codex-multi-auth 2.8.7 → 2.9.0

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-multi-auth",
-	"version": "2.8.7",
+	"version": "2.9.0",
   "description": "Install and operate codex-multi-auth for the official @openai/codex CLI with multi-account OAuth rotation, switching, health checks, and recovery tools.",
   "interface": {
     "composerIcon": "./assets/codex-multi-auth-icon.svg"

package/README.md

@@ -392,7 +392,7 @@ codex-multi-auth doctor --json
 
 ## Release Notes
 
-- Current stable: [docs/releases/v2.8.7.md](docs/releases/v2.8.7.md) — install via `npm i -g codex-multi-auth`
+- Current stable: [docs/releases/v2.9.0.md](docs/releases/v2.9.0.md) — install via `npm i -g codex-multi-auth`
 - Previous stable: [docs/releases/v2.8.3.md](docs/releases/v2.8.3.md)
 - Previous stable: [docs/releases/v2.8.2.md](docs/releases/v2.8.2.md)
 - Previous stable: [docs/releases/v2.7.1.md](docs/releases/v2.7.1.md)

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAe,MAAM,kBAAkB,CAAC;AA2V5D;;;;;;;;;;;;;;;GAeG;AAEH,eAAO,MAAM,iBAAiB,EAAE,MA2uI/B,CAAC;AAEF,eAAO,MAAM,gBAAgB,KAAoB,CAAC;AAElD,eAAe,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAe,MAAM,kBAAkB,CAAC;AAoW5D;;;;;;;;;;;;;;;GAeG;AAEH,eAAO,MAAM,iBAAiB,EAAE,MAuwI/B,CAAC;AAEF,eAAO,MAAM,gBAAgB,KAAoB,CAAC;AAElD,eAAe,iBAAiB,CAAC"}

package/dist/index.js

@@ -38,6 +38,14 @@ import { LiveAccountSync } from "./lib/live-account-sync.js";
 import { clearCorrelationId, initLogger, logDebug, logError, logInfo, logRequest, logWarn, setCorrelationId, } from "./lib/logger.js";
 import { PreemptiveQuotaScheduler, readQuotaSchedulerSnapshot, } from "./lib/preemptive-quota-scheduler.js";
 import { createRuntimeUsageRecorder, evaluateRuntimePolicy, loadRuntimePolicyState, } from "./lib/policy/runtime-policy.js";
+import { createStreamUsageDeferral } from "./lib/usage/stream-usage-deferral.js";
+/**
+ * How long a streaming request's usage-ledger row may wait for the upstream
+ * `usage` event before it is written without token counts. Long enough not to
+ * truncate a genuinely slow completion; the timer is unref'd so it never holds
+ * the process open. See createStreamUsageDeferral.
+ */
+const USAGE_STREAM_RECORD_FALLBACK_MS = 15 * 60_000;
 import { getModelFamily, MODEL_FAMILIES, prewarmCodexInstructions, } from "./lib/prompts/codex.js";
 import { prewarmHostCodexPrompt } from "./lib/prompts/host-codex-prompt.js";
 import { fetchCodexQuotaSnapshot, formatQuotaSnapshotLine, } from "./lib/quota-probe.js";
@@ -546,6 +554,18 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                         async fetch(input, init) {
                             let usageRecorder = null;
                             let usageCompletion = null;
+                            // A non-streaming response reports its token counts while
+                            // handleSuccessResponse is still assembling the body, so they
+                            // are folded straight into usageCompletion below. A streaming
+                            // one reports them only as the client drains the body, long
+                            // after the `finally` that writes the row — so that row is
+                            // handed to the deferral instead of written empty.
+                            const usageDeferral = createStreamUsageDeferral({
+                                record: (completion) => {
+                                    void usageRecorder?.record(completion);
+                                },
+                                fallbackMs: USAGE_STREAM_RECORD_FALLBACK_MS,
+                            });
                             try {
                                 if (cachedAccountManager &&
                                     cachedAccountManager !== accountManager) {
@@ -1594,6 +1614,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                                     sessionAffinityStore?.updateLastResponseId(sessionAffinityKey, responseId, Date.now(), sessionAffinityVersion);
                                                     storedResponseIdForSuccess = true;
                                                 },
+                                                onUsage: usageDeferral.onUsage,
                                                 streamStallTimeoutMs,
                                             });
                                             if (!isStreaming && emptyResponseMaxRetries > 0) {
@@ -1679,7 +1700,20 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                                     accountId: successAccountForResponse.accountId ?? null,
                                                     email: successAccountForResponse.email ?? null,
                                                 },
+                                                // Already known for a non-streaming response, which
+                                                // reported its usage while the body was being
+                                                // assembled above.
+                                                ...(usageDeferral.captured() ?? {}),
                                             };
+                                            if (isStreaming && !usageDeferral.captured()) {
+                                                // Writing the row in the `finally` below would stamp
+                                                // zero tokens — the client has not read a byte yet —
+                                                // and the ledger is append-only, so the real counts
+                                                // could never correct it. Zero tokens is exactly what
+                                                // left maxTokens / maxCostUsd unenforceable here.
+                                                usageDeferral.defer(usageCompletion);
+                                                usageCompletion = null;
+                                            }
                                             if (lastCodexCliActiveSyncIndex !==
                                                 successAccountForResponse.index) {
                                                 void accountManager.syncCodexCliActiveSelectionForIndex(successAccountForResponse.index);

package/dist/lib/account-policy.d.ts

@@ -13,7 +13,9 @@ export interface AccountPolicyStore {
     accounts: Record<string, AccountPolicy>;
 }
 export declare function getAccountPolicyPath(): string;
-export declare function getAccountPolicyKey(account: Pick<AccountMetadataV3, "accountId" | "email">, _index?: number): string;
+export declare function getAccountPolicyKey(account: Pick<AccountMetadataV3, "accountId" | "email"> & {
+    refreshToken?: string | null;
+}, _index?: number): string;
 export declare function loadAccountPolicyStore(): Promise<AccountPolicyStore>;
 export declare function saveAccountPolicyStore(store: AccountPolicyStore): Promise<void>;
 export declare function upsertAccountPolicy(store: AccountPolicyStore, accountKey: string, mutate: (policy: AccountPolicy) => void, now?: number): AccountPolicy;

package/dist/lib/account-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account-policy.d.ts","sourceRoot":"","sources":["../../lib/account-policy.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAItD,MAAM,WAAW,aAAa;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IAClC,OAAO,EAAE,CAAC,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;CACxC;AAkFD,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAED,wBAAgB,mBAAmB,CAClC,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,WAAW,GAAG,OAAO,CAAC,EACvD,MAAM,CAAC,EAAE,MAAM,GACb,MAAM,CAMR;AAED,wBAAsB,sBAAsB,IAAI,OAAO,CAAC,kBAAkB,CAAC,CAa1E;AAED,wBAAsB,sBAAsB,CAC3C,KAAK,EAAE,kBAAkB,GACvB,OAAO,CAAC,IAAI,CAAC,CAsCf;AAED,wBAAgB,mBAAmB,CAClC,KAAK,EAAE,kBAAkB,EACzB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,IAAI,EACvC,GAAG,SAAa,GACd,aAAa,CAgBf;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAEtE;AAED,wBAAgB,oCAAoC,IAAI,IAAI,CAE3D"}
+{"version":3,"file":"account-policy.d.ts","sourceRoot":"","sources":["../../lib/account-policy.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAItD,MAAM,WAAW,aAAa;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IAClC,OAAO,EAAE,CAAC,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;CACxC;AAkFD,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAED,wBAAgB,mBAAmB,CAClC,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,WAAW,GAAG,OAAO,CAAC,GAAG;IACzD,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B,EACD,MAAM,CAAC,EAAE,MAAM,GACb,MAAM,CAmBR;AAED,wBAAsB,sBAAsB,IAAI,OAAO,CAAC,kBAAkB,CAAC,CAa1E;AAED,wBAAsB,sBAAsB,CAC3C,KAAK,EAAE,kBAAkB,GACvB,OAAO,CAAC,IAAI,CAAC,CAsCf;AAED,wBAAgB,mBAAmB,CAClC,KAAK,EAAE,kBAAkB,EACzB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,IAAI,EACvC,GAAG,SAAa,GACd,aAAa,CAgBf;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAEtE;AAED,wBAAgB,oCAAoC,IAAI,IAAI,CAE3D"}

package/dist/lib/account-policy.js

@@ -81,9 +81,22 @@ export function getAccountPolicyPath() {
     return join(getCodexMultiAuthDir(), ACCOUNT_POLICY_FILE_NAME);
 }
 export function getAccountPolicyKey(account, _index) {
+    // The key must be stable across processes and independent of the account's
+    // slot (policy state is persisted and survives reordering), so it is derived
+    // from identity, never from `_index`.
+    //
+    // An account whose accountId AND email are both missing — freshly imported,
+    // or not yet hydrated from its token — used to hash the literal "unknown",
+    // which gave EVERY such account the same key: pausing, draining or tagging
+    // one silently applied to all of them. Fall back to the refresh token
+    // instead, which every account has and no two accounts share. It is
+    // namespaced before hashing so a token value can never collide with an
+    // email or accountId of the same text, and only its digest is persisted.
+    // Mirrors getAccountIdentityKey's `allowRefreshFallback`.
+    const refreshFallback = account.refreshToken?.trim();
     const identity = account.accountId?.trim() ||
         account.email?.trim().toLowerCase() ||
-        "unknown";
+        (refreshFallback ? `refresh:${refreshFallback}` : "unknown");
     return `sha256:${createHash("sha256").update(identity).digest("hex")}`;
 }
 export async function loadAccountPolicyStore() {

package/dist/lib/codex-manager/login-flow.js

@@ -290,6 +290,13 @@ async function runAuthLoginFlow(loginOptions, deps) {
                             parsed: targetIndex + 1,
                             switchReason: "restore",
                             preserveActiveIndexByFamily: true,
+                            // A restore replaces the whole account list, so every
+                            // index moves. Session affinity remembers accounts BY
+                            // INDEX, so without this a live proxy keeps routing
+                            // in-flight sessions to whatever now occupies the old
+                            // slot. `switch`/`best` already bump for a single
+                            // move; a restore moves everything. See issue #474.
+                            bumpAffinityGeneration: true,
                         });
                         console.log(UI_COPY.oauth.restoreBackupLoaded(selectedBackup.fileName, restoredStorage.accounts.length));
                         if (!synced) {

