codex-multi-auth 2.17.0 → 2.17.2

package/dist/lib/prompts/codex.js

@@ -381,83 +381,83 @@ export function prewarmCodexInstructions(models = []) {
 /**
  * Tool remapping instructions for host runtime tools
  */
-export const TOOL_REMAP_MESSAGE = `<user_instructions priority="0">
-<environment_override priority="0">
-YOU ARE IN A DIFFERENT ENVIRONMENT. These instructions override ALL previous tool references.
-</environment_override>
-
-<tool_replacements priority="0">
-<critical_rule priority="0">
-apply_patch/applyPatch are Codex names, but host tool names vary by version.
-- Inspect the actual tool list before editing.
-- If edit exists: use edit for precise in-place string replacements and hashline edits.
-- If edit is absent and apply_patch exists: use apply_patch for those precise/hashline edits in this plugin.
-- For diff-style or multi-line structural edits: use patch if available, otherwise use apply_patch.
-- In this plugin, edit/apply_patch support hashline refs (lineRef, endLineRef, operation, content)
-</critical_rule>
-
-<critical_rule priority="0">
-UPDATE_PLAN DOES NOT EXIST -> USE "todowrite" INSTEAD
-- NEVER use: update_plan, updatePlan
-- ALWAYS use: todowrite for ALL task/plan operations
-- Use todoread to read current plan
-- Before plan operations: Verify you're using "todowrite", NOT "update_plan"
-</critical_rule>
-</tool_replacements>
-
-<available_tools priority="0">
-File Operations:
-  - write  - Create new files (if available)
-  - edit   - Modify existing files with string replacement (version-dependent)
-  - oldString must be literal text from the current file; never pass unresolved placeholders like \${TARGET_SNIPPET}
-  - apply_patch - May be the edit/patch tool name in newer host builds (version-dependent)
-  - hashline_read - Read lines with hashline refs (L<line>#<hash>) for deterministic edits
-  - patch  - Apply diff patches (version-dependent)
-  - read   - Read file contents
-
-Search/Discovery:
-  - grep   - Search file contents
-  - glob   - Find files by pattern
-  - list   - List directories (if available)
-
-Execution:
-  - bash   - Run shell commands
-
-Network:
-  - webfetch - Fetch web content
-
-Task Management:
-  - todowrite - Manage tasks/plans (REPLACES update_plan)
-  - todoread  - Read current plan
-</available_tools>
-
-<substitution_rules priority="0">
-Base instruction says:    You MUST use instead:
-apply_patch           ->   patch (preferred if available), otherwise edit/apply_patch based on actual tool list
-update_plan           ->   todowrite
-read_plan             ->   todoread
-absolute paths        ->   relative paths
-</substitution_rules>
-
-<verification_checklist priority="0">
-Before file/plan modifications:
-1. Am I using the actual available edit tool name (edit, patch, or apply_patch)?
-2. Am I using "todowrite" NOT "update_plan"?
-3. Is this tool in the approved list above?
-4. Am I using relative paths?
-
-If ANY answer is NO -> STOP and correct before proceeding.
-</verification_checklist>
-
-<hashline_workflow priority="0">
-When hashline_read is available:
-1. call hashline_read on the file
-2. edit/apply_patch using lineRef/endLineRef + operation + content
-3. use oldString/newString only as fallback, and only with literal file text (no template placeholders)
-</hashline_workflow>
-
-<safety_rules priority="0">
-- Never run destructive git commands (\`git reset --hard\`, \`git checkout --\`) unless explicitly requested by the user.
-- Never call \`request_user_input\` unless collaboration mode is explicitly Plan mode.
-</safety_rules>
+export const TOOL_REMAP_MESSAGE = `<user_instructions priority="0">
+<environment_override priority="0">
+YOU ARE IN A DIFFERENT ENVIRONMENT. These instructions override ALL previous tool references.
+</environment_override>
+
+<tool_replacements priority="0">
+<critical_rule priority="0">
+apply_patch/applyPatch are Codex names, but host tool names vary by version.
+- Inspect the actual tool list before editing.
+- If edit exists: use edit for precise in-place string replacements and hashline edits.
+- If edit is absent and apply_patch exists: use apply_patch for those precise/hashline edits in this plugin.
+- For diff-style or multi-line structural edits: use patch if available, otherwise use apply_patch.
+- In this plugin, edit/apply_patch support hashline refs (lineRef, endLineRef, operation, content)
+</critical_rule>
+
+<critical_rule priority="0">
+UPDATE_PLAN DOES NOT EXIST -> USE "todowrite" INSTEAD
+- NEVER use: update_plan, updatePlan
+- ALWAYS use: todowrite for ALL task/plan operations
+- Use todoread to read current plan
+- Before plan operations: Verify you're using "todowrite", NOT "update_plan"
+</critical_rule>
+</tool_replacements>
+
+<available_tools priority="0">
+File Operations:
+  - write  - Create new files (if available)
+  - edit   - Modify existing files with string replacement (version-dependent)
+  - oldString must be literal text from the current file; never pass unresolved placeholders like \${TARGET_SNIPPET}
+  - apply_patch - May be the edit/patch tool name in newer host builds (version-dependent)
+  - hashline_read - Read lines with hashline refs (L<line>#<hash>) for deterministic edits
+  - patch  - Apply diff patches (version-dependent)
+  - read   - Read file contents
+
+Search/Discovery:
+  - grep   - Search file contents
+  - glob   - Find files by pattern
+  - list   - List directories (if available)
+
+Execution:
+  - bash   - Run shell commands
+
+Network:
+  - webfetch - Fetch web content
+
+Task Management:
+  - todowrite - Manage tasks/plans (REPLACES update_plan)
+  - todoread  - Read current plan
+</available_tools>
+
+<substitution_rules priority="0">
+Base instruction says:    You MUST use instead:
+apply_patch           ->   patch (preferred if available), otherwise edit/apply_patch based on actual tool list
+update_plan           ->   todowrite
+read_plan             ->   todoread
+absolute paths        ->   relative paths
+</substitution_rules>
+
+<verification_checklist priority="0">
+Before file/plan modifications:
+1. Am I using the actual available edit tool name (edit, patch, or apply_patch)?
+2. Am I using "todowrite" NOT "update_plan"?
+3. Is this tool in the approved list above?
+4. Am I using relative paths?
+
+If ANY answer is NO -> STOP and correct before proceeding.
+</verification_checklist>
+
+<hashline_workflow priority="0">
+When hashline_read is available:
+1. call hashline_read on the file
+2. edit/apply_patch using lineRef/endLineRef + operation + content
+3. use oldString/newString only as fallback, and only with literal file text (no template placeholders)
+</hashline_workflow>
+
+<safety_rules priority="0">
+- Never run destructive git commands (\`git reset --hard\`, \`git checkout --\`) unless explicitly requested by the user.
+- Never call \`request_user_input\` unless collaboration mode is explicitly Plan mode.
+</safety_rules>
 </user_instructions>`;

