codex-multi-auth 2.16.0 → 2.17.2

package/dist/lib/runtime/resume-picker.js

@@ -0,0 +1,169 @@
+import { spawn } from "node:child_process";
+import { createInterface } from "node:readline";
+import { select } from "../ui/select.js";
+/** Read the canonical index through Codex, rather than depending on SQLite schemas. */
+export function createResumeCatalog(options) {
+    const args = [...options.configArgs, "app-server", "--listen", "stdio://"];
+    const child = spawn(options.codexBin.launchWithNode ? process.execPath : options.codexBin.path, options.codexBin.launchWithNode ? [options.codexBin.path, ...args] : args, { cwd: options.cwd, env: options.env ?? process.env, stdio: ["pipe", "pipe", "pipe"] });
+    const lines = createInterface({ input: child.stdout });
+    // Drain diagnostics, but never print arbitrary child output (which may contain secrets).
+    child.stderr.resume();
+    let nextId = 0;
+    let closed = false;
+    let failure = null;
+    const pending = new Map();
+    function fail(error) {
+        failure = error;
+        for (const request of pending.values()) {
+            clearTimeout(request.timer);
+            request.reject(error);
+        }
+        pending.clear();
+    }
+    child.on("error", () => fail(new Error("Could not start Codex session discovery.")));
+    child.on("exit", () => fail(new Error("Codex session discovery stopped.")));
+    child.stdin.on("error", () => fail(new Error("Codex session discovery disconnected.")));
+    lines.on("line", (line) => {
+        let message;
+        try {
+            message = JSON.parse(line);
+        }
+        catch {
+            return;
+        }
+        if (!message || typeof message.id !== "number")
+            return;
+        const request = pending.get(message.id);
+        if (!request)
+            return;
+        pending.delete(message.id);
+        clearTimeout(request.timer);
+        if (message.error)
+            request.reject(new Error("Codex rejected the session discovery request."));
+        else
+            request.resolve(message.result);
+    });
+    function request(method, params) {
+        if (failure || closed)
+            return Promise.reject(failure ?? new Error("Session catalog is closed."));
+        return new Promise((resolve, reject) => {
+            const id = ++nextId;
+            const timer = setTimeout(() => {
+                pending.delete(id);
+                reject(new Error("Codex session discovery timed out."));
+            }, options.timeoutMs ?? 15_000);
+            pending.set(id, { resolve, reject, timer });
+            child.stdin.write(`${JSON.stringify({ id, method, params })}\n`);
+        });
+    }
+    let initialized = false;
+    return {
+        async page(cursor = null) {
+            if (!initialized) {
+                await request("initialize", {
+                    clientInfo: { name: "codex-multi-auth-resume", version: "1" },
+                    capabilities: { experimentalApi: true },
+                });
+                child.stdin.write(`${JSON.stringify({ method: "initialized" })}\n`);
+                initialized = true;
+            }
+            const result = await request("thread/list", {
+                limit: 50, cursor, sortKey: "updated_at", archived: false,
+                // An empty list explicitly disables the server's current-provider filter.
+                modelProviders: [],
+                // Omitted or empty means interactive-only, so name the resumable non-interactive kinds (as Codex does).
+                sourceKinds: options.includeNonInteractive ? ["cli", "vscode", "exec", "appServer"] : ["cli", "vscode"],
+                ...(options.showAll ? {} : { cwd: options.cwd }),
+            });
+            if (!result || typeof result !== "object" || !("data" in result) || !Array.isArray(result.data)) {
+                throw new Error("Codex returned an invalid session list.");
+            }
+            const data = result.data.filter((thread) => thread && typeof thread.id === "string" && typeof thread.cwd === "string");
+            const cursorValue = "nextCursor" in result ? result.nextCursor : null;
+            return { data, nextCursor: typeof cursorValue === "string" ? cursorValue : null };
+        },
+        close() {
+            if (closed)
+                return;
+            closed = true;
+            fail(new Error("Session catalog is closed."));
+            lines.close();
+            child.stdin.end();
+            child.kill("SIGTERM");
+            // Only terminate the discovery child we own, never an existing Codex server.
+            const timer = setTimeout(() => {
+                if (child.exitCode === null && child.signalCode === null)
+                    child.kill("SIGKILL");
+            }, 1_000);
+            timer.unref();
+            child.once("exit", () => clearTimeout(timer));
+        },
+    };
+}
+function displayText(value) {
+    // Session titles and directory names are untrusted terminal output.
+    return String(value).replace(/[\x00-\x1f\x7f-\x9f]/g, " ").slice(0, 180);
+}
+export async function pickResumeThread(options, deps = { createCatalog: createResumeCatalog, select: (select) }) {
+    const catalog = deps.createCatalog(options);
+    const pages = [];
+    let pageIndex = 0;
+    let interrupted = false;
+    const onInterrupt = () => {
+        interrupted = true;
+        catalog.close();
+    };
+    process.once("SIGINT", onInterrupt);
+    process.once("SIGTERM", onInterrupt);
+    try {
+        pages.push(await catalog.page());
+        for (;;) {
+            const page = pages[pageIndex];
+            if (!page)
+                throw new Error("Session page is unavailable.");
+            const items = page.data.map((thread) => ({
+                label: displayText(thread.name || thread.preview || thread.id),
+                hint: displayText(`${thread.cwd} · ${thread.modelProvider ?? "unknown provider"} · ${thread.id}`),
+                value: { kind: "thread", id: thread.id },
+            }));
+            if (pageIndex > 0)
+                items.push({ label: "Previous page", value: { kind: "previous" } });
+            if (page.nextCursor)
+                items.push({ label: "Next page", value: { kind: "next" } });
+            // select() returns a sole choice without rendering, so an empty list would exit silently.
+            if (items.length === 0) {
+                process.stdout.write("No saved Codex sessions found.\n");
+                return null;
+            }
+            // Also prevents the shared select UI from auto-opening a single session.
+            items.push({ label: "Cancel", value: { kind: "cancel" } });
+            const choice = await deps.select(items, {
+                message: "Resume a Codex session",
+                subtitle: page.data.length ? "All providers · resumes through multi-auth" : "No saved sessions found",
+                allowEscape: true,
+            });
+            if (!choice || choice.kind === "cancel")
+                return null;
+            if (choice.kind === "thread")
+                return choice.id;
+            if (choice.kind === "previous") {
+                pageIndex -= 1;
+                continue;
+            }
+            if (!pages[pageIndex + 1])
+                pages.push(await catalog.page(page.nextCursor));
+            pageIndex += 1;
+        }
+    }
+    catch (error) {
+        // Closing the catalog on Ctrl+C rejects the pending request; that is a cancel, not a failure.
+        if (interrupted)
+            return null;
+        throw error;
+    }
+    finally {
+        process.removeListener("SIGINT", onInterrupt);
+        process.removeListener("SIGTERM", onInterrupt);
+        catalog.close();
+    }
+}

