codex-multi-auth 2.22.0 → 2.24.0

package/dist/lib/policy/runtime-policy.d.ts

@@ -25,6 +25,7 @@ export interface RuntimePolicyDecision {
     blockedAccountReasons?: Record<number, string>;
     scoreBoostByAccount: Record<number, number>;
     priorityByAccount?: Record<number, number>;
+    emergencyAccountIndexes?: Set<number>;
     budgetEvaluations: BudgetGuardEvaluation[];
 }
 export interface RuntimePolicyState {

package/dist/lib/policy/runtime-policy.js

@@ -101,6 +101,7 @@ export async function evaluateRuntimePolicy(input) {
     const blockedAccountReasons = {};
     const scoreBoostByAccount = {};
     const priorityByAccount = {};
+    const emergencyAccountIndexes = new Set();
     const profile = input.state.project.profile;
     if (profile?.modelDenylist.length && matchesModel(profile.modelDenylist, input.model)) {
         reasons.push("routing profile denies requested model");
@@ -131,6 +132,8 @@ export async function evaluateRuntimePolicy(input) {
         }, account.index);
         const accountPolicy = input.state.accountPolicies.accounts[accountKey];
         priorityByAccount[account.index] = accountPolicy?.priority ?? 1;
+        if (accountPolicy?.emergencyOnly)
+            emergencyAccountIndexes.add(account.index);
         let boost = 0;
         if (accountPolicy?.paused) {
             blockedAccountIndexes.add(account.index);
@@ -186,6 +189,7 @@ export async function evaluateRuntimePolicy(input) {
         blockedAccountReasons,
         scoreBoostByAccount,
         priorityByAccount,
+        emergencyAccountIndexes,
         budgetEvaluations,
     };
 }

package/dist/lib/preemptive-quota-scheduler.js

@@ -1,4 +1,4 @@
-import { MAX_RATE_LIMIT_DELAY_MS } from "./constants.js";
+import { MAX_RATE_LIMIT_DELAY_MS, RATE_LIMIT_CACHE_TTL_MS } from "./constants.js";
 import { quotaLeftPercentFromUsed } from "./quota-readiness.js";
 const DEFAULT_REMAINING_PERCENT_THRESHOLD = 5;
 const DEFAULT_MAX_DEFERRAL_MS = 2 * 60 * 60_000;
@@ -219,6 +219,11 @@ export class PreemptiveQuotaScheduler {
         const snapshot = this.snapshots.get(key);
         if (!snapshot)
             return { defer: false, waitMs: 0 };
+        const cacheRemainingMs = snapshot.updatedAt + RATE_LIMIT_CACHE_TTL_MS - now;
+        if (cacheRemainingMs <= 0) {
+            this.snapshots.delete(key);
+            return { defer: false, waitMs: 0 };
+        }
         // For a 429 deferral, only count a window whose reset is genuinely a
         // rate-limit / exhaustion window. A window carrying a healthy usedPercent
         // (e.g. a weekly secondary at 30% from a prior 200 snapshot) is NOT the
@@ -239,7 +244,7 @@ export class PreemptiveQuotaScheduler {
             .filter((value) => value > 0);
         const longestWait = waitCandidates.length > 0 ? Math.max(...waitCandidates) : 0;
         if (snapshot.status === 429 && longestWait > 0) {
-            const bounded = Math.min(longestWait, this.maxDeferralMs);
+            const bounded = Math.min(longestWait, this.maxDeferralMs, cacheRemainingMs);
             if (bounded > 0) {
                 return { defer: true, waitMs: bounded, reason: "rate-limit" };
             }
@@ -260,7 +265,11 @@ export class PreemptiveQuotaScheduler {
             ? getNearExhaustedWait(snapshot.secondary)
             : 0);
         if (nearExhaustedWait > 0) {
-            return { defer: true, waitMs: nearExhaustedWait, reason: "quota-near-exhaustion" };
+            return {
+                defer: true,
+                waitMs: Math.min(nearExhaustedWait, cacheRemainingMs),
+                reason: "quota-near-exhaustion",
+            };
         }
         return { defer: false, waitMs: 0 };
     }

