codex-multi-auth 2.8.7 → 2.9.1

package/dist/lib/runtime-rotation-proxy.js

@@ -8,6 +8,7 @@ import { getModelFamily } from "./prompts/codex.js";
 import { CURRENT_CODEX_MODEL } from "./request/helpers/model-map.js";
 import { mutateRuntimeObservabilitySnapshot, recordRuntimeAccountRecovery, recordRuntimePoolExhaustion, } from "./runtime/runtime-observability.js";
 import { createRuntimeUsageRecorder, evaluateRuntimePolicy, loadRuntimePolicyState, } from "./policy/runtime-policy.js";
+import { createUsageStreamScanner } from "./usage/usage-extraction.js";
 import { isWorkspaceDisabledError } from "./request/fetch-helpers.js";
 import { PreemptiveQuotaScheduler, readQuotaSchedulerSnapshot, } from "./preemptive-quota-scheduler.js";
 import { createLogger, maskString, runWithCorrelationId } from "./logger.js";
@@ -936,11 +937,35 @@ async function handleRequestInner(state, req, res, traceId) {
                 upstream = await withTimeout(state.fetchImpl(upstreamUrl, upstreamRequestInit), state.fetchTimeoutMs, () => fetchAbortController.abort(), `upstream fetch timed out after ${state.fetchTimeoutMs}ms`);
             }
             catch (error) {
-                state.status.lastError = error instanceof Error ? error.message : String(error);
+                // errors-logging-08: a custom fetchImpl, a proxy agent, or an undici
+                // cause chain can embed the request URL or credential material in the
+                // raw message, so mask before it reaches any state.status consumer.
+                const transportError = maskString(error instanceof Error ? error.message : String(error));
+                state.status.lastError = transportError;
+                // errors-logging-01: give the failure a structured, trace-correlated
+                // line instead of only a last-write-wins status string. Nothing else
+                // on this path reaches proxyLog, because the request does not throw.
+                proxyLog.error("upstream transport failure", {
+                    traceId,
+                    code: "codex_runtime_rotation_transport_error",
+                    error: transportError,
+                });
                 accountManager.refundToken(refreshed.account, context.family, context.model);
-                accountManager.recordFailure(refreshed.account, context.family, context.model);
+                // A pre-header transport exception is a property of the network path,
+                // not of this account's credentials or quota, so it must NOT feed the
+                // account's circuit breaker / health tracker: that is what would
+                // otherwise retire a healthy account for an outage it did not cause.
+                // See #677.
+                //
+                // The short timed cooldown IS still applied. It is self-healing, it
+                // keeps an account whose upstream hangs from stalling 1/N of every
+                // later request for the full fetch timeout, and it is what gives the
+                // exhaustion 503 a non-zero `retry_after_ms` to back the client off
+                // with (`getMinWaitTimeForFamily` returns 0 while any account is
+                // still selectable).
                 accountManager.markAccountCoolingDown(refreshed.account, state.networkErrorCooldownMs, "network-error");
                 accountManager.saveToDiskDebounced();
+                accountSkipReasons.set(refreshed.account.index, "network-error");
                 exhaustionReason = "network-error";
                 transientAttempts += 1;
                 transientExhaustionReason = "network-error";
@@ -1152,17 +1177,35 @@ async function handleRequestInner(state, req, res, traceId) {
                 state.lastGlobalSwitchAt = state.now();
             }
             await persistRuntimeActiveAccount(accountManager, refreshed.account, context.family, isPinned && refreshed.account.index === pinnedIndex, state.schedulingStrategy);
+            // Recover the upstream token counts as the body streams past. Without
+            // them every ledger row lands with all-zero tokens and a zero cost, so
+            // evaluateBudgetGuard compares `0 >= limit` for maxTokens/maxCostUsd
+            // and those caps never fire — `budget set --cost 50` would allow
+            // unlimited spend, with only --requests actually enforced.
+            const usageScanner = createUsageStreamScanner({
+                contentType: upstream.headers.get("content-type"),
+            });
             const forwarded = await forwardStreamingResponse(upstream, res, state.status, () => {
+                // Deliberately NOT the pre-header transport policy above,
+                // which skips recordFailure (#677). By this point the
+                // upstream accepted the request and began responding, so a
+                // broken stream is a signal about THIS account's session
+                // (upstream tearing it down) rather than about the shared
+                // network path, and it should still credit the breaker.
                 accountManager.recordFailure(refreshed.account, context.family, context.model);
                 accountManager.markAccountCoolingDown(refreshed.account, state.networkErrorCooldownMs, "network-error");
                 state.sessionAffinityStore?.forgetSession(context.sessionKey);
                 accountManager.saveToDiskDebounced();
-            }, state.streamStallTimeoutMs);
+            }, state.streamStallTimeoutMs, usageScanner.push);
+            // A stream that broke mid-flight still bills for whatever the upstream
+            // reported before the break, so record the counts on both outcomes.
+            const usageTokens = usageScanner.result();
             await usageRecorder.record({
                 outcome: forwarded ? "success" : "failure",
                 statusCode: upstream.status,
                 errorCode: forwarded ? null : "stream_forward_failed",
                 account: refreshed.account,
+                ...(usageTokens ?? {}),
             });
             return;
         }

package/dist/lib/storage.d.ts

@@ -83,6 +83,25 @@ export declare function normalizeAccountStorage(data: unknown): AccountStorageV3
  * helper only narrows the lost-update window. See issue #474.
  */
 export declare function readAffinityGenerationFromDisk(path: string): number;
+/**
+ * Advance the session-affinity generation so a running runtime proxy drops its
+ * sticky session→account bindings on the next request.
+ *
+ * Session affinity remembers an account by ITS INDEX, so any mutation that
+ * reshuffles the pool (removing an account, restoring a backup) silently
+ * re-points every live session at a different account until the generation
+ * changes. `switch`/`best`/`unpin` already bump it; the reshuffling paths are
+ * the ones that need it most, because they move every index at once.
+ *
+ * Re-reads the on-disk generation first so concurrent CLI processes do not lose
+ * increments via lost-update on the load+mutate pair. `Math.max` keeps the
+ * counter monotonic: an extra bump only costs one additional affinity
+ * invalidation, while a missed bump lets the proxy cling to the wrong account.
+ * See issue #474.
+ */
+export declare function bumpStorageAffinityGeneration(storage: {
+    affinityGeneration?: number;
+}, storagePath?: string | null): number;
 /**
  * Synchronously reads both the top-level `pinnedAccountIndex` and
  * `affinityGeneration` fields from the accounts storage file. Used by

