codex-multi-auth 2.22.0 → 2.24.0

package/dist/lib/runtime/reset-credits.d.ts

@@ -4,9 +4,22 @@ export interface ResetTarget {
     key: string;
     accountId: string;
 }
+/** A routing observation may invalidate a healthy check, never authorize spending. */
+export interface ResetExhaustionEvidence extends ResetTarget {
+    observedAt: number;
+}
+declare const creditDetailSchema: z.ZodObject<{
+    expiresAt: z.ZodCatch<z.ZodOptional<z.ZodNullable<z.ZodNumber>>>;
+    title: z.ZodCatch<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
+}, z.core.$strip>;
+export type ResetCreditDetail = z.infer<typeof creditDetailSchema>;
 declare const snapshotSchema: z.ZodObject<{
     updatedAt: z.ZodNumber;
     availableCount: z.ZodNullable<z.ZodNumber>;
+    credits: z.ZodCatch<z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodObject<{
+        expiresAt: z.ZodCatch<z.ZodOptional<z.ZodNullable<z.ZodNumber>>>;
+        title: z.ZodCatch<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
+    }, z.core.$strip>>>>>;
     ordinaryUsageAllowed: z.ZodNullable<z.ZodBoolean>;
     planType: z.ZodNullable<z.ZodString>;
     primary: z.ZodObject<{
@@ -22,7 +35,7 @@ declare const snapshotSchema: z.ZodObject<{
 }, z.core.$strip>;
 export type ResetSnapshot = z.infer<typeof snapshotSchema>;
 declare const stateSchema: z.ZodObject<{
-    version: z.ZodLiteral<1>;
+    version: z.ZodUnion<readonly [z.ZodLiteral<1>, z.ZodLiteral<2>]>;
     policy: z.ZodDefault<z.ZodEnum<{
         "last-resort": "last-resort";
         manual: "manual";
@@ -30,6 +43,10 @@ declare const stateSchema: z.ZodObject<{
     snapshots: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
         updatedAt: z.ZodNumber;
         availableCount: z.ZodNullable<z.ZodNumber>;
+        credits: z.ZodCatch<z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodObject<{
+            expiresAt: z.ZodCatch<z.ZodOptional<z.ZodNullable<z.ZodNumber>>>;
+            title: z.ZodCatch<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
+        }, z.core.$strip>>>>>;
         ordinaryUsageAllowed: z.ZodNullable<z.ZodBoolean>;
         planType: z.ZodNullable<z.ZodString>;
         primary: z.ZodObject<{
@@ -46,6 +63,7 @@ declare const stateSchema: z.ZodObject<{
     pending: z.ZodOptional<z.ZodObject<{
         key: z.ZodString;
         idempotencyKey: z.ZodString;
+        creditId: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>;
     lastAutomaticCheckAt: z.ZodOptional<z.ZodNumber>;
     lastRedemptionAt: z.ZodOptional<z.ZodNumber>;
@@ -75,10 +93,17 @@ export declare function parseResetSnapshot(value: unknown, accountId: string, no
 export declare function resetSnapshotQuota(snapshot: ResetSnapshot): QuotaCacheEntry;
 export declare function isResetSubscription(snapshot: ResetSnapshot): boolean;
 export interface ResetCreditIO {
-    read: (target: ResetTarget) => Promise<unknown>;
-    consume: (target: ResetTarget, idempotencyKey: string) => Promise<unknown>;
+    /** creditDetails asks the backend for per-credit rows; display refreshes and credit selection need them. */
+    read: (target: ResetTarget, options: {
+        creditDetails: boolean;
+    }) => Promise<unknown>;
+    consume: (target: ResetTarget, idempotencyKey: string, creditId?: string) => Promise<unknown>;
     now?: () => number;
 }
+type AutomaticResult = {
+    key: string;
+    outcome: ResetOutcome;
+} | null;
 export declare class ResetCreditService {
     private readonly path;
     private readonly io;
@@ -87,14 +112,13 @@ export declare class ResetCreditService {
     status(): Promise<State>;
     private save;
     setPolicy(policy: State['policy']): Promise<void>;
+    private readDetails;
     private read;
     refresh(targets: ResetTarget[]): Promise<Record<string, ResetSnapshot>>;
     private consumeLocked;
     redeem(target: ResetTarget): Promise<ResetOutcome>;
-    automatic(targets: ResetTarget[]): Promise<{
-        key: string;
-        outcome: ResetOutcome;
-    } | null>;
+    automatic(targets: ResetTarget[], evidence?: ResetExhaustionEvidence[]): Promise<AutomaticResult>;
+    private automaticBatch;
     private automaticLocked;
 }
 export {};

package/dist/lib/runtime/reset-credits.js

@@ -6,32 +6,96 @@ import { z } from 'zod';
 import { withFileTransactionLock } from '../storage/file-lock.js';
 import { mapWithConcurrency } from '../concurrency.js';
 import { MAX_RATE_LIMIT_DELAY_MS } from '../constants.js';
+// Display-only projection: unknown keys (credit ids, backend extras) are stripped before
+// persistence, and a malformed field degrades to unknown instead of failing the count read.
