codex-multi-auth 2.8.7 → 2.9.1

package/dist/lib/codex-manager/login-oauth.js

@@ -11,6 +11,8 @@ import { setCodexCliActiveSelection } from "../codex-cli/writer.js";
 import { createLogger } from "../logger.js";
 import { MODEL_FAMILIES } from "../prompts/codex.js";
 import { findMatchingAccountIndex, withAccountStorageTransaction, } from "../storage.js";
+import { cloneAccountStorageForPersistence } from "../storage/account-persistence.js";
+import { CodexValidationError } from "../errors.js";
 import { UI_COPY } from "../ui/ui-copy.js";
 import { applyAccountPoolResults, } from "./account-pool-write.js";
 import { stylePromptText } from "./formatters/index.js";
@@ -39,7 +41,7 @@ export function isAbortError(error) {
  *
  * @internal
  */
-export function resolveAccountSelection(tokens, orgOverride) {
+export function resolveAccountSelection(tokens, orgOverride, targetAccountId) {
     const candidates = getAccountIdCandidates(tokens.access, tokens.idToken);
     // Surface every workspace/organization exposed by the token so the saved
     // account can track them (issue #491/#512). Without this, same-email
@@ -54,18 +56,50 @@ export function resolveAccountSelection(tokens, orgOverride) {
             isDefault: candidate.isDefault,
         }))
         : undefined;
-    const override = resolveOrgOverride(orgOverride);
-    if (override) {
-        // Prefer the token candidate's human label for the chosen org so the
-        // saved row is identifiable, falling back to a bare manual binding.
-        const matched = candidates.find((candidate) => candidate.accountId === override);
-        return {
-            ...tokens,
-            accountIdOverride: override,
-            accountIdSource: "manual",
-            accountLabel: matched?.label,
-            workspaces,
-        };
+    // A targeted re-authentication names one saved row, which is a stricter and
+    // more specific instruction than the ambient CODEX_AUTH_ACCOUNT_ID env var
+    // that resolveOrgOverride also honours. Consulting the override first let an
+    // unrelated exported org id hijack `login --account <n>` and then fail the
+    // identity guard with a misleading "does not match" message. An explicit
+    // `--org` cannot reach here alongside a target: parseAuthLoginArgs rejects
+    // that combination outright.
+    if (targetAccountId) {
+        const targetedCandidate = candidates.find((candidate) => candidate.accountId === targetAccountId);
+        if (targetedCandidate) {
+            return {
+                ...tokens,
+                accountIdOverride: targetedCandidate.accountId,
+                // `id_token` candidates auto-follow the access token inside
+                // resolveRequestAccountId, which would rewrite this binding back to
+                // the access-token account and make the caller's own identity guard
+                // reject the write. Pin those as an explicit selection; a `token`
+                // candidate already IS the access-token account, and an `org`
+                // candidate never auto-follows, so both keep their source.
+                accountIdSource: targetedCandidate.source === "id_token"
+                    ? "manual"
+                    : targetedCandidate.source,
+                accountLabel: targetedCandidate.label,
+                workspaces,
+            };
+        }
+        // The user signed in as somebody else. Fall through to the generic
+        // selection so persistAccountPool refuses the write with the precise
+        // identity-mismatch message instead of a confusing override error.
+    }
+    else {
+        const override = resolveOrgOverride(orgOverride);
+        if (override) {
+            // Prefer the token candidate's human label for the chosen org so the
+            // saved row is identifiable, falling back to a bare manual binding.
+            const matched = candidates.find((candidate) => candidate.accountId === override);
+            return {
+                ...tokens,
+                accountIdOverride: override,
+                accountIdSource: "manual",
+                accountLabel: matched?.label,
+                workspaces,
+            };
+        }
     }
     if (candidates.length === 0) {
         return tokens;
@@ -300,8 +334,81 @@ export async function runSignInFlow(forceNewLogin, signInMode, options = {}) {
     }
     return runOAuthFlow(forceNewLogin, signInMode);
 }
+function sameExpectedLoginIdentity(write, expected) {
+    const expectedAccountId = expected.accountId?.trim();
+    const incomingAccountId = write.accountId?.trim();
+    const expectedEmail = sanitizeEmail(expected.email);
+    const incomingEmail = sanitizeEmail(write.email);
+    // When the saved row already carries the provider identity it is
+    // authoritative and the incoming login must match it: the id survives an
+    // email change, and falling back to a shared email across workspaces would
+    // let a targeted re-auth overwrite the wrong saved account.
+    if (expectedAccountId) {
+        return incomingAccountId === expectedAccountId;
+    }
+    // A pre-#491 row saved before workspace tracking carries no account id at
+    // all. Fresh tokens essentially always carry one, so demanding the id on both
+    // sides made every legacy row permanently un-refreshable through --account.
+    // Email is the only identity such a row has, and the caller already resolved
+    // it to a single unambiguous row before starting the sign-in.
+    return Boolean(expectedEmail && incomingEmail === expectedEmail);
+}
+function matchesExpectedAccount(account, expected) {
+    if (!account)
+        return false;
+    if (expected.recordId && account.recordId) {
+        return account.recordId === expected.recordId;
+    }
+    const expectedAccountId = expected.accountId?.trim();
+    const candidateAccountId = account.accountId?.trim();
+    if (expectedAccountId || candidateAccountId) {
+        return Boolean(expectedAccountId &&
+            candidateAccountId &&
+            expectedAccountId === candidateAccountId);
+    }
+    const expectedEmail = sanitizeEmail(expected.email);
+    const candidateEmail = sanitizeEmail(account.email);
+    if (expectedEmail || candidateEmail) {
+        return Boolean(expectedEmail && candidateEmail === expectedEmail);
+    }
+    return account.refreshToken === expected.refreshToken;
+}
+/**
+ * Locate the saved row a targeted re-authentication must write.
+ *
+ * Resolution is deliberately identity-first and refresh-token-last. The runtime
+ * rotation proxy rewrites a stored refreshToken whenever it refreshes an account
+ * (AccountManager.commitRefreshedAuth), so a sign-in that overlaps a live codex
+ * session would otherwise "lose" its own target and throw away a completed
+ * OAuth. `recordId` is exact when both sides have one, the caller's position is
+ * honoured only while the row sitting there is still the same identity, and
+ * findMatchingAccountIndex supplies the same composite/email/refresh-token
+ * ladder the rest of the pool already resolves identities with.
+ */
+function resolveExpectedAccountIndex(accounts, expected, hintedIndex) {