package/dist/lib/storage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../lib/storage.ts"],"names":[],"mappings":"AA+BA,OAAO,EACN,KAAK,cAAc,EAGnB,KAAK,iBAAiB,EAEtB,MAAM,8BAA8B,CAAC;AAkBtC,OAAO,EAEN,KAAK,oBAAoB,EACzB,MAAM,qBAAqB,CAAC;AAe7B,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EACN,sBAAsB,EACtB,cAAc,GACd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACN,qBAAqB,EACrB,iBAAiB,GACjB,MAAM,uBAAuB,CAAC;AAa/B,OAAO,KAAK,EACX,iBAAiB,EACjB,gBAAgB,EAChB,cAAc,EACd,wBAAwB,EACxB,uBAAuB,EACvB,gBAAgB,EAChB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAEN,KAAK,kBAAkB,EACvB,MAAM,4BAA4B,CAAC;AA2CpC,YAAY,EACX,oBAAoB,EACpB,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,wBAAwB,EACxB,uBAAuB,EACvB,cAAc,EACd,iBAAiB,EACjB,kBAAkB,GAClB,CAAC;AAcF,KAAK,WAAW,GAAG;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAiBF,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAE9D;AAuWD,wBAAgB,4BAA4B,IAAI,MAAM,CAErD;AAED,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CA4C/D;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAO9D;AAED;;;GAGG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAMvC;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAarE;AAED,wBAAsB,yBAAyB,CAC9C,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAC7B,OAAO,CAAC,gBAAgB,CAAC,CAe3B;AAED,wBAAsB,iBAAiB,CACtC,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAC3B,OAAO,CAAC,MAAM,CAAC,CAQjB;AAED,wBAAgB,sBAAsB,IAAI,MAAM,CAE/C;AA6LD,KAAK,mBAAmB,GAAG;IAC1B,wCAAwC,CAAC,EAAE,OAAO,CAAC;CACnD,CAAC;AA8IF,wBAAgB,wBAAwB,CACvC,CAAC,SAAS,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,EAEnE,QAAQ,EAAE,SAAS,CAAC,EAAE,EACtB,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,EACpE,OAAO,GAAE,mBAAwB,GAC/B,MAAM,GAAG,SAAS,CAkBpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAC1C,aAAa,EACV,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,GACzD,SAAS,EACZ,YAAY,EAAE,SAAS,IAAI,CAC1B,WAAW,EACX,WAAW,GAAG,OAAO,GAAG,cAAc,CACtC,EAAE,GACD,MAAM,GAAG,SAAS,CAGpB;AAED,wBAAgB,4BAA4B,CAC3C,CAAC,SAAS,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,EAEnE,QAAQ,EAAE,SAAS,CAAC,EAAE,EACtB,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,EACpE,aAAa,SAAI,GACf,MAAM,CAOR;AAsCD;;;GAGG;AACH,wBAAgB,mBAAmB,CAClC,CAAC,SAAS;IACT,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB,EACA,QAAQ,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,CAEpB;AAED,wBAAgB,0BAA0B,CACzC,CAAC,SAAS;IACT,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB,EACA,QAAQ,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,CAEpB;AAoBD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACtC,IAAI,EAAE,OAAO,GACX,gBAAgB,GAAG,IAAI,CAoJzB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAoBnE;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG;IACpD,kBAAkB,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,kBAAkB,EAAE,MAAM,CAAC;CAC3B,CA8BA;AAED;;;;GAIG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAErE;AAED,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,cAAc,CAAC,CAajE;AAED,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,iBAAiB,CAAC,CASvE;AAED,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,oBAAoB,CAAC,CAiG1E;AAyaD,wBAAsB,6BAA6B,CAAC,CAAC,EACpD,OAAO,EAAE,CACR,OAAO,EAAE,gBAAgB,GAAG,IAAI,EAChC,OAAO,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,KACjD,OAAO,CAAC,CAAC,CAAC,GACb,OAAO,CAAC,CAAC,CAAC,CAMZ;AAED,wBAAsB,uCAAuC,CAAC,CAAC,EAC9D,OAAO,EAAE,CACR,OAAO,EAAE,gBAAgB,GAAG,IAAI,EAChC,OAAO,EAAE,CACR,cAAc,EAAE,gBAAgB,EAChC,cAAc,EAAE,uBAAuB,KACnC,OAAO,CAAC,IAAI,CAAC,EAClB,cAAc,EAAE,uBAAuB,KACnC,OAAO,CAAC,CAAC,CAAC,GACb,OAAO,CAAC,CAAC,CAAC,CAgDZ;AAED,wBAAsB,6BAA6B,CAAC,CAAC,EACpD,OAAO,EAAE,CACR,OAAO,EAAE,uBAAuB,EAChC,OAAO,EAAE,CAAC,OAAO,EAAE,uBAAuB,KAAK,OAAO,CAAC,IAAI,CAAC,KACxD,OAAO,CAAC,CAAC,CAAC,GACb,OAAO,CAAC,CAAC,CAAC,CAiCZ;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAM3E;AAED;;;GAGG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAcnD;AAED,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,uBAAuB,CAAC,CAgD5E;AAyBD,wBAAsB,mBAAmB,CACxC,OAAO,EAAE,uBAAuB,GAC9B,OAAO,CAAC,IAAI,CAAC,CAMf;AAED,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,IAAI,CAAC,CAa1D;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CACnC,QAAQ,EAAE,MAAM,EAChB,KAAK,UAAO,EACZ,YAAY,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,GAC3D,OAAO,CAAC,IAAI,CAAC,CAgBf;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CACnC,QAAQ,EAAE,MAAM,GACd,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAe/D"}
