codex-multi-auth 2.18.0 → 2.19.0

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-multi-auth",
-	"version": "2.18.0",
+	"version": "2.19.0",
   "description": "Install and operate codex-multi-auth for the official @openai/codex CLI with multi-account OAuth rotation, switching, health checks, and recovery tools.",
   "interface": {
     "composerIcon": "./assets/codex-multi-auth-icon.svg"

package/README.md

@@ -137,7 +137,7 @@ Common symptoms — wrong active account, OAuth callback port `1455` already bou
 
 ## Release notes
 
-- Current stable: [v2.18.0](docs/releases/v2.18.0.md) — `npm i -g codex-multi-auth`
+- Current stable: [v2.19.0](docs/releases/v2.19.0.md) — `npm i -g codex-multi-auth`
 - Earlier stable lines: [v2.6.0](docs/releases/v2.6.0.md), [v2.5.0](docs/releases/v2.5.0.md)
 - Full release archive: [docs/README.md#release-history](docs/README.md#release-history)
 

package/dist/lib/account-policy.d.ts

@@ -20,7 +20,9 @@ export declare function getAccountPolicyPath(): string;
 export declare function getAccountPolicyKey(account: Pick<AccountMetadataV3, "accountId" | "email"> & {
     refreshToken?: string | null;
 }, _index?: number): string;
-export declare function loadAccountPolicyStore(): Promise<AccountPolicyStore>;
+export declare function loadAccountPolicyStore(options?: {
+    strict?: boolean;
+}): Promise<AccountPolicyStore>;
 export declare function saveAccountPolicyStore(store: AccountPolicyStore, baseline?: AccountPolicyStore): Promise<void>;
 /**
  * Run a policy-store read→mutate→write inside the write queue (in-process

package/dist/lib/account-policy.js

@@ -1,5 +1,5 @@
 import { createHash } from "node:crypto";
-import { existsSync, promises as fs } from "node:fs";
+import { promises as fs } from "node:fs";
 import { basename, join } from "node:path";
 import { logWarn } from "./logger.js";
 import { getCodexMultiAuthDir } from "./runtime-paths.js";
@@ -100,14 +100,30 @@ export function getAccountPolicyKey(account, _index) {
         (refreshFallback ? `refresh:${refreshFallback}` : "unknown");
     return `sha256:${createHash("sha256").update(identity).digest("hex")}`;
 }
-export async function loadAccountPolicyStore() {
+export async function loadAccountPolicyStore(options = {}) {
     const path = getAccountPolicyPath();
-    if (!existsSync(path))
-        return emptyStore();
     try {
-        return normalizeStore(JSON.parse(await readFileWithRetry(path)));
+        const parsed = JSON.parse(await readFileWithRetry(path));
+        if (options.strict) {
+            if (!isRecord(parsed) || parsed.version !== 1 || !isRecord(parsed.accounts)) {
+                throw new Error("Invalid account policy store");
+            }
+            for (const [key, row] of Object.entries(parsed.accounts)) {
+                if (!key.startsWith("sha256:"))
+                    continue;
+                // Legacy rows may omit flags; explicit malformed values are not OFF.
+                if (!isRecord(row) || ["autoPrime", "paused", "drained"].some(flag => flag in row && typeof row[flag] !== "boolean")) {
+                    throw new Error("Invalid account policy row");
+                }
+            }
+        }
+        return normalizeStore(parsed);
     }
     catch (error) {
+        if (error.code === "ENOENT")
+            return emptyStore();
+        if (options.strict)
+            throw error;
         logWarn(`Failed to load account policies from ${basename(path)}: ${error instanceof Error ? error.message : String(error)}`);
         return emptyStore();
     }

package/dist/lib/codex-manager/commands/history.js

@@ -107,7 +107,9 @@ function parseRollout(rolloutPath, deps, previewLimit) {
         if (typeof record.timestamp === "string") {
             updatedAt = record.timestamp;
         }
-        if (record.type === "session_meta") {
+        // Forked rollouts append the parent's session_meta after their own, so
+        // only the first one describes this rollout.
+        if (record.type === "session_meta" && !hasSessionMeta) {
             const payload = record.payload;
             const metaId = readStringField(payload, "id");
             if (metaId)

