codex-multi-auth 2.20.0 → 2.22.0

package/dist/lib/runtime/api-model-capabilities.js

@@ -14,11 +14,14 @@ const efforts = new Set([
 ]);
 /** Read the explicit model-specific statement, never surrounding examples or another model's settings. */
 export function parseApiReasoningDocumentation(id, text) {
+    return parseReasoningStatement(id, text) ?? [];
+}
+function parseReasoningStatement(id, text) {
     if (text.match(/^Model ID:\s*`([^`]+)`/m)?.[1] !== id)
-        return [];
+        return undefined;
     const statement = text.match(/`?reasoning\.effort`?\s+supports\s*:?\s*([^\n.]+)\./i)?.[1];
-    if (!statement)
-        return [];
+    if (statement === undefined)
+        return undefined;
     const values = statement
         .replace(/`|\(default\)/g, " ")
         .split(/,|\band\b/)
@@ -29,9 +32,25 @@ export function parseApiReasoningDocumentation(id, text) {
         values.some((v) => !/^[a-z][a-z0-9_-]{0,31}$/.test(v) ||
             v === "ultra" ||
             v === "persistent"))
-        return [];
+        return undefined;
     return [...new Set(values)];
 }
+/** Candidates describe checks, never request defaults or granted entitlements. */
+function programCandidates(route, id) {
+    const configured = (route.modelAccessPrograms?.[id] ?? route.accessPrograms)?.cyber;
+    const candidates = [...(configured ?? []), ...(/(?:^|-)cyber(?:-|$)|daybreak-red/.test(id)
+            ? ["daybreak_red"] : /^gpt-[56](?:[.-]|$)/.test(id) ? ["standard", "daybreak_blue"] : [])];
+    return [...new Set(candidates)].filter(value => ["standard", "daybreak_blue", "daybreak_red"].includes(value));
+}
+function programsFresh(result, programs, now) {
+    return result.programRetry !== true && result.programCheckedAt !== undefined &&
+        Number.isFinite(result.programCheckedAt) && result.programCheckedAt >= 0 && result.programCheckedAt <= 8.64e15 &&
+        result.programCheckedAt <= now && result.programCheckedAt + 86400_000 > now &&
+        programs.every(program => ["verified", "unsupported"].includes(result.status[`program:cyber:${program}`] ?? ""));
+}
+function probeKey(route, id) {
+    return createHash("sha256").update(route.id).update("\0").update(route.apiKey).update("\0").update(id).digest("hex");
+}
 /** Only the exact model's input declaration can enable native image attachments. */
 function parseInputModalities(id, text) {
     if (text.match(/^Model ID:\s*`([^`]+)`/m)?.[1] !== id)
@@ -81,9 +100,14 @@ function classifyProbe403(data, setting) {
 export class ApiModelCapabilities {
     fetchImpl;
     now;
+    probeSlot;
+    documentationSource;
+    programRefreshBefore;
     activeProbes = 0;
     probeWaiters = [];
     async withProbeSlot(operation) {
+        if (this.probeSlot)
+            return this.probeSlot(operation);
         if (this.activeProbes >= 4)
             await new Promise((resolve) => this.probeWaiters.push(resolve));
         else
@@ -102,9 +126,16 @@ export class ApiModelCapabilities {
     inFlight = new Map();
     probes = new Map();
     cache = new Map();
-    constructor(fetchImpl = fetch, now = Date.now) {
+    constructor(fetchImpl = fetch, now = Date.now, probeSlot, 
+    // Keep public documentation across short-lived credential/model leases.
+    documentationSource, 
+    // Scheduled checks need program evidence to last until their next run.