+// expiresAt is Unix seconds; null means the credit does not expire.
+const creditDetailSchema = z.object({ expiresAt: z.number().nullish().catch(undefined), title: z.string().nullish().catch(undefined) });
+const creditDetailsSchema = z.array(creditDetailSchema).nullish().catch(null);
 const windowSchema = z.object({ usedPercent: z.number().min(0).max(100).optional(), resetsAt: z.number().nonnegative().nullish(), windowDurationMins: z.number().nonnegative().nullish() });
-const snapshotSchema = z.object({ updatedAt: z.number(), availableCount: z.number().int().nonnegative().nullable(), ordinaryUsageAllowed: z.boolean().nullable(), planType: z.string().nullable(), primary: windowSchema, secondary: windowSchema });
-const stateSchema = z.object({ version: z.literal(1), policy: z.enum(['manual', 'last-resort']).default('manual'), snapshots: z.record(z.string(), snapshotSchema).default({}), pending: z.object({ key: z.string(), idempotencyKey: z.string().uuid() }).optional(), lastAutomaticCheckAt: z.number().optional(), lastRedemptionAt: z.number().optional(), lastRedemption: z.object({ key: z.string(), at: z.number(), outcome: z.enum(['reset', 'nothingToReset', 'noCredit', 'alreadyRedeemed']), automatic: z.boolean() }).optional() });
-const readSchema = z.object({ accountId: z.string(), ordinaryUsageAllowed: z.boolean().nullish(), rateLimitResetCredits: z.object({ availableCount: z.number().int().nonnegative() }).nullish(), rateLimits: z.object({ planType: z.string().nullish(), primary: windowSchema.nullish(), secondary: windowSchema.nullish() }) });
+const snapshotSchema = z.object({ updatedAt: z.number(), availableCount: z.number().int().nonnegative().nullable(), credits: creditDetailsSchema, ordinaryUsageAllowed: z.boolean().nullable(), planType: z.string().nullable(), primary: windowSchema, secondary: windowSchema });
+const creditIdSchema = z.string().min(1).refine(id => id.trim().length > 0);
+const stateSchema = z.object({ version: z.union([z.literal(1), z.literal(2)]), policy: z.enum(['manual', 'last-resort']).default('manual'), snapshots: z.record(z.string(), snapshotSchema).default({}), pending: z.object({ key: z.string(), idempotencyKey: z.string().uuid(), creditId: creditIdSchema.optional() }).optional(), lastAutomaticCheckAt: z.number().optional(), lastRedemptionAt: z.number().optional(), lastRedemption: z.object({ key: z.string(), at: z.number(), outcome: z.enum(['reset', 'nothingToReset', 'noCredit', 'alreadyRedeemed']), automatic: z.boolean() }).optional() });
+// Raw credit rows stay in memory for credit selection; only the display projection is persisted.
