codex-multi-auth 2.3.0-beta.0 → 2.3.0-beta.2

package/dist/lib/runtime/rotation-proxy-state.d.ts

@@ -0,0 +1,54 @@
+import { AccountManager } from "../accounts.js";
+import type { RuntimeRotationProxyStatus } from "./rotation-server-types.js";
+import type { SessionAffinityStore } from "../session-affinity.js";
+/**
+ * Per-instance configuration resolved once in `startRuntimeRotationProxy`,
+ * captured as explicit fields instead of closure variables so the request
+ * handler and the stale-reload recovery can be plain functions.
+ *
+ * @internal
+ */
+export interface RotationProxyStateInit {
+    activeAccountManager: AccountManager;
+    routingMutexMode: "enabled" | "legacy";
+    schedulingStrategy: "hybrid" | "sequential";
+    fetchImpl: typeof fetch;
+    upstreamBaseUrl: string;
+    clientApiKey: string;
+    now: () => number;
+    tokenRefreshSkewMs: number;
+    networkErrorCooldownMs: number;
+    serverErrorCooldownMs: number;
+    tokenInvalidationCooldownMs: number;
+    minRotationIntervalMs: number;
+    pidOffsetEnabled: boolean;
+    fetchTimeoutMs: number;
+    streamStallTimeoutMs: number;
+    maxRuntimeAccountAttempts: number;
+    maxRequestBodyBytes: number;
+    quotaRemainingPercentThreshold: number;
+    sessionAffinityStore: SessionAffinityStore | null;
+    lastObservedAffinityGeneration: number;
+}
+/**
+ * Mutable rotation-loop state shared by every request of one proxy instance.
+ * `activeAccountManager` and `lastObservedAffinityGeneration` are reassigned
+ * at runtime (stale-state recovery and affinity-generation tracking), so the
+ * whole container is passed by reference and never copied.
+ *
+ * @internal
+ */
+export interface RotationProxyState extends RotationProxyStateInit {
+    readonly knownAccountManagers: Set<AccountManager>;
+    readonly status: RuntimeRotationProxyStatus;
+    readonly threadGoalFallbacks: Map<string, string | null>;
+    lastGlobalAccountIndex: number | null;
+    lastGlobalSwitchAt: number;
+    staleRuntimeReloadPromise: Promise<AccountManager | null> | null;
+    lastStaleRuntimeReloadAt: number;
+}
+/** @internal */
+export declare function createRotationProxyState(init: RotationProxyStateInit): RotationProxyState;
+/** @internal */
+export declare function recoverStaleRuntimeState(state: RotationProxyState): Promise<AccountManager | null>;
+//# sourceMappingURL=rotation-proxy-state.d.ts.map

package/dist/lib/runtime/rotation-proxy-state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rotation-proxy-state.d.ts","sourceRoot":"","sources":["../../../lib/runtime/rotation-proxy-state.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAKhD,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AAC7E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAEnE;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACtC,oBAAoB,EAAE,cAAc,CAAC;IACrC,gBAAgB,EAAE,SAAS,GAAG,QAAQ,CAAC;IACvC,kBAAkB,EAAE,QAAQ,GAAG,YAAY,CAAC;IAC5C,SAAS,EAAE,OAAO,KAAK,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,EAAE,MAAM,MAAM,CAAC;IAClB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,2BAA2B,EAAE,MAAM,CAAC;IACpC,qBAAqB,EAAE,MAAM,CAAC;IAC9B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,yBAAyB,EAAE,MAAM,CAAC;IAClC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,8BAA8B,EAAE,MAAM,CAAC;IACvC,oBAAoB,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAClD,8BAA8B,EAAE,MAAM,CAAC;CACvC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAmB,SAAQ,sBAAsB;IACjE,QAAQ,CAAC,oBAAoB,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;IACnD,QAAQ,CAAC,MAAM,EAAE,0BAA0B,CAAC;IAC5C,QAAQ,CAAC,mBAAmB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;IACzD,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,yBAAyB,EAAE,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IACjE,wBAAwB,EAAE,MAAM,CAAC;CACjC;AAID,gBAAgB;AAChB,wBAAgB,wBAAwB,CACvC,IAAI,EAAE,sBAAsB,GAC1B,kBAAkB,CAuBpB;AAED,gBAAgB;AAChB,wBAAsB,wBAAwB,CAC7C,KAAK,EAAE,kBAAkB,GACvB,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CA0BhC"}

