codex-multi-auth 2.6.0 → 2.7.0

package/dist/lib/auth/browser.d.ts

@@ -17,6 +17,10 @@ export declare function isBrowserLaunchSuppressed(): boolean;
  * OAuth codes) from `url` before calling. Invocations are not atomic—concurrent calls may race but are
  * safe to perform.
  *
+ * Under WSL the browser lives on the Windows host, so `xdg-open` is the wrong tool and is usually not
+ * even installed. Prefer `wslview` (wslu), then Windows PowerShell via interop, before falling back to
+ * the Linux opener.
+ *
  * @param url - The URL to open; redact sensitive tokens (e.g., OAuth codes) before passing.
  * @returns `true` if a browser launch was attempted, `false` if no suitable opener was available or an exception occurred.
  */

package/dist/lib/auth/browser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"browser.d.ts","sourceRoot":"","sources":["../../../lib/auth/browser.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAUH;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAKzC;AAED,wBAAgB,yBAAyB,IAAI,OAAO,CAQnD;AA6DD;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAwCnD;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAmDzD"}
+{"version":3,"file":"browser.d.ts","sourceRoot":"","sources":["../../../lib/auth/browser.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAWH;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAKzC;AAED,wBAAgB,yBAAyB,IAAI,OAAO,CAQnD;AAqGD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAyCnD;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CA8DzD"}

package/dist/lib/auth/browser.js

@@ -6,6 +6,7 @@ import { spawn } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
 import { PLATFORM_OPENERS } from "../constants.js";
+import { isWsl } from "../wsl.js";
 const BROWSER_DISABLED_VALUES = new Set(["0", "false", "no", "off", "none"]);
 const NO_BROWSER_TRUTHY_VALUES = new Set(["1", "true", "yes", "on"]);
 /**
@@ -89,6 +90,40 @@ function commandExists(command) {
     }
     return false;
 }
+/**
+ * Escape a value for safe interpolation into a double-quoted PowerShell string.
+ *
+ * Neutralizes backticks, `$` sub-expression injection, and embedded double quotes.
+ */
+function escapeForPowerShell(value) {
+    return value.replace(/`/g, "``").replace(/\$/g, "`$").replace(/"/g, '""');
+}
+/**
+ * Run a PowerShell command, fire-and-forget.
+ *
+ * Reachable from Windows and from WSL, where `powershell.exe` resolves through
+ * Windows/Linux PATH interop.
+ *
+ * @param command - A PowerShell command string; interpolated values must already be escaped.
+ * @param stdinText - Optional text piped to the command's stdin.
+ * @returns `true` if the spawn was attempted, `false` if PowerShell is unavailable.
+ */
+function spawnPowerShell(command, stdinText) {
+    if (!commandExists("powershell.exe")) {
+        return false;
+    }
+    const child = spawn("powershell.exe", ["-NoLogo", "-NoProfile", "-Command", command], {
+        stdio: stdinText === undefined ? "ignore" : ["pipe", "ignore", "ignore"],
+    });
+    child.on("error", () => { });
+    if (stdinText !== undefined) {
+        // A child that dies before draining stdin emits EPIPE on the stream, not
+        // on the child. Unhandled, that is an async throw no try/catch can catch.
+        child.stdin?.on("error", () => { });
+        child.stdin?.end(stdinText);
+    }
+    return true;
+}
 /**
  * Launches the user's default browser to open the provided URL using a platform-appropriate command.
  *
@@ -98,6 +133,10 @@ function commandExists(command) {
  * OAuth codes) from `url` before calling. Invocations are not atomic—concurrent calls may race but are
  * safe to perform.
  *
+ * Under WSL the browser lives on the Windows host, so `xdg-open` is the wrong tool and is usually not
+ * even installed. Prefer `wslview` (wslu), then Windows PowerShell via interop, before falling back to
+ * the Linux opener.
+ *
  * @param url - The URL to open; redact sensitive tokens (e.g., OAuth codes) before passing.
  * @returns `true` if a browser launch was attempted, `false` if no suitable opener was available or an exception occurred.
  */
@@ -108,17 +147,22 @@ export function openBrowserUrl(url) {
         }
         // Windows: use PowerShell Start-Process to avoid cmd/start quirks with URLs containing '&' or ':'
         if (process.platform === "win32") {
-            if (!commandExists("powershell.exe")) {
-                return false;
+            return spawnPowerShell(`Start-Process "${escapeForPowerShell(url)}"`);
+        }
+        if (isWsl()) {
+            // wslu's browser shim: hands the URL to the Windows default browser.
+            if (commandExists("wslview")) {
+                const child = spawn("wslview", [url], {
+                    stdio: "ignore",
+                    shell: false,
+                });
+                child.on("error", () => { });
+                return true;
             }
-            // Escape PowerShell special characters: backticks, double quotes, and $ (sub-expression injection)
-            const psUrl = url
-                .replace(/`/g, "``")
-                .replace(/\$/g, "`$")
-                .replace(/"/g, '""');
-            const child = spawn("powershell.exe", ["-NoLogo", "-NoProfile", "-Command", `Start-Process "${psUrl}"`], { stdio: "ignore" });
-            child.on("error", () => { });
-            return true;
+            if (spawnPowerShell(`Start-Process "${escapeForPowerShell(url)}"`)) {
+                return true;
+            }
+            // Fall through: an X/Wayland browser inside the distro is still possible.
         }
         const opener = getBrowserOpener();
         if (!commandExists(opener)) {
@@ -151,16 +195,24 @@ export function copyTextToClipboard(text) {
         if (!text)
             return false;
         if (process.platform === "win32") {
-            if (!commandExists("powershell.exe")) {
-                return false;
+            return spawnPowerShell(`Set-Clipboard -Value "${escapeForPowerShell(text)}"`);
+        }
+        if (isWsl()) {
+            // The clipboard the user pastes from is the Windows one, not the distro's.
+            if (commandExists("clip.exe")) {
+                const child = spawn("clip.exe", [], {
+                    stdio: ["pipe", "ignore", "ignore"],
+                    shell: false,
+                });
+                child.on("error", () => { });
+                child.stdin?.on("error", () => { });
+                child.stdin?.end(text);
+                return true;
             }
-            const psText = text
-                .replace(/`/g, "``")
-                .replace(/\$/g, "`$")
-                .replace(/"/g, '""');
-            const child = spawn("powershell.exe", ["-NoLogo", "-NoProfile", "-Command", `Set-Clipboard -Value "${psText}"`], { stdio: "ignore" });
-            child.on("error", () => { });
-            return true;
+            if (spawnPowerShell(`Set-Clipboard -Value "${escapeForPowerShell(text)}"`)) {
+                return true;
+            }
+            // Fall through to the Linux clipboard tools.
         }
         if (process.platform === "darwin") {
             if (!commandExists("pbcopy"))
@@ -170,6 +222,7 @@ export function copyTextToClipboard(text) {
                 shell: false,
             });
             child.on("error", () => { });
+            child.stdin?.on("error", () => { });
             child.stdin?.end(text);
             return true;
         }
@@ -186,6 +239,7 @@ export function copyTextToClipboard(text) {
                 shell: false,
             });
             child.on("error", () => { });
+            child.stdin?.on("error", () => { });
             child.stdin?.end(text);
             return true;
         }

