codex-multi-auth 2.22.0 → 2.24.0

package/dist/lib/request/url-rewriting.js

@@ -98,11 +98,28 @@ function shouldBypassProxyForUrl(url, noProxyValue) {
     }
     return false;
 }
+/**
+ * Loopback destinations never traverse a configured proxy: routing them through
+ * HTTP_PROXY would leak managed bearer tokens to the proxy and break the
+ * loopback-only runtime proxy contract. This bypass applies even when NO_PROXY
+ * is unset, matching curl/git proxy conventions.
+ */
+function isLoopbackRequestHost(url) {
+    const hostname = url.hostname.replace(/^\[|\]$/g, "").toLowerCase();
+    return (hostname === "localhost" ||
+        hostname.endsWith(".localhost") ||
+        hostname === "::1" ||
+        hostname.startsWith("127.") ||
+        hostname.startsWith("::ffff:127."));
+}
 export function resolveProxyUrlForRequest(url, env = process.env) {
     const parsed = new URL(url);
     if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
         return undefined;
     }
+    if (isLoopbackRequestHost(parsed)) {
+        return undefined;
+    }
     const httpProxy = resolveProxyEnvValue(env, "http_proxy", "HTTP_PROXY");
     const httpsProxy = resolveProxyEnvValue(env, "https_proxy", "HTTPS_PROXY");
     if (!httpProxy && !httpsProxy) {

package/dist/lib/runtime/account-model-catalog.d.ts

@@ -23,6 +23,8 @@ export declare class AccountModelCatalog {
     private readonly pending;
     constructor(fetchCatalog: (accountKey: string) => Promise<unknown>, now?: () => number, ttlMs?: number);
     private read;
+    /** Includes successful empty catalogs; stale or failed discovery remains unknown. */
+    hasUsablePickerSnapshot(key: string): boolean;
     /** Picker-only stale-while-refresh view; routing still awaits fresh discovery. */
     cachedList(accountKeys: string[]): CatalogModel[];
     invalidate(): void;

package/dist/lib/runtime/account-model-catalog.js

@@ -83,12 +83,17 @@ export class AccountModelCatalog {
             this.pending.delete(key);
         }
     }
+    /** Includes successful empty catalogs; stale or failed discovery remains unknown. */
+    hasUsablePickerSnapshot(key) {
+        const entry = this.cache.get(key);
+        return Boolean(entry && !entry.error && entry.checkedAt <= this.now() && this.now() - entry.checkedAt < 15 * 60_000);
+    }
     /** Picker-only stale-while-refresh view; routing still awaits fresh discovery. */
     cachedList(accountKeys) {
         return buildVisibleModelUnion(accountKeys.map((key, index) => {
             const entry = this.cache.get(key);
-            const usable = entry && !entry.error && entry.checkedAt <= this.now() && this.now() - entry.checkedAt < 15 * 60_000;
-            return { id: key, kind: "oauth", priority: index, enabled: true, models: usable ? entry.models ?? [] : [], visibleModels: null };
+            const usable = this.hasUsablePickerSnapshot(key);
+            return { id: key, kind: "oauth", priority: index, enabled: true, models: usable ? entry?.models ?? [] : [], visibleModels: null };
         }));
     }
     invalidate() { this.cache.clear(); }

package/dist/lib/runtime/account-reset-credits.d.ts

@@ -1,15 +1,19 @@
 import { AccountManager } from '../accounts.js';
 import { type AccountMetadataV3 } from '../storage.js';
-import { ResetCreditService, type ResetTarget } from './reset-credits.js';
+import { ResetCreditService, type ResetCreditDetail, type ResetTarget } from './reset-credits.js';
 export declare function resetTargetForStoredAccount(account: AccountMetadataV3): ResetTarget | null;
 export declare function isResetTargetEnabled(account: AccountMetadataV3, target: ResetTarget): boolean;
 export declare function createResetCreditService(manager?: AccountManager): ResetCreditService;
 export declare function loadResetCreditState(): Promise<{
-    version: 1;
+    version: 1 | 2;
     policy: "last-resort" | "manual";
     snapshots: Record<string, {
         updatedAt: number;
         availableCount: number | null;
+        credits?: {
+            expiresAt?: number | null | undefined;
+            title?: string | null | undefined;
+        }[] | null | undefined;
         ordinaryUsageAllowed: boolean | null;
         planType: string | null;
         primary: {
@@ -26,6 +30,7 @@ export declare function loadResetCreditState(): Promise<{
     pending?: {
         key: string;
         idempotencyKey: string;
+        creditId?: string | undefined;
     } | undefined;
     lastAutomaticCheckAt?: number | undefined;
     lastRedemptionAt?: number | undefined;
@@ -38,4 +43,8 @@ export declare function loadResetCreditState(): Promise<{
 }>;
 /** Local terminal labels only; never used in provider requests or public artifacts. */
 export declare function resetAccountLabel(account: Pick<AccountMetadataV3, "email">, index: number): string;
+/** Strips terminal control codes, invisible formatters, and whitespace before printing credit titles. */
+export declare function sanitizeCreditTitle(title: string | null | undefined): string | null;
+/** One local terminal line per credit row; expiresAt is Unix seconds and null means it never expires. */
+export declare function formatResetCreditLine(credit: ResetCreditDetail, index: number): string;
 export declare function refreshAndPrintResetCredits(log: (message: string) => void): Promise<void>;

