ima2-gen 3.21.0 → 3.22.0

package/lib/mcp/connectionManager.js

@@ -68,12 +68,43 @@ export class McpConnectionManager {
         return session;
     }
     status(provider) {
+        this.sweepExpiredPendingAuth();
         const descriptor = this.knownProvider(provider);
         if (!descriptor.enabled)
             return publicStatus(provider);
         const session = this.sessions.get(provider);
         return publicStatus(provider, session);
     }
+    /** Reap abandoned OAuth attempts: without a callback the pending entry, its
+     *  candidate transport, and a stale auth_required session would otherwise
+     *  linger for the process lifetime. Same teardown as rejectInvalidCallback. */
+    sweepExpiredPendingAuth() {
+        const now = this.now();
+        for (const [state, pending] of this.pendingAuth) {
+            if (pending.expiresAt >= now)
+                continue;
+            this.pendingAuth.delete(state);
+            removeCandidate(this.candidates, pending.provider, pending.transport);
+            void pending.transport.close().catch(() => undefined);
+            // Only a still-auth_required session belongs to the expired attempt — a
+            // successful reconnect may already have attached a connected session.
+            const session = this.sessions.get(pending.provider);
+            if (session?.state === "auth_required" && this.isCurrent(pending.provider, pending.generation)) {
+                this.markDisconnected(pending.provider);
+            }
+        }
+    }
+    /** A successful connect supersedes the provider's pending OAuth attempts;
+     *  dropping them keeps their expiry from touching the attached session. */
+    dropProviderPendings(provider) {
+        for (const [state, pending] of this.pendingAuth) {
+            if (pending.provider !== provider)
+                continue;
+            this.pendingAuth.delete(state);
+            removeCandidate(this.candidates, provider, pending.transport);
+            void pending.transport.close().catch(() => undefined);
+        }
+    }
     isCurrent(provider, generation) {
         return this.generation(provider) === generation && !this.disconnectIntents.has(provider);
     }
@@ -150,6 +181,7 @@ export class McpConnectionManager {
             if (!this.isCurrent(provider, generation))
                 return this.closeStale(provider, transport);
             removeCandidate(this.candidates, provider, transport);
+            this.dropProviderPendings(provider);
             Object.assign(session, {
                 state: "connected",
                 client,

package/lib/mcp/modelsCatalog.js

@@ -74,6 +74,16 @@ function syntheticDuration(record) {
         return null;
     return { name: "duration", type: "number", min, max };
 }
+// Provider media-role names project to ima2's canonical input-role vocabulary —
+// the same shape the runway static catalog emits. Higgsfield's generic media
+// roles are *_references; `text` is implied for every model since medias are
+// optional inputs and a prompt always applies (optional only for
+// marketing_studio_*), never a declared requirement.
+const INPUT_ROLE_CANONICAL = {
+    image: "image_references",
+    video: "video_references",
+    audio: "audio_references",
+};
 function parseCapabilities(record) {
     const parameters = Array.isArray(record.parameters)
         ? record.parameters.slice(0, 100).map(parseParameter).filter((item) => Boolean(item))
@@ -82,7 +92,8 @@ function parseCapabilities(record) {
     if (duration && !parameters.some((parameter) => parameter.name === "duration"))
         parameters.push(duration);
     const mediaItems = Array.isArray(record.medias) ? record.medias.slice(0, 50) : [];
-    const inputRoles = boundedStrings(mediaItems.flatMap((item) => (item && typeof item === "object" ? item.roles ?? [] : [])), 100, 64);
+    const declared = boundedStrings(mediaItems.flatMap((item) => (item && typeof item === "object" ? item.roles ?? [] : [])), 100, 64);
+    const inputRoles = [...new Set(["text", ...declared.map((role) => INPUT_ROLE_CANONICAL[role] ?? role)])];
     return {
         source: "provider-declared",
         aspectRatios: boundedStrings(record.aspect_ratios, 50, 24),