+    if (expected.recordId) {
+        const byRecordId = accounts.findIndex((account) => account?.recordId === expected.recordId);
+        if (byRecordId >= 0)
+            return byRecordId;
+    }
+    if (validSelectionIndex(hintedIndex, accounts) &&
+        matchesExpectedAccount(accounts[hintedIndex], expected)) {
+        return hintedIndex;
+    }
+    return findMatchingAccountIndex(accounts, {
+        accountId: expected.accountId,
+        email: expected.email,
+        refreshToken: expected.refreshToken,
+    }, { allowUniqueAccountIdFallbackWithoutEmail: true });
+}
+function validSelectionIndex(index, accounts) {
+    return (typeof index === "number" &&
+        Number.isInteger(index) &&
+        index >= 0 &&
+        index < accounts.length);
+}
 /** @internal */
-export async function persistAccountPool(results, replaceAll) {
+export async function persistAccountPool(results, replaceAll, options = {}) {
     if (results.length === 0)
         return null;
     return await withAccountStorageTransaction(async (loadedStorage, persist) => {
@@ -324,26 +431,101 @@ export async function persistAccountPool(results, replaceAll) {
                 accessToken: result.access,
                 expiresAt: result.expires,
                 workspaces: result.workspaces,
+                // A targeted re-auth only tops up credentials for the row the user
+                // named; it must not silently re-enable an account they disabled.
+                preserveEnabledState: Boolean(options.expectedAccount),
                 now,
             };
         });
+        if (options.expectedAccount && writes.length !== 1) {
+            throw new CodexValidationError("Targeted re-authentication accepts exactly one OAuth result. No saved credentials were changed.");
+        }
+        const expectedAccountIndex = options.expectedAccount && stored
+            ? resolveExpectedAccountIndex(stored.accounts, options.expectedAccount, options.expectedAccountIndex)
+            : undefined;
+        if (options.expectedAccount && expectedAccountIndex === undefined) {
+            throw new CodexValidationError("The requested Codex account is no longer present. No saved credentials were changed.");
+        }
+        const expectedAccount = options.expectedAccount;
+        if (expectedAccount &&
+            writes.some((write) => !sameExpectedLoginIdentity(write, expectedAccount))) {
+            throw new CodexValidationError("The authenticated Codex identity does not match the account requested for re-authentication. No saved credentials were changed.");
+        }
         const { accounts, activeIndex, outcome } = applyAccountPoolResults({
             existing,
             writes,
             priorActiveIndex: stored?.activeIndex,
-            findMatchingAccountIndex,
+            findMatchingAccountIndex: expectedAccountIndex === undefined
+                ? findMatchingAccountIndex
+                : () => expectedAccountIndex,
         });
+        const nextActiveIndex = options.preserveSelection &&
+            validSelectionIndex(stored?.activeIndex, accounts)
+            ? stored.activeIndex
+            : activeIndex;
+        const priorActiveIndex = stored?.activeIndex;
         const activeIndexByFamily = {};
         for (const family of MODEL_FAMILIES) {
-            activeIndexByFamily[family] = activeIndex;
+            const storedFamilyIndex = stored?.activeIndexByFamily?.[family];
+            const priorFamilyIndex = storedFamilyIndex ?? priorActiveIndex;
+            if (!validSelectionIndex(priorFamilyIndex, accounts)) {
+                activeIndexByFamily[family] = nextActiveIndex;
+                continue;
+            }
+            if (options.preserveSelection) {
+                activeIndexByFamily[family] = priorFamilyIndex;
+                continue;
+            }
+            // A family the user deliberately pointed at a DIFFERENT account than
+            // the global selection is a setting of its own, and a plain login must
+            // not silently drag it onto the account just signed in: adding a third
+            // account used to move a deliberate `codex-max -> account 2` binding
+            // onto account 3. Families that were merely following the global
+            // selection keep following it, which is what makes a plain login still
+            // feel like "this new account is now the one in use".
+            //
+            // Indices stay meaningful here because login only updates a row in
+            // place or appends one; it never reorders or removes the pool.
+            const followedGlobalSelection = storedFamilyIndex === undefined || storedFamilyIndex === priorActiveIndex;
+            activeIndexByFamily[family] = followedGlobalSelection
+                ? nextActiveIndex
+                : priorFamilyIndex;
         }
-        await persist({
-            version: 3,
-            accounts,
-            activeIndex,
-            activeIndexByFamily,
-        });
-        return outcome;
+        // Reuse the shared persistence clone so the pin/affinity carry-over rule
+        // (issue #474) keeps living in exactly one place instead of being
+        // re-derived at every write site with a slightly different validity check.
+        const nextStorage = cloneAccountStorageForPersistence(stored);
+        nextStorage.accounts = accounts;
+        nextStorage.activeIndex = nextActiveIndex;
+        nextStorage.activeIndexByFamily = activeIndexByFamily;
+        // A selection-preserving login leaves the pool exactly where it was, so a
+        // manual `switch <n>` pin survives it: login only updates a row in place
+        // or appends one and never reorders, so the raw position still points at
+        // the row the user pinned even when two rows share an identity.
+        //
+        // A plain login is the opposite. It moves activeIndex onto the account
+        // just signed in and publishes that account to ~/.codex/auth.json.
+        // Carrying an old pin through it would leave storage claiming one account
+        // is active while the runtime proxy routes every request to another
+        // (runtime-rotation-proxy resolves pinnedAccountIndex first) -- the
+        // contradiction `status` reports as "runtime using N but pin requests M".
+        if (!options.preserveSelection ||
+            !validSelectionIndex(nextStorage.pinnedAccountIndex, accounts)) {
+            delete nextStorage.pinnedAccountIndex;
+        }
+        await persist(nextStorage);
+        if (outcome === null)
+            return null;
+        return {
+            outcome,
+            accountIndex: activeIndex,
+            activeIndex: nextActiveIndex,
+            // The Codex CLI reads the `codex` family selection, so that -- not the
+            // bare global index -- decides whether this write owns the native
+            // ~/.codex/auth.json credentials.
+            isActiveAccount: activeIndex === (activeIndexByFamily.codex ?? nextActiveIndex),
+            accountEnabled: accounts[activeIndex]?.enabled !== false,
+        };
     });
 }
 /** @internal */