package/dist/lib/runtime/account-reset-credits.js

@@ -1,9 +1,9 @@
 import { join } from 'node:path';
-import { AccountManager, extractAccountId, resolveAccountRecordId, sanitizeEmail } from '../accounts.js';
+import { AccountManager, resolveAccountRecordId, sanitizeEmail } from '../accounts.js';
 import { loadAccounts } from '../storage.js';
 import { getCodexMultiAuthDir } from '../runtime-paths.js';
 import { ensureFreshAccessToken } from './rotation-token-refresh.js';
-import { modelScopeId, workspaceModelScopes } from './workspace-model-scopes.js';
+import { modelScopeId, workspaceModelScopes, nativeWorkspaceIdentity } from './workspace-model-scopes.js';
 import { nativeRateLimitsRpc } from './native-rate-limits.js';
 import { codexCliAccountIdFor } from '../auth/token-utils.js';
 import { isRecord } from '../utils.js';
@@ -11,10 +11,13 @@ import { ResetCreditService } from './reset-credits.js';
 import { withCheckProgress } from '../ui/check-progress.js';
 export function resetTargetForStoredAccount(account) {
     // Organization display aliases are not native ChatGPT workspace identities.
-    const stored = account.accountId?.trim();
-    const id = stored?.startsWith("org-") ? extractAccountId(account.accessToken)?.trim() : stored;
+    const selected = account.workspaces?.length ? account.workspaces[account.currentWorkspaceIndex ?? 0] : undefined;
+    if (account.workspaces?.length && (!selected || selected.enabled === false))
+        return null;
+    const stored = (selected?.id ?? account.accountId)?.trim();
+    const id = nativeWorkspaceIdentity({ access: account.accessToken, codexCliMirror: account.codexCliMirror }, stored);
     const workspace = account.workspaces?.find(w => w.id === id);
-    if (!id || id.startsWith("org-") || account.enabled === false || workspace?.enabled === false)
+    if (!id || id.startsWith("org-") || account.enabled === false || (!selected && workspace?.enabled === false))
         return null;
     return { key: modelScopeId('oauth', resolveAccountRecordId(account), id), accountId: id };
 }
@@ -24,8 +27,7 @@ export function isResetTargetEnabled(account, target) {
     const canonical = resetTargetForStoredAccount(account);
     if (canonical?.key === target.key && canonical.accountId === target.accountId)
         return true;
-    const scopeKey = modelScopeId('oauth', resolveAccountRecordId(account), target.accountId);
-    return !target.accountId.startsWith('org-') && scopeKey === target.key && Boolean(account.workspaces?.some(w => w.id === target.accountId && w.enabled !== false));
+    return false;
 }
 export function createResetCreditService(manager) {
     const auth = async (target) => {
@@ -43,17 +45,17 @@ export function createResetCreditService(manager) {
         return { accessToken: fresh.accessToken, accountId: target.accountId, expiresAt: fresh.account.expires ?? 0, codexCliMirror: current.codexCliMirror };
     };
     return new ResetCreditService(join(getCodexMultiAuthDir(), 'reset-credits.json'), {
-        read: async (target) => {
+        read: async (target, { creditDetails }) => {
             // The backend answers for the id written into its auth.json (the mirror id when one
             // applies). Verify the reply against that id; the snapshot stays keyed on the target.
             const freshAuth = await auth(target);
             const sent = codexCliAccountIdFor(freshAuth, freshAuth.accessToken) ?? freshAuth.accountId;
-            const reply = await nativeRateLimitsRpc(freshAuth, 'account/rateLimits/read', { excludeResetCreditDetails: true });
+            const reply = await nativeRateLimitsRpc(freshAuth, 'account/rateLimits/read', { excludeResetCreditDetails: !creditDetails });
             if (!isRecord(reply) || reply.accountId !== sent)
                 throw Error('Reset credit workspace identity mismatch');
             return { ...reply, accountId: target.accountId };
         },
-        consume: async (target, idempotencyKey) => {
+        consume: async (target, idempotencyKey, creditId) => {
             const freshAuth = await auth(target);
             const disk = await loadAccounts();
             const matches = disk?.accounts.filter(a => isResetTargetEnabled(a, target)) ?? [];
@@ -61,7 +63,7 @@ export function createResetCreditService(manager) {
                 throw Error('Reset account identity is ambiguous; no credit consumed');
             if (matches.length !== 1)
                 throw Error('Reset target was removed, disabled, or changed; no credit consumed');
-            return nativeRateLimitsRpc(freshAuth, 'account/rateLimitResetCredit/consume', { idempotencyKey });
+            return nativeRateLimitsRpc(freshAuth, 'account/rateLimitResetCredit/consume', { idempotencyKey, ...(creditId === undefined ? {} : { creditId }) });
         },
     });
 }
@@ -72,6 +74,22 @@ export function resetAccountLabel(account, index) {
     const printable = email && !/[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/u.test(email);
     return `Account ${index + 1}${printable ? ` (${email})` : ""}`;
 }
+/** Strips terminal control codes, invisible formatters, and whitespace before printing credit titles. */
+export function sanitizeCreditTitle(title) {
+    if (typeof title !== "string")
+        return null;
+    const trimmed = title.trim();
+    if (!trimmed || /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/u.test(trimmed))
+        return null;
+    return trimmed;
+}
+/** One local terminal line per credit row; expiresAt is Unix seconds and null means it never expires. */
+export function formatResetCreditLine(credit, index) {
+    const date = new Date(typeof credit.expiresAt === 'number' && credit.expiresAt > 0 ? credit.expiresAt * 1000 : Number.NaN);
+    const expiry = credit.expiresAt === null ? 'no expiry' : Number.isNaN(date.getTime()) ? 'expires unknown' : `expires ${date.toLocaleString()}`;
+    const title = sanitizeCreditTitle(credit.title);
+    return `   - credit #${index + 1}: ${expiry}${title ? ` (${title})` : ''}`;
+}
 export async function refreshAndPrintResetCredits(log) {
     const storage = await loadAccounts();
     if (!storage?.accounts.length)
@@ -80,7 +98,12 @@ export async function refreshAndPrintResetCredits(log) {
     const targets = storage.accounts.map(resetTargetForStoredAccount).filter((t) => Boolean(t));
     try {
         const snapshots = await withCheckProgress(`Checking reset credits for ${targets.length} accounts`, () => createResetCreditService(manager).refresh(targets), log);
-        storage.accounts.forEach((a, i) => { const target = resetTargetForStoredAccount(a); const count = target ? snapshots[target.key]?.availableCount : undefined; log(`${resetAccountLabel(a, i)}: available subscription resets: ${count ?? 'unknown (not verified)'}`); });
+        storage.accounts.forEach((a, i) => {
+            const target = resetTargetForStoredAccount(a);
+            const snap = target ? snapshots[target.key] : undefined;
+            log(`${resetAccountLabel(a, i)}: available subscription resets: ${snap?.availableCount ?? 'unknown (not verified)'}`);
+            snap?.credits?.forEach((c, idx) => log(formatResetCreditLine(c, idx)));
+        });
     }
     finally {
         await manager.flushPendingSave();

