codex-multi-auth 2.7.0 → 2.8.0

package/dist/lib/cli.d.ts

@@ -24,6 +24,8 @@ export interface ExistingAccountInfo {
     quota5hResetAtMs?: number;
     quota7dLeftPercent?: number;
     quota7dResetAtMs?: number;
+    quotaPrimaryWindowMinutes?: number;
+    quotaSecondaryWindowMinutes?: number;
     quotaRateLimited?: boolean;
     quotaExhausted?: boolean;
     isCurrentAccount?: boolean;

package/dist/lib/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../lib/cli.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EAGN,KAAK,EACL,KAAK,aAAa,EAClB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAEjF;;;;GAIG;AACH,wBAAgB,oBAAoB,IAAI,OAAO,CAQ9C;AAED,wBAAsB,uBAAuB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAcpF;AAED,MAAM,MAAM,SAAS,GAClB,KAAK,GACL,UAAU,GACV,KAAK,GACL,UAAU,GACV,OAAO,GACP,QAAQ,GACR,OAAO,GACP,YAAY,GACZ,gBAAgB,GAChB,QAAQ,CAAC;AAEZ,MAAM,WAAW,mBAAmB;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,cAAc,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACxC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,0BAA0B,CAAC,EAAE,OAAO,CAAC;IACrC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,UAAU,CAAC,EAAE,YAAY,GAAG,MAAM,CAAC;IACnC,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,gBAAgB;IAChC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC;CACpD;AAED,MAAM,WAAW,eAAe;IAC/B,IAAI,EAAE,SAAS,CAAC;IAChB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,SAAS,CAAC,EAAE,OAAO,CAAC;CACpB;AA0FD,wBAAsB,eAAe,CACpC,gBAAgB,EAAE,mBAAmB,EAAE,EACvC,OAAO,GAAE,gBAAqB,GAC5B,OAAO,CAAC,eAAe,CAAC,CAqG1B;AAED,MAAM,WAAW,yBAAyB;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,SAAS,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,uBAAuB;IACvC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wBAAsB,sBAAsB,CAC3C,UAAU,EAAE,yBAAyB,EAAE,EACvC,OAAO,GAAE,uBAA4B,GACnC,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC,CAyC3C;AAED,OAAO,EAAE,KAAK,EAAE,CAAC;AACjB,YAAY,EAAE,aAAa,EAAE,CAAC"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../lib/cli.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EAGN,KAAK,EACL,KAAK,aAAa,EAClB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAEjF;;;;GAIG;AACH,wBAAgB,oBAAoB,IAAI,OAAO,CAQ9C;AAED,wBAAsB,uBAAuB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAcpF;AAED,MAAM,MAAM,SAAS,GAClB,KAAK,GACL,UAAU,GACV,KAAK,GACL,UAAU,GACV,OAAO,GACP,QAAQ,GACR,OAAO,GACP,YAAY,GACZ,gBAAgB,GAChB,QAAQ,CAAC;AAEZ,MAAM,WAAW,mBAAmB;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,2BAA2B,CAAC,EAAE,MAAM,CAAC;IACrC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,cAAc,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACxC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,0BAA0B,CAAC,EAAE,OAAO,CAAC;IACrC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,UAAU,CAAC,EAAE,YAAY,GAAG,MAAM,CAAC;IACnC,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,gBAAgB;IAChC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC;CACpD;AAED,MAAM,WAAW,eAAe;IAC/B,IAAI,EAAE,SAAS,CAAC;IAChB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,SAAS,CAAC,EAAE,OAAO,CAAC;CACpB;AA0FD,wBAAsB,eAAe,CACpC,gBAAgB,EAAE,mBAAmB,EAAE,EACvC,OAAO,GAAE,gBAAqB,GAC5B,OAAO,CAAC,eAAe,CAAC,CAqG1B;AAED,MAAM,WAAW,yBAAyB;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,SAAS,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,uBAAuB;IACvC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wBAAsB,sBAAsB,CAC3C,UAAU,EAAE,yBAAyB,EAAE,EACvC,OAAO,GAAE,uBAA4B,GACnC,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC,CAyC3C;AAED,OAAO,EAAE,KAAK,EAAE,CAAC;AACjB,YAAY,EAAE,aAAa,EAAE,CAAC"}

package/dist/lib/codex-cli/writer.d.ts

@@ -6,6 +6,57 @@ interface ActiveSelection {
     expiresAt?: number;
     idToken?: string;
 }
+/**
+ * Whether `config.toml` may be rewritten to pin the credential store.
+ *
+ * Exported so callers that only *plan* a rewrite — `doctor --fix --dry-run` —
+ * can report the same outcome the real run would produce, instead of promising
+ * a change the opt-out would suppress.
+ */
+export declare function shouldEnforceCodexCliFileAuthStore(): boolean;
+/**
+ * Reads the top-level `cli_auth_credentials_store` value out of a raw
+ * `config.toml`.
+ *
+ * Mirrors the scoping rules of {@link ensureCodexCliFileAuthStore}: assignments
+ * inside a `[table]` belong to that table, so only lines before the first table
+ * header describe the official CLI's default credential store. Reporting a
+ * profile-scoped value as the effective one would let `doctor` call a config
+ * healthy while the CLI still reaches for the keychain.
+ *
+ * Both TOML string forms count. A literal string (`'file'`) is as valid as a
+ * basic string (`"file"`), so treating only the latter as real would make
+ * `doctor` warn about a perfectly healthy config. Literal strings have no
+ * escape sequences, and the values in play here are bare identifiers, so a
+ * non-greedy character class is an exact match for both forms.
+ *
+ * @param rawConfig - Full text of `config.toml`.
+ * @returns The declared mode, or `null` when no top-level assignment exists.
+ */
+export declare function readTopLevelCodexCliAuthStoreMode(rawConfig: string): string | null;
+/**
+ * Persists `cli_auth_credentials_store = "file"` as a top-level key in the
+ * official Codex CLI `config.toml`.
+ *
+ * The wrapper already appends `-c cli_auth_credentials_store="file"` to every
+ * command it forwards, but that only covers processes it launches itself.
+ * Third-party front-ends (menu-bar apps such as CodexBar, editor extensions)
+ * exec the official binary directly, so the *persisted* value is what decides
+ * whether the official CLI reaches into the macOS login keychain. Leaving it on
+ * `"keychain"` is what produces the repeated "Always Allow" prompts reported in
+ * issue #641.
+ *
+ * Only top-level assignments are rewritten. A `cli_auth_credentials_store`
+ * inside a `[profiles.*]` table must be left alone: rewriting it in place would
+ * mangle a scoped setting while still leaving the top-level default pointed at
+ * the keychain, so the prompts would continue.
+ *
+ * @param configPath - Config file to reconcile; defaults to the resolved Codex
+ * CLI `config.toml`.
+ * @returns `true` when the file was rewritten, `false` when it was already
+ * correct or enforcement is disabled.
+ */
+export declare function ensureCodexCliFileAuthStore(configPath?: string): Promise<boolean>;
 export declare function setCodexCliActiveSelection(selection: ActiveSelection): Promise<boolean>;
 export declare function getLastCodexCliSelectionWriteTimestamp(): number;
 export {};

package/dist/lib/codex-cli/writer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"writer.d.ts","sourceRoot":"","sources":["../../../lib/codex-cli/writer.ts"],"names":[],"mappings":"AAoBA,UAAU,eAAe;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AA2XD,wBAAsB,0BAA0B,CAC/C,SAAS,EAAE,eAAe,GACxB,OAAO,CAAC,OAAO,CAAC,CAqMlB;AAED,wBAAgB,sCAAsC,IAAI,MAAM,CAE/D"}
+{"version":3,"file":"writer.d.ts","sourceRoot":"","sources":["../../../lib/codex-cli/writer.ts"],"names":[],"mappings":"AAoBA,UAAU,eAAe;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AA8ND;;;;;;GAMG;AACH,wBAAgB,kCAAkC,IAAI,OAAO,CAG5D;AAiBD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,iCAAiC,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CASlF;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,2BAA2B,CAChD,UAAU,GAAE,MAAgC,GAC1C,OAAO,CAAC,OAAO,CAAC,CAgDlB;AAmHD,wBAAsB,0BAA0B,CAC/C,SAAS,EAAE,eAAe,GACxB,OAAO,CAAC,OAAO,CAAC,CAqMlB;AAED,wBAAgB,sCAAsC,IAAI,MAAM,CAE/D"}

