codex-multi-auth 2.3.0-beta.0 → 2.3.0-beta.2

package/dist/lib/request/headers.js

@@ -0,0 +1,64 @@
+/**
+ * Header construction helpers for the custom fetch implementation
+ * Extracted from fetch-helpers.ts (audit roadmap §4.1.2); fetch-helpers.ts
+ * re-exports the public symbols so existing importers are unchanged.
+ */
+import { logWarn } from "../logger.js";
+import { isRecord } from "../utils.js";
+import { OPENAI_HEADERS, OPENAI_HEADER_VALUES } from "../constants.js";
+const CREATE_CODEX_HEADERS_PARAM_KEYS = new Set(["init", "accountId", "accessToken", "opts"]);
+function isCreateCodexHeadersNamedParams(value) {
+    if (!isRecord(value))
+        return false;
+    if (typeof value.accountId !== "string" || typeof value.accessToken !== "string")
+        return false;
+    return Object.keys(value).every((key) => CREATE_CODEX_HEADERS_PARAM_KEYS.has(key));
+}
+export function createCodexHeaders(initOrParams, accountId, accessToken, opts) {
+    const useNamedParams = typeof accountId === "undefined" &&
+        typeof accessToken === "undefined" &&
+        isCreateCodexHeadersNamedParams(initOrParams);
+    const namedParams = useNamedParams
+        ? initOrParams
+        : null;
+    const resolvedInit = useNamedParams
+        ? namedParams?.init
+        : initOrParams;
+    const resolvedAccountId = useNamedParams ? namedParams?.accountId : accountId;
+    const resolvedAccessToken = useNamedParams ? namedParams?.accessToken : accessToken;
+    const resolvedOpts = useNamedParams ? namedParams?.opts : opts;
+    if (!resolvedAccountId || !resolvedAccessToken) {
+        throw new TypeError("createCodexHeaders requires accountId and accessToken");
+    }
+    const headers = new Headers(resolvedInit?.headers ?? {});
+    headers.delete("x-api-key"); // Remove any existing API key
+    headers.set("Authorization", `Bearer ${resolvedAccessToken}`);
+    headers.set(OPENAI_HEADERS.ACCOUNT_ID, resolvedAccountId);
+    headers.set(OPENAI_HEADERS.BETA, OPENAI_HEADER_VALUES.BETA_RESPONSES);
+    headers.set(OPENAI_HEADERS.ORIGINATOR, OPENAI_HEADER_VALUES.ORIGINATOR_CODEX);
+    const cacheKey = resolvedOpts?.promptCacheKey;
+    if (cacheKey) {
+        headers.set(OPENAI_HEADERS.CONVERSATION_ID, cacheKey);
+        headers.set(OPENAI_HEADERS.SESSION_ID, cacheKey);
+    }
+    else {
+        headers.delete(OPENAI_HEADERS.CONVERSATION_ID);
+        headers.delete(OPENAI_HEADERS.SESSION_ID);
+    }
+    headers.set("accept", "text/event-stream");
+    return headers;
+}
+/**
+ * Log RFC 8594 Deprecation/Sunset headers if present. Shared by the success and
+ * error response handlers so a sunset notice is surfaced regardless of status
+ * (request-01).
+ *
+ * @internal Exported only for sibling lib/request modules; import via fetch-helpers.ts elsewhere.
+ */
+export function logDeprecationHeaders(response) {
+    const deprecation = response.headers.get("Deprecation");
+    const sunset = response.headers.get("Sunset");
+    if (deprecation || sunset) {
+        logWarn(`API deprecation notice`, { deprecation, sunset });
+    }
+}

package/dist/lib/request/helpers/input-utils.js

@@ -211,4 +211,3 @@ export const injectMissingToolOutputs = (input) => {
     }
     return result;
 };
-//# sourceMappingURL=input-utils.js.map

