codex-multi-auth 2.6.1 → 2.7.1

package/dist/lib/quota-probe.js

@@ -228,16 +228,18 @@ function formatQuotaWindowLabel(windowMinutes) {
  * and produces no sensitive token data.
  *
  * @param resetAtMs - Timestamp in milliseconds since epoch; if `undefined`, non-finite, or <= 0, the function returns `undefined`.
+ * @param nowMs - Reference timestamp used for the "is today" comparison; defaults to the current time.
  * @returns The formatted reset time string, or `undefined` if `resetAtMs` is invalid or not provided.
  */
-function formatResetAt(resetAtMs) {
+export function formatQuotaResetAt(resetAtMs, nowMs = Date.now()) {
     if (!resetAtMs || !Number.isFinite(resetAtMs) || resetAtMs <= 0)
         return undefined;
     const date = new Date(resetAtMs);
     if (!Number.isFinite(date.getTime()))
         return undefined;
-    const now = new Date();
-    const sameDay = now.getFullYear() === date.getFullYear() &&
+    const now = new Date(nowMs);
+    const sameDay = Number.isFinite(now.getTime()) &&
+        now.getFullYear() === date.getFullYear() &&
         now.getMonth() === date.getMonth() &&
         now.getDate() === date.getDate();
     const time = date.toLocaleTimeString(undefined, {
@@ -264,7 +266,7 @@ function formatWindowSummary(label, window) {
     const left = typeof used === "number" && Number.isFinite(used)
         ? Math.max(0, Math.min(100, Math.round(100 - used)))
         : undefined;
-    const reset = formatResetAt(window.resetAtMs);
+    const reset = formatQuotaResetAt(window.resetAtMs);
     let summary = label;
     if (left !== undefined)
         summary = `${summary} ${left}% left`;

package/dist/lib/quota-readiness.d.ts

@@ -11,6 +11,7 @@ export type QuotaEmailFallbackState = {
 export declare function buildQuotaEmailFallbackState(accounts: readonly QuotaCacheAccountRef[]): ReadonlyMap<string, QuotaEmailFallbackState>;
 export declare function hasSafeQuotaEmailFallback(emailFallbackState: ReadonlyMap<string, QuotaEmailFallbackState>, account: QuotaCacheAccountRef): boolean;
 export declare function quotaLeftPercentFromUsed(usedPercent: number | undefined): number | undefined;
+export declare function quotaUsedPercentIsExhausted(usedPercent: number | undefined): boolean;
 export declare function isQuotaCacheEntryExhausted(entry: Pick<QuotaCacheEntry, "primary" | "secondary"> & {
     updatedAt?: number;
 } | null | undefined, now?: number): boolean;

package/dist/lib/quota-readiness.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"quota-readiness.d.ts","sourceRoot":"","sources":["../../lib/quota-readiness.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAoB,MAAM,kBAAkB,CAAC;AAC1F,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEtD,MAAM,MAAM,oBAAoB,GAAG,IAAI,CAAC,iBAAiB,EAAE,WAAW,GAAG,OAAO,CAAC,CAAC;AAIlF,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAGhF;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAG5E;AAED,wBAAgB,uBAAuB,CACtC,QAAQ,EAAE,SAAS,oBAAoB,EAAE,EACzC,OAAO,EAAE,oBAAoB,GAC3B,OAAO,CAQT;AAED,MAAM,MAAM,uBAAuB,GAAG;IACrC,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CAChC,CAAC;AAEF,wBAAgB,4BAA4B,CAC3C,QAAQ,EAAE,SAAS,oBAAoB,EAAE,GACvC,WAAW,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAiB9C;AAED,wBAAgB,yBAAyB,CACxC,kBAAkB,EAAE,WAAW,CAAC,MAAM,EAAE,uBAAuB,CAAC,EAChE,OAAO,EAAE,oBAAoB,GAC3B,OAAO,CAMT;AAED,wBAAgB,wBAAwB,CACvC,WAAW,EAAE,MAAM,GAAG,SAAS,GAC7B,MAAM,GAAG,SAAS,CAKpB;AA4BD,wBAAgB,0BAA0B,CACzC,KAAK,EAAE,IAAI,CAAC,eAAe,EAAE,SAAS,GAAG,WAAW,CAAC,GAAG;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,EACjG,GAAG,SAAa,GACd,OAAO,CAQT;AAED,wBAAgB,6BAA6B,CAC5C,KAAK,EAAE,cAAc,GAAG,IAAI,GAAG,SAAS,EACxC,OAAO,EAAE,oBAAoB,EAC7B,QAAQ,EAAE,SAAS,oBAAoB,EAAE,EACzC,kBAAkB,+CAAyC,GACzD,eAAe,GAAG,IAAI,CAWxB"}
+{"version":3,"file":"quota-readiness.d.ts","sourceRoot":"","sources":["../../lib/quota-readiness.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAoB,MAAM,kBAAkB,CAAC;AAC1F,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEtD,MAAM,MAAM,oBAAoB,GAAG,IAAI,CAAC,iBAAiB,EAAE,WAAW,GAAG,OAAO,CAAC,CAAC;AAIlF,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAGhF;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAG5E;AAED,wBAAgB,uBAAuB,CACtC,QAAQ,EAAE,SAAS,oBAAoB,EAAE,EACzC,OAAO,EAAE,oBAAoB,GAC3B,OAAO,CAQT;AAED,MAAM,MAAM,uBAAuB,GAAG;IACrC,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CAChC,CAAC;AAEF,wBAAgB,4BAA4B,CAC3C,QAAQ,EAAE,SAAS,oBAAoB,EAAE,GACvC,WAAW,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAiB9C;AAED,wBAAgB,yBAAyB,CACxC,kBAAkB,EAAE,WAAW,CAAC,MAAM,EAAE,uBAAuB,CAAC,EAChE,OAAO,EAAE,oBAAoB,GAC3B,OAAO,CAMT;AAED,wBAAgB,wBAAwB,CACvC,WAAW,EAAE,MAAM,GAAG,SAAS,GAC7B,MAAM,GAAG,SAAS,CAKpB;AAQD,wBAAgB,2BAA2B,CAC1C,WAAW,EAAE,MAAM,GAAG,SAAS,GAC7B,OAAO,CAMT;AA2BD,wBAAgB,0BAA0B,CACzC,KAAK,EAAE,IAAI,CAAC,eAAe,EAAE,SAAS,GAAG,WAAW,CAAC,GAAG;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,EACjG,GAAG,SAAa,GACd,OAAO,CAQT;AAED,wBAAgB,6BAA6B,CAC5C,KAAK,EAAE,cAAc,GAAG,IAAI,GAAG,SAAS,EACxC,OAAO,EAAE,oBAAoB,EAC7B,QAAQ,EAAE,SAAS,oBAAoB,EAAE,EACzC,kBAAkB,+CAAyC,GACzD,eAAe,GAAG,IAAI,CAWxB"}

package/dist/lib/quota-readiness.js

@@ -53,6 +53,17 @@ export function quotaLeftPercentFromUsed(usedPercent) {
     }
     return Math.max(0, Math.min(100, Math.round(100 - usedPercent)));
 }
+// A window is exhausted only when it is genuinely at/over 100% used. Base this on
+// the RAW usedPercent, never the rounded quotaLeftPercentFromUsed: rounding
+// 100 - 99.6 = 0.4 down to 0 left-percent would falsely bench a window that still
+// has ~0.4% quota (any usedPercent in (99.5, 100) rounds to 0 left). The header
+// parser preserves fractional used-percent, so this input is expected;
+// quotaLeftPercentFromUsed stays for DISPLAY only.
+export function quotaUsedPercentIsExhausted(usedPercent) {
+    return (typeof usedPercent === "number" &&
+        Number.isFinite(usedPercent) &&
+        usedPercent >= 100);
+}
 function quotaWindowIsExhausted(window, now = Date.now(), updatedAt) {
     if (typeof window?.resetAtMs === "number" && now >= window.resetAtMs) {
         return false;
@@ -69,8 +80,7 @@ function quotaWindowIsExhausted(window, now = Date.now(), updatedAt) {
         now >= updatedAt + window.windowMinutes * 60_000) {
         return false;
     }
-    const leftPercent = quotaLeftPercentFromUsed(window?.usedPercent);
-    return typeof leftPercent === "number" && leftPercent <= 0;
+    return quotaUsedPercentIsExhausted(window?.usedPercent);
 }
 export function isQuotaCacheEntryExhausted(entry, now = Date.now()) {
     // Codex quota windows are cumulative gates: a 0% remaining active window blocks use

package/dist/lib/refresh-lease.d.ts

@@ -1,5 +1,6 @@
 import { promises as fs } from "node:fs";
 import type { TokenResult } from "./types.js";
+export declare const DEFAULT_WAIT_TIMEOUT_MS = 35000;
 type LeaseFsOps = Pick<typeof fs, "mkdir" | "open" | "writeFile" | "rename" | "unlink" | "readFile" | "stat" | "readdir"> & Partial<Pick<typeof fs, "chmod">>;
 export interface RefreshLeaseCoordinatorOptions {
     enabled?: boolean;
@@ -24,6 +25,17 @@ export declare class RefreshLeaseCoordinator {
     private readonly resultTtlMs;
     private readonly fsOps;
     constructor(options?: RefreshLeaseCoordinatorOptions);
+    /**
+     * Resolved maximum time `acquire()` may block waiting for a lease.
+     *
+     * Exposed so the refresh queue can size its acquire-stage eviction threshold
+     * against the budget this coordinator ACTUALLY uses. The budget is
+     * configurable (constructor option / `CODEX_AUTH_REFRESH_LEASE_WAIT_MS`), so
+     * sizing eviction off the static `DEFAULT_WAIT_TIMEOUT_MS` would evict an
+     * acquire that is still legitimately waiting under a larger budget, spawning
+     * the duplicate refresh (→ `invalid_grant`) the lease exists to prevent.
+     */
+    get configuredWaitTimeoutMs(): number;
     static fromEnvironment(): RefreshLeaseCoordinator;
     acquire(refreshToken: string): Promise<RefreshLeaseHandle>;
     private createBypassHandle;