package/dist/lib/codex-cli/writer.js

@@ -199,30 +199,111 @@ async function atomicWriteText(path, content) {
 async function atomicWriteJson(path, payload) {
     return atomicWriteText(path, JSON.stringify(payload, null, 2));
 }
-function shouldEnforceCodexCliFileAuthStore() {
+/**
+ * Whether `config.toml` may be rewritten to pin the credential store.
+ *
+ * Exported so callers that only *plan* a rewrite — `doctor --fix --dry-run` —
+ * can report the same outcome the real run would produce, instead of promising
+ * a change the opt-out would suppress.
+ */
+export function shouldEnforceCodexCliFileAuthStore() {
     const override = (process.env.CODEX_MULTI_AUTH_ENFORCE_CLI_FILE_AUTH_STORE ?? "1").trim();
     return override !== "0";
 }
-function ensureTrailingNewline(value) {
-    return value.endsWith("\n") ? value : `${value}\n`;
+/**
+ * Matches a complete TOML table header, mirroring `readTomlTableName` in
+ * `lib/runtime/config-toml.ts` (plus an optional trailing comment).
+ *
+ * A loose `/^\s*\[/` would also match a continuation line of a multi-line array
+ * such as `[1, 2],`, cutting the top-level scan short. The writer would then
+ * miss a real top-level assignment below it and insert a second one — a
+ * duplicate key, which is invalid TOML and stops the official CLI from starting.
+ */
+const TOML_TABLE_HEADER_PATTERN = /^\s*\[{1,2}\s*[^\]]+?\s*\]{1,2}\s*(?:#.*)?$/;
+function ensureTrailingNewline(value, lineEnding = "\n") {
+    return value.endsWith("\n") ? value : `${value}${lineEnding}`;
 }
-async function ensureCodexCliFileAuthStore(configPath) {
+/**
+ * Reads the top-level `cli_auth_credentials_store` value out of a raw
+ * `config.toml`.
+ *
+ * Mirrors the scoping rules of {@link ensureCodexCliFileAuthStore}: assignments
+ * inside a `[table]` belong to that table, so only lines before the first table
+ * header describe the official CLI's default credential store. Reporting a
+ * profile-scoped value as the effective one would let `doctor` call a config
+ * healthy while the CLI still reaches for the keychain.
+ *
+ * Both TOML string forms count. A literal string (`'file'`) is as valid as a
+ * basic string (`"file"`), so treating only the latter as real would make
+ * `doctor` warn about a perfectly healthy config. Literal strings have no
+ * escape sequences, and the values in play here are bare identifiers, so a
+ * non-greedy character class is an exact match for both forms.
+ *
+ * @param rawConfig - Full text of `config.toml`.
+ * @returns The declared mode, or `null` when no top-level assignment exists.
+ */
+export function readTopLevelCodexCliAuthStoreMode(rawConfig) {
+    for (const line of rawConfig.split(/\r?\n/)) {
+        if (TOML_TABLE_HEADER_PATTERN.test(line))
+            break;
+        const match = line.match(/^\s*cli_auth_credentials_store\s*=\s*(?:"([^"]*)"|'([^']*)')\s*(?:#.*)?$/);
+        if (match)
+            return (match[1] ?? match[2] ?? "").trim() || null;
+    }
+    return null;
+}
+/**
+ * Persists `cli_auth_credentials_store = "file"` as a top-level key in the
+ * official Codex CLI `config.toml`.
+ *
+ * The wrapper already appends `-c cli_auth_credentials_store="file"` to every
+ * command it forwards, but that only covers processes it launches itself.
+ * Third-party front-ends (menu-bar apps such as CodexBar, editor extensions)
+ * exec the official binary directly, so the *persisted* value is what decides
+ * whether the official CLI reaches into the macOS login keychain. Leaving it on
+ * `"keychain"` is what produces the repeated "Always Allow" prompts reported in
+ * issue #641.
+ *
+ * Only top-level assignments are rewritten. A `cli_auth_credentials_store`
+ * inside a `[profiles.*]` table must be left alone: rewriting it in place would
+ * mangle a scoped setting while still leaving the top-level default pointed at
+ * the keychain, so the prompts would continue.
+ *
+ * @param configPath - Config file to reconcile; defaults to the resolved Codex
+ * CLI `config.toml`.
+ * @returns `true` when the file was rewritten, `false` when it was already
+ * correct or enforcement is disabled.
+ */
+export async function ensureCodexCliFileAuthStore(configPath = getCodexCliConfigPath()) {
     if (!shouldEnforceCodexCliFileAuthStore())
         return false;
     const desired = 'cli_auth_credentials_store = "file"';
     const raw = existsSync(configPath) ? await fs.readFile(configPath, "utf-8") : "";
+    // Quote style is not ours to normalize: a literal-string `'file'` already
+    // keeps the CLI off the keychain, so rewriting it to `"file"` would churn a
+    // healthy config on every wrapper startup for no behavioral gain.
+    if (readTopLevelCodexCliAuthStoreMode(raw) === "file")
+        return false;
+    // Preserve the file's existing line endings, as the runtime config rewriter
+    // does. Splitting on /\r?\n/ and rejoining with "\n" would silently convert a
+    // CRLF config.toml to LF -- an edit the user never asked for, and one this
+    // code now risks on every wrapper startup rather than only on account switch.
+    const lineEnding = raw.includes("\r\n") ? "\r\n" : "\n";
     const lines = raw.length > 0 ? raw.split(/\r?\n/) : [];
     const assignmentRegex = /^\s*cli_auth_credentials_store\s*=/;
     let replaced = false;
+    let inTopLevelTable = true;
     const nextLines = lines.map((line) => {
-        if (!replaced && assignmentRegex.test(line)) {
+        if (TOML_TABLE_HEADER_PATTERN.test(line))
+            inTopLevelTable = false;
+        if (inTopLevelTable && !replaced && assignmentRegex.test(line)) {
             replaced = true;
             return desired;
         }
         return line;
     });
     if (!replaced) {
-        let insertAt = nextLines.findIndex((line) => /^\s*\[/.test(line));
+        let insertAt = nextLines.findIndex((line) => TOML_TABLE_HEADER_PATTERN.test(line));
         if (insertAt < 0)
             insertAt = nextLines.length;
         nextLines.splice(insertAt, 0, desired);
@@ -230,8 +311,8 @@ async function ensureCodexCliFileAuthStore(configPath) {
             nextLines.splice(insertAt + 1, 0, "");
         }
     }
-    const nextRaw = ensureTrailingNewline(nextLines.join("\n"));
-    if (nextRaw === ensureTrailingNewline(raw)) {
+    const nextRaw = ensureTrailingNewline(nextLines.join(lineEnding), lineEnding);
+    if (nextRaw === ensureTrailingNewline(raw, lineEnding)) {
         return false;
     }
     await atomicWriteText(configPath, nextRaw);

