codex-multi-auth 2.8.4 → 2.8.6

package/dist/lib/request/rate-limit-decision.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit-decision.d.ts","sourceRoot":"","sources":["../../../lib/request/rate-limit-decision.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AAC5E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAe/C,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAGlE;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,OAAO,CAAC,WAAW,EAAE;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC,GAAG,OAAO,CAWjG;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAapF;AAED,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAoBlF;AAYD,wBAAgB,0BAA0B,CAAC,gBAAgB,EAAE,MAAM,GAAG,MAAM,CAuB3E;AAED,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAkBxE;AA0BD,wBAAgB,4BAA4B,CAC3C,OAAO,EAAE,OAAO,EAChB,kBAAkB,EAAE,MAAM,EAC1B,GAAG,EAAE,MAAM,GACT,MAAM,CAcR;AAED,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAE1E;AAED;;;;;;GAMG;AACH,MAAM,WAAW,0BAA0B;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,kCAAkC,CAAC;IACzC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC7C;AAED,wBAAgB,+BAA+B,CAC9C,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACtC,kBAAkB,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GAC7C,0BAA0B,CA0B5B"}
+{"version":3,"file":"rate-limit-decision.d.ts","sourceRoot":"","sources":["../../../lib/request/rate-limit-decision.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AAC5E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAe/C,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAGlE;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,OAAO,CAAC,WAAW,EAAE;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC,GAAG,OAAO,CAWjG;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAapF;AAED,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAoBlF;AAYD,wBAAgB,0BAA0B,CAAC,gBAAgB,EAAE,MAAM,GAAG,MAAM,CAuB3E;AAED,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAkBxE;AA0BD,wBAAgB,4BAA4B,CAC3C,OAAO,EAAE,OAAO,EAChB,kBAAkB,EAAE,MAAM,EAC1B,GAAG,EAAE,MAAM,GACT,MAAM,CAcR;AAED,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAE1E;AAED;;;;;;GAMG;AACH,MAAM,WAAW,0BAA0B;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,kCAAkC,CAAC;IACzC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,mEAAmE;IACnE,UAAU,EAAE,QAAQ,GAAG,QAAQ,GAAG,IAAI,CAAC;IACvC,2EAA2E;IAC3E,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC7C;AAQD,MAAM,WAAW,wBAAwB;IACxC;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,IAAI,CAAC;IACvC,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,GAAG,CAAC,EAAE,MAAM,CAAC;CACb;AAED,wBAAgB,+BAA+B,CAC9C,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACtC,kBAAkB,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/C,OAAO,CAAC,EAAE,wBAAwB,GAChC,0BAA0B,CAwD5B"}

package/dist/lib/request/rate-limit-decision.js

@@ -172,7 +172,12 @@ export function getQuotaNearExhaustionWaitMs(headers, remainingThreshold, now) {
 export function normalizeExhaustionStatus(reason) {
     return reason === "rate-limit" ? HTTP_STATUS.TOO_MANY_REQUESTS : 503;
 }
-export function buildPinnedUnavailableErrorBody(pinnedIndex, accountSkipReasons) {
+/**
+ * Largest epoch-ms value `new Date(...).toISOString()` accepts; anything beyond
+ * throws RangeError (ECMAScript time-value limit, ±100,000,000 days).
+ */
+const MAX_ECMASCRIPT_TIME_VALUE = 8_640_000_000_000_000;
+export function buildPinnedUnavailableErrorBody(pinnedIndex, accountSkipReasons, context) {
     const normalizedPinnedIndex = typeof pinnedIndex === "number" ? pinnedIndex : null;
     const skipReason = normalizedPinnedIndex !== null
         ? accountSkipReasons.get(normalizedPinnedIndex) ?? null
@@ -183,11 +188,38 @@ export function buildPinnedUnavailableErrorBody(pinnedIndex, accountSkipReasons)
     const accountPhrase = normalizedPinnedIndex === null
         ? "The pinned account"
         : `Pinned account ${normalizedPinnedIndex + 1}`;
+    const pinSource = context?.pinSource ?? null;
+    // Upper bound as well as lower: resetAtMs comes from persisted account state
+    // (rateLimitResetTimes, coolingDownUntil), and markAccountCoolingDown clamps
+    // only the low side while nothing re-validates either on load. A finite but
+    // absurd deadline past the ECMAScript time limit would make toISOString below
+    // throw a RangeError inside handleRequestInner, collapsing this diagnostic 503
+    // into a generic 500 that carries no pinnedAccountIndex, reason, or skip map —
+    // the exact payload this branch exists to deliver. Such a value bounds nothing
+    // usable anyway, so treat it as "no known recovery" instead.
+    const resetAtMs = typeof context?.resetAtMs === "number" &&
+        Number.isFinite(context.resetAtMs) &&
+        context.resetAtMs > 0 &&
+        context.resetAtMs <= MAX_ECMASCRIPT_TIME_VALUE
+        ? context.resetAtMs
+        : null;
+    const now = context?.now ?? Date.now();
+    const retryAfterMs = resetAtMs !== null ? Math.max(0, resetAtMs - now) : null;
+    const resetAt = resetAtMs !== null ? new Date(resetAtMs).toISOString() : null;
+    const waitSuffix = resetAt !== null ? `; the recorded limit resets at ${resetAt}` : "";
+    // A forced pin belongs to the launching process, not to the persisted pin
+    // state, so `unpin` would clear nothing — say what actually helps.
+    const remedy = pinSource === "forced"
+        ? "the pin was set by this session's launcher, so relaunch to select a different account"
+        : "run `codex-multi-auth status` for details, or `codex-multi-auth unpin` to allow rotation";
     return {
-        message: `${accountPhrase} is currently unavailable${reasonSuffix}; run \`codex-multi-auth status\` for details, or \`codex-multi-auth unpin\` to allow rotation.`,
+        message: `${accountPhrase} is currently unavailable${reasonSuffix}${waitSuffix}; ${remedy}.`,
         code: "codex_pinned_account_unavailable",
         pinnedAccountIndex: normalizedPinnedIndex,
         reason: skipReason,
+        pin_source: pinSource,
+        reset_at: resetAt,
+        retry_after_ms: retryAfterMs,
         account_skip_reasons: Object.fromEntries([...accountSkipReasons.entries()].map(([index, reason]) => [
             String(index),
             reason,