package/dist/lib/codex-manager/login-menu-actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login-menu-actions.d.ts","sourceRoot":"","sources":["../../../lib/codex-manager/login-menu-actions.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAEjD,OAAO,EAEN,KAAK,gBAAgB,EAIrB,KAAK,kBAAkB,EAGvB,MAAM,eAAe,CAAC;AASvB,OAAO,EACN,KAAK,eAAe,EAKpB,MAAM,kBAAkB,CAAC;AAG1B;;;;;GAKG;AAEH,gBAAgB;AAChB,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;AAE7D,gBAAgB;AAChB,wBAAsB,qBAAqB,CAC1C,YAAY,EAAE,kBAAkB,GAAG,IAAI,EACvC,sBAAsB,GAAE,MAAM,GAAG,IAAW,GAC1C,OAAO,CAAC,eAAe,CAAC,CA6D1B;AAED,gBAAgB;AAChB,wBAAsB,uBAAuB,CAC5C,YAAY,EAAE,kBAAkB,GAC9B,OAAO,CAAC,iBAAiB,CAAC,CA0C5B;AAED,gBAAgB;AAChB,wBAAsB,2BAA2B,CAChD,OAAO,EAAE,kBAAkB,EAAE,GAC3B,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAkCpC;AA8GD,gBAAgB;AAChB,wBAAsB,kBAAkB,CACvC,OAAO,EAAE,gBAAgB,EACzB,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,eAAe,CAAC,CAAC,GACrD,OAAO,CAAC,IAAI,CAAC,CA0Hf"}
+{"version":3,"file":"login-menu-actions.d.ts","sourceRoot":"","sources":["../../../lib/codex-manager/login-menu-actions.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAEjD,OAAO,EAEN,KAAK,gBAAgB,EAKrB,KAAK,kBAAkB,EAGvB,MAAM,eAAe,CAAC;AASvB,OAAO,EACN,KAAK,eAAe,EAKpB,MAAM,kBAAkB,CAAC;AAG1B;;;;;GAKG;AAEH,gBAAgB;AAChB,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;AAE7D,gBAAgB;AAChB,wBAAsB,qBAAqB,CAC1C,YAAY,EAAE,kBAAkB,GAAG,IAAI,EACvC,sBAAsB,GAAE,MAAM,GAAG,IAAW,GAC1C,OAAO,CAAC,eAAe,CAAC,CA6D1B;AAED,gBAAgB;AAChB,wBAAsB,uBAAuB,CAC5C,YAAY,EAAE,kBAAkB,GAC9B,OAAO,CAAC,iBAAiB,CAAC,CA0C5B;AAED,gBAAgB;AAChB,wBAAsB,2BAA2B,CAChD,OAAO,EAAE,kBAAkB,EAAE,GAC3B,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAkCpC;AA8GD,gBAAgB;AAChB,wBAAsB,kBAAkB,CACvC,OAAO,EAAE,gBAAgB,EACzB,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,eAAe,CAAC,CAAC,GACrD,OAAO,CAAC,IAAI,CAAC,CAgIf"}

package/dist/lib/codex-manager/login-menu-actions.js

@@ -1,7 +1,7 @@
 import { stdin as input, stdout as output } from "node:process";
 import { sanitizeEmail } from "../accounts.js";
 import { MODEL_FAMILIES } from "../prompts/codex.js";
-import { findMatchingAccountIndex, loadAccounts, reconcilePinnedAccountIndex, setStoragePath, withAccountStorageTransaction, } from "../storage.js";
+import { bumpStorageAffinityGeneration, findMatchingAccountIndex, loadAccounts, reconcilePinnedAccountIndex, setStoragePath, withAccountStorageTransaction, } from "../storage.js";
 import { UI_COPY } from "../ui/ui-copy.js";
 import { getUiRuntimeOptions } from "../ui/runtime.js";
 import { select } from "../ui/select.js";
@@ -249,6 +249,12 @@ export async function handleManageAction(storage, menuResult) {
                 nextStorage.accounts.splice(nextIndex, 1);
                 resetManageActionSelection(nextStorage, nextIndex);
                 nextStorage.pinnedAccountIndex = reconcilePinnedAccountIndex(pinnedAccount, nextStorage.accounts);
+                // The splice shifts every index above the removed slot, and session
+                // affinity remembers accounts BY INDEX. Without a generation bump a
+                // live proxy keeps routing in-flight sessions to the account that
+                // slid into the old slot. Reconciling the pin is not enough — the
+                // affinity map is separate state. See issue #474.
+                bumpStorageAffinityGeneration(nextStorage);
                 await persist(nextStorage);
                 replaceManageActionStorage(storage, nextStorage);
                 deleted = true;

package/dist/lib/policy/runtime-policy.d.ts

@@ -7,6 +7,13 @@ export interface RuntimePolicyAccount {
     index: number;
     accountId?: string | null;
     email?: string | null;
+    /**
+     * Only used to key account policy for an account with no accountId and no
+     * email. Without it the runtime would key such an account as "unknown"
+     * while the CLI keys it by refresh-token digest, and pause/drain/tag state
+     * written by one would be invisible to the other.
+     */
+    refreshToken?: string | null;
 }
 export interface RuntimePolicyDecision {
     allowed: boolean;

package/dist/lib/policy/runtime-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-policy.d.ts","sourceRoot":"","sources":["../../../lib/policy/runtime-policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAErE,OAAO,EAGN,KAAK,kBAAkB,EACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAKN,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAEN,KAAK,4BAA4B,EACjC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACN,oBAAoB,EAGpB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,WAAW,oBAAoB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,qBAAqB;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,qBAAqB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACnC,qBAAqB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/C,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,iBAAiB,EAAE,qBAAqB,EAAE,CAAC;CAC3C;AAED,MAAM,WAAW,kBAAkB;IAClC,eAAe,EAAE,kBAAkB,CAAC;IACpC,OAAO,EAAE,gBAAgB,CAAC;IAC1B,OAAO,EAAE,4BAA4B,CAAC;CACtC;AAED,MAAM,WAAW,oBAAoB;IACpC,MAAM,EAAE,CAAC,KAAK,EAAE,uBAAuB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,WAAW,EAAE,MAAM,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,uBAAuB;IACvC,OAAO,EAAE,kBAAkB,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,OAAO,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACtC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,wBAAsB,sBAAsB,CAC3C,QAAQ,SAAgB,GACtB,OAAO,CAAC,kBAAkB,CAAC,CAO7B;AA6DD,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IAClD,KAAK,EAAE,kBAAkB,CAAC;IAC1B,QAAQ,EAAE,oBAAoB,EAAE,CAAC;IACjC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,gBAAgB,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAChD,GAAG,CAAC,EAAE,MAAM,CAAC;CACb,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA4GjC;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAAE;IACjD,MAAM,EAAE,iBAAiB,CAAC;IAC1B,SAAS,EAAE,oBAAoB,CAAC;IAChC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,oBAAoB,CAAC;CACrC,GAAG,oBAAoB,CAgCvB"}
+{"version":3,"file":"runtime-policy.d.ts","sourceRoot":"","sources":["../../../lib/policy/runtime-policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAErE,OAAO,EAGN,KAAK,kBAAkB,EACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAKN,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAEN,KAAK,4BAA4B,EACjC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACN,oBAAoB,EAGpB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,WAAW,oBAAoB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,qBAAqB;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,qBAAqB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACnC,qBAAqB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/C,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,iBAAiB,EAAE,qBAAqB,EAAE,CAAC;CAC3C;AAED,MAAM,WAAW,kBAAkB;IAClC,eAAe,EAAE,kBAAkB,CAAC;IACpC,OAAO,EAAE,gBAAgB,CAAC;IAC1B,OAAO,EAAE,4BAA4B,CAAC;CACtC;AAED,MAAM,WAAW,oBAAoB;IACpC,MAAM,EAAE,CAAC,KAAK,EAAE,uBAAuB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,WAAW,EAAE,MAAM,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,uBAAuB;IACvC,OAAO,EAAE,kBAAkB,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,OAAO,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACtC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,wBAAsB,sBAAsB,CAC3C,QAAQ,SAAgB,GACtB,OAAO,CAAC,kBAAkB,CAAC,CAO7B;AA6DD,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IAClD,KAAK,EAAE,kBAAkB,CAAC;IAC1B,QAAQ,EAAE,oBAAoB,EAAE,CAAC;IACjC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,gBAAgB,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAChD,GAAG,CAAC,EAAE,MAAM,CAAC;CACb,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA6GjC;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAAE;IACjD,MAAM,EAAE,iBAAiB,CAAC;IAC1B,SAAS,EAAE,oBAAoB,CAAC;IAChC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,oBAAoB,CAAC;CACrC,GAAG,oBAAoB,CAgCvB"}

package/dist/lib/policy/runtime-policy.js

@@ -98,6 +98,7 @@ export async function evaluateRuntimePolicy(input) {
         const accountKey = getAccountPolicyKey({
             accountId: account.accountId ?? undefined,
             email: account.email ?? undefined,
+            refreshToken: account.refreshToken ?? undefined,
         }, account.index);
         const accountPolicy = input.state.accountPolicies.accounts[accountKey];
         let boost = 0;

package/dist/lib/request/fetch-helpers.d.ts

@@ -4,6 +4,7 @@
  */
 import { type FastSessionInputTrimPlan } from "./request-transformer.js";
 import type { UserConfig, RequestBody } from "../types.js";
+import type { UsageTokenCounts } from "../usage/types.js";
 export { shouldRefreshToken, refreshAndUpdateToken } from "./token-refresh.js";
 export { DEFAULT_UNSUPPORTED_CODEX_FALLBACK_CHAIN, extractUnsupportedCodexModelFromText, getUnsupportedCodexModelInfo, resolveUnsupportedCodexFallbackModel, shouldFallbackToGpt52OnUnsupportedGpt53, isEntitlementError, isWorkspaceDisabledError, createEntitlementErrorResponse, } from "./error-classification.js";
 export type { EntitlementError, UnsupportedCodexModelInfo, ResolveUnsupportedCodexFallbackOptions, } from "./error-classification.js";
@@ -70,6 +71,12 @@ export declare function handleErrorResponse(response: Response, options?: ErrorH
  */
 export declare function handleSuccessResponse(response: Response, isStreaming: boolean, options?: {
     onResponseId?: (responseId: string) => void;
+    /**
+     * Reports the upstream token counts once they are known, for the usage
+     * ledger. Fires from the SSE tee on the streaming path and from the
+     * assembled response on the non-streaming path.
+     */
+    onUsage?: (usage: UsageTokenCounts) => void;
     streamStallTimeoutMs?: number;
 }): Promise<Response>;
 //# sourceMappingURL=fetch-helpers.d.ts.map

