codex-multi-auth 2.3.0-beta.1 → 2.3.0-beta.3

package/dist/lib/runtime/rotation-account-selection.js

@@ -0,0 +1,172 @@
+/**
+ * `chooseAccount` is a SYNC selector that internally advances the rotation
+ * cursor (the session-affinity-preferred branch and the round-robin fallback
+ * both call `accountManager.markSwitched(...)`, and the hybrid selector advances
+ * its own cursor). It does NOT acquire the routing mutex itself.
+ *
+ * Concurrency (L4): when `routingMutex === "enabled"`, the proxy hot path runs
+ * this whole call AND the subsequent `markSwitchedLocked` commit inside a single
+ * `withRoutingMutex` acquisition, so concurrent requests serialize selection +
+ * cursor advance and cannot stampede the same account. `withRoutingMutex` is
+ * reentrant (AsyncLocalStorage), so the nested `markSwitchedLocked` — and the
+ * later one in `persistRuntimeActiveAccount` — run inline without re-acquiring
+ * the non-reentrant FIFO queue (no deadlock). In legacy mode the inline
+ * `markSwitched` calls below are used unchanged and no lock is taken, so default
+ * behavior and perf are identical. See the hot-path caller in
+ * `startRuntimeRotationProxy` and the regression in
+ * `test/runtime-rotation-proxy.test.ts`.
+ */
+export function chooseAccount(params) {
+    const { accountManager, sessionAffinityStore, sessionKey, family, model, attemptedIndexes, now, policy, pinnedIndex, skipReasons, stickyBoostByAccount, pidOffsetEnabled, schedulingStrategy, } = params;
+    // Manual pin (from `codex-multi-auth switch <n>`) overrides every other
+    // selection signal. We do NOT call markSwitched here — the proxy must not
+    // clobber the pin set by the CLI. See issue #474.
+    if (typeof pinnedIndex === "number") {
+        if (attemptedIndexes.has(pinnedIndex)) {
+            skipReasons?.set(pinnedIndex, "already-attempted");
+            return null;
+        }
+        if (pinnedIndex < 0 || pinnedIndex >= accountManager.getAccountCount()) {
+            skipReasons?.set(pinnedIndex, "missing");
+            return null;
+        }
+        if (policy?.blockedAccountIndexes.has(pinnedIndex)) {
+            skipReasons?.set(pinnedIndex, "policy-blocked");
+            return null;
+        }
+        const pinned = accountManager.getAccountByIndex(pinnedIndex);
+        if (!pinned || pinned.enabled === false) {
+            skipReasons?.set(pinnedIndex, "disabled");
+            return null;
+        }
+        const reason = accountManager.getAccountRuntimeSkipReason(pinnedIndex, family, model);
+        if (reason) {
+            skipReasons?.set(pinnedIndex, reason);
+            return null;
+        }
+        return pinned;
+    }
+    // Sequential / drain-first mode (issue #509): the active account governs ALL
+    // new requests, so we deliberately SKIP the per-session affinity tier — there
+    // is no per-chat stickiness, every request follows the single active account.
+    // The manual pin above still wins (handled first). When the active account is
+    // exhausted the selector advances to the next available account and earlier
+    // accounts reclaim the slot once their quota recovers.
+    if (schedulingStrategy === "sequential") {
+        const selected = accountManager.getCurrentOrNextForFamilySequential(family, model, policy?.blockedAccountIndexes);
+        if (selected &&
+            !attemptedIndexes.has(selected.index) &&
+            !policy?.blockedAccountIndexes.has(selected.index)) {
+            const reason = accountManager.getAccountRuntimeSkipReason(selected.index, family, model);
+            if (!reason)
+                return selected;
+            skipReasons?.set(selected.index, reason);
+        }
+        // Active account was attempted/blocked/skipped this request (e.g. it just
+        // rate-limited mid-loop): fall through to the shared linear scan to find
+        // the next eligible account to TRY. Pass advanceActivePointer=false so a
+        // transient, non-exhausting failure on the active account does not
+        // permanently move the drain-first primary — only
+        // getCurrentOrNextForFamilySequential advances it, and only on true
+        // exhaustion.
+        return chooseLinearScanFallback({
+            accountManager,
+            family,
+            model,
+            attemptedIndexes,
+            policy,
+            skipReasons,
