dsh-codex-connect 0.1.0-alpha.4.37 → 0.1.0-alpha.4.38

package/INSTALL.md

@@ -1,10 +1,10 @@
 # Installation Runbook for CLI Agents
 
-Published Alpha 4.35 is verified with DSH `0.1.2-rc.1` and pi-ai `0.84.4` within `^0.84.2`, and with each exact DSH `0.1.5-alpha.1`, `0.1.5-rc.1`, and `0.1.5-rc.2` model-runtime pairing using pi-ai `0.85.1`.
+Published Alpha 4.37 is verified with DSH `0.1.2-rc.1` and pi-ai `0.84.4` within `^0.84.2`, and with each exact DSH `0.1.5-alpha.1`, `0.1.5-rc.1`, and `0.1.5-rc.2` model-runtime pairing using pi-ai `0.85.1`.
 
 Install `dsh-codex-connect` into one requested DeepSeek Harness profile without changing its current default model, search route, global configuration, or OAuth state.
 
-Channel snapshot on 2026-09-11: npm `alpha` points to `0.1.0-alpha.4.35`; `latest` intentionally remains on `0.1.0-alpha.4.34`. Use the exact-version commands below for 4.35. Publishing an Alpha and promoting the default installation channel are separate actions.
+Channel snapshot on 2026-09-19: npm `alpha` points to `0.1.0-alpha.4.37`; `latest` intentionally remains on `0.1.0-alpha.4.34`. Use the exact-version commands below for 4.37. Publishing an Alpha and promoting the default installation channel are separate actions.
 
 ## Safety requirements
 
@@ -25,15 +25,19 @@ Check `dsh --version` before changing the requested profile. Use `dsh --help` to
 | `0.1.0-rc.7` | `0.1.0-alpha.4.14` |
 | `0.1.1-rc.2` | `0.1.0-alpha.4.21` |
 | `0.1.2-alpha.2` | `0.1.0-alpha.4.23` |
-| `0.1.2-rc.1` | `0.1.0-alpha.4.35` |
+| `0.1.2-rc.1` | `0.1.0-alpha.4.37` |
 | `0.1.2-alpha.5` | `0.1.0-alpha.4.25` |
-| `0.1.5-alpha.1` | `0.1.0-alpha.4.35` |
-| `0.1.5-rc.1` | `0.1.0-alpha.4.35` |
-| `0.1.5-rc.2` | `0.1.0-alpha.4.35` |
+| `0.1.5-alpha.1` | `0.1.0-alpha.4.37` |
+| `0.1.5-rc.1` | `0.1.0-alpha.4.37` |
+| `0.1.5-rc.2` | `0.1.0-alpha.4.37` |
 
 If your exact DSH version is unknown or not listed, preserve the installed host, report that the combination is unverified, and verify it before making installation changes. A missing record does not prove incompatibility, and the catalog's latest verified DSH version is not the latest upstream release. Do not recommend upgrading or downgrading DSH merely to match a row. Investigate any specific failure and seek verification of the installed combination. Do not blindly install `dsh-codex-connect@alpha`: `alpha` is a moving tag, not a compatibility guarantee. Do not infer support for newer DSH versions from these rows.
 
-Alpha 4.35 requires one consistent DSH plugin API version: `0.1.2-rc.1` with `@earendil-works/pi-ai` `^0.84.2`, or one of `0.1.5-alpha.1`, `0.1.5-rc.1`, and `0.1.5-rc.2` with pi-ai `0.85.1`; Node.js remains `^22.19.0 || >=24.0.0`. Mixed host versions and other DSH/pi-ai combinations remain unverified. Alpha 4.25 remains the verified choice for DSH `0.1.2-alpha.5`, Alpha 4.23 remains the verified choice for DSH `0.1.2-alpha.2`, Alpha 4.21 remains the verified choice for DSH `0.1.1-rc.2`, and staying on DSH `0.1.0-rc.7` means selecting Alpha 4.14. Changing DSH is a separate operation requiring the user's explicit request; a plugin update request does not authorize it. The repository's `pnpm --silent run check:compatibility` remains a strict development/release dependency gate, not a recommendation to change a user's host.
+Alpha 4.37 requires one consistent DSH plugin API version: `0.1.2-rc.1` with `@earendil-works/pi-ai` `^0.84.2`, or one of `0.1.5-alpha.1`, `0.1.5-rc.1`, and `0.1.5-rc.2` with pi-ai `0.85.1`; Node.js remains `^22.19.0 || >=24.0.0`. Mixed host versions and other DSH/pi-ai combinations remain unverified. Alpha 4.25 remains the verified choice for DSH `0.1.2-alpha.5`, Alpha 4.23 remains the verified choice for DSH `0.1.2-alpha.2`, Alpha 4.21 remains the verified choice for DSH `0.1.1-rc.2`, and staying on DSH `0.1.0-rc.7` means selecting Alpha 4.14. Changing DSH is a separate operation requiring the user's explicit request; a plugin update request does not authorize it. The repository's `pnpm --silent run check:compatibility` remains a strict development/release dependency gate, not a recommendation to change a user's host.
+
+The Alpha 4.37 recommendation follows successful exact-release main CI, 975 local tests, 32 Chromium tests, and a four-host same-artifact installation matrix with 40 fresh native-compaction lifecycle processes. Independent post-publication download verified that npm's archive is byte-identical to the tested artifact and the release workflow's verified package; the Git tag resolves to the exact release commit. These are synthetic-provider installation/lifecycle checks, not new real-account acceptance or a newly exercised published-package upgrade. See [.github/ALPHA_437_PUBLICATION.md](.github/ALPHA_437_PUBLICATION.md). Native context management remains opt-in. The preview-only DSH checkpoint-retry patch is not installed by this plugin, and stock DSH 0.1.6-alpha.2 remains undeclared.
+
+Historical Alpha 4.35 evidence (not relabeled as 4.37):
 
 The Alpha 4.35 rows reflect successful release-commit CI on Node 22.19.0 and 24.20.0 (840 tests each), 28 Chromium tests, Windows canary contracts, and the four-host installation/Reserve matrix. Independent post-publication checks installed the exact npm version on all four hosts, matched all 63 installed plugin files to the verified published archive, and exercised a 4.34-to-4.35 upgrade on rc.2. All eight advertised models resolved and prepared, defaults were unchanged, all optional capabilities remained disabled, and provider disposal and synthetic Reserve transitions passed. These checks are not fresh real OAuth, live Reserve/model/tool/image, or full Windows application acceptance. See [.github/ALPHA_435_RELEASE_READINESS.md](.github/ALPHA_435_RELEASE_READINESS.md) for publication, installation evidence, and limitations. Historical rows remain the repository's existing verification record. This guidance does not change upstream DSH behavior or resolve [Issue #64](https://github.com/franksong2702/dsh-codex-connect/issues/64).
 
@@ -60,10 +64,10 @@ Alpha 4.33 omits the `modelErrors` profile field required by RC model packages,
    dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.23
    ```
 
-   For DSH `0.1.2-rc.1`, `0.1.5-alpha.1`, `0.1.5-rc.1`, or `0.1.5-rc.2`, use Alpha 4.35:
+   For DSH `0.1.2-rc.1`, `0.1.5-alpha.1`, `0.1.5-rc.1`, or `0.1.5-rc.2`, use Alpha 4.37:
 
    ```sh
-   dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.35
+   dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.37
    ```
 
    For DSH `0.1.2-alpha.5`, use Alpha 4.25:
@@ -72,7 +76,7 @@ Alpha 4.33 omits the `modelErrors` profile field required by RC model packages,
    dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.25
    ```
 
-   If npm is unavailable after the matching GitHub prerelease is created, use `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.21'` only for the DSH `0.1.1-rc.2` combination, `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.23'` only for the DSH `0.1.2-alpha.2` combination, `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.25'` only for the DSH `0.1.2-alpha.5` combination, or `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.35'` only for the DSH `0.1.2-rc.1`, `0.1.5-alpha.1`, `0.1.5-rc.1`, or `0.1.5-rc.2` combinations.
+   If npm is unavailable after the matching GitHub prerelease is created, use `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.21'` only for the DSH `0.1.1-rc.2` combination, `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.23'` only for the DSH `0.1.2-alpha.2` combination, `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.25'` only for the DSH `0.1.2-alpha.5` combination, or `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.37'` only for the DSH `0.1.2-rc.1`, `0.1.5-alpha.1`, `0.1.5-rc.1`, or `0.1.5-rc.2` combinations.
 
 3. Run `dsh web --help` once to compose the installed profile without starting the server. DSH `0.1.2-rc.1` prepares profile plugin dependency fallback during this step.
 4. Run `dsh --profile web --dump-config` and require exactly one `llm-openai-codex` row loading `dsh-codex-connect`.

package/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   git hash-object README.md docs/README.zh.md
-README.md: 5c2bff3d29c1366e52035ac809f119a2fdca47fc
-docs/README.zh.md: f629b3789be4b361ffd4045dff7fa6acf92770ff
+README.md: 59ddc56fb06a92c01d60d3d516095cc8cad5cd68
+docs/README.zh.md: c4784c0b2aece6af6f81f7944e12ec89f1631b46

package/README.md

@@ -16,17 +16,17 @@ This guide describes the published pairings below. Check `dsh --version` first a
 
 | Requirement | Verified pairing |
 |---|---|
-| Codex Connect | `0.1.0-alpha.4.35` |
+| Codex Connect | `0.1.0-alpha.4.37` |
 | DeepSeek Harness | `0.1.2-rc.1`, `0.1.5-alpha.1`, `0.1.5-rc.1`, or `0.1.5-rc.2` |
 | Node.js | `^22.19.0 \|\| >=24.0.0` |
 | Account | ChatGPT OAuth with access to the requested Codex model; availability is decided by OpenAI |
 
-As of 2026-09-11, npm `alpha` points to 4.35 while `latest` intentionally remains on 4.34. Use the exact version below for 4.35; this recommendation does not promote the default installation channel.
+As of 2026-09-19, npm `alpha` points to 4.37 while `latest` intentionally remains on 4.34. Use the exact version below for 4.37; this recommendation does not promote the default installation channel.
 