package/lib/xaiAuth.js

@@ -316,7 +316,14 @@ async function performRefresh(stored, opts) {
             ...(opts.signal !== undefined ? { signal: opts.signal } : {}),
             ...(opts.deps !== undefined ? { deps: opts.deps } : {}),
         });
-        const merged = { ...stored, ...fresh };
+        // The file is the single source of truth and other writers (progrok, a device login,
+        // a logout) can move it while a refresh is in flight — never clobber or resurrect it.
+        const current = loadGrokCredentials(opts.homeDir);
+        if (!current)
+            throw new GrokAuthError("GROK_AUTH_REQUIRED", LOGIN_REQUIRED_MESSAGE);
+        if (current.refreshToken !== stored.refreshToken)
+            return current;
+        const merged = { ...current, ...fresh };
         // An unknown new expiry must erase the old one rather than inherit a stale deadline.
         if (fresh.expiresAt === undefined)
             delete merged.expiresAt;
@@ -332,7 +339,16 @@ function runRefreshFlight(stored, opts) {
     const existing = refreshFlight;
     if (existing && now() - existing.startedAt <= FLIGHT_STALE_MS)
         return existing.promise;
-    const flight = { startedAt: now(), promise: performRefresh(stored, opts) };
+    // The flight is shared, so no caller's signal may reach it: one aborted request must
+    // not fail every other caller joined to the same refresh (callers abort via their
+    // own await in getGrokAccessToken instead).
+    const shared = {
+        ...(opts.forceRefresh !== undefined ? { forceRefresh: opts.forceRefresh } : {}),
+        ...(opts.rejectedAccessToken !== undefined ? { rejectedAccessToken: opts.rejectedAccessToken } : {}),
+        ...(opts.homeDir !== undefined ? { homeDir: opts.homeDir } : {}),
+        ...(opts.deps !== undefined ? { deps: opts.deps } : {}),
+    };
+    const flight = { startedAt: now(), promise: performRefresh(stored, shared) };
     // Release only when we are still the current flight, so a slow earlier refresh cannot
     // clear a newer one (OpenCodex index.ts:537 pattern).
     flight.promise = flight.promise.finally(() => {
@@ -359,9 +375,25 @@ export async function getGrokAccessToken(opts = {}) {
     if (!stored.refreshToken) {
         throw new GrokAuthError("GROK_AUTH_REQUIRED", `Grok session expired and cannot be refreshed. ${LOGIN_REQUIRED_MESSAGE}`);
     }
-    const fresh = await runRefreshFlight(stored, opts);
+    // A caller that is already dead must not start a shared refresh: its fetch would
+    // still hit the server and still write the file.
+    if (opts.signal?.aborted)
+        throw opts.signal.reason;
+    const fresh = await raceWithAbort(runRefreshFlight(stored, opts), opts.signal);
     return fresh.accessToken;
 }
+/** A caller bails on its own signal without cancelling the shared flight. */
+function raceWithAbort(promise, signal) {
+    if (!signal)
+        return promise;
+    if (signal.aborted)
+        return Promise.reject(signal.reason);
+    return new Promise((resolve, reject) => {
+        const onAbort = () => reject(signal.reason);
+        signal.addEventListener("abort", onAbort, { once: true });
+        promise.then((value) => { signal.removeEventListener("abort", onAbort); resolve(value); }, (error) => { signal.removeEventListener("abort", onAbort); reject(error); });
+    });
+}
 /** Test-only: clears the single-flight slot and the terminal-failure negative cache. */
 export function __resetGrokAuthStateForTest() {
     refreshFlight = undefined;

