codex-multi-auth 2.17.2 → 2.18.0

package/dist/lib/recovery/types.d.ts

@@ -105,4 +105,3 @@ export interface ToolResultPart {
     content: string;
 }
 export {};
-//# sourceMappingURL=types.d.ts.map

package/dist/lib/recovery.d.ts

@@ -28,4 +28,3 @@ export interface SessionRecoveryContext {
     directory: string;
 }
 export declare function createSessionRecoveryHook(ctx: SessionRecoveryContext, config: PluginConfig): SessionRecoveryHook | null;
-//# sourceMappingURL=recovery.d.ts.map

package/dist/lib/redaction.d.ts

@@ -14,4 +14,3 @@
 export declare function maskEmail(value: string): string;
 /** Mask every address embedded in a free-text string. */
 export declare function redactEmails(value: string): string;
-//# sourceMappingURL=redaction.d.ts.map

package/dist/lib/refresh-guardian.d.ts

@@ -31,4 +31,3 @@ export declare class RefreshGuardian {
     private applyRefreshOutcome;
     tick(): Promise<void>;
 }
-//# sourceMappingURL=refresh-guardian.d.ts.map

package/dist/lib/refresh-lease.d.ts

@@ -47,4 +47,3 @@ export declare class RefreshLeaseCoordinator {
     private pruneExpiredArtifacts;
 }
 export {};
-//# sourceMappingURL=refresh-lease.d.ts.map

package/dist/lib/refresh-queue.d.ts

@@ -113,4 +113,3 @@ export declare function resetRefreshQueue(): void;
  * @returns Token result
  */
 export declare function queuedRefresh(refreshToken: string): Promise<TokenResult>;
-//# sourceMappingURL=refresh-queue.d.ts.map

package/dist/lib/request/client-cancellation.d.ts

@@ -2,4 +2,3 @@
 export declare class ClientCancellationError extends Error {
     constructor();
 }
-//# sourceMappingURL=client-cancellation.d.ts.map

package/dist/lib/request/error-classification.d.ts

@@ -79,4 +79,3 @@ export declare function isWorkspaceDisabledError(status: number, code: unknown,
  * @returns A 403 Response with a JSON body describing the entitlement error and guidance for resolving it
  */
 export declare function createEntitlementErrorResponse(_bodyText: string): Response;
-//# sourceMappingURL=error-classification.d.ts.map