 ### 1. Install
 
 ```sh
-dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.35
+dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.37
 dsh web
 ```
 
@@ -56,7 +56,7 @@ dsh plugin --profile web exec dsh-codex-connect doctor --json
 - **Accounts:** save up to 16 accounts on the DSH host and manually select the active account for subsequent requests. Account selection is not a per-session binding. Requests keep their captured account; the plugin does not rotate accounts or silently fail over.
 - **Models and Astra support:** the currently verified DSH and plugin combination supports `gpt-6-astra`. The plugin supplies its missing model definition with Low, Medium, High, Xhigh, and Max reasoning levels; Default preserves the provider default. Saved Off/Minimal selections require an [explicit update](MIGRATION.md#astra-reasoning-selections). When the installed dependency catalog includes Astra, the plugin preserves its native metadata while retaining these five calibrated reasoning choices. A model appearing in the list does not mean the current account has permission to use it; overall compatibility with new dependency versions still requires separate verification.
 - **Fast Mode:** request priority service for one conversation, off by default. Actual speed and quota consumption depend on the service; no fixed speed multiplier is guaranteed.
-- **Quota:** show the server-returned `5h` and `7d` windows and reset times, normally refreshed every 60 seconds while signed in. Missing windows are not invented; Spark uses its separate quota bucket.
+- **Quota:** show the server-returned `5h` and `7d` windows and reset times, normally refreshed every 60 seconds while signed in and the tab is visible; failures back off. Missing windows are not invented; Spark uses its separate quota bucket.
 - **Plugin updates:** check for newer Codex Connect releases without installing anything or recommending changes to DSH. Host compatibility is available through explicit local diagnostics.
 
 <p align="center">
@@ -78,7 +78,7 @@ All options below are off on a fresh installation. Edit them in **Settings → P
 
 **Published experiment:** Alpha 4.35 includes Luna Reserve fallback, disabled by default. Real-account Reserve entry and recovery remain unverified; Alpha 4.34 does not include this feature.
 
-With `enableReserveFallback: true`, the account UI and agent routing share one identity-bound quota state. Background refresh follows the returned quota windows; fresh state is reused across agent steps. The plugin enters `gpt-reserve` only with complete, non-FedRAMP account/user identity and backend Luna Reserve authorization, then restores the session's previous model and reasoning effort after confirmed ordinary-usage recovery. Reserve has its own allowance, is hidden from the model picker, and is not unlimited. The backend decides eligibility; reset times alone do not authorize a switch. This version supports known `gpt-5.6-luna` metadata only. See [Luna Reserve fallback](docs/reference.md#luna-reserve-fallback) for refresh, identity, and verification limits.
+With `enableReserveFallback: true`, the account UI and agent routing share one identity-bound quota state. Background refresh follows the returned quota windows while recently in use; fresh state is reused across agent steps. Ordinary quota reads also share the cache, even with Reserve disabled. The plugin enters `gpt-reserve` only with complete, non-FedRAMP account/user identity and backend Luna Reserve authorization, then restores the session's previous model and reasoning effort after confirmed ordinary-usage recovery. Reserve has its own allowance, is hidden from the model picker, and is not unlimited. The backend decides eligibility; reset times alone do not authorize a switch. This version supports known `gpt-5.6-luna` metadata only. See [Luna Reserve fallback](docs/reference.md#luna-reserve-fallback) for refresh, identity, and verification limits.
 
 Use the image generation capability included with your current GPT subscription. Generated originals are stored separately from attachment previews; disabling the capability or uninstalling the plugin does not delete them. See [Configuration and recovery](docs/reference.md#search-and-image-tools) for storage and access rules.
 
@@ -100,8 +100,14 @@ Subsequent Codex requests use the selected active account; conversations do not
 
 ### Why does a listed model fail?
 
+Model HTTP/SSE failures include bounded, request-local diagnostic metadata after the existing error message. An `overloaded` message alone does not establish an account block. See [persistent-error diagnostics](docs/experiments/issue-219-diagnostics.md) for scope and reproduction.
+
 Account permissions, plugin/host compatibility, and network conditions all affect availability. Access on another client does not guarantee this integration will work. OpenAI controls model access, quota, context capacity, and service behavior; catalog entries are not proof of entitlement.
 
+### Does changing client headers prevent persistent authorization failures?
+
+No such guarantee is established. Codex Connect is a third-party integration; it does not impersonate Codex Desktop or fabricate installation/attestation headers. The pi-ai model/OAuth route and auxiliary routes currently identify themselves differently. OpenAI's [App Server documentation](https://developers.openai.com/codex/app-server/) asks integrations to identify their own client with `clientInfo`; it does not establish acceptance rules for this plugin's direct backend calls. An `overloaded` message is not proof of a block. Capture the bounded error metadata and compare successful and failed windows before attributing the cause; share request IDs privately, never tokens or full session archives.
+
 ### Can I keep the original `dsh-codex` plugin installed?
 
 Not in the same effective configuration: both register `openai-codex`. Follow [MIGRATION.md](MIGRATION.md); remove only the confirmed conflicting entry, not credentials or unrelated providers.

package/docs/README.zh.md

@@ -16,17 +16,17 @@ Codex Connect 为标准 Harness agent loop 添加 `openai-codex` 模型提供方
 
 | 要求 | 已验证组合 |
 |---|---|
-| Codex Connect | `0.1.0-alpha.4.35` |
+| Codex Connect | `0.1.0-alpha.4.37` |
 | DeepSeek Harness | `0.1.2-rc.1`、`0.1.5-alpha.1`、`0.1.5-rc.1` 或 `0.1.5-rc.2` |
 | Node.js | `^22.19.0 \|\| >=24.0.0` |
 | 账户 | 通过 ChatGPT OAuth 使用所请求的 Codex 模型；可用性由 OpenAI 决定 |
 
-截至 2026-09-11，npm `alpha` 指向 4.35，`latest` 则有意保留在 4.34。安装 4.35 请使用下方精确版本命令；文档推荐更新不代表默认安装渠道已提升。
+截至 2026-09-19，npm `alpha` 指向 4.37，`latest` 则有意保留在 4.34。安装 4.37 请使用下方精确版本命令；文档推荐更新不代表默认安装渠道已提升。
 
 ### 1. 安装
 
 ```sh
-dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.35
+dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.37
 dsh web
 ```
 
@@ -56,7 +56,7 @@ dsh plugin --profile web exec dsh-codex-connect doctor --json
 - **账户：**在 DSH 主机上保存最多 16 个账户，手动选择后续请求使用的活动账户，不按会话绑定。请求保持已固定的账户，插件不会自动轮换或静默故障切换。
 - **模型与 Astra 支持：**当前已验证的 DSH 与插件组合已支持 `gpt-6-astra`。插件补充缺失的模型定义，提供 Low、Medium、High、Xhigh 和 Max 五档推理强度；Default 保持提供方默认值。已保存的 Off/Minimal 选择需要[明确更新](../MIGRATION.md#astra-reasoning-selections)。安装的依赖目录包含 Astra 时，插件保留其原生元数据，同时维持这五档已校准的推理选择。模型出现在列表中，不代表当前账户具有调用权限；新依赖版本的整体兼容性仍需单独验证。
 - **Fast Mode：**为单个对话请求优先服务，默认关闭。实际速度和额度消耗取决于服务端，不保证固定提速倍数。
-- **额度：**显示服务端返回的 `5h`、`7d` 窗口及重置时间，已登录时通常每 60 秒刷新一次。不虚构缺失窗口；Spark 使用独立额度桶。
+- **额度：**显示服务端返回的 `5h`、`7d` 窗口及重置时间，已登录且标签页可见时通常每 60 秒刷新一次；失败后延长重试间隔。不虚构缺失窗口；Spark 使用独立额度桶。
 - **插件更新：**检查 Codex Connect 新版本，不自动安装，也不建议更改 DSH。宿主兼容性信息通过主动运行的本地诊断查看。
 
 <p align="center">
@@ -78,7 +78,7 @@ dsh plugin --profile web exec dsh-codex-connect doctor --json
 
 **已发布的实验功能：** Alpha 4.35 包含 Luna Reserve 回退，仍默认关闭。真实账户进入 Reserve 及恢复普通模型的过程仍未验证；Alpha 4.34 不包含该功能。
 
-启用 `enableReserveFallback: true` 后，账户 UI 和 agent 路由共用一份绑定身份的额度状态，按服务端返回的额度窗口后台刷新；有效状态可跨 agent step 复用。只有身份完整、非 FedRAMP 且服务端授权时，插件才进入 `gpt-reserve`；普通额度确认恢复后，切回该会话先前的模型和推理强度。Reserve 有自己的额度，不出现在模型选择器中，也不是无限额度。资格由服务端决定，重置时间本身不授权切换。当前版本只支持已知的 `gpt-5.6-luna` 元数据。刷新、身份和验证限制见 [Luna Reserve 回退](reference.zh.md#luna-reserve-回退)。
+启用 `enableReserveFallback: true` 后，账户 UI 和 agent 路由共用一份绑定身份的额度状态，最近有使用需求时按服务端返回的额度窗口后台刷新；有效状态可跨 agent step 复用。普通额度读取也共用缓存，即使 Reserve 已关闭。只有身份完整、非 FedRAMP 且服务端授权时，插件才进入 `gpt-reserve`；普通额度确认恢复后，切回该会话先前的模型和推理强度。Reserve 有自己的额度，不出现在模型选择器中，也不是无限额度。资格由服务端决定，重置时间本身不授权切换。当前版本只支持已知的 `gpt-5.6-luna` 元数据。刷新、身份和验证限制见 [Luna Reserve 回退](reference.zh.md#luna-reserve-回退)。
 
 使用你当前 GPT 订阅计划提供的图片生成能力。生成原文件与附件预览分开保存；关闭能力或卸载插件不会删除这些文件。存储和访问规则见[配置与恢复](reference.zh.md#搜索与图片工具)。
 