package/dist/lib/runtime/app-bind.d.ts

@@ -1,4 +1,4 @@
-import type { WebSocketDisconnectDiagnostic } from "./responses-websocket.js";
+import type { WebSocketDisconnectDiagnostic, WebSocketUpgradeRejectionDiagnostic } from "./responses-websocket.js";
 export interface AppBindPaths {
     codexHome: string;
     configPath: string;
@@ -39,6 +39,9 @@ export interface AppBindState {
 }
 export interface AppBindRouterStatus {
     lastWebsocketDisconnect?: WebSocketDisconnectDiagnostic | null;
+    websocketActiveConnections?: number | null;
+    websocketCapacityReclaims?: number | null;
+    lastWebsocketUpgradeRejection?: WebSocketUpgradeRejectionDiagnostic | null;
     schedulingStrategy?: "hybrid" | "sequential";
     state: string | null;
     pid: number | null;

package/dist/lib/runtime/app-bind.js

@@ -232,6 +232,29 @@ function readWebsocketDisconnect(value) {
     if (!isRecord(value) || typeof value.at !== "number" || !Number.isFinite(value.at) || value.at < 0)
         return null;
     const { cause, stage, closeCode, routeKind, connectionAgeMs, eventCount } = value;
+    const transport = {};
+    for (const key of ["requestBytes", "inputItemCount"]) {
+        const field = value[key];
+        if (field !== undefined) {
+            if (typeof field !== "number" || !Number.isSafeInteger(field) || field < 0)
+                return null;
+            transport[key] = field;
+        }
+    }
+    for (const key of ["isPrewarm", "hasPreviousResponse", "reusedConnection", "sendCompleted", "compressionNegotiated", "tcpEndReceived", "tcpCloseHadError"]) {
+        const field = value[key];
+        if (field !== undefined) {
+            if (typeof field !== "boolean")
+                return null;
+            transport[key] = field;
+        }
+    }
+    const errorCode = value.transportErrorCode;
+    if (errorCode !== undefined) {
+        if (errorCode !== "ECONNRESET" && errorCode !== "EPIPE" && errorCode !== "ETIMEDOUT" && errorCode !== "OTHER")
+            return null;
+        transport.transportErrorCode = errorCode;
+    }
     if (routeKind !== undefined && routeKind !== "oauth" && routeKind !== "api" && routeKind !== "zdr")
         return null;
     for (const count of [connectionAgeMs, eventCount])
@@ -246,7 +269,24 @@ function readWebsocketDisconnect(value) {
     return { at: value.at, cause, stage, ...(typeof closeCode === "number" ? { closeCode } : {}),
         ...(routeKind === "oauth" || routeKind === "api" || routeKind === "zdr" ? { routeKind } : {}),
         ...(typeof connectionAgeMs === "number" ? { connectionAgeMs } : {}),
-        ...(typeof eventCount === "number" ? { eventCount } : {}) };
+        ...(typeof eventCount === "number" ? { eventCount } : {}), ...transport };
+}
+function readWebsocketCounter(value, maximum = Number.MAX_SAFE_INTEGER) {
+    return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 && value <= maximum
+        ? value : null;
+}
+function readWebsocketUpgradeRejection(value) {
+    if (!isRecord(value))
+        return null;
+    const at = readWebsocketCounter(value.at, 8.64e15);
+    const activeConnections = readWebsocketCounter(value.activeConnections, 64);
+    const { reason, status } = value;
+    if (at === null || activeConnections === null)
+        return null;
+    if (!((reason === "origin" && status === 403) ||
+        ((reason === "capacity" || reason === "repeated_disconnect") && status === 426)))
+        return null;
+    return { at, reason, status, activeConnections };
 }
 async function readRouterStatus(path) {
     const record = await readJsonFile(path);
@@ -254,6 +294,9 @@ async function readRouterStatus(path) {
         return null;
     return {
         lastWebsocketDisconnect: readWebsocketDisconnect(record.lastWebsocketDisconnect),
