codex-multi-auth 2.21.0 → 2.22.0

package/dist/lib/runtime/responses-websocket.js

@@ -66,6 +66,7 @@ class SocketSession {
     stats;
     httpFetch;
     channels = new Map();
+    openedAt = new WeakMap();
     owners = new Map();
     chains = new Map();
     /** Credentials whose WebSocket handshake was refused; they use HTTP for the session. */
@@ -224,34 +225,47 @@ class SocketSession {
                 this.httpOnly.add(key);
                 return this.httpFetch(input, init);
             }
+            this.openedAt.set(socket, Date.now());
             this.channels.set(key, socket);
         }
         const active = socket;
         return new Promise((resolve, reject) => {
             let accepted = false, finished = false;
+            let bodyCancelled = false;
+            let eventCount = 0;
             let streamController;
             const stream = new ReadableStream({
                 start(controller) {
                     streamController = controller;
                 },
                 cancel() {
+                    bodyCancelled = true;
                     active.terminate();
                 },
             }, { highWaterMark: this.maxBytes, size: (chunk) => chunk.byteLength });
             const cleanup = () => {
                 active.off("message", onMessage);
-                active.off("close", onClose);
-                active.off("error", onClose);
+                active.off("close", onSocketClose);
+                active.off("error", onError);
                 init.signal?.removeEventListener("abort", abort);
                 context.signal.removeEventListener("abort", abort);
             };
-            const onClose = () => {
+            const onClose = (closeCode, cause = "close") => {
                 if (finished)
                     return;
                 finished = true;
                 cleanup();
                 this.channels.delete(key);
-                const cancelled = context.signal.aborted || this.closed;
+                const cancelled = bodyCancelled || init.signal?.aborted || context.signal.aborted || this.closed;
+                if (!cancelled) {
+                    const at = Date.now();
+                    this.stats.lastDisconnect = {
+                        at, cause, routeKind: context.routeKind,
+                        connectionAgeMs: Math.max(0, at - (this.openedAt.get(active) ?? at)), eventCount,
+                        stage: accepted ? "streaming" : "awaiting_first_event",
+                        ...(typeof closeCode === "number" ? { closeCode } : {}),
+                    };
+                }
                 // Once create has been sent, a disconnect cannot prove generation
                 // did not start. Never replay it, even before the first event.
                 const error = cancelled
@@ -269,8 +283,11 @@ class SocketSession {
                     }));
                 }
             };
+            const onSocketClose = (code) => onClose(code);
+            const onError = () => onClose(undefined, "transport_error");
             const abort = () => active.terminate();
             const onMessage = (raw, isBinary) => {
+                let failureCause = "invalid_event";
                 try {
                     if (isBinary)
                         throw Error("Unexpected binary response");
@@ -278,6 +295,7 @@ class SocketSession {
                     const event = JSON.parse(text);
                     if (!isRecord(event) || typeof event.type !== "string")
                         throw Error("Invalid response event");
+                    eventCount++;
                     if (event.type === "error" && !accepted) {
                         finished = true;
                         cleanup();
@@ -297,8 +315,10 @@ class SocketSession {
                             headers: { ...handshakeHeaders, "content-type": "text/event-stream" },
                         }));
                     }
-                    if ((streamController.desiredSize ?? 0) < -this.maxBytes)
+                    if ((streamController.desiredSize ?? 0) < -this.maxBytes) {
+                        failureCause = "buffer_limit";
                         throw Error("Upstream buffer exceeded");
+                    }
                     streamController.enqueue(Buffer.from(`data: ${text}\n\n`));
                     if (isRecord(event.response) &&
                         typeof event.response.id === "string") {
@@ -316,13 +336,13 @@ class SocketSession {
                     }
                 }
                 catch {
+                    onClose(undefined, failureCause);
                     active.terminate();
-                    onClose();
                 }
             };
             active.on("message", onMessage);
-            active.once("close", onClose);
-            active.once("error", onClose);
+            active.once("close", onSocketClose);
+            active.once("error", onError);
             init.signal?.addEventListener("abort", abort, { once: true });
             context.signal.addEventListener("abort", abort, { once: true });
             if (init.signal?.aborted || context.signal.aborted) {
@@ -331,8 +351,10 @@ class SocketSession {
             }
             this.stats.upstreamRequests++;
             active.send(JSON.stringify(body), (error) => {
-                if (error)
-                    onClose();
+                if (error) {
+                    onClose(undefined, "send_error");
+                    active.terminate();
+                }
             });
         });
     }
@@ -548,7 +570,7 @@ export class ResponsesWebSocketGateway {
                     const controller = new AbortController();
                     session.controller = controller;
                     const clientBeta = req.headers["openai-beta"];
-                    this.contexts.set(id, { session, previousId, delta: event.input, signal: controller.signal, clientBeta: typeof clientBeta === "string" ? clientBeta : undefined });
+                    this.contexts.set(id, { routeKind: pool, session, previousId, delta: event.input, signal: controller.signal, clientBeta: typeof clientBeta === "string" ? clientBeta : undefined });
                     const headers = new Headers();
                     for (const [key, value] of Object.entries(req.headers)) {
                         if (typeof value === "string" &&

