dsh-codex-subscription 1.11.3 → 1.12.0

package/lib/index.js

@@ -1,7 +1,9 @@
-import { credentialRef } from "@deepseek-ai/dsh-credentials";
+import * as dshCredentials from "@deepseek-ai/dsh-credentials";
+import { dshHomePath, resolveDshHome } from "@deepseek-ai/dsh-home-paths";
 import { LlmError, createUserMessage } from "@deepseek-ai/dsh-llm";
 import { PiAiAdapter } from "@deepseek-ai/dsh-llm-pi-ai";
 import z from "@deepseek-ai/schemastery";
+import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { execFile, spawn } from "node:child_process";
 import { request } from "node:https";
 import { AsyncLocalStorage } from "node:async_hooks";
@@ -10,13 +12,269 @@ import { promisify } from "node:util";
 import { HttpsProxyAgent } from "https-proxy-agent";
 import { openaiCodexProvider as createOpenAICodexProvider } from "@earendil-works/pi-ai/providers/openai-codex";
 import { createModels } from "@earendil-works/pi-ai";
-import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { WebError } from "@deepseek-ai/dsh-web";
 import { defineTool } from "@deepseek-ai/dsh-tools";
 import { constants } from "node:fs";
-import { lstat, mkdir, open, readFile, rename, rm } from "node:fs/promises";
+import { lstat, mkdir, open, readFile, rename, rm, stat } from "node:fs/promises";
 import { dirname, join, resolve } from "node:path";
-import { resolveDshHome } from "@deepseek-ai/dsh-home-paths";
+//#region src/account-vault.js
+const VERSION = 1;
+const DEFAULT_LABEL = "Account 1";
+const clone$1 = (value) => value === void 0 ? void 0 : structuredClone(value);
+function assertOAuthCredential$1(value) {
+	if (value === null || typeof value !== "object" || value.type !== "oauth" || typeof value.access !== "string" || value.access.length === 0 || typeof value.refresh !== "string" || value.refresh.length === 0 || typeof value.expires !== "number" || !Number.isFinite(value.expires)) throw new Error("Codex account vault received a malformed OAuth credential");
+	return clone$1(value);
+}
+function parseOAuthCredential$1(value) {
+	try {
+		return assertOAuthCredential$1(JSON.parse(value));
+	} catch (error) {
+		if (error?.message === "Codex account vault received a malformed OAuth credential") throw error;
+		throw new Error("Codex account vault contains malformed OAuth JSON", { cause: error });
+	}
+}
+function normalizeLabel(value) {
+	if (typeof value !== "string") throw new Error("Codex account label must be text");
+	const label = value.trim().replace(/\s+/gu, " ");
+	if (label.length === 0 || label.length > 48) throw new Error("Codex account label must contain 1 to 48 characters");
+	return label;
+}
+function assertVaultRecord(record) {
+	if (record?.kind !== "grant" || record.payload?.version !== VERSION || typeof record.payload.activeId !== "string" || !Array.isArray(record.payload.accounts) || record.payload.accounts.length === 0) throw new Error("Codex account vault contains a malformed grant record");
+	const ids = /* @__PURE__ */ new Set();
+	const accounts = record.payload.accounts.map((account) => {
+		if (account === null || typeof account !== "object" || typeof account.id !== "string" || account.id.length === 0 || ids.has(account.id)) throw new Error("Codex account vault contains a malformed account id");
+		ids.add(account.id);
+		return {
+			id: account.id,
+			label: normalizeLabel(account.label),
+			credential: assertOAuthCredential$1(account.credential)
+		};
+	});
+	if (!ids.has(record.payload.activeId)) throw new Error("Codex account vault active account is missing");
+	const legacyAccountId = record.payload.legacyAccountId;
+	if (legacyAccountId !== void 0 && !ids.has(legacyAccountId)) throw new Error("Codex account vault legacy account is missing");
+	return {
+		version: VERSION,
+		activeId: record.payload.activeId,
+		legacyAccountId,
+		accounts
+	};
+}
+const grant = (payload) => ({
+	kind: "grant",
+	payload
+});
+var PendingOAuthCredentialStore = class {
+	#credential;
+	async read(providerId) {
+		if (providerId !== "openai-codex") throw new Error("Pending Codex login received an unknown provider");
+		return clone$1(this.#credential);
+	}
+	async list() {
+		return this.#credential === void 0 ? [] : [{
+			providerId: "openai-codex",
+			type: "oauth"
+		}];
+	}
+	async modify(providerId, update) {
+		if (providerId !== "openai-codex") throw new Error("Pending Codex login received an unknown provider");
+		const next = await update(clone$1(this.#credential));
+		if (next !== void 0) this.#credential = assertOAuthCredential$1(next);
+		return clone$1(this.#credential);
+	}
+	async delete(providerId) {
+		if (providerId !== "openai-codex") throw new Error("Pending Codex login received an unknown provider");
+		this.#credential = void 0;
+	}
+	credential() {
+		return clone$1(this.#credential);
+	}
+};
+/**
+* Multi-account owner state stored in DSH's atomic plugin credential record.
+* The old single-account reference remains as a rollback source and is kept in
+* sync whenever that imported account rotates its refresh token.