package/dist/lib/auth/callback-guidance.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Operator-facing guidance for OAuth callback failures on the fixed callback port.
+ *
+ * The redirect URI is registered with the provider, so the port cannot be
+ * negotiated away when it is contended. The best the CLI can do is name the
+ * likely conflict and point at a flow that does not need the port at all.
+ *
+ * Windows and WSL contend for that port as far as a browser running on the
+ * Windows host is concerned, so a listener on either side can swallow a callback
+ * intended for the other. From inside the distro this is invisible: the WSL
+ * listener binds cleanly and simply never receives the redirect.
+ */
+/**
+ * Why the browser callback did not produce an authorization code.
+ *
+ * - `bind-failed`: the local listener could not take the callback port at all.
+ * - `callback-timeout`: the listener bound, but no redirect ever arrived.
+ */
+export type CallbackFailureReason = "bind-failed" | "callback-timeout";
+/** @internal */
+export type CallbackFailureContext = {
+    /** `errno` code from a failed listen, when one is known. */
+    bindErrorCode?: string;
+};
+/**
+ * Build the lines shown to the user when a browser OAuth callback fails.
+ *
+ * Contention is only *asserted* when it was actually observed — that is, the
+ * listen failed with `EADDRINUSE`. A callback that never arrives is far more
+ * often a cancelled or abandoned sign-in than a stolen redirect, so that case
+ * is phrased as a conditional ("if you completed sign-in and still landed
+ * here") rather than a diagnosis.
+ *
+ * @param reason - Which half of the callback flow broke.
+ * @param context - Extra detail from the failed bind, when available.
+ * @returns Guidance lines. Empty strings are intentional blank separators.
+ */
+export declare function describeCallbackFailure(reason: CallbackFailureReason, context?: CallbackFailureContext): string[];
+//# sourceMappingURL=callback-guidance.d.ts.map

package/dist/lib/auth/callback-guidance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"callback-guidance.d.ts","sourceRoot":"","sources":["../../../lib/auth/callback-guidance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH;;;;;GAKG;AACH,MAAM,MAAM,qBAAqB,GAAG,aAAa,GAAG,kBAAkB,CAAC;AAEvE,gBAAgB;AAChB,MAAM,MAAM,sBAAsB,GAAG;IACpC,4DAA4D;IAC5D,aAAa,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AA4CF;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CACtC,MAAM,EAAE,qBAAqB,EAC7B,OAAO,GAAE,sBAA2B,GAClC,MAAM,EAAE,CA0CV"}