package/dist/lib/request/error-classification.js

@@ -12,66 +12,55 @@ const CHATGPT_CODEX_UNSUPPORTED_MODEL_PATTERN = /model is not supported when usi
 const NORMALIZED_UNSUPPORTED_MODEL_PATTERN = /the model ['"]([^'"]+)['"] is not currently available for this chatgpt account/i;
 const MODEL_ACCESS_DENIED_PATTERN = /the model [`'"]([^`'"]+)[`'"] does not exist or you do not have access to it/i;
 export const DEFAULT_UNSUPPORTED_CODEX_FALLBACK_CHAIN = {
-    // GPT-6 Astra rolls out org by org, so an account that is not entitled yet
-    // gets a real unsupported-model response for it. This chain only fires when
-    // the user has opted into `fallbackOnUnsupportedCodexModel` (default
-    // `false`), and only on that response, so it never silently swaps the model
-    // out from under a request the account could have served.
+    // GPT-6 models roll out org by org, so an account that is not entitled yet
+    // gets a real unsupported-model response for them. This chain only fires
+    // when the user has opted into `fallbackOnUnsupportedCodexModel` (default
+    // `false`), and only on that response, so it never silently swaps the
+    // model out from under a request the account could have served.
     //
     // This table is walked ONE HOP AT A TIME, not as a per-request candidate
-    // list. index.ts reassigns `model` to whatever came back and passes that as
-    // `requestedModel` on the next unsupported response, so reaching `gpt-5.5`
-    // from Astra requires `gpt-5.6-sol` to carry its own entry below. A second
-    // element here is only ever consulted when the first is already in
-    // `attemptedModels` for that same call.
+    // list. index.ts reassigns `model` to whatever came back and passes that
+    // as `requestedModel` on the next unsupported response, so reaching the
+    // terminal models from a launch model requires every intermediate model
+    // to carry its own entry below. A second element here is only ever
+    // consulted when the first is already in `attemptedModels` for that same
+    // call.
     //
-    // Depth is not free: every hop spends one of the shared per-request outbound
-    // attempts (`tryConsumeOutboundRequestAttempt`). A single-account balanced
-    // session gets a budget of 5, and the aeon walk needs 4 (it needed all 5
-    // until `gpt-5.4` was retired as the floor), leaving one attempt for a retry
-    // or a stream failover. Spend two and the tail hop becomes unreachable,
-    // ending as an attempt-budget-exhausted 503 rather than `gpt-5.5`. Hops are
+    // Depth is not free: every hop spends one of the shared per-request
+    // outbound attempts (`tryConsumeOutboundRequestAttempt`). A single-account
+    // balanced session gets a budget of 5, and the deepest walks — 6.1 Sol and
+    // the retired ids that migrate through Astra — spend all 5, the same shape
+    // the aeon walk had before `gpt-5.4` was retired as the floor. Hops are
     // ordered most-valuable-first so what is lost first matters least. Do not
-    // add a hop to a GPT-6 row without
-    // re-checking that budget; `test/gpt6-astra-models.test.ts` asserts it.
-    "gpt-6-astra": ["gpt-5.6-sol", "gpt-5.5"],
-    // aeon steps to the flagship first: still GPT-6, still Astra, just without
-    // the long-horizon behaviour.
-    "gpt-6-astra-aeon": ["gpt-6-astra", "gpt-5.6-sol"],
-    // Sol and Luna step to the 5.6 tier they replace, never sideways into Astra:
-    // an account without the new tier is far likelier to lack Astra too, and
-    // Astra is the priciest hop available ($10/$50 per 1M against Luna's
-    // $0.10/$0.50). Every hop on these walks still costs more than Luna itself.
+    // add a hop to a GPT-6 row without re-checking that budget;
+    // `test/gpt6-astra-models.test.ts` asserts it.
+    "gpt-6.1-sol": ["gpt-6-sol"],
+    // Astra steps to the workhorse rather than to a smaller tier: an account
+    // without the flagship is still likelier than not to hold the standard
+    // GPT-6 tier, and `gpt-6-sol` keeps the walk inside the generation.
+    "gpt-6-astra": ["gpt-6-sol"],
+    // Sol and Luna step to the 5.6 tier they replace, never sideways into a
+    // pricier model: an account without the new tier is far likelier to lack
+    // Astra too, and Astra is the priciest hop available ($10/$50 per 1M
+    // against Luna's $0.10/$0.50). Every hop on these walks still costs more
+    // than Luna itself.
     "gpt-6-sol": ["gpt-5.6-sol"],
     "gpt-6-luna": ["gpt-5.6-luna"],
-    // The hop that makes the Astra path reach a model every account has. GPT-5.6
-    // shipped without a chain entry, so an unsupported 5.6 response ended the
-    // walk; with Astra above it that would have stranded the fallback one rung
-    // short of the floor it documents.
-    "gpt-5.6-sol": ["gpt-5.5"],
-    // Luna gained its row once `gpt-6-luna` started stepping into it; without
-    // it the Luna walk would stop one rung short of `gpt-5.5`, the same
-    // stranding the Sol row fixed. It also applies to a direct `gpt-5.6-luna`
-    // request, which used to end its walk on an unsupported response and now
-    // retries on the pricier `gpt-5.5`.
-    "gpt-5.6-luna": ["gpt-5.5"],
-    // Terra gained its row once the retired codex minis and `gpt-5-mini` began
-    // stepping into it; without it those walks stopped at Terra instead of the
-    // `gpt-5.5` floor every other retired id reaches.
-    "gpt-5.6-terra": ["gpt-5.5"],
-    "gpt-5": ["gpt-5.5"],
-    "gpt-5-pro": ["gpt-5.5-pro"],
-    "gpt-5.5-2026-04-23": ["gpt-5.5"],
-    "gpt-5.5-20260423": ["gpt-5.5"],
-    "gpt-5.5-pro-2026-04-23": ["gpt-5.5-pro"],
-    "gpt-5.5-pro-20260423": ["gpt-5.5-pro"],
-    // `gpt-5.5` and `gpt-5.5-pro` are the floor: they used to step to `gpt-5.4`,
-    // which the Codex backend no longer serves (`retirement_at: 2026-08-31` in
-    // the upstream catalog), so that hop could only ever fail.
-    //
+    // The hop that makes every general walk reach a model almost every account
+    // has: `gpt-6-luna` ships on the most plans of any catalog model, which is
+    // why the quota-probe chain also ends on it.
+    "gpt-5.6-sol": ["gpt-6-luna"],
+    // Luna's own row crosses to Sol rather than stopping: a `gpt-5.6-luna`
+    // request whose tier is absent retries on the same-generation workhorse
+    // instead of ending on an unsupported response.
+    "gpt-5.6-luna": ["gpt-5.6-sol"],
+    "gpt-5.6-terra": ["gpt-5.6-sol"],
+    "gpt-5": ["gpt-5.6-sol"],
+    "gpt-5-pro": ["gpt-6-astra"],
     // A retired id still reaches the backend verbatim through the pass-through
     // rotation proxy, and the backend rejects it as unsupported. One hop to the
-    // replacement OpenAI names for it turns that into a working request.
+    // replacement OpenAI names for it turns that into a working request, and
+    // from there the same staircase above continues toward Luna.
     ...Object.fromEntries(Object.entries(RETIRED_MODEL_REPLACEMENTS).map(([retired, replacement]) => [
         retired,
         [replacement],

