codex-multi-auth 2.21.0 → 2.23.0

package/dist/lib/runtime/rotation-account-selection.d.ts

@@ -1,8 +1,27 @@
 import { type SubscriptionQuotaPreference } from "./subscription-quota-order.js";
-import type { AccountManager, ManagedAccount } from "../accounts.js";
+import { type AccountManager, type ManagedAccount } from "../accounts.js";
 import type { ModelFamily } from "../prompts/codex.js";
 import type { RuntimePolicyDecision } from "../policy/runtime-policy.js";
 import type { SessionAffinityStore } from "../session-affinity.js";
+/**
+ * Select a managed credential for transcription without consulting or mutating
+ * Codex inference health, quota, cooldown, circuit-breaker, affinity, or cursor
+ * state. Transcription shares account authentication and workspace policy with
+ * inference, but it is a separately admitted operation and must not inherit
+ * model-runtime backpressure.
+ */
+export declare function chooseTranscriptionAccount(params: {
+    accountManager: AccountManager;
+    attemptedIndexes: ReadonlySet<number>;
+    policy: RuntimePolicyDecision | null;
+    pinnedIndex: number | null;
+    now: number;
+    transcriptionRateLimitUntilByRecordId?: ReadonlyMap<string, number>;
+    startIndex?: number | null;
+    preferredIndex?: number | null;
+    fallbackPinnedIndex?: number | null;
+    skipReasons?: Map<number, string>;
+}): ManagedAccount | null;
 /**
  * `chooseAccount` is a SYNC selector that internally advances the rotation
  * cursor (the session-affinity-preferred branch and the round-robin fallback
@@ -43,16 +62,17 @@ export declare function chooseAccount(params: {
     /**
      * Admit a pinned account that is only blocked by its own cooldown.
      *
-     * Set by the proxy for the RETRY passes of one pinned request, never for
-     * the first pass. A cooldown exists to keep OTHER requests off a flaky
-     * account; a retry budget exists to give THIS request another attempt.
+     * Set by the proxy for RETRY passes, or the first pass when a pin only
+     * has a shared network-error cooldown. Independent concurrent work must
+     * not fail solely because another request encountered a transport error.
+     * Other cooldown reasons still protect the pin from new requests.
      * Conflating them meant every transient branch cooled the pin down before
      * the next selection pass and the budget could never be spent — a pinned
      * request got exactly one upstream attempt under shipped defaults.
      *
      * Only the cooldown is waived. Rate limits, an open circuit, a disabled
      * account, workspace and policy blocks all still reject the pin, and the
-     * cooldown itself stays on the account for everyone else and for the 503's
+     * cooldown itself stays on the account for unpinned selection and the 503's
      * `retry_after_ms`.
      *
      * One ordering note: `getAccountRuntimeSkipReason` reports the FIRST

package/dist/lib/runtime/rotation-account-selection.js

@@ -1,4 +1,5 @@
 import { compareSubscriptionQuota, usesSubscriptionReserve } from "./subscription-quota-order.js";
+import { AUTH_INVALIDATION_MARKER } from "../accounts.js";
 /**
  * Whether a runtime skip reason is a cooldown, the one blocker a pinned
  * retry may waive. `getManagedAccountRuntimeSkipReason` emits either the
@@ -7,6 +8,84 @@ import { compareSubscriptionQuota, usesSubscriptionReserve } from "./subscriptio
 function isCooldownReason(reason) {
     return reason === "cooling-down" || reason.startsWith("cooling-down:");
 }
+/**
+ * Select a managed credential for transcription without consulting or mutating
+ * Codex inference health, quota, cooldown, circuit-breaker, affinity, or cursor
+ * state. Transcription shares account authentication and workspace policy with
+ * inference, but it is a separately admitted operation and must not inherit
+ * model-runtime backpressure.
