codex-multi-auth 2.17.3 → 2.19.0

package/dist/lib/codex-manager/health-check.js

@@ -1,3 +1,6 @@
+import { subscriptionStatus, formatSubscriptionStatus } from "./formatters/subscription-status.js";
+import { getAccountPolicyKey, loadAccountPolicyStore } from "../account-policy.js";
+import { automaticCheckWorkspaceId } from "../runtime/automatic-account-checks.js";
 import { refreshAndPrintResetCredits } from "../runtime/account-reset-credits.js";
 import { mapWithConcurrency } from "../concurrency.js";
 import { withCheckProgress } from "../ui/check-progress.js";
@@ -16,7 +19,7 @@ import { loadAccounts, saveAccounts, setStoragePath } from "../storage.js";
 import { applyTokenAccountIdentity, hasLikelyInvalidRefreshToken, hasUsableAccessToken, } from "./account-credentials.js";
 import { saveAccountsWithRetry } from "./forecast-report-shared.js";
 import { formatModelInspection, formatQuotaSnapshotForDashboard, formatResultSummary, inspectRequestedModel, normalizeFailureDetail, styleAccountDetailText, stylePromptText, } from "./formatters/index.js";
-import { cloneQuotaCacheData, DEFAULT_LIVE_PROBE_MODEL, pruneUnsafeQuotaEmailCacheEntry, updateQuotaCacheForAccount, } from "./quota-cache-helpers.js";
+import { cloneQuotaCacheData, DEFAULT_LIVE_PROBE_MODEL, pruneUnsafeQuotaEmailCacheEntry, updateQuotaCacheForWorkspace, } from "./quota-cache-helpers.js";
 function appendAuthInvalidationMarker(account, detail) {
     return typeof account.authInvalidatedAt === "number" &&
         Number.isFinite(account.authInvalidatedAt)
@@ -44,6 +47,8 @@ export async function runHealthCheck(options = {}) {
     let quotaEmailFallbackState = liveProbe && quotaCache
         ? buildQuotaEmailFallbackState(storage.accounts)
         : null;
+    const policies = await loadAccountPolicyStore({ strict: true }).catch(() => null);
+    const subscriptionLine = (account, snapshot) => formatSubscriptionStatus(subscriptionStatus(account, { ...snapshot, updatedAt: snapshot.observedAt ?? Date.now() }, policies ? policies.accounts[getAccountPolicyKey(account)] ?? {} : undefined, Date.now()));
     let changed = false;
     let ok = 0;
     let failed = 0;
@@ -62,7 +67,7 @@ export async function runHealthCheck(options = {}) {
     const quickProbes = new Map();
     if (liveProbe && !forceRefresh) {
         const candidates = storage.accounts.flatMap((account, index) => {
-            const accountId = account.accountId ?? extractAccountId(account.accessToken);
+            const accountId = automaticCheckWorkspaceId(account);
             return hasUsableAccessToken(account, now) && account.accessToken && accountId
                 ? [{ index, accountId, accessToken: account.accessToken }] : [];
         });
@@ -104,14 +109,14 @@ export async function runHealthCheck(options = {}) {
             if (liveProbe) {
                 const currentAccessToken = account.accessToken;
                 const probeAccountId = currentAccessToken
-                    ? (account.accountId ?? extractAccountId(currentAccessToken))
+                    ? automaticCheckWorkspaceId(account)
                     : undefined;
                 if (!probeAccountId || !currentAccessToken) {
                     warnings += 1;
                     signedInOnly += 1;
                     healthTone = "warning";
                     healthDetail =
-                        "signed in (live check skipped: missing account ID)";
+                        "signed in (live check skipped: missing account ID or unavailable selected workspace)";
                 }
                 else {
                     try {
@@ -124,10 +129,10 @@ export async function runHealthCheck(options = {}) {
                             model: modelInspection.normalized,
                         }), console.log);
                         if (workingQuotaCache) {
-                            quotaCacheChanged =
-                                updateQuotaCacheForAccount(workingQuotaCache, account, snapshot, storage.accounts, quotaEmailFallbackState ?? undefined) || quotaCacheChanged;
+                            updateQuotaCacheForWorkspace(workingQuotaCache, account, probeAccountId, snapshot, storage.accounts);
+                            quotaCacheChanged = true;
                         }
-                        healthDetail = formatQuotaSnapshotForDashboard(snapshot, display);
+                        healthDetail = formatQuotaSnapshotForDashboard(snapshot, display) + " | " + subscriptionLine(account, snapshot);
                         if (snapshot.primingFailure) {
                             healthTone = "warning";
                             warnings += 1;
@@ -210,13 +215,13 @@ export async function runHealthCheck(options = {}) {
             let healthyMessage = "working now";
             let healthyTone = "success";
             if (liveProbe) {
-                const probeAccountId = account.accountId ?? tokenAccountId;
+                const probeAccountId = automaticCheckWorkspaceId(account);
                 if (!probeAccountId) {
                     warnings += 1;
                     signedInOnly += 1;
                     healthyTone = "warning";
                     healthyMessage =
-                        "signed in (live check skipped: missing account ID)";
+                        "signed in (live check skipped: missing account ID or unavailable selected workspace)";
                 }
                 else {
                     try {
@@ -226,10 +231,10 @@ export async function runHealthCheck(options = {}) {
                             model: modelInspection.normalized,
                         }), console.log);
                         if (workingQuotaCache) {
-                            quotaCacheChanged =
-                                updateQuotaCacheForAccount(workingQuotaCache, account, snapshot, storage.accounts, quotaEmailFallbackState ?? undefined) || quotaCacheChanged;
+                            updateQuotaCacheForWorkspace(workingQuotaCache, account, probeAccountId, snapshot, storage.accounts);
+                            quotaCacheChanged = true;
                         }
-                        healthyMessage = formatQuotaSnapshotForDashboard(snapshot, display);
+                        healthyMessage = formatQuotaSnapshotForDashboard(snapshot, display) + " | " + subscriptionLine(account, snapshot);
                         if (snapshot.primingFailure) {
                             healthyTone = "warning";
                             warnings += 1;

