codex-multi-auth 2.23.0 → 2.24.0

package/dist/lib/runtime/reset-credits.d.ts

@@ -4,9 +4,22 @@ export interface ResetTarget {
     key: string;
     accountId: string;
 }
+/** A routing observation may invalidate a healthy check, never authorize spending. */
+export interface ResetExhaustionEvidence extends ResetTarget {
+    observedAt: number;
+}
+declare const creditDetailSchema: z.ZodObject<{
+    expiresAt: z.ZodCatch<z.ZodOptional<z.ZodNullable<z.ZodNumber>>>;
+    title: z.ZodCatch<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
+}, z.core.$strip>;
+export type ResetCreditDetail = z.infer<typeof creditDetailSchema>;
 declare const snapshotSchema: z.ZodObject<{
     updatedAt: z.ZodNumber;
     availableCount: z.ZodNullable<z.ZodNumber>;
+    credits: z.ZodCatch<z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodObject<{
+        expiresAt: z.ZodCatch<z.ZodOptional<z.ZodNullable<z.ZodNumber>>>;
+        title: z.ZodCatch<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
+    }, z.core.$strip>>>>>;
     ordinaryUsageAllowed: z.ZodNullable<z.ZodBoolean>;
     planType: z.ZodNullable<z.ZodString>;
     primary: z.ZodObject<{
@@ -22,7 +35,7 @@ declare const snapshotSchema: z.ZodObject<{
 }, z.core.$strip>;
 export type ResetSnapshot = z.infer<typeof snapshotSchema>;
 declare const stateSchema: z.ZodObject<{
-    version: z.ZodLiteral<1>;
+    version: z.ZodUnion<readonly [z.ZodLiteral<1>, z.ZodLiteral<2>]>;
     policy: z.ZodDefault<z.ZodEnum<{
         "last-resort": "last-resort";
         manual: "manual";
@@ -30,6 +43,10 @@ declare const stateSchema: z.ZodObject<{
     snapshots: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
         updatedAt: z.ZodNumber;
         availableCount: z.ZodNullable<z.ZodNumber>;
+        credits: z.ZodCatch<z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodObject<{
+            expiresAt: z.ZodCatch<z.ZodOptional<z.ZodNullable<z.ZodNumber>>>;
+            title: z.ZodCatch<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
+        }, z.core.$strip>>>>>;
         ordinaryUsageAllowed: z.ZodNullable<z.ZodBoolean>;
         planType: z.ZodNullable<z.ZodString>;
         primary: z.ZodObject<{
@@ -46,6 +63,7 @@ declare const stateSchema: z.ZodObject<{
     pending: z.ZodOptional<z.ZodObject<{
         key: z.ZodString;
         idempotencyKey: z.ZodString;
+        creditId: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>;
     lastAutomaticCheckAt: z.ZodOptional<z.ZodNumber>;
     lastRedemptionAt: z.ZodOptional<z.ZodNumber>;
@@ -75,10 +93,17 @@ export declare function parseResetSnapshot(value: unknown, accountId: string, no
 export declare function resetSnapshotQuota(snapshot: ResetSnapshot): QuotaCacheEntry;
 export declare function isResetSubscription(snapshot: ResetSnapshot): boolean;
 export interface ResetCreditIO {
-    read: (target: ResetTarget) => Promise<unknown>;
-    consume: (target: ResetTarget, idempotencyKey: string) => Promise<unknown>;
+    /** creditDetails asks the backend for per-credit rows; display refreshes and credit selection need them. */
+    read: (target: ResetTarget, options: {
+        creditDetails: boolean;
+    }) => Promise<unknown>;
+    consume: (target: ResetTarget, idempotencyKey: string, creditId?: string) => Promise<unknown>;
     now?: () => number;
 }
+type AutomaticResult = {
+    key: string;
+    outcome: ResetOutcome;
+} | null;
 export declare class ResetCreditService {
     private readonly path;
     private readonly io;
@@ -87,14 +112,13 @@ export declare class ResetCreditService {
     status(): Promise<State>;
     private save;
     setPolicy(policy: State['policy']): Promise<void>;
+    private readDetails;
     private read;
     refresh(targets: ResetTarget[]): Promise<Record<string, ResetSnapshot>>;
     private consumeLocked;
     redeem(target: ResetTarget): Promise<ResetOutcome>;
-    automatic(targets: ResetTarget[]): Promise<{
-        key: string;
-        outcome: ResetOutcome;
-    } | null>;
+    automatic(targets: ResetTarget[], evidence?: ResetExhaustionEvidence[]): Promise<AutomaticResult>;
+    private automaticBatch;
     private automaticLocked;
 }
 export {};