package/dist/lib/runtime/rotation-proxy-state.js

@@ -0,0 +1,56 @@
+import { AccountManager } from "../accounts.js";
+import { recordRuntimeReload, recordRuntimeReset, } from "./runtime-observability.js";
+const STALE_RUNTIME_RELOAD_DEDUPE_MS = 1_000;
+/** @internal */
+export function createRotationProxyState(init) {
+    return {
+        ...init,
+        knownAccountManagers: new Set([init.activeAccountManager]),
+        status: {
+            startedAt: init.now(),
+            totalRequests: 0,
+            upstreamRequests: 0,
+            retries: 0,
+            rotations: 0,
+            streamsStarted: 0,
+            lastError: null,
+            lastAccountIndex: null,
+            lastAccountLabel: null,
+            lastAccountId: null,
+            lastAccountUpdatedAt: null,
+        },
+        threadGoalFallbacks: new Map(),
+        lastGlobalAccountIndex: null,
+        lastGlobalSwitchAt: 0,
+        staleRuntimeReloadPromise: null,
+        lastStaleRuntimeReloadAt: 0,
+    };
+}
+/** @internal */
+export async function recoverStaleRuntimeState(state) {
+    if (Date.now() - state.lastStaleRuntimeReloadAt <= STALE_RUNTIME_RELOAD_DEDUPE_MS) {
+        return state.activeAccountManager;
+    }
+    if (state.staleRuntimeReloadPromise) {
+        return state.staleRuntimeReloadPromise;
+    }
+    state.staleRuntimeReloadPromise = (async () => {
+        AccountManager.resetVolatileRuntimeState();
+        recordRuntimeReset("pool-exhausted-no-account");
+        const reloaded = await AccountManager.loadFromDisk();
+        reloaded.setRoutingMutexMode(state.routingMutexMode);
+        state.activeAccountManager = reloaded;
+        state.knownAccountManagers.add(reloaded);
+        state.lastStaleRuntimeReloadAt = Date.now();
+        recordRuntimeReload("pool-exhausted-no-account");
+        return reloaded;
+    })()
+        .catch((error) => {
+        state.status.lastError = error instanceof Error ? error.message : String(error);
+        return null;
+    })
+        .finally(() => {
+        state.staleRuntimeReloadPromise = null;
+    });
+    return state.staleRuntimeReloadPromise;
+}

package/dist/lib/runtime/rotation-server-types.d.ts

@@ -0,0 +1,57 @@
+import type { AccountManager } from "../accounts.js";
+import type { ModelFamily } from "../prompts/codex.js";
+export interface RuntimeRotationProxyServer {
+    host: string;
+    port: number;
+    baseUrl: string;
+    close: () => Promise<void>;
+    getStatus: () => RuntimeRotationProxyStatus;
+}
+export interface RuntimeRotationProxyStatus {
+    startedAt: number;
+    totalRequests: number;
+    upstreamRequests: number;
+    retries: number;
+    rotations: number;
+    streamsStarted: number;
+    lastError: string | null;
+    lastAccountIndex: number | null;
+    lastAccountLabel: string | null;
+    lastAccountId: string | null;
+    lastAccountUpdatedAt: number | null;
+}
+export interface RuntimeRotationProxyOptions {
+    host?: string;
+    port?: number;
+    upstreamBaseUrl?: string;
+    clientApiKey: string;
+    accountManager?: AccountManager;
+    fetchImpl?: typeof fetch;
+    now?: () => number;
+    quotaRemainingPercentThreshold?: number;
+    maxRequestBodyBytes?: number;
+    fetchTimeoutMs?: number;
+    streamStallTimeoutMs?: number;
+}
+export interface RequestContext {
+    body: Buffer;
+    headers: Headers;
+    method: "GET" | "POST";
+    upstreamPath: string;
+    model: string | null;
+    family: ModelFamily;
+    stream: boolean;
+    sessionKey: string | null;
+}
+export type ExhaustionReason = "rate-limit" | "server-error" | "network-error" | "auth-failure" | "budget" | "deactivated" | "no-account";
+export type RuntimeProxyHttpError = Error & {
+    statusCode: number;
+    code: string;
+};
+export interface RuntimeRotationAccountIdentity {
+    index: number;
+    label: string;
+    accountId: string | null;
+    updatedAt: number;
+}
+//# sourceMappingURL=rotation-server-types.d.ts.map

package/dist/lib/runtime/rotation-server-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rotation-server-types.d.ts","sourceRoot":"","sources":["../../../lib/runtime/rotation-server-types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD,MAAM,WAAW,0BAA0B;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,SAAS,EAAE,MAAM,0BAA0B,CAAC;CAC5C;AAED,MAAM,WAAW,0BAA0B;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,2BAA2B;IAC3C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,8BAA8B,CAAC,EAAE,MAAM,CAAC;IACxC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,cAAc;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,KAAK,GAAG,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,WAAW,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,MAAM,gBAAgB,GACzB,YAAY,GACZ,cAAc,GACd,eAAe,GACf,cAAc,GACd,QAAQ,GACR,aAAa,GACb,YAAY,CAAC;AAChB,MAAM,MAAM,qBAAqB,GAAG,KAAK,GAAG;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,MAAM,WAAW,8BAA8B;IAC9C,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;CAClB"}

