codex-multi-auth 2.19.1 → 2.21.0

package/dist/lib/runtime-rotation-proxy.js

@@ -28,8 +28,9 @@ import { createServer } from "node:http";
 import * as zlib from "node:zlib";
 import { AccountManager, AUTH_INVALIDATION_MARKER, extractAccountId, } from "./accounts.js";
 import { withRoutingMutex } from "./routing-mutex.js";
+import { getQuotaKey } from "./accounts/rate-limits.js";
 import { getFetchTimeoutMs, getNetworkErrorCooldownMs, getRetryAllAccountsMaxRetries, getServerErrorCooldownMs, getSessionAffinity, getSessionAffinityMaxEntries, getSessionAffinityTtlMs, getStreamStallTimeoutMs, getMinRotationIntervalMs, getTokenInvalidationCooldownMs, getTokenRefreshSkewMs, getPidOffsetEnabled, getPreemptiveQuotaEnabled, getPreemptiveQuotaMaxDeferralMs, getPreemptiveQuotaRemainingPercent5h, getPreemptiveQuotaRemainingPercent7d, getContextBudgetGuardEnabled, getContextBudgetGuardSoftPercent, getContextBudgetGuardHardPercent, getContextBudgetGuardModelWindowOverrides, getRoutingMutexMode, getSchedulingStrategy, loadPluginConfig, } from "./config.js";
-import { CODEX_BASE_URL, HTTP_STATUS, OPENAI_HEADERS, OPENAI_HEADER_VALUES, URL_PATHS, } from "./constants.js";
+import { CODEX_BASE_URL, HTTP_STATUS, LUNA_RESERVE_MODEL, MAX_RATE_LIMIT_DELAY_MS, OPENAI_HEADERS, OPENAI_HEADER_VALUES, URL_PATHS, } from "./constants.js";
 import { getModelFamily } from "./prompts/codex.js";
 import { CURRENT_CODEX_MODEL } from "./request/helpers/model-map.js";
 import { recordRuntimeInferenceRequest, flushRuntimeInferenceActivity, mutateRuntimeObservabilitySnapshot, recordRuntimeAccountRecovery, recordRuntimePoolExhaustion, } from "./runtime/runtime-observability.js";
@@ -697,6 +698,38 @@ function buildResponsesRequestContext(req, body) {
         stableSessionKey: resolveStableSessionKey(headers, parsedBody),
     };
 }
+const CONFIRMED_QUOTA_EXHAUSTION_PREFIX = "__confirmed-quota-exhaustion:";
+function confirmedQuotaExhaustionKey(family, model) {
+    return `${CONFIRMED_QUOTA_EXHAUSTION_PREFIX}${getQuotaKey(family, model)}`;
+}
+/** Rewrite one ordinary Luna request to the separately metered Reserve model. */
+function switchRequestToLunaReserve(context) {
+    if (context.model !== "gpt-6-luna" && context.model !== "gpt-5.6-luna")
+        return false;
+    const body = parseRequestBody(context.body);
+    if (!body)
+        return false;
+    body.model = LUNA_RESERVE_MODEL;
+    // Reserve availability is independent from paid Fast service-tier access.
+    // Let the backend choose its supported tier instead of carrying a Luna-only
+    // preference into the fallback request.
+    delete body.service_tier;
+    context.body = Buffer.from(JSON.stringify(body));
+    context.model = LUNA_RESERVE_MODEL;
+    context.family = getModelFamily(LUNA_RESERVE_MODEL);
+    return true;
+}
+/** True only for 429s that identify subscription usage/quota exhaustion. */
+function isSubscriptionQuota429(status, bodyText) {
+    if (status !== HTTP_STATUS.TOO_MANY_REQUESTS)
+        return false;
+    const code = extractErrorCodeFromBody(bodyText)?.toLowerCase() ?? "";
+    if (code.includes("usage_limit") || code.includes("quota"))
+        return true;
+    if (code)
+        return false;
+    return /\busage[ _-]+limit[ _-]+(?:reached|exceeded|exhausted)\b|\bquota[ _-]+(?:reached|exceeded|exhausted)\b/i.test(bodyText);
+}
 function buildImageRequestContext(req, body, pathname) {
     return {
         ...buildResponsesRequestContext(req, body),
@@ -1198,13 +1231,14 @@ async function handleRequestInner(state, req, res, traceId) {
         }
         const requestStartedAt = state.now();
         let policyDecision = null;
+        let runtimePolicyState = null;
         let projectKey = null;
         let policyError = null;
         try {
-            const policyState = await loadRuntimePolicyState();
-            projectKey = policyState.project.projectKey;
+            runtimePolicyState = await loadRuntimePolicyState();
+            projectKey = runtimePolicyState.project.projectKey;
             policyDecision = await evaluateRuntimePolicy({
-                state: policyState,
+                state: runtimePolicyState,
                 accounts: accountManager.getAccountsSnapshot(),
                 model: context.model,
                 now: requestStartedAt,
@@ -1220,7 +1254,8 @@ async function handleRequestInner(state, req, res, traceId) {
             policyError = error instanceof Error ? error.message : String(error);
             state.status.lastError = policyError;
         }
-        usageRecorder = createRuntimeUsageRecorder({
+        /** Build a recorder for the model that actually serves this request. */
+        const createUsageRecorderForModel = (model) => createRuntimeUsageRecorder({
             source: "runtime-proxy",
             operation: isModelsRequest