package/dist/lib/auth/callback-guidance.js

@@ -0,0 +1,106 @@
+/**
+ * Operator-facing guidance for OAuth callback failures on the fixed callback port.
+ *
+ * The redirect URI is registered with the provider, so the port cannot be
+ * negotiated away when it is contended. The best the CLI can do is name the
+ * likely conflict and point at a flow that does not need the port at all.
+ *
+ * Windows and WSL contend for that port as far as a browser running on the
+ * Windows host is concerned, so a listener on either side can swallow a callback
+ * intended for the other. From inside the distro this is invisible: the WSL
+ * listener binds cleanly and simply never receives the redirect.
+ */
+import { AUTH_REDIRECT } from "./auth.js";
+import { getWslDistroName, isWsl } from "../wsl.js";
+const INSPECT_WINDOWS = `  Windows (PowerShell):  Get-NetTCPConnection -LocalPort ${AUTH_REDIRECT.port}`;
+const INSPECT_LINUX = `  Linux / WSL:           ss -lptn 'sport = :${AUTH_REDIRECT.port}'`;
+const INSPECT_DARWIN = `  macOS:                 lsof -nP -iTCP:${AUTH_REDIRECT.port} -sTCP:LISTEN`;
+const USE_DEVICE_AUTH = "  Or sign in without the callback port: codex-multi-auth login --device-auth";
+/**
+ * The commands that would reveal a listener on the callback port here.
+ *
+ * Inside WSL both sides of the boundary are worth checking, because the
+ * offending listener is usually the one on the Windows host.
+ */
+function inspectCommands() {
+    if (isWsl())
+        return [INSPECT_WINDOWS, INSPECT_LINUX];
+    if (process.platform === "win32")
+        return [INSPECT_WINDOWS];
+    if (process.platform === "darwin")
+        return [INSPECT_DARWIN];
+    return [INSPECT_LINUX];
+}
+/**
+ * Why a listener on the other side of the Windows/WSL boundary may be at fault.
+ *
+ * @returns Explanatory lines, or an empty array when no WSL boundary is in play.
+ */
+function crossBoundaryNote() {
+    if (isWsl()) {
+        const distro = getWslDistroName();
+        const where = distro ? `WSL (${distro})` : "WSL";
+        return [
+            `You are running inside ${where}, but the browser opens on the Windows host.`,
+            `Windows and ${where} contend for localhost:${AUTH_REDIRECT.port}, so a codex-multi-auth`,
+            "or Codex login or proxy on the Windows side can take the callback meant for this one.",
+        ];
+    }
+    if (process.platform === "win32") {
+        return [
+            `A codex-multi-auth login or proxy running inside WSL can also hold port ${AUTH_REDIRECT.port}.`,
+        ];
+    }
+    return [];
+}
+/**
+ * Build the lines shown to the user when a browser OAuth callback fails.
+ *
+ * Contention is only *asserted* when it was actually observed — that is, the
+ * listen failed with `EADDRINUSE`. A callback that never arrives is far more
+ * often a cancelled or abandoned sign-in than a stolen redirect, so that case
+ * is phrased as a conditional ("if you completed sign-in and still landed
+ * here") rather than a diagnosis.
+ *
+ * @param reason - Which half of the callback flow broke.
+ * @param context - Extra detail from the failed bind, when available.
+ * @returns Guidance lines. Empty strings are intentional blank separators.
+ */
+export function describeCallbackFailure(reason, context = {}) {
+    const port = AUTH_REDIRECT.port;
+    if (reason === "bind-failed") {
+        // A failed listen is hard evidence: something is on the port right now.
+        if (context.bindErrorCode === "EADDRINUSE") {
+            return [
+                `Could not listen on port ${port} for the OAuth callback — another process already holds it.`,
+                ...crossBoundaryNote(),
+                "",
+                `Find the listener:`,
+                ...inspectCommands(),
+                "",
+                "Close it, then retry.",
+                USE_DEVICE_AUTH,
+            ];
+        }
+        return [
+            `Could not listen on port ${port} for the OAuth callback${context.bindErrorCode ? ` (${context.bindErrorCode})` : ""}.`,
+            "",
+            "The callback port is fixed by the provider and cannot be changed.",
+            USE_DEVICE_AUTH,
+        ];
+    }
+    // The listener bound cleanly and nothing arrived. Usually the sign-in was
+    // simply cancelled or abandoned — say so first, and do not misdiagnose it.
+    return [
+        `No OAuth callback arrived on port ${port} before the sign-in window closed.`,
+        "",
+        "If you closed or cancelled the browser sign-in, just run login again.",
+        "",
+        "If you completed sign-in in the browser and still landed here, something else",
+        `may have taken the callback on port ${port}:`,
+        ...crossBoundaryNote(),
+        ...inspectCommands(),
+        "",
+        USE_DEVICE_AUTH,
+    ];
+}

package/dist/lib/auth/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../lib/auth/server.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAWnD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,qBAAqB,CAAC,EACrC,KAAK,GACL,EAAE;IACF,KAAK,EAAE,MAAM,CAAC;CACd,GAAG,OAAO,CAAC,eAAe,CAAC,CAgH3B"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../lib/auth/server.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAWnD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,qBAAqB,CAAC,EACrC,KAAK,GACL,EAAE;IACF,KAAK,EAAE,MAAM,CAAC;CACd,GAAG,OAAO,CAAC,eAAe,CAAC,CAiH3B"}

package/dist/lib/auth/server.js

@@ -112,6 +112,7 @@ export function startLocalOAuthServer({ state, }) {
             resolve({
                 port: AUTH_REDIRECT.port,
                 ready: false,
+                bindErrorCode: err?.code,
                 close: () => {
                     pollAborted = true;
                     try {