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../lib/storage.ts"],"names":[],"mappings":"AA+BA,OAAO,EACN,KAAK,cAAc,EAGnB,KAAK,iBAAiB,EAEtB,MAAM,8BAA8B,CAAC;AAkBtC,OAAO,EAEN,KAAK,oBAAoB,EACzB,MAAM,qBAAqB,CAAC;AAe7B,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EACN,sBAAsB,EACtB,cAAc,GACd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACN,qBAAqB,EACrB,iBAAiB,GACjB,MAAM,uBAAuB,CAAC;AAa/B,OAAO,KAAK,EACX,iBAAiB,EACjB,gBAAgB,EAChB,cAAc,EACd,wBAAwB,EACxB,uBAAuB,EACvB,gBAAgB,EAChB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAEN,KAAK,kBAAkB,EACvB,MAAM,4BAA4B,CAAC;AA2CpC,YAAY,EACX,oBAAoB,EACpB,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,wBAAwB,EACxB,uBAAuB,EACvB,cAAc,EACd,iBAAiB,EACjB,kBAAkB,GAClB,CAAC;AAcF,KAAK,WAAW,GAAG;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAiBF,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAE9D;AAuWD,wBAAgB,4BAA4B,IAAI,MAAM,CAErD;AAED,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CA4C/D;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAO9D;AAED;;;GAGG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAMvC;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAarE;AAED,wBAAsB,yBAAyB,CAC9C,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAC7B,OAAO,CAAC,gBAAgB,CAAC,CAe3B;AAED,wBAAsB,iBAAiB,CACtC,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAC3B,OAAO,CAAC,MAAM,CAAC,CAQjB;AAED,wBAAgB,sBAAsB,IAAI,MAAM,CAE/C;AA6LD,KAAK,mBAAmB,GAAG;IAC1B,wCAAwC,CAAC,EAAE,OAAO,CAAC;CACnD,CAAC;AA8IF,wBAAgB,wBAAwB,CACvC,CAAC,SAAS,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,EAEnE,QAAQ,EAAE,SAAS,CAAC,EAAE,EACtB,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,EACpE,OAAO,GAAE,mBAAwB,GAC/B,MAAM,GAAG,SAAS,CAkBpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAC1C,aAAa,EACV,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,GACzD,SAAS,EACZ,YAAY,EAAE,SAAS,IAAI,CAC1B,WAAW,EACX,WAAW,GAAG,OAAO,GAAG,cAAc,CACtC,EAAE,GACD,MAAM,GAAG,SAAS,CAGpB;AAED,wBAAgB,4BAA4B,CAC3C,CAAC,SAAS,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,EAEnE,QAAQ,EAAE,SAAS,CAAC,EAAE,EACtB,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,EACpE,aAAa,SAAI,GACf,MAAM,CAOR;AAsCD;;;GAGG;AACH,wBAAgB,mBAAmB,CAClC,CAAC,SAAS;IACT,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB,EACA,QAAQ,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,CAEpB;AAED,wBAAgB,0BAA0B,CACzC,CAAC,SAAS;IACT,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB,EACA,QAAQ,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,CAEpB;AAoBD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACtC,IAAI,EAAE,OAAO,GACX,gBAAgB,GAAG,IAAI,CAoJzB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAoBnE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,6BAA6B,CAC5C,OAAO,EAAE;IAAE,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAAE,EACxC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,GACzB,MAAM,CAaR;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG;IACpD,kBAAkB,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,kBAAkB,EAAE,MAAM,CAAC;CAC3B,CA8BA;AAED;;;;GAIG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAErE;AAED,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,cAAc,CAAC,CAajE;AAED,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,iBAAiB,CAAC,CASvE;AAED,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,oBAAoB,CAAC,CAiG1E;AAyaD,wBAAsB,6BAA6B,CAAC,CAAC,EACpD,OAAO,EAAE,CACR,OAAO,EAAE,gBAAgB,GAAG,IAAI,EAChC,OAAO,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,KACjD,OAAO,CAAC,CAAC,CAAC,GACb,OAAO,CAAC,CAAC,CAAC,CAMZ;AAED,wBAAsB,uCAAuC,CAAC,CAAC,EAC9D,OAAO,EAAE,CACR,OAAO,EAAE,gBAAgB,GAAG,IAAI,EAChC,OAAO,EAAE,CACR,cAAc,EAAE,gBAAgB,EAChC,cAAc,EAAE,uBAAuB,KACnC,OAAO,CAAC,IAAI,CAAC,EAClB,cAAc,EAAE,uBAAuB,KACnC,OAAO,CAAC,CAAC,CAAC,GACb,OAAO,CAAC,CAAC,CAAC,CAgDZ;AAED,wBAAsB,6BAA6B,CAAC,CAAC,EACpD,OAAO,EAAE,CACR,OAAO,EAAE,uBAAuB,EAChC,OAAO,EAAE,CAAC,OAAO,EAAE,uBAAuB,KAAK,OAAO,CAAC,IAAI,CAAC,KACxD,OAAO,CAAC,CAAC,CAAC,GACb,OAAO,CAAC,CAAC,CAAC,CAiCZ;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAM3E;AAED;;;GAGG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAcnD;AAED,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,uBAAuB,CAAC,CAgD5E;AAyBD,wBAAsB,mBAAmB,CACxC,OAAO,EAAE,uBAAuB,GAC9B,OAAO,CAAC,IAAI,CAAC,CAMf;AAED,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,IAAI,CAAC,CAa1D;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CACnC,QAAQ,EAAE,MAAM,EAChB,KAAK,UAAO,EACZ,YAAY,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,GAC3D,OAAO,CAAC,IAAI,CAAC,CAgBf;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CACnC,QAAQ,EAAE,MAAM,GACd,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAe/D"}