package/dist/lib/codex-manager/login-menu-actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login-menu-actions.d.ts","sourceRoot":"","sources":["../../../lib/codex-manager/login-menu-actions.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAEjD,OAAO,EAEN,KAAK,gBAAgB,EAGrB,KAAK,kBAAkB,EAGvB,MAAM,eAAe,CAAC;AASvB,OAAO,EACN,KAAK,eAAe,EAKpB,MAAM,kBAAkB,CAAC;AAG1B;;;;;GAKG;AAEH,gBAAgB;AAChB,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;AAE7D,gBAAgB;AAChB,wBAAsB,qBAAqB,CAC1C,YAAY,EAAE,kBAAkB,GAAG,IAAI,EACvC,sBAAsB,GAAE,MAAM,GAAG,IAAW,GAC1C,OAAO,CAAC,eAAe,CAAC,CA6D1B;AAED,gBAAgB;AAChB,wBAAsB,uBAAuB,CAC5C,YAAY,EAAE,kBAAkB,GAC9B,OAAO,CAAC,iBAAiB,CAAC,CA0C5B;AAED,gBAAgB;AAChB,wBAAsB,2BAA2B,CAChD,OAAO,EAAE,kBAAkB,EAAE,GAC3B,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAkCpC;AA2GD,gBAAgB;AAChB,wBAAsB,kBAAkB,CACvC,OAAO,EAAE,gBAAgB,EACzB,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,eAAe,CAAC,CAAC,GACrD,OAAO,CAAC,IAAI,CAAC,CA8Gf"}
+{"version":3,"file":"login-menu-actions.d.ts","sourceRoot":"","sources":["../../../lib/codex-manager/login-menu-actions.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAEjD,OAAO,EAEN,KAAK,gBAAgB,EAIrB,KAAK,kBAAkB,EAGvB,MAAM,eAAe,CAAC;AASvB,OAAO,EACN,KAAK,eAAe,EAKpB,MAAM,kBAAkB,CAAC;AAG1B;;;;;GAKG;AAEH,gBAAgB;AAChB,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;AAE7D,gBAAgB;AAChB,wBAAsB,qBAAqB,CAC1C,YAAY,EAAE,kBAAkB,GAAG,IAAI,EACvC,sBAAsB,GAAE,MAAM,GAAG,IAAW,GAC1C,OAAO,CAAC,eAAe,CAAC,CA6D1B;AAED,gBAAgB;AAChB,wBAAsB,uBAAuB,CAC5C,YAAY,EAAE,kBAAkB,GAC9B,OAAO,CAAC,iBAAiB,CAAC,CA0C5B;AAED,gBAAgB;AAChB,wBAAsB,2BAA2B,CAChD,OAAO,EAAE,kBAAkB,EAAE,GAC3B,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAkCpC;AA8GD,gBAAgB;AAChB,wBAAsB,kBAAkB,CACvC,OAAO,EAAE,gBAAgB,EACzB,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,eAAe,CAAC,CAAC,GACrD,OAAO,CAAC,IAAI,CAAC,CA0Hf"}

package/dist/lib/codex-manager/login-menu-actions.js

@@ -1,7 +1,7 @@
 import { stdin as input, stdout as output } from "node:process";
 import { sanitizeEmail } from "../accounts.js";
 import { MODEL_FAMILIES } from "../prompts/codex.js";
-import { findMatchingAccountIndex, loadAccounts, setStoragePath, withAccountStorageTransaction, } from "../storage.js";
+import { findMatchingAccountIndex, loadAccounts, reconcilePinnedAccountIndex, setStoragePath, withAccountStorageTransaction, } from "../storage.js";
 import { UI_COPY } from "../ui/ui-copy.js";
 import { getUiRuntimeOptions } from "../ui/runtime.js";
 import { select } from "../ui/select.js";
@@ -179,6 +179,9 @@ function replaceManageActionStorage(target, source) {
     target.activeIndexByFamily = {
         ...source.activeIndexByFamily,
     };
+    // Keep the in-memory view's manual pin in sync with what was just persisted;
+    // the pin was re-resolved (or cleared) against the post-deletion account list.
+    target.pinnedAccountIndex = source.pinnedAccountIndex;
 }
 function resolveManageActionAccountIndex(storage, fallbackIndex, account) {
     if (account) {
@@ -236,8 +239,16 @@ export async function handleManageAction(storage, menuResult) {
                 if (!matchesManageActionAccount(selectedAccount, nextAccount)) {
                     return;
                 }
+                // Capture the pinned account BEFORE the splice so the manual pin can be
+                // followed by identity afterwards. resetManageActionSelection only remaps
+                // activeIndex; without this the pin keeps its raw slot and silently points
+                // at a different account (or wedges the pool). See #474.
+                const pinnedAccount = typeof nextStorage.pinnedAccountIndex === "number"
+                    ? nextStorage.accounts[nextStorage.pinnedAccountIndex]
+                    : undefined;
                 nextStorage.accounts.splice(nextIndex, 1);
                 resetManageActionSelection(nextStorage, nextIndex);
+                nextStorage.pinnedAccountIndex = reconcilePinnedAccountIndex(pinnedAccount, nextStorage.accounts);
                 await persist(nextStorage);
                 replaceManageActionStorage(storage, nextStorage);
                 deleted = true;

package/dist/lib/codex-manager/login-menu-data.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login-menu-data.d.ts","sourceRoot":"","sources":["../../../lib/codex-manager/login-menu-data.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAGrD,OAAO,EAEN,KAAK,wBAAwB,EAE7B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAEN,KAAK,cAAc,EAGnB,MAAM,mBAAmB,CAAC;AAe3B,OAAO,EAKN,KAAK,8BAA8B,EACnC,MAAM,uCAAuC,CAAC;AAE/C,OAAO,KAAK,EAAqB,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAczE;;;;;;GAMG;AAEH,eAAO,MAAM,iCAAiC,QAAa,CAAC;AA+E5D,wBAAgB,4BAA4B,CAC3C,OAAO,EAAE,gBAAgB,EACzB,KAAK,EAAE,cAAc,EACrB,QAAQ,EAAE,MAAM,EAChB,GAAG,SAAa,GACd,MAAM,CAkBR;AAED,wBAAsB,wBAAwB,CAC7C,OAAO,EAAE,gBAAgB,EACzB,KAAK,EAAE,cAAc,EACrB,QAAQ,EAAE,MAAM,EAChB,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,GACnD,OAAO,CAAC,cAAc,CAAC,CAiGzB;AA0JD,wBAAgB,qBAAqB,CACpC,OAAO,EAAE,gBAAgB,EACzB,UAAU,EAAE,cAAc,GAAG,IAAI,EACjC,eAAe,EAAE,wBAAwB,EACzC,cAAc,GAAE,8BAA8B,GAAG,IAAW,GAC1D,mBAAmB,EAAE,CA6EvB;AAED,wBAAsB,qCAAqC,CAC1D,OAAO,EAAE,gBAAgB,EACzB,GAAG,SAAa,GACd,OAAO,CAAC,8BAA8B,GAAG,IAAI,CAAC,CAgBhD;AAsBD,wBAAsB,oCAAoC,CACzD,OAAO,EAAE,gBAAgB,GACvB,OAAO,CAAC,OAAO,CAAC,CAyBlB"}
+{"version":3,"file":"login-menu-data.d.ts","sourceRoot":"","sources":["../../../lib/codex-manager/login-menu-data.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAGrD,OAAO,EAEN,KAAK,wBAAwB,EAE7B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAEN,KAAK,cAAc,EAGnB,MAAM,mBAAmB,CAAC;AAe3B,OAAO,EAKN,KAAK,8BAA8B,EACnC,MAAM,uCAAuC,CAAC;AAE/C,OAAO,KAAK,EAAqB,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAezE;;;;;;GAMG;AAEH,eAAO,MAAM,iCAAiC,QAAa,CAAC;AA+E5D,wBAAgB,4BAA4B,CAC3C,OAAO,EAAE,gBAAgB,EACzB,KAAK,EAAE,cAAc,EACrB,QAAQ,EAAE,MAAM,EAChB,GAAG,SAAa,GACd,MAAM,CAkBR;AAED,wBAAsB,wBAAwB,CAC7C,OAAO,EAAE,gBAAgB,EACzB,KAAK,EAAE,cAAc,EACrB,QAAQ,EAAE,MAAM,EAChB,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,GACnD,OAAO,CAAC,cAAc,CAAC,CAiGzB;AAoKD,wBAAgB,qBAAqB,CACpC,OAAO,EAAE,gBAAgB,EACzB,UAAU,EAAE,cAAc,GAAG,IAAI,EACjC,eAAe,EAAE,wBAAwB,EACzC,cAAc,GAAE,8BAA8B,GAAG,IAAW,GAC1D,mBAAmB,EAAE,CA+EvB;AAED,wBAAsB,qCAAqC,CAC1D,OAAO,EAAE,gBAAgB,EACzB,GAAG,SAAa,GACd,OAAO,CAAC,8BAA8B,GAAG,IAAI,CAAC,CAgBhD;AAsBD,wBAAsB,oCAAoC,CACzD,OAAO,EAAE,gBAAgB,GACvB,OAAO,CAAC,OAAO,CAAC,CAyBlB"}

