codex-multi-auth 2.17.0 → 2.17.3

package/dist/lib/request/stream-failover.js

@@ -1,8 +1,23 @@
 import { ensureContentType } from "./response-handler.js";
 const DEFAULT_MAX_FAILOVERS = 1;
+// Generous hard bound for the library API: the runtime path already clamps to
+// MAX_STREAM_FAILOVERS via capStreamFailoverMax, but a direct caller passing a
+// non-finite or huge value must not produce unbounded fallback churn.
+const MAX_FAILOVERS_HARD_BOUND = 32;
+function normalizeMaxFailovers(value) {
+    if (value === undefined || !Number.isFinite(value)) {
+        return DEFAULT_MAX_FAILOVERS;
+    }
+    return Math.max(0, Math.min(MAX_FAILOVERS_HARD_BOUND, Math.floor(value)));
+}
 const DEFAULT_STALL_TIMEOUT_MS = 45_000;
 const DEFAULT_SOFT_TIMEOUT_MS = 15_000;
 const MAX_REQUEST_INSTANCE_ID_LENGTH = 64;
+// Node clamps setTimeout delays above 2^31-1 (~24.8 days) to ~1ms, so an
+// oversized-but-finite timeout would otherwise fire the stall window almost
+// immediately and churn fallovers. Cap effective delays at the supported
+// maximum.
+const MAX_TIMER_DELAY_MS = 2_147_483_647;
 class StallTimeoutError extends Error {
     isStallTimeout = true;
     constructor(timeoutMs) {
@@ -106,10 +121,19 @@ async function readChunkWithSoftHardTimeout(reader, softTimeoutMs, hardTimeoutMs
  * @returns A new Response that streams data from the initial response but may switch to fallback responses on stall/error, preserving the original status, statusText, and content-type header.
  */
 export function withStreamingFailover(initialResponse, getFallbackResponse, options = {}) {
-    const maxFailovers = Math.max(0, Math.floor(options.maxFailovers ?? DEFAULT_MAX_FAILOVERS));
-    const defaultHardTimeoutMs = options.stallTimeoutMs ?? DEFAULT_STALL_TIMEOUT_MS;
-    const softTimeoutMs = Math.max(1_000, Math.floor(options.softTimeoutMs ?? Math.min(defaultHardTimeoutMs, DEFAULT_SOFT_TIMEOUT_MS)));
-    const hardTimeoutMs = Math.max(softTimeoutMs, Math.floor(options.hardTimeoutMs ?? defaultHardTimeoutMs));
+    const maxFailovers = normalizeMaxFailovers(options.maxFailovers);
+    const stallTimeoutOption = options.stallTimeoutMs !== undefined && Number.isFinite(options.stallTimeoutMs)
+        ? options.stallTimeoutMs
+        : DEFAULT_STALL_TIMEOUT_MS;
+    const defaultHardTimeoutMs = stallTimeoutOption;
+    const softTimeoutOption = options.softTimeoutMs !== undefined && Number.isFinite(options.softTimeoutMs)
+        ? options.softTimeoutMs
+        : Math.min(defaultHardTimeoutMs, DEFAULT_SOFT_TIMEOUT_MS);
+    const softTimeoutMs = Math.min(MAX_TIMER_DELAY_MS, Math.max(1_000, Math.floor(softTimeoutOption)));
+    const hardTimeoutOption = options.hardTimeoutMs !== undefined && Number.isFinite(options.hardTimeoutMs)
+        ? options.hardTimeoutMs
+        : defaultHardTimeoutMs;
+    const hardTimeoutMs = Math.min(MAX_TIMER_DELAY_MS, Math.max(softTimeoutMs, Math.floor(hardTimeoutOption)));
     const requestInstanceId = normalizeRequestInstanceId(options.requestInstanceId);
     const headers = ensureContentType(initialResponse.headers);
     if (!initialResponse.body || maxFailovers <= 0) {

package/dist/lib/request/token-refresh.d.ts

@@ -27,4 +27,3 @@ export declare function shouldRefreshToken(auth: Auth, skewMs?: number): boolean
  * @returns Updated auth (throws on failure)
  */
 export declare function refreshAndUpdateToken(currentAuth: Auth, client: CodexClient): Promise<Auth>;
-//# sourceMappingURL=token-refresh.d.ts.map

package/dist/lib/request/url-rewriting.d.ts

@@ -21,4 +21,3 @@ export declare function rewriteUrlForCodex(url: string): string;
 export declare function resolveProxyUrlForRequest(url: string, env?: NodeJS.ProcessEnv): string | undefined;
 export declare function closeSharedProxyDispatchers(): Promise<void>;
 export declare function applyProxyCompatibleInit(url: string, init?: ProxyCompatibleRequestInit, env?: NodeJS.ProcessEnv): ProxyCompatibleRequestInit;
-//# sourceMappingURL=url-rewriting.d.ts.map

package/dist/lib/request/wait-utils.d.ts

@@ -11,4 +11,3 @@ export declare function sleepWithCountdown(params: {
     abortSignal?: AbortSignal | null;
     intervalMs?: number;
 }): Promise<void>;
-//# sourceMappingURL=wait-utils.d.ts.map

package/dist/lib/rotation.d.ts

@@ -233,4 +233,3 @@ export declare function getHealthTracker(config?: Partial<HealthScoreConfig>): H
 export declare function getTokenTracker(config?: Partial<TokenBucketConfig>): TokenBucketTracker;
 export declare function resetTrackers(): void;
 export {};
-//# sourceMappingURL=rotation.d.ts.map