+        websocketActiveConnections: readWebsocketCounter(record.websocketActiveConnections, 64),
+        websocketCapacityReclaims: readWebsocketCounter(record.websocketCapacityReclaims),
+        lastWebsocketUpgradeRejection: readWebsocketUpgradeRejection(record.lastWebsocketUpgradeRejection),
         schedulingStrategy: record.schedulingStrategy === "hybrid" || record.schedulingStrategy === "sequential"
             ? record.schedulingStrategy : undefined,
         state: readString(record, "state"),
@@ -1407,7 +1450,22 @@ export function formatWebsocketDisconnect(value) {
     const diagnostic = readWebsocketDisconnect(value);
     if (!diagnostic || diagnostic.at > 8.64e15)
         return null;
-    return `Last WebSocket disconnect: ${new Date(diagnostic.at).toISOString()}; cause=${diagnostic.cause}; stage=${diagnostic.stage}${diagnostic.closeCode !== undefined ? `; closeCode=${diagnostic.closeCode}` : ""}${diagnostic.routeKind !== undefined ? `; route=${diagnostic.routeKind}` : ""}${diagnostic.connectionAgeMs !== undefined ? `; connectionAgeMs=${diagnostic.connectionAgeMs}` : ""}${diagnostic.eventCount !== undefined ? `; events=${diagnostic.eventCount}` : ""}`;
+    const transport = ["requestBytes", "inputItemCount", "isPrewarm", "hasPreviousResponse", "reusedConnection", "sendCompleted", "compressionNegotiated", "transportErrorCode", "tcpEndReceived", "tcpCloseHadError"]
+        .filter(key => diagnostic[key] !== undefined).map(key => `; ${key}=${diagnostic[key]}`).join("");
+    return `Last WebSocket disconnect: ${new Date(diagnostic.at).toISOString()}; cause=${diagnostic.cause}; stage=${diagnostic.stage}${diagnostic.closeCode !== undefined ? `; closeCode=${diagnostic.closeCode}` : ""}${diagnostic.routeKind !== undefined ? `; route=${diagnostic.routeKind}` : ""}${diagnostic.connectionAgeMs !== undefined ? `; connectionAgeMs=${diagnostic.connectionAgeMs}` : ""}${diagnostic.eventCount !== undefined ? `; events=${diagnostic.eventCount}` : ""}${transport}`;
+}
+function formatWebsocketAdmission(status) {
+    const active = readWebsocketCounter(status?.websocketActiveConnections, 64);
+    const reclaimed = readWebsocketCounter(status?.websocketCapacityReclaims);
+    const counters = [
+        ...(active !== null ? [`active=${active}`] : []),
+        ...(reclaimed !== null ? [`idleReclaimed=${reclaimed}`] : []),
+    ];
+    const rejection = readWebsocketUpgradeRejection(status?.lastWebsocketUpgradeRejection);
+    return [
+        ...(counters.length ? [`WebSocket connections: ${counters.join("; ")}`] : []),
+        ...(rejection ? [`Last WebSocket upgrade rejection: ${new Date(rejection.at).toISOString()}; reason=${rejection.reason}; status=${rejection.status}; active=${rejection.activeConnections}`] : []),
+    ];
 }
 export function formatAppBindStatus(status) {
     if (status.unmanagedBind && !status.state) {
@@ -1434,11 +1492,13 @@ export function formatAppBindStatus(status) {
         parts.push(`lastAccount=Account ${status.router.lastAccountIndex + 1}`);
     }
     const diagnostic = formatWebsocketDisconnect(status.router?.lastWebsocketDisconnect);
+    const admission = formatWebsocketAdmission(status.router);
     if (status.state.nativeOpenai)
-        return [`Codex app bind: ${parts.join(", ")}, native OpenAI, live account catalogs`, ...(diagnostic ? [diagnostic] : [])].join("\n");
+        return [`Codex app bind: ${parts.join(", ")}, native OpenAI, live account catalogs`, ...(diagnostic ? [diagnostic] : []), ...admission].join("\n");
     return [
         `Codex app bind: ${parts.join(", ")}`,
         ...(diagnostic ? [diagnostic] : []),
+        ...admission,
         [
             "Note: Codex Desktop may hide history while the app bind selects the",
             "codex-multi-auth-runtime-proxy provider; use `codex-multi-auth rotation",