+ */
+export function chooseTranscriptionAccount(params) {
+    const { accountManager, attemptedIndexes, policy, pinnedIndex, now, transcriptionRateLimitUntilByRecordId, startIndex, preferredIndex, fallbackPinnedIndex, skipReasons, } = params;
+    /** Return only credential-level blockers; inference runtime health is intentionally ignored. */
+    const credentialReason = (index) => {
+        const account = accountManager.getAccountByIndex(index);
+        if (!account)
+            return "missing";
+        if (account.enabled === false)
+            return "disabled";
+        if (!accountManager.hasEnabledWorkspaces(account))
+            return "workspace-disabled";
+        if (accountManager.isAccountAuthInvalidated(account))
+            return AUTH_INVALIDATION_MARKER;
+        if (account.cooldownReason === "auth-failure" &&
+            typeof account.coolingDownUntil === "number" &&
+            account.coolingDownUntil > now)
+            return "cooling-down:auth-failure";
+        const transcriptionRateLimitUntil = account.recordId
+            ? transcriptionRateLimitUntilByRecordId?.get(account.recordId)
+            : undefined;
+        if (typeof transcriptionRateLimitUntil === "number" && transcriptionRateLimitUntil > now) {
+            return "transcription-rate-limited";
+        }
+        if (policy?.blockedAccountIndexes.has(index))
+            return "policy-blocked";
+        if (attemptedIndexes.has(index))
+            return "already-attempted";
+        return null;
+    };
+    /** Resolve one candidate while preserving a diagnostic skip reason for rejected credentials. */
+    const eligible = (index) => {
+        const reason = credentialReason(index);
+        if (reason) {
+            skipReasons?.set(index, reason);
+            return null;
+        }
+        return accountManager.getAccountByIndex(index);
+    };
+    if (typeof pinnedIndex === "number")
+        return eligible(pinnedIndex);
+    if (typeof fallbackPinnedIndex === "number") {
+        const fallback = eligible(fallbackPinnedIndex);
+        if (fallback)
+            return fallback;
+    }
+    let candidates = accountManager.getAccountsSnapshot().filter((account) => credentialReason(account.index) === null);
+    if (!candidates.length) {
+        for (const account of accountManager.getAccountsSnapshot()) {
+            const reason = credentialReason(account.index);
+            if (reason)
+                skipReasons?.set(account.index, reason);
+        }
+        return null;
+    }
+    if (policy?.priorityByAccount) {
+        const tier = Math.min(...candidates.map((account) => policy.priorityByAccount?.[account.index] ?? 1));
+        candidates = candidates.filter((account) => (policy.priorityByAccount?.[account.index] ?? 1) === tier);
+    }
+    if (typeof preferredIndex === "number") {
+        const preferred = candidates.find((account) => account.index === preferredIndex);
+        if (preferred)
+            return accountManager.getAccountByIndex(preferred.index);
+    }
+    if (typeof startIndex === "number" && candidates.length > 1) {
+        const after = candidates.filter((account) => account.index >= startIndex);
+        const before = candidates.filter((account) => account.index < startIndex);
+        candidates = [...after, ...before];
+    }
+    const first = candidates[0];
+    return first ? accountManager.getAccountByIndex(first.index) : null;
+}
 /**
  * `chooseAccount` is a SYNC selector that internally advances the rotation
  * cursor (the session-affinity-preferred branch and the round-robin fallback
@@ -58,8 +137,13 @@ export function chooseAccount(params) {
         }
         const tier = Math.min(...candidates.map(a => priorities[a.index] ?? 1));
         const tierIndexes = new Set(candidates.filter(a => (priorities[a.index] ?? 1) === tier).map(a => a.index));
-        let preferred = params.preferredIndex;
-        if (quotaByAccount) {
+        // Runtime policy fills default priority 1 even without a configured order.
+        const useSavedOrder = schedulingStrategy === "sequential" &&
+            Object.values(priorities).some(priority => priority !== 1);
+        let preferred = useSavedOrder
+            ? candidates.find(account => tierIndexes.has(account.index))?.index
+            : params.preferredIndex;
+        if (quotaByAccount && schedulingStrategy !== "sequential") {
             // Rank only measured accounts: "no data" compares equal to everything, which
             // is not transitive and would make the winner depend on storage order.
             const ranked = candidates.flatMap(a => {
@@ -75,19 +159,25 @@ export function chooseAccount(params) {
             }
         }
         // Re-evaluate tiers on every attempt. Never persist a temporary tier block.
-        return chooseAccount({
+        const selected = chooseAccount({
             ...params,
             policy: {
                 ...policy,
                 priorityByAccount: undefined,
                 blockedAccountIndexes: new Set([
                     ...policy.blockedAccountIndexes,
-                    ...accountManager.getAccountsSnapshot().filter(a => !tierIndexes.has(a.index)).map(a => a.index),
+                    // A retry alone must not make a healthy sequential primary unusable.