package/dist/lib/routing-mutex.d.ts

@@ -116,4 +116,3 @@ export declare function __resetRoutingMutexForTests(): void;
  * `withRoutingMutex` calls it makes are detected as reentrant.
  */
 export declare function withRoutingMutex<T>(mode: RoutingMutexMode, fn: () => Promise<T> | T): Promise<T>;
-//# sourceMappingURL=routing-mutex.d.ts.map

package/dist/lib/routing-profiles.d.ts

@@ -23,7 +23,22 @@ export interface ProjectRoutingProfileContext {
 }
 export declare function getRoutingProfilesPath(): string;
 export declare function loadRoutingProfileStore(): Promise<RoutingProfileStore>;
-export declare function saveRoutingProfileStore(store: RoutingProfileStore): Promise<void>;
+export declare function saveRoutingProfileStore(store: RoutingProfileStore, baseline?: RoutingProfileStore): Promise<void>;
+/**
+ * Run a routing-profile read→mutate→write inside the write queue (in-process
+ * serialization) AND the cross-process lock directory, with mtime CAS retry:
+ * every attempt re-reads the freshest on-disk store and re-applies `mutate`
+ * before writing — so a mutation is applied to the latest committed state
+ * rather than merged by whole-record `updatedAt`, which can drop or clobber
+ * a concurrent process's change to the same profile. `mutate` must be
+ * re-appliable across retries (apply precomputed work onto the store it is
+ * handed, don't capture mutated state). Prefer this over load→upsert→save
+ * whenever the caller is mutating rather than importing a foreign store.
+ */
+export declare function updateRoutingProfileStore<T>(mutate: (store: RoutingProfileStore) => {
+    result: T;
+    dirty: boolean;
+}): Promise<T>;
 export declare function createDefaultRoutingProfile(input: {
     projectKey: string;
     projectName: string;
@@ -33,4 +48,3 @@ export declare function createDefaultRoutingProfile(input: {
 export declare function upsertRoutingProfile(store: RoutingProfileStore, profile: RoutingProfile, mutate?: (profile: RoutingProfile) => void, now?: number): RoutingProfile;
 export declare function resolveProjectRoutingProfile(startDir?: string, storeLoader?: () => Promise<RoutingProfileStore>): Promise<ProjectRoutingProfileContext>;
 export declare function resetRoutingProfileWriteQueueForTests(): void;
-//# sourceMappingURL=routing-profiles.d.ts.map