package/dist/lib/storage.js

@@ -951,6 +951,38 @@ export function readAffinityGenerationFromDisk(path) {
         return 0;
     }
 }
+/**
+ * Advance the session-affinity generation so a running runtime proxy drops its
+ * sticky session→account bindings on the next request.
+ *
+ * Session affinity remembers an account by ITS INDEX, so any mutation that
+ * reshuffles the pool (removing an account, restoring a backup) silently
+ * re-points every live session at a different account until the generation
+ * changes. `switch`/`best`/`unpin` already bump it; the reshuffling paths are
+ * the ones that need it most, because they move every index at once.
+ *
+ * Re-reads the on-disk generation first so concurrent CLI processes do not lose
+ * increments via lost-update on the load+mutate pair. `Math.max` keeps the
+ * counter monotonic: an extra bump only costs one additional affinity
+ * invalidation, while a missed bump lets the proxy cling to the wrong account.
+ * See issue #474.
+ */
+export function bumpStorageAffinityGeneration(storage, storagePath) {
+    let diskGeneration = 0;
+    try {
+        const path = storagePath ?? getStoragePath();
+        if (path)
+            diskGeneration = readAffinityGenerationFromDisk(path);
+    }
+    catch {
+        // No resolvable storage path (never configured). The in-memory counter
+        // is still bumped below; only the lost-update guard is unavailable.
+    }
+    const inMemoryGeneration = storage.affinityGeneration ?? 0;
+    const next = Math.max(inMemoryGeneration, diskGeneration) + 1;
+    storage.affinityGeneration = next;
+    return next;
+}
 /**
  * Synchronously reads both the top-level `pinnedAccountIndex` and
  * `affinityGeneration` fields from the accounts storage file. Used by

package/dist/lib/usage/index.d.ts

@@ -2,4 +2,6 @@ export * from "./types.js";
 export * from "./pricing.js";
 export * from "./redaction.js";
 export * from "./ledger.js";
+export * from "./usage-extraction.js";
+export * from "./stream-usage-deferral.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/lib/usage/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../lib/usage/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../lib/usage/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,uBAAuB,CAAC;AACtC,cAAc,4BAA4B,CAAC"}

package/dist/lib/usage/index.js

@@ -2,3 +2,5 @@ export * from "./types.js";
 export * from "./pricing.js";
 export * from "./redaction.js";
 export * from "./ledger.js";
+export * from "./usage-extraction.js";
+export * from "./stream-usage-deferral.js";

package/dist/lib/usage/ledger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ledger.d.ts","sourceRoot":"","sources":["../../../lib/usage/ledger.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EACX,sBAAsB,EAEtB,gBAAgB,EAChB,gBAAgB,EAEhB,cAAc,EAEd,YAAY,EAGZ,iBAAiB,EAEjB,MAAM,YAAY,CAAC;AAqOpB,wBAAgB,mBAAmB,IAAI,gBAAgB,CAMtD;AAED,wBAAsB,oBAAoB,CACzC,KAAK,EAAE,sBAAsB,GAC3B,OAAO,CAAC,cAAc,CAAC,CASzB;AA+JD,wBAAsB,mBAAmB,CACxC,KAAK,GAAE,gBAAqB,GAC1B,OAAO,CAAC,cAAc,EAAE,CAAC,CAc3B;AAgDD,wBAAgB,kBAAkB,CACjC,IAAI,EAAE,cAAc,EAAE,EACtB,KAAK,GAAE,iBAAsB,GAC3B,YAAY,CAwBd;AAED,wBAAsB,oBAAoB,CACzC,KAAK,GAAE,iBAAsB,GAC3B,OAAO,CAAC,YAAY,CAAC,CAEvB;AAED,wBAAsB,iBAAiB,CAAC,OAAO,GAAE;IAChD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,iBAAiB,CAAC,EAAE,MAAM,CAAC;CACtB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA2B9B;AAED,wBAAgB,6BAA6B,IAAI,IAAI,CAEpD"}
+{"version":3,"file":"ledger.d.ts","sourceRoot":"","sources":["../../../lib/usage/ledger.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EACX,sBAAsB,EAEtB,gBAAgB,EAChB,gBAAgB,EAEhB,cAAc,EAEd,YAAY,EAGZ,iBAAiB,EAEjB,MAAM,YAAY,CAAC;AAqOpB,wBAAgB,mBAAmB,IAAI,gBAAgB,CAMtD;AAED,wBAAsB,oBAAoB,CACzC,KAAK,EAAE,sBAAsB,GAC3B,OAAO,CAAC,cAAc,CAAC,CASzB;AA+JD,wBAAsB,mBAAmB,CACxC,KAAK,GAAE,gBAAqB,GAC1B,OAAO,CAAC,cAAc,EAAE,CAAC,CAc3B;AAuDD,wBAAgB,kBAAkB,CACjC,IAAI,EAAE,cAAc,EAAE,EACtB,KAAK,GAAE,iBAAsB,GAC3B,YAAY,CAwBd;AAED,wBAAsB,oBAAoB,CACzC,KAAK,GAAE,iBAAsB,GAC3B,OAAO,CAAC,YAAY,CAAC,CAEvB;AAED,wBAAsB,iBAAiB,CAAC,OAAO,GAAE;IAChD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,iBAAiB,CAAC,EAAE,MAAM,CAAC;CACtB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA2B9B;AAED,wBAAgB,6BAA6B,IAAI,IAAI,CAEpD"}

package/dist/lib/usage/ledger.js

@@ -405,6 +405,7 @@ function createBucket(key) {
         reasoningTokens: 0,
         totalTokens: 0,
         costUsd: 0,
+        unpricedRequests: 0,
     };
 }
 function getBucketKey(row, by) {
@@ -437,6 +438,12 @@ function addRowToBucket(bucket, row) {
     bucket.reasoningTokens += row.tokens.reasoningTokens;
     bucket.totalTokens += row.tokens.totalTokens;
     bucket.costUsd = Number((bucket.costUsd + (row.costUsd ?? 0)).toFixed(8));
+    // Only rows that actually consumed tokens count as unpriced spend. A blocked
+    // or cancelled request carries no tokens and no cost, and must not make a
+    // cost budget unevaluable.
+    if (row.costUsd === null && row.tokens.totalTokens > 0) {
+        bucket.unpricedRequests += 1;
+    }
 }
 export function summarizeUsageRows(rows, query = {}) {
     const by = query.by ?? "model";

