dsh-codex-subscription 2.6.9 → 2.7.0

package/README.en.md

@@ -106,7 +106,7 @@ This plugin supports the latest DeepSeek Harness release recorded in its package
 2. Paste this package name, with its version, into the **Package name or address** field:
 
    ```text
-   dsh-codex-subscription@2.6.9
+   dsh-codex-subscription@2.7.0
    ```
 
 3. Click **Install** and wait for completion. Follow the page instructions; save your work before restarting if requested.
@@ -118,7 +118,7 @@ Why the version is included: DSH's plugin page only installs versions that are a
 <summary>Terminal installation (with an existing dsh command)</summary>
 
 ```sh
-dsh plugin --profile web add dsh-codex-subscription@2.6.9
+dsh plugin --profile web add dsh-codex-subscription@2.7.0
 ```
 
 Follow the restart instructions, then sign in under **Settings → Codex**. Both the Plugins page and the terminal use DSH's installation management.
@@ -131,7 +131,7 @@ Follow the restart instructions, then sign in under **Settings → Codex**. Both
 After signing in and selecting a Codex model in Web, install the same plugin in the Headless profile:
 
 ```sh
-dsh plugin --profile headless add dsh-codex-subscription@2.6.9
+dsh plugin --profile headless add dsh-codex-subscription@2.7.0
 dsh --profile headless "Reply with only the word: ok"
 ```
 
@@ -266,7 +266,7 @@ Find this plugin on the DSH **Plugins** page and use its update or uninstall act
 <summary>Terminal commands</summary>
 
 ```sh
-dsh plugin --profile web update dsh-codex-subscription@2.6.9
+dsh plugin --profile web update dsh-codex-subscription@2.7.0
 ```
 
 Run only when you want to uninstall:
@@ -282,7 +282,7 @@ dsh plugin --profile web remove dsh-codex-subscription
 <details>
 <summary>DSH 0.2.0-rc.2 reports the plugin as incompatible?</summary>
 
-DSH 0.2.0-rc.2 did not exist when any release before 2.2.10 was published, and a published package's compatibility declaration cannot be changed. Install 2.2.10 or later (a bare package name can resolve to an older release during the first 24 hours, so enter `dsh-codex-subscription@2.2.10`) from the **Plugins** page, or run `dsh plugin --profile web update dsh-codex-subscription@2.6.9`, then restart DSH.
+DSH 0.2.0-rc.2 did not exist when any release before 2.2.10 was published, and a published package's compatibility declaration cannot be changed. Install 2.2.10 or later (a bare package name can resolve to an older release during the first 24 hours, so enter `dsh-codex-subscription@2.2.10`) from the **Plugins** page, or run `dsh plugin --profile web update dsh-codex-subscription@2.7.0`, then restart DSH.
 
 </details>
 

package/README.md

@@ -106,7 +106,7 @@
 2. 在 **包名或地址** 输入框中粘贴下面的包名（已带版本号）：
 
    ```text
-   dsh-codex-subscription@2.6.9
+   dsh-codex-subscription@2.7.0
    ```
 
 3. 点击 **安装**，等待安装完成；按页面提示操作，需要重启时先保存工作。
@@ -118,7 +118,7 @@
 <summary>终端安装（已能运行 dsh 命令）</summary>
 
 ```sh
-dsh plugin --profile web add dsh-codex-subscription@2.6.9
+dsh plugin --profile web add dsh-codex-subscription@2.7.0
 ```
 
 安装完成后按提示重启 DSH，再到 **设置 → Codex 订阅** 登录。插件页面和终端均由 DSH 管理安装。
@@ -131,7 +131,7 @@ dsh plugin --profile web add dsh-codex-subscription@2.6.9
 先在 Web 中完成登录并选择一次 Codex 模型，再把同一个插件安装到 Headless profile：
 
 ```sh
-dsh plugin --profile headless add dsh-codex-subscription@2.6.9
+dsh plugin --profile headless add dsh-codex-subscription@2.7.0
 dsh --profile headless "只回复：ok"
 ```
 
@@ -295,7 +295,7 @@ DSH 实机设置截图。
 <summary>终端方式</summary>
 
 ```sh
-dsh plugin --profile web update dsh-codex-subscription@2.6.9
+dsh plugin --profile web update dsh-codex-subscription@2.7.0
 ```
 
 仅在需要卸载时运行：
@@ -311,7 +311,7 @@ dsh plugin --profile web remove dsh-codex-subscription
 <details>
 <summary>DSH 0.2.0-rc.2 提示插件不兼容？</summary>
 
-2.2.10 之前的所有版本发布时 DSH 0.2.0-rc.2 还不存在，其兼容声明无法事后修改。请安装 2.2.10 或更高版本（只填包名时，发布满 24 小时前可能装到旧版，请直接填 `dsh-codex-subscription@2.2.10`）：在 **插件** 页面更新，或运行 `dsh plugin --profile web update dsh-codex-subscription@2.6.9`，然后重启 DSH。
+2.2.10 之前的所有版本发布时 DSH 0.2.0-rc.2 还不存在，其兼容声明无法事后修改。请安装 2.2.10 或更高版本（只填包名时，发布满 24 小时前可能装到旧版，请直接填 `dsh-codex-subscription@2.2.10`）：在 **插件** 页面更新，或运行 `dsh plugin --profile web update dsh-codex-subscription@2.7.0`，然后重启 DSH。
 