package/dist/lib/policy/runtime-policy.d.ts

@@ -7,6 +7,13 @@ export interface RuntimePolicyAccount {
     index: number;
     accountId?: string | null;
     email?: string | null;
+    /**
+     * Only used to key account policy for an account with no accountId and no
+     * email. Without it the runtime would key such an account as "unknown"
+     * while the CLI keys it by refresh-token digest, and pause/drain/tag state
+     * written by one would be invisible to the other.
+     */
+    refreshToken?: string | null;
 }
 export interface RuntimePolicyDecision {
     allowed: boolean;

package/dist/lib/policy/runtime-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-policy.d.ts","sourceRoot":"","sources":["../../../lib/policy/runtime-policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAErE,OAAO,EAGN,KAAK,kBAAkB,EACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAKN,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAEN,KAAK,4BAA4B,EACjC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACN,oBAAoB,EAGpB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,WAAW,oBAAoB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,qBAAqB;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,qBAAqB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACnC,qBAAqB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/C,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,iBAAiB,EAAE,qBAAqB,EAAE,CAAC;CAC3C;AAED,MAAM,WAAW,kBAAkB;IAClC,eAAe,EAAE,kBAAkB,CAAC;IACpC,OAAO,EAAE,gBAAgB,CAAC;IAC1B,OAAO,EAAE,4BAA4B,CAAC;CACtC;AAED,MAAM,WAAW,oBAAoB;IACpC,MAAM,EAAE,CAAC,KAAK,EAAE,uBAAuB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,WAAW,EAAE,MAAM,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,uBAAuB;IACvC,OAAO,EAAE,kBAAkB,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,OAAO,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACtC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,wBAAsB,sBAAsB,CAC3C,QAAQ,SAAgB,GACtB,OAAO,CAAC,kBAAkB,CAAC,CAO7B;AA6DD,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IAClD,KAAK,EAAE,kBAAkB,CAAC;IAC1B,QAAQ,EAAE,oBAAoB,EAAE,CAAC;IACjC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,gBAAgB,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAChD,GAAG,CAAC,EAAE,MAAM,CAAC;CACb,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA4GjC;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAAE;IACjD,MAAM,EAAE,iBAAiB,CAAC;IAC1B,SAAS,EAAE,oBAAoB,CAAC;IAChC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,oBAAoB,CAAC;CACrC,GAAG,oBAAoB,CAgCvB"}
+{"version":3,"file":"runtime-policy.d.ts","sourceRoot":"","sources":["../../../lib/policy/runtime-policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAErE,OAAO,EAGN,KAAK,kBAAkB,EACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAKN,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAEN,KAAK,4BAA4B,EACjC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACN,oBAAoB,EAGpB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,WAAW,oBAAoB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,qBAAqB;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,qBAAqB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACnC,qBAAqB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/C,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,iBAAiB,EAAE,qBAAqB,EAAE,CAAC;CAC3C;AAED,MAAM,WAAW,kBAAkB;IAClC,eAAe,EAAE,kBAAkB,CAAC;IACpC,OAAO,EAAE,gBAAgB,CAAC;IAC1B,OAAO,EAAE,4BAA4B,CAAC;CACtC;AAED,MAAM,WAAW,oBAAoB;IACpC,MAAM,EAAE,CAAC,KAAK,EAAE,uBAAuB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,WAAW,EAAE,MAAM,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,uBAAuB;IACvC,OAAO,EAAE,kBAAkB,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,OAAO,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACtC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,wBAAsB,sBAAsB,CAC3C,QAAQ,SAAgB,GACtB,OAAO,CAAC,kBAAkB,CAAC,CAO7B;AA6DD,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IAClD,KAAK,EAAE,kBAAkB,CAAC;IAC1B,QAAQ,EAAE,oBAAoB,EAAE,CAAC;IACjC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,gBAAgB,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAChD,GAAG,CAAC,EAAE,MAAM,CAAC;CACb,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA6GjC;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAAE;IACjD,MAAM,EAAE,iBAAiB,CAAC;IAC1B,SAAS,EAAE,oBAAoB,CAAC;IAChC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,oBAAoB,CAAC;CACrC,GAAG,oBAAoB,CAgCvB"}

package/dist/lib/policy/runtime-policy.js

@@ -98,6 +98,7 @@ export async function evaluateRuntimePolicy(input) {
         const accountKey = getAccountPolicyKey({
             accountId: account.accountId ?? undefined,
             email: account.email ?? undefined,
+            refreshToken: account.refreshToken ?? undefined,
         }, account.index);
         const accountPolicy = input.state.accountPolicies.accounts[accountKey];
         let boost = 0;

package/dist/lib/request/fetch-helpers.d.ts

@@ -4,6 +4,7 @@
  */
 import { type FastSessionInputTrimPlan } from "./request-transformer.js";
 import type { UserConfig, RequestBody } from "../types.js";
+import type { UsageTokenCounts } from "../usage/types.js";
 export { shouldRefreshToken, refreshAndUpdateToken } from "./token-refresh.js";
 export { DEFAULT_UNSUPPORTED_CODEX_FALLBACK_CHAIN, extractUnsupportedCodexModelFromText, getUnsupportedCodexModelInfo, resolveUnsupportedCodexFallbackModel, shouldFallbackToGpt52OnUnsupportedGpt53, isEntitlementError, isWorkspaceDisabledError, createEntitlementErrorResponse, } from "./error-classification.js";
 export type { EntitlementError, UnsupportedCodexModelInfo, ResolveUnsupportedCodexFallbackOptions, } from "./error-classification.js";
@@ -70,6 +71,12 @@ export declare function handleErrorResponse(response: Response, options?: ErrorH
  */
 export declare function handleSuccessResponse(response: Response, isStreaming: boolean, options?: {
     onResponseId?: (responseId: string) => void;
+    /**
+     * Reports the upstream token counts once they are known, for the usage
+     * ledger. Fires from the SSE tee on the streaming path and from the
+     * assembled response on the non-streaming path.
+     */
+    onUsage?: (usage: UsageTokenCounts) => void;
     streamStallTimeoutMs?: number;
 }): Promise<Response>;
 //# sourceMappingURL=fetch-helpers.d.ts.map

