codex-multi-auth 2.20.0 → 2.22.0

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-multi-auth",
-	"version": "2.20.0",
+	"version": "2.22.0",
   "description": "Install and operate codex-multi-auth for the official @openai/codex CLI with multi-account OAuth rotation, switching, health checks, and recovery tools.",
   "interface": {
     "composerIcon": "./assets/codex-multi-auth-icon.svg"

package/README.md

@@ -16,8 +16,9 @@ Using OpenCode rather than the Codex CLI? The sibling project [`oc-codex-multi-a
 ## What it does
 
 - **Account pool** — OAuth login for multiple ChatGPT accounts, stored locally under `~/.codex/multi-auth` (files `0600`, directories `0700`), with per-project pools under `projects/<project-key>/`.
-- **Switching and selection** — pin an account, pick the forecast-best one, or let health- and quota-aware hybrid selection rotate for you.
-- **Runtime rotation** — a default-on, loopback-only proxy that forwards Responses API and model-discovery traffic through the best available account during wrapper-launched Codex sessions.
+- **Switching and selection** — pin an account, pick the forecast-best one, follow saved account order within customized priority tiers with sequential scheduling, or let health- and quota-aware hybrid selection rotate for you.
+- **Runtime rotation** — a default-on, loopback-only proxy that forwards Responses API, model-discovery, image, thread-goal, and Codex dictation/transcription traffic through managed accounts during wrapper-launched Codex sessions.
+- **API capability evidence** — opted-in API/ZDR routes receive daily billable checks while the router runs; status distinguishes configured access programs from verified responses. See [check behavior and controls](docs/reference/commands.md#codex-multi-auth-check).
 - **Diagnostics and repair** — status, live health checks, quota forecasts, JSON reports, and `fix`/`doctor`/`verify` commands that recover stale or damaged local state.
 - **Luna Reserve fallback** — treats `gpt-reserve` as a separately metered Luna allowance, automatically falls back after a genuine Luna quota 429, and exposes the Reserve percentage through `limits --json --refresh`.
 - **Local governance** — file-backed usage ledger, budget guards, account tags/weights/pause/drain policies, routing profiles, and an optional loopback bridge with bearer tokens for local OpenAI-compatible clients.
@@ -94,7 +95,7 @@ codex-multi-auth rotation status              # is live rotation enabled?
 
 ## Runtime rotation, in one paragraph
 
-With rotation on (the default), request-bearing wrapper commands — `exec`, `review`, `resume`, `fork`, `app`, and the bare TUI — route through a local proxy that picks the healthiest account per request, refreshes tokens as needed, and fails over across the pool on rate limits within a bounded retry budget. The proxy listens on loopback only, authenticates its own clients with a per-process token, forwards only Responses API, model-discovery, image, and thread-goal calls, and never writes account emails or tokens to client headers or logs. Plain `codex` is never touched: rotation exists only inside `codex-multi-auth-codex`/`mcodex` sessions, or inside the packaged desktop app after an opt-in, reversible bind. Turn it off with `codex-multi-auth rotation disable` or `CODEX_MULTI_AUTH_RUNTIME_ROTATION_PROXY=0`.
+With rotation on (the default), request-bearing wrapper commands — `exec`, `review`, `resume`, `fork`, `app`, and the bare TUI — route through a local proxy that picks the healthiest account per request, refreshes tokens as needed, and fails over across the pool on rate limits within a bounded retry budget. The proxy listens on loopback only, authenticates its own clients with a per-process token, forwards only Responses API, model-discovery, image, thread-goal, and `POST /transcribe` calls, and never writes account emails or tokens to client headers or logs. Transcription preserves the incoming multipart audio body and boundary, uses managed ChatGPT OAuth, and does not replay ambiguous audio uploads across accounts. Plain `codex` is never touched: rotation exists only inside `codex-multi-auth-codex`/`mcodex` sessions, or inside the packaged desktop app after an opt-in, reversible bind. Turn it off with `codex-multi-auth rotation disable` or `CODEX_MULTI_AUTH_RUNTIME_ROTATION_PROXY=0`.
 
