codex-multi-auth 2.17.2 → 2.17.3

package/dist/lib/auth/browser.d.ts

@@ -36,4 +36,3 @@ export declare function openBrowserUrl(url: string): boolean;
  * @returns `true` if a clipboard command was launched, `false` otherwise
  */
 export declare function copyTextToClipboard(text: string): boolean;
-//# sourceMappingURL=browser.d.ts.map

package/dist/lib/auth/callback-guidance.d.ts

@@ -36,4 +36,3 @@ export type CallbackFailureContext = {
  * @returns Guidance lines. Empty strings are intentional blank separators.
  */
 export declare function describeCallbackFailure(reason: CallbackFailureReason, context?: CallbackFailureContext): string[];
-//# sourceMappingURL=callback-guidance.d.ts.map

package/dist/lib/auth/device-auth.d.ts

@@ -39,4 +39,3 @@ export declare function requestDeviceAuthorization(options?: DeviceAuthFlowOptio
 export declare function pollDeviceAuthorization(deviceCode: DeviceAuthCode, options?: DeviceAuthFlowOptions): Promise<DeviceAuthCompletionResult>;
 export declare function runDeviceAuthFlow(options?: DeviceAuthFlowOptions): Promise<TokenResult>;
 export {};
-//# sourceMappingURL=device-auth.d.ts.map

package/dist/lib/auth/index.d.ts

@@ -1,4 +1,3 @@
 export * from "./auth.js";
 export { runDeviceAuthFlow } from "./device-auth.js";
 export type { DeviceAuthFlowOptions } from "./device-auth.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/lib/auth/org-override.d.ts

@@ -16,4 +16,3 @@
  * @returns the trimmed effective override, or null when neither source provides one
  */
 export declare function resolveOrgOverride(explicitOrg?: string, env?: NodeJS.ProcessEnv): string | null;
-//# sourceMappingURL=org-override.d.ts.map

package/dist/lib/auth/server.d.ts

@@ -6,7 +6,7 @@ import type { OAuthServerInfo } from "../types.js";
  * and retains a single authorization code on the server instance until consumed via `waitForCode`.
  * Only one code is stored at a time; call `close` to abort polling and shut down the server.
  *
- * On platforms such as Windows, binding to localhost:1455 may fail if another process holds the port
+ * On platforms such as Windows, binding the callback port may fail if another process holds it
  * or if firewall/antivirus restrictions prevent local binding; in that case the returned `ready`
  * flag is `false` to allow a manual paste fallback.
  *
@@ -21,4 +21,3 @@ import type { OAuthServerInfo } from "../types.js";
 export declare function startLocalOAuthServer({ state, }: {
     state: string;
 }): Promise<OAuthServerInfo>;
-//# sourceMappingURL=server.d.ts.map