+                    ...accountManager.getAccountsSnapshot().filter(a => !tierIndexes.has(a.index) && (schedulingStrategy !== "sequential" || !attemptedIndexes.has(a.index) ||
+                        quotaByAccount?.[a.index]?.exhausted ||
+                        (hasNonReserve && usesSubscriptionReserve(quotaByAccount?.[a.index])))).map(a => a.index),
                 ]),
             },
             fallbackPinnedIndex: null,
             pinnedIndex: typeof preferred === "number" && tierIndexes.has(preferred) ? preferred : null,
         });
+        if (selected && schedulingStrategy === "sequential")
+            selected.lastUsed = now;
+        return selected;
     }
     // Manual pin (from `codex-multi-auth switch <n>`) overrides every other
     // selection signal. We do NOT call markSwitched here — the proxy must not

package/dist/lib/runtime/rotation-proxy-state.d.ts

@@ -32,6 +32,13 @@ export interface RotationProxyStateInit {
     routingMutexMode: "enabled" | "legacy";
     schedulingStrategy: "hybrid" | "sequential";
     fetchImpl: typeof fetch;
+    /**
+     * The embedder's configured fetcher, captured before `state.fetchImpl` is
+     * rebound to the WebSocket gateway. Capability/doc probes must use this —
+     * the gateway fetch exists for Responses transport upgrades, and bare
+     * `fetch` would bypass a custom fetcher's instrumentation entirely.
+     */
+    upstreamFetchImpl: typeof fetch;
     upstreamBaseUrl: string;
     clientApiKey: string;
     now: () => number;
@@ -96,8 +103,27 @@ export interface RotationProxyState extends RotationProxyStateInit {
     lastGlobalSwitchAt: number;
     staleRuntimeReloadPromise: Promise<AccountManager | null> | null;
     lastStaleRuntimeReloadAt: number;
+    credentialReloadPromise: Promise<AccountManager | null> | null;
+    lastCredentialReloadAt: number;
+    transcriptionNextAccountIndex: number;
+    readonly transcriptionRateLimitUntilByRecordId: Map<string, number>;
 }
 /** @internal */
 export declare function createRotationProxyState(init: RotationProxyStateInit): RotationProxyState;
+/**
+ * Reload account credentials without resetting inference runtime state.
+ *
+ * This is intentionally narrower than {@link recoverStaleRuntimeState}: it is
+ * used when a non-inference operation discovers that its in-memory credential
+ * inventory is stale after an external login/enable action. Fresh credential,
+ * workspace, enabled and auth-invalidation fields come from disk, while live
+ * inference rate-limit windows and non-auth cooldowns are carried forward by
+ * stable account identity. An auth-failure cooldown is carried only while the
+ * access token is unchanged, so a genuine re-login can repair the credential.
+ * Process-global health/token trackers and circuit breakers are never reset.
+ *
+ * @internal
+ */
+export declare function reloadRuntimeCredentials(state: RotationProxyState): Promise<AccountManager | null>;
 /** @internal */
 export declare function recoverStaleRuntimeState(state: RotationProxyState): Promise<AccountManager | null>;

package/dist/lib/runtime/rotation-proxy-state.js

@@ -1,6 +1,61 @@
-import { AccountManager } from "../accounts.js";
+import { AccountManager, sanitizeEmail } from "../accounts.js";
 import { recordRuntimeReload, recordRuntimeReset, } from "./runtime-observability.js";
+import { redirectRuntimeRefreshCommits, waitForRuntimeRefreshCommits } from "./rotation-token-refresh.js";
 const STALE_RUNTIME_RELOAD_DEDUPE_MS = 1_000;
+/**
+ * Copy credentials that rotated on `previousManager` since `authBeforeLoad`
+ * into the matching rows of `reloaded`. A replacement snapshot read before a
+ * refresh commit persisted still holds the spent single-use refresh token;
+ * without this carry the swap reintroduces it and the next refresh fails with
+ * token reuse. Matching is deliberately conservative — persisted record id,
+ * then the refresh token on either side of the rotation, then accountId+email —
+ * so a credential never lands on a different account.