package/dist/lib/runtime/rotation-account-selection.d.ts

@@ -1,3 +1,4 @@
+import { type SubscriptionQuotaPreference } from "./subscription-quota-order.js";
 import type { AccountManager, ManagedAccount } from "../accounts.js";
 import type { ModelFamily } from "../prompts/codex.js";
 import type { RuntimePolicyDecision } from "../policy/runtime-policy.js";
@@ -30,6 +31,11 @@ export declare function chooseAccount(params: {
     now: number;
     policy: RuntimePolicyDecision | null;
     pinnedIndex: number | null;
+    /** Soft preference, used only within the first eligible priority tier. */
+    preferredIndex?: number | null;
+    /** Soft pin: first eligible attempt across tiers, then normal fallback. Ignored whenever `pinnedIndex` is set, which is how the proxy applies a stored `switch` pin. */
+    fallbackPinnedIndex?: number | null;
+    subscriptionQuotaByAccount?: Record<number, SubscriptionQuotaPreference>;
     skipReasons?: Map<number, string>;
     stickyBoostByAccount?: Record<number, number>;
     pidOffsetEnabled?: boolean;

package/dist/lib/runtime/rotation-account-selection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rotation-account-selection.d.ts","sourceRoot":"","sources":["../../../lib/runtime/rotation-account-selection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACzE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAWnE;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE;IACrC,cAAc,EAAE,cAAc,CAAC;IAC/B,oBAAoB,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAClD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,EAAE,WAAW,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,qBAAqB,GAAG,IAAI,CAAC;IACrC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,WAAW,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,kBAAkB,CAAC,EAAE,QAAQ,GAAG,YAAY,CAAC;IAC7C;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC9B,GAAG,cAAc,GAAG,IAAI,CA0JxB"}
+{"version":3,"file":"rotation-account-selection.d.ts","sourceRoot":"","sources":["../../../lib/runtime/rotation-account-selection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqD,KAAK,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AACpI,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACzE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAWnE;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE;IACrC,cAAc,EAAE,cAAc,CAAC;IAC/B,oBAAoB,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAClD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,EAAE,WAAW,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,qBAAqB,GAAG,IAAI,CAAC;IACrC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,0EAA0E;IAC1E,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,wKAAwK;IACxK,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,0BAA0B,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,2BAA2B,CAAC,CAAC;IACzE,WAAW,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,kBAAkB,CAAC,EAAE,QAAQ,GAAG,YAAY,CAAC;IAC7C;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC9B,GAAG,cAAc,GAAG,IAAI,CAqNxB"}