package/dist/lib/runtime/rotation-account-selection.d.ts

@@ -1,8 +1,27 @@
 import { type SubscriptionQuotaPreference } from "./subscription-quota-order.js";
-import type { AccountManager, ManagedAccount } from "../accounts.js";
+import { type AccountManager, type ManagedAccount } from "../accounts.js";
 import type { ModelFamily } from "../prompts/codex.js";
 import type { RuntimePolicyDecision } from "../policy/runtime-policy.js";
 import type { SessionAffinityStore } from "../session-affinity.js";
+/**
+ * Select a managed credential for transcription without consulting or mutating
+ * Codex inference health, quota, cooldown, circuit-breaker, affinity, or cursor
+ * state. Transcription shares account authentication and workspace policy with
+ * inference, but it is a separately admitted operation and must not inherit
+ * model-runtime backpressure.
+ */
+export declare function chooseTranscriptionAccount(params: {
+    accountManager: AccountManager;
+    attemptedIndexes: ReadonlySet<number>;
+    policy: RuntimePolicyDecision | null;
+    pinnedIndex: number | null;
+    now: number;
+    transcriptionRateLimitUntilByRecordId?: ReadonlyMap<string, number>;
+    startIndex?: number | null;
+    preferredIndex?: number | null;
+    fallbackPinnedIndex?: number | null;
+    skipReasons?: Map<number, string>;
+}): ManagedAccount | null;
 /**
  * `chooseAccount` is a SYNC selector that internally advances the rotation
  * cursor (the session-affinity-preferred branch and the round-robin fallback

