codex-multi-auth 2.8.5 → 2.8.7

package/dist/lib/runtime/account-status.d.ts

@@ -7,7 +7,74 @@ export declare function resolveActiveIndex(storage: {
 export declare function getRateLimitResetTimeForFamily(account: {
     rateLimitResetTimes?: Record<string, number | undefined>;
 }, now: number, family: ModelFamily): number | null;
+export interface AccountRecoveryBounds {
+    /**
+     * The moment the account becomes usable again: `rateLimitAtMs` widened by
+     * any active cooldown, because the account stays skipped while ANY gating
+     * record is active. Null when nothing bounds recovery.
+     */
+    recoveryAtMs: number | null;
+    /**
+     * The rate-limit records' own contribution to `recoveryAtMs`, cooldowns
+     * excluded. The pinned-503 uses it to decide whether the deadline it
+     * advertises is in fact the rate limit's own reset — with a breaker or
+     * cooldown ending later, the full recovery bound outlives the rate limit
+     * and must not be worded as its reset. Null when no rate-limit record
+     * gates the request.
+     */
+    rateLimitAtMs: number | null;
+}
+/**
+ * Both recovery bounds for a `family`/`model` request, from ONE pass over
+ * `rateLimitResetTimes` against a single `now`.
+ *
+ * Two deliberate differences from getRateLimitResetTimeForFamily, whose
+ * earliest-reset answer feeds wait displays: the latest bound wins, because
+ * the earliest reset would send clients back into a 503 — and only the keys
+ * selection consults (`family`, plus `family:<model>` when a model is known;
+ * see isRateLimitedForFamily) may contribute, because another model's record
+ * does not block this request and would overstate its recovery.
+ *
+ * A caller that needs both bounds must take them from one call. Measuring
+ * them separately lets a record expire between the two walks, which reports
+ * a rate-limited account as if a cooldown bounded its recovery.
+ */
+export declare function getAccountRecoveryBoundsForFamily(account: {
+    rateLimitResetTimes?: Record<string, number | undefined>;
+    coolingDownUntil?: number;
+}, now: number, family: ModelFamily, model?: string | null): AccountRecoveryBounds;
+/** The `recoveryAtMs` bound alone; see getAccountRecoveryBoundsForFamily. */
+export declare function getAccountRecoveryTimeForFamily(account: {
+    rateLimitResetTimes?: Record<string, number | undefined>;
+    coolingDownUntil?: number;
+}, now: number, family: ModelFamily, model?: string | null): number | null;
+/** The `rateLimitAtMs` bound alone; see getAccountRecoveryBoundsForFamily. */
+export declare function getRateLimitRecoveryTimeForFamily(account: {
+    rateLimitResetTimes?: Record<string, number | undefined>;
+}, now: number, family: ModelFamily, model?: string | null): number | null;
 export declare function formatRateLimitEntry(account: {
     rateLimitResetTimes?: Record<string, number | undefined>;
 }, now: number, formatWaitTime: (ms: number) => string, family?: ModelFamily): string | null;
+/**
+ * When a request for `family`/`model` stops being rate limited: the LATEST
+ * active bound among exactly the two keys selection consults — the family-wide
+ * key and `family:<model>` (see `isRateLimitedForFamily`). Null when neither is
+ * active.
+ *
+ * Deliberately narrower and later than `getRateLimitResetTimeForFamily`, whose
+ * earliest-reset-across-every-`family:*`-key answer feeds wait displays and
+ * model-less callers:
+ *
+ * - narrower, because `markRateLimitedWithReason` keys token/concurrency limits
+ *   under `family:<model>`, and a sibling model's record does not gate this
+ *   request — folding it in reports a delay the runtime proxy would not impose;
+ * - later, because the account stays skipped while EITHER key is active, so the
+ *   earliest reset understates the wait when both are set.
+ *
+ * Requires a model by construction: a caller without one cannot know which
+ * model key applies and should keep the family-wide union above.