                 ? "models"
@@ -1229,11 +1264,12 @@ async function handleRequestInner(state, req, res, traceId) {
                     : isImageRequest
                         ? "images"
                         : "responses",
-            model: context.model,
+            model,
             projectKey,
             requestId: traceId,
             startedAt: requestStartedAt,
         });
+        usageRecorder = createUsageRecorderForModel(context.model);
         if (policyError) {
             await usageRecorder.record({
                 outcome: "failure",
@@ -1340,11 +1376,11 @@ async function handleRequestInner(state, req, res, traceId) {
                         snapshot.lastAccountUpdatedAt = state.now();
                     });
                 });
-                const responseOutcome = new ResponseOutcome(upstream.headers.get("content-type")?.includes("text/event-stream") === true);
                 const scanner = createUsageStreamScanner({
                     contentType: upstream.headers.get("content-type"),
                     onEvent: event => responseOutcome.observe(event),
                 });
+                const responseOutcome = new ResponseOutcome(() => scanner.isSse());
                 const forwarded = await forwardStreamingResponse(upstream, res, state.status, () => controller.abort(), state.streamStallTimeoutMs, scanner.push, state.catalogEtag ? { "x-models-etag": state.catalogEtag } : undefined, () => { scanner.result(); return responseOutcome.finish(); });
                 const attemptedCredential = attemptedCredentialIndex === undefined ? undefined : apiRoutes[attemptedCredentialIndex];
                 if (!forwarded && attemptedCredential)
@@ -1483,6 +1519,35 @@ async function handleRequestInner(state, req, res, traceId) {
         // silently serving from another account.
         const pinnedIndex = state.forcedAccountIndex ?? storageMeta.pinnedAccountIndex;
         const isPinned = typeof pinnedIndex === "number";
+        let requestModelCatalog;
+        /** Rebuild native routing scopes after Luna is rewritten to separately metered Reserve. */
+        const rebuildReserveWorkspaceCandidates = async () => {
+            const modelCatalog = requestModelCatalog;
+            if (!(state.nativeOpenai && isResponsesRequest && context.model === LUNA_RESERVE_MODEL && modelCatalog))
+                return;
+            const body = parseRequestBody(context.body);
+            const effort = isRecord(body?.reasoning) && typeof body.reasoning.effort === "string" ? body.reasoning.effort : undefined;
+            const tier = typeof body?.service_tier === "string" ? body.service_tier : undefined;
+            if (!state.capabilityFailures)
+                state.capabilityFailures = new RuntimeCapabilityFailures(state.now);
+            const failures = state.capabilityFailures;
+            const eligibleAccounts = accountManager.getAccountsSnapshot().filter((account) => account.enabled !== false && (!isPinned || account.index === pinnedIndex) && !policyDecision?.blockedAccountIndexes.has(account.index));
+            const routableScopes = eligibleAccounts.flatMap(workspaceModelScopes).filter((scope) => scope.routable);
+            await modelCatalog.prepareRouting(routableScopes.map((scope) => scope.id), context.model, effort, tier, (key) => failures.supports(key, context.model ?? LUNA_RESERVE_MODEL, effort, tier));
+            workspaceCandidates.clear();
+            catalogEligibleKeys = new Set();
+            for (const key of Object.keys(subscriptionQuotaByAccount))
+                delete subscriptionQuotaByAccount[Number(key)];
+            for (const account of eligibleAccounts) {
+                const candidates = workspaceModelScopes(account).filter((scope) => scope.routable)
+                    .sort((a, b) => Number(b.selected) - Number(a.selected) || Number(b.bound) - Number(a.bound))
+                    .filter((scope) => failures.supports(scope.id, context.model ?? LUNA_RESERVE_MODEL, effort, tier) && modelCatalog.supportsForRouting(scope.id, context.model ?? LUNA_RESERVE_MODEL, effort, tier));
+                if (!candidates.length)
+                    continue;
+                workspaceCandidates.set(account.index, candidates);
+                catalogEligibleKeys.add(catalogAccountKey(account));
+            }
+        };
         if (state.nativeOpenai && (isModelsRequest || (isResponsesRequest && context.model))) {
             const requestedVersion = incomingUrl.searchParams.get("client_version") ?? incomingHeaders.get("version");
             const catalogClientVersion = requestedVersion && /^[0-9A-Za-z.+_-]{1,80}$/.test(requestedVersion) ? requestedVersion : undefined;
@@ -1557,6 +1622,7 @@ async function handleRequestInner(state, req, res, traceId) {