package/dist/lib/quota-cache.d.ts

@@ -14,6 +14,8 @@ export interface QuotaCacheEntry {
 export interface QuotaCacheData {
     byAccountId: Record<string, QuotaCacheEntry>;
     byEmail: Record<string, QuotaCacheEntry>;
+    /** Quota scoped to a saved credential record and exact workspace. */
+    byWorkspace?: Record<string, QuotaCacheEntry>;
 }
 /**
  * Get the absolute filesystem path to the quota-cache.json file.
@@ -52,8 +54,9 @@ export declare function loadQuotaCache(): Promise<QuotaCacheData>;
  * quota cache path. Failures are logged and do not throw, so callers should handle
  * eventual consistency or retry as needed.
  *
- * Concurrency: concurrent writers may race and overwrite each other; callers should
- * serialize writes if strong consistency is required.
+ * Concurrency: reload, apply changes since `baseline`, and atomically write under
+ * a cross-process lock. Pass the pre-edit snapshot for read–modify–write callers.
+ * Without a baseline, supplied entries are upserts; omitted entries are retained.
  *
  * Filesystem notes: Windows path length, permissions, or antivirus locks may cause
  * write failures; such errors are logged rather than thrown.
@@ -63,6 +66,7 @@ export declare function loadQuotaCache(): Promise<QuotaCacheData>;
  *
  * @param data - The quota cache data (byAccountId and byEmail maps) to persist; callers
  *               should pass normalized QuotaCacheData.
+ * @param baseline - The unmodified pre-edit snapshot; only changes since it are applied.
  */
-export declare function saveQuotaCache(data: QuotaCacheData): Promise<void>;
+export declare function saveQuotaCache(data: QuotaCacheData, baseline?: QuotaCacheData): Promise<void>;
 //# sourceMappingURL=quota-cache.d.ts.map

package/dist/lib/quota-cache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"quota-cache.d.ts","sourceRoot":"","sources":["../../lib/quota-cache.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,gBAAgB;IAChC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,gBAAgB,CAAC;IAC1B,SAAS,EAAE,gBAAgB,CAAC;CAC5B;AAED,MAAM,WAAW,cAAc;IAC9B,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC7C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;CACzC;AAsGD;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,cAAc,IAAI,OAAO,CAAC,cAAc,CAAC,CA4B9D;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CA4DxE"}
+{"version":3,"file":"quota-cache.d.ts","sourceRoot":"","sources":["../../lib/quota-cache.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,gBAAgB;IAChC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,gBAAgB,CAAC;IAC1B,SAAS,EAAE,gBAAgB,CAAC;CAC5B;AAED,MAAM,WAAW,cAAc;IAC9B,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC7C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACzC,qEAAqE;IACrE,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;CAC9C;AAwGD;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,cAAc,IAAI,OAAO,CAAC,cAAc,CAAC,CAO9D;AA2CD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,cAAc,EAAE,QAAQ,GAAE,cAAiD,GAAG,OAAO,CAAC,IAAI,CAAC,CA6DrI"}