package/dist/lib/request/failover-config.d.ts

@@ -1,4 +1,3 @@
 import type { FailoverMode } from "./failure-policy.js";
 export declare function parseFailoverMode(value: string | undefined): FailoverMode;
 export declare function parseEnvInt(value: string | undefined): number | undefined;
-//# sourceMappingURL=failover-config.d.ts.map

package/dist/lib/request/failure-policy.d.ts

@@ -39,4 +39,3 @@ export declare function evaluateFailurePolicy(input: FailurePolicyInput, overrid
     networkCooldownMs?: number;
     serverCooldownMs?: number;
 }): FailurePolicyDecision;
-//# sourceMappingURL=failure-policy.d.ts.map

package/dist/lib/request/fetch-helpers.d.ts

@@ -79,4 +79,3 @@ export declare function handleSuccessResponse(response: Response, isStreaming: b
     onUsage?: (usage: UsageTokenCounts) => void;
     streamStallTimeoutMs?: number;
 }): Promise<Response>;
-//# sourceMappingURL=fetch-helpers.d.ts.map

package/dist/lib/request/fetch-helpers.js

@@ -252,7 +252,7 @@ function normalizeErrorPayload(errorBody, bodyText, statusText, status, diagnost
             error: {
                 message: `The model '${unsupportedModel}' is not currently available for this ChatGPT account when using Codex OAuth. ` +
                     "This is an account/workspace entitlement gate, not a temporary rate limit. " +
-                    "Try 'gpt-5.6-sol' or 'gpt-5.5', or enable automatic fallback via " +
+                    "Try 'gpt-6.1-sol' or 'gpt-5.6-sol', or enable automatic fallback via " +
                     'unsupportedCodexPolicy: "fallback" (or CODEX_AUTH_UNSUPPORTED_MODEL_POLICY=fallback). ' +
                     "(Legacy: CODEX_AUTH_FALLBACK_UNSUPPORTED_MODEL=1 or fallbackOnUnsupportedCodexModel).",
                 type: "entitlement_error",

package/dist/lib/request/headers.d.ts

@@ -30,4 +30,3 @@ export declare function createCodexHeaders(init: RequestInit | undefined, accoun
  * @internal Exported only for sibling lib/request modules; import via fetch-helpers.ts elsewhere.
  */
 export declare function logDeprecationHeaders(response: Response): void;
-//# sourceMappingURL=headers.d.ts.map

package/dist/lib/request/helpers/input-utils.d.ts

@@ -4,4 +4,3 @@ export declare function isHostSystemPrompt(item: InputItem, cachedPrompt: string
 export declare function filterHostSystemPromptsWithCachedPrompt(input: InputItem[] | undefined, cachedPrompt: string | null): InputItem[] | undefined;
 export declare const normalizeOrphanedToolOutputs: (input: InputItem[]) => InputItem[];
 export declare const injectMissingToolOutputs: (input: InputItem[]) => InputItem[];
-//# sourceMappingURL=input-utils.d.ts.map