+*/
+var DshOAuthAccountVault = class {
+	#tail = Promise.resolve();
+	constructor(credentials, options) {
+		if (credentials === void 0 || credentials === null || typeof credentials.readRecord !== "function" || typeof credentials.modifyRecord !== "function") throw new Error("Codex multi-account requires DSH credential records");
+		this.credentials = credentials;
+		this.key = options.key;
+		this.legacyRef = options.legacyRef;
+		this.legacyRefs = Object.freeze([...options.legacyRefs ?? []]);
+		this.createId = options.createId ?? randomUUID;
+		this.onLegacySyncFailure = options.onLegacySyncFailure ?? (() => {});
+	}
+	#enqueue(operation) {
+		const current = this.#tail.catch(() => void 0).then(operation);
+		this.#tail = current.catch(() => void 0);
+		return current;
+	}
+	async #legacyCredential() {
+		for (const ref of [this.legacyRef, ...this.legacyRefs]) {
+			const hit = await this.credentials.resolve(ref);
+			if (hit?.value === void 0 || hit.value === "") continue;
+			return {
+				ref,
+				credential: parseOAuthCredential$1(hit.value)
+			};
+		}
+	}
+	async #ensurePayload() {
+		const existing = await this.credentials.readRecord(this.key);
+		if (existing !== void 0) return assertVaultRecord(existing);
+		const legacy = await this.#legacyCredential();
+		if (legacy === void 0) return void 0;
+		const id = this.createId();
+		return assertVaultRecord(await this.credentials.modifyRecord(this.key, (current) => {
+			if (current !== void 0) return Promise.resolve(current);
+			return Promise.resolve(grant({
+				version: VERSION,
+				activeId: id,
+				legacyAccountId: id,
+				accounts: [{
+					id,
+					label: DEFAULT_LABEL,
+					credential: legacy.credential
+				}]
+			}));
+		}));
+	}
+	async #modifyPayload(update) {
+		await this.#ensurePayload();
+		let previousLegacy;
+		const payload = assertVaultRecord(await this.credentials.modifyRecord(this.key, async (current) => {
+			if (current === void 0) throw new Error("Codex account vault is not signed in");
+			const payload = assertVaultRecord(current);
+			previousLegacy = payload.accounts.find((account) => account.id === payload.legacyAccountId)?.credential;
+			const next = await update(clone$1(payload));
+			return grant(next);
+		}));
+		const legacy = payload.accounts.find((account) => account.id === payload.legacyAccountId)?.credential;
+		try {
+			if (legacy === void 0) {
+				if (previousLegacy !== void 0) await this.credentials.unset(this.legacyRef);
+			} else if (JSON.stringify(legacy) !== JSON.stringify(previousLegacy)) await this.credentials.set(this.legacyRef, JSON.stringify(legacy));
+		} catch {
+			this.onLegacySyncFailure();
+		}
+		return payload;
+	}
+	list() {
+		return this.#enqueue(async () => {
+			const payload = await this.#ensurePayload();
+			if (payload === void 0) return [];
+			return payload.accounts.map((account) => ({
+				id: account.id,
+				label: account.label,
+				active: account.id === payload.activeId,
+				expiresAt: account.credential.expires
+			}));
+		});
+	}
+	readActive() {
+		return this.#enqueue(async () => {
+			const payload = await this.#ensurePayload();
+			return clone$1(payload?.accounts.find((account) => account.id === payload.activeId)?.credential);
+		});
+	}
+	activeId() {
+		return this.#enqueue(async () => (await this.#ensurePayload())?.activeId);
+	}
+	add(label, credential) {
+		return this.#enqueue(async () => {
+			const normalizedLabel = normalizeLabel(label);
+			const validated = assertOAuthCredential$1(credential);
+			await this.#ensurePayload();
+			const id = this.createId();
+			const account = (await this.#modifyPayload((current) => ({
+				...current,
+				activeId: id,
+				accounts: [...current.accounts, {
+					id,
+					label: normalizedLabel,
+					credential: validated
+				}]
+			}))).accounts.find((candidate) => candidate.id === id);
+			return {
+				id,
+				label: account.label,
+				active: true,
+				expiresAt: account.credential.expires
+			};
+		});
+	}
+	select(id) {
+		return this.#enqueue(async () => {
+			await this.#modifyPayload((current) => {
+				if (!current.accounts.some((account) => account.id === id)) throw new Error("Unknown Codex account");
+				return {
+					...current,
+					activeId: id
+				};
+			});
+		});
+	}
+	modifyActive(update) {
+		return this.#enqueue(async () => {
+			if (await this.#ensurePayload() === void 0) {
+				const initial = await update(void 0);
+				if (initial === void 0) return void 0;
+				const credential = assertOAuthCredential$1(initial);
+				await this.credentials.set(this.legacyRef, JSON.stringify(credential));
+				await this.#ensurePayload();
+				return clone$1(credential);
+			}
+			let result;
+			await this.#modifyPayload(async (current) => {
+				const index = current.accounts.findIndex((account) => account.id === current.activeId);
+				const previous = clone$1(current.accounts[index].credential);
+				const next = await update(previous);
+				if (next === void 0) {
+					result = previous;
+					return current;
+				}
+				const credential = assertOAuthCredential$1(next);
+				const accounts = [...current.accounts];
+				accounts[index] = {
+					...accounts[index],
+					credential
+				};
+				result = clone$1(credential);
+				return {
+					...current,
+					accounts
+				};
+			});
+			return result;
+		});
+	}
+	deleteAll() {