package/dist/lib/usage/pricing.d.ts

@@ -5,6 +5,21 @@ export interface UsageModelPricing {
     cachedInputUsdPerMillion?: number;
     reasoningUsdPerMillion?: number;
 }
+/**
+ * Models the router can normalize to that have no published rate here yet.
+ *
+ * Their cost is deliberately reported as unknown (`null`) rather than guessed:
+ * a wrong dollar figure is worse than no figure, and it would silently move a
+ * `maxCostUsd` budget's trip point. Nothing may treat an unknown cost as zero —
+ * `evaluateBudgetGuard` refuses a cost budget while unknown-cost usage is in
+ * the window instead of counting it as free (that under-count made cost caps
+ * unenforceable for exactly these models, every `pro` tier among them).
+ *
+ * Add a real rate to MODEL_PRICING and delete the entry here once published;
+ * `test/usage-pricing-coverage.test.ts` fails if a NEW routable model appears
+ * in neither list.
+ */
+export declare const UNPRICED_ROUTABLE_MODELS: readonly ["gpt-5.1", "gpt-5.2-pro", "gpt-5.4-mini", "gpt-5.4-nano", "gpt-5.4-pro", "gpt-5.5-pro", "gpt-5-mini", "gpt-5-nano"];
 export declare function getUsageModelPricing(model: string | null | undefined): UsageModelPricing | null;
 export declare function estimateUsageCostUsd(model: string | null | undefined, tokens: UsageTokenCounts): number | null;
 export declare function listUsageModelPricing(): Record<string, UsageModelPricing>;

package/dist/lib/usage/pricing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pricing.d.ts","sourceRoot":"","sources":["../../../lib/usage/pricing.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEnD,MAAM,WAAW,iBAAiB;IACjC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,sBAAsB,CAAC,EAAE,MAAM,CAAC;CAChC;AAgED,wBAAgB,oBAAoB,CACnC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC9B,iBAAiB,GAAG,IAAI,CAM1B;AAED,wBAAgB,oBAAoB,CACnC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,MAAM,EAAE,gBAAgB,GACtB,MAAM,GAAG,IAAI,CAqBf;AAED,wBAAgB,qBAAqB,IAAI,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAEzE"}
+{"version":3,"file":"pricing.d.ts","sourceRoot":"","sources":["../../../lib/usage/pricing.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEnD,MAAM,WAAW,iBAAiB;IACjC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,sBAAsB,CAAC,EAAE,MAAM,CAAC;CAChC;AA2DD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,wBAAwB,+HAS3B,CAAC;AAOX,wBAAgB,oBAAoB,CACnC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC9B,iBAAiB,GAAG,IAAI,CAM1B;AAED,wBAAgB,oBAAoB,CACnC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,MAAM,EAAE,gBAAgB,GACtB,MAAM,GAAG,IAAI,CAqBf;AAED,wBAAgB,qBAAqB,IAAI,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAEzE"}

package/dist/lib/usage/pricing.js

@@ -54,6 +54,30 @@ const MODEL_PRICING = {
         reasoningUsdPerMillion: 6,
     },
 };
+/**
+ * Models the router can normalize to that have no published rate here yet.
+ *
+ * Their cost is deliberately reported as unknown (`null`) rather than guessed:
+ * a wrong dollar figure is worse than no figure, and it would silently move a
+ * `maxCostUsd` budget's trip point. Nothing may treat an unknown cost as zero —
+ * `evaluateBudgetGuard` refuses a cost budget while unknown-cost usage is in
+ * the window instead of counting it as free (that under-count made cost caps
+ * unenforceable for exactly these models, every `pro` tier among them).
+ *
+ * Add a real rate to MODEL_PRICING and delete the entry here once published;
+ * `test/usage-pricing-coverage.test.ts` fails if a NEW routable model appears
+ * in neither list.
+ */
+export const UNPRICED_ROUTABLE_MODELS = [
+    "gpt-5.1",
+    "gpt-5.2-pro",
+    "gpt-5.4-mini",
+    "gpt-5.4-nano",
+    "gpt-5.4-pro",
+    "gpt-5.5-pro",
+    "gpt-5-mini",
+    "gpt-5-nano",
+];
 function normalizeModelName(model) {
     const trimmed = model?.trim().toLowerCase();
     return trimmed && trimmed.length > 0 ? trimmed : null;

package/dist/lib/usage/stream-usage-deferral.d.ts

@@ -0,0 +1,39 @@
+import type { UsageTokenCounts } from "./types.js";
+export interface StreamUsageDeferral<TRow> {
+    /** Latest counts reported by upstream, or null if none have arrived. */
+    captured: () => UsageTokenCounts | null;
+    /** Feed upstream-reported counts. Writes a deferred row immediately. */
+    onUsage: (usage: UsageTokenCounts) => void;
+    /**
+     * Hand over a row to be written once upstream reports its counts, or after
+     * `fallbackMs` without them. Only the first pending row is held.
+     */
+    defer: (completion: TRow) => void;
+}
+/**
+ * Holds a usage-ledger row open until a streaming response reports its tokens.
+ *
+ * A streaming request's row would otherwise be written when the request handler
+ * returns its Response — before the client has read a byte, and therefore
+ * before the upstream `usage` event exists. The ledger is append-only, so that
+ * row could never be corrected: it would stand at zero tokens and zero cost
+ * forever, which is what silently disables the `maxTokens` and `maxCostUsd`
+ * budget caps (`evaluateBudgetGuard` compares `0 >= limit`).
+ *
+ * The fallback timer is not optional bookkeeping. A client that disconnects
+ * mid-stream, or an upstream that never emits a terminal usage event, must
+ * still cost one row, because `maxRequests` counts rows — losing it would
+ * weaken a cap that currently works.
+ *
+ * Generic over the row type so this stays inside `lib/usage` rather than
+ * importing the policy layer that imports it back.
+ */
+export declare function createStreamUsageDeferral<TRow extends object>(options: {
+    record: (completion: TRow & Partial<UsageTokenCounts>) => void;
+    fallbackMs: number;
+    /** Injectable for tests; defaults to an unref'd setTimeout. */
+    schedule?: (run: () => void, ms: number) => {
+        cancel: () => void;
+    };
+}): StreamUsageDeferral<TRow>;
+//# sourceMappingURL=stream-usage-deferral.d.ts.map