package/dist/lib/runtime/account-status.d.ts

@@ -7,7 +7,45 @@ export declare function resolveActiveIndex(storage: {
 export declare function getRateLimitResetTimeForFamily(account: {
     rateLimitResetTimes?: Record<string, number | undefined>;
 }, now: number, family: ModelFamily): number | null;
+/**
+ * The moment the account becomes usable again for a `family`/`model`
+ * request: the LATEST bound among the records that actually gate that
+ * request plus any active cooldown. Two deliberate differences from
+ * getRateLimitResetTimeForFamily, whose earliest-reset answer feeds wait
+ * displays: the account stays skipped while ANY gating record is active,
+ * so the earliest reset would send clients back into a 503 — and only the
+ * keys selection consults (`family`, plus `family:<model>` when a model is
+ * known; see isRateLimitedForFamily) may contribute, because another
+ * model's record does not block this request and would overstate its
+ * recovery. Null when nothing bounds recovery.
+ */
+export declare function getAccountRecoveryTimeForFamily(account: {
+    rateLimitResetTimes?: Record<string, number | undefined>;
+    coolingDownUntil?: number;
+}, now: number, family: ModelFamily, model?: string | null): number | null;
 export declare function formatRateLimitEntry(account: {
     rateLimitResetTimes?: Record<string, number | undefined>;
 }, now: number, formatWaitTime: (ms: number) => string, family?: ModelFamily): string | null;
+/**
+ * When a request for `family`/`model` stops being rate limited: the LATEST
+ * active bound among exactly the two keys selection consults — the family-wide
+ * key and `family:<model>` (see `isRateLimitedForFamily`). Null when neither is
+ * active.
+ *
+ * Deliberately narrower and later than `getRateLimitResetTimeForFamily`, whose
+ * earliest-reset-across-every-`family:*`-key answer feeds wait displays and
+ * model-less callers:
+ *
+ * - narrower, because `markRateLimitedWithReason` keys token/concurrency limits
+ *   under `family:<model>`, and a sibling model's record does not gate this
+ *   request — folding it in reports a delay the runtime proxy would not impose;
+ * - later, because the account stays skipped while EITHER key is active, so the
+ *   earliest reset understates the wait when both are set.
+ *
+ * Requires a model by construction: a caller without one cannot know which
+ * model key applies and should keep the family-wide union above.
+ */
+export declare function getRateLimitResetTimeForModel(account: {
+    rateLimitResetTimes?: Record<string, number | undefined>;
+}, now: number, family: ModelFamily, model: string): number | null;
 //# sourceMappingURL=account-status.d.ts.map

package/dist/lib/runtime/account-status.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account-status.d.ts","sourceRoot":"","sources":["../../../lib/runtime/account-status.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD,wBAAgB,kBAAkB,CACjC,OAAO,EAAE;IACR,WAAW,EAAE,MAAM,CAAC;IACpB,mBAAmB,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3D,QAAQ,EAAE,OAAO,EAAE,CAAC;CACpB,EACD,MAAM,GAAE,WAAqB,GAC3B,MAAM,CAOR;AAED,wBAAgB,8BAA8B,CAC7C,OAAO,EAAE;IAAE,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;CAAE,EACrE,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,WAAW,GACjB,MAAM,GAAG,IAAI,CAgBf;AAED,wBAAgB,oBAAoB,CACnC,OAAO,EAAE;IAAE,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;CAAE,EACrE,GAAG,EAAE,MAAM,EACX,cAAc,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,MAAM,EACtC,MAAM,GAAE,WAAqB,GAC3B,MAAM,GAAG,IAAI,CAMf"}
+{"version":3,"file":"account-status.d.ts","sourceRoot":"","sources":["../../../lib/runtime/account-status.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD,wBAAgB,kBAAkB,CACjC,OAAO,EAAE;IACR,WAAW,EAAE,MAAM,CAAC;IACpB,mBAAmB,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3D,QAAQ,EAAE,OAAO,EAAE,CAAC;CACpB,EACD,MAAM,GAAE,WAAqB,GAC3B,MAAM,CAOR;AAED,wBAAgB,8BAA8B,CAC7C,OAAO,EAAE;IAAE,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;CAAE,EACrE,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,WAAW,GACjB,MAAM,GAAG,IAAI,CAgBf;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,+BAA+B,CAC9C,OAAO,EAAE;IACR,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACzD,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC1B,EACD,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,WAAW,EACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GACnB,MAAM,GAAG,IAAI,CAcf;AAED,wBAAgB,oBAAoB,CACnC,OAAO,EAAE;IAAE,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;CAAE,EACrE,GAAG,EAAE,MAAM,EACX,cAAc,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,MAAM,EACtC,MAAM,GAAE,WAAqB,GAC3B,MAAM,GAAG,IAAI,CAMf;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,6BAA6B,CAC5C,OAAO,EAAE;IAAE,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;CAAE,EACrE,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,MAAM,GACX,MAAM,GAAG,IAAI,CAcf"}