+    programRefreshBefore) {
         this.fetchImpl = fetchImpl;
         this.now = now;
+        this.probeSlot = probeSlot;
+        this.documentationSource = documentationSource;
+        this.programRefreshBefore = programRefreshBefore;
     }
     /** Probe results keyed by an opaque hash, for a fresh CLI process to honour the 15-minute cache. */
     exportProbes() {
@@ -121,6 +152,8 @@ export class ApiModelCapabilities {
         return (await this.documentation(id, refresh)).levels;
     }
     async documentation(id, refresh = false) {
+        if (this.documentationSource)
+            return this.documentationSource.documentation(id, refresh);
         if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,199}$/.test(id))
             return { levels: [] };
         const cached = this.cache.get(id);
@@ -153,41 +186,60 @@ export class ApiModelCapabilities {
                 await reader.cancel();
             }
             const text = Buffer.concat(chunks).toString("utf8");
+            const reasoning = parseReasoningStatement(id, text);
             metadata = {
-                levels: parseApiReasoningDocumentation(id, text),
+                levels: reasoning ?? [],
+                reasoningAvailable: reasoning !== undefined,
                 inputModalities: parseInputModalities(id, text),
             };
         }
         catch {
             // An outage is not a capability revocation. Keep last successful evidence.
-            metadata = cached ?? metadata;
+            metadata = { ...(cached ?? metadata), reasoningAvailable: false };
         }
         if (this.cache.size >= 1000)
             this.cache.delete(this.cache.keys().next().value ?? "");
         this.cache.set(id, { ...metadata, at: this.now() });
         return metadata;
     }
-    async probe(route, id, documented, force = false) {
-        const key = createHash("sha256")
-            .update(route.id)
-            .update("\0")
-            .update(route.apiKey)
-            .update("\0")
-            .update(id)
-            .digest("hex");
-        const old = this.probes.get(key);
+    programsCoverCheck(result, programs) {
+        return programsFresh(result, programs, this.now()) &&
+            (this.programRefreshBefore === undefined || (result.programCheckedAt ?? -Infinity) + 86400_000 >= this.programRefreshBefore);
+    }
+    freshProbe(route, id, old) {
         // A probe cut short by 401/403/429 is retried after a minute, not trusted for 15.
         const freshFor = old?.status.retry === "transient" ? 60_000 : 900_000;
-        if (!force && old && old.at + freshFor > this.now())
+        const programs = programCandidates(route, id);
+        const oldPrograms = old ? Object.keys(old.status).filter(name => name.startsWith("program:cyber:")) : [];
+        const samePrograms = oldPrograms.length === programs.length && programs.every(program => oldPrograms.includes(`program:cyber:${program}`));
+        const programCacheFresh = old && samePrograms && (programs.length
+            ? this.programsCoverCheck(old, programs) || ((old.programRetry === true || old.status.retry === "transient") && old.at + 60_000 > this.now())
+            : old.programCheckedAt === undefined);
+        if (old && old.at <= this.now() && old.at + freshFor > this.now() && programCacheFresh)
             return old;
+        return undefined;
+    }
+    reconcileReasoning(probe, documented, available) {
+        if (!available)
+            return probe;
+        return { ...probe, levels: probe.levels.filter(effort => documented.includes(effort) || probe.status[`effort:${effort}`] === "verified") };
+    }
+    async probe(route, id, documented, force = false, reasoningAvailable = false) {
+        const key = probeKey(route, id);
+        const fresh = this.freshProbe(route, id, this.probes.get(key));
+        if (!force && fresh) {
+            const reconciled = this.reconcileReasoning(fresh, documented, reasoningAvailable);
+            this.probes.set(key, reconciled);
+            return reconciled;
+        }
         const running = this.inFlight.get(key);
         if (running)
             return running;
-        const pending = this.runProbe(route, id, documented, key).finally(() => this.inFlight.delete(key));
+        const pending = this.runProbe(route, id, documented, key, force, reasoningAvailable).finally(() => this.inFlight.delete(key));
         this.inFlight.set(key, pending);
         return pending;
     }
-    async runProbe(route, id, documented, key) {
+    async runProbe(route, id, documented, key, force, reasoningAvailable) {
         const result = {
             at: this.now(),
             levels: [...documented],
@@ -200,6 +252,7 @@ export class ApiModelCapabilities {
         // inconclusive and keeps what an earlier probe verified. Only
         // "unsupported" or "downgraded" removes a setting otherwise.
         let lostAccess = false;
+        let programAuthFailure = false;
         // A model-level denial hides the model on this credential: no efforts, no tiers.