package/dist/lib/codex-manager/login-menu-data.js

@@ -9,6 +9,7 @@ import { resolveActiveIndex } from "../runtime/account-status.js";
 import { getAppBindStatus } from "../runtime/app-bind.js";
 import { isDisplayCurrentAccount, readAppRuntimeHelperAccountSignal, resolveAccountCurrentMarkers, resolveRuntimeCurrentAccount, } from "../runtime/runtime-current-account.js";
 import { loadPersistedRuntimeObservabilitySnapshot } from "../runtime/runtime-observability.js";
+import { resolveQuotaWindowLabel } from "../ui/auth-menu-builder.js";
 import { hasUsableAccessToken } from "./account-credentials.js";
 import { formatAccountQuotaSummary, formatRateLimitEntry, } from "./formatters/index.js";
 import { cloneQuotaCacheData, DEFAULT_LIVE_PROBE_MODEL, getPersistedQuotaViewForAccount, updateQuotaCacheForAccount, } from "./quota-cache-helpers.js";
@@ -175,17 +176,25 @@ function parseLeftPercentFromQuotaSummary(summary, windowLabel) {
         return -1;
     return Math.max(0, Math.min(100, value));
 }
-function readQuotaLeftPercent(account, windowLabel) {
-    const direct = windowLabel === "5h"
+function readQuotaLeftPercent(account, window) {
+    const isPrimary = window === "primary";
+    const direct = isPrimary
         ? account.quota5hLeftPercent
         : account.quota7dLeftPercent;
     if (typeof direct === "number" && Number.isFinite(direct)) {
         return Math.max(0, Math.min(100, Math.round(direct)));
     }
-    return parseLeftPercentFromQuotaSummary(account.quotaSummary, windowLabel);
+    // The summary string is labelled by DURATION (formatAccountQuotaSummary), so a
+    // Codex Business row reads "30d 18%, ...". Searching it for the positional
+    // "5h"/"7d" finds nothing, scores the account -1, and sinks it to the bottom of
+    // a ready-first sort. Resolve the label from the window's real duration.
+    const label = resolveQuotaWindowLabel(isPrimary
+        ? account.quotaPrimaryWindowMinutes
+        : account.quotaSecondaryWindowMinutes, isPrimary ? "5h" : "7d");
+    return parseLeftPercentFromQuotaSummary(account.quotaSummary, label);
 }
 function readQuotaFloorPercent(account) {
-    return Math.min(readQuotaLeftPercent(account, "5h"), readQuotaLeftPercent(account, "7d"));
+    return Math.min(readQuotaLeftPercent(account, "primary"), readQuotaLeftPercent(account, "secondary"));
 }
 function accountStatusSortBucket(status) {
     switch (status) {
@@ -220,12 +229,12 @@ function compareReadyFirstAccounts(left, right) {
     const rightFloor = readQuotaFloorPercent(right);
     if (leftFloor !== rightFloor)
         return rightFloor - leftFloor;
-    const left5h = readQuotaLeftPercent(left, "5h");
-    const right5h = readQuotaLeftPercent(right, "5h");
+    const left5h = readQuotaLeftPercent(left, "primary");
+    const right5h = readQuotaLeftPercent(right, "primary");
     if (left5h !== right5h)
         return right5h - left5h;
-    const left7d = readQuotaLeftPercent(left, "7d");
-    const right7d = readQuotaLeftPercent(right, "7d");
+    const left7d = readQuotaLeftPercent(left, "secondary");
+    const right7d = readQuotaLeftPercent(right, "secondary");
     if (left7d !== right7d)
         return right7d - left7d;
     const leftLastUsed = left.lastUsed ?? 0;
@@ -291,6 +300,8 @@ export function toExistingAccountInfo(storage, quotaCache, displaySettings, runt
             quota5hResetAtMs: entry?.primary.resetAtMs,
             quota7dLeftPercent: quotaLeftPercentFromUsed(entry?.secondary.usedPercent),
             quota7dResetAtMs: entry?.secondary.resetAtMs,
+            quotaPrimaryWindowMinutes: entry?.primary.windowMinutes,
+            quotaSecondaryWindowMinutes: entry?.secondary.windowMinutes,
             quotaRateLimited: entry?.status === 429,
             quotaExhausted,
             isCurrentAccount,