package/dist/lib/routing-profiles.js

@@ -4,10 +4,9 @@ import { logWarn } from "./logger.js";
 import { getCodexMultiAuthDir } from "./runtime-paths.js";
 import { findProjectRoot, getProjectStorageKey, resolveProjectStorageIdentityRoot, } from "./storage/paths.js";
 import { isRecord, sleep } from "./utils.js";
-import { tempPathFor } from "./temp-path.js";
+import { getJsonStoreFileMtimeMs, resetJsonStoreWriteQueuesForTests, stampUpdatedAt, withJsonStoreCasRetry, withJsonStoreFileLock, withJsonStoreWriteQueue, writeJsonStoreFileAtomicWithRetry, } from "./storage/json-store-lock.js";
 const ROUTING_PROFILES_FILE_NAME = "routing-profiles.json";
 const RETRYABLE_FS_CODES = new Set(["EBUSY", "EPERM"]);
-let writeQueue = Promise.resolve();
 function isRetryableFsError(error) {
     const code = error?.code;
     return typeof code === "string" && RETRYABLE_FS_CODES.has(code);
@@ -64,13 +63,24 @@ function normalizeProfile(key, value) {
             : 0,
     };
 }
+// Profile keys are caller/project-derived strings — including, via a crafted
+// store file or a literal upsert, Object.prototype member names such as
+// "constructor" or "__proto__". On a plain object, reading an absent key
+// resolves an inherited member ({}.constructor === Object), which made a
+// same-named profile look "already present" to the merge and silently dropped
+// the incoming entry; writing "__proto__" invokes the setter and mutates the
+// prototype instead of storing anything. Null-prototype maps make every key a
+// plain data slot regardless of name.
+function newProfilesMap() {
+    return Object.create(null);
+}
 function emptyStore() {
-    return { version: 1, profiles: {} };
+    return { version: 1, profiles: newProfilesMap() };
 }
 function normalizeStore(value) {
     if (!isRecord(value) || value.version !== 1)
         return emptyStore();
-    const profiles = {};
+    const profiles = newProfilesMap();
     if (isRecord(value.profiles)) {
         for (const [key, raw] of Object.entries(value.profiles)) {
             const profile = normalizeProfile(key, raw);
@@ -112,45 +122,100 @@ export async function loadRoutingProfileStore() {
         return emptyStore();
     }
 }
-export async function saveRoutingProfileStore(store) {
-    const path = getRoutingProfilesPath();
-    const payload = normalizeStore(store);
-    const task = async () => {
-        await fs.mkdir(getCodexMultiAuthDir(), { recursive: true, mode: 0o700 });
-        const tempPath = tempPathFor(path);
-        let moved = false;
-        try {
-            await fs.writeFile(tempPath, `${JSON.stringify(payload, null, 2)}\n`, {
-                encoding: "utf8",
-                mode: 0o600,
-            });
-            for (let attempt = 0; attempt < 5; attempt += 1) {
-                try {
-                    await fs.rename(tempPath, path);
-                    moved = true;
-                    return;
-                }
-                catch (error) {
-                    if (!isRetryableFsError(error) || attempt >= 4)
-                        throw error;
-                    await sleep(10 * 2 ** attempt);
-                }
+/**
+ * Per-key merge of the caller's normalized store over the freshest on-disk
+ * store. Profiles carry `updatedAt`; the newer entry wins per key so a save
+ * built on a stale snapshot cannot resurrect an older profile over a
+ * concurrent process's newer one. Keys the caller does not carry are
+ * preserved (upsert-only store — nothing deletes entries), matching the
+ * config save's patch-over-fresh-read semantics.
+ *
+ * When `baseline` (the caller's pre-edit snapshot) is supplied, entries
+ * identical to it are untouched carried copies and skipped entirely, so a
+ * stale snapshot row can never be re-stamped over a raced write. Entries
+ * that differ are deliberate writes and must not lose purely on timestamp:
+ * the upsert-time floor stamps against the caller's snapshot, but a
+ * concurrent writer can land a still-newer entry before this merge runs, so
+ * the merge re-stamps against the freshest on-disk entry instead of
+ * silently dropping the edit. Without a baseline every supplied entry is a
+ * plain `updatedAt >=` upsert.
+ */
+function mergeRoutingProfiles(current, incoming, baseline) {
+    const merged = {
+        version: 1,
+        profiles: Object.assign(newProfilesMap(), current.profiles),
+    };
+    const same = (a, b) => JSON.stringify(a) === JSON.stringify(b);
+    for (const [key, profile] of Object.entries(incoming.profiles)) {
+        const existing = merged.profiles[key];
+        if (!baseline) {
+            if (!existing || profile.updatedAt >= existing.updatedAt) {
+                merged.profiles[key] = profile;
             }
+            continue;
         }
-        finally {
-            if (!moved) {
-                try {
-                    await fs.unlink(tempPath);
-                }
-                catch {
-                    // Best-effort temp cleanup.
-                }
-            }
+        if (same(profile, baseline.profiles[key]))
+            continue;
+        profile.updatedAt = stampUpdatedAt(profile.updatedAt, existing?.updatedAt);
+        merged.profiles[key] = profile;
+    }
+    return merged;
+}
+export async function saveRoutingProfileStore(store, baseline) {
+    const path = getRoutingProfilesPath();
+    const incoming = normalizeStore(store);
+    // Normalize at invocation like `incoming`: later caller-side mutation of
+    // `baseline` must not shift which entries the merge counts as deliberate.
+    const prior = baseline ? normalizeStore(baseline) : undefined;
+    // Per-path promise queue serializes writers inside THIS process; the
+    // lock directory closes the same window against OTHER processes. Inside the lock
+    // every attempt re-stats (CAS), re-reads the freshest on-disk store, and
+    // merges this call's entries over it — so a save that raced a concurrent
+    // write reloads-and-retries rather than blindly overwriting it.
+    await withJsonStoreWriteQueue(path, async () => {
+        await withJsonStoreFileLock(path, async () => {
+            await withJsonStoreCasRetry(async () => {
+                const expectedMtimeMs = await getJsonStoreFileMtimeMs(path);
+                const current = await loadRoutingProfileStore();
+                const merged = mergeRoutingProfiles(current, incoming, prior);
+                await fs.mkdir(getCodexMultiAuthDir(), {
+                    recursive: true,
+                    mode: 0o700,
+                });
+                await writeJsonStoreFileAtomicWithRetry(path, merged, {
+                    expectedMtimeMs,
+                    mode: 0o600,
+                });
+            });
+        });
+    });
+}
+/**
+ * Run a routing-profile read→mutate→write inside the write queue (in-process
+ * serialization) AND the cross-process lock directory, with mtime CAS retry:
+ * every attempt re-reads the freshest on-disk store and re-applies `mutate`
+ * before writing — so a mutation is applied to the latest committed state
+ * rather than merged by whole-record `updatedAt`, which can drop or clobber
+ * a concurrent process's change to the same profile. `mutate` must be
+ * re-appliable across retries (apply precomputed work onto the store it is
+ * handed, don't capture mutated state). Prefer this over load→upsert→save
+ * whenever the caller is mutating rather than importing a foreign store.
+ */
+export async function updateRoutingProfileStore(mutate) {
+    const path = getRoutingProfilesPath();
+    return withJsonStoreWriteQueue(path, () => withJsonStoreFileLock(path, () => withJsonStoreCasRetry(async () => {
+        const expectedMtimeMs = await getJsonStoreFileMtimeMs(path);
+        const store = await loadRoutingProfileStore();
+        const { result, dirty } = mutate(store);
+        if (dirty) {
+            await fs.mkdir(getCodexMultiAuthDir(), {
+                recursive: true,
+                mode: 0o700,
+            });
+            await writeJsonStoreFileAtomicWithRetry(path, normalizeStore(store), { expectedMtimeMs, mode: 0o600 });
         }
-    };
-    const queued = writeQueue.catch(() => undefined).then(task);
-    writeQueue = queued.then(() => undefined, () => undefined);
-    await queued;
+        return result;
+    })));
 }
 export function createDefaultRoutingProfile(input) {
     return {
@@ -167,13 +232,23 @@ export function createDefaultRoutingProfile(input) {
     };
 }
 export function upsertRoutingProfile(store, profile, mutate, now = Date.now()) {
-    const next = structuredClone(store.profiles[profile.projectKey] ?? profile);
+    // store.profiles may be a caller-built plain object, so absent-key reads
+    // need an own-property check and "__proto__" needs a setter-safe write.
+    const existing = Object.hasOwn(store.profiles, profile.projectKey)
+        ? store.profiles[profile.projectKey]
+        : undefined;
+    const next = structuredClone(existing ?? profile);
     mutate?.(next);
-    next.updatedAt = now;
+    next.updatedAt = stampUpdatedAt(now, existing?.updatedAt);
     const normalized = normalizeProfile(profile.projectKey, next);
     if (!normalized)
         throw new Error("Invalid routing profile");
-    store.profiles[profile.projectKey] = normalized;
+    Object.defineProperty(store.profiles, profile.projectKey, {
+        value: normalized,
+        writable: true,
+        enumerable: true,
+        configurable: true,
+    });
     return normalized;
 }
 export async function resolveProjectRoutingProfile(startDir = process.cwd(), storeLoader = loadRoutingProfileStore) {
@@ -199,5 +274,5 @@ export async function resolveProjectRoutingProfile(startDir = process.cwd(), sto
     };
 }
 export function resetRoutingProfileWriteQueueForTests() {
-    writeQueue = Promise.resolve();
+    resetJsonStoreWriteQueuesForTests(getRoutingProfilesPath());
 }