package/dist/lib/request/helpers/model-map.d.ts

@@ -8,6 +8,16 @@
  */
 export type ModelReasoningEffort = "none" | "minimal" | "low" | "medium" | "high" | "xhigh";
 export type PromptModelFamily = "gpt-5-codex" | "codex-max" | "codex" | "gpt-5.2" | "gpt-5.1";
+/**
+ * Model family type for prompt selection
+ * Maps to different system prompts in the Codex CLI
+ */
+export type ModelFamily = PromptModelFamily;
+/**
+ * All supported model families
+ * Used for per-family account rotation and rate limit tracking
+ */
+export declare const MODEL_FAMILIES: readonly ModelFamily[];
 export interface ModelCapabilities {
     toolSearch: boolean;
     computerUse: boolean;

package/dist/lib/request/helpers/model-map.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"model-map.d.ts","sourceRoot":"","sources":["../../../../lib/request/helpers/model-map.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,MAAM,oBAAoB,GAC7B,MAAM,GACN,SAAS,GACT,KAAK,GACL,QAAQ,GACR,MAAM,GACN,OAAO,CAAC;AAEX,MAAM,MAAM,iBAAiB,GAC1B,aAAa,GACb,WAAW,GACX,OAAO,GACP,SAAS,GACT,SAAS,CAAC;AAEb,MAAM,WAAW,iBAAiB;IACjC,UAAU,EAAE,OAAO,CAAC;IACpB,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,YAAY;IAC5B,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,iBAAiB,CAAC;IAChC,sBAAsB,EAAE,oBAAoB,CAAC;IAC7C,yBAAyB,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC3D,YAAY,EAAE,iBAAiB,CAAC;CAChC;AA6CD,eAAO,MAAM,mBAAmB,kBAAkB,CAAC;AACnD,eAAO,MAAM,aAAa,YAAY,CAAC;AAKvC,eAAO,MAAM,uBAAuB,kFAM1B,CAAC;AA4CX;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAqF9C,CAAC;AAEX,QAAA,MAAM,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,CAAC;AAoE7C,OAAO,EAAE,SAAS,EAAE,CAAC;AA6IrB;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAQtE;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAsBxE;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,YAAY,CAavE;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,iBAAiB,CAEjF;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAErD"}
+{"version":3,"file":"model-map.d.ts","sourceRoot":"","sources":["../../../../lib/request/helpers/model-map.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,MAAM,oBAAoB,GAC7B,MAAM,GACN,SAAS,GACT,KAAK,GACL,QAAQ,GACR,MAAM,GACN,OAAO,CAAC;AAEX,MAAM,MAAM,iBAAiB,GAC1B,aAAa,GACb,WAAW,GACX,OAAO,GACP,SAAS,GACT,SAAS,CAAC;AAEb;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG,iBAAiB,CAAC;AAE5C;;;GAGG;AACH,eAAO,MAAM,cAAc,EAAE,SAAS,WAAW,EAMvC,CAAC;AAEX,MAAM,WAAW,iBAAiB;IACjC,UAAU,EAAE,OAAO,CAAC;IACpB,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,YAAY;IAC5B,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,iBAAiB,CAAC;IAChC,sBAAsB,EAAE,oBAAoB,CAAC;IAC7C,yBAAyB,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC3D,YAAY,EAAE,iBAAiB,CAAC;CAChC;AA6CD,eAAO,MAAM,mBAAmB,kBAAkB,CAAC;AACnD,eAAO,MAAM,aAAa,YAAY,CAAC;AAKvC,eAAO,MAAM,uBAAuB,kFAM1B,CAAC;AA4CX;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAqF9C,CAAC;AAEX,QAAA,MAAM,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,CAAC;AAoE7C,OAAO,EAAE,SAAS,EAAE,CAAC;AA6IrB;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAQtE;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAsBxE;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,YAAY,CAavE;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,iBAAiB,CAEjF;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAErD"}