package/lib/xaiDeviceLogin.js

@@ -14,6 +14,8 @@ const MIN_POLL_INTERVAL_SECONDS = 5;
 const SLOW_DOWN_STEP_MS = 5_000;
 const DEVICE_REQUEST_TIMEOUT_MS = 15_000;
 const TOKEN_REQUEST_TIMEOUT_MS = 10_000;
+/** Consecutive transport/5xx poll failures tolerated before the login gives up. */
+const MAX_CONSECUTIVE_POLL_FAILURES = 3;
 function defaultSleep(ms) {
     return new Promise((resolve) => {
         setTimeout(resolve, ms);
@@ -54,10 +56,20 @@ async function requestDeviceCode(endpoint, deps) {
     };
 }
 async function pollTokenOnce(tokenEndpoint, deviceCode, deps) {
-    const response = await deps.doFetch(tokenEndpoint, {
-        ...formEncoded({ grant_type: DEVICE_CODE_GRANT, client_id: XAI_OAUTH_CLIENT_ID, device_code: deviceCode }),
-        signal: requestSignal(deps.signal, TOKEN_REQUEST_TIMEOUT_MS),
-    });
+    let response;
+    try {
+        response = await deps.doFetch(tokenEndpoint, {
+            ...formEncoded({ grant_type: DEVICE_CODE_GRANT, client_id: XAI_OAUTH_CLIENT_ID, device_code: deviceCode }),
+            signal: requestSignal(deps.signal, TOKEN_REQUEST_TIMEOUT_MS),
+        });
+    }
+    catch (error) {
+        if (deps.signal?.aborted)
+            throw error;
+        // A reset or one timed-out poll must not kill an interactive login the user is
+        // still completing; the caller tolerates a few consecutive failures.
+        return { kind: "retryable" };
+    }
     if (response.ok)
         return { kind: "token", payload: (await response.json()) };
     const raw = await response.text();
@@ -74,6 +86,8 @@ async function pollTokenOnce(tokenEndpoint, deviceCode, deps) {
         return { kind: "pending" };
     if (oauthError === "slow_down")
         return { kind: "slow_down" };
+    if (response.status === 429 || response.status >= 500)
+        return { kind: "retryable", status: response.status };
     throw new Error(`xAI device login failed: ${oauthError ?? `HTTP ${response.status}`}`);
 }
 /**
@@ -85,6 +99,8 @@ async function pollUntilAuthorized(tokenEndpoint, grant, deps) {
     const deadlineMs = grant.expiresIn * 1000;
     let intervalMs = Math.max(grant.intervalSeconds, MIN_POLL_INTERVAL_SECONDS) * 1000;
     let sleptMs = 0;
+    let consecutiveFailures = 0;
+    let lastFailureStatus;
     while (Math.max(Date.now() - startedAt, sleptMs) < deadlineMs) {
         await deps.sleep(intervalMs);
         sleptMs += intervalMs;
@@ -93,6 +109,16 @@ async function pollUntilAuthorized(tokenEndpoint, grant, deps) {
         const outcome = await pollTokenOnce(tokenEndpoint, grant.deviceCode, deps);
         if (outcome.kind === "token")
             return outcome.payload;
+        if (outcome.kind === "retryable") {
+            consecutiveFailures += 1;
+            if (outcome.status !== undefined)
+                lastFailureStatus = outcome.status;
+            if (consecutiveFailures >= MAX_CONSECUTIVE_POLL_FAILURES) {
+                throw new Error(`xAI device login failed: the token endpoint kept failing (last: HTTP ${lastFailureStatus ?? "network"})`);
+            }
+            continue;
+        }
+        consecutiveFailures = 0;
         if (outcome.kind === "slow_down")
             intervalMs += SLOW_DOWN_STEP_MS;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ima2-gen",
-  "version": "3.21.0",
+  "version": "3.22.0",
   "packageManager": "npm@11.18.0",
   "description": "Local-first visual generation runtime and studio for people and coding agents, with reproducible image and video workflows across multiple providers.",
   "type": "module",
@@ -129,5 +129,5 @@
     "typescript-eslint": "8.70.0",
     "yaml": "2.9.1"
   },
-  "gitHead": "b502a70fb703fd700ae1788c232cb6411db0c323"
+  "gitHead": "6cf759090e426f0f3d2395de187531b293bc25ea"
 }