 </details>
 

package/lib/client.js

@@ -1074,6 +1074,7 @@ window.__ModuleLoader__.load({
 			"account/select",
 			"account/remove",
 			"usage",
+			"usage/accounts",
 			"diagnostics",
 			"preferences/status",
 			"preferences/models",
@@ -6037,7 +6038,13 @@ window.__ModuleLoader__.load({
 			resetNoCredit: "没有可用的额度重置。",
 			resetAlready: "这次重置请求已处理。",
 			resetFailed: "无法使用额度重置。",
+			accountQuotaLeft: "{label}剩余 {value}%",
+			accountQuotaResets: "{value} 重置",
+			accountQuotaLoading: "正在读取额度…",
+			accountQuotaError: "暂时读不到这个账号的额度",
+			accountQuotaNone: "没有额度窗口信息",
 			resetRenewLogin: "登录状态已失效，请重新登录。",
+			resetBlocked: "ChatGPT 的网络防护拦截了这次请求（HTTP 403），登录状态没有问题。请稍后再试，或检查网络、代理或 VPN。",
 			resetExpired: "本次确认已失效，请重新开始。",
 			resetInProgress: "额度重置正在处理中。",
 			resetTooEarly: "请等待冷静期结束后再确认。",
@@ -6643,7 +6650,13 @@ window.__ModuleLoader__.load({
 			resetNoCredit: "No quota reset is available.",
 			resetAlready: "This reset request was already processed.",
 			resetFailed: "Could not use the quota reset.",
+			accountQuotaLeft: "{label} {value}% left",
+			accountQuotaResets: "resets {value}",
+			accountQuotaLoading: "Reading quota…",
+			accountQuotaError: "The quota of this account could not be read right now",
+			accountQuotaNone: "No quota window reported",
 			resetRenewLogin: "Your sign-in expired. Sign in again.",
+			resetBlocked: "ChatGPT network protection blocked this request (HTTP 403). Your sign-in is fine; try again later or check your network, proxy or VPN.",
 			resetExpired: "This confirmation expired. Start again.",
 			resetInProgress: "A quota reset is already in progress.",
 			resetTooEarly: "Wait for the cooldown before confirming.",
@@ -6849,6 +6862,9 @@ window.__ModuleLoader__.load({
 .codexSubscriptionAccounts{display:flex;flex-direction:column;border-top:1px solid var(--dsw-alias-border-l2)}
 .codexSubscriptionAccount{display:flex;align-items:center;justify-content:space-between;gap:10px;min-height:42px;border-bottom:1px solid var(--dsw-alias-border-l2);font-size:13px}
 .codexSubscriptionAccount:last-child{border-bottom:0}
+.codexSubscriptionAccountMain{display:flex;flex-direction:column;gap:2px;padding:6px 0;min-width:0}
+.codexSubscriptionAccountQuota{display:flex;flex-wrap:wrap;gap:2px 12px;font-size:12px;color:var(--dsw-alias-text-l2)}
+.codexSubscriptionAccountQuota[data-state=error]{color:var(--dsw-alias-text-danger,#c0392b)}
 .codexSubscriptionAccount[data-active=true] .codexSubscriptionEmail,.codexSubscriptionAccount[data-active=true]>span{font-weight:600}
 .codexSubscriptionEmail{max-width:100%;overflow:hidden;padding:2px 4px;border:0;border-radius:5px;background:transparent;color:var(--dsw-alias-label-primary);font:inherit;text-align:left;text-overflow:ellipsis;white-space:nowrap;cursor:pointer}
 .codexSubscriptionEmail:hover{background:var(--dsw-alias-interactive-bg-hover)}
@@ -9078,7 +9094,9 @@ window.__ModuleLoader__.load({
 			return `${local[0]}•••${local.at(-1)}@${domain}`;
 		};
 		const hours = (seconds) => Math.round(seconds / 3600 * 10) / 10;
-		const percent = (value) => Number(value).toLocaleString(void 0, { maximumFractionDigits: 1 });
+		/** The language DSH shows its interface in, so dates and numbers match the text around them rather than the OS. */
+		const uiLocale = () => typeof document === "undefined" ? void 0 : document.documentElement.lang || void 0;
+		const percent = (value) => Number(value).toLocaleString(uiLocale(), { maximumFractionDigits: 1 });
 		const isApproximateWindow = (seconds, expected) => seconds >= expected * .95 && seconds <= expected * 1.05;
 		const windowLabel = (seconds, t) => {
 			if (isApproximateWindow(seconds, 18e3)) return t("windowFiveHours");
@@ -9155,7 +9173,7 @@ window.__ModuleLoader__.load({
 		}
 		//#endregion
 		//#region src/version.js
-		const PACKAGE_VERSION = "2.6.9";
+		const PACKAGE_VERSION = "2.7.0";
 		//#endregion
 		//#region src/client-recovery.js
 		async function recoveryCall(rpc, endpoint, payload = {}, timeoutMs = 1e4) {
@@ -9383,7 +9401,7 @@ window.__ModuleLoader__.load({
 		}
 		function shortReset(quota, t) {
 			if (!Number.isSafeInteger(quota.resetsAt)) return t("resetUnknown");
-			const value = (/* @__PURE__ */ new Date(quota.resetsAt * 1e3)).toLocaleString(void 0, {
+			const value = (/* @__PURE__ */ new Date(quota.resetsAt * 1e3)).toLocaleString(uiLocale(), {
 				month: "numeric",
 				day: "numeric",
 				hour: "2-digit",
@@ -11152,6 +11170,73 @@ window.__ModuleLoader__.load({
 			}
 		}
 		//#endregion
+		//#region src/client-account-quota.jsx
+		const when = (seconds) => (/* @__PURE__ */ new Date(seconds * 1e3)).toLocaleString(uiLocale(), {
+			month: "numeric",
+			day: "numeric",
+			hour: "2-digit",
+			minute: "2-digit"
+		});
+		/** Quota of every signed-in account (read-only; the active account does not change). */
+		function useAccountQuotas(rpc, ids) {
+			const [entries, setEntries] = (0, react.useState)({});
+			const [busy, setBusy] = (0, react.useState)(false);
+			const request = (0, react.useRef)(0);
+			const key = ids.join(",");
+			const load = (force) => {
+				if (ids.length < 2) {
+					setEntries({});
+					return;
+				}
+				const id = ++request.current;
+				setBusy(true);
