clients expose independent effort/speed controls, not a pair matrix.
+        // Every selectable pair therefore needs a witness in an original catalog.
+        result.service_tiers = result.service_tiers.filter(tier => {
+            if (!isRecord(tier) || typeof tier.id !== "string")
+                return false;
+            const id = tier.id;
+            return (efforts.length ? efforts : [undefined]).every(effort => models.some(model => supportsCatalogSettings(model, effort, id)));
+        });
+    }
+    if (typeof result.default_service_tier === "string" && !["default", "auto"].includes(result.default_service_tier) &&
+        !supportsCatalogSettings(result, undefined, result.default_service_tier))
+        result.default_service_tier = "default";
+    for (const model of models.slice(1))
+        result = clampCatalogContext(result, model);
+    return result;
+}
+/** Two-source convenience; multi-account callers must retain all original records. */
+export function mergeCatalogModel(a, b) {
+    return mergeCatalogModels([a, b]) ?? a;
+}
+export function clampCatalogContext(a, b) {
+    const result = { ...a };
+    // Context is not a selectable setting sent on requests. Advertise the safe
+    // shared limit instead of letting the first account overstate another's limit.
+    for (const field of contextLimits) {
+        if (typeof a[field] === "number" && typeof b[field] === "number")
+            result[field] = Math.min(a[field], b[field]);
+        else
+            delete result[field];
+    }
+    return result;
+}
+export function supportsCatalogSettings(model, effort, tier) {
+    if (effort && (!Array.isArray(model.supported_reasoning_levels) || !model.supported_reasoning_levels.some(level => isRecord(level) && level.effort === effort)))
+        return false;
+    if (tier && tier !== "default" && tier !== "auto" && (!Array.isArray(model.service_tiers) || !model.service_tiers.some(level => isRecord(level) && typeof level.id === "string" && canonicalTier(level.id) === canonicalTier(tier))))
+        return false;
+    return true;
+}

package/dist/lib/runtime/inference-activity.d.ts

@@ -0,0 +1,15 @@
+import { getAccountIdentityKey } from "../storage/identity.js";
+export declare function inferenceAccountKey(account: Parameters<typeof getAccountIdentityKey>[0]): string;
+/** Separate from shared diagnostic snapshots: only inference dispatches write these files. */
+export declare function saveInferenceRequestTime(key: string, at: number): Promise<void>;
+/**
+ * Per-request dispatches only need the latest time per key on disk. Keep the
+ * newest pending time per key and write them together after a short debounce,
+ * instead of chaining one mkdir/read/write/rename per request.
+ */
+export declare function createInferenceActivityWriter(save?: (key: string, at: number) => Promise<void>, delayMs?: number, onError?: (error: unknown) => void): {
+    record(key: string, at: number): void;
+    flush(): Promise<void>;
+};
+export declare function loadInferenceRequestTimes(keys: string[]): Promise<Record<string, number>>;
+//# sourceMappingURL=inference-activity.d.ts.map

package/dist/lib/runtime/inference-activity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inference-activity.d.ts","sourceRoot":"","sources":["../../../lib/runtime/inference-activity.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAS/D,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAEhG;AAmBD,8FAA8F;AAC9F,wBAAsB,wBAAwB,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBrF;AACD;;;;GAIG;AACH,wBAAgB,6BAA6B,CAC5C,IAAI,GAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAA4B,EAC3E,OAAO,SAAO,EACd,OAAO,GAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAsB,GACjD;IAAE,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAwBnE;AACD,wBAAsB,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAG/F"}