package/dist/lib/codex-manager/repair-commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repair-commands.d.ts","sourceRoot":"","sources":["../../../lib/codex-manager/repair-commands.ts"],"names":[],"mappings":"AAcA,OAAO,EAAkC,KAAK,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxF,OAAO,EACN,uBAAuB,EAEvB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EASN,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EAGrB,MAAM,eAAe,CAAC;AAOvB,OAAO,EAAkB,KAAK,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAGvE,OAAO,KAAK,EAAE,eAAe,EAA6B,MAAM,aAAa,CAAC;AAG9E,KAAK,UAAU,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,GAAG,OAAO,CAAC;AAExE,KAAK,uBAAuB,GAAG;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CAChC,CAAC;AAEF,KAAK,oBAAoB,GAAG,IAAI,CAAC,iBAAiB,EAAE,WAAW,CAAC,GAAG;IAClE,KAAK,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,KAAK,gBAAgB,CAAC,CAAC,IAAI;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,CAAC,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAErF,KAAK,yBAAyB,GAAG;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,eAAe,CAAC;CAClC,CAAC;AAEF,MAAM,WAAW,aAAa;IAC7B,MAAM,EAAE,OAAO,CAAC;IAChB,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACd;AAcD,MAAM,WAAW,iBAAiB;IACjC,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,KAAK,MAAM,CAAC;IAC5D,sBAAsB,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,UAAU,KAAK,MAAM,CAAC;IAC9E,mBAAmB,EAAE,CACpB,QAAQ,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,UAAU,CAAA;KAAE,CAAC,KACvD,MAAM,CAAC;IACZ,kBAAkB,EAAE,CACnB,OAAO,EAAE,gBAAgB,EACzB,MAAM,CAAC,EAAE,WAAW,KAChB,MAAM,CAAC;IACZ,oBAAoB,EAAE,CACrB,OAAO,EAAE,iBAAiB,EAC1B,GAAG,EAAE,MAAM,KACP,OAAO,CAAC;IACb,4BAA4B,EAAE,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC;IAC5E,sBAAsB,EAAE,CACvB,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,MAAM,EAAE,MAAM,GAAG,SAAS,KACtB,MAAM,CAAC;IACZ,4BAA4B,EAAE,CAC7B,QAAQ,EAAE,SAAS,oBAAoB,EAAE,KACrC,WAAW,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;IAClD,0BAA0B,EAAE,CAC3B,KAAK,EAAE,cAAc,EACrB,OAAO,EAAE,oBAAoB,EAC7B,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC,EAC7D,QAAQ,EAAE,SAAS,oBAAoB,EAAE,EACzC,kBAAkB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,uBAAuB,CAAC,KAC7D,OAAO,CAAC;IACb,mBAAmB,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,cAAc,CAAC;IAC/D,+BAA+B,EAAE,CAChC,KAAK,EAAE,cAAc,EACrB,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,QAAQ,EAAE,SAAS,oBAAoB,EAAE,EACzC,kBAAkB,EAAE,WAAW,CAAC,MAAM,EAAE,uBAAuB,CAAC,KAC5D,OAAO,CAAC;IACb,0BAA0B,EAAE,CAC3B,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC,KACzD,MAAM,CAAC;IACZ,4BAA4B,EAAE,CAC7B,eAAe,EAAE,MAAM,GAAG,SAAS,EACnC,qBAAqB,EAAE,eAAe,GAAG,SAAS,EAClD,kBAAkB,EAAE,MAAM,GAAG,SAAS,KAClC,yBAAyB,CAAC;IAC/B,yBAAyB,EAAE,CAC1B,OAAO,EAAE,iBAAiB,EAC1B,kBAAkB,EAAE,MAAM,GAAG,SAAS,KAClC,OAAO,CAAC;CACb;AA2DD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAAC,aAAa,CAAC,CA4C5E;AAkjBD,wBAAsB,gBAAgB,CACrC,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,EAAE,iBAAiB,GACrB,OAAO,CAAC,MAAM,CAAC,CA6XjB;AAED,wBAAsB,MAAM,CAC3B,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,EAAE,iBAAiB,GACrB,OAAO,CAAC,MAAM,CAAC,CA2cjB;AAED,wBAAsB,SAAS,CAC9B,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,EAAE,iBAAiB,GACrB,OAAO,CAAC,MAAM,CAAC,CAinBjB"}
+{"version":3,"file":"repair-commands.d.ts","sourceRoot":"","sources":["../../../lib/codex-manager/repair-commands.ts"],"names":[],"mappings":"AAcA,OAAO,EAAkC,KAAK,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxF,OAAO,EACN,uBAAuB,EAEvB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EASN,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EAGrB,MAAM,eAAe,CAAC;AAYvB,OAAO,EAAkB,KAAK,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAGvE,OAAO,KAAK,EAAE,eAAe,EAA6B,MAAM,aAAa,CAAC;AAG9E,KAAK,UAAU,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,GAAG,OAAO,CAAC;AAExE,KAAK,uBAAuB,GAAG;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CAChC,CAAC;AAEF,KAAK,oBAAoB,GAAG,IAAI,CAAC,iBAAiB,EAAE,WAAW,CAAC,GAAG;IAClE,KAAK,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,KAAK,gBAAgB,CAAC,CAAC,IAAI;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,CAAC,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAErF,KAAK,yBAAyB,GAAG;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,eAAe,CAAC;CAClC,CAAC;AAEF,MAAM,WAAW,aAAa;IAC7B,MAAM,EAAE,OAAO,CAAC;IAChB,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACd;AAcD,MAAM,WAAW,iBAAiB;IACjC,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,KAAK,MAAM,CAAC;IAC5D,sBAAsB,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,UAAU,KAAK,MAAM,CAAC;IAC9E,mBAAmB,EAAE,CACpB,QAAQ,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,UAAU,CAAA;KAAE,CAAC,KACvD,MAAM,CAAC;IACZ,kBAAkB,EAAE,CACnB,OAAO,EAAE,gBAAgB,EACzB,MAAM,CAAC,EAAE,WAAW,KAChB,MAAM,CAAC;IACZ,oBAAoB,EAAE,CACrB,OAAO,EAAE,iBAAiB,EAC1B,GAAG,EAAE,MAAM,KACP,OAAO,CAAC;IACb,4BAA4B,EAAE,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC;IAC5E,sBAAsB,EAAE,CACvB,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,MAAM,EAAE,MAAM,GAAG,SAAS,KACtB,MAAM,CAAC;IACZ,4BAA4B,EAAE,CAC7B,QAAQ,EAAE,SAAS,oBAAoB,EAAE,KACrC,WAAW,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;IAClD,0BAA0B,EAAE,CAC3B,KAAK,EAAE,cAAc,EACrB,OAAO,EAAE,oBAAoB,EAC7B,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC,EAC7D,QAAQ,EAAE,SAAS,oBAAoB,EAAE,EACzC,kBAAkB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,uBAAuB,CAAC,KAC7D,OAAO,CAAC;IACb,mBAAmB,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,cAAc,CAAC;IAC/D,+BAA+B,EAAE,CAChC,KAAK,EAAE,cAAc,EACrB,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,QAAQ,EAAE,SAAS,oBAAoB,EAAE,EACzC,kBAAkB,EAAE,WAAW,CAAC,MAAM,EAAE,uBAAuB,CAAC,KAC5D,OAAO,CAAC;IACb,0BAA0B,EAAE,CAC3B,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC,KACzD,MAAM,CAAC;IACZ,4BAA4B,EAAE,CAC7B,eAAe,EAAE,MAAM,GAAG,SAAS,EACnC,qBAAqB,EAAE,eAAe,GAAG,SAAS,EAClD,kBAAkB,EAAE,MAAM,GAAG,SAAS,KAClC,yBAAyB,CAAC;IAC/B,yBAAyB,EAAE,CAC1B,OAAO,EAAE,iBAAiB,EAC1B,kBAAkB,EAAE,MAAM,GAAG,SAAS,KAClC,OAAO,CAAC;CACb;AA2DD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAAC,aAAa,CAAC,CA4C5E;AAkjBD,wBAAsB,gBAAgB,CACrC,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,EAAE,iBAAiB,GACrB,OAAO,CAAC,MAAM,CAAC,CA6XjB;AAED,wBAAsB,MAAM,CAC3B,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,EAAE,iBAAiB,GACrB,OAAO,CAAC,MAAM,CAAC,CA2cjB;AAED,wBAAsB,SAAS,CAC9B,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,EAAE,iBAAiB,GACrB,OAAO,CAAC,MAAM,CAAC,CA0qBjB"}