package/dist/lib/runtime/rotation-account-selection.js

@@ -1,3 +1,4 @@
+import { compareSubscriptionQuota, usesSubscriptionReserve } from "./subscription-quota-order.js";
 /**
  * Whether a runtime skip reason is a cooldown, the one blocker a pinned
  * retry may waive. `getManagedAccountRuntimeSkipReason` emits either the
@@ -26,6 +27,68 @@ function isCooldownReason(reason) {
  */
 export function chooseAccount(params) {
     const { accountManager, sessionAffinityStore, sessionKey, family, model, attemptedIndexes, now, policy, pinnedIndex, skipReasons, stickyBoostByAccount, pidOffsetEnabled, schedulingStrategy, allowPinnedCooldown, } = params;
+    const fallbackPin = params.fallbackPinnedIndex;
+    const quotaByAccount = params.subscriptionQuotaByAccount;
+    const hasNonReserve = quotaByAccount && accountManager.getAccountsSnapshot().some(a => a.enabled !== false && !attemptedIndexes.has(a.index) && !policy?.blockedAccountIndexes.has(a.index) &&
+        !accountManager.getAccountRuntimeSkipReason(a.index, family, model) && !quotaByAccount[a.index]?.exhausted && !usesSubscriptionReserve(quotaByAccount[a.index]));
+    if (pinnedIndex === null && typeof fallbackPin === "number" && !attemptedIndexes.has(fallbackPin) &&
+        !quotaByAccount?.[fallbackPin]?.exhausted && !(hasNonReserve && usesSubscriptionReserve(quotaByAccount?.[fallbackPin]))) {
+        const selected = chooseAccount({ ...params, pinnedIndex: fallbackPin, allowPinnedCooldown: false });
+        if (selected)
+            return selected;
+    }
+    if (pinnedIndex === null && policy?.priorityByAccount) {
+        const priorities = policy.priorityByAccount;
+        let candidates = accountManager.getAccountsSnapshot().filter(account => {
+            if (account.enabled === false || attemptedIndexes.has(account.index) || policy.blockedAccountIndexes.has(account.index))
+                return false;
+            const reason = accountManager.getAccountRuntimeSkipReason(account.index, family, model);
+            if (reason)
+                skipReasons?.set(account.index, reason);
+            return !reason;
+        });
+        if (!candidates.length)
+            return null;
+        if (quotaByAccount) {
+            const usable = candidates.filter(a => !quotaByAccount[a.index]?.exhausted);
+            if (!usable.length)
+                return null;
+            const nonReserve = usable.filter(a => !usesSubscriptionReserve(quotaByAccount[a.index]));
+            candidates = nonReserve.length ? nonReserve : usable;
+        }
+        const tier = Math.min(...candidates.map(a => priorities[a.index] ?? 1));
+        const tierIndexes = new Set(candidates.filter(a => (priorities[a.index] ?? 1) === tier).map(a => a.index));
+        let preferred = params.preferredIndex;
+        if (quotaByAccount) {
+            // Rank only measured accounts: "no data" compares equal to everything, which
+            // is not transitive and would make the winner depend on storage order.
+            const ranked = candidates.flatMap(a => {
+                const quota = quotaByAccount[a.index];
+                return tierIndexes.has(a.index) && quota ? [{ account: a, quota }] : [];
+            }).sort((a, b) => compareSubscriptionQuota(a.quota, b.quota)).map(entry => entry.account);
+            const best = ranked[0];
+            const bestQuota = best && quotaByAccount[best.index];
+            if (best && bestQuota && (bestQuota.resetAtMs !== null || bestQuota.remainingPercent !== null)) {
+                const preferredQuota = typeof preferred === "number" ? quotaByAccount[preferred] : undefined;
+                if (!preferredQuota || !tierIndexes.has(preferred ?? -1) || compareSubscriptionQuota(bestQuota, preferredQuota) < 0)
+                    preferred = best.index;
+            }
+        }
+        // Re-evaluate tiers on every attempt. Never persist a temporary tier block.
+        return chooseAccount({
+            ...params,
+            policy: {
+                ...policy,
+                priorityByAccount: undefined,
+                blockedAccountIndexes: new Set([
+                    ...policy.blockedAccountIndexes,
+                    ...accountManager.getAccountsSnapshot().filter(a => !tierIndexes.has(a.index)).map(a => a.index),
+                ]),
+            },
+            fallbackPinnedIndex: null,
+            pinnedIndex: typeof preferred === "number" && tierIndexes.has(preferred) ? preferred : null,
+        });
+    }
     // Manual pin (from `codex-multi-auth switch <n>`) overrides every other
     // selection signal. We do NOT call markSwitched here — the proxy must not
     // clobber the pin set by the CLI. See issue #474.

package/dist/lib/runtime/rotation-proxy-state.d.ts

@@ -1,3 +1,12 @@
+import type { NativeAccountSnapshot } from "./native-account-storage.js";
+import type { QuotaCacheData, QuotaCacheEntry } from "../quota-cache.js";
+import type { RuntimeCapabilityFailures } from "./runtime-capability-failures.js";
+import type { RouteModel } from "../model-route-policy.js";
+import type { ModelInventory } from "./model-discovery-status.js";
+import type { ApiModelCapabilities } from "./api-model-capabilities.js";
+import type { ApiModelRuntime } from "./api-model-runtime.js";
+import type { ApiRouteCredential } from "../api-route-store.js";
+import type { AccountModelCatalog } from "./account-model-catalog.js";
 import { AccountManager } from "../accounts.js";
 import type { ContextBudgetGuard } from "../context-budget-guard.js";
 import type { PreemptiveQuotaScheduler } from "../preemptive-quota-scheduler.js";
@@ -11,6 +20,14 @@ import type { SessionAffinityStore } from "../session-affinity.js";
  * @internal
  */
 export interface RotationProxyStateInit {
+    nativeOpenai?: boolean;
+    readNativeAccountStorage?: () => Promise<NativeAccountSnapshot>;
+    readApiRoutes?: () => Promise<ApiRouteCredential[]>;
+    readSubscriptionQuota?: () => Promise<QuotaCacheData | null>;
+    catalogAccount?: {
+        email: string;
+        accountId: string;
+    };
     activeAccountManager: AccountManager;
     routingMutexMode: "enabled" | "legacy";
     schedulingStrategy: "hybrid" | "sequential";
@@ -58,6 +75,22 @@ export interface RotationProxyStateInit {
 export interface RotationProxyState extends RotationProxyStateInit {
     readonly knownAccountManagers: Set<AccountManager>;
     readonly status: RuntimeRotationProxyStatus;
+    modelCatalog?: AccountModelCatalog;
+    modelCatalogs?: Map<string, AccountModelCatalog>;
+    catalogBackoff?: Map<string, number>;
+    /** Short-lived per-request file reads (quota cache, reset credits), keyed by source. */
+    readCache?: Map<string, {
+        at: number;
+        value: Promise<unknown>;
+    }>;
+    capabilityFailures?: RuntimeCapabilityFailures;
+    apiModelRuntime?: ApiModelRuntime;
+    apiModelCapabilities?: ApiModelCapabilities;
+    catalogEtag?: string;
+    catalogOAuthModels?: RouteModel[];
+    catalogApiRoutes?: ApiRouteCredential[];
+    catalogInventory?: ModelInventory;
+    subscriptionQuotaObservations?: Map<string, QuotaCacheEntry>;
     readonly threadGoalFallbacks: Map<string, string | null>;
     lastGlobalAccountIndex: number | null;
     lastGlobalSwitchAt: number;