package/dist/lib/runtime/account-check-helpers.d.ts

@@ -5,4 +5,3 @@ export declare function clampActiveIndices(storage: AccountStorageV3, families:
 export declare function isFlaggableFailure(failure: Extract<TokenResult, {
     type: "failed";
 }>): boolean;
-//# sourceMappingURL=account-check-helpers.d.ts.map

package/dist/lib/runtime/account-check-types.d.ts

@@ -16,4 +16,3 @@ export declare function createAccountCheckWorkingState(flaggedStorage: {
     version: 1;
     accounts: FlaggedAccountMetadataV1[];
 }): AccountCheckWorkingState;
-//# sourceMappingURL=account-check-types.d.ts.map

package/dist/lib/runtime/account-check.d.ts

@@ -49,4 +49,3 @@ export declare function runRuntimeAccountCheck(deepProbe: boolean, deps: {
     now?: () => number;
     showLine: (message: string) => void;
 }): Promise<void>;
-//# sourceMappingURL=account-check.d.ts.map

package/dist/lib/runtime/account-manager-cache-entry.d.ts

@@ -22,4 +22,3 @@ export declare function reloadAccountManagerFromDiskEntry<TManager>(params: {
     onSettled: () => void;
     setReloadInFlight: (promise: Promise<TManager>) => void;
 }): Promise<TManager>;
-//# sourceMappingURL=account-manager-cache-entry.d.ts.map

package/dist/lib/runtime/account-manager-cache.d.ts

@@ -22,4 +22,3 @@ export declare function reloadAccountManagerFromDiskState<TManager>(params: {
     onLoaded: (manager: TManager) => void;
     onSettled: () => void;
 }): Promise<TManager>;
-//# sourceMappingURL=account-manager-cache.d.ts.map

package/dist/lib/runtime/account-model-catalog.d.ts

@@ -53,7 +53,7 @@ export declare class AccountModelCatalog {
             reasoningLevels: string[];
             accessPrograms: string[];
             probes?: {
-                [k: string]: "unsupported" | "verified" | "unverified" | "downgraded";
+                [k: string]: "verified" | "unsupported" | "unverified" | "downgraded";
             } | undefined;
             checkedAt?: number | undefined;
             model: string;
@@ -61,4 +61,3 @@ export declare class AccountModelCatalog {
         error: boolean;
     };
 }
-//# sourceMappingURL=account-model-catalog.d.ts.map

package/dist/lib/runtime/account-pool.d.ts

@@ -22,4 +22,3 @@ export declare function persistAccountPoolResults(params: {
     extractAccountEmail: (accessToken: string, idToken?: string) => string | undefined;
     sanitizeEmail: (email: string | undefined) => string | undefined;
 }): Promise<void>;
-//# sourceMappingURL=account-pool.d.ts.map

package/dist/lib/runtime/account-reset-credits.d.ts

@@ -39,4 +39,3 @@ export declare function loadResetCreditState(): Promise<{
 /** Local terminal labels only; never used in provider requests or public artifacts. */
 export declare function resetAccountLabel(account: Pick<AccountMetadataV3, "email">, index: number): string;
 export declare function refreshAndPrintResetCredits(log: (message: string) => void): Promise<void>;
-//# sourceMappingURL=account-reset-credits.d.ts.map

package/dist/lib/runtime/account-reset-credits.js

@@ -29,7 +29,10 @@ export function isResetTargetEnabled(account, target) {
 }
 export function createResetCreditService(manager) {
     const auth = async (target) => {
-        const account = manager?.getAccountsSnapshot().find(a => workspaceModelScopes(a).some(s => s.id === target.key && s.accountId === target.accountId && s.routable) || (resetTargetForStoredAccount({ ...a, accessToken: a.access })?.key === target.key && resetTargetForStoredAccount({ ...a, accessToken: a.access })?.accountId === target.accountId));
+        const matches = manager?.getAccountsSnapshot().filter(a => workspaceModelScopes(a).some(s => s.id === target.key && s.accountId === target.accountId && s.routable) || (resetTargetForStoredAccount({ ...a, accessToken: a.access })?.key === target.key && resetTargetForStoredAccount({ ...a, accessToken: a.access })?.accountId === target.accountId));
+        if (matches && matches.length > 1)
+            throw Error('Reset account identity is ambiguous; repair duplicate records before checking or redeeming');
+        const account = matches?.[0];
         const current = account && manager?.getAccountByIndex(account.index);
         if (!manager || !current || current.enabled === false)
             throw Error('Reset workspace is not enabled');
@@ -53,7 +56,10 @@ export function createResetCreditService(manager) {
         consume: async (target, idempotencyKey) => {
             const freshAuth = await auth(target);
             const disk = await loadAccounts();
-            if (!disk?.accounts.some(a => isResetTargetEnabled(a, target)))
+            const matches = disk?.accounts.filter(a => isResetTargetEnabled(a, target)) ?? [];
+            if (matches.length > 1)
+                throw Error('Reset account identity is ambiguous; no credit consumed');
+            if (matches.length !== 1)
                 throw Error('Reset target was removed, disabled, or changed; no credit consumed');
             return nativeRateLimitsRpc(freshAuth, 'account/rateLimitResetCredit/consume', { idempotencyKey });
         },