+            advanceActivePointer: false,
+        });
+    }
+    const preferredIndex = sessionAffinityStore?.getPreferredAccountIndex(sessionKey, now);
+    if (typeof preferredIndex === "number" &&
+        !attemptedIndexes.has(preferredIndex) &&
+        !policy?.blockedAccountIndexes.has(preferredIndex)) {
+        const preferred = accountManager.getAccountByIndex(preferredIndex);
+        if (preferred) {
+            const reason = accountManager.getAccountRuntimeSkipReason(preferred.index, family, model);
+            if (reason) {
+                skipReasons?.set(preferred.index, reason);
+            }
+            else {
+                // L4 (deferred): unlocked cursor mutation — see chooseAccount header.
+                accountManager.markSwitched(preferred, "rotation", family);
+                return preferred;
+            }
+        }
+    }
+    const selected = accountManager.getCurrentOrNextForFamilyHybrid(family, model, {
+        scoreBoostByAccount: {
+            ...(policy?.scoreBoostByAccount ?? {}),
+            ...(stickyBoostByAccount ?? {}),
+        },
+        // accounts-05: carry the PID-offset distribution into the default-on proxy
+        // path too (index.ts already does). Without it, parallel proxy processes can
+        // stampede the same account instead of spreading across the pool.
+        pidOffsetEnabled,
+    });
+    if (selected &&
+        !attemptedIndexes.has(selected.index) &&
+        !policy?.blockedAccountIndexes.has(selected.index)) {
+        const reason = accountManager.getAccountRuntimeSkipReason(selected.index, family, model);
+        if (!reason)
+            return selected;
+        skipReasons?.set(selected.index, reason);
+    }
+    return chooseLinearScanFallback({
+        accountManager,
+        family,
+        model,
+        attemptedIndexes,
+        policy,
+        skipReasons,
+    });
+}
+/**
+ * Shared linear-scan fallback used by both the hybrid and sequential selection
+ * paths in `chooseAccount`. Walks every account in pool order and returns the
+ * first one that is not already attempted, not policy-blocked, and has no
+ * runtime skip reason (rate-limited / cooling down / circuit-open), recording a
+ * skip reason for each rejected candidate. Returns null when no eligible
+ * account remains.
+ *
+ * `advanceActivePointer` (default `true`) controls whether the winner is
+ * committed as the new active/cursor position via `markSwitched`. The hybrid
+ * path wants this (round-robin advance). The sequential path passes `false`:
+ * its within-request fallback only needs an account to TRY this request, and
+ * must NOT move `currentAccountIndexByFamily` — otherwise a transient,
+ * non-exhausting failure on the active account (which leaves it `isUsable` but
+ * present in `attemptedIndexes`) would permanently switch the drain-first
+ * primary even though it was never exhausted (issue #509 regression caught in
+ * review). In sequential mode only `getCurrentOrNextForFamilySequential` is
+ * allowed to advance the active pointer, and only on true exhaustion.
+ */
+function chooseLinearScanFallback(params) {
+    const { accountManager, family, model, attemptedIndexes, policy, skipReasons, advanceActivePointer = true, } = params;
+    for (const account of accountManager.getAccountsSnapshot()) {
+        if (attemptedIndexes.has(account.index)) {
+            skipReasons?.set(account.index, "already-attempted");
+            continue;
+        }
+        if (policy?.blockedAccountIndexes.has(account.index)) {
+            skipReasons?.set(account.index, "policy-blocked");
+            continue;
+        }
+        const reason = accountManager.getAccountRuntimeSkipReason(account.index, family, model);
+        if (!reason) {
+            const live = accountManager.getAccountByIndex(account.index);
+            if (!live)
+                continue;
+            // L4 (deferred): unlocked cursor mutation — see chooseAccount header.
+            // Skipped in sequential mode (advanceActivePointer=false) so a
+            // within-request retry never reassigns the drain-first primary.
+            if (advanceActivePointer) {
+                accountManager.markSwitched(live, "rotation", family);
+            }
+            return live;
+        }
+        skipReasons?.set(account.index, reason);
+    }
+    return null;
+}