package/dist/lib/request/fetch-helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fetch-helpers.d.ts","sourceRoot":"","sources":["../../../lib/request/fetch-helpers.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,EAIN,KAAK,wBAAwB,EAC7B,MAAM,0BAA0B,CAAC;AAMlC,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAiB3D,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC/E,OAAO,EACN,wCAAwC,EACxC,oCAAoC,EACpC,4BAA4B,EAC5B,oCAAoC,EACpC,uCAAuC,EACvC,kBAAkB,EAClB,wBAAwB,EACxB,8BAA8B,GAC9B,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACX,gBAAgB,EAChB,yBAAyB,EACzB,sCAAsC,GACtC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACN,iBAAiB,EACjB,kBAAkB,EAClB,yBAAyB,EACzB,2BAA2B,EAC3B,wBAAwB,GACxB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,YAAY,EACX,yBAAyB,EACzB,wBAAwB,GACxB,MAAM,cAAc,CAAC;AAEtB,MAAM,WAAW,aAAa;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;CACrB;AASD,MAAM,WAAW,8BAA8B;IAC9C,IAAI,EAAE,WAAW,CAAC;IAClB,WAAW,EAAE,WAAW,CAAC;IACzB,4BAA4B,CAAC,EAAE,wBAAwB,CAAC,MAAM,CAAC,CAAC;CAChE;AAED,MAAM,WAAW,mBAAmB;IAC5B,QAAQ,EAAE,QAAQ,CAAC;IACnB,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,SAAS,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,oBAAoB;IACpC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,wBAAwB,CAC7C,IAAI,EAAE,WAAW,GAAG,SAAS,EAC7B,GAAG,EAAE,MAAM,EACX,UAAU,EAAE,UAAU,EACtB,SAAS,UAAO,EAChB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,OAAO,CAAC,EAAE;IACT,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,mBAAmB,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC1C,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,6BAA6B,CAAC,EAAE,OAAO,CAAC;IACxC,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACnC,GACC,OAAO,CAAC,8BAA8B,GAAG,SAAS,CAAC,CA4FrD;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CACjC,QAAQ,EAAE,QAAQ,EAClB,OAAO,CAAC,EAAE,oBAAoB,GACnC,OAAO,CAAC,mBAAmB,CAAC,CA4C9B;AAED;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACvC,QAAQ,EAAE,QAAQ,EAClB,WAAW,EAAE,OAAO,EACpB,OAAO,CAAC,EAAE;IACZ,YAAY,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5C,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC9B,GACC,OAAO,CAAC,QAAQ,CAAC,CAanB"}
+{"version":3,"file":"fetch-helpers.d.ts","sourceRoot":"","sources":["../../../lib/request/fetch-helpers.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,EAIN,KAAK,wBAAwB,EAC7B,MAAM,0BAA0B,CAAC;AAMlC,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAiB1D,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC/E,OAAO,EACN,wCAAwC,EACxC,oCAAoC,EACpC,4BAA4B,EAC5B,oCAAoC,EACpC,uCAAuC,EACvC,kBAAkB,EAClB,wBAAwB,EACxB,8BAA8B,GAC9B,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACX,gBAAgB,EAChB,yBAAyB,EACzB,sCAAsC,GACtC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACN,iBAAiB,EACjB,kBAAkB,EAClB,yBAAyB,EACzB,2BAA2B,EAC3B,wBAAwB,GACxB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,YAAY,EACX,yBAAyB,EACzB,wBAAwB,GACxB,MAAM,cAAc,CAAC;AAEtB,MAAM,WAAW,aAAa;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;CACrB;AASD,MAAM,WAAW,8BAA8B;IAC9C,IAAI,EAAE,WAAW,CAAC;IAClB,WAAW,EAAE,WAAW,CAAC;IACzB,4BAA4B,CAAC,EAAE,wBAAwB,CAAC,MAAM,CAAC,CAAC;CAChE;AAED,MAAM,WAAW,mBAAmB;IAC5B,QAAQ,EAAE,QAAQ,CAAC;IACnB,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,SAAS,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,oBAAoB;IACpC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,wBAAwB,CAC7C,IAAI,EAAE,WAAW,GAAG,SAAS,EAC7B,GAAG,EAAE,MAAM,EACX,UAAU,EAAE,UAAU,EACtB,SAAS,UAAO,EAChB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,OAAO,CAAC,EAAE;IACT,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,mBAAmB,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC1C,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,6BAA6B,CAAC,EAAE,OAAO,CAAC;IACxC,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACnC,GACC,OAAO,CAAC,8BAA8B,GAAG,SAAS,CAAC,CA4FrD;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CACjC,QAAQ,EAAE,QAAQ,EAClB,OAAO,CAAC,EAAE,oBAAoB,GACnC,OAAO,CAAC,mBAAmB,CAAC,CA4C9B;AAED;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACvC,QAAQ,EAAE,QAAQ,EAClB,WAAW,EAAE,OAAO,EACpB,OAAO,CAAC,EAAE;IACZ,YAAY,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5C;;;;OAIG;IACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,IAAI,CAAC;IAC5C,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC9B,GACC,OAAO,CAAC,QAAQ,CAAC,CAkBnB"}

package/dist/lib/request/fetch-helpers.js

@@ -155,7 +155,7 @@ export async function handleSuccessResponse(response, isStreaming, options) {
         return await convertSseToJson(response, responseHeaders, options);
     }
     // For streaming requests (streamText), return stream as-is
-    return attachResponseIdCapture(response, responseHeaders, options?.onResponseId);
+    return attachResponseIdCapture(response, responseHeaders, options?.onResponseId, options?.onUsage);
 }
 async function safeReadBody(response) {
     try {

package/dist/lib/request/response-handler.d.ts

@@ -1,3 +1,4 @@
+import type { UsageTokenCounts } from "../usage/types.js";
 /**
  * Convert SSE stream response to JSON for generateText()
  * @param response - Fetch response with SSE stream
@@ -6,6 +7,7 @@
  */
 export declare function convertSseToJson(response: Response, headers: Headers, options?: {
     onResponseId?: (responseId: string) => void;
+    onUsage?: (usage: UsageTokenCounts) => void;
     streamStallTimeoutMs?: number;
 }): Promise<Response>;
 /**
@@ -21,5 +23,5 @@ export declare function ensureContentType(headers: Headers): Headers;
  * @returns True if response should be considered empty/malformed
  */
 export declare function isEmptyResponse(body: unknown): boolean;
-export declare function attachResponseIdCapture(response: Response, headers: Headers, onResponseId?: (responseId: string) => void): Response;
+export declare function attachResponseIdCapture(response: Response, headers: Headers, onResponseId?: (responseId: string) => void, onUsage?: (usage: UsageTokenCounts) => void): Response;
 //# sourceMappingURL=response-handler.d.ts.map

package/dist/lib/request/response-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"response-handler.d.ts","sourceRoot":"","sources":["../../../lib/request/response-handler.ts"],"names":[],"mappings":"AAwwBA;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACrC,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE;IACT,YAAY,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5C,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC9B,GACC,OAAO,CAAC,QAAQ,CAAC,CA2HnB;AA6DD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAQ3D;AA2BD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CA4CtD;AAED,wBAAgB,uBAAuB,CACtC,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,YAAY,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,IAAI,GACzC,QAAQ,CAiBV"}
+{"version":3,"file":"response-handler.d.ts","sourceRoot":"","sources":["../../../lib/request/response-handler.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAqwB1D;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACrC,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE;IACT,YAAY,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5C,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,IAAI,CAAC;IAC5C,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC9B,GACC,OAAO,CAAC,QAAQ,CAAC,CAkInB;AAwED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAQ3D;AA2BD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CA4CtD;AAED,wBAAgB,uBAAuB,CACtC,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,YAAY,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,IAAI,EAC3C,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,IAAI,GACzC,QAAQ,CAiBV"}

package/dist/lib/request/response-handler.js

@@ -1,6 +1,7 @@
 import { createLogger, logRequest, LOGGING_ENABLED } from "../logger.js";
 import { HTTP_STATUS, PLUGIN_NAME } from "../constants.js";
 import { isRecord } from "../utils.js";
+import { extractResponsesUsage } from "../usage/usage-extraction.js";
 const log = createLogger("response-handler");
 const MAX_SSE_SIZE = 10 * 1024 * 1024; // 10MB limit to prevent memory exhaustion
 const DEFAULT_STREAM_STALL_TIMEOUT_MS = 45_000;
@@ -663,6 +664,15 @@ export async function convertSseToJson(response, headers, options) {
             });
         }
         logStreamDiagnostics(finalResponse);
+        if (options?.onUsage) {
+            // The non-streaming branch already holds the assembled response, so
+            // the token counts come straight off it. Reported even though the
+            // caller sees JSON rather than SSE: the usage ledger (and therefore
+            // the maxTokens / maxCostUsd budget caps) needs both shapes.
+            const usage = extractResponsesUsage(finalResponse);
+            if (usage)
+                options.onUsage(usage);
+        }
         // Return as plain JSON (not SSE)
         const jsonHeaders = new Headers(headers);
         jsonHeaders.set("content-type", "application/json; charset=utf-8");
@@ -685,7 +695,7 @@ export async function convertSseToJson(response, headers, options) {
         reader.releaseLock();
     }
 }
-function createResponseIdCapturingStream(body, onResponseId) {
+function createResponseIdCapturingStream(body, onResponseId, onUsage) {
     const decoder = new TextDecoder();
     let bufferedText = "";
     let loggedMalformedStreamChunk = false;
@@ -709,7 +719,18 @@ function createResponseIdCapturingStream(body, onResponseId) {
                 continue;
             try {
                 const data = JSON.parse(payload);
-                maybeCaptureResponseEvent(state, data, onResponseId);
+                if (onResponseId) {
+                    maybeCaptureResponseEvent(state, data, onResponseId);
+                }
+                if (onUsage) {
+                    // Reuse the JSON this loop already parsed rather than scanning
+                    // the stream twice. Without these counts every usage-ledger row
+                    // lands with zero tokens and zero cost, which silently disables
+                    // the maxTokens / maxCostUsd budget caps.
+                    const usage = extractResponsesUsage(data);
+                    if (usage)
+                        onUsage(usage);
+                }
                 if (state.encounteredError)
                     break;
             }
@@ -812,15 +833,15 @@ export function isEmptyResponse(body) {
     }
     return false;
 }
-export function attachResponseIdCapture(response, headers, onResponseId) {
-    if (!response.body || !onResponseId) {
+export function attachResponseIdCapture(response, headers, onResponseId, onUsage) {
+    if (!response.body || (!onResponseId && !onUsage)) {
         return new Response(response.body, {
             status: response.status,
             statusText: response.statusText,
             headers,
         });
     }
-    return new Response(createResponseIdCapturingStream(response.body, onResponseId), {
+    return new Response(createResponseIdCapturingStream(response.body, onResponseId, onUsage), {
         status: response.status,
         statusText: response.statusText,
         headers,