+		return this.#enqueue(async () => {
+			await this.credentials.deleteRecord(this.key);
+			await this.credentials.unset(this.legacyRef);
+			for (const ref of this.legacyRefs) await this.credentials.unset(ref);
+		});
+	}
+	remove(id) {
+		return this.#enqueue(async () => {
+			await this.#modifyPayload((current) => {
+				if (!current.accounts.some((account) => account.id === id)) throw new Error("Unknown Codex account");
+				if (current.accounts.length === 1) throw new Error("Cannot remove the last account; sign out instead");
+				const accounts = current.accounts.filter((account) => account.id !== id);
+				return {
+					...current,
+					activeId: current.activeId === id ? accounts[0].id : current.activeId,
+					legacyAccountId: current.legacyAccountId === id ? void 0 : current.legacyAccountId,
+					accounts
+				};
+			});
+		});
+	}
+};
+//#endregion
 //#region src/credential-store.js
 const PROVIDER$1 = "openai-codex";
 const abortIfNeeded = (options) => options?.signal?.throwIfAborted();
@@ -44,11 +302,15 @@ function parseOAuthCredential(value) {
 */
 var DshOAuthCredentialStore = class {
 	#chains = /* @__PURE__ */ new Map();
-	constructor(credentials, ref, legacyRefs = []) {
+	constructor(credentials, ref, legacyRefs = [], options = {}) {
 		if (credentials === void 0 || credentials === null) throw new Error("Codex OAuth requires the DSH credentials service");
+		const expirySkewMs = options.expirySkewMs ?? 0;
+		if (!Number.isFinite(expirySkewMs) || expirySkewMs < 0) throw new Error("Codex OAuth expiry skew must be a non-negative finite number");
 		this.credentials = credentials;
 		this.ref = ref;
 		this.legacyRefs = Object.freeze([...legacyRefs]);
+		this.expirySkewMs = expirySkewMs;
+		this.vault = options.vault;
 	}
 	#enqueue(providerId, operation, options) {
 		assertProvider(providerId);
@@ -66,6 +328,14 @@ var DshOAuthCredentialStore = class {
 	async #read(providerId, options) {
 		assertProvider(providerId);
 		abortIfNeeded(options);
+		if (this.vault !== void 0) {
+			const current = await this.vault.readActive();
+			if (current === void 0) return void 0;
+			return this.expirySkewMs === 0 ? current : {
+				...current,
+				expires: current.expires - this.expirySkewMs
+			};
+		}
 		let hit = await this.credentials.resolve(this.ref);
 		if (hit?.value === void 0 || hit.value === "") for (const legacyRef of this.legacyRefs) {
 			const legacy = await this.credentials.resolve(legacyRef);
@@ -78,7 +348,11 @@ var DshOAuthCredentialStore = class {
 		}
 		abortIfNeeded(options);
 		if (hit?.value === void 0 || hit.value === "") return void 0;
-		return parseOAuthCredential(hit.value);
+		const credential = parseOAuthCredential(hit.value);
+		return this.expirySkewMs === 0 ? credential : {
+			...credential,
+			expires: credential.expires - this.expirySkewMs
+		};
 	}
 	read(providerId, options) {
 		return this.#enqueue(providerId, () => this.#read(providerId, options), options);
@@ -92,6 +366,18 @@ var DshOAuthCredentialStore = class {
 	}
 	modify(providerId, update, options) {
 		return this.#enqueue(providerId, async () => {
+			if (this.vault !== void 0) {
+				const next = await this.vault.modifyActive(async (current) => {
+					const visible = current === void 0 || this.expirySkewMs === 0 ? current : {
+						...current,
+						expires: current.expires - this.expirySkewMs
+					};
+					const updated = await update(clone(visible));
+					return updated === void 0 ? void 0 : assertOAuthCredential(updated);
+				});
+				abortIfNeeded(options);
+				return clone(next);
+			}
 			const current = await this.#read(providerId, options);
 			const next = await update(clone(current));
 			abortIfNeeded(options);
@@ -105,6 +391,11 @@ var DshOAuthCredentialStore = class {
 	}
 	delete(providerId, options) {
 		return this.#enqueue(providerId, async () => {
+			if (this.vault !== void 0) {
+				await this.vault.deleteAll();
+				abortIfNeeded(options);
+				return;
+			}
 			await this.credentials.unset(this.ref);
 			for (const legacyRef of this.legacyRefs) await this.credentials.unset(legacyRef);
 			abortIfNeeded(options);
@@ -114,23 +405,49 @@ var DshOAuthCredentialStore = class {
 /** Return only account state that is safe to expose to the browser client. */
 function createCodexAuthService(models, store, options = {}) {
 	const runLogin = options.runLogin ?? ((run) => run());
+	const accountVault = options.accountVault;
+	const createLoginModels = options.createLoginModels;
+	const createPendingStore = options.createPendingStore ?? (() => new PendingOAuthCredentialStore());
 	return Object.freeze({
 		async status(options) {
 			const current = await store.read(PROVIDER$1, options);
+			const accounts = await accountVault?.list();
 			if (current === void 0) return {
 				authenticated: false,
-				provider: PROVIDER$1
+				provider: PROVIDER$1,
+				...accounts === void 0 ? {} : { accounts }
 			};
 			return {
 				authenticated: true,
 				provider: PROVIDER$1,
 				type: "oauth",
-				expiresAt: current.expires
+				expiresAt: current.expires,
+				...accounts === void 0 ? {} : { accounts }
 			};
 		},
-		login(interaction) {
+		login(interaction, input = {}) {
+			if (input.label !== void 0) {
+				if (accountVault === void 0 || createLoginModels === void 0) throw new Error("Codex multi-account is unavailable");