package/dist/lib/runtime/account-status.js

@@ -1,3 +1,4 @@
+import { getQuotaKey } from "../accounts/rate-limits.js";
 export function resolveActiveIndex(storage, family = "codex") {
     const total = storage.accounts.length;
     if (total === 0)
@@ -25,6 +26,37 @@ export function getRateLimitResetTimeForFamily(account, now, family) {
     }
     return minReset;
 }
+/**
+ * The moment the account becomes usable again for a `family`/`model`
+ * request: the LATEST bound among the records that actually gate that
+ * request plus any active cooldown. Two deliberate differences from
+ * getRateLimitResetTimeForFamily, whose earliest-reset answer feeds wait
+ * displays: the account stays skipped while ANY gating record is active,
+ * so the earliest reset would send clients back into a 503 — and only the
+ * keys selection consults (`family`, plus `family:<model>` when a model is
+ * known; see isRateLimitedForFamily) may contribute, because another
+ * model's record does not block this request and would overstate its
+ * recovery. Null when nothing bounds recovery.
+ */
+export function getAccountRecoveryTimeForFamily(account, now, family, model) {
+    let latest = null;
+    const consider = (value) => {
+        if (typeof value !== "number" || !Number.isFinite(value))
+            return;
+        if (value <= now)
+            return;
+        if (latest === null || value > latest)
+            latest = value;
+    };
+    const times = account.rateLimitResetTimes;
+    if (times) {
+        consider(times[getQuotaKey(family)]);
+        if (model)
+            consider(times[getQuotaKey(family, model)]);
+    }
+    consider(account.coolingDownUntil);
+    return latest;
+}
 export function formatRateLimitEntry(account, now, formatWaitTime, family = "codex") {
     const resetAt = getRateLimitResetTimeForFamily(account, now, family);
     if (typeof resetAt !== "number")
@@ -34,3 +66,39 @@ export function formatRateLimitEntry(account, now, formatWaitTime, family = "cod
         return null;
     return `resets in ${formatWaitTime(remaining)}`;
 }
+/**
+ * When a request for `family`/`model` stops being rate limited: the LATEST
+ * active bound among exactly the two keys selection consults — the family-wide
+ * key and `family:<model>` (see `isRateLimitedForFamily`). Null when neither is
+ * active.
+ *
+ * Deliberately narrower and later than `getRateLimitResetTimeForFamily`, whose
+ * earliest-reset-across-every-`family:*`-key answer feeds wait displays and
+ * model-less callers:
+ *
+ * - narrower, because `markRateLimitedWithReason` keys token/concurrency limits
+ *   under `family:<model>`, and a sibling model's record does not gate this
+ *   request — folding it in reports a delay the runtime proxy would not impose;
+ * - later, because the account stays skipped while EITHER key is active, so the
+ *   earliest reset understates the wait when both are set.
+ *
+ * Requires a model by construction: a caller without one cannot know which
+ * model key applies and should keep the family-wide union above.
+ */
+export function getRateLimitResetTimeForModel(account, now, family, model) {
+    const times = account.rateLimitResetTimes;
+    if (!times)
+        return null;
+    let latest = null;
+    const consider = (value) => {
+        if (typeof value !== "number" || !Number.isFinite(value))
+            return;
+        if (value <= now)
+            return;
+        if (latest === null || value > latest)
+            latest = value;
+    };
+    consider(times[getQuotaKey(family)]);
+    consider(times[getQuotaKey(family, model)]);
+    return latest;
+}

package/dist/lib/runtime/app-bind.d.ts

@@ -111,6 +111,13 @@ export declare function stopRuntimeRotationRouterProcess(router: Pick<AppBindRou
 /** Parse the documented local-time format emitted by `ps -o lstart=`. */
 export declare function parsePosixProcessStartTime(value: string): number | null;
 export declare function stopDetachedProcess(pid: number | null, platform: NodeJS.Platform, options?: DetachedProcessStopOptions): Promise<boolean>;
+/**
+ * How many helper records unbind processes at once. Exported so a regression
+ * test can observe the bound rather than only its effects — with a handful of
+ * records any width behaves identically, so an edit to `Infinity` would
+ * otherwise ship green.
+ */
+export declare const UNBIND_HELPER_CONCURRENCY = 8;
 export declare function stopRuntimeRotationAppHelperProcess(helper: RuntimeRotationAppHelperStatus, options?: DetachedProcessStopOptions & {
     platform?: NodeJS.Platform;
 }): Promise<boolean>;