package/dist/lib/runtime/account-scope.d.ts

@@ -7,4 +7,3 @@ export declare function applyAccountStorageScope<TConfig>(pluginConfig: TConfig,
     getCwd: () => string;
     warnPerProjectSyncConflict: () => void;
 }): void;
-//# sourceMappingURL=account-scope.d.ts.map

package/dist/lib/runtime/account-select-event.d.ts

@@ -16,4 +16,3 @@ export declare function handleAccountSelectEvent(input: {
     setLastCodexCliActiveSyncIndex: (index: number) => void;
     showToast: (message: string, variant?: "info" | "success" | "warning" | "error") => Promise<void>;
 }): Promise<boolean>;
-//# sourceMappingURL=account-select-event.d.ts.map

package/dist/lib/runtime/account-selection.d.ts

@@ -25,4 +25,3 @@ export declare function resolveAccountSelection<T extends {
     selectBestAccountCandidate: (candidates: AccountCandidate[]) => AccountCandidate | null | undefined;
 }): TokenSuccessWithAccount<T>;
 export {};
-//# sourceMappingURL=account-selection.d.ts.map

package/dist/lib/runtime/account-state.d.ts

@@ -1,2 +1 @@
 export { formatRateLimitEntry, getRateLimitResetTimeForFamily, resolveActiveIndex, } from "./account-status.js";
-//# sourceMappingURL=account-state.d.ts.map

package/dist/lib/runtime/account-status.d.ts

@@ -77,4 +77,3 @@ export declare function formatRateLimitEntry(account: {
 export declare function getRateLimitResetTimeForModel(account: {
     rateLimitResetTimes?: Record<string, number | undefined>;
 }, now: number, family: ModelFamily, model: string): number | null;
-//# sourceMappingURL=account-status.d.ts.map

package/dist/lib/runtime/account-storage-scope-entry.d.ts

@@ -23,4 +23,3 @@ export declare function applyAccountStorageScopeEntry(params: {
         cwd: () => string;
     }) => void;
 }): void;
-//# sourceMappingURL=account-storage-scope-entry.d.ts.map

package/dist/lib/runtime/api-model-capabilities.d.ts

@@ -27,4 +27,3 @@ export declare class ApiModelCapabilities {
     private runProbe;
     enrich(models: RouteModel[], refresh?: boolean, route?: ApiRouteCredential, forceProbes?: boolean): Promise<RouteModel[]>;
 }
-//# sourceMappingURL=api-model-capabilities.d.ts.map

package/dist/lib/runtime/api-model-runtime.d.ts

@@ -39,4 +39,3 @@ export declare class ApiModelRuntime {
     recordStreamFailure(credential: ApiRouteCredential, alias: string, body: Record<string, unknown>, error: unknown): void;
     private failure;
 }
-//# sourceMappingURL=api-model-runtime.d.ts.map

package/dist/lib/runtime/app-bind.d.ts

@@ -143,4 +143,3 @@ export declare function getAppBindStatus(options?: AppBindOptions): Promise<AppB
 export declare function bindCodexAppRuntimeRotation(options?: AppBindOptions): Promise<AppBindResult>;
 export declare function unbindCodexAppRuntimeRotation(options?: AppBindOptions): Promise<AppBindResult>;
 export declare function formatAppBindStatus(status: AppBindStatus): string;
-//# sourceMappingURL=app-bind.d.ts.map