+				recoveryCall(rpc, "usage/accounts", { force }).then((value) => {
+					if (request.current === id) setEntries(Object.fromEntries((value?.accounts ?? []).map((entry) => [entry.id, entry])));
+				}).catch(() => {
+					if (request.current === id) setEntries(Object.fromEntries(ids.map((account) => [account, {
+						id: account,
+						error: "Could not read ChatGPT usage"
+					}])));
+				}).finally(() => {
+					if (request.current === id) setBusy(false);
+				});
+			};
+			(0, react.useEffect)(() => {
+				load(false);
+				return () => {
+					request.current += 1;
+				};
+			}, [key]);
+			return {
+				entries,
+				busy,
+				refresh: () => load(true)
+			};
+		}
+		function AccountQuota({ entry, loading, t }) {
+			if (entry === void 0) return loading ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("small", {
+				className: "codexSubscriptionAccountQuota",
+				children: t("accountQuotaLoading")
+			}) : null;
+			if (entry.error !== void 0) return /* @__PURE__ */ (0, react_jsx_runtime.jsx)("small", {
+				className: "codexSubscriptionAccountQuota",
+				"data-state": "error",
+				children: entry.error === "ChatGPT sign-in needs to be renewed" ? t("resetRenewLogin") : t("accountQuotaError")
+			});
+			const windows = entry.usage?.rateLimits?.find((limit) => limit.id === "codex")?.windows ?? [];
+			if (windows.length === 0) return /* @__PURE__ */ (0, react_jsx_runtime.jsx)("small", {
+				className: "codexSubscriptionAccountQuota",
+				children: t("accountQuotaNone")
+			});
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsx)("small", {
+				className: "codexSubscriptionAccountQuota",
+				children: windows.map((window) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", { children: [fill(t("accountQuotaLeft"), {
+					label: windowLabel(window.windowSeconds, t),
+					value: percent(window.remainingPercent)
+				}), window.resetsAt === void 0 ? "" : ` · ${fill(t("accountQuotaResets"), { value: when(window.resetsAt) })}`] }, window.windowSeconds))
+			});
+		}
+		//#endregion
 		//#region src/client-account.jsx
 		const LOGIN_FAILURES = [
 			"account-claim",
@@ -11173,6 +11258,7 @@ window.__ModuleLoader__.load({
 				children: emailVisible ? candidate.email : maskEmail(candidate.email)
 			});
 		}
+		const signedInIds = (account) => account?.authenticated === true ? (account.accounts ?? []).map((candidate) => candidate.id).filter((id) => typeof id === "string") : [];
 		function AccountCard({ rpc, t, account, setAccount, onSignedOut }) {
 			const [flow, setFlow] = (0, react.useState)();
 			const flowGeneration = (0, react.useRef)(0);
@@ -11185,6 +11271,7 @@ window.__ModuleLoader__.load({
 			const [emailVisibilityKey, setEmailVisibilityKey] = (0, react.useState)(accountVisibilityKey);
 			const [busy, setBusy] = (0, react.useState)(false);
 			const [error, setError] = (0, react.useState)();
+			const quotas = useAccountQuotas(rpc, signedInIds(account));
 			const call = (endpoint, payload = {}) => recoveryCall(rpc, endpoint, payload);
 			(0, react.useEffect)(() => {
 				if (emailVisibilityKey === accountVisibilityKey) return;
@@ -11380,12 +11467,19 @@ window.__ModuleLoader__.load({
 						children: accounts.map((candidate) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 							className: "codexSubscriptionAccount",
 							"data-active": candidate.active,
-							children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)(AccountEmail, {
-								candidate,
-								fallback: candidate.label,
-								t,
-								emailVisible: emailVisibleForAccount,
-								onClick: toggleEmail
+							children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+								className: "codexSubscriptionAccountMain",
+								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)(AccountEmail, {
+									candidate,
+									fallback: candidate.label,
+									t,
+									emailVisible: emailVisibleForAccount,
+									onClick: toggleEmail
+								}), accounts.length > 1 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)(AccountQuota, {
+									entry: quotas.entries[candidate.id],
+									loading: quotas.busy,
+									t
+								}) : null]
 							}), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 								className: "codexSubscriptionActions",
 								children: [
@@ -11789,7 +11883,7 @@ window.__ModuleLoader__.load({
 							children: [
 								t("diagnosticsSnapshotTime"),
 								" ",
-								new Date(report.generatedAt).toLocaleString()
+								new Date(report.generatedAt).toLocaleString(uiLocale())
 							]
 						}) : null,
 						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
@@ -11807,7 +11901,7 @@ window.__ModuleLoader__.load({
 									" · ",
 									t(`diagnosticSource_${event.source}`),
 									" · ",
-									new Date(event.observedAt).toLocaleTimeString()
+									new Date(event.observedAt).toLocaleTimeString(uiLocale())
 								] }, `${event.source}:${event.action}`)) }) : null
 							] }, item.code)) }) : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", { children: t("diagnosticsNoRecordedFailure") })
 						}),
@@ -11825,7 +11919,7 @@ window.__ModuleLoader__.load({