package/dist/lib/runtime/rotation-proxy-state.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rotation-proxy-state.d.ts","sourceRoot":"","sources":["../../../lib/runtime/rotation-proxy-state.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAKjF,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AAC7E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAEnE;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACtC,oBAAoB,EAAE,cAAc,CAAC;IACrC,gBAAgB,EAAE,SAAS,GAAG,QAAQ,CAAC;IACvC,kBAAkB,EAAE,QAAQ,GAAG,YAAY,CAAC;IAC5C,SAAS,EAAE,OAAO,KAAK,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,EAAE,MAAM,MAAM,CAAC;IAClB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,qBAAqB,EAAE,MAAM,CAAC;IAC9B;;;;OAIG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAC7B,2BAA2B,EAAE,MAAM,CAAC;IACpC,qBAAqB,EAAE,MAAM,CAAC;IAC9B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,yBAAyB,EAAE,MAAM,CAAC;IAClC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,8BAA8B,EAAE,MAAM,CAAC;IACvC,wBAAwB,EAAE,wBAAwB,CAAC;IACnD,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,oBAAoB,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAClD,8BAA8B,EAAE,MAAM,CAAC;IACvC;;;;;OAKG;IACH,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAmB,SAAQ,sBAAsB;IACjE,QAAQ,CAAC,oBAAoB,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;IACnD,QAAQ,CAAC,MAAM,EAAE,0BAA0B,CAAC;IAC5C,QAAQ,CAAC,mBAAmB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;IACzD,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,yBAAyB,EAAE,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IACjE,wBAAwB,EAAE,MAAM,CAAC;CACjC;AAID,gBAAgB;AAChB,wBAAgB,wBAAwB,CACvC,IAAI,EAAE,sBAAsB,GAC1B,kBAAkB,CAuBpB;AAED,gBAAgB;AAChB,wBAAsB,wBAAwB,CAC7C,KAAK,EAAE,kBAAkB,GACvB,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAkDhC"}
+{"version":3,"file":"rotation-proxy-state.d.ts","sourceRoot":"","sources":["../../../lib/runtime/rotation-proxy-state.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACzE,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,KAAK,EAAC,yBAAyB,EAAC,MAAM,kCAAkC,CAAC;AAChF,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,0BAA0B,CAAC;AACzD,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAKjF,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AAC7E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAEnE;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACtC,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,wBAAwB,CAAC,EAAE,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAChE,aAAa,CAAC,EAAE,MAAM,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACpD,qBAAqB,CAAC,EAAE,MAAM,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IAC7D,cAAc,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;KAAE,CAAC;IACvD,oBAAoB,EAAE,cAAc,CAAC;IACrC,gBAAgB,EAAE,SAAS,GAAG,QAAQ,CAAC;IACvC,kBAAkB,EAAE,QAAQ,GAAG,YAAY,CAAC;IAC5C,SAAS,EAAE,OAAO,KAAK,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,EAAE,MAAM,MAAM,CAAC;IAClB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,qBAAqB,EAAE,MAAM,CAAC;IAC9B;;;;OAIG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAC7B,2BAA2B,EAAE,MAAM,CAAC;IACpC,qBAAqB,EAAE,MAAM,CAAC;IAC9B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,yBAAyB,EAAE,MAAM,CAAC;IAClC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,8BAA8B,EAAE,MAAM,CAAC;IACvC,wBAAwB,EAAE,wBAAwB,CAAC;IACnD,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,oBAAoB,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAClD,8BAA8B,EAAE,MAAM,CAAC;IACvC;;;;;OAKG;IACH,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAmB,SAAQ,sBAAsB;IACjE,QAAQ,CAAC,oBAAoB,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;IACnD,QAAQ,CAAC,MAAM,EAAE,0BAA0B,CAAC;IAC5C,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAC9C,cAAc,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,wFAAwF;IACxF,SAAS,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IACpE,kBAAkB,CAAC,EAAE,yBAAyB,CAAC;IAC/C,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,oBAAoB,CAAC,EAAC,oBAAoB,CAAC;IAC3C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kBAAkB,CAAC,EAAC,UAAU,EAAE,CAAC;IACjC,gBAAgB,CAAC,EAAC,kBAAkB,EAAE,CAAC;IACvC,gBAAgB,CAAC,EAAC,cAAc,CAAC;IACjC,6BAA6B,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC7D,QAAQ,CAAC,mBAAmB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;IACzD,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,yBAAyB,EAAE,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IACjE,wBAAwB,EAAE,MAAM,CAAC;CACjC;AAID,gBAAgB;AAChB,wBAAgB,wBAAwB,CACvC,IAAI,EAAE,sBAAsB,GAC1B,kBAAkB,CAuBpB;AAED,gBAAgB;AAChB,wBAAsB,wBAAwB,CAC7C,KAAK,EAAE,kBAAkB,GACvB,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAkDhC"}