package/dist/lib/prompts/codex-host-bridge.js

@@ -7,142 +7,142 @@
  *
  * Token Count: ~450 tokens (~90% reduction vs full host prompt)
  */
-export const CODEX_HOST_BRIDGE = `# Codex Host Bridge
-
-You are running Codex through a host terminal coding runtime. The host provides specific tools to help you work efficiently.
-
-## CRITICAL: Tool Usage
-
-<critical_rule priority="0">
-apply_patch/applyPatch are Codex names, but host tool names vary by version.
-- Inspect the actual tool list before editing.
-- If \`edit\` exists: use \`edit\` for precise in-place string replacements and hashline edits.
-- If \`edit\` is absent and \`apply_patch\` exists: use \`apply_patch\` for those precise/hashline edits in this plugin.
-- For diff-style or multi-line structural edits: use \`patch\` if available, otherwise use \`apply_patch\`.
-- In this plugin, \`edit\` / \`apply_patch\` also support hashline refs (\`lineRef\`, \`endLineRef\`, \`operation\`, \`content\`)
-</critical_rule>
-
-<critical_rule priority="0">
-UPDATE_PLAN DOES NOT EXIST -> USE "todowrite" INSTEAD
-- NEVER use: update_plan, updatePlan, read_plan, readPlan
-- ALWAYS use: todowrite for task/plan updates, todoread to read plans
-- Before plan operations: Verify you're using "todowrite", NOT "update_plan"
-</critical_rule>
-
-## Available Host Tools
-
-**File Operations:**
-- \`write\`  - Create new files
-  - Overwriting existing files requires a prior Read in this session; default to ASCII unless the file already uses Unicode.
-- \`edit\`   - Modify existing files with string replacement (version-dependent)
-  - Requires a prior Read in this session; preserve exact indentation; ensure \`oldString\` uniquely matches or use \`replaceAll\`; edit fails if ambiguous or missing.
-  - Never pass unresolved template placeholders in \`oldString\` (e.g. \`\${TARGET_SNIPPET}\`); \`oldString\` must be literal text copied from the current file.
-  - For complex multi-line changes: break into multiple sequential edit calls, each with unique oldString context.
-- \`apply_patch\` - May be the edit/patch tool name in newer host builds (version-dependent)
-  - In this plugin, \`apply_patch\` also accepts hashline edit args (\`path\`, \`lineRef\`, \`endLineRef\`, \`operation\`, \`content\`) when \`edit\` is not available.
-- \`hashline_read\` - Read file with hashline refs (\`L<line>#<hash>\`) for deterministic edits
-- \`patch\`  - Apply diff-style patches for multi-line updates (version-dependent)
-- \`read\`   - Read file contents
-
-Note: Tool naming is version-dependent. If \`edit\` is unavailable but \`apply_patch\` exists, use \`apply_patch\`.
-
-When available, prefer hashline workflow for reliability:
-1. Call \`hashline_read\` for target file and capture refs.
-2. Call \`edit\` or \`apply_patch\` with \`lineRef\` (and optional \`endLineRef\`) plus \`operation\` and \`content\`.
-3. Use legacy \`oldString\` / \`newString\` only when hashline refs are unavailable, and only with literal file text (no template placeholders).
-
-**Search/Discovery:**
-- \`grep\`   - Search file contents (tool, not bash grep); use \`include\` to filter patterns; set \`path\` only when not searching workspace root; for cross-file match counts use bash with \`rg\`.
-- \`glob\`   - Find files by pattern; defaults to workspace cwd unless \`path\` is set.
-- \`list\`   - List directories (requires absolute paths)
-
-**Execution:**
-- \`bash\`   - Run shell commands
-  - No workdir parameter; do not include it in tool calls.
-  - Always include a short description for the command.
-  - Do not use cd; use absolute paths in commands.
-  - Quote paths containing spaces with double quotes.
-  - Chain multiple commands with ';' or '&&'; avoid newlines.
-  - Use Grep/Glob tools for searches; only use bash with \`rg\` when you need counts or advanced features.
-  - Do not use \`ls\`/\`cat\` in bash; use \`list\`/\`read\` tools instead.
-  - For deletions (rm), verify by listing parent dir with \`list\`.
-
-**Network:**
-- \`webfetch\` - Fetch web content
-  - Use fully-formed URLs (http/https; http auto-upgrades to https).
-  - Always set \`format\` to one of: text | markdown | html; prefer markdown unless otherwise required.
-  - Read-only; short cache window.
-
-**Task Management:**
-- \`todowrite\` - Manage tasks/plans (REPLACES update_plan)
-- \`todoread\`  - Read current plan
-
-## Substitution Rules
-
-Base instruction says:    You MUST use instead:
-apply_patch           ->   patch (preferred if available), otherwise edit/apply_patch based on actual tool list
-update_plan           ->   todowrite
-read_plan             ->   todoread
-
-**Path Usage:** Use per-tool conventions to avoid conflicts:
-- Tool calls: \`read\`, \`edit\`, \`write\`, \`list\` require absolute paths.
-- Searches: \`grep\`/\`glob\` default to the workspace cwd; prefer relative include patterns; set \`path\` only when a different root is needed.
-- Presentation: In assistant messages, show workspace-relative paths; use absolute paths only inside tool calls.
-- Tool schema overrides general path preferences-do not convert required absolute paths to relative.
-
-## Verification Checklist