         let modelDenied = false;
         const previous = this.probes.get(key);
@@ -222,6 +275,7 @@ export class ApiModelCapabilities {
                 if (kind === "setting")
                     return "unsupported";
                 credentialUnavailable = true;
+                programAuthFailure = Boolean(setting.program);
                 return "unverified";
             };
             return this.withProbeSlot(async () => {
@@ -266,6 +320,7 @@ export class ApiModelCapabilities {
                                 ? { reasoning: { effort: setting.effort } }
                                 : {}),
                             ...(setting.tier ? { service_tier: setting.tier } : {}),
+                            ...(setting.program ? { access_programs: { cyber: setting.program } } : {}),
                         }),
                     });
                     if ([401, 429].includes(response.status))
@@ -299,6 +354,21 @@ export class ApiModelCapabilities {
                     catch {
                         return response.status === 403 ? denied403(null) : "unverified";
                     }
+                    if (setting.program) {
+                        const error = isRecord(data) && isRecord(data.error) ? data.error : null;
+                        if ([400, 403].includes(response.status) && error &&
+                            (["invalid_access_program", "unsupported_access_program", "access_program_not_enabled"].includes(String(error.code)) ||
+                                ["access_programs", "access_programs.cyber"].includes(String(error.param))))
+                            return "unsupported";
+                        if (response.status === 403) {
+                            programAuthFailure = true;
+                            return denied403(data);
+                        }
+                        if (!response.ok)
+                            return "unverified";
+                        return isRecord(data) && ["completed", "incomplete"].includes(String(data.status)) && isRecord(data.access_programs) && data.access_programs.cyber === setting.program
+                            ? "verified" : "unverified";
+                    }
                     if (response.status === 403)
                         return denied403(data);
                     if (!response.ok) {
@@ -357,7 +427,10 @@ export class ApiModelCapabilities {
             for (const { effort, status } of checked) {
                 const effective = keep(`effort:${effort}`, status);
                 result.status[`effort:${effort}`] = effective;
-                if (effective === "verified")
+                // Persisted levels can originate in public documentation, without a
+                // verified effort probe. Keep that scoped evidence through an
+                // inconclusive retry only while current documentation is unavailable.
+                if (effective === "verified" || (status === "unverified" && !reasoningAvailable && !lostAccess && !modelDenied && previous?.levels.includes(effort)))
                     result.levels.push(effort);
             }
         }
@@ -373,12 +446,54 @@ export class ApiModelCapabilities {
             if (effective === "verified")
                 result.tiers.push(tier);
         }
+        const programs = programCandidates(route, id);
+        const reusable = !force && previous && this.programsCoverCheck(previous, programs);
+        if (programs.length && reusable && !lostAccess && !modelDenied && !programAuthFailure) {
+            for (const program of programs)
+                result.status[`program:cyber:${program}`] = previous.status[`program:cyber:${program}`] ?? "unverified";
+            result.programCheckedAt = previous.programCheckedAt;
+        }
+        else if (programs.length) {
+            let inconclusive = false;
+            for (const program of programs) {
+                const name = `program:cyber:${program}`;
+                const status = await attempt({ program, effort });
+                if (status === "unverified")
+                    inconclusive = true;
+                result.status[name] = !force && !programAuthFailure ? keep(name, status) : status;
+            }
+            // Never renew old evidence after throttling, transport failure or a missing echo.
+            result.programCheckedAt = inconclusive ? previous?.programCheckedAt : this.now();
+            if (inconclusive) {
+                result.status.retry = "transient";
+                result.programRetry = true;
+            }
+            if (programAuthFailure) {
+                for (const program of programs)
+                    result.status[`program:cyber:${program}`] = "unverified";
+            }
+        }
         if (modelDenied) {
             result.levels = [];
             result.tiers = [];
             for (const name of Object.keys(result.status))
                 result.status[name] = "unsupported";
             result.status.responses = "unsupported";
+            if (!lostAccess) {
+                // A structured model denial conclusively denies every candidate,
+                // including checks skipped after the denial. Do not retry it as a
+                // transport failure merely because those POSTs were unnecessary.
+                delete result.status.retry;
+                delete result.programRetry;
+                if (programs.length)
+                    result.programCheckedAt = this.now();
+            }
+        }
+        if (lostAccess) {
+            result.levels = [];
+            result.tiers = [];
+            for (const name of Object.keys(result.status))
+                result.status[name] = "unverified";
         }
         if (credentialUnavailable && !modelDenied)
             result.status.retry = "transient";
@@ -388,15 +503,21 @@ export class ApiModelCapabilities {
         this.probes.set(key, result);
         return result;
     }
-    async enrich(models, refresh = false, route, forceProbes = false) {
+    async enrich(models, refresh = false, route, forceProbes = false, 
+    // Supplying evidence limits this call to cache reads, even when forced.