package/dist/lib/refresh-lease.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"refresh-lease.d.ts","sourceRoot":"","sources":["../../lib/refresh-lease.ts"],"names":[],"mappings":"AACA,OAAO,EAAc,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AAMrD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AA4B9C,KAAK,UAAU,GAAG,IAAI,CACrB,OAAO,EAAE,EACT,OAAO,GAAG,MAAM,GAAG,WAAW,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,SAAS,CACtF,GACA,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;AAEnC,MAAM,WAAW,8BAA8B;IAC9C,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IAClC,IAAI,EAAE,OAAO,GAAG,UAAU,GAAG,QAAQ,CAAC;IACtC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACjD;AAyGD,qBAAa,uBAAuB;IACnC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAU;IAClC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAa;gBAEvB,OAAO,GAAE,8BAAmC;IAUxD,MAAM,CAAC,eAAe,IAAI,uBAAuB;IAgB3C,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IA+FhE,OAAO,CAAC,kBAAkB;IAU1B,OAAO,CAAC,iBAAiB;YAmCX,QAAQ;YAkBR,WAAW;YAwBX,eAAe;YAiBf,mBAAmB;YAuCnB,qBAAqB;CAsBnC"}
+{"version":3,"file":"refresh-lease.d.ts","sourceRoot":"","sources":["../../lib/refresh-lease.ts"],"names":[],"mappings":"AACA,OAAO,EAAc,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AAMrD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAQ9C,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAsB9C,KAAK,UAAU,GAAG,IAAI,CACrB,OAAO,EAAE,EACT,OAAO,GAAG,MAAM,GAAG,WAAW,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,SAAS,CACtF,GACA,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;AAEnC,MAAM,WAAW,8BAA8B;IAC9C,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IAClC,IAAI,EAAE,OAAO,GAAG,UAAU,GAAG,QAAQ,CAAC;IACtC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACjD;AAyGD,qBAAa,uBAAuB;IACnC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAU;IAClC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAa;gBAEvB,OAAO,GAAE,8BAAmC;IAUxD;;;;;;;;;OASG;IACH,IAAI,uBAAuB,IAAI,MAAM,CAEpC;IAED,MAAM,CAAC,eAAe,IAAI,uBAAuB;IAgB3C,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IA+FhE,OAAO,CAAC,kBAAkB;IAU1B,OAAO,CAAC,iBAAiB;YA0CX,QAAQ;YAkBR,WAAW;YAwBX,eAAe;YAiBf,mBAAmB;YAuCnB,qBAAqB;CAsBnC"}

package/dist/lib/refresh-lease.js

@@ -8,7 +8,9 @@ import { safeParseTokenResult } from "./schemas.js";
 import { isRecord } from "./utils.js";
 const log = createLogger("refresh-lease");
 const DEFAULT_LEASE_TTL_MS = 30_000;
-const DEFAULT_WAIT_TIMEOUT_MS = 35_000;
+// Exported so the refresh queue can size its acquire-stage eviction threshold
+// above the maximum time a lease acquire() may legitimately block waiting.
+export const DEFAULT_WAIT_TIMEOUT_MS = 35_000;
 const DEFAULT_POLL_INTERVAL_MS = 150;
 const DEFAULT_RESULT_TTL_MS = 20_000;
 const RETRYABLE_IO_ERRORS = new Set(["EBUSY", "EPERM", "EMFILE", "ENFILE"]);
@@ -120,6 +122,19 @@ export class RefreshLeaseCoordinator {
         this.resultTtlMs = Math.max(1_000, Math.floor(options.resultTtlMs ?? DEFAULT_RESULT_TTL_MS));
         this.fsOps = options.fsOps ?? fs;
     }
+    /**
+     * Resolved maximum time `acquire()` may block waiting for a lease.
+     *
+     * Exposed so the refresh queue can size its acquire-stage eviction threshold
+     * against the budget this coordinator ACTUALLY uses. The budget is
+     * configurable (constructor option / `CODEX_AUTH_REFRESH_LEASE_WAIT_MS`), so
+     * sizing eviction off the static `DEFAULT_WAIT_TIMEOUT_MS` would evict an
+     * acquire that is still legitimately waiting under a larger budget, spawning
+     * the duplicate refresh (→ `invalid_grant`) the lease exists to prevent.
+     */
+    get configuredWaitTimeoutMs() {
+        return this.waitTimeoutMs;
+    }
     static fromEnvironment() {
         const testMode = process.env.VITEST === "true" || process.env.NODE_ENV === "test";
         const enabled = parseBooleanEnv(process.env.CODEX_AUTH_REFRESH_LEASE) ??
@@ -243,7 +258,14 @@ export class RefreshLeaseCoordinator {
                     return;
                 released = true;
                 try {
-                    if (result) {
+                    // Only ever cache a SUCCESSFUL refresh in the cross-process lease.
+                    // A `failed` result carries no token material to share; caching it
+                    // would make readFreshResult serve the failure verbatim to every
+                    // follower for the whole result TTL (DEFAULT_RESULT_TTL_MS), blocking
+                    // a real refresh and even escalating to cooldowns. On failure we skip
+                    // the cache and still unlink the lock in `finally`, so the next caller
+                    // becomes owner and retries immediately.
+                    if (result?.type === "success") {
                         await this.writeResult(resultPath, tokenHash, result);
                     }
                 }

package/dist/lib/refresh-queue.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"refresh-queue.d.ts","sourceRoot":"","sources":["../../lib/refresh-queue.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AA6B7D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,OAAO,CAAwC;IACvD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA0B;IAC3D,OAAO,CAAC,cAAc,CAAK;IAE3B;;;;OAIG;IACH,OAAO,CAAC,gBAAgB,CAAkC;IAE1D;;OAEG;IACH,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IAEvC;;;OAGG;gBAED,aAAa,GAAE,MAAe,EAC9B,gBAAgB,GAAE,uBAAmE;IAMvF;;;;;;;;OAQG;IACG,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAuHzD,OAAO,CAAC,iBAAiB;IASzB,OAAO,CAAC,sBAAsB;YAShB,kCAAkC;IAchD;;OAEG;YACW,cAAc;IAsE5B;;;OAGG;IACH,OAAO,CAAC,OAAO;IAwBf;;;;OAIG;IACH,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IAI3C;;;OAGG;IACH,IAAI,YAAY,IAAI,MAAM,CAEzB;IAED;;OAEG;IACH,KAAK,IAAI,IAAI;CAId;AAQD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,YAAY,CAKpE;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAGxC;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAE9E"}
+{"version":3,"file":"refresh-queue.d.ts","sourceRoot":"","sources":["../../lib/refresh-queue.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,OAAO,EAAE,uBAAuB,EAA2B,MAAM,oBAAoB,CAAC;AAqCtF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,OAAO,CAAwC;IACvD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA0B;IAC3D,OAAO,CAAC,cAAc,CAAK;IAE3B;;;;OAIG;IACH,OAAO,CAAC,gBAAgB,CAAkC;IAE1D;;OAEG;IACH,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IAEvC;;;OAGG;gBAED,aAAa,GAAE,MAAe,EAC9B,gBAAgB,GAAE,uBAAmE;IAMvF;;;;;;;;OAQG;IACG,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAuHzD,OAAO,CAAC,iBAAiB;IASzB,OAAO,CAAC,sBAAsB;YAShB,kCAAkC;IAchD;;OAEG;YACW,cAAc;IAsE5B;;;OAGG;IACH,OAAO,CAAC,OAAO;IA8Cf;;;;OAIG;IACH,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IAI3C;;;OAGG;IACH,IAAI,YAAY,IAAI,MAAM,CAEzB;IAED;;OAEG;IACH,KAAK,IAAI,IAAI;CAId;AAQD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,YAAY,CAKpE;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAGxC;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAE9E"}