+const readSchema = z.object({ accountId: z.string(), ordinaryUsageAllowed: z.boolean().nullish(), rateLimitResetCredits: z.object({ availableCount: z.number().int().nonnegative(), credits: z.unknown().optional() }).nullish(), rateLimits: z.object({ planType: z.string().nullish(), primary: windowSchema.nullish(), secondary: windowSchema.nullish() }) });
+const creditSchema = z.object({ id: creditIdSchema, status: z.literal('available'), resetType: z.literal('codexRateLimits'), expiresAt: z.number().int().safe().nonnegative().nullish() });
 const outcomeSchema = z.object({ outcome: z.enum(['reset', 'nothingToReset', 'noCredit', 'alreadyRedeemed']) });
 export function parseResetSnapshot(value, accountId, now) {
+    return parseResetReading(value, accountId, now).snapshot;
+}
+function parseResetReading(value, accountId, now) {
     const parsed = readSchema.parse(value);
     if (parsed.accountId !== accountId)
         throw Error('Reset credit workspace identity mismatch');
-    return { updatedAt: now, availableCount: parsed.rateLimitResetCredits?.availableCount ?? null, ordinaryUsageAllowed: parsed.ordinaryUsageAllowed ?? null, planType: parsed.rateLimits.planType ?? null, primary: parsed.rateLimits.primary ?? {}, secondary: parsed.rateLimits.secondary ?? {} };
+    const snapshot = { updatedAt: now, availableCount: parsed.rateLimitResetCredits?.availableCount ?? null, credits: creditDetailsSchema.parse(parsed.rateLimitResetCredits?.credits) ?? null, ordinaryUsageAllowed: parsed.ordinaryUsageAllowed ?? null, planType: parsed.rateLimits.planType ?? null, primary: parsed.rateLimits.primary ?? {}, secondary: parsed.rateLimits.secondary ?? {} };
+    const rows = parsed.rateLimitResetCredits?.credits;
+    return { snapshot, credits: Array.isArray(rows) ? rows : [] };
+}
+/** Counts authorize availability; potentially capped detail rows only rank it.
+ * Never confuse credit expiry (seconds) with a quota window's scheduled reset. */
+function firstExpiringCredit(rows, now) {
+    const ids = rows.map(row => z.object({ id: creditIdSchema }).safeParse(row));
+    const counts = new Map();
+    for (const id of ids)
+        if (id.success)
+            counts.set(id.data.id, (counts.get(id.data.id) ?? 0) + 1);
+    let best = { expiresAt: Infinity };
+    for (const row of rows) {
+        const parsed = creditSchema.safeParse(row);
+        if (!parsed.success || counts.get(parsed.data.id) !== 1)
+            continue;
+        const credit = parsed.data;
+        if (typeof credit.expiresAt === 'number' && credit.expiresAt <= now / 1000)
+            continue;
+        const expiresAt = credit.expiresAt ?? Infinity;
+        if (best.creditId === undefined || expiresAt < best.expiresAt)
+            best = { creditId: credit.id, expiresAt };
+    }
+    return best;
 }
 export function resetSnapshotQuota(snapshot) {
     // A bogus resetsAt must not read as a window that never resets.