package/dist/lib/request/helpers/model-map.js

@@ -6,6 +6,17 @@
  * tool-surface metadata so routing logic stays consistent across the request
  * transformer, prompt selection, and CLI diagnostics.
  */
+/**
+ * All supported model families
+ * Used for per-family account rotation and rate limit tracking
+ */
+export const MODEL_FAMILIES = [
+    "gpt-5-codex",
+    "codex-max",
+    "codex",
+    "gpt-5.2",
+    "gpt-5.1",
+];
 const REASONING_VARIANTS = [
     "none",
     "minimal",
@@ -403,4 +414,3 @@ export function getModelCapabilities(model) {
 export function isKnownModel(modelId) {
     return getNormalizedModel(modelId) !== undefined;
 }
-//# sourceMappingURL=model-map.js.map

package/dist/lib/request/helpers/tool-utils.js

@@ -157,4 +157,3 @@ function cleanupSchema(schema) {
         cleanupSchema(schema.items);
     }
 }
-//# sourceMappingURL=tool-utils.js.map

package/dist/lib/request/index.js

@@ -2,4 +2,3 @@ export * from "./failure-policy.js";
 export * from "./fetch-helpers.js";
 export * from "./rate-limit-backoff.js";
 export * from "./request-transformer.js";
-//# sourceMappingURL=index.js.map

package/dist/lib/request/rate-limit-backoff.js

@@ -186,4 +186,3 @@ export function getRateLimitBackoffWithReason(accountIndexOrParams, quotaKey, se
         reason: resolvedReason,
     };
 }
-//# sourceMappingURL=rate-limit-backoff.js.map

package/dist/lib/request/rate-limit-decision.d.ts

@@ -0,0 +1,28 @@
+import type { ExhaustionReason } from "../runtime/rotation-server-types.js";
+import type { TokenResult } from "../types.js";
+export declare function isTokenInvalidationError(bodyText: string): boolean;
+export declare function isTokenRefreshRetryable(result: Extract<TokenResult, {
+    type: "failed";
+}>): boolean;
+export declare function parseRetryAfterHeaderMs(headers: Headers, now: number): number | null;
+export declare function parseRetryAfterBodyMs(bodyText: string, now: number): number | null;
+export declare function buildTokenInvalidationBody(upstreamBodyText: string): string;
+export declare function extractErrorCodeFromBody(bodyText: string): string | null;
+export declare function getQuotaNearExhaustionWaitMs(headers: Headers, remainingThreshold: number, now: number): number;
+export declare function normalizeExhaustionStatus(reason: ExhaustionReason): number;
+/**
+ * Build the JSON `error` body for a pinned-account 503 response. Extracted so
+ * the null-reason desync path (`reason: null`, no parenthetical in `message`)
+ * can be unit-tested without standing up a full proxy. The shape mirrors
+ * `writePoolExhausted` so consumers can handle both 503 codes uniformly. See
+ * issue #486.
+ */
+export interface PinnedUnavailableErrorBody {
+    message: string;
+    code: "codex_pinned_account_unavailable";
+    pinnedAccountIndex: number | null;
+    reason: string | null;
+    account_skip_reasons: Record<string, string>;
+}
+export declare function buildPinnedUnavailableErrorBody(pinnedIndex: number | null | undefined, accountSkipReasons: ReadonlyMap<number, string>): PinnedUnavailableErrorBody;
+//# sourceMappingURL=rate-limit-decision.d.ts.map

package/dist/lib/request/rate-limit-decision.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit-decision.d.ts","sourceRoot":"","sources":["../../../lib/request/rate-limit-decision.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AAC5E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAe/C,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAGlE;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,OAAO,CAAC,WAAW,EAAE;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC,GAAG,OAAO,CAWjG;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAapF;AAED,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAoBlF;AAYD,wBAAgB,0BAA0B,CAAC,gBAAgB,EAAE,MAAM,GAAG,MAAM,CAuB3E;AAED,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAkBxE;AA0BD,wBAAgB,4BAA4B,CAC3C,OAAO,EAAE,OAAO,EAChB,kBAAkB,EAAE,MAAM,EAC1B,GAAG,EAAE,MAAM,GACT,MAAM,CAUR;AAED,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAE1E;AAED;;;;;;GAMG;AACH,MAAM,WAAW,0BAA0B;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,kCAAkC,CAAC;IACzC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC7C;AAED,wBAAgB,+BAA+B,CAC9C,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACtC,kBAAkB,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GAC7C,0BAA0B,CA0B5B"}