package/dist/lib/request/helpers/input-utils.js

@@ -49,47 +49,78 @@ const extractHostContext = (contentText) => {
         return null;
     return contentText.slice(earliestIndex).trimStart();
 };
-export function isHostSystemPrompt(item, cachedPrompt) {
-    const isSystemRole = item.role === "developer" || item.role === "system";
-    if (!isSystemRole)
-        return false;
-    const contentText = getContentText(item);
+/**
+ * Normalizes the cached host prompt once per filter pass so the per-item
+ * checks do not re-trim/re-slice the same string.
+ */
+const prepareCachedPrompt = (cachedPrompt) => {
+    if (!cachedPrompt)
+        return null;
+    const trimmed = cachedPrompt.trim();
+    return { trimmed, prefix: trimmed.substring(0, 200) };
+};
+const isHostPromptContent = (contentText, cached) => {
     if (!contentText)
         return false;
-    if (cachedPrompt) {
+    if (cached) {
         const contentTrimmed = contentText.trim();
-        const cachedTrimmed = cachedPrompt.trim();
-        if (contentTrimmed === cachedTrimmed) {
+        if (contentTrimmed === cached.trimmed) {
             return true;
         }
-        if (contentTrimmed.startsWith(cachedTrimmed)) {
+        if (contentTrimmed.startsWith(cached.trimmed)) {
             return true;
         }
         const contentPrefix = contentTrimmed.substring(0, 200);
-        const cachedPrefix = cachedTrimmed.substring(0, 200);
-        if (contentPrefix === cachedPrefix) {
+        if (contentPrefix === cached.prefix) {
             return true;
         }
     }
     const normalized = contentText.trimStart().toLowerCase();
     return HOST_PROMPT_SIGNATURES.some((signature) => normalized.startsWith(signature));
+};
+export function isHostSystemPrompt(item, cachedPrompt) {
+    const isSystemRole = item.role === "developer" || item.role === "system";
+    if (!isSystemRole)
+        return false;
+    return isHostPromptContent(getContentText(item), prepareCachedPrompt(cachedPrompt));
 }
 export function filterHostSystemPromptsWithCachedPrompt(input, cachedPrompt) {
     if (!Array.isArray(input))
         return input;
-    return input.flatMap((item) => {
-        if (item.role === "user")
-            return [item];
-        if (!isHostSystemPrompt(item, cachedPrompt)) {
-            return [item];
+    const cached = prepareCachedPrompt(cachedPrompt);
+    // Copy-on-write: most items pass through untouched, so the result array is
+    // only materialized once an item is actually dropped or rewritten.
+    let filtered = null;
+    for (let i = 0; i < input.length; i++) {
+        // flatMap skips sparse holes entirely; an explicit `undefined` element
+        // still reaches the callback and throws on `.role` — mirrored below.
+        if (!(i in input)) {
+            if (filtered === null)
+                filtered = input.slice(0, i);
+            continue;
+        }
+        const item = input[i];
+        const isSystemRole = item.role === "developer" || item.role === "system";
+        if (!isSystemRole) {
+            if (filtered !== null)
+                filtered.push(item);
+            continue;
         }
         const contentText = getContentText(item);
+        if (!isHostPromptContent(contentText, cached)) {
+            if (filtered !== null)
+                filtered.push(item);
+            continue;
+        }
         const preservedContext = extractHostContext(contentText);
+        if (filtered === null) {
+            filtered = input.slice(0, i);
+        }
         if (preservedContext) {
-            return [replaceContentText(item, preservedContext)];
+            filtered.push(replaceContentText(item, preservedContext));
         }
-        return [];
-    });
+    }
+    return filtered ?? input;
 }
 const getCallId = (item) => {
     const rawCallId = item.call_id;
@@ -103,13 +134,16 @@ const convertOrphanedOutputToMessage = (item, callId) => {
         ? item.name
         : "tool";
     const labelCallId = callId ?? "unknown";
+    // Read `.output` once: the catch fallback must use the same value —
+    // re-reading a throwing getter inside the catch would just re-throw.
+    const out = item.output;
     let text;
     try {
-        const out = item.output;
-        text = typeof out === "string" ? out : JSON.stringify(out);
+        text =
+            typeof out === "string" ? out : (JSON.stringify(out) ?? "");
     }
     catch {
-        text = String(item.output ?? "");
+        text = String(out ?? "");
     }