package/dist/lib/runtime/rotation-account-selection.js

@@ -1,4 +1,5 @@
 import { compareSubscriptionQuota, usesSubscriptionReserve } from "./subscription-quota-order.js";
+import { AUTH_INVALIDATION_MARKER } from "../accounts.js";
 /**
  * Whether a runtime skip reason is a cooldown, the one blocker a pinned
  * retry may waive. `getManagedAccountRuntimeSkipReason` emits either the
@@ -7,6 +8,84 @@ import { compareSubscriptionQuota, usesSubscriptionReserve } from "./subscriptio
 function isCooldownReason(reason) {
     return reason === "cooling-down" || reason.startsWith("cooling-down:");
 }
+/**
+ * Select a managed credential for transcription without consulting or mutating
+ * Codex inference health, quota, cooldown, circuit-breaker, affinity, or cursor
+ * state. Transcription shares account authentication and workspace policy with
+ * inference, but it is a separately admitted operation and must not inherit
+ * model-runtime backpressure.
+ */
+export function chooseTranscriptionAccount(params) {
+    const { accountManager, attemptedIndexes, policy, pinnedIndex, now, transcriptionRateLimitUntilByRecordId, startIndex, preferredIndex, fallbackPinnedIndex, skipReasons, } = params;
+    /** Return only credential-level blockers; inference runtime health is intentionally ignored. */
+    const credentialReason = (index) => {
+        const account = accountManager.getAccountByIndex(index);
+        if (!account)
+            return "missing";
+        if (account.enabled === false)
+            return "disabled";
+        if (!accountManager.hasEnabledWorkspaces(account))
+            return "workspace-disabled";
+        if (accountManager.isAccountAuthInvalidated(account))
+            return AUTH_INVALIDATION_MARKER;
+        if (account.cooldownReason === "auth-failure" &&
+            typeof account.coolingDownUntil === "number" &&
+            account.coolingDownUntil > now)
+            return "cooling-down:auth-failure";
+        const transcriptionRateLimitUntil = account.recordId
+            ? transcriptionRateLimitUntilByRecordId?.get(account.recordId)
+            : undefined;
+        if (typeof transcriptionRateLimitUntil === "number" && transcriptionRateLimitUntil > now) {
+            return "transcription-rate-limited";
+        }
+        if (policy?.blockedAccountIndexes.has(index))
+            return "policy-blocked";
+        if (attemptedIndexes.has(index))
+            return "already-attempted";
+        return null;
+    };
+    /** Resolve one candidate while preserving a diagnostic skip reason for rejected credentials. */
+    const eligible = (index) => {
+        const reason = credentialReason(index);
+        if (reason) {
+            skipReasons?.set(index, reason);
+            return null;
+        }
+        return accountManager.getAccountByIndex(index);
+    };
+    if (typeof pinnedIndex === "number")
+        return eligible(pinnedIndex);
+    if (typeof fallbackPinnedIndex === "number") {
+        const fallback = eligible(fallbackPinnedIndex);
+        if (fallback)
+            return fallback;
+    }
+    let candidates = accountManager.getAccountsSnapshot().filter((account) => credentialReason(account.index) === null);
+    if (!candidates.length) {
+        for (const account of accountManager.getAccountsSnapshot()) {
+            const reason = credentialReason(account.index);
+            if (reason)
+                skipReasons?.set(account.index, reason);
+        }
+        return null;
+    }
+    if (policy?.priorityByAccount) {
+        const tier = Math.min(...candidates.map((account) => policy.priorityByAccount?.[account.index] ?? 1));
+        candidates = candidates.filter((account) => (policy.priorityByAccount?.[account.index] ?? 1) === tier);
+    }
+    if (typeof preferredIndex === "number") {
+        const preferred = candidates.find((account) => account.index === preferredIndex);
+        if (preferred)
+            return accountManager.getAccountByIndex(preferred.index);
+    }
+    if (typeof startIndex === "number" && candidates.length > 1) {
+        const after = candidates.filter((account) => account.index >= startIndex);
+        const before = candidates.filter((account) => account.index < startIndex);
+        candidates = [...after, ...before];
+    }
+    const first = candidates[0];
+    return first ? accountManager.getAccountByIndex(first.index) : null;
+}
 /**
  * `chooseAccount` is a SYNC selector that internally advances the rotation
  * cursor (the session-affinity-preferred branch and the round-robin fallback
@@ -58,8 +137,13 @@ export function chooseAccount(params) {
         }
         const tier = Math.min(...candidates.map(a => priorities[a.index] ?? 1));
         const tierIndexes = new Set(candidates.filter(a => (priorities[a.index] ?? 1) === tier).map(a => a.index));
-        let preferred = params.preferredIndex;
-        if (quotaByAccount) {
+        // Runtime policy fills default priority 1 even without a configured order.
+        const useSavedOrder = schedulingStrategy === "sequential" &&
+            Object.values(priorities).some(priority => priority !== 1);
+        let preferred = useSavedOrder
+            ? candidates.find(account => tierIndexes.has(account.index))?.index
+            : params.preferredIndex;
+        if (quotaByAccount && schedulingStrategy !== "sequential") {
             // Rank only measured accounts: "no data" compares equal to everything, which
             // is not transitive and would make the winner depend on storage order.
             const ranked = candidates.flatMap(a => {
@@ -75,19 +159,25 @@ export function chooseAccount(params) {
             }
         }
         // Re-evaluate tiers on every attempt. Never persist a temporary tier block.
-        return chooseAccount({
+        const selected = chooseAccount({
             ...params,
             policy: {
                 ...policy,
                 priorityByAccount: undefined,
                 blockedAccountIndexes: new Set([
                     ...policy.blockedAccountIndexes,
-                    ...accountManager.getAccountsSnapshot().filter(a => !tierIndexes.has(a.index)).map(a => a.index),
+                    // A retry alone must not make a healthy sequential primary unusable.
+                    ...accountManager.getAccountsSnapshot().filter(a => !tierIndexes.has(a.index) && (schedulingStrategy !== "sequential" || !attemptedIndexes.has(a.index) ||
+                        quotaByAccount?.[a.index]?.exhausted ||
+                        (hasNonReserve && usesSubscriptionReserve(quotaByAccount?.[a.index])))).map(a => a.index),
                 ]),
             },
             fallbackPinnedIndex: null,
             pinnedIndex: typeof preferred === "number" && tierIndexes.has(preferred) ? preferred : null,
         });
+        if (selected && schedulingStrategy === "sequential")
+            selected.lastUsed = now;
+        return selected;
     }
     // Manual pin (from `codex-multi-auth switch <n>`) overrides every other
     // selection signal. We do NOT call markSwitched here — the proxy must not