     const resetAtMs = (s) => typeof s === 'number' && Number.isFinite(s) ? Math.min(s * 1000, snapshot.updatedAt + MAX_RATE_LIMIT_DELAY_MS) : undefined;
     const window = (w) => ({ usedPercent: w.usedPercent, resetAtMs: resetAtMs(w.resetsAt), windowMinutes: w.windowDurationMins ?? undefined });
-    return { updatedAt: snapshot.updatedAt, status: 200, model: 'usage-read', planType: snapshot.planType ?? undefined, primary: window(snapshot.primary), secondary: window(snapshot.secondary) };
+    return { updatedAt: snapshot.updatedAt, status: 200, model: 'usage-read', ordinaryUsageAllowed: snapshot.ordinaryUsageAllowed, planType: snapshot.planType ?? undefined, primary: window(snapshot.primary), secondary: window(snapshot.secondary) };
 }
 export function isResetSubscription(snapshot) {
-    return ['plus', 'pro', 'prolite', 'team', 'business', 'self_serve_business_prolite', 'enterprise', 'edu', 'edu_plus', 'edu_pro'].includes(snapshot.planType ?? '');
+    return ['plus', 'pro', 'promax', 'prolite', 'team', 'business', 'self_serve_business_prolite', 'enterprise', 'edu', 'edu_plus', 'edu_pro'].includes(snapshot.planType ?? '');
 }
-/** No credentials or credit IDs are persisted. One global redemption lease covers
- * all accounts: concurrent exhausted requests cannot independently spend credits. */
+/** No credentials or credit lists are persisted (snapshot credit rows keep only expiry
+ * and title). Only an explicitly selected credit ID accompanies its pending idempotency
+ * key until completion. One global lease prevents concurrent exhausted requests from
+ * independently spending. */
 /** A stored time further ahead than this came from a clock that has since stepped back: treat it as expired. */
 const FUTURE_SKEW_MS = 5 * 60000;
 const within = (at, now, windowMs) => at !== undefined && at <= now + FUTURE_SKEW_MS && now - at < windowMs;
+function validExhaustionEvidence(targets, proof, now) {
+    return targets.some(target => target.key === proof.key && target.accountId === proof.accountId) &&
+        Number.isFinite(proof.observedAt) && proof.observedAt <= now && now - proof.observedAt <= 60000;
+}
+function hasNewExhaustion(state, targets, evidence, now) {
+    return evidence.some(proof => {
+        const snapshot = state.snapshots[proof.key];
+        return validExhaustionEvidence(targets, proof, now) &&
+            state.lastAutomaticCheckAt !== undefined && proof.observedAt > state.lastAutomaticCheckAt &&
+            snapshot?.ordinaryUsageAllowed === true && Number.isFinite(snapshot.updatedAt) &&
+            snapshot.updatedAt <= now && proof.observedAt > snapshot.updatedAt;
+    });
+}
 const automaticChecks = new Map();
+// Stop even if failures keep advancing. New evidence after the final pass can
+// be retried by a later request; no batch can hold callers indefinitely.
+const MAX_AUTOMATIC_CHECK_PASSES = 3;
+function mergeExhaustionEvidence(check, targets, evidence, now) {
+    for (const proof of evidence) {
+        if (!validExhaustionEvidence(targets, proof, now))
+            continue;
+        const key = JSON.stringify([proof.key, proof.accountId]), previous = check.evidence.get(key);
+        if (previous && previous.observedAt >= proof.observedAt)
+            continue;
+        check.evidence.set(key, { key: proof.key, accountId: proof.accountId, observedAt: proof.observedAt });
+        check.version++;
+    }
+}
 export class ResetCreditService {
     path;
     io;
@@ -54,6 +118,9 @@ export class ResetCreditService {
         }
     }
     async save(state) {
+        // Older readers strip unknown pending fields. Make them reject an explicit
+        // credit attempt instead of retrying its UUID with different parameters.
+        state.version = state.pending?.creditId === undefined ? 1 : 2;
         const path = this.path + '.' + randomUUID() + '.tmp';
         try {
             const file = await fs.open(path, 'wx', 0o600);
@@ -71,10 +138,11 @@ export class ResetCreditService {
         }
     }
     async setPolicy(policy) { await withFileTransactionLock(this.path, async () => { const s = await this.status(); s.policy = policy; await this.save(s); }); }
-    async read(target) { return parseResetSnapshot(await this.io.read(target), target.accountId, this.now()); }
+    async readDetails(target, creditDetails) { return parseResetReading(await this.io.read(target, { creditDetails }), target.accountId, this.now()); }
+    async read(target, creditDetails = false) { return (await this.readDetails(target, creditDetails)).snapshot; }
     async refresh(targets) {
         const results = await mapWithConcurrency(targets, 3, async (t) => { try {
-            return { key: t.key, snapshot: await this.read(t) };
+            return { key: t.key, snapshot: await this.read(t, true) };
         }
         catch {
             return null;
@@ -87,13 +155,13 @@ export class ResetCreditService {
                 updated[row.key] = row.snapshot;
             } await this.save(state); return updated; });
     }
-    async consumeLocked(state, target, automatic = false) {
+    async consumeLocked(state, target, automatic = false, creditId) {
         if (state.pending && state.pending.key !== target.key)
             throw Error('A reset redemption is pending for another account; retry that account explicitly first.');
-        state.pending ??= { key: target.key, idempotencyKey: randomUUID() };
+        state.pending ??= { key: target.key, idempotencyKey: randomUUID(), ...(creditId === undefined ? {} : { creditId }) };
         state.lastRedemptionAt = this.now();
         await this.save(state);
-        const result = outcomeSchema.parse(await this.io.consume(target, state.pending.idempotencyKey));
+        const result = outcomeSchema.parse(await this.io.consume(target, state.pending.idempotencyKey, state.pending.creditId));
         // Keep the same key on *any* ambiguous outcome, including a failed follow-up read.