package/dist/lib/codex-manager/quota-cache-helpers.js

@@ -1,4 +1,5 @@
 import { buildQuotaEmailFallbackState, findQuotaCacheEntryForAccount, quotaWorkspaceKey, hasSafeQuotaEmailFallback, hasUniqueQuotaAccountId, normalizeQuotaAccountId, normalizeQuotaEmail, } from "../quota-readiness.js";
+import { mergeQuotaCacheEntry, } from "../quota-cache.js";
 import { DEFAULT_MODEL, DEFAULT_PROBE_MODEL, } from "../request/helpers/model-map.js";
 import { getRateLimitResetTimeForFamily } from "../runtime/account-status.js";
 /**
@@ -41,7 +42,10 @@ export function getPersistedQuotaViewForAccount(cache, account, accounts, now, e
 /** Retain only quota fields from a probe, never its credentials or response body. */
 function quotaEntryFromSnapshot(snapshot) {
     return {
-        updatedAt: Date.now(),
+        ...(snapshot.primingCompleted ? { primingCompleted: true } : {}),
+        ...(snapshot.primingFailure ? { primingFailure: snapshot.primingFailure } : {}),
+        ...(snapshot.primingCompleted || snapshot.primingFailure ? { primingObservedAt: snapshot.primingObservedAt ?? Date.now() } : {}),
+        updatedAt: snapshot.observedAt ?? Date.now(),
         status: snapshot.status,
         model: snapshot.model,
         planType: snapshot.planType,
@@ -64,14 +68,14 @@ export function updateQuotaCacheForAccount(cache, account, snapshot, accounts, e
     const accountId = normalizeQuotaAccountId(account.accountId);
     const hasUniqueAccountId = accountId !== null && hasUniqueQuotaAccountId(accounts, account);
     if (hasUniqueAccountId) {
-        cache.byAccountId[accountId] = nextEntry;
+        cache.byAccountId[accountId] = mergeQuotaCacheEntry(cache.byAccountId[accountId], nextEntry);
         changed = true;
     }
     const email = normalizeQuotaEmail(account.email);
     if (email &&
         hasSafeQuotaEmailFallback(emailFallbackState, account) &&
         !hasUniqueAccountId) {
-        cache.byEmail[email] = nextEntry;
+        cache.byEmail[email] = mergeQuotaCacheEntry(cache.byEmail[email], nextEntry);
         changed = true;
     }
     else if (email && cache.byEmail[email]) {
@@ -86,7 +90,7 @@ export function updateQuotaCacheForWorkspace(cache, account, workspaceId, snapsh
     if (!key)
         return;
     cache.byWorkspace ??= {};
-    cache.byWorkspace[key] = quotaEntryFromSnapshot(snapshot);
+    cache.byWorkspace[key] = mergeQuotaCacheEntry(cache.byWorkspace[key], quotaEntryFromSnapshot(snapshot));
     if (workspaceId === normalizeQuotaAccountId(account.accountId)) {
         updateQuotaCacheForAccount(cache, account, snapshot, accounts);
     }