+ */
+export declare function getRateLimitResetTimeForModel(account: {
+    rateLimitResetTimes?: Record<string, number | undefined>;
+}, now: number, family: ModelFamily, model: string): number | null;
 //# sourceMappingURL=account-status.d.ts.map

package/dist/lib/runtime/account-status.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account-status.d.ts","sourceRoot":"","sources":["../../../lib/runtime/account-status.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD,wBAAgB,kBAAkB,CACjC,OAAO,EAAE;IACR,WAAW,EAAE,MAAM,CAAC;IACpB,mBAAmB,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3D,QAAQ,EAAE,OAAO,EAAE,CAAC;CACpB,EACD,MAAM,GAAE,WAAqB,GAC3B,MAAM,CAOR;AAED,wBAAgB,8BAA8B,CAC7C,OAAO,EAAE;IAAE,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;CAAE,EACrE,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,WAAW,GACjB,MAAM,GAAG,IAAI,CAgBf;AAED,wBAAgB,oBAAoB,CACnC,OAAO,EAAE;IAAE,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;CAAE,EACrE,GAAG,EAAE,MAAM,EACX,cAAc,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,MAAM,EACtC,MAAM,GAAE,WAAqB,GAC3B,MAAM,GAAG,IAAI,CAMf"}
+{"version":3,"file":"account-status.d.ts","sourceRoot":"","sources":["../../../lib/runtime/account-status.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD,wBAAgB,kBAAkB,CACjC,OAAO,EAAE;IACR,WAAW,EAAE,MAAM,CAAC;IACpB,mBAAmB,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3D,QAAQ,EAAE,OAAO,EAAE,CAAC;CACpB,EACD,MAAM,GAAE,WAAqB,GAC3B,MAAM,CAOR;AAED,wBAAgB,8BAA8B,CAC7C,OAAO,EAAE;IAAE,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;CAAE,EACrE,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,WAAW,GACjB,MAAM,GAAG,IAAI,CAgBf;AAeD,MAAM,WAAW,qBAAqB;IACrC;;;;OAIG;IACH,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B;;;;;;;OAOG;IACH,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iCAAiC,CAChD,OAAO,EAAE;IACR,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACzD,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC1B,EACD,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,WAAW,EACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GACnB,qBAAqB,CAevB;AAED,6EAA6E;AAC7E,wBAAgB,+BAA+B,CAC9C,OAAO,EAAE;IACR,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACzD,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC1B,EACD,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,WAAW,EACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GACnB,MAAM,GAAG,IAAI,CAGf;AAED,8EAA8E;AAC9E,wBAAgB,iCAAiC,CAChD,OAAO,EAAE;IACR,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CACzD,EACD,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,WAAW,EACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GACnB,MAAM,GAAG,IAAI,CAGf;AAED,wBAAgB,oBAAoB,CACnC,OAAO,EAAE;IAAE,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;CAAE,EACrE,GAAG,EAAE,MAAM,EACX,cAAc,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,MAAM,EACtC,MAAM,GAAE,WAAqB,GAC3B,MAAM,GAAG,IAAI,CAMf;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,6BAA6B,CAC5C,OAAO,EAAE;IAAE,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;CAAE,EACrE,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,MAAM,GACX,MAAM,GAAG,IAAI,CAGf"}

package/dist/lib/runtime/account-status.js

@@ -1,3 +1,4 @@
+import { getQuotaKey } from "../accounts/rate-limits.js";
 export function resolveActiveIndex(storage, family = "codex") {
     const total = storage.accounts.length;
     if (total === 0)
@@ -25,6 +26,55 @@ export function getRateLimitResetTimeForFamily(account, now, family) {
     }
     return minReset;
 }
+/** The value when it is still a live bound at `now`, otherwise null. */
+function activeBound(value, now) {
+    if (typeof value !== "number" || !Number.isFinite(value))
+        return null;
+    return value > now ? value : null;
+}
+/** The later of two bounds, treating null as "does not bound". */
+function laterBound(a, b) {
+    if (a === null)
+        return b;
+    if (b === null)
+        return a;
+    return a > b ? a : b;
+}
+/**
+ * Both recovery bounds for a `family`/`model` request, from ONE pass over
+ * `rateLimitResetTimes` against a single `now`.