package/dist/lib/runtime/reset-credits.js

@@ -6,32 +6,96 @@ import { z } from 'zod';
 import { withFileTransactionLock } from '../storage/file-lock.js';
 import { mapWithConcurrency } from '../concurrency.js';
 import { MAX_RATE_LIMIT_DELAY_MS } from '../constants.js';
+// Display-only projection: unknown keys (credit ids, backend extras) are stripped before
+// persistence, and a malformed field degrades to unknown instead of failing the count read.
+// expiresAt is Unix seconds; null means the credit does not expire.
+const creditDetailSchema = z.object({ expiresAt: z.number().nullish().catch(undefined), title: z.string().nullish().catch(undefined) });
+const creditDetailsSchema = z.array(creditDetailSchema).nullish().catch(null);
 const windowSchema = z.object({ usedPercent: z.number().min(0).max(100).optional(), resetsAt: z.number().nonnegative().nullish(), windowDurationMins: z.number().nonnegative().nullish() });
-const snapshotSchema = z.object({ updatedAt: z.number(), availableCount: z.number().int().nonnegative().nullable(), ordinaryUsageAllowed: z.boolean().nullable(), planType: z.string().nullable(), primary: windowSchema, secondary: windowSchema });
-const stateSchema = z.object({ version: z.literal(1), policy: z.enum(['manual', 'last-resort']).default('manual'), snapshots: z.record(z.string(), snapshotSchema).default({}), pending: z.object({ key: z.string(), idempotencyKey: z.string().uuid() }).optional(), lastAutomaticCheckAt: z.number().optional(), lastRedemptionAt: z.number().optional(), lastRedemption: z.object({ key: z.string(), at: z.number(), outcome: z.enum(['reset', 'nothingToReset', 'noCredit', 'alreadyRedeemed']), automatic: z.boolean() }).optional() });
-const readSchema = z.object({ accountId: z.string(), ordinaryUsageAllowed: z.boolean().nullish(), rateLimitResetCredits: z.object({ availableCount: z.number().int().nonnegative() }).nullish(), rateLimits: z.object({ planType: z.string().nullish(), primary: windowSchema.nullish(), secondary: windowSchema.nullish() }) });
+const snapshotSchema = z.object({ updatedAt: z.number(), availableCount: z.number().int().nonnegative().nullable(), credits: creditDetailsSchema, ordinaryUsageAllowed: z.boolean().nullable(), planType: z.string().nullable(), primary: windowSchema, secondary: windowSchema });
+const creditIdSchema = z.string().min(1).refine(id => id.trim().length > 0);
+const stateSchema = z.object({ version: z.union([z.literal(1), z.literal(2)]), policy: z.enum(['manual', 'last-resort']).default('manual'), snapshots: z.record(z.string(), snapshotSchema).default({}), pending: z.object({ key: z.string(), idempotencyKey: z.string().uuid(), creditId: creditIdSchema.optional() }).optional(), lastAutomaticCheckAt: z.number().optional(), lastRedemptionAt: z.number().optional(), lastRedemption: z.object({ key: z.string(), at: z.number(), outcome: z.enum(['reset', 'nothingToReset', 'noCredit', 'alreadyRedeemed']), automatic: z.boolean() }).optional() });
+// Raw credit rows stay in memory for credit selection; only the display projection is persisted.
+const readSchema = z.object({ accountId: z.string(), ordinaryUsageAllowed: z.boolean().nullish(), rateLimitResetCredits: z.object({ availableCount: z.number().int().nonnegative(), credits: z.unknown().optional() }).nullish(), rateLimits: z.object({ planType: z.string().nullish(), primary: windowSchema.nullish(), secondary: windowSchema.nullish() }) });
+const creditSchema = z.object({ id: creditIdSchema, status: z.literal('available'), resetType: z.literal('codexRateLimits'), expiresAt: z.number().int().safe().nonnegative().nullish() });
 const outcomeSchema = z.object({ outcome: z.enum(['reset', 'nothingToReset', 'noCredit', 'alreadyRedeemed']) });
 export function parseResetSnapshot(value, accountId, now) {
+    return parseResetReading(value, accountId, now).snapshot;
+}
+function parseResetReading(value, accountId, now) {
     const parsed = readSchema.parse(value);
     if (parsed.accountId !== accountId)
         throw Error('Reset credit workspace identity mismatch');
-    return { updatedAt: now, availableCount: parsed.rateLimitResetCredits?.availableCount ?? null, ordinaryUsageAllowed: parsed.ordinaryUsageAllowed ?? null, planType: parsed.rateLimits.planType ?? null, primary: parsed.rateLimits.primary ?? {}, secondary: parsed.rateLimits.secondary ?? {} };