+				return runLogin(async () => {
+					const pending = createPendingStore();
+					await createLoginModels(pending).login(PROVIDER$1, "oauth", interaction);
+					const credential = pending.credential();
+					if (credential === void 0) throw new Error("Codex login did not return credentials");
+					await accountVault.add(input.label, credential);
+				});
+			}
 			return runLogin(() => models.login(PROVIDER$1, "oauth", interaction));
 		},
+		async select(id) {
+			if (accountVault === void 0) throw new Error("Codex multi-account is unavailable");
+			await accountVault.select(id);
+			return this.status();
+		},
+		async remove(id) {
+			if (accountVault === void 0) throw new Error("Codex multi-account is unavailable");
+			await accountVault.remove(id);
+			return this.status();
+		},
 		logout(options) {
 			return models.logout(PROVIDER$1, options);
 		}
@@ -256,8 +573,9 @@ var CodexLoginCoordinator = class {
 			...active.view.phase === "failed" ? { failure: classifyLoginFailure(active.hostError) } : {}
 		};
 	}
-	async start({ method }) {
+	async start({ method, label }) {
 		if (!LOGIN_METHODS.has(method)) throw new Error(`unsupported Codex login method: ${String(method)}`);
+		if (label !== void 0 && (typeof label !== "string" || label.trim().length === 0 || label.trim().length > 48)) throw new Error("unsupported Codex account label");
 		const active = this.#activeId === void 0 ? void 0 : this.#sessions.get(this.#activeId);
 		if (active !== void 0 && !TERMINAL_PHASES.has(active.view.phase)) {
 			active.view = {
@@ -342,7 +660,7 @@ var CodexLoginCoordinator = class {
 				publishReady();
 			}
 		};
-		session.run = Promise.resolve().then(() => this.auth.login(interaction)).then(async () => {
+		session.run = Promise.resolve().then(() => this.auth.login(interaction, label === void 0 ? {} : { label: label.trim() })).then(async () => {
 			if (controller.signal.aborted) return;
 			const status = await this.auth.status();
 			session.view = {
@@ -365,6 +683,7 @@ var CodexLoginCoordinator = class {
 				return;
 			}
 			try {
+				if (label !== void 0) throw error;
 				const status = await this.auth.status();
 				if (status.authenticated === true) {
 					session.view = {
@@ -433,6 +752,12 @@ var CodexLoginCoordinator = class {
 		await this.auth.logout(options);
 		return this.accountStatus(options);
 	}
+	async selectAccount(id) {
+		return publicClone(await this.auth.select(id));
+	}
+	async removeAccount(id) {
+		return publicClone(await this.auth.remove(id));
+	}
 };
 /** Map the loopback-only DSH Connection channel onto the coordinator. */
 function createCodexRpcHandler(coordinator, options = {}) {
@@ -443,7 +768,10 @@ function createCodexRpcHandler(coordinator, options = {}) {
 			const input = asObject(payload);
 			if (endpoint === "status") return ok(await coordinator.accountStatus({ signal }));
 			if (endpoint === "login/start") {
-				const started = await coordinator.start({ method: input.method });
+				const started = await coordinator.start({
+					method: input.method,
+					label: input.label
+				});
 				if (input.openExternal !== true) return ok(started);
 				const url = started.authUrl ?? started.deviceCode?.verificationUri;
 				if (typeof url !== "string" || openExternal === void 0) return ok({
@@ -470,6 +798,8 @@ function createCodexRpcHandler(coordinator, options = {}) {
 			}));
 			if (endpoint === "login/cancel") return ok(await coordinator.cancel(input.id));
 			if (endpoint === "logout") return ok(await coordinator.logout({ signal }));
+			if (endpoint === "account/select") return ok(await coordinator.selectAccount(input.id));
+			if (endpoint === "account/remove") return ok(await coordinator.removeAccount(input.id));
 			return badRequest(`unknown Codex auth endpoint: ${endpoint}`);
 		} catch (error) {
 			if (signal.aborted) throw error;
@@ -935,7 +1265,7 @@ function openaiCodexSubscriptionProvider({ resolveSpeedMode = () => void 0, reso
 }
 //#endregion
 //#region src/version.js
-const PACKAGE_VERSION = "1.11.3";
+const PACKAGE_VERSION = "1.12.0";
 const USER_AGENT = `dsh-codex-subscription/${PACKAGE_VERSION}`;
 //#endregion
 //#region src/model-catalog.js
@@ -1836,6 +2166,8 @@ async function createSubscriptionDiagnostics({ auth, preferences, login = { phas
 const CODEX_USAGE_URL = "https://chatgpt.com/backend-api/wham/usage";
 const DEFAULT_TTL_MS = 6e4;
 const DEFAULT_TIMEOUT_MS$1 = 15e3;
+const DEFAULT_FAILURE_TTL_MS = 5e3;
+const DEFAULT_MAX_RETRY_AFTER_MS = 5 * 6e4;
 const record$1 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 function windowOf(value) {
 	if (value === void 0 || value === null) return void 0;
@@ -1951,6 +2283,15 @@ const requestSignal$1 = (signal, timeoutMs) => {
 	const timeout = AbortSignal.timeout(timeoutMs);
 	return signal === void 0 ? timeout : AbortSignal.any([signal, timeout]);
 };
+function retryAfterMs(response, now, maximum) {
+	if (response.status !== 429) return void 0;
+	const raw = response.headers?.get?.("retry-after")?.trim();
+	if (!raw) return void 0;
+	const seconds = Number(raw);
+	const delay = Number.isFinite(seconds) && seconds >= 0 ? seconds * 1e3 : Date.parse(raw) - now();
+	if (!Number.isFinite(delay) || delay < 0) return void 0;
+	return Math.min(delay, maximum);
+}
 /**
 * Read quota through the same refreshable OAuth lifecycle used by model turns.