+    cachedProbesOnly) {
+        const cached = cachedProbesOnly === undefined ? undefined : new Map(cachedProbesOnly);
         return mapWithConcurrency(models, 3, async (model) => {
             const documented = await this.documentation(model.slug, refresh);
             let levels = documented.levels;
             let extra = {};
             if (route?.enabled && route.probeCapabilities) {
-                const probed = await this.probe(route, model.slug, levels, forceProbes);
-                levels = probed.levels;
-                extra = {
+                let probed = cached ? this.freshProbe(route, model.slug, cached.get(probeKey(route, model.slug))) : await this.probe(route, model.slug, levels, forceProbes, documented.reasoningAvailable === true);
+                if (probed && cached)
+                    probed = this.reconcileReasoning(probed, levels, documented.reasoningAvailable === true);
+                if (probed)
+                    levels = probed.levels;
+                extra = probed ? {
                     service_tiers: probed.tiers.map((id) => ({
                         id: id === "fast" ? "priority" : id,
                         name: id === "fast" ? "Fast" : "Ultrafast",
@@ -406,6 +527,16 @@ export class ApiModelCapabilities {
                     additional_speed_tiers: probed.tiers,
                     capability_probe_status: probed.status,
                     capability_checked_at: probed.at,
+                    program_checked_at: probed.programCheckedAt,
+                } : {
+                    // A previously enriched model must not smuggle expired or
+                    // differently scoped evidence through a cache-only miss.
+                    service_tiers: [],
+                    default_service_tier: "default",
+                    additional_speed_tiers: [],
+                    capability_probe_status: undefined,
+                    capability_checked_at: undefined,
+                    program_checked_at: undefined,
                 };
             }
             // Ultra is a native orchestration mode. Codex resolves it to this

package/dist/lib/runtime/app-bind.d.ts

@@ -1,3 +1,4 @@
+import type { WebSocketDisconnectDiagnostic } from "./responses-websocket.js";
 export interface AppBindPaths {
     codexHome: string;
     configPath: string;
@@ -37,6 +38,8 @@ export interface AppBindState {
     updatedAt: number;
 }
 export interface AppBindRouterStatus {
+    lastWebsocketDisconnect?: WebSocketDisconnectDiagnostic | null;
+    schedulingStrategy?: "hybrid" | "sequential";
     state: string | null;
     pid: number | null;
     startedAt?: number | null;
@@ -142,4 +145,5 @@ export declare function stopRuntimeRotationAppHelperProcess(helper: RuntimeRotat
 export declare function getAppBindStatus(options?: AppBindOptions): Promise<AppBindStatus>;
 export declare function bindCodexAppRuntimeRotation(options?: AppBindOptions): Promise<AppBindResult>;
 export declare function unbindCodexAppRuntimeRotation(options?: AppBindOptions): Promise<AppBindResult>;
+export declare function formatWebsocketDisconnect(value: unknown): string | null;
 export declare function formatAppBindStatus(status: AppBindStatus): string;

package/dist/lib/runtime/app-bind.js

@@ -228,11 +228,34 @@ async function readAppBindBackup(path) {
         createdAt,
     };
 }
+function readWebsocketDisconnect(value) {
+    if (!isRecord(value) || typeof value.at !== "number" || !Number.isFinite(value.at) || value.at < 0)
+        return null;
+    const { cause, stage, closeCode, routeKind, connectionAgeMs, eventCount } = value;
+    if (routeKind !== undefined && routeKind !== "oauth" && routeKind !== "api" && routeKind !== "zdr")
+        return null;
+    for (const count of [connectionAgeMs, eventCount])
+        if (count !== undefined && (typeof count !== "number" || !Number.isSafeInteger(count) || count < 0))