 ## Where state lives
 
@@ -138,7 +139,7 @@ Common symptoms — wrong active account, OAuth callback port `1455` already bou
 
 ## Release notes
 
-- Current stable: [v2.20.0](docs/releases/v2.20.0.md) — `npm i -g codex-multi-auth`
+- Current stable: [v2.22.0](docs/releases/v2.22.0.md) — `npm i -g codex-multi-auth`
 - Earlier stable lines: [v2.6.0](docs/releases/v2.6.0.md), [v2.5.0](docs/releases/v2.5.0.md)
 - Full release archive: [docs/README.md#release-history](docs/README.md#release-history)
 

package/dist/lib/accounts.d.ts

@@ -70,6 +70,7 @@ export declare class AccountManager {
     private readonly persistedWorkspaceSelections;
     private readonly persistedWorkspaces;
     private hadPersistedStorage;
+    private readonly loadedAccountStorageSnapshot;
     private cursorByFamily;
     private currentAccountIndexByFamily;
     private lastToastAccountIndex;
@@ -103,6 +104,10 @@ export declare class AccountManager {
      */
     private routingMutexMode;
     static loadFromDisk(authFallback?: OAuthAuthDetails): Promise<AccountManager>;
+    /** @internal True when construction received a parsed/recovered storage snapshot. */
+    hasLoadedAccountStorageSnapshot(): boolean;
+    /** @internal True only when this account identity was explicitly persisted, not legacy-derived in memory. */
+    hasPersistedRecordId(account: ManagedAccount): boolean;
     hasRefreshToken(refreshToken: string): boolean;
     private hydrateFromCodexCli;
     constructor(authFallback?: OAuthAuthDetails, stored?: AccountStorageV3 | null);

package/dist/lib/accounts.js

@@ -142,6 +142,7 @@ export class AccountManager {
     persistedWorkspaceSelections = new WeakMap();
     persistedWorkspaces = new WeakMap();
     hadPersistedStorage = false;
+    loadedAccountStorageSnapshot;
     cursorByFamily = initFamilyState(0);
     currentAccountIndexByFamily = initFamilyState(-1);
     lastToastAccountIndex = -1;
@@ -202,6 +203,18 @@ export class AccountManager {
         await manager.hydrateFromCodexCli();
         return manager;
     }
+    /** @internal True when construction received a parsed/recovered storage snapshot. */
+    hasLoadedAccountStorageSnapshot() {
+        return this.loadedAccountStorageSnapshot;
+    }
+    /** @internal True only when this account identity was explicitly persisted, not legacy-derived in memory. */
+    hasPersistedRecordId(account) {
+        const recordId = account.recordId?.trim();
+        if (!recordId || !this.persistenceBaseline)
+            return false;
+        const baseline = this.persistenceBaseline.accounts.find((row) => resolveAccountRecordId(row) === recordId);
+        return typeof baseline?.recordId === "string" && baseline.recordId.trim().length > 0;
+    }
     hasRefreshToken(refreshToken) {
         return this.accounts.some((account) => account.refreshToken === refreshToken);
     }
@@ -266,6 +279,7 @@ export class AccountManager {
     }
     constructor(authFallback, stored) {
         this.storagePathState = { ...getStoragePathState() };
+        this.loadedAccountStorageSnapshot = stored !== undefined && stored !== null;
         this.hadPersistedStorage = existsSync(this.resolveSelectionStoragePath());
         const fallbackAccountId = extractAccountId(authFallback?.access)?.trim() || undefined;
         const fallbackAccountEmail = sanitizeEmail(extractAccountEmail(authFallback?.access));
@@ -522,6 +536,7 @@ export class AccountManager {
                 _runtimeTrackerKey: trackerKey,
                 circuitKeyId,
                 rateLimitResetTimes: { ...account.rateLimitResetTimes },
+                workspaces: account.workspaces?.map((workspace) => ({ ...workspace })),
             };
         });
     }
@@ -1377,6 +1392,14 @@ export class AccountManager {
                 if (!storedAccount) {
                     return null;
                 }
+                const liveAccount = this.getAccountByIdentity(source, auth);
+                // Credential rotation proves auth health only. It must not erase an
+                // unrelated inference network/server/rate-limit backoff that happens
+                // to be live on the same account.
+                const preserveNonAuthCooldown = liveAccount?.cooldownReason !== undefined &&
+                    liveAccount.cooldownReason !== "auth-failure" &&
+                    typeof liveAccount.coolingDownUntil === "number" &&
+                    liveAccount.coolingDownUntil > nowMs();
                 storedAccount.refreshToken = auth.refresh;
                 storedAccount.accessToken = auth.access;
                 storedAccount.expiresAt = auth.expires;
@@ -1391,9 +1414,14 @@ export class AccountManager {
                 storedAccount.enabled = undefined;
                 delete storedAccount.authInvalidatedAt;
                 delete storedAccount.authInvalidationErrorCode;
-                delete storedAccount.coolingDownUntil;
-                delete storedAccount.cooldownReason;
-                const liveAccount = this.getAccountByIdentity(source, auth);
+                if (preserveNonAuthCooldown && liveAccount) {
+                    storedAccount.coolingDownUntil = liveAccount.coolingDownUntil;
+                    storedAccount.cooldownReason = liveAccount.cooldownReason;
+                }
+                else {
+                    delete storedAccount.coolingDownUntil;
+                    delete storedAccount.cooldownReason;
+                }
                 if (liveAccount) {
                     const previousLiveAccountState = {
                         access: liveAccount.access,
@@ -1411,7 +1439,8 @@ export class AccountManager {
                     };
                     this.updateFromAuth(liveAccount, auth);
                     liveAccount.enabled = true;
-                    this.clearAccountCooldown(liveAccount);
+                    if (!preserveNonAuthCooldown)
+                        this.clearAccountCooldown(liveAccount);
                     this.clearAuthFailures(liveAccount);
                     try {
                         await this.persistSnapshot(_current, nextStorage, persist, storedAccount);