package/routes/auth.js

@@ -2,7 +2,8 @@ import { randomBytes } from "node:crypto";
 import { runChatgptLogin } from "../lib/chatgptLogin.js";
 import { runXaiDeviceLogin } from "../lib/xaiDeviceLogin.js";
 const MAX_CONCURRENT_SESSIONS = 20;
-const PROMPT_TIMEOUT_MS = 30_000;
+// Must outlast the slowest healthy prompt path: discovery (30s) + device code (15s).
+const PROMPT_TIMEOUT_MS = 60_000;
 const sessions = new Map();
 function sid() {
     return randomBytes(16).toString("hex");
@@ -98,7 +99,17 @@ function startCodexLogin(flow, ctx) {
         return session.email ? { email: session.email } : {};
     }, () => { ctx?.restartOAuthProxy?.(); }, liveCodexLogins);
 }
+/**
+ * Every grok login that has started but not settled. The ~/.progrok/auth.json file is a
+ * singleton like codex's localhost port: two overlapping device logins would race on the
+ * same file, so a new start aborts all pending ones before its own first await.
+ */
+const liveGrokLogins = new Set();
 function startGrokLogin(ctx) {
+    cancelPending("grok");
+    for (const controller of liveGrokLogins)
+        controller.abort();
+    liveGrokLogins.clear();
     return startSession("grok", async (signal, onPrompt) => {
         const creds = await runXaiDeviceLogin({
             signal,
@@ -106,7 +117,7 @@ function startGrokLogin(ctx) {
             onUserCode: (info) => onPrompt({ flow: "device", url: info.verificationUrl, userCode: info.userCode, expiresIn: info.expiresIn }),
         });
         return creds.email ? { email: creds.email } : {};
-    });
+    }, undefined, liveGrokLogins);
 }
 export function registerAuthRoutes(app, ctx) {
     app.post("/api/auth/switch", async (req, res) => {