package/dist/lib/usage/stream-usage-deferral.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stream-usage-deferral.d.ts","sourceRoot":"","sources":["../../../lib/usage/stream-usage-deferral.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEnD,MAAM,WAAW,mBAAmB,CAAC,IAAI;IACxC,wEAAwE;IACxE,QAAQ,EAAE,MAAM,gBAAgB,GAAG,IAAI,CAAC;IACxC,wEAAwE;IACxE,OAAO,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,IAAI,CAAC;IAC3C;;;OAGG;IACH,KAAK,EAAE,CAAC,UAAU,EAAE,IAAI,KAAK,IAAI,CAAC;CAClC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,SAAS,MAAM,EAAE,OAAO,EAAE;IACvE,MAAM,EAAE,CAAC,UAAU,EAAE,IAAI,GAAG,OAAO,CAAC,gBAAgB,CAAC,KAAK,IAAI,CAAC;IAC/D,UAAU,EAAE,MAAM,CAAC;IACnB,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,IAAI,EAAE,EAAE,EAAE,MAAM,KAAK;QAAE,MAAM,EAAE,MAAM,IAAI,CAAA;KAAE,CAAC;CACnE,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAqC5B"}

package/dist/lib/usage/stream-usage-deferral.js

@@ -0,0 +1,54 @@
+/**
+ * Holds a usage-ledger row open until a streaming response reports its tokens.
+ *
+ * A streaming request's row would otherwise be written when the request handler
+ * returns its Response — before the client has read a byte, and therefore
+ * before the upstream `usage` event exists. The ledger is append-only, so that
+ * row could never be corrected: it would stand at zero tokens and zero cost
+ * forever, which is what silently disables the `maxTokens` and `maxCostUsd`
+ * budget caps (`evaluateBudgetGuard` compares `0 >= limit`).
+ *
+ * The fallback timer is not optional bookkeeping. A client that disconnects
+ * mid-stream, or an upstream that never emits a terminal usage event, must
+ * still cost one row, because `maxRequests` counts rows — losing it would
+ * weaken a cap that currently works.
+ *
+ * Generic over the row type so this stays inside `lib/usage` rather than
+ * importing the policy layer that imports it back.
+ */
+export function createStreamUsageDeferral(options) {
+    const schedule = options.schedule ??
+        ((run, ms) => {
+            const timer = setTimeout(run, ms);
+            // Never hold the process open for a row that is only a fallback.
+            timer.unref?.();
+            return { cancel: () => clearTimeout(timer) };
+        });
+    let captured = null;
+    let pending = null;
+    let timer = null;
+    const flush = (usage) => {
+        const completion = pending;
+        pending = null;
+        timer?.cancel();
+        timer = null;
+        if (!completion)
+            return;
+        options.record(usage ? { ...completion, ...usage } : completion);
+    };
+    return {
+        captured: () => captured,
+        onUsage: (usage) => {
+            captured = usage;
+            flush(usage);
+        },
+        defer: (completion) => {
+            // A second defer would orphan the first row's timer, so keep the row
+            // already in flight and let it settle on its own terms.
+            if (pending)
+                return;
+            pending = completion;
+            timer = schedule(() => flush(null), options.fallbackMs);
+        },
+    };
+}

package/dist/lib/usage/types.d.ts

@@ -74,6 +74,12 @@ export interface UsageSummaryBucket {
     reasoningTokens: number;
     totalTokens: number;
     costUsd: number;
+    /**
+     * Requests that consumed tokens but could not be priced, so `costUsd` is an
+     * UNDER-count by an unknown amount. A cost budget cannot be evaluated while
+     * this is above zero; see `evaluateBudgetGuard`.
+     */
+    unpricedRequests: number;
 }
 export interface UsageSummary {
     since: number | null;

