oc-chatgpt-multi-auth 4.12.3 → 4.13.0

package/dist/index.js

@@ -28,15 +28,16 @@ import { queuedRefresh } from "./lib/refresh-queue.js";
 import { openBrowserUrl } from "./lib/auth/browser.js";
 import { startLocalOAuthServer } from "./lib/auth/server.js";
 import { promptLoginMode } from "./lib/cli.js";
-import { getCodexMode, getRateLimitToastDebounceMs, getRetryAllAccountsMaxRetries, getRetryAllAccountsMaxWaitMs, getRetryAllAccountsRateLimited, getTokenRefreshSkewMs, getSessionRecovery, getAutoResume, getToastDurationMs, getPerProjectAccounts, loadPluginConfig, } from "./lib/config.js";
+import { getCodexMode, getRateLimitToastDebounceMs, getRetryAllAccountsMaxRetries, getRetryAllAccountsMaxWaitMs, getRetryAllAccountsRateLimited, getTokenRefreshSkewMs, getSessionRecovery, getAutoResume, getToastDurationMs, getPerProjectAccounts, getEmptyResponseMaxRetries, getEmptyResponseRetryDelayMs, getPidOffsetEnabled, getFetchTimeoutMs, getStreamStallTimeoutMs, loadPluginConfig, } from "./lib/config.js";
 import { AUTH_LABELS, CODEX_BASE_URL, DUMMY_API_KEY, LOG_STAGES, PLUGIN_NAME, PROVIDER_ID, ACCOUNT_LIMITS, } from "./lib/constants.js";
-import { initLogger, logRequest, logDebug, logInfo, logWarn, logError } from "./lib/logger.js";
+import { initLogger, logRequest, logDebug, logInfo, logWarn, logError, setCorrelationId, clearCorrelationId, } from "./lib/logger.js";
 import { checkAndNotify } from "./lib/auto-update-checker.js";
 import { handleContextOverflow } from "./lib/context-overflow.js";
 import { AccountManager, getAccountIdCandidates, extractAccountEmail, extractAccountId, formatAccountLabel, formatCooldown, formatWaitTime, sanitizeEmail, shouldUpdateAccountIdFromToken, parseRateLimitReason, } from "./lib/accounts.js";
 import { getStoragePath, loadAccounts, saveAccounts, setStoragePath, exportAccounts, importAccounts, StorageError, formatStorageErrorHint } from "./lib/storage.js";
 import { createCodexHeaders, extractRequestUrl, handleErrorResponse, handleSuccessResponse, refreshAndUpdateToken, rewriteUrlForCodex, shouldRefreshToken, transformRequestForCodex, } from "./lib/request/fetch-helpers.js";
 import { getRateLimitBackoff, RATE_LIMIT_SHORT_RETRY_THRESHOLD_MS, resetRateLimitBackoff, } from "./lib/request/rate-limit-backoff.js";
+import { isEmptyResponse } from "./lib/request/response-handler.js";
 import { addJitter } from "./lib/rotation.js";
 import { buildTableHeader, buildTableRow } from "./lib/table-formatter.js";
 import { getModelFamily, MODEL_FAMILIES } from "./lib/prompts/codex.js";
@@ -64,6 +65,21 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
     let accountManagerPromise = null;
     let loaderMutex = null;
     const MIN_BACKOFF_MS = 100;
+    const runtimeMetrics = {
+        startedAt: Date.now(),
+        totalRequests: 0,
+        successfulRequests: 0,
+        failedRequests: 0,
+        rateLimitedResponses: 0,
+        serverErrors: 0,
+        networkErrors: 0,
+        authRefreshFailures: 0,
+        emptyResponseRetries: 0,
+        accountRotations: 0,
+        cumulativeLatencyMs: 0,
+        lastRequestAt: null,
+        lastError: null,
+    };
     const resolveAccountSelection = (tokens) => {
         const override = (process.env.CODEX_AUTH_ACCOUNT_ID ?? "").trim();
         if (override) {
@@ -487,11 +503,16 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                     const retryAllAccountsMaxRetries = getRetryAllAccountsMaxRetries(pluginConfig);
                     const toastDurationMs = getToastDurationMs(pluginConfig);
                     const perProjectAccounts = getPerProjectAccounts(pluginConfig);
+                    const fetchTimeoutMs = getFetchTimeoutMs(pluginConfig);
+                    const streamStallTimeoutMs = getStreamStallTimeoutMs(pluginConfig);
                     if (perProjectAccounts) {
                         setStoragePath(process.cwd());
                     }
                     const sessionRecoveryEnabled = getSessionRecovery(pluginConfig);
                     const autoResumeEnabled = getAutoResume(pluginConfig);
+                    const emptyResponseMaxRetries = getEmptyResponseMaxRetries(pluginConfig);
+                    const emptyResponseRetryDelayMs = getEmptyResponseRetryDelayMs(pluginConfig);
+                    const pidOffsetEnabled = getPidOffsetEnabled(pluginConfig);
                     const recoveryHook = sessionRecoveryEnabled
                         ? createSessionRecoveryHook({ client, directory: process.cwd() }, { sessionRecovery: true, autoResume: autoResumeEnabled })
                         : null;
@@ -520,249 +541,310 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                          * @returns Response from Codex API
                          */
                         async fetch(input, init) {
-                            // Step 1: Extract and rewrite URL for Codex backend
-                            const originalUrl = extractRequestUrl(input);
-                            const url = rewriteUrlForCodex(originalUrl);
-                            // Step 3: Transform request body with model-specific Codex instructions
-                            // Instructions are fetched per model family (codex-max, codex, gpt-5.1)
-                            // Capture original stream value before transformation
-                            // generateText() sends no stream field, streamText() sends stream=true