package/dist/lib/codex-manager/commands/status.js

@@ -1,3 +1,4 @@
+import { subscriptionStatus, formatSubscriptionStatus } from "../formatters/subscription-status.js";
 import { resetSnapshotQuota } from "../../runtime/reset-credits.js";
 import { resetTargetForStoredAccount } from "../../runtime/account-reset-credits.js";
 import { subscriptionQuotaPreference, compareSubscriptionQuota, usesSubscriptionReserve, SUBSCRIPTION_RESERVE_PERCENT } from "../../runtime/subscription-quota-order.js";
@@ -87,7 +88,8 @@ export async function runStatusCommand(deps) {
     const modelInventory = await deps.loadModelInventory?.();
     const resetCredits = await deps.loadResetCreditState?.().catch(() => null);
     const resetSnapshot = (account) => { const target = resetTargetForStoredAccount(account); return target ? resetCredits?.snapshots[target.key] : undefined; };
-    const accountPolicies = await (deps.loadAccountPolicies ?? loadAccountPolicyStore)().catch(() => ({ version: 1, accounts: {} }));
+    let policiesUnavailable = false;
+    const accountPolicies = await (deps.loadAccountPolicies ?? loadAccountPolicyStore)({ strict: true }).catch(() => { policiesUnavailable = true; return { version: 1, accounts: {} }; });
     if (!deps.json && deps.loadModelInventory)
         for (const line of formatModelInventory(modelInventory ?? null))
             logInfo(line);
@@ -136,6 +138,7 @@ export async function runStatusCommand(deps) {
     const now = deps.getNow?.() ?? Date.now();
     const activeIndex = storage.accounts.length ? deps.resolveActiveIndex(storage, "codex") : -1;
     const quotaCache = await deps.loadQuotaCache?.() ?? null;
+    const subscriptionStatuses = storage.accounts.map(account => subscriptionStatus(account, findQuotaCacheEntryForAccount(quotaCache, account, storage.accounts), policiesUnavailable ? undefined : accountPolicies.accounts[getAccountPolicyKey(account)] ?? {}, now));
     const forecastQuotas = storage.accounts.map(account => {
         const cached = findQuotaCacheEntryForAccount(quotaCache, account, storage.accounts);
         const reset = resetSnapshot(account);
@@ -217,6 +220,7 @@ export async function runStatusCommand(deps) {
             const markers = buildAccountMarkers(account, i, activeIndex, runtimeCurrent, now, quotaCache, storage.accounts, deps.formatRateLimitEntry);
             return {
                 index: i,
+                subscription: subscriptionStatuses[i],
                 resetCreditsAvailable: resetSnapshot(account)?.availableCount ?? null,
                 resetCreditsCheckedAt: resetSnapshot(account)?.updatedAt ?? null,
                 label: formatAccountLabel(account, i),
@@ -335,8 +339,9 @@ export async function runStatusCommand(deps) {
             : `inference not yet recorded; ${activity}`;
         logInfo(`${paint(`${i + 1}. ${label}`, "heading")}${paint(markerLabel, markers.some(m => /disabled|cooldown|exhausted|limited|invalid/.test(m)) ? "warning" : "success")} ${paint(lastUsed, "muted")}`);
         logInfo(`   ${paint(`priority tier: ${accountPolicies.accounts[getAccountPolicyKey(account, i)]?.priority ?? 1}`, "accent")}`);
-        if (accountPolicies.accounts[getAccountPolicyKey(account, i)]?.autoPrime)
-            logInfo("   automatic first-use priming: on (router checks every 15 minutes)");
+        const subscription = subscriptionStatuses[i];
+        if (subscription)
+            logInfo(`   ${formatSubscriptionStatus(subscription)}`);
         if (appBindStatus?.nativeOpenai) {
             const preference = quotaPreferences[i];
             const order = automaticOrder.get(i);

package/dist/lib/codex-manager/formatters/subscription-status.d.ts

@@ -0,0 +1,16 @@
+import type { AccountPolicy } from "../../account-policy.js";
+import type { QuotaCacheEntry } from "../../quota-cache.js";
+import type { AccountMetadataV3 } from "../../storage.js";
+/** Display only observed evidence; never age a placeholder into a running timer. */
+export declare function subscriptionStatus(account: AccountMetadataV3, entry: QuotaCacheEntry | null, policy: Partial<AccountPolicy> | undefined, now: number): {
+    planType: string | null;
+    planLabel: string;
+    selectedWorkspace: string;
+    autoPrime: boolean | null;
+    primingState: "failed" | "unknown" | "awaiting-first-use" | "timer-running" | "used" | "completed" | "not-applicable";
+    primingFailure: "timed out" | "stream ended early" | "upstream failed" | "response too large" | "network error" | null;
+    automaticBlock: string | null;
+    freshness: string;
+    observedAt: number | null;
+};
+export declare function formatSubscriptionStatus(value: ReturnType<typeof subscriptionStatus>): string;