package/dist/lib/codex-manager/formatters/quota-formatters.d.ts

@@ -2,8 +2,25 @@ import type { DashboardDisplaySettings } from "../../dashboard-settings.js";
 import type { QuotaCacheEntry } from "../../quota-cache.js";
 import { type CodexQuotaSnapshot, fetchCodexQuotaSnapshot } from "../../quota-probe.js";
 export declare function styleQuotaSummary(summary: string): string;
-export declare function formatQuotaSnapshotForDashboard(snapshot: Awaited<ReturnType<typeof fetchCodexQuotaSnapshot>>, settings: DashboardDisplaySettings): string;
+/**
+ * Render the per-account health line printed by `codex-multi-auth check`.
+ *
+ * `check` is the only caller, and unlike the dashboard rows and account menu it
+ * prints one account per line with no width pressure, so it opts into the
+ * absolute reset clock for each quota window.
+ */
+export declare function formatQuotaSnapshotForDashboard(snapshot: Awaited<ReturnType<typeof fetchCodexQuotaSnapshot>>, settings: DashboardDisplaySettings, now?: number): string;
 export declare function quotaCacheEntryToSnapshot(entry: QuotaCacheEntry): CodexQuotaSnapshot;
-export declare function formatCompactQuotaSnapshot(snapshot: CodexQuotaSnapshot, now?: number): string;
-export declare function formatAccountQuotaSummary(entry: QuotaCacheEntry, now?: number): string;
+/**
+ * Options shared by the compact quota formatters.
+ *
+ * `showReset` is opt-in so that space-constrained surfaces (dashboard rows, the
+ * account menu, forecast lines) keep their existing single-line width, while
+ * `codex-multi-auth check` can append the absolute reset time.
+ */
+export interface CompactQuotaFormatOptions {
+    showReset?: boolean;
+}
+export declare function formatCompactQuotaSnapshot(snapshot: CodexQuotaSnapshot, now?: number, options?: CompactQuotaFormatOptions): string;
+export declare function formatAccountQuotaSummary(entry: QuotaCacheEntry, now?: number, options?: CompactQuotaFormatOptions): string;
 //# sourceMappingURL=quota-formatters.d.ts.map

package/dist/lib/codex-manager/formatters/quota-formatters.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"quota-formatters.d.ts","sourceRoot":"","sources":["../../../../lib/codex-manager/formatters/quota-formatters.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAC5E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EACN,KAAK,kBAAkB,EACvB,uBAAuB,EAEvB,MAAM,sBAAsB,CAAC;AAY9B,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CA8BzD;AAED,wBAAgB,+BAA+B,CAC9C,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC,EAC7D,QAAQ,EAAE,wBAAwB,GAChC,MAAM,CAGR;AAED,wBAAgB,yBAAyB,CACxC,KAAK,EAAE,eAAe,GACpB,kBAAkB,CAgBpB;AAyBD,wBAAgB,0BAA0B,CACzC,QAAQ,EAAE,kBAAkB,EAC5B,GAAG,SAAa,GACd,MAAM,CAuBR;AAED,wBAAgB,yBAAyB,CACxC,KAAK,EAAE,eAAe,EACtB,GAAG,SAAa,GACd,MAAM,CAuBR"}
+{"version":3,"file":"quota-formatters.d.ts","sourceRoot":"","sources":["../../../../lib/codex-manager/formatters/quota-formatters.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAC5E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EACN,KAAK,kBAAkB,EACvB,uBAAuB,EAGvB,MAAM,sBAAsB,CAAC;AAY9B,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAmCzD;AAED;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAC9C,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC,EAC7D,QAAQ,EAAE,wBAAwB,EAClC,GAAG,SAAa,GACd,MAAM,CAGR;AAED,wBAAgB,yBAAyB,CACxC,KAAK,EAAE,eAAe,GACpB,kBAAkB,CAgBpB;AAaD;;;;;;GAMG;AACH,MAAM,WAAW,yBAAyB;IACzC,SAAS,CAAC,EAAE,OAAO,CAAC;CACpB;AAqBD,wBAAgB,0BAA0B,CACzC,QAAQ,EAAE,kBAAkB,EAC5B,GAAG,SAAa,EAChB,OAAO,GAAE,yBAA8B,GACrC,MAAM,CA6BR;AAED,wBAAgB,yBAAyB,CACxC,KAAK,EAAE,eAAe,EACtB,GAAG,SAAa,EAChB,OAAO,GAAE,yBAA8B,GACrC,MAAM,CA6BR"}