package/dist/lib/runtime/rotation-server-types.js

@@ -0,0 +1 @@
+export {};

package/dist/lib/runtime/rotation-storage-meta.d.ts

@@ -0,0 +1,40 @@
+import type { SessionAffinityStore } from "../session-affinity.js";
+export interface StorageMeta {
+    pinnedAccountIndex: number | null;
+    affinityGeneration: number;
+}
+/**
+ * Cheap, hot-path-safe single read with mtime-cache short-circuit. When the
+ * file's `mtimeMs` and `size` match the cached snapshot for this path we
+ * return the cached value WITHOUT reading or hashing the file. Only when
+ * mtime/size differ (or were never cached) do we `readFileSync` + sha1 and,
+ * if the content hash still matches, skip the `JSON.parse`. Transient
+ * failures (EBUSY/EPERM/EACCES/EAGAIN, partial-write SyntaxError) fall through
+ * to the last cached value for this path; defaults are only returned when the
+ * file has never been successfully read.
+ *
+ * Replaces an earlier retry loop with a sub-15ms busy-wait that blocked the
+ * event loop on every transient failure. The proxy is on the request hot
+ * path; serving a slightly stale (but consistent) value is strictly better
+ * than blocking. See #474.
+ */
+export declare function readStorageMetaFromDisk(storagePath?: string): StorageMeta;
+/**
+ * Backwards-compatible helper retained for tests. Prefer `readStorageMetaFromDisk`
+ * for new callers that also need `affinityGeneration`.
+ */
+export declare function readPinnedAccountIndexFromDisk(storagePath?: string): number | null;
+/**
+ * Test-only: reset the storage-meta content-hash cache between scenarios so
+ * each test starts from a clean read-from-disk state.
+ */
+export declare function resetPinCacheForTesting(): void;
+/**
+ * If the on-disk `affinityGeneration` is greater than `lastObservedGeneration`,
+ * drop every entry in `sessionAffinityStore` and return the new generation so
+ * the caller can update its tracker. Otherwise returns `lastObservedGeneration`
+ * unchanged. Extracted so the request-flow logic can be unit-tested without
+ * spinning up the full proxy. See issue #474.
+ */
+export declare function maybeInvalidateAffinityFromDisk(sessionAffinityStore: SessionAffinityStore | null, lastObservedGeneration: number, storagePath?: string): number;
+//# sourceMappingURL=rotation-storage-meta.d.ts.map

package/dist/lib/runtime/rotation-storage-meta.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rotation-storage-meta.d.ts","sourceRoot":"","sources":["../../../lib/runtime/rotation-storage-meta.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAqCnE,MAAM,WAAW,WAAW;IAC3B,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,kBAAkB,EAAE,MAAM,CAAC;CAC3B;AA8BD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CACtC,WAAW,GAAE,MAAyB,GACpC,WAAW,CA6Eb;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAC7C,WAAW,GAAE,MAAyB,GACpC,MAAM,GAAG,IAAI,CAEf;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,IAAI,IAAI,CAE9C;AAED;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAC9C,oBAAoB,EAAE,oBAAoB,GAAG,IAAI,EACjD,sBAAsB,EAAE,MAAM,EAC9B,WAAW,GAAE,MAAyB,GACpC,MAAM,CAOR"}