@@ -100,8 +100,14 @@ OAuth 凭据保存在运行 DSH 的主机上，由该主机用于向 OpenAI 认
 
 ### 为什么列表中的模型调用失败？
 
+模型 HTTP/SSE 请求失败时，会在原错误消息后附加有界、仅属于该请求的诊断信息。单凭 `overloaded` 消息不能认定账户被封锁。范围与复现方式见[持续错误诊断](experiments/issue-219-diagnostics.md)。
+
 账户权限、插件与宿主兼容性、网络条件都会影响可用性。其他客户端可以使用，不代表此集成一定可用。OpenAI 控制模型权限、额度、上下文容量和服务行为；目录条目不是账户权限证明。
 
+### 修改客户端请求头就能避免持续授权失败吗？
+
+目前没有这样的保证。Codex Connect 是第三方集成，不冒充 Codex Desktop，也不伪造安装标识或 attestation 请求头。pi-ai 模型/OAuth 路由与辅助路由目前采用不同的客户端身份。OpenAI 的 [App Server 文档](https://developers.openai.com/codex/app-server/)要求集成通过 `clientInfo` 标识自己的客户端，但这不能证明本插件直接调用后端接口的接受规则。`overloaded` 本身不是封锁证据。应保留有界诊断信息，对照成功和失败时段后再判断原因；请求 ID 仅私下提供，不公开 token 或完整会话归档。
+
 ### 可以保留原来的 `dsh-codex` 插件吗？
 
 不能在同一份有效配置中并存：两者都会注册 `openai-codex`。请遵循 [MIGRATION.md](../MIGRATION.md)，只移除已经确认冲突的条目，不删除凭据或无关提供方。

package/docs/agent-notes/adaptive-runtime-status.md

@@ -1,4 +1,8 @@
-# Alpha 4.37 preparation checkpoint — 2026-09-19
+# Alpha 4.37 published checkpoint — 2026-09-19
+
+Alpha `0.1.0-alpha.4.37` was published from `5cbd0d330d12c81f0bf37515b65bc799e480aa78` through successful workflow `35439115133`. The npm archive equals the final tested artifact; the Git tag and published GitHub prerelease match the release commit. `alpha` is 4.37; `latest` remains 4.34. See [publication verification](../../.github/ALPHA_437_PUBLICATION.md). No service or default changed, and no new live-model request was made. The local DSH repair, Think and Split are not included.
+
+## Historical preparation checkpoint — 2026-09-19
 
 #216 was normally squash-merged at `525e01b6e1c2b7d23ba70e29510ef1fd31fb0168`; the merge tree equals the reviewed `1e05677` tree. Main CI `35436177342` passed. This branch prepares 0.1.0-alpha.4.37. The maintainer subsequently authorized publication through the normal candidate-review/main-CI/OIDC workflow on 2026-09-19; a prepared branch is not publication evidence. `latest`, running services and live model calls remain outside scope. See [release readiness](../../.github/ALPHA_437_RELEASE_READINESS.md) and [draft release notes](../release-notes/alpha-4.37.md).
 

package/docs/experiments/issue-219-diagnostics.md

@@ -0,0 +1,49 @@
+# Issue 219: persistent SSE failures and quota traffic
+
+Implementation baseline: main commit e5772cd8a5c47f30b5ab14fe73d2901914348463 (alpha 4.37), 2026-09-20.
+These changes are diagnostic and traffic-management fixes, not evidence that the reported authorization session was blocked or that an account-side problem has been resolved.
+
+## Model request diagnostics
+
+The adapter uses the provider's request-local fetch extension, not a global fetch patch or a modified pi-ai installation. It observes bounded complete SSE frames while forwarding the original bytes, response metadata, backpressure and cancellation. It does not retry or replay failed model turns.
+
+Each HTTP attempt receives a fresh x-client-request-id. Session affinity and originator/User-Agent are unchanged. The final Harness error message receives a compact JSON diagnostic suffix only after Harness has classified the original error, so numeric request ids cannot change PI_AI_ERROR into AUTH/RATE_LIMIT. Concurrent turns do not share diagnostic state.
+
+Fields are limited to HTTP status, locally generated attempt id, bounded server request ids, first SSE error event type, schema-shaped error code/type, and a finite HTTP Retry-After delay. Missing fields remain missing. Arbitrary event fields, full headers, tokens, account ids, generated content and raw payloads are not added to the suffix. A maximum 16 KiB decoded frame is observed; larger or malformed frames stop further SSE attribution for that response, preserving HTTP metadata without guessing at later frames; incomplete frames are not inferred. The original bytes sent to pi-ai are unchanged. Existing provider error text remains unchanged.
+
+Coverage is the model adapter's HTTP/SSE route through a pi-ai version honoring the fetch extension. It does not add persisted history to doctor, infer blocked-vs-capacity from a message, change standalone Search/Image/Auto-review diagnostics, or instrument native compaction's separate direct fetch. WebSocket diagnostics are not claimed; the plugin's model profile uses SSE.
+
+## Quota traffic
+
+Ordinary quota reads now coalesce and cache even when Reserve is off. Cache keys bind the account and a hash of the exact access credential; no raw token is retained as a key. Renewed credentials do not inherit an old session's rejected snapshot. Configuration/account mutations and disposal still invalidate authority.
+
+Successful ordinary snapshots last 60 seconds. Reserve retains its existing adaptive freshness requirements while in use, but its timer cannot renew its own activity lease. After two minutes without a foreground consumer it stops fetching. Expiry still revokes stale routing permits without a network request. Enabling Reserve remains explicit; none of these changes infer server authorization from elapsed time or a generic error.
+
+Transient errors use 60/120/240/480/900-second backoff, positive jitter bounded to 10% (and a 900-second local ceiling), and any longer valid server Retry-After. A successful refresh resets the failure count. Authentication rejection and non-retryable 4xx failures latch for the current credential/state. Retry hints outside the timer range cannot become immediate timers.
+
+The browser does not poll while hidden, does not overlap slow requests, and respects its existing cooldown when refocused. Both local network failures and server quotaError responses cause browser backoff. Foreground retry requests cannot bypass the backend's cached failure deadline. These caches are per plugin instance, not a cross-process rate limiter.
+
+## Offline verification
+
+Run from the working checkout:
+
+~~~sh
+pnpm exec vitest run tests/issue-219-diagnostics.spec.ts tests/issue-219-quota.client.spec.tsx tests/quota-state.spec.ts tests/openai-codex-quota-indicator.client.spec.tsx tests/usage.spec.ts tests/adapter.spec.ts tests/adapter-auth-boundary.spec.ts
+pnpm run check
+~~~
+
+The targeted fixtures use synthetic credentials and mocked HTTP/SSE, including an actual pi-ai -> Harness adapter pass. They cover flat/nested/response.failed errors, request-id isolation, host classification, hooks, malformed/large/split frames, cancellation, visibility, ordinary-mode cache sharing, repeated errors, retry hints, reauthorization and idle expiry. They do not reproduce the reporter's 23-hour account condition or constitute Windows/live-account acceptance.
+
+A follow-up review reproduced an expiry/foreground-refresh race introduced in 420ce42: when a foreground refresh starts at the old snapshot deadline before its already-queued timer fires, the timer could abort the replacement request using the old deadline. The timer now skips entries with a pending refresh; starting that refresh has already revoked the old snapshot. The regression test queues both operations at the same deadline and verifies that the old permit expires, the new request survives, and concurrent readers reuse its result. The test fails before the fix and passes after it; account invalidation and disposal still cancel pending work.
+
+A second review reproduced incorrect attribution of an unread later error after malformed JSON, an oversized earlier error, or a completed empty response in one network chunk. Three real-adapter regressions fail on 0bc83ee and pass after stopping observation at an ambiguous or terminal boundary. HTTP request metadata remains available when SSE attribution stops.
+
+When collecting future evidence, compare a failed request's timestamp, HTTP status, SSE code/type and server request id with its successful window. Share request ids privately with the service operator; never publish OAuth tokens, credential files, account ids or a complete session archive.
+
+## Issue closure criteria
+
+The release candidate is 0.1.0-alpha.4.38. Its client-side acceptance covers hidden-page suspension, ordinary cache/coalescing, failure backoff, renewed-credential isolation, bounded diagnostics and the expiry/attribution regressions. CI and synthetic fixtures cannot establish the cause or recovery of a 23-hour upstream failure. Do not auto-close #219 merely because this PR merges or the package publishes.
+
+The reporter should confirm the exact installed plugin/DSH/pi-ai versions and whether normal use remains healthy through a comparable observation window. If it recurs, retain the timestamp, HTTP status, error code/type and request IDs from the new suffix; send request IDs privately to the service operator. Compare ordinary single-turn use with optional Search/Image/Reserve/Auto-review disabled, then re-enable only the needed routes one at a time. This is controlled diagnosis, not a high-volume stress test or a guarantee of recovery. Do not revoke all devices, delete credentials, rotate accounts, or rewrite the client identity automatically.
+
+On 2026-09-20 a repository-scoped issue search for `overloaded` found #219 only. This is not a claim that no similar upstream report exists. Header classification, backend eligibility and account/session-level restrictions require evidence from the service operator; official-client binary strings are not a published backend contract.

package/docs/reference.i18n.yaml

@@ -1,4 +1,4 @@
 # Bilingual-pair consistency record for the operational reference. Re-record with:
 #   git hash-object docs/reference.md docs/reference.zh.md
-docs/reference.md: b4a7480a0bd95cc5cfee5f713a10a7820ee61342
-docs/reference.zh.md: cffb2fd685a2f0189d75c4ae3cbf6716697e063c
+docs/reference.md: b6d177da34691432d0c39c27644ef4b083af0d2a
+docs/reference.zh.md: 926b475eb378191b56b9de6c386b7a03a9292d30

package/docs/reference.md

@@ -28,7 +28,7 @@ An explicit OAuth `invalid_grant` rejection during refresh shows the reauthoriza
 For GPT Codex conversations, the Composer shows Fast Mode and quota:
 
 - **Fast Mode** requests priority service (`service_tier: 'priority'`) for that conversation only. It is off by default and does not change the model. Actual speed and quota consumption depend on the service; a fixed speed multiplier is not guaranteed.
-- **Quota bars** normally refresh every 60 seconds while signed in and show only the `5h` and `7d` windows returned by the server, with the exact remaining percentage and reset time. `gpt-5.3-codex-spark` uses its separate Spark bucket. Codex Connect never invents missing windows or suppresses returned windows based on a plan name.
+- **Quota bars** normally refresh every 60 seconds while signed in and the tab is visible (hidden tabs pause; failures back off) and show only the `5h` and `7d` windows returned by the server, with the exact remaining percentage and reset time. `gpt-5.3-codex-spark` uses its separate Spark bucket. Codex Connect never invents missing windows or suppresses returned windows based on a plan name.
 