package/dist/lib/codex-manager/formatters/quota-formatters.js

@@ -1,4 +1,4 @@
-import { formatQuotaSnapshotLine, } from "../../quota-probe.js";
+import { formatQuotaResetAt, formatQuotaSnapshotLine, } from "../../quota-probe.js";
 import { isQuotaCacheEntryExhausted, quotaLeftPercentFromUsed, } from "../../quota-readiness.js";
 import { quotaToneFromLeftPercent } from "../../ui/format.js";
 import { collapseWhitespace, joinStyledSegments, stylePromptText, } from "./text-style.js";
@@ -16,7 +16,7 @@ export function styleQuotaSummary(summary) {
         if (/rate-limited/i.test(segment)) {
             return stylePromptText(segment, "danger");
         }
-        const match = segment.match(/^([0-9a-zA-Z]+)\s+(\d{1,3})%$/);
+        const match = segment.match(/^([0-9a-zA-Z]+)\s+(\d{1,3})%(,\s*resets\s+\S.*)?$/);
         if (!match) {
             return stylePromptText(segment, "muted");
         }
@@ -26,14 +26,24 @@ export function styleQuotaSummary(summary) {
             return stylePromptText(segment, "muted");
         }
         const tone = quotaToneFromLeftPercent(leftPercent);
-        return `${stylePromptText(windowLabel, "muted")} ${stylePromptText(`${leftPercent}%`, tone)}`;
+        const resetSuffix = match[3]
+            ? stylePromptText(match[3], "muted")
+            : "";
+        return `${stylePromptText(windowLabel, "muted")} ${stylePromptText(`${leftPercent}%`, tone)}${resetSuffix}`;
     });
     return joinStyledSegments(rendered);
 }
-export function formatQuotaSnapshotForDashboard(snapshot, settings) {
+/**
+ * Render the per-account health line printed by `codex-multi-auth check`.
+ *
+ * `check` is the only caller, and unlike the dashboard rows and account menu it
+ * prints one account per line with no width pressure, so it opts into the
+ * absolute reset clock for each quota window.
+ */
+export function formatQuotaSnapshotForDashboard(snapshot, settings, now = Date.now()) {
     if (!settings.showQuotaDetails)
         return "live session OK";
-    return `live session OK (${formatCompactQuotaSnapshot(snapshot)})`;
+    return `live session OK (${formatCompactQuotaSnapshot(snapshot, now, { showReset: true })})`;
 }
 export function quotaCacheEntryToSnapshot(entry) {
     return {
@@ -62,18 +72,23 @@ function formatCompactQuotaWindowLabel(windowMinutes) {
         return `${windowMinutes / 60}h`;
     return `${windowMinutes}m`;
 }
-function formatCompactQuotaPart(windowMinutes, usedPercent) {
+function formatCompactQuotaPart(windowMinutes, usedPercent, resetAtMs, options, now) {
     const label = formatCompactQuotaWindowLabel(windowMinutes);
     if (typeof usedPercent !== "number" || !Number.isFinite(usedPercent)) {
         return null;
     }
     const left = quotaLeftPercentFromUsed(usedPercent);
-    return `${label} ${left}%`;
+    const part = `${label} ${left}%`;
+    if (!options.showReset)
+        return part;
+    // A missing or malformed reset timestamp must never drop the percentage.
+    const reset = formatQuotaResetAt(resetAtMs, now);
+    return reset ? `${part}, resets ${reset}` : part;
 }
-export function formatCompactQuotaSnapshot(snapshot, now = Date.now()) {
+export function formatCompactQuotaSnapshot(snapshot, now = Date.now(), options = {}) {
     const parts = [
-        formatCompactQuotaPart(snapshot.primary.windowMinutes, snapshot.primary.usedPercent),
-        formatCompactQuotaPart(snapshot.secondary.windowMinutes, snapshot.secondary.usedPercent),
+        formatCompactQuotaPart(snapshot.primary.windowMinutes, snapshot.primary.usedPercent, snapshot.primary.resetAtMs, options, now),
+        formatCompactQuotaPart(snapshot.secondary.windowMinutes, snapshot.secondary.usedPercent, snapshot.secondary.resetAtMs, options, now),
     ].filter((value) => typeof value === "string" && value.length > 0);
     if (snapshot.status === 429) {
         parts.push("rate-limited");
@@ -86,10 +101,10 @@ export function formatCompactQuotaSnapshot(snapshot, now = Date.now()) {
     }
     return formatQuotaSnapshotLine(snapshot);
 }
-export function formatAccountQuotaSummary(entry, now = Date.now()) {
+export function formatAccountQuotaSummary(entry, now = Date.now(), options = {}) {
     const parts = [
-        formatCompactQuotaPart(entry.primary.windowMinutes, entry.primary.usedPercent),
-        formatCompactQuotaPart(entry.secondary.windowMinutes, entry.secondary.usedPercent),
+        formatCompactQuotaPart(entry.primary.windowMinutes, entry.primary.usedPercent, entry.primary.resetAtMs, options, now),
+        formatCompactQuotaPart(entry.secondary.windowMinutes, entry.secondary.usedPercent, entry.secondary.resetAtMs, options, now),
     ].filter((value) => typeof value === "string" && value.length > 0);
     if (entry.status === 429) {
         parts.push("rate-limited");

package/dist/lib/codex-manager/help.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"help.d.ts","sourceRoot":"","sources":["../../../lib/codex-manager/help.ts"],"names":[],"mappings":"AAIA,wBAAgB,UAAU,IAAI,IAAI,CAkDjC;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC9B,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAC5B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,gBAAgB,CAAA;CAAE,GACvC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC7B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,mBAAmB,CAgEtE;AAED,UAAU,cAAc;IACvB,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,MAAM,cAAc,GACvB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,cAAc,CAAA;CAAE,GACrC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC7B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnD,wBAAgB,cAAc,IAAI,IAAI,CAgBrC;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,cAAc,CAyD5D"}
+{"version":3,"file":"help.d.ts","sourceRoot":"","sources":["../../../lib/codex-manager/help.ts"],"names":[],"mappings":"AAIA,wBAAgB,UAAU,IAAI,IAAI,CAsDjC;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC9B,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAC5B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,gBAAgB,CAAA;CAAE,GACvC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC7B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,mBAAmB,CAgEtE;AAED,UAAU,cAAc;IACvB,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,MAAM,cAAc,GACvB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,cAAc,CAAA;CAAE,GACrC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC7B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnD,wBAAgB,cAAc,IAAI,IAAI,CAgBrC;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,cAAc,CAyD5D"}