package/routes/mcpMedia.js

@@ -16,6 +16,7 @@ import { commitMediaResult } from "../lib/mcp/commitMediaResult.js";
 import { appendMcpJobLog, logMcpJobError } from "../lib/mcp/jobLog.js";
 import { buildRunwayActionCall, REFERENCE_TAG_PATTERN, runwayAdapter } from "../lib/mcp/adapters/runway.js";
 import { uploadLocalMediaToRunway } from "../lib/mcp/adapters/runwayUpload.js";
+import { importUrlToHiggsfield, uploadLocalMediaToHiggsfield } from "../lib/mcp/adapters/higgsfieldUpload.js";
 import { resolveMediaAction } from "../lib/mcp/mediaWorkflowRouter.js";
 import { loadEffectiveSnapshot } from "../lib/mcp/snapshotStore.js";
 import { scrubValue } from "../lib/mcp/sanitizer.js";
@@ -57,7 +58,7 @@ export async function localMediaPath(generatedDir, filename, options) {
         throw new Error(`${options.label} has an unsupported extension`);
     return resolved;
 }
-function imageMime(filePath) {
+export function imageMime(filePath) {
     const ext = extname(filePath).toLowerCase();
     return ext === ".png" ? "image/png" : ext === ".webp" ? "image/webp" : "image/jpeg";
 }
@@ -260,7 +261,7 @@ async function runMediaAction(input) {
         const code = errorCode(error);
         // Secret-scrub (030): tool-error text can embed signed URLs/emails from the provider.
         console.error(`[mcp-action ERROR] requestId=${requestId} operation=${input.operation} code=${code} message=${scrubValue(String(error?.message ?? "").slice(0, 500))} stack=${scrubValue(String(error?.stack ?? "").slice(0, 300))}`);
-        void logMcpJobError(ctx.config.storage.generatedDir, { requestId, provider: "runway" }, error);
+        void logMcpJobError(ctx.config.storage.generatedDir, { requestId, provider: input.provider }, error);
         finishJob(requestId, { status: "error", errorCode: code });
         publishJobEvent(requestId, "error", { code, message: "media action failed", ...errorEnvelopeFields(error) });
     }
@@ -276,7 +277,7 @@ function actionForOperation(operation) {
         return "edit-video-submit";
     return "edit-video";
 }
-function extensionFor(kind, contentType, url) {
+export function extensionFor(kind, contentType, url) {
     const fromUrl = url.match(/\.(png|jpe?g|webp|mp4|mov|webm)(?:\?|$)/i)?.[1]?.toLowerCase();
     if (fromUrl)
         return fromUrl === "jpeg" ? "jpg" : fromUrl;
@@ -298,6 +299,7 @@ export function registerMcpMediaRoutes(app, ctxRaw, depsPartial = {}) {
         download: depsPartial.download ?? downloadMediaResult,
         writeSidecar: depsPartial.writeSidecar ?? atomicWriteJson,
         upload: depsPartial.upload ?? uploadLocalMediaToRunway,
+        uploadHiggsfield: depsPartial.uploadHiggsfield ?? uploadLocalMediaToHiggsfield,
         concat: depsPartial.concat ?? concatVideos,
         ...(depsPartial.adapters ? { adapters: depsPartial.adapters } : {}),
     };
@@ -488,31 +490,43 @@ async function runMcpMediaJob(input) {
             setJobPhase(requestId, "uploading");
             publishJobEvent(requestId, "progress", { phase: "uploading", current: uploadCurrent, total: uploadTotal });
         };
+        // Media input upload is provider-specific: runway hosts assets via
+        // init_upload, higgsfield requires media_upload + media_confirm media_ids
+        // (higgsfield cannot consume runway-hosted URLs or other https values).
+        const upload = adapter.provider === "higgsfield" ? deps.uploadHiggsfield : deps.upload;
         let startFrameUrl = input.startFrameUrl;
         if (input.localStartFramePath) {
             publishUploading();
-            startFrameUrl = await deps.upload(manager, input.localStartFramePath, {
+            startFrameUrl = await upload(manager, input.localStartFramePath, {
                 fileName: basename(input.localStartFramePath), mimeType: imageMime(input.localStartFramePath),
             });
         }
+        else if (adapter.provider === "higgsfield" && startFrameUrl && /^https:/i.test(startFrameUrl)) {
+            startFrameUrl = await importUrlToHiggsfield(manager, startFrameUrl, "image");
+        }
         let endFrameUrl;
         if (input.localEndFramePath) {
             publishUploading();
-            endFrameUrl = await deps.upload(manager, input.localEndFramePath, {
+            endFrameUrl = await upload(manager, input.localEndFramePath, {
                 fileName: basename(input.localEndFramePath), mimeType: imageMime(input.localEndFramePath),
             });
         }
         const referenceImages = [];
         for (const entry of input.localReferences ?? []) {
             publishUploading();
-            const url = await deps.upload(manager, entry.path, { fileName: basename(entry.path), mimeType: imageMime(entry.path) });
+            const url = await upload(manager, entry.path, { fileName: basename(entry.path), mimeType: imageMime(entry.path) });
             referenceImages.push({ url, ...(entry.tag ? { tag: entry.tag } : {}) });
         }
         let referenceVideoUrl;
         if (input.localReferenceVideoPath) {
+            // higgsfield declares no video-input role — surface the contract error
+            // before a media_upload the adapter will reject anyway.
+            if (adapter.provider === "higgsfield") {
+                throw new Error("MCP_INPUT_ROLE_UNSUPPORTED:higgsfield:video_references");
+            }
             publishUploading();
             const mimeType = extname(input.localReferenceVideoPath).toLowerCase() === ".mov" ? "video/quicktime" : "video/mp4";
-            referenceVideoUrl = await deps.upload(manager, input.localReferenceVideoPath, {
+            referenceVideoUrl = await upload(manager, input.localReferenceVideoPath, {
                 fileName: basename(input.localReferenceVideoPath), mimeType, maxBytes: VIDEO_INPUT_MAX_BYTES,
             });
         }