package/dist/lib/auth/server.js

@@ -7,6 +7,22 @@ import { AUTH_REDIRECT } from "./auth.js";
 // Resolve path to oauth-success.html (one level up from auth/ subfolder)
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const successHtml = fs.readFileSync(path.join(__dirname, "..", "oauth-success.html"), "utf-8");
+/**
+ * Host the callback listener actually binds.
+ *
+ * The registered redirect URI keeps its registered host name
+ * (`http://localhost:1455/auth/callback`), but the LISTEN side pins a numeric
+ * IPv4 loopback: Node resolves a listen host through DNS, and on a dual-stack
+ * host "localhost" may resolve to ::1 first (leaving 127.0.0.1 clients unable
+ * to reach the callback) or — with a hostile hosts-file entry — somewhere
+ * off-box entirely. We therefore bind BOTH numeric loopbacks: whichever family
+ * a resolver picks lands on this listener, and a holder of the other family's
+ * same port still surfaces as EADDRINUSE instead of silently receiving the
+ * callback code.
+ */
+const OAUTH_BIND_HOSTS = AUTH_REDIRECT.host === "localhost"
+    ? ["::1", "127.0.0.1"]
+    : [AUTH_REDIRECT.host];
 /**
  * Start a local HTTP server that captures an OAuth authorization code sent to /auth/callback.
  *
@@ -14,7 +30,7 @@ const successHtml = fs.readFileSync(path.join(__dirname, "..", "oauth-success.ht
  * and retains a single authorization code on the server instance until consumed via `waitForCode`.
  * Only one code is stored at a time; call `close` to abort polling and shut down the server.
  *
- * On platforms such as Windows, binding to localhost:1455 may fail if another process holds the port
+ * On platforms such as Windows, binding the callback port may fail if another process holds it
  * or if firewall/antivirus restrictions prevent local binding; in that case the returned `ready`
  * flag is `false` to allow a manual paste fallback.
  *
@@ -26,7 +42,7 @@ const successHtml = fs.readFileSync(path.join(__dirname, "..", "oauth-success.ht
  *          function to abort polling and close the server, and `waitForCode` which returns
  *          `{ code: string }` when a code becomes available or `null` on timeout/abort.
  */
-export function startLocalOAuthServer({ state, }) {
+export async function startLocalOAuthServer({ state, }) {
     let pollAborted = false;
     // Capture the authorization code/state in per-call closure variables rather
     // than mutating the shared http.Server instance. Two logins in the same
@@ -35,7 +51,7 @@ export function startLocalOAuthServer({ state, }) {
     // independent.
     let capturedCode;
     let capturedState;
-    const server = http.createServer((req, res) => {
+    const requestHandler = (req, res) => {
         try {
             const url = new URL(req.url || "", AUTH_REDIRECT.origin);
             if (url.pathname !== AUTH_REDIRECT.path) {
@@ -72,58 +88,89 @@ export function startLocalOAuthServer({ state, }) {
             res.statusCode = 500;
             res.end("Internal error");
         }
-    });
-    server.unref();
-    return new Promise((resolve) => {
-        server
-            .listen(AUTH_REDIRECT.port, AUTH_REDIRECT.host, () => {
-            resolve({
-                port: AUTH_REDIRECT.port,
-                ready: true,
-                close: () => {
-                    pollAborted = true;
-                    server.close();
-                },
-                waitForCode: async (expectedState) => {
-                    const POLL_INTERVAL_MS = 100;
-                    const TIMEOUT_MS = 5 * 60 * 1000;
-                    const maxIterations = Math.floor(TIMEOUT_MS / POLL_INTERVAL_MS);
-                    const poll = () => new Promise((r) => setTimeout(r, POLL_INTERVAL_MS));
-                    for (let i = 0; i < maxIterations; i++) {
-                        if (pollAborted)
-                            return null;
-                        const lastCode = capturedCode;
-                        if (lastCode) {
-                            if (capturedState !== expectedState) {
-                                logWarn("Discarding OAuth callback due to state mismatch in waitForCode");
-                                return null;
-                            }
-                            return { code: lastCode };
-                        }
-                        await poll();
-                    }
-                    logWarn("OAuth poll timeout after 5 minutes");
-                    return null;
-                },
+    };
+    const attempts = OAUTH_BIND_HOSTS.map((host) => {
+        const candidate = http.createServer(requestHandler);
+        candidate.unref();
+        const bound = new Promise((settle) => {
+            candidate.on("error", (err) => {
+                settle({ server: candidate, ok: false, code: err?.code });
             });
-        })
-            .on("error", (err) => {
-            logError(`Failed to bind ${AUTH_REDIRECT.origin} (${err?.code}). Falling back to manual paste.`);
-            resolve({
-                port: AUTH_REDIRECT.port,
-                ready: false,
-                bindErrorCode: err?.code,
-                close: () => {
-                    pollAborted = true;
-                    try {
-                        server.close();
-                    }
-                    catch (closeErr) {
-                        logError(`Failed to close OAuth server: ${closeErr?.message ?? String(closeErr)}`);
-                    }
-                },
-                waitForCode: (_expectedState) => Promise.resolve(null),
+            candidate.listen(AUTH_REDIRECT.port, host, () => {
+                settle({ server: candidate, ok: true });
             });
         });
+        return { candidate, bound };
     });
+    const servers = attempts.map((attempt) => attempt.candidate);
+    const closeAll = () => {
+        for (const candidate of servers) {
+            try {
+                candidate.close();
+            }
+            catch (closeErr) {
+                logError(`Failed to close OAuth server: ${closeErr?.message ?? String(closeErr)}`);
+            }
+        }
+    };
+    const waitForCode = async (expectedState) => {
+        const POLL_INTERVAL_MS = 100;
+        const TIMEOUT_MS = 5 * 60 * 1000;
+        const maxIterations = Math.floor(TIMEOUT_MS / POLL_INTERVAL_MS);
+        const poll = () => new Promise((r) => setTimeout(r, POLL_INTERVAL_MS));
+        for (let i = 0; i < maxIterations; i++) {
+            if (pollAborted)
+                return null;
+            const lastCode = capturedCode;
+            if (lastCode) {
+                if (capturedState !== expectedState) {
+                    logWarn("Discarding OAuth callback due to state mismatch in waitForCode");
+                    return null;
+                }
+                return { code: lastCode };
+            }
+            await poll();
+        }
+        logWarn("OAuth poll timeout after 5 minutes");
+        return null;
+    };
+    const outcomes = await Promise.all(attempts.map((attempt) => attempt.bound));
+    const inUse = outcomes.find((outcome) => outcome.code === "EADDRINUSE");
+    const bound = outcomes
+        .filter((outcome) => outcome.ok)
+        .map((outcome) => outcome.server);
+    if (inUse || bound.length === 0) {
+        // A holder on ANY loopback family conflicts with the registered callback
+        // URI — surface it instead of degrading to whichever family was free.
+        // When nothing bound, report the first error observed.
+        const code = inUse?.code ?? outcomes.find((outcome) => !outcome.ok)?.code;
+        logError(`Failed to bind ${AUTH_REDIRECT.origin} (${code}). Falling back to manual paste.`);
+        for (const candidate of bound) {
+            try {
+                candidate.close();
+            }
+            catch {
+                // Best effort — the port was never ours to keep anyway.
+            }
+        }
+        return {
+            port: AUTH_REDIRECT.port,
+            ready: false,
+            bindErrorCode: code,
+            close: () => {
+                pollAborted = true;
+                closeAll();
+            },
+            waitForCode: (_expectedState) => Promise.resolve(null),
+        };
+    }
+    return {
+        port: AUTH_REDIRECT.port,
+        ready: true,
+        close: () => {
+            pollAborted = true;
+            closeAll();
+        },
+        waitForCode,
+    };
 }