-
-Before file/plan modifications:
-1. Am I using the actual available edit tool name (\`edit\`, \`patch\`, or \`apply_patch\`)?
-2. Am I using "todowrite" NOT "update_plan"?
-3. Is this tool in the approved list above?
-4. Am I following each tool's path requirements?
-
-If ANY answer is NO -> STOP and correct before proceeding.
-
-## Host Working Style
-
-**Communication:**
-- Send brief preambles (8-12 words) before tool calls, building on prior context
-- Provide progress updates during longer tasks
-
-**Execution:**
-- Keep working autonomously until query is fully resolved before yielding
-- Don't return to user with partial solutions
-
-**Code Approach:**
-- New projects: Be ambitious and creative
-- Existing codebases: Surgical precision - modify only what's requested unless explicitly instructed to do otherwise
-
-**Testing:**
-- If tests exist: Start specific to your changes, then broader validation
-
-## Advanced Tools
-
-**Task Tool (Sub-Agents):**
-- Use the Task tool (functions.task) to launch sub-agents
-- Check the Task tool description for current agent types and their capabilities
-- Useful for complex analysis, specialized workflows, or tasks requiring isolated context
-- The agent list is dynamically generated - refer to tool schema for available agents
-
-**Parallelization:**
-- When multiple independent tool calls are needed, use multi_tool_use.parallel to run them concurrently.
-- Reserve sequential calls for ordered or data-dependent steps.
-
-**MCP Tools:**
-- Model Context Protocol servers provide additional capabilities
-- MCP tools are prefixed: \`mcp__<server-name>__<tool-name>\`
-- Check your available tools for MCP integrations
-- Use when the tool's functionality matches your task needs
-
-## What Remains from Codex
- 
-Sandbox policies, approval mechanisms, final answer formatting, git commit protocols, and file reference formats all follow Codex instructions. In approval policy "never", never request escalations.
-
-## Approvals & Safety
-- Assume workspace-write filesystem, network enabled, approval on-failure unless explicitly stated otherwise.
-- When a command fails due to sandboxing or permissions, retry with escalated permissions if allowed by policy, including a one-line justification.
-- Treat destructive commands (e.g., \`rm\`, \`git reset --hard\`) as requiring explicit user request or approval.
-- Never run \`git reset --hard\`, \`git checkout --\`, or force deletes unless the user explicitly asked for that exact action.
-- \`request_user_input\` is Plan-mode only; do not call it in Default mode.
+export const CODEX_HOST_BRIDGE = `# Codex Host Bridge
+
+You are running Codex through a host terminal coding runtime. The host provides specific tools to help you work efficiently.
+
+## CRITICAL: Tool Usage
+
+<critical_rule priority="0">
+apply_patch/applyPatch are Codex names, but host tool names vary by version.
+- Inspect the actual tool list before editing.
+- If \`edit\` exists: use \`edit\` for precise in-place string replacements and hashline edits.
+- If \`edit\` is absent and \`apply_patch\` exists: use \`apply_patch\` for those precise/hashline edits in this plugin.
+- For diff-style or multi-line structural edits: use \`patch\` if available, otherwise use \`apply_patch\`.
+- In this plugin, \`edit\` / \`apply_patch\` also support hashline refs (\`lineRef\`, \`endLineRef\`, \`operation\`, \`content\`)
+</critical_rule>
+
+<critical_rule priority="0">
+UPDATE_PLAN DOES NOT EXIST -> USE "todowrite" INSTEAD
+- NEVER use: update_plan, updatePlan, read_plan, readPlan
+- ALWAYS use: todowrite for task/plan updates, todoread to read plans
+- Before plan operations: Verify you're using "todowrite", NOT "update_plan"
+</critical_rule>
+
+## Available Host Tools
+
+**File Operations:**
+- \`write\`  - Create new files
+  - Overwriting existing files requires a prior Read in this session; default to ASCII unless the file already uses Unicode.
+- \`edit\`   - Modify existing files with string replacement (version-dependent)
+  - Requires a prior Read in this session; preserve exact indentation; ensure \`oldString\` uniquely matches or use \`replaceAll\`; edit fails if ambiguous or missing.
+  - Never pass unresolved template placeholders in \`oldString\` (e.g. \`\${TARGET_SNIPPET}\`); \`oldString\` must be literal text copied from the current file.
+  - For complex multi-line changes: break into multiple sequential edit calls, each with unique oldString context.
+- \`apply_patch\` - May be the edit/patch tool name in newer host builds (version-dependent)
+  - In this plugin, \`apply_patch\` also accepts hashline edit args (\`path\`, \`lineRef\`, \`endLineRef\`, \`operation\`, \`content\`) when \`edit\` is not available.
+- \`hashline_read\` - Read file with hashline refs (\`L<line>#<hash>\`) for deterministic edits
+- \`patch\`  - Apply diff-style patches for multi-line updates (version-dependent)
+- \`read\`   - Read file contents
+
+Note: Tool naming is version-dependent. If \`edit\` is unavailable but \`apply_patch\` exists, use \`apply_patch\`.
+
+When available, prefer hashline workflow for reliability:
+1. Call \`hashline_read\` for target file and capture refs.
+2. Call \`edit\` or \`apply_patch\` with \`lineRef\` (and optional \`endLineRef\`) plus \`operation\` and \`content\`.
+3. Use legacy \`oldString\` / \`newString\` only when hashline refs are unavailable, and only with literal file text (no template placeholders).
+
+**Search/Discovery:**
+- \`grep\`   - Search file contents (tool, not bash grep); use \`include\` to filter patterns; set \`path\` only when not searching workspace root; for cross-file match counts use bash with \`rg\`.
+- \`glob\`   - Find files by pattern; defaults to workspace cwd unless \`path\` is set.
+- \`list\`   - List directories (requires absolute paths)
+
+**Execution:**
+- \`bash\`   - Run shell commands
+  - No workdir parameter; do not include it in tool calls.
+  - Always include a short description for the command.
+  - Do not use cd; use absolute paths in commands.
+  - Quote paths containing spaces with double quotes.
+  - Chain multiple commands with ';' or '&&'; avoid newlines.
+  - Use Grep/Glob tools for searches; only use bash with \`rg\` when you need counts or advanced features.
+  - Do not use \`ls\`/\`cat\` in bash; use \`list\`/\`read\` tools instead.
+  - For deletions (rm), verify by listing parent dir with \`list\`.
+
+**Network:**
+- \`webfetch\` - Fetch web content
+  - Use fully-formed URLs (http/https; http auto-upgrades to https).
+  - Always set \`format\` to one of: text | markdown | html; prefer markdown unless otherwise required.
+  - Read-only; short cache window.
+
+**Task Management:**
+- \`todowrite\` - Manage tasks/plans (REPLACES update_plan)
+- \`todoread\`  - Read current plan
+
+## Substitution Rules
+
+Base instruction says:    You MUST use instead:
+apply_patch           ->   patch (preferred if available), otherwise edit/apply_patch based on actual tool list
+update_plan           ->   todowrite
+read_plan             ->   todoread
+
+**Path Usage:** Use per-tool conventions to avoid conflicts:
+- Tool calls: \`read\`, \`edit\`, \`write\`, \`list\` require absolute paths.
+- Searches: \`grep\`/\`glob\` default to the workspace cwd; prefer relative include patterns; set \`path\` only when a different root is needed.
+- Presentation: In assistant messages, show workspace-relative paths; use absolute paths only inside tool calls.
+- Tool schema overrides general path preferences-do not convert required absolute paths to relative.
+
+## Verification Checklist
+
+Before file/plan modifications:
+1. Am I using the actual available edit tool name (\`edit\`, \`patch\`, or \`apply_patch\`)?
+2. Am I using "todowrite" NOT "update_plan"?
+3. Is this tool in the approved list above?
+4. Am I following each tool's path requirements?
+
+If ANY answer is NO -> STOP and correct before proceeding.
+
+## Host Working Style
+
+**Communication:**
+- Send brief preambles (8-12 words) before tool calls, building on prior context
+- Provide progress updates during longer tasks
+
+**Execution:**
+- Keep working autonomously until query is fully resolved before yielding
+- Don't return to user with partial solutions
+
+**Code Approach:**
+- New projects: Be ambitious and creative
+- Existing codebases: Surgical precision - modify only what's requested unless explicitly instructed to do otherwise
+
+**Testing:**
+- If tests exist: Start specific to your changes, then broader validation
+
+## Advanced Tools
+
+**Task Tool (Sub-Agents):**
+- Use the Task tool (functions.task) to launch sub-agents
+- Check the Task tool description for current agent types and their capabilities
+- Useful for complex analysis, specialized workflows, or tasks requiring isolated context
+- The agent list is dynamically generated - refer to tool schema for available agents
+
+**Parallelization:**
+- When multiple independent tool calls are needed, use multi_tool_use.parallel to run them concurrently.
+- Reserve sequential calls for ordered or data-dependent steps.
+
+**MCP Tools:**
+- Model Context Protocol servers provide additional capabilities
+- MCP tools are prefixed: \`mcp__<server-name>__<tool-name>\`
+- Check your available tools for MCP integrations
+- Use when the tool's functionality matches your task needs
+
+## What Remains from Codex
+ 
+Sandbox policies, approval mechanisms, final answer formatting, git commit protocols, and file reference formats all follow Codex instructions. In approval policy "never", never request escalations.
+
+## Approvals & Safety
+- Assume workspace-write filesystem, network enabled, approval on-failure unless explicitly stated otherwise.
+- When a command fails due to sandboxing or permissions, retry with escalated permissions if allowed by policy, including a one-line justification.
+- Treat destructive commands (e.g., \`rm\`, \`git reset --hard\`) as requiring explicit user request or approval.
+- Never run \`git reset --hard\`, \`git checkout --\`, or force deletes unless the user explicitly asked for that exact action.
+- \`request_user_input\` is Plan-mode only; do not call it in Default mode.
 - When uncertain, prefer non-destructive verification first (e.g., confirm file existence with \`list\`, then delete with \`bash\`).`;