                 return JSON.parse(Buffer.concat(chunks).toString("utf8"));
             }, state.now);
             const modelCatalog = state.modelCatalog;
+            requestModelCatalog = modelCatalog;
             if (catalogsByVersion.size >= 4 && !catalogsByVersion.has(versionKey))
                 catalogsByVersion.delete(catalogsByVersion.keys().next().value ?? "");
             catalogsByVersion.set(versionKey, modelCatalog);
@@ -1700,9 +1766,11 @@ async function handleRequestInner(state, req, res, traceId) {
                         candidates.push(scope);
                 }
                 if (candidates.length) {
-                    candidates.sort((a, b) => compareSubscriptionQuota(subscriptionQuotaPreference(quotaForScope(account, a), state.now()), subscriptionQuotaPreference(quotaForScope(account, b), state.now())));
-                    const first = candidates[0];
-                    subscriptionQuotaByAccount[account.index] = subscriptionQuotaPreference(first ? quotaForScope(account, first) : null, state.now());
+                    if (requestedModel !== LUNA_RESERVE_MODEL) {
+                        candidates.sort((a, b) => compareSubscriptionQuota(subscriptionQuotaPreference(quotaForScope(account, a), state.now()), subscriptionQuotaPreference(quotaForScope(account, b), state.now())));
+                        const first = candidates[0];
+                        subscriptionQuotaByAccount[account.index] = subscriptionQuotaPreference(first ? quotaForScope(account, first) : null, state.now());
+                    }
                     workspaceCandidates.set(account.index, candidates);
                     catalogEligibleKeys.add(catalogAccountKey(account));
                     supported++;
@@ -1713,7 +1781,7 @@ async function handleRequestInner(state, req, res, traceId) {
                 return;
             }
         }
-        if (state.nativeOpenai && isResponsesRequest && context.model && resetCreditState?.lastRedemptionAt !== undefined) {
+        if (state.nativeOpenai && isResponsesRequest && context.model && context.model !== LUNA_RESERVE_MODEL && resetCreditState?.lastRedemptionAt !== undefined) {
             for (const [index, scopes] of workspaceCandidates) {
                 const account = accountManager.getAccountByIndex(index);
                 if (!account)
@@ -1724,7 +1792,7 @@ async function handleRequestInner(state, req, res, traceId) {
                         observations: state.subscriptionQuotaObservations ??= new Map(), now: state.now(), clearQuotaScheduler: a => state.preemptiveQuotaScheduler.clear(buildQuotaScheduleKey(a, context.family, context.model)) });
             }
         }
-        if (state.nativeOpenai && isResponsesRequest && context.model && !isPinned) {
+        if (state.nativeOpenai && isResponsesRequest && context.model && context.model !== LUNA_RESERVE_MODEL && !isPinned) {
             try {
                 await recoverResetQuota({ model: context.model, family: context.family, native: true, pinned: false, manager: accountManager,
                     scopes: workspaceCandidates, quotaForScope, priorityByAccount: policyDecision?.priorityByAccount, preferredIndex: storageMeta.pinnedAccountIndex, service: createResetCreditService(accountManager),
@@ -1738,6 +1806,52 @@ async function handleRequestInner(state, req, res, traceId) {
             // Recovery may have redeemed and written new reset state; the next request re-reads it.
             state.readCache?.delete("reset-credits");
         }
+        // A pinned Luna request can arrive after an earlier turn already proved
+        // ordinary subscription quota exhausted. That persisted family marker
+        // would make chooseAccount reject the hard pin before any upstream call,
+        // so move the request to the independently metered Reserve model first.
+        if (isPinned &&
+            (context.model === "gpt-6-luna" || context.model === "gpt-5.6-luna")) {
+            const pinnedAccount = accountManager.getAccountByIndex(pinnedIndex);
+            const now = state.now();
+            const familyResetAt = pinnedAccount?.rateLimitResetTimes[getQuotaKey(context.family)];
+            const modelResetAt = pinnedAccount?.rateLimitResetTimes[getQuotaKey(context.family, context.model)];
+            const confirmedQuotaResetAt = pinnedAccount?.rateLimitResetTimes[confirmedQuotaExhaustionKey(context.family, context.model)];
+            const persistedQuotaExhausted = typeof familyResetAt === "number" &&
+                familyResetAt > now &&
+                typeof confirmedQuotaResetAt === "number" &&
+                confirmedQuotaResetAt > now &&
+                !(typeof modelResetAt === "number" && modelResetAt > now);
+            if (persistedQuotaExhausted && switchRequestToLunaReserve(context)) {