+    const snapshot = { updatedAt: now, availableCount: parsed.rateLimitResetCredits?.availableCount ?? null, credits: creditDetailsSchema.parse(parsed.rateLimitResetCredits?.credits) ?? null, ordinaryUsageAllowed: parsed.ordinaryUsageAllowed ?? null, planType: parsed.rateLimits.planType ?? null, primary: parsed.rateLimits.primary ?? {}, secondary: parsed.rateLimits.secondary ?? {} };
+    const rows = parsed.rateLimitResetCredits?.credits;
+    return { snapshot, credits: Array.isArray(rows) ? rows : [] };
+}
+/** Counts authorize availability; potentially capped detail rows only rank it.
+ * Never confuse credit expiry (seconds) with a quota window's scheduled reset. */
+function firstExpiringCredit(rows, now) {
+    const ids = rows.map(row => z.object({ id: creditIdSchema }).safeParse(row));
+    const counts = new Map();
+    for (const id of ids)
+        if (id.success)
+            counts.set(id.data.id, (counts.get(id.data.id) ?? 0) + 1);
+    let best = { expiresAt: Infinity };
+    for (const row of rows) {
+        const parsed = creditSchema.safeParse(row);
+        if (!parsed.success || counts.get(parsed.data.id) !== 1)
+            continue;
+        const credit = parsed.data;
+        if (typeof credit.expiresAt === 'number' && credit.expiresAt <= now / 1000)
+            continue;
+        const expiresAt = credit.expiresAt ?? Infinity;
+        if (best.creditId === undefined || expiresAt < best.expiresAt)
+            best = { creditId: credit.id, expiresAt };
+    }
+    return best;
 }
 export function resetSnapshotQuota(snapshot) {
     // A bogus resetsAt must not read as a window that never resets.
     const resetAtMs = (s) => typeof s === 'number' && Number.isFinite(s) ? Math.min(s * 1000, snapshot.updatedAt + MAX_RATE_LIMIT_DELAY_MS) : undefined;
     const window = (w) => ({ usedPercent: w.usedPercent, resetAtMs: resetAtMs(w.resetsAt), windowMinutes: w.windowDurationMins ?? undefined });
-    return { updatedAt: snapshot.updatedAt, status: 200, model: 'usage-read', planType: snapshot.planType ?? undefined, primary: window(snapshot.primary), secondary: window(snapshot.secondary) };
+    return { updatedAt: snapshot.updatedAt, status: 200, model: 'usage-read', ordinaryUsageAllowed: snapshot.ordinaryUsageAllowed, planType: snapshot.planType ?? undefined, primary: window(snapshot.primary), secondary: window(snapshot.secondary) };
 }
 export function isResetSubscription(snapshot) {
-    return ['plus', 'pro', 'prolite', 'team', 'business', 'self_serve_business_prolite', 'enterprise', 'edu', 'edu_plus', 'edu_pro'].includes(snapshot.planType ?? '');
+    return ['plus', 'pro', 'promax', 'prolite', 'team', 'business', 'self_serve_business_prolite', 'enterprise', 'edu', 'edu_plus', 'edu_pro'].includes(snapshot.planType ?? '');
 }
-/** No credentials or credit IDs are persisted. One global redemption lease covers
- * all accounts: concurrent exhausted requests cannot independently spend credits. */
+/** No credentials or credit lists are persisted (snapshot credit rows keep only expiry
+ * and title). Only an explicitly selected credit ID accompanies its pending idempotency
+ * key until completion. One global lease prevents concurrent exhausted requests from
+ * independently spending. */
 /** A stored time further ahead than this came from a clock that has since stepped back: treat it as expired. */
 const FUTURE_SKEW_MS = 5 * 60000;
 const within = (at, now, windowMs) => at !== undefined && at <= now + FUTURE_SKEW_MS && now - at < windowMs;
+function validExhaustionEvidence(targets, proof, now) {
+    return targets.some(target => target.key === proof.key && target.accountId === proof.accountId) &&
+        Number.isFinite(proof.observedAt) && proof.observedAt <= now && now - proof.observedAt <= 60000;
+}
+function hasNewExhaustion(state, targets, evidence, now) {
+    return evidence.some(proof => {
+        const snapshot = state.snapshots[proof.key];
+        return validExhaustionEvidence(targets, proof, now) &&
+            state.lastAutomaticCheckAt !== undefined && proof.observedAt > state.lastAutomaticCheckAt &&
+            snapshot?.ordinaryUsageAllowed === true && Number.isFinite(snapshot.updatedAt) &&
+            snapshot.updatedAt <= now && proof.observedAt > snapshot.updatedAt;
+    });
+}
 const automaticChecks = new Map();
+// Stop even if failures keep advancing. New evidence after the final pass can