package/dist/lib/prompts/codex.js

@@ -381,83 +381,83 @@ export function prewarmCodexInstructions(models = []) {
 /**
  * Tool remapping instructions for host runtime tools
  */
-export const TOOL_REMAP_MESSAGE = `<user_instructions priority="0">
-<environment_override priority="0">
-YOU ARE IN A DIFFERENT ENVIRONMENT. These instructions override ALL previous tool references.
-</environment_override>
-
-<tool_replacements priority="0">
-<critical_rule priority="0">
-apply_patch/applyPatch are Codex names, but host tool names vary by version.
-- Inspect the actual tool list before editing.
-- If edit exists: use edit for precise in-place string replacements and hashline edits.
-- If edit is absent and apply_patch exists: use apply_patch for those precise/hashline edits in this plugin.
-- For diff-style or multi-line structural edits: use patch if available, otherwise use apply_patch.
-- In this plugin, edit/apply_patch support hashline refs (lineRef, endLineRef, operation, content)
-</critical_rule>
-
-<critical_rule priority="0">
-UPDATE_PLAN DOES NOT EXIST -> USE "todowrite" INSTEAD
-- NEVER use: update_plan, updatePlan
-- ALWAYS use: todowrite for ALL task/plan operations
-- Use todoread to read current plan
-- Before plan operations: Verify you're using "todowrite", NOT "update_plan"
-</critical_rule>
-</tool_replacements>
-
-<available_tools priority="0">
-File Operations:
-  - write  - Create new files (if available)
-  - edit   - Modify existing files with string replacement (version-dependent)
-  - oldString must be literal text from the current file; never pass unresolved placeholders like \${TARGET_SNIPPET}
-  - apply_patch - May be the edit/patch tool name in newer host builds (version-dependent)
-  - hashline_read - Read lines with hashline refs (L<line>#<hash>) for deterministic edits
-  - patch  - Apply diff patches (version-dependent)
-  - read   - Read file contents
-
-Search/Discovery:
-  - grep   - Search file contents
-  - glob   - Find files by pattern
-  - list   - List directories (if available)
-
-Execution:
-  - bash   - Run shell commands
-
-Network:
-  - webfetch - Fetch web content
-
-Task Management:
-  - todowrite - Manage tasks/plans (REPLACES update_plan)
-  - todoread  - Read current plan
-</available_tools>
-
-<substitution_rules priority="0">
-Base instruction says:    You MUST use instead:
-apply_patch           ->   patch (preferred if available), otherwise edit/apply_patch based on actual tool list
-update_plan           ->   todowrite
-read_plan             ->   todoread
-absolute paths        ->   relative paths
-</substitution_rules>
-
-<verification_checklist priority="0">
-Before file/plan modifications:
-1. Am I using the actual available edit tool name (edit, patch, or apply_patch)?
-2. Am I using "todowrite" NOT "update_plan"?
-3. Is this tool in the approved list above?
-4. Am I using relative paths?
-
-If ANY answer is NO -> STOP and correct before proceeding.
-</verification_checklist>
-
-<hashline_workflow priority="0">
-When hashline_read is available:
-1. call hashline_read on the file
-2. edit/apply_patch using lineRef/endLineRef + operation + content
-3. use oldString/newString only as fallback, and only with literal file text (no template placeholders)
-</hashline_workflow>
-
-<safety_rules priority="0">
-- Never run destructive git commands (\`git reset --hard\`, \`git checkout --\`) unless explicitly requested by the user.