package/dist/lib/codex-manager/help.js

@@ -6,46 +6,50 @@ export function printUsage() {
         "",
         "Start here:",
         "  codex-multi-auth login [--device-auth|--manual|--no-browser] [--org <org_id>]",
-        "  codex-multi-auth status",
-        "  codex-multi-auth check",
+        "  codex-multi-auth status [--json]   (list is the same command)",
+        "  codex-multi-auth check            (always live-probes)",
         "",
         "Daily use:",
-        "  codex-multi-auth list",
+        "  codex-multi-auth list [--json]",
         "  codex-multi-auth switch <index>   (pins the account for runtime routing)",
         "  codex-multi-auth unpin            (clears the manual pin set by switch)",
         "  codex-multi-auth workspace <account> [workspace]   (list or switch an account's workspaces)",
         "  codex-multi-auth best [--live] [--json] [--model <model>]   (clears any manual pin set by switch)",
-        "  codex-multi-auth forecast [--live] [--json] [--model <model>]",
-        "  codex-multi-auth account tag|untag|weight|pause|unpause|drain|undrain|note ...",
+        "  codex-multi-auth forecast [--live] [--json] [--explain] [--model <model>] [--no-runtime-overlay]",
+        "  codex-multi-auth account tag|untag|weight|pause|unpause|drain|undrain|note|policy list ...",
         "",
         "Repair:",
         "  codex-multi-auth uninstall [--dry-run] [--json] [--clear-accounts]",
-        "  codex-multi-auth verify-flagged [--dry-run] [--json] [--no-restore]",
+        "  codex-multi-auth verify-flagged [--dry-run|-n] [--json] [--no-restore]",
         "  codex-multi-auth verify [--paths | --flagged | --all] [--json]",
-        "  codex-multi-auth fix [--dry-run] [--json] [--live] [--model <model>]",
-        "  codex-multi-auth doctor [--json] [--fix] [--dry-run]",
+        "  codex-multi-auth fix [--dry-run|-n] [--json] [--live] [--model <model>]",
+        "  codex-multi-auth doctor [--json] [--fix] [--dry-run|-n]   (--dry-run requires --fix)",
         "",
         "Diagnostics:",
         "  codex-multi-auth usage [--since <time|duration>] [--by <group>] [--json|--csv] [--out <path>]",
-        "  codex-multi-auth budget limit|check|list ...",
-        "  codex-multi-auth bridge token create|list|rotate|revoke",
+        "  codex-multi-auth usage rotate [--if-larger-than-bytes <n>] [--json]",
+        "  codex-multi-auth budget limit <key> --window <hour|day|week|month> [--requests N] [--tokens N] [--cost USD]",
+        "  codex-multi-auth budget check|list [--json]",
+        "  codex-multi-auth bridge token create|list|rotate|revoke [--json]",
         "  codex-multi-auth integrations [--kind <name>] [--base-url <url>] [--model <model>] [--json]",
         "  codex-multi-auth models [--json] [--model <model>]",
         "  codex-multi-auth monitor [--json]",
-        "  codex-multi-auth rotation <enable|disable|status|bind-app|unbind-app>",
+        "  codex-multi-auth rotation <enable|disable|status|bind-app|unbind-app|reset-runtime>",
         "  codex-multi-auth rotation reset-rate-limits [--all | --account <idx>] [--dry-run] [--json]",
-        "  codex-multi-auth why-selected [--now | --last] [--json]",
+        "  codex-multi-auth why-selected [--now|-n | --last|-l] [--json]",
         "  codex-multi-auth history [list|show <id>] [--json]   (all local sessions, ignores /resume provider filtering)",
         "",
         "Advanced:",
-        "  codex-multi-auth report [--live] [--json] [--explain] [--model <model>] [--out <path>]",
+        "  codex-multi-auth report [--live] [--json] [--explain] [--model <model>] [--max-accounts <n>] [--max-probes <n>] [--cached-only] [--out <path>]",
         "  codex-multi-auth config explain [--json]",
+        "  codex-multi-auth config template|init-config [modern|legacy|minimal] [--write <path>] [--stdout]",
         "  codex-multi-auth debug bundle [--json]",
-        "  codex-multi-auth features",
+        "  codex-multi-auth features   (partial built-in checklist; see docs/features.md for the full product map)",
         "",
         "Notes:",
         "  - Uses ~/.codex/multi-auth/openai-codex-accounts.json",
         "  - Syncs active account into Codex CLI auth state",
+        "  - Default live probe model: " + DEFAULT_LIVE_PROBE_MODEL,
         "  - See docs/reference/commands.md for the full command and flag matrix",
     ].join("\n"));
 }