 * The browser receives only a parsed quota projection; bearer and account id
@@ -1963,7 +2304,10 @@ function createCodexUsageReader(options) {
 	const now = options.now ?? Date.now;
 	const ttlMs = options.ttlMs ?? DEFAULT_TTL_MS;
 	const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS$1;
+	const failureTtlMs = options.failureTtlMs ?? DEFAULT_FAILURE_TTL_MS;
+	const maxRetryAfterMs = options.maxRetryAfterMs ?? DEFAULT_MAX_RETRY_AFTER_MS;
 	let cached;
+	let failed;
 	let inFlight;
 	let generation = 0;
 	const load = async (signal) => {
@@ -1984,7 +2328,11 @@ function createCodexUsageReader(options) {
 			},
 			signal: requestSignal$1(signal, timeoutMs)
 		});
-		if (!response.ok) throw new Error(response.status === 401 || response.status === 403 ? "ChatGPT sign-in needs to be renewed" : `ChatGPT usage request failed (HTTP ${response.status})`);
+		if (!response.ok) {
+			const error = /* @__PURE__ */ new Error(response.status === 401 || response.status === 403 ? "ChatGPT sign-in needs to be renewed" : `ChatGPT usage request failed (HTTP ${response.status})`);
+			Object.defineProperty(error, "retryAfterMs", { value: retryAfterMs(response, now, maxRetryAfterMs) });
+			throw error;
+		}
 		let value;
 		try {
 			value = await response.json();
@@ -1998,12 +2346,25 @@ function createCodexUsageReader(options) {
 	};
 	return Object.freeze({
 		read({ force = false, signal } = {}) {
+			if (failed !== void 0 && now() < failed.retryAt) return Promise.reject(new Error(failed.message));
 			if (!force && cached !== void 0 && now() - cached.fetchedAt < ttlMs) return Promise.resolve(structuredClone(cached));
 			if (inFlight !== void 0) return inFlight.then(structuredClone);
 			const currentGeneration = generation;
 			const current = load(signal).then((value) => {
-				if (generation === currentGeneration) cached = structuredClone(value);
+				if (generation === currentGeneration) {
+					cached = structuredClone(value);
+					failed = void 0;
+				}
 				return structuredClone(value);
+			}).catch((error) => {
+				if (generation === currentGeneration && error?.name !== "AbortError") {
+					const delay = Number.isFinite(error?.retryAfterMs) ? error.retryAfterMs : failureTtlMs;
+					failed = {
+						message: error instanceof Error ? error.message : "ChatGPT usage request failed",
+						retryAt: now() + delay
+					};
+				}
+				throw error;
 			}).finally(() => {
 				if (inFlight === current) inFlight = void 0;
 			});
@@ -2013,6 +2374,7 @@ function createCodexUsageReader(options) {
 		clear() {
 			generation += 1;
 			cached = void 0;
+			failed = void 0;
 			inFlight = void 0;
 		}
 	});
@@ -2021,18 +2383,33 @@ function createCodexUsageReader(options) {
 //#region src/quota-forecast.js
 const HOUR_MS = 3600 * 1e3;
 const HISTORY_MS = 24 * HOUR_MS;
-const MIN_SPAN_MS = 1800 * 1e3;
-const MIN_CONSUMED_PERCENT = 1;
+const MIN_SAMPLES = 3;
 const PLATEAU_SAMPLE_MS = 900 * 1e3;
 const finite = (value) => Number.isFinite(Number(value));
 const clampPercent = (value) => Math.max(0, Math.min(100, Number(value)));
-const keyFor = (window) => `codex:${Number(window.windowSeconds) || "limit"}`;
-function observeQuotaForecast(state, windows, now = Date.now()) {
+const cleanSegment = (value) => String(value ?? "default").slice(0, 96);
+const keyFor = (window, context = {}) => JSON.stringify([
+	cleanSegment(context.scope),
+	cleanSegment(context.limitId ?? "codex"),
+	Number(window.windowSeconds) || "limit"
+]);
+const median = (values) => {
+	const ordered = [...values].sort((a, b) => a - b);
+	const middle = Math.floor(ordered.length / 2);
+	return ordered.length % 2 === 0 ? (ordered[middle - 1] + ordered[middle]) / 2 : ordered[middle];
+};
+function requiredSpanMs(consumedPercent) {
+	if (consumedPercent >= 2) return 300 * 1e3;
+	if (consumedPercent >= 1) return 600 * 1e3;
+	if (consumedPercent >= .5) return 1200 * 1e3;
+	return 1800 * 1e3;
+}
+function observeQuotaForecast(state, windows, now = Date.now(), context = {}) {
 	const next = { windows: { ...state?.windows ?? {} } };
 	let changed = false;
 	for (const window of windows ?? []) {
 		if (!finite(window?.remainingPercent)) continue;
-		const key = keyFor(window);
+		const key = keyFor(window, context);
 		const resetsAt = finite(window.resetsAt) ? Number(window.resetsAt) : null;
 		const remainingPercent = Math.round(clampPercent(window.remainingPercent) * 1e4) / 1e4;
 		const previous = next.windows[key];
@@ -2062,14 +2439,14 @@ function observeQuotaForecast(state, windows, now = Date.now()) {
 		changed
 	};
 }
-function estimateQuotaForecast(state, window, now = Date.now()) {
+function estimateQuotaForecast(state, window, now = Date.now(), context = {}) {