+            return null;
+    if (cause !== "close" && cause !== "transport_error" && cause !== "invalid_event" && cause !== "buffer_limit" && cause !== "send_error")
+        return null;
+    if (stage !== "awaiting_first_event" && stage !== "streaming")
+        return null;
+    if (closeCode !== undefined && (typeof closeCode !== "number" || !Number.isInteger(closeCode) || closeCode < 1000 || closeCode > 4999))
+        return null;
+    return { at: value.at, cause, stage, ...(typeof closeCode === "number" ? { closeCode } : {}),
+        ...(routeKind === "oauth" || routeKind === "api" || routeKind === "zdr" ? { routeKind } : {}),
+        ...(typeof connectionAgeMs === "number" ? { connectionAgeMs } : {}),
+        ...(typeof eventCount === "number" ? { eventCount } : {}) };
+}
 async function readRouterStatus(path) {
     const record = await readJsonFile(path);
     if (!record)
         return null;
     return {
+        lastWebsocketDisconnect: readWebsocketDisconnect(record.lastWebsocketDisconnect),
+        schedulingStrategy: record.schedulingStrategy === "hybrid" || record.schedulingStrategy === "sequential"
+            ? record.schedulingStrategy : undefined,
         state: readString(record, "state"),
         pid: readNumber(record, "pid"),
         startedAt: readNumber(record, "startedAt"),
@@ -1380,6 +1403,12 @@ async function unbindCodexAppRuntimeRotationLocked(options, paths) {
         message,
     };
 }
+export function formatWebsocketDisconnect(value) {
+    const diagnostic = readWebsocketDisconnect(value);
+    if (!diagnostic || diagnostic.at > 8.64e15)
+        return null;
+    return `Last WebSocket disconnect: ${new Date(diagnostic.at).toISOString()}; cause=${diagnostic.cause}; stage=${diagnostic.stage}${diagnostic.closeCode !== undefined ? `; closeCode=${diagnostic.closeCode}` : ""}${diagnostic.routeKind !== undefined ? `; route=${diagnostic.routeKind}` : ""}${diagnostic.connectionAgeMs !== undefined ? `; connectionAgeMs=${diagnostic.connectionAgeMs}` : ""}${diagnostic.eventCount !== undefined ? `; events=${diagnostic.eventCount}` : ""}`;
+}
 export function formatAppBindStatus(status) {
     if (status.unmanagedBind && !status.state) {
         return [
@@ -1404,10 +1433,12 @@ export function formatAppBindStatus(status) {
     else if (status.router?.lastAccountIndex !== null && status.router?.lastAccountIndex !== undefined) {
         parts.push(`lastAccount=Account ${status.router.lastAccountIndex + 1}`);
     }
+    const diagnostic = formatWebsocketDisconnect(status.router?.lastWebsocketDisconnect);
     if (status.state.nativeOpenai)
-        return `Codex app bind: ${parts.join(", ")}, native OpenAI, live account catalogs`;
+        return [`Codex app bind: ${parts.join(", ")}, native OpenAI, live account catalogs`, ...(diagnostic ? [diagnostic] : [])].join("\n");
     return [
         `Codex app bind: ${parts.join(", ")}`,
+        ...(diagnostic ? [diagnostic] : []),
         [
             "Note: Codex Desktop may hide history while the app bind selects the",
             "codex-multi-auth-runtime-proxy provider; use `codex-multi-auth rotation",

package/dist/lib/runtime/automatic-api-checks.d.ts

@@ -0,0 +1,15 @@
+import { type ApiRouteCredential } from "../api-route-store.js";
+export declare const AUTOMATIC_API_CHECK_INTERVAL_MS: number;
+export declare function runAutomaticApiChecks(options: {
+    path: string;
+    loadRoutes: () => Promise<ApiRouteCredential[]>;
+    prepareRoute?: (route: ApiRouteCredential, signal: AbortSignal) => Promise<ApiRouteCredential | undefined>;
+    check: (route: ApiRouteCredential, signal: AbortSignal, programRefreshBefore: number) => Promise<void>;
+    now?: () => number;
+    signal?: AbortSignal;
+}): Promise<number | undefined>;
+export declare function createAutomaticApiCheck(upstreamFetch?: typeof fetch): (signal: AbortSignal) => Promise<number | undefined>;