package/dist/lib/context-budget/model-context-windows.d.ts

@@ -6,7 +6,7 @@
  * behavior (see the v2.5.0 release notes) closely enough to launch that no
  * estimate here has been reviewed for it yet.
  */
-export declare const UNESTIMATED_ROUTABLE_MODELS: readonly ["gpt-5.6-sol", "gpt-5.6-terra", "gpt-5.6-luna", "gpt-6-astra", "gpt-6-astra-aeon", "gpt-6-sol", "gpt-6-luna", "gpt-daybreak-blue-latest", "gpt-daybreak-red-latest"];
+export declare const UNESTIMATED_ROUTABLE_MODELS: readonly ["gpt-5.6-sol", "gpt-5.6-terra", "gpt-5.6-luna", "gpt-6-astra", "gpt-6-sol", "gpt-6-luna", "gpt-6.1-sol", "gpt-daybreak-blue-latest", "gpt-daybreak-red-latest"];
 export interface EffectiveContextWindow {
     tokens: number;
     source: "override" | "estimate";

package/dist/lib/context-budget/model-context-windows.js

@@ -23,14 +23,11 @@ import { getNormalizedModel } from "../request/helpers/model-map.js";
  * it to UNESTIMATED_ROUTABLE_MODELS instead.
  */
 //
-// Retired models (`gpt-5.1` through `gpt-5.4-*`, `gpt-5-mini`/`nano`, the codex
-// models) are deliberately absent. Their ids now route to a replacement, and
-// estimating the window from the retired name would evaluate a request against
-// a model it no longer runs on.
-const ESTIMATED_MODEL_CONTEXT_WINDOWS = {
-    "gpt-5.5": 260_000,
-    "gpt-5.5-pro": 260_000,
-};
+// Retired models (`gpt-5.1` through `gpt-5.5-pro`, `gpt-5-mini`/`nano`, the
+// codex models) are deliberately absent. Their ids now route to a
+// replacement, and estimating the window from the retired name would
+// evaluate a request against a model it no longer runs on.
+const ESTIMATED_MODEL_CONTEXT_WINDOWS = {};
 /**
  * Routable models this guard consciously does not estimate a window for.
  * `getEffectiveContextWindow` returns `null` for these absent an override,
@@ -52,11 +49,11 @@ export const UNESTIMATED_ROUTABLE_MODELS = [
     // measured ceiling for this transport, so it stays unestimated too. Set
     // `contextBudgetGuardModelWindowOverrides` once you know your real ceiling.
     "gpt-6-astra",
-    "gpt-6-astra-aeon",
-    // Sol and Luna carry the same 272K Codex / 872K max split in the upstream
-    // catalog as Astra, so the same reasoning keeps them unestimated.
+    // Sol, Luna and 6.1 Sol carry the same 272K Codex / 872K max split in the
+    // upstream catalog as Astra, so the same reasoning keeps them unestimated.
     "gpt-6-sol",
     "gpt-6-luna",
+    "gpt-6.1-sol",
     "gpt-daybreak-blue-latest",
     "gpt-daybreak-red-latest",
 ];
@@ -79,8 +76,8 @@ function normalizeModelName(model) {
  * the way they type the model still wins, then the catalog's canonical id for
  * it. `getNormalizedModel` is deliberately the exact/alias-only resolver —
  * `resolveNormalizedModel` falls back to `DEFAULT_MODEL` for anything it does
- * not recognize, which would hand an unknown model gpt-5.5's window and
- * evaluate a real session against a fabricated number.
+ * not recognize, which would hand an unknown model the default model's
+ * window and evaluate a real session against a fabricated number.
  */
 function windowLookupCandidates(model) {
     const raw = normalizeModelName(model);