package/dist/lib/quota-cache.js

@@ -1,9 +1,10 @@
-import { existsSync, promises as fs } from "node:fs";
+import { promises as fs } from "node:fs";
 import { basename, join } from "node:path";
 import { withRetry } from "./fs-retry.js";
 import { logWarn } from "./logger.js";
 import { getCodexMultiAuthDir } from "./runtime-paths.js";
 import { tempPathFor } from "./temp-path.js";
+import { withFileTransactionLock } from "./storage/file-lock.js";
 import { isRecord } from "./utils.js";
 const QUOTA_CACHE_PATH = join(getCodexMultiAuthDir(), "quota-cache.json");
 const QUOTA_CACHE_LABEL = basename(QUOTA_CACHE_PATH);
@@ -127,29 +128,57 @@ export function getQuotaCachePath() {
  *          will be empty if the on-disk file is absent, malformed, or could not be read.
  */
 export async function loadQuotaCache() {
-    if (!existsSync(QUOTA_CACHE_PATH)) {
-        return { byAccountId: {}, byEmail: {} };
-    }
     try {
-        const content = await readCacheFileWithRetry(QUOTA_CACHE_PATH);
-        const parsed = JSON.parse(content);
-        if (!isRecord(parsed)) {
-            return { byAccountId: {}, byEmail: {} };
-        }
-        if (parsed.version !== 1) {
-            logWarn(`Quota cache rejected due to version mismatch: ${String(parsed.version)}`);
-            return { byAccountId: {}, byEmail: {} };
-        }
-        return {
-            byAccountId: normalizeEntryMap(parsed.byAccountId),
-            byEmail: normalizeEntryMap(parsed.byEmail),
-        };
+        return await readQuotaCache();
     }
     catch (error) {
         logWarn(`Failed to load quota cache from ${QUOTA_CACHE_LABEL}: ${error instanceof Error ? error.message : String(error)}`);
         return { byAccountId: {}, byEmail: {} };
     }
 }
+/** Only a missing file is empty for writers; read failures must never erase concurrent data. */
+async function readQuotaCache() {
+    let content;
+    try {
+        content = await readCacheFileWithRetry(QUOTA_CACHE_PATH);
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return { byAccountId: {}, byEmail: {} };
+        throw error;
+    }
+    const parsed = JSON.parse(content);
+    if (!isRecord(parsed) || parsed.version !== 1) {
+        throw Error("Quota cache rejected due to version mismatch or invalid payload");
+    }
+    return {
+        byAccountId: normalizeEntryMap(parsed.byAccountId),
+        byEmail: normalizeEntryMap(parsed.byEmail),
+        ...(parsed.byWorkspace ? { byWorkspace: normalizeEntryMap(parsed.byWorkspace) } : {}),
+    };
+}
+/** Reapply this run's changed entries, preserving unrelated or newer concurrent observations. */
+function mergeQuotaChanges(current, proposed, baseline) {
+    const same = (a, b) => JSON.stringify(a) === JSON.stringify(b);
+    for (const namespace of ["byAccountId", "byEmail", "byWorkspace"]) {
+        const before = baseline[namespace] ?? {}, next = proposed[namespace] ?? {};
+        for (const key of new Set([...Object.keys(before), ...Object.keys(next)])) {
+            if (same(before[key], next[key]))
+                continue;
+            const latest = current[namespace]?.[key], update = next[key];
+            if (update) {
+                if (!latest || update.updatedAt >= latest.updatedAt) {
+                    current[namespace] ??= {};
+                    current[namespace][key] = update;
+                }
+            }
+            else if (same(latest, before[key])) {
+                delete current[namespace]?.[key];
+            }
+        }
+    }
+    return current;
+}
 /**
  * Persist the quota cache to the on-disk JSON file used by the multi-auth runtime.
  *
@@ -157,8 +186,9 @@ export async function loadQuotaCache() {
  * quota cache path. Failures are logged and do not throw, so callers should handle
  * eventual consistency or retry as needed.
  *
- * Concurrency: concurrent writers may race and overwrite each other; callers should
- * serialize writes if strong consistency is required.
+ * Concurrency: reload, apply changes since `baseline`, and atomically write under
+ * a cross-process lock. Pass the pre-edit snapshot for read–modify–write callers.
+ * Without a baseline, supplied entries are upserts; omitted entries are retained.
  *
  * Filesystem notes: Windows path length, permissions, or antivirus locks may cause
  * write failures; such errors are logged rather than thrown.
@@ -168,54 +198,56 @@ export async function loadQuotaCache() {
  *
  * @param data - The quota cache data (byAccountId and byEmail maps) to persist; callers
  *               should pass normalized QuotaCacheData.
+ * @param baseline - The unmodified pre-edit snapshot; only changes since it are applied.
  */
-export async function saveQuotaCache(data) {
-    const payload = {
-        version: 1,
-        byAccountId: data.byAccountId,
-        byEmail: data.byEmail,
-    };
+export async function saveQuotaCache(data, baseline = { byAccountId: {}, byEmail: {} }) {
+    // Snapshot at invocation, not after waiting behind other writers.
+    const proposed = structuredClone(data), before = structuredClone(baseline);
     const writeTask = async () => {
         try {
-            const cacheDir = getCodexMultiAuthDir();
-            // The quota cache lives alongside other at-rest secrets, so keep the
-            // directory owner-only on POSIX (mode is a no-op on win32 / ACL-based).
-            await fs.mkdir(cacheDir, { recursive: true, mode: 0o700 });
-            // mkdir's mode only applies to a freshly-created dir; an upgrade with a
-            // pre-existing multi-auth dir keeps its old (possibly world-listable)
-            // perms, so re-assert 0o700 on POSIX. Best-effort: a chmod failure must
-            // not break the cache write (the 0o600 file below still protects data).
-            if (process.platform !== "win32") {
-                try {
-                    await fs.chmod(cacheDir, 0o700);
-                }
-                catch {
-                    // Best-effort hardening only.
-                }
-            }
-            const tempPath = tempPathFor(QUOTA_CACHE_PATH);
-            await fs.writeFile(tempPath, `${JSON.stringify(payload, null, 2)}\n`, {
-                encoding: "utf8",
-                mode: 0o600,
-            });
-            let renamed = false;
-            try {
-                await withRetry(() => fs.rename(tempPath, QUOTA_CACHE_PATH), {
-                    maxAttempts: 5,
-                    backoffMs: (attempt) => 10 * 2 ** (attempt - 1),
-                });
-                renamed = true;
-            }
-            finally {
-                if (!renamed) {
+            await withFileTransactionLock(QUOTA_CACHE_PATH, async () => {
+                const merged = mergeQuotaChanges(await readQuotaCache(), proposed, before);
+                const payload = { version: 1, ...merged };
+                const cacheDir = getCodexMultiAuthDir();
+                // The quota cache lives alongside other at-rest secrets, so keep the
+                // directory owner-only on POSIX (mode is a no-op on win32 / ACL-based).
+                await fs.mkdir(cacheDir, { recursive: true, mode: 0o700 });
+                // mkdir's mode only applies to a freshly-created dir; an upgrade with a
+                // pre-existing multi-auth dir keeps its old (possibly world-listable)
+                // perms, so re-assert 0o700 on POSIX. Best-effort: a chmod failure must
+                // not break the cache write (the 0o600 file below still protects data).
+                if (process.platform !== "win32") {
                     try {
-                        await fs.unlink(tempPath);
+                        await fs.chmod(cacheDir, 0o700);
                     }
                     catch {
-                        // Best effort temp cleanup.
+                        // Best-effort hardening only.
                     }
                 }
-            }
+                const tempPath = tempPathFor(QUOTA_CACHE_PATH);
+                await fs.writeFile(tempPath, `${JSON.stringify(payload, null, 2)}\n`, {
+                    encoding: "utf8",
+                    mode: 0o600,
+                });
+                let renamed = false;
+                try {
+                    await withRetry(() => fs.rename(tempPath, QUOTA_CACHE_PATH), {
+                        maxAttempts: 5,
+                        backoffMs: (attempt) => 10 * 2 ** (attempt - 1),
+                    });
+                    renamed = true;
+                }
+                finally {
+                    if (!renamed) {
+                        try {
+                            await fs.unlink(tempPath);
+                        }
+                        catch {
+                            // Best effort temp cleanup.
+                        }
+                    }
+                }
+            });
         }
         catch (error) {
             logWarn(`Failed to save quota cache to ${QUOTA_CACHE_LABEL}: ${error instanceof Error ? error.message : String(error)}`);