package/dist/lib/runtime/inference-activity.js

@@ -0,0 +1,95 @@
+import { createHash } from "node:crypto";
+import { getAccountIdentityKey } from "../storage/identity.js";
+import { promises as fs } from "node:fs";
+import { join } from "node:path";
+import { getCodexMultiAuthDir } from "../runtime-paths.js";
+import { tempPathFor } from "../temp-path.js";
+import { withRetry } from "../fs-retry.js";
+import { withFileTransactionLock } from "../storage/file-lock.js";
+import { mapWithConcurrency } from "../concurrency.js";
+export function inferenceAccountKey(account) {
+    return `sha256:${createHash("sha256").update(getAccountIdentityKey(account) ?? "unknown").digest("hex")}`;
+}
+const validKey = (key) => /^sha256:[a-f0-9]{64}$/.test(key);
+function activityPath(key) {
+    return join(getCodexMultiAuthDir(), "inference-activity", `${key.slice(7)}.json`);
+}
+async function readTimestamp(key) {
+    try {
+        const handle = await fs.open(activityPath(key), "r");
+        try {
+            const bytes = Buffer.alloc(64);
+            const { bytesRead } = await handle.read(bytes, 0, bytes.length, 0);
+            if (bytesRead === bytes.length)
+                return null;
+            const value = JSON.parse(bytes.subarray(0, bytesRead).toString("utf8"));
+            return typeof value === "number" && Number.isFinite(value) && value > 0 ? value : null;
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    catch {
+        return null;
+    }
+}
+/** Separate from shared diagnostic snapshots: only inference dispatches write these files. */
+export async function saveInferenceRequestTime(key, at) {
+    if (!validKey(key) || !Number.isFinite(at) || at <= 0)
+        return;
+    const path = activityPath(key);
+    await fs.mkdir(join(getCodexMultiAuthDir(), "inference-activity"), { recursive: true, mode: 0o700 });
+    // Read-max-write under the cross-process lock, so a concurrent writer (app
+    // router and a wrapper proxy) cannot replace a newer time with an older one.
+    await withFileTransactionLock(path, async () => {
+        const temp = tempPathFor(path);
+        const timestamp = Math.max(at, await readTimestamp(key) ?? 0);
+        try {
+            await fs.writeFile(temp, JSON.stringify(timestamp) + "\n", { mode: 0o600, flag: "wx" });
+            await withRetry(() => fs.rename(temp, path), { maxAttempts: 6, backoffMs: 25 });
+        }
+        finally {
+            await withRetry(() => fs.unlink(temp), { maxAttempts: 6, backoffMs: 25 }).catch(error => { if (error.code !== "ENOENT")
+                throw error; });
+        }
+    });
+}
+/**
+ * Per-request dispatches only need the latest time per key on disk. Keep the
+ * newest pending time per key and write them together after a short debounce,
+ * instead of chaining one mkdir/read/write/rename per request.
+ */
+export function createInferenceActivityWriter(save = saveInferenceRequestTime, delayMs = 1000, onError = () => undefined) {
+    const pending = new Map();
+    let timer;
+    let flushing = Promise.resolve();
+    const flush = () => {
+        if (timer) {
+            clearTimeout(timer);
+            timer = undefined;
+        }
+        const batch = [...pending];
+        pending.clear();
+        flushing = flushing.then(async () => {
+            for (const [key, at] of batch)
+                await save(key, at).catch(onError);
+        });
+        return flushing;
+    };
+    return {
+        record(key, at) {
+            if (!validKey(key) || !Number.isFinite(at) || at <= 0)
+                return;
+            pending.set(key, Math.max(pending.get(key) ?? 0, at));
+            if (!timer) {
+                timer = setTimeout(() => void flush(), delayMs);
+                timer.unref?.();
+            }
+        },
+        flush,
+    };
+}
+export async function loadInferenceRequestTimes(keys) {
+    const entries = await mapWithConcurrency([...new Set(keys)].filter(validKey).slice(0, 1000), 4, async (key) => ({ key, at: await readTimestamp(key) }));
+    return Object.fromEntries(entries.flatMap(entry => entry.at === null ? [] : [[entry.key, entry.at]]));
+}