package/dist/lib/runtime/app-bind.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app-bind.d.ts","sourceRoot":"","sources":["../../../lib/runtime/app-bind.ts"],"names":[],"mappings":"AA2CA,MAAM,WAAW,YAAY;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAUD,MAAM,WAAW,YAAY;IAC5B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,cAAc,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;KAAE,CAAC;IACvD,OAAO,EAAE,CAAC,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,iFAAiF;IACjF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,mBAAmB;IACnC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,+EAA+E;IAC/E,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,mEAAmE;IACnE,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,2DAA2D;IAC3D,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,aAAa;IAC7B,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;OAKG;IACH,aAAa,EAAE,OAAO,CAAC;IACvB,KAAK,EAAE,YAAY,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACnC,KAAK,EAAE,YAAY,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC7B,MAAM,EAAE,aAAa,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,uBAAuB,GAAG,CACrC,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ,EACzB,aAAa,CAAC,EAAE,MAAM,KAClB,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC,MAAM,WAAW,cAAc;IAC9B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,cAAc,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;KAAE,CAAC;IACvD,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAC;IAClC,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,sEAAsE;IACtE,qBAAqB,CAAC,EAAE,uBAAuB,CAAC;CAChD;AAED,MAAM,WAAW,0BAA0B;IAC1C,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IACnC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC;IACrD,kBAAkB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAC9D,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,iEAAiE;IACjE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,qBAAqB,CAAC,EAAE,uBAAuB,CAAC;IAChD,qFAAqF;IACrF,mBAAmB,CAAC,EAAE,MAAM,IAAI,CAAC;CACjC;AAED,MAAM,WAAW,8BAA8B;IAC9C,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,oEAAoE;IACpE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,2DAA2D;IAC3D,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAoCD,wBAAgB,2BAA2B,CAC1C,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,YAAY,SAAK,EACjB,YAAY,UAAQ,GAClB,MAAM,CAOR;AAED,wBAAgB,4BAA4B,CAAC,aAAa,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,MAAM,CAKlG;AAwPD,wBAAgB,mBAAmB,CAAC,OAAO,GAAE,cAAmB,GAAG,YAAY,CAwB9E;AAgJD;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,QAAQ,GAAE,MAAM,CAAC,QAA2B,EAAE,SAAS,SAA0E,GAAG,OAAO,CAAC,SAAS,GAAG,WAAW,GAAG,SAAS,CAAC,CAY5P;AAqCD,wBAAsB,gCAAgC,CACrD,MAAM,EAAE,IAAI,CACX,mBAAmB,EACjB,OAAO,GACP,KAAK,GACL,WAAW,GACX,WAAW,GACX,YAAY,GACZ,kBAAkB,GAClB,eAAe,CACjB,GAAG,IAAI,EACR,QAAQ,EAAE,MAAM,CAAC,QAAQ,EACzB,gBAAgB,EAAE,MAAM,EACxB,OAAO,GAAE,0BAA+B,GACtC,OAAO,CAAC,OAAO,CAAC,CAoElB;AAyLD,yEAAyE;AACzE,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAwCvE;AAmKD,wBAAsB,mBAAmB,CACxC,GAAG,EAAE,MAAM,GAAG,IAAI,EAClB,QAAQ,EAAE,MAAM,CAAC,QAAQ,EACzB,OAAO,GAAE,0BAA+B,GACtC,OAAO,CAAC,OAAO,CAAC,CA6DlB;AAmED;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,IAAI,CAAC;AA8C3C,wBAAsB,mCAAmC,CACxD,MAAM,EAAE,8BAA8B,EACtC,OAAO,GAAE,0BAA0B,GAAG;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAA;CAAO,GACvE,OAAO,CAAC,OAAO,CAAC,CAwClB;AAUD,wBAAsB,gBAAgB,CAAC,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,aAAa,CAAC,CAqB3F;AAED,wBAAsB,2BAA2B,CAChD,OAAO,GAAE,cAAmB,GAC1B,OAAO,CAAC,aAAa,CAAC,CAKxB;AA2JD,wBAAsB,6BAA6B,CAClD,OAAO,GAAE,cAAmB,GAC1B,OAAO,CAAC,aAAa,CAAC,CAKxB;AAsQD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,CAuCjE"}
+{"version":3,"file":"app-bind.d.ts","sourceRoot":"","sources":["../../../lib/runtime/app-bind.ts"],"names":[],"mappings":"AA2CA,MAAM,WAAW,YAAY;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAUD,MAAM,WAAW,YAAY;IAC5B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,cAAc,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;KAAE,CAAC;IACvD,OAAO,EAAE,CAAC,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,iFAAiF;IACjF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,mBAAmB;IACnC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,+EAA+E;IAC/E,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,mEAAmE;IACnE,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,2DAA2D;IAC3D,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,aAAa;IAC7B,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;OAKG;IACH,aAAa,EAAE,OAAO,CAAC;IACvB,KAAK,EAAE,YAAY,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACnC,KAAK,EAAE,YAAY,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC7B,MAAM,EAAE,aAAa,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,uBAAuB,GAAG,CACrC,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ,EACzB,aAAa,CAAC,EAAE,MAAM,KAClB,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC,MAAM,WAAW,cAAc;IAC9B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,cAAc,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;KAAE,CAAC;IACvD,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAC;IAClC,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,sEAAsE;IACtE,qBAAqB,CAAC,EAAE,uBAAuB,CAAC;CAChD;AAED,MAAM,WAAW,0BAA0B;IAC1C,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IACnC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC;IACrD,kBAAkB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAC9D,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,iEAAiE;IACjE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,qBAAqB,CAAC,EAAE,uBAAuB,CAAC;IAChD,qFAAqF;IACrF,mBAAmB,CAAC,EAAE,MAAM,IAAI,CAAC;CACjC;AAED,MAAM,WAAW,8BAA8B;IAC9C,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,oEAAoE;IACpE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,2DAA2D;IAC3D,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAoCD,wBAAgB,2BAA2B,CAC1C,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,YAAY,SAAK,EACjB,YAAY,UAAQ,GAClB,MAAM,CAOR;AAED,wBAAgB,4BAA4B,CAAC,aAAa,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,MAAM,CAKlG;AAwPD,wBAAgB,mBAAmB,CAAC,OAAO,GAAE,cAAmB,GAAG,YAAY,CAwB9E;AAgJD;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,QAAQ,GAAE,MAAM,CAAC,QAA2B,EAAE,SAAS,SAA0E,GAAG,OAAO,CAAC,SAAS,GAAG,WAAW,GAAG,SAAS,CAAC,CAY5P;AAqCD,wBAAsB,gCAAgC,CACrD,MAAM,EAAE,IAAI,CACX,mBAAmB,EACjB,OAAO,GACP,KAAK,GACL,WAAW,GACX,WAAW,GACX,YAAY,GACZ,kBAAkB,GAClB,eAAe,CACjB,GAAG,IAAI,EACR,QAAQ,EAAE,MAAM,CAAC,QAAQ,EACzB,gBAAgB,EAAE,MAAM,EACxB,OAAO,GAAE,0BAA+B,GACtC,OAAO,CAAC,OAAO,CAAC,CAoElB;AAsMD,yEAAyE;AACzE,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAwCvE;AAmKD,wBAAsB,mBAAmB,CACxC,GAAG,EAAE,MAAM,GAAG,IAAI,EAClB,QAAQ,EAAE,MAAM,CAAC,QAAQ,EACzB,OAAO,GAAE,0BAA+B,GACtC,OAAO,CAAC,OAAO,CAAC,CA6DlB;AAmED;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,IAAI,CAAC;AA8C3C,wBAAsB,mCAAmC,CACxD,MAAM,EAAE,8BAA8B,EACtC,OAAO,GAAE,0BAA0B,GAAG;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAA;CAAO,GACvE,OAAO,CAAC,OAAO,CAAC,CAwClB;AAUD,wBAAsB,gBAAgB,CAAC,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,aAAa,CAAC,CAqB3F;AAED,wBAAsB,2BAA2B,CAChD,OAAO,GAAE,cAAmB,GAC1B,OAAO,CAAC,aAAa,CAAC,CAKxB;AA2JD,wBAAsB,6BAA6B,CAClD,OAAO,GAAE,cAAmB,GAC1B,OAAO,CAAC,aAAa,CAAC,CAKxB;AAsQD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,CAuCjE"}