+ */
+function carryRotatedCredentials(previousManager, authBeforeLoad, reloaded) {
+    const candidates = reloaded.getAccountsSnapshot();
+    for (const previous of previousManager.getAccountsSnapshot()) {
+        const baseline = authBeforeLoad.find((account) => (account.recordId && account.recordId === previous.recordId) ||
+            account.index === previous.index);
+        if (!baseline ||
+            (baseline.access === previous.access &&
+                baseline.refreshToken === previous.refreshToken &&
+                baseline.expires === previous.expires)) {
+            continue;
+        }
+        const rotatedTokens = new Set([previous.refreshToken, baseline.refreshToken]);
+        const sourceEmail = sanitizeEmail(previous.email);
+        const matches = candidates.filter((candidate) => (previousManager.hasPersistedRecordId(previous) &&
+            candidate.recordId === previous.recordId) ||
+            rotatedTokens.has(candidate.refreshToken) ||
+            (previous.accountId !== undefined &&
+                candidate.accountId === previous.accountId &&
+                sanitizeEmail(candidate.email) === sourceEmail));
+        const [matched] = matches;
+        if (matches.length !== 1 || !matched)
+            continue;
+        const live = reloaded.getAccountByIndex(matched.index);
+        if (!live)
+            continue;
+        live.access = previous.access;
+        live.refreshToken = previous.refreshToken;
+        live.expires = previous.expires;
+        // Token-bound identity (accountId/accountIdSource/email) rides along with
+        // the rotated credential — `commitRefreshedAuth` can refresh it during the
+        // same window, and without it the row keeps a workspace binding issued for
+        // the spent token. Explicit manual/org bindings stay authoritative.
+        const tokenBoundIdentityChanged = baseline.accountId !== previous.accountId ||
+            baseline.accountIdSource !== previous.accountIdSource;
+        const liveHasExplicitBinding = live.accountIdSource === "manual" || live.accountIdSource === "org";
+        const previousHasTokenBinding = previous.accountIdSource === "token" || previous.accountIdSource === "id_token";
+        if (tokenBoundIdentityChanged && previousHasTokenBinding && !liveHasExplicitBinding) {
+            live.accountId = previous.accountId;
+            live.accountIdSource = previous.accountIdSource;
+        }
+        if (baseline.email !== previous.email) {
+            live.email = previous.email;
+        }
+    }
+}
 /** @internal */
 export function createRotationProxyState(init) {
     return {
@@ -24,21 +79,325 @@ export function createRotationProxyState(init) {
         lastGlobalSwitchAt: 0,
         staleRuntimeReloadPromise: null,
         lastStaleRuntimeReloadAt: 0,
+        credentialReloadPromise: null,
+        lastCredentialReloadAt: 0,
+        transcriptionNextAccountIndex: 0,
+        transcriptionRateLimitUntilByRecordId: new Map(),
     };
 }
+/**
+ * Reload account credentials without resetting inference runtime state.
+ *
+ * This is intentionally narrower than {@link recoverStaleRuntimeState}: it is
+ * used when a non-inference operation discovers that its in-memory credential
+ * inventory is stale after an external login/enable action. Fresh credential,
+ * workspace, enabled and auth-invalidation fields come from disk, while live
+ * inference rate-limit windows and non-auth cooldowns are carried forward by
+ * stable account identity. An auth-failure cooldown is carried only while the
+ * access token is unchanged, so a genuine re-login can repair the credential.
+ * Process-global health/token trackers and circuit breakers are never reset.
+ *
+ * @internal
+ */
+export async function reloadRuntimeCredentials(state) {
+    // Inference stale recovery is destructive by design and takes precedence over
+    // the credential-only refresh. Sharing the in-flight result prevents two
+    // asynchronous loaders from racing to replace activeAccountManager.