package/dist/lib/refresh-queue.js

@@ -10,9 +10,16 @@
 import { createHash } from "node:crypto";
 import { refreshAccessToken } from "./auth/auth.js";
 import { createLogger } from "./logger.js";
-import { RefreshLeaseCoordinator } from "./refresh-lease.js";
+import { RefreshLeaseCoordinator, DEFAULT_WAIT_TIMEOUT_MS } from "./refresh-lease.js";
 import { isAbortError } from "./utils.js";
 const log = createLogger("refresh-queue");
+/**
+ * Extra headroom beyond the lease wait budget before an acquire-stage entry is
+ * treated as genuinely stuck. A lease acquire() polls on an interval and does
+ * filesystem work, so it can overshoot its wait deadline slightly; this slack
+ * keeps cleanup from evicting an acquire that is still legitimately waiting.
+ */
+const ACQUIRE_EVICTION_SLACK_MS = 5_000;
 /**
  * Non-reversible correlation fingerprint for a token, for logs.
  *
@@ -311,11 +318,28 @@ export class RefreshQueue {
      */
     cleanup() {
         const now = Date.now();
+        // A lease acquire() can legitimately block up to the coordinator's wait
+        // budget. Evicting an acquire-stage entry before that budget elapses would
+        // spawn a duplicate refresh whose refresh token OpenAI has already rotated on
+        // first use (invalid_grant). So an acquire-stage entry is only evicted once it
+        // exceeds BOTH the configured max age AND the lease wait budget plus slack —
+        // never merely maxEntryAgeMs, which can be shorter than the wait budget.
+        //
+        // Read the budget the coordinator was actually CONFIGURED with (constructor
+        // option / CODEX_AUTH_REFRESH_LEASE_WAIT_MS) rather than the static default:
+        // under a larger configured budget the default would evict too early. An
+        // injected test double may not expose the getter, so fall back to the default.
+        const configuredWaitTimeoutMs = this.leaseCoordinator.configuredWaitTimeoutMs;
+        const leaseWaitTimeoutMs = typeof configuredWaitTimeoutMs === "number" &&
+            Number.isFinite(configuredWaitTimeoutMs)
+            ? configuredWaitTimeoutMs
+            : DEFAULT_WAIT_TIMEOUT_MS;
+        const acquireEvictionAgeMs = Math.max(this.maxEntryAgeMs, leaseWaitTimeoutMs + ACQUIRE_EVICTION_SLACK_MS);
         for (const [token, entry] of this.pending.entries()) {
             const ageMs = now - entry.startedAt;
-            if (ageMs <= this.maxEntryAgeMs)
-                continue;
             if (entry.stage === "acquire") {
+                if (ageMs <= acquireEvictionAgeMs)
+                    continue;
                 log.warn("Evicting stale refresh entry during lease acquire stage", {
                     tokenSuffix: tokenFingerprint(token),
                     ageMs,
@@ -324,6 +348,8 @@ export class RefreshQueue {
                 this.cleanupRotationMapping(token);
                 continue;
             }
+            if (ageMs <= this.maxEntryAgeMs)
+                continue;
             if (!entry.staleWarningLogged) {
                 log.warn("Refresh entry exceeded stale warning threshold", {
                     tokenSuffix: tokenFingerprint(token),

package/dist/lib/request/request-transformer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"request-transformer.d.ts","sourceRoot":"","sources":["../../../lib/request/request-transformer.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EACX,aAAa,EACb,SAAS,EACT,eAAe,EACf,WAAW,EAEX,UAAU,EACV,MAAM,aAAa,CAAC;AAGrB,KAAK,mBAAmB,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAO/C,MAAM,WAAW,0BAA0B;IAC1C,IAAI,EAAE,WAAW,CAAC;IAClB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,6BAA6B,CAAC,EAAE,OAAO,CAAC;IACxC,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACnC;AAID,OAAO,EACN,kBAAkB,EAClB,uCAAuC,GACvC,MAAM,0BAA0B,CAAC;AAElC;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAEhE;AAkBD;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC7B,SAAS,EAAE,MAAM,EACjB,UAAU,GAAE,UAAuC,GACjD,aAAa,CAqEf;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CACvC,UAAU,GAAE,UAAuC,GACjD,UAAU,CAUZ;AA4QD;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CACjC,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,UAAU,GAAE,aAAkB,GAC5B,eAAe,CAuBjB;AA2DD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,WAAW,CAC1B,KAAK,EAAE,SAAS,EAAE,GAAG,SAAS,EAC9B,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,GAC9B,SAAS,EAAE,GAAG,SAAS,CAsBzB;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACtC,KAAK,EAAE,SAAS,EAAE,GAAG,SAAS,EAC9B,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;IAAE,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAAE,GAC1C,SAAS,EAAE,GAAG,SAAS,CAkEzB;AAED,MAAM,WAAW,wBAAwB;IACxC,WAAW,EAAE,OAAO,CAAC;IACrB,aAAa,EAAE,OAAO,CAAC;IACvB,IAAI,CAAC,EAAE;QACN,QAAQ,EAAE,MAAM,CAAC;QACjB,oBAAoB,EAAE,OAAO,CAAC;KAC9B,CAAC;CACF;AA4DD,wBAAgB,+BAA+B,CAC9C,IAAI,EAAE,WAAW,EACjB,WAAW,EAAE,OAAO,EACpB,mBAAmB,EAAE,mBAAmB,EACxC,wBAAwB,EAAE,MAAM,GAC9B,wBAAwB,CAoB1B;AAiCD;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAC5C,KAAK,EAAE,SAAS,EAAE,GAAG,SAAS,GAC5B,OAAO,CAAC,SAAS,EAAE,GAAG,SAAS,CAAC,CAalC;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACpC,KAAK,EAAE,SAAS,EAAE,GAAG,SAAS,EAC9B,QAAQ,EAAE,OAAO,GACf,SAAS,EAAE,GAAG,SAAS,CAezB;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAClC,KAAK,EAAE,SAAS,EAAE,GAAG,SAAS,EAC9B,QAAQ,EAAE,OAAO,GACf,SAAS,EAAE,GAAG,SAAS,CAezB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,oBAAoB,CACzC,MAAM,EAAE,0BAA0B,GAChC,OAAO,CAAC,WAAW,CAAC,CAAC;AACxB,wBAAsB,oBAAoB,CACzC,IAAI,EAAE,WAAW,EACjB,iBAAiB,EAAE,MAAM,EACzB,UAAU,CAAC,EAAE,UAAU,EACvB,SAAS,CAAC,EAAE,OAAO,EACnB,WAAW,CAAC,EAAE,OAAO,EACrB,mBAAmB,CAAC,EAAE,mBAAmB,EACzC,wBAAwB,CAAC,EAAE,MAAM,EACjC,6BAA6B,CAAC,EAAE,OAAO,EACvC,wBAAwB,CAAC,EAAE,OAAO,GAChC,OAAO,CAAC,WAAW,CAAC,CAAC"}
+{"version":3,"file":"request-transformer.d.ts","sourceRoot":"","sources":["../../../lib/request/request-transformer.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EACX,aAAa,EACb,SAAS,EACT,eAAe,EACf,WAAW,EAEX,UAAU,EACV,MAAM,aAAa,CAAC;AAGrB,KAAK,mBAAmB,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAO/C,MAAM,WAAW,0BAA0B;IAC1C,IAAI,EAAE,WAAW,CAAC;IAClB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,6BAA6B,CAAC,EAAE,OAAO,CAAC;IACxC,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACnC;AAID,OAAO,EACN,kBAAkB,EAClB,uCAAuC,GACvC,MAAM,0BAA0B,CAAC;AAElC;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAEhE;AAkBD;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC7B,SAAS,EAAE,MAAM,EACjB,UAAU,GAAE,UAAuC,GACjD,aAAa,CAqEf;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CACvC,UAAU,GAAE,UAAuC,GACjD,UAAU,CAUZ;AA4QD;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CACjC,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,UAAU,GAAE,aAAkB,GAC5B,eAAe,CAuBjB;AA2DD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,WAAW,CAC1B,KAAK,EAAE,SAAS,EAAE,GAAG,SAAS,EAC9B,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,GAC9B,SAAS,EAAE,GAAG,SAAS,CAsBzB;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACtC,KAAK,EAAE,SAAS,EAAE,GAAG,SAAS,EAC9B,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;IAAE,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAAE,GAC1C,SAAS,EAAE,GAAG,SAAS,CA8EzB;AAED,MAAM,WAAW,wBAAwB;IACxC,WAAW,EAAE,OAAO,CAAC;IACrB,aAAa,EAAE,OAAO,CAAC;IACvB,IAAI,CAAC,EAAE;QACN,QAAQ,EAAE,MAAM,CAAC;QACjB,oBAAoB,EAAE,OAAO,CAAC;KAC9B,CAAC;CACF;AA4DD,wBAAgB,+BAA+B,CAC9C,IAAI,EAAE,WAAW,EACjB,WAAW,EAAE,OAAO,EACpB,mBAAmB,EAAE,mBAAmB,EACxC,wBAAwB,EAAE,MAAM,GAC9B,wBAAwB,CAoB1B;AAiCD;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAC5C,KAAK,EAAE,SAAS,EAAE,GAAG,SAAS,GAC5B,OAAO,CAAC,SAAS,EAAE,GAAG,SAAS,CAAC,CAalC;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACpC,KAAK,EAAE,SAAS,EAAE,GAAG,SAAS,EAC9B,QAAQ,EAAE,OAAO,GACf,SAAS,EAAE,GAAG,SAAS,CAezB;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAClC,KAAK,EAAE,SAAS,EAAE,GAAG,SAAS,EAC9B,QAAQ,EAAE,OAAO,GACf,SAAS,EAAE,GAAG,SAAS,CAezB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,oBAAoB,CACzC,MAAM,EAAE,0BAA0B,GAChC,OAAO,CAAC,WAAW,CAAC,CAAC;AACxB,wBAAsB,oBAAoB,CACzC,IAAI,EAAE,WAAW,EACjB,iBAAiB,EAAE,MAAM,EACzB,UAAU,CAAC,EAAE,UAAU,EACvB,SAAS,CAAC,EAAE,OAAO,EACnB,WAAW,CAAC,EAAE,OAAO,EACrB,mBAAmB,CAAC,EAAE,mBAAmB,EACzC,wBAAwB,CAAC,EAAE,MAAM,EACjC,6BAA6B,CAAC,EAAE,OAAO,EACvC,wBAAwB,CAAC,EAAE,OAAO,GAChC,OAAO,CAAC,WAAW,CAAC,CAAC"}