package/dist/lib/request/stream-failover-runtime.d.ts

@@ -4,5 +4,12 @@ export declare const HOP_BY_HOP_HEADERS: Set<string>;
 export declare function responseHeadersForClient(upstreamHeaders: Headers): Record<string, string>;
 export declare function withTimeout<T>(promise: Promise<T>, timeoutMs: number, onTimeout: () => void, message: string): Promise<T>;
 export declare function readErrorBody(response: Response, timeoutMs: number, maxBytes?: number): Promise<string>;
-export declare function forwardStreamingResponse(upstream: Response, res: ServerResponse, status: RuntimeRotationProxyStatus, onStreamError: () => void, streamStallTimeoutMs: number): Promise<boolean>;
+export declare function forwardStreamingResponse(upstream: Response, res: ServerResponse, status: RuntimeRotationProxyStatus, onStreamError: () => void, streamStallTimeoutMs: number, 
+/**
+ * Observe each forwarded chunk. Used to recover the upstream `usage` totals
+ * for the usage ledger without buffering the body; it must not mutate the
+ * chunk and is called before the write, so a slow observer delays the
+ * forward. Implementations are expected to swallow their own errors.
+ */
+onChunk?: (chunk: Uint8Array) => void): Promise<boolean>;
 //# sourceMappingURL=stream-failover-runtime.d.ts.map

package/dist/lib/request/stream-failover-runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stream-failover-runtime.d.ts","sourceRoot":"","sources":["../../../lib/request/stream-failover-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AAEtF,eAAO,MAAM,kBAAkB,aAW7B,CAAC;AAWH,wBAAgB,wBAAwB,CAAC,eAAe,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAUzF;AAED,wBAAsB,WAAW,CAAC,CAAC,EAClC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EACnB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,IAAI,EACrB,OAAO,EAAE,MAAM,GACb,OAAO,CAAC,CAAC,CAAC,CAmBZ;AAED,wBAAsB,aAAa,CAClC,QAAQ,EAAE,QAAQ,EAClB,SAAS,EAAE,MAAM,EACjB,QAAQ,SAAc,GACpB,OAAO,CAAC,MAAM,CAAC,CAuDjB;AAoBD,wBAAsB,wBAAwB,CAC7C,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,0BAA0B,EAClC,aAAa,EAAE,MAAM,IAAI,EACzB,oBAAoB,EAAE,MAAM,GAC1B,OAAO,CAAC,OAAO,CAAC,CAqDlB"}
+{"version":3,"file":"stream-failover-runtime.d.ts","sourceRoot":"","sources":["../../../lib/request/stream-failover-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AAEtF,eAAO,MAAM,kBAAkB,aAW7B,CAAC;AAWH,wBAAgB,wBAAwB,CAAC,eAAe,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAUzF;AAED,wBAAsB,WAAW,CAAC,CAAC,EAClC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EACnB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,IAAI,EACrB,OAAO,EAAE,MAAM,GACb,OAAO,CAAC,CAAC,CAAC,CAmBZ;AAED,wBAAsB,aAAa,CAClC,QAAQ,EAAE,QAAQ,EAClB,SAAS,EAAE,MAAM,EACjB,QAAQ,SAAc,GACpB,OAAO,CAAC,MAAM,CAAC,CAuDjB;AAoBD,wBAAsB,wBAAwB,CAC7C,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,0BAA0B,EAClC,aAAa,EAAE,MAAM,IAAI,EACzB,oBAAoB,EAAE,MAAM;AAC5B;;;;;GAKG;AACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,GACnC,OAAO,CAAC,OAAO,CAAC,CAsDlB"}

package/dist/lib/request/stream-failover-runtime.js

@@ -128,7 +128,14 @@ function waitForDrain(res) {
         res.once("error", settle);
     });
 }
-export async function forwardStreamingResponse(upstream, res, status, onStreamError, streamStallTimeoutMs) {
+export async function forwardStreamingResponse(upstream, res, status, onStreamError, streamStallTimeoutMs, 
+/**
+ * Observe each forwarded chunk. Used to recover the upstream `usage` totals
+ * for the usage ledger without buffering the body; it must not mutate the
+ * chunk and is called before the write, so a slow observer delays the
+ * forward. Implementations are expected to swallow their own errors.
+ */
+onChunk) {
     status.streamsStarted += 1;
     res.writeHead(upstream.status, responseHeadersForClient(upstream.headers));
     if (!upstream.body) {
@@ -149,6 +156,7 @@ export async function forwardStreamingResponse(upstream, res, status, onStreamEr
             if (done)
                 break;
             if (value && value.byteLength > 0) {
+                onChunk?.(value);
                 // If the response is already finished (clean end by a concurrent
                 // close-then-reader-cancel path), stop writing. Do NOT guard on
                 // res.destroyed here: a socket-error-during-backpressure scenario sets

package/dist/lib/request/stream-failover.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stream-failover.d.ts","sourceRoot":"","sources":["../../../lib/request/stream-failover.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,qBAAqB;IACrC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAkGD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CACpC,eAAe,EAAE,QAAQ,EACzB,mBAAmB,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,EACxF,OAAO,GAAE,qBAA0B,GACjC,QAAQ,CA4HV"}
+{"version":3,"file":"stream-failover.d.ts","sourceRoot":"","sources":["../../../lib/request/stream-failover.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,qBAAqB;IACrC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAkGD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CACpC,eAAe,EAAE,QAAQ,EACzB,mBAAmB,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,EACxF,OAAO,GAAE,qBAA0B,GACjC,QAAQ,CAuKV"}

package/dist/lib/request/stream-failover.js

@@ -117,6 +117,34 @@ export function withStreamingFailover(initialResponse, getFallbackResponse, opti
     }
     let closed = false;
     let releaseCurrentReaderForCancel = null;
+    // Backpressure. `pump()` runs from `start()` as a free-running loop, so
+    // without a demand signal it enqueues every chunk upstream delivers as fast
+    // as it arrives and the whole stream buffers in memory for a slow consumer.
+    // `pull()` (and cancellation) release the loop; the sibling forwarder in
+    // stream-failover-runtime.ts gets the same guarantee from waitForDrain.
+    let demandWaiter = null;
+    let demandPending = false;
+    const signalDemand = () => {
+        if (demandWaiter) {
+            demandWaiter();
+            return;
+        }
+        // `pull()` can fire before the loop parks. Latch it, or the next
+        // awaitDemand() would block on a signal that already happened.
+        demandPending = true;
+    };
+    const awaitDemand = () => {
+        if (demandPending || closed) {
+            demandPending = false;
+            return Promise.resolve();
+        }
+        return new Promise((resolve) => {
+            demandWaiter = () => {
+                demandWaiter = null;
+                resolve();
+            };
+        });
+    };
     const body = new ReadableStream({
         start(controller) {
             let currentReader = initialResponse.body?.getReader() ?? null;
@@ -174,6 +202,13 @@ export function withStreamingFailover(initialResponse, getFallbackResponse, opti
                         if (result.value && result.value.byteLength > 0) {
                             emittedBytes += result.value.byteLength;
                             controller.enqueue(result.value);
+                            // Park until the consumer asks for more. desiredSize is
+                            // null once the controller is errored or closed, and the
+                            // loop's own `closed` checks cover that case.
+                            if (typeof controller.desiredSize === "number" &&
+                                controller.desiredSize <= 0) {
+                                await awaitDemand();
+                            }
                         }
                     }
                     catch (error) {
@@ -206,8 +241,14 @@ export function withStreamingFailover(initialResponse, getFallbackResponse, opti
                 }
             });
         },
+        pull() {
+            signalDemand();
+        },
         cancel() {
             closed = true;
+            // Release a parked pump so it observes `closed` and unwinds instead
+            // of holding the upstream reader open for a demand that never comes.
+            signalDemand();
             if (releaseCurrentReaderForCancel) {
                 void releaseCurrentReaderForCancel();
             }

package/dist/lib/runtime/account-check.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account-check.d.ts","sourceRoot":"","sources":["../../../lib/runtime/account-check.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EACN,KAAK,gBAAgB,EACrB,KAAK,wBAAwB,EAE7B,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAE7D,wBAAsB,sBAAsB,CAC3C,SAAS,EAAE,OAAO,EAClB,IAAI,EAAE;IACL,aAAa,EAAE,CACd,OAAO,EAAE,gBAAgB,GAAG,IAAI,KAC5B,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACtC,YAAY,EAAE,MAAM,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACrD,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;IAC3C,mBAAmB,EAAE,MAAM,OAAO,CAAC;QAClC,OAAO,EAAE,CAAC,CAAC;QACX,QAAQ,EAAE,wBAAwB,EAAE,CAAC;KACrC,CAAC,CAAC;IACH,8BAA8B,EAAE,CAAC,cAAc,EAAE;QAChD,OAAO,EAAE,CAAC,CAAC;QACX,QAAQ,EAAE,wBAAwB,EAAE,CAAC;KACrC,KAAK,wBAAwB,CAAC;IAC/B,2BAA2B,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAChE;QACA,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,WAAW,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;KAClB,GACD,IAAI,GACJ,SAAS,CACX,CAAC;IACF,gBAAgB,EAAE,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,KAAK,MAAM,GAAG,SAAS,CAAC;IAC1E,8BAA8B,EAAE,CAC/B,MAAM,EAAE,eAAe,GAAG,SAAS,EACnC,gBAAgB,EAAE,MAAM,GAAG,SAAS,KAChC,OAAO,CAAC;IACb,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,KAAK,MAAM,GAAG,SAAS,CAAC;IACjE,mBAAmB,EAAE,CACpB,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,KACxB,MAAM,GAAG,SAAS,CAAC;IACxB,aAAa,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9D,yBAAyB,EAAE,CAC1B,OAAO,EAAE,OAAO,CAAC,WAAW,EAAE;QAAE,IAAI,EAAE,QAAQ,CAAA;KAAE,CAAC,KAC7C,OAAO,CAAC;IACb,uBAAuB,EAAE,CAAC,MAAM,EAAE;QACjC,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;KACpB,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAClC,uBAAuB,EAAE,CACxB,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,eAAe,EAAE,eAAe,GAAG,SAAS,EAC5C,cAAc,EAAE,MAAM,GAAG,SAAS,KAC9B,MAAM,GAAG,SAAS,CAAC;IACxB,oBAAoB,EAAE,CAAC,QAAQ,EAAE,kBAAkB,KAAK,MAAM,CAAC;IAC/D,yBAAyB,EAAE,CAC1B,OAAO,EAAE,gBAAgB,EACzB,aAAa,EAAE,SAAS,WAAW,EAAE,KACjC,IAAI,CAAC;IACV,cAAc,EAAE,SAAS,WAAW,EAAE,CAAC;IACvC,YAAY,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,6BAA6B,EAAE,MAAM,IAAI,CAAC;IAC1C,mBAAmB,EAAE,CAAC,OAAO,EAAE;QAC9B,OAAO,EAAE,CAAC,CAAC;QACX,QAAQ,EAAE,wBAAwB,EAAE,CAAC;KACrC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpB,+BAA+B,CAAC,EAAE,CACjC,cAAc,EAAE,gBAAgB,EAChC,cAAc,EAAE;QACf,OAAO,EAAE,CAAC,CAAC;QACX,QAAQ,EAAE,wBAAwB,EAAE,CAAC;KACrC,KACG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACpC,GACC,OAAO,CAAC,IAAI,CAAC,CAoSf"}
+{"version":3,"file":"account-check.d.ts","sourceRoot":"","sources":["../../../lib/runtime/account-check.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EACN,KAAK,gBAAgB,EAErB,KAAK,wBAAwB,EAE7B,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAE7D,wBAAsB,sBAAsB,CAC3C,SAAS,EAAE,OAAO,EAClB,IAAI,EAAE;IACL,aAAa,EAAE,CACd,OAAO,EAAE,gBAAgB,GAAG,IAAI,KAC5B,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACtC,YAAY,EAAE,MAAM,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACrD,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;IAC3C,mBAAmB,EAAE,MAAM,OAAO,CAAC;QAClC,OAAO,EAAE,CAAC,CAAC;QACX,QAAQ,EAAE,wBAAwB,EAAE,CAAC;KACrC,CAAC,CAAC;IACH,8BAA8B,EAAE,CAAC,cAAc,EAAE;QAChD,OAAO,EAAE,CAAC,CAAC;QACX,QAAQ,EAAE,wBAAwB,EAAE,CAAC;KACrC,KAAK,wBAAwB,CAAC;IAC/B,2BAA2B,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAChE;QACA,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,WAAW,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;KAClB,GACD,IAAI,GACJ,SAAS,CACX,CAAC;IACF,gBAAgB,EAAE,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,KAAK,MAAM,GAAG,SAAS,CAAC;IAC1E,8BAA8B,EAAE,CAC/B,MAAM,EAAE,eAAe,GAAG,SAAS,EACnC,gBAAgB,EAAE,MAAM,GAAG,SAAS,KAChC,OAAO,CAAC;IACb,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,KAAK,MAAM,GAAG,SAAS,CAAC;IACjE,mBAAmB,EAAE,CACpB,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,KACxB,MAAM,GAAG,SAAS,CAAC;IACxB,aAAa,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9D,yBAAyB,EAAE,CAC1B,OAAO,EAAE,OAAO,CAAC,WAAW,EAAE;QAAE,IAAI,EAAE,QAAQ,CAAA;KAAE,CAAC,KAC7C,OAAO,CAAC;IACb,uBAAuB,EAAE,CAAC,MAAM,EAAE;QACjC,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;KACpB,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAClC,uBAAuB,EAAE,CACxB,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,eAAe,EAAE,eAAe,GAAG,SAAS,EAC5C,cAAc,EAAE,MAAM,GAAG,SAAS,KAC9B,MAAM,GAAG,SAAS,CAAC;IACxB,oBAAoB,EAAE,CAAC,QAAQ,EAAE,kBAAkB,KAAK,MAAM,CAAC;IAC/D,yBAAyB,EAAE,CAC1B,OAAO,EAAE,gBAAgB,EACzB,aAAa,EAAE,SAAS,WAAW,EAAE,KACjC,IAAI,CAAC;IACV,cAAc,EAAE,SAAS,WAAW,EAAE,CAAC;IACvC,YAAY,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,6BAA6B,EAAE,MAAM,IAAI,CAAC;IAC1C,mBAAmB,EAAE,CAAC,OAAO,EAAE;QAC9B,OAAO,EAAE,CAAC,CAAC;QACX,QAAQ,EAAE,wBAAwB,EAAE,CAAC;KACrC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpB,+BAA+B,CAAC,EAAE,CACjC,cAAc,EAAE,gBAAgB,EAChC,cAAc,EAAE;QACf,OAAO,EAAE,CAAC,CAAC;QACX,QAAQ,EAAE,wBAAwB,EAAE,CAAC;KACrC,KACG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACpC,GACC,OAAO,CAAC,IAAI,CAAC,CA2Sf"}