package/dist/lib/api-route-store.d.ts

@@ -1,5 +1,7 @@
 import { z } from "zod";
 declare const routeSchema: z.ZodObject<{
+    capabilityEpoch: z.ZodOptional<z.ZodString>;
+    legacyCapabilityCache: z.ZodOptional<z.ZodBoolean>;
     id: z.ZodString;
     label: z.ZodString;
     kind: z.ZodEnum<{
@@ -19,5 +21,9 @@ export type ApiRouteCredential = z.infer<typeof routeSchema>;
 export declare function getApiRoutesPath(): string;
 export declare function loadApiRoutes(path?: string): Promise<ApiRouteCredential[]>;
 export declare function saveApiRoutes(routes: ApiRouteCredential[], path?: string, expected?: ApiRouteCredential[]): Promise<void>;
+/** Return our committed snapshot, never a later writer's configuration. */
+export declare function saveApiRoutesSnapshot(routes: ApiRouteCredential[], path?: string, expected?: ApiRouteCredential[]): Promise<ApiRouteCredential[]>;
 export declare function updateApiModelDiscovery(route: ApiRouteCredential, models: string[], path?: string): Promise<ApiRouteCredential>;
+/** Migrate legacy ownership before taking any capability lease or cache lock. */
+export declare function ensureApiRouteCapabilityEpoch(route: ApiRouteCredential, signal?: AbortSignal): Promise<ApiRouteCredential | undefined>;
 export {};