 <p align="center">
   <img src="https://raw.githubusercontent.com/franksong2702/dsh-codex-connect/main/docs/assets/composer-capabilities.jpg" alt="Fast Mode and quota controls in the DeepSeek Harness Composer" width="820">
@@ -61,9 +61,9 @@ Direct connection is the default. An enabled credential-free HTTP(S) proxy appli
 
 Published Alpha 4.35 includes this default-off experiment; Alpha 4.34 does not include it. Real-account Reserve entry and recovery remain unverified. See the [publication and installation evidence](../.github/ALPHA_435_RELEASE_READINESS.md).
 
-`enableReserveFallback: true` opts agent requests into backend-authorized Luna Reserve fallback. The account UI and routing share an in-memory account/user-bound quota snapshot; concurrent reads coalesce and fresh reads do not issue another quota `GET`. A cold or stale read waits for refresh. After a successful fetch, background refresh runs at 60/30/15/5 seconds for usage below 75%, at least 75%, at least 90%, and at least 99%, using the highest consumption across ordinary and relevant model windows. Future reset times shorten the next refresh to reset plus one second; they never establish recovery. Cache reads do not postpone that deadline. Failed fetches discard cached decisions and retry after five seconds. Account mutations, settings changes, and plugin disposal invalidate the state; UI receives only the public quota projection.
+`enableReserveFallback: true` opts agent requests into backend-authorized Luna Reserve fallback. The account UI and routing share an in-memory account/user-bound quota snapshot; concurrent reads coalesce and fresh reads do not issue another quota `GET`. A cold or stale read waits for refresh. After a successful fetch, background refresh runs at 60/30/15/5 seconds for usage below 75%, at least 75%, at least 90%, and at least 99%, using the highest consumption across ordinary and relevant model windows. Future reset times shorten the next refresh to reset plus one second; they never establish recovery. Cache reads do not postpone that deadline. Transient failures discard cached decisions and use exponential backoff starting at 60 seconds, with up to 10% positive jitter and a 15-minute local cap; a longer valid `Retry-After` takes precedence. Authentication rejections and non-retryable 4xx errors stop automatic usage requests for that credential until credentials/state change. Delays beyond the timer range stop automatic retry rather than overflowing. Background GETs stop after two minutes without a foreground quota consumer; stale routing authority still expires. Account mutations, settings changes, and plugin disposal invalidate the state; UI receives only the public quota projection.
 
-A valid shared decision issues a private one-shot permit for the next `gpt-reserve` dispatch in that session/account. This local dispatch guard is not a server-side per-call authorization requirement. Cancellation, replacement, an agent error, turn stopping, quota invalidation, snapshot refresh, or cache eviction revokes an unused permit. Return-target I/O rechecks that authority before restoring an ordinary model. Direct and auxiliary Reserve calls fail before a model request. With fallback disabled, ordinary agent steps do not query quota, account UI reads remain passive, and there is no background quota poller. An already-Reserve session requires an explicitly selected ordinary model.
+A valid shared decision issues a private one-shot permit for the next `gpt-reserve` dispatch in that session/account. This local dispatch guard is not a server-side per-call authorization requirement. Cancellation, replacement, an agent error, turn stopping, quota invalidation, snapshot refresh, or cache eviction revokes an unused permit. Return-target I/O rechecks that authority before restoring an ordinary model. Direct and auxiliary Reserve calls fail before a model request. With fallback disabled, ordinary agent steps do not query quota and there is no background quota poller; account UI reads share a 60-second credential-bound cache, concurrent GET coalescing, and failure cooldowns. An already-Reserve session requires an explicitly selected ordinary model.
 
 The access token must contain non-empty `chatgpt_account_id` and `chatgpt_user_id` (or `user_id`) claims under `https://api.openai.com/auth`, and `chatgpt_account_is_fedramp` must be absent or `false`. Missing, partial, FedRAMP, changed, or response-mismatched identity disables fallback for that step. The plugin does not guess identity from an email address or subscription plan.
 

package/docs/reference.zh.md

@@ -28,7 +28,7 @@ Codex 目录来自已安装的 `@earendil-works/pi-ai` 包，不是实时查询
 GPT Codex 对话的 Composer 会显示 Fast Mode 与额度：
 
 - **Fast Mode** 只为当前对话请求优先服务（`service_tier: 'priority'`）。默认关闭，也不会更换模型。实际速度和额度消耗取决于服务端，不保证固定提速倍数。
-- **额度条**在已登录时通常每 60 秒刷新一次，只显示服务端实际返回的 `5h` 和 `7d` 窗口，并显示精确剩余百分比与重置时间。`gpt-5.3-codex-spark` 使用独立的 Spark 额度桶。Codex Connect 不会虚构缺失窗口，也不会根据套餐名称隐藏已返回窗口。
+- **额度条**在已登录且标签页可见时通常每 60 秒刷新一次（隐藏时暂停，失败后延长重试间隔），只显示服务端实际返回的 `5h` 和 `7d` 窗口，并显示精确剩余百分比与重置时间。`gpt-5.3-codex-spark` 使用独立的 Spark 额度桶。Codex Connect 不会虚构缺失窗口，也不会根据套餐名称隐藏已返回窗口。
 
 <p align="center">
   <img src="https://raw.githubusercontent.com/franksong2702/dsh-codex-connect/main/docs/assets/composer-capabilities.jpg" alt="DeepSeek Harness Composer 中的 Fast Mode 与额度控件" width="820">
@@ -61,9 +61,9 @@ GPT Codex 对话的 Composer 会显示 Fast Mode 与额度：
 
 已发布的 Alpha 4.35 包含这项默认关闭的实验功能；Alpha 4.34 不包含该功能。真实账户进入 Reserve 及恢复普通模型的过程仍未完成验证。详见[发布与安装验证记录](../.github/ALPHA_435_RELEASE_READINESS.md)。
 
-`enableReserveFallback: true` 为 agent 请求启用由后端授权的 Luna Reserve 回退。账户 UI 和路由共用绑定账户与用户的内存额度快照；并发读取合并，有效状态不再发起额度 `GET`。首次或过期读取等待刷新。查询成功后，根据普通额度和相关模型窗口中的最高消耗，低于 75%、达到 75%、达到 90%、达到 99% 时，分别每 60/30/15/5 秒后台刷新。未来重置时间可将下次刷新提前到重置后一秒，但不证明额度恢复。缓存读取不会推迟刷新期限。查询失败会清除缓存决策，五秒后重试。账户修改、设置变更和插件卸载会使状态失效；UI 只接收公开额度投影。
+`enableReserveFallback: true` 为 agent 请求启用由后端授权的 Luna Reserve 回退。账户 UI 和路由共用绑定账户与用户的内存额度快照；并发读取合并，有效状态不再发起额度 `GET`。首次或过期读取等待刷新。查询成功后，根据普通额度和相关模型窗口中的最高消耗，低于 75%、达到 75%、达到 90%、达到 99% 时，分别每 60/30/15/5 秒后台刷新。未来重置时间可将下次刷新提前到重置后一秒，但不证明额度恢复。缓存读取不会推迟刷新期限。临时查询失败会清除缓存决策，并从 60 秒开始指数退避，附加最多 10% 的正向随机延迟，本地等待上限为 15 分钟；服务端有效的 `Retry-After` 更长时优先遵循。认证拒绝和不可重试的 4xx 错误会停止该凭据的自动额度请求，直到凭据或状态改变。超出定时器范围的延迟会停止自动重试，而不会溢出为立即重试。两分钟没有前台额度消费者后，后台停止发送 GET；过期的路由授权仍会失效。账户修改、设置变更和插件卸载会使状态失效；UI 只接收公开额度投影。
 
-有效的共享决策为该会话和账户的下一次 `gpt-reserve` 调用签发私有一次性许可。这是本地调用保护，不代表服务端要求每次调用单独认证额度。取消、替换请求、agent 出错、回合停止、额度状态失效、快照刷新或缓存淘汰都会撤销未使用的许可。恢复普通模型前，返回记录的读取也会重新检查该授权是否有效。直接和辅助 Reserve 调用会在发送前失败。关闭回退时，普通 agent 步骤不查询额度，账户 UI 保持被动读取，也不创建后台额度轮询；已处于 Reserve 的会话需要显式选择普通模型。
+有效的共享决策为该会话和账户的下一次 `gpt-reserve` 调用签发私有一次性许可。这是本地调用保护，不代表服务端要求每次调用单独认证额度。取消、替换请求、agent 出错、回合停止、额度状态失效、快照刷新或缓存淘汰都会撤销未使用的许可。恢复普通模型前，返回记录的读取也会重新检查该授权是否有效。直接和辅助 Reserve 调用会在发送前失败。关闭回退时，普通 agent 步骤不查询额度，也不创建后台额度轮询；账户 UI 读取共用绑定凭据的 60 秒缓存、并发 GET 合并与失败冷却；已处于 Reserve 的会话需要显式选择普通模型。
 
 Access token 的 `https://api.openai.com/auth` 中必须包含非空的 `chatgpt_account_id` 和 `chatgpt_user_id`（或 `user_id`），且 `chatgpt_account_is_fedramp` 必须缺省或为 `false`。身份缺失、不完整、属于 FedRAMP、发生变化或与额度响应不匹配时，该步骤不会启用回退。插件不会从邮箱地址或订阅套餐推测身份。
 

package/docs/release-notes/alpha-4.37.md

@@ -1,6 +1,6 @@
-# Codex Connect 0.1.0-alpha.4.37 — draft release notes
+# Codex Connect 0.1.0-alpha.4.37 — release notes
 
-**Preparation only; not published.**
+**Published on 2026-09-19.** [GitHub prerelease](https://github.com/franksong2702/dsh-codex-connect/releases/tag/v0.1.0-alpha.4.37); npm `alpha` points to 4.37 and `latest` remains 4.34. The [publication record](../../.github/ALPHA_437_PUBLICATION.md) verifies the immutable release commit and archive. This post-publication document update does not republish the package.
 