package/dist/lib/quota-readiness.d.ts

@@ -1,6 +1,6 @@
 import type { QuotaCacheData, QuotaCacheEntry } from "./quota-cache.js";
 import type { AccountMetadataV3 } from "./storage.js";
-export type QuotaCacheAccountRef = Pick<AccountMetadataV3, "accountId" | "email">;
+export type QuotaCacheAccountRef = Pick<AccountMetadataV3, "accountId" | "email" | "recordId" | "workspaces" | "currentWorkspaceIndex"> & Partial<Pick<AccountMetadataV3, "refreshToken" | "addedAt">>;
 export declare function normalizeQuotaAccountId(value: string | undefined): string | null;
 export declare function normalizeQuotaEmail(value: string | undefined): string | null;
 export declare function hasUniqueQuotaAccountId(accounts: readonly QuotaCacheAccountRef[], account: QuotaCacheAccountRef): boolean;
@@ -15,5 +15,10 @@ export declare function quotaUsedPercentIsExhausted(usedPercent: number | undefi
 export declare function isQuotaCacheEntryExhausted(entry: Pick<QuotaCacheEntry, "primary" | "secondary"> & {
     updatedAt?: number;
 } | null | undefined, now?: number): boolean;
-export declare function findQuotaCacheEntryForAccount(cache: QuotaCacheData | null | undefined, account: QuotaCacheAccountRef, accounts: readonly QuotaCacheAccountRef[], emailFallbackState?: ReadonlyMap<string, QuotaEmailFallbackState>): QuotaCacheEntry | null;
+/** Cache identity includes the credential record, so shared organization IDs cannot collide. */
+export declare function quotaWorkspaceKey(account: QuotaCacheAccountRef, workspaceId: string): string | undefined;
+/** Display the selected workspace; callers routing another scope must pass that exact workspace. */
+export declare function quotaWorkspaceId(account: QuotaCacheAccountRef): string | undefined;
+/** Read exact-workspace quota, using legacy binding entries only for that binding. */
+export declare function findQuotaCacheEntryForAccount(cache: QuotaCacheData | null | undefined, account: QuotaCacheAccountRef, accounts: readonly QuotaCacheAccountRef[], emailFallbackState?: ReadonlyMap<string, QuotaEmailFallbackState>, workspaceId?: string | undefined): QuotaCacheEntry | null;
 //# sourceMappingURL=quota-readiness.d.ts.map