package/dist/lib/runtime/app-bind.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app-bind.d.ts","sourceRoot":"","sources":["../../../lib/runtime/app-bind.ts"],"names":[],"mappings":"AAsCA,MAAM,WAAW,YAAY;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAUD,MAAM,WAAW,YAAY;IAC5B,OAAO,EAAE,CAAC,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,iFAAiF;IACjF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,mBAAmB;IACnC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,+EAA+E;IAC/E,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,mEAAmE;IACnE,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,2DAA2D;IAC3D,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,aAAa;IAC7B,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;OAKG;IACH,aAAa,EAAE,OAAO,CAAC;IACvB,KAAK,EAAE,YAAY,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACnC,KAAK,EAAE,YAAY,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC7B,MAAM,EAAE,aAAa,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,uBAAuB,GAAG,CACrC,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ,EACzB,aAAa,CAAC,EAAE,MAAM,KAClB,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC,MAAM,WAAW,cAAc;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAC;IAClC,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,sEAAsE;IACtE,qBAAqB,CAAC,EAAE,uBAAuB,CAAC;CAChD;AAED,MAAM,WAAW,0BAA0B;IAC1C,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IACnC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC;IACrD,kBAAkB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAC9D,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,iEAAiE;IACjE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,qBAAqB,CAAC,EAAE,uBAAuB,CAAC;CAChD;AAED,MAAM,WAAW,8BAA8B;IAC9C,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,oEAAoE;IACpE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,2DAA2D;IAC3D,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAoCD,wBAAgB,2BAA2B,CAC1C,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,YAAY,SAAK,GACf,MAAM,CAMR;AAED,wBAAgB,4BAA4B,CAAC,aAAa,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,MAAM,CAKlG;AAsPD,wBAAgB,mBAAmB,CAAC,OAAO,GAAE,cAAmB,GAAG,YAAY,CAwB9E;AAmLD,wBAAsB,gCAAgC,CACrD,MAAM,EAAE,IAAI,CACX,mBAAmB,EACjB,OAAO,GACP,KAAK,GACL,WAAW,GACX,WAAW,GACX,YAAY,GACZ,kBAAkB,GAClB,eAAe,CACjB,GAAG,IAAI,EACR,QAAQ,EAAE,MAAM,CAAC,QAAQ,EACzB,gBAAgB,EAAE,MAAM,EACxB,OAAO,GAAE,0BAA+B,GACtC,OAAO,CAAC,OAAO,CAAC,CAmElB;AAyLD,yEAAyE;AACzE,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAwCvE;AAmKD,wBAAsB,mBAAmB,CACxC,GAAG,EAAE,MAAM,GAAG,IAAI,EAClB,QAAQ,EAAE,MAAM,CAAC,QAAQ,EACzB,OAAO,GAAE,0BAA+B,GACtC,OAAO,CAAC,OAAO,CAAC,CA6DlB;AAmED,wBAAsB,mCAAmC,CACxD,MAAM,EAAE,8BAA8B,EACtC,OAAO,GAAE,0BAA0B,GAAG;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAA;CAAO,GACvE,OAAO,CAAC,OAAO,CAAC,CAwClB;AAUD,wBAAsB,gBAAgB,CAAC,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,aAAa,CAAC,CAqB3F;AAED,wBAAsB,2BAA2B,CAChD,OAAO,GAAE,cAAmB,GAC1B,OAAO,CAAC,aAAa,CAAC,CAKxB;AAsHD,wBAAsB,6BAA6B,CAClD,OAAO,GAAE,cAAmB,GAC1B,OAAO,CAAC,aAAa,CAAC,CAKxB;AAgLD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,CAsCjE"}
+{"version":3,"file":"app-bind.d.ts","sourceRoot":"","sources":["../../../lib/runtime/app-bind.ts"],"names":[],"mappings":"AAuCA,MAAM,WAAW,YAAY;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAUD,MAAM,WAAW,YAAY;IAC5B,OAAO,EAAE,CAAC,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,iFAAiF;IACjF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,mBAAmB;IACnC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,+EAA+E;IAC/E,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,mEAAmE;IACnE,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,2DAA2D;IAC3D,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,aAAa;IAC7B,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;OAKG;IACH,aAAa,EAAE,OAAO,CAAC;IACvB,KAAK,EAAE,YAAY,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACnC,KAAK,EAAE,YAAY,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC7B,MAAM,EAAE,aAAa,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,uBAAuB,GAAG,CACrC,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ,EACzB,aAAa,CAAC,EAAE,MAAM,KAClB,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC,MAAM,WAAW,cAAc;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAC;IAClC,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,sEAAsE;IACtE,qBAAqB,CAAC,EAAE,uBAAuB,CAAC;CAChD;AAED,MAAM,WAAW,0BAA0B;IAC1C,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IACnC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC;IACrD,kBAAkB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAC9D,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,iEAAiE;IACjE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,qBAAqB,CAAC,EAAE,uBAAuB,CAAC;CAChD;AAED,MAAM,WAAW,8BAA8B;IAC9C,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,oEAAoE;IACpE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,2DAA2D;IAC3D,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAoCD,wBAAgB,2BAA2B,CAC1C,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,YAAY,SAAK,GACf,MAAM,CAMR;AAED,wBAAgB,4BAA4B,CAAC,aAAa,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,MAAM,CAKlG;AAsPD,wBAAgB,mBAAmB,CAAC,OAAO,GAAE,cAAmB,GAAG,YAAY,CAwB9E;AAmLD,wBAAsB,gCAAgC,CACrD,MAAM,EAAE,IAAI,CACX,mBAAmB,EACjB,OAAO,GACP,KAAK,GACL,WAAW,GACX,WAAW,GACX,YAAY,GACZ,kBAAkB,GAClB,eAAe,CACjB,GAAG,IAAI,EACR,QAAQ,EAAE,MAAM,CAAC,QAAQ,EACzB,gBAAgB,EAAE,MAAM,EACxB,OAAO,GAAE,0BAA+B,GACtC,OAAO,CAAC,OAAO,CAAC,CAmElB;AAyLD,yEAAyE;AACzE,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAwCvE;AAmKD,wBAAsB,mBAAmB,CACxC,GAAG,EAAE,MAAM,GAAG,IAAI,EAClB,QAAQ,EAAE,MAAM,CAAC,QAAQ,EACzB,OAAO,GAAE,0BAA+B,GACtC,OAAO,CAAC,OAAO,CAAC,CA6DlB;AAmED;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,IAAI,CAAC;AA8C3C,wBAAsB,mCAAmC,CACxD,MAAM,EAAE,8BAA8B,EACtC,OAAO,GAAE,0BAA0B,GAAG;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAA;CAAO,GACvE,OAAO,CAAC,OAAO,CAAC,CAwClB;AAUD,wBAAsB,gBAAgB,CAAC,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,aAAa,CAAC,CAqB3F;AAED,wBAAsB,2BAA2B,CAChD,OAAO,GAAE,cAAmB,GAC1B,OAAO,CAAC,aAAa,CAAC,CAKxB;AAsHD,wBAAsB,6BAA6B,CAClD,OAAO,GAAE,cAAmB,GAC1B,OAAO,CAAC,aAAa,CAAC,CAKxB;AAsQD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,CAsCjE"}