package/dist/lib/auth/token-utils.d.ts

@@ -125,4 +125,3 @@ export declare function resolveRuntimeRequestIdentity(input: {
  */
 export declare function sanitizeEmail(email: string | undefined): string | undefined;
 export {};
-//# sourceMappingURL=token-utils.d.ts.map

package/dist/lib/auth-rate-limit.d.ts

@@ -17,4 +17,3 @@ export declare class AuthRateLimitError extends Error {
     constructor(accountId: string, attemptsRemaining: number, resetAfterMs: number);
 }
 export declare function checkAuthRateLimit(accountId: string): void;
-//# sourceMappingURL=auth-rate-limit.d.ts.map

package/dist/lib/budget-guard.d.ts

@@ -32,9 +32,23 @@ export interface BudgetGuardEvaluation {
 export declare function getBudgetGuardPath(): string;
 export declare function normalizeBudgetKey(value: string): string | null;
 export declare function loadBudgetGuardStore(): Promise<BudgetGuardStore>;
-export declare function saveBudgetGuardStore(store: BudgetGuardStore): Promise<void>;
+export declare function saveBudgetGuardStore(store: BudgetGuardStore, baseline?: BudgetGuardStore): Promise<void>;
+/**
+ * Run a budget-guard read→mutate→write inside the write queue (in-process
+ * serialization) AND the cross-process lock directory, with mtime CAS retry:
+ * every attempt re-reads the freshest on-disk store and re-applies `mutate`
+ * before writing — so a mutation is applied to the latest committed state
+ * rather than merged by whole-record `updatedAt`, which can drop or clobber
+ * a concurrent process's change to the same key. `mutate` must be
+ * re-appliable across retries (apply precomputed work onto the store it is
+ * handed, don't capture mutated state). Prefer this over load→upsert→save
+ * whenever the caller is mutating rather than importing a foreign store.
+ */
+export declare function updateBudgetGuardStore<T>(mutate: (store: BudgetGuardStore) => {
+    result: T;
+    dirty: boolean;
+}): Promise<T>;
 export declare function upsertBudgetLimit(store: BudgetGuardStore, limit: Omit<BudgetLimit, "updatedAt">, now?: number): BudgetLimit;
 export declare function getBudgetWindowStart(window: BudgetWindow, now?: number): number;
 export declare function evaluateBudgetGuard(limit: BudgetLimit, summary: UsageSummary): BudgetGuardEvaluation;
 export declare function resetBudgetGuardWriteQueueForTests(): void;
-//# sourceMappingURL=budget-guard.d.ts.map