 							] }) }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("tbody", { children: (report.inspection?.capabilities ?? []).map((item) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("tr", { children: [
 								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("td", { children: t(`diagnosticCapability_${item.id}`) }),
 								/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("td", { children: [t(`diagnosticReason_${item.reason}`), item.blockedBy ? ` · ${t(`diagnosticCapability_${item.blockedBy}`)}` : ""] }),
-								/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("td", { children: [item.latest ? `${item.latest.action} · ${t(`diagnosticSource_${item.latest.source}`)} · ${t(`diagnosticOutcome_${item.latest.status}`)} · ${new Date(item.latest.observedAt).toLocaleTimeString()}` : t("diagnosticsUnverified"), item.unresolved?.length ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", { children: t("diagnosticsUnresolved") }) : null] })
+								/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("td", { children: [item.latest ? `${item.latest.action} · ${t(`diagnosticSource_${item.latest.source}`)} · ${t(`diagnosticOutcome_${item.latest.status}`)} · ${new Date(item.latest.observedAt).toLocaleTimeString(uiLocale())}` : t("diagnosticsUnverified"), item.unresolved?.length ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", { children: t("diagnosticsUnresolved") }) : null] })
 							] }, item.id)) })]
 						}),
 						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
@@ -11972,8 +12066,8 @@ window.__ModuleLoader__.load({
 		}
 		//#endregion
 		//#region src/client-usage.jsx
-		const count = (value) => Number(value).toLocaleString();
-		const creditAmount = (value) => Number.isFinite(Number(value)) && String(value).trim() !== "" ? Number(value).toLocaleString(void 0, { maximumFractionDigits: 2 }) : value;
+		const count = (value) => Number(value).toLocaleString(uiLocale());
+		const creditAmount = (value) => Number.isFinite(Number(value)) && String(value).trim() !== "" ? Number(value).toLocaleString(uiLocale(), { maximumFractionDigits: 2 }) : value;
 		function CreditExpiry({ credits, t }) {
 			const date = validDate(credits.expiresAt);
 			if (date === void 0 || credits.unlimited) return null;
@@ -11984,7 +12078,7 @@ window.__ModuleLoader__.load({
 				"data-soon": status.soon,
 				role: "status",
 				children: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("p", { children: [fill(t(status.daysLeft === 0 ? "creditsExpiredToday" : "creditsExpires"), {
-					date: date.toLocaleDateString(),
+					date: date.toLocaleDateString(uiLocale()),
 					days: status.daysLeft
 				}), estimate ? ` ${t("creditsExpiryEstimate")}` : ""] })
 			});
@@ -11992,7 +12086,7 @@ window.__ModuleLoader__.load({
 		function ResetTime({ resetsAt, t }) {
 			const date = Number.isSafeInteger(resetsAt) ? validDate(resetsAt * 1e3) : void 0;
 			if (date === void 0) return /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: t("resetUnknown") });
-			const value = date.toLocaleString(void 0, {
+			const value = date.toLocaleString(uiLocale(), {
 				month: "numeric",
 				day: "numeric",
 				hour: "2-digit",
@@ -12000,7 +12094,7 @@ window.__ModuleLoader__.load({
 			});
 			return /* @__PURE__ */ (0, react_jsx_runtime.jsx)("time", {
 				dateTime: date.toISOString(),
-				title: date.toLocaleString(),
+				title: date.toLocaleString(uiLocale()),
 				children: fill(t("resets"), { value })
 			});
 		}
@@ -12010,8 +12104,8 @@ window.__ModuleLoader__.load({
 				className: "codexSubscriptionResetExpiry",
 				children: date === void 0 ? t("resetCreditExpiryUnknown") : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("time", {
 					dateTime: date.toISOString(),
-					title: date.toLocaleString(),
-					children: fill(t("resetCreditExpires"), { value: date.toLocaleDateString(void 0, {
+					title: date.toLocaleString(uiLocale()),
+					children: fill(t("resetCreditExpires"), { value: date.toLocaleDateString(uiLocale(), {
 						month: "long",
 						day: "numeric"
 					}) })
@@ -12203,6 +12297,7 @@ window.__ModuleLoader__.load({
 			return t((/* @__PURE__ */ new Map([
 				["ChatGPT subscription is not signed in", "resetRenewLogin"],
 				["ChatGPT sign-in needs to be renewed", "resetRenewLogin"],
+				["ChatGPT blocked this request before it reached your account (HTTP 403); your sign-in is fine, try again later or check your network, proxy or VPN", "resetBlocked"],
 				["No quota reset is available", "resetNoCredit"],
 				["No usable quota reset is available", "resetNoCredit"],
 				["The available quota reset expires too soon", "resetExpired"],
@@ -12265,7 +12360,7 @@ window.__ModuleLoader__.load({
 							children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("h3", { children: t("usage") }), fetchedAt === void 0 ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("time", {
 								className: "codexSubscriptionFreshness",
 								dateTime: fetchedAt.toISOString(),
-								children: fill(t("usageUpdated"), { value: fetchedAt.toLocaleString() })
+								children: fill(t("usageUpdated"), { value: fetchedAt.toLocaleString(uiLocale()) })
 							})]
 						}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(Button, {
 							className: "codexSubscriptionRefresh",