package/dist/lib/api-route-store.js

@@ -1,3 +1,4 @@
+import { randomUUID } from "node:crypto";
 import { promises as fs } from "node:fs";
 import { dirname, join } from "node:path";
 import { z } from "zod";
@@ -15,6 +16,9 @@ const programId = z.string().min(1).max(80).regex(/^[A-Za-z0-9][A-Za-z0-9._-]*$/
 const accessPrograms = z.record(programId, z.array(programId).max(32))
     .refine(value => Object.keys(value).length <= 16);
 const routeSchema = z.object({
+    /** Internal lifetime token. Store-owned; never trust an incoming token. */
+    capabilityEpoch: z.string().uuid().optional(),
+    legacyCapabilityCache: z.boolean().optional(),
     id: z
         .string()
         .min(1)
@@ -52,6 +56,9 @@ function validate(value) {
         throw new Error("Invalid API route configuration");
     return parsed.data.routes;
 }
+class InvalidApiRouteContentsError extends Error {
+    constructor() { super("Invalid API route configuration"); }
+}
 export async function loadApiRoutes(path = getApiRoutesPath()) {
     let raw;
     try {
@@ -78,39 +85,80 @@ export async function loadApiRoutes(path = getApiRoutesPath()) {
         return validate(JSON.parse(raw));
     }
     catch {
-        throw new Error("Invalid API route configuration");
+        throw new InvalidApiRouteContentsError();
     }
 }
-export async function saveApiRoutes(routes, path = getApiRoutesPath(), expected) {
+export function saveApiRoutes(routes, path = getApiRoutesPath(), expected) {
+    return saveApiRoutesInternal(routes, path, expected);
+}
+/** Return our committed snapshot, never a later writer's configuration. */
+export async function saveApiRoutesSnapshot(routes, path = getApiRoutesPath(), expected) {
+    let saved = [];
+    await saveApiRoutesInternal(routes, path, expected, false, undefined, value => { saved = value; });
+    return saved;
+}
+async function saveApiRoutesInternal(routes, path = getApiRoutesPath(), expected, discoveryExpansion = false, signal, onSaved) {
+    await withStorageLock(() => withFileTransactionLock(path, () => saveApiRoutesLocked(routes, path, expected, discoveryExpansion, signal, onSaved), { signal }));
+}
+async function saveApiRoutesLocked(routes, path = getApiRoutesPath(), expected, discoveryExpansion = false, signal, onSaved) {
     const validated = validate({ version: 1, routes });
-    const serialized = JSON.stringify({ version: 1, routes: validated }) + "\n";
+    let serialized = JSON.stringify({ version: 1, routes: validated }) + "\n";
     if (Buffer.byteLength(serialized) > 1024 * 1024)
         throw new Error("API route configuration is too large");
-    await withStorageLock(() => withFileTransactionLock(path, async () => {
-        await fs.mkdir(dirname(path), { recursive: true, mode: 0o700 });
-        const temp = tempPathFor(path);
-        try {
-            if (expected &&
-                JSON.stringify(await loadApiRoutes(path)) !==
-                    JSON.stringify(validate({ version: 1, routes: expected }))) {
-                throw new Error("API route configuration changed; reopen the menu before saving.");
-            }
-            await fs.writeFile(temp, serialized, { mode: 0o600, flag: "wx" });
-            await withRetry(() => fs.rename(temp, path), {
-                maxAttempts: 6,
-                backoffMs: 25,
-            });
-        }
-        finally {
-            await withRetry(() => fs.unlink(temp), {
-                maxAttempts: 6,
-                backoffMs: 25,
-            }).catch((error) => {
-                if (error.code !== "ENOENT")
-                    throw error;
-            });
+    signal?.throwIfAborted();
+    let current;
+    try {
+        current = await loadApiRoutes(path);
+    }
+    catch (error) {
+        // Only explicit replacement may repair parsed-content corruption. CAS,
+        // oversized reads and I/O failures must not be treated as an empty store.
+        if (expected !== undefined || !(error instanceof InvalidApiRouteContentsError))
+            throw error;
+        current = [];
+    }
+    await fs.mkdir(dirname(path), { recursive: true, mode: 0o700 });
+    const temp = tempPathFor(path);
+    try {
+        if (expected &&
+            JSON.stringify(current) !==
+                JSON.stringify(validate({ version: 1, routes: expected }))) {
+            throw new Error("API route configuration changed; reopen the menu before saving.");
         }
-    }));
+        const owned = validated.map(route => {
+            const old = current.find(value => value.id === route.id);
+            const policy = (value) => JSON.stringify([
+                value.kind, value.apiKey, value.enabled, value.probeCapabilities,
+                value.accessPrograms, value.modelAccessPrograms,
+                // Visibility is a selection set; menu ordering is not a policy edit.
+                ...(discoveryExpansion ? [] : [[...new Set(value.visibleModels)].sort()]),
+            ]);
+            const sameLifetime = old && policy(old) === policy(route);
+            const withoutLegacy = { ...route };
+            delete withoutLegacy.legacyCapabilityCache;
+            return { ...withoutLegacy, capabilityEpoch: sameLifetime ? old.capabilityEpoch ?? randomUUID() : randomUUID(),
+                ...(sameLifetime && (!old.capabilityEpoch || old.legacyCapabilityCache === true) ? { legacyCapabilityCache: true } : {}) };
+        });
+        serialized = JSON.stringify({ version: 1, routes: owned }) + "\n";
+        if (Buffer.byteLength(serialized) > 1024 * 1024)
+            throw Error("API route configuration is too large");
+        await fs.writeFile(temp, serialized, { mode: 0o600, flag: "wx" });
+        signal?.throwIfAborted();
+        await withRetry(() => fs.rename(temp, path), {
+            maxAttempts: 6,
+            backoffMs: 25,
+        });
+        onSaved?.(owned);
+    }
+    finally {
+        await withRetry(() => fs.unlink(temp), {
+            maxAttempts: 6,
+            backoffMs: 25,
+        }).catch((error) => {
+            if (error.code !== "ENOENT")
+                throw error;
+        });
+    }
 }
 /** Persist a discovery baseline and new GPT text IDs without undoing menu edits.
  * Callers supply IDs already filtered for the Responses endpoint family. */
@@ -122,7 +170,8 @@ export function updateApiModelDiscovery(route, models, path = getApiRoutesPath()
 }
 async function updateApiModelDiscoverySerial(route, models, path = getApiRoutesPath()) {
     const routes = await loadApiRoutes(path);
-    const current = routes.find((r) => r.id === route.id && r.apiKey === route.apiKey && r.kind === route.kind);
+    const current = routes.find((r) => r.id === route.id && r.apiKey === route.apiKey && r.kind === route.kind &&
+        (!route.capabilityEpoch || route.capabilityEpoch === r.capabilityEpoch));
     if (!current)
         return { ...route, enabled: false, visibleModels: [] };
     if (!current.enabled)
@@ -139,7 +188,26 @@ async function updateApiModelDiscoverySerial(route, models, path = getApiRoutesP
         knownModels: [...known],
         visibleModels: [...visible],
     };
+    let persisted = updated;
     if (JSON.stringify(updated) !== JSON.stringify(current))
-        await saveApiRoutes(routes.map((r) => (r.id === current.id ? updated : r)), path, routes);
-    return updated;
+        await saveApiRoutesInternal(routes.map((r) => (r.id === current.id ? updated : r)), path, routes, true, undefined, values => { const saved = values.find(value => value.id === updated.id); if (saved)
+            persisted = saved; });
+    return persisted;
+}
+/** Migrate legacy ownership before taking any capability lease or cache lock. */
+export async function ensureApiRouteCapabilityEpoch(route, signal) {
+    return withStorageLock(() => withFileTransactionLock(getApiRoutesPath(), async () => {
+        signal?.throwIfAborted();
+        const current = await loadApiRoutes();
+        const match = current.find(value => value.id === route.id && value.kind === route.kind && value.apiKey === route.apiKey);
+        if (!match || (route.capabilityEpoch && route.capabilityEpoch !== match.capabilityEpoch))
+            return undefined;
+        if (match.capabilityEpoch)
+            return match;
+        let migrated;
+        await saveApiRoutesLocked(current, getApiRoutesPath(), current, false, signal, values => {
+            migrated = values.find(value => value.id === route.id);
+        });
+        return migrated;
+    }, { signal }));
 }