package/dist/lib/budget-guard.js

@@ -3,11 +3,10 @@ import { basename, join } from "node:path";
 import { logWarn } from "./logger.js";
 import { getCodexMultiAuthDir } from "./runtime-paths.js";
 import { isRecord, sleep } from "./utils.js";
-import { tempPathFor } from "./temp-path.js";
+import { getJsonStoreFileMtimeMs, resetJsonStoreWriteQueuesForTests, stampUpdatedAt, withJsonStoreCasRetry, withJsonStoreFileLock, withJsonStoreWriteQueue, writeJsonStoreFileAtomicWithRetry, } from "./storage/json-store-lock.js";
 const BUDGET_GUARD_FILE_NAME = "budget-guards.json";
 const RETRYABLE_FS_CODES = new Set(["EBUSY", "EPERM"]);
 const VALID_WINDOWS = new Set(["hour", "day", "week", "month"]);
-let writeQueue = Promise.resolve();
 function isRetryableFsError(error) {
     const code = error?.code;
     return typeof code === "string" && RETRYABLE_FS_CODES.has(code);
@@ -40,13 +39,35 @@ function normalizeLimit(key, value) {
             : 0,
     };
 }
+// Normalized keys can literally be Object.prototype member names —
+// "constructor" and "__proto__" both survive normalizeKey untouched. On a
+// plain object, reading an absent key resolves an inherited member
+// ({}.constructor === Object), which made a same-named limit look "already
+// present" to the merge and silently dropped the incoming entry; writing
+// "__proto__" invokes the setter and mutates the prototype instead of storing
+// anything. Null-prototype maps make every key a plain data slot regardless of
+// name (same convention as lib/storage/snapshot-merge.ts).
+function newLimitsMap() {
+    return Object.create(null);
+}
+// Writes into maps that callers may have built as plain object literals cannot
+// rely on the map being null-prototype, so "__proto__" needs an own-property
+// write that bypasses the inherited setter.
+function writeLimitEntry(map, key, limit) {
+    Object.defineProperty(map, key, {
+        value: limit,
+        writable: true,
+        enumerable: true,
+        configurable: true,
+    });
+}
 function emptyStore() {
-    return { version: 1, limits: {} };
+    return { version: 1, limits: newLimitsMap() };
 }
 function normalizeStore(value) {
     if (!isRecord(value) || value.version !== 1)
         return emptyStore();
-    const limits = {};
+    const limits = newLimitsMap();
     if (isRecord(value.limits)) {
         for (const [rawKey, raw] of Object.entries(value.limits)) {
             const key = normalizeKey(rawKey);
@@ -94,54 +115,113 @@ export async function loadBudgetGuardStore() {
         return emptyStore();
     }
 }
-export async function saveBudgetGuardStore(store) {
-    const path = getBudgetGuardPath();
-    const payload = normalizeStore(store);
-    const task = async () => {
-        await fs.mkdir(getCodexMultiAuthDir(), { recursive: true, mode: 0o700 });
-        const tempPath = tempPathFor(path);
-        let moved = false;
-        try {
-            await fs.writeFile(tempPath, `${JSON.stringify(payload, null, 2)}\n`, {
-                encoding: "utf8",
-                mode: 0o600,
-            });
-            for (let attempt = 0; attempt < 5; attempt += 1) {
-                try {
-                    await fs.rename(tempPath, path);
-                    moved = true;
-                    return;
-                }
-                catch (error) {
-                    if (!isRetryableFsError(error) || attempt >= 4)
-                        throw error;
-                    await sleep(10 * 2 ** attempt);
-                }
+/**
+ * Per-key merge of the caller's normalized store over the freshest on-disk
+ * store. Budget entries carry `updatedAt`; the newer entry wins per key so a
+ * save built on a stale snapshot cannot resurrect an older limit over a
+ * concurrent process's newer one. Keys the caller does not carry are
+ * preserved (upsert-only store — nothing deletes entries), matching the
+ * config save's patch-over-fresh-read semantics.
+ *
+ * When `baseline` (the caller's pre-edit snapshot) is supplied, entries
+ * identical to it are untouched carried copies and skipped entirely, so a
+ * stale snapshot row can never be re-stamped over a raced write. Entries
+ * that differ are deliberate writes and must not lose purely on timestamp:
+ * the upsert-time floor stamps against the caller's snapshot, but a
+ * concurrent writer can land a still-newer entry before this merge runs, so
+ * the merge re-stamps against the freshest on-disk entry instead of
+ * silently dropping the edit. Without a baseline every supplied entry is a
+ * plain `updatedAt >=` upsert.
+ */
+function mergeBudgetGuardLimits(current, incoming, baseline) {
+    const merged = {
+        version: 1,
+        limits: Object.assign(newLimitsMap(), current.limits),
+    };