package/dist/lib/runtime/rotation-server-types.d.ts

@@ -1,3 +1,6 @@
+import type { QuotaCacheData } from "../quota-cache.js";
+import type { ApiRouteCredential } from "../api-route-store.js";
+import type { AccountStorageV3 } from "../storage.js";
 import type { AccountManager } from "../accounts.js";
 import type { ModelFamily } from "../prompts/codex.js";
 export interface RuntimeRotationProxyServer {
@@ -15,6 +18,10 @@ export interface RuntimeRotationProxyServer {
     getOpenConnectionCount?: () => number;
 }
 export interface RuntimeRotationProxyStatus {
+    streamQuotaUpdates?: number;
+    lastStreamQuotaUpdateAt?: number;
+    websocketConnections?: number;
+    websocketUpstreamRequests?: number;
     startedAt: number;
     totalRequests: number;
     upstreamRequests: number;
@@ -25,9 +32,20 @@ export interface RuntimeRotationProxyStatus {
     lastAccountIndex: number | null;
     lastAccountLabel: string | null;
     lastAccountId: string | null;
+    /** Outgoing ChatGPT-Account-ID; distinct from the saved account binding. */
+    lastRequestedWorkspaceId?: string | null;
     lastAccountUpdatedAt: number | null;
 }
 export interface RuntimeRotationProxyOptions {
+    nativeOpenai?: boolean;
+    /** Override the native credential reader for embedded hosts and tests. */
+    readNativeAccountStorage?: () => Promise<AccountStorageV3 | null>;
+    readApiRoutes?: () => Promise<ApiRouteCredential[]>;
+    readSubscriptionQuota?: () => Promise<QuotaCacheData | null>;
+    catalogAccount?: {
+        email: string;
+        accountId: string;
+    };
     host?: string;
     port?: number;
     upstreamBaseUrl?: string;

package/dist/lib/runtime/rotation-server-types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rotation-server-types.d.ts","sourceRoot":"","sources":["../../../lib/runtime/rotation-server-types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD,MAAM,WAAW,0BAA0B;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,SAAS,EAAE,MAAM,0BAA0B,CAAC;IAC5C;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,MAAM,MAAM,CAAC;CACtC;AAED,MAAM,WAAW,0BAA0B;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,2BAA2B;IAC3C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,8BAA8B,CAAC,EAAE,MAAM,CAAC;IACxC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,cAAc;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,KAAK,GAAG,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,WAAW,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;;;;;;;;OASG;IACH,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED,MAAM,MAAM,gBAAgB,GACzB,YAAY,GACZ,cAAc,GACd,eAAe,GACf,cAAc,GACd,QAAQ,GACR,aAAa,GACb,YAAY,CAAC;AAChB,MAAM,MAAM,qBAAqB,GAAG,KAAK,GAAG;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,MAAM,WAAW,8BAA8B;IAC9C,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;CAClB"}
+{"version":3,"file":"rotation-server-types.d.ts","sourceRoot":"","sources":["../../../lib/runtime/rotation-server-types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD,MAAM,WAAW,0BAA0B;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,SAAS,EAAE,MAAM,0BAA0B,CAAC;IAC5C;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,MAAM,MAAM,CAAC;CACtC;AAED,MAAM,WAAW,0BAA0B;IAC1C,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,4EAA4E;IAC5E,wBAAwB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,2BAA2B;IAC3C,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,0EAA0E;IAC1E,wBAAwB,CAAC,EAAE,MAAM,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAClE,aAAa,CAAC,EAAE,MAAM,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACpD,qBAAqB,CAAC,EAAE,MAAM,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IAC7D,cAAc,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;KAAE,CAAC;IACvD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,8BAA8B,CAAC,EAAE,MAAM,CAAC;IACxC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,cAAc;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,KAAK,GAAG,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,WAAW,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;;;;;;;;OASG;IACH,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED,MAAM,MAAM,gBAAgB,GACzB,YAAY,GACZ,cAAc,GACd,eAAe,GACf,cAAc,GACd,QAAQ,GACR,aAAa,GACb,YAAY,CAAC;AAChB,MAAM,MAAM,qBAAqB,GAAG,KAAK,GAAG;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,MAAM,WAAW,8BAA8B;IAC9C,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;CAClB"}

package/dist/lib/runtime/runtime-capability-failures.d.ts

@@ -0,0 +1,14 @@
+export type CapabilityFailure = "model" | "effort" | "tier";
+/** Narrow structured rejections only: malformed input, authentication and capacity are not entitlements. */
+export declare function classifyCapabilityFailure(status: number, body: unknown): CapabilityFailure | null;
+/** Bounded short-lived negative evidence; never persisted with credentials or user content. */
+export declare class RuntimeCapabilityFailures {
+    private readonly now;
+    private readonly ttlMs;
+    private readonly denied;
+    constructor(now?: () => number, ttlMs?: number);
+    private key;
+    record(credential: string, model: string, kind: CapabilityFailure, effort?: string, tier?: string): void;
+    supports(credential: string, model: string, effort?: string, tier?: string): boolean;
+}
+//# sourceMappingURL=runtime-capability-failures.d.ts.map