+                usageRecorder = createUsageRecorderForModel(context.model);
+                if (runtimePolicyState) {
+                    try {
+                        const reservePolicy = await evaluateRuntimePolicy({ state: runtimePolicyState, accounts: accountManager.getAccountsSnapshot(), model: context.model, now });
+                        policyDecision = reservePolicy;
+                        mutateRuntimeObservabilitySnapshot((snapshot) => {
+                            snapshot.policyBlockedIndexes = [...reservePolicy.blockedAccountIndexes];
+                            snapshot.policyBlockedReasons = Object.fromEntries([...reservePolicy.blockedAccountIndexes].map((index) => [String(index), "policy-blocked"]));
+                        });
+                        if (!reservePolicy.allowed) {
+                            await usageRecorder.record({ outcome: "blocked", statusCode: reservePolicy.statusCode, errorCode: reservePolicy.errorCode });
+                            writeJson(res, reservePolicy.statusCode, { error: { message: "Runtime policy blocked Luna Reserve fallback.", code: reservePolicy.errorCode ?? "policy_blocked", reasons: reservePolicy.reasons } });
+                            return;
+                        }
+                    }
+                    catch {
+                        await usageRecorder.record({ outcome: "failure", statusCode: HTTP_STATUS.SERVICE_UNAVAILABLE, errorCode: "runtime_policy_unavailable" });
+                        writeJson(res, HTTP_STATUS.SERVICE_UNAVAILABLE, { error: { message: "Runtime policy could not be loaded for Luna Reserve fallback.", code: "runtime_policy_unavailable" } });
+                        return;
+                    }
+                }
+                attemptedIndexes.clear();
+                accountSkipReasons.clear();
+                await rebuildReserveWorkspaceCandidates();
+                state.status.lunaReserveFallbacks = (state.status.lunaReserveFallbacks ?? 0) + 1;
+                mutateRuntimeObservabilitySnapshot((snapshot) => { snapshot.lunaReserveFallbacks = (snapshot.lunaReserveFallbacks ?? 0) + 1; });
+                proxyLog.info("persisted Luna quota exhausted; routing pinned request through Luna Reserve", { traceId });
+            }
+        }
         // The token bucket spreads load across a selectable pool. A pin has no
         // alternative account, so exhausting that local heuristic can only reject a
         // request that the pinned account could serve. Keep circuit-breaker admission
@@ -1868,14 +1982,16 @@ async function handleRequestInner(state, req, res, traceId) {
             // calls inside `chooseAccount` are used unchanged and no lock is taken,
             // so default behavior and perf are identical to before.
             const selectAccount = () => {
-                for (const [index, scopes] of workspaceCandidates) {
-                    const account = accountManager.getAccountByIndex(index);
-                    if (!account)
-                        continue;
-                    scopes.sort((a, b) => compareSubscriptionQuota(subscriptionQuotaPreference(quotaForScope(account, a), state.now()), subscriptionQuotaPreference(quotaForScope(account, b), state.now())));
-                    const scope = scopes[0];
-                    if (scope)
-                        subscriptionQuotaByAccount[index] = subscriptionQuotaPreference(quotaForScope(account, scope), state.now());
+                if (context.model !== LUNA_RESERVE_MODEL) {
+                    for (const [index, scopes] of workspaceCandidates) {
+                        const account = accountManager.getAccountByIndex(index);
+                        if (!account)
+                            continue;
+                        scopes.sort((a, b) => compareSubscriptionQuota(subscriptionQuotaPreference(quotaForScope(account, a), state.now()), subscriptionQuotaPreference(quotaForScope(account, b), state.now())));
+                        const scope = scopes[0];
+                        if (scope)
+                            subscriptionQuotaByAccount[index] = subscriptionQuotaPreference(quotaForScope(account, scope), state.now());
+                    }
                 }
                 const result = chooseAccount({
                     accountManager,
@@ -1888,7 +2004,7 @@ async function handleRequestInner(state, req, res, traceId) {
                     policy: policyDecision,
                     pinnedIndex,
                     preferredIndex,
-                    subscriptionQuotaByAccount: state.nativeOpenai && isResponsesRequest ? subscriptionQuotaByAccount : undefined,
+                    subscriptionQuotaByAccount: state.nativeOpenai && isResponsesRequest && context.model !== LUNA_RESERVE_MODEL ? subscriptionQuotaByAccount : undefined,