package/dist/lib/runtime/rotation-proxy-state.d.ts

@@ -0,0 +1,54 @@
+import { AccountManager } from "../accounts.js";
+import type { RuntimeRotationProxyStatus } from "./rotation-server-types.js";
+import type { SessionAffinityStore } from "../session-affinity.js";
+/**
+ * Per-instance configuration resolved once in `startRuntimeRotationProxy`,
+ * captured as explicit fields instead of closure variables so the request
+ * handler and the stale-reload recovery can be plain functions.
+ *
+ * @internal
+ */
+export interface RotationProxyStateInit {
+    activeAccountManager: AccountManager;
+    routingMutexMode: "enabled" | "legacy";
+    schedulingStrategy: "hybrid" | "sequential";
+    fetchImpl: typeof fetch;
+    upstreamBaseUrl: string;
+    clientApiKey: string;
+    now: () => number;
+    tokenRefreshSkewMs: number;
+    networkErrorCooldownMs: number;
+    serverErrorCooldownMs: number;
+    tokenInvalidationCooldownMs: number;
+    minRotationIntervalMs: number;
+    pidOffsetEnabled: boolean;
+    fetchTimeoutMs: number;
+    streamStallTimeoutMs: number;
+    maxRuntimeAccountAttempts: number;
+    maxRequestBodyBytes: number;
+    quotaRemainingPercentThreshold: number;
+    sessionAffinityStore: SessionAffinityStore | null;
+    lastObservedAffinityGeneration: number;
+}
+/**
+ * Mutable rotation-loop state shared by every request of one proxy instance.
+ * `activeAccountManager` and `lastObservedAffinityGeneration` are reassigned
+ * at runtime (stale-state recovery and affinity-generation tracking), so the
+ * whole container is passed by reference and never copied.
+ *
+ * @internal
+ */
+export interface RotationProxyState extends RotationProxyStateInit {
+    readonly knownAccountManagers: Set<AccountManager>;
+    readonly status: RuntimeRotationProxyStatus;
+    readonly threadGoalFallbacks: Map<string, string | null>;
+    lastGlobalAccountIndex: number | null;
+    lastGlobalSwitchAt: number;
+    staleRuntimeReloadPromise: Promise<AccountManager | null> | null;
+    lastStaleRuntimeReloadAt: number;
+}
+/** @internal */
+export declare function createRotationProxyState(init: RotationProxyStateInit): RotationProxyState;
+/** @internal */
+export declare function recoverStaleRuntimeState(state: RotationProxyState): Promise<AccountManager | null>;
+//# sourceMappingURL=rotation-proxy-state.d.ts.map

package/dist/lib/runtime/rotation-proxy-state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rotation-proxy-state.d.ts","sourceRoot":"","sources":["../../../lib/runtime/rotation-proxy-state.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAKhD,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AAC7E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAEnE;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACtC,oBAAoB,EAAE,cAAc,CAAC;IACrC,gBAAgB,EAAE,SAAS,GAAG,QAAQ,CAAC;IACvC,kBAAkB,EAAE,QAAQ,GAAG,YAAY,CAAC;IAC5C,SAAS,EAAE,OAAO,KAAK,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,EAAE,MAAM,MAAM,CAAC;IAClB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,2BAA2B,EAAE,MAAM,CAAC;IACpC,qBAAqB,EAAE,MAAM,CAAC;IAC9B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,yBAAyB,EAAE,MAAM,CAAC;IAClC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,8BAA8B,EAAE,MAAM,CAAC;IACvC,oBAAoB,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAClD,8BAA8B,EAAE,MAAM,CAAC;CACvC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAmB,SAAQ,sBAAsB;IACjE,QAAQ,CAAC,oBAAoB,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;IACnD,QAAQ,CAAC,MAAM,EAAE,0BAA0B,CAAC;IAC5C,QAAQ,CAAC,mBAAmB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;IACzD,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,yBAAyB,EAAE,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IACjE,wBAAwB,EAAE,MAAM,CAAC;CACjC;AAID,gBAAgB;AAChB,wBAAgB,wBAAwB,CACvC,IAAI,EAAE,sBAAsB,GAC1B,kBAAkB,CAuBpB;AAED,gBAAgB;AAChB,wBAAsB,wBAAwB,CAC7C,KAAK,EAAE,kBAAkB,GACvB,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CA0BhC"}