+// be retried by a later request; no batch can hold callers indefinitely.
+const MAX_AUTOMATIC_CHECK_PASSES = 3;
+function mergeExhaustionEvidence(check, targets, evidence, now) {
+    for (const proof of evidence) {
+        if (!validExhaustionEvidence(targets, proof, now))
+            continue;
+        const key = JSON.stringify([proof.key, proof.accountId]), previous = check.evidence.get(key);
+        if (previous && previous.observedAt >= proof.observedAt)
+            continue;
+        check.evidence.set(key, { key: proof.key, accountId: proof.accountId, observedAt: proof.observedAt });
+        check.version++;
+    }
+}
 export class ResetCreditService {
     path;
     io;
@@ -54,6 +118,9 @@ export class ResetCreditService {
         }
     }
     async save(state) {
+        // Older readers strip unknown pending fields. Make them reject an explicit
+        // credit attempt instead of retrying its UUID with different parameters.
+        state.version = state.pending?.creditId === undefined ? 1 : 2;
         const path = this.path + '.' + randomUUID() + '.tmp';
         try {
             const file = await fs.open(path, 'wx', 0o600);
@@ -71,10 +138,11 @@ export class ResetCreditService {
         }
     }
     async setPolicy(policy) { await withFileTransactionLock(this.path, async () => { const s = await this.status(); s.policy = policy; await this.save(s); }); }
-    async read(target) { return parseResetSnapshot(await this.io.read(target), target.accountId, this.now()); }
+    async readDetails(target, creditDetails) { return parseResetReading(await this.io.read(target, { creditDetails }), target.accountId, this.now()); }
+    async read(target, creditDetails = false) { return (await this.readDetails(target, creditDetails)).snapshot; }
     async refresh(targets) {
         const results = await mapWithConcurrency(targets, 3, async (t) => { try {
-            return { key: t.key, snapshot: await this.read(t) };
+            return { key: t.key, snapshot: await this.read(t, true) };
         }
         catch {
             return null;
@@ -87,13 +155,13 @@ export class ResetCreditService {
                 updated[row.key] = row.snapshot;
             } await this.save(state); return updated; });
     }
-    async consumeLocked(state, target, automatic = false) {
+    async consumeLocked(state, target, automatic = false, creditId) {
         if (state.pending && state.pending.key !== target.key)
             throw Error('A reset redemption is pending for another account; retry that account explicitly first.');
-        state.pending ??= { key: target.key, idempotencyKey: randomUUID() };
+        state.pending ??= { key: target.key, idempotencyKey: randomUUID(), ...(creditId === undefined ? {} : { creditId }) };
         state.lastRedemptionAt = this.now();
         await this.save(state);
-        const result = outcomeSchema.parse(await this.io.consume(target, state.pending.idempotencyKey));
+        const result = outcomeSchema.parse(await this.io.consume(target, state.pending.idempotencyKey, state.pending.creditId));
         // Keep the same key on *any* ambiguous outcome, including a failed follow-up read.
         state.snapshots[target.key] = await this.read(target);
         state.lastRedemption = { key: target.key, at: this.now(), outcome: result.outcome, automatic };
@@ -118,33 +186,63 @@ export class ResetCreditService {
             return this.consumeLocked(state, target);
         });
     }
-    automatic(targets) {
+    automatic(targets, evidence = []) {
         const key = resolve(this.path), signature = JSON.stringify(targets), pending = automaticChecks.get(key);
-        if (pending)
-            return pending.targets === signature ? pending.promise : pending.promise.then(() => null);
+        if (pending?.accepting) {
+            if (pending.targets !== signature)
+                return pending.promise.then(() => null);
+            mergeExhaustionEvidence(pending, targets, evidence, this.now());
+            return pending.promise;
+        }
         if (automaticChecks.size >= 1000)
             return Promise.resolve(null);
-        const promise = this.automaticLocked(targets).finally(() => { automaticChecks.delete(key); });
-        automaticChecks.set(key, { targets: signature, promise });
-        return promise;