package/dist/lib/model-route-policy.d.ts

@@ -44,7 +44,7 @@ export declare function modelEntitlements(model: RouteModel): {
     reasoningLevels: string[];
     accessPrograms: string[];
     probes?: {
-        [k: string]: "verified" | "unsupported" | "unverified" | "downgraded";
+        [k: string]: "unsupported" | "verified" | "unverified" | "downgraded";
     } | undefined;
     checkedAt?: number | undefined;
     model: string;

package/dist/lib/oc-chatgpt-target-detection.d.ts

@@ -35,7 +35,8 @@ export type OcChatgptTargetDetectionResult = OcChatgptTargetFound | OcChatgptTar
 /**
  * Detects the oc-chatgpt multi-auth storage target by evaluating explicit, canonical, and per-project candidate roots.
  *
- * Examines an explicit override (OC_CHATGPT_MULTI_AUTH_DIR or options.explicitRoot), the canonical user store (~/.opencode),
+ * Examines an explicit override (OC_CODEX_MULTI_AUTH_DIR, the legacy OC_CHATGPT_MULTI_AUTH_DIR alias, or
+ * options.explicitRoot), the canonical user store (~/.opencode),
  * and a per-project storage location (derived from options.projectRoot or the current working directory). For each candidate
  * it checks for account artifacts and storage signals and returns a single resolved target, an ambiguity listing multiple
  * matching candidates, or a "none" result with the attempted candidates. This function performs synchronous filesystem checks
@@ -45,7 +46,7 @@ export type OcChatgptTargetDetectionResult = OcChatgptTargetFound | OcChatgptTar
  *
  * @param options - Optional overrides:
  *   - explicitRoot: absolute path to force as the candidate root (use `null` to explicitly disable); if omitted the
- *     OC_CHATGPT_MULTI_AUTH_DIR environment variable is considered.
+ *     OC_CODEX_MULTI_AUTH_DIR environment variable is considered, then the legacy OC_CHATGPT_MULTI_AUTH_DIR alias.
  *   - projectRoot: explicit project root to derive per-project storage; if omitted the current working directory is used to
  *     discover the project root.
  * @returns An OcChatgptTargetDetectionResult describing either a resolved `target` (with `descriptor` and a `resolution`