+ *
+ * Two deliberate differences from getRateLimitResetTimeForFamily, whose
+ * earliest-reset answer feeds wait displays: the latest bound wins, because
+ * the earliest reset would send clients back into a 503 — and only the keys
+ * selection consults (`family`, plus `family:<model>` when a model is known;
+ * see isRateLimitedForFamily) may contribute, because another model's record
+ * does not block this request and would overstate its recovery.
+ *
+ * A caller that needs both bounds must take them from one call. Measuring
+ * them separately lets a record expire between the two walks, which reports
+ * a rate-limited account as if a cooldown bounded its recovery.
+ */
+export function getAccountRecoveryBoundsForFamily(account, now, family, model) {
+    const times = account.rateLimitResetTimes;
+    const rateLimitAtMs = times
+        ? laterBound(activeBound(times[getQuotaKey(family)], now), model ? activeBound(times[getQuotaKey(family, model)], now) : null)
+        : null;
+    return {
+        rateLimitAtMs,
+        recoveryAtMs: laterBound(rateLimitAtMs, activeBound(account.coolingDownUntil, now)),
+    };
+}
+/** The `recoveryAtMs` bound alone; see getAccountRecoveryBoundsForFamily. */
+export function getAccountRecoveryTimeForFamily(account, now, family, model) {
+    return getAccountRecoveryBoundsForFamily(account, now, family, model)
+        .recoveryAtMs;
+}
+/** The `rateLimitAtMs` bound alone; see getAccountRecoveryBoundsForFamily. */
+export function getRateLimitRecoveryTimeForFamily(account, now, family, model) {
+    return getAccountRecoveryBoundsForFamily(account, now, family, model)
+        .rateLimitAtMs;
+}
 export function formatRateLimitEntry(account, now, formatWaitTime, family = "codex") {
     const resetAt = getRateLimitResetTimeForFamily(account, now, family);
     if (typeof resetAt !== "number")
@@ -34,3 +84,26 @@ export function formatRateLimitEntry(account, now, formatWaitTime, family = "cod
         return null;
     return `resets in ${formatWaitTime(remaining)}`;
 }
+/**
+ * When a request for `family`/`model` stops being rate limited: the LATEST
+ * active bound among exactly the two keys selection consults — the family-wide
+ * key and `family:<model>` (see `isRateLimitedForFamily`). Null when neither is
+ * active.
+ *
+ * Deliberately narrower and later than `getRateLimitResetTimeForFamily`, whose
+ * earliest-reset-across-every-`family:*`-key answer feeds wait displays and
+ * model-less callers:
+ *
+ * - narrower, because `markRateLimitedWithReason` keys token/concurrency limits
+ *   under `family:<model>`, and a sibling model's record does not gate this
+ *   request — folding it in reports a delay the runtime proxy would not impose;
+ * - later, because the account stays skipped while EITHER key is active, so the
+ *   earliest reset understates the wait when both are set.
+ *
+ * Requires a model by construction: a caller without one cannot know which
+ * model key applies and should keep the family-wide union above.