package/dist/lib/usage/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../lib/usage/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,iBAAiB,GAC1B,eAAe,GACf,aAAa,GACb,cAAc,GACd,KAAK,GACL,SAAS,CAAC;AAEb,MAAM,MAAM,oBAAoB,GAC7B,WAAW,GACX,QAAQ,GACR,aAAa,GACb,cAAc,GACd,YAAY,GACZ,SAAS,CAAC;AAEb,MAAM,MAAM,kBAAkB,GAC3B,SAAS,GACT,SAAS,GACT,SAAS,GACT,WAAW,CAAC;AAEf,MAAM,WAAW,gBAAgB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,qBAAqB;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC9B,OAAO,EAAE,CAAC,CAAC;IACX,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,iBAAiB,CAAC;IAC1B,SAAS,EAAE,oBAAoB,CAAC;IAChC,OAAO,EAAE,kBAAkB,CAAC;IAC5B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,EAAE,qBAAqB,GAAG,IAAI,CAAC;IACtC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,EAAE,gBAAgB,CAAC;IACzB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,sBAAsB;IACtC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B,SAAS,CAAC,EAAE,oBAAoB,CAAC;IACjC,OAAO,EAAE,kBAAkB,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,MAAM,MAAM,mBAAmB,GAC5B,OAAO,GACP,SAAS,GACT,SAAS,GACT,SAAS,GACT,KAAK,CAAC;AAET,MAAM,WAAW,gBAAgB;IAChC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAAC;IAC/B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAAC;IAC/B,eAAe,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,iBAAkB,SAAQ,gBAAgB;IAC1D,EAAE,CAAC,EAAE,mBAAmB,CAAC;CACzB;AAED,MAAM,WAAW,kBAAkB;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC5B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,EAAE,EAAE,mBAAmB,CAAC;IACxB,MAAM,EAAE,kBAAkB,CAAC;IAC3B,OAAO,EAAE,kBAAkB,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,gBAAgB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;CAChB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../lib/usage/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,iBAAiB,GAC1B,eAAe,GACf,aAAa,GACb,cAAc,GACd,KAAK,GACL,SAAS,CAAC;AAEb,MAAM,MAAM,oBAAoB,GAC7B,WAAW,GACX,QAAQ,GACR,aAAa,GACb,cAAc,GACd,YAAY,GACZ,SAAS,CAAC;AAEb,MAAM,MAAM,kBAAkB,GAC3B,SAAS,GACT,SAAS,GACT,SAAS,GACT,WAAW,CAAC;AAEf,MAAM,WAAW,gBAAgB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,qBAAqB;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC9B,OAAO,EAAE,CAAC,CAAC;IACX,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,iBAAiB,CAAC;IAC1B,SAAS,EAAE,oBAAoB,CAAC;IAChC,OAAO,EAAE,kBAAkB,CAAC;IAC5B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,EAAE,qBAAqB,GAAG,IAAI,CAAC;IACtC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,EAAE,gBAAgB,CAAC;IACzB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,sBAAsB;IACtC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B,SAAS,CAAC,EAAE,oBAAoB,CAAC;IACjC,OAAO,EAAE,kBAAkB,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,MAAM,MAAM,mBAAmB,GAC5B,OAAO,GACP,SAAS,GACT,SAAS,GACT,SAAS,GACT,KAAK,CAAC;AAET,MAAM,WAAW,gBAAgB;IAChC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAAC;IAC/B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAAC;IAC/B,eAAe,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,iBAAkB,SAAQ,gBAAgB;IAC1D,EAAE,CAAC,EAAE,mBAAmB,CAAC;CACzB;AAED,MAAM,WAAW,kBAAkB;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,gBAAgB,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAC5B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,EAAE,EAAE,mBAAmB,CAAC;IACxB,MAAM,EAAE,kBAAkB,CAAC;IAC3B,OAAO,EAAE,kBAAkB,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,gBAAgB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;CAChB"}

package/dist/lib/usage/usage-extraction.d.ts

@@ -0,0 +1,42 @@
+import type { UsageTokenCounts } from "./types.js";
+/**
+ * Read an OpenAI Responses `usage` object into the ledger's token shape.
+ *
+ * Two containment rules drive the mapping, and getting either backwards
+ * mis-prices every row:
+ *
+ * - `input_tokens_details.cached_tokens` is a SUBSET of `input_tokens`, and
+ *   `estimateUsageCostUsd` already subtracts it (`billableInputTokens`), so
+ *   both are passed through raw.
+ * - `output_tokens_details.reasoning_tokens` is likewise a SUBSET of
+ *   `output_tokens`, but `estimateUsageCostUsd` prices `outputTokens` and
+ *   `reasoningTokens` as DISJOINT buckets and sums them. Passing the raw
+ *   `output_tokens` alongside the reasoning count would bill reasoning twice,
+ *   so the reasoning share is subtracted out here.
+ */
+export declare function extractUsageTokenCounts(usage: unknown): UsageTokenCounts | null;
+/**
+ * Pull the `usage` object out of a Responses payload, whether it arrived as a
+ * bare response object (non-streaming) or wrapped in a stream event envelope.
+ */
+export declare function extractResponsesUsage(payload: unknown): UsageTokenCounts | null;
+export interface UsageStreamScanner {
+    /** Feed one forwarded chunk. Never throws. */
+    push: (chunk: Uint8Array) => void;
+    /** Flush any trailing partial data and return the final counts, if any. */
+    result: () => UsageTokenCounts | null;
+}
+/**
+ * Observe a forwarded response body and recover its token counts.
+ *
+ * SSE bodies are scanned line by line so only the current partial line is
+ * retained; a full response can be gigabytes of deltas and must never be
+ * buffered. Non-SSE JSON bodies have no incremental structure to exploit, so
+ * they are accumulated up to `MAX_BUFFERED_BYTES` and parsed at the end —
+ * beyond that cap the scanner gives up on usage rather than grow without
+ * bound.
+ */
+export declare function createUsageStreamScanner(options: {
+    contentType?: string | null;
+}): UsageStreamScanner;
+//# sourceMappingURL=usage-extraction.d.ts.map

package/dist/lib/usage/usage-extraction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"usage-extraction.d.ts","sourceRoot":"","sources":["../../../lib/usage/usage-extraction.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AA+BnD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CACtC,KAAK,EAAE,OAAO,GACZ,gBAAgB,GAAG,IAAI,CA+BzB;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,gBAAgB,GAAG,IAAI,CAQ/E;AAED,MAAM,WAAW,kBAAkB;IAClC,8CAA8C;IAC9C,IAAI,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC;IAClC,2EAA2E;IAC3E,MAAM,EAAE,MAAM,gBAAgB,GAAG,IAAI,CAAC;CACtC;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE;IACjD,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B,GAAG,kBAAkB,CA6ErB"}