package/dist/lib/runtime/rotation-proxy-state.js

@@ -0,0 +1,56 @@
+import { AccountManager } from "../accounts.js";
+import { recordRuntimeReload, recordRuntimeReset, } from "./runtime-observability.js";
+const STALE_RUNTIME_RELOAD_DEDUPE_MS = 1_000;
+/** @internal */
+export function createRotationProxyState(init) {
+    return {
+        ...init,
+        knownAccountManagers: new Set([init.activeAccountManager]),
+        status: {
+            startedAt: init.now(),
+            totalRequests: 0,
+            upstreamRequests: 0,
+            retries: 0,
+            rotations: 0,
+            streamsStarted: 0,
+            lastError: null,
+            lastAccountIndex: null,
+            lastAccountLabel: null,
+            lastAccountId: null,
+            lastAccountUpdatedAt: null,
+        },
+        threadGoalFallbacks: new Map(),
+        lastGlobalAccountIndex: null,
+        lastGlobalSwitchAt: 0,
+        staleRuntimeReloadPromise: null,
+        lastStaleRuntimeReloadAt: 0,
+    };
+}
+/** @internal */
+export async function recoverStaleRuntimeState(state) {
+    if (Date.now() - state.lastStaleRuntimeReloadAt <= STALE_RUNTIME_RELOAD_DEDUPE_MS) {
+        return state.activeAccountManager;
+    }
+    if (state.staleRuntimeReloadPromise) {
+        return state.staleRuntimeReloadPromise;
+    }
+    state.staleRuntimeReloadPromise = (async () => {
+        AccountManager.resetVolatileRuntimeState();
+        recordRuntimeReset("pool-exhausted-no-account");
+        const reloaded = await AccountManager.loadFromDisk();
+        reloaded.setRoutingMutexMode(state.routingMutexMode);
+        state.activeAccountManager = reloaded;
+        state.knownAccountManagers.add(reloaded);
+        state.lastStaleRuntimeReloadAt = Date.now();
+        recordRuntimeReload("pool-exhausted-no-account");
+        return reloaded;
+    })()
+        .catch((error) => {
+        state.status.lastError = error instanceof Error ? error.message : String(error);
+        return null;
+    })
+        .finally(() => {
+        state.staleRuntimeReloadPromise = null;
+    });
+    return state.staleRuntimeReloadPromise;
+}

package/dist/lib/runtime/rotation-server-types.d.ts

@@ -0,0 +1,57 @@
+import type { AccountManager } from "../accounts.js";
+import type { ModelFamily } from "../prompts/codex.js";
+export interface RuntimeRotationProxyServer {
+    host: string;
+    port: number;
+    baseUrl: string;
+    close: () => Promise<void>;
+    getStatus: () => RuntimeRotationProxyStatus;
+}
+export interface RuntimeRotationProxyStatus {
+    startedAt: number;
+    totalRequests: number;
+    upstreamRequests: number;
+    retries: number;
+    rotations: number;
+    streamsStarted: number;
+    lastError: string | null;
+    lastAccountIndex: number | null;
+    lastAccountLabel: string | null;
+    lastAccountId: string | null;
+    lastAccountUpdatedAt: number | null;
+}
+export interface RuntimeRotationProxyOptions {
+    host?: string;
+    port?: number;
+    upstreamBaseUrl?: string;
+    clientApiKey: string;
+    accountManager?: AccountManager;
+    fetchImpl?: typeof fetch;
+    now?: () => number;
+    quotaRemainingPercentThreshold?: number;
+    maxRequestBodyBytes?: number;
+    fetchTimeoutMs?: number;
+    streamStallTimeoutMs?: number;
+}
+export interface RequestContext {
+    body: Buffer;
+    headers: Headers;
+    method: "GET" | "POST";
+    upstreamPath: string;
+    model: string | null;
+    family: ModelFamily;
+    stream: boolean;
+    sessionKey: string | null;
+}
+export type ExhaustionReason = "rate-limit" | "server-error" | "network-error" | "auth-failure" | "budget" | "deactivated" | "no-account";
+export type RuntimeProxyHttpError = Error & {
+    statusCode: number;
+    code: string;
+};
+export interface RuntimeRotationAccountIdentity {
+    index: number;
+    label: string;
+    accountId: string | null;
+    updatedAt: number;
+}
+//# sourceMappingURL=rotation-server-types.d.ts.map

package/dist/lib/runtime/rotation-server-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rotation-server-types.d.ts","sourceRoot":"","sources":["../../../lib/runtime/rotation-server-types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD,MAAM,WAAW,0BAA0B;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,SAAS,EAAE,MAAM,0BAA0B,CAAC;CAC5C;AAED,MAAM,WAAW,0BAA0B;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,2BAA2B;IAC3C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,8BAA8B,CAAC,EAAE,MAAM,CAAC;IACxC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,cAAc;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,KAAK,GAAG,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,WAAW,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,MAAM,gBAAgB,GACzB,YAAY,GACZ,cAAc,GACd,eAAe,GACf,cAAc,GACd,QAAQ,GACR,aAAa,GACb,YAAY,CAAC;AAChB,MAAM,MAAM,qBAAqB,GAAG,KAAK,GAAG;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,MAAM,WAAW,8BAA8B;IAC9C,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;CAClB"}