+/** Daily checks follow persisted claim deadlines, never overlap, and drain on shutdown. */
+export declare function startAutomaticApiChecks(run: (signal: AbortSignal) => Promise<number | void>): {
+    stop(): Promise<void>;
+};

package/dist/lib/runtime/automatic-api-checks.js

@@ -0,0 +1,188 @@
+import { createHash } from "node:crypto";
+import { promises as fs } from "node:fs";
+import { dirname, join } from "node:path";
+import { z } from "zod";
+import { loadApiRoutes, updateApiModelDiscovery, ensureApiRouteCapabilityEpoch } from "../api-route-store.js";
+import { getCodexMultiAuthDir } from "../runtime-paths.js";
+import { withFileTransactionLock } from "../storage/file-lock.js";
+import { tempPathFor } from "../temp-path.js";
+import { withRetry } from "../fs-retry.js";
+import { combineSignals } from "../utils.js";
+import { logWarn } from "../logger.js";
+import { discoverModelInventory, saveModelInventory } from "./model-discovery-status.js";
+export const AUTOMATIC_API_CHECK_INTERVAL_MS = 24 * 60 * 60_000;
+const PREPARATION_RETRY_MS = 60_000;
+const schema = z.record(z.string().regex(/^[a-f0-9]{64}$/), z.number().finite().nonnegative());
+const retry = { maxAttempts: 6, backoffMs: 25 };
+function key(route) { return createHash("sha256").update(JSON.stringify([route.id, route.kind, route.apiKey, route.visibleModels])).digest("hex"); }
+const eligible = (route) => route.enabled && route.probeCapabilities === true;
+// Visibility can expand during discovery; daily spending remains credential-scoped.
+function claimKey(route) { return createHash("sha256").update(JSON.stringify([route.id, route.kind, route.apiKey])).digest("hex"); }
+// Compare visibility as a set without changing stored order or legacy claim hashes.
+function semanticRoute(route) { return { ...route, visibleModels: [...new Set(route.visibleModels)].sort() }; }
+function sameRoute(a, b) { return JSON.stringify(Object.entries(semanticRoute(a)).sort(([x], [y]) => x.localeCompare(y))) === JSON.stringify(Object.entries(semanticRoute(b)).sort(([x], [y]) => x.localeCompare(y))); }
+export async function runAutomaticApiChecks(options) {
+    const signal = options.signal ?? new AbortController().signal;
+    // Claims name the scheduled pass, so I/O and later routes cannot move its horizon.
+    const startedAt = options.now?.() ?? Date.now();
+    let nextRunAt;
+    const includeDeadline = (at) => { nextRunAt = Math.min(nextRunAt ?? Infinity, at + AUTOMATIC_API_CHECK_INTERVAL_MS); };
+    if (signal.aborted)
+        return;
+    const routes = (await options.loadRoutes()).filter(eligible);
+    if (!routes.length)
+        return;
+    for (const route of routes) {
+        if (signal.aborted)
+            return;
+        const observed = (await options.loadRoutes()).find(r => eligible(r) && key(semanticRoute(r)) === key(semanticRoute(route)));
+        if (!observed)
+            continue;
+        // Complete store-owned migrations before capturing the exact claim snapshot.
+        let current;
+        try {
+            current = options.prepareRoute ? await options.prepareRoute(observed, signal) : observed;
+        }
+        catch {
+            if (signal.aborted)
+                return;
+            nextRunAt = Math.min(nextRunAt ?? Infinity, (options.now?.() ?? Date.now()) + PREPARATION_RETRY_MS);
+            logWarn("Automatic API route preparation failed; retrying shortly.");
+            continue;
+        }
+        if (!current || !eligible(current) || signal.aborted)
+            continue;
+        // Commit the claim before network I/O. Concurrent routers and restarts share it.
+        let programRefreshBefore = startedAt + AUTOMATIC_API_CHECK_INTERVAL_MS;
+        const claimed = await withFileTransactionLock(options.path, async () => {
+            // A credential wipe can finish while this checker is queued for the lock.