                     fallbackPinnedIndex: state.nativeOpenai ? storageMeta.pinnedAccountIndex : null,
                     skipReasons: accountSkipReasons,
                     stickyBoostByAccount: rotationStickyBoost,
@@ -1964,7 +2080,9 @@ async function handleRequestInner(state, req, res, traceId) {
             attemptedIndexes.add(selected.index);
             const quotaScheduleKey = buildQuotaScheduleKey(selected, context.family, context.model);
             const preemptiveDeferral = state.preemptiveQuotaScheduler.getDeferral(quotaScheduleKey, state.now());
-            if (preemptiveDeferral.defer && preemptiveDeferral.waitMs > 0) {
+            if (context.model !== LUNA_RESERVE_MODEL &&
+                preemptiveDeferral.defer &&
+                preemptiveDeferral.waitMs > 0) {
                 accountSkipReasons.set(selected.index, preemptiveDeferral.reason ?? "quota-near-exhaustion");
                 exhaustionReason = "rate-limit";
                 capabilityRejectionIsLatest = false;
@@ -2253,8 +2371,9 @@ async function handleRequestInner(state, req, res, traceId) {
                 }
             };
             const quotaSnapshot = readQuotaSchedulerSnapshot(upstream.headers, upstream.status, state.now());
-            if (quotaSnapshot)
+            if (quotaSnapshot && context.model !== LUNA_RESERVE_MODEL) {
                 observeQuota(quotaSnapshot, upstream.headers.get("x-codex-plan-type") ?? undefined);
+            }
             if (isResponsesRequest && context.model && [400, 403, 404].includes(upstream.status)) {
                 const errorBody = await readErrorBody(upstream, state.streamStallTimeoutMs, 65536);
                 let data;
@@ -2309,7 +2428,9 @@ async function handleRequestInner(state, req, res, traceId) {
                 // A capacity 429 is not this account's quota. Marking it rate
                 // limited would take a healthy account out of the pool for the
                 // retry-after window on an outage that affects every account.
-                if (isModelAtCapacityError(upstream.status, bodyText)) {
+                const modelAtCapacity = isModelAtCapacityError(upstream.status, bodyText);
+                const subscriptionQuotaExceeded = isSubscriptionQuota429(upstream.status, bodyText);
+                if (modelAtCapacity) {
                     const outcome = await waitOutModelCapacity(retryAfterHintMs, refreshed.account);
                     if (outcome === "client-gone") {
                         await usageRecorder.record({
@@ -2323,12 +2444,55 @@ async function handleRequestInner(state, req, res, traceId) {
                     if (outcome === "retry")
                         continue;
                 }
-                state.preemptiveQuotaScheduler.markRateLimited(quotaScheduleKey, retryAfterMs, state.now());
-                // A 429 is the upstream quota signal for the attempted account, so
-                // keep the consumed runtime token drained.
+                if (context.model !== LUNA_RESERVE_MODEL && subscriptionQuotaExceeded) {
+                    state.preemptiveQuotaScheduler.markRateLimited(quotaScheduleKey, retryAfterMs, state.now());
+                }
+                // Every 429 still drains this account for its retry window, but only an
+                // explicit subscription-usage signal is persisted as quota exhaustion.
                 accountManager.recordRateLimit(refreshed.account, context.family, context.model);
-                accountManager.markRateLimitedWithReason(refreshed.account, retryAfterMs, context.family, "quota", context.model);
+                accountManager.markRateLimitedWithReason(refreshed.account, retryAfterMs, context.family, subscriptionQuotaExceeded ? "quota" : "unknown", context.model);
+                if (subscriptionQuotaExceeded &&
+                    (context.model === "gpt-6-luna" || context.model === "gpt-5.6-luna")) {
+                    const confirmedKey = confirmedQuotaExhaustionKey(context.family, context.model);
+                    const confirmedResetAt = state.now() +
+                        Math.min(Math.max(0, Math.floor(retryAfterMs)), MAX_RATE_LIMIT_DELAY_MS);
+                    refreshed.account.rateLimitResetTimes[confirmedKey] = Math.max(refreshed.account.rateLimitResetTimes[confirmedKey] ?? 0, confirmedResetAt);
+                }
                 accountManager.saveToDiskDebounced();
+                if (!modelAtCapacity && subscriptionQuotaExceeded && switchRequestToLunaReserve(context)) {
+                    usageRecorder = createUsageRecorderForModel(context.model);
+                    if (runtimePolicyState) {
+                        try {
+                            const reservePolicy = await evaluateRuntimePolicy({ state: runtimePolicyState, accounts: accountManager.getAccountsSnapshot(), model: context.model, now: state.now() });