 	if (!finite(window?.remainingPercent)) return { status: "calibrating" };
-	const record = state?.windows?.[keyFor(window)];
+	const record = state?.windows?.[keyFor(window, context)];
 	if (record === void 0) return { status: "calibrating" };
 	const resetsAt = finite(window.resetsAt) ? Number(window.resetsAt) : null;
 	if (record.resetsAt === null !== (resetsAt === null) || resetsAt !== null && Math.abs(record.resetsAt - resetsAt) > 300) return { status: "calibrating" };
 	const samples = record.samples.filter((sample) => sample.at >= now - HISTORY_MS && sample.at <= now + 6e4);
-	if (samples.length < 3) return {
+	if (samples.length < MIN_SAMPLES) return {
 		status: "calibrating",
 		sampleCount: samples.length
 	};
@@ -2077,77 +2454,190 @@ function estimateQuotaForecast(state, window, now = Date.now()) {
 	const last = samples.at(-1);
 	const spanMs = last.at - first.at;
 	const consumedPercent = Math.max(0, first.remainingPercent - last.remainingPercent);
-	if (spanMs < MIN_SPAN_MS || consumedPercent < MIN_CONSUMED_PERCENT) return {
+	if (spanMs < requiredSpanMs(consumedPercent)) return {
 		status: "calibrating",
 		sampleCount: samples.length,
 		observedSpanMs: spanMs,
 		consumedPercent
 	};
-	const firstAt = first.at;
-	const weighted = samples.map((sample) => ({
-		x: (sample.at - firstAt) / HOUR_MS,
-		y: first.remainingPercent - sample.remainingPercent,
-		weight: Math.exp((sample.at - last.at) / (6 * HOUR_MS))
-	}));
-	const totalWeight = weighted.reduce((sum, point) => sum + point.weight, 0);
-	const meanX = weighted.reduce((sum, point) => sum + point.x * point.weight, 0) / totalWeight;
-	const meanY = weighted.reduce((sum, point) => sum + point.y * point.weight, 0) / totalWeight;
-	const numerator = weighted.reduce((sum, point) => sum + point.weight * (point.x - meanX) * (point.y - meanY), 0);
-	const denominator = weighted.reduce((sum, point) => sum + point.weight * (point.x - meanX) ** 2, 0);
-	const pacePerHour = denominator > 0 ? numerator / denominator : 0;
+	const slopes = [];
+	for (let left = 0; left < samples.length - 1; left += 1) for (let right = left + 1; right < samples.length; right += 1) {
+		const hours = (samples[right].at - samples[left].at) / HOUR_MS;
+		if (hours <= 0) continue;
+		slopes.push((samples[left].remainingPercent - samples[right].remainingPercent) / hours);
+	}
+	const positive = slopes.filter((value) => Number.isFinite(value) && value >= 0);
+	const pacePerHour = positive.length === 0 ? 0 : median(positive);
 	if (!Number.isFinite(pacePerHour) || pacePerHour < .02) return {
 		status: "idle",
-		pacePerHour: 0
+		pacePerHour: 0,
+		sampleCount: samples.length,
+		observedSpanMs: spanMs,
+		consumedPercent
 	};
-	const runwaySeconds = clampPercent(window.remainingPercent) / pacePerHour * 3600;
+	const deviations = positive.map((value) => Math.abs(value - pacePerHour));
+	const uncertaintyPerHour = deviations.length === 0 ? 0 : median(deviations) * 1.4826;
+	const lowerPacePerHour = Math.max(.02, pacePerHour - uncertaintyPerHour);
+	const upperPacePerHour = pacePerHour + uncertaintyPerHour;
+	const remaining = clampPercent(window.remainingPercent);
+	const runwaySeconds = remaining / pacePerHour * 3600;
+	const runwayMinSeconds = remaining / upperPacePerHour * 3600;
+	const runwayMaxSeconds = remaining / lowerPacePerHour * 3600;
 	const resetSeconds = resetsAt === null ? null : Math.max(0, resetsAt - now / 1e3);
 	return {
 		status: "ready",
 		pacePerHour,
+		uncertaintyPerHour,
 		runwaySeconds,
-		survivesReset: resetSeconds !== null && runwaySeconds >= resetSeconds,
+		runwayMinSeconds,
+		runwayMaxSeconds,
+		survivesReset: resetSeconds !== null && runwayMinSeconds >= resetSeconds,
 		sampleCount: samples.length,
 		observedSpanMs: spanMs,
 		consumedPercent
 	};
 }
-function forecastUsage(usage, state = { windows: {} }, now = Date.now()) {
-	const observed = observeQuotaForecast(state, usage?.rateLimits?.find((limit) => limit.id === "codex")?.windows ?? [], now);
+function forecastUsage(usage, state = { windows: {} }, now = Date.now(), options = {}) {
+	let nextState = state;
+	let changed = false;
+	const rateLimits = (usage?.rateLimits ?? []).map((limit) => {
+		const context = {
+			scope: options.scope,
+			limitId: limit.id
+		};
+		const observed = observeQuotaForecast(nextState, limit.windows, now, context);
+		nextState = observed.state;
+		changed ||= observed.changed;
+		return {
+			...limit,
+			windows: limit.windows.map((window) => ({
+				...window,
+				forecast: estimateQuotaForecast(nextState, window, now, context)
+			}))
+		};
+	});
 	return {
-		state: observed.state,