package/dist/lib/runtime/rotation-server-types.js

@@ -0,0 +1 @@
+export {};

package/dist/lib/runtime/rotation-storage-meta.d.ts

@@ -0,0 +1,40 @@
+import type { SessionAffinityStore } from "../session-affinity.js";
+export interface StorageMeta {
+    pinnedAccountIndex: number | null;
+    affinityGeneration: number;
+}
+/**
+ * Cheap, hot-path-safe single read with mtime-cache short-circuit. When the
+ * file's `mtimeMs` and `size` match the cached snapshot for this path we
+ * return the cached value WITHOUT reading or hashing the file. Only when
+ * mtime/size differ (or were never cached) do we `readFileSync` + sha1 and,
+ * if the content hash still matches, skip the `JSON.parse`. Transient
+ * failures (EBUSY/EPERM/EACCES/EAGAIN, partial-write SyntaxError) fall through
+ * to the last cached value for this path; defaults are only returned when the
+ * file has never been successfully read.
+ *
+ * Replaces an earlier retry loop with a sub-15ms busy-wait that blocked the
+ * event loop on every transient failure. The proxy is on the request hot
+ * path; serving a slightly stale (but consistent) value is strictly better
+ * than blocking. See #474.
+ */
+export declare function readStorageMetaFromDisk(storagePath?: string): StorageMeta;
+/**
+ * Backwards-compatible helper retained for tests. Prefer `readStorageMetaFromDisk`
+ * for new callers that also need `affinityGeneration`.
+ */
+export declare function readPinnedAccountIndexFromDisk(storagePath?: string): number | null;
+/**
+ * Test-only: reset the storage-meta content-hash cache between scenarios so
+ * each test starts from a clean read-from-disk state.
+ */
+export declare function resetPinCacheForTesting(): void;
+/**
+ * If the on-disk `affinityGeneration` is greater than `lastObservedGeneration`,
+ * drop every entry in `sessionAffinityStore` and return the new generation so
+ * the caller can update its tracker. Otherwise returns `lastObservedGeneration`
+ * unchanged. Extracted so the request-flow logic can be unit-tested without
+ * spinning up the full proxy. See issue #474.
+ */
+export declare function maybeInvalidateAffinityFromDisk(sessionAffinityStore: SessionAffinityStore | null, lastObservedGeneration: number, storagePath?: string): number;
+//# sourceMappingURL=rotation-storage-meta.d.ts.map

package/dist/lib/runtime/rotation-storage-meta.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rotation-storage-meta.d.ts","sourceRoot":"","sources":["../../../lib/runtime/rotation-storage-meta.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAqCnE,MAAM,WAAW,WAAW;IAC3B,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,kBAAkB,EAAE,MAAM,CAAC;CAC3B;AA8BD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CACtC,WAAW,GAAE,MAAyB,GACpC,WAAW,CA6Eb;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAC7C,WAAW,GAAE,MAAyB,GACpC,MAAM,GAAG,IAAI,CAEf;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,IAAI,IAAI,CAE9C;AAED;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAC9C,oBAAoB,EAAE,oBAAoB,GAAG,IAAI,EACjD,sBAAsB,EAAE,MAAM,EAC9B,WAAW,GAAE,MAAyB,GACpC,MAAM,CAOR"}