package/dist/lib/request/rate-limit-decision.js

@@ -0,0 +1,191 @@
+import { HTTP_STATUS } from "../constants.js";
+import { isRecord } from "../utils.js";
+// Phrases observed in upstream 401 response bodies when OpenAI/Microsoft has
+// explicitly revoked an OAuth token (as opposed to a generic expired-token 401
+// that can be retried after a refresh). Matching is case-insensitive substring.
+// If anti-abuse detection triggers different wording in production, add the new
+// phrase here and record the source provider and date. See issue #495.
+const TOKEN_INVALIDATION_PHRASES = [
+    "invalidated oauth token",
+    "authentication token has been invalidated",
+    "oauth token has been invalidated",
+    "token has been invalidated",
+];
+export function isTokenInvalidationError(bodyText) {
+    const lower = bodyText.toLowerCase();
+    return TOKEN_INVALIDATION_PHRASES.some((phrase) => lower.includes(phrase));
+}
+export function isTokenRefreshRetryable(result) {
+    if (result.reason === "network_error" || result.reason === "unknown")
+        return true;
+    if (result.reason === "invalid_response")
+        return true;
+    if (result.reason === "http_error") {
+        return !(result.statusCode === HTTP_STATUS.BAD_REQUEST ||
+            result.statusCode === HTTP_STATUS.UNAUTHORIZED ||
+            result.statusCode === HTTP_STATUS.FORBIDDEN);
+    }
+    return false;
+}
+export function parseRetryAfterHeaderMs(headers, now) {
+    const retryAfterMs = headers.get("retry-after-ms");
+    if (retryAfterMs) {
+        const parsed = Number.parseInt(retryAfterMs, 10);
+        if (Number.isFinite(parsed) && parsed > 0)
+            return parsed;
+    }
+    const retryAfter = headers.get("retry-after");
+    if (!retryAfter)
+        return null;
+    const asSeconds = Number.parseInt(retryAfter, 10);
+    if (Number.isFinite(asSeconds) && asSeconds > 0)
+        return asSeconds * 1000;
+    const asDate = Date.parse(retryAfter);
+    if (Number.isFinite(asDate) && asDate > now)
+        return asDate - now;
+    return null;
+}
+export function parseRetryAfterBodyMs(bodyText, now) {
+    if (!bodyText.trim())
+        return null;
+    try {
+        const parsed = JSON.parse(bodyText);
+        if (!isRecord(parsed) || !isRecord(parsed.error))
+            return null;
+        const retryAfterMs = Number(parsed.error.retry_after_ms);
+        if (Number.isFinite(retryAfterMs) && retryAfterMs > 0)
+            return retryAfterMs;
+        const retryAfterSeconds = Number(parsed.error.retry_after);
+        if (Number.isFinite(retryAfterSeconds) && retryAfterSeconds > 0) {
+            return retryAfterSeconds * 1000;
+        }
+        const resetAtRaw = Number(parsed.error.resets_at ?? parsed.error.reset_at);
+        if (Number.isFinite(resetAtRaw) && resetAtRaw > 0) {
+            const resetAtMs = resetAtRaw < 10_000_000_000 ? resetAtRaw * 1000 : resetAtRaw;
+            if (resetAtMs > now)
+                return resetAtMs - now;
+        }
+    }
+    catch {
+        return null;
+    }
+    return null;
+}
+const TOKEN_INVALIDATED_CODE = "token_invalidated";
+const TOKEN_INVALIDATED_FALLBACK_MESSAGE = "OAuth token has been invalidated. Please re-login.";
+// Both invalidation exit paths (refresh-failure and upstream-401) must hand the
+// client the same machine-readable shape — { error: { message, code:
+// "token_invalidated" } } — so a consumer keying off error.code behaves
+// identically regardless of which vector fired. The upstream forwards a raw body
+// with no guaranteed code, so we wrap it here while preserving its human-readable
+// message when one is present.
+export function buildTokenInvalidationBody(upstreamBodyText) {
+    let message = TOKEN_INVALIDATED_FALLBACK_MESSAGE;
+    const trimmed = upstreamBodyText.trim();
+    if (trimmed) {
+        try {
+            const parsed = JSON.parse(trimmed);
+            if (isRecord(parsed)) {
+                const direct = parsed.message;
+                if (typeof direct === "string" && direct.trim()) {
+                    message = direct.trim();