package/dist/lib/runtime/account-check.js

@@ -1,7 +1,7 @@
 import { maskEmail } from "../logger.js";
 import { CODEX_UNAVAILABLE_PROBE_NOTE } from "../quota-probe.js";
 import { isCodexUnavailableError } from "../errors.js";
-import { reconcilePinnedAccountIndex, } from "../storage.js";
+import { bumpStorageAffinityGeneration, reconcilePinnedAccountIndex, } from "../storage.js";
 export async function runRuntimeAccountCheck(deepProbe, deps) {
     const loadedStorage = await deps.hydrateEmails(await deps.loadAccounts());
     const workingStorage = loadedStorage
@@ -195,6 +195,13 @@ export async function runRuntimeAccountCheck(deepProbe, deps) {
         workingStorage.accounts = workingStorage.accounts.filter((account) => !state.removeFromActive.has(account.refreshToken));
         deps.clampRuntimeActiveIndices(workingStorage, deps.MODEL_FAMILIES);
         workingStorage.pinnedAccountIndex = reconcilePinnedAccountIndex(pinnedAccount, workingStorage.accounts);
+        // The filter can drop several accounts at once, shifting every index
+        // after each hole. Session affinity remembers accounts BY INDEX, so
+        // without a generation bump a live proxy keeps routing in-flight
+        // sessions to whatever now occupies the old slot — and this path is
+        // AUTOMATIC (revoked-token accounts are removed without a prompt), so
+        // nothing else invalidates the affinity map. See issue #474.
+        bumpStorageAffinityGeneration(workingStorage);
         state.storageChanged = true;
     }
     const persistAccountAndFlaggedStorage = deps.persistAccountAndFlaggedStorage;

package/dist/lib/runtime-rotation-proxy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-rotation-proxy.d.ts","sourceRoot":"","sources":["../../lib/runtime-rotation-proxy.ts"],"names":[],"mappings":"AAGA,OAAO,EAIN,KAAK,cAAc,EACnB,MAAM,eAAe,CAAC;AA8BvB,OAAO,EAAkB,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AA4CtE,OAAO,KAAK,EAKX,2BAA2B,EAC3B,0BAA0B,EAE1B,MAAM,oCAAoC,CAAC;AAe5C,YAAY,EACX,2BAA2B,EAC3B,0BAA0B,EAC1B,0BAA0B,GAC1B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACN,+BAA+B,EAC/B,0BAA0B,GAC1B,MAAM,kCAAkC,CAAC;AAC1C,YAAY,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AACnF,OAAO,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAC;AACxE,OAAO,EACN,+BAA+B,EAC/B,8BAA8B,EAC9B,uBAAuB,EACvB,uBAAuB,GACvB,MAAM,oCAAoC,CAAC;AAC5C,YAAY,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAC;AA8DtE,kFAAkF;AAClF,wBAAgB,qBAAqB,CACpC,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,GAAG;IACvE,gFAAgF;IAChF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB,EACD,MAAM,EAAE,WAAW,EACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GACnB,MAAM,CAmBR;AA8bD;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAC1C,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,GACvC,MAAM,GAAG,IAAI,CAUf;AAED,wBAAsB,yBAAyB,CAC9C,OAAO,EAAE,2BAA2B,GAClC,OAAO,CAAC,0BAA0B,CAAC,CA4KrC"}
+{"version":3,"file":"runtime-rotation-proxy.d.ts","sourceRoot":"","sources":["../../lib/runtime-rotation-proxy.ts"],"names":[],"mappings":"AAGA,OAAO,EAIN,KAAK,cAAc,EACnB,MAAM,eAAe,CAAC;AA8BvB,OAAO,EAAkB,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AA6CtE,OAAO,KAAK,EAKX,2BAA2B,EAC3B,0BAA0B,EAE1B,MAAM,oCAAoC,CAAC;AAe5C,YAAY,EACX,2BAA2B,EAC3B,0BAA0B,EAC1B,0BAA0B,GAC1B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACN,+BAA+B,EAC/B,0BAA0B,GAC1B,MAAM,kCAAkC,CAAC;AAC1C,YAAY,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AACnF,OAAO,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAC;AACxE,OAAO,EACN,+BAA+B,EAC/B,8BAA8B,EAC9B,uBAAuB,EACvB,uBAAuB,GACvB,MAAM,oCAAoC,CAAC;AAC5C,YAAY,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAC;AA8DtE,kFAAkF;AAClF,wBAAgB,qBAAqB,CACpC,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,GAAG;IACvE,gFAAgF;IAChF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB,EACD,MAAM,EAAE,WAAW,EACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GACnB,MAAM,CAmBR;AA8bD;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAC1C,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,GACvC,MAAM,GAAG,IAAI,CAUf;AAED,wBAAsB,yBAAyB,CAC9C,OAAO,EAAE,2BAA2B,GAClC,OAAO,CAAC,0BAA0B,CAAC,CA4KrC"}