package/lib/index.js

@@ -1135,6 +1135,7 @@ const RPC_ENDPOINTS = Object.freeze([
 	"account/select",
 	"account/remove",
 	"usage",
+	"usage/accounts",
 	"diagnostics",
 	"preferences/status",
 	"preferences/models",
@@ -2087,9 +2088,36 @@ function inheritedOriginalImageRef(session, assetId) {
 }
 //#endregion
 //#region src/version.js
-const PACKAGE_VERSION = "2.6.9";
+const PACKAGE_VERSION = "2.7.0";
 const USER_AGENT = `dsh-codex-subscription/${PACKAGE_VERSION}`;
 //#endregion
+//#region src/http-failure.js
+const SIGN_IN_RENEW = "ChatGPT sign-in needs to be renewed";
+const REQUEST_BLOCKED = "ChatGPT blocked this request before it reached your account (HTTP 403); your sign-in is fine, try again later or check your network, proxy or VPN";
+const CHALLENGE_MARKERS = /just a moment|cf-chl|_cf_chl_opt|attention required|enable javascript and cookies|challenge-platform/iu;
+/** Whether error text is a Cloudflare / network-protection page (pi-ai keeps only the body of a failed request, not its status). */
+const isChallengePage = (text) => typeof text === "string" && /^\s*<(?:!doctype|html)/iu.test(text) && CHALLENGE_MARKERS.test(text);
+/** Whether a 403 response is a Cloudflare / network-protection page rather than an answer from the ChatGPT backend. */
+async function isBlockedByNetwork(response) {
+	if (response?.status !== 403) return false;
+	try {
+		const header = (name) => String(response.headers?.get?.(name) ?? "");
+		if (/challenge/iu.test(header("cf-mitigated"))) return true;
+		if (!/html/iu.test(header("content-type"))) return false;
+		if (/cloudflare/iu.test(header("server"))) return true;
+		const text = typeof response.clone === "function" ? (await response.clone().text()).slice(0, 8192) : "";
+		return CHALLENGE_MARKERS.test(text);
+	} catch {
+		return false;
+	}
+}
+/** The error message for a 401 or 403 answer, or undefined for any other status. */
+async function authFailureMessage(response) {
+	if (response?.status === 401) return SIGN_IN_RENEW;
+	if (response?.status !== 403) return void 0;
+	return await isBlockedByNetwork(response) ? REQUEST_BLOCKED : SIGN_IN_RENEW;
+}
+//#endregion
 //#region src/codex-images.js
 const CODEX_IMAGE_TOOL_NAME = "codex_image_generate";
 const CODEX_IMAGE_GENERATION_URL = "https://chatgpt.com/backend-api/codex/images/generations";
@@ -2592,7 +2620,8 @@ function createCodexImageTool(options) {
 				throw new Error(`Codex image ${editing ? "edit" : "generation"} request failed${requestFailureReason(error)}`, { cause: error });
 			}
 			if (!response.ok) {
-				if (response.status === 401 || response.status === 403) throw new Error("ChatGPT sign-in needs to be renewed");
+				const authFailure = await authFailureMessage(response);
+				if (authFailure !== void 0) throw new Error(authFailure);
 				const requestId = supportId(response);
 				if (response.status === 429) throw new Error(`${await limitMessage(response)}${requestId}`);
 				throw new Error(`Codex image ${editing ? "edit" : "generation"} failed (HTTP ${response.status})${requestId}`);
@@ -3000,6 +3029,42 @@ var DshOAuthAccountVault = class {
 			return clone$1(payload?.accounts.find((account) => account.id === payload.activeId)?.credential);
 		});
 	}
+	/** One account's credential, whether or not it is the active one. */
+	readAccount(id) {
+		return this.#enqueue(async () => {
+			const payload = await this.#ensurePayload();
+			return clone$1(payload?.accounts.find((account) => account.id === id)?.credential);
+		});
+	}
+	/** Update one account's credential (a token refresh) without changing which account is active. */
+	modifyAccount(id, update) {
+		return this.#enqueue(async () => {
+			let result;
+			await this.#modifyPayload(async (current) => {
+				const index = current.accounts.findIndex((account) => account.id === id);
+				if (index < 0) throw new Error("Unknown Codex account");
+				const previous = clone$1(current.accounts[index].credential);
+				const next = await update(previous);
+				if (next === void 0) {
+					result = previous;
+					return current;
+				}
+				const credential = sanitizeOAuthCredential(next);
+				if (credential.email === void 0 && previous.email !== void 0) credential.email = previous.email;
+				const accounts = [...current.accounts];
+				accounts[index] = {
+					...accounts[index],
+					credential
+				};
+				result = clone$1(credential);
+				return {
+					...current,
+					accounts
+				};
+			});
+			return result;
+		});
+	}
 	activeId() {
 		return this.#enqueue(async () => (await this.#ensurePayload())?.activeId);
 	}
@@ -3099,11 +3164,11 @@ var DshOAuthAccountVault = class {
 };
 //#endregion
 //#region src/credential-store.js
-const PROVIDER$1 = "openai-codex";
+const PROVIDER$2 = "openai-codex";
 const abortIfNeeded = (options) => options?.signal?.throwIfAborted();
 const clone = (value) => value === void 0 ? void 0 : structuredClone(value);
-function assertProvider(providerId) {
-	if (providerId !== PROVIDER$1) throw new Error(`Codex credential store does not own provider ${JSON.stringify(providerId)}`);