package/dist/lib/runtime/model-discovery-status.d.ts

@@ -0,0 +1,100 @@
+import { z } from "zod";
+import { type AccountStorageV3 } from "../storage.js";
+import { type ApiRouteCredential, updateApiModelDiscovery } from "../api-route-store.js";
+declare const schema: z.ZodObject<{
+    apiConfigurationUnavailable: z.ZodOptional<z.ZodBoolean>;
+    version: z.ZodLiteral<1>;
+    checkedAt: z.ZodNumber;
+    clientVersion: z.ZodOptional<z.ZodString>;
+    entries: z.ZodArray<z.ZodObject<{
+        id: z.ZodOptional<z.ZodString>;
+        routable: z.ZodOptional<z.ZodBoolean>;
+        bound: z.ZodOptional<z.ZodBoolean>;
+        selected: z.ZodOptional<z.ZodBoolean>;
+        changes: z.ZodOptional<z.ZodObject<{
+            observedAt: z.ZodNumber;
+            added: z.ZodArray<z.ZodString>;
+            removed: z.ZodArray<z.ZodString>;
+            capabilities: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>>;
+        lastSuccessful: z.ZodOptional<z.ZodObject<{
+            models: z.ZodArray<z.ZodString>;
+            entitlements: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                model: z.ZodString;
+                checkedAt: z.ZodOptional<z.ZodNumber>;
+                probes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<{
+                    unsupported: "unsupported";
+                    verified: "verified";
+                    unverified: "unverified";
+                    downgraded: "downgraded";
+                }>>>;
+                serviceTiers: z.ZodArray<z.ZodObject<{
+                    id: z.ZodString;
+                    name: z.ZodString;
+                }, z.core.$strip>>;
+                reasoningLevels: z.ZodArray<z.ZodString>;
+                accessPrograms: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>>;
+        }, z.core.$strip>>;
+        label: z.ZodString;
+        kind: z.ZodEnum<{
+            oauth: "oauth";
+            api: "api";
+            zdr: "zdr";
+        }>;
+        enabled: z.ZodBoolean;
+        checkedAt: z.ZodNumber;
+        error: z.ZodBoolean;
+        models: z.ZodArray<z.ZodString>;
+        visibleModels: z.ZodArray<z.ZodString>;
+        entitlements: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            model: z.ZodString;
+            checkedAt: z.ZodOptional<z.ZodNumber>;
+            probes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<{
+                unsupported: "unsupported";
+                verified: "verified";
+                unverified: "unverified";
+                downgraded: "downgraded";
+            }>>>;
+            serviceTiers: z.ZodArray<z.ZodObject<{
+                id: z.ZodString;
+                name: z.ZodString;
+            }, z.core.$strip>>;
+            reasoningLevels: z.ZodArray<z.ZodString>;
+            accessPrograms: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type ModelInventory = z.infer<typeof schema>;
+export declare function discoverModelInventory(storage: AccountStorageV3 | null, routes: ApiRouteCredential[], options?: {
+    fetchImpl?: typeof fetch;
+    now?: () => number;
+    clientVersion?: string;
+    updateApiDiscovery?: typeof updateApiModelDiscovery;
+    /** Send billable API probes even when a result is inside the 15-minute cache. */
+    forceProbes?: boolean;
+    /** Share probe results with later CLI processes through the multi-auth directory. */
+    persistProbes?: boolean;
+}): Promise<ModelInventory>;
+export declare function loadModelInventory(): Promise<ModelInventory | null>;
+export declare function saveModelInventory(value: ModelInventory): Promise<void>;
+export declare function formatModelInventory(inventory: ModelInventory | null, now?: number): string[];
+export declare function refreshAndPrintModelInventory(log: (message: string) => void, deps?: {
+    getBinding?: () => Promise<{
+        running: boolean;
+        state: {
+            nativeOpenai?: boolean;
+            baseUrl: string;
+            clientApiKey: string;
+        } | null;
+    }>;
+    fetchImpl?: typeof fetch;
+    loadInventory?: typeof loadModelInventory;
+    now?: () => number;
+    /** Only an explicit `check capabilities` bypasses the 15-minute probe cache. */
+    forceProbes?: boolean;
+}): Promise<boolean>;
+/** Compare stable credential/workspace scopes, keeping the last successful baseline through outages. */
+export declare function withInventoryChanges(current: ModelInventory, previous: ModelInventory | null): ModelInventory;
+export {};
+//# sourceMappingURL=model-discovery-status.d.ts.map

package/dist/lib/runtime/model-discovery-status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"model-discovery-status.d.ts","sourceRoot":"","sources":["../../../lib/runtime/model-discovery-status.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,KAAK,gBAAgB,EAAgB,MAAM,eAAe,CAAC;AACpE,OAAO,EACN,KAAK,kBAAkB,EAEvB,uBAAuB,EACvB,MAAM,uBAAuB,CAAC;AAgC/B,QAAA,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAUV,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,CAAC;AAkBpD,wBAAsB,sBAAsB,CAC3C,OAAO,EAAE,gBAAgB,GAAG,IAAI,EAChC,MAAM,EAAE,kBAAkB,EAAE,EAC5B,OAAO,GAAE;IACR,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kBAAkB,CAAC,EAAE,OAAO,uBAAuB,CAAC;IACpD,iFAAiF;IACjF,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,qFAAqF;IACrF,aAAa,CAAC,EAAE,OAAO,CAAC;CACnB,GACJ,OAAO,CAAC,cAAc,CAAC,CAuGzB;AAID,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAgBzE;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAOvE;AA2BD,wBAAgB,oBAAoB,CACnC,SAAS,EAAE,cAAc,GAAG,IAAI,EAChC,GAAG,SAAa,GACd,MAAM,EAAE,CAyBV;AACD,wBAAsB,6BAA6B,CAClD,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,EAC9B,IAAI,GAAE;IACL,UAAU,CAAC,EAAE,MAAM,OAAO,CAAC;QAC1B,OAAO,EAAE,OAAO,CAAC;QACjB,KAAK,EAAE;YACN,YAAY,CAAC,EAAE,OAAO,CAAC;YACvB,OAAO,EAAE,MAAM,CAAC;YAChB,YAAY,EAAE,MAAM,CAAC;SACrB,GAAG,IAAI,CAAC;KACT,CAAC,CAAC;IACH,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,aAAa,CAAC,EAAE,OAAO,kBAAkB,CAAC;IAC1C,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,gFAAgF;IAChF,WAAW,CAAC,EAAE,OAAO,CAAC;CACjB,GACJ,OAAO,CAAC,OAAO,CAAC,CAwElB;AAUD,wGAAwG;AACxG,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,cAAc,GAAG,IAAI,GAAG,cAAc,CAmB7G"}