 ## Changes
 

package/lib/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { A as DSH_PLUGIN_API_PACKAGES, B as isSupportedDshPluginApiVersion, Ft as loginOpenAICodex, Gt as openAICodexAuthPath, It as logoutOpenAICodex, Lt as openAICodexAuthStatus, Pt as openAICodexModelCatalog, Rt as publicAuthError, Ut as OPENAI_CODEX_PROVIDER, V as readInstalledPackageVersion, Wt as OpenAICodexCredentialStore, c as migrateOpenAICodexSearchHistory, d as OPENAI_CODEX_BASE_URL, jt as normalizeOpenAICodexProxyUrl, l as CODEX_AUTO_REVIEW_MODEL, nt as OpenAICodexTrustedOriginsStore, rt as normalizeTrustedOrigin, u as probeCodexAutoReview, x as CODEX_CONNECT_VERSION, y as diagnoseOpenAICodex, z as evaluateCompatibility } from "./src-CceJ4VNv.js";
+import { A as DSH_PLUGIN_API_PACKAGES, B as isSupportedDshPluginApiVersion, Ft as loginOpenAICodex, Gt as openAICodexAuthPath, It as logoutOpenAICodex, Lt as openAICodexAuthStatus, Pt as openAICodexModelCatalog, Rt as publicAuthError, Ut as OPENAI_CODEX_PROVIDER, V as readInstalledPackageVersion, Wt as OpenAICodexCredentialStore, c as migrateOpenAICodexSearchHistory, d as OPENAI_CODEX_BASE_URL, jt as normalizeOpenAICodexProxyUrl, l as CODEX_AUTO_REVIEW_MODEL, nt as OpenAICodexTrustedOriginsStore, rt as normalizeTrustedOrigin, u as probeCodexAutoReview, x as CODEX_CONNECT_VERSION, y as diagnoseOpenAICodex, z as evaluateCompatibility } from "./src-hB8Ph2Et.js";
 import { i as fetch, r as ProxyAgent, t as Agent } from "./undici-runtime-H2uktiw6.js";
 import { createHash } from "node:crypto";
 import { realpathSync } from "node:fs";

package/lib/client.js

@@ -4244,7 +4244,7 @@ window.__ModuleLoader__.load({
 			return typeof remainingPercent === "number" && Number.isFinite(remainingPercent) && remainingPercent >= 0 && remainingPercent <= 100 && typeof windowSeconds === "number" && Number.isSafeInteger(windowSeconds) && windowSeconds > 0 && (resetAt === void 0 || typeof resetAt === "number" && Number.isSafeInteger(resetAt) && resetAt > 0 && Number.isFinite((/* @__PURE__ */ new Date(resetAt * 1e3)).getTime()));
 		}
 		function usageFromStatus(value) {
-			if (!isRecord$1(value) || value["status"] !== "signed-in") return void 0;
+			if (!isRecord$1(value) || value["status"] !== "signed-in" || typeof value["quotaError"] === "string") return void 0;
 			const usage = value["usage"];
 			if (!isRecord$1(usage) || !Array.isArray(usage["rateLimits"])) return void 0;
 			const rateLimits = usage["rateLimits"];
@@ -4308,8 +4308,18 @@ window.__ModuleLoader__.load({
 				const controller = new AbortController();
 				let inFlight = false;
 				let disposed = false;
+				let failures = 0;
+				let nextAt = 0;
+				let timer;
+				const schedule = () => {
+					window.clearTimeout(timer);
+					timer = void 0;
+					if (!disposed && !document.hidden && !inFlight) timer = window.setTimeout(() => {
+						refresh();
+					}, Math.max(0, nextAt - Date.now()));
+				};
 				const refresh = async () => {
-					if (inFlight || disposed) return;
+					if (inFlight || disposed || document.hidden) return;
 					inFlight = true;
 					try {
 						const response = await fetch(OPENAI_CODEX_AUTH_STATUS_PATH, {
@@ -4320,24 +4330,27 @@ window.__ModuleLoader__.load({
 						});
 						const value = await response.json().catch(() => void 0);
 						const usage = response.ok ? usageFromStatus(value) : void 0;
+						failures = usage === void 0 ? Math.min(failures + 1, 5) : 0;
 						if (!disposed && !controller.signal.aborted) setRequest(usage === void 0 ? { status: "hidden" } : {
 							status: "ready",
 							usage
 						});
 					} catch {
+						failures = Math.min(failures + 1, 5);
 						if (!disposed && !controller.signal.aborted) setRequest({ status: "hidden" });
 					} finally {
 						inFlight = false;
+						nextAt = Date.now() + Math.min(9e5, USAGE_POLL_INTERVAL_MS * 2 ** Math.max(0, failures - 1));
+						schedule();
 					}
 				};
 				setRequest({ status: "loading" });
 				refresh();
-				const timer = window.setInterval(() => {
-					refresh();
-				}, USAGE_POLL_INTERVAL_MS);
+				document.addEventListener("visibilitychange", schedule);
 				return () => {
 					disposed = true;
-					window.clearInterval(timer);
+					document.removeEventListener("visibilitychange", schedule);
+					window.clearTimeout(timer);
 					controller.abort();
 				};
 			}, [eligible]);
@@ -6530,7 +6543,7 @@ window.__ModuleLoader__.load({
 		}
 		//#endregion
 		//#region src/version.ts
-		const CODEX_CONNECT_VERSION = "0.1.0-alpha.4.37";
+		const CODEX_CONNECT_VERSION = "0.1.0-alpha.4.38";
 		//#endregion
 		//#region src/client/OpenAICodexModelsCard.tsx
 		/** Compact Models account entry with quota disclosure and shared configuration. */