+                }
+                else if (isRecord(parsed.error)) {
+                    const nested = parsed.error.message;
+                    if (typeof nested === "string" && nested.trim()) {
+                        message = nested.trim();
+                    }
+                }
+            }
+        }
+        catch {
+            // Non-JSON upstream body (e.g. HTML error page): keep the stable fallback
+            // message rather than echoing markup back to the client.
+        }
+    }
+    return JSON.stringify({ error: { message, code: TOKEN_INVALIDATED_CODE } });
+}
+export function extractErrorCodeFromBody(bodyText) {
+    if (!bodyText.trim())
+        return null;
+    try {
+        const parsed = JSON.parse(bodyText);
+        if (!isRecord(parsed))
+            return null;
+        const directCode = parsed.code;
+        if (typeof directCode === "string" && directCode.trim()) {
+            return directCode.trim();
+        }
+        const maybeError = parsed.error;
+        if (!isRecord(maybeError))
+            return null;
+        const nestedCode = maybeError.code;
+        return typeof nestedCode === "string" && nestedCode.trim()
+            ? nestedCode.trim()
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+function getQuotaWindowWaitMs(headers, prefix, now) {
+    const resetAfterSeconds = Number.parseInt(headers.get(`${prefix}-reset-after-seconds`) ?? "", 10);
+    if (Number.isFinite(resetAfterSeconds) && resetAfterSeconds > 0) {
+        return resetAfterSeconds * 1000;
+    }
+    const resetAtRaw = headers.get(`${prefix}-reset-at`);
+    if (!resetAtRaw)
+        return 0;
+    const trimmed = resetAtRaw.trim();
+    let resetAtMs = 0;
+    if (/^\d+$/.test(trimmed)) {
+        const parsed = Number.parseInt(trimmed, 10);
+        if (Number.isFinite(parsed) && parsed > 0) {
+            resetAtMs = parsed < 10_000_000_000 ? parsed * 1000 : parsed;
+        }
+    }
+    else {
+        const parsedDate = Date.parse(trimmed);
+        if (Number.isFinite(parsedDate))
+            resetAtMs = parsedDate;
+    }
+    return resetAtMs > now ? resetAtMs - now : 0;
+}
+export function getQuotaNearExhaustionWaitMs(headers, remainingThreshold, now) {
+    const usedThreshold = 100 - Math.max(0, Math.min(100, remainingThreshold));
+    const candidates = [];
+    for (const prefix of ["x-codex-primary", "x-codex-secondary"]) {
+        const used = Number(headers.get(`${prefix}-used-percent`) ?? "");
+        if (!Number.isFinite(used) || used < usedThreshold)
+            continue;
+        const waitMs = getQuotaWindowWaitMs(headers, prefix, now);
+        if (waitMs > 0)
+            candidates.push(waitMs);
+    }
+    return candidates.length > 0 ? Math.max(...candidates) : 0;
+}
+export function normalizeExhaustionStatus(reason) {
+    return reason === "rate-limit" ? HTTP_STATUS.TOO_MANY_REQUESTS : 503;
+}
+export function buildPinnedUnavailableErrorBody(pinnedIndex, accountSkipReasons) {
+    const normalizedPinnedIndex = typeof pinnedIndex === "number" ? pinnedIndex : null;
+    const skipReason = normalizedPinnedIndex !== null
+        ? accountSkipReasons.get(normalizedPinnedIndex) ?? null
+        : null;
+    const reasonSuffix = skipReason ? ` (${skipReason})` : "";
+    // On the desync path the pin index is unknown (null); claiming "account 1"
+    // there would contradict the machine-readable pinnedAccountIndex: null.
+    const accountPhrase = normalizedPinnedIndex === null
+        ? "The pinned account"
+        : `Pinned account ${normalizedPinnedIndex + 1}`;
+    return {
+        message: `${accountPhrase} is currently unavailable${reasonSuffix}; run \`codex-multi-auth status\` for details, or \`codex-multi-auth unpin\` to allow rotation.`,
+        code: "codex_pinned_account_unavailable",
+        pinnedAccountIndex: normalizedPinnedIndex,
+        reason: skipReason,
+        account_skip_reasons: Object.fromEntries([...accountSkipReasons.entries()].map(([index, reason]) => [
+            String(index),
+            reason,
+        ])),
+    };
+}