         state.snapshots[target.key] = await this.read(target);
         state.lastRedemption = { key: target.key, at: this.now(), outcome: result.outcome, automatic };
@@ -118,33 +186,63 @@ export class ResetCreditService {
             return this.consumeLocked(state, target);
         });
     }
-    automatic(targets) {
+    automatic(targets, evidence = []) {
         const key = resolve(this.path), signature = JSON.stringify(targets), pending = automaticChecks.get(key);
-        if (pending)
-            return pending.targets === signature ? pending.promise : pending.promise.then(() => null);
+        if (pending?.accepting) {
+            if (pending.targets !== signature)
+                return pending.promise.then(() => null);
+            mergeExhaustionEvidence(pending, targets, evidence, this.now());
+            return pending.promise;
+        }
         if (automaticChecks.size >= 1000)
             return Promise.resolve(null);
-        const promise = this.automaticLocked(targets).finally(() => { automaticChecks.delete(key); });
-        automaticChecks.set(key, { targets: signature, promise });
-        return promise;
+        const currentTargets = targets.map(target => ({ key: target.key, accountId: target.accountId }));
+        const check = { targets: signature, accepting: true, evidence: new Map(), version: 0, promise: Promise.resolve(null) };
+        mergeExhaustionEvidence(check, currentTargets, evidence, this.now());
+        check.promise = this.automaticBatch(currentTargets, check).finally(() => {
+            if (automaticChecks.get(key) === check)
+                automaticChecks.delete(key);
+        });
+        automaticChecks.set(key, check);
+        return check.promise;
     }
-    async automaticLocked(targets) {
+    async automaticBatch(targets, check) {
+        try {
+            for (let pass = 0; pass < MAX_AUTOMATIC_CHECK_PASSES; pass++) {
+                const version = check.version;
+                const result = await this.automaticLocked(targets, [...check.evidence.values()]);
+                if (result !== null || check.version === version)
+                    return result;
+            }
+            return null;
+        }
+        finally {
+            // Close admission before resolving: a late caller must not append evidence
+            // between batch completion and the outer promise's map cleanup.
+            check.accepting = false;
+        }
+    }
+    async automaticLocked(targets, evidence) {
         if (!targets.length || (await this.status()).policy !== 'last-resort')
             return null;
         return withFileTransactionLock(this.path, async () => {
             const state = await this.status();
-            if (state.policy !== 'last-resort' || state.pending || within(state.lastAutomaticCheckAt, this.now(), 60000) || within(state.lastRedemptionAt, this.now(), 300000))
+            const now = this.now();
+            if (state.policy !== 'last-resort' || state.pending || within(state.lastRedemptionAt, now, 300000))
                 return null;
-            state.lastAutomaticCheckAt = this.now();
+            if (within(state.lastAutomaticCheckAt, now, 60000) && !hasNewExhaustion(state, targets, evidence, now))
+                return null;
+            state.lastAutomaticCheckAt = now;
             await this.save(state);
             // Missing/failed reads prevent spending. A scheduled reset that has arrived
             // is confirmed by ordinaryUsageAllowed, never inferred from a clock or %.