package/lib/index.js

@@ -1,2 +1,2 @@
-import { $ as OPENAI_CODEX_FAST_MODE_MAX_SESSIONS, A as DSH_PLUGIN_API_PACKAGES, At as isValidOpenAICodexProxyUrl, Bt as OPENAI_CODEX_AUTH_DOCUMENT_LIMIT, C as checkForOpenAICodexUpdate, Ct as DEFAULT_OPENAI_CODEX_SEARCH_MODE, D as COMPATIBILITY_CONTRACT, Dt as decodeOpenAICodexSettings, E as parseOpenAICodexVersion, Et as OPENAI_CODEX_SETTINGS_NAMESPACE, F as SUPPORTED_NODE_RANGE, Ft as loginOpenAICodex, G as OPENAI_CODEX_PROXY_CANDIDATE_LIMIT, Gt as openAICodexAuthPath, H as OPENAI_CODEX_PROXY_DETECT_PATH, Ht as OPENAI_CODEX_AUTH_V1_BACKUP_SUFFIX, I as SUPPORTED_PI_AI_RANGE, It as logoutOpenAICodex, J as OpenAICodexProxyManager, K as OPENAI_CODEX_PROXY_PROBE_TIMEOUT_MS, L as assessCompatibility, Lt as openAICodexAuthStatus, M as SUPPORTED_DSH_PLUGIN_API_RANGE, Mt as resolveOpenAICodexProxyUrl, N as SUPPORTED_DSH_PLUGIN_API_VERSION, Nt as resolveOpenAICodexSettings, O as COMPATIBILITY_PACKAGES, Ot as isValidOpenAICodexContextWindowOverrides, P as SUPPORTED_DSH_PLUGIN_API_VERSIONS, Q as FastModeRegistry, R as detectCompatibility, S as OPENAI_CODEX_UPDATE_PATH, St as DEFAULT_OPENAI_CODEX_SEARCH_MAX_OUTPUT_TOKENS, T as parseOpenAICodexUpdateResult, Tt as DEFAULT_OPENAI_CODEX_SETTINGS, U as OPENAI_CODEX_PROXY_TEST_PATH, Ut as OPENAI_CODEX_PROVIDER, Vt as OPENAI_CODEX_AUTH_FILENAME, W as OPENAI_CODEX_LOCAL_PROXY_CANDIDATES, Wt as OpenAICodexCredentialStore, X as listOpenAICodexProxyCandidates, Y as detectOpenAICodexProxies, Z as OPENAI_CODEX_FAST_MODE_PATH, _ as IMAGE_GENERATE_TOOL_NAME, _t as OpenAICodexTransportError, a as name, at as parseOpenAICodexUsage, b as openAICodexConflictMessage, bt as DEFAULT_OPENAI_CODEX_PROXY_URL, c as migrateOpenAICodexSearchHistory, ct as OPENAI_CODEX_IMAGE_MAX_COUNT, d as OPENAI_CODEX_BASE_URL, dt as OPENAI_CODEX_IMAGE_PROMPT_MAX_LENGTH, et as OPENAI_CODEX_FAST_MODE_MAX_SESSION_ID_LENGTH, f as OPENAI_CODEX_SEARCH_PROVIDER, ft as OPENAI_CODEX_IMAGE_REQUEST_TIMEOUT_MS, g as VIEW_IMAGE_TOOL_NAME, gt as OpenAICodexTransport, h as mapOpenAICodexSearchResponse, ht as OPENAI_CODEX_TRANSPORT_SERVICE, i as inject, it as OPENAI_CODEX_USAGE_URL, j as PI_AI_PACKAGE, k as COMPATIBILITY_SCHEMA_VERSION, kt as isValidOpenAICodexImageModelHint, lt as OPENAI_CODEX_IMAGE_MAX_ERROR_BYTES, m as OpenAICodexSearchProvider, mt as OPENAI_CODEX_TRANSPORT_ERROR_CODES, n as OPENAI_CODEX_SETTINGS_NS, o as OPENAI_CODEX_HISTORY_BACKUP_SUFFIX, ot as readOpenAICodexRateLimits, p as OPENAI_CODEX_SEARCH_URL, pt as OPENAI_CODEX_TRANSPORT_API_VERSION, q as OPENAI_CODEX_PROXY_PROBE_URL, r as apply, s as OPENAI_CODEX_SEARCH_MODEL_REQUEST_EVENT, st as OPENAI_CODEX_IMAGE_GENERATION_URL, t as Config, tt as isFastModeSessionId, ut as OPENAI_CODEX_IMAGE_MAX_RESPONSE_BYTES, v as assertNoOpenAICodexProviderConflict, vt as isOpenAICodexTransportError, w as compareOpenAICodexVersions, wt as DEFAULT_OPENAI_CODEX_SEARCH_MODEL, xt as DEFAULT_OPENAI_CODEX_SEARCH_CONTEXT_SIZE, y as diagnoseOpenAICodex, yt as DEFAULT_OPENAI_CODEX_IMAGE_MODEL_HINT, z as evaluateCompatibility, zt as OPENAI_CODEX_ACCOUNT_LIMIT } from "./src-CceJ4VNv.js";
+import { $ as OPENAI_CODEX_FAST_MODE_MAX_SESSIONS, A as DSH_PLUGIN_API_PACKAGES, At as isValidOpenAICodexProxyUrl, Bt as OPENAI_CODEX_AUTH_DOCUMENT_LIMIT, C as checkForOpenAICodexUpdate, Ct as DEFAULT_OPENAI_CODEX_SEARCH_MODE, D as COMPATIBILITY_CONTRACT, Dt as decodeOpenAICodexSettings, E as parseOpenAICodexVersion, Et as OPENAI_CODEX_SETTINGS_NAMESPACE, F as SUPPORTED_NODE_RANGE, Ft as loginOpenAICodex, G as OPENAI_CODEX_PROXY_CANDIDATE_LIMIT, Gt as openAICodexAuthPath, H as OPENAI_CODEX_PROXY_DETECT_PATH, Ht as OPENAI_CODEX_AUTH_V1_BACKUP_SUFFIX, I as SUPPORTED_PI_AI_RANGE, It as logoutOpenAICodex, J as OpenAICodexProxyManager, K as OPENAI_CODEX_PROXY_PROBE_TIMEOUT_MS, L as assessCompatibility, Lt as openAICodexAuthStatus, M as SUPPORTED_DSH_PLUGIN_API_RANGE, Mt as resolveOpenAICodexProxyUrl, N as SUPPORTED_DSH_PLUGIN_API_VERSION, Nt as resolveOpenAICodexSettings, O as COMPATIBILITY_PACKAGES, Ot as isValidOpenAICodexContextWindowOverrides, P as SUPPORTED_DSH_PLUGIN_API_VERSIONS, Q as FastModeRegistry, R as detectCompatibility, S as OPENAI_CODEX_UPDATE_PATH, St as DEFAULT_OPENAI_CODEX_SEARCH_MAX_OUTPUT_TOKENS, T as parseOpenAICodexUpdateResult, Tt as DEFAULT_OPENAI_CODEX_SETTINGS, U as OPENAI_CODEX_PROXY_TEST_PATH, Ut as OPENAI_CODEX_PROVIDER, Vt as OPENAI_CODEX_AUTH_FILENAME, W as OPENAI_CODEX_LOCAL_PROXY_CANDIDATES, Wt as OpenAICodexCredentialStore, X as listOpenAICodexProxyCandidates, Y as detectOpenAICodexProxies, Z as OPENAI_CODEX_FAST_MODE_PATH, _ as IMAGE_GENERATE_TOOL_NAME, _t as OpenAICodexTransportError, a as name, at as parseOpenAICodexUsage, b as openAICodexConflictMessage, bt as DEFAULT_OPENAI_CODEX_PROXY_URL, c as migrateOpenAICodexSearchHistory, ct as OPENAI_CODEX_IMAGE_MAX_COUNT, d as OPENAI_CODEX_BASE_URL, dt as OPENAI_CODEX_IMAGE_PROMPT_MAX_LENGTH, et as OPENAI_CODEX_FAST_MODE_MAX_SESSION_ID_LENGTH, f as OPENAI_CODEX_SEARCH_PROVIDER, ft as OPENAI_CODEX_IMAGE_REQUEST_TIMEOUT_MS, g as VIEW_IMAGE_TOOL_NAME, gt as OpenAICodexTransport, h as mapOpenAICodexSearchResponse, ht as OPENAI_CODEX_TRANSPORT_SERVICE, i as inject, it as OPENAI_CODEX_USAGE_URL, j as PI_AI_PACKAGE, k as COMPATIBILITY_SCHEMA_VERSION, kt as isValidOpenAICodexImageModelHint, lt as OPENAI_CODEX_IMAGE_MAX_ERROR_BYTES, m as OpenAICodexSearchProvider, mt as OPENAI_CODEX_TRANSPORT_ERROR_CODES, n as OPENAI_CODEX_SETTINGS_NS, o as OPENAI_CODEX_HISTORY_BACKUP_SUFFIX, ot as readOpenAICodexRateLimits, p as OPENAI_CODEX_SEARCH_URL, pt as OPENAI_CODEX_TRANSPORT_API_VERSION, q as OPENAI_CODEX_PROXY_PROBE_URL, r as apply, s as OPENAI_CODEX_SEARCH_MODEL_REQUEST_EVENT, st as OPENAI_CODEX_IMAGE_GENERATION_URL, t as Config, tt as isFastModeSessionId, ut as OPENAI_CODEX_IMAGE_MAX_RESPONSE_BYTES, v as assertNoOpenAICodexProviderConflict, vt as isOpenAICodexTransportError, w as compareOpenAICodexVersions, wt as DEFAULT_OPENAI_CODEX_SEARCH_MODEL, xt as DEFAULT_OPENAI_CODEX_SEARCH_CONTEXT_SIZE, y as diagnoseOpenAICodex, yt as DEFAULT_OPENAI_CODEX_IMAGE_MODEL_HINT, z as evaluateCompatibility, zt as OPENAI_CODEX_ACCOUNT_LIMIT } from "./src-hB8Ph2Et.js";
 export { COMPATIBILITY_CONTRACT, COMPATIBILITY_PACKAGES, COMPATIBILITY_SCHEMA_VERSION, Config, DEFAULT_OPENAI_CODEX_IMAGE_MODEL_HINT, DEFAULT_OPENAI_CODEX_PROXY_URL, DEFAULT_OPENAI_CODEX_SEARCH_CONTEXT_SIZE, DEFAULT_OPENAI_CODEX_SEARCH_MAX_OUTPUT_TOKENS, DEFAULT_OPENAI_CODEX_SEARCH_MODE, DEFAULT_OPENAI_CODEX_SEARCH_MODEL, DEFAULT_OPENAI_CODEX_SETTINGS, DSH_PLUGIN_API_PACKAGES, FastModeRegistry, FastModeRegistry as OpenAICodexFastModeRegistry, IMAGE_GENERATE_TOOL_NAME, OPENAI_CODEX_ACCOUNT_LIMIT, OPENAI_CODEX_AUTH_DOCUMENT_LIMIT, OPENAI_CODEX_AUTH_FILENAME, OPENAI_CODEX_AUTH_V1_BACKUP_SUFFIX, OPENAI_CODEX_BASE_URL, OPENAI_CODEX_FAST_MODE_MAX_SESSIONS, OPENAI_CODEX_FAST_MODE_MAX_SESSION_ID_LENGTH, OPENAI_CODEX_FAST_MODE_PATH, OPENAI_CODEX_HISTORY_BACKUP_SUFFIX, OPENAI_CODEX_IMAGE_GENERATION_URL, OPENAI_CODEX_IMAGE_MAX_COUNT, OPENAI_CODEX_IMAGE_MAX_ERROR_BYTES, OPENAI_CODEX_IMAGE_MAX_RESPONSE_BYTES, OPENAI_CODEX_IMAGE_PROMPT_MAX_LENGTH, OPENAI_CODEX_IMAGE_REQUEST_TIMEOUT_MS, OPENAI_CODEX_LOCAL_PROXY_CANDIDATES, OPENAI_CODEX_PROVIDER, OPENAI_CODEX_PROXY_CANDIDATE_LIMIT, OPENAI_CODEX_PROXY_DETECT_PATH, OPENAI_CODEX_PROXY_PROBE_TIMEOUT_MS, OPENAI_CODEX_PROXY_PROBE_URL, OPENAI_CODEX_PROXY_TEST_PATH, OPENAI_CODEX_SEARCH_MODEL_REQUEST_EVENT, OPENAI_CODEX_SEARCH_PROVIDER, OPENAI_CODEX_SEARCH_URL, OPENAI_CODEX_SETTINGS_NAMESPACE, OPENAI_CODEX_SETTINGS_NS, OPENAI_CODEX_TRANSPORT_API_VERSION, OPENAI_CODEX_TRANSPORT_ERROR_CODES, OPENAI_CODEX_TRANSPORT_SERVICE, OPENAI_CODEX_UPDATE_PATH, OPENAI_CODEX_USAGE_URL, OpenAICodexCredentialStore, OpenAICodexProxyManager, OpenAICodexSearchProvider, OpenAICodexTransport, OpenAICodexTransportError, PI_AI_PACKAGE, SUPPORTED_DSH_PLUGIN_API_RANGE, SUPPORTED_DSH_PLUGIN_API_VERSION, SUPPORTED_DSH_PLUGIN_API_VERSIONS, SUPPORTED_NODE_RANGE, SUPPORTED_PI_AI_RANGE, VIEW_IMAGE_TOOL_NAME, apply, assertNoOpenAICodexProviderConflict, assessCompatibility, checkForOpenAICodexUpdate, compareOpenAICodexVersions, decodeOpenAICodexSettings, detectCompatibility, detectOpenAICodexProxies, diagnoseOpenAICodex, evaluateCompatibility, inject, isFastModeSessionId, isOpenAICodexTransportError, isValidOpenAICodexContextWindowOverrides, isValidOpenAICodexImageModelHint, isValidOpenAICodexProxyUrl, listOpenAICodexProxyCandidates, loginOpenAICodex, logoutOpenAICodex, mapOpenAICodexSearchResponse, migrateOpenAICodexSearchHistory, name, openAICodexAuthPath, openAICodexAuthStatus, openAICodexConflictMessage, parseOpenAICodexUpdateResult, parseOpenAICodexUsage, parseOpenAICodexVersion, readOpenAICodexRateLimits, resolveOpenAICodexProxyUrl, resolveOpenAICodexSettings };