package/dist/lib/runtime/runtime-capability-failures.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-capability-failures.d.ts","sourceRoot":"","sources":["../../../lib/runtime/runtime-capability-failures.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,iBAAiB,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,CAAC;AAC5D,4GAA4G;AAC5G,wBAAgB,yBAAyB,CACxC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,OAAO,GACX,iBAAiB,GAAG,IAAI,CA2B1B;AACD,+FAA+F;AAC/F,qBAAa,yBAAyB;IAGpC,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,KAAK;IAHvB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6B;gBAElC,GAAG,GAAE,MAAM,MAAiB,EAC5B,KAAK,SAAU;IAEjC,OAAO,CAAC,GAAG;IAQX,MAAM,CACL,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,iBAAiB,EACvB,MAAM,CAAC,EAAE,MAAM,EACf,IAAI,CAAC,EAAE,MAAM;IAkBd,QAAQ,CACP,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,MAAM,EACf,IAAI,CAAC,EAAE,MAAM,GACX,OAAO;CAkBV"}

package/dist/lib/runtime/runtime-capability-failures.js

@@ -0,0 +1,76 @@
+import { canonicalServiceTier } from "../model-route-policy.js";
+import { isRecord } from "../utils.js";
+/** Narrow structured rejections only: malformed input, authentication and capacity are not entitlements. */
+export function classifyCapabilityFailure(status, body) {
+    if (![400, 403, 404].includes(status) ||
+        !isRecord(body) ||
+        !isRecord(body.error))
+        return null;
+    const { code, param } = body.error;
+    if ([
+        "model_not_found",
+        "model_not_supported",
+        "unsupported_model",
+        "model_access_denied",
+    ].includes(String(code)))
+        return "model";
+    if (status !== 400 ||
+        !["invalid_value", "unsupported_value", "unsupported_parameter"].includes(String(code)))
+        return null;
+    if (param === "reasoning.effort")
+        return "effort";
+    if (param === "service_tier")
+        return "tier";
+    return null;
+}
+/** Bounded short-lived negative evidence; never persisted with credentials or user content. */
+export class RuntimeCapabilityFailures {
+    now;
+    ttlMs;
+    denied = new Map();
+    constructor(now = Date.now, ttlMs = 300_000) {
+        this.now = now;
+        this.ttlMs = ttlMs;
+    }
+    key(credential, model, kind, value = "") {
+        return JSON.stringify([credential, model, kind, value]);
+    }
+    record(credential, model, kind, effort, tier) {
+        if ((kind === "effort" && !effort) || (kind === "tier" && !tier))
+            return;
+        const value = kind === "model"
+            ? ""
+            : JSON.stringify([
+                effort ?? null,
+                canonicalServiceTier(tier ?? "default"),
+            ]);
+        const key = this.key(credential, model, kind, value);
+        this.denied.delete(key);
+        this.denied.set(key, this.now() + this.ttlMs);
+        while (this.denied.size > 4096) {
+            const first = this.denied.keys().next().value;
+            if (first)
+                this.denied.delete(first);
+        }
+    }
+    supports(credential, model, effort, tier) {
+        const combination = JSON.stringify([
+            effort ?? null,
+            canonicalServiceTier(tier ?? "default"),
+        ]);
+        const keys = [
+            this.key(credential, model, "model"),
+            this.key(credential, model, "effort", combination),
+            this.key(credential, model, "tier", combination),
+        ];
+        return keys.every((key) => {
+            const expiry = this.denied.get(key);
+            if (expiry === undefined)
+                return true;
+            if (expiry > this.now())
+                return false;
+            this.denied.delete(key);
+            return true;
+        });
+    }
+}

package/dist/lib/runtime/runtime-observability.d.ts

@@ -41,7 +41,11 @@ export interface RuntimeObservabilitySnapshot {
     lastAccountLabel?: string | null;
     lastAccountEmail?: string | null;
     lastAccountId?: string | null;
+    /** Outgoing request scope, not proof of the upstream billing plan. */
+    lastRequestedWorkspaceId?: string | null;
     lastAccountUpdatedAt?: number | null;
+    /** Actual inference dispatches, keyed by hashed credential identity (not selection or health checks). */
+    lastInferenceRequestAtByAccount?: Record<string, number>;
     lastPoolExhaustionReason?: string | null;
     lastPoolExhaustionRetryAfterMs?: number | null;
     lastPoolExhaustionSkipReasons?: Record<string, string>;
@@ -54,6 +58,9 @@ export interface RuntimeObservabilitySnapshot {
     policyBlockedReasons?: Record<string, string>;
     runtimeMetrics: RuntimeMetricsSnapshot;
 }
+/** Write pending inference times now (proxy shutdown). */
+export declare function flushRuntimeInferenceActivity(): Promise<void>;
+export declare function recordRuntimeInferenceRequest(accountKey: string, at: number): void;
 export declare function getRuntimeObservabilitySnapshot(): RuntimeObservabilitySnapshot;
 export declare function mutateRuntimeObservabilitySnapshot(mutator: (snapshot: RuntimeObservabilitySnapshot) => void): void;
 export declare function recordRuntimePoolExhaustion(params: {