package/dist/lib/quota-readiness.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"quota-readiness.d.ts","sourceRoot":"","sources":["../../lib/quota-readiness.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAoB,MAAM,kBAAkB,CAAC;AAC1F,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEtD,MAAM,MAAM,oBAAoB,GAAG,IAAI,CAAC,iBAAiB,EAAE,WAAW,GAAG,OAAO,CAAC,CAAC;AAIlF,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAGhF;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAG5E;AAED,wBAAgB,uBAAuB,CACtC,QAAQ,EAAE,SAAS,oBAAoB,EAAE,EACzC,OAAO,EAAE,oBAAoB,GAC3B,OAAO,CAQT;AAED,MAAM,MAAM,uBAAuB,GAAG;IACrC,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CAChC,CAAC;AAEF,wBAAgB,4BAA4B,CAC3C,QAAQ,EAAE,SAAS,oBAAoB,EAAE,GACvC,WAAW,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAiB9C;AAED,wBAAgB,yBAAyB,CACxC,kBAAkB,EAAE,WAAW,CAAC,MAAM,EAAE,uBAAuB,CAAC,EAChE,OAAO,EAAE,oBAAoB,GAC3B,OAAO,CAMT;AAED,wBAAgB,wBAAwB,CACvC,WAAW,EAAE,MAAM,GAAG,SAAS,GAC7B,MAAM,GAAG,SAAS,CAKpB;AAQD,wBAAgB,2BAA2B,CAC1C,WAAW,EAAE,MAAM,GAAG,SAAS,GAC7B,OAAO,CAMT;AA2BD,wBAAgB,0BAA0B,CACzC,KAAK,EAAE,IAAI,CAAC,eAAe,EAAE,SAAS,GAAG,WAAW,CAAC,GAAG;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,EACjG,GAAG,SAAa,GACd,OAAO,CAQT;AAED,wBAAgB,6BAA6B,CAC5C,KAAK,EAAE,cAAc,GAAG,IAAI,GAAG,SAAS,EACxC,OAAO,EAAE,oBAAoB,EAC7B,QAAQ,EAAE,SAAS,oBAAoB,EAAE,EACzC,kBAAkB,+CAAyC,GACzD,eAAe,GAAG,IAAI,CAWxB"}
+{"version":3,"file":"quota-readiness.d.ts","sourceRoot":"","sources":["../../lib/quota-readiness.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAoB,MAAM,kBAAkB,CAAC;AAC1F,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEtD,MAAM,MAAM,oBAAoB,GAAG,IAAI,CAAC,iBAAiB,EAAE,WAAW,GAAG,OAAO,GAAG,UAAU,GAAG,YAAY,GAAG,uBAAuB,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,iBAAiB,EAAE,cAAc,GAAG,SAAS,CAAC,CAAC,CAAC;AAIvM,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAGhF;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAG5E;AAED,wBAAgB,uBAAuB,CACtC,QAAQ,EAAE,SAAS,oBAAoB,EAAE,EACzC,OAAO,EAAE,oBAAoB,GAC3B,OAAO,CAQT;AAED,MAAM,MAAM,uBAAuB,GAAG;IACrC,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CAChC,CAAC;AAEF,wBAAgB,4BAA4B,CAC3C,QAAQ,EAAE,SAAS,oBAAoB,EAAE,GACvC,WAAW,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAiB9C;AAED,wBAAgB,yBAAyB,CACxC,kBAAkB,EAAE,WAAW,CAAC,MAAM,EAAE,uBAAuB,CAAC,EAChE,OAAO,EAAE,oBAAoB,GAC3B,OAAO,CAMT;AAED,wBAAgB,wBAAwB,CACvC,WAAW,EAAE,MAAM,GAAG,SAAS,GAC7B,MAAM,GAAG,SAAS,CAKpB;AAQD,wBAAgB,2BAA2B,CAC1C,WAAW,EAAE,MAAM,GAAG,SAAS,GAC7B,OAAO,CAMT;AA2BD,wBAAgB,0BAA0B,CACzC,KAAK,EAAE,IAAI,CAAC,eAAe,EAAE,SAAS,GAAG,WAAW,CAAC,GAAG;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,EACjG,GAAG,SAAa,GACd,OAAO,CAQT;AAED,gGAAgG;AAChG,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAIxG;AAED,oGAAoG;AACpG,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,oBAAoB,GAAG,MAAM,GAAG,SAAS,CAIlF;AAED,sFAAsF;AACtF,wBAAgB,6BAA6B,CAC5C,KAAK,EAAE,cAAc,GAAG,IAAI,GAAG,SAAS,EACxC,OAAO,EAAE,oBAAoB,EAC7B,QAAQ,EAAE,SAAS,oBAAoB,EAAE,EACzC,kBAAkB,+CAAyC,EAC3D,WAAW,qBAA4B,GACrC,eAAe,GAAG,IAAI,CAgBxB"}

package/dist/lib/quota-readiness.js

@@ -1,3 +1,5 @@
+import { createHash } from "node:crypto";
+import { resolveAccountRecordId } from "./storage/record-identity.js";
 export function normalizeQuotaAccountId(value) {
     const trimmed = value?.trim();
     return trimmed && trimmed.length > 0 ? trimmed : null;
@@ -89,16 +91,35 @@ export function isQuotaCacheEntryExhausted(entry, now = Date.now()) {
     return (quotaWindowIsExhausted(entry?.primary, now, updatedAt) ||
         quotaWindowIsExhausted(entry?.secondary, now, updatedAt));
 }
-export function findQuotaCacheEntryForAccount(cache, account, accounts, emailFallbackState = buildQuotaEmailFallbackState(accounts)) {
+/** Cache identity includes the credential record, so shared organization IDs cannot collide. */
+export function quotaWorkspaceKey(account, workspaceId) {
+    const recordId = account.recordId?.trim() || (account.refreshToken !== undefined && account.addedAt !== undefined
+        ? resolveAccountRecordId({ ...account, refreshToken: account.refreshToken, addedAt: account.addedAt }) : undefined);
+    return recordId ? createHash("sha256").update(JSON.stringify(["oauth", recordId, workspaceId.trim()])).digest("hex") : undefined;
+}
+/** Display the selected workspace; callers routing another scope must pass that exact workspace. */
+export function quotaWorkspaceId(account) {
+    return account.workspaces?.length
+        ? account.workspaces[account.currentWorkspaceIndex ?? 0]?.id.trim()
+        : account.accountId?.trim();
+}
+/** Read exact-workspace quota, using legacy binding entries only for that binding. */
+export function findQuotaCacheEntryForAccount(cache, account, accounts, emailFallbackState = buildQuotaEmailFallbackState(accounts), workspaceId = quotaWorkspaceId(account)) {
     if (!cache)
         return null;
+    const key = workspaceId && quotaWorkspaceKey(account, workspaceId);
+    const scoped = key ? cache.byWorkspace?.[key] : undefined;
+    // Legacy entries describe only the stored binding, never a sibling workspace.
+    if (normalizeQuotaAccountId(workspaceId) !== normalizeQuotaAccountId(account.accountId))
+        return scoped ?? null;
     const accountId = normalizeQuotaAccountId(account.accountId);
+    const newer = (legacy) => scoped && (!legacy || scoped.updatedAt >= legacy.updatedAt) ? scoped : legacy ?? null;
     if (accountId && hasUniqueQuotaAccountId(accounts, account) && cache.byAccountId[accountId]) {
-        return cache.byAccountId[accountId] ?? null;
+        return newer(cache.byAccountId[accountId]);
     }
     const email = normalizeQuotaEmail(account.email);
     if (email && hasSafeQuotaEmailFallback(emailFallbackState, account) && cache.byEmail[email]) {
-        return cache.byEmail[email] ?? null;
+        return newer(cache.byEmail[email]);
     }
-    return null;
+    return scoped ?? null;
 }