-- Never call \`request_user_input\` unless collaboration mode is explicitly Plan mode.
-</safety_rules>
+export const TOOL_REMAP_MESSAGE = `<user_instructions priority="0">
+<environment_override priority="0">
+YOU ARE IN A DIFFERENT ENVIRONMENT. These instructions override ALL previous tool references.
+</environment_override>
+
+<tool_replacements priority="0">
+<critical_rule priority="0">
+apply_patch/applyPatch are Codex names, but host tool names vary by version.
+- Inspect the actual tool list before editing.
+- If edit exists: use edit for precise in-place string replacements and hashline edits.
+- If edit is absent and apply_patch exists: use apply_patch for those precise/hashline edits in this plugin.
+- For diff-style or multi-line structural edits: use patch if available, otherwise use apply_patch.
+- In this plugin, edit/apply_patch support hashline refs (lineRef, endLineRef, operation, content)
+</critical_rule>
+
+<critical_rule priority="0">
+UPDATE_PLAN DOES NOT EXIST -> USE "todowrite" INSTEAD
+- NEVER use: update_plan, updatePlan
+- ALWAYS use: todowrite for ALL task/plan operations
+- Use todoread to read current plan
+- Before plan operations: Verify you're using "todowrite", NOT "update_plan"
+</critical_rule>
+</tool_replacements>
+
+<available_tools priority="0">
+File Operations:
+  - write  - Create new files (if available)
+  - edit   - Modify existing files with string replacement (version-dependent)
+  - oldString must be literal text from the current file; never pass unresolved placeholders like \${TARGET_SNIPPET}
+  - apply_patch - May be the edit/patch tool name in newer host builds (version-dependent)
+  - hashline_read - Read lines with hashline refs (L<line>#<hash>) for deterministic edits
+  - patch  - Apply diff patches (version-dependent)
+  - read   - Read file contents
+
+Search/Discovery:
+  - grep   - Search file contents
+  - glob   - Find files by pattern
+  - list   - List directories (if available)
+
+Execution:
+  - bash   - Run shell commands
+
+Network:
+  - webfetch - Fetch web content
+
+Task Management:
+  - todowrite - Manage tasks/plans (REPLACES update_plan)
+  - todoread  - Read current plan
+</available_tools>
+
+<substitution_rules priority="0">
+Base instruction says:    You MUST use instead:
+apply_patch           ->   patch (preferred if available), otherwise edit/apply_patch based on actual tool list
+update_plan           ->   todowrite
+read_plan             ->   todoread
+absolute paths        ->   relative paths
+</substitution_rules>
+
+<verification_checklist priority="0">
+Before file/plan modifications:
+1. Am I using the actual available edit tool name (edit, patch, or apply_patch)?
+2. Am I using "todowrite" NOT "update_plan"?
+3. Is this tool in the approved list above?
+4. Am I using relative paths?
+
+If ANY answer is NO -> STOP and correct before proceeding.
+</verification_checklist>
+
+<hashline_workflow priority="0">
+When hashline_read is available:
+1. call hashline_read on the file
+2. edit/apply_patch using lineRef/endLineRef + operation + content
+3. use oldString/newString only as fallback, and only with literal file text (no template placeholders)
+</hashline_workflow>
+
+<safety_rules priority="0">
+- Never run destructive git commands (\`git reset --hard\`, \`git checkout --\`) unless explicitly requested by the user.
+- Never call \`request_user_input\` unless collaboration mode is explicitly Plan mode.
+</safety_rules>
 </user_instructions>`;