package/dist/lib/runtime/automatic-account-checks.js

@@ -2,7 +2,7 @@ import { createHash } from "node:crypto";
 import { promises as fs } from "node:fs";
 import { z } from "zod";
 import { resolveAccountRecordId } from "../accounts.js";
-import { extractAccountId } from "../auth/token-utils.js";
+import { extractAccountId, nativeWorkspaceIdentity } from "../auth/token-utils.js";
 import { getAccountPolicyKey } from "../account-policy.js";
 import { withFileTransactionLock } from "../storage/file-lock.js";
 import { withRetry } from "../fs-retry.js";
@@ -17,11 +17,12 @@ const schema = z.record(z.string().regex(/^sha256:[a-f0-9]{64}$/), z.number().fi
 const retry = { maxAttempts: 6, backoffMs: 25 };
 /** Honor the saved selection; a disabled/invalid selection must not fall back to a sibling. */
 export function automaticCheckWorkspaceId(account) {
+    const identity = { access: account.accessToken, codexCliMirror: account.codexCliMirror };
     if (account.workspaces?.length) {
         const selected = account.workspaces[account.currentWorkspaceIndex ?? 0];
-        return selected?.enabled === false ? undefined : selected?.id.trim() || undefined;
+        return selected?.enabled === false ? undefined : nativeWorkspaceIdentity(identity, selected?.id);
     }
-    return account.accountId?.trim() || extractAccountId(account.accessToken) || undefined;
+    return nativeWorkspaceIdentity(identity, account.accountId?.trim() || extractAccountId(account.accessToken));
 }
 /** Policy keys can be shared by organization members; attempt limits must never be. */
 export function automaticAccountCheckKey(account) {
@@ -72,7 +73,7 @@ export async function runAutomaticAccountChecks(options) {
         // Keep every still-saved workspace's throttle, including temporarily disabled selections.
         const keys = new Set(storage.accounts.flatMap(account => [
             automaticAccountCheckKey(account),
-            ...(account.workspaces ?? []).map(workspace => workspaceAttemptKey(account, workspace.id.trim())),
+            ...(account.workspaces ?? []).map(workspace => workspaceAttemptKey(account, nativeWorkspaceIdentity({ access: account.accessToken, codexCliMirror: account.codexCliMirror }, workspace.id) ?? "")),
         ]));
         for (const key of Object.keys(attempts))
             if (!keys.has(key))
@@ -84,7 +85,7 @@ export async function runAutomaticAccountChecks(options) {
             if (!account)
                 continue;
             const key = automaticAccountCheckKey(account), policy = policies.accounts[getAccountPolicyKey(account)], now = options.now?.() ?? Date.now();
-            if (!policy?.autoPrime || policy.paused || policy.drained || account.enabled === false || account.authInvalidatedAt || (account.coolingDownUntil ?? 0) > now)
+            if (!policy?.autoPrime || policy.paused || policy.drained || policy.emergencyOnly || account.enabled === false || account.authInvalidatedAt || (account.coolingDownUntil ?? 0) > now)
                 continue;
             const lastAttempt = attempts[key];
             if (lastAttempt !== undefined && lastAttempt <= now + FUTURE_SKEW_MS && now - lastAttempt < AUTOMATIC_CHECK_INTERVAL_MS)