package/dist/lib/request/request-transformer.js

@@ -487,7 +487,8 @@ export function trimInputForFastSession(input, maxItems, options) {
         }
         break;
     }
-    for (let i = Math.max(0, input.length - safeMax); i < input.length; i++) {
+    const tailStart = Math.max(0, input.length - safeMax);
+    for (let i = tailStart; i < input.length; i++) {
         if (excludedHeadIndexes.has(i))
             continue;
         keepIndexes.add(i);
@@ -499,7 +500,17 @@ export function trimInputForFastSession(input, maxItems, options) {
         return input;
     if (trimmed.length <= safeMax)
         return trimmed;
-    return trimmed.slice(trimmed.length - safeMax);
+    // Kept head items are always the LOWEST kept indexes, so they occupy the first
+    // `keptHead` entries of `trimmed`. Reserve budget for exactly that many.
+    // Recounting the kept indexes below `tailStart` instead would miss a head
+    // instruction that ALSO falls inside the tail window (input.length only just
+    // over safeMax), and the tail slice would then drop it. The two slices cannot
+    // overlap here: keptHead + tailBudget === safeMax < trimmed.length.
+    const tailBudget = Math.max(1, safeMax - keptHead);
+    return [
+        ...trimmed.slice(0, keptHead),
+        ...trimmed.slice(trimmed.length - tailBudget),
+    ];
 }
 function isTrivialLatestPrompt(text) {
     const normalized = text.trim();

package/dist/lib/request/response-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"response-handler.d.ts","sourceRoot":"","sources":["../../../lib/request/response-handler.ts"],"names":[],"mappings":"AAwwBA;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACrC,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE;IACT,YAAY,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5C,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC9B,GACC,OAAO,CAAC,QAAQ,CAAC,CA2HnB;AA6DD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAQ3D;AA2BD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAgCtD;AAED,wBAAgB,uBAAuB,CACtC,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,YAAY,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,IAAI,GACzC,QAAQ,CAiBV"}
+{"version":3,"file":"response-handler.d.ts","sourceRoot":"","sources":["../../../lib/request/response-handler.ts"],"names":[],"mappings":"AAwwBA;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACrC,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE;IACT,YAAY,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5C,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC9B,GACC,OAAO,CAAC,QAAQ,CAAC,CA2HnB;AA6DD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAQ3D;AA2BD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CA4CtD;AAED,wBAAgB,uBAAuB,CACtC,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,YAAY,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,IAAI,GACzC,QAAQ,CAiBV"}

package/dist/lib/request/response-handler.js

@@ -787,7 +787,16 @@ export function isEmptyResponse(body) {
     const obj = body;
     if (Object.keys(obj).length === 0)
         return true;
-    const hasOutput = "output" in obj && obj.output !== null && obj.output !== undefined;
+    const hasOutput = "output" in obj &&
+        obj.output !== null &&
+        obj.output !== undefined &&
+        (Array.isArray(obj.output)
+            ? obj.output.some((o) => o !== null &&
+                o !== undefined &&
+                (typeof o !== "object" || Object.keys(o).length > 0))
+            : typeof obj.output === "string"
+                ? obj.output.trim() !== ""
+                : true);
     const hasChoices = "choices" in obj &&
         Array.isArray(obj.choices) &&
         obj.choices.some((c) => c !== null &&