+    const same = (a, b) => JSON.stringify(a) === JSON.stringify(b);
+    for (const [key, limit] of Object.entries(incoming.limits)) {
+        const existing = merged.limits[key];
+        if (!baseline) {
+            if (!existing || limit.updatedAt >= existing.updatedAt) {
+                merged.limits[key] = limit;
             }
+            continue;
         }
-        finally {
-            if (!moved) {
-                try {
-                    await fs.unlink(tempPath);
-                }
-                catch {
-                    // Best-effort temp cleanup.
-                }
-            }
+        if (same(limit, baseline.limits[key]))
+            continue;
+        limit.updatedAt = stampUpdatedAt(limit.updatedAt, existing?.updatedAt);
+        merged.limits[key] = limit;
+    }
+    return merged;
+}
+export async function saveBudgetGuardStore(store, baseline) {
+    const path = getBudgetGuardPath();
+    const incoming = normalizeStore(store);
+    // Normalize at invocation like `incoming`: later caller-side mutation of
+    // `baseline` must not shift which entries the merge counts as deliberate.
+    const prior = baseline ? normalizeStore(baseline) : undefined;
+    // Per-path promise queue serializes writers inside THIS process; the
+    // lock directory closes the same window against OTHER processes. Inside the lock
+    // every attempt re-stats (CAS), re-reads the freshest on-disk store, and
+    // merges this call's entries over it — so a save that raced a concurrent
+    // write reloads-and-retries rather than blindly overwriting it.
+    await withJsonStoreWriteQueue(path, async () => {
+        await withJsonStoreFileLock(path, async () => {
+            await withJsonStoreCasRetry(async () => {
+                const expectedMtimeMs = await getJsonStoreFileMtimeMs(path);
+                const current = await loadBudgetGuardStore();
+                const merged = mergeBudgetGuardLimits(current, incoming, prior);
+                await fs.mkdir(getCodexMultiAuthDir(), {
+                    recursive: true,
+                    mode: 0o700,
+                });
+                await writeJsonStoreFileAtomicWithRetry(path, merged, {
+                    expectedMtimeMs,
+                    mode: 0o600,
+                });
+            });
+        });
+    });
+}
+/**
+ * Run a budget-guard read→mutate→write inside the write queue (in-process
+ * serialization) AND the cross-process lock directory, with mtime CAS retry:
+ * every attempt re-reads the freshest on-disk store and re-applies `mutate`
+ * before writing — so a mutation is applied to the latest committed state
+ * rather than merged by whole-record `updatedAt`, which can drop or clobber
+ * a concurrent process's change to the same key. `mutate` must be
+ * re-appliable across retries (apply precomputed work onto the store it is
+ * handed, don't capture mutated state). Prefer this over load→upsert→save
+ * whenever the caller is mutating rather than importing a foreign store.
+ */
+export async function updateBudgetGuardStore(mutate) {
+    const path = getBudgetGuardPath();
+    return withJsonStoreWriteQueue(path, () => withJsonStoreFileLock(path, () => withJsonStoreCasRetry(async () => {
+        const expectedMtimeMs = await getJsonStoreFileMtimeMs(path);
+        const store = await loadBudgetGuardStore();
+        const { result, dirty } = mutate(store);
+        if (dirty) {
+            await fs.mkdir(getCodexMultiAuthDir(), {
+                recursive: true,
+                mode: 0o700,
+            });
+            await writeJsonStoreFileAtomicWithRetry(path, normalizeStore(store), { expectedMtimeMs, mode: 0o600 });
         }
-    };
-    const queued = writeQueue.catch(() => undefined).then(task);
-    writeQueue = queued.then(() => undefined, () => undefined);
-    await queued;
+        return result;
+    })));
 }
 export function upsertBudgetLimit(store, limit, now = Date.now()) {
     const key = normalizeKey(limit.key);
     if (!key)
         throw new Error("Budget key is required");
-    const next = normalizeLimit(key, { ...limit, key, updatedAt: now });
+    const next = normalizeLimit(key, {
+        ...limit,
+        key,
+        updatedAt: stampUpdatedAt(now, store.limits[key]?.updatedAt),
+    });
     if (!next)
         throw new Error("Invalid budget limit");
-    store.limits[key] = next;
+    writeLimitEntry(store.limits, key, next);
     return next;
 }
 export function getBudgetWindowStart(window, now = Date.now()) {
@@ -207,5 +287,5 @@ export function evaluateBudgetGuard(limit, summary) {
     };
 }
 export function resetBudgetGuardWriteQueueForTests() {
-    writeQueue = Promise.resolve();
+    resetJsonStoreWriteQueuesForTests(getBudgetGuardPath());
 }