package/dist/lib/runtime/automatic-subscription-checks.js

@@ -20,7 +20,8 @@ export function createAutomaticSubscriptionCheck(observe) {
         await saveQuotaCache(cache, baseline);
     });
     return (signal) => runWithStoragePathState(storageState, () => runAutomaticAccountChecks({
-        path: `${path}.automatic-checks.json`, signal, loadPolicies: loadAccountPolicyStore,
+        // Priming may consume quota: malformed permissions must never normalize to OFF.
+        path: `${path}.automatic-checks.json`, signal, loadPolicies: () => loadAccountPolicyStore({ strict: true }),
         loadAccounts: async () => { const snapshot = await read(); return snapshot.verified ? snapshot.storage : null; },
         check: async (storage, index) => {
             const manager = new AccountManager(undefined, storage);
@@ -36,8 +37,8 @@ export function createAutomaticSubscriptionCheck(observe) {
                 // A refresh is an I/O boundary: revalidate removal, policy, auth and workspace changes.
                 const disk = await read();
                 const current = disk.verified ? disk.storage?.accounts.find(row => resolveAccountRecordId(row) === resolveAccountRecordId(fresh.account)) : undefined;
-                const policy = current ? (await loadAccountPolicyStore()).accounts[getAccountPolicyKey(current)] : undefined;
-                if (!disk.storage || !current || current.refreshToken !== fresh.account.refreshToken || current.accessToken !== fresh.accessToken || !policy?.autoPrime || policy.paused || policy.drained || current.enabled === false || current.authInvalidatedAt || (current.coolingDownUntil ?? 0) > Date.now())
+                const policy = current ? (await loadAccountPolicyStore({ strict: true })).accounts[getAccountPolicyKey(current)] : undefined;
+                if (!disk.storage || !current || current.refreshToken !== fresh.account.refreshToken || current.accessToken !== fresh.accessToken || !policy?.autoPrime || policy.paused || policy.drained || policy.emergencyOnly || current.enabled === false || current.authInvalidatedAt || (current.coolingDownUntil ?? 0) > Date.now())
                     return;
                 if (automaticCheckWorkspaceId(current) !== targetId || signal.aborted)
                     return;

package/dist/lib/runtime/model-discovery-status.js

@@ -68,7 +68,7 @@ export async function discoverModelInventory(storage, routes, options = {}) {
     const scopes = manager.getAccountsSnapshot().flatMap(workspaceModelScopes);
     const catalog = new AccountModelCatalog(async (key) => {
         const scope = scopes.find(item => item.id === key);
-        const account = scope?.enabled ? manager.getAccountByIndex(scope.accountIndex) : null;
+        const account = scope?.routable ? manager.getAccountByIndex(scope.accountIndex) : null;
         if (!account || account.enabled === false)
             throw Error("Disabled");
         const fresh = await ensureFreshAccessToken({
@@ -105,7 +105,7 @@ export async function discoverModelInventory(storage, routes, options = {}) {
     }, now);
     try {
         entries.push(...await mapWithConcurrency(scopes, 3, async (scope) => {
-            if (scope.enabled)
+            if (scope.routable)
                 await catalog.list([scope.id]);
             const snapshot = catalog.snapshot(scope.id);
             return { id: scope.id, label: scope.label, kind: "oauth", enabled: scope.enabled, routable: scope.routable, bound: scope.bound, selected: scope.selected,

package/dist/lib/runtime/reset-credit-routing.d.ts

@@ -1,8 +1,8 @@
-import { type AccountManager, type ManagedAccount } from '../accounts.js';
+import type { AccountManager, ManagedAccount } from '../accounts.js';
 import type { ModelFamily } from '../prompts/codex.js';
 import type { QuotaCacheEntry } from '../quota-cache.js';
-import { type ResetCreditService } from './reset-credits.js';
-import type { workspaceModelScopes } from './workspace-model-scopes.js';
+import { type ResetSnapshot, type ResetCreditService, type ResetExhaustionEvidence } from './reset-credits.js';
+import { workspaceModelScopes } from './workspace-model-scopes.js';
 type Scope = ReturnType<typeof workspaceModelScopes>[number];
 export declare function recoverResetQuota(options: {
     model: string;
@@ -19,6 +19,7 @@ export declare function recoverResetQuota(options: {
             snapshots: Awaited<ReturnType<ResetCreditService['status']>>['snapshots'];
         }>;
     };
+    quotaRejections?: ReadonlyMap<string, ResetExhaustionEvidence>;
     observations: Map<string, QuotaCacheEntry>;
     clearQuotaScheduler: (account: ManagedAccount) => void;
     now: () => number;
@@ -37,4 +38,11 @@ export declare function applyConfirmedReset(options: {
     clearQuotaScheduler: (account: ManagedAccount) => void;
     now: number;
 }): boolean;
+/** Unknown, stale, or pending reset state must never authorize backup traffic. */
+export declare function primaryPoolFullyExhausted(scopes: Map<number, Scope[]>, state: {
+    snapshots: Record<string, ResetSnapshot>;
+    pending?: {
+        key: string;
+    };
+} | null, now: number, latestQuota?: (index: number, scope: Scope) => QuotaCacheEntry | null | undefined): boolean;
 export {};