package/dist/lib/rotation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rotation.d.ts","sourceRoot":"","sources":["../../lib/rotation.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAUH,MAAM,WAAW,iBAAiB;IACjC,yCAAyC;IACzC,YAAY,EAAE,MAAM,CAAC;IACrB,+CAA+C;IAC/C,cAAc,EAAE,MAAM,CAAC;IACvB,mDAAmD;IACnD,YAAY,EAAE,MAAM,CAAC;IACrB,2BAA2B;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,2BAA2B;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,8CAA8C;IAC9C,sBAAsB,EAAE,MAAM,CAAC;CAC/B;AAED,eAAO,MAAM,2BAA2B,EAAE,iBAOzC,CAAC;AAQF,KAAK,UAAU,GAAG,MAAM,GAAG,MAAM,CAAC;AAWlC;;;GAGG;AACH,qBAAa,kBAAkB;IAC9B,OAAO,CAAC,OAAO,CAAuC;IACtD,OAAO,CAAC,MAAM,CAAoB;gBAEtB,MAAM,GAAE,OAAO,CAAC,iBAAiB,CAAM;IAInD,OAAO,CAAC,MAAM;IAId,OAAO,CAAC,oBAAoB;IAO5B,QAAQ,CAAC,UAAU,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM;IAO3D,sBAAsB,CAAC,UAAU,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM;IAMzE,aAAa,CAAC,UAAU,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI;IAiB9D,eAAe,CAAC,UAAU,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI;IAiBhE,aAAa,CAAC,UAAU,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI;IAiB9D,KAAK,CAAC,UAAU,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI;IAKtD,KAAK,IAAI,IAAI;IAIb,yBAAyB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;IAanD;;;;OAIG;IACH,eAAe,CAAC,UAAU,EAAE,UAAU,GAAG,IAAI;CAW7C;AAMD,MAAM,WAAW,iBAAiB;IACjC,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,oCAAoC;IACpC,eAAe,EAAE,MAAM,CAAC;CACxB;AAED,eAAO,MAAM,2BAA2B,EAAE,iBAGzC,CAAC;AAUF;;;GAGG;AACH,qBAAa,kBAAkB;IAC9B,OAAO,CAAC,OAAO,CAA4C;IAC3D,OAAO,CAAC,MAAM,CAAoB;gBAEtB,MAAM,GAAE,OAAO,CAAC,iBAAiB,CAAM;IAInD,OAAO,CAAC,MAAM;IAId,OAAO,CAAC,YAAY;IAOpB,SAAS,CAAC,UAAU,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM;IAO5D;;OAEG;IACH,UAAU,CAAC,UAAU,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO;IA0B9D;;;;OAIG;IACH,WAAW,CAAC,UAAU,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO;IAwB/D;;OAEG;IACH,KAAK,CACJ,UAAU,EAAE,UAAU,EACtB,QAAQ,CAAC,EAAE,MAAM,EACjB,WAAW,GAAE,MAAW,GACtB,IAAI;IAaP,KAAK,CAAC,UAAU,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI;IAKtD,KAAK,IAAI,IAAI;IAIb,yBAAyB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;IAanD;;;;OAIG;IACH,eAAe,CAAC,UAAU,EAAE,UAAU,GAAG,IAAI;CAW7C;AAMD,MAAM,WAAW,kBAAkB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,WAAW,EAAE,OAAO,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,qBAAqB;IACrC,2CAA2C;IAC3C,YAAY,EAAE,MAAM,CAAC;IACrB,0CAA0C;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,kDAAkD;IAClD,eAAe,EAAE,MAAM,CAAC;CACxB;AAQD;;;;;;;;;GASG;AACH,MAAM,WAAW,sBAAsB;IACtC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC7C;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACzC,QAAQ,EAAE,kBAAkB,EAAE,CAAC;IAC/B,aAAa,EAAE,kBAAkB,CAAC;IAClC,YAAY,EAAE,kBAAkB,CAAC;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACxC,OAAO,CAAC,EAAE,sBAAsB,CAAC;CACjC;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CAClC,MAAM,EAAE,yBAAyB,GAC/B,kBAAkB,GAAG,IAAI,CAAC;AAC7B,wBAAgB,mBAAmB,CAClC,QAAQ,EAAE,kBAAkB,EAAE,EAC9B,aAAa,EAAE,kBAAkB,EACjC,YAAY,EAAE,kBAAkB,EAChC,QAAQ,CAAC,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,EACvC,OAAO,CAAC,EAAE,sBAAsB,GAC9B,kBAAkB,GAAG,IAAI,CAAC;AAmH7B;;;;;;;GAOG;AACH,MAAM,WAAW,6BAA6B;IAC7C,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,UAAU,CAAC;IACvB,WAAW,EAAE,OAAO,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,0BAA0B;IAC1C,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACpC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,6BAA6B,EAAE,CAAC;IAC5C,MAAM,EAAE,qBAAqB,CAAC;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,+BAA+B;IAC/C,QAAQ,EAAE,kBAAkB,EAAE,CAAC;IAC/B,aAAa,EAAE,kBAAkB,CAAC;IAClC,YAAY,EAAE,kBAAkB,CAAC;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACxC,OAAO,CAAC,EAAE,sBAAsB,CAAC;CACjC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CACxC,MAAM,EAAE,+BAA+B,GACrC,0BAA0B,CA2F5B;AAMD;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,GAAE,MAAY,GAAG,MAAM,CAG5E;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEhE;AAED,MAAM,WAAW,yBAAyB;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,yBAAyB,GAAG,MAAM,CAAC;AAC/E,wBAAgB,kBAAkB,CACjC,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,MAAM,EACf,KAAK,CAAC,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,MAAM,GACnB,MAAM,CAAC;AA2DV,wBAAgB,gBAAgB,CAC/B,MAAM,CAAC,EAAE,OAAO,CAAC,iBAAiB,CAAC,GACjC,kBAAkB,CAKpB;AAED,wBAAgB,eAAe,CAC9B,MAAM,CAAC,EAAE,OAAO,CAAC,iBAAiB,CAAC,GACjC,kBAAkB,CAKpB;AAED,wBAAgB,aAAa,IAAI,IAAI,CAGpC"}
+{"version":3,"file":"rotation.d.ts","sourceRoot":"","sources":["../../lib/rotation.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAUH,MAAM,WAAW,iBAAiB;IACjC,yCAAyC;IACzC,YAAY,EAAE,MAAM,CAAC;IACrB,+CAA+C;IAC/C,cAAc,EAAE,MAAM,CAAC;IACvB,mDAAmD;IACnD,YAAY,EAAE,MAAM,CAAC;IACrB,2BAA2B;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,2BAA2B;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,8CAA8C;IAC9C,sBAAsB,EAAE,MAAM,CAAC;CAC/B;AAED,eAAO,MAAM,2BAA2B,EAAE,iBAOzC,CAAC;AAQF,KAAK,UAAU,GAAG,MAAM,GAAG,MAAM,CAAC;AAWlC;;;GAGG;AACH,qBAAa,kBAAkB;IAC9B,OAAO,CAAC,OAAO,CAAuC;IACtD,OAAO,CAAC,MAAM,CAAoB;gBAEtB,MAAM,GAAE,OAAO,CAAC,iBAAiB,CAAM;IAInD,OAAO,CAAC,MAAM;IAId,OAAO,CAAC,oBAAoB;IAO5B,QAAQ,CAAC,UAAU,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM;IAO3D,sBAAsB,CAAC,UAAU,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM;IAMzE,aAAa,CAAC,UAAU,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI;IAiB9D,eAAe,CAAC,UAAU,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI;IAiBhE,aAAa,CAAC,UAAU,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI;IAiB9D,KAAK,CAAC,UAAU,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI;IAKtD,KAAK,IAAI,IAAI;IAIb,yBAAyB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;IAanD;;;;OAIG;IACH,eAAe,CAAC,UAAU,EAAE,UAAU,GAAG,IAAI;CAW7C;AAMD,MAAM,WAAW,iBAAiB;IACjC,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,oCAAoC;IACpC,eAAe,EAAE,MAAM,CAAC;CACxB;AAED,eAAO,MAAM,2BAA2B,EAAE,iBAGzC,CAAC;AAiBF;;;GAGG;AACH,qBAAa,kBAAkB;IAC9B,OAAO,CAAC,OAAO,CAA4C;IAC3D,OAAO,CAAC,MAAM,CAAoB;gBAEtB,MAAM,GAAE,OAAO,CAAC,iBAAiB,CAAM;IAInD,OAAO,CAAC,MAAM;IAId,OAAO,CAAC,YAAY;IAOpB,SAAS,CAAC,UAAU,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM;IAO5D;;OAEG;IACH,UAAU,CAAC,UAAU,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO;IA0B9D;;;;OAIG;IACH,WAAW,CAAC,UAAU,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO;IAwB/D;;OAEG;IACH,KAAK,CACJ,UAAU,EAAE,UAAU,EACtB,QAAQ,CAAC,EAAE,MAAM,EACjB,WAAW,GAAE,MAAW,GACtB,IAAI;IAaP,KAAK,CAAC,UAAU,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI;IAKtD,KAAK,IAAI,IAAI;IAIb,yBAAyB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;IAanD;;;;OAIG;IACH,eAAe,CAAC,UAAU,EAAE,UAAU,GAAG,IAAI;CAW7C;AAMD,MAAM,WAAW,kBAAkB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,WAAW,EAAE,OAAO,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,qBAAqB;IACrC,2CAA2C;IAC3C,YAAY,EAAE,MAAM,CAAC;IACrB,0CAA0C;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,kDAAkD;IAClD,eAAe,EAAE,MAAM,CAAC;CACxB;AAQD;;;;;;;;;GASG;AACH,MAAM,WAAW,sBAAsB;IACtC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC7C;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACzC,QAAQ,EAAE,kBAAkB,EAAE,CAAC;IAC/B,aAAa,EAAE,kBAAkB,CAAC;IAClC,YAAY,EAAE,kBAAkB,CAAC;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACxC,OAAO,CAAC,EAAE,sBAAsB,CAAC;CACjC;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CAClC,MAAM,EAAE,yBAAyB,GAC/B,kBAAkB,GAAG,IAAI,CAAC;AAC7B,wBAAgB,mBAAmB,CAClC,QAAQ,EAAE,kBAAkB,EAAE,EAC9B,aAAa,EAAE,kBAAkB,EACjC,YAAY,EAAE,kBAAkB,EAChC,QAAQ,CAAC,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,EACvC,OAAO,CAAC,EAAE,sBAAsB,GAC9B,kBAAkB,GAAG,IAAI,CAAC;AAmH7B;;;;;;;GAOG;AACH,MAAM,WAAW,6BAA6B;IAC7C,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,UAAU,CAAC;IACvB,WAAW,EAAE,OAAO,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,0BAA0B;IAC1C,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACpC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,6BAA6B,EAAE,CAAC;IAC5C,MAAM,EAAE,qBAAqB,CAAC;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,+BAA+B;IAC/C,QAAQ,EAAE,kBAAkB,EAAE,CAAC;IAC/B,aAAa,EAAE,kBAAkB,CAAC;IAClC,YAAY,EAAE,kBAAkB,CAAC;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACxC,OAAO,CAAC,EAAE,sBAAsB,CAAC;CACjC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CACxC,MAAM,EAAE,+BAA+B,GACrC,0BAA0B,CA2F5B;AAMD;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,GAAE,MAAY,GAAG,MAAM,CAG5E;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEhE;AAED,MAAM,WAAW,yBAAyB;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,yBAAyB,GAAG,MAAM,CAAC;AAC/E,wBAAgB,kBAAkB,CACjC,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,MAAM,EACf,KAAK,CAAC,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,MAAM,GACnB,MAAM,CAAC;AA2DV,wBAAgB,gBAAgB,CAC/B,MAAM,CAAC,EAAE,OAAO,CAAC,iBAAiB,CAAC,GACjC,kBAAkB,CAKpB;AAED,wBAAgB,eAAe,CAC9B,MAAM,CAAC,EAAE,OAAO,CAAC,iBAAiB,CAAC,GACjC,kBAAkB,CAKpB;AAED,wBAAgB,aAAa,IAAI,IAAI,CAGpC"}

package/dist/lib/rotation.js

@@ -132,7 +132,14 @@ export const DEFAULT_TOKEN_BUCKET_CONFIG = {
     maxTokens: 50,
     tokensPerMinute: 6,
 };
-const TOKEN_REFUND_WINDOW_MS = 30_000;
+// Must cover the full request lifetime so a token consumed at request start can
+// still be refunded when the request fails at the very end. The runtime proxy
+// refunds on network error / upstream timeout, and the default fetch timeout is
+// 60_000ms (config.ts fetchTimeoutMs) — measured AFTER token consumption and a
+// token refresh. 90_000ms = that 60s timeout plus slack for the refresh and
+// processing, so a genuinely timed-out request's token is reversed instead of
+// leaking (gradual token-bucket starvation -> spurious token-exhausted skips).
+const TOKEN_REFUND_WINDOW_MS = 90_000;
 /**
  * Client-side token bucket for rate limiting requests per account.
  * Prevents sending requests to accounts that are likely to be rate-limited.

package/dist/lib/runtime/account-check.d.ts

@@ -1,5 +1,5 @@
 import type { ModelFamily } from "../prompts/codex.js";
-import type { AccountStorageV3, FlaggedAccountMetadataV1 } from "../storage.js";
+import { type AccountStorageV3, type FlaggedAccountMetadataV1 } from "../storage.js";
 import type { AccountIdSource, TokenResult } from "../types.js";
 import type { AccountCheckWorkingState } from "./account-check-types.js";
 import type { CodexQuotaSnapshot } from "./quota-headers.js";