package/dist/lib/request/fetch-helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fetch-helpers.d.ts","sourceRoot":"","sources":["../../../lib/request/fetch-helpers.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,EAIN,KAAK,wBAAwB,EAC7B,MAAM,0BAA0B,CAAC;AAMlC,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAiB3D,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC/E,OAAO,EACN,wCAAwC,EACxC,oCAAoC,EACpC,4BAA4B,EAC5B,oCAAoC,EACpC,uCAAuC,EACvC,kBAAkB,EAClB,wBAAwB,EACxB,8BAA8B,GAC9B,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACX,gBAAgB,EAChB,yBAAyB,EACzB,sCAAsC,GACtC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACN,iBAAiB,EACjB,kBAAkB,EAClB,yBAAyB,EACzB,2BAA2B,EAC3B,wBAAwB,GACxB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,YAAY,EACX,yBAAyB,EACzB,wBAAwB,GACxB,MAAM,cAAc,CAAC;AAEtB,MAAM,WAAW,aAAa;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;CACrB;AASD,MAAM,WAAW,8BAA8B;IAC9C,IAAI,EAAE,WAAW,CAAC;IAClB,WAAW,EAAE,WAAW,CAAC;IACzB,4BAA4B,CAAC,EAAE,wBAAwB,CAAC,MAAM,CAAC,CAAC;CAChE;AAED,MAAM,WAAW,mBAAmB;IAC5B,QAAQ,EAAE,QAAQ,CAAC;IACnB,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,SAAS,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,oBAAoB;IACpC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,wBAAwB,CAC7C,IAAI,EAAE,WAAW,GAAG,SAAS,EAC7B,GAAG,EAAE,MAAM,EACX,UAAU,EAAE,UAAU,EACtB,SAAS,UAAO,EAChB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,OAAO,CAAC,EAAE;IACT,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,mBAAmB,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC1C,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,6BAA6B,CAAC,EAAE,OAAO,CAAC;IACxC,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACnC,GACC,OAAO,CAAC,8BAA8B,GAAG,SAAS,CAAC,CA4FrD;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CACjC,QAAQ,EAAE,QAAQ,EAClB,OAAO,CAAC,EAAE,oBAAoB,GACnC,OAAO,CAAC,mBAAmB,CAAC,CA4C9B;AAED;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACvC,QAAQ,EAAE,QAAQ,EAClB,WAAW,EAAE,OAAO,EACpB,OAAO,CAAC,EAAE;IACZ,YAAY,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5C,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC9B,GACC,OAAO,CAAC,QAAQ,CAAC,CAanB"}
+{"version":3,"file":"fetch-helpers.d.ts","sourceRoot":"","sources":["../../../lib/request/fetch-helpers.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,EAIN,KAAK,wBAAwB,EAC7B,MAAM,0BAA0B,CAAC;AAMlC,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAiB1D,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC/E,OAAO,EACN,wCAAwC,EACxC,oCAAoC,EACpC,4BAA4B,EAC5B,oCAAoC,EACpC,uCAAuC,EACvC,kBAAkB,EAClB,wBAAwB,EACxB,8BAA8B,GAC9B,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACX,gBAAgB,EAChB,yBAAyB,EACzB,sCAAsC,GACtC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACN,iBAAiB,EACjB,kBAAkB,EAClB,yBAAyB,EACzB,2BAA2B,EAC3B,wBAAwB,GACxB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,YAAY,EACX,yBAAyB,EACzB,wBAAwB,GACxB,MAAM,cAAc,CAAC;AAEtB,MAAM,WAAW,aAAa;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;CACrB;AASD,MAAM,WAAW,8BAA8B;IAC9C,IAAI,EAAE,WAAW,CAAC;IAClB,WAAW,EAAE,WAAW,CAAC;IACzB,4BAA4B,CAAC,EAAE,wBAAwB,CAAC,MAAM,CAAC,CAAC;CAChE;AAED,MAAM,WAAW,mBAAmB;IAC5B,QAAQ,EAAE,QAAQ,CAAC;IACnB,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,SAAS,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,oBAAoB;IACpC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,wBAAwB,CAC7C,IAAI,EAAE,WAAW,GAAG,SAAS,EAC7B,GAAG,EAAE,MAAM,EACX,UAAU,EAAE,UAAU,EACtB,SAAS,UAAO,EAChB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,OAAO,CAAC,EAAE;IACT,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,mBAAmB,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC1C,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,6BAA6B,CAAC,EAAE,OAAO,CAAC;IACxC,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACnC,GACC,OAAO,CAAC,8BAA8B,GAAG,SAAS,CAAC,CA4FrD;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CACjC,QAAQ,EAAE,QAAQ,EAClB,OAAO,CAAC,EAAE,oBAAoB,GACnC,OAAO,CAAC,mBAAmB,CAAC,CA4C9B;AAED;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACvC,QAAQ,EAAE,QAAQ,EAClB,WAAW,EAAE,OAAO,EACpB,OAAO,CAAC,EAAE;IACZ,YAAY,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5C;;;;OAIG;IACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,IAAI,CAAC;IAC5C,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC9B,GACC,OAAO,CAAC,QAAQ,CAAC,CAkBnB"}

package/dist/lib/request/fetch-helpers.js

@@ -155,7 +155,7 @@ export async function handleSuccessResponse(response, isStreaming, options) {
         return await convertSseToJson(response, responseHeaders, options);
     }
     // For streaming requests (streamText), return stream as-is
-    return attachResponseIdCapture(response, responseHeaders, options?.onResponseId);
+    return attachResponseIdCapture(response, responseHeaders, options?.onResponseId, options?.onUsage);
 }
 async function safeReadBody(response) {
     try {