+    if (state.staleRuntimeReloadPromise)
+        return state.staleRuntimeReloadPromise;
+    if (Date.now() - state.lastCredentialReloadAt <= STALE_RUNTIME_RELOAD_DEDUPE_MS) {
+        return state.activeAccountManager;
+    }
+    if (state.credentialReloadPromise)
+        return state.credentialReloadPromise;
+    state.credentialReloadPromise = (async () => {
+        const previousManager = state.activeAccountManager;
+        /** Stable matching key for carrying only runtime observations between credential snapshots. */
+        const identityOf = (account) => {
+            const accountId = account.accountId?.trim();
+            const email = sanitizeEmail(account.email);
+            return accountId || email
+                ? JSON.stringify([accountId ?? null, email ?? null])
+                : account.refreshToken?.trim()
+                    ? `refresh:${account.refreshToken.trim()}`
+                    : null;
+        };
+        // Capture auth before I/O so a token rotation that lands while loadFromDisk
+        // is suspended can be distinguished from credentials intentionally changed
+        // on disk by another login. Only the former is carried into the replacement.
+        const authBeforeLoad = previousManager.getAccountsSnapshot();
+        const reloaded = await AccountManager.loadFromDisk();
+        if (state.activeAccountManager !== previousManager) {
+            // Another path (native storage sync, stale recovery) already swapped
+            // the manager while disk I/O was pending; never clobber its redirect.
+            state.lastCredentialReloadAt = Date.now();
+            return state.activeAccountManager;
+        }
+        reloaded.setRoutingMutexMode(state.routingMutexMode);
+        const freshAccounts = reloaded.getAccountsSnapshot();
+        // loadFromDisk intentionally converts an unreadable/corrupt source with no
+        // usable WAL/backup into an empty manager. Do not let a transient read
+        // failure erase a healthy resident pool; a parsed empty/reset snapshot is
+        // still authoritative and may intentionally remove every account.
+        if (authBeforeLoad.length > 0 &&
+            freshAccounts.length === 0 &&
+            !reloaded.hasLoadedAccountStorageSnapshot()) {
+            state.lastCredentialReloadAt = Date.now();
+            return previousManager;
+        }
+        // A refresh can finish upstream while disk I/O is pending and then queue
+        // its auth commit against the resident manager. Let every commit already
+        // targeting that manager settle before taking the final live snapshot.
+        await waitForRuntimeRefreshCommits(previousManager);
+        if (state.activeAccountManager !== previousManager) {
+            state.lastCredentialReloadAt = Date.now();
+            return state.activeAccountManager;
+        }
+        const previousAccounts = previousManager.getAccountsSnapshot();
+        const credentialInventoryFingerprint = (accounts) => JSON.stringify(accounts.map((account) => ({
+            recordId: account.recordId ?? null,
+            accountId: account.accountId?.trim() ?? null,
+            accountIdSource: account.accountIdSource ?? null,
+            email: sanitizeEmail(account.email) ?? null,
+            refreshToken: account.refreshToken,
+            access: account.access ?? null,
+            expires: account.expires ?? null,
+            enabled: account.enabled !== false,
+            authInvalidatedAt: account.authInvalidatedAt ?? null,
+            authInvalidationErrorCode: account.authInvalidationErrorCode ?? null,
+            workspaces: (account.workspaces ?? []).map((workspace) => ({
+                id: workspace.id.trim(),
+                name: workspace.name ?? null,
+                enabled: workspace.enabled !== false,
+                disabledAt: workspace.disabledAt ?? null,
+                isDefault: workspace.isDefault ?? null,
+            })),
+            currentWorkspaceIndex: account.currentWorkspaceIndex ?? null,
+        })));
+        // A credential probe that finds the exact same inventory must not swap the
+        // live manager. Returning the resident object preserves inference cursors,
+        // lastUsed state, and in-flight runtime observations while still bounding
+        // disk checks through lastCredentialReloadAt.
+        if (credentialInventoryFingerprint(authBeforeLoad) === credentialInventoryFingerprint(freshAccounts)) {
+            // Cooldown fields are deliberately excluded from the inventory fingerprint
+            // so a disk probe cannot reset inference selector state. Still absorb a
+            // newer persisted auth-failure cooldown from another proxy, but only when
+            // the credential itself is unchanged; a re-login/rotation repairs that wait.