package/dist/lib/codex-manager/api-login-menu.d.ts

@@ -2,7 +2,7 @@ import { type ApiRouteCredential } from "../api-route-store.js";
 import { type MenuItem } from "../ui/select.js";
 interface MenuDeps {
     load: () => Promise<ApiRouteCredential[]>;
-    save: (routes: ApiRouteCredential[], expected: ApiRouteCredential[]) => Promise<void>;
+    save: (routes: ApiRouteCredential[], expected: ApiRouteCredential[]) => Promise<ApiRouteCredential[]>;
     select: (items: MenuItem<string>[], message: string) => Promise<string | null>;
     text: (message: string) => Promise<string>;
     secret: () => Promise<string>;

package/dist/lib/codex-manager/api-login-menu.js

@@ -1,7 +1,7 @@
 import { randomUUID } from "node:crypto";
 import { createInterface } from "node:readline/promises";
 import { Writable } from "node:stream";
-import { loadApiRoutes, saveApiRoutes, } from "../api-route-store.js";
+import { loadApiRoutes, saveApiRoutesSnapshot, } from "../api-route-store.js";
 import { ApiModelRuntime } from "../runtime/api-model-runtime.js";
 import { select } from "../ui/select.js";
 async function ask(message, secret = false) {
@@ -35,7 +35,7 @@ async function ask(message, secret = false) {
 }
 const defaults = {
     load: loadApiRoutes,
-    save: (routes, expected) => saveApiRoutes(routes, undefined, expected),
+    save: (routes, expected) => saveApiRoutesSnapshot(routes, undefined, expected),
     select: (items, message) => select(items, { message, allowEscape: true }),
     text: (message) => ask(message),
     secret: () => ask("API key (hidden): ", true),
@@ -189,8 +189,7 @@ export async function runApiLoginMenu(overrides = {}) {
                 }
                 if (action !== "models") {
                     const next = routes.map((r) => (r.id === route?.id ? route : r));
-                    await d.save(next, routes);
-                    routes = next;
+                    routes = await d.save(next, routes);
                     continue;
                 }
             }
@@ -203,8 +202,7 @@ export async function runApiLoginMenu(overrides = {}) {
             const next = routes.some((r) => r.id === edited.id)
                 ? routes.map((r) => (r.id === edited.id ? edited : r))
                 : [...routes, edited];
-            await d.save(next, routes);
-            routes = next;
+            routes = await d.save(next, routes);
             d.log("Saved. Choose an API or ZDR model explicitly in Codex. Desktop login is unchanged.");
         }
         catch (error) {