package/dist/lib/request/request-attempt-budget.js

@@ -46,4 +46,3 @@ export function buildStreamFailoverCandidateOrder(primaryIndex, accountIndices)
     }
     return order;
 }
-//# sourceMappingURL=request-attempt-budget.js.map

package/dist/lib/request/request-init.js

@@ -47,4 +47,3 @@ export async function parseRequestBodyFromInit(body, logWarn) {
     }
     return {};
 }
-//# sourceMappingURL=request-init.js.map

package/dist/lib/request/request-resilience.js

@@ -77,4 +77,3 @@ export function resetRequestResilienceStateForTests() {
     clearPoolExhaustionCooldown();
     clearServerBurstCooldown();
 }
-//# sourceMappingURL=request-resilience.js.map

package/dist/lib/request/request-transformer.js

@@ -852,4 +852,3 @@ export async function transformRequestBody(bodyOrParams, codexInstructions, user
     body.max_completion_tokens = undefined;
     return body;
 }
-//# sourceMappingURL=request-transformer.js.map

package/dist/lib/request/response-compaction.js

@@ -121,4 +121,3 @@ export async function applyResponseCompaction(params) {
         cleanup();
     }
 }
-//# sourceMappingURL=response-compaction.js.map

package/dist/lib/request/response-handler.js

@@ -765,4 +765,3 @@ export function attachResponseIdCapture(response, headers, onResponseId) {
         headers,
     });
 }
-//# sourceMappingURL=response-handler.js.map

package/dist/lib/request/response-metadata.js

@@ -58,4 +58,3 @@ export function sanitizeResponseHeadersForLog(headers) {
     }
     return sanitized;
 }
-//# sourceMappingURL=response-metadata.js.map

package/dist/lib/request/stream-failover-runtime.d.ts

@@ -0,0 +1,8 @@
+import type { ServerResponse } from "node:http";
+import type { RuntimeRotationProxyStatus } from "../runtime/rotation-server-types.js";
+export declare const HOP_BY_HOP_HEADERS: Set<string>;
+export declare function responseHeadersForClient(upstreamHeaders: Headers): Record<string, string>;
+export declare function withTimeout<T>(promise: Promise<T>, timeoutMs: number, onTimeout: () => void, message: string): Promise<T>;
+export declare function readErrorBody(response: Response, timeoutMs: number, maxBytes?: number): Promise<string>;
+export declare function forwardStreamingResponse(upstream: Response, res: ServerResponse, status: RuntimeRotationProxyStatus, onStreamError: () => void, streamStallTimeoutMs: number): Promise<boolean>;
+//# sourceMappingURL=stream-failover-runtime.d.ts.map