package/dist/lib/codex-manager/repair-commands.js

@@ -9,7 +9,7 @@ import { isCodexUnavailableError } from "../errors.js";
 import { queuedRefresh } from "../refresh-queue.js";
 import { findMatchingAccountIndex, getStoragePath, loadAccounts, loadFlaggedAccounts, setStoragePath, withAccountStorageTransaction, withAccountAndFlaggedStorageTransaction, withFlaggedStorageTransaction, } from "../storage.js";
 import { getCodexCliAuthPath, getCodexCliConfigPath, loadCodexCliState, } from "../codex-cli/state.js";
-import { setCodexCliActiveSelection } from "../codex-cli/writer.js";
+import { ensureCodexCliFileAuthStore, readTopLevelCodexCliAuthStoreMode, setCodexCliActiveSelection, shouldEnforceCodexCliFileAuthStore, } from "../codex-cli/writer.js";
 import { MODEL_FAMILIES } from "../prompts/codex.js";
 import { DEFAULT_PROBE_MODEL, resolveNormalizedModel } from "../request/helpers/model-map.js";
 import { loadPersistedRuntimeObservabilitySnapshot } from "../runtime/runtime-observability.js";
@@ -1300,14 +1300,16 @@ export async function runDoctor(args, deps) {
             : "Codex config file does not exist",
         details: codexConfigPath,
     });
+    const supplementalFixActions = [];
+    // Tracked separately from account storage: pinning the auth store is a real
+    // remediation even on a machine with no accounts yet, which is exactly the
+    // state a user hitting repeated keychain prompts tends to be in.
+    let authStoreFixChanged = false;
     let codexAuthStoreMode;
     if (codexConfigFileExists) {
         try {
             const configRaw = await fs.readFile(codexConfigPath, "utf-8");
-            const match = configRaw.match(/^\s*cli_auth_credentials_store\s*=\s*"([^"]+)"\s*$/m);
-            if (match?.[1]) {
-                codexAuthStoreMode = match[1].trim();
-            }
+            codexAuthStoreMode = readTopLevelCodexCliAuthStoreMode(configRaw) ?? undefined;
         }
         catch (error) {
             addCheck({
@@ -1319,13 +1321,59 @@ export async function runDoctor(args, deps) {
         }
     }
     if (!checks.some((check) => check.key === "codex-auth-store")) {
+        // A config that is not pinned to "file" is what makes the official CLI
+        // reach into the macOS login keychain, so `--fix` repairs it directly
+        // instead of waiting for the incidental `pendingCodexActiveSync` path
+        // below, which only fires when there is an active account to mirror.
+        if (options.fix &&
+            codexAuthStoreMode !== "file" &&
+            shouldEnforceCodexCliFileAuthStore()) {
+            if (options.dryRun) {
+                authStoreFixChanged = true;
+                supplementalFixActions.push({
+                    key: "codex-auth-store",
+                    message: "Prepared Codex CLI credential store pin to file in config.toml (dry-run)",
+                });
+            }
+            else {
+                try {
+                    if (await ensureCodexCliFileAuthStore(codexConfigPath)) {
+                        codexAuthStoreMode = "file";
+                        authStoreFixChanged = true;
+                        supplementalFixActions.push({
+                            key: "codex-auth-store",
+                            message: "Pinned Codex CLI credential store to file in config.toml",
+                        });
+                    }
+                }
+                catch (error) {
+                    addCheck({
+                        key: "codex-auth-store-fix",
+                        severity: "warn",
+                        message: "Failed to pin Codex CLI credential store to file",
+                        details: error instanceof Error ? error.message : String(error),
+                    });
+                }
+            }
+        }
+        const authStoreDetails = [
+            codexAuthStoreMode ? `mode=${codexAuthStoreMode}` : "mode=unset",
+        ];
+        if (codexAuthStoreMode !== "file" && !options.fix) {
+            authStoreDetails.push("run `codex-multi-auth doctor --fix` to pin it to file");
+        }
+        if (process.platform === "darwin" && codexAuthStoreMode === "file") {
+            // Purely informational: reading or deleting keychain items would
+            // itself raise the prompt this check exists to eliminate.
+            authStoreDetails.push("credentials saved by an earlier official `codex login` may still sit in the login keychain; they are no longer read and can be removed manually via Keychain Access");
+        }
         addCheck({
             key: "codex-auth-store",
             severity: codexAuthStoreMode === "file" ? "ok" : "warn",
             message: codexAuthStoreMode === "file"
                 ? "Codex auth storage is set to file"
                 : "Codex auth storage is not explicitly set to file",
-            details: codexAuthStoreMode ? `mode=${codexAuthStoreMode}` : "mode=unset",
+            details: authStoreDetails.join("; "),
         });
     }
     const codexCliState = await loadCodexCliState({ forceRefresh: true });
@@ -1343,7 +1391,6 @@ export async function runDoctor(args, deps) {
     let fixChanged = false;
     let storageFixChanged = false;
     let structuralFixActions = [];
-    const supplementalFixActions = [];
     let doctorRefreshMutation = null;
     let pendingCodexActiveSync = null;
     if (options.fix && storageForChecks && storageForChecks.accounts.length > 0) {
@@ -1677,7 +1724,9 @@ export async function runDoctor(args, deps) {
         }
     }
     const fixActions = [...structuralFixActions, ...supplementalFixActions];
-    if (options.fix && storageForChecks && storageForChecks.accounts.length > 0) {
+    if (options.fix &&
+        ((storageForChecks && storageForChecks.accounts.length > 0) ||
+            authStoreFixChanged)) {
         fixChanged = storageFixChanged || fixActions.length > 0;
         addCheck({
             key: "auto-fix",

package/dist/lib/forecast.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"forecast.d.ts","sourceRoot":"","sources":["../../lib/forecast.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAOvD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,KAAK,oBAAoB,GAAG,OAAO,GAAG,SAAS,GAAG,aAAa,CAAC;AAChE,KAAK,iBAAiB,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEnD,MAAM,WAAW,oBAAoB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,iBAAiB,CAAC;IAC3B,SAAS,EAAE,OAAO,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,cAAc,CAAC,EAAE,YAAY,CAAC;IAC9B,SAAS,CAAC,EAAE,kBAAkB,CAAC;IAC/B,UAAU,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC;IACnC,WAAW,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC3C,cAAc,CAAC,EAAE,sBAAsB,GAAG,IAAI,CAAC;CAC/C;AAED,MAAM,WAAW,sBAAsB;IACtC,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,6BAA6B,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvD,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,qBAAqB;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,EAAE,oBAAoB,CAAC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,iBAAiB,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,WAAW,EAAE,OAAO,CAAC;IACrB,QAAQ,EAAE,OAAO,CAAC;IAKlB,SAAS,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,sBAAsB;IACtC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,MAAM,EAAE,MAAM,CAAC;CACf;AAED,UAAU,0BAA0B;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,EAAE,oBAAoB,CAAC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,iBAAiB,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,mBAAmB;IACnC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,oBAAoB,EAAE,MAAM,CAAC;IAC7B,UAAU,EAAE,0BAA0B,EAAE,CAAC;CACzC;AAED,MAAM,WAAW,eAAe;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CACjB;AAqFD,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAUnE;AAWD,wBAAgB,uBAAuB,CACtC,KAAK,EAAE,oBAAoB,GACzB,qBAAqB,CAiMvB;AAED,wBAAgB,wBAAwB,CACvC,MAAM,EAAE,oBAAoB,EAAE,GAC5B,qBAAqB,EAAE,CAEzB;AAkCD,wBAAgB,wBAAwB,CACvC,OAAO,EAAE,qBAAqB,EAAE,GAC9B,sBAAsB,CAuDxB;AAED,wBAAgB,iBAAiB,CAChC,OAAO,EAAE,qBAAqB,EAAE,GAC9B,eAAe,CAWjB;AAED,wBAAgB,wBAAwB,CACvC,OAAO,EAAE,qBAAqB,EAAE,EAChC,cAAc,EAAE,sBAAsB,GACpC,mBAAmB,CAgBrB"}
+{"version":3,"file":"forecast.d.ts","sourceRoot":"","sources":["../../lib/forecast.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAOvD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,KAAK,oBAAoB,GAAG,OAAO,GAAG,SAAS,GAAG,aAAa,CAAC;AAChE,KAAK,iBAAiB,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEnD,MAAM,WAAW,oBAAoB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,iBAAiB,CAAC;IAC3B,SAAS,EAAE,OAAO,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,cAAc,CAAC,EAAE,YAAY,CAAC;IAC9B,SAAS,CAAC,EAAE,kBAAkB,CAAC;IAC/B,UAAU,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC;IACnC,WAAW,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC3C,cAAc,CAAC,EAAE,sBAAsB,GAAG,IAAI,CAAC;CAC/C;AAED,MAAM,WAAW,sBAAsB;IACtC,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,6BAA6B,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvD,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,qBAAqB;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,EAAE,oBAAoB,CAAC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,iBAAiB,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,WAAW,EAAE,OAAO,CAAC;IACrB,QAAQ,EAAE,OAAO,CAAC;IAKlB,SAAS,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,sBAAsB;IACtC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,MAAM,EAAE,MAAM,CAAC;CACf;AAED,UAAU,0BAA0B;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,EAAE,oBAAoB,CAAC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,iBAAiB,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,mBAAmB;IACnC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,oBAAoB,EAAE,MAAM,CAAC;IAC7B,UAAU,EAAE,0BAA0B,EAAE,CAAC;CACzC;AAED,MAAM,WAAW,eAAe;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CACjB;AAuFD,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAUnE;AAWD,wBAAgB,uBAAuB,CACtC,KAAK,EAAE,oBAAoB,GACzB,qBAAqB,CA0NvB;AAED,wBAAgB,wBAAwB,CACvC,MAAM,EAAE,oBAAoB,EAAE,GAC5B,qBAAqB,EAAE,CAEzB;AAkCD,wBAAgB,wBAAwB,CACvC,OAAO,EAAE,qBAAqB,EAAE,GAC9B,sBAAsB,CAuDxB;AAED,wBAAgB,iBAAiB,CAChC,OAAO,EAAE,qBAAqB,EAAE,GAC9B,eAAe,CAWjB;AAED,wBAAgB,wBAAwB,CACvC,OAAO,EAAE,qBAAqB,EAAE,EAChC,cAAc,EAAE,sBAAsB,GACpC,mBAAmB,CAgBrB"}