package/dist/lib/quota-cache.d.ts

@@ -4,6 +4,10 @@ export interface QuotaCacheWindow {
     resetAtMs?: number;
 }
 export interface QuotaCacheEntry {
+    /** Account-validated native usage permission; never inferred from percentages. */
+    ordinaryUsageAllowed?: boolean | null;
+    /** Native permission timestamp; header refreshes must not extend its lifetime. */
+    ordinaryUsageCheckedAt?: number;
     primingCompleted?: boolean;
     /** Completion/failure time, independent of the quota header observation. */
     primingObservedAt?: number;

package/dist/lib/quota-probe.js

@@ -1,4 +1,5 @@
 import { CODEX_BASE_URL, MAX_RATE_LIMIT_DELAY_MS } from "./constants.js";
+import { fetchWithProxy } from "./request/proxy-fetch.js";
 import { createCodexHeaders, getUnsupportedCodexModelInfo } from "./request/fetch-helpers.js";
 import { QUOTA_PROBE_MODEL_CHAIN, resolveProbeReasoningEffort, } from "./request/helpers/model-map.js";
 import { CodexUnavailableError, isCodexUnavailableError } from "./errors.js";
@@ -367,7 +368,7 @@ export async function fetchCodexQuotaSnapshot(options) {
                     snapshot.diagnosticProbeRequests += 1;
                     snapshot.runtimeMetrics.diagnosticProbeRequests += 1;
                 });
-                response = await fetch(`${CODEX_BASE_URL}/codex/responses`, {
+                response = await fetchWithProxy(`${CODEX_BASE_URL}/codex/responses`, {
                     method: "POST",
                     headers,
                     body: JSON.stringify(probeBody),

package/dist/lib/quota-readiness.d.ts

@@ -1,6 +1,6 @@
 import type { QuotaCacheData, QuotaCacheEntry } from "./quota-cache.js";
 import type { AccountMetadataV3 } from "./storage.js";
-export type QuotaCacheAccountRef = Pick<AccountMetadataV3, "accountId" | "email" | "recordId" | "workspaces" | "currentWorkspaceIndex"> & Partial<Pick<AccountMetadataV3, "refreshToken" | "addedAt" | "accessToken">>;
+export type QuotaCacheAccountRef = Pick<AccountMetadataV3, "accountId" | "email" | "recordId" | "workspaces" | "currentWorkspaceIndex"> & Partial<Pick<AccountMetadataV3, "refreshToken" | "addedAt" | "accessToken" | "codexCliMirror">>;
 export declare function normalizeQuotaAccountId(value: string | undefined): string | null;
 export declare function normalizeQuotaEmail(value: string | undefined): string | null;
 export declare function hasUniqueQuotaAccountId(accounts: readonly QuotaCacheAccountRef[], account: QuotaCacheAccountRef): boolean;