package/dist/lib/runtime/app-bind.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app-bind.d.ts","sourceRoot":"","sources":["../../../lib/runtime/app-bind.ts"],"names":[],"mappings":"AA2CA,MAAM,WAAW,YAAY;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAUD,MAAM,WAAW,YAAY;IAC5B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,cAAc,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;KAAE,CAAC;IACvD,OAAO,EAAE,CAAC,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,iFAAiF;IACjF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,mBAAmB;IACnC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,+EAA+E;IAC/E,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,mEAAmE;IACnE,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,2DAA2D;IAC3D,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,aAAa;IAC7B,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;OAKG;IACH,aAAa,EAAE,OAAO,CAAC;IACvB,KAAK,EAAE,YAAY,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACnC,KAAK,EAAE,YAAY,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC7B,MAAM,EAAE,aAAa,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,uBAAuB,GAAG,CACrC,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ,EACzB,aAAa,CAAC,EAAE,MAAM,KAClB,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC,MAAM,WAAW,cAAc;IAC9B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,cAAc,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;KAAE,CAAC;IACvD,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAC;IAClC,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,sEAAsE;IACtE,qBAAqB,CAAC,EAAE,uBAAuB,CAAC;CAChD;AAED,MAAM,WAAW,0BAA0B;IAC1C,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IACnC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC;IACrD,kBAAkB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAC9D,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,iEAAiE;IACjE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,qBAAqB,CAAC,EAAE,uBAAuB,CAAC;IAChD,qFAAqF;IACrF,mBAAmB,CAAC,EAAE,MAAM,IAAI,CAAC;CACjC;AAED,MAAM,WAAW,8BAA8B;IAC9C,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,oEAAoE;IACpE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,2DAA2D;IAC3D,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAoCD,wBAAgB,2BAA2B,CAC1C,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,YAAY,SAAK,EACjB,YAAY,UAAQ,GAClB,MAAM,CAOR;AAED,wBAAgB,4BAA4B,CAAC,aAAa,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,MAAM,CAKlG;AAwPD,wBAAgB,mBAAmB,CAAC,OAAO,GAAE,cAAmB,GAAG,YAAY,CAwB9E;AAgJD;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,QAAQ,GAAE,MAAM,CAAC,QAA2B,EAAE,SAAS,SAA0E,GAAG,OAAO,CAAC,SAAS,GAAG,WAAW,GAAG,SAAS,CAAC,CAY5P;AAqCD,wBAAsB,gCAAgC,CACrD,MAAM,EAAE,IAAI,CACX,mBAAmB,EACjB,OAAO,GACP,KAAK,GACL,WAAW,GACX,WAAW,GACX,YAAY,GACZ,kBAAkB,GAClB,eAAe,CACjB,GAAG,IAAI,EACR,QAAQ,EAAE,MAAM,CAAC,QAAQ,EACzB,gBAAgB,EAAE,MAAM,EACxB,OAAO,GAAE,0BAA+B,GACtC,OAAO,CAAC,OAAO,CAAC,CAoElB;AAyLD,yEAAyE;AACzE,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAwCvE;AAmKD,wBAAsB,mBAAmB,CACxC,GAAG,EAAE,MAAM,GAAG,IAAI,EAClB,QAAQ,EAAE,MAAM,CAAC,QAAQ,EACzB,OAAO,GAAE,0BAA+B,GACtC,OAAO,CAAC,OAAO,CAAC,CA6DlB;AAmED;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,IAAI,CAAC;AA8C3C,wBAAsB,mCAAmC,CACxD,MAAM,EAAE,8BAA8B,EACtC,OAAO,GAAE,0BAA0B,GAAG;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAA;CAAO,GACvE,OAAO,CAAC,OAAO,CAAC,CAwClB;AAUD,wBAAsB,gBAAgB,CAAC,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,aAAa,CAAC,CAqB3F;AAED,wBAAsB,2BAA2B,CAChD,OAAO,GAAE,cAAmB,GAC1B,OAAO,CAAC,aAAa,CAAC,CAKxB;AA2JD,wBAAsB,6BAA6B,CAClD,OAAO,GAAE,cAAmB,GAC1B,OAAO,CAAC,aAAa,CAAC,CAKxB;AAsQD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,CAuCjE"}
+{"version":3,"file":"app-bind.d.ts","sourceRoot":"","sources":["../../../lib/runtime/app-bind.ts"],"names":[],"mappings":"AA2CA,MAAM,WAAW,YAAY;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAUD,MAAM,WAAW,YAAY;IAC5B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,cAAc,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;KAAE,CAAC;IACvD,OAAO,EAAE,CAAC,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,iFAAiF;IACjF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,mBAAmB;IACnC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,+EAA+E;IAC/E,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,mEAAmE;IACnE,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,2DAA2D;IAC3D,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,aAAa;IAC7B,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;OAKG;IACH,aAAa,EAAE,OAAO,CAAC;IACvB,KAAK,EAAE,YAAY,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACnC,KAAK,EAAE,YAAY,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC7B,MAAM,EAAE,aAAa,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,uBAAuB,GAAG,CACrC,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ,EACzB,aAAa,CAAC,EAAE,MAAM,KAClB,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC,MAAM,WAAW,cAAc;IAC9B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,cAAc,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;KAAE,CAAC;IACvD,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAC;IAClC,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,sEAAsE;IACtE,qBAAqB,CAAC,EAAE,uBAAuB,CAAC;CAChD;AAED,MAAM,WAAW,0BAA0B;IAC1C,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IACnC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC;IACrD,kBAAkB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAC9D,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,iEAAiE;IACjE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,qBAAqB,CAAC,EAAE,uBAAuB,CAAC;IAChD,qFAAqF;IACrF,mBAAmB,CAAC,EAAE,MAAM,IAAI,CAAC;CACjC;AAED,MAAM,WAAW,8BAA8B;IAC9C,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,oEAAoE;IACpE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,2DAA2D;IAC3D,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAoCD,wBAAgB,2BAA2B,CAC1C,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,YAAY,SAAK,EACjB,YAAY,UAAQ,GAClB,MAAM,CAOR;AAED,wBAAgB,4BAA4B,CAAC,aAAa,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,MAAM,CAKlG;AAwPD,wBAAgB,mBAAmB,CAAC,OAAO,GAAE,cAAmB,GAAG,YAAY,CAwB9E;AAgJD;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,QAAQ,GAAE,MAAM,CAAC,QAA2B,EAAE,SAAS,SAA0E,GAAG,OAAO,CAAC,SAAS,GAAG,WAAW,GAAG,SAAS,CAAC,CAY5P;AAqCD,wBAAsB,gCAAgC,CACrD,MAAM,EAAE,IAAI,CACX,mBAAmB,EACjB,OAAO,GACP,KAAK,GACL,WAAW,GACX,WAAW,GACX,YAAY,GACZ,kBAAkB,GAClB,eAAe,CACjB,GAAG,IAAI,EACR,QAAQ,EAAE,MAAM,CAAC,QAAQ,EACzB,gBAAgB,EAAE,MAAM,EACxB,OAAO,GAAE,0BAA+B,GACtC,OAAO,CAAC,OAAO,CAAC,CAoElB;AAsMD,yEAAyE;AACzE,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAwCvE;AAmKD,wBAAsB,mBAAmB,CACxC,GAAG,EAAE,MAAM,GAAG,IAAI,EAClB,QAAQ,EAAE,MAAM,CAAC,QAAQ,EACzB,OAAO,GAAE,0BAA+B,GACtC,OAAO,CAAC,OAAO,CAAC,CA6DlB;AAmED;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,IAAI,CAAC;AA8C3C,wBAAsB,mCAAmC,CACxD,MAAM,EAAE,8BAA8B,EACtC,OAAO,GAAE,0BAA0B,GAAG;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAA;CAAO,GACvE,OAAO,CAAC,OAAO,CAAC,CAwClB;AAUD,wBAAsB,gBAAgB,CAAC,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,aAAa,CAAC,CAqB3F;AAED,wBAAsB,2BAA2B,CAChD,OAAO,GAAE,cAAmB,GAC1B,OAAO,CAAC,aAAa,CAAC,CAKxB;AA2JD,wBAAsB,6BAA6B,CAClD,OAAO,GAAE,cAAmB,GAC1B,OAAO,CAAC,aAAa,CAAC,CAKxB;AAsQD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,CAuCjE"}