package/dist/lib/runtime/app-bind.js

@@ -1,14 +1,14 @@
 import { spawn } from "node:child_process";
 import { createHash, randomBytes } from "node:crypto";
 import { closeSync, existsSync, mkdirSync, openSync } from "node:fs";
-import { mkdir, open, readFile, rename, rm, unlink } from "node:fs/promises";
+import { mkdir, open, readFile, readdir, rename, rm, unlink } from "node:fs/promises";
 import { homedir } from "node:os";
 import { basename, dirname, join } from "node:path";
 import process from "node:process";
 import { fileURLToPath } from "node:url";
 import { withFileOperationRetry } from "../fs-retry.js";
 import { getCodexMultiAuthDir } from "../runtime-paths.js";
-import { APP_RUNTIME_HELPER_OWNER_FILE, APP_RUNTIME_HELPER_STATUS_FILE, } from "../runtime-constants.js";
+import { APP_RUNTIME_HELPER_OWNER_FILE, listRuntimeHelperOwnerPaths, listRuntimeHelperStatusPaths, } from "../runtime-constants.js";
 import { configHasRuntimeRotationProvider, restoreConfigTomlFromRuntimeRotationProvider, restoreConfigTomlFromRuntimeRotationProviderWithoutBackup, rewriteConfigTomlForRuntimeRotationProvider, } from "./config-toml.js";
 const APP_BIND_DIR_NAME = "app-bind";
 const APP_BIND_STATE_FILE = "runtime-rotation-app-bind.json";
@@ -879,6 +879,44 @@ function resolveRuntimeHelperOwnerPath(baseDir, pid) {
         return null;
     return join(baseDir, APP_RUNTIME_HELPER_OWNER_FILE.replace(/\.json$/i, `.${pid}.json`));
 }
+/**
+ * How many helper records unbind processes at once. Exported so a regression
+ * test can observe the bound rather than only its effects — with a handful of
+ * records any width behaves identically, so an edit to `Infinity` would
+ * otherwise ship green.
+ */
+export const UNBIND_HELPER_CONCURRENCY = 8;
+/**
+ * `Promise.all` over `items` with at most `limit` in flight, preserving input
+ * order in the result. Used where the per-item work is independent but not
+ * free — a helper stop pays a SIGTERM, a graceful wait and possibly a SIGKILL —
+ * so serialising it multiplies a single stop window by the number of stale
+ * helpers, and unbounded parallelism signals every one of them at once.
+ */
+async function mapWithConcurrency(items, limit, worker) {
+    const results = new Array(items.length);
+    let next = 0;
+    const runners = Array.from({ length: Math.max(1, Math.min(limit, items.length)) }, async () => {
+        for (;;) {
+            const index = next;
+            next += 1;
+            // Only running past the end retires a runner. Folding the
+            // `undefined` check into the same `return` would make a sparse
+            // array or a `(T | undefined)[]` silently drop every item after
+            // the first hole — on a cleanup path whose failure mode is
+            // "helpers left running while the user is told the app was
+            // unbound".
+            if (index >= items.length)
+                return;
+            const item = items[index];
+            if (item === undefined)
+                continue;
+            results[index] = await worker(item, index);
+        }
+    });
+    await Promise.all(runners);
+    return results;
+}
 export async function stopRuntimeRotationAppHelperProcess(helper, options = {}) {
     if (helper.kind !== "codex-app-runtime-rotation-helper" ||
         helper.state !== "running" ||
@@ -1054,66 +1092,146 @@ async function unbindCodexAppRuntimeRotationLocked(options, paths) {
     if (router?.pid && (!routerStopped || isProcessAlive(router.pid))) {
         options.log?.(`Warning: runtime router (pid ${router.pid}) did not stop; continuing cleanup`);
     }
-    const helperStatusPath = join(dirname(paths.bindDir), APP_RUNTIME_HELPER_STATUS_FILE);
-    const helperRead = await readRuntimeHelperStatus(helperStatusPath);
-    let removeHelperStatus = false;
-    let removeHelperOwner = false;
-    let helperOwnerPath = null;
-    if (helperRead.kind === "valid") {
+    // Helpers publish per-PID status files (`runtime-rotation-app-helper.<pid>.json`);
+    // the un-suffixed name is the legacy shared path from before that change,
+    // still checked so a pre-upgrade helper is torn down too. Every candidate
+    // walks the same per-helper logic the single file used to get: stopping is
+    // gated on ownership verification (status/owner identity-token agreement
+    // plus process identity), so unbind reaps each helper it can prove is one
+    // of ours and preserves — with a warning — anything it cannot.
+    const helperBaseDir = dirname(paths.bindDir);
+    let helperDirEntries = [];
+    try {
+        helperDirEntries = await withFileOperationRetry(() => readdir(helperBaseDir));
+    }
+    catch (error) {
+        // Degrading to legacy-only cleanup while reporting success would leave
+        // every per-PID helper running with the user told the app was unbound —
+        // say so. ENOENT just means no helper ever ran.
+        const code = error && typeof error === "object" && "code" in error
+            ? String(error.code)
+            : "unknown";