package/dist/lib/runtime/rotation-storage-meta.js

@@ -0,0 +1,143 @@
+import { createHash } from "node:crypto";
+import { existsSync, readFileSync, statSync } from "node:fs";
+import { getStoragePath } from "../storage.js";
+// Keyed by absolute storage path so multiple proxy instances and concurrent
+// vitest workers (each pointing at their own temp storage file) cannot
+// corrupt each other's snapshots. See issue #474.
+const STORAGE_META_CACHE = new Map();
+// The mtime+size short-circuit (L3) may only be trusted once the cached
+// mtime is far enough in the past that no *subsequent* write could share the
+// same coarse mtime tick. Filesystems report mtime at wildly different
+// granularities (ext4 ns, FAT 2s, some network/Windows volumes ~1s, and CI
+// containers occasionally coarser), and our writers use atomic rename, so two
+// rapid CLI bumps can land on an identical mtimeMs. Within this settle window
+// we therefore ignore mtime equality and fall back to the read + sha1 path
+// (the real source of truth). Outside it, the file has been quiescent long
+// enough that mtime equality provably means "unchanged", so we skip the read.
+// 2s comfortably exceeds the coarsest mtime granularity we expect in practice.
+const MTIME_SHORTCIRCUIT_SETTLE_MS = 2_000;
+function hashStorageBytes(bytes) {
+    return createHash("sha1").update(bytes).digest("hex");
+}
+function metaFromSnapshot(snapshot) {
+    return {
+        pinnedAccountIndex: snapshot.pinnedAccountIndex,
+        affinityGeneration: snapshot.affinityGeneration,
+    };
+}
+/**
+ * Cheap, hot-path-safe single read with mtime-cache short-circuit. When the
+ * file's `mtimeMs` and `size` match the cached snapshot for this path we
+ * return the cached value WITHOUT reading or hashing the file. Only when
+ * mtime/size differ (or were never cached) do we `readFileSync` + sha1 and,
+ * if the content hash still matches, skip the `JSON.parse`. Transient
+ * failures (EBUSY/EPERM/EACCES/EAGAIN, partial-write SyntaxError) fall through
+ * to the last cached value for this path; defaults are only returned when the
+ * file has never been successfully read.
+ *
+ * Replaces an earlier retry loop with a sub-15ms busy-wait that blocked the
+ * event loop on every transient failure. The proxy is on the request hot
+ * path; serving a slightly stale (but consistent) value is strictly better
+ * than blocking. See #474.
+ */
+export function readStorageMetaFromDisk(storagePath = getStoragePath()) {
+    if (!existsSync(storagePath)) {
+        STORAGE_META_CACHE.delete(storagePath);
+        return { pinnedAccountIndex: null, affinityGeneration: 0 };
+    }
+    try {
+        // mtime+size short-circuit (L3): when neither has changed since the last
+        // successful read AND the cached mtime has settled (see
+        // MTIME_SHORTCIRCUIT_SETTLE_MS) we return the cached snapshot without
+        // reading or hashing the file. During the settle window we deliberately
+        // fall through to the read + sha1 path below, which stays the source of
+        // truth and protects against the coarse-mtime collision described on
+        // StorageMetaSnapshot. So this is a pure fast path for the common
+        // "file quiescent, proxy polling every request" case.
+        const stats = statSync(storagePath);
+        const cachedByStat = STORAGE_META_CACHE.get(storagePath);
+        if (cachedByStat &&
+            cachedByStat.mtimeMs === stats.mtimeMs &&
+            cachedByStat.size === stats.size &&
+            Date.now() - stats.mtimeMs > MTIME_SHORTCIRCUIT_SETTLE_MS) {
+            return metaFromSnapshot(cachedByStat);
+        }
+        const bytes = readFileSync(storagePath);
+        const contentHash = hashStorageBytes(bytes);
+        const cached = STORAGE_META_CACHE.get(storagePath);
+        if (cached && cached.contentHash === contentHash) {
+            // Content is byte-identical despite the mtime/size change (e.g. an
+            // atomic-rename rewrite of the same bytes). Refresh the stat fields so
+            // the next request takes the fast path, but skip the JSON.parse.
+            const refreshed = {
+                ...cached,
+                mtimeMs: stats.mtimeMs,
+                size: stats.size,
+            };
+            STORAGE_META_CACHE.set(storagePath, refreshed);
+            return metaFromSnapshot(refreshed);
+        }
+        const parsed = JSON.parse(bytes.toString("utf8"));
+        const pinnedAccountIndex = typeof parsed.pinnedAccountIndex === "number" &&
+            Number.isFinite(parsed.pinnedAccountIndex)
+            ? Math.trunc(parsed.pinnedAccountIndex)
+            : null;
+        const affinityGeneration = typeof parsed.affinityGeneration === "number" &&
+            Number.isFinite(parsed.affinityGeneration) &&
+            Number.isInteger(parsed.affinityGeneration) &&
+            parsed.affinityGeneration >= 0
+            ? parsed.affinityGeneration
+            : 0;
+        const snapshot = {
+            mtimeMs: stats.mtimeMs,
+            size: stats.size,
+            contentHash,
+            pinnedAccountIndex,
+            affinityGeneration,
+        };
+        STORAGE_META_CACHE.set(storagePath, snapshot);
+        return { pinnedAccountIndex, affinityGeneration };
+    }
+    catch (error) {
+        // On any failure, prefer the last good snapshot for this path so we
+        // don't blow away affinity unnecessarily. Defensive: even non-transient
+        // errors fall back to the cache when one exists — better stale than
+        // wrong. Defaults are only returned when this file has never been read
+        // successfully (cache miss).
+        void error;
+        const cached = STORAGE_META_CACHE.get(storagePath);
+        if (cached) {
+            return metaFromSnapshot(cached);
+        }
+        return { pinnedAccountIndex: null, affinityGeneration: 0 };
+    }
+}
+/**
+ * Backwards-compatible helper retained for tests. Prefer `readStorageMetaFromDisk`
+ * for new callers that also need `affinityGeneration`.
+ */
+export function readPinnedAccountIndexFromDisk(storagePath = getStoragePath()) {
+    return readStorageMetaFromDisk(storagePath).pinnedAccountIndex;
+}
+/**
+ * Test-only: reset the storage-meta content-hash cache between scenarios so
+ * each test starts from a clean read-from-disk state.
+ */
+export function resetPinCacheForTesting() {
+    STORAGE_META_CACHE.clear();
+}
+/**
+ * If the on-disk `affinityGeneration` is greater than `lastObservedGeneration`,
+ * drop every entry in `sessionAffinityStore` and return the new generation so
+ * the caller can update its tracker. Otherwise returns `lastObservedGeneration`
+ * unchanged. Extracted so the request-flow logic can be unit-tested without
+ * spinning up the full proxy. See issue #474.
+ */
+export function maybeInvalidateAffinityFromDisk(sessionAffinityStore, lastObservedGeneration, storagePath = getStoragePath()) {
+    const meta = readStorageMetaFromDisk(storagePath);
+    if (meta.affinityGeneration > lastObservedGeneration) {
+        sessionAffinityStore?.clearAll();
+        return meta.affinityGeneration;
+    }
+    return lastObservedGeneration;
+}