package/routes/mcpMultishot.js

@@ -13,7 +13,7 @@ import { buildMultishotCall, runwayAdapter } from "../lib/mcp/adapters/runway.js
 import { uploadLocalMediaToRunway } from "../lib/mcp/adapters/runwayUpload.js";
 import { atomicWriteJson } from "../lib/atomicWrite.js";
 import { requireRuntimeContext } from "../lib/runtimeContext.js";
-import { localMediaPath, IMAGE_INPUT_MAX_BYTES } from "./mcpMedia.js";
+import { localMediaPath, imageMime, IMAGE_INPUT_MAX_BYTES } from "./mcpMedia.js";
 import { errorEnvelopeFields } from "../lib/errors/envelope.js";
 export function registerMcpMultishotRoutes(app, ctxRaw) {
     const ctx = requireRuntimeContext(ctxRaw);
@@ -42,16 +42,12 @@ export function registerMcpMultishotRoutes(app, ctxRaw) {
         const sound = typeof req.body?.sound === "boolean" ? req.body.sound : undefined;
         const firstSceneFilename = typeof req.body?.firstSceneFilename === "string" && req.body.firstSceneFilename
             ? req.body.firstSceneFilename : null;
-        let firstSceneImageUrl;
+        let firstScenePath = null;
         if (firstSceneFilename) {
             try {
-                const resolved = await localMediaPath(ctx.config.storage.generatedDir, firstSceneFilename, {
+                firstScenePath = await localMediaPath(ctx.config.storage.generatedDir, firstSceneFilename, {
                     label: "first scene image", maxBytes: IMAGE_INPUT_MAX_BYTES, extensions: /\.(png|jpe?g|webp)$/i,
                 });
-                setJobPhase("multishot-upload", "uploading");
-                firstSceneImageUrl = await uploadLocalMediaToRunway(manager, resolved, {
-                    fileName: basename(resolved), mimeType: "image/png",
-                });
             }
             catch (error) {
                 return res.status(400).json({ error: { code: "INVALID_FIRST_SCENE", message: String(error?.message ?? error).slice(0, 120) } });
@@ -67,6 +63,14 @@ export function registerMcpMultishotRoutes(app, ctxRaw) {
         const abort = new AbortController();
         registerJobAbortController(requestId, abort);
         try {
+            let firstSceneImageUrl;
+            if (firstScenePath) {
+                setJobPhase(requestId, "uploading");
+                publishJobEvent(requestId, "progress", { phase: "uploading" });
+                firstSceneImageUrl = await uploadLocalMediaToRunway(manager, firstScenePath, {
+                    fileName: basename(firstScenePath), mimeType: imageMime(firstScenePath),
+                });
+            }
             const plan = buildMultishotCall({
                 storyPrompt: prompt ?? undefined, shots: shots ?? undefined,
                 duration, resolution, aspectRatio, sound, firstSceneImageUrl,

package/routes/mcpRecover.js

@@ -13,6 +13,7 @@ import { runwayAdapter } from "../lib/mcp/adapters/runway.js";
 import { higgsfieldAdapter } from "../lib/mcp/adapters/higgsfield.js";
 import { requireRuntimeContext } from "../lib/runtimeContext.js";
 import { errorEnvelopeFields } from "../lib/errors/envelope.js";
+import { extensionFor } from "./mcpMedia.js";
 const ADAPTERS = {
     runway: runwayAdapter,
     higgsfield: higgsfieldAdapter,
@@ -42,7 +43,7 @@ async function runRecoverJob(input) {
         await commitMediaResult({
             ctx, deps, requestId, kind,
             tempPath: download.tempPath, cleanup: download.cleanup,
-            ext: download.contentType.includes("png") ? "png" : kind === "video" ? "mp4" : "jpg",
+            ext: extensionFor(kind, download.contentType, outputUrl),
             meta: {
                 requestId, mediaType: kind, provider: adapter.provider,
                 providerTransport: "mcp-streamable-http",
@@ -87,7 +88,10 @@ export function registerMcpRecoverRoutes(app, ctxRaw, depsPartial = {}) {
         if (!manager || manager.status(adapter.provider).state !== "connected") {
             return res.status(409).json({ error: { code: "MCP_NOT_CONNECTED", message: `connect ${adapter.provider} first` } });
         }
-        const requestId = `mcpr_${Date.now()}_${randomBytes(4).toString("hex")}`;
+        // Same caller-requestId contract as /api/mcp/generate: a retried recover with
+        // the same requestId dedupes via startJob instead of committing the asset twice.
+        const requestId = typeof req.body?.requestId === "string" && req.body.requestId
+            ? req.body.requestId : `mcpr_${Date.now()}_${randomBytes(4).toString("hex")}`;
         const started = startJob({ requestId, kind: "mcp-recover", prompt: `recover ${provider} task ${taskId}`, meta: { provider, taskId } });
         if (started && isStartJobFailure(started)) {
             return res.status(started.code === "TOO_MANY_JOBS" ? 429 : 409).json({ error: { code: started.code, message: "cannot start job" } });