package/dist/lib/codex-manager/commands/status.d.ts

@@ -4,7 +4,7 @@ import { loadAccountPolicyStore } from "../../account-policy.js";
 import { type ModelInventory } from "../../runtime/model-discovery-status.js";
 import type { ModelFamily } from "../../prompts/codex.js";
 import type { QuotaCacheData } from "../../quota-cache.js";
-import type { AppBindRouterStatus } from "../../runtime/app-bind.js";
+import { type AppBindRouterStatus } from "../../runtime/app-bind.js";
 import { type RuntimeAccountSignal } from "../../runtime/runtime-current-account.js";
 import type { RuntimeObservabilitySnapshot } from "../../runtime/runtime-observability.js";
 import type { AccountStorageV3, StorageHealthSummary } from "../../storage.js";

package/dist/lib/codex-manager/commands/status.js

@@ -6,10 +6,12 @@ import { styleReportText as paint } from "../../ui/format.js";
 import { inferenceAccountKey } from "../../runtime/inference-activity.js";
 import { modelScopeId } from "../../runtime/workspace-model-scopes.js";
 import { loadAccountPolicyStore, getAccountPolicyKey } from "../../account-policy.js";
+import { getSchedulingStrategy, loadPluginConfig } from "../../config.js";
 import { formatModelInventory } from "../../runtime/model-discovery-status.js";
 import { AUTH_INVALIDATION_MARKER, formatAccountLabel, formatCooldown, formatWaitTime, formatWorkspaceLines, } from "../../accounts.js";
 import { evaluateForecastAccounts, recommendForecastAccount, } from "../../forecast.js";
 import { findQuotaCacheEntryForAccount, isQuotaCacheEntryExhausted, } from "../../quota-readiness.js";
+import { formatWebsocketDisconnect } from "../../runtime/app-bind.js";
 import { resolveAccountCurrentMarkers, resolveRuntimeCurrentAccount, } from "../../runtime/runtime-current-account.js";
 import { isRateLimitedMarker } from "../rate-limit-markers.js";
 function isRestoreReason(value) {
@@ -86,6 +88,10 @@ export async function runStatusCommand(deps) {
     if (apiConfigurationUnavailable && !deps.json)
         logInfo("API configuration unavailable; subscription status remains available.");
     const modelInventory = await deps.loadModelInventory?.();
+    const appBindStatus = await deps.loadAppBindStatus?.() ?? null;
+    const disconnectLine = formatWebsocketDisconnect(appBindStatus?.lastWebsocketDisconnect);
+    if (!deps.json && disconnectLine)
+        logInfo(paint(disconnectLine, "warning"));
     const resetCredits = await deps.loadResetCreditState?.().catch(() => null);
     const resetSnapshot = (account) => { const target = resetTargetForStoredAccount(account); return target ? resetCredits?.snapshots[target.key] : undefined; };
     let policiesUnavailable = false;
@@ -111,6 +117,7 @@ export async function runStatusCommand(deps) {
                 totalAccountCount: 0,
                 apiAccounts: [],
                 modelInventory: modelInventory ?? null,
+                lastWebsocketDisconnect: appBindStatus?.lastWebsocketDisconnect ?? null,
                 // Emit the same keys the populated branch does (as null) so a
                 // --json consumer sees one stable shape regardless of account count.
                 activeIndex: null,
@@ -172,17 +179,26 @@ export async function runStatusCommand(deps) {
         }
     }
     const appHelperStatus = deps.loadAppHelperStatus?.() ?? null;
-    const [runtimeSnapshot, appBindStatus] = await Promise.all([
-        deps.loadRuntimeObservabilitySnapshot?.() ?? Promise.resolve(null),
-        deps.loadAppBindStatus?.() ?? Promise.resolve(null),
-    ]);
+    const runtimeSnapshot = await deps.loadRuntimeObservabilitySnapshot?.() ?? null;
     const quotaPreferences = forecastQuotas.map(quota => subscriptionQuotaPreference(quota, now));
     const automaticOrder = new Map();
     if (appBindStatus?.nativeOpenai) {
-        const candidates = storage.accounts.map((account, index) => ({ account, index, quota: quotaPreferences[index] ?? subscriptionQuotaPreference(null, now), tier: accountPolicies.accounts[getAccountPolicyKey(account, index)]?.priority ?? 1 }))
-            .filter(a => forecastResults[a.index]?.availability === "ready" && !a.quota.exhausted);
-        candidates.sort((a, b) => Number(usesSubscriptionReserve(a.quota)) - Number(usesSubscriptionReserve(b.quota)) ||
-            a.tier - b.tier || compareSubscriptionQuota(a.quota, b.quota) || Number(b.index === activeIndex) - Number(a.index === activeIndex) || a.index - b.index);
+        const schedulingStrategy = appBindStatus.schedulingStrategy ?? getSchedulingStrategy(loadPluginConfig());
+        let candidates = storage.accounts.map((account, index) => ({ account, index, quota: quotaPreferences[index] ?? subscriptionQuotaPreference(null, now), tier: accountPolicies.accounts[getAccountPolicyKey(account, index)]?.priority ?? 1 }));
+        const useSavedOrder = candidates.some(account => account.tier !== 1);
+        candidates = candidates.filter(a => forecastResults[a.index]?.availability === "ready" && !a.quota.exhausted);
+        candidates.sort((a, b) => {
+            const tierOrder = Number(usesSubscriptionReserve(a.quota)) - Number(usesSubscriptionReserve(b.quota)) || a.tier - b.tier;
+            if (tierOrder)
+                return tierOrder;
+            if (schedulingStrategy === "sequential") {
+                if (useSavedOrder)
+                    return a.index - b.index;
+                const count = storage.accounts.length;
+                return (a.index - activeIndex + count) % count - (b.index - activeIndex + count) % count;
+            }
+            return compareSubscriptionQuota(a.quota, b.quota) || Number(b.index === activeIndex) - Number(a.index === activeIndex) || a.index - b.index;
+        });
         // A switch pin is strict in native mode too: no other account is tried, so none gets an order.
         const pinned = typeof storage.pinnedAccountIndex === "number" ? candidates.filter(a => a.index === storage.pinnedAccountIndex) : candidates;
         pinned.forEach((a, index) => { automaticOrder.set(a.index, index + 1); });
@@ -260,6 +276,7 @@ export async function runStatusCommand(deps) {
             recommendationReason: recommendation.reason,
             runtimeInUseIndex: runtimeCurrent ? runtimeCurrent.index : null,
             modelInventory: modelInventory ?? null,
+            lastWebsocketDisconnect: appBindStatus?.lastWebsocketDisconnect ?? null,
             accounts,
             lastRequestedWorkspace: runtimeSnapshot?.lastRequestedWorkspaceId ? {
                 id: runtimeSnapshot.lastRequestedWorkspaceId,
@@ -345,7 +362,7 @@ export async function runStatusCommand(deps) {
         if (appBindStatus?.nativeOpenai) {
             const preference = quotaPreferences[i];
             const order = automaticOrder.get(i);
-            const reset = preference?.resetAtMs ? `; limiting window resets in ${formatWaitTime(Math.max(0, preference.resetAtMs - now))}` : "; reset ordering unknown; run check";
+            const reset = preference?.resetAtMs ? `; limiting window resets in ${formatWaitTime(Math.max(0, preference.resetAtMs - now))}` : "; quota reset unknown; run check";
             const reserve = usesSubscriptionReserve(preference) ? `; ${SUBSCRIPTION_RESERVE_PERCENT}% reserve (last resort)` : "";
             const pinnedElsewhere = typeof storage.pinnedAccountIndex === "number" && storage.pinnedAccountIndex !== i;
             logInfo(paint(`   automatic order: ${order ? `#${order}` : pinnedElsewhere ? `none (account ${(storage.pinnedAccountIndex ?? 0) + 1} is pinned)` : "unavailable"}${reset}${reserve}`, reserve ? "warning" : "accent"));