+            for (const fresh of freshAccounts) {
+                const resident = previousManager.getAccountByIndex(fresh.index);
+                if (resident &&
+                    fresh.cooldownReason === "auth-failure" &&
+                    typeof fresh.coolingDownUntil === "number" &&
+                    fresh.coolingDownUntil > state.now() &&
+                    resident.access === fresh.access &&
+                    resident.refreshToken === fresh.refreshToken &&
+                    fresh.coolingDownUntil > (resident.coolingDownUntil ?? 0)) {
+                    resident.coolingDownUntil = fresh.coolingDownUntil;
+                    resident.cooldownReason = "auth-failure";
+                }
+            }
+            state.lastCredentialReloadAt = Date.now();
+            return previousManager;
+        }
+        const baselineFor = (previous) => authBeforeLoad.find((account) => (account.recordId && account.recordId === previous.recordId) ||
+            account.index === previous.index);
+        const workspaceIds = (account) => new Set([
+            account.accountId?.trim(),
+            ...(account.workspaces ?? []).map((workspace) => workspace.id.trim()),
+        ].filter((value) => Boolean(value)));
+        const hasWorkspaceConflict = (previous, baseline, candidate) => {
+            const sourceIds = workspaceIds(previous);
+            if (baseline) {
+                for (const id of workspaceIds(baseline))
+                    sourceIds.add(id);
+            }
+            const candidateIds = workspaceIds(candidate);
+            return sourceIds.size > 0 && candidateIds.size > 0 &&
+                ![...sourceIds].some((id) => candidateIds.has(id));
+        };
+        const claimed = new Set();
+        const matchedFreshIndexByPrevious = new Map();
+        const reserve = (previous, candidate) => {
+            if (!candidate || claimed.has(candidate.index))
+                return false;
+            claimed.add(candidate.index);
+            matchedFreshIndexByPrevious.set(previous.index, candidate.index);
+            return true;
+        };
+        // Reserve every strong match for every old row before considering fuzzy
+        // fallbacks. This prevents an earlier deleted row from stealing the only
+        // surviving same-email workspace before that survivor can claim itself.
+        for (const previous of previousAccounts) {
+            if (!previous.recordId)
+                continue;
+            const matches = freshAccounts.filter((account) => !claimed.has(account.index) && account.recordId === previous.recordId);
+            if (matches.length === 1)
+                reserve(previous, matches[0]);
+        }
+        for (const previous of previousAccounts) {
+            if (matchedFreshIndexByPrevious.has(previous.index))
+                continue;
+            const baseline = baselineFor(previous);
+            const identities = new Set([identityOf(previous), baseline ? identityOf(baseline) : null].filter((identity) => identity !== null));
+            const matches = freshAccounts.filter((account) => {
+                if (claimed.has(account.index))
+                    return false;
+                const identity = identityOf(account);
+                return identity !== null && identities.has(identity);
+            });
+            if (matches.length === 1)
+                reserve(previous, matches[0]);
+        }
+        for (const previous of previousAccounts) {
+            if (matchedFreshIndexByPrevious.has(previous.index))
+                continue;
+            const baseline = baselineFor(previous);
+            const refreshTokens = new Set([previous.refreshToken, baseline?.refreshToken].filter((value) => Boolean(value)));
+            const matches = freshAccounts.filter((account) => !claimed.has(account.index) && refreshTokens.has(account.refreshToken));
+            if (matches.length === 1)
+                reserve(previous, matches[0]);
+        }
+        for (const previous of previousAccounts) {
+            if (matchedFreshIndexByPrevious.has(previous.index))
+                continue;
+            const baseline = baselineFor(previous);
+            const stableEmail = sanitizeEmail(previous.email) ?? sanitizeEmail(baseline?.email);
+            if (!stableEmail)
+                continue;
+            const matches = freshAccounts.filter((account) => !claimed.has(account.index) &&
+                sanitizeEmail(account.email) === stableEmail &&
+                !hasWorkspaceConflict(previous, baseline, account));
+            if (matches.length === 1)
+                reserve(previous, matches[0]);
+        }
+        for (const previous of previousAccounts) {
+            const matchedIndex = matchedFreshIndexByPrevious.get(previous.index);
+            if (matchedIndex === undefined)
+                continue;
+            const baseline = baselineFor(previous);
+            const live = reloaded.getAccountByIndex(matchedIndex);
+            if (!live)
+                continue;
+            const authRotatedDuringLoad = baseline !== undefined && (baseline.access !== previous.access ||