package/dist/lib/runtime-rotation-proxy.js

@@ -8,6 +8,7 @@ import { getModelFamily } from "./prompts/codex.js";
 import { CURRENT_CODEX_MODEL } from "./request/helpers/model-map.js";
 import { mutateRuntimeObservabilitySnapshot, recordRuntimeAccountRecovery, recordRuntimePoolExhaustion, } from "./runtime/runtime-observability.js";
 import { createRuntimeUsageRecorder, evaluateRuntimePolicy, loadRuntimePolicyState, } from "./policy/runtime-policy.js";
+import { createUsageStreamScanner } from "./usage/usage-extraction.js";
 import { isWorkspaceDisabledError } from "./request/fetch-helpers.js";
 import { PreemptiveQuotaScheduler, readQuotaSchedulerSnapshot, } from "./preemptive-quota-scheduler.js";
 import { createLogger, maskString, runWithCorrelationId } from "./logger.js";
@@ -936,11 +937,35 @@ async function handleRequestInner(state, req, res, traceId) {
                 upstream = await withTimeout(state.fetchImpl(upstreamUrl, upstreamRequestInit), state.fetchTimeoutMs, () => fetchAbortController.abort(), `upstream fetch timed out after ${state.fetchTimeoutMs}ms`);
             }
             catch (error) {
-                state.status.lastError = error instanceof Error ? error.message : String(error);
+                // errors-logging-08: a custom fetchImpl, a proxy agent, or an undici
+                // cause chain can embed the request URL or credential material in the
+                // raw message, so mask before it reaches any state.status consumer.
+                const transportError = maskString(error instanceof Error ? error.message : String(error));
+                state.status.lastError = transportError;
+                // errors-logging-01: give the failure a structured, trace-correlated
+                // line instead of only a last-write-wins status string. Nothing else
+                // on this path reaches proxyLog, because the request does not throw.
+                proxyLog.error("upstream transport failure", {
+                    traceId,
+                    code: "codex_runtime_rotation_transport_error",
+                    error: transportError,
+                });
                 accountManager.refundToken(refreshed.account, context.family, context.model);
-                accountManager.recordFailure(refreshed.account, context.family, context.model);
+                // A pre-header transport exception is a property of the network path,
+                // not of this account's credentials or quota, so it must NOT feed the
+                // account's circuit breaker / health tracker: that is what would
+                // otherwise retire a healthy account for an outage it did not cause.
+                // See #677.
+                //
+                // The short timed cooldown IS still applied. It is self-healing, it
+                // keeps an account whose upstream hangs from stalling 1/N of every
+                // later request for the full fetch timeout, and it is what gives the
+                // exhaustion 503 a non-zero `retry_after_ms` to back the client off
+                // with (`getMinWaitTimeForFamily` returns 0 while any account is
+                // still selectable).
                 accountManager.markAccountCoolingDown(refreshed.account, state.networkErrorCooldownMs, "network-error");
                 accountManager.saveToDiskDebounced();
+                accountSkipReasons.set(refreshed.account.index, "network-error");
                 exhaustionReason = "network-error";
                 transientAttempts += 1;
                 transientExhaustionReason = "network-error";
@@ -1152,17 +1177,35 @@ async function handleRequestInner(state, req, res, traceId) {
                 state.lastGlobalSwitchAt = state.now();
             }
             await persistRuntimeActiveAccount(accountManager, refreshed.account, context.family, isPinned && refreshed.account.index === pinnedIndex, state.schedulingStrategy);
+            // Recover the upstream token counts as the body streams past. Without
+            // them every ledger row lands with all-zero tokens and a zero cost, so
+            // evaluateBudgetGuard compares `0 >= limit` for maxTokens/maxCostUsd
+            // and those caps never fire — `budget set --cost 50` would allow
+            // unlimited spend, with only --requests actually enforced.
+            const usageScanner = createUsageStreamScanner({
+                contentType: upstream.headers.get("content-type"),
+            });
             const forwarded = await forwardStreamingResponse(upstream, res, state.status, () => {
+                // Deliberately NOT the pre-header transport policy above,
+                // which skips recordFailure (#677). By this point the
+                // upstream accepted the request and began responding, so a
+                // broken stream is a signal about THIS account's session
+                // (upstream tearing it down) rather than about the shared
+                // network path, and it should still credit the breaker.
                 accountManager.recordFailure(refreshed.account, context.family, context.model);
                 accountManager.markAccountCoolingDown(refreshed.account, state.networkErrorCooldownMs, "network-error");
                 state.sessionAffinityStore?.forgetSession(context.sessionKey);
                 accountManager.saveToDiskDebounced();
-            }, state.streamStallTimeoutMs);
+            }, state.streamStallTimeoutMs, usageScanner.push);
+            // A stream that broke mid-flight still bills for whatever the upstream
+            // reported before the break, so record the counts on both outcomes.
+            const usageTokens = usageScanner.result();
             await usageRecorder.record({
                 outcome: forwarded ? "success" : "failure",
                 statusCode: upstream.status,
                 errorCode: forwarded ? null : "stream_forward_failed",
                 account: refreshed.account,
+                ...(usageTokens ?? {}),
             });
             return;
         }

package/dist/lib/storage.d.ts

@@ -83,6 +83,25 @@ export declare function normalizeAccountStorage(data: unknown): AccountStorageV3
  * helper only narrows the lost-update window. See issue #474.
  */
 export declare function readAffinityGenerationFromDisk(path: string): number;
+/**
+ * Advance the session-affinity generation so a running runtime proxy drops its
+ * sticky session→account bindings on the next request.
+ *
+ * Session affinity remembers an account by ITS INDEX, so any mutation that
+ * reshuffles the pool (removing an account, restoring a backup) silently
+ * re-points every live session at a different account until the generation
+ * changes. `switch`/`best`/`unpin` already bump it; the reshuffling paths are
+ * the ones that need it most, because they move every index at once.
+ *
+ * Re-reads the on-disk generation first so concurrent CLI processes do not lose
+ * increments via lost-update on the load+mutate pair. `Math.max` keeps the
+ * counter monotonic: an extra bump only costs one additional affinity
+ * invalidation, while a missed bump lets the proxy cling to the wrong account.
+ * See issue #474.
+ */
+export declare function bumpStorageAffinityGeneration(storage: {
+    affinityGeneration?: number;
+}, storagePath?: string | null): number;
 /**
  * Synchronously reads both the top-level `pinnedAccountIndex` and
  * `affinityGeneration` fields from the accounts storage file. Used by

package/dist/lib/storage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../lib/storage.ts"],"names":[],"mappings":"AA+BA,OAAO,EACN,KAAK,cAAc,EAGnB,KAAK,iBAAiB,EAEtB,MAAM,8BAA8B,CAAC;AAkBtC,OAAO,EAEN,KAAK,oBAAoB,EACzB,MAAM,qBAAqB,CAAC;AAe7B,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EACN,sBAAsB,EACtB,cAAc,GACd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACN,qBAAqB,EACrB,iBAAiB,GACjB,MAAM,uBAAuB,CAAC;AAa/B,OAAO,KAAK,EACX,iBAAiB,EACjB,gBAAgB,EAChB,cAAc,EACd,wBAAwB,EACxB,uBAAuB,EACvB,gBAAgB,EAChB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAEN,KAAK,kBAAkB,EACvB,MAAM,4BAA4B,CAAC;AA2CpC,YAAY,EACX,oBAAoB,EACpB,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,wBAAwB,EACxB,uBAAuB,EACvB,cAAc,EACd,iBAAiB,EACjB,kBAAkB,GAClB,CAAC;AAcF,KAAK,WAAW,GAAG;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAiBF,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAE9D;AAuWD,wBAAgB,4BAA4B,IAAI,MAAM,CAErD;AAED,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CA4C/D;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAO9D;AAED;;;GAGG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAMvC;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAarE;AAED,wBAAsB,yBAAyB,CAC9C,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAC7B,OAAO,CAAC,gBAAgB,CAAC,CAe3B;AAED,wBAAsB,iBAAiB,CACtC,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAC3B,OAAO,CAAC,MAAM,CAAC,CAQjB;AAED,wBAAgB,sBAAsB,IAAI,MAAM,CAE/C;AA6LD,KAAK,mBAAmB,GAAG;IAC1B,wCAAwC,CAAC,EAAE,OAAO,CAAC;CACnD,CAAC;AA8IF,wBAAgB,wBAAwB,CACvC,CAAC,SAAS,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,EAEnE,QAAQ,EAAE,SAAS,CAAC,EAAE,EACtB,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,EACpE,OAAO,GAAE,mBAAwB,GAC/B,MAAM,GAAG,SAAS,CAkBpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAC1C,aAAa,EACV,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,GACzD,SAAS,EACZ,YAAY,EAAE,SAAS,IAAI,CAC1B,WAAW,EACX,WAAW,GAAG,OAAO,GAAG,cAAc,CACtC,EAAE,GACD,MAAM,GAAG,SAAS,CAGpB;AAED,wBAAgB,4BAA4B,CAC3C,CAAC,SAAS,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,EAEnE,QAAQ,EAAE,SAAS,CAAC,EAAE,EACtB,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,EACpE,aAAa,SAAI,GACf,MAAM,CAOR;AAsCD;;;GAGG;AACH,wBAAgB,mBAAmB,CAClC,CAAC,SAAS;IACT,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB,EACA,QAAQ,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,CAEpB;AAED,wBAAgB,0BAA0B,CACzC,CAAC,SAAS;IACT,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB,EACA,QAAQ,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,CAEpB;AAoBD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACtC,IAAI,EAAE,OAAO,GACX,gBAAgB,GAAG,IAAI,CAoJzB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAoBnE;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG;IACpD,kBAAkB,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,kBAAkB,EAAE,MAAM,CAAC;CAC3B,CA8BA;AAED;;;;GAIG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAErE;AAED,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,cAAc,CAAC,CAajE;AAED,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,iBAAiB,CAAC,CASvE;AAED,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,oBAAoB,CAAC,CAiG1E;AAyaD,wBAAsB,6BAA6B,CAAC,CAAC,EACpD,OAAO,EAAE,CACR,OAAO,EAAE,gBAAgB,GAAG,IAAI,EAChC,OAAO,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,KACjD,OAAO,CAAC,CAAC,CAAC,GACb,OAAO,CAAC,CAAC,CAAC,CAMZ;AAED,wBAAsB,uCAAuC,CAAC,CAAC,EAC9D,OAAO,EAAE,CACR,OAAO,EAAE,gBAAgB,GAAG,IAAI,EAChC,OAAO,EAAE,CACR,cAAc,EAAE,gBAAgB,EAChC,cAAc,EAAE,uBAAuB,KACnC,OAAO,CAAC,IAAI,CAAC,EAClB,cAAc,EAAE,uBAAuB,KACnC,OAAO,CAAC,CAAC,CAAC,GACb,OAAO,CAAC,CAAC,CAAC,CAgDZ;AAED,wBAAsB,6BAA6B,CAAC,CAAC,EACpD,OAAO,EAAE,CACR,OAAO,EAAE,uBAAuB,EAChC,OAAO,EAAE,CAAC,OAAO,EAAE,uBAAuB,KAAK,OAAO,CAAC,IAAI,CAAC,KACxD,OAAO,CAAC,CAAC,CAAC,GACb,OAAO,CAAC,CAAC,CAAC,CAiCZ;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAM3E;AAED;;;GAGG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAcnD;AAED,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,uBAAuB,CAAC,CAgD5E;AAyBD,wBAAsB,mBAAmB,CACxC,OAAO,EAAE,uBAAuB,GAC9B,OAAO,CAAC,IAAI,CAAC,CAMf;AAED,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,IAAI,CAAC,CAa1D;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CACnC,QAAQ,EAAE,MAAM,EAChB,KAAK,UAAO,EACZ,YAAY,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,GAC3D,OAAO,CAAC,IAAI,CAAC,CAgBf;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CACnC,QAAQ,EAAE,MAAM,GACd,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAe/D"}
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../lib/storage.ts"],"names":[],"mappings":"AA+BA,OAAO,EACN,KAAK,cAAc,EAGnB,KAAK,iBAAiB,EAEtB,MAAM,8BAA8B,CAAC;AAkBtC,OAAO,EAEN,KAAK,oBAAoB,EACzB,MAAM,qBAAqB,CAAC;AAe7B,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EACN,sBAAsB,EACtB,cAAc,GACd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACN,qBAAqB,EACrB,iBAAiB,GACjB,MAAM,uBAAuB,CAAC;AAa/B,OAAO,KAAK,EACX,iBAAiB,EACjB,gBAAgB,EAChB,cAAc,EACd,wBAAwB,EACxB,uBAAuB,EACvB,gBAAgB,EAChB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAEN,KAAK,kBAAkB,EACvB,MAAM,4BAA4B,CAAC;AA2CpC,YAAY,EACX,oBAAoB,EACpB,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,wBAAwB,EACxB,uBAAuB,EACvB,cAAc,EACd,iBAAiB,EACjB,kBAAkB,GAClB,CAAC;AAcF,KAAK,WAAW,GAAG;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAiBF,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAE9D;AAuWD,wBAAgB,4BAA4B,IAAI,MAAM,CAErD;AAED,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CA4C/D;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAO9D;AAED;;;GAGG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAMvC;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAarE;AAED,wBAAsB,yBAAyB,CAC9C,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAC7B,OAAO,CAAC,gBAAgB,CAAC,CAe3B;AAED,wBAAsB,iBAAiB,CACtC,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAC3B,OAAO,CAAC,MAAM,CAAC,CAQjB;AAED,wBAAgB,sBAAsB,IAAI,MAAM,CAE/C;AA6LD,KAAK,mBAAmB,GAAG;IAC1B,wCAAwC,CAAC,EAAE,OAAO,CAAC;CACnD,CAAC;AA8IF,wBAAgB,wBAAwB,CACvC,CAAC,SAAS,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,EAEnE,QAAQ,EAAE,SAAS,CAAC,EAAE,EACtB,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,EACpE,OAAO,GAAE,mBAAwB,GAC/B,MAAM,GAAG,SAAS,CAkBpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAC1C,aAAa,EACV,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,GACzD,SAAS,EACZ,YAAY,EAAE,SAAS,IAAI,CAC1B,WAAW,EACX,WAAW,GAAG,OAAO,GAAG,cAAc,CACtC,EAAE,GACD,MAAM,GAAG,SAAS,CAGpB;AAED,wBAAgB,4BAA4B,CAC3C,CAAC,SAAS,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,EAEnE,QAAQ,EAAE,SAAS,CAAC,EAAE,EACtB,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,EACpE,aAAa,SAAI,GACf,MAAM,CAOR;AAsCD;;;GAGG;AACH,wBAAgB,mBAAmB,CAClC,CAAC,SAAS;IACT,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB,EACA,QAAQ,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,CAEpB;AAED,wBAAgB,0BAA0B,CACzC,CAAC,SAAS;IACT,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB,EACA,QAAQ,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,CAEpB;AAoBD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACtC,IAAI,EAAE,OAAO,GACX,gBAAgB,GAAG,IAAI,CAoJzB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAoBnE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,6BAA6B,CAC5C,OAAO,EAAE;IAAE,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAAE,EACxC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,GACzB,MAAM,CAaR;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG;IACpD,kBAAkB,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,kBAAkB,EAAE,MAAM,CAAC;CAC3B,CA8BA;AAED;;;;GAIG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAErE;AAED,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,cAAc,CAAC,CAajE;AAED,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,iBAAiB,CAAC,CASvE;AAED,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,oBAAoB,CAAC,CAiG1E;AAyaD,wBAAsB,6BAA6B,CAAC,CAAC,EACpD,OAAO,EAAE,CACR,OAAO,EAAE,gBAAgB,GAAG,IAAI,EAChC,OAAO,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,KACjD,OAAO,CAAC,CAAC,CAAC,GACb,OAAO,CAAC,CAAC,CAAC,CAMZ;AAED,wBAAsB,uCAAuC,CAAC,CAAC,EAC9D,OAAO,EAAE,CACR,OAAO,EAAE,gBAAgB,GAAG,IAAI,EAChC,OAAO,EAAE,CACR,cAAc,EAAE,gBAAgB,EAChC,cAAc,EAAE,uBAAuB,KACnC,OAAO,CAAC,IAAI,CAAC,EAClB,cAAc,EAAE,uBAAuB,KACnC,OAAO,CAAC,CAAC,CAAC,GACb,OAAO,CAAC,CAAC,CAAC,CAgDZ;AAED,wBAAsB,6BAA6B,CAAC,CAAC,EACpD,OAAO,EAAE,CACR,OAAO,EAAE,uBAAuB,EAChC,OAAO,EAAE,CAAC,OAAO,EAAE,uBAAuB,KAAK,OAAO,CAAC,IAAI,CAAC,KACxD,OAAO,CAAC,CAAC,CAAC,GACb,OAAO,CAAC,CAAC,CAAC,CAiCZ;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAM3E;AAED;;;GAGG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAcnD;AAED,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,uBAAuB,CAAC,CAgD5E;AAyBD,wBAAsB,mBAAmB,CACxC,OAAO,EAAE,uBAAuB,GAC9B,OAAO,CAAC,IAAI,CAAC,CAMf;AAED,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,IAAI,CAAC,CAa1D;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CACnC,QAAQ,EAAE,MAAM,EAChB,KAAK,UAAO,EACZ,YAAY,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,GAC3D,OAAO,CAAC,IAAI,CAAC,CAgBf;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CACnC,QAAQ,EAAE,MAAM,GACd,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAe/D"}