package/dist/lib/runtime/rotation-proxy-state.d.ts

@@ -32,6 +32,13 @@ export interface RotationProxyStateInit {
     routingMutexMode: "enabled" | "legacy";
     schedulingStrategy: "hybrid" | "sequential";
     fetchImpl: typeof fetch;
+    /**
+     * The embedder's configured fetcher, captured before `state.fetchImpl` is
+     * rebound to the WebSocket gateway. Capability/doc probes must use this —
+     * the gateway fetch exists for Responses transport upgrades, and bare
+     * `fetch` would bypass a custom fetcher's instrumentation entirely.
+     */
+    upstreamFetchImpl: typeof fetch;
     upstreamBaseUrl: string;
     clientApiKey: string;
     now: () => number;
@@ -96,8 +103,27 @@ export interface RotationProxyState extends RotationProxyStateInit {
     lastGlobalSwitchAt: number;
     staleRuntimeReloadPromise: Promise<AccountManager | null> | null;
     lastStaleRuntimeReloadAt: number;
+    credentialReloadPromise: Promise<AccountManager | null> | null;
+    lastCredentialReloadAt: number;
+    transcriptionNextAccountIndex: number;
+    readonly transcriptionRateLimitUntilByRecordId: Map<string, number>;
 }
 /** @internal */
 export declare function createRotationProxyState(init: RotationProxyStateInit): RotationProxyState;
+/**
+ * Reload account credentials without resetting inference runtime state.
+ *
+ * This is intentionally narrower than {@link recoverStaleRuntimeState}: it is
+ * used when a non-inference operation discovers that its in-memory credential
+ * inventory is stale after an external login/enable action. Fresh credential,
+ * workspace, enabled and auth-invalidation fields come from disk, while live
+ * inference rate-limit windows and non-auth cooldowns are carried forward by
+ * stable account identity. An auth-failure cooldown is carried only while the
+ * access token is unchanged, so a genuine re-login can repair the credential.
+ * Process-global health/token trackers and circuit breakers are never reset.
+ *
+ * @internal
+ */
+export declare function reloadRuntimeCredentials(state: RotationProxyState): Promise<AccountManager | null>;
 /** @internal */
 export declare function recoverStaleRuntimeState(state: RotationProxyState): Promise<AccountManager | null>;