package/dist/lib/runtime/app-bind.js

@@ -570,6 +570,13 @@ async function runWindowsTaskkill(pid) {
         }
     });
 }
+// `ps -o lstart=` is locale-sensitive: under a non-English LC_TIME it prints
+// localized day/month names that parsePosixProcessStartTime cannot read, so
+// every POSIX identity probe would fail and unbind would leak live routers.
+const POSIX_IDENTITY_PROBE_ENV = {
+    ...process.env,
+    LC_ALL: "C",
+};
 async function runProcessIdentityProbe(command, args, options = {}) {
     return new Promise((resolve) => {
         let output = "";
@@ -601,6 +608,7 @@ async function runProcessIdentityProbe(command, args, options = {}) {
             child = spawn(command, args, {
                 stdio: ["ignore", "pipe", "ignore"],
                 windowsHide: true,
+                ...(options.env ? { env: options.env } : {}),
             });
             child.stdout?.setEncoding("utf8");
             child.stdout?.on("data", (chunk) => {
@@ -649,8 +657,8 @@ async function readProcessIdentity(pid, platform, log) {
         };
     }
     const [startedAtRaw, commandLineRaw] = await Promise.all([
-        runProcessIdentityProbe("ps", ["-p", String(pid), "-o", "lstart="], { log }),
-        runProcessIdentityProbe("ps", ["-p", String(pid), "-o", "command="], { log }),
+        runProcessIdentityProbe("ps", ["-p", String(pid), "-o", "lstart="], { env: POSIX_IDENTITY_PROBE_ENV, log }),
+        runProcessIdentityProbe("ps", ["-p", String(pid), "-o", "command="], { env: POSIX_IDENTITY_PROBE_ENV, log }),
     ]);
     if (!startedAtRaw || !commandLineRaw) {
         log?.(`Process identity probe returned no POSIX record for PID ${pid}`);

package/dist/lib/runtime/app-helper-selection.d.ts

@@ -66,4 +66,3 @@ export declare function liveRuntimeHelpers<T extends RuntimeHelperSelectable>(st
  * count describe one instant rather than two.
  */
 export declare function selectRuntimeHelperStatus<T extends RuntimeHelperSelectable>(statuses: readonly T[], now?: number): T | null;
-//# sourceMappingURL=app-helper-selection.d.ts.map

package/dist/lib/runtime/auth-facade.d.ts

@@ -48,4 +48,3 @@ export declare function createAccountManagerReloader<TAccountManager>(deps: {
     setAccountManagerPromise: (value: Promise<TAccountManager> | null) => void;
     setReloadInFlight: (value: Promise<TAccountManager> | null) => void;
 }): (authFallback?: OAuthAuthDetails) => Promise<TAccountManager>;
-//# sourceMappingURL=auth-facade.d.ts.map

package/dist/lib/runtime/automatic-account-checks.d.ts

@@ -1,5 +1,5 @@
 import { type AccountPolicyStore } from "../account-policy.js";
-import type { AccountStorageV3 } from "../storage.js";
+import type { AccountMetadataV3, AccountStorageV3 } from "../storage.js";
 export declare const AUTOMATIC_CHECK_INTERVAL_MS: number;
 /** First tick after router start, so a short CLI session still gets its check. */
 export declare const AUTOMATIC_CHECK_INITIAL_DELAY_MS = 5000;
@@ -11,6 +11,10 @@ export interface AutomaticAccountCheckOptions {
     now?: () => number;
     signal?: AbortSignal;
 }
+/** Honor the saved selection; a disabled/invalid selection must not fall back to a sibling. */
+export declare function automaticCheckWorkspaceId(account: AccountMetadataV3): string | undefined;
+/** Policy keys can be shared by organization members; attempt limits must never be. */
+export declare function automaticAccountCheckKey(account: AccountMetadataV3): string;
 /** A durable attempt precedes network I/O, so failures and competing routers cannot double-prime. */
 export declare function runAutomaticAccountChecks(options: AutomaticAccountCheckOptions): Promise<void>;
 /**
@@ -28,4 +32,3 @@ export declare function runAutomaticAccountChecks(options: AutomaticAccountCheck
 export declare function startAutomaticAccountChecks(run: (signal: AbortSignal) => Promise<void>): {
     stop(): Promise<void>;
 };
-//# sourceMappingURL=automatic-account-checks.d.ts.map