package/lib/{src-CceJ4VNv.js → src-hB8Ph2Et.js}

@@ -1836,6 +1836,239 @@ function withOpenAICodexNativeCompaction(provider) {
 		}
 	};
 }
+//#endregion
+//#region src/request-backoff.ts
+/** Parse server retry hints without allowing invalid or overflowing timer delays. */
+function readRetryAfterMs(headers, now = Date.now()) {
+	const milliseconds = headers.get("retry-after-ms");
+	const seconds = headers.get("retry-after");
+	const numeric = (value) => {
+		if (value === null || !/^\d+(?:\.\d+)?$/u.test(value.trim())) return void 0;
+		const result = Number(value);
+		return Number.isFinite(result) && result >= 0 ? result : void 0;
+	};
+	const ms = numeric(milliseconds);
+	const delay = numeric(seconds);
+	const date = seconds !== null && /[A-Za-z]/u.test(seconds) ? Date.parse(seconds) : NaN;
+	const result = ms ?? (delay === void 0 ? Number.isFinite(date) ? Math.max(0, date - now) : void 0 : delay * 1e3);
+	return result === void 0 ? void 0 : result > 2147483647 ? Infinity : Math.ceil(result);
+}
+//#endregion
+//#region src/request-diagnostics.ts
+/** Request-local, bounded diagnostics for Codex HTTP/SSE failures. Never logs payloads. */
+const requestScope = new AsyncLocalStorage();
+const MAX_FRAME_CHARS = 16384;
+function record$3(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function requestId(value) {
+	return typeof value === "string" && /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/u.test(value) && !/^(?:eyJ|sk-|Bearer)/iu.test(value) ? value : void 0;
+}
+function errorCode(value) {
+	return typeof value === "string" && /^[a-z][a-z0-9_]{0,79}$/u.test(value) ? value : void 0;
+}
+/** Observe bounded frames only while their attribution is unambiguous; never scan past a terminal. */
+var ErrorFrameObserver = class {
+	diagnostic;
+	decoder = new TextDecoder();
+	line = "";
+	data = "";
+	size = 0;
+	stopped = false;
+	previousCR = false;
+	lineHasText = false;
+	constructor(diagnostic) {
+		this.diagnostic = diagnostic;
+	}
+	feed(chunk) {
+		for (let offset = 0; !this.stopped && offset < chunk.byteLength; offset += 4096) this.text(this.decoder.decode(chunk.subarray(offset, offset + 4096), { stream: true }));
+	}
+	finish() {
+		this.text(this.decoder.decode());
+		this.line = "";
+		this.data = "";
+		this.size = 0;
+	}
+	stop() {
+		this.stopped = true;
+		this.line = "";
+		this.data = "";
+		this.size = 0;
+	}
+	text(text) {
+		for (const character of text) {
+			if (this.stopped) return;
+			if (character === "\n" && this.previousCR) {
+				this.previousCR = false;
+				continue;
+			}
+			this.previousCR = character === "\r";
+			if (character === "\r" || character === "\n") this.completeLine();
+			else {
+				this.lineHasText = true;
+				this.size += 1;
+				if (this.size > MAX_FRAME_CHARS) {
+					this.stop();
+					return;
+				}
+				this.line += character;
+			}
+		}
+	}
+	completeLine() {
+		if (!this.lineHasText) {
+			if (this.data) this.observe(this.data);
+			this.data = "";
+			this.size = 0;
+		} else if (this.line.startsWith("data:")) {
+			this.data += this.line.slice(5).replace(/^ /u, "") + "\n";
+			this.size += 1;
+			if (this.size > MAX_FRAME_CHARS) this.stop();
+		}
+		this.line = "";
+		this.lineHasText = false;
+	}
+	observe(data) {
+		if (data.trim() === "[DONE]") {
+			this.stop();
+			return;
+		}
+		let event;
+		try {
+			event = JSON.parse(data);
+		} catch {
+			this.stop();
+			return;
+		}
+		if (!record$3(event)) {
+			this.stop();
+			return;
+		}
+		if ([
+			"response.completed",
+			"response.done",
+			"response.incomplete"
+		].includes(String(event["type"]))) {
+			this.stop();
+			return;
+		}
+		if (event["type"] !== "error" && event["type"] !== "response.failed") return;
+		this.stop();
+		const response = record$3(event["response"]) ? event["response"] : void 0;
+		const nested = record$3(event["error"]) ? event["error"] : response !== void 0 && record$3(response["error"]) ? response["error"] : void 0;
+		this.diagnostic.eventType = event["type"];
+		const code = errorCode(event["code"]) ?? errorCode(nested?.["code"]);
+		const type = errorCode(nested?.["type"]);
+		const id = requestId(event["request_id"]) ?? requestId(nested?.["request_id"]);
+		if (code !== void 0) this.diagnostic.errorCode = code;
+		if (type !== void 0) this.diagnostic.errorType = type;
+		if (id !== void 0) this.diagnostic.sseRequestId = id;
+	}
+};
+function observeResponse(response, diagnostic) {
+	if (response.body === null || !response.headers.get("content-type")?.toLowerCase().includes("text/event-stream")) return response;
+	const observer = new ErrorFrameObserver(diagnostic);
+	const reader = response.body.getReader();
+	let released = false;
+	const release = () => {
+		if (!released) {
+			released = true;
+			reader.releaseLock();
+		}
+	};
+	const body = new ReadableStream({
+		async pull(controller) {
+			try {
+				const { done, value } = await reader.read();
+				if (done) {
+					observer.finish();
+					release();
+					controller.close();
+					return;
+				}
+				observer.feed(value);
+				controller.enqueue(value);
+			} catch (error) {
+				release();
+				controller.error(error);
+			}
+		},
+		async cancel(reason) {
+			try {
+				await reader.cancel(reason);
+			} finally {
+				release();
+			}
+		}
+	}, { highWaterMark: 0 });
+	const wrapped = new Response(body, {
+		status: response.status,
+		statusText: response.statusText,
+		headers: response.headers
+	});
+	for (const key of [
+		"url",
+		"redirected",
+		"type"
+	]) Object.defineProperty(wrapped, key, { value: response[key] });
+	return wrapped;
+}
+/** Inject a request-local fetch seam, preserving existing provider hooks and dispatchers. */
+function withCodexDiagnosticFetch(options) {
+	const scope = requestScope.getStore();
+	if (scope === void 0) return options;
+	const fetch = options?.fetch ?? globalThis.fetch;
+	return {
+		...options,
+		async fetch(input, init) {
+			const diagnostic = { clientRequestId: randomUUID() };
+			scope.current = diagnostic;
+			const headers = new Headers(init?.headers ?? (input instanceof Request ? input.headers : void 0));
+			headers.set("x-client-request-id", diagnostic.clientRequestId);
+			const response = await fetch(input, {
+				...init,
+				headers
+			});
+			diagnostic.httpStatus = response.status;
+			const id = requestId(response.headers.get("x-request-id")) ?? requestId(response.headers.get("request-id"));
+			if (id !== void 0) diagnostic.httpRequestId = id;
+			const retry = readRetryAfterMs(response.headers);
+			if (retry !== void 0 && Number.isFinite(retry)) diagnostic.retryAfterMs = retry;
+			return observeResponse(response, diagnostic);
+		}
+	};
+}
+/** Append diagnostics after DSH has classified the error; request ids must not affect that classification. */
+function streamWithCodexRequestDiagnostics(stream, options) {
+	return { async *[Symbol.asyncIterator]() {
+		const scope = {};
+		const iterator = requestScope.run(scope, () => stream(options)[Symbol.asyncIterator]());
+		try {
+			while (true) {
+				const next = await requestScope.run(scope, () => iterator.next());
+				if (next.done) return;
+				const chunk = next.value;
+				if (chunk.type === "finish" && chunk.reason.kind === "error" && chunk.reason.failure !== void 0 && scope.current !== void 0) yield {
+					...chunk,
+					reason: {
+						...chunk.reason,
+						failure: {
+							...chunk.reason.failure,
+							message: chunk.reason.failure.message + "\n[Codex diagnostics: " + JSON.stringify(scope.current) + "]"
+						}
+					}
+				};
+				else yield chunk;
+			}
+		} finally {
+			try {
+				await requestScope.run(scope, () => iterator.return?.());
+			} finally {
+				delete scope.current;
+			}
+		}
+	} };
+}
 const OPENAI_CODEX_ASTRA_MODEL = {
 	id: "gpt-6-astra",
 	name: "GPT-6-Astra",
@@ -1955,7 +2188,7 @@ function requestProvider(provider, fastMode, proxyManager, resolveProxyUrl) {
 		...configured,
 		streamSimple(model, context, options) {
 			const proxyUrl = resolveProxyUrl?.();
-			const operation = () => streamSimple.call(configured, model, context, options);
+			const operation = () => streamSimple.call(configured, model, context, withCodexDiagnosticFetch(options));
 			return proxyManager?.runStream(proxyUrl, operation) ?? operation();
 		},
 		auth: {
@@ -2043,7 +2276,7 @@ function createOpenAICodexAdapter(credentials, resolveAttachments, fastMode, vis
 	};
 	class OpenAICodexAdapter extends PiAiAdapter {
 		streamPrepared(stream, options) {
-			return streamWithNativeCompactionScope(stream, options, nativeCompactionEnabled?.() === true);
+			return streamWithCodexRequestDiagnostics((next) => streamWithNativeCompactionScope(stream, next, nativeCompactionEnabled?.() === true), options);
 		}
 		async prepareCall(providerId, model, signal) {
 			const prepared = await super.prepareCall(providerId, model, signal);
@@ -2510,6 +2743,17 @@ var OpenAICodexReauthRequiredError = class extends Error {
 		this.name = "OpenAICodexReauthRequiredError";
 	}
 };
+/** Safe HTTP status and retry hint; never retains response bodies or credentials. */
+var OpenAICodexUsageHttpError = class extends Error {
+	status;
+	retryAfterMs;
+	constructor(status, retryAfterMs) {