package/dist/lib/forecast.js

@@ -1,5 +1,5 @@
 import { formatAccountLabel, formatWaitTime } from "./accounts.js";
-import { findQuotaCacheEntryForAccount, isQuotaCacheEntryExhausted, quotaLeftPercentFromUsed, } from "./quota-readiness.js";
+import { findQuotaCacheEntryForAccount, isQuotaCacheEntryExhausted, quotaUsedPercentIsExhausted, } from "./quota-readiness.js";
 import { getRateLimitResetTimeForFamily } from "./runtime/account-status.js";
 function clampRisk(score) {
     if (!Number.isFinite(score))
@@ -49,8 +49,10 @@ function getLiveQuotaWaitMs(snapshot, now, onlyExhausted) {
         // resets ~7d out; folding that in would overstate the wait by orders of
         // magnitude and invert the account recommendation (stress audit H5). On a
         // 429 we honor every future window, since the upstream said "slow down now"
-        // regardless of the usage gauge.
-        if (onlyExhausted && quotaLeftPercentFromUsed(window?.usedPercent) !== 0) {
+        // regardless of the usage gauge. The test is the RAW usedPercent, never the
+        // rounded left-percent: 100 - 99.6 rounds to 0 left, which would bench a
+        // window that still has quota and falsely mark the account "delayed".
+        if (onlyExhausted && !quotaUsedPercentIsExhausted(window?.usedPercent)) {
             continue;
         }
         const resetAt = window?.resetAtMs;
@@ -135,8 +137,13 @@ export function evaluateForecastAccount(input) {
     }
     const quotaEntry = findQuotaCacheEntryForAccount(input.quotaCache, account, input.allAccounts ?? [account]);
     if (isQuotaCacheEntryExhausted(quotaEntry, now)) {
+        // Only a window that is genuinely at/over 100% used should contribute its
+        // reset time. Testing the ROUNDED left-percent instead would treat a
+        // 99.6%-used sibling as at-limit and fold its (possibly far-future) reset
+        // into the Math.max below, overstating the wait for an account whose
+        // actually-exhausted window recovers much sooner.
         const resetAts = [quotaEntry?.primary, quotaEntry?.secondary]
-            .filter((window) => quotaLeftPercentFromUsed(window?.usedPercent) === 0 &&
+            .filter((window) => quotaUsedPercentIsExhausted(window?.usedPercent) &&
             typeof window?.resetAtMs === "number" &&
             Number.isFinite(window.resetAtMs) &&
             window.resetAtMs > now)
@@ -207,6 +214,25 @@ export function evaluateForecastAccount(input) {
         if (liveWait > 0 && availability === "ready") {
             availability = "delayed";
         }
+        // A live window at 100% used with NO resetAtMs has no known recovery time —
+        // the probe reports it fully consumed and cannot say when it refills. On a
+        // 200 probe getLiveQuotaWaitMs then yields 0 (no reset to wait on) and the
+        // 429 branch never fires, so without this the account would stay "ready" and
+        // be recommended as a healthy pick. Treat that case as exhausted and downgrade
+        // a "ready" account to "delayed". A window WITH a resetAtMs is only *delayed*,
+        // not exhausted: getLiveQuotaWaitMs already contributes its wait above, so a
+        // 429 with known reset times stays a recoverable "delayed" account rather than
+        // a blocked one. The raw-usedPercent test (not rounded left-percent) keeps
+        // 99.6% from being falsely benched.
+        const liveExhausted = (quotaUsedPercentIsExhausted(quota.primary.usedPercent) &&
+            typeof quota.primary.resetAtMs !== "number") ||
+            (quotaUsedPercentIsExhausted(quota.secondary.usedPercent) &&
+                typeof quota.secondary.resetAtMs !== "number");
+        if (liveExhausted) {
+            exhausted = true;
+            if (availability === "ready")
+                availability = "delayed";
+        }
         const primaryUsage = describeQuotaUsage("primary", quota.primary.usedPercent);
         if (primaryUsage)
             reasons.push(primaryUsage);

package/dist/lib/policy/runtime-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-policy.d.ts","sourceRoot":"","sources":["../../../lib/policy/runtime-policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAErE,OAAO,EAGN,KAAK,kBAAkB,EACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAIN,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAEN,KAAK,4BAA4B,EACjC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACN,oBAAoB,EAGpB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,WAAW,oBAAoB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,qBAAqB;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,qBAAqB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACnC,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,iBAAiB,EAAE,qBAAqB,EAAE,CAAC;CAC3C;AAED,MAAM,WAAW,kBAAkB;IAClC,eAAe,EAAE,kBAAkB,CAAC;IACpC,OAAO,EAAE,gBAAgB,CAAC;IAC1B,OAAO,EAAE,4BAA4B,CAAC;CACtC;AAED,MAAM,WAAW,oBAAoB;IACpC,MAAM,EAAE,CAAC,KAAK,EAAE,uBAAuB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,WAAW,EAAE,MAAM,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,uBAAuB;IACvC,OAAO,EAAE,kBAAkB,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,OAAO,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACtC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,wBAAsB,sBAAsB,CAC3C,QAAQ,SAAgB,GACtB,OAAO,CAAC,kBAAkB,CAAC,CAO7B;AAsDD,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IAClD,KAAK,EAAE,kBAAkB,CAAC;IAC1B,QAAQ,EAAE,oBAAoB,EAAE,CAAC;IACjC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,gBAAgB,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAChD,GAAG,CAAC,EAAE,MAAM,CAAC;CACb,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAqGjC;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAAE;IACjD,MAAM,EAAE,iBAAiB,CAAC;IAC1B,SAAS,EAAE,oBAAoB,CAAC;IAChC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,oBAAoB,CAAC;CACrC,GAAG,oBAAoB,CAgCvB"}
+{"version":3,"file":"runtime-policy.d.ts","sourceRoot":"","sources":["../../../lib/policy/runtime-policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAErE,OAAO,EAGN,KAAK,kBAAkB,EACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAKN,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAEN,KAAK,4BAA4B,EACjC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACN,oBAAoB,EAGpB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,WAAW,oBAAoB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,qBAAqB;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,qBAAqB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACnC,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,iBAAiB,EAAE,qBAAqB,EAAE,CAAC;CAC3C;AAED,MAAM,WAAW,kBAAkB;IAClC,eAAe,EAAE,kBAAkB,CAAC;IACpC,OAAO,EAAE,gBAAgB,CAAC;IAC1B,OAAO,EAAE,4BAA4B,CAAC;CACtC;AAED,MAAM,WAAW,oBAAoB;IACpC,MAAM,EAAE,CAAC,KAAK,EAAE,uBAAuB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,WAAW,EAAE,MAAM,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,uBAAuB;IACvC,OAAO,EAAE,kBAAkB,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,OAAO,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACtC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,wBAAsB,sBAAsB,CAC3C,QAAQ,SAAgB,GACtB,OAAO,CAAC,kBAAkB,CAAC,CAO7B;AA6DD,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IAClD,KAAK,EAAE,kBAAkB,CAAC;IAC1B,QAAQ,EAAE,oBAAoB,EAAE,CAAC;IACjC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,gBAAgB,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAChD,GAAG,CAAC,EAAE,MAAM,CAAC;CACb,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAqGjC;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAAE;IACjD,MAAM,EAAE,iBAAiB,CAAC;IAC1B,SAAS,EAAE,oBAAoB,CAAC;IAChC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,oBAAoB,CAAC;CACrC,GAAG,oBAAoB,CAgCvB"}