+                            policyDecision = reservePolicy;
+                            mutateRuntimeObservabilitySnapshot((snapshot) => { snapshot.policyBlockedIndexes = [...reservePolicy.blockedAccountIndexes]; snapshot.policyBlockedReasons = Object.fromEntries([...reservePolicy.blockedAccountIndexes].map((index) => [String(index), "policy-blocked"])); });
+                            if (!reservePolicy.allowed) {
+                                await usageRecorder.record({ outcome: "blocked", statusCode: reservePolicy.statusCode, errorCode: reservePolicy.errorCode });
+                                writeJson(res, reservePolicy.statusCode, { error: { message: "Runtime policy blocked Luna Reserve fallback.", code: reservePolicy.errorCode ?? "policy_blocked", reasons: reservePolicy.reasons } });
+                                return;
+                            }
+                        }
+                        catch {
+                            await usageRecorder.record({ outcome: "failure", statusCode: HTTP_STATUS.SERVICE_UNAVAILABLE, errorCode: "runtime_policy_unavailable" });
+                            writeJson(res, HTTP_STATUS.SERVICE_UNAVAILABLE, { error: { message: "Runtime policy could not be loaded for Luna Reserve fallback.", code: "runtime_policy_unavailable" } });
+                            return;
+                        }
+                    }
+                    attemptedIndexes.clear();
+                    accountSkipReasons.clear();
+                    rejectedWorkspaces.clear();
+                    await rebuildReserveWorkspaceCandidates();
+                    state.status.lunaReserveFallbacks = (state.status.lunaReserveFallbacks ?? 0) + 1;
+                    mutateRuntimeObservabilitySnapshot((snapshot) => { snapshot.lunaReserveFallbacks = (snapshot.lunaReserveFallbacks ?? 0) + 1; });
+                    proxyLog.info("ordinary Luna quota exhausted; retrying with Luna Reserve", {
+                        traceId,
+                        pinned: isPinned,
+                    });
+                    capabilityRejectionIsLatest = false;
+                    exhaustionReason = "no-account";
+                    state.status.retries += 1;
+                    continue;
+                }
                 exhaustionReason = "rate-limit";
                 capabilityRejectionIsLatest = false;
                 transientAttempts += 1;
@@ -2544,9 +2708,11 @@ async function handleRequestInner(state, req, res, traceId) {
             // the forecast keeps reporting this working account as unavailable.
             // No-op when no reason is recorded, so the hot path stays write-free.
             const quotaDeferral = state.preemptiveQuotaScheduler.getDeferral(quotaScheduleKey, state.now());
-            const nearExhaustionWaitMs = quotaDeferral.defer
-                ? quotaDeferral.waitMs
-                : 0;
+            const nearExhaustionWaitMs = context.model === LUNA_RESERVE_MODEL
+                ? 0
+                : quotaDeferral.defer
+                    ? quotaDeferral.waitMs
+                    : 0;
             if (nearExhaustionWaitMs > 0) {
                 accountManager.markRateLimitedWithReason(refreshed.account, nearExhaustionWaitMs, context.family, "quota", context.model);
                 state.sessionAffinityStore?.forgetSession(context.sessionKey);
@@ -2565,11 +2731,12 @@ async function handleRequestInner(state, req, res, traceId) {
             // evaluateBudgetGuard compares `0 >= limit` for maxTokens/maxCostUsd
             // and those caps never fire — `budget set --cost 50` would allow
             // unlimited spend, with only --requests actually enforced.
-            const responseOutcome = new ResponseOutcome(isResponsesRequest && upstream.headers.get("content-type")?.includes("text/event-stream") === true);
             const usageScanner = createUsageStreamScanner({
                 contentType: upstream.headers.get("content-type"),
                 onEvent: (event) => {
                     responseOutcome.observe(event);
+                    if (context.model === LUNA_RESERVE_MODEL)
+                        return;
                     const snapshot = readSubscriptionQuotaEvent(event, state.now());
                     if (!snapshot)
                         return;
@@ -2578,6 +2745,7 @@ async function handleRequestInner(state, req, res, traceId) {
                     state.status.lastStreamQuotaUpdateAt = snapshot.updatedAt;
                 },
             });
+            const responseOutcome = new ResponseOutcome(() => isResponsesRequest && usageScanner.isSse());
             let streamErrored = false;
             const forwarded = await forwardStreamingResponse(upstream, res, state.status, () => {
                 streamErrored = true;