package/dist/lib/codex-manager/formatters/subscription-status.js

@@ -0,0 +1,69 @@
+import { needsSubscriptionFirstUse } from "../../runtime/subscription-first-use.js";
+const PLAN_LABELS = new Map([
+    ["free", "Free"], ["plus", "Plus"], ["pro", "Pro 200"],
+    ["prolite", "Pro 100"], ["promax", "Pro 500"], ["team", "Business"],
+    ["business", "Business"], ["enterprise", "Enterprise"], ["edu", "Edu"],
+]);
+const STATE_LABELS = {
+    unknown: "Priming status unknown",
+    "awaiting-first-use": "Awaiting first use",
+    "timer-running": "Reset timer running",
+    used: "Usage recorded",
+    completed: "First-use completed; timer not yet verified",
+    failed: "Priming failed",
+    "not-applicable": "Priming not applicable",
+};
+/** Display only observed evidence; never age a placeholder into a running timer. */
+export function subscriptionStatus(account, entry, policy, now) {
+    const workspace = account.workspaces?.[account.currentWorkspaceIndex ?? 0];
+    const selectedWorkspace = workspace
+        ? workspace.name?.replace(/\s*\(role:.*$|\s*\[id:.*$/g, "").trim() || "Unnamed workspace"
+        : account.workspaces?.length ? "Invalid workspace selection" : "Stored binding (workspace unknown)";
+    const freshness = !entry ? "missing"
+        : entry.updatedAt > now || now - entry.updatedAt > 30 * 60000 ? "stale" : "fresh";
+    const planType = entry?.planType?.trim().toLowerCase() ?? null;
+    const planLabel = PLAN_LABELS.get(planType ?? "") ?? "Unknown plan";
+    let primingState = "unknown";
+    if (entry && freshness === "fresh" && entry.status === 200) {
+        const windows = [entry.primary, entry.secondary].filter(w => w.windowMinutes !== 0);
+        if (!planType || !PLAN_LABELS.has(planType))
+            primingState = "unknown";
+        else if (!["plus", "pro", "prolite", "promax"].includes(planType))
+            primingState = "not-applicable";
+        else if (entry.primingFailure)
+            primingState = "failed";
+        else if (entry.primingCompleted)
+            primingState = "completed";
+        else if (windows.some(w => typeof w.usedPercent === "number" && w.usedPercent > 0)) {
+            primingState = "used";
+        }
+        else if (windows.some(w => typeof w.windowMinutes === "number" && w.windowMinutes > 0 &&
+            typeof w.resetAtMs === "number" && w.resetAtMs > now &&
+            w.resetAtMs - entry.updatedAt < w.windowMinutes * 60000 - 2000)) {
+            primingState = "timer-running";
+        }
+        else if (needsSubscriptionFirstUse(entry, entry.updatedAt)) {
+            primingState = "awaiting-first-use";
+        }
+    }
+    const automaticBlock = account.enabled === false ? "account disabled"
+        : account.authInvalidatedAt ? "sign-in required"
+            : policy?.paused ? "paused"
+                : policy?.drained ? "drained"
+                    : (account.coolingDownUntil ?? 0) > now ? "cooling down"
+                        : account.workspaces?.length && (!workspace || workspace.enabled === false) ? "workspace unavailable"
+                            : null;
+    return {
+        planType, planLabel, selectedWorkspace,
+        autoPrime: policy ? policy.autoPrime === true : null,
+        primingState, primingFailure: entry?.primingFailure ?? null,
+        automaticBlock, freshness, observedAt: entry?.updatedAt ?? null,
+    };
+}
+export function formatSubscriptionStatus(value) {
+    const freshness = value.freshness === "stale" ? " (stale; run check accounts)"
+        : value.freshness === "missing" ? " (not observed)" : "";
+    const autoPrime = value.autoPrime === null ? "unknown" : value.autoPrime ? "ON" : "OFF";
+    const block = value.automaticBlock ? `; blocked: ${value.automaticBlock}` : "";
+    return `${value.selectedWorkspace} · ${value.planLabel}${freshness} · Auto-prime ${autoPrime} · ${STATE_LABELS[value.primingState]}${block}`;
+}