package/dist/lib/runtime/app-bind.js

@@ -570,6 +570,13 @@ async function runWindowsTaskkill(pid) {
         }
     });
 }
+// `ps -o lstart=` is locale-sensitive: under a non-English LC_TIME it prints
+// localized day/month names that parsePosixProcessStartTime cannot read, so
+// every POSIX identity probe would fail and unbind would leak live routers.
+const POSIX_IDENTITY_PROBE_ENV = {
+    ...process.env,
+    LC_ALL: "C",
+};
 async function runProcessIdentityProbe(command, args, options = {}) {
     return new Promise((resolve) => {
         let output = "";
@@ -601,6 +608,7 @@ async function runProcessIdentityProbe(command, args, options = {}) {
             child = spawn(command, args, {
                 stdio: ["ignore", "pipe", "ignore"],
                 windowsHide: true,
+                ...(options.env ? { env: options.env } : {}),
             });
             child.stdout?.setEncoding("utf8");
             child.stdout?.on("data", (chunk) => {
@@ -649,8 +657,8 @@ async function readProcessIdentity(pid, platform, log) {
         };
     }
     const [startedAtRaw, commandLineRaw] = await Promise.all([
-        runProcessIdentityProbe("ps", ["-p", String(pid), "-o", "lstart="], { log }),
-        runProcessIdentityProbe("ps", ["-p", String(pid), "-o", "command="], { log }),
+        runProcessIdentityProbe("ps", ["-p", String(pid), "-o", "lstart="], { env: POSIX_IDENTITY_PROBE_ENV, log }),
+        runProcessIdentityProbe("ps", ["-p", String(pid), "-o", "command="], { env: POSIX_IDENTITY_PROBE_ENV, log }),
     ]);
     if (!startedAtRaw || !commandLineRaw) {
         log?.(`Process identity probe returned no POSIX record for PID ${pid}`);

package/dist/lib/runtime/automatic-account-checks.d.ts

@@ -1,5 +1,5 @@
 import { type AccountPolicyStore } from "../account-policy.js";
-import type { AccountStorageV3 } from "../storage.js";
+import type { AccountMetadataV3, AccountStorageV3 } from "../storage.js";
 export declare const AUTOMATIC_CHECK_INTERVAL_MS: number;
 /** First tick after router start, so a short CLI session still gets its check. */
 export declare const AUTOMATIC_CHECK_INITIAL_DELAY_MS = 5000;
@@ -11,6 +11,10 @@ export interface AutomaticAccountCheckOptions {
     now?: () => number;
     signal?: AbortSignal;
 }
+/** Honor the saved selection; a disabled/invalid selection must not fall back to a sibling. */
+export declare function automaticCheckWorkspaceId(account: AccountMetadataV3): string | undefined;
+/** Policy keys can be shared by organization members; attempt limits must never be. */
+export declare function automaticAccountCheckKey(account: AccountMetadataV3): string;
 /** A durable attempt precedes network I/O, so failures and competing routers cannot double-prime. */
 export declare function runAutomaticAccountChecks(options: AutomaticAccountCheckOptions): Promise<void>;
 /**