package/dist/lib/codex-manager.js

@@ -280,7 +280,13 @@ const runListOrStatusCommand = (rest) => runStatusCommand({
     formatRateLimitEntry,
     loadRuntimeObservabilitySnapshot: loadPersistedRuntimeObservabilitySnapshot,
     loadAppBindStatus: async () => getAppBindStatus()
-        .then((status) => (status.running && status.router ? { ...status.router, nativeOpenai: status.state?.nativeOpenai === true } : null))
+        .then((status) => status.router ? {
+        ...status.router,
+        // Keep historical diagnostics, but never revive a crashed router's
+        // persisted "running" marker or its account-selection signal.
+        state: status.running ? status.router.state : "stopped",
+        nativeOpenai: status.running && status.state?.nativeOpenai === true,
+    } : null)
         .catch(() => null),
     loadAppHelperStatus: readAppRuntimeHelperAccountSignal,
     loadQuotaCache,

package/dist/lib/constants.d.ts

@@ -48,6 +48,7 @@ export declare const URL_PATHS: {
     readonly MODELS: "/models";
     readonly RESPONSES: "/responses";
     readonly CODEX_RESPONSES: "/codex/responses";
+    readonly TRANSCRIBE: "/transcribe";
 };
 /** JWT claim path for ChatGPT account ID */
 export declare const JWT_CLAIM_PATH: "https://api.openai.com/auth";