package/dist/lib/runtime/account-check.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account-check.d.ts","sourceRoot":"","sources":["../../../lib/runtime/account-check.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAChF,OAAO,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAE7D,wBAAsB,sBAAsB,CAC3C,SAAS,EAAE,OAAO,EAClB,IAAI,EAAE;IACL,aAAa,EAAE,CACd,OAAO,EAAE,gBAAgB,GAAG,IAAI,KAC5B,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACtC,YAAY,EAAE,MAAM,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACrD,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;IAC3C,mBAAmB,EAAE,MAAM,OAAO,CAAC;QAClC,OAAO,EAAE,CAAC,CAAC;QACX,QAAQ,EAAE,wBAAwB,EAAE,CAAC;KACrC,CAAC,CAAC;IACH,8BAA8B,EAAE,CAAC,cAAc,EAAE;QAChD,OAAO,EAAE,CAAC,CAAC;QACX,QAAQ,EAAE,wBAAwB,EAAE,CAAC;KACrC,KAAK,wBAAwB,CAAC;IAC/B,2BAA2B,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAChE;QACA,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,WAAW,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;KAClB,GACD,IAAI,GACJ,SAAS,CACX,CAAC;IACF,gBAAgB,EAAE,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,KAAK,MAAM,GAAG,SAAS,CAAC;IAC1E,8BAA8B,EAAE,CAC/B,MAAM,EAAE,eAAe,GAAG,SAAS,EACnC,gBAAgB,EAAE,MAAM,GAAG,SAAS,KAChC,OAAO,CAAC;IACb,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,KAAK,MAAM,GAAG,SAAS,CAAC;IACjE,mBAAmB,EAAE,CACpB,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,KACxB,MAAM,GAAG,SAAS,CAAC;IACxB,aAAa,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9D,yBAAyB,EAAE,CAC1B,OAAO,EAAE,OAAO,CAAC,WAAW,EAAE;QAAE,IAAI,EAAE,QAAQ,CAAA;KAAE,CAAC,KAC7C,OAAO,CAAC;IACb,uBAAuB,EAAE,CAAC,MAAM,EAAE;QACjC,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;KACpB,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAClC,uBAAuB,EAAE,CACxB,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,eAAe,EAAE,eAAe,GAAG,SAAS,EAC5C,cAAc,EAAE,MAAM,GAAG,SAAS,KAC9B,MAAM,GAAG,SAAS,CAAC;IACxB,oBAAoB,EAAE,CAAC,QAAQ,EAAE,kBAAkB,KAAK,MAAM,CAAC;IAC/D,yBAAyB,EAAE,CAC1B,OAAO,EAAE,gBAAgB,EACzB,aAAa,EAAE,SAAS,WAAW,EAAE,KACjC,IAAI,CAAC;IACV,cAAc,EAAE,SAAS,WAAW,EAAE,CAAC;IACvC,YAAY,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,6BAA6B,EAAE,MAAM,IAAI,CAAC;IAC1C,mBAAmB,EAAE,CAAC,OAAO,EAAE;QAC9B,OAAO,EAAE,CAAC,CAAC;QACX,QAAQ,EAAE,wBAAwB,EAAE,CAAC;KACrC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpB,+BAA+B,CAAC,EAAE,CACjC,cAAc,EAAE,gBAAgB,EAChC,cAAc,EAAE;QACf,OAAO,EAAE,CAAC,CAAC;QACX,QAAQ,EAAE,wBAAwB,EAAE,CAAC;KACrC,KACG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACpC,GACC,OAAO,CAAC,IAAI,CAAC,CAyRf"}
+{"version":3,"file":"account-check.d.ts","sourceRoot":"","sources":["../../../lib/runtime/account-check.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EACN,KAAK,gBAAgB,EACrB,KAAK,wBAAwB,EAE7B,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAE7D,wBAAsB,sBAAsB,CAC3C,SAAS,EAAE,OAAO,EAClB,IAAI,EAAE;IACL,aAAa,EAAE,CACd,OAAO,EAAE,gBAAgB,GAAG,IAAI,KAC5B,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACtC,YAAY,EAAE,MAAM,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACrD,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;IAC3C,mBAAmB,EAAE,MAAM,OAAO,CAAC;QAClC,OAAO,EAAE,CAAC,CAAC;QACX,QAAQ,EAAE,wBAAwB,EAAE,CAAC;KACrC,CAAC,CAAC;IACH,8BAA8B,EAAE,CAAC,cAAc,EAAE;QAChD,OAAO,EAAE,CAAC,CAAC;QACX,QAAQ,EAAE,wBAAwB,EAAE,CAAC;KACrC,KAAK,wBAAwB,CAAC;IAC/B,2BAA2B,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAChE;QACA,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,WAAW,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;KAClB,GACD,IAAI,GACJ,SAAS,CACX,CAAC;IACF,gBAAgB,EAAE,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,KAAK,MAAM,GAAG,SAAS,CAAC;IAC1E,8BAA8B,EAAE,CAC/B,MAAM,EAAE,eAAe,GAAG,SAAS,EACnC,gBAAgB,EAAE,MAAM,GAAG,SAAS,KAChC,OAAO,CAAC;IACb,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,KAAK,MAAM,GAAG,SAAS,CAAC;IACjE,mBAAmB,EAAE,CACpB,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,KACxB,MAAM,GAAG,SAAS,CAAC;IACxB,aAAa,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9D,yBAAyB,EAAE,CAC1B,OAAO,EAAE,OAAO,CAAC,WAAW,EAAE;QAAE,IAAI,EAAE,QAAQ,CAAA;KAAE,CAAC,KAC7C,OAAO,CAAC;IACb,uBAAuB,EAAE,CAAC,MAAM,EAAE;QACjC,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;KACpB,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAClC,uBAAuB,EAAE,CACxB,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,eAAe,EAAE,eAAe,GAAG,SAAS,EAC5C,cAAc,EAAE,MAAM,GAAG,SAAS,KAC9B,MAAM,GAAG,SAAS,CAAC;IACxB,oBAAoB,EAAE,CAAC,QAAQ,EAAE,kBAAkB,KAAK,MAAM,CAAC;IAC/D,yBAAyB,EAAE,CAC1B,OAAO,EAAE,gBAAgB,EACzB,aAAa,EAAE,SAAS,WAAW,EAAE,KACjC,IAAI,CAAC;IACV,cAAc,EAAE,SAAS,WAAW,EAAE,CAAC;IACvC,YAAY,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,6BAA6B,EAAE,MAAM,IAAI,CAAC;IAC1C,mBAAmB,EAAE,CAAC,OAAO,EAAE;QAC9B,OAAO,EAAE,CAAC,CAAC;QACX,QAAQ,EAAE,wBAAwB,EAAE,CAAC;KACrC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpB,+BAA+B,CAAC,EAAE,CACjC,cAAc,EAAE,gBAAgB,EAChC,cAAc,EAAE;QACf,OAAO,EAAE,CAAC,CAAC;QACX,QAAQ,EAAE,wBAAwB,EAAE,CAAC;KACrC,KACG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACpC,GACC,OAAO,CAAC,IAAI,CAAC,CAoSf"}

package/dist/lib/runtime/account-check.js

@@ -1,6 +1,7 @@
 import { maskEmail } from "../logger.js";
 import { CODEX_UNAVAILABLE_PROBE_NOTE } from "../quota-probe.js";
 import { isCodexUnavailableError } from "../errors.js";
+import { reconcilePinnedAccountIndex, } from "../storage.js";
 export async function runRuntimeAccountCheck(deepProbe, deps) {
     const loadedStorage = await deps.hydrateEmails(await deps.loadAccounts());
     const workingStorage = loadedStorage
@@ -185,8 +186,15 @@ export async function runRuntimeAccountCheck(deepProbe, deps) {
         }
     }
     if (state.removeFromActive.size > 0) {
+        // Follow the manual pin by identity across the removal: the filter can drop
+        // several accounts at once, so a raw index would point at the wrong account
+        // (or out of range, wedging the pool). See #474.
+        const pinnedAccount = typeof workingStorage.pinnedAccountIndex === "number"
+            ? workingStorage.accounts[workingStorage.pinnedAccountIndex]
+            : undefined;
         workingStorage.accounts = workingStorage.accounts.filter((account) => !state.removeFromActive.has(account.refreshToken));
         deps.clampRuntimeActiveIndices(workingStorage, deps.MODEL_FAMILIES);
+        workingStorage.pinnedAccountIndex = reconcilePinnedAccountIndex(pinnedAccount, workingStorage.accounts);
         state.storageChanged = true;
     }
     const persistAccountAndFlaggedStorage = deps.persistAccountAndFlaggedStorage;

package/dist/lib/runtime/rotation-storage-meta.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rotation-storage-meta.d.ts","sourceRoot":"","sources":["../../../lib/runtime/rotation-storage-meta.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAqCnE,MAAM,WAAW,WAAW;IAC3B,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,kBAAkB,EAAE,MAAM,CAAC;CAC3B;AA8BD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CACtC,WAAW,GAAE,MAAyB,GACpC,WAAW,CA6Eb;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAC7C,WAAW,GAAE,MAAyB,GACpC,MAAM,GAAG,IAAI,CAEf;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,IAAI,IAAI,CAE9C;AAED;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAC9C,oBAAoB,EAAE,oBAAoB,GAAG,IAAI,EACjD,sBAAsB,EAAE,MAAM,EAC9B,WAAW,GAAE,MAAyB,GACpC,MAAM,CAOR"}
+{"version":3,"file":"rotation-storage-meta.d.ts","sourceRoot":"","sources":["../../../lib/runtime/rotation-storage-meta.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAqCnE,MAAM,WAAW,WAAW;IAC3B,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,kBAAkB,EAAE,MAAM,CAAC;CAC3B;AA8BD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CACtC,WAAW,GAAE,MAAyB,GACpC,WAAW,CAmFb;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAC7C,WAAW,GAAE,MAAyB,GACpC,MAAM,GAAG,IAAI,CAEf;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,IAAI,IAAI,CAE9C;AAED;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAC9C,oBAAoB,EAAE,oBAAoB,GAAG,IAAI,EACjD,sBAAsB,EAAE,MAAM,EAC9B,WAAW,GAAE,MAAyB,GACpC,MAAM,CAOR"}

package/dist/lib/runtime/rotation-storage-meta.js

@@ -78,9 +78,15 @@ export function readStorageMetaFromDisk(storagePath = getStoragePath()) {
             return metaFromSnapshot(refreshed);
         }
         const parsed = JSON.parse(bytes.toString("utf8"));
+        // Validate exactly like readPinAndGenFromDisk / the loader / the zod schema:
+        // a non-integer or negative pin is rejected (null), never truncated. This is
+        // the value the proxy actually routes on, so a malformed disk pin must not
+        // slip past here and reach chooseAccount (a negative index wedges the pool).
         const pinnedAccountIndex = typeof parsed.pinnedAccountIndex === "number" &&
-            Number.isFinite(parsed.pinnedAccountIndex)
-            ? Math.trunc(parsed.pinnedAccountIndex)
+            Number.isFinite(parsed.pinnedAccountIndex) &&
+            Number.isInteger(parsed.pinnedAccountIndex) &&
+            parsed.pinnedAccountIndex >= 0
+            ? parsed.pinnedAccountIndex
             : null;
         const affinityGeneration = typeof parsed.affinityGeneration === "number" &&
             Number.isFinite(parsed.affinityGeneration) &&