package/dist/lib/codex-manager/health-check.js

@@ -1,3 +1,6 @@
+import { subscriptionStatus, formatSubscriptionStatus } from "./formatters/subscription-status.js";
+import { getAccountPolicyKey, loadAccountPolicyStore } from "../account-policy.js";
+import { automaticCheckWorkspaceId } from "../runtime/automatic-account-checks.js";
 import { refreshAndPrintResetCredits } from "../runtime/account-reset-credits.js";
 import { mapWithConcurrency } from "../concurrency.js";
 import { withCheckProgress } from "../ui/check-progress.js";
@@ -16,7 +19,7 @@ import { loadAccounts, saveAccounts, setStoragePath } from "../storage.js";
 import { applyTokenAccountIdentity, hasLikelyInvalidRefreshToken, hasUsableAccessToken, } from "./account-credentials.js";
 import { saveAccountsWithRetry } from "./forecast-report-shared.js";
 import { formatModelInspection, formatQuotaSnapshotForDashboard, formatResultSummary, inspectRequestedModel, normalizeFailureDetail, styleAccountDetailText, stylePromptText, } from "./formatters/index.js";
-import { cloneQuotaCacheData, DEFAULT_LIVE_PROBE_MODEL, pruneUnsafeQuotaEmailCacheEntry, updateQuotaCacheForAccount, } from "./quota-cache-helpers.js";
+import { cloneQuotaCacheData, DEFAULT_LIVE_PROBE_MODEL, pruneUnsafeQuotaEmailCacheEntry, updateQuotaCacheForWorkspace, } from "./quota-cache-helpers.js";
 function appendAuthInvalidationMarker(account, detail) {
     return typeof account.authInvalidatedAt === "number" &&
         Number.isFinite(account.authInvalidatedAt)
@@ -44,6 +47,8 @@ export async function runHealthCheck(options = {}) {
     let quotaEmailFallbackState = liveProbe && quotaCache
         ? buildQuotaEmailFallbackState(storage.accounts)
         : null;
+    const policies = await loadAccountPolicyStore({ strict: true }).catch(() => null);
+    const subscriptionLine = (account, snapshot) => formatSubscriptionStatus(subscriptionStatus(account, { ...snapshot, updatedAt: snapshot.observedAt ?? Date.now() }, policies ? policies.accounts[getAccountPolicyKey(account)] ?? {} : undefined, Date.now()));
     let changed = false;
     let ok = 0;
     let failed = 0;
@@ -62,7 +67,7 @@ export async function runHealthCheck(options = {}) {
     const quickProbes = new Map();
     if (liveProbe && !forceRefresh) {
         const candidates = storage.accounts.flatMap((account, index) => {
-            const accountId = account.accountId ?? extractAccountId(account.accessToken);
+            const accountId = automaticCheckWorkspaceId(account);
             return hasUsableAccessToken(account, now) && account.accessToken && accountId
                 ? [{ index, accountId, accessToken: account.accessToken }] : [];
         });
@@ -104,14 +109,14 @@ export async function runHealthCheck(options = {}) {
             if (liveProbe) {
                 const currentAccessToken = account.accessToken;
                 const probeAccountId = currentAccessToken
-                    ? (account.accountId ?? extractAccountId(currentAccessToken))
+                    ? automaticCheckWorkspaceId(account)
                     : undefined;
                 if (!probeAccountId || !currentAccessToken) {
                     warnings += 1;
                     signedInOnly += 1;
                     healthTone = "warning";
                     healthDetail =
-                        "signed in (live check skipped: missing account ID)";
+                        "signed in (live check skipped: missing account ID or unavailable selected workspace)";
                 }
                 else {
                     try {
@@ -124,10 +129,10 @@ export async function runHealthCheck(options = {}) {
                             model: modelInspection.normalized,
                         }), console.log);
                         if (workingQuotaCache) {
-                            quotaCacheChanged =
-                                updateQuotaCacheForAccount(workingQuotaCache, account, snapshot, storage.accounts, quotaEmailFallbackState ?? undefined) || quotaCacheChanged;
+                            updateQuotaCacheForWorkspace(workingQuotaCache, account, probeAccountId, snapshot, storage.accounts);
+                            quotaCacheChanged = true;
                         }
-                        healthDetail = formatQuotaSnapshotForDashboard(snapshot, display);
+                        healthDetail = formatQuotaSnapshotForDashboard(snapshot, display) + " | " + subscriptionLine(account, snapshot);
                         if (snapshot.primingFailure) {
                             healthTone = "warning";
                             warnings += 1;
@@ -210,13 +215,13 @@ export async function runHealthCheck(options = {}) {
             let healthyMessage = "working now";
             let healthyTone = "success";
             if (liveProbe) {
-                const probeAccountId = account.accountId ?? tokenAccountId;
+                const probeAccountId = automaticCheckWorkspaceId(account);
                 if (!probeAccountId) {
                     warnings += 1;
                     signedInOnly += 1;
                     healthyTone = "warning";
                     healthyMessage =
-                        "signed in (live check skipped: missing account ID)";
+                        "signed in (live check skipped: missing account ID or unavailable selected workspace)";
                 }
                 else {
                     try {
@@ -226,10 +231,10 @@ export async function runHealthCheck(options = {}) {
                             model: modelInspection.normalized,
                         }), console.log);
                         if (workingQuotaCache) {
-                            quotaCacheChanged =
-                                updateQuotaCacheForAccount(workingQuotaCache, account, snapshot, storage.accounts, quotaEmailFallbackState ?? undefined) || quotaCacheChanged;
+                            updateQuotaCacheForWorkspace(workingQuotaCache, account, probeAccountId, snapshot, storage.accounts);
+                            quotaCacheChanged = true;
                         }
-                        healthyMessage = formatQuotaSnapshotForDashboard(snapshot, display);
+                        healthyMessage = formatQuotaSnapshotForDashboard(snapshot, display) + " | " + subscriptionLine(account, snapshot);
                         if (snapshot.primingFailure) {
                             healthyTone = "warning";
                             warnings += 1;