package/dist/lib/codex-manager/login-oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login-oauth.d.ts","sourceRoot":"","sources":["../../../lib/codex-manager/login-oauth.ts"],"names":[],"mappings":"AAEA,OAAO,EAON,KAAK,SAAS,EACd,MAAM,gBAAgB,CAAC;AAqBxB,OAAO,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEhE,OAAO,EACN,KAAK,uBAAuB,EAG5B,MAAM,yBAAyB,CAAC;AAOjC;;;;;GAKG;AAEH,gBAAgB;AAChB,MAAM,MAAM,YAAY,GAAG,OAAO,CAAC,WAAW,EAAE;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,CAAC,CAAC;AACrE,gBAAgB;AAChB,MAAM,MAAM,uBAAuB,GAAG,YAAY,GAAG;IACpD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;CACzB,CAAC;AAIF,gBAAgB;AAChB,wBAAgB,mBAAmB,CAClC,MAAM,EAAE,OAAO,CAAC,WAAW,EAAE;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,CAAC,GAC/C,OAAO,CAGT;AAED,gBAAgB;AAChB,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAIpD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CACtC,MAAM,EAAE,YAAY,EACpB,WAAW,CAAC,EAAE,MAAM,GAClB,uBAAuB,CA+DzB;AA0FD,gBAAgB;AAChB,MAAM,MAAM,eAAe,GACxB,SAAS,GACT,QAAQ,GACR,QAAQ,GACR,gBAAgB,GAChB,QAAQ,CAAC;AACZ,gBAAgB;AAChB,MAAM,MAAM,iBAAiB,GAAG;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,gBAAgB;AAChB,wBAAsB,YAAY,CACjC,aAAa,EAAE,OAAO,EACtB,UAAU,EAAE,OAAO,CAAC,eAAe,EAAE,SAAS,GAAG,QAAQ,CAAC,GACxD,OAAO,CAAC,WAAW,CAAC,CAwHtB;AAED,gBAAgB;AAChB,wBAAsB,aAAa,CAClC,aAAa,EAAE,OAAO,EACtB,UAAU,EAAE,OAAO,CAAC,eAAe,EAAE,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAC,EACrE,OAAO,GAAE,iBAAsB,GAC7B,OAAO,CAAC,WAAW,CAAC,CAetB;AAED,gBAAgB;AAChB,MAAM,MAAM,yBAAyB,GAAG,uBAAuB,CAAC;AAEhE,gBAAgB;AAChB,wBAAsB,kBAAkB,CACvC,OAAO,EAAE,uBAAuB,EAAE,EAClC,UAAU,EAAE,OAAO,GACjB,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC,CAuD3C;AAED,gBAAgB;AAChB,wBAAsB,oBAAoB,CACzC,MAAM,EAAE,uBAAuB,GAC7B,OAAO,CAAC,IAAI,CAAC,CAkBf"}
+{"version":3,"file":"login-oauth.d.ts","sourceRoot":"","sources":["../../../lib/codex-manager/login-oauth.ts"],"names":[],"mappings":"AAEA,OAAO,EAON,KAAK,SAAS,EACd,MAAM,gBAAgB,CAAC;AAsBxB,OAAO,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEhE,OAAO,EACN,KAAK,uBAAuB,EAG5B,MAAM,yBAAyB,CAAC;AAOjC;;;;;GAKG;AAEH,gBAAgB;AAChB,MAAM,MAAM,YAAY,GAAG,OAAO,CAAC,WAAW,EAAE;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,CAAC,CAAC;AACrE,gBAAgB;AAChB,MAAM,MAAM,uBAAuB,GAAG,YAAY,GAAG;IACpD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;CACzB,CAAC;AAIF,gBAAgB;AAChB,wBAAgB,mBAAmB,CAClC,MAAM,EAAE,OAAO,CAAC,WAAW,EAAE;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,CAAC,GAC/C,OAAO,CAGT;AAED,gBAAgB;AAChB,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAIpD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CACtC,MAAM,EAAE,YAAY,EACpB,WAAW,CAAC,EAAE,MAAM,GAClB,uBAAuB,CA+DzB;AA0FD,gBAAgB;AAChB,MAAM,MAAM,eAAe,GACxB,SAAS,GACT,QAAQ,GACR,QAAQ,GACR,gBAAgB,GAChB,QAAQ,CAAC;AACZ,gBAAgB;AAChB,MAAM,MAAM,iBAAiB,GAAG;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,gBAAgB;AAChB,wBAAsB,YAAY,CACjC,aAAa,EAAE,OAAO,EACtB,UAAU,EAAE,OAAO,CAAC,eAAe,EAAE,SAAS,GAAG,QAAQ,CAAC,GACxD,OAAO,CAAC,WAAW,CAAC,CAsItB;AAED,gBAAgB;AAChB,wBAAsB,aAAa,CAClC,aAAa,EAAE,OAAO,EACtB,UAAU,EAAE,OAAO,CAAC,eAAe,EAAE,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAC,EACrE,OAAO,GAAE,iBAAsB,GAC7B,OAAO,CAAC,WAAW,CAAC,CAetB;AAED,gBAAgB;AAChB,MAAM,MAAM,yBAAyB,GAAG,uBAAuB,CAAC;AAEhE,gBAAgB;AAChB,wBAAsB,kBAAkB,CACvC,OAAO,EAAE,uBAAuB,EAAE,EAClC,UAAU,EAAE,OAAO,GACjB,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC,CAuD3C;AAED,gBAAgB;AAChB,wBAAsB,oBAAoB,CACzC,MAAM,EAAE,uBAAuB,GAC7B,OAAO,CAAC,IAAI,CAAC,CAkBf"}

package/dist/lib/codex-manager/login-oauth.js

@@ -6,6 +6,7 @@ import { copyTextToClipboard, openBrowserUrl, } from "../auth/browser.js";
 import { runDeviceAuthFlow } from "../auth/device-auth.js";
 import { resolveOrgOverride } from "../auth/org-override.js";
 import { startLocalOAuthServer } from "../auth/server.js";
+import { describeCallbackFailure } from "../auth/callback-guidance.js";
 import { setCodexCliActiveSelection } from "../codex-cli/writer.js";
 import { createLogger } from "../logger.js";
 import { MODEL_FAMILIES } from "../prompts/codex.js";
@@ -230,6 +231,16 @@ export async function runOAuthFlow(forceNewLogin, signInMode) {
                 : signInMode === "manual"
                     ? UI_COPY.oauth.callbackBypassed
                     : UI_COPY.oauth.callbackUnavailable, "warning"));
+            // Explain *why* the callback failed before dropping the user into the
+            // manual-paste prompt. A contended port 1455 — most often a Windows
+            // listener shadowing a WSL one, or vice versa — otherwise presents as
+            // an unexplained broken login.
+            if (signInMode === "browser") {
+                const failureLines = describeCallbackFailure(waitingForCallback ? "callback-timeout" : "bind-failed", { bindErrorCode: oauthServer?.bindErrorCode });
+                for (const line of failureLines) {
+                    console.log(line.length > 0 ? stylePromptText(line, "muted") : "");
+                }
+            }
             const manualResult = await promptManualCallback(state, {
                 allowNonTty: signInMode === "manual",
             });