package/dist/lib/runtime/rotation-token-refresh.d.ts

@@ -0,0 +1,25 @@
+import type { AccountManager, ManagedAccount } from "../accounts.js";
+import type { ModelFamily } from "../prompts/codex.js";
+/** @internal */
+export declare const DEFAULT_AUTH_FAILURE_COOLDOWN_MS = 30000;
+/** @internal */
+export declare function applyMonotonicAuthCooldown(accountManager: AccountManager, account: ManagedAccount, cooldownMs: number): void;
+/** @internal */
+export declare function ensureFreshAccessToken(params: {
+    accountManager: AccountManager;
+    account: ManagedAccount;
+    family: ModelFamily;
+    model: string | null;
+    now: number;
+    tokenRefreshSkewMs: number;
+    tokenInvalidationCooldownMs: number;
+}): Promise<{
+    ok: true;
+    accessToken: string;
+    account: ManagedAccount;
+} | {
+    ok: false;
+    retryable: boolean;
+    invalidated?: boolean;
+}>;
+//# sourceMappingURL=rotation-token-refresh.d.ts.map

package/dist/lib/runtime/rotation-token-refresh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rotation-token-refresh.d.ts","sourceRoot":"","sources":["../../../lib/runtime/rotation-token-refresh.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAQvD,gBAAgB;AAChB,eAAO,MAAM,gCAAgC,QAAS,CAAC;AAMvD,gBAAgB;AAChB,wBAAgB,0BAA0B,CACzC,cAAc,EAAE,cAAc,EAC9B,OAAO,EAAE,cAAc,EACvB,UAAU,EAAE,MAAM,GAChB,IAAI,CAUN;AA6CD,gBAAgB;AAChB,wBAAsB,sBAAsB,CAAC,MAAM,EAAE;IACpD,cAAc,EAAE,cAAc,CAAC;IAC/B,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,WAAW,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,kBAAkB,EAAE,MAAM,CAAC;IAC3B,2BAA2B,EAAE,MAAM,CAAC;CACpC,GAAG,OAAO,CACR;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,cAAc,CAAA;CAAE,GAC1D;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,SAAS,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,OAAO,CAAA;CAAE,CAC1D,CAgEA"}