package/dist/lib/codex-manager/quota-cache-helpers.js

@@ -1,4 +1,5 @@
 import { buildQuotaEmailFallbackState, findQuotaCacheEntryForAccount, quotaWorkspaceKey, hasSafeQuotaEmailFallback, hasUniqueQuotaAccountId, normalizeQuotaAccountId, normalizeQuotaEmail, } from "../quota-readiness.js";
+import { mergeQuotaCacheEntry, } from "../quota-cache.js";
 import { DEFAULT_MODEL, DEFAULT_PROBE_MODEL, } from "../request/helpers/model-map.js";
 import { getRateLimitResetTimeForFamily } from "../runtime/account-status.js";
 /**
@@ -41,7 +42,10 @@ export function getPersistedQuotaViewForAccount(cache, account, accounts, now, e
 /** Retain only quota fields from a probe, never its credentials or response body. */
 function quotaEntryFromSnapshot(snapshot) {
     return {
-        updatedAt: Date.now(),
+        ...(snapshot.primingCompleted ? { primingCompleted: true } : {}),
+        ...(snapshot.primingFailure ? { primingFailure: snapshot.primingFailure } : {}),
+        ...(snapshot.primingCompleted || snapshot.primingFailure ? { primingObservedAt: snapshot.primingObservedAt ?? Date.now() } : {}),
+        updatedAt: snapshot.observedAt ?? Date.now(),
         status: snapshot.status,
         model: snapshot.model,
         planType: snapshot.planType,
@@ -64,14 +68,14 @@ export function updateQuotaCacheForAccount(cache, account, snapshot, accounts, e
     const accountId = normalizeQuotaAccountId(account.accountId);
     const hasUniqueAccountId = accountId !== null && hasUniqueQuotaAccountId(accounts, account);
     if (hasUniqueAccountId) {
-        cache.byAccountId[accountId] = nextEntry;
+        cache.byAccountId[accountId] = mergeQuotaCacheEntry(cache.byAccountId[accountId], nextEntry);
         changed = true;
     }
     const email = normalizeQuotaEmail(account.email);
     if (email &&
         hasSafeQuotaEmailFallback(emailFallbackState, account) &&
         !hasUniqueAccountId) {
-        cache.byEmail[email] = nextEntry;
+        cache.byEmail[email] = mergeQuotaCacheEntry(cache.byEmail[email], nextEntry);
         changed = true;
     }
     else if (email && cache.byEmail[email]) {
@@ -86,7 +90,7 @@ export function updateQuotaCacheForWorkspace(cache, account, workspaceId, snapsh
     if (!key)
         return;
     cache.byWorkspace ??= {};
-    cache.byWorkspace[key] = quotaEntryFromSnapshot(snapshot);
+    cache.byWorkspace[key] = mergeQuotaCacheEntry(cache.byWorkspace[key], quotaEntryFromSnapshot(snapshot));
     if (workspaceId === normalizeQuotaAccountId(account.accountId)) {
         updateQuotaCacheForAccount(cache, account, snapshot, accounts);
     }