+        if (code !== "ENOENT") {
+            options.log?.(`Warning: could not enumerate runtime app helper status files (${code}); only the legacy helper path is checked`);
+        }
+        helperDirEntries = [];
+    }
+    const helperStatusPaths = listRuntimeHelperStatusPaths(helperBaseDir, helperDirEntries);
+    // Each candidate is independent — a read, a liveness check, and at most one
+    // SIGTERM/graceful-wait/SIGKILL sequence — and on the machine from #663 there
+    // were 183 of them. Run them in a bounded pool rather than one after another,
+    // so unbind costs roughly one stop window instead of N of them; the bound
+    // keeps a machine full of stale helpers from being hit with 183 concurrent
+    // signal sequences.
+    const helperResults = await mapWithConcurrency(helperStatusPaths, UNBIND_HELPER_CONCURRENCY, async (helperStatusPath) => {
+        const helperRead = await readRuntimeHelperStatus(helperStatusPath);
+        if (helperRead.kind !== "valid")
+            return null;
         const helper = helperRead.status;
-        if (helper.kind === "codex-app-runtime-rotation-helper") {
-            helperOwnerPath = resolveRuntimeHelperOwnerPath(dirname(paths.bindDir), helper.pid);
-            const helperOwner = helperOwnerPath
-                ? await readRuntimeHelperOwner(helperOwnerPath)
-                : null;
-            const helperOwnershipMatches = !helper.identityToken ||
-                (helperOwner !== null &&
-                    helper.identityToken === helperOwner.identityToken);
-            if (helper.state === "running") {
-                if (helper.pid === null) {
-                    options.log?.("Warning: runtime app helper status has no valid PID; preserving status");
+        if (helper.kind !== "codex-app-runtime-rotation-helper")
+            return null;
+        let removeHelperStatus = false;
+        let removeHelperOwner = false;
+        const helperOwnerPath = resolveRuntimeHelperOwnerPath(helperBaseDir, helper.pid);
+        const helperOwner = helperOwnerPath
+            ? await readRuntimeHelperOwner(helperOwnerPath)
+            : null;
+        const helperOwnershipMatches = !helper.identityToken ||
+            (helperOwner !== null &&
+                helper.identityToken === helperOwner.identityToken);
+        if (helper.state === "running") {
+            if (helper.pid === null) {
+                options.log?.("Warning: runtime app helper status has no valid PID; preserving status");
+            }
+            else {
+                const wasAlive = isProcessAlive(helper.pid);
+                if (!wasAlive) {
+                    // Decisive, and deliberately not gated on ownership (#666): a
+                    // dead PID means both files describe a process that no longer
+                    // exists, so keeping the owner file preserves nothing. It used
+                    // to be gated, which deleted the status file and stranded the
+                    // owner file — and because unbind then enumerated status paths
+                    // only, nothing ever rediscovered it. This matches what the
+                    // launcher-side sweep already does with a dead PID.
+                    removeHelperStatus = true;
+                    removeHelperOwner = helperOwnerPath !== null;
+                }
+                else if (!helperOwnershipMatches) {
+                    options.log?.("Warning: runtime app helper ownership metadata does not match; preserving status");
                 }
                 else {
-                    const wasAlive = isProcessAlive(helper.pid);
-                    if (!wasAlive) {
-                        removeHelperStatus = true;
-                        removeHelperOwner =
-                            helperOwnershipMatches && helperOwnerPath !== null;
-                    }
-                    else if (!helperOwnershipMatches) {
-                        options.log?.("Warning: runtime app helper ownership metadata does not match; preserving status");
-                    }
-                    else {
-                        const stopped = await stopRuntimeRotationAppHelperProcess(helper, {
-                            platform,
-                            log: options.log,
-                            identityToken: helper.identityToken
-                                ? helperOwner?.identityToken
-                                : undefined,
-                            verifyProcessIdentity: options.verifyProcessIdentity,
-                        });
-                        const stillAlive = isProcessAlive(helper.pid);
-                        removeHelperStatus = stopped && !stillAlive;
-                        removeHelperOwner =
-                            removeHelperStatus && helperOwnerPath !== null;
-                        if (!removeHelperStatus) {
-                            options.log?.(`Warning: runtime app helper (pid ${helper.pid}) did not stop; preserving status`);
-                        }