package/dist/lib/runtime/automatic-account-checks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"automatic-account-checks.d.ts","sourceRoot":"","sources":["../../../lib/runtime/automatic-account-checks.ts"],"names":[],"mappings":"AAEA,OAAO,EAAuB,KAAK,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AACpF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAKtD,eAAO,MAAM,2BAA2B,QAAa,CAAC;AACtD,kFAAkF;AAClF,eAAO,MAAM,gCAAgC,OAAO,CAAC;AAKrD,MAAM,WAAW,4BAA4B;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACrD,YAAY,EAAE,MAAM,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAChD,KAAK,EAAE,CAAC,OAAO,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxF,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,WAAW,CAAC;CACxB;AAwBD,qGAAqG;AACrG,wBAAsB,yBAAyB,CAAC,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,IAAI,CAAC,CAqCpG;AACD;;;;;;;;;;;GAWG;AACH,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC;;EAwBtF"}
+{"version":3,"file":"automatic-account-checks.d.ts","sourceRoot":"","sources":["../../../lib/runtime/automatic-account-checks.ts"],"names":[],"mappings":"AAKA,OAAO,EAAuB,KAAK,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AACpF,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAKzE,eAAO,MAAM,2BAA2B,QAAa,CAAC;AACtD,kFAAkF;AAClF,eAAO,MAAM,gCAAgC,OAAO,CAAC;AAKrD,MAAM,WAAW,4BAA4B;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACrD,YAAY,EAAE,MAAM,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAChD,KAAK,EAAE,CAAC,OAAO,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxF,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,WAAW,CAAC;CACxB;AACD,+FAA+F;AAC/F,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,GAAG,SAAS,CAMxF;AAED,uFAAuF;AACvF,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAE3E;AAkCD,qGAAqG;AACrG,wBAAsB,yBAAyB,CAAC,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,IAAI,CAAC,CAyCpG;AACD;;;;;;;;;;;GAWG;AACH,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC;;EAwBtF"}

package/dist/lib/runtime/automatic-account-checks.js

@@ -1,5 +1,8 @@
+import { createHash } from "node:crypto";
 import { promises as fs } from "node:fs";
 import { z } from "zod";
+import { resolveAccountRecordId } from "../accounts.js";
+import { extractAccountId } from "../auth/token-utils.js";
 import { getAccountPolicyKey } from "../account-policy.js";
 import { withFileTransactionLock } from "../storage/file-lock.js";
 import { withRetry } from "../fs-retry.js";
@@ -12,6 +15,25 @@ export const AUTOMATIC_CHECK_INITIAL_DELAY_MS = 5000;
 const FUTURE_SKEW_MS = 5 * 60000;
 const schema = z.record(z.string().regex(/^sha256:[a-f0-9]{64}$/), z.number().finite().nonnegative());
 const retry = { maxAttempts: 6, backoffMs: 25 };
+/** Honor the saved selection; a disabled/invalid selection must not fall back to a sibling. */
+export function automaticCheckWorkspaceId(account) {
+    if (account.workspaces?.length) {
+        const selected = account.workspaces[account.currentWorkspaceIndex ?? 0];
+        return selected?.enabled === false ? undefined : selected?.id.trim() || undefined;
+    }
+    return account.accountId?.trim() || extractAccountId(account.accessToken) || undefined;
+}
+/** Policy keys can be shared by organization members; attempt limits must never be. */
+export function automaticAccountCheckKey(account) {
+    return workspaceAttemptKey(account, automaticCheckWorkspaceId(account) ?? "");
+}
+/** Build the same key for inactive workspaces while pruning the attempt journal. */
+function workspaceAttemptKey(account, workspaceId) {
+    return `sha256:${createHash("sha256").update(JSON.stringify([
+        "automatic-check-v2", resolveAccountRecordId(account), workspaceId,
+    ])).digest("hex")}`;
+}
+/** Reject unreadable or oversized history rather than silently allowing duplicate probes. */
 async function readAttempts(path) {
     try {
         const raw = await withRetry(() => fs.readFile(path, "utf8"), retry);
@@ -25,6 +47,7 @@ async function readAttempts(path) {
         throw error;
     }
 }
+/** Atomically persist attempt timestamps before any billable network request. */
 async function saveAttempts(path, attempts) {
     const temp = tempPathFor(path);
     try {
@@ -46,7 +69,11 @@ export async function runAutomaticAccountChecks(options) {
         if (!storage || signal.aborted)
             return;
         const attempts = await readAttempts(options.path);
-        const keys = new Set(storage.accounts.map(a => getAccountPolicyKey(a)));
+        // Keep every still-saved workspace's throttle, including temporarily disabled selections.
+        const keys = new Set(storage.accounts.flatMap(account => [
+            automaticAccountCheckKey(account),
+            ...(account.workspaces ?? []).map(workspace => workspaceAttemptKey(account, workspace.id.trim())),
+        ]));
         for (const key of Object.keys(attempts))
             if (!keys.has(key))
                 delete attempts[key];
@@ -56,7 +83,7 @@ export async function runAutomaticAccountChecks(options) {
             const account = storage.accounts[index];
             if (!account)
                 continue;
-            const key = getAccountPolicyKey(account), policy = policies.accounts[key], now = options.now?.() ?? Date.now();
+            const key = automaticAccountCheckKey(account), policy = policies.accounts[getAccountPolicyKey(account)], now = options.now?.() ?? Date.now();
             if (!policy?.autoPrime || policy.paused || policy.drained || account.enabled === false || account.authInvalidatedAt || (account.coolingDownUntil ?? 0) > now)
                 continue;
             const lastAttempt = attempts[key];