package/dist/lib/runtime/runtime-observability.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-observability.d.ts","sourceRoot":"","sources":["../../../lib/runtime/runtime-observability.ts"],"names":[],"mappings":"AAIA,UAAU,sBAAsB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,uBAAuB,EAAE,MAAM,CAAC;IAChC,4BAA4B,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,+BAA+B,EAAE,MAAM,CAAC;IACxC,+BAA+B,EAAE,MAAM,CAAC;IACxC,uBAAuB,EAAE,MAAM,CAAC;IAChC,oBAAoB,EAAE,MAAM,CAAC;IAC7B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,gBAAgB,EAAE,MAAM,CAAC;IACzB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,kCAAkC,EAAE,MAAM,CAAC;IAC3C,gCAAgC,EAAE,MAAM,CAAC;IACzC,wBAAwB,EAAE,MAAM,CAAC;IACjC,oCAAoC,EAAE,MAAM,CAAC;IAC7C,mBAAmB,EAAE,MAAM,CAAC;IAC5B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,4BAA4B;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,uBAAuB,EAAE,MAAM,CAAC;IAChC,2BAA2B,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3C,wBAAwB,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,oBAAoB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,wBAAwB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,8BAA8B,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/C,6BAA6B,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvD,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,uBAAuB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,cAAc,EAAE,sBAAsB,CAAC;CACvC;AA6LD,wBAAgB,+BAA+B,IAAI,4BAA4B,CAE9E;AAED,wBAAgB,kCAAkC,CACjD,OAAO,EAAE,CAAC,QAAQ,EAAE,4BAA4B,KAAK,IAAI,GACvD,IAAI,CAYN;AAED,wBAAgB,2BAA2B,CAAC,MAAM,EAAE;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC3C,GAAG,IAAI,CAOP;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAKxD;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAWvD;AAED;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAoBhE;AAED,wBAAsB,yCAAyC,IAAI,OAAO,CAAC,4BAA4B,GAAG,IAAI,CAAC,CAY9G"}
+{"version":3,"file":"runtime-observability.d.ts","sourceRoot":"","sources":["../../../lib/runtime/runtime-observability.ts"],"names":[],"mappings":"AAMA,UAAU,sBAAsB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,uBAAuB,EAAE,MAAM,CAAC;IAChC,4BAA4B,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,+BAA+B,EAAE,MAAM,CAAC;IACxC,+BAA+B,EAAE,MAAM,CAAC;IACxC,uBAAuB,EAAE,MAAM,CAAC;IAChC,oBAAoB,EAAE,MAAM,CAAC;IAC7B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,gBAAgB,EAAE,MAAM,CAAC;IACzB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,kCAAkC,EAAE,MAAM,CAAC;IAC3C,gCAAgC,EAAE,MAAM,CAAC;IACzC,wBAAwB,EAAE,MAAM,CAAC;IACjC,oCAAoC,EAAE,MAAM,CAAC;IAC7C,mBAAmB,EAAE,MAAM,CAAC;IAC5B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,4BAA4B;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,uBAAuB,EAAE,MAAM,CAAC;IAChC,2BAA2B,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3C,wBAAwB,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,sEAAsE;IACtE,wBAAwB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,oBAAoB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,yGAAyG;IACzG,+BAA+B,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzD,wBAAwB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,8BAA8B,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/C,6BAA6B,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvD,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,uBAAuB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,cAAc,EAAE,sBAAsB,CAAC;CACvC;AAcD,0DAA0D;AAC1D,wBAAgB,6BAA6B,IAAI,OAAO,CAAC,IAAI,CAAC,CAE7D;AAyED,wBAAgB,6BAA6B,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,IAAI,CAQlF;AAyHD,wBAAgB,+BAA+B,IAAI,4BAA4B,CAE9E;AAED,wBAAgB,kCAAkC,CACjD,OAAO,EAAE,CAAC,QAAQ,EAAE,4BAA4B,KAAK,IAAI,GACvD,IAAI,CAoBN;AAED,wBAAgB,2BAA2B,CAAC,MAAM,EAAE;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC3C,GAAG,IAAI,CAOP;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAKxD;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAWvD;AAED;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAoBhE;AAED,wBAAsB,yCAAyC,IAAI,OAAO,CAAC,4BAA4B,GAAG,IAAI,CAAC,CAY9G"}