+                    const stopped = await stopRuntimeRotationAppHelperProcess(helper, {
+                        platform,
+                        log: options.log,
+                        identityToken: helper.identityToken
+                            ? helperOwner?.identityToken
+                            : undefined,
+                        verifyProcessIdentity: options.verifyProcessIdentity,
+                    });
+                    const stillAlive = isProcessAlive(helper.pid);
+                    removeHelperStatus = stopped && !stillAlive;
+                    removeHelperOwner = removeHelperStatus && helperOwnerPath !== null;
+                    if (!removeHelperStatus) {
+                        options.log?.(`Warning: runtime app helper (pid ${helper.pid}) did not stop; preserving status`);
                     }
                 }
             }
-            else {
-                // A non-running, owned record is removable only when its PID is
-                // absent or no longer alive. This avoids deleting a status file
-                // while a helper is still serving despite a stale state value.
-                removeHelperStatus =
-                    helper.pid === null || !isProcessAlive(helper.pid);
-                removeHelperOwner =
-                    removeHelperStatus &&
-                        helperOwnershipMatches &&
-                        helperOwnerPath !== null;
-            }
         }
+        else {
+            // A non-running, owned record is removable only when its PID is
+            // absent or no longer alive. This avoids deleting a status file
+            // while a helper is still serving despite a stale state value.
+            // Ownership does not gate the owner file here either, for the same
+            // reason as above: the PID is gone, so neither file describes
+            // anything that can still be running.
+            removeHelperStatus = helper.pid === null || !isProcessAlive(helper.pid);
+            removeHelperOwner = removeHelperStatus && helperOwnerPath !== null;
+        }
+        return {
+            statusPath: helperStatusPath,
+            ownerPath: helperOwnerPath,
+            removeHelperStatus,
+            removeHelperOwner,
+        };
+    });
+    const helperCleanupPaths = [];
+    // Owner paths this pass already reasoned about, whether or not it decided to
+    // remove them — a preserved live helper's owner file must not then be swept
+    // by the orphan pass below.
+    const consideredOwnerPaths = new Set();
+    for (const result of helperResults) {
+        if (!result)
+            continue;
+        if (result.ownerPath !== null)
+            consideredOwnerPaths.add(result.ownerPath);
+        if (result.removeHelperStatus)
+            helperCleanupPaths.push(result.statusPath);
+        if (result.removeHelperOwner && result.ownerPath !== null) {
+            helperCleanupPaths.push(result.ownerPath);
+        }
+    }
+    // Owner files with no status record left to pair them with. Before #666 these
+    // were unreachable: every earlier pass walked status paths only, so an owner
+    // file that outlived its status file was never looked at again. A dead PID is
+    // the whole test — a live PID's owner file belongs to a helper that is still
+    // running, and was already considered above.
+    for (const owner of listRuntimeHelperOwnerPaths(helperBaseDir, helperDirEntries)) {
+        if (consideredOwnerPaths.has(owner.path))
+            continue;
+        if (isProcessAlive(owner.pid)) {
+            // An owner file with no status record whose PID is nonetheless live
+            // is the one shape this pass cannot reclaim. Either a helper is
+            // starting right now and has not published yet, or — the case that
+            // accumulates — the PID was recycled by an unrelated process after
+            // the status file was already gone. Telling those apart needs the
+            // recorded-start-time comparison the launcher-side sweep does, which
+            // unbind has no equivalent of; that is a scope decision, but it
+            // should not be a silent one. Every other preserve in this function
+            // warns, so this one does too.
+            options.log?.(`Warning: runtime app helper owner metadata (pid ${owner.pid}) has no status record but its PID is live; preserving`);
+            continue;
+        }
+        helperCleanupPaths.push(owner.path);
     }
     await removeAppBindStartup(state ?? paths);
     const backup = await readAppBindBackup(paths.backupPath);
@@ -1154,8 +1272,7 @@ async function unbindCodexAppRuntimeRotationLocked(options, paths) {
         paths.backupPath,
         paths.statusPath,
         state?.logPath ?? paths.logPath,
-        ...(removeHelperStatus ? [helperStatusPath] : []),
-        ...(removeHelperOwner && helperOwnerPath ? [helperOwnerPath] : []),
+        ...helperCleanupPaths,
     ];
     for (const candidate of cleanupCandidates) {
         try {