package/dist/lib/runtime/automatic-account-checks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"automatic-account-checks.d.ts","sourceRoot":"","sources":["../../../lib/runtime/automatic-account-checks.ts"],"names":[],"mappings":"AAEA,OAAO,EAAuB,KAAK,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AACpF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAKtD,eAAO,MAAM,2BAA2B,QAAa,CAAC;AACtD,kFAAkF;AAClF,eAAO,MAAM,gCAAgC,OAAO,CAAC;AAKrD,MAAM,WAAW,4BAA4B;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACrD,YAAY,EAAE,MAAM,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAChD,KAAK,EAAE,CAAC,OAAO,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxF,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,WAAW,CAAC;CACxB;AAwBD,qGAAqG;AACrG,wBAAsB,yBAAyB,CAAC,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,IAAI,CAAC,CAqCpG;AACD;;;;;;;;;;;GAWG;AACH,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC;;EAwBtF"}
+{"version":3,"file":"automatic-account-checks.d.ts","sourceRoot":"","sources":["../../../lib/runtime/automatic-account-checks.ts"],"names":[],"mappings":"AAKA,OAAO,EAAuB,KAAK,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AACpF,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAKzE,eAAO,MAAM,2BAA2B,QAAa,CAAC;AACtD,kFAAkF;AAClF,eAAO,MAAM,gCAAgC,OAAO,CAAC;AAKrD,MAAM,WAAW,4BAA4B;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACrD,YAAY,EAAE,MAAM,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAChD,KAAK,EAAE,CAAC,OAAO,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxF,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,WAAW,CAAC;CACxB;AACD,+FAA+F;AAC/F,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,GAAG,SAAS,CAMxF;AAED,uFAAuF;AACvF,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAE3E;AAkCD,qGAAqG;AACrG,wBAAsB,yBAAyB,CAAC,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,IAAI,CAAC,CAyCpG;AACD;;;;;;;;;;;GAWG;AACH,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC;;EAwBtF"}

package/dist/lib/runtime/automatic-account-checks.js

@@ -1,5 +1,8 @@
+import { createHash } from "node:crypto";
 import { promises as fs } from "node:fs";
 import { z } from "zod";
+import { resolveAccountRecordId } from "../accounts.js";
+import { extractAccountId } from "../auth/token-utils.js";
 import { getAccountPolicyKey } from "../account-policy.js";
 import { withFileTransactionLock } from "../storage/file-lock.js";
 import { withRetry } from "../fs-retry.js";
@@ -12,6 +15,25 @@ export const AUTOMATIC_CHECK_INITIAL_DELAY_MS = 5000;
 const FUTURE_SKEW_MS = 5 * 60000;
 const schema = z.record(z.string().regex(/^sha256:[a-f0-9]{64}$/), z.number().finite().nonnegative());
 const retry = { maxAttempts: 6, backoffMs: 25 };
+/** Honor the saved selection; a disabled/invalid selection must not fall back to a sibling. */
+export function automaticCheckWorkspaceId(account) {
+    if (account.workspaces?.length) {
+        const selected = account.workspaces[account.currentWorkspaceIndex ?? 0];
+        return selected?.enabled === false ? undefined : selected?.id.trim() || undefined;
+    }
+    return account.accountId?.trim() || extractAccountId(account.accessToken) || undefined;
+}
+/** Policy keys can be shared by organization members; attempt limits must never be. */
+export function automaticAccountCheckKey(account) {
+    return workspaceAttemptKey(account, automaticCheckWorkspaceId(account) ?? "");
+}
+/** Build the same key for inactive workspaces while pruning the attempt journal. */
+function workspaceAttemptKey(account, workspaceId) {
+    return `sha256:${createHash("sha256").update(JSON.stringify([
+        "automatic-check-v2", resolveAccountRecordId(account), workspaceId,
+    ])).digest("hex")}`;
+}
+/** Reject unreadable or oversized history rather than silently allowing duplicate probes. */
 async function readAttempts(path) {
     try {
         const raw = await withRetry(() => fs.readFile(path, "utf8"), retry);
@@ -25,6 +47,7 @@ async function readAttempts(path) {
         throw error;
     }
 }
+/** Atomically persist attempt timestamps before any billable network request. */
 async function saveAttempts(path, attempts) {
     const temp = tempPathFor(path);
     try {
@@ -46,7 +69,11 @@ export async function runAutomaticAccountChecks(options) {
         if (!storage || signal.aborted)
             return;
         const attempts = await readAttempts(options.path);
-        const keys = new Set(storage.accounts.map(a => getAccountPolicyKey(a)));
+        // Keep every still-saved workspace's throttle, including temporarily disabled selections.
+        const keys = new Set(storage.accounts.flatMap(account => [
+            automaticAccountCheckKey(account),
+            ...(account.workspaces ?? []).map(workspace => workspaceAttemptKey(account, workspace.id.trim())),
+        ]));
         for (const key of Object.keys(attempts))
             if (!keys.has(key))
                 delete attempts[key];
@@ -56,7 +83,7 @@ export async function runAutomaticAccountChecks(options) {
             const account = storage.accounts[index];
             if (!account)
                 continue;
-            const key = getAccountPolicyKey(account), policy = policies.accounts[key], now = options.now?.() ?? Date.now();
+            const key = automaticAccountCheckKey(account), policy = policies.accounts[getAccountPolicyKey(account)], now = options.now?.() ?? Date.now();
             if (!policy?.autoPrime || policy.paused || policy.drained || account.enabled === false || account.authInvalidatedAt || (account.coolingDownUntil ?? 0) > now)
                 continue;
             const lastAttempt = attempts[key];

package/dist/lib/runtime/automatic-subscription-checks.d.ts

@@ -1,6 +1,6 @@
 import { type AccountMetadataV3 } from "../storage.js";
 import { type CodexQuotaSnapshot } from "../quota-probe.js";
-type Observer = (account: AccountMetadataV3, snapshot: CodexQuotaSnapshot, accounts: AccountMetadataV3[]) => Promise<void> | void;
+type Observer = (account: AccountMetadataV3, snapshot: CodexQuotaSnapshot, accounts: AccountMetadataV3[], workspaceId: string) => Promise<void> | void;
 /** Captures this router's pool; reads only verified primary credentials, never API/ZDR entries. */
 export declare function createAutomaticSubscriptionCheck(observe?: Observer): (signal: AbortSignal) => Promise<void>;
 export {};