package/dist/lib/oc-chatgpt-target-detection.js

@@ -2,7 +2,14 @@ import { existsSync, readdirSync } from "node:fs";
 import { homedir } from "node:os";
 import { join, normalize, relative, resolve, sep, win32 } from "node:path";
 import { findProjectRoot, getProjectStorageKey, resolveProjectStorageIdentityRoot, } from "./storage/paths.js";
-const ACCOUNT_FILE_NAME = "openai-codex-accounts.json";
+// The sibling plugin renamed its account file from `openai-codex-accounts.json`
+// (oc-chatgpt-multi-auth era) to `oc-codex-multi-auth-accounts.json`; both are
+// detected, preferring the current name when a root holds both.
+const ACCOUNT_FILE_NAMES = [
+    "oc-codex-multi-auth-accounts.json",
+    "openai-codex-accounts.json",
+];
+const ACCOUNT_FILE_NAME = ACCOUNT_FILE_NAMES[0];
 const BACKUPS_DIR_NAME = "backups";
 const PROJECTS_DIR_NAME = "projects";
 const CANONICAL_HOME_BASENAME = ".opencode";
@@ -107,17 +114,32 @@ function deduplicatePaths(paths) {
     }
     return result;
 }
+/**
+ * Returns the path of the primary account file under `root`, preferring the
+ * current `oc-codex-multi-auth-accounts.json` name over the legacy
+ * `openai-codex-accounts.json` name when both exist, or `null` when neither
+ * file (nor its `.wal` sidecar) is present.
+ */
+function findPrimaryAccountPath(root) {
+    for (const name of ACCOUNT_FILE_NAMES) {
+        const accountPath = join(root, name);
+        if (existsSync(accountPath) || existsSync(`${accountPath}.wal`)) {
+            return accountPath;
+        }
+    }
+    return null;
+}
 /**
  * Detects whether an account file or rotated account artifacts exist under the specified storage root.
  *
- * Scans for the canonical account file and its WAL variant, rotated/archived files matching the account filename pattern (excluding `.tmp`, `.wal`, and names containing `.rotate.`), and the backups directory. The probe is tolerant of unreadable directories (errors are ignored) and does not read file contents. Callers should be aware of concurrent filesystem changes — a `false` result does not guarantee no artifact will appear shortly after. On Windows, filesystem matching should be considered case-insensitive by callers. This check does not expose or parse any token contents.
+ * Scans for an account file under either known name (`oc-codex-multi-auth-accounts.json` or the legacy `openai-codex-accounts.json`) and its WAL variant, rotated/archived files matching either account filename pattern (excluding `.tmp`, `.wal`, and names containing `.rotate.`), and the backups directory. The probe is tolerant of unreadable directories (errors are ignored) and does not read file contents. Callers should be aware of concurrent filesystem changes — a `false` result does not guarantee no artifact will appear shortly after. On Windows, filesystem matching should be considered case-insensitive by callers. This check does not expose or parse any token contents.
  *
  * @param root - Filesystem path of the storage root to probe
+ * @param primaryAccountPath - Result of `findPrimaryAccountPath(root)`, so callers resolve the descriptor path once
  * @returns `true` if any account file or rotated account artifact exists under `root` or its backups directory, `false` otherwise.
  */
-function hasAccountArtifacts(root) {
-    const accountPath = join(root, ACCOUNT_FILE_NAME);
-    if (existsSync(accountPath) || existsSync(`${accountPath}.wal`)) {
+function hasAccountArtifacts(root, primaryAccountPath) {
+    if (primaryAccountPath !== null) {
         return true;
     }
     const hasRotated = (dir) => {
@@ -126,7 +148,7 @@ function hasAccountArtifacts(root) {
             for (const entry of entries) {
                 if (!entry.isFile())
                     continue;
-                if (!entry.name.startsWith(`${ACCOUNT_FILE_NAME}.`))
+                if (!ACCOUNT_FILE_NAMES.some((name) => entry.name.startsWith(`${name}.`)))