package/dist/lib/request/response-handler.d.ts

@@ -1,3 +1,4 @@
+import type { UsageTokenCounts } from "../usage/types.js";
 /**
  * Convert SSE stream response to JSON for generateText()
  * @param response - Fetch response with SSE stream
@@ -6,6 +7,7 @@
  */
 export declare function convertSseToJson(response: Response, headers: Headers, options?: {
     onResponseId?: (responseId: string) => void;
+    onUsage?: (usage: UsageTokenCounts) => void;
     streamStallTimeoutMs?: number;
 }): Promise<Response>;
 /**
@@ -21,5 +23,5 @@ export declare function ensureContentType(headers: Headers): Headers;
  * @returns True if response should be considered empty/malformed
  */
 export declare function isEmptyResponse(body: unknown): boolean;
-export declare function attachResponseIdCapture(response: Response, headers: Headers, onResponseId?: (responseId: string) => void): Response;
+export declare function attachResponseIdCapture(response: Response, headers: Headers, onResponseId?: (responseId: string) => void, onUsage?: (usage: UsageTokenCounts) => void): Response;
 //# sourceMappingURL=response-handler.d.ts.map

package/dist/lib/request/response-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"response-handler.d.ts","sourceRoot":"","sources":["../../../lib/request/response-handler.ts"],"names":[],"mappings":"AAwwBA;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACrC,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE;IACT,YAAY,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5C,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC9B,GACC,OAAO,CAAC,QAAQ,CAAC,CA2HnB;AA6DD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAQ3D;AA2BD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CA4CtD;AAED,wBAAgB,uBAAuB,CACtC,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,YAAY,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,IAAI,GACzC,QAAQ,CAiBV"}
+{"version":3,"file":"response-handler.d.ts","sourceRoot":"","sources":["../../../lib/request/response-handler.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAqwB1D;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACrC,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE;IACT,YAAY,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5C,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,IAAI,CAAC;IAC5C,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC9B,GACC,OAAO,CAAC,QAAQ,CAAC,CAkInB;AAwED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAQ3D;AA2BD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CA4CtD;AAED,wBAAgB,uBAAuB,CACtC,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,YAAY,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,IAAI,EAC3C,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,IAAI,GACzC,QAAQ,CAiBV"}

package/dist/lib/request/response-handler.js

@@ -1,6 +1,7 @@
 import { createLogger, logRequest, LOGGING_ENABLED } from "../logger.js";
 import { HTTP_STATUS, PLUGIN_NAME } from "../constants.js";
 import { isRecord } from "../utils.js";
+import { extractResponsesUsage } from "../usage/usage-extraction.js";
 const log = createLogger("response-handler");
 const MAX_SSE_SIZE = 10 * 1024 * 1024; // 10MB limit to prevent memory exhaustion
 const DEFAULT_STREAM_STALL_TIMEOUT_MS = 45_000;
@@ -663,6 +664,15 @@ export async function convertSseToJson(response, headers, options) {
             });
         }
         logStreamDiagnostics(finalResponse);
+        if (options?.onUsage) {
+            // The non-streaming branch already holds the assembled response, so
+            // the token counts come straight off it. Reported even though the
+            // caller sees JSON rather than SSE: the usage ledger (and therefore
+            // the maxTokens / maxCostUsd budget caps) needs both shapes.
+            const usage = extractResponsesUsage(finalResponse);
+            if (usage)
+                options.onUsage(usage);
+        }
         // Return as plain JSON (not SSE)
         const jsonHeaders = new Headers(headers);
         jsonHeaders.set("content-type", "application/json; charset=utf-8");
@@ -685,7 +695,7 @@ export async function convertSseToJson(response, headers, options) {
         reader.releaseLock();
     }
 }
-function createResponseIdCapturingStream(body, onResponseId) {
+function createResponseIdCapturingStream(body, onResponseId, onUsage) {
     const decoder = new TextDecoder();
     let bufferedText = "";
     let loggedMalformedStreamChunk = false;
@@ -709,7 +719,18 @@ function createResponseIdCapturingStream(body, onResponseId) {
                 continue;
             try {
                 const data = JSON.parse(payload);
-                maybeCaptureResponseEvent(state, data, onResponseId);
+                if (onResponseId) {
+                    maybeCaptureResponseEvent(state, data, onResponseId);
+                }
+                if (onUsage) {
+                    // Reuse the JSON this loop already parsed rather than scanning
+                    // the stream twice. Without these counts every usage-ledger row
+                    // lands with zero tokens and zero cost, which silently disables
+                    // the maxTokens / maxCostUsd budget caps.
+                    const usage = extractResponsesUsage(data);
+                    if (usage)
+                        onUsage(usage);
+                }
                 if (state.encounteredError)
                     break;
             }
@@ -812,15 +833,15 @@ export function isEmptyResponse(body) {
     }
     return false;
 }
-export function attachResponseIdCapture(response, headers, onResponseId) {
-    if (!response.body || !onResponseId) {
+export function attachResponseIdCapture(response, headers, onResponseId, onUsage) {
+    if (!response.body || (!onResponseId && !onUsage)) {
         return new Response(response.body, {
             status: response.status,
             statusText: response.statusText,
             headers,
         });
     }
-    return new Response(createResponseIdCapturingStream(response.body, onResponseId), {
+    return new Response(createResponseIdCapturingStream(response.body, onResponseId, onUsage), {
         status: response.status,
         statusText: response.statusText,
         headers,

package/dist/lib/request/stream-failover-runtime.d.ts

@@ -4,5 +4,12 @@ export declare const HOP_BY_HOP_HEADERS: Set<string>;
 export declare function responseHeadersForClient(upstreamHeaders: Headers): Record<string, string>;
 export declare function withTimeout<T>(promise: Promise<T>, timeoutMs: number, onTimeout: () => void, message: string): Promise<T>;
 export declare function readErrorBody(response: Response, timeoutMs: number, maxBytes?: number): Promise<string>;
-export declare function forwardStreamingResponse(upstream: Response, res: ServerResponse, status: RuntimeRotationProxyStatus, onStreamError: () => void, streamStallTimeoutMs: number): Promise<boolean>;
+export declare function forwardStreamingResponse(upstream: Response, res: ServerResponse, status: RuntimeRotationProxyStatus, onStreamError: () => void, streamStallTimeoutMs: number, 
+/**
+ * Observe each forwarded chunk. Used to recover the upstream `usage` totals
+ * for the usage ledger without buffering the body; it must not mutate the
+ * chunk and is called before the write, so a slow observer delays the
+ * forward. Implementations are expected to swallow their own errors.
+ */
+onChunk?: (chunk: Uint8Array) => void): Promise<boolean>;
 //# sourceMappingURL=stream-failover-runtime.d.ts.map