package/dist/lib/storage.js

@@ -951,6 +951,38 @@ export function readAffinityGenerationFromDisk(path) {
         return 0;
     }
 }
+/**
+ * Advance the session-affinity generation so a running runtime proxy drops its
+ * sticky session→account bindings on the next request.
+ *
+ * Session affinity remembers an account by ITS INDEX, so any mutation that
+ * reshuffles the pool (removing an account, restoring a backup) silently
+ * re-points every live session at a different account until the generation
+ * changes. `switch`/`best`/`unpin` already bump it; the reshuffling paths are
+ * the ones that need it most, because they move every index at once.
+ *
+ * Re-reads the on-disk generation first so concurrent CLI processes do not lose
+ * increments via lost-update on the load+mutate pair. `Math.max` keeps the
+ * counter monotonic: an extra bump only costs one additional affinity
+ * invalidation, while a missed bump lets the proxy cling to the wrong account.
+ * See issue #474.
+ */
+export function bumpStorageAffinityGeneration(storage, storagePath) {
+    let diskGeneration = 0;
+    try {
+        const path = storagePath ?? getStoragePath();
+        if (path)
+            diskGeneration = readAffinityGenerationFromDisk(path);
+    }
+    catch {
+        // No resolvable storage path (never configured). The in-memory counter
+        // is still bumped below; only the lost-update guard is unavailable.
+    }
+    const inMemoryGeneration = storage.affinityGeneration ?? 0;
+    const next = Math.max(inMemoryGeneration, diskGeneration) + 1;
+    storage.affinityGeneration = next;
+    return next;
+}
 /**
  * Synchronously reads both the top-level `pinnedAccountIndex` and
  * `affinityGeneration` fields from the accounts storage file. Used by

package/dist/lib/usage/index.d.ts

@@ -2,4 +2,6 @@ export * from "./types.js";
 export * from "./pricing.js";
 export * from "./redaction.js";
 export * from "./ledger.js";
+export * from "./usage-extraction.js";
+export * from "./stream-usage-deferral.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/lib/usage/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../lib/usage/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../lib/usage/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,uBAAuB,CAAC;AACtC,cAAc,4BAA4B,CAAC"}

package/dist/lib/usage/index.js

@@ -2,3 +2,5 @@ export * from "./types.js";
 export * from "./pricing.js";
 export * from "./redaction.js";
 export * from "./ledger.js";
+export * from "./usage-extraction.js";
+export * from "./stream-usage-deferral.js";

package/dist/lib/usage/stream-usage-deferral.d.ts

@@ -0,0 +1,39 @@
+import type { UsageTokenCounts } from "./types.js";
+export interface StreamUsageDeferral<TRow> {
+    /** Latest counts reported by upstream, or null if none have arrived. */
+    captured: () => UsageTokenCounts | null;
+    /** Feed upstream-reported counts. Writes a deferred row immediately. */
+    onUsage: (usage: UsageTokenCounts) => void;
+    /**
+     * Hand over a row to be written once upstream reports its counts, or after
+     * `fallbackMs` without them. Only the first pending row is held.
+     */
+    defer: (completion: TRow) => void;
+}
+/**
+ * Holds a usage-ledger row open until a streaming response reports its tokens.
+ *
+ * A streaming request's row would otherwise be written when the request handler
+ * returns its Response — before the client has read a byte, and therefore
+ * before the upstream `usage` event exists. The ledger is append-only, so that
+ * row could never be corrected: it would stand at zero tokens and zero cost
+ * forever, which is what silently disables the `maxTokens` and `maxCostUsd`
+ * budget caps (`evaluateBudgetGuard` compares `0 >= limit`).
+ *
+ * The fallback timer is not optional bookkeeping. A client that disconnects
+ * mid-stream, or an upstream that never emits a terminal usage event, must
+ * still cost one row, because `maxRequests` counts rows — losing it would
+ * weaken a cap that currently works.
+ *
+ * Generic over the row type so this stays inside `lib/usage` rather than
+ * importing the policy layer that imports it back.
+ */
+export declare function createStreamUsageDeferral<TRow extends object>(options: {
+    record: (completion: TRow & Partial<UsageTokenCounts>) => void;
+    fallbackMs: number;
+    /** Injectable for tests; defaults to an unref'd setTimeout. */
+    schedule?: (run: () => void, ms: number) => {
+        cancel: () => void;
+    };
+}): StreamUsageDeferral<TRow>;
+//# sourceMappingURL=stream-usage-deferral.d.ts.map

package/dist/lib/usage/stream-usage-deferral.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stream-usage-deferral.d.ts","sourceRoot":"","sources":["../../../lib/usage/stream-usage-deferral.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEnD,MAAM,WAAW,mBAAmB,CAAC,IAAI;IACxC,wEAAwE;IACxE,QAAQ,EAAE,MAAM,gBAAgB,GAAG,IAAI,CAAC;IACxC,wEAAwE;IACxE,OAAO,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,IAAI,CAAC;IAC3C;;;OAGG;IACH,KAAK,EAAE,CAAC,UAAU,EAAE,IAAI,KAAK,IAAI,CAAC;CAClC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,SAAS,MAAM,EAAE,OAAO,EAAE;IACvE,MAAM,EAAE,CAAC,UAAU,EAAE,IAAI,GAAG,OAAO,CAAC,gBAAgB,CAAC,KAAK,IAAI,CAAC;IAC/D,UAAU,EAAE,MAAM,CAAC;IACnB,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,IAAI,EAAE,EAAE,EAAE,MAAM,KAAK;QAAE,MAAM,EAAE,MAAM,IAAI,CAAA;KAAE,CAAC;CACnE,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAqC5B"}

package/dist/lib/usage/stream-usage-deferral.js

@@ -0,0 +1,54 @@
+/**
+ * Holds a usage-ledger row open until a streaming response reports its tokens.
+ *
+ * A streaming request's row would otherwise be written when the request handler
+ * returns its Response — before the client has read a byte, and therefore
+ * before the upstream `usage` event exists. The ledger is append-only, so that
+ * row could never be corrected: it would stand at zero tokens and zero cost
+ * forever, which is what silently disables the `maxTokens` and `maxCostUsd`
+ * budget caps (`evaluateBudgetGuard` compares `0 >= limit`).
+ *
+ * The fallback timer is not optional bookkeeping. A client that disconnects
+ * mid-stream, or an upstream that never emits a terminal usage event, must
+ * still cost one row, because `maxRequests` counts rows — losing it would
+ * weaken a cap that currently works.
+ *
+ * Generic over the row type so this stays inside `lib/usage` rather than
+ * importing the policy layer that imports it back.
+ */
+export function createStreamUsageDeferral(options) {
+    const schedule = options.schedule ??
+        ((run, ms) => {
+            const timer = setTimeout(run, ms);
+            // Never hold the process open for a row that is only a fallback.
+            timer.unref?.();
+            return { cancel: () => clearTimeout(timer) };
+        });
+    let captured = null;
+    let pending = null;
+    let timer = null;
+    const flush = (usage) => {
+        const completion = pending;
+        pending = null;
+        timer?.cancel();
+        timer = null;
+        if (!completion)
+            return;
+        options.record(usage ? { ...completion, ...usage } : completion);
+    };
+    return {
+        captured: () => captured,
+        onUsage: (usage) => {
+            captured = usage;
+            flush(usage);
+        },
+        defer: (completion) => {
+            // A second defer would orphan the first row's timer, so keep the row
+            // already in flight and let it settle on its own terms.
+            if (pending)
+                return;
+            pending = completion;
+            timer = schedule(() => flush(null), options.fallbackMs);
+        },
+    };
+}