package/routes/quota.js

@@ -4,21 +4,50 @@ import { homedir } from "node:os";
 import { join } from "node:path";
 import { fetchNaiSubscription } from "../lib/naiSubscription.js";
 import { readChatgptAccess } from "../lib/chatgptAuth.js";
+import { authHeaders, codexSessionStore } from "../lib/codexBackend/client.js";
 import { logWarn } from "../lib/logger.js";
-/** Same file GPT OAuth reads (ima2 store first, then Codex CLI files). */
-function readCodexTokens() {
-    const access = readChatgptAccess();
-    return access ? { access_token: access.accessToken, account_id: access.accountId } : null;
+const CODEX_USAGE_URL = "https://chatgpt.com/backend-api/wham/usage";
+const CODEX_SESSION_TIMEOUT_MS = 8_000;
+/** A hung token endpoint must not stall the whole quota response. */
+function withSessionTimeout(work) {
+    return Promise.race([
+        work,
+        new Promise((_resolve, reject) => {
+            setTimeout(() => reject(new Error("codex session read timed out")), CODEX_SESSION_TIMEOUT_MS).unref();
+        }),
+    ]);
 }
-async function fetchCodexUsage(tokens) {
+/** Same session the GPT OAuth lane uses: the file is re-read and a near-expired token refreshes. */
+async function readCodexSession() {
     try {
-        const resp = await fetch("https://chatgpt.com/backend-api/wham/usage", {
-            headers: {
-                Authorization: `Bearer ${tokens.access_token}`,
-                "ChatGPT-Account-Id": tokens.account_id,
-            },
-            signal: AbortSignal.timeout(8000),
-        });
+        return { session: await withSessionTimeout(codexSessionStore().get()) };
+    }
+    catch {
+        // A session file exists but the store could not serve it (a refresh or read
+        // failure): that is a quota error, not a logged-out account.
+        return readChatgptAccess() ? "error" : "none";
+    }
+}
+function codexUsageRequest(session) {
+    return fetch(CODEX_USAGE_URL, {
+        headers: authHeaders(session),
+        signal: AbortSignal.timeout(8000),
+    });
+}
+async function fetchCodexUsage(session) {
+    try {
+        let resp = await codexUsageRequest(session);
+        if (resp.status === 401) {
+            // The one-shot recovery codexUpstream uses: an invalidated token refreshes once and retries.
+            try {
+                const fresh = await withSessionTimeout(codexSessionStore().refresh(session.accessToken));
+                if (fresh.accessToken !== session.accessToken) {
+                    await resp.body?.cancel().catch(() => undefined);
+                    resp = await codexUsageRequest(fresh);
+                }
+            }
+            catch { /* the first response stands */ }
+        }
         if (!resp.ok) {
             if (resp.status === 401 || resp.status === 403)
                 return { provider: "codex", authenticated: false, windows: [] };
@@ -269,9 +298,16 @@ export async function fetchNaiQuota(ctx) {
 export function registerQuotaRoutes(app, ctx) {
     app.get("/api/quota", async (_req, res) => {
         try {
-            const tokens = readCodexTokens();
+            const read = await readCodexSession();
+            const codexResult = typeof read === "object"
+                ? fetchCodexUsage(read.session)
+                : Promise.resolve({
+                    provider: "codex",
+                    ...(read === "error" ? { error: true } : { authenticated: false }),
+                    windows: [],
+                });
             const [codex, grok, nai] = await Promise.all([
-                tokens ? fetchCodexUsage(tokens) : Promise.resolve({ provider: "codex", authenticated: false, windows: [] }),
+                codexResult,
                 fetchGrokBilling(),
                 fetchNaiQuota(ctx),
             ]);