package/dist/lib/storage/account-port.d.ts

@@ -33,6 +33,7 @@ export declare function importAccountsSnapshot(params: {
         imported: AccountStorageV3;
         maxAccounts: number;
         deduplicateAccounts: (accounts: AccountStorageV3["accounts"]) => AccountStorageV3["accounts"];
+        findMatchingAccountIndex: (accounts: AccountStorageV3["accounts"], candidate: AccountStorageV3["accounts"][number]) => number | undefined;
     }) => {
         newStorage: AccountStorageV3;
         imported: number;
@@ -41,6 +42,7 @@ export declare function importAccountsSnapshot(params: {
     };
     maxAccounts: number;
     deduplicateAccounts: (accounts: AccountStorageV3["accounts"]) => AccountStorageV3["accounts"];
+    findMatchingAccountIndex: (accounts: AccountStorageV3["accounts"], candidate: AccountStorageV3["accounts"][number]) => number | undefined;
     logInfo: (message: string, details: Record<string, unknown>) => void;
 }): Promise<{
     imported: number;

package/dist/lib/storage/account-port.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account-port.d.ts","sourceRoot":"","sources":["../../../lib/storage/account-port.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE1D,wBAAsB,sBAAsB,CAAC,MAAM,EAAE;IACpD,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,OAAO,CAAC;IACf,kBAAkB,EAAE,MAAM,CAAC;IAC3B,gBAAgB,EACb;QACA,MAAM,EAAE,OAAO,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC;QACpB,QAAQ,EAAE,gBAAgB,GAAG,IAAI,CAAC;KACjC,GACD,SAAS,CAAC;IACb,0BAA0B,EAAE,MAAM,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACnE,kBAAkB,EAAE,MAAM,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAC3D,oBAAoB,EAAE,CAAC,IAAI,EAAE;QAC5B,YAAY,EAAE,MAAM,CAAC;QACrB,KAAK,EAAE,OAAO,CAAC;QACf,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAAC;QACjC,YAAY,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QAC9D,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;KACrE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpB,YAAY,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC9D,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;CACrE,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBhB;AAED,wBAAsB,sBAAsB,CAAC,MAAM,EAAE;IACpD,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,CAAC,IAAI,EAAE;QACtB,YAAY,EAAE,MAAM,CAAC;QACrB,uBAAuB,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,gBAAgB,GAAG,IAAI,CAAC;KACrE,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAChC,uBAAuB,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,gBAAgB,GAAG,IAAI,CAAC;IACrE,6BAA6B,EAAE,CAAC,CAAC,EAChC,OAAO,EAAE,CACR,OAAO,EAAE,gBAAgB,GAAG,IAAI,EAChC,OAAO,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,KACjD,OAAO,CAAC,CAAC,CAAC,KACX,OAAO,CAAC,CAAC,CAAC,CAAC;IAChB,qBAAqB,EAAE,CAAC,IAAI,EAAE;QAC7B,QAAQ,EAAE,gBAAgB,GAAG,IAAI,CAAC;QAClC,QAAQ,EAAE,gBAAgB,CAAC;QAC3B,WAAW,EAAE,MAAM,CAAC;QACpB,mBAAmB,EAAE,CACpB,QAAQ,EAAE,gBAAgB,CAAC,UAAU,CAAC,KAClC,gBAAgB,CAAC,UAAU,CAAC,CAAC;KAClC,KAAK;QACL,UAAU,EAAE,gBAAgB,CAAC;QAC7B,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,WAAW,EAAE,MAAM,CAAC;IACpB,mBAAmB,EAAE,CACpB,QAAQ,EAAE,gBAAgB,CAAC,UAAU,CAAC,KAClC,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAClC,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;CACrE,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CA8BhE"}
+{"version":3,"file":"account-port.d.ts","sourceRoot":"","sources":["../../../lib/storage/account-port.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE1D,wBAAsB,sBAAsB,CAAC,MAAM,EAAE;IACpD,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,OAAO,CAAC;IACf,kBAAkB,EAAE,MAAM,CAAC;IAC3B,gBAAgB,EACb;QACA,MAAM,EAAE,OAAO,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC;QACpB,QAAQ,EAAE,gBAAgB,GAAG,IAAI,CAAC;KACjC,GACD,SAAS,CAAC;IACb,0BAA0B,EAAE,MAAM,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACnE,kBAAkB,EAAE,MAAM,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAC3D,oBAAoB,EAAE,CAAC,IAAI,EAAE;QAC5B,YAAY,EAAE,MAAM,CAAC;QACrB,KAAK,EAAE,OAAO,CAAC;QACf,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAAC;QACjC,YAAY,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QAC9D,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;KACrE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpB,YAAY,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC9D,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;CACrE,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBhB;AAED,wBAAsB,sBAAsB,CAAC,MAAM,EAAE;IACpD,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,CAAC,IAAI,EAAE;QACtB,YAAY,EAAE,MAAM,CAAC;QACrB,uBAAuB,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,gBAAgB,GAAG,IAAI,CAAC;KACrE,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAChC,uBAAuB,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,gBAAgB,GAAG,IAAI,CAAC;IACrE,6BAA6B,EAAE,CAAC,CAAC,EAChC,OAAO,EAAE,CACR,OAAO,EAAE,gBAAgB,GAAG,IAAI,EAChC,OAAO,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,KACjD,OAAO,CAAC,CAAC,CAAC,KACX,OAAO,CAAC,CAAC,CAAC,CAAC;IAChB,qBAAqB,EAAE,CAAC,IAAI,EAAE;QAC7B,QAAQ,EAAE,gBAAgB,GAAG,IAAI,CAAC;QAClC,QAAQ,EAAE,gBAAgB,CAAC;QAC3B,WAAW,EAAE,MAAM,CAAC;QACpB,mBAAmB,EAAE,CACpB,QAAQ,EAAE,gBAAgB,CAAC,UAAU,CAAC,KAClC,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAClC,wBAAwB,EAAE,CACzB,QAAQ,EAAE,gBAAgB,CAAC,UAAU,CAAC,EACtC,SAAS,EAAE,gBAAgB,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAC3C,MAAM,GAAG,SAAS,CAAC;KACxB,KAAK;QACL,UAAU,EAAE,gBAAgB,CAAC;QAC7B,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,WAAW,EAAE,MAAM,CAAC;IACpB,mBAAmB,EAAE,CACpB,QAAQ,EAAE,gBAAgB,CAAC,UAAU,CAAC,KAClC,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAGlC,wBAAwB,EAAE,CACzB,QAAQ,EAAE,gBAAgB,CAAC,UAAU,CAAC,EACtC,SAAS,EAAE,gBAAgB,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAC3C,MAAM,GAAG,SAAS,CAAC;IACxB,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;CACrE,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CA+BhE"}

package/dist/lib/storage/account-port.js

@@ -24,6 +24,7 @@ export async function importAccountsSnapshot(params) {
             imported: normalized,
             maxAccounts: params.maxAccounts,
             deduplicateAccounts: params.deduplicateAccounts,
+            findMatchingAccountIndex: params.findMatchingAccountIndex,
         });
         await persist(merged.newStorage);
         return {

package/dist/lib/storage/import-export.d.ts

@@ -15,6 +15,7 @@ export declare function mergeImportedAccounts(params: {
     imported: AccountStorageV3;
     maxAccounts: number;
     deduplicateAccounts: (accounts: AccountStorageV3["accounts"]) => AccountStorageV3["accounts"];
+    findMatchingAccountIndex: (accounts: AccountStorageV3["accounts"], candidate: AccountStorageV3["accounts"][number]) => number | undefined;
 }): {
     newStorage: AccountStorageV3;
     imported: number;

package/dist/lib/storage/import-export.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"import-export.d.ts","sourceRoot":"","sources":["../../../lib/storage/import-export.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAsD1D,wBAAsB,oBAAoB,CAAC,MAAM,EAAE;IAClD,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACjC,YAAY,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC9D,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;CACrE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuChB;AAED,wBAAsB,cAAc,CAAC,MAAM,EAAE;IAC5C,YAAY,EAAE,MAAM,CAAC;IACrB,uBAAuB,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,gBAAgB,GAAG,IAAI,CAAC;CACrE,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA8C5B;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE;IAC7C,QAAQ,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAClC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,mBAAmB,EAAE,CACpB,QAAQ,EAAE,gBAAgB,CAAC,UAAU,CAAC,KAClC,gBAAgB,CAAC,UAAU,CAAC,CAAC;CAClC,GAAG;IACH,UAAU,EAAE,gBAAgB,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CAChB,CAgCA"}
+{"version":3,"file":"import-export.d.ts","sourceRoot":"","sources":["../../../lib/storage/import-export.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAsD1D,wBAAsB,oBAAoB,CAAC,MAAM,EAAE;IAClD,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACjC,YAAY,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC9D,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;CACrE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuChB;AAED,wBAAsB,cAAc,CAAC,MAAM,EAAE;IAC5C,YAAY,EAAE,MAAM,CAAC;IACrB,uBAAuB,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,gBAAgB,GAAG,IAAI,CAAC;CACrE,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA8C5B;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE;IAC7C,QAAQ,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAClC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,mBAAmB,EAAE,CACpB,QAAQ,EAAE,gBAAgB,CAAC,UAAU,CAAC,KAClC,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAGlC,wBAAwB,EAAE,CACzB,QAAQ,EAAE,gBAAgB,CAAC,UAAU,CAAC,EACtC,SAAS,EAAE,gBAAgB,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAC3C,MAAM,GAAG,SAAS,CAAC;CACxB,GAAG;IACH,UAAU,EAAE,gBAAgB,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CAChB,CA6DA"}