package/dist/lib/usage/pricing.d.ts

@@ -51,7 +51,7 @@ export declare const SHORT_CONTEXT_MAX_INPUT_TOKENS = 272000;
  * `test/usage-pricing-coverage.test.ts` fails if a NEW routable model appears
  * in neither list.
  */
-export declare const UNPRICED_ROUTABLE_MODELS: readonly ["gpt-daybreak-blue-latest", "gpt-daybreak-red-latest"];
+export declare const UNPRICED_ROUTABLE_MODELS: readonly ["gpt-reserve", "gpt-daybreak-blue-latest", "gpt-daybreak-red-latest"];
 export declare function getUsageModelPricing(model: string | null | undefined): UsageModelPricing | null;
 export declare function estimateUsageCostUsd(model: string | null | undefined, tokens: UsageTokenCounts): number | null;
 export declare function listUsageModelPricing(): Record<string, UsageModelPricing>;

package/dist/lib/usage/pricing.js

@@ -168,6 +168,10 @@ const MODEL_PRICING = {
  * in neither list.
  */
 export const UNPRICED_ROUTABLE_MODELS = [
+    // Luna Reserve is a separately metered subscription allowance. The backend
+    // exposes usage percentage, not a public per-token dollar rate; cost budgets
+    // therefore remain fail-closed instead of borrowing Luna API pricing.
+    "gpt-reserve",
     // The Daybreak cyber models are sold under a separate controlled-access
     // agreement with no public per-token rate.
     "gpt-daybreak-blue-latest",

package/dist/lib/usage/usage-extraction.d.ts

@@ -22,6 +22,8 @@ export declare function extractUsageTokenCounts(usage: unknown): UsageTokenCount
  */
 export declare function extractResponsesUsage(payload: unknown): UsageTokenCounts | null;
 export interface UsageStreamScanner {
+    /** The shared format decision, updated as the bounded body prefix arrives. */
+    isSse: () => boolean;
     /** Feed one forwarded chunk. Never throws. */
     push: (chunk: Uint8Array) => void;
     /** Flush any trailing partial data and return the final counts, if any. */

package/dist/lib/usage/usage-extraction.js

@@ -9,6 +9,8 @@
  */
 /** Cap on retained bytes so a hostile or unterminated body cannot grow forever. */
 const MAX_BUFFERED_BYTES = 1_048_576;
+/** Only inspect this many leading bytes when the media type does not identify SSE. */
+const MAX_SNIFF_BYTES = 4_096;
 /** Terminal Responses stream events that carry the final `usage` object. */
 const TERMINAL_EVENT_TYPES = new Set([
     "response.completed",
@@ -132,7 +134,11 @@ export function extractResponsesUsage(payload) {
  * bound.
  */
 export function createUsageStreamScanner(options) {
-    const sse = (options.contentType ?? "").toLowerCase().includes("text/event-stream");
+    let sse = (options.contentType ?? "").toLowerCase().includes("text/event-stream");
+    let sniffing = !sse;
+    let sniffedBytes = 0;
+    let sniffPrefix = "";
+    const sniffDecoder = new TextDecoder("utf-8");
     const decoder = new TextDecoder("utf-8");
     let pending = "";
     let bufferedBytes = 0;
@@ -190,11 +196,29 @@ export function createUsageStreamScanner(options) {
         }
         eventData.push(value);
     };
+    const sniffFormat = (chunk) => {
+        if (!sniffing)
+            return;
+        const prefix = chunk.subarray(0, MAX_SNIFF_BYTES - sniffedBytes);
+        sniffedBytes += prefix.byteLength;
+        sniffPrefix += sniffDecoder.decode(prefix, { stream: true });
+        // Match only at the start (after blank lines/BOM), never a data: string
+        // inside JSON. A field or comment identifies SSE before a possibly huge
+        // event arrives, so streaming never depends on buffering its whole frame.
+        sse = /^(?:\r?\n)*(?::|(?:data|event|id|retry):)/.test(sniffPrefix);
+        const first = sniffPrefix.trimStart()[0];
+        if (sse || first === "{" || first === "[" || sniffedBytes >= MAX_SNIFF_BYTES) {
+            sniffing = false;
+            sniffPrefix = "";
+        }
+    };
     return {
+        isSse: () => sse,
         push: (chunk) => {
             try {
                 if (overflowed || chunk.byteLength === 0)
                     return;
+                sniffFormat(chunk);
                 bufferedBytes += chunk.byteLength;
                 pending += decoder.decode(chunk, { stream: true });
                 if (!sse) {