package/dist/lib/runtime/rotation-token-refresh.js

@@ -0,0 +1,99 @@
+import { queuedRefresh } from "../refresh-queue.js";
+import { isTokenInvalidationError, isTokenRefreshRetryable, } from "../request/rate-limit-decision.js";
+/** @internal */
+export const DEFAULT_AUTH_FAILURE_COOLDOWN_MS = 30_000;
+// Monotonic auth-failure cooldown: only extend, never shorten. Two concurrent
+// requests on the same account can race so that an invalidation path sets a
+// long cooldown (5 min) and a subsequent generic 401 truncates it (30 s).
+// Reading the live coolingDownUntil before writing prevents that race.
+/** @internal */
+export function applyMonotonicAuthCooldown(accountManager, account, cooldownMs) {
+    const existing = accountManager.getAccountByIndex(account.index)?.coolingDownUntil ?? 0;
+    // Intentionally Date.now(), not the proxy's injected now(): coolingDownUntil is
+    // written by markAccountCoolingDown via nowMs() (== Date.now()), so both sides of
+    // this comparison must live in the same real-wall-clock domain. Switching to the
+    // injected now() would mis-compare an injected-clock value against a real-clock
+    // deadline and silently defeat the monotonic guard.
+    if (Date.now() + cooldownMs > existing) {
+        accountManager.markAccountCoolingDown(account, cooldownMs, "auth-failure");
+    }
+}
+function hasUsableAccessToken(account, now, skewMs) {
+    return (typeof account.access === "string" &&
+        account.access.trim().length > 0 &&
+        typeof account.expires === "number" &&
+        account.expires > now + Math.max(0, skewMs));
+}
+const runtimeRefreshCommitQueues = new WeakMap();
+async function commitRefreshedAuthOnce(accountManager, account, auth) {
+    const key = [
+        account.index,
+        account.accountId ?? "",
+        account.email ?? "",
+        account.refreshToken,
+    ].join("\0");
+    let queue = runtimeRefreshCommitQueues.get(accountManager);
+    if (!queue) {
+        queue = new Map();
+        runtimeRefreshCommitQueues.set(accountManager, queue);
+    }
+    const existing = queue.get(key);
+    if (existing)
+        return existing;
+    const pending = accountManager
+        .commitRefreshedAuth(account, auth)
+        .finally(() => queue?.delete(key));
+    queue.set(key, pending);
+    return pending;
+}
+/** @internal */
+export async function ensureFreshAccessToken(params) {
+    const { accountManager, account, family, model, now, tokenRefreshSkewMs, tokenInvalidationCooldownMs } = params;
+    if (hasUsableAccessToken(account, now, tokenRefreshSkewMs)) {
+        return { ok: true, accessToken: account.access ?? "", account };
+    }
+    const refreshResult = await queuedRefresh(account.refreshToken);
+    if (refreshResult.type === "failed") {
+        accountManager.recordFailure(account, family, model);
+        accountManager.incrementAuthFailures(account);
+        // If the refresh endpoint itself returns an explicit invalidation message
+        // (e.g. Microsoft/Outlook SSO revokes the refresh token server-side), apply
+        // the long cooldown and signal to the caller to stop rotating rather than
+        // presenting other accounts' tokens from the same IP.
+        const invalidated = isTokenInvalidationError(refreshResult.message ?? "");
+        applyMonotonicAuthCooldown(accountManager, account, invalidated ? tokenInvalidationCooldownMs : DEFAULT_AUTH_FAILURE_COOLDOWN_MS);
+        accountManager.saveToDiskDebounced();
+        return { ok: false, retryable: isTokenRefreshRetryable(refreshResult), invalidated };
+    }
+    const auth = {
+        type: "oauth",
+        access: refreshResult.access,
+        refresh: refreshResult.refresh,
+        expires: refreshResult.expires,
+    };
+    try {
+        const updatedAccount = await commitRefreshedAuthOnce(accountManager, account, auth);
+        // If commit succeeded, use the stored access token from the committed
+        // account — this also handles the dedup case where two concurrent callers
+        // share one commit and both end up with the same committed token.
+        // If commit returned null (account missing from storage after persist),
+        // fall back to the original account object but always use refreshResult.access:
+        // the original account may carry an expired token, and using that would
+        // cause a downstream 401 and incorrectly trigger invalidation-cooldown logic.
+        const resolvedAccount = updatedAccount ?? account;
+        const accessToken = updatedAccount !== null
+            ? (updatedAccount.access ?? refreshResult.access)
+            : refreshResult.access;
+        return {
+            ok: true,
+            accessToken,
+            account: resolvedAccount,
+        };
+    }
+    catch {
+        accountManager.recordFailure(account, family, model);
+        accountManager.markAccountCoolingDown(account, DEFAULT_AUTH_FAILURE_COOLDOWN_MS, "auth-failure");
+        accountManager.saveToDiskDebounced();
+        return { ok: false, retryable: true };
+    }
+}