package/dist/lib/request/stream-failover-runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stream-failover-runtime.d.ts","sourceRoot":"","sources":["../../../lib/request/stream-failover-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AAEtF,eAAO,MAAM,kBAAkB,aAW7B,CAAC;AAWH,wBAAgB,wBAAwB,CAAC,eAAe,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAUzF;AAED,wBAAsB,WAAW,CAAC,CAAC,EAClC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EACnB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,IAAI,EACrB,OAAO,EAAE,MAAM,GACb,OAAO,CAAC,CAAC,CAAC,CAmBZ;AAED,wBAAsB,aAAa,CAClC,QAAQ,EAAE,QAAQ,EAClB,SAAS,EAAE,MAAM,EACjB,QAAQ,SAAc,GACpB,OAAO,CAAC,MAAM,CAAC,CAuDjB;AAoBD,wBAAsB,wBAAwB,CAC7C,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,0BAA0B,EAClC,aAAa,EAAE,MAAM,IAAI,EACzB,oBAAoB,EAAE,MAAM,GAC1B,OAAO,CAAC,OAAO,CAAC,CAqDlB"}
+{"version":3,"file":"stream-failover-runtime.d.ts","sourceRoot":"","sources":["../../../lib/request/stream-failover-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AAEtF,eAAO,MAAM,kBAAkB,aAW7B,CAAC;AAWH,wBAAgB,wBAAwB,CAAC,eAAe,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAUzF;AAED,wBAAsB,WAAW,CAAC,CAAC,EAClC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EACnB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,IAAI,EACrB,OAAO,EAAE,MAAM,GACb,OAAO,CAAC,CAAC,CAAC,CAmBZ;AAED,wBAAsB,aAAa,CAClC,QAAQ,EAAE,QAAQ,EAClB,SAAS,EAAE,MAAM,EACjB,QAAQ,SAAc,GACpB,OAAO,CAAC,MAAM,CAAC,CAuDjB;AAoBD,wBAAsB,wBAAwB,CAC7C,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,0BAA0B,EAClC,aAAa,EAAE,MAAM,IAAI,EACzB,oBAAoB,EAAE,MAAM;AAC5B;;;;;GAKG;AACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,GACnC,OAAO,CAAC,OAAO,CAAC,CAsDlB"}

package/dist/lib/request/stream-failover-runtime.js

@@ -128,7 +128,14 @@ function waitForDrain(res) {
         res.once("error", settle);
     });
 }
-export async function forwardStreamingResponse(upstream, res, status, onStreamError, streamStallTimeoutMs) {
+export async function forwardStreamingResponse(upstream, res, status, onStreamError, streamStallTimeoutMs, 
+/**
+ * Observe each forwarded chunk. Used to recover the upstream `usage` totals
+ * for the usage ledger without buffering the body; it must not mutate the
+ * chunk and is called before the write, so a slow observer delays the
+ * forward. Implementations are expected to swallow their own errors.
+ */
+onChunk) {
     status.streamsStarted += 1;
     res.writeHead(upstream.status, responseHeadersForClient(upstream.headers));
     if (!upstream.body) {
@@ -149,6 +156,7 @@ export async function forwardStreamingResponse(upstream, res, status, onStreamEr
             if (done)
                 break;
             if (value && value.byteLength > 0) {
+                onChunk?.(value);
                 // If the response is already finished (clean end by a concurrent
                 // close-then-reader-cancel path), stop writing. Do NOT guard on
                 // res.destroyed here: a socket-error-during-backpressure scenario sets

package/dist/lib/request/stream-failover.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stream-failover.d.ts","sourceRoot":"","sources":["../../../lib/request/stream-failover.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,qBAAqB;IACrC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAkGD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CACpC,eAAe,EAAE,QAAQ,EACzB,mBAAmB,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,EACxF,OAAO,GAAE,qBAA0B,GACjC,QAAQ,CA4HV"}
+{"version":3,"file":"stream-failover.d.ts","sourceRoot":"","sources":["../../../lib/request/stream-failover.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,qBAAqB;IACrC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAkGD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CACpC,eAAe,EAAE,QAAQ,EACzB,mBAAmB,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,EACxF,OAAO,GAAE,qBAA0B,GACjC,QAAQ,CAuKV"}

package/dist/lib/request/stream-failover.js

@@ -117,6 +117,34 @@ export function withStreamingFailover(initialResponse, getFallbackResponse, opti
     }
     let closed = false;
     let releaseCurrentReaderForCancel = null;
+    // Backpressure. `pump()` runs from `start()` as a free-running loop, so
+    // without a demand signal it enqueues every chunk upstream delivers as fast
+    // as it arrives and the whole stream buffers in memory for a slow consumer.
+    // `pull()` (and cancellation) release the loop; the sibling forwarder in
+    // stream-failover-runtime.ts gets the same guarantee from waitForDrain.
+    let demandWaiter = null;
+    let demandPending = false;
+    const signalDemand = () => {
+        if (demandWaiter) {
+            demandWaiter();
+            return;
+        }
+        // `pull()` can fire before the loop parks. Latch it, or the next
+        // awaitDemand() would block on a signal that already happened.
+        demandPending = true;
+    };
+    const awaitDemand = () => {
+        if (demandPending || closed) {
+            demandPending = false;
+            return Promise.resolve();
+        }
+        return new Promise((resolve) => {
+            demandWaiter = () => {
+                demandWaiter = null;
+                resolve();
+            };
+        });
+    };
     const body = new ReadableStream({
         start(controller) {
             let currentReader = initialResponse.body?.getReader() ?? null;
@@ -174,6 +202,13 @@ export function withStreamingFailover(initialResponse, getFallbackResponse, opti
                         if (result.value && result.value.byteLength > 0) {
                             emittedBytes += result.value.byteLength;
                             controller.enqueue(result.value);
+                            // Park until the consumer asks for more. desiredSize is
+                            // null once the controller is errored or closed, and the
+                            // loop's own `closed` checks cover that case.
+                            if (typeof controller.desiredSize === "number" &&
+                                controller.desiredSize <= 0) {
+                                await awaitDemand();
+                            }
                         }
                     }
                     catch (error) {
@@ -206,8 +241,14 @@ export function withStreamingFailover(initialResponse, getFallbackResponse, opti
                 }
             });
         },
+        pull() {
+            signalDemand();
+        },
         cancel() {
             closed = true;
+            // Release a parked pump so it observes `closed` and unwinds instead
+            // of holding the upstream reader open for a demand that never comes.
+            signalDemand();
             if (releaseCurrentReaderForCancel) {
                 void releaseCurrentReaderForCancel();
             }