package/dist/lib/codex-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codex-manager.d.ts","sourceRoot":"","sources":["../../lib/codex-manager.ts"],"names":[],"mappings":"AAqFA,OAAO,EAEN,mBAAmB,EAMnB,sBAAsB,EAGtB,MAAM,qCAAqC,CAAC;AAiD7C,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,CAAC;AA+HvD,wBAAsB,4BAA4B,IAAI,OAAO,CAAC,OAAO,CAAC,CAuGrE;AAwRD,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA4C7E"}
+{"version":3,"file":"codex-manager.d.ts","sourceRoot":"","sources":["../../lib/codex-manager.ts"],"names":[],"mappings":"AAqFA,OAAO,EAEN,mBAAmB,EAMnB,sBAAsB,EAGtB,MAAM,qCAAqC,CAAC;AAiD7C,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,CAAC;AA4IvD,wBAAsB,4BAA4B,IAAI,OAAO,CAAC,OAAO,CAAC,CAuGrE;AAwRD,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA4C7E"}

package/dist/lib/codex-manager.js

@@ -113,6 +113,19 @@ const IMPLEMENTED_FEATURES = [
     { id: 39, name: "Unified color/theme runtime (v2 UI)" },
     { id: 40, name: "OAuth browser-first flow with manual callback fallback" },
     { id: 41, name: "Auto-switch to best account command" },
+    { id: 42, name: "Device-code OAuth login (--device-auth)" },
+    { id: 43, name: "Workspace/org-bound login (--org)" },
+    { id: 44, name: "Manual pin, unpin, and affinity-generation invalidation" },
+    { id: 45, name: "Per-account workspace selection command" },
+    { id: 46, name: "Default-on runtime Responses rotation proxy" },
+    { id: 47, name: "Reversible packaged Codex app bind and launcher routing" },
+    { id: 48, name: "Local usage ledger, budgets, and account policies" },
+    { id: 49, name: "Routing profiles and model capability matrix" },
+    { id: 50, name: "Local bridge tokens and integration snippets" },
+    { id: 51, name: "Provider-agnostic local history listing" },
+    { id: 52, name: "Why-selected and monitor diagnostics" },
+    { id: 53, name: "Config explain, init-config templates, and debug bundle" },
+    { id: 54, name: "mcodex convenience launcher (monitor/tmux/forward)" },
 ];
 async function runForecast(args) {
     return runForecastCommand(args, {

package/dist/lib/quota-probe.d.ts

@@ -32,6 +32,19 @@ export interface CodexQuotaSnapshot {
     secondary: CodexQuotaWindow;
     model: string;
 }
+/**
+ * Format a millisecond epoch timestamp into a concise human-readable reset time.
+ *
+ * Returns a 24-hour time "HH:MM" when the timestamp is today, otherwise "HH:MM on Mon DD".
+ *
+ * This function has no side effects, is safe for concurrent use, does not access the filesystem,
+ * and produces no sensitive token data.
+ *
+ * @param resetAtMs - Timestamp in milliseconds since epoch; if `undefined`, non-finite, or <= 0, the function returns `undefined`.
+ * @param nowMs - Reference timestamp used for the "is today" comparison; defaults to the current time.
+ * @returns The formatted reset time string, or `undefined` if `resetAtMs` is invalid or not provided.
+ */
+export declare function formatQuotaResetAt(resetAtMs: number | undefined, nowMs?: number): string | undefined;
 /**
  * Produce a single-line human-readable summary of a Codex quota snapshot.
  *

package/dist/lib/quota-probe.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"quota-probe.d.ts","sourceRoot":"","sources":["../../lib/quota-probe.ts"],"names":[],"mappings":"AAYA;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,yCAAyC,CAAC;AAEnF;;;;;;;;;;;;GAYG;AACH,wBAAgB,yBAAyB,CACxC,KAAK,EAAE,OAAO,EACd,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GACrC,MAAM,CAMR;AAED,MAAM,WAAW,gBAAgB;IAChC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,gBAAgB,CAAC;IAC1B,SAAS,EAAE,gBAAgB,CAAC;IAC5B,KAAK,EAAE,MAAM,CAAC;CACd;AAiQD;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,MAAM,CAa5E;AAED,MAAM,WAAW,sBAAsB;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,uBAAuB,CAC5C,OAAO,EAAE,sBAAsB,GAC7B,OAAO,CAAC,kBAAkB,CAAC,CA4G7B"}
+{"version":3,"file":"quota-probe.d.ts","sourceRoot":"","sources":["../../lib/quota-probe.ts"],"names":[],"mappings":"AAYA;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,yCAAyC,CAAC;AAEnF;;;;;;;;;;;;GAYG;AACH,wBAAgB,yBAAyB,CACxC,KAAK,EAAE,OAAO,EACd,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GACrC,MAAM,CAMR;AAED,MAAM,WAAW,gBAAgB;IAChC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,gBAAgB,CAAC;IAC1B,SAAS,EAAE,gBAAgB,CAAC;IAC5B,KAAK,EAAE,MAAM,CAAC;CACd;AA0MD;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CACjC,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,KAAK,SAAa,GAChB,MAAM,GAAG,SAAS,CAqBpB;AAwBD;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,MAAM,CAa5E;AAED,MAAM,WAAW,sBAAsB;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,uBAAuB,CAC5C,OAAO,EAAE,sBAAsB,GAC7B,OAAO,CAAC,kBAAkB,CAAC,CA4G7B"}