+                baseline.refreshToken !== previous.refreshToken ||
+                baseline.expires !== previous.expires);
+            if (authRotatedDuringLoad) {
+                live.access = previous.access;
+                live.refreshToken = previous.refreshToken;
+                live.expires = previous.expires;
+                const tokenBoundIdentityChanged = baseline !== undefined && (baseline.accountId !== previous.accountId ||
+                    baseline.accountIdSource !== previous.accountIdSource);
+                const liveHasExplicitBinding = live.accountIdSource === "manual" || live.accountIdSource === "org";
+                const previousHasTokenBinding = previous.accountIdSource === "token" || previous.accountIdSource === "id_token";
+                if (tokenBoundIdentityChanged && previousHasTokenBinding && !liveHasExplicitBinding) {
+                    live.accountId = previous.accountId;
+                    live.accountIdSource = previous.accountIdSource;
+                }
+                if (baseline !== undefined && baseline.email !== previous.email) {
+                    live.email = previous.email;
+                }
+            }
+            for (const [key, until] of Object.entries(previous.rateLimitResetTimes)) {
+                if (typeof until === "number" && until > state.now()) {
+                    live.rateLimitResetTimes[key] = Math.max(live.rateLimitResetTimes[key] ?? 0, until);
+                }
+            }
+            if ((previous.coolingDownUntil ?? 0) > (live.coolingDownUntil ?? 0)) {
+                const repairedAuth = previous.cooldownReason === "auth-failure" && previous.access !== live.access;
+                if (!repairedAuth) {
+                    live.coolingDownUntil = previous.coolingDownUntil;
+                    live.cooldownReason = previous.cooldownReason;
+                }
+            }
+            const sameCredential = live.access === previous.access && live.refreshToken === previous.refreshToken;
+            // Auth-invalidation and workspace-disable markers are written in memory
+            // first and only reach disk through the debounced save. Carry only a
+            // marker that landed during the load window (absent from the baseline):
+            // a pre-existing marker may have been legitimately cleared on disk by
+            // another process, which is then authoritative. A re-login (rotated
+            // credential) legitimately clears them either way.
+            const baselineInvalidated = baseline !== undefined && previousManager.isAccountAuthInvalidated(baseline);
+            if (sameCredential &&
+                !baselineInvalidated &&
+                previousManager.isAccountAuthInvalidated(previous) &&
+                !reloaded.isAccountAuthInvalidated(live)) {
+                live.authInvalidatedAt = previous.authInvalidatedAt;
+                live.authInvalidationErrorCode = previous.authInvalidationErrorCode;
+            }
+            if (sameCredential) {
+                for (const workspace of previous.workspaces ?? []) {
+                    const baselineWorkspace = baseline?.workspaces?.find((item) => item.id === workspace.id);
+                    // A disable that predates the load is already in the baseline —
+                    // disk may have re-enabled the workspace, and that wins.
+                    if (baselineWorkspace?.enabled === false)
+                        continue;
+                    const target = live.workspaces?.find((item) => item.id === workspace.id);
+                    if (target &&
+                        workspace.enabled === false &&
+                        workspace.disabledAt !== undefined &&
+                        target.enabled !== false) {
+                        target.enabled = false;
+                        target.disabledAt = workspace.disabledAt;
+                    }
+                }
+            }
+        }
+        // Requests that captured the resident manager before this swap may finish
+        // refreshing afterward. Redirect those late auth commits to the replacement
+        // so rotated single-use refresh tokens cannot be stranded on the old object.
+        redirectRuntimeRefreshCommits(previousManager, reloaded);
+        state.activeAccountManager = reloaded;
+        state.knownAccountManagers.add(reloaded);
+        state.lastCredentialReloadAt = Date.now();
+        recordRuntimeReload("credential-inventory-refresh");
+        return reloaded;
+    })()
+        .catch((error) => {
+        state.status.lastError = error instanceof Error ? error.message : String(error);
+        return null;
+    })
+        .finally(() => {
+        state.credentialReloadPromise = null;
+    });
+    return state.credentialReloadPromise;
+}
 /** @internal */
 export async function recoverStaleRuntimeState(state) {
+    if (state.staleRuntimeReloadPromise)
+        return state.staleRuntimeReloadPromise;
+    // If a non-destructive credential refresh started first, let it publish its
+    // inventory before performing the authoritative stale-state reset. Re-check
+    // the stale promise afterward so concurrent recovery callers still dedupe.