+function assertProvider$1(providerId) {
+	if (providerId !== PROVIDER$2) throw new Error(`Codex credential store does not own provider ${JSON.stringify(providerId)}`);
 }
 function assertOAuthCredential(value) {
 	if (value === void 0) return void 0;
@@ -3136,7 +3201,7 @@ var DshOAuthCredentialStore = class {
 		this.vault = options.vault;
 	}
 	#enqueue(providerId, operation, options) {
-		assertProvider(providerId);
+		assertProvider$1(providerId);
 		const current = (this.#chains.get(providerId) ?? Promise.resolve()).catch(() => void 0).then(async () => {
 			abortIfNeeded(options);
 			return operation();
@@ -3149,7 +3214,7 @@ var DshOAuthCredentialStore = class {
 		return current;
 	}
 	async #read(providerId, options) {
-		assertProvider(providerId);
+		assertProvider$1(providerId);
 		abortIfNeeded(options);
 		if (this.vault !== void 0) {
 			const current = await this.vault.readActive();
@@ -3182,8 +3247,8 @@ var DshOAuthCredentialStore = class {
 	}
 	async list(options) {
 		abortIfNeeded(options);
-		return await this.read(PROVIDER$1, options) === void 0 ? [] : [{
-			providerId: PROVIDER$1,
+		return await this.read(PROVIDER$2, options) === void 0 ? [] : [{
+			providerId: PROVIDER$2,
 			type: "oauth"
 		}];
 	}
@@ -3233,16 +3298,16 @@ function createCodexAuthService(models, store, options = {}) {
 	const createPendingStore = options.createPendingStore ?? (() => new PendingOAuthCredentialStore());
 	return Object.freeze({
 		async status(options) {
-			const current = await store.read(PROVIDER$1, options);
+			const current = await store.read(PROVIDER$2, options);
 			const accounts = await accountVault?.list();
 			if (current === void 0) return {
 				authenticated: false,
-				provider: PROVIDER$1,
+				provider: PROVIDER$2,
 				...accounts === void 0 ? {} : { accounts }
 			};
 			return {
 				authenticated: true,
-				provider: PROVIDER$1,
+				provider: PROVIDER$2,
 				type: "oauth",
 				expiresAt: current.expires,
 				...accounts === void 0 ? {} : { accounts }
@@ -3253,13 +3318,13 @@ function createCodexAuthService(models, store, options = {}) {
 				if (accountVault === void 0 || createLoginModels === void 0) throw new Error("Codex multi-account is unavailable");
 				return runLogin(async () => {
 					const pending = createPendingStore();
-					await createLoginModels(pending).login(PROVIDER$1, "oauth", interaction);
+					await createLoginModels(pending).login(PROVIDER$2, "oauth", interaction);
 					const credential = pending.credential();
 					if (credential === void 0) throw new Error("Codex login did not return credentials");
 					await accountVault.add(input.label, credential);
 				});
 			}
-			return runLogin(() => models.login(PROVIDER$1, "oauth", interaction));
+			return runLogin(() => models.login(PROVIDER$2, "oauth", interaction));
 		},
 		async select(id) {
 			if (accountVault === void 0) throw new Error("Codex multi-account is unavailable");
@@ -3272,7 +3337,7 @@ function createCodexAuthService(models, store, options = {}) {
 			return this.status();
 		},
 		logout(options) {
-			return models.logout(PROVIDER$1, options);
+			return models.logout(PROVIDER$2, options);
 		}
 	});
 }
@@ -3808,6 +3873,13 @@ function normalizeTransportEvent(event, signal) {
 	if (signal?.aborted || event?.type !== "error" || event.reason !== "error") return event;
 	const message = event.error?.errorMessage;
 	if (typeof message !== "string") return event;
+	if (isChallengePage(message)) return {
+		...event,
+		error: {
+			...event.error,
+			errorMessage: REQUEST_BLOCKED
+		}
+	};
 	if (!TRANSIENT_WEBSOCKET_CLOSE.test(message) && !GATEWAY_REPLAY_BUFFER_EXCEEDED.test(message)) return event;
 	return {
 		...event,
@@ -4532,7 +4604,10 @@ function createCodexSearchProvider(options) {
 				if (signal?.aborted || error?.name === "AbortError") throw new WebError("Codex search aborted", "WEB_ABORTED", { cause: error });
 				throw new WebError("Codex search request failed", "WEB_PROVIDER_ERROR", { cause: error });
 			}
-			if (!response.ok) throw response.status === 401 || response.status === 403 ? new WebError("ChatGPT sign-in needs to be renewed", "WEB_PROVIDER_CREDENTIAL_MISSING") : new WebError(`Codex search request failed (HTTP ${response.status})`, "WEB_PROVIDER_ERROR");
+			if (!response.ok) {
+				const authFailure = await authFailureMessage(response);
+				throw authFailure === "ChatGPT sign-in needs to be renewed" ? new WebError(authFailure, "WEB_PROVIDER_CREDENTIAL_MISSING") : authFailure !== void 0 ? new WebError(authFailure, "WEB_PROVIDER_ERROR") : new WebError(`Codex search request failed (HTTP ${response.status})`, "WEB_PROVIDER_ERROR");
+			}
 			let value;
 			try {
 				value = await response.json();
@@ -5531,7 +5606,7 @@ function createCodexUsageReader(options) {
 			signal: requestSignal$1(signal, timeoutMs)
 		});
 		if (!response.ok) {
-			const error = /* @__PURE__ */ new Error(response.status === 401 || response.status === 403 ? "ChatGPT sign-in needs to be renewed" : `ChatGPT usage request failed (HTTP ${response.status})`);