package/dist/lib/request/stream-failover-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stream-failover-runtime.d.ts","sourceRoot":"","sources":["../../../lib/request/stream-failover-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AAEtF,eAAO,MAAM,kBAAkB,aAW7B,CAAC;AAWH,wBAAgB,wBAAwB,CAAC,eAAe,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAUzF;AAED,wBAAsB,WAAW,CAAC,CAAC,EAClC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EACnB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,IAAI,EACrB,OAAO,EAAE,MAAM,GACb,OAAO,CAAC,CAAC,CAAC,CAmBZ;AAED,wBAAsB,aAAa,CAClC,QAAQ,EAAE,QAAQ,EAClB,SAAS,EAAE,MAAM,EACjB,QAAQ,SAAc,GACpB,OAAO,CAAC,MAAM,CAAC,CAuDjB;AAED,wBAAsB,wBAAwB,CAC7C,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,0BAA0B,EAClC,aAAa,EAAE,MAAM,IAAI,EACzB,oBAAoB,EAAE,MAAM,GAC1B,OAAO,CAAC,OAAO,CAAC,CA0ClB"}

package/dist/lib/request/stream-failover-runtime.js

@@ -0,0 +1,149 @@
+export const HOP_BY_HOP_HEADERS = new Set([
+    "connection",
+    "content-length",
+    "expect",
+    "keep-alive",
+    "proxy-authenticate",
+    "proxy-authorization",
+    "te",
+    "trailer",
+    "transfer-encoding",
+    "upgrade",
+]);
+// Any header under this prefix carries account-identifying rotation metadata
+// (index/label/email/id today) and must never reach the client; matching by
+// prefix means a future header added under it is blocked by default instead
+// of leaking until someone remembers to extend an allowlist.
+const PRIVATE_CLIENT_RESPONSE_HEADER_PREFIX = "x-codex-multi-auth-account-";
+const DECODED_UPSTREAM_RESPONSE_HEADERS = new Set([
+    // Node fetch returns decoded bytes while preserving the upstream encoding header.
+    "content-encoding",
+]);
+export function responseHeadersForClient(upstreamHeaders) {
+    const headers = {};
+    for (const [key, value] of upstreamHeaders.entries()) {
+        const normalizedKey = key.toLowerCase();
+        if (HOP_BY_HOP_HEADERS.has(normalizedKey))
+            continue;
+        if (normalizedKey.startsWith(PRIVATE_CLIENT_RESPONSE_HEADER_PREFIX))
+            continue;
+        if (DECODED_UPSTREAM_RESPONSE_HEADERS.has(normalizedKey))
+            continue;
+        headers[key] = value;
+    }
+    return headers;
+}
+export async function withTimeout(promise, timeoutMs, onTimeout, message) {
+    let timeout;
+    try {
+        return await Promise.race([
+            promise,
+            new Promise((_resolve, reject) => {
+                timeout = setTimeout(() => {
+                    // Reject BEFORE onTimeout: onTimeout side effects (e.g. cancelling a
+                    // stream reader) can settle `promise` with a clean value, and a
+                    // settlement enqueued ahead of this rejection would win the race —
+                    // turning a stall into a silent success.
+                    reject(new Error(message));
+                    onTimeout();
+                }, Math.max(1, timeoutMs));
+            }),
+        ]);
+    }
+    finally {
+        if (timeout)
+            clearTimeout(timeout);
+    }
+}
+export async function readErrorBody(response, timeoutMs, maxBytes = 1024 * 1024) {
+    // The outbound fetch's abort timer is cleared once headers arrive, so a
+    // stalled error body would otherwise hang this handler forever (the success
+    // path is per-chunk stall-bounded; the error path was not). Read the body via
+    // a reader, bound it by an idle timeout AND a size cap, and cancel the stream
+    // on timeout/overflow so the socket is released.
+    const body = response.body;
+    if (!body || typeof body.getReader !== "function") {
+        // Fallback for impls without a streamable body: race text() against a timer.
+        try {
+            return await withTimeout(response.text(), timeoutMs, () => undefined, "error body stalled");
+        }
+        catch {
+            return "";
+        }
+    }
+    const reader = body.getReader();
+    const chunks = [];
+    let total = 0;
+    try {
+        for (;;) {
+            let idleTimer;
+            const idle = new Promise((_resolve, reject) => {
+                idleTimer = setTimeout(() => reject(new Error("error body stalled")), Math.max(1, timeoutMs));
+            });
+            let result;
+            try {
+                result = await Promise.race([reader.read(), idle]);
+            }
+            finally {
+                if (idleTimer)
+                    clearTimeout(idleTimer);
+            }
+            if (result.done)
+                break;
+            if (result.value) {
+                total += result.value.byteLength;
+                if (total > maxBytes)
+                    break; // cap: enough for diagnostics, no OOM
+                chunks.push(result.value);
+            }
+        }
+    }
+    catch {
+        // stalled or errored — fall through with whatever we have
+    }
+    finally {
+        await reader.cancel().catch(() => undefined);
+    }
+    try {
+        return Buffer.concat(chunks).toString("utf8");
+    }
+    catch {
+        return "";
+    }
+}
+export async function forwardStreamingResponse(upstream, res, status, onStreamError, streamStallTimeoutMs) {
+    status.streamsStarted += 1;
+    res.writeHead(upstream.status, responseHeadersForClient(upstream.headers));
+    if (!upstream.body) {
+        res.end();
+        return true;
+    }
+    const reader = upstream.body.getReader();
+    res.on("close", () => {
+        if (!res.writableEnded) {
+            void reader.cancel().catch(() => undefined);
+        }
+    });
+    try {
+        while (true) {
+            const { done, value } = await withTimeout(reader.read(), streamStallTimeoutMs, () => {
+                void reader.cancel().catch(() => undefined);
+            }, `upstream stream stalled after ${streamStallTimeoutMs}ms`);
+            if (done)
+                break;
+            if (value && value.byteLength > 0) {
+                res.write(Buffer.from(value));
+            }
+        }
+        res.end();
+        return true;
+    }
+    catch (error) {
+        status.lastError = error instanceof Error ? error.message : String(error);
+        onStreamError();
+        if (!res.destroyed) {
+            res.destroy(error instanceof Error ? error : undefined);
+        }
+        return false;
+    }
+}