package/dist/lib/runtime/account-check.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account-check.d.ts","sourceRoot":"","sources":["../../../lib/runtime/account-check.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EACN,KAAK,gBAAgB,EACrB,KAAK,wBAAwB,EAE7B,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAE7D,wBAAsB,sBAAsB,CAC3C,SAAS,EAAE,OAAO,EAClB,IAAI,EAAE;IACL,aAAa,EAAE,CACd,OAAO,EAAE,gBAAgB,GAAG,IAAI,KAC5B,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACtC,YAAY,EAAE,MAAM,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACrD,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;IAC3C,mBAAmB,EAAE,MAAM,OAAO,CAAC;QAClC,OAAO,EAAE,CAAC,CAAC;QACX,QAAQ,EAAE,wBAAwB,EAAE,CAAC;KACrC,CAAC,CAAC;IACH,8BAA8B,EAAE,CAAC,cAAc,EAAE;QAChD,OAAO,EAAE,CAAC,CAAC;QACX,QAAQ,EAAE,wBAAwB,EAAE,CAAC;KACrC,KAAK,wBAAwB,CAAC;IAC/B,2BAA2B,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAChE;QACA,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,WAAW,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;KAClB,GACD,IAAI,GACJ,SAAS,CACX,CAAC;IACF,gBAAgB,EAAE,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,KAAK,MAAM,GAAG,SAAS,CAAC;IAC1E,8BAA8B,EAAE,CAC/B,MAAM,EAAE,eAAe,GAAG,SAAS,EACnC,gBAAgB,EAAE,MAAM,GAAG,SAAS,KAChC,OAAO,CAAC;IACb,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,KAAK,MAAM,GAAG,SAAS,CAAC;IACjE,mBAAmB,EAAE,CACpB,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,KACxB,MAAM,GAAG,SAAS,CAAC;IACxB,aAAa,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9D,yBAAyB,EAAE,CAC1B,OAAO,EAAE,OAAO,CAAC,WAAW,EAAE;QAAE,IAAI,EAAE,QAAQ,CAAA;KAAE,CAAC,KAC7C,OAAO,CAAC;IACb,uBAAuB,EAAE,CAAC,MAAM,EAAE;QACjC,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;KACpB,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAClC,uBAAuB,EAAE,CACxB,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,eAAe,EAAE,eAAe,GAAG,SAAS,EAC5C,cAAc,EAAE,MAAM,GAAG,SAAS,KAC9B,MAAM,GAAG,SAAS,CAAC;IACxB,oBAAoB,EAAE,CAAC,QAAQ,EAAE,kBAAkB,KAAK,MAAM,CAAC;IAC/D,yBAAyB,EAAE,CAC1B,OAAO,EAAE,gBAAgB,EACzB,aAAa,EAAE,SAAS,WAAW,EAAE,KACjC,IAAI,CAAC;IACV,cAAc,EAAE,SAAS,WAAW,EAAE,CAAC;IACvC,YAAY,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,6BAA6B,EAAE,MAAM,IAAI,CAAC;IAC1C,mBAAmB,EAAE,CAAC,OAAO,EAAE;QAC9B,OAAO,EAAE,CAAC,CAAC;QACX,QAAQ,EAAE,wBAAwB,EAAE,CAAC;KACrC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpB,+BAA+B,CAAC,EAAE,CACjC,cAAc,EAAE,gBAAgB,EAChC,cAAc,EAAE;QACf,OAAO,EAAE,CAAC,CAAC;QACX,QAAQ,EAAE,wBAAwB,EAAE,CAAC;KACrC,KACG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACpC,GACC,OAAO,CAAC,IAAI,CAAC,CAoSf"}
+{"version":3,"file":"account-check.d.ts","sourceRoot":"","sources":["../../../lib/runtime/account-check.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EACN,KAAK,gBAAgB,EAErB,KAAK,wBAAwB,EAE7B,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAE7D,wBAAsB,sBAAsB,CAC3C,SAAS,EAAE,OAAO,EAClB,IAAI,EAAE;IACL,aAAa,EAAE,CACd,OAAO,EAAE,gBAAgB,GAAG,IAAI,KAC5B,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACtC,YAAY,EAAE,MAAM,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACrD,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;IAC3C,mBAAmB,EAAE,MAAM,OAAO,CAAC;QAClC,OAAO,EAAE,CAAC,CAAC;QACX,QAAQ,EAAE,wBAAwB,EAAE,CAAC;KACrC,CAAC,CAAC;IACH,8BAA8B,EAAE,CAAC,cAAc,EAAE;QAChD,OAAO,EAAE,CAAC,CAAC;QACX,QAAQ,EAAE,wBAAwB,EAAE,CAAC;KACrC,KAAK,wBAAwB,CAAC;IAC/B,2BAA2B,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAChE;QACA,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,WAAW,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;KAClB,GACD,IAAI,GACJ,SAAS,CACX,CAAC;IACF,gBAAgB,EAAE,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,KAAK,MAAM,GAAG,SAAS,CAAC;IAC1E,8BAA8B,EAAE,CAC/B,MAAM,EAAE,eAAe,GAAG,SAAS,EACnC,gBAAgB,EAAE,MAAM,GAAG,SAAS,KAChC,OAAO,CAAC;IACb,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,KAAK,MAAM,GAAG,SAAS,CAAC;IACjE,mBAAmB,EAAE,CACpB,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,KACxB,MAAM,GAAG,SAAS,CAAC;IACxB,aAAa,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9D,yBAAyB,EAAE,CAC1B,OAAO,EAAE,OAAO,CAAC,WAAW,EAAE;QAAE,IAAI,EAAE,QAAQ,CAAA;KAAE,CAAC,KAC7C,OAAO,CAAC;IACb,uBAAuB,EAAE,CAAC,MAAM,EAAE;QACjC,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;KACpB,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAClC,uBAAuB,EAAE,CACxB,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,eAAe,EAAE,eAAe,GAAG,SAAS,EAC5C,cAAc,EAAE,MAAM,GAAG,SAAS,KAC9B,MAAM,GAAG,SAAS,CAAC;IACxB,oBAAoB,EAAE,CAAC,QAAQ,EAAE,kBAAkB,KAAK,MAAM,CAAC;IAC/D,yBAAyB,EAAE,CAC1B,OAAO,EAAE,gBAAgB,EACzB,aAAa,EAAE,SAAS,WAAW,EAAE,KACjC,IAAI,CAAC;IACV,cAAc,EAAE,SAAS,WAAW,EAAE,CAAC;IACvC,YAAY,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,6BAA6B,EAAE,MAAM,IAAI,CAAC;IAC1C,mBAAmB,EAAE,CAAC,OAAO,EAAE;QAC9B,OAAO,EAAE,CAAC,CAAC;QACX,QAAQ,EAAE,wBAAwB,EAAE,CAAC;KACrC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpB,+BAA+B,CAAC,EAAE,CACjC,cAAc,EAAE,gBAAgB,EAChC,cAAc,EAAE;QACf,OAAO,EAAE,CAAC,CAAC;QACX,QAAQ,EAAE,wBAAwB,EAAE,CAAC;KACrC,KACG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACpC,GACC,OAAO,CAAC,IAAI,CAAC,CA2Sf"}