+			const error = new Error(await authFailureMessage(response) ?? `ChatGPT usage request failed (HTTP ${response.status})`);
 			Object.defineProperty(error, "retryAfterMs", { value: retryAfterMs(response, now, maxRetryAfterMs) });
 			throw error;
 		}
@@ -5582,6 +5657,102 @@ function createCodexUsageReader(options) {
 	});
 }
 //#endregion
+//#region src/account-usage.js
+const PROVIDER$1 = "openai-codex";
+const MAX_PARALLEL = 4;
+const assertProvider = (providerId) => {
+	if (providerId !== PROVIDER$1) throw new Error("Codex account usage received an unknown provider");
+};
+/** pi-ai's OAuth credential store, bound to one account of the vault. */
+function accountCredentialStore(vault, id, expirySkewMs = 0) {
+	const shift = (credential) => credential === void 0 || expirySkewMs === 0 ? credential : {
+		...credential,
+		expires: credential.expires - expirySkewMs
+	};
+	return {
+		async read(providerId) {
+			assertProvider(providerId);
+			return shift(await vault.readAccount(id));
+		},
+		async list() {
+			return await vault.readAccount(id) === void 0 ? [] : [{
+				providerId: PROVIDER$1,
+				type: "oauth"
+			}];
+		},
+		async modify(providerId, update) {
+			assertProvider(providerId);
+			return vault.modifyAccount(id, async (current) => update(shift(current)));
+		},
+		async delete() {
+			throw new Error("An account usage read cannot remove a sign-in");
+		}
+	};
+}
+/**
+* @param {object} options
+* @param {{ list(): Promise<object[]>, readAccount(id: string): Promise<object|undefined>, modifyAccount: Function }} options.vault
+* @param {(credentials: object) => object} options.createModels builds a pi-ai Models over a credential store, with the Codex provider set
+* @param {typeof fetch} options.fetch
+*/
+function createAccountUsageReader({ vault, createModels, fetch, expirySkewMs = 0, now = Date.now, activeReader }) {
+	const readers = /* @__PURE__ */ new Map();
+	const readerFor = (id) => {
+		let reader = readers.get(id);
+		if (reader === void 0) {
+			const models = createModels(accountCredentialStore(vault, id, expirySkewMs));
+			reader = createCodexUsageReader({
+				getAuth: () => models.getAuth(PROVIDER$1),
+				readCredential: () => vault.readAccount(id).then((credential) => credential),
+				fetch,
+				now
+			});
+			readers.set(id, reader);
+		}
+		return reader;
+	};
+	const summarize = (error, signal) => {
+		if (signal?.aborted) throw error;
+		const message = error instanceof Error ? error.message : "";
+		return ["ChatGPT subscription is not signed in", "ChatGPT sign-in needs to be renewed"].includes(message) || message.includes("blocked this request") ? message : "Could not read ChatGPT usage";
+	};
+	return Object.freeze({
+		/** One entry per account: its usage reading, or the reason it could not be read. */
+		async readAll({ force = false, signal } = {}) {
+			const accounts = await vault.list();
+			for (const id of [...readers.keys()]) if (!accounts.some((account) => account.id === id)) readers.delete(id);
+			const entries = new Array(accounts.length);
+			let next = 0;
+			const worker = async () => {
+				while (next < accounts.length) {
+					const index = next++;
+					const account = accounts[index];
+					try {
+						const reader = account.active && activeReader !== void 0 ? activeReader : readerFor(account.id);
+						entries[index] = {
+							id: account.id,
+							usage: await reader.read({
+								force,
+								signal
+							})
+						};
+					} catch (error) {
+						entries[index] = {
+							id: account.id,
+							error: summarize(error, signal)
+						};
+					}
+				}
+			};
+			await Promise.all(Array.from({ length: Math.min(MAX_PARALLEL, accounts.length) }, worker));
+			return entries;
+		},
+		clear() {
+			readers.clear();
+		}
+	});
+}
+//#endregion
 //#region src/quota-retry.js
 const DEFAULT_MAX_WAIT_MS = 360 * 60 * 1e3;
 const DEFAULT_RESET_MARGIN_MS = 1e4;
@@ -6302,7 +6473,7 @@ function createCodexResetCreditService(options) {
 			},
 			signal: requestSignal(signal, timeoutMs)
 		});
-		if (!response.ok) throw new Error(response.status === 401 || response.status === 403 ? "ChatGPT sign-in needs to be renewed" : `ChatGPT quota reset request failed (HTTP ${response.status})`);
+		if (!response.ok) throw new Error(await authFailureMessage(response) ?? `ChatGPT quota reset request failed (HTTP ${response.status})`);
 		let raw;
 		try {
 			raw = await response.json();
@@ -6436,7 +6607,7 @@ function createCodexResetCreditService(options) {
 						throw new Error(UNCERTAIN_RESET_RESULT);
 					}
 					if (response.status !== 401 && response.status !== 403) retryable = false;
-					throw new Error(response.status === 401 || response.status === 403 ? "ChatGPT sign-in needs to be renewed" : `ChatGPT quota reset request failed (HTTP ${response.status})`);
+					throw new Error(await authFailureMessage(response) ?? `ChatGPT quota reset request failed (HTTP ${response.status})`);
 				}
 				let raw;
 				try {