package/dist/lib/runtime/runtime-current-account.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-current-account.d.ts","sourceRoot":"","sources":["../../../lib/runtime/runtime-current-account.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAC;AAC/E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAGzD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEtD,MAAM,MAAM,2BAA2B,GACpC,uBAAuB,GACvB,UAAU,GACV,YAAY,CAAC;AAEhB,MAAM,MAAM,0BAA0B,GAAG,YAAY,GAAG,OAAO,GAAG,OAAO,CAAC;AAE1E,MAAM,MAAM,oBAAoB,GAAG,SAAS,GAAG,QAAQ,GAAG,UAAU,CAAC;AAErE,MAAM,WAAW,oBAAoB;IACpC,MAAM,EAAE,2BAA2B,CAAC;IACpC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,oBAAoB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,8BAA8B;IAC9C,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,2BAA2B,CAAC;IACpC,SAAS,EAAE,0BAA0B,CAAC;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,4BAA4B;IAC5C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,4BAA4B;IAC5C,eAAe,CAAC,EAAE,4BAA4B,GAAG,IAAI,CAAC;IACtD,aAAa,CAAC,EAAE,mBAAmB,GAAG,IAAI,CAAC;IAC3C,eAAe,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;CAC9C;AAED,eAAO,MAAM,kCAAkC,QAAsB,CAAC;AAItE,MAAM,WAAW,6BAA6B;IAC7C,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAkED,wBAAgB,0BAA0B,IAAI,6BAA6B,GAAG,IAAI,CA0BjF;AAED,wBAAgB,8BAA8B,CAC7C,MAAM,EAAE,6BAA6B,GAAG,IAAI,GAC1C,oBAAoB,GAAG,IAAI,CAc7B;AAED,wBAAgB,iCAAiC,IAAI,oBAAoB,GAAG,IAAI,CAE/E;AA+FD,wBAAgB,4BAA4B,CAC3C,OAAO,EAAE,gBAAgB,EACzB,OAAO,EAAE,4BAA4B,EACrC,OAAO,GAAE,4BAAiC,GACxC,8BAA8B,GAAG,IAAI,CAgDvC;AAED,wBAAgB,4BAA4B,CAC3C,KAAK,EAAE,MAAM,EACb,kBAAkB,EAAE,MAAM,EAC1B,cAAc,EAAE,8BAA8B,GAAG,IAAI,GACnD,oBAAoB,EAAE,CAWxB;AAED,wBAAgB,uBAAuB,CACtC,KAAK,EAAE,MAAM,EACb,kBAAkB,EAAE,MAAM,EAC1B,cAAc,EAAE,8BAA8B,GAAG,IAAI,GACnD,OAAO,CAET"}
+{"version":3,"file":"runtime-current-account.d.ts","sourceRoot":"","sources":["../../../lib/runtime/runtime-current-account.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAC;AAC/E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAGzD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAGtD,MAAM,MAAM,2BAA2B,GACpC,uBAAuB,GACvB,UAAU,GACV,YAAY,CAAC;AAEhB,MAAM,MAAM,0BAA0B,GAAG,YAAY,GAAG,OAAO,GAAG,OAAO,CAAC;AAE1E,MAAM,MAAM,oBAAoB,GAAG,SAAS,GAAG,QAAQ,GAAG,UAAU,CAAC;AAErE,MAAM,WAAW,oBAAoB;IACpC,MAAM,EAAE,2BAA2B,CAAC;IACpC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,oBAAoB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,8BAA8B;IAC9C,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,2BAA2B,CAAC;IACpC,SAAS,EAAE,0BAA0B,CAAC;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,4BAA4B;IAC5C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,4BAA4B;IAC5C,eAAe,CAAC,EAAE,4BAA4B,GAAG,IAAI,CAAC;IACtD,aAAa,CAAC,EAAE,mBAAmB,GAAG,IAAI,CAAC;IAC3C,eAAe,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;CAC9C;AAED,eAAO,MAAM,kCAAkC,QAAsB,CAAC;AAItE,MAAM,WAAW,6BAA6B;IAC7C,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AA8DD,wBAAgB,0BAA0B,IAAI,6BAA6B,GAAG,IAAI,CA0BjF;AAED,wBAAgB,8BAA8B,CAC7C,MAAM,EAAE,6BAA6B,GAAG,IAAI,GAC1C,oBAAoB,GAAG,IAAI,CAc7B;AAED,wBAAgB,iCAAiC,IAAI,oBAAoB,GAAG,IAAI,CAE/E;AA+FD,wBAAgB,4BAA4B,CAC3C,OAAO,EAAE,gBAAgB,EACzB,OAAO,EAAE,4BAA4B,EACrC,OAAO,GAAE,4BAAiC,GACxC,8BAA8B,GAAG,IAAI,CAgDvC;AAED,wBAAgB,4BAA4B,CAC3C,KAAK,EAAE,MAAM,EACb,kBAAkB,EAAE,MAAM,EAC1B,cAAc,EAAE,8BAA8B,GAAG,IAAI,GACnD,oBAAoB,EAAE,CAWxB;AAED,wBAAgB,uBAAuB,CACtC,KAAK,EAAE,MAAM,EACb,kBAAkB,EAAE,MAAM,EAC1B,cAAc,EAAE,8BAA8B,GAAG,IAAI,GACnD,OAAO,CAET"}

