codex-multi-auth 2.8.6 → 2.9.0

package/dist/lib/usage/stream-usage-deferral.js

@@ -0,0 +1,54 @@
+/**
+ * Holds a usage-ledger row open until a streaming response reports its tokens.
+ *
+ * A streaming request's row would otherwise be written when the request handler
+ * returns its Response — before the client has read a byte, and therefore
+ * before the upstream `usage` event exists. The ledger is append-only, so that
+ * row could never be corrected: it would stand at zero tokens and zero cost
+ * forever, which is what silently disables the `maxTokens` and `maxCostUsd`
+ * budget caps (`evaluateBudgetGuard` compares `0 >= limit`).
+ *
+ * The fallback timer is not optional bookkeeping. A client that disconnects
+ * mid-stream, or an upstream that never emits a terminal usage event, must
+ * still cost one row, because `maxRequests` counts rows — losing it would
+ * weaken a cap that currently works.
+ *
+ * Generic over the row type so this stays inside `lib/usage` rather than
+ * importing the policy layer that imports it back.
+ */
+export function createStreamUsageDeferral(options) {
+    const schedule = options.schedule ??
+        ((run, ms) => {
+            const timer = setTimeout(run, ms);
+            // Never hold the process open for a row that is only a fallback.
+            timer.unref?.();
+            return { cancel: () => clearTimeout(timer) };
+        });
+    let captured = null;
+    let pending = null;
+    let timer = null;
+    const flush = (usage) => {
+        const completion = pending;
+        pending = null;
+        timer?.cancel();
+        timer = null;
+        if (!completion)
+            return;
+        options.record(usage ? { ...completion, ...usage } : completion);
+    };
+    return {
+        captured: () => captured,
+        onUsage: (usage) => {
+            captured = usage;
+            flush(usage);
+        },
+        defer: (completion) => {
+            // A second defer would orphan the first row's timer, so keep the row
+            // already in flight and let it settle on its own terms.
+            if (pending)
+                return;
+            pending = completion;
+            timer = schedule(() => flush(null), options.fallbackMs);
+        },
+    };
+}

package/dist/lib/usage/usage-extraction.d.ts

@@ -0,0 +1,42 @@
+import type { UsageTokenCounts } from "./types.js";
+/**
+ * Read an OpenAI Responses `usage` object into the ledger's token shape.
+ *
+ * Two containment rules drive the mapping, and getting either backwards
+ * mis-prices every row:
+ *
+ * - `input_tokens_details.cached_tokens` is a SUBSET of `input_tokens`, and
+ *   `estimateUsageCostUsd` already subtracts it (`billableInputTokens`), so
+ *   both are passed through raw.
+ * - `output_tokens_details.reasoning_tokens` is likewise a SUBSET of
+ *   `output_tokens`, but `estimateUsageCostUsd` prices `outputTokens` and
+ *   `reasoningTokens` as DISJOINT buckets and sums them. Passing the raw
+ *   `output_tokens` alongside the reasoning count would bill reasoning twice,
+ *   so the reasoning share is subtracted out here.
+ */
+export declare function extractUsageTokenCounts(usage: unknown): UsageTokenCounts | null;
+/**
+ * Pull the `usage` object out of a Responses payload, whether it arrived as a
+ * bare response object (non-streaming) or wrapped in a stream event envelope.
+ */
+export declare function extractResponsesUsage(payload: unknown): UsageTokenCounts | null;
+export interface UsageStreamScanner {
+    /** Feed one forwarded chunk. Never throws. */
+    push: (chunk: Uint8Array) => void;
+    /** Flush any trailing partial data and return the final counts, if any. */
+    result: () => UsageTokenCounts | null;
+}
+/**
+ * Observe a forwarded response body and recover its token counts.
+ *
+ * SSE bodies are scanned line by line so only the current partial line is
+ * retained; a full response can be gigabytes of deltas and must never be
+ * buffered. Non-SSE JSON bodies have no incremental structure to exploit, so
+ * they are accumulated up to `MAX_BUFFERED_BYTES` and parsed at the end —
+ * beyond that cap the scanner gives up on usage rather than grow without
+ * bound.
+ */
+export declare function createUsageStreamScanner(options: {
+    contentType?: string | null;
+}): UsageStreamScanner;
+//# sourceMappingURL=usage-extraction.d.ts.map