package/dist/lib/runtime/reset-credit-routing.js

@@ -1,8 +1,21 @@
-import { extractAccountId } from '../accounts.js';
 import { LUNA_RESERVE_MODEL } from '../constants.js';
 import { parseModelRoute } from '../model-route-policy.js';
 import { subscriptionQuotaPreference } from './subscription-quota-order.js';
-import { resetSnapshotQuota } from './reset-credits.js';
+import { resetSnapshotQuota, isResetSubscription } from './reset-credits.js';
+import { workspaceModelScopes } from './workspace-model-scopes.js';
+/** Account-level quota blockers belong to the currently routed workspace. */
+function clearRecoveredScopeQuota(options) {
+    const { account, scope, family, model, manager, clearQuotaScheduler } = options;
+    // Recheck selection and enablement: a reset read may outlive a workspace change.
+    if (account.lastRateLimitReason !== 'quota' || !workspaceModelScopes(account).some(current => current.routable && current.id === scope.id && current.accountId === scope.accountId))
+        return false;
+    delete account.rateLimitResetTimes[family];
+    delete account.rateLimitResetTimes[`${family}:${model}`];
+    if (account.cooldownReason === 'rate-limit')
+        manager.clearAccountCooldown(account);
+    clearQuotaScheduler(account);
+    return true;
+}
 export async function recoverResetQuota(options) {
     if (options.model === LUNA_RESERVE_MODEL || !options.native || options.pinned || parseModelRoute(options.model).kind !== 'oauth')
         return false;
@@ -10,39 +23,62 @@ export async function recoverResetQuota(options) {
     const candidates = [...options.scopes].flatMap(([index, scopes]) => { const account = options.manager.getAccountByIndex(index); return account && !account.authInvalidatedAt ? scopes.map(scope => ({ account, scope })) : []; });
     if (!candidates.length)
         return false;
+    const currentScope = (account, scope) => workspaceModelScopes(account).some(current => current.routable && current.id === scope.id && current.accountId === scope.accountId);
+    const rejectionForScope = (account, scope) => {
+        const proof = options.quotaRejections?.get(JSON.stringify([scope.id, options.model]));
+        const latest = options.quotaForScope(account, scope), now = options.now();
+        // An older in-flight response can deliver newer percentage headers. Only a
+        // later authoritative native permission check supersedes a body rejection.
+        const checkedAt = typeof latest?.ordinaryUsageAllowed === 'boolean'
+            ? latest.ordinaryUsageCheckedAt ?? latest.updatedAt : 0;
+        return proof && proof.key === scope.id && proof.accountId === scope.accountId &&
+            Number.isFinite(proof.observedAt) && proof.observedAt <= now && now - proof.observedAt <= 60000 &&
+            proof.observedAt > checkedAt ? proof : undefined;
+    };
     // Any usable capacity (including the reserve), unknown quota, or non-quota
     // failure prevents an automatic credit from being spent.
     if (candidates.some(({ account, scope }) => {
-        if (account.enabled === false || account.authInvalidatedAt || !scope.routable)
+        if (account.enabled === false || account.authInvalidatedAt || !scope.routable || !currentScope(account, scope))
             return true;
         const skip = options.manager.getAccountRuntimeSkipReason(account.index, family, options.model);
         if (skip && !['rate-limited', 'cooling-down:rate-limit'].includes(skip))
             return true;
         const quota = subscriptionQuotaPreference(options.quotaForScope(account, scope), options.now());
-        return !quota.exhausted && !['rate-limited', 'cooling-down:rate-limit'].includes(skip ?? '');
+        return !quota.exhausted && !rejectionForScope(account, scope) && !['rate-limited', 'cooling-down:rate-limit'].includes(skip ?? '');
     }))
         return false;
     candidates.sort((a, b) => Number(b.account.index === options.preferredIndex) - Number(a.account.index === options.preferredIndex) || (options.priorityByAccount?.[a.account.index] ?? 1) - (options.priorityByAccount?.[b.account.index] ?? 1));
     const targets = candidates.filter(({ scope }) => !scope.accountId.startsWith("org-")).map(({ scope }) => ({ key: scope.id, accountId: scope.accountId }));
-    await options.service.automatic(targets);
+    const evidence = candidates.flatMap(({ account, scope }) => {
+        if (scope.accountId.startsWith("org-"))
+            return [];
+        const rejection = rejectionForScope(account, scope);
+        if (rejection)