package/dist/lib/model-route-policy.d.ts

@@ -44,7 +44,7 @@ export declare function modelEntitlements(model: RouteModel): {
     reasoningLevels: string[];
     accessPrograms: string[];
     probes?: {
-        [k: string]: "verified" | "unsupported" | "unverified" | "downgraded";
+        [k: string]: "unsupported" | "verified" | "unverified" | "downgraded";
     } | undefined;
     checkedAt?: number | undefined;
     model: string;

package/dist/lib/quota-cache.d.ts

@@ -4,6 +4,10 @@ export interface QuotaCacheWindow {
     resetAtMs?: number;
 }
 export interface QuotaCacheEntry {
+    primingCompleted?: boolean;
+    /** Completion/failure time, independent of the quota header observation. */
+    primingObservedAt?: number;
+    primingFailure?: "timed out" | "stream ended early" | "upstream failed" | "response too large" | "network error";
     updatedAt: number;
     status: number;
     model: string;
@@ -47,6 +51,8 @@ export declare function getQuotaCachePath(): string;
  *          will be empty if the on-disk file is absent, malformed, or could not be read.
  */
 export declare function loadQuotaCache(): Promise<QuotaCacheData>;
+/** Merge quota and priming evidence independently; subsequent quota retires old outcomes. */
+export declare function mergeQuotaCacheEntry(latest: QuotaCacheEntry | undefined, update: QuotaCacheEntry): QuotaCacheEntry;
 /**
  * Persist the quota cache to the on-disk JSON file used by the multi-auth runtime.
  *

package/dist/lib/quota-cache.js

@@ -58,6 +58,9 @@ function normalizeEntry(value) {
         return null;
     }
     return {
+        ...(value.primingCompleted === true ? { primingCompleted: true } : {}),
+        ...(typeof value.primingFailure === "string" && ["timed out", "stream ended early", "upstream failed", "response too large", "network error"].includes(value.primingFailure) ? { primingFailure: value.primingFailure } : {}),
+        ...(normalizeNumber(value.primingObservedAt) !== undefined ? { primingObservedAt: normalizeNumber(value.primingObservedAt) } : {}),
         updatedAt,
         status,
         model: model.trim(),
@@ -158,6 +161,32 @@ async function readQuotaCache() {
         ...(parsed.byWorkspace ? { byWorkspace: normalizeEntryMap(parsed.byWorkspace) } : {}),
     };
 }
+/** Merge quota and priming evidence independently; subsequent quota retires old outcomes. */
+export function mergeQuotaCacheEntry(latest, update) {
+    if (!latest)
+        return update;
+    const quota = update.updatedAt >= latest.updatedAt ? update : latest;
+    const outcomeTime = (entry) => entry.primingCompleted || entry.primingFailure
+        ? entry.primingObservedAt ?? entry.updatedAt : -Infinity;
+    // A timeout does not undo a completion from an overlapping attempt.
+    // Only completions at/after the newest quota observation remain relevant.
+    const completion = [update, latest].filter(entry => entry.primingCompleted && outcomeTime(entry) >= quota.updatedAt)
+        .sort((a, b) => outcomeTime(b) - outcomeTime(a))[0];
+    const evidence = completion ?? (outcomeTime(update) >= outcomeTime(latest) ? update : latest);
+    const result = { ...quota };
+    delete result.primingCompleted;
+    delete result.primingFailure;
+    delete result.primingObservedAt;
+    if (outcomeTime(evidence) >= quota.updatedAt) {
+        if (evidence.primingCompleted)
+            result.primingCompleted = true;
+        else if (evidence.primingFailure)
+            result.primingFailure = evidence.primingFailure;
+        if (evidence.primingObservedAt !== undefined)
+            result.primingObservedAt = evidence.primingObservedAt;
+    }
+    return result;
+}
 /** Reapply this run's changed entries, preserving unrelated or newer concurrent observations. */
 function mergeQuotaChanges(current, proposed, baseline) {
     const same = (a, b) => JSON.stringify(a) === JSON.stringify(b);
@@ -168,24 +197,12 @@ function mergeQuotaChanges(current, proposed, baseline) {
                 continue;
             const latest = current[namespace]?.[key], update = next[key];
             if (update) {
-                if (!latest || update.updatedAt >= latest.updatedAt) {
-                    current[namespace] ??= {};
-                    current[namespace][key] = update;
-                }
-                else if (same(latest, before[key])) {
-                    // The on-disk entry is still exactly the one this caller's
-                    // baseline saw, so nothing concurrent touched this key:
-                    // `update` is a deliberate write whose lower stamp can only
-                    // come from a backward clock jump on this writer. Re-stamp
-                    // it just ahead instead of silently losing it. A raced key
-                    // (`!same`) falls through and keeps the on-disk entry: its
-                    // higher stamp marks a newer observation, and bumping an
-                    // older one past it would let stale quota data overwrite
-                    // fresher data.
+                if (latest && update.updatedAt < latest.updatedAt && same(latest, before[key])) {
+                    // Preserve the existing backward-clock handling for an unraced write.
                     update.updatedAt = latest.updatedAt + 1;
-                    current[namespace] ??= {};
-                    current[namespace][key] = update;
                 }
+                current[namespace] ??= {};
+                current[namespace][key] = mergeQuotaCacheEntry(latest, update);
             }
             else if (same(latest, before[key])) {
                 delete current[namespace]?.[key];