+        const currentTargets = targets.map(target => ({ key: target.key, accountId: target.accountId }));
+        const check = { targets: signature, accepting: true, evidence: new Map(), version: 0, promise: Promise.resolve(null) };
+        mergeExhaustionEvidence(check, currentTargets, evidence, this.now());
+        check.promise = this.automaticBatch(currentTargets, check).finally(() => {
+            if (automaticChecks.get(key) === check)
+                automaticChecks.delete(key);
+        });
+        automaticChecks.set(key, check);
+        return check.promise;
     }
-    async automaticLocked(targets) {
+    async automaticBatch(targets, check) {
+        try {
+            for (let pass = 0; pass < MAX_AUTOMATIC_CHECK_PASSES; pass++) {
+                const version = check.version;
+                const result = await this.automaticLocked(targets, [...check.evidence.values()]);
+                if (result !== null || check.version === version)
+                    return result;
+            }
+            return null;
+        }
+        finally {
+            // Close admission before resolving: a late caller must not append evidence
+            // between batch completion and the outer promise's map cleanup.
+            check.accepting = false;
+        }
+    }
+    async automaticLocked(targets, evidence) {
         if (!targets.length || (await this.status()).policy !== 'last-resort')
             return null;
         return withFileTransactionLock(this.path, async () => {
             const state = await this.status();
-            if (state.policy !== 'last-resort' || state.pending || within(state.lastAutomaticCheckAt, this.now(), 60000) || within(state.lastRedemptionAt, this.now(), 300000))
+            const now = this.now();
+            if (state.policy !== 'last-resort' || state.pending || within(state.lastRedemptionAt, now, 300000))
                 return null;
-            state.lastAutomaticCheckAt = this.now();
+            if (within(state.lastAutomaticCheckAt, now, 60000) && !hasNewExhaustion(state, targets, evidence, now))
+                return null;
+            state.lastAutomaticCheckAt = now;
             await this.save(state);
             // Missing/failed reads prevent spending. A scheduled reset that has arrived
             // is confirmed by ordinaryUsageAllowed, never inferred from a clock or %.
-            const reads = await mapWithConcurrency(targets, 3, async (t) => { try {
-                return await this.read(t);
+            const details = await mapWithConcurrency(targets, 3, async (t) => { try {
+                return await this.readDetails(t, true);
             }
             catch {
                 return null;
             } });
+            const reads = details.map(row => row?.snapshot ?? null);
             reads.forEach((s, i) => { const t = targets[i]; if (s && t)
                 state.snapshots[t.key] = s; });
             await this.save(state);
@@ -152,11 +250,20 @@ export class ResetCreditService {
                 return null;
             if (reads.some(s => s && [s.primary, s.secondary].some(w => w.usedPercent === 100 && typeof w.resetsAt === 'number' && w.resetsAt * 1000 <= this.now() + 60000)))
                 return null;
-            const index = reads.findIndex(s => s !== null && (s.availableCount ?? 0) > 0);
-            const target = targets[index];
-            if (!target)
+            let best;
+            for (const [index, row] of details.entries()) {
+                const target = targets[index];
+                if (!row || !target || (row.snapshot.availableCount ?? 0) <= 0)
+                    continue;
+                const credit = firstExpiringCredit(row.credits, this.now());
+                // Stable ties retain the caller's preferred-account/priority ordering.
+                // Unknown, omitted and nonexpiring details follow all known deadlines.
+                if (!best || credit.expiresAt < best.expiresAt)
+                    best = { target, ...credit };
+            }
+            if (!best)
                 return null;
-            return { key: target.key, outcome: await this.consumeLocked(state, target, true) };
+            return { key: best.target.key, outcome: await this.consumeLocked(state, best.target, true, best.creditId) };
         }, { waitMs: 1000 });
     }
 }