package/dist/lib/runtime/app-helper-selection.d.ts

@@ -0,0 +1,69 @@
+/**
+ * The fields any helper status record has to expose for the shared selector to
+ * reason about it. `rotation status` and runtime account resolution carry
+ * different extra fields — request counters on one side, account identity on
+ * the other — but they answer "which helper is current" the same way, and used
+ * to answer it with two hand-rolled copies that could drift apart within a
+ * single command (#667).
+ */
+export interface RuntimeHelperSelectable {
+    state: string | null;
+    pid: number | null;
+    startedAt: number | null;
+    updatedAt: number | null;
+}
+/**
+ * How stale a `running` record may be before it stops counting as live.
+ *
+ * A running helper republishes its status on every tick, and the publish path
+ * heartbeats at least once per `APP_RUNTIME_HELPER_STATUS_HEARTBEAT_MS` (60s)
+ * even when nothing in the payload changed. Ten heartbeats of silence is not a
+ * helper that is merely quiet — it is a record whose writer is gone.
+ *
+ * This is the identity check these readers were missing. `kill(pid, 0)` answers
+ * "does *a* process hold this integer", so a stale record — classically the
+ * legacy shared `runtime-rotation-app-helper.json` left behind by a SIGKILLed
+ * pre-upgrade helper — passes liveness as soon as an unrelated process is
+ * handed its PID, and can then win selection outright. Freshness is the half of
+ * identity available to a synchronous reader: the wrapper verifies identity by
+ * probing kernel start times, but that costs a `ps` per candidate, and these
+ * two call sites are read-only status paths reached from the interactive menu
+ * as well as the CLI. Whoever holds the PID now, they are not the process that
+ * last wrote this file.
+ */
+export declare const RUNTIME_HELPER_STATUS_STALE_MS: number;
+/** Tolerance for clock skew between the writing helper and the reader. */
+export declare const RUNTIME_HELPER_CLOCK_TOLERANCE_MS: number;
+/**
+ * A PID is a positive integer or it is nothing. Both readers used to accept any
+ * finite number, so a corrupt or hand-edited record carrying `-1234` reached
+ * `process.kill(-1234, 0)` — which on POSIX probes process *group* 1234 and
+ * succeeds on any busy machine, reporting a helper that does not exist as live.
+ * Fractional values were accepted the same way.
+ */
+export declare function readRuntimeHelperPid(value: unknown): number | null;
+/**
+ * Best-effort liveness probe. `EPERM` means a process exists that this user may
+ * not signal, so it counts as alive; every other errno — including the `EINVAL`
+ * some platforms raise for a PID above their ceiling — counts as dead.
+ */
+export declare function isRuntimeHelperProcessAlive(pid: number | null): boolean;
+/**
+ * The single definition of "this helper is currently serving": a running state,
+ * a live PID, and a record recent enough to have been written by that PID's
+ * current occupant.
+ */
+export declare function isLiveRuntimeHelper(status: RuntimeHelperSelectable, now?: number): boolean;
+/** Every helper that passes {@link isLiveRuntimeHelper}, input order preserved. */
+export declare function liveRuntimeHelpers<T extends RuntimeHelperSelectable>(statuses: readonly T[], now?: number): T[];
+/**
+ * Prefer a live helper, and among several the most recently updated. Absent any
+ * live helper, fall back to the freshest record so the previous "reports the
+ * last helper's final state" behaviour survives.
+ *
+ * Callers that also need the live count must pass the same `statuses` array and
+ * the same `now` to {@link liveRuntimeHelpers}, so the selected helper and the
+ * count describe one instant rather than two.
+ */
+export declare function selectRuntimeHelperStatus<T extends RuntimeHelperSelectable>(statuses: readonly T[], now?: number): T | null;
+//# sourceMappingURL=app-helper-selection.d.ts.map

package/dist/lib/runtime/app-helper-selection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-helper-selection.d.ts","sourceRoot":"","sources":["../../../lib/runtime/app-helper-selection.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AACH,MAAM,WAAW,uBAAuB;IACvC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,8BAA8B,QAAiB,CAAC;AAE7D,0EAA0E;AAC1E,eAAO,MAAM,iCAAiC,QAAY,CAAC;AAE3D;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAIlE;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAWvE;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAClC,MAAM,EAAE,uBAAuB,EAC/B,GAAG,GAAE,MAAmB,GACtB,OAAO,CAgBT;AAED,mFAAmF;AACnF,wBAAgB,kBAAkB,CAAC,CAAC,SAAS,uBAAuB,EACnE,QAAQ,EAAE,SAAS,CAAC,EAAE,EACtB,GAAG,GAAE,MAAmB,GACtB,CAAC,EAAE,CAEL;AASD;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,CAAC,SAAS,uBAAuB,EAC1E,QAAQ,EAAE,SAAS,CAAC,EAAE,EACtB,GAAG,GAAE,MAAmB,GACtB,CAAC,GAAG,IAAI,CAKV"}