+ */
+export function getRateLimitResetTimeForModel(account, now, family, model) {
+    return getAccountRecoveryBoundsForFamily(account, now, family, model)
+        .rateLimitAtMs;
+}

package/dist/lib/runtime-rotation-proxy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-rotation-proxy.d.ts","sourceRoot":"","sources":["../../lib/runtime-rotation-proxy.ts"],"names":[],"mappings":"AAGA,OAAO,EAGN,KAAK,cAAc,EACnB,MAAM,eAAe,CAAC;AA8BvB,OAAO,EAAkB,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AA2CtE,OAAO,KAAK,EAKX,2BAA2B,EAC3B,0BAA0B,EAE1B,MAAM,oCAAoC,CAAC;AAe5C,YAAY,EACX,2BAA2B,EAC3B,0BAA0B,EAC1B,0BAA0B,GAC1B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACN,+BAA+B,EAC/B,0BAA0B,GAC1B,MAAM,kCAAkC,CAAC;AAC1C,YAAY,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AACnF,OAAO,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAC;AACxE,OAAO,EACN,+BAA+B,EAC/B,8BAA8B,EAC9B,uBAAuB,EACvB,uBAAuB,GACvB,MAAM,oCAAoC,CAAC;AAC5C,YAAY,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAC;AAiDtE,kFAAkF;AAClF,wBAAgB,qBAAqB,CACpC,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,GAAG;IACvE,gFAAgF;IAChF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB,EACD,MAAM,EAAE,WAAW,EACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GACnB,MAAM,CAmBR;AA8bD;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAC1C,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,GACvC,MAAM,GAAG,IAAI,CAUf;AAED,wBAAsB,yBAAyB,CAC9C,OAAO,EAAE,2BAA2B,GAClC,OAAO,CAAC,0BAA0B,CAAC,CA4KrC"}
+{"version":3,"file":"runtime-rotation-proxy.d.ts","sourceRoot":"","sources":["../../lib/runtime-rotation-proxy.ts"],"names":[],"mappings":"AAGA,OAAO,EAIN,KAAK,cAAc,EACnB,MAAM,eAAe,CAAC;AA8BvB,OAAO,EAAkB,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AA4CtE,OAAO,KAAK,EAKX,2BAA2B,EAC3B,0BAA0B,EAE1B,MAAM,oCAAoC,CAAC;AAe5C,YAAY,EACX,2BAA2B,EAC3B,0BAA0B,EAC1B,0BAA0B,GAC1B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACN,+BAA+B,EAC/B,0BAA0B,GAC1B,MAAM,kCAAkC,CAAC;AAC1C,YAAY,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AACnF,OAAO,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAC;AACxE,OAAO,EACN,+BAA+B,EAC/B,8BAA8B,EAC9B,uBAAuB,EACvB,uBAAuB,GACvB,MAAM,oCAAoC,CAAC;AAC5C,YAAY,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAC;AA8DtE,kFAAkF;AAClF,wBAAgB,qBAAqB,CACpC,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,GAAG;IACvE,gFAAgF;IAChF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB,EACD,MAAM,EAAE,WAAW,EACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GACnB,MAAM,CAmBR;AA8bD;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAC1C,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,GACvC,MAAM,GAAG,IAAI,CAUf;AAED,wBAAsB,yBAAyB,CAC9C,OAAO,EAAE,2BAA2B,GAClC,OAAO,CAAC,0BAA0B,CAAC,CA4KrC"}

package/dist/lib/runtime-rotation-proxy.js

@@ -1,6 +1,6 @@
 import { createHash, randomUUID, timingSafeEqual } from "node:crypto";
 import { createServer } from "node:http";
-import { AccountManager, extractAccountId, } from "./accounts.js";
+import { AccountManager, AUTH_INVALIDATION_MARKER, extractAccountId, } from "./accounts.js";
 import { withRoutingMutex } from "./routing-mutex.js";
 import { getFetchTimeoutMs, getNetworkErrorCooldownMs, getRetryAllAccountsMaxRetries, getServerErrorCooldownMs, getSessionAffinity, getSessionAffinityMaxEntries, getSessionAffinityTtlMs, getStreamStallTimeoutMs, getMinRotationIntervalMs, getTokenInvalidationCooldownMs, getTokenRefreshSkewMs, getPidOffsetEnabled, getPreemptiveQuotaEnabled, getPreemptiveQuotaMaxDeferralMs, getPreemptiveQuotaRemainingPercent5h, getPreemptiveQuotaRemainingPercent7d, getRoutingMutexMode, getSchedulingStrategy, loadPluginConfig, } from "./config.js";