package/dist/lib/utils.d.ts

@@ -18,7 +18,7 @@ export declare function isAbortError(error: unknown): boolean;
  * Combines two abort signals into one that aborts when the FIRST input does.
  *
  * This is a thin null-tolerant wrapper over `AbortSignal.any` — available
- * since Node 18.17.0, which the engines floor already requires. Using the
+ * on every Node version the engines floor (`>=22.19`) permits. Using the
  * native composite matters beyond brevity: a manual addEventListener pair
  * stays registered on BOTH inputs until one fires, so a caller that combines
  * a long-lived signal (e.g. a proxy-lifetime abort) once per request would

package/dist/lib/utils.js

@@ -25,7 +25,7 @@ export function isAbortError(error) {
  * Combines two abort signals into one that aborts when the FIRST input does.
  *
  * This is a thin null-tolerant wrapper over `AbortSignal.any` — available
- * since Node 18.17.0, which the engines floor already requires. Using the
+ * on every Node version the engines floor (`>=22.19`) permits. Using the
  * native composite matters beyond brevity: a manual addEventListener pair
  * stays registered on BOTH inputs until one fires, so a caller that combines
  * a long-lived signal (e.g. a proxy-lifetime abort) once per request would

package/node_modules/@codex-ai/plugin/dist/index.d.ts

@@ -1,2 +1,2 @@
-export type PluginInput = any;
-export type Plugin = any;
+export type PluginInput = any;
+export type Plugin = any;

package/node_modules/@codex-ai/plugin/dist/index.js

@@ -1,2 +1,2 @@
-export {};
-
+export {};
+

package/node_modules/@codex-ai/plugin/dist/tool.d.ts

@@ -1,42 +1,42 @@
-export interface ToolContext {
-  [key: string]: any;
-  directory: string;
-  worktree: string;
-  ask: (request: any) => Promise<any> | any;
-}
-
-export interface ToolDefinition<TArgs = any, TResult = any> {
-  description?: string;
-  args?: Record<string, any>;
-  parameters?: unknown;
-  execute: (args: TArgs, context: ToolContext) => Promise<TResult> | TResult;
-  [key: string]: any;
-}
-
-export interface SchemaNode {
-  optional: () => SchemaNode;
-  describe: (_text: string) => SchemaNode;
-  min: (_value: number) => SchemaNode;
-  max: (_value: number) => SchemaNode;
-  default: (_value: unknown) => SchemaNode;
-  int: () => SchemaNode;
-  array: (_node?: unknown) => SchemaNode;
-  [key: string]: any;
-}
-
-export interface ToolFactory {
-  <TArgs = any, TResult = any>(definition: ToolDefinition<TArgs, TResult>): ToolDefinition<TArgs, TResult>;
-  schema: {
-    string: () => SchemaNode;
-    number: () => SchemaNode;
-    boolean: () => SchemaNode;
-    object: (shape: Record<string, unknown>) => SchemaNode;
-    enum: (values: readonly unknown[]) => SchemaNode;
-    literal: (value: unknown) => SchemaNode;
-    array: (node: unknown) => SchemaNode;
-    any: () => SchemaNode;
-    unknown: () => SchemaNode;
-  };
-}
-
-export declare const tool: ToolFactory;
+export interface ToolContext {
+  [key: string]: any;
+  directory: string;
+  worktree: string;
+  ask: (request: any) => Promise<any> | any;
+}
+
+export interface ToolDefinition<TArgs = any, TResult = any> {
+  description?: string;
+  args?: Record<string, any>;
+  parameters?: unknown;
+  execute: (args: TArgs, context: ToolContext) => Promise<TResult> | TResult;
+  [key: string]: any;
+}
+
+export interface SchemaNode {
+  optional: () => SchemaNode;
+  describe: (_text: string) => SchemaNode;
+  min: (_value: number) => SchemaNode;
+  max: (_value: number) => SchemaNode;
+  default: (_value: unknown) => SchemaNode;
+  int: () => SchemaNode;
+  array: (_node?: unknown) => SchemaNode;
+  [key: string]: any;
+}
+
+export interface ToolFactory {
+  <TArgs = any, TResult = any>(definition: ToolDefinition<TArgs, TResult>): ToolDefinition<TArgs, TResult>;
+  schema: {
+    string: () => SchemaNode;
+    number: () => SchemaNode;
+    boolean: () => SchemaNode;
+    object: (shape: Record<string, unknown>) => SchemaNode;
+    enum: (values: readonly unknown[]) => SchemaNode;
+    literal: (value: unknown) => SchemaNode;
+    array: (node: unknown) => SchemaNode;
+    any: () => SchemaNode;
+    unknown: () => SchemaNode;
+  };
+}
+
+export declare const tool: ToolFactory;