package/dist/lib/runtime/account-check.js

@@ -1,7 +1,7 @@
 import { maskEmail } from "../logger.js";
 import { CODEX_UNAVAILABLE_PROBE_NOTE } from "../quota-probe.js";
 import { isCodexUnavailableError } from "../errors.js";
-import { reconcilePinnedAccountIndex, } from "../storage.js";
+import { bumpStorageAffinityGeneration, reconcilePinnedAccountIndex, } from "../storage.js";
 export async function runRuntimeAccountCheck(deepProbe, deps) {
     const loadedStorage = await deps.hydrateEmails(await deps.loadAccounts());
     const workingStorage = loadedStorage
@@ -195,6 +195,13 @@ export async function runRuntimeAccountCheck(deepProbe, deps) {
         workingStorage.accounts = workingStorage.accounts.filter((account) => !state.removeFromActive.has(account.refreshToken));
         deps.clampRuntimeActiveIndices(workingStorage, deps.MODEL_FAMILIES);
         workingStorage.pinnedAccountIndex = reconcilePinnedAccountIndex(pinnedAccount, workingStorage.accounts);
+        // The filter can drop several accounts at once, shifting every index
+        // after each hole. Session affinity remembers accounts BY INDEX, so
+        // without a generation bump a live proxy keeps routing in-flight
+        // sessions to whatever now occupies the old slot — and this path is
+        // AUTOMATIC (revoked-token accounts are removed without a prompt), so
+        // nothing else invalidates the affinity map. See issue #474.
+        bumpStorageAffinityGeneration(workingStorage);
         state.storageChanged = true;
     }
     const persistAccountAndFlaggedStorage = deps.persistAccountAndFlaggedStorage;

package/dist/lib/runtime-rotation-proxy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-rotation-proxy.d.ts","sourceRoot":"","sources":["../../lib/runtime-rotation-proxy.ts"],"names":[],"mappings":"AAGA,OAAO,EAIN,KAAK,cAAc,EACnB,MAAM,eAAe,CAAC;AA8BvB,OAAO,EAAkB,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AA4CtE,OAAO,KAAK,EAKX,2BAA2B,EAC3B,0BAA0B,EAE1B,MAAM,oCAAoC,CAAC;AAe5C,YAAY,EACX,2BAA2B,EAC3B,0BAA0B,EAC1B,0BAA0B,GAC1B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACN,+BAA+B,EAC/B,0BAA0B,GAC1B,MAAM,kCAAkC,CAAC;AAC1C,YAAY,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AACnF,OAAO,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAC;AACxE,OAAO,EACN,+BAA+B,EAC/B,8BAA8B,EAC9B,uBAAuB,EACvB,uBAAuB,GACvB,MAAM,oCAAoC,CAAC;AAC5C,YAAY,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAC;AA8DtE,kFAAkF;AAClF,wBAAgB,qBAAqB,CACpC,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,GAAG;IACvE,gFAAgF;IAChF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB,EACD,MAAM,EAAE,WAAW,EACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GACnB,MAAM,CAmBR;AA8bD;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAC1C,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,GACvC,MAAM,GAAG,IAAI,CAUf;AAED,wBAAsB,yBAAyB,CAC9C,OAAO,EAAE,2BAA2B,GAClC,OAAO,CAAC,0BAA0B,CAAC,CA4KrC"}
+{"version":3,"file":"runtime-rotation-proxy.d.ts","sourceRoot":"","sources":["../../lib/runtime-rotation-proxy.ts"],"names":[],"mappings":"AAGA,OAAO,EAIN,KAAK,cAAc,EACnB,MAAM,eAAe,CAAC;AA8BvB,OAAO,EAAkB,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AA6CtE,OAAO,KAAK,EAKX,2BAA2B,EAC3B,0BAA0B,EAE1B,MAAM,oCAAoC,CAAC;AAe5C,YAAY,EACX,2BAA2B,EAC3B,0BAA0B,EAC1B,0BAA0B,GAC1B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACN,+BAA+B,EAC/B,0BAA0B,GAC1B,MAAM,kCAAkC,CAAC;AAC1C,YAAY,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AACnF,OAAO,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAC;AACxE,OAAO,EACN,+BAA+B,EAC/B,8BAA8B,EAC9B,uBAAuB,EACvB,uBAAuB,GACvB,MAAM,oCAAoC,CAAC;AAC5C,YAAY,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAC;AA8DtE,kFAAkF;AAClF,wBAAgB,qBAAqB,CACpC,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,GAAG;IACvE,gFAAgF;IAChF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB,EACD,MAAM,EAAE,WAAW,EACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GACnB,MAAM,CAmBR;AA8bD;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAC1C,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,GACvC,MAAM,GAAG,IAAI,CAUf;AAED,wBAAsB,yBAAyB,CAC9C,OAAO,EAAE,2BAA2B,GAClC,OAAO,CAAC,0BAA0B,CAAC,CA4KrC"}