package/dist/lib/capability-policy.d.ts

@@ -15,4 +15,3 @@ export declare class CapabilityPolicyStore {
     clearAccount(accountKey: string): number;
     private evictIfNeeded;
 }
-//# sourceMappingURL=capability-policy.d.ts.map

package/dist/lib/circuit-breaker.d.ts

@@ -9,6 +9,20 @@ export type CircuitState = "closed" | "open" | "half-open";
 export declare class CircuitOpenError extends Error {
     constructor(message?: string);
 }
+/**
+ * Non-throwing admission result, for hot paths that would otherwise pay for a
+ * {@link CircuitOpenError} allocation on every rejection during a storm.
+ * `reason` names the gate that rejected so callers can keep their own error
+ * taxonomy without parsing exception messages.
+ */
+export type CircuitAdmissionResult = {
+    ok: true;
+} | {
+    ok: false;
+    reason: "open" | "half-open";
+    /** Milliseconds until a fresh attempt may be admitted. */
+    retryAfterMs: number;
+};
 export declare class CircuitBreaker {
     private state;
     private failures;
@@ -16,6 +30,12 @@ export declare class CircuitBreaker {
     private halfOpenAttempts;
     private config;
     constructor(config?: Partial<CircuitBreakerConfig>);
+    /**
+     * Same admission decision as {@link canExecute} but returns a result
+     * object instead of throwing, so reject-heavy callers stay exception-free.
+     * Admitting a probe still consumes the half-open attempt slot.
+     */
+    tryCanExecute(): CircuitAdmissionResult;
     canExecute(): boolean;
     isAvailable(now?: number): boolean;
     recordSuccess(): void;
@@ -41,4 +61,3 @@ export declare function clearCircuitBreakers(): void;
  * than inheriting an open one (accounts-02).
  */
 export declare function removeCircuitBreaker(key: string): void;
-//# sourceMappingURL=circuit-breaker.d.ts.map