package/dist/lib/policy/runtime-policy.js

@@ -1,6 +1,6 @@
 import { resolveEntitlementAccountKey } from "../entitlement-cache.js";
 import { getAccountPolicyKey, loadAccountPolicyStore, } from "../account-policy.js";
-import { evaluateBudgetGuard, getBudgetWindowStart, loadBudgetGuardStore, } from "../budget-guard.js";
+import { evaluateBudgetGuard, getBudgetWindowStart, loadBudgetGuardStore, normalizeBudgetKey, } from "../budget-guard.js";
 import { resolveProjectRoutingProfile, } from "../routing-profiles.js";
 import { appendUsageLedgerRow, summarizeUsageLedger, } from "../usage/index.js";
 export async function loadRuntimePolicyState(startDir = process.cwd()) {
@@ -33,12 +33,21 @@ function intersects(left, right) {
 }
 async function evaluateBudgets(input) {
     const keys = new Set();
+    // `global` is already normalize-clean. Project/profile keys can carry uppercase
+    // or spaces, but budget-guard STORES limits only under normalizeBudgetKey (see
+    // upsertBudgetLimit and load-time normalizeStore). Look them up the same way, or
+    // a key like `project:MyApp` never matches its stored `project:myapp` and the
+    // budget is silently unenforced.
     keys.add("global");
     if (input.state.project.projectKey) {
-        keys.add(`project:${input.state.project.projectKey}`);
+        const projectKey = normalizeBudgetKey(`project:${input.state.project.projectKey}`);
+        if (projectKey)
+            keys.add(projectKey);
     }
     if (input.state.project.profile?.budgetKey) {
-        keys.add(input.state.project.profile.budgetKey);
+        const budgetKey = normalizeBudgetKey(input.state.project.profile.budgetKey);
+        if (budgetKey)
+            keys.add(budgetKey);
     }
     const evaluations = [];
     for (const key of keys) {

package/dist/lib/quota-readiness.d.ts

@@ -11,6 +11,7 @@ export type QuotaEmailFallbackState = {
 export declare function buildQuotaEmailFallbackState(accounts: readonly QuotaCacheAccountRef[]): ReadonlyMap<string, QuotaEmailFallbackState>;
 export declare function hasSafeQuotaEmailFallback(emailFallbackState: ReadonlyMap<string, QuotaEmailFallbackState>, account: QuotaCacheAccountRef): boolean;
 export declare function quotaLeftPercentFromUsed(usedPercent: number | undefined): number | undefined;
+export declare function quotaUsedPercentIsExhausted(usedPercent: number | undefined): boolean;
 export declare function isQuotaCacheEntryExhausted(entry: Pick<QuotaCacheEntry, "primary" | "secondary"> & {
     updatedAt?: number;
 } | null | undefined, now?: number): boolean;

package/dist/lib/quota-readiness.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"quota-readiness.d.ts","sourceRoot":"","sources":["../../lib/quota-readiness.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAoB,MAAM,kBAAkB,CAAC;AAC1F,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEtD,MAAM,MAAM,oBAAoB,GAAG,IAAI,CAAC,iBAAiB,EAAE,WAAW,GAAG,OAAO,CAAC,CAAC;AAIlF,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAGhF;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAG5E;AAED,wBAAgB,uBAAuB,CACtC,QAAQ,EAAE,SAAS,oBAAoB,EAAE,EACzC,OAAO,EAAE,oBAAoB,GAC3B,OAAO,CAQT;AAED,MAAM,MAAM,uBAAuB,GAAG;IACrC,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CAChC,CAAC;AAEF,wBAAgB,4BAA4B,CAC3C,QAAQ,EAAE,SAAS,oBAAoB,EAAE,GACvC,WAAW,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAiB9C;AAED,wBAAgB,yBAAyB,CACxC,kBAAkB,EAAE,WAAW,CAAC,MAAM,EAAE,uBAAuB,CAAC,EAChE,OAAO,EAAE,oBAAoB,GAC3B,OAAO,CAMT;AAED,wBAAgB,wBAAwB,CACvC,WAAW,EAAE,MAAM,GAAG,SAAS,GAC7B,MAAM,GAAG,SAAS,CAKpB;AA4BD,wBAAgB,0BAA0B,CACzC,KAAK,EAAE,IAAI,CAAC,eAAe,EAAE,SAAS,GAAG,WAAW,CAAC,GAAG;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,EACjG,GAAG,SAAa,GACd,OAAO,CAQT;AAED,wBAAgB,6BAA6B,CAC5C,KAAK,EAAE,cAAc,GAAG,IAAI,GAAG,SAAS,EACxC,OAAO,EAAE,oBAAoB,EAC7B,QAAQ,EAAE,SAAS,oBAAoB,EAAE,EACzC,kBAAkB,+CAAyC,GACzD,eAAe,GAAG,IAAI,CAWxB"}
+{"version":3,"file":"quota-readiness.d.ts","sourceRoot":"","sources":["../../lib/quota-readiness.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAoB,MAAM,kBAAkB,CAAC;AAC1F,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEtD,MAAM,MAAM,oBAAoB,GAAG,IAAI,CAAC,iBAAiB,EAAE,WAAW,GAAG,OAAO,CAAC,CAAC;AAIlF,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAGhF;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAG5E;AAED,wBAAgB,uBAAuB,CACtC,QAAQ,EAAE,SAAS,oBAAoB,EAAE,EACzC,OAAO,EAAE,oBAAoB,GAC3B,OAAO,CAQT;AAED,MAAM,MAAM,uBAAuB,GAAG;IACrC,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CAChC,CAAC;AAEF,wBAAgB,4BAA4B,CAC3C,QAAQ,EAAE,SAAS,oBAAoB,EAAE,GACvC,WAAW,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAiB9C;AAED,wBAAgB,yBAAyB,CACxC,kBAAkB,EAAE,WAAW,CAAC,MAAM,EAAE,uBAAuB,CAAC,EAChE,OAAO,EAAE,oBAAoB,GAC3B,OAAO,CAMT;AAED,wBAAgB,wBAAwB,CACvC,WAAW,EAAE,MAAM,GAAG,SAAS,GAC7B,MAAM,GAAG,SAAS,CAKpB;AAQD,wBAAgB,2BAA2B,CAC1C,WAAW,EAAE,MAAM,GAAG,SAAS,GAC7B,OAAO,CAMT;AA2BD,wBAAgB,0BAA0B,CACzC,KAAK,EAAE,IAAI,CAAC,eAAe,EAAE,SAAS,GAAG,WAAW,CAAC,GAAG;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,EACjG,GAAG,SAAa,GACd,OAAO,CAQT;AAED,wBAAgB,6BAA6B,CAC5C,KAAK,EAAE,cAAc,GAAG,IAAI,GAAG,SAAS,EACxC,OAAO,EAAE,oBAAoB,EAC7B,QAAQ,EAAE,SAAS,oBAAoB,EAAE,EACzC,kBAAkB,+CAAyC,GACzD,eAAe,GAAG,IAAI,CAWxB"}

package/dist/lib/quota-readiness.js

@@ -53,6 +53,17 @@ export function quotaLeftPercentFromUsed(usedPercent) {
     }
     return Math.max(0, Math.min(100, Math.round(100 - usedPercent)));
 }
+// A window is exhausted only when it is genuinely at/over 100% used. Base this on
+// the RAW usedPercent, never the rounded quotaLeftPercentFromUsed: rounding
+// 100 - 99.6 = 0.4 down to 0 left-percent would falsely bench a window that still
+// has ~0.4% quota (any usedPercent in (99.5, 100) rounds to 0 left). The header
+// parser preserves fractional used-percent, so this input is expected;
+// quotaLeftPercentFromUsed stays for DISPLAY only.
+export function quotaUsedPercentIsExhausted(usedPercent) {
+    return (typeof usedPercent === "number" &&
+        Number.isFinite(usedPercent) &&
+        usedPercent >= 100);
+}
 function quotaWindowIsExhausted(window, now = Date.now(), updatedAt) {
     if (typeof window?.resetAtMs === "number" && now >= window.resetAtMs) {
         return false;
@@ -69,8 +80,7 @@ function quotaWindowIsExhausted(window, now = Date.now(), updatedAt) {
         now >= updatedAt + window.windowMinutes * 60_000) {
         return false;
     }
-    const leftPercent = quotaLeftPercentFromUsed(window?.usedPercent);
-    return typeof leftPercent === "number" && leftPercent <= 0;
+    return quotaUsedPercentIsExhausted(window?.usedPercent);
 }
 export function isQuotaCacheEntryExhausted(entry, now = Date.now()) {
     // Codex quota windows are cumulative gates: a 0% remaining active window blocks use