     if (text.length > 16000) {
         text = text.slice(0, 16000) + "\n...[truncated]";
@@ -146,31 +180,43 @@ const collectCallIds = (input) => {
 };
 export const normalizeOrphanedToolOutputs = (input) => {
     const { functionCallIds, localShellCallIds, customToolCallIds } = collectCallIds(input);
-    return input.map((item) => {
+    // Copy-on-write: items pass through by reference until an output actually
+    // needs converting; an unchanged input returns the original array instead
+    // of a per-item `map` copy.
+    let mapped = null;
+    for (let i = 0; i < input.length; i++) {
+        const item = input[i];
+        let converted = item;
         if (item.type === "function_call_output") {
             const callId = getCallId(item);
             const hasMatch = !!callId &&
                 (functionCallIds.has(callId) || localShellCallIds.has(callId));
             if (!hasMatch) {
-                return convertOrphanedOutputToMessage(item, callId);
+                converted = convertOrphanedOutputToMessage(item, callId);
             }
         }
-        if (item.type === "custom_tool_call_output") {
+        else if (item.type === "custom_tool_call_output") {
             const callId = getCallId(item);
             const hasMatch = !!callId && customToolCallIds.has(callId);
             if (!hasMatch) {
-                return convertOrphanedOutputToMessage(item, callId);
+                converted = convertOrphanedOutputToMessage(item, callId);
             }
         }
-        if (item.type === "local_shell_call_output") {
+        else if (item.type === "local_shell_call_output") {
             const callId = getCallId(item);
             const hasMatch = !!callId && localShellCallIds.has(callId);
             if (!hasMatch) {
-                return convertOrphanedOutputToMessage(item, callId);
+                converted = convertOrphanedOutputToMessage(item, callId);
             }
         }
-        return item;
-    });
+        if (converted !== item && mapped === null) {
+            mapped = input.slice(0, i);
+        }
+        if (mapped !== null) {
+            mapped.push(converted);
+        }
+    }
+    return mapped ?? input;
 };
 const CANCELLED_TOOL_OUTPUT = "Operation cancelled by user";
 const collectOutputCallIds = (input) => {
@@ -188,9 +234,14 @@ const collectOutputCallIds = (input) => {
 };
 export const injectMissingToolOutputs = (input) => {
     const outputCallIds = collectOutputCallIds(input);
-    const result = [];
-    for (const item of input) {
-        result.push(item);
+    // Copy-on-write: items pass through by reference; the result array is only
+    // materialized when a synthetic output is actually injected.
+    let result = null;
+    for (let i = 0; i < input.length; i++) {
+        const item = input[i];
+        if (result !== null) {
+            result.push(item);
+        }
         if (item.type === "function_call" ||
             item.type === "local_shell_call" ||
             item.type === "custom_tool_call") {
@@ -201,6 +252,9 @@ export const injectMissingToolOutputs = (input) => {
                     : item.type === "local_shell_call"
                         ? "local_shell_call_output"
                         : "custom_tool_call_output";
+                if (result === null) {
+                    result = input.slice(0, i + 1);
+                }
                 result.push({
                     type: outputType,
                     call_id: callId,
@@ -209,5 +263,5 @@ export const injectMissingToolOutputs = (input) => {
             }
         }
     }
-    return result;
+    return result ?? input;
 };

package/dist/lib/request/helpers/model-map.d.ts

@@ -40,9 +40,9 @@ export interface ModelProfile {
  * still read naturally.
  */
 export declare const CURRENT_CODEX_MODEL = "gpt-5.6-sol";
-export declare const DEFAULT_MODEL = "gpt-5.5";
+export declare const DEFAULT_MODEL = "gpt-6.1-sol";
 export declare const DEFAULT_PROBE_MODEL = "gpt-5.6-sol";
-export declare const QUOTA_PROBE_MODEL_CHAIN: readonly ["gpt-5.6-sol", "gpt-5.5", "gpt-6-luna"];
+export declare const QUOTA_PROBE_MODEL_CHAIN: readonly ["gpt-5.6-sol", "gpt-6.1-sol", "gpt-6-luna"];
 /**
  * Effective model profiles keyed by canonical model name.
  *
@@ -99,4 +99,3 @@ export declare function resolveProbeReasoningEffort(model: string | undefined):
  * `resolveNormalizedModel()` if you want the fallback behavior.
  */
 export declare function isKnownModel(modelId: string): boolean;
-//# sourceMappingURL=model-map.d.ts.map