package/dist/lib/circuit-breaker.js

@@ -19,14 +19,23 @@ export class CircuitBreaker {
     constructor(config = {}) {
         this.config = { ...DEFAULT_CIRCUIT_BREAKER_CONFIG, ...config };
     }
-    canExecute() {
+    /**
+     * Same admission decision as {@link canExecute} but returns a result
+     * object instead of throwing, so reject-heavy callers stay exception-free.
+     * Admitting a probe still consumes the half-open attempt slot.
+     */
+    tryCanExecute() {
         const now = Date.now();
         if (this.state === "open") {
             if (now - this.lastStateChange >= this.config.resetTimeoutMs) {
                 this.transitionToHalfOpen(now);
             }
             else {
-                throw new CircuitOpenError();
+                return {
+                    ok: false,
+                    reason: "open",
+                    retryAfterMs: Math.max(0, this.config.resetTimeoutMs - (now - this.lastStateChange)),
+                };
             }
         }
         if (this.state === "half-open") {
@@ -35,13 +44,23 @@ export class CircuitBreaker {
                     this.resetHalfOpenProbeWindow(now);
                 }
                 else {
-                    throw new CircuitOpenError("Circuit is half-open");
+                    return {
+                        ok: false,
+                        reason: "half-open",
+                        retryAfterMs: Math.max(0, this.config.resetTimeoutMs - (now - this.lastStateChange)),
+                    };
                 }
             }
             this.halfOpenAttempts += 1;
-            return true;
+            return { ok: true };
         }
-        return true;
+        return { ok: true };
+    }
+    canExecute() {
+        const result = this.tryCanExecute();
+        if (result.ok)
+            return true;
+        throw new CircuitOpenError(result.reason === "half-open" ? "Circuit is half-open" : "Circuit is open");
     }
     isAvailable(now = Date.now()) {
         if (this.state === "open") {

package/dist/lib/cli.d.ts

@@ -68,4 +68,3 @@ export interface AccountSelectionOptions {
 export declare function promptAccountSelection(candidates: AccountSelectionCandidate[], options?: AccountSelectionOptions): Promise<AccountSelectionCandidate | null>;
 export { isTTY };
 export type { AccountStatus };
-//# sourceMappingURL=cli.d.ts.map

package/dist/lib/codex-cli/index.d.ts

@@ -2,4 +2,3 @@ export * from "./observability.js";
 export * from "./state.js";
 export * from "./sync.js";
 export * from "./writer.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/lib/codex-cli/observability.d.ts

@@ -19,4 +19,3 @@ export declare function makeAccountFingerprint(input: {
     accountId?: string;
     email?: string;
 }): string | undefined;
-//# sourceMappingURL=observability.d.ts.map

package/dist/lib/codex-cli/state.d.ts

@@ -99,4 +99,3 @@ export declare function loadCodexCliState(options?: {
 export declare function lookupCodexCliTokensByEmail(email: string | undefined): Promise<CodexCliTokenCacheEntry | null>;
 export declare function clearCodexCliStateCache(): void;
 export declare function __resetCodexCliWarningCacheForTests(): void;
-//# sourceMappingURL=state.d.ts.map

package/dist/lib/codex-cli/sync.d.ts

@@ -17,4 +17,3 @@ export declare function syncAccountStorageFromCodexCli(current: AccountStorageV3
     changed: boolean;
 }>;
 export declare function getActiveSelectionForFamily(storage: AccountStorageV3, family: ModelFamily): number;
-//# sourceMappingURL=sync.d.ts.map

package/dist/lib/codex-cli/writer.d.ts

@@ -60,4 +60,3 @@ export declare function ensureCodexCliFileAuthStore(configPath?: string): Promis
 export declare function setCodexCliActiveSelection(selection: ActiveSelection): Promise<boolean>;
 export declare function getLastCodexCliSelectionWriteTimestamp(): number;
 export {};
-//# sourceMappingURL=writer.d.ts.map

package/dist/lib/codex-manager/account-credentials.d.ts

@@ -10,4 +10,3 @@ export declare function applyTokenAccountIdentity(account: {
     accountId?: string;
     accountIdSource?: AccountIdSource;
 }, tokenAccountId: string | undefined): boolean;
-//# sourceMappingURL=account-credentials.d.ts.map

package/dist/lib/codex-manager/account-manager-commands.d.ts

@@ -11,4 +11,3 @@
  * @internal
  */
 export declare const ACCOUNT_MANAGER_COMMANDS: Set<string>;
-//# sourceMappingURL=account-manager-commands.d.ts.map

package/dist/lib/codex-manager/account-pool-write.d.ts

@@ -102,4 +102,3 @@ export declare function applyAccountPoolResults(params: {
     activeIndex: number;
     outcome: AccountPoolWriteOutcome | null;
 };
-//# sourceMappingURL=account-pool-write.d.ts.map

package/dist/lib/codex-manager/active-account-sync.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Test-only: clear the storage-fingerprint cache so each test re-reads from
+ * disk instead of inheriting a previous scenario's "already synced" state.
+ */
+export declare function resetActiveAccountSyncMetaForTests(): void;
+export declare function autoSyncActiveAccountToCodex(): Promise<boolean>;