                     continue;
                 if (entry.name.endsWith(".tmp"))
                     continue;
@@ -146,7 +168,7 @@ function hasAccountArtifacts(root) {
         return true;
     }
     const backupsDir = join(root, BACKUPS_DIR_NAME);
-    if (existsSync(join(backupsDir, ACCOUNT_FILE_NAME))) {
+    if (ACCOUNT_FILE_NAMES.some((name) => existsSync(join(backupsDir, name)))) {
         return true;
     }
     if (hasRotated(backupsDir)) {
@@ -191,7 +213,8 @@ function inferScopeFromRoot(root, canonicalRoot) {
 /**
  * Detects the oc-chatgpt multi-auth storage target by evaluating explicit, canonical, and per-project candidate roots.
  *
- * Examines an explicit override (OC_CHATGPT_MULTI_AUTH_DIR or options.explicitRoot), the canonical user store (~/.opencode),
+ * Examines an explicit override (OC_CODEX_MULTI_AUTH_DIR, the legacy OC_CHATGPT_MULTI_AUTH_DIR alias, or
+ * options.explicitRoot), the canonical user store (~/.opencode),
  * and a per-project storage location (derived from options.projectRoot or the current working directory). For each candidate
  * it checks for account artifacts and storage signals and returns a single resolved target, an ambiguity listing multiple
  * matching candidates, or a "none" result with the attempted candidates. This function performs synchronous filesystem checks
@@ -201,14 +224,17 @@ function inferScopeFromRoot(root, canonicalRoot) {
  *
  * @param options - Optional overrides:
  *   - explicitRoot: absolute path to force as the candidate root (use `null` to explicitly disable); if omitted the
- *     OC_CHATGPT_MULTI_AUTH_DIR environment variable is considered.
+ *     OC_CODEX_MULTI_AUTH_DIR environment variable is considered, then the legacy OC_CHATGPT_MULTI_AUTH_DIR alias.
  *   - projectRoot: explicit project root to derive per-project storage; if omitted the current working directory is used to
  *     discover the project root.
  * @returns An OcChatgptTargetDetectionResult describing either a resolved `target` (with `descriptor` and a `resolution`
  *   of `"accounts"` or `"signals"`), an `ambiguous` outcome listing conflicting candidates, or `none` with the tried candidates.
  */
 export function detectOcChatgptMultiAuthTarget(options) {
-    const explicitFromEnv = (process.env.OC_CHATGPT_MULTI_AUTH_DIR ?? "").trim();
+    const explicitFromEnv = (firstNonEmpty([
+        process.env.OC_CODEX_MULTI_AUTH_DIR,
+        process.env.OC_CHATGPT_MULTI_AUTH_DIR,
+    ]) ?? "").trim();
     const hasExplicitRootOption = options !== undefined && "explicitRoot" in options;
     const explicitRoot = (hasExplicitRootOption ? (options.explicitRoot ?? "") : explicitFromEnv).trim();
     const userHome = getResolvedUserHomeDir();
@@ -233,9 +259,10 @@ export function detectOcChatgptMultiAuthTarget(options) {
             : inferredScope === "project"
                 ? "project"
                 : "default-global";
-        const accountPath = join(root, ACCOUNT_FILE_NAME);
+        const primaryAccountPath = findPrimaryAccountPath(root);
+        const accountPath = primaryAccountPath ?? join(root, ACCOUNT_FILE_NAME);
         const backupRoot = join(root, BACKUPS_DIR_NAME);
-        const hasAccountArtifactsFlag = hasAccountArtifacts(root);
+        const hasAccountArtifactsFlag = hasAccountArtifacts(root, primaryAccountPath);
         return {
             scope: inferredScope,
             source,
@@ -314,7 +341,7 @@ export function detectOcChatgptMultiAuthTarget(options) {
     }
     return {
         kind: "none",
-        reason: "No oc-chatgpt-multi-auth target root found; create ~/.opencode or supply OC_CHATGPT_MULTI_AUTH_DIR.",
+        reason: "No oc-chatgpt-multi-auth target root found; create ~/.opencode or supply OC_CODEX_MULTI_AUTH_DIR (legacy OC_CHATGPT_MULTI_AUTH_DIR is still accepted).",
         tried: candidates.map(({ scope, source, root, accountPath, backupRoot }) => ({
             scope,
             source,