+            if (signal.aborted || !(await options.loadRoutes()).some(r => eligible(r) && sameRoute(r, current)))
+                return false;
+            let attempts = {};
+            let raw, repairHistory = false;
+            try {
+                raw = await withRetry(() => fs.readFile(options.path, "utf8"), retry);
+            }
+            catch (error) {
+                if (error.code !== "ENOENT")
+                    throw error;
+            }
+            if (raw !== undefined)
+                try {
+                    if (Buffer.byteLength(raw) > 1024 * 1024)
+                        throw Error("API-check history too large");
+                    attempts = schema.parse(JSON.parse(raw));
+                }
+                catch {
+                    repairHistory = true;
+                }
+            const now = options.now?.() ?? Date.now(), id = claimKey(current);
+            // Unknown prior attempts must not trigger another billable pass on repair.
+            // Seed every eligible route so a restart can resume normally the next day.
+            if (repairHistory)
+                attempts = Object.fromEntries((await options.loadRoutes()).filter(eligible).map(route => [claimKey(route), now]));
+            const legacyClaims = [attempts[key(current)], attempts[key(observed)], attempts[key(route)]].filter((at) => at !== undefined && Number.isFinite(at) && at <= now + 300_000);
+            const last = attempts[id] ?? (legacyClaims.length ? Math.max(...legacyClaims) : undefined);
+            if (signal.aborted)
+                return false;
+            if (!repairHistory && last !== undefined && last <= now + 300_000 && now - last < AUTOMATIC_API_CHECK_INTERVAL_MS) {
+                includeDeadline(last);
+                return false;
+            }
+            // Keep other processes' claims; prune only the oldest history at a fixed bound.
+            for (const [old] of Object.entries(attempts).sort((a, b) => b[1] - a[1]).slice(999))
+                delete attempts[old];
+            const claimedAt = repairHistory ? now : Math.min(startedAt, now);
+            attempts[id] = claimedAt;
+            programRefreshBefore = claimedAt + AUTOMATIC_API_CHECK_INTERVAL_MS;
+            includeDeadline(claimedAt);
+            const temp = tempPathFor(options.path);
+            await fs.mkdir(dirname(options.path), { recursive: true, mode: 0o700 });
+            try {
+                await fs.writeFile(temp, JSON.stringify(attempts) + "\n", { mode: 0o600, flag: "wx" });
+                await withRetry(() => fs.rename(temp, options.path), retry);
+            }
+            finally {
+                await withRetry(() => fs.rm(temp, { force: true }), retry);
+            }
+            if (repairHistory)
+                logWarn("Automatic API check history repaired; billable checks deferred for one daily interval.");
+            return !repairHistory;
+        }, { signal });
+        if (!claimed || signal.aborted)
+            continue;
+        try {
+            await options.check(current, signal, programRefreshBefore);
+        }
+        catch {
+            if (!signal.aborted)
+                logWarn("Automatic API capability check failed; retry deferred until the next daily interval.");
+        }
+    }
+    return nextRunAt;
+}
+export function createAutomaticApiCheck(upstreamFetch = fetch) {
+    return async (signal) => {
+        return runAutomaticApiChecks({
+            path: join(getCodexMultiAuthDir(), "automatic-api-checks.json"), loadRoutes: loadApiRoutes, signal, prepareRoute: ensureApiRouteCapabilityEpoch,
+            check: async (route, stop, programRefreshBefore) => {
+                let acceptedRoute = route, discoveryAccepted = true;
+                const updateDiscovery = async (original, models) => {
+                    discoveryAccepted = false;
+                    const known = new Set(original.knownModels ?? models), visible = new Set(original.visibleModels);
+                    for (const model of models) {
+                        if (!known.has(model) && /^gpt-/i.test(model))
+                            visible.add(model);
+                        known.add(model);
+                    }
+                    const expected = { ...original, knownModels: [...known], visibleModels: [...visible] };
+                    const updated = await updateApiModelDiscovery(original, models);
+                    // Accept this discovery's expansion only, never a concurrent policy edit.
+                    if (!sameRoute(updated, expected))
+                        throw Error("API check route changed");
+                    acceptedRoute = updated;
+                    discoveryAccepted = true;
+                    return updated;
+                };
+                // Link shutdown to each existing bounded request without weakening its timeout.