package/dist/lib/storage/import-export.js

@@ -127,6 +127,14 @@ export async function readImportFile(params) {
 export function mergeImportedAccounts(params) {
     const existingAccounts = params.existing?.accounts ?? [];
     const existingActiveIndex = params.existing?.activeIndex ?? 0;
+    // Resolve the pinned account by IDENTITY before merging. The merged list is
+    // deduplicated below, which can move accounts to different positions, so a raw
+    // positional pin can end up selecting a DIFFERENT account (in range, wrong
+    // account) instead of the one the user pinned.
+    const existingPinnedIndex = params.existing?.pinnedAccountIndex;
+    const pinnedAccount = typeof existingPinnedIndex === "number"
+        ? existingAccounts[existingPinnedIndex]
+        : undefined;
     const merged = [...existingAccounts, ...params.imported.accounts];
     if (merged.length > params.maxAccounts) {
         const deduped = params.deduplicateAccounts(merged);
@@ -142,6 +150,23 @@ export function mergeImportedAccounts(params) {
         activeIndex: existingActiveIndex,
         activeIndexByFamily: params.existing?.activeIndexByFamily,
     };
+    // Preserve the user's manual pin (#474) and affinity generation across import.
+    // Rebuilding storage from scratch here previously dropped a `switch <n>` pin
+    // and reset affinityGeneration to 0, which lets a running proxy holding a
+    // higher in-memory generation clobber a newer CLI pin. The pin is re-resolved
+    // against the deduplicated list by identity — a range check alone would happily
+    // keep an in-range index that dedupe has repointed at another account. When the
+    // pinned account no longer resolves (removed or ambiguous) the pin is dropped
+    // rather than left pointing somewhere arbitrary.
+    if (pinnedAccount) {
+        const remappedPinnedIndex = params.findMatchingAccountIndex(deduplicatedAccounts, pinnedAccount);
+        if (remappedPinnedIndex !== undefined) {
+            newStorage.pinnedAccountIndex = remappedPinnedIndex;
+        }
+    }
+    if (typeof params.existing?.affinityGeneration === "number") {
+        newStorage.affinityGeneration = params.existing.affinityGeneration;
+    }
     const importedCount = deduplicatedAccounts.length - deduplicatedExistingAccounts.length;
     const skippedCount = params.imported.accounts.length - importedCount;
     return {

package/dist/lib/storage/project-migration.d.ts

@@ -6,5 +6,5 @@ export declare function loadNormalizedStorageFromPath(path: string, label: strin
     }>;
     logWarn: (message: string, details: Record<string, unknown>) => void;
 }): Promise<AccountStorageV3 | null>;
-export declare function mergeStorageForMigration(current: AccountStorageV3 | null, incoming: AccountStorageV3, normalizeAccountStorage: (value: unknown) => AccountStorageV3 | null): AccountStorageV3;
+export declare function mergeStorageForMigration(current: AccountStorageV3 | null, incoming: AccountStorageV3, normalizeAccountStorage: (value: unknown) => AccountStorageV3 | null, findMatchingAccountIndex: (accounts: AccountStorageV3["accounts"], candidate: AccountStorageV3["accounts"][number]) => number | undefined): AccountStorageV3;
 //# sourceMappingURL=project-migration.d.ts.map

package/dist/lib/storage/project-migration.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"project-migration.d.ts","sourceRoot":"","sources":["../../../lib/storage/project-migration.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE1D,wBAAsB,6BAA6B,CAClD,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,IAAI,EAAE;IACL,oBAAoB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;QAC/C,UAAU,EAAE,gBAAgB,GAAG,IAAI,CAAC;QACpC,YAAY,EAAE,MAAM,EAAE,CAAC;KACvB,CAAC,CAAC;IACH,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;CACrE,GACC,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAoBlC;AAED,wBAAgB,wBAAwB,CACvC,OAAO,EAAE,gBAAgB,GAAG,IAAI,EAChC,QAAQ,EAAE,gBAAgB,EAC1B,uBAAuB,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,gBAAgB,GAAG,IAAI,GAClE,gBAAgB,CAelB"}
+{"version":3,"file":"project-migration.d.ts","sourceRoot":"","sources":["../../../lib/storage/project-migration.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE1D,wBAAsB,6BAA6B,CAClD,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,IAAI,EAAE;IACL,oBAAoB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;QAC/C,UAAU,EAAE,gBAAgB,GAAG,IAAI,CAAC;QACpC,YAAY,EAAE,MAAM,EAAE,CAAC;KACvB,CAAC,CAAC;IACH,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;CACrE,GACC,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAoBlC;AAED,wBAAgB,wBAAwB,CACvC,OAAO,EAAE,gBAAgB,GAAG,IAAI,EAChC,QAAQ,EAAE,gBAAgB,EAC1B,uBAAuB,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,gBAAgB,GAAG,IAAI,EAIpE,wBAAwB,EAAE,CACzB,QAAQ,EAAE,gBAAgB,CAAC,UAAU,CAAC,EACtC,SAAS,EAAE,gBAAgB,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAC3C,MAAM,GAAG,SAAS,GACrB,gBAAgB,CAuClB"}

package/dist/lib/storage/project-migration.js

@@ -20,18 +20,44 @@ export async function loadNormalizedStorageFromPath(path, label, deps) {
         return null;
     }
 }
-export function mergeStorageForMigration(current, incoming, normalizeAccountStorage) {
+export function mergeStorageForMigration(current, incoming, normalizeAccountStorage, 
+// Injected like `normalizeAccountStorage` rather than imported from
+// ../storage.js, which would put this leaf module in a dependency cycle with
+// the storage barrel.
+findMatchingAccountIndex) {
     if (!current) {
         return incoming;
     }
+    // Resolve the pinned account by IDENTITY before merging. normalizeAccountStorage
+    // deduplicates the merged list but only RANGE-validates the pin, so a raw
+    // positional pin that survives the range check can still end up pointing at a
+    // different account once dedupe shifts positions.
+    const pinnedAccount = typeof current.pinnedAccountIndex === "number"
+        ? current.accounts[current.pinnedAccountIndex]
+        : undefined;
     const merged = normalizeAccountStorage({
         version: 3,
         activeIndex: current.activeIndex,
         activeIndexByFamily: current.activeIndexByFamily,
         accounts: [...current.accounts, ...incoming.accounts],
+        // Carry the manual pin (#474) and affinity generation from the current
+        // storage through legacy-project migration; normalizeAccountStorage
+        // validates/clamps them against the merged account list. Omitting them
+        // dropped the pin and reset affinityGeneration to 0, which let a running
+        // proxy clobber a newer CLI pin.
+        pinnedAccountIndex: current.pinnedAccountIndex,
+        affinityGeneration: current.affinityGeneration,
     });
     if (!merged) {
         return current;
     }
-    return merged;
+    if (!pinnedAccount) {
+        return merged;
+    }
+    // Re-point the pin at the account the user actually pinned; clear it when that
+    // account no longer resolves in the normalized list.
+    return {
+        ...merged,
+        pinnedAccountIndex: findMatchingAccountIndex(merged.accounts, pinnedAccount),
+    };
 }

package/dist/lib/storage.d.ts

@@ -35,6 +35,16 @@ type AccountMatchOptions = {
     allowUniqueAccountIdFallbackWithoutEmail?: boolean;
 };
 export declare function findMatchingAccountIndex<T extends Pick<AccountLike, "accountId" | "email" | "refreshToken">>(accounts: readonly T[], candidate: Pick<AccountLike, "accountId" | "email" | "refreshToken">, options?: AccountMatchOptions): number | undefined;
+/**
+ * Re-resolve a manual pin after the account list changes (deletion / auto-removal).
+ * `pinnedAccountIndex` is a POSITION, so once accounts are removed or reordered the
+ * raw index silently points at a DIFFERENT account — or out of range, which wedges
+ * the pool. Capture the pinned account BEFORE the change and pass it here to follow
+ * it by identity: returns its new index, or `undefined` when it is no longer present
+ * (the pin is cleared, never left dangling at a stale slot). See #474 — a manual pin
+ * must keep pointing at the account the user chose, or be dropped.
+ */
+export declare function reconcilePinnedAccountIndex(pinnedAccount: Pick<AccountLike, "accountId" | "email" | "refreshToken"> | undefined, nextAccounts: readonly Pick<AccountLike, "accountId" | "email" | "refreshToken">[]): number | undefined;
 export declare function resolveAccountSelectionIndex<T extends Pick<AccountLike, "accountId" | "email" | "refreshToken">>(accounts: readonly T[], candidate: Pick<AccountLike, "accountId" | "email" | "refreshToken">, fallbackIndex?: number): number;
 /**
  * Removes duplicate accounts, keeping the most recently used entry for each