package/dist/lib/constants.js

@@ -48,6 +48,7 @@ export const URL_PATHS = {
     MODELS: "/models",
     RESPONSES: "/responses",
     CODEX_RESPONSES: "/codex/responses",
+    TRANSCRIBE: "/transcribe",
 };
 /** JWT claim path for ChatGPT account ID */
 export const JWT_CLAIM_PATH = "https://api.openai.com/auth";

package/dist/lib/model-route-policy.d.ts

@@ -38,6 +38,7 @@ export declare function buildVisibleModelUnion(catalogs: RouteCatalog[]): RouteM
 /** Whitelist capability metadata; never persist model instructions or arbitrary fields. */
 export declare function modelEntitlements(model: RouteModel): {
     model: string;
+    programCheckedAt?: number | undefined;
     checkedAt?: number | undefined;
     probes?: {
         [k: string]: "downgraded" | "unsupported" | "unverified" | "verified";

package/dist/lib/model-route-policy.js

@@ -129,12 +129,13 @@ export function modelEntitlements(model) {
     const safe = (v) => typeof v === "string" && /^[A-Za-z0-9._-]{1,80}$/.test(v);
     return {
         model: model.slug,
+        ...(typeof model.program_checked_at === "number" && Number.isFinite(model.program_checked_at) && model.program_checked_at >= 0 && model.program_checked_at <= 8.64e15 ? { programCheckedAt: model.program_checked_at } : {}),
         ...(typeof model.capability_checked_at === "number"
             ? { checkedAt: model.capability_checked_at }
             : {}),
         ...(isRecord(model.capability_probe_status)
             ? {
-                probes: Object.fromEntries(Object.entries(model.capability_probe_status).filter((entry) => /^(responses|fast|ultrafast|effort:(none|minimal|low|medium|high|xhigh|max|ultra))$/.test(entry[0]) &&
+                probes: Object.fromEntries(Object.entries(model.capability_probe_status).filter((entry) => /^(responses|fast|ultrafast|effort:(none|minimal|low|medium|high|xhigh|max|ultra)|program:cyber:(standard|daybreak_blue|daybreak_red))$/.test(entry[0]) &&
                     [
                         "verified",
                         "unsupported",

package/dist/lib/runtime/account-model-catalog.d.ts

@@ -47,6 +47,7 @@ export declare class AccountModelCatalog {
         models: string[];
         entitlements: {
             model: string;
+            programCheckedAt?: number | undefined;
             checkedAt?: number | undefined;
             probes?: {
                 [k: string]: "downgraded" | "unsupported" | "unverified" | "verified";

package/dist/lib/runtime/api-model-capabilities.d.ts

@@ -3,6 +3,9 @@ import { type RouteModel } from "../model-route-policy.js";
 /** Read the explicit model-specific statement, never surrounding examples or another model's settings. */
 export declare function parseApiReasoningDocumentation(id: string, text: string): string[];
 export type ProbeResult = {
+    ownerEpoch?: string;
+    programCheckedAt?: number;
+    programRetry?: boolean;
     at: number;
     levels: string[];
     tiers: string[];
@@ -11,19 +14,25 @@ export type ProbeResult = {
 export declare class ApiModelCapabilities {
     private readonly fetchImpl;
     private readonly now;
+    private readonly probeSlot?;
+    private readonly documentationSource?;
+    private readonly programRefreshBefore?;
     private activeProbes;
     private readonly probeWaiters;
     private withProbeSlot;
     private readonly inFlight;
     private readonly probes;
     private readonly cache;
-    constructor(fetchImpl?: typeof fetch, now?: () => number);
+    constructor(fetchImpl?: typeof fetch, now?: () => number, probeSlot?: (<T>(operation: () => Promise<T>) => Promise<T>) | undefined, documentationSource?: ApiModelCapabilities | undefined, programRefreshBefore?: number | undefined);
     /** Probe results keyed by an opaque hash, for a fresh CLI process to honour the 15-minute cache. */
     exportProbes(): Array<[string, ProbeResult]>;
     importProbes(entries: Array<[string, ProbeResult]>): void;
     reasoning(id: string, refresh?: boolean): Promise<string[]>;
     private documentation;
+    private programsCoverCheck;
+    private freshProbe;
+    private reconcileReasoning;
     private probe;
     private runProbe;
-    enrich(models: RouteModel[], refresh?: boolean, route?: ApiRouteCredential, forceProbes?: boolean): Promise<RouteModel[]>;
+    enrich(models: RouteModel[], refresh?: boolean, route?: ApiRouteCredential, forceProbes?: boolean, cachedProbesOnly?: Array<[string, ProbeResult]>): Promise<RouteModel[]>;
 }