-		changed: observed.changed,
+		state: nextState,
+		changed,
 		usage: {
 			...usage,
-			rateLimits: (usage?.rateLimits ?? []).map((limit) => limit.id !== "codex" ? limit : {
-				...limit,
-				windows: limit.windows.map((window) => ({
-					...window,
-					forecast: estimateQuotaForecast(observed.state, window, now)
-				}))
-			})
+			rateLimits
 		}
 	};
 }
-function createQuotaForecastReader({ reader, enabled, now = Date.now }) {
+function createQuotaForecastReader({ reader, enabled, now = Date.now, scope = () => "default", stateStore }) {
 	let state = { windows: {} };
+	let loaded = false;
+	const load = async () => {
+		if (loaded) return;
+		loaded = true;
+		const restored = await stateStore?.load?.();
+		if (restored?.windows !== null && typeof restored?.windows === "object") state = restored;
+	};
 	return Object.freeze({
 		async read(options) {
 			const usage = await reader.read(options);
+			await load();
 			if (!enabled()) {
 				state = { windows: {} };
+				await stateStore?.clear?.();
 				return usage;
 			}
-			const forecast = forecastUsage(usage, state, now());
+			const forecast = forecastUsage(usage, state, now(), { scope: await scope() });
 			state = forecast.state;
+			if (forecast.changed) await stateStore?.save?.(state);
 			return forecast.usage;
 		},
-		clear() {
+		async clear() {
 			state = { windows: {} };
+			loaded = true;
 			reader.clear();
+			await stateStore?.clear?.();
+		},
+		clearCache() {
+			reader.clear();
+		},
+		async clearScope(targetScope) {
+			await load();
+			const prefix = `[${JSON.stringify(cleanSegment(targetScope))},`;
+			state = { windows: Object.fromEntries(Object.entries(state.windows).filter(([key]) => !key.startsWith(prefix))) };
+			await stateStore?.save?.(state);
 		}
 	});
 }
 //#endregion
+//#region src/quota-forecast-store.js
+const DEFAULT_MAX_BYTES = 256 * 1024;
+const MAX_WINDOWS = 128;
+const MAX_SAMPLES = 192;
+function sanitize(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value) || value.windows === null || typeof value.windows !== "object" || Array.isArray(value.windows)) return void 0;
+	const entries = Object.entries(value.windows);
+	if (entries.length > MAX_WINDOWS) return void 0;
+	const windows = {};
+	for (const [key, record] of entries) {
+		if (key.length === 0 || key.length > 320 || record === null || typeof record !== "object" || !Array.isArray(record.samples) || record.samples.length > MAX_SAMPLES) return void 0;
+		const resetsAt = record.resetsAt === null ? null : Number(record.resetsAt);
+		if (resetsAt !== null && !Number.isFinite(resetsAt)) return void 0;
+		const samples = [];
+		for (const sample of record.samples) {
+			const at = Number(sample?.at);
+			const remainingPercent = Number(sample?.remainingPercent);
+			if (!Number.isFinite(at) || !Number.isFinite(remainingPercent) || remainingPercent < 0 || remainingPercent > 100) return void 0;
+			samples.push({
+				at,
+				remainingPercent
+			});
+		}
+		windows[key] = {
+			resetsAt,
+			samples
+		};
+	}
+	return { windows };
+}
+var QuotaForecastStateStore = class {
+	constructor({ filename, maxBytes = DEFAULT_MAX_BYTES }) {
+		this.filename = filename;
+		this.maxBytes = maxBytes;
+	}
+	async load() {
+		try {
+			if ((await stat(this.filename)).size > this.maxBytes) return void 0;
+			return sanitize(JSON.parse(await readFile(this.filename, "utf8")));
+		} catch (error) {
+			if (error?.code === "ENOENT" || error instanceof SyntaxError) return void 0;
+			throw error;
+		}
+	}
+	async save(state) {
+		const safe = sanitize(state);
+		if (safe === void 0) throw new Error("Refusing to persist malformed quota forecast state");
+		const data = `${JSON.stringify(safe)}\n`;
+		if (Buffer.byteLength(data) > this.maxBytes) throw new Error("Quota forecast state is too large");
+		await mkdir(dirname(this.filename), {
+			recursive: true,
+			mode: 448
+		});
+		const temporary = `${this.filename}.${process.pid}.${randomUUID()}.tmp`;
+		let handle;
+		try {
+			handle = await open(temporary, "wx", 384);
+			await handle.writeFile(data);
+			await handle.sync();
+			await handle.close();
+			handle = void 0;
+			await rename(temporary, this.filename);
+		} finally {
+			await handle?.close().catch(() => void 0);
+			await rm(temporary, { force: true }).catch(() => void 0);
+		}
+	}
+	async clear() {
+		await rm(this.filename, { force: true });
+	}
+};
+//#endregion
 //#region src/reset-credits.js
 const CODEX_RESET_CREDITS_URL = "https://chatgpt.com/backend-api/wham/rate-limit-reset-credits";
 const CODEX_RESET_CONSUME_URL = `${CODEX_RESET_CREDITS_URL}/consume`;
@@ -2404,8 +2894,10 @@ const inject = [
 	"attachments"
 ];
 const PROVIDER = "openai-codex";