package/dist/lib/usage/usage-extraction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"usage-extraction.d.ts","sourceRoot":"","sources":["../../../lib/usage/usage-extraction.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AA+BnD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CACtC,KAAK,EAAE,OAAO,GACZ,gBAAgB,GAAG,IAAI,CA+BzB;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,gBAAgB,GAAG,IAAI,CAQ/E;AAED,MAAM,WAAW,kBAAkB;IAClC,8CAA8C;IAC9C,IAAI,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC;IAClC,2EAA2E;IAC3E,MAAM,EAAE,MAAM,gBAAgB,GAAG,IAAI,CAAC;CACtC;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE;IACjD,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B,GAAG,kBAAkB,CA6ErB"}

package/dist/lib/usage/usage-extraction.js

@@ -0,0 +1,178 @@
+/**
+ * Extracting token counts from upstream Responses API traffic.
+ *
+ * Without this the usage ledger records every request with all-zero tokens and
+ * a zero cost, which silently disables the `maxTokens` / `maxCostUsd` budget
+ * caps: `evaluateBudgetGuard` compares `0 >= limit`, which never fires, so
+ * `codex-multi-auth budget set --cost 50` allows unlimited spend and only
+ * `--requests` actually enforces anything.
+ */
+/** Cap on retained bytes so a hostile or unterminated body cannot grow forever. */
+const MAX_BUFFERED_BYTES = 1_048_576;
+/** Terminal Responses stream events that carry the final `usage` object. */
+const TERMINAL_EVENT_TYPES = new Set([
+    "response.completed",
+    "response.incomplete",
+    "response.failed",
+    "response.done",
+]);
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function nonNegativeInteger(value) {
+    if (typeof value !== "number" || !Number.isFinite(value))
+        return 0;
+    return Math.max(0, Math.trunc(value));
+}
+/**
+ * Read an OpenAI Responses `usage` object into the ledger's token shape.
+ *
+ * Two containment rules drive the mapping, and getting either backwards
+ * mis-prices every row:
+ *
+ * - `input_tokens_details.cached_tokens` is a SUBSET of `input_tokens`, and
+ *   `estimateUsageCostUsd` already subtracts it (`billableInputTokens`), so
+ *   both are passed through raw.
+ * - `output_tokens_details.reasoning_tokens` is likewise a SUBSET of
+ *   `output_tokens`, but `estimateUsageCostUsd` prices `outputTokens` and
+ *   `reasoningTokens` as DISJOINT buckets and sums them. Passing the raw
+ *   `output_tokens` alongside the reasoning count would bill reasoning twice,
+ *   so the reasoning share is subtracted out here.
+ */
+export function extractUsageTokenCounts(usage) {
+    if (!isRecord(usage))
+        return null;
+    const hasAnyCount = typeof usage.input_tokens === "number" ||
+        typeof usage.output_tokens === "number" ||
+        typeof usage.total_tokens === "number";
+    if (!hasAnyCount)
+        return null;
+    const inputTokens = nonNegativeInteger(usage.input_tokens);
+    const rawOutputTokens = nonNegativeInteger(usage.output_tokens);
+    const cachedInputTokens = isRecord(usage.input_tokens_details)
+        ? Math.min(inputTokens, nonNegativeInteger(usage.input_tokens_details.cached_tokens))
+        : 0;
+    const reasoningTokens = isRecord(usage.output_tokens_details)
+        ? Math.min(rawOutputTokens, nonNegativeInteger(usage.output_tokens_details.reasoning_tokens))
+        : 0;
+    const providedTotal = typeof usage.total_tokens === "number" && Number.isFinite(usage.total_tokens)
+        ? Math.max(0, Math.trunc(usage.total_tokens))
+        : inputTokens + rawOutputTokens;
+    return {
+        inputTokens,
+        outputTokens: rawOutputTokens - reasoningTokens,
+        cachedInputTokens,
+        reasoningTokens,
+        totalTokens: providedTotal,
+    };
+}
+/**
+ * Pull the `usage` object out of a Responses payload, whether it arrived as a
+ * bare response object (non-streaming) or wrapped in a stream event envelope.
+ */
+export function extractResponsesUsage(payload) {
+    if (!isRecord(payload))
+        return null;
+    const direct = extractUsageTokenCounts(payload.usage);
+    if (direct)
+        return direct;
+    if (isRecord(payload.response)) {