package/dist/lib/quota-cache.d.ts

@@ -4,6 +4,10 @@ export interface QuotaCacheWindow {
     resetAtMs?: number;
 }
 export interface QuotaCacheEntry {
+    primingCompleted?: boolean;
+    /** Completion/failure time, independent of the quota header observation. */
+    primingObservedAt?: number;
+    primingFailure?: "timed out" | "stream ended early" | "upstream failed" | "response too large" | "network error";
     updatedAt: number;
     status: number;
     model: string;
@@ -47,6 +51,8 @@ export declare function getQuotaCachePath(): string;
  *          will be empty if the on-disk file is absent, malformed, or could not be read.
  */
 export declare function loadQuotaCache(): Promise<QuotaCacheData>;
+/** Merge quota and priming evidence independently; subsequent quota retires old outcomes. */
+export declare function mergeQuotaCacheEntry(latest: QuotaCacheEntry | undefined, update: QuotaCacheEntry): QuotaCacheEntry;
 /**
  * Persist the quota cache to the on-disk JSON file used by the multi-auth runtime.
  *

package/dist/lib/quota-cache.js

@@ -58,6 +58,9 @@ function normalizeEntry(value) {
         return null;
     }
     return {
+        ...(value.primingCompleted === true ? { primingCompleted: true } : {}),
+        ...(typeof value.primingFailure === "string" && ["timed out", "stream ended early", "upstream failed", "response too large", "network error"].includes(value.primingFailure) ? { primingFailure: value.primingFailure } : {}),
+        ...(normalizeNumber(value.primingObservedAt) !== undefined ? { primingObservedAt: normalizeNumber(value.primingObservedAt) } : {}),
         updatedAt,
         status,
         model: model.trim(),
@@ -158,6 +161,32 @@ async function readQuotaCache() {
         ...(parsed.byWorkspace ? { byWorkspace: normalizeEntryMap(parsed.byWorkspace) } : {}),
     };
 }
+/** Merge quota and priming evidence independently; subsequent quota retires old outcomes. */
+export function mergeQuotaCacheEntry(latest, update) {
+    if (!latest)
+        return update;
+    const quota = update.updatedAt >= latest.updatedAt ? update : latest;
+    const outcomeTime = (entry) => entry.primingCompleted || entry.primingFailure
+        ? entry.primingObservedAt ?? entry.updatedAt : -Infinity;
+    // A timeout does not undo a completion from an overlapping attempt.
+    // Only completions at/after the newest quota observation remain relevant.
+    const completion = [update, latest].filter(entry => entry.primingCompleted && outcomeTime(entry) >= quota.updatedAt)
+        .sort((a, b) => outcomeTime(b) - outcomeTime(a))[0];
+    const evidence = completion ?? (outcomeTime(update) >= outcomeTime(latest) ? update : latest);
+    const result = { ...quota };
+    delete result.primingCompleted;
+    delete result.primingFailure;
+    delete result.primingObservedAt;
+    if (outcomeTime(evidence) >= quota.updatedAt) {
+        if (evidence.primingCompleted)
+            result.primingCompleted = true;
+        else if (evidence.primingFailure)
+            result.primingFailure = evidence.primingFailure;
+        if (evidence.primingObservedAt !== undefined)
+            result.primingObservedAt = evidence.primingObservedAt;
+    }
+    return result;
+}
 /** Reapply this run's changed entries, preserving unrelated or newer concurrent observations. */
 function mergeQuotaChanges(current, proposed, baseline) {
     const same = (a, b) => JSON.stringify(a) === JSON.stringify(b);
@@ -168,24 +197,12 @@ function mergeQuotaChanges(current, proposed, baseline) {
                 continue;
             const latest = current[namespace]?.[key], update = next[key];
             if (update) {
-                if (!latest || update.updatedAt >= latest.updatedAt) {
-                    current[namespace] ??= {};
-                    current[namespace][key] = update;
-                }
-                else if (same(latest, before[key])) {
-                    // The on-disk entry is still exactly the one this caller's
-                    // baseline saw, so nothing concurrent touched this key:
-                    // `update` is a deliberate write whose lower stamp can only
-                    // come from a backward clock jump on this writer. Re-stamp
-                    // it just ahead instead of silently losing it. A raced key
-                    // (`!same`) falls through and keeps the on-disk entry: its
-                    // higher stamp marks a newer observation, and bumping an
-                    // older one past it would let stale quota data overwrite
-                    // fresher data.
+                if (latest && update.updatedAt < latest.updatedAt && same(latest, before[key])) {
+                    // Preserve the existing backward-clock handling for an unraced write.
                     update.updatedAt = latest.updatedAt + 1;
-                    current[namespace] ??= {};
-                    current[namespace][key] = update;
                 }
+                current[namespace] ??= {};
+                current[namespace][key] = mergeQuotaCacheEntry(latest, update);
             }
             else if (same(latest, before[key])) {
                 delete current[namespace]?.[key];

package/dist/lib/quota-probe.d.ts

@@ -26,7 +26,10 @@ export interface CodexQuotaWindow {
     resetAtMs?: number;
 }
 export interface CodexQuotaSnapshot {
+    /** Time quota headers were observed, before consuming the response stream. */
+    observedAt?: number;
     primingCompleted?: boolean;
+    primingObservedAt?: number;
     primingFailure?: FirstUseProbeError["reason"];
     status: number;
     planType?: string;