package/dist/lib/usage/usage-extraction.d.ts

@@ -0,0 +1,42 @@
+import type { UsageTokenCounts } from "./types.js";
+/**
+ * Read an OpenAI Responses `usage` object into the ledger's token shape.
+ *
+ * Two containment rules drive the mapping, and getting either backwards
+ * mis-prices every row:
+ *
+ * - `input_tokens_details.cached_tokens` is a SUBSET of `input_tokens`, and
+ *   `estimateUsageCostUsd` already subtracts it (`billableInputTokens`), so
+ *   both are passed through raw.
+ * - `output_tokens_details.reasoning_tokens` is likewise a SUBSET of
+ *   `output_tokens`, but `estimateUsageCostUsd` prices `outputTokens` and
+ *   `reasoningTokens` as DISJOINT buckets and sums them. Passing the raw
+ *   `output_tokens` alongside the reasoning count would bill reasoning twice,
+ *   so the reasoning share is subtracted out here.
+ */
+export declare function extractUsageTokenCounts(usage: unknown): UsageTokenCounts | null;
+/**
+ * Pull the `usage` object out of a Responses payload, whether it arrived as a
+ * bare response object (non-streaming) or wrapped in a stream event envelope.
+ */
+export declare function extractResponsesUsage(payload: unknown): UsageTokenCounts | null;
+export interface UsageStreamScanner {
+    /** Feed one forwarded chunk. Never throws. */
+    push: (chunk: Uint8Array) => void;
+    /** Flush any trailing partial data and return the final counts, if any. */
+    result: () => UsageTokenCounts | null;
+}
+/**
+ * Observe a forwarded response body and recover its token counts.
+ *
+ * SSE bodies are scanned line by line so only the current partial line is
+ * retained; a full response can be gigabytes of deltas and must never be
+ * buffered. Non-SSE JSON bodies have no incremental structure to exploit, so
+ * they are accumulated up to `MAX_BUFFERED_BYTES` and parsed at the end —
+ * beyond that cap the scanner gives up on usage rather than grow without
+ * bound.
+ */
+export declare function createUsageStreamScanner(options: {
+    contentType?: string | null;
+}): UsageStreamScanner;
+//# sourceMappingURL=usage-extraction.d.ts.map

package/dist/lib/usage/usage-extraction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"usage-extraction.d.ts","sourceRoot":"","sources":["../../../lib/usage/usage-extraction.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AA+BnD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CACtC,KAAK,EAAE,OAAO,GACZ,gBAAgB,GAAG,IAAI,CA+BzB;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,gBAAgB,GAAG,IAAI,CAQ/E;AAED,MAAM,WAAW,kBAAkB;IAClC,8CAA8C;IAC9C,IAAI,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC;IAClC,2EAA2E;IAC3E,MAAM,EAAE,MAAM,gBAAgB,GAAG,IAAI,CAAC;CACtC;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE;IACjD,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B,GAAG,kBAAkB,CA6ErB"}

package/dist/lib/usage/usage-extraction.js

@@ -0,0 +1,178 @@
+/**
+ * Extracting token counts from upstream Responses API traffic.
+ *
+ * Without this the usage ledger records every request with all-zero tokens and
+ * a zero cost, which silently disables the `maxTokens` / `maxCostUsd` budget
+ * caps: `evaluateBudgetGuard` compares `0 >= limit`, which never fires, so
+ * `codex-multi-auth budget set --cost 50` allows unlimited spend and only
+ * `--requests` actually enforces anything.
+ */
+/** Cap on retained bytes so a hostile or unterminated body cannot grow forever. */
+const MAX_BUFFERED_BYTES = 1_048_576;
+/** Terminal Responses stream events that carry the final `usage` object. */
+const TERMINAL_EVENT_TYPES = new Set([
+    "response.completed",
+    "response.incomplete",
+    "response.failed",
+    "response.done",
+]);
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function nonNegativeInteger(value) {
+    if (typeof value !== "number" || !Number.isFinite(value))
+        return 0;
+    return Math.max(0, Math.trunc(value));
+}
+/**
+ * Read an OpenAI Responses `usage` object into the ledger's token shape.
+ *
+ * Two containment rules drive the mapping, and getting either backwards
+ * mis-prices every row:
+ *
+ * - `input_tokens_details.cached_tokens` is a SUBSET of `input_tokens`, and
+ *   `estimateUsageCostUsd` already subtracts it (`billableInputTokens`), so
+ *   both are passed through raw.
+ * - `output_tokens_details.reasoning_tokens` is likewise a SUBSET of
+ *   `output_tokens`, but `estimateUsageCostUsd` prices `outputTokens` and
+ *   `reasoningTokens` as DISJOINT buckets and sums them. Passing the raw
+ *   `output_tokens` alongside the reasoning count would bill reasoning twice,
+ *   so the reasoning share is subtracted out here.
+ */
+export function extractUsageTokenCounts(usage) {
+    if (!isRecord(usage))
+        return null;
+    const hasAnyCount = typeof usage.input_tokens === "number" ||
+        typeof usage.output_tokens === "number" ||
+        typeof usage.total_tokens === "number";
+    if (!hasAnyCount)
+        return null;
+    const inputTokens = nonNegativeInteger(usage.input_tokens);
+    const rawOutputTokens = nonNegativeInteger(usage.output_tokens);
+    const cachedInputTokens = isRecord(usage.input_tokens_details)
+        ? Math.min(inputTokens, nonNegativeInteger(usage.input_tokens_details.cached_tokens))
+        : 0;
+    const reasoningTokens = isRecord(usage.output_tokens_details)
+        ? Math.min(rawOutputTokens, nonNegativeInteger(usage.output_tokens_details.reasoning_tokens))
+        : 0;
+    const providedTotal = typeof usage.total_tokens === "number" && Number.isFinite(usage.total_tokens)
+        ? Math.max(0, Math.trunc(usage.total_tokens))
+        : inputTokens + rawOutputTokens;
+    return {
+        inputTokens,
+        outputTokens: rawOutputTokens - reasoningTokens,
+        cachedInputTokens,
+        reasoningTokens,
+        totalTokens: providedTotal,
+    };
+}
+/**
+ * Pull the `usage` object out of a Responses payload, whether it arrived as a
+ * bare response object (non-streaming) or wrapped in a stream event envelope.
+ */
+export function extractResponsesUsage(payload) {
+    if (!isRecord(payload))
+        return null;
+    const direct = extractUsageTokenCounts(payload.usage);
+    if (direct)
+        return direct;
+    if (isRecord(payload.response)) {
+        return extractUsageTokenCounts(payload.response.usage);
+    }
+    return null;
+}
+/**
+ * Observe a forwarded response body and recover its token counts.
+ *
+ * SSE bodies are scanned line by line so only the current partial line is
+ * retained; a full response can be gigabytes of deltas and must never be
+ * buffered. Non-SSE JSON bodies have no incremental structure to exploit, so
+ * they are accumulated up to `MAX_BUFFERED_BYTES` and parsed at the end —
+ * beyond that cap the scanner gives up on usage rather than grow without
+ * bound.
+ */
+export function createUsageStreamScanner(options) {
+    const sse = (options.contentType ?? "").toLowerCase().includes("text/event-stream");
+    const decoder = new TextDecoder("utf-8");
+    let pending = "";
+    let bufferedBytes = 0;
+    let overflowed = false;
+    let latest = null;
+    const consumeLine = (line) => {
+        const trimmed = line.trim();
+        if (!trimmed.startsWith("data:"))
+            return;
+        const payload = trimmed.slice("data:".length).trim();
+        if (payload.length === 0 || payload === "[DONE]")
+            return;
+        let parsed;
+        try {
+            parsed = JSON.parse(payload);
+        }
+        catch {
+            return;
+        }
+        // Prefer terminal events, which carry the authoritative totals, but fall
+        // back to any event that reports usage so a stream that ends on a
+        // non-standard terminal type still records something.
+        const type = isRecord(parsed) ? parsed.type : undefined;
+        const isTerminal = typeof type === "string" && TERMINAL_EVENT_TYPES.has(type);
+        const counts = extractResponsesUsage(parsed);
+        if (counts && (isTerminal || latest === null)) {
+            latest = counts;
+        }
+    };
+    return {
+        push: (chunk) => {
+            try {
+                if (overflowed || chunk.byteLength === 0)
+                    return;
+                bufferedBytes += chunk.byteLength;
+                pending += decoder.decode(chunk, { stream: true });
+                if (!sse) {
+                    if (bufferedBytes > MAX_BUFFERED_BYTES) {
+                        overflowed = true;
+                        pending = "";
+                    }
+                    return;
+                }
+                let newlineAt = pending.indexOf("\n");
+                while (newlineAt !== -1) {
+                    consumeLine(pending.slice(0, newlineAt));
+                    pending = pending.slice(newlineAt + 1);
+                    newlineAt = pending.indexOf("\n");
+                }
+                // A single unterminated line this long is not SSE any more; stop
+                // retaining it rather than growing the buffer for the whole body.
+                if (pending.length > MAX_BUFFERED_BYTES) {
+                    overflowed = true;
+                    pending = "";
+                }
+            }
+            catch {
+                // Usage accounting must never break the forwarded response.
+            }
+        },
+        result: () => {
+            try {
+                if (overflowed)
+                    return latest;
+                pending += decoder.decode();
+                if (sse) {
+                    if (pending.length > 0)
+                        consumeLine(pending);
+                    pending = "";
+                    return latest;
+                }
+                if (pending.trim().length === 0)
+                    return latest;
+                const parsed = JSON.parse(pending);
+                pending = "";
+                return extractResponsesUsage(parsed) ?? latest;
+            }
+            catch {
+                return latest;
+            }
+        },
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "codex-multi-auth",
-	"version": "2.8.7",
+	"version": "2.9.0",
 	"description": "Codex CLI multi-account OAuth manager with account switching, health checks, runtime rotation, diagnostics, and recovery tools for @openai/codex",
 	"main": "./dist/index.js",
 	"types": "./dist/index.d.ts",