 import { CODEX_BASE_URL, HTTP_STATUS, OPENAI_HEADERS, OPENAI_HEADER_VALUES, URL_PATHS, } from "./constants.js";
@@ -15,6 +15,7 @@ import { CodexValidationError } from "./errors.js";
 import { normalizeEmailKey } from "./storage/identity.js";
 import { buildPinnedUnavailableErrorBody, buildTokenInvalidationBody, extractErrorCodeFromBody, isTokenInvalidationError, normalizeExhaustionStatus, parseRetryAfterBodyMs, parseRetryAfterHeaderMs, } from "./request/rate-limit-decision.js";
 import { forwardStreamingResponse, HOP_BY_HOP_HEADERS, readErrorBody, responseHeadersForClient, withTimeout, } from "./request/stream-failover-runtime.js";
+import { getAccountRecoveryBoundsForFamily } from "./runtime/account-status.js";
 import { chooseAccount } from "./runtime/rotation-account-selection.js";
 import { createRotationProxyState, recoverStaleRuntimeState, } from "./runtime/rotation-proxy-state.js";
 import { readStorageMetaFromDisk } from "./runtime/rotation-storage-meta.js";
@@ -62,6 +63,18 @@ function toUrlHost(host) {
 // failures surfaced only as a last-write-wins status.lastError string. Logs are
 // level-gated and carry the per-request correlation id set in handleRequest.
 const proxyLog = createLogger("runtime-proxy");
+/**
+ * Pinned skip reasons that no timer clears: the account stays unselectable
+ * after any concurrent rate-limit record or cooldown expires, so the pinned
+ * 503 must not advertise that record's expiry as a recovery time.
+ */
+const PINNED_PERMANENT_SKIP_REASONS = new Set([
+    "missing",
+    "disabled",
+    "workspace-disabled",
+    "policy-blocked",
+    AUTH_INVALIDATION_MARKER,
+]);
 const DEFAULT_QUOTA_REMAINING_THRESHOLD = 10;
 /** @internal Stable identity key for in-memory quota snapshots across reloads. */
 export function buildQuotaScheduleKey(account, family, model) {
@@ -1170,7 +1183,82 @@ async function handleRequestInner(state, req, res, traceId) {
         // null reason indicates a forecast/runtime state desync (the pinned
         // account was selected but no skip reason was recorded) — see #486.
         if (isPinned) {
-            const errorBody = buildPinnedUnavailableErrorBody(pinnedIndex, accountSkipReasons);
+            const pinnedAccount = typeof pinnedIndex === "number"
+                ? accountManager.getAccountByIndex(pinnedIndex)
+                : null;
+            const pinnedSkipReason = typeof pinnedIndex === "number"
+                ? accountSkipReasons.get(pinnedIndex) ?? null
+                : null;
+            // A permanent blocker (disabled, no enabled workspace, invalidated
+            // auth, policy block, out-of-range pin) outlives every timed record,
+            // so advertising a record's expiry would invite a retry into another
+            // 503.
+            //
+            // The recorded reason alone is not enough to detect one. It is the
+            // SELECTION verdict, and this request can make the pin permanently
+            // unselectable after selection already ran: a workspace-disabled
+            // 402/403 calls setAccountEnabled(index, false) above and then
+            // continues, so the next pass records "already-attempted" and the
+            // disable never surfaces. With a breaker tripped by the same failure
+            // the 503 would then advertise the circuit's ~30s reset for an
+            // account no timer will ever re-admit. Re-read the pin's CURRENT
+            // runtime state so a permanent blocker cannot hide behind the
+            // verdict; the recorded reason still covers the selection-only
+            // verdicts ("missing", "policy-blocked") that state cannot express.