package/dist/lib/runtime/runtime-current-account.js

@@ -3,6 +3,7 @@ import { join } from "node:path";
 import process from "node:process";
 import { APP_RUNTIME_HELPER_STATUS_FILE } from "../runtime-constants.js";
 import { getCodexMultiAuthDir } from "../runtime-paths.js";
+import { isRecord } from "../utils.js";
 export const RUNTIME_CURRENT_ACCOUNT_MAX_AGE_MS = 24 * 60 * 60 * 1000;
 const APP_RUNTIME_HELPER_KIND = "codex-app-runtime-rotation-helper";
 const MAX_STATUS_FILE_BYTES = 1024 * 1024; // 1 MB sanity cap
@@ -35,9 +36,6 @@ function normalizeTimestamp(signal) {
     ].filter((timestamp) => timestamp !== null);
     return timestamps.length > 0 ? Math.max(...timestamps) : null;
 }
-function isRecord(value) {
-    return typeof value === "object" && value !== null;
-}
 function readOptionalNumber(record, key) {
     const value = record[key];
     return typeof value === "number" && Number.isFinite(value) ? value : null;
@@ -258,4 +256,3 @@ export function resolveAccountCurrentMarkers(index, storedCurrentIndex, runtimeC
 export function isDisplayCurrentAccount(index, storedCurrentIndex, runtimeCurrent) {
     return runtimeCurrent ? index === runtimeCurrent.index : index === storedCurrentIndex;
 }
-//# sourceMappingURL=runtime-current-account.js.map

package/dist/lib/runtime/runtime-observability.js

@@ -267,4 +267,3 @@ export function resetRuntimeObservabilitySnapshotForTests() {
     snapshotState = createDefaultSnapshot();
     pendingWrite = null;
 }
-//# sourceMappingURL=runtime-observability.js.map

package/dist/lib/runtime/runtime-services.js

@@ -96,4 +96,3 @@ export function ensureSessionAffinityState(params) {
         sessionAffinityConfigKey: configKey,
     };
 }
-//# sourceMappingURL=runtime-services.js.map

package/dist/lib/runtime/session-affinity-entry.js

@@ -8,4 +8,3 @@ export function ensureSessionAffinityEntry(params) {
         createStore: params.createStore,
     });
 }
-//# sourceMappingURL=session-affinity-entry.js.map

package/dist/lib/runtime/session-affinity.js

@@ -14,4 +14,3 @@ export function ensureRuntimeSessionAffinity(deps) {
         configKey,
     };
 }
-//# sourceMappingURL=session-affinity.js.map

package/dist/lib/runtime/session-recovery.js

@@ -4,4 +4,3 @@ export function createRuntimeSessionRecoveryHook(deps) {
         ? createSessionRecoveryHook({ client: deps.client, directory: deps.directory }, { sessionRecovery: true, autoResume: deps.autoResume })
         : null;
 }
-//# sourceMappingURL=session-recovery.js.map

package/dist/lib/runtime/status-marker.js

@@ -12,4 +12,3 @@ export function getRuntimeStatusMarker(ui, status) {
         return "!";
     return ui.theme.glyphs.cross;
 }
-//# sourceMappingURL=status-marker.js.map

package/dist/lib/runtime/storage-scope.js

@@ -27,4 +27,3 @@ export function applyAccountStorageScopeFromConfig(pluginConfig, deps) {
     }
     deps.setStoragePath(perProjectAccounts ? deps.cwd() : null);
 }
-//# sourceMappingURL=storage-scope.js.map

package/dist/lib/runtime/toast.js

@@ -13,4 +13,3 @@ export async function showRuntimeToast(client, message, variant = "success", opt
         // Ignore when TUI is not available.
     }
 }
-//# sourceMappingURL=toast.js.map

package/dist/lib/runtime/ui-runtime-entry.js

@@ -1,4 +1,3 @@
 export function resolveUiRuntimeEntry(params) {
     return params.resolveUiRuntimeFromConfig(params.loadPluginConfig, params.applyUiRuntimeFromConfig);
 }
-//# sourceMappingURL=ui-runtime-entry.js.map

package/dist/lib/runtime/ui-runtime.js

@@ -20,4 +20,3 @@ export function getStatusMarker(ui, status) {
         return "!";
     return ui.theme.glyphs.cross;
 }
-//# sourceMappingURL=ui-runtime.js.map

package/dist/lib/runtime/verify-flagged.js

@@ -90,4 +90,3 @@ export async function verifyRuntimeFlaggedAccounts(deps) {
     deps.showLine(`Results: ${state.restored.length} restored, ${state.remaining.length} still flagged`);
     deps.showLine("");
 }
-//# sourceMappingURL=verify-flagged.js.map

package/dist/lib/runtime-constants.js

@@ -1,3 +1,2 @@
 export const RUNTIME_ROTATION_PROXY_PROVIDER_ID = "codex-multi-auth-runtime-proxy";
 export const APP_RUNTIME_HELPER_STATUS_FILE = "runtime-rotation-app-helper.json";
-//# sourceMappingURL=runtime-constants.js.map

package/dist/lib/runtime-paths.js

@@ -247,4 +247,3 @@ export function getCodexLogDir() {
 export function getLegacyCodexDir() {
     return join(getResolvedUserHomeDir(), ".codex");
 }
-//# sourceMappingURL=runtime-paths.js.map