package/dist/lib/runtime/rotation-proxy-state.d.ts

@@ -1,3 +1,4 @@
+import type { ResetExhaustionEvidence } from "./reset-credits.js";
 import type { NativeAccountSnapshot } from "./native-account-storage.js";
 import type { QuotaCacheData, QuotaCacheEntry } from "../quota-cache.js";
 import type { RuntimeCapabilityFailures } from "./runtime-capability-failures.js";
@@ -98,6 +99,8 @@ export interface RotationProxyState extends RotationProxyStateInit {
     catalogApiRoutes?: ApiRouteCredential[];
     catalogInventory?: ModelInventory;
     subscriptionQuotaObservations?: Map<string, QuotaCacheEntry>;
+    /** Explicit pre-inference quota rejections, scoped to immutable workspace/model identity. */
+    subscriptionQuotaRejections?: Map<string, ResetExhaustionEvidence>;
     readonly threadGoalFallbacks: Map<string, string | null>;
     lastGlobalAccountIndex: number | null;
     lastGlobalSwitchAt: number;

package/dist/lib/runtime/subscription-quota-order.d.ts

@@ -9,6 +9,7 @@ export interface SubscriptionQuotaPreference {
 }
 export declare const SUBSCRIPTION_RESERVE_PERCENT = 5;
 export declare const SUBSCRIPTION_QUOTA_MAX_AGE_MS: number;
+export declare function hasFreshOrdinaryUsagePermission(entry: QuotaCacheEntry | null | undefined, now: number): boolean;
 /** Scheduling hint only; percentages are not comparable dollar/token balances. */
 export declare function subscriptionQuotaPreference(entry: QuotaCacheEntry | null | undefined, now: number): SubscriptionQuotaPreference;
 export declare function usesSubscriptionReserve(preference: SubscriptionQuotaPreference | undefined): boolean;

package/dist/lib/runtime/subscription-quota-order.js

@@ -1,11 +1,15 @@
 import { isQuotaCacheEntryExhausted } from "../quota-readiness.js";
 export const SUBSCRIPTION_RESERVE_PERCENT = 5;
 export const SUBSCRIPTION_QUOTA_MAX_AGE_MS = 15 * 60_000;
+export function hasFreshOrdinaryUsagePermission(entry, now) {
+    const checkedAt = entry?.ordinaryUsageCheckedAt ?? entry?.updatedAt;
+    return entry?.status === 200 && entry.ordinaryUsageAllowed === true && typeof checkedAt === "number" && Number.isFinite(checkedAt) && checkedAt <= now && now - checkedAt <= 60_000;
+}
 /** Scheduling hint only; percentages are not comparable dollar/token balances. */
 export function subscriptionQuotaPreference(entry, now) {
     const planType = entry?.planType?.trim().toLowerCase();
-    const plan = planType === "free" ? "free" : ["plus", "pro", "team", "business", "enterprise", "edu"].includes(planType ?? "") ? "subscription" : "unknown";
-    const result = { plan, remainingPercent: null, resetAtMs: null, urgency: null, exhausted: isQuotaCacheEntryExhausted(entry, now), observedAt: entry?.updatedAt ?? null };
+    const plan = planType === "free" ? "free" : ["plus", "pro", "promax", "prolite", "team", "business", "self_serve_business_prolite", "enterprise", "edu", "edu_plus", "edu_pro"].includes(planType ?? "") ? "subscription" : "unknown";
+    const result = { plan, remainingPercent: null, resetAtMs: null, urgency: null, exhausted: !hasFreshOrdinaryUsagePermission(entry, now) && isQuotaCacheEntryExhausted(entry, now), observedAt: entry?.updatedAt ?? null };
     if (!entry || !Number.isFinite(entry.updatedAt) || entry.updatedAt > now || now - entry.updatedAt > SUBSCRIPTION_QUOTA_MAX_AGE_MS || entry.status !== 200)
         return result;
     const windows = [entry.primary, entry.secondary].filter(w => typeof w.usedPercent === "number" && Number.isFinite(w.usedPercent) && w.usedPercent >= 0 && w.usedPercent <= 100 && !(typeof w.resetAtMs === "number" && w.resetAtMs <= now) && !(w.resetAtMs === undefined && typeof w.windowMinutes === "number" && w.windowMinutes > 0 && now >= entry.updatedAt + w.windowMinutes * 60_000));
@@ -15,7 +19,7 @@ export function subscriptionQuotaPreference(entry, now) {
     if (!window)
         return result;
     result.remainingPercent = 100 - (window.usedPercent ?? 0);
-    result.exhausted = result.remainingPercent === 0;
+    result.exhausted = result.remainingPercent === 0 && !hasFreshOrdinaryUsagePermission(entry, now);
     if (typeof window.resetAtMs === "number" && Number.isFinite(window.resetAtMs) && window.resetAtMs > now) {
         result.resetAtMs = window.resetAtMs;
         result.urgency = result.remainingPercent / (Math.max(60_000, window.resetAtMs - now) / 3_600_000);