+                const fetcher = async (input, init) => {
+                    const signal = combineSignals(stop, init?.signal);
+                    signal.throwIfAborted();
+                    if (init?.method?.toUpperCase() === "POST" && (!discoveryAccepted || !(await loadApiRoutes()).some(r => eligible(r) && sameRoute(r, acceptedRoute))))
+                        throw Error("API check route changed");
+                    signal.throwIfAborted();
+                    return upstreamFetch(input, { ...init, signal });
+                };
+                const inventory = await discoverModelInventory(null, [route], { fetchImpl: fetcher, signal: stop, persistProbes: true, programRefreshBefore, updateApiDiscovery: updateDiscovery });
+                if (stop.aborted || !discoveryAccepted)
+                    return;
+                const current = (await loadApiRoutes()).find(r => eligible(r) && sameRoute(r, acceptedRoute));
+                if (current)
+                    await saveModelInventory(inventory, { mergeEntries: true, signal: stop });
+            },
+        });
+    };
+}
+/** Daily checks follow persisted claim deadlines, never overlap, and drain on shutdown. */
+export function startAutomaticApiChecks(run) {
+    const controller = new AbortController();
+    let pending;
+    let timer;
+    const schedule = (delay) => { if (!controller.signal.aborted) {
+        timer = setTimeout(tick, delay);
+        timer.unref();
+    } };
+    const tick = () => {
+        timer = undefined;
+        if (controller.signal.aborted)
+            return;
+        let nextRunAt = Date.now() + AUTOMATIC_API_CHECK_INTERVAL_MS;
+        pending = Promise.resolve().then(() => run(controller.signal)).then(due => { if (typeof due === "number" && Number.isFinite(due))
+            nextRunAt = due; })
+            .catch(() => { if (!controller.signal.aborted)
+            logWarn("Automatic API capability checks unavailable; retry deferred."); })
+            .finally(() => { pending = undefined; schedule(Math.min(AUTOMATIC_API_CHECK_INTERVAL_MS, Math.max(0, nextRunAt - Date.now()))); });
+    };
+    schedule(5000);
+    return { async stop() { clearTimeout(timer); controller.abort(); await pending; } };
+}

package/dist/lib/runtime/model-discovery-status.d.ts

@@ -22,6 +22,7 @@ declare const schema: z.ZodObject<{
             entitlements: z.ZodOptional<z.ZodArray<z.ZodObject<{
                 model: z.ZodString;
                 checkedAt: z.ZodOptional<z.ZodNumber>;
+                programCheckedAt: z.ZodOptional<z.ZodNumber>;
                 probes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<{
                     downgraded: "downgraded";
                     unsupported: "unsupported";
@@ -50,6 +51,7 @@ declare const schema: z.ZodObject<{
         entitlements: z.ZodOptional<z.ZodArray<z.ZodObject<{
             model: z.ZodString;
             checkedAt: z.ZodOptional<z.ZodNumber>;
+            programCheckedAt: z.ZodOptional<z.ZodNumber>;
             probes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<{
                 downgraded: "downgraded";
                 unsupported: "unsupported";
@@ -68,6 +70,7 @@ declare const schema: z.ZodObject<{
 export type ModelInventory = z.infer<typeof schema>;
 export declare function discoverModelInventory(storage: AccountStorageV3 | null, routes: ApiRouteCredential[], options?: {
     fetchImpl?: typeof fetch;
+    signal?: AbortSignal;
     now?: () => number;
     clientVersion?: string;
     updateApiDiscovery?: typeof updateApiModelDiscovery;
@@ -75,9 +78,16 @@ export declare function discoverModelInventory(storage: AccountStorageV3 | null,
     forceProbes?: boolean;
     /** Share probe results with later CLI processes through the multi-auth directory. */
     persistProbes?: boolean;
+    /** Refresh program evidence that expires before the next scheduled check. */
+    programRefreshBefore?: number;
 }): Promise<ModelInventory>;
 export declare function loadModelInventory(): Promise<ModelInventory | null>;
-export declare function saveModelInventory(value: ModelInventory): Promise<void>;
+/** Drain queued writes before resetting process-local test state. */
+export declare function resetModelInventoryWritesForTests(): Promise<void>;
+export declare function saveModelInventory(value: ModelInventory, options?: {
+    mergeEntries?: boolean;
+    signal?: AbortSignal;
+}): Promise<void>;
 export declare function formatModelInventory(inventory: ModelInventory | null, now?: number): string[];
 export declare function refreshAndPrintModelInventory(log: (message: string) => void, deps?: {
     getBinding?: () => Promise<{