package/dist/lib/quota-probe.d.ts

@@ -26,7 +26,10 @@ export interface CodexQuotaWindow {
     resetAtMs?: number;
 }
 export interface CodexQuotaSnapshot {
+    /** Time quota headers were observed, before consuming the response stream. */
+    observedAt?: number;
     primingCompleted?: boolean;
+    primingObservedAt?: number;
     primingFailure?: FirstUseProbeError["reason"];
     status: number;
     planType?: string;

package/dist/lib/quota-probe.js

@@ -382,15 +382,16 @@ export async function fetchCodexQuotaSnapshot(options) {
             }
             const snapshotBase = parseQuotaSnapshotBase(response.headers, response.status);
             if (snapshotBase) {
-                if (options.primeUnusedSubscription && needsSubscriptionFirstUse(snapshotBase, Date.now())) {
+                const observedAt = Date.now();
+                if (options.primeUnusedSubscription && needsSubscriptionFirstUse(snapshotBase, observedAt)) {
                     try {
                         await finishSubscriptionFirstUse(response, timeoutMs);
-                        return { ...snapshotBase, model, primingCompleted: true };
+                        return { ...snapshotBase, observedAt, model, primingObservedAt: Date.now(), primingCompleted: true };
                     }
                     catch (error) {
                         // Keep valid quota data without retrying an accepted inference.
                         if (error instanceof FirstUseProbeError)
-                            return { ...snapshotBase, model, primingFailure: error.reason };
+                            return { ...snapshotBase, observedAt, model, primingObservedAt: Date.now(), primingFailure: error.reason };
                         throw error;
                     }
                 }
@@ -400,7 +401,7 @@ export async function fetchCodexQuotaSnapshot(options) {
                 catch {
                     // Best effort cancellation.
                 }
-                return { ...snapshotBase, model };
+                return { ...snapshotBase, observedAt, model };
             }
             if (!response.ok) {
                 const bodyText = await response.text().catch(() => "");

package/dist/lib/quota-readiness.d.ts

@@ -1,6 +1,6 @@
 import type { QuotaCacheData, QuotaCacheEntry } from "./quota-cache.js";
 import type { AccountMetadataV3 } from "./storage.js";
-export type QuotaCacheAccountRef = Pick<AccountMetadataV3, "accountId" | "email" | "recordId" | "workspaces" | "currentWorkspaceIndex"> & Partial<Pick<AccountMetadataV3, "refreshToken" | "addedAt">>;
+export type QuotaCacheAccountRef = Pick<AccountMetadataV3, "accountId" | "email" | "recordId" | "workspaces" | "currentWorkspaceIndex"> & Partial<Pick<AccountMetadataV3, "refreshToken" | "addedAt" | "accessToken">>;
 export declare function normalizeQuotaAccountId(value: string | undefined): string | null;
 export declare function normalizeQuotaEmail(value: string | undefined): string | null;
 export declare function hasUniqueQuotaAccountId(accounts: readonly QuotaCacheAccountRef[], account: QuotaCacheAccountRef): boolean;