package/dist/lib/runtime/workspace-model-scopes.d.ts

@@ -1,10 +1,12 @@
 import { type ManagedAccount } from "../accounts.js";
+export { nativeWorkspaceIdentity } from "../auth/token-utils.js";
 export declare function modelScopeId(...parts: string[]): string;
 /** Request scopes are immutable views. Discovery must never switch a saved account. */
 export declare function workspaceModelScopes(account: ManagedAccount): {
     accountId: string;
     workspaceIndex: number;
     enabled: boolean;
+    storedWorkspaceId: string | undefined;
     id: string;
     accountIndex: number;
     routable: boolean;

package/dist/lib/runtime/workspace-model-scopes.js

@@ -1,32 +1,42 @@
 import { createHash } from "node:crypto";
 import { resolveAccountRecordId } from "../accounts.js";
-import { extractAccountId } from "../auth/token-utils.js";
+import { extractAccountId, nativeWorkspaceIdentity } from "../auth/token-utils.js";
+export { nativeWorkspaceIdentity } from "../auth/token-utils.js";
 export function modelScopeId(...parts) {
     return createHash("sha256").update(JSON.stringify(parts)).digest("hex");
 }
 /** Request scopes are immutable views. Discovery must never switch a saved account. */
 export function workspaceModelScopes(account) {
-    const boundId = account.accountId?.trim() || extractAccountId(account.access);
+    const boundId = nativeWorkspaceIdentity(account, account.accountId?.trim() || extractAccountId(account.access));
+    const selectedIndex = account.currentWorkspaceIndex ?? 0;
     const candidates = (account.workspaces ?? []).map((workspace, index) => ({
-        accountId: workspace.id.trim(), workspaceIndex: index,
+        accountId: index === selectedIndex ? nativeWorkspaceIdentity(account, workspace.id) ?? "" : workspace.id.trim(), workspaceIndex: index,
         enabled: account.enabled !== false && workspace.enabled !== false,
     }));
     if (boundId && !candidates.some(scope => scope.accountId === boundId))
         candidates.unshift({ accountId: boundId, workspaceIndex: -1, enabled: account.enabled !== false });
     if (!candidates.length)
         candidates.push({ accountId: "", workspaceIndex: -1, enabled: account.enabled !== false });
+    // A selected alias may resolve to the same identity as an earlier token entry.
+    // Keep the selected entry so its enablement and index remain authoritative.
     const seen = new Set();
     return candidates.filter(scope => {
+        if (scope.workspaceIndex !== selectedIndex && candidates.some(other => other.workspaceIndex === selectedIndex && other.accountId === scope.accountId))
+            return false;
         if (seen.has(scope.accountId))
             return false;
         seen.add(scope.accountId);
         return true;
     }).map(scope => ({
         ...scope,
+        // Keep the stored identity across async inventory syncs, including Personal aliases.
+        storedWorkspaceId: account.workspaces?.[scope.workspaceIndex]?.id,
         // Same record identity as reset-credit targets (resolveAccountRecordId), or their keys diverge.
         id: modelScopeId("oauth", resolveAccountRecordId(account), scope.accountId),
         accountIndex: account.index,
-        routable: scope.enabled && Boolean(scope.accountId),
+        routable: scope.enabled && Boolean(scope.accountId) && ((account.workspaces?.length ?? 0) > 0
+            ? scope.workspaceIndex === (account.currentWorkspaceIndex ?? 0)
+            : scope.accountId === boundId),
         bound: scope.accountId === boundId,
         selected: scope.workspaceIndex >= 0 && scope.workspaceIndex === (account.currentWorkspaceIndex ?? 0),
         label: `Account ${account.index + 1}${scope.workspaceIndex >= 0 ? ` / Workspace ${scope.workspaceIndex + 1}` : candidates.length > 1 ? " / Stored binding" : ""}`,