+        return extractUsageTokenCounts(payload.response.usage);
+    }
+    return null;
+}
+/**
+ * Observe a forwarded response body and recover its token counts.
+ *
+ * SSE bodies are scanned line by line so only the current partial line is
+ * retained; a full response can be gigabytes of deltas and must never be
+ * buffered. Non-SSE JSON bodies have no incremental structure to exploit, so
+ * they are accumulated up to `MAX_BUFFERED_BYTES` and parsed at the end —
+ * beyond that cap the scanner gives up on usage rather than grow without
+ * bound.
+ */
+export function createUsageStreamScanner(options) {
+    const sse = (options.contentType ?? "").toLowerCase().includes("text/event-stream");
+    const decoder = new TextDecoder("utf-8");
+    let pending = "";
+    let bufferedBytes = 0;
+    let overflowed = false;
+    let latest = null;
+    const consumeLine = (line) => {
+        const trimmed = line.trim();
+        if (!trimmed.startsWith("data:"))
+            return;
+        const payload = trimmed.slice("data:".length).trim();
+        if (payload.length === 0 || payload === "[DONE]")
+            return;
+        let parsed;
+        try {
+            parsed = JSON.parse(payload);
+        }
+        catch {
+            return;
+        }
+        // Prefer terminal events, which carry the authoritative totals, but fall
+        // back to any event that reports usage so a stream that ends on a
+        // non-standard terminal type still records something.
+        const type = isRecord(parsed) ? parsed.type : undefined;
+        const isTerminal = typeof type === "string" && TERMINAL_EVENT_TYPES.has(type);
+        const counts = extractResponsesUsage(parsed);
+        if (counts && (isTerminal || latest === null)) {
+            latest = counts;
+        }
+    };
+    return {
+        push: (chunk) => {
+            try {
+                if (overflowed || chunk.byteLength === 0)
+                    return;
+                bufferedBytes += chunk.byteLength;
+                pending += decoder.decode(chunk, { stream: true });
+                if (!sse) {
+                    if (bufferedBytes > MAX_BUFFERED_BYTES) {
+                        overflowed = true;
+                        pending = "";
+                    }
+                    return;
+                }
+                let newlineAt = pending.indexOf("\n");
+                while (newlineAt !== -1) {
+                    consumeLine(pending.slice(0, newlineAt));
+                    pending = pending.slice(newlineAt + 1);
+                    newlineAt = pending.indexOf("\n");
+                }
+                // A single unterminated line this long is not SSE any more; stop
+                // retaining it rather than growing the buffer for the whole body.
+                if (pending.length > MAX_BUFFERED_BYTES) {
+                    overflowed = true;
+                    pending = "";
+                }
+            }
+            catch {
+                // Usage accounting must never break the forwarded response.
+            }
+        },
+        result: () => {
+            try {
+                if (overflowed)
+                    return latest;
+                pending += decoder.decode();
+                if (sse) {
+                    if (pending.length > 0)
+                        consumeLine(pending);
+                    pending = "";
+                    return latest;
+                }
+                if (pending.trim().length === 0)
+                    return latest;
+                const parsed = JSON.parse(pending);
+                pending = "";
+                return extractResponsesUsage(parsed) ?? latest;
+            }
+            catch {
+                return latest;
+            }
+        },
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "codex-multi-auth",
-	"version": "2.8.6",
+	"version": "2.9.0",
 	"description": "Codex CLI multi-account OAuth manager with account switching, health checks, runtime rotation, diagnostics, and recovery tools for @openai/codex",
 	"main": "./dist/index.js",
 	"types": "./dist/index.d.ts",