package/dist/lib/runtime/rotation-storage-meta.js

@@ -0,0 +1,143 @@
+import { createHash } from "node:crypto";
+import { existsSync, readFileSync, statSync } from "node:fs";
+import { getStoragePath } from "../storage.js";
+// Keyed by absolute storage path so multiple proxy instances and concurrent
+// vitest workers (each pointing at their own temp storage file) cannot
+// corrupt each other's snapshots. See issue #474.
+const STORAGE_META_CACHE = new Map();
+// The mtime+size short-circuit (L3) may only be trusted once the cached
+// mtime is far enough in the past that no *subsequent* write could share the
+// same coarse mtime tick. Filesystems report mtime at wildly different
+// granularities (ext4 ns, FAT 2s, some network/Windows volumes ~1s, and CI
+// containers occasionally coarser), and our writers use atomic rename, so two
+// rapid CLI bumps can land on an identical mtimeMs. Within this settle window
+// we therefore ignore mtime equality and fall back to the read + sha1 path
+// (the real source of truth). Outside it, the file has been quiescent long
+// enough that mtime equality provably means "unchanged", so we skip the read.
+// 2s comfortably exceeds the coarsest mtime granularity we expect in practice.
+const MTIME_SHORTCIRCUIT_SETTLE_MS = 2_000;
+function hashStorageBytes(bytes) {
+    return createHash("sha1").update(bytes).digest("hex");
+}
+function metaFromSnapshot(snapshot) {
+    return {
+        pinnedAccountIndex: snapshot.pinnedAccountIndex,
+        affinityGeneration: snapshot.affinityGeneration,
+    };
+}
+/**
+ * Cheap, hot-path-safe single read with mtime-cache short-circuit. When the
+ * file's `mtimeMs` and `size` match the cached snapshot for this path we
+ * return the cached value WITHOUT reading or hashing the file. Only when
+ * mtime/size differ (or were never cached) do we `readFileSync` + sha1 and,
+ * if the content hash still matches, skip the `JSON.parse`. Transient
+ * failures (EBUSY/EPERM/EACCES/EAGAIN, partial-write SyntaxError) fall through
+ * to the last cached value for this path; defaults are only returned when the
+ * file has never been successfully read.
+ *
+ * Replaces an earlier retry loop with a sub-15ms busy-wait that blocked the
+ * event loop on every transient failure. The proxy is on the request hot
+ * path; serving a slightly stale (but consistent) value is strictly better
+ * than blocking. See #474.
+ */
+export function readStorageMetaFromDisk(storagePath = getStoragePath()) {
+    if (!existsSync(storagePath)) {
+        STORAGE_META_CACHE.delete(storagePath);
+        return { pinnedAccountIndex: null, affinityGeneration: 0 };
+    }
+    try {
+        // mtime+size short-circuit (L3): when neither has changed since the last
+        // successful read AND the cached mtime has settled (see
+        // MTIME_SHORTCIRCUIT_SETTLE_MS) we return the cached snapshot without
+        // reading or hashing the file. During the settle window we deliberately
+        // fall through to the read + sha1 path below, which stays the source of
+        // truth and protects against the coarse-mtime collision described on
+        // StorageMetaSnapshot. So this is a pure fast path for the common
+        // "file quiescent, proxy polling every request" case.
+        const stats = statSync(storagePath);
+        const cachedByStat = STORAGE_META_CACHE.get(storagePath);
+        if (cachedByStat &&
+            cachedByStat.mtimeMs === stats.mtimeMs &&
+            cachedByStat.size === stats.size &&
+            Date.now() - stats.mtimeMs > MTIME_SHORTCIRCUIT_SETTLE_MS) {
+            return metaFromSnapshot(cachedByStat);
+        }
+        const bytes = readFileSync(storagePath);
+        const contentHash = hashStorageBytes(bytes);
+        const cached = STORAGE_META_CACHE.get(storagePath);
+        if (cached && cached.contentHash === contentHash) {
+            // Content is byte-identical despite the mtime/size change (e.g. an
+            // atomic-rename rewrite of the same bytes). Refresh the stat fields so
+            // the next request takes the fast path, but skip the JSON.parse.
+            const refreshed = {
+                ...cached,
+                mtimeMs: stats.mtimeMs,
+                size: stats.size,
+            };
+            STORAGE_META_CACHE.set(storagePath, refreshed);
+            return metaFromSnapshot(refreshed);
+        }
+        const parsed = JSON.parse(bytes.toString("utf8"));
+        const pinnedAccountIndex = typeof parsed.pinnedAccountIndex === "number" &&
+            Number.isFinite(parsed.pinnedAccountIndex)
+            ? Math.trunc(parsed.pinnedAccountIndex)
+            : null;
+        const affinityGeneration = typeof parsed.affinityGeneration === "number" &&
+            Number.isFinite(parsed.affinityGeneration) &&
+            Number.isInteger(parsed.affinityGeneration) &&
+            parsed.affinityGeneration >= 0
+            ? parsed.affinityGeneration
+            : 0;
+        const snapshot = {
+            mtimeMs: stats.mtimeMs,
+            size: stats.size,
+            contentHash,
+            pinnedAccountIndex,
+            affinityGeneration,
+        };
+        STORAGE_META_CACHE.set(storagePath, snapshot);
+        return { pinnedAccountIndex, affinityGeneration };
+    }
+    catch (error) {
+        // On any failure, prefer the last good snapshot for this path so we
+        // don't blow away affinity unnecessarily. Defensive: even non-transient
+        // errors fall back to the cache when one exists — better stale than
+        // wrong. Defaults are only returned when this file has never been read
+        // successfully (cache miss).
+        void error;
+        const cached = STORAGE_META_CACHE.get(storagePath);
+        if (cached) {
+            return metaFromSnapshot(cached);
+        }
+        return { pinnedAccountIndex: null, affinityGeneration: 0 };
+    }
+}
+/**
+ * Backwards-compatible helper retained for tests. Prefer `readStorageMetaFromDisk`
+ * for new callers that also need `affinityGeneration`.
+ */
+export function readPinnedAccountIndexFromDisk(storagePath = getStoragePath()) {
+    return readStorageMetaFromDisk(storagePath).pinnedAccountIndex;
+}
+/**
+ * Test-only: reset the storage-meta content-hash cache between scenarios so
+ * each test starts from a clean read-from-disk state.
+ */
+export function resetPinCacheForTesting() {
+    STORAGE_META_CACHE.clear();
+}
+/**
+ * If the on-disk `affinityGeneration` is greater than `lastObservedGeneration`,
+ * drop every entry in `sessionAffinityStore` and return the new generation so
+ * the caller can update its tracker. Otherwise returns `lastObservedGeneration`
+ * unchanged. Extracted so the request-flow logic can be unit-tested without
+ * spinning up the full proxy. See issue #474.
+ */
+export function maybeInvalidateAffinityFromDisk(sessionAffinityStore, lastObservedGeneration, storagePath = getStoragePath()) {
+    const meta = readStorageMetaFromDisk(storagePath);
+    if (meta.affinityGeneration > lastObservedGeneration) {
+        sessionAffinityStore?.clearAll();
+        return meta.affinityGeneration;
+    }
+    return lastObservedGeneration;
+}