@@ -6478,7 +6649,7 @@ const publicError = (code, message) => ({
 		details: { issues: [] }
 	}
 });
-function createSubscriptionRpcHandler({ authHandler, usageReader, resetCreditService, preferences, defaultModel, runtimeManagement, diagnosticsReader, modelCatalog, originalImages, resolveInheritedOriginal, closeConnections, onAccountChanged, onCleanupFailure }) {
+function createSubscriptionRpcHandler({ authHandler, usageReader, accountUsageReader, resetCreditService, preferences, defaultModel, runtimeManagement, diagnosticsReader, modelCatalog, originalImages, resolveInheritedOriginal, closeConnections, onAccountChanged, onCleanupFailure }) {
 	return async (endpoint, payload, signal) => {
 		if (endpoint === "default-model/status" || endpoint === "default-model/select") try {
 			signal.throwIfAborted();
@@ -6625,10 +6796,27 @@ function createSubscriptionRpcHandler({ authHandler, usageReader, resetCreditSer
 			};
 		} catch (error) {
 			if (signal.aborted) throw error;
-			const known = /* @__PURE__ */ new Set(["ChatGPT subscription is not signed in", "ChatGPT sign-in needs to be renewed"]);
+			const known = /* @__PURE__ */ new Set([
+				"ChatGPT subscription is not signed in",
+				"ChatGPT sign-in needs to be renewed",
+				REQUEST_BLOCKED
+			]);
 			const message = error instanceof Error && known.has(error.message) ? error.message : "Could not read ChatGPT usage";
 			return publicError("internal", message);
 		}
+		if (endpoint === "usage/accounts") try {
+			signal.throwIfAborted();
+			return {
+				ok: true,
+				value: { accounts: await accountUsageReader.readAll({
+					force: payload?.force === true,
+					signal
+				}) }
+			};
+		} catch (error) {
+			if (signal.aborted) throw error;
+			return publicError("internal", "Could not read the usage of the signed-in accounts");
+		}
 		if (endpoint === "reset-credit/inspect" || endpoint === "reset-credit/prepare" || endpoint === "reset-credit/consume") try {
 			signal.throwIfAborted();
 			return {
@@ -6647,6 +6835,7 @@ function createSubscriptionRpcHandler({ authHandler, usageReader, resetCreditSer
 			const known = /* @__PURE__ */ new Set([
 				"ChatGPT subscription is not signed in",
 				"ChatGPT sign-in needs to be renewed",
+				REQUEST_BLOCKED,
 				"No quota reset is available",
 				"No usable quota reset is available",
 				"The available quota reset expires too soon",
@@ -6669,7 +6858,7 @@ function createSubscriptionRpcHandler({ authHandler, usageReader, resetCreditSer
 				() => modelCatalog?.clear(),
 				() => onAccountChanged?.()
 			];
-			if (endpoint === "logout") tasks.push(() => usageReader.clear());
+			if (endpoint === "logout") tasks.push(() => usageReader.clear(), () => accountUsageReader?.clear());
 			if (endpoint === "account/remove" && typeof payload?.id === "string") tasks.push(() => usageReader.clearScope(payload.id));
 			if ((await Promise.allSettled(tasks.map((task) => Promise.resolve().then(task)))).some((value) => value.status === "rejected")) try {
 				onCleanupFailure?.();
@@ -7030,12 +7219,13 @@ function apply(ctx, config = {}) {
 		}
 	});
 	const coordinator = new CodexLoginCoordinator(auth);
+	const baseUsageReader = createCodexUsageReader({
+		getAuth: resolveAuth,
+		readCredential: (options) => store.read(PROVIDER, options),
+		fetch: (input, init) => network.fetch("quota", input, init)
+	});
 	const usageReader = createQuotaForecastReader({
-		reader: createCodexUsageReader({
-			getAuth: resolveAuth,
-			readCredential: (options) => store.read(PROVIDER, options),
-			fetch: (input, init) => network.fetch("quota", input, init)
-		}),
+		reader: baseUsageReader,
 		enabled: () => normalizeQuickQuotaMode(settings.get()[QUICK_QUOTA_MODE_FIELD], settings.get()[LEGACY_QUICK_QUOTA_FIELD]) === QUICK_QUOTA_MODE_FORECAST,
 		scope: async () => await accountVault?.activeId() ?? "legacy",
 		stateStore: new QuotaForecastStateStore({ filename: dshHomePath("state", "codex-subscription", "quota-forecast.json") })
@@ -7109,9 +7299,21 @@ function apply(ctx, config = {}) {
 			sketchBridge.dispose();
 		};
 	}, "codex-subscription: native sketch tool");
+	const accountUsageReader = createAccountUsageReader({
+		vault: accountVault,
+		createModels: (credentials) => {
+			const accountModels = createModels({ credentials });
+			accountModels.setProvider(provider);
+			return accountModels;
+		},
+		fetch: (input, init) => network.fetch("quota", input, init),
+		expirySkewMs: OAUTH_EXPIRY_SKEW_MS,
+		activeReader: baseUsageReader
+	});
 	const subscriptionHandler = createSubscriptionRpcHandler({
 		authHandler: createCodexRpcHandler(coordinator, { openExternal: openCodexAuthUrl }),
 		usageReader,
+		accountUsageReader,
 		resetCreditService,
 		preferences,
 		defaultModel,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-codex-subscription",
-  "version": "2.6.9",
+  "version": "2.7.0",
   "description": "Use ChatGPT and Codex subscriptions in DeepSeek Harness with OAuth, quota, safe resets, web search, images, and Fast mode",
   "type": "module",
   "main": "./lib/index.js",