+            const pinnedCurrentSkipReason = pinnedAccount === null
+                ? null
+                : accountManager.getManagedAccountRuntimeSkipReason(pinnedAccount, context.family, context.model);
+            const pinnedBlockedPermanently = (pinnedSkipReason !== null &&
+                PINNED_PERMANENT_SKIP_REASONS.has(pinnedSkipReason)) ||
+                (pinnedCurrentSkipReason !== null &&
+                    PINNED_PERMANENT_SKIP_REASONS.has(pinnedCurrentSkipReason));
+            // Otherwise recovery comes from the pinned account's persisted state, not the
+            // recorded skip reason: a direct 429/cooldown on the pinned account
+            // reaches this 503 as "already-attempted" (the retry loop's selection
+            // verdict) while the record it just wrote is what actually bounds
+            // recovery — and with several overlapping records the account stays
+            // skipped until the LAST one expires, so the latest bound is the one
+            // worth advertising.
+            //
+            // One clock for the whole body. The recovery bound and the
+            // rate-limit bound are compared against each other below, so
+            // reading state.now() per lookup would let a record expire between
+            // them and report a rate-limited pin as bounded by something else.
+            const evaluatedAtMs = state.now();
+            // Both bounds come from a single pass over the account's records.
+            const pinnedRecoveryBounds = pinnedAccount === null
+                ? null
+                : getAccountRecoveryBoundsForFamily(pinnedAccount, evaluatedAtMs, context.family, context.model);
+            const pinnedStateRecoveryAtMs = pinnedRecoveryBounds?.recoveryAtMs ?? null;
+            // An open circuit outlives the short failure cooldowns that tripped
+            // it; its deadline lives in the breaker, not the account record.
+            const pinnedCircuitRecoveryAtMs = pinnedAccount === null
+                ? null
+                : accountManager.getCircuitRecoveryTime(pinnedAccount, evaluatedAtMs);
+            const pinnedResetAtMs = pinnedBlockedPermanently ||
+                (pinnedStateRecoveryAtMs === null && pinnedCircuitRecoveryAtMs === null)
+                ? null
+                : Math.max(pinnedStateRecoveryAtMs ?? 0, pinnedCircuitRecoveryAtMs ?? 0);
+            // The message only words the recovery deadline as a rate-limit reset
+            // when the rate-limit records are in fact what supplies it — a
+            // breaker or cooldown can end later and then bounds it instead.
+            const pinnedRateLimitResetAtMs = pinnedRecoveryBounds?.rateLimitAtMs ?? null;
+            const recoveryBound = pinnedResetAtMs !== null &&
+                pinnedRateLimitResetAtMs !== null &&
+                pinnedRateLimitResetAtMs >= pinnedResetAtMs
+                ? "rate-limit"
+                : "other";
+            const errorBody = buildPinnedUnavailableErrorBody(pinnedIndex, accountSkipReasons, {
+                // typeof check so a forced index of 0 still reads as forced.
+                pinSource: typeof state.forcedAccountIndex === "number" ? "forced" : "manual",
+                resetAtMs: pinnedResetAtMs,
+                recoveryBound,
+                // The recorded verdict above is the retry loop's
+                // "already-attempted" on the dominant path; the re-read runtime
+                // state is what the operator-facing sentence should describe.
+                currentSkipReason: pinnedCurrentSkipReason,
+                now: evaluatedAtMs,
+            });
             if (errorBody.reason === null) {
                 state.status.lastError = `pinned-503 missing skip reason (pinnedIndex=${pinnedIndex})`;
             }

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "codex-multi-auth",
-	"version": "2.8.5",
+	"version": "2.8.7",
 	"description": "Codex CLI multi-account OAuth manager with account switching, health checks, runtime rotation, diagnostics, and recovery tools for @openai/codex",
 	"main": "./dist/index.js",
 	"types": "./dist/index.d.ts",