package/dist/lib/request/stream-failover.js

@@ -219,4 +219,3 @@ export function withStreamingFailover(initialResponse, getFallbackResponse, opti
         headers,
     });
 }
-//# sourceMappingURL=stream-failover.js.map

package/dist/lib/request/token-refresh.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Token refresh helpers for the custom fetch implementation
+ * Extracted from fetch-helpers.ts (audit roadmap §4.1.2); fetch-helpers.ts
+ * re-exports the public symbols so existing importers are unchanged.
+ */
+import type { Auth, CodexClient } from "@codex-ai/sdk";
+/**
+ * Determines if the current auth token needs to be refreshed
+ * @param auth - Current authentication state
+ * @returns True if token is expired or invalid
+ */
+export declare function shouldRefreshToken(auth: Auth, skewMs?: number): boolean;
+/**
+ * Refreshes the OAuth token and updates stored credentials
+ *
+ * Mutation contract: on success the passed `currentAuth` object is updated
+ * IN PLACE (access/refresh/expires) after the persistence await, and the same
+ * reference is returned. Same-account refreshes are serialized by
+ * `queuedRefresh`, so two concurrent calls for one account coalesce rather
+ * than race; callers must still not share one Auth object across calls for
+ * DIFFERENT accounts, and must not read token fields from a shared reference
+ * while a refresh for it is in flight (the window between the persistence
+ * await and the mutation block exposes the pre-refresh values).
+ *
+ * @param currentAuth - Current auth state
+ * @param client - Codex client for updating stored credentials
+ * @returns Updated auth (throws on failure)
+ */
+export declare function refreshAndUpdateToken(currentAuth: Auth, client: CodexClient): Promise<Auth>;
+//# sourceMappingURL=token-refresh.d.ts.map

package/dist/lib/request/token-refresh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-refresh.d.ts","sourceRoot":"","sources":["../../../lib/request/token-refresh.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAqBvD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,SAAI,GAAG,OAAO,CAMlE;AAoDD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,qBAAqB,CAC1C,WAAW,EAAE,IAAI,EACjB,MAAM,EAAE,WAAW,GACjB,OAAO,CAAC,IAAI,CAAC,CA+Cf"}