-const CREDENTIAL_REF = credentialRef("OPENAI_CODEX_SUBSCRIPTION_OAUTH");
-const LEGACY_CREDENTIAL_REF = credentialRef("WSL043_OPENAI_CODEX_OAUTH");
+const OAUTH_EXPIRY_SKEW_MS = 6e4;
+const CREDENTIAL_REF = dshCredentials.credentialRef("OPENAI_CODEX_SUBSCRIPTION_OAUTH");
+const LEGACY_CREDENTIAL_REF = dshCredentials.credentialRef("WSL043_OPENAI_CODEX_OAUTH");
+const ACCOUNT_VAULT_KEY = typeof dshCredentials.credentialKey === "function" ? dshCredentials.credentialKey("codex-subscription", "accounts") : void 0;
 const CHANNEL = "/codex-subscription";
 const WEB_ENTRY_ID = "web";
 const DSH_SEARCH_PROVIDER_FALLBACK = "deepseek-official";
@@ -2552,10 +3044,16 @@ function createSubscriptionRpcHandler({ authHandler, usageReader, resetCreditSer
 			return publicError("internal", message);
 		}
 		const result = await authHandler(endpoint, payload, signal);
+		if (endpoint === "account/remove" && result.ok === true && typeof payload?.id === "string") await usageReader.clearScope(payload.id);
 		if (endpoint === "logout" && result.ok === true) {
-			usageReader.clear();
+			await usageReader.clear();
 			resetCreditService.clear();
 			modelCatalog?.clear();
+		} else if (result.ok === true && (endpoint === "account/select" || endpoint === "account/remove" || endpoint === "login/status" && result.value?.authenticated === true)) {
+			usageReader.clearCache();
+			resetCreditService.clear();
+			modelCatalog?.clear();
+			modelCatalog?.refresh({ signal: void 0 }).catch(() => {});
 		} else if (result.ok === true && (endpoint === "status" || result.value?.authenticated === true)) modelCatalog?.refresh({ signal: void 0 }).catch(() => {});
 		return result;
 	};
@@ -2616,7 +3114,15 @@ function apply(ctx) {
 	const searchProvider = createSearchProviderSwitcher(ctx.loader);
 	const network = createCodexNetworkTransport();
 	const originalImages = new OriginalImageStore();
-	const store = new DshOAuthCredentialStore(ctx.credentials, CREDENTIAL_REF, [LEGACY_CREDENTIAL_REF]);
+	const accountVault = ACCOUNT_VAULT_KEY !== void 0 && typeof ctx.credentials.readRecord === "function" && typeof ctx.credentials.modifyRecord === "function" && typeof ctx.credentials.deleteRecord === "function" ? new DshOAuthAccountVault(ctx.credentials, {
+		key: ACCOUNT_VAULT_KEY,
+		legacyRef: CREDENTIAL_REF,
+		legacyRefs: [LEGACY_CREDENTIAL_REF]
+	}) : void 0;
+	const store = new DshOAuthCredentialStore(ctx.credentials, CREDENTIAL_REF, [LEGACY_CREDENTIAL_REF], {
+		expirySkewMs: OAUTH_EXPIRY_SKEW_MS,
+		vault: accountVault
+	});
 	const baseProvider = createOpenAICodexProvider();
 	let resolveAuth = async () => void 0;
 	const modelCatalog = createOfficialModelCatalog({
@@ -2738,7 +3244,15 @@ function apply(ctx) {
 		select(settings.get());
 		return settings.watch(select);
 	}, "codex-subscription: search provider selection");
-	const auth = createCodexAuthService(authModels, store, { runLogin: (operation) => network.run("login", operation) });
+	const auth = createCodexAuthService(authModels, store, {
+		runLogin: (operation) => network.run("login", operation),
+		accountVault,
+		createLoginModels: (credentials) => {
+			const loginModels = createModels({ credentials });
+			loginModels.setProvider(provider);
+			return loginModels;
+		}
+	});
 	const coordinator = new CodexLoginCoordinator(auth);
 	const usageReader = createQuotaForecastReader({
 		reader: createCodexUsageReader({
@@ -2746,8 +3260,18 @@ function apply(ctx) {
 			readCredential: (options) => store.read(PROVIDER, options),
 			fetch: (input, init) => network.fetch("quota", input, init)
 		}),
-		enabled: () => normalizeQuickQuotaMode(settings.get()[QUICK_QUOTA_MODE_FIELD], settings.get()[LEGACY_QUICK_QUOTA_FIELD]) === QUICK_QUOTA_MODE_FORECAST
+		enabled: () => normalizeQuickQuotaMode(settings.get()[QUICK_QUOTA_MODE_FIELD], settings.get()[LEGACY_QUICK_QUOTA_FIELD]) === QUICK_QUOTA_MODE_FORECAST,
+		scope: async () => await accountVault?.activeId() ?? "legacy",
+		stateStore: new QuotaForecastStateStore({ filename: dshHomePath("state", "codex-subscription", "quota-forecast.json") })
 	});
+	ctx.effect(() => {
+		const warmForecast = (value) => {
+			if (normalizeQuickQuotaMode(value["quickQuotaMode"], value["quickQuotaVisible"]) !== "forecast") return;
+			usageReader.read().catch((error) => ctx.logger?.debug?.("could not warm Codex quota forecast: %s", error.message));
+		};
+		warmForecast(settings.get());
+		return settings.watch(warmForecast);
+	}, "codex-subscription: quota forecast warm-up");
 	const resetCreditService = createCodexResetCreditService({
 		getAuth: resolveAuth,
 		readCredential: (options) => store.read(PROVIDER, options),