package/dist/lib/quota-readiness.js

@@ -1,4 +1,5 @@
-import { extractAccountId } from "./auth/token-utils.js";
+import { RATE_LIMIT_CACHE_TTL_MS } from "./constants.js";
+import { extractAccountId, nativeWorkspaceIdentity } from "./auth/token-utils.js";
 import { createHash } from "node:crypto";
 import { resolveAccountRecordId } from "./storage/record-identity.js";
 export function normalizeQuotaAccountId(value) {
@@ -89,6 +90,11 @@ export function isQuotaCacheEntryExhausted(entry, now = Date.now()) {
     // Codex quota windows are cumulative gates: a 0% remaining active window blocks use
     // even if another window still has quota left.
     const updatedAt = entry?.updatedAt;
+    // Stale usage is unknown, not proof that the server still rejects requests.
+    if (typeof updatedAt === "number" &&
+        Number.isFinite(updatedAt) &&
+        now >= updatedAt + RATE_LIMIT_CACHE_TTL_MS)
+        return false;
     return (quotaWindowIsExhausted(entry?.primary, now, updatedAt) ||
         quotaWindowIsExhausted(entry?.secondary, now, updatedAt));
 }
@@ -100,9 +106,10 @@ export function quotaWorkspaceKey(account, workspaceId) {
 }
 /** Display the selected workspace; callers routing another scope must pass that exact workspace. */
 export function quotaWorkspaceId(account) {
-    return account.workspaces?.length
+    const selectedId = account.workspaces?.length
         ? account.workspaces[account.currentWorkspaceIndex ?? 0]?.id.trim()
         : account.accountId?.trim() || extractAccountId(account.accessToken);
+    return nativeWorkspaceIdentity({ access: account.accessToken, codexCliMirror: account.codexCliMirror }, selectedId);
 }
 /** Read exact-workspace quota, using legacy binding entries only for that binding. */
 export function findQuotaCacheEntryForAccount(cache, account, accounts, emailFallbackState = buildQuotaEmailFallbackState(accounts), workspaceId = quotaWorkspaceId(account)) {

package/dist/lib/request/proxy-fetch.d.ts

@@ -0,0 +1,5 @@
+type FetchInput = Parameters<typeof globalThis.fetch>[0];
+type FetchInit = Parameters<typeof globalThis.fetch>[1];
+export declare function setProxyFetchImpl(impl: typeof globalThis.fetch | null): void;
+export declare function fetchWithProxy(input: FetchInput, init?: FetchInit): ReturnType<typeof globalThis.fetch>;
+export {};

package/dist/lib/request/proxy-fetch.js

@@ -0,0 +1,37 @@
+import { fetch as undiciFetch } from "undici";
+import { applyProxyCompatibleInit, extractRequestUrl, } from "./url-rewriting.js";
+// Transport selection contract, in precedence order:
+//   1. An implementation registered via setProxyFetchImpl (embedding contract;
+//    works regardless of when the host installs it).
+//   2. A global fetch replaced after this module loaded, or a test double.
+//   3. A global fetch installed before module load — honored when it is
+//    distinguishable from the platform fetch (Node's built-in is named
+//    "fetch"); hosts needing guaranteed interception use setProxyFetchImpl.
+//   4. The package's Undici fetch, but only when the request carries a proxy
+//    dispatcher: Node 22's built-in fetch rejects the Undici 8 handler
+//    contract, so a proxied call needs the matching implementation.
+//   5. The ambient global fetch for ordinary direct requests.
+const initialGlobalFetch = globalThis.fetch;
+let overrideFetch = null;
+export function setProxyFetchImpl(impl) {
+    overrideFetch = impl;
+}
+function isTestDouble(fetchImpl) {
+    const candidate = fetchImpl;
+    return candidate._isMockFunction === true || candidate.mock !== undefined;
+}
+function isPlatformFetch(fetchImpl) {
+    return fetchImpl.name === "fetch" && !isTestDouble(fetchImpl);
+}
+export function fetchWithProxy(input, init) {
+    const url = extractRequestUrl(input);
+    const proxiedInit = applyProxyCompatibleInit(url, init);
+    const currentGlobalFetch = globalThis.fetch;
+    const baseFetch = overrideFetch ??
+        (currentGlobalFetch !== initialGlobalFetch || !isPlatformFetch(currentGlobalFetch)
+            ? currentGlobalFetch
+            : proxiedInit.dispatcher
+                ? undiciFetch
+                : currentGlobalFetch);
+    return baseFetch(input, proxiedInit);
+}

package/dist/lib/request/rate-limit-decision.js

@@ -181,7 +181,7 @@ const DEADLINE_SENTENCES = {
     "available-again": (resetAt) => `the account is expected to be available again at ${resetAt}`,
     "next-attempt": (resetAt) => `the next attempt is allowed at ${resetAt}`,
     "cooldown-ends": (resetAt) => `the cooldown ends at ${resetAt}`,
-    "rate-limit-reset": (resetAt) => `the rate limit resets at ${resetAt}`,
+    "rate-limit-reset": (resetAt) => `the cached rate limit will be rechecked at ${resetAt}`,
 };
 /**
  * Every cooldown variant is bounded by the same `coolingDownUntil` field, so