+		super(`OpenAI Codex usage request failed with HTTP ${status}`);
+		this.status = status;
+		this.retryAfterMs = retryAfterMs;
+		this.name = "OpenAICodexUsageHttpError";
+	}
+};
 /** Identify the dedicated reauthorization failure without comparing messages. */
 function isOpenAICodexReauthRequiredError(error) {
 	return error instanceof OpenAICodexReauthRequiredError;
@@ -2644,7 +2888,7 @@ async function readOpenAICodexUsageResponse(auth, signal, supportsReserve) {
 	if (!response.ok) {
 		await cancelDiscardedResponseBody(response);
 		if (response.status === 401 || response.status === 403) throw new OpenAICodexReauthRequiredError();
-		throw new Error(`OpenAI Codex usage request failed with HTTP ${response.status}`);
+		throw new OpenAICodexUsageHttpError(response.status, readRetryAfterMs(response.headers));
 	}
 	try {
 		const bytes = await readOpenAICodexBoundedBody(response, OPENAI_CODEX_USAGE_MAX_BYTES);
@@ -4676,7 +4920,7 @@ function registerOpenAICodexOriginalImageRoute(ctx, trustedOrigins, assets) {
 }
 //#endregion
 //#region src/version.ts
-const CODEX_CONNECT_VERSION = "0.1.0-alpha.4.37";
+const CODEX_CONNECT_VERSION = "0.1.0-alpha.4.38";
 //#endregion
 //#region src/doctor.ts
 /** Secret-free diagnostics and duplicate-provider guidance. */
@@ -7060,19 +7304,27 @@ function abortable(promise, signal) {
 	});
 }
 function safeFailure(error) {
-	if (error instanceof OpenAICodexReauthRequiredError) return error;
+	if (error instanceof OpenAICodexReauthRequiredError || error instanceof OpenAICodexUsageHttpError) return error;
 	if (error instanceof OpenAICodexRequestAuthError) return error.code === "REAUTH_REQUIRED" ? new OpenAICodexReauthRequiredError() : error;
 	if (error instanceof Error && /^OpenAI Codex usage request failed with HTTP [1-5][0-9]{2}$/u.test(error.message)) return new Error(error.message);
 	return /* @__PURE__ */ new Error("OpenAI Codex quota is temporarily unavailable");
 }
-function refreshDeadline(snapshot, model, fetchedAt) {
+function refreshDeadline(snapshot, model, fetchedAt, adaptive) {
+	if (!adaptive) return fetchedAt + 6e4;
 	const windows = snapshot.usage.rateLimits.filter((limit) => limit.id === "codex" || model !== void 0 && limit.name === model || (snapshot.decision.kind === "reserve" || snapshot.decision.kind === "exhausted") && limit.name === "gpt-reserve").flatMap((limit) => limit.windows);
 	const highest = Math.max(0, ...windows.map((window) => 100 - window.remainingPercent));
 	const interval = highest >= 99 ? 5e3 : highest >= 90 ? 15e3 : highest >= 75 ? 3e4 : 6e4;
 	const resets = windows.flatMap((window) => window.resetAt !== void 0 && window.resetAt * 1e3 > fetchedAt ? [window.resetAt * 1e3 + 1e3] : []);
 	return Math.max(fetchedAt + 1e3, Math.min(fetchedAt + interval, ...resets));
 }
-/** Owns quota cache, Reserve negotiation, and lazy adaptive background refresh. */
+function failureDelay(error, failures) {
+	if (error instanceof OpenAICodexReauthRequiredError) return Infinity;
+	if (error instanceof OpenAICodexUsageHttpError && error.status >= 400 && error.status < 500 && error.status !== 408 && error.status !== 429) return Infinity;
+	const backoff = Math.min(9e5, 6e4 * 2 ** Math.min(failures - 1, 4));
+	const jittered = Math.min(9e5, backoff + Math.floor(Math.random() * backoff * .1));
+	return Math.max(jittered, error instanceof OpenAICodexUsageHttpError ? error.retryAfterMs ?? 0 : 0);
+}
+/** Owns quota cache, Reserve negotiation, and demand-bounded background refresh. */
 var OpenAICodexQuotaState = class {
 	options;
 	cache = /* @__PURE__ */ new Map();
@@ -7081,6 +7333,7 @@ var OpenAICodexQuotaState = class {
 	configuration;
 	timer;
 	timerAt = Infinity;
+	activeUntil = 0;
 	model;
 	disposed = false;
 	disposal;
@@ -7092,23 +7345,31 @@ var OpenAICodexQuotaState = class {
 		this.epoch.abort();
 		this.epoch = new AbortController();
 		this.cache.clear();
+		this.activeUntil = 0;
 		if (this.timer !== void 0) clearTimeout(this.timer);
 		this.timer = void 0;
 		this.timerAt = Infinity;
 	}
 	schedule(at) {
-		if (this.disposed || !this.options.enabled() || this.timerAt <= at) return;
+		if (this.disposed || !this.options.enabled() || !Number.isFinite(at) || this.timerAt <= at) return;
 		if (this.timer !== void 0) clearTimeout(this.timer);
 		this.timerAt = at;
 		this.timer = setTimeout(() => {
 			this.timer = void 0;
 			this.timerAt = Infinity;
-			this.read(void 0, void 0, this.model).catch(() => void 0);
+			for (const entry of this.cache.values()) if (entry.pending === void 0 && Date.now() >= entry.refreshAt) entry.authority?.abort();
+			const nextExpiry = Math.min(...[...this.cache.values()].filter((entry) => entry.snapshot !== void 0 && entry.authority?.signal.aborted === false && entry.refreshAt > Date.now()).map((entry) => entry.refreshAt));
+			if (Number.isFinite(nextExpiry)) this.schedule(nextExpiry);
+			if (Date.now() >= this.activeUntil) return;
+			this.readSnapshot(void 0, void 0, this.model, true).catch(() => void 0);
 		}, Math.max(0, at - Date.now()));
 		this.timer.unref?.();
 	}
 	/** Read a fresh snapshot, coalescing GETs without tying shared work to one caller. */
 	read(snapshot, signal, model) {
+		return this.readSnapshot(snapshot, signal, model, false);
+	}
+	readSnapshot(snapshot, signal, model, background) {
 		if (this.disposed) return Promise.reject(/* @__PURE__ */ new Error("OpenAI Codex quota state has been disposed"));
 		if (signal?.aborted) return Promise.reject(new DOMException("The operation was aborted", "AbortError"));
 		const enabled = this.options.enabled();
@@ -7116,6 +7377,7 @@ var OpenAICodexQuotaState = class {
 		const configuration = JSON.stringify([enabled, proxy]);
 		if (this.configuration !== void 0 && this.configuration !== configuration) this.invalidate();
 		this.configuration = configuration;
+		if (!background) this.activeUntil = Date.now() + 12e4;
 		if (model !== void 0) this.model = model;
 		const epoch = this.epoch.signal;
 		const operation = this.readInternal(snapshot ?? this.options.credentials, enabled, proxy, epoch, model).catch((error) => {
@@ -7132,7 +7394,7 @@ var OpenAICodexQuotaState = class {
 		const candidate = enabled ? reserveIdentity(auth.access) : void 0;
 		const identity = candidate?.accountId === auth.accountId ? candidate : void 0;
 		const fetch = async (authoritySignal = epoch) => {
-			const value = await this.options.proxyManager.run(proxy, () => readOpenAICodexUsageResponse(auth, epoch, enabled && identity !== void 0));
+			const value = await this.options.proxyManager.run(proxy, () => readOpenAICodexUsageResponse(auth, authoritySignal, enabled && identity !== void 0));
 			epoch.throwIfAborted();
 			return {
 				usage: parseOpenAICodexUsage(value),
@@ -7141,8 +7403,7 @@ var OpenAICodexQuotaState = class {
 				authoritySignal
 			};
 		};
-		if (!enabled) return fetch();
-		const key = JSON.stringify([auth.accountId, identity?.key]);
+		const key = JSON.stringify([auth.accountId, createHash("sha256").update(auth.access).digest("hex")]);
 		let entry = this.cache.get(key);
 		if (entry === void 0) {
 			if (this.cache.size >= 16) {
@@ -7153,18 +7414,19 @@ var OpenAICodexQuotaState = class {
 			}
 			entry = {
 				fetchedAt: 0,
-				refreshAt: 0
+				refreshAt: 0,
+				failures: 0
 			};
 			this.cache.set(key, entry);
 		}
 		if (entry.pending !== void 0) {
 			const result = await entry.pending;
 			epoch.throwIfAborted();
-			entry.refreshAt = Math.min(entry.refreshAt, refreshDeadline(result, model, entry.fetchedAt));
+			entry.refreshAt = Math.min(entry.refreshAt, refreshDeadline(result, model, entry.fetchedAt, enabled));
 			this.schedule(entry.refreshAt);
 			return result;
 		}
-		if (entry.snapshot !== void 0) entry.refreshAt = Math.min(entry.refreshAt, refreshDeadline(entry.snapshot, model, entry.fetchedAt));
+		if (entry.snapshot !== void 0) entry.refreshAt = Math.min(entry.refreshAt, refreshDeadline(entry.snapshot, model, entry.fetchedAt, enabled));
 		if (Date.now() < entry.refreshAt) {
 			this.schedule(entry.refreshAt);
 			if (entry.error !== void 0) throw entry.error;
@@ -7179,14 +7441,16 @@ var OpenAICodexQuotaState = class {
 			current.snapshot = result;
 			delete current.error;
 			current.fetchedAt = Date.now();
-			current.refreshAt = refreshDeadline(result, model, current.fetchedAt);
+			current.failures = 0;
+			current.refreshAt = refreshDeadline(result, model, current.fetchedAt, enabled);
 			this.schedule(current.refreshAt);
 			return result;
 		}, (error) => {
 			epoch.throwIfAborted();
 			delete current.snapshot;
 			current.error = safeFailure(error);
-			current.refreshAt = Date.now() + 5e3;
+			current.failures += 1;
+			current.refreshAt = Date.now() + failureDelay(current.error, current.failures);
 			this.schedule(current.refreshAt);
 			throw current.error;
 		}).finally(() => {

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-codex-connect",
   "displayName": "Codex Connect",
   "description": "ChatGPT OAuth and Codex models for DeepSeek Harness.",
-  "version": "0.1.0-alpha.4.37",
+  "version": "0.1.0-alpha.4.38",
   "author": "Frank Song",
   "contributors": [
     "Yan-Zero (original dsh-codex author)"