+    if (state.credentialReloadPromise)
+        await state.credentialReloadPromise;
+    if (state.staleRuntimeReloadPromise)
+        return state.staleRuntimeReloadPromise;
     if (Date.now() - state.lastStaleRuntimeReloadAt <= STALE_RUNTIME_RELOAD_DEDUPE_MS) {
         return state.activeAccountManager;
     }
-    if (state.staleRuntimeReloadPromise) {
-        return state.staleRuntimeReloadPromise;
-    }
     state.staleRuntimeReloadPromise = (async () => {
+        const previousManager = state.activeAccountManager;
+        const authBeforeLoad = previousManager.getAccountsSnapshot();
         AccountManager.resetVolatileRuntimeState();
         recordRuntimeReset("pool-exhausted-no-account");
         const reloaded = await AccountManager.loadFromDisk();
+        if (state.activeAccountManager !== previousManager) {
+            // A concurrent swap (native storage sync, credential reload) already
+            // published a newer manager; discarding this result keeps its redirect
+            // chain intact instead of clobbering previous → live with stale.
+            state.lastStaleRuntimeReloadAt = Date.now();
+            return state.activeAccountManager;
+        }
         reloaded.setRoutingMutexMode(state.routingMutexMode);
+        // Drain refresh commits that queued against the resident manager while
+        // disk I/O was pending, then carry the rotated credentials: the loaded
+        // snapshot predates their persist and still holds the spent token.
+        await waitForRuntimeRefreshCommits(previousManager);
+        if (state.activeAccountManager !== previousManager) {
+            state.lastStaleRuntimeReloadAt = Date.now();
+            return state.activeAccountManager;
+        }
+        carryRotatedCredentials(previousManager, authBeforeLoad, reloaded);
         // Wipe per-account cooldowns and rate-limit windows on the freshly
         // reloaded pool. `resetVolatileRuntimeState` above only cleared global
         // singletons (trackers, circuit breakers); the per-account transient
@@ -63,6 +422,19 @@ export async function recoverStaleRuntimeState(state) {
         // durable across a restart, not just best-effort. Recovery is rare
         // (full-pool exhaustion), so the extra synchronous write is cheap.
         await reloaded.flushPendingSave();
+        // The flush opened another window in which a late commit could queue on
+        // the superseded manager. Drain it, then carry + redirect + swap in one
+        // synchronous block so no commit can slip between the drain and the swap.
+        await waitForRuntimeRefreshCommits(previousManager);
+        if (state.activeAccountManager !== previousManager) {
+            state.lastStaleRuntimeReloadAt = Date.now();
+            return state.activeAccountManager;
+        }
+        carryRotatedCredentials(previousManager, authBeforeLoad, reloaded);
+        // Keep refresh ownership chains current across destructive recovery too.
+        // Requests that captured the previous manager before this swap must never
+        // persist a late refresh/cooldown into an object that is no longer active.
+        redirectRuntimeRefreshCommits(previousManager, reloaded);
         state.activeAccountManager = reloaded;
         state.knownAccountManagers.add(reloaded);
         state.lastStaleRuntimeReloadAt = Date.now();

package/dist/lib/runtime/rotation-server-types.d.ts

@@ -1,3 +1,4 @@
+import type { WebSocketDisconnectDiagnostic, WebSocketUpgradeRejectionDiagnostic } from "./responses-websocket.js";
 import type { QuotaCacheData } from "../quota-cache.js";
 import type { ApiRouteCredential } from "../api-route-store.js";
 import type { AccountStorageV3 } from "../storage.js";
@@ -18,10 +19,15 @@ export interface RuntimeRotationProxyServer {
     getOpenConnectionCount?: () => number;
 }
 export interface RuntimeRotationProxyStatus {
+    schedulingStrategy?: "hybrid" | "sequential";
     streamQuotaUpdates?: number;
     lastStreamQuotaUpdateAt?: number;
     websocketConnections?: number;
     websocketUpstreamRequests?: number;
+    websocketActiveConnections?: number;
+    websocketCapacityReclaims?: number;
+    lastWebsocketUpgradeRejection?: WebSocketUpgradeRejectionDiagnostic;
+    lastWebsocketDisconnect?: WebSocketDisconnectDiagnostic;
     startedAt: number;
     totalRequests: number;
     upstreamRequests: number;