package/dist/lib/runtime/rotation-token-refresh.d.ts

@@ -0,0 +1,25 @@
+import type { AccountManager, ManagedAccount } from "../accounts.js";
+import type { ModelFamily } from "../prompts/codex.js";
+/** @internal */
+export declare const DEFAULT_AUTH_FAILURE_COOLDOWN_MS = 30000;
+/** @internal */
+export declare function applyMonotonicAuthCooldown(accountManager: AccountManager, account: ManagedAccount, cooldownMs: number): void;
+/** @internal */
+export declare function ensureFreshAccessToken(params: {
+    accountManager: AccountManager;
+    account: ManagedAccount;
+    family: ModelFamily;
+    model: string | null;
+    now: number;
+    tokenRefreshSkewMs: number;
+    tokenInvalidationCooldownMs: number;
+}): Promise<{
+    ok: true;
+    accessToken: string;
+    account: ManagedAccount;
+} | {
+    ok: false;
+    retryable: boolean;
+    invalidated?: boolean;
+}>;
+//# sourceMappingURL=rotation-token-refresh.d.ts.map

package/dist/lib/runtime/rotation-token-refresh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rotation-token-refresh.d.ts","sourceRoot":"","sources":["../../../lib/runtime/rotation-token-refresh.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAQvD,gBAAgB;AAChB,eAAO,MAAM,gCAAgC,QAAS,CAAC;AAMvD,gBAAgB;AAChB,wBAAgB,0BAA0B,CACzC,cAAc,EAAE,cAAc,EAC9B,OAAO,EAAE,cAAc,EACvB,UAAU,EAAE,MAAM,GAChB,IAAI,CAUN;AA6CD,gBAAgB;AAChB,wBAAsB,sBAAsB,CAAC,MAAM,EAAE;IACpD,cAAc,EAAE,cAAc,CAAC;IAC/B,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,WAAW,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,kBAAkB,EAAE,MAAM,CAAC;IAC3B,2BAA2B,EAAE,MAAM,CAAC;CACpC,GAAG,OAAO,CACR;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,cAAc,CAAA;CAAE,GAC1D;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,SAAS,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,OAAO,CAAA;CAAE,CAC1D,CAgEA"}