+            return [rejection];
+        const quota = subscriptionQuotaPreference(options.quotaForScope(account, scope), options.now());
+        return quota.exhausted && quota.observedAt !== null
+            ? [{ key: scope.id, accountId: scope.accountId, observedAt: quota.observedAt }] : [];
+    });
+    await options.service.automatic(targets, evidence);
     const state = await options.service.status();
     let recovered = false;
     for (const { account, scope } of candidates) {
         const snapshot = state.snapshots[scope.id];
         const previous = options.quotaForScope(account, scope);
-        if (!snapshot || snapshot.updatedAt < (previous?.updatedAt ?? 0) || options.now() - snapshot.updatedAt > 60000 || snapshot.updatedAt > options.now())
+        const rejectedAt = rejectionForScope(account, scope)?.observedAt ?? 0;
+        // Healthy headers may arrive late from an older in-flight request. Native
+        // permission chronology wins there; unknown, exhausted, and failed reads do not.
+        const healthyHeaders = snapshot?.ordinaryUsageAllowed === true && previous?.status === 200 &&
+            (subscriptionQuotaPreference(previous, options.now()).remainingPercent ?? 0) > 0;
+        const previousAt = healthyHeaders
+            ? typeof previous?.ordinaryUsageAllowed === 'boolean' ? previous.ordinaryUsageCheckedAt ?? previous.updatedAt : 0
+            : previous?.updatedAt ?? 0;
+        if (!snapshot || snapshot.updatedAt < Math.max(previousAt, rejectedAt) || options.now() - snapshot.updatedAt > 60000 || snapshot.updatedAt > options.now())
             continue;
         options.observations.set(JSON.stringify([scope.id, options.model]), resetSnapshotQuota(snapshot));
         if (snapshot.ordinaryUsageAllowed !== true)
             continue;
-        // Do not clear sibling workspace/model throttles or authentication failures.
-        if ((scope.bound || (account.accountId?.startsWith('org-') && scope.accountId === extractAccountId(account.access))) && account.lastRateLimitReason === 'quota') {
-            delete account.rateLimitResetTimes[family];
-            delete account.rateLimitResetTimes[`${family}:${options.model}`];
-            if (account.cooldownReason === 'rate-limit')
-                options.manager.clearAccountCooldown(account);
-            options.clearQuotaScheduler(account);
-        }
+        clearRecoveredScopeQuota({ ...options, account, scope, family });
         recovered = true;
     }
     if (recovered)
@@ -57,13 +93,22 @@ export function applyConfirmedReset(options) {
     if (!s || options.lastRedemptionAt === undefined || s.updatedAt < options.lastRedemptionAt || s.ordinaryUsageAllowed !== true || s.updatedAt <= (options.previous?.updatedAt ?? 0) || options.now - s.updatedAt > 60000 || s.updatedAt > options.now)
         return false;
     options.observations.set(JSON.stringify([options.scope.id, options.model]), resetSnapshotQuota(s));
-    if ((options.scope.bound || (options.account.accountId?.startsWith('org-') && options.scope.accountId === extractAccountId(options.account.access))) && options.account.lastRateLimitReason === 'quota') {
-        delete options.account.rateLimitResetTimes[options.family];
-        delete options.account.rateLimitResetTimes[`${options.family}:${options.model}`];
-        if (options.account.cooldownReason === 'rate-limit')
-            options.manager.clearAccountCooldown(options.account);
-        options.clearQuotaScheduler(options.account);
+    if (clearRecoveredScopeQuota(options))
         options.manager.saveToDiskDebounced();
-    }
     return true;
 }
+/** Unknown, stale, or pending reset state must never authorize backup traffic. */
+export function primaryPoolFullyExhausted(scopes, state, now, latestQuota) {
+    const primary = [...scopes].flatMap(([index, rows]) => rows.map(scope => ({ index, scope })));
+    return primary.length > 0 && !!state && !state.pending && primary.every(({ index, scope }) => {
+        const snapshot = state.snapshots[scope.id];
+        const latest = latestQuota?.(index, scope);
+        if (snapshot && latest && latest.updatedAt >= snapshot.updatedAt &&
+            !subscriptionQuotaPreference(latest, now).exhausted)
+            return false;
+        return scope.routable && !!snapshot && Number.isFinite(snapshot.updatedAt) &&
+            snapshot.updatedAt <= now && now - snapshot.updatedAt <= 60_000 &&
+            isResetSubscription(snapshot) && snapshot.ordinaryUsageAllowed === false &&
+            snapshot.availableCount === 0;
+    });
+}