package/dist/lib/runtime/runtime-observability.js

@@ -1,3 +1,5 @@
+import { createInferenceActivityWriter } from "./inference-activity.js";
+import { createLogger } from "../logger.js";
 import { existsSync, readFileSync, promises as fs } from "node:fs";
 import { join } from "node:path";
 import { getCodexMultiAuthDir } from "../runtime-paths.js";
@@ -7,6 +9,13 @@ const RUNTIME_OBSERVABILITY_SNAPSHOT_VERSION = 1;
 const RETRYABLE_SNAPSHOT_ERRORS = new Set(["EBUSY", "EPERM"]);
 let snapshotState = null;
 let pendingWrite = null;
+/** Latest snapshot waiting behind the in-flight write; newer mutations replace it. */
+let queuedSnapshot = null;
+const inferenceActivity = createInferenceActivityWriter(undefined, 1000, () => createLogger("runtime-observability").warn("Inference activity could not be saved"));
+/** Write pending inference times now (proxy shutdown). */
+export function flushRuntimeInferenceActivity() {
+    return inferenceActivity.flush();
+}
 function getSnapshotPath() {
     return join(getCodexMultiAuthDir(), SNAPSHOT_FILE_NAME);
 }
@@ -24,7 +33,9 @@ function createDefaultSnapshot() {
         lastAccountLabel: null,
         lastAccountEmail: null,
         lastAccountId: null,
+        lastRequestedWorkspaceId: null,
         lastAccountUpdatedAt: null,
+        lastInferenceRequestAtByAccount: {},
         lastPoolExhaustionReason: null,
         lastPoolExhaustionRetryAfterMs: null,
         lastPoolExhaustionSkipReasons: {},
@@ -67,6 +78,24 @@ function createDefaultSnapshot() {
         },
     };
 }
+function normalizeInferenceTimes(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return {};
+    return Object.fromEntries(Object.entries(value)
+        .filter((entry) => /^sha256:[a-f0-9]{64}$/.test(entry[0]) && typeof entry[1] === "number" && Number.isFinite(entry[1]) && entry[1] > 0)
+        .sort((a, b) => b[1] - a[1]).slice(0, 1000));
+}
+export function recordRuntimeInferenceRequest(accountKey, at) {
+    if (!/^sha256:[a-f0-9]{64}$/.test(accountKey) || !Number.isFinite(at) || at <= 0)
+        return;
+    mutateRuntimeObservabilitySnapshot(snapshot => {
+        const times = normalizeInferenceTimes(snapshot.lastInferenceRequestAtByAccount);
+        times[accountKey] = Math.max(times[accountKey] ?? 0, at);
+        snapshot.lastInferenceRequestAtByAccount = normalizeInferenceTimes(times);
+    });
+    if (PERSIST_RUNTIME_SNAPSHOT)
+        inferenceActivity.record(accountKey, at);
+}
 function normalizePersistedSnapshot(parsed) {
     if (!parsed || typeof parsed !== "object") {
         return null;
@@ -80,6 +109,8 @@ function normalizePersistedSnapshot(parsed) {
         ...base,
         ...parsed,
         version: RUNTIME_OBSERVABILITY_SNAPSHOT_VERSION,
+        lastInferenceRequestAtByAccount: normalizeInferenceTimes(parsed.lastInferenceRequestAtByAccount),
+        lastRequestedWorkspaceId: typeof parsed.lastRequestedWorkspaceId === "string" && parsed.lastRequestedWorkspaceId.length <= 256 ? parsed.lastRequestedWorkspaceId : null,
         runtimeMetrics: {
             ...base.runtimeMetrics,
             ...(parsed.runtimeMetrics ?? {}),
@@ -189,10 +220,19 @@ export function mutateRuntimeObservabilitySnapshot(mutator) {
     if (!PERSIST_RUNTIME_SNAPSHOT) {
         return;
     }
-    const nextSnapshot = structuredClone(snapshot);
+    // At most one write in flight and one queued: a burst of per-request
+    // mutations collapses into the latest snapshot instead of an unbounded chain.
+    const alreadyQueued = queuedSnapshot !== null;
+    queuedSnapshot = structuredClone(snapshot);
+    if (alreadyQueued)
+        return;
     pendingWrite = (pendingWrite ?? Promise.resolve())
         .catch(() => undefined)
-        .then(() => writeSnapshot(nextSnapshot))
+        .then(() => {
+        const next = queuedSnapshot;
+        queuedSnapshot = null;
+        return next ? writeSnapshot(next) : undefined;
+    })
         .catch(() => undefined);
 }
 export function recordRuntimePoolExhaustion(params) {

package/dist/lib/runtime/subscription-first-use.d.ts

@@ -0,0 +1,10 @@
+import type { CodexQuotaSnapshot } from "../quota-probe.js";
+/** Only personal included subscriptions may receive an automatic first-use probe. */
+export declare function needsSubscriptionFirstUse(snapshot: Omit<CodexQuotaSnapshot, "model">, now: number): boolean;
+export declare class FirstUseProbeError extends Error {
+    readonly reason: "timed out" | "stream ended early" | "upstream failed" | "response too large" | "network error";
+    constructor(reason?: "timed out" | "stream ended early" | "upstream failed" | "response too large" | "network error");
+}
+/** Consume the already-open tiny response, never start a second request. */
+export declare function finishSubscriptionFirstUse(response: Response, timeoutMs: number): Promise<void>;
+//# sourceMappingURL=subscription-first-use.d.ts.map

package/dist/lib/runtime/subscription-first-use.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"subscription-first-use.d.ts","sourceRoot":"","sources":["../../../lib/runtime/subscription-first-use.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAE5D,qFAAqF;AACrF,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,IAAI,CAAC,kBAAkB,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAW3G;AAED,qBAAa,kBAAmB,SAAQ,KAAK;IAChC,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,oBAAoB,GAAG,iBAAiB,GAAG,oBAAoB,GAAG,eAAe;gBAAvG,MAAM,GAAE,WAAW,GAAG,oBAAoB,GAAG,iBAAiB,GAAG,oBAAoB,GAAG,eAAsC;CAGnJ;AAED,4EAA4E;AAC5E,wBAAsB,0BAA0B,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAyBrG"}