package/dist/lib/quota-probe.js

@@ -382,15 +382,16 @@ export async function fetchCodexQuotaSnapshot(options) {
             }
             const snapshotBase = parseQuotaSnapshotBase(response.headers, response.status);
             if (snapshotBase) {
-                if (options.primeUnusedSubscription && needsSubscriptionFirstUse(snapshotBase, Date.now())) {
+                const observedAt = Date.now();
+                if (options.primeUnusedSubscription && needsSubscriptionFirstUse(snapshotBase, observedAt)) {
                     try {
                         await finishSubscriptionFirstUse(response, timeoutMs);
-                        return { ...snapshotBase, model, primingCompleted: true };
+                        return { ...snapshotBase, observedAt, model, primingObservedAt: Date.now(), primingCompleted: true };
                     }
                     catch (error) {
                         // Keep valid quota data without retrying an accepted inference.
                         if (error instanceof FirstUseProbeError)
-                            return { ...snapshotBase, model, primingFailure: error.reason };
+                            return { ...snapshotBase, observedAt, model, primingObservedAt: Date.now(), primingFailure: error.reason };
                         throw error;
                     }
                 }
@@ -400,7 +401,7 @@ export async function fetchCodexQuotaSnapshot(options) {
                 catch {
                     // Best effort cancellation.
                 }
-                return { ...snapshotBase, model };
+                return { ...snapshotBase, observedAt, model };
             }
             if (!response.ok) {
                 const bodyText = await response.text().catch(() => "");

package/dist/lib/quota-readiness.d.ts

@@ -1,6 +1,6 @@
 import type { QuotaCacheData, QuotaCacheEntry } from "./quota-cache.js";
 import type { AccountMetadataV3 } from "./storage.js";
-export type QuotaCacheAccountRef = Pick<AccountMetadataV3, "accountId" | "email" | "recordId" | "workspaces" | "currentWorkspaceIndex"> & Partial<Pick<AccountMetadataV3, "refreshToken" | "addedAt">>;
+export type QuotaCacheAccountRef = Pick<AccountMetadataV3, "accountId" | "email" | "recordId" | "workspaces" | "currentWorkspaceIndex"> & Partial<Pick<AccountMetadataV3, "refreshToken" | "addedAt" | "accessToken">>;
 export declare function normalizeQuotaAccountId(value: string | undefined): string | null;
 export declare function normalizeQuotaEmail(value: string | undefined): string | null;
 export declare function hasUniqueQuotaAccountId(accounts: readonly QuotaCacheAccountRef[], account: QuotaCacheAccountRef): boolean;

package/dist/lib/quota-readiness.js

@@ -1,3 +1,4 @@
+import { extractAccountId } from "./auth/token-utils.js";
 import { createHash } from "node:crypto";
 import { resolveAccountRecordId } from "./storage/record-identity.js";
 export function normalizeQuotaAccountId(value) {
@@ -101,7 +102,7 @@ export function quotaWorkspaceKey(account, workspaceId) {
 export function quotaWorkspaceId(account) {
     return account.workspaces?.length
         ? account.workspaces[account.currentWorkspaceIndex ?? 0]?.id.trim()
-        : account.accountId?.trim();
+        : account.accountId?.trim() || extractAccountId(account.accessToken);
 }
 /** Read exact-workspace quota, using legacy binding entries only for that binding. */
 export function findQuotaCacheEntryForAccount(cache, account, accounts, emailFallbackState = buildQuotaEmailFallbackState(accounts), workspaceId = quotaWorkspaceId(account)) {
@@ -110,7 +111,10 @@ export function findQuotaCacheEntryForAccount(cache, account, accounts, emailFal
     const key = workspaceId && quotaWorkspaceKey(account, workspaceId);
     const scoped = key ? cache.byWorkspace?.[key] : undefined;
     // Legacy entries describe only the stored binding, never a sibling workspace.
-    if (normalizeQuotaAccountId(workspaceId) !== normalizeQuotaAccountId(account.accountId))
+    // A workspaces-bearing account whose selection does not resolve (invalid index
+    // or blank id) has no valid binding at all — never fall back to legacy keys.
+    if (normalizeQuotaAccountId(workspaceId) !== normalizeQuotaAccountId(account.accountId) ||
+        (account.workspaces?.length && !normalizeQuotaAccountId(workspaceId)))
         return scoped ?? null;
     const accountId = normalizeQuotaAccountId(account.accountId);
     const newer = (legacy) => scoped && (!legacy || scoped.updatedAt >= legacy.updatedAt) ? scoped : legacy ?? null;