package/dist/lib/usage/usage-extraction.js

@@ -0,0 +1,178 @@
+/**
+ * Extracting token counts from upstream Responses API traffic.
+ *
+ * Without this the usage ledger records every request with all-zero tokens and
+ * a zero cost, which silently disables the `maxTokens` / `maxCostUsd` budget
+ * caps: `evaluateBudgetGuard` compares `0 >= limit`, which never fires, so
+ * `codex-multi-auth budget set --cost 50` allows unlimited spend and only
+ * `--requests` actually enforces anything.
+ */
+/** Cap on retained bytes so a hostile or unterminated body cannot grow forever. */
+const MAX_BUFFERED_BYTES = 1_048_576;
+/** Terminal Responses stream events that carry the final `usage` object. */
+const TERMINAL_EVENT_TYPES = new Set([
+    "response.completed",
+    "response.incomplete",
+    "response.failed",
+    "response.done",
+]);
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function nonNegativeInteger(value) {
+    if (typeof value !== "number" || !Number.isFinite(value))
+        return 0;
+    return Math.max(0, Math.trunc(value));
+}
+/**
+ * Read an OpenAI Responses `usage` object into the ledger's token shape.
+ *
+ * Two containment rules drive the mapping, and getting either backwards
+ * mis-prices every row:
+ *
+ * - `input_tokens_details.cached_tokens` is a SUBSET of `input_tokens`, and
+ *   `estimateUsageCostUsd` already subtracts it (`billableInputTokens`), so
+ *   both are passed through raw.
+ * - `output_tokens_details.reasoning_tokens` is likewise a SUBSET of
+ *   `output_tokens`, but `estimateUsageCostUsd` prices `outputTokens` and
+ *   `reasoningTokens` as DISJOINT buckets and sums them. Passing the raw
+ *   `output_tokens` alongside the reasoning count would bill reasoning twice,
+ *   so the reasoning share is subtracted out here.
+ */
+export function extractUsageTokenCounts(usage) {
+    if (!isRecord(usage))
+        return null;
+    const hasAnyCount = typeof usage.input_tokens === "number" ||
+        typeof usage.output_tokens === "number" ||
+        typeof usage.total_tokens === "number";
+    if (!hasAnyCount)
+        return null;
+    const inputTokens = nonNegativeInteger(usage.input_tokens);
+    const rawOutputTokens = nonNegativeInteger(usage.output_tokens);
+    const cachedInputTokens = isRecord(usage.input_tokens_details)
+        ? Math.min(inputTokens, nonNegativeInteger(usage.input_tokens_details.cached_tokens))
+        : 0;
+    const reasoningTokens = isRecord(usage.output_tokens_details)
+        ? Math.min(rawOutputTokens, nonNegativeInteger(usage.output_tokens_details.reasoning_tokens))
+        : 0;
+    const providedTotal = typeof usage.total_tokens === "number" && Number.isFinite(usage.total_tokens)
+        ? Math.max(0, Math.trunc(usage.total_tokens))
+        : inputTokens + rawOutputTokens;
+    return {
+        inputTokens,
+        outputTokens: rawOutputTokens - reasoningTokens,
+        cachedInputTokens,
+        reasoningTokens,
+        totalTokens: providedTotal,
+    };
+}
+/**
+ * Pull the `usage` object out of a Responses payload, whether it arrived as a
+ * bare response object (non-streaming) or wrapped in a stream event envelope.
+ */
+export function extractResponsesUsage(payload) {
+    if (!isRecord(payload))
+        return null;
+    const direct = extractUsageTokenCounts(payload.usage);
+    if (direct)
+        return direct;
+    if (isRecord(payload.response)) {
+        return extractUsageTokenCounts(payload.response.usage);
+    }
+    return null;
+}
+/**
+ * Observe a forwarded response body and recover its token counts.
+ *
+ * SSE bodies are scanned line by line so only the current partial line is
+ * retained; a full response can be gigabytes of deltas and must never be
+ * buffered. Non-SSE JSON bodies have no incremental structure to exploit, so
+ * they are accumulated up to `MAX_BUFFERED_BYTES` and parsed at the end —
+ * beyond that cap the scanner gives up on usage rather than grow without
+ * bound.
+ */
+export function createUsageStreamScanner(options) {
+    const sse = (options.contentType ?? "").toLowerCase().includes("text/event-stream");
+    const decoder = new TextDecoder("utf-8");
+    let pending = "";
+    let bufferedBytes = 0;
+    let overflowed = false;
+    let latest = null;
+    const consumeLine = (line) => {
+        const trimmed = line.trim();
+        if (!trimmed.startsWith("data:"))
+            return;
+        const payload = trimmed.slice("data:".length).trim();
+        if (payload.length === 0 || payload === "[DONE]")
+            return;
+        let parsed;
+        try {
+            parsed = JSON.parse(payload);
+        }
+        catch {
+            return;
+        }
+        // Prefer terminal events, which carry the authoritative totals, but fall
+        // back to any event that reports usage so a stream that ends on a
+        // non-standard terminal type still records something.
+        const type = isRecord(parsed) ? parsed.type : undefined;
+        const isTerminal = typeof type === "string" && TERMINAL_EVENT_TYPES.has(type);
+        const counts = extractResponsesUsage(parsed);
+        if (counts && (isTerminal || latest === null)) {
+            latest = counts;
+        }
+    };
+    return {
+        push: (chunk) => {
+            try {
+                if (overflowed || chunk.byteLength === 0)
+                    return;
+                bufferedBytes += chunk.byteLength;
+                pending += decoder.decode(chunk, { stream: true });
+                if (!sse) {
+                    if (bufferedBytes > MAX_BUFFERED_BYTES) {
+                        overflowed = true;
+                        pending = "";
+                    }
+                    return;
+                }
+                let newlineAt = pending.indexOf("\n");
+                while (newlineAt !== -1) {
+                    consumeLine(pending.slice(0, newlineAt));
+                    pending = pending.slice(newlineAt + 1);
+                    newlineAt = pending.indexOf("\n");
+                }
+                // A single unterminated line this long is not SSE any more; stop
+                // retaining it rather than growing the buffer for the whole body.
+                if (pending.length > MAX_BUFFERED_BYTES) {
+                    overflowed = true;
+                    pending = "";
+                }
+            }
+            catch {
+                // Usage accounting must never break the forwarded response.
+            }
+        },
+        result: () => {
+            try {
+                if (overflowed)
+                    return latest;
+                pending += decoder.decode();
+                if (sse) {
+                    if (pending.length > 0)
+                        consumeLine(pending);
+                    pending = "";
+                    return latest;
+                }
+                if (pending.trim().length === 0)
+                    return latest;
+                const parsed = JSON.parse(pending);
+                pending = "";
+                return extractResponsesUsage(parsed) ?? latest;
+            }
+            catch {
+                return latest;
+            }
+        },
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "codex-multi-auth",
-	"version": "2.8.7",
+	"version": "2.9.1",
 	"description": "Codex CLI multi-account OAuth manager with account switching, health checks, runtime rotation, diagnostics, and recovery tools for @openai/codex",
 	"main": "./dist/index.js",
 	"types": "./dist/index.d.ts",