-            const reads = await mapWithConcurrency(targets, 3, async (t) => { try {
-                return await this.read(t);
+            const details = await mapWithConcurrency(targets, 3, async (t) => { try {
+                return await this.readDetails(t, true);
             }
             catch {
                 return null;
             } });
+            const reads = details.map(row => row?.snapshot ?? null);
             reads.forEach((s, i) => { const t = targets[i]; if (s && t)
                 state.snapshots[t.key] = s; });
             await this.save(state);
@@ -152,11 +250,20 @@ export class ResetCreditService {
                 return null;
             if (reads.some(s => s && [s.primary, s.secondary].some(w => w.usedPercent === 100 && typeof w.resetsAt === 'number' && w.resetsAt * 1000 <= this.now() + 60000)))
                 return null;
-            const index = reads.findIndex(s => s !== null && (s.availableCount ?? 0) > 0);
-            const target = targets[index];
-            if (!target)
+            let best;
+            for (const [index, row] of details.entries()) {
+                const target = targets[index];
+                if (!row || !target || (row.snapshot.availableCount ?? 0) <= 0)
+                    continue;
+                const credit = firstExpiringCredit(row.credits, this.now());
+                // Stable ties retain the caller's preferred-account/priority ordering.
+                // Unknown, omitted and nonexpiring details follow all known deadlines.
+                if (!best || credit.expiresAt < best.expiresAt)
+                    best = { target, ...credit };
+            }
+            if (!best)
                 return null;
-            return { key: target.key, outcome: await this.consumeLocked(state, target, true) };
+            return { key: best.target.key, outcome: await this.consumeLocked(state, best.target, true, best.creditId) };
         }, { waitMs: 1000 });
     }
 }

package/dist/lib/runtime/responses-websocket.d.ts

@@ -9,12 +9,33 @@ export interface WebSocketDisconnectDiagnostic {
     routeKind?: "oauth" | "api" | "zdr";
     connectionAgeMs?: number;
     eventCount?: number;
+    requestBytes?: number;
+    inputItemCount?: number;
+    isPrewarm?: boolean;
+    hasPreviousResponse?: boolean;
+    reusedConnection?: boolean;
+    /** Local send callback success, not evidence of upstream receipt. */
+    sendCompleted?: boolean;
+    compressionNegotiated?: boolean;
+    transportErrorCode?: "ECONNRESET" | "EPIPE" | "ETIMEDOUT" | "OTHER";
+    tcpEndReceived?: boolean;
+    tcpCloseHadError?: boolean;
+}
+/** Local admission evidence only; no headers, credentials, or conversation IDs. */
+export interface WebSocketUpgradeRejectionDiagnostic {
+    at: number;
+    reason: "origin" | "capacity" | "repeated_disconnect";
+    status: number;
+    activeConnections: number;
 }
 interface WebSocketStats {
     connections: number;
+    activeConnections: number;
+    capacityReclaims: number;
     upstreamConnections: number;
     upstreamRequests: number;
     lastDisconnect?: WebSocketDisconnectDiagnostic;
+    lastUpgradeRejection?: WebSocketUpgradeRejectionDiagnostic;
 }
 /** Adapts only the transport; authenticated HTTP routing remains the policy authority. */
 export declare class ResponsesWebSocketGateway {
@@ -24,6 +45,9 @@ export declare class ResponsesWebSocketGateway {
     private readonly contexts;
     private readonly scope;
     private readonly sessions;
+    /** Credential-hashed, bounded API handshake backoff survives local reconnects. */
+    private readonly apiHandshakeBackoff;
+    private readonly websocketFailures;
     private readonly wss;
     private readonly maxBytes;
     /** Loopback hops must never go through an environment HTTP proxy (NODE_USE_ENV_PROXY). */
@@ -35,6 +59,12 @@ export declare class ResponsesWebSocketGateway {
         routeModel?: (model: string, headers: Headers) => string;
     });
     readonly fetch: typeof fetch;
+    private rememberDisconnect;
+    private needsHttpFallback;
+    /** One writer for the upgrade-rejection diagnostic so the two reject paths cannot drift. */
+    private recordUpgradeRejection;
+    /** Release idle setup sockets only; active work and generated history stay pinned. */
+    private reclaimIdleSession;
     handle(req: IncomingMessage, handler: () => Promise<void>): void;
     attach(server: Server, baseUrl: string): void;
     private serve;