package/dist/lib/quota-readiness.js

@@ -1,3 +1,4 @@
+import { extractAccountId } from "./auth/token-utils.js";
 import { createHash } from "node:crypto";
 import { resolveAccountRecordId } from "./storage/record-identity.js";
 export function normalizeQuotaAccountId(value) {
@@ -101,7 +102,7 @@ export function quotaWorkspaceKey(account, workspaceId) {
 export function quotaWorkspaceId(account) {
     return account.workspaces?.length
         ? account.workspaces[account.currentWorkspaceIndex ?? 0]?.id.trim()
-        : account.accountId?.trim();
+        : account.accountId?.trim() || extractAccountId(account.accessToken);
 }
 /** Read exact-workspace quota, using legacy binding entries only for that binding. */
 export function findQuotaCacheEntryForAccount(cache, account, accounts, emailFallbackState = buildQuotaEmailFallbackState(accounts), workspaceId = quotaWorkspaceId(account)) {
@@ -110,7 +111,10 @@ export function findQuotaCacheEntryForAccount(cache, account, accounts, emailFal
     const key = workspaceId && quotaWorkspaceKey(account, workspaceId);
     const scoped = key ? cache.byWorkspace?.[key] : undefined;
     // Legacy entries describe only the stored binding, never a sibling workspace.
-    if (normalizeQuotaAccountId(workspaceId) !== normalizeQuotaAccountId(account.accountId))
+    // A workspaces-bearing account whose selection does not resolve (invalid index
+    // or blank id) has no valid binding at all — never fall back to legacy keys.
+    if (normalizeQuotaAccountId(workspaceId) !== normalizeQuotaAccountId(account.accountId) ||
+        (account.workspaces?.length && !normalizeQuotaAccountId(workspaceId)))
         return scoped ?? null;
     const accountId = normalizeQuotaAccountId(account.accountId);
     const newer = (legacy) => scoped && (!legacy || scoped.updatedAt >= legacy.updatedAt) ? scoped : legacy ?? null;

package/dist/lib/runtime/account-model-catalog.d.ts

@@ -53,7 +53,7 @@ export declare class AccountModelCatalog {
             reasoningLevels: string[];
             accessPrograms: string[];
             probes?: {
-                [k: string]: "verified" | "unsupported" | "unverified" | "downgraded";
+                [k: string]: "unsupported" | "verified" | "unverified" | "downgraded";
             } | undefined;
             checkedAt?: number | undefined;
             model: string;

package/dist/lib/runtime/subscription-first-use.js

@@ -2,7 +2,7 @@ import { createUsageStreamScanner } from "../usage/usage-extraction.js";
 import { isRecord } from "../utils.js";
 /** Only personal included subscriptions may receive an automatic first-use probe. */
 export function needsSubscriptionFirstUse(snapshot, now) {
-    if (snapshot.status !== 200 || !["plus", "pro", "prolite"].includes(snapshot.planType?.toLowerCase() ?? ""))
+    if (snapshot.status !== 200 || !["plus", "pro", "prolite", "promax"].includes(snapshot.planType?.toLowerCase() ?? ""))
         return false;
     const allWindows = [snapshot.primary, snapshot.secondary];
     if (allWindows.some(window => typeof window.usedPercent === "number" && window.usedPercent !== 0))

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "codex-multi-auth",
-	"version": "2.18.0",
+	"version": "2.19.0",
 	"description": "Codex CLI multi-account OAuth manager with account switching, health checks, runtime rotation, diagnostics, and recovery tools for @openai/codex",
 	"main": "./dist/index.js",
 	"types": "./dist/index.d.ts",
@@ -177,7 +177,7 @@
 		"@codex-ai/plugin": "file:vendor/codex-ai-plugin",
 		"@codex-ai/sdk": "file:vendor/codex-ai-sdk",
 		"hono": "4.13.9",
-		"undici": "6.28.0",
+		"undici": "6.29.0",
 		"ws": "8.21.3",
 		"zod": "4.4.3"
 	},