-                            let originalBody = {};
-                            if (init?.body) {
-                                try {
-                                    originalBody = JSON.parse(init.body);
-                                }
-                                catch {
-                                    logWarn("Failed to parse request body, using empty object");
-                                }
-                            }
-                            const isStreaming = originalBody.stream === true;
-                            const transformation = await transformRequestForCodex(init, url, userConfig, codexMode, originalBody);
-                            const requestInit = transformation?.updatedInit ?? init;
-                            const promptCacheKey = transformation?.body?.prompt_cache_key;
-                            const model = transformation?.body.model;
-                            const modelFamily = model ? getModelFamily(model) : "gpt-5.1";
-                            const quotaKey = model ? `${modelFamily}:${model}` : modelFamily;
-                            const abortSignal = requestInit?.signal ?? init?.signal ?? null;
-                            const sleep = (ms) => new Promise((resolve, reject) => {
-                                if (abortSignal?.aborted) {
-                                    reject(new Error("Aborted"));
-                                    return;
-                                }
-                                const timeout = setTimeout(() => {
-                                    cleanup();
-                                    resolve();
-                                }, ms);
-                                const onAbort = () => {
-                                    cleanup();
-                                    reject(new Error("Aborted"));
-                                };
-                                const cleanup = () => {
-                                    clearTimeout(timeout);
-                                    abortSignal?.removeEventListener("abort", onAbort);
-                                };
-                                abortSignal?.addEventListener("abort", onAbort, { once: true });
-                            });
-                            const sleepWithCountdown = async (totalMs, message, intervalMs = 5000) => {
-                                const startTime = Date.now();
-                                const endTime = startTime + totalMs;
-                                while (Date.now() < endTime) {
-                                    if (abortSignal?.aborted) {
-                                        throw new Error("Aborted");
-                                    }
-                                    const remaining = Math.max(0, endTime - Date.now());
-                                    const waitLabel = formatWaitTime(remaining);
-                                    await showToast(`${message} (${waitLabel} remaining)`, "warning", { duration: Math.min(intervalMs + 1000, toastDurationMs) });
-                                    const sleepTime = Math.min(intervalMs, remaining);
-                                    if (sleepTime > 0) {
-                                        await sleep(sleepTime);
-                                    }
-                                    else {
-                                        break;
-                                    }
-                                }
-                            };
-                            let allRateLimitedRetries = 0;
-                            while (true) {
-                                const accountCount = accountManager.getAccountCount();
-                                const attempted = new Set();
-                                while (attempted.size < Math.max(1, accountCount)) {
-                                    const account = accountManager.getCurrentOrNextForFamilyHybrid(modelFamily, model);
-                                    if (!account || attempted.has(account.index)) {
-                                        break;
-                                    }
-                                    attempted.add(account.index);
-                                    // Log account selection for debugging rotation
-                                    logDebug(`Using account ${account.index + 1}/${accountCount}: ${account.email ?? "unknown"} for ${modelFamily}`);
-                                    let accountAuth = accountManager.toAuthDetails(account);
+                            try {
+                                // Step 1: Extract and rewrite URL for Codex backend
+                                const originalUrl = extractRequestUrl(input);
+                                const url = rewriteUrlForCodex(originalUrl);
+                                // Step 3: Transform request body with model-specific Codex instructions
+                                // Instructions are fetched per model family (codex-max, codex, gpt-5.1)
+                                // Capture original stream value before transformation
+                                // generateText() sends no stream field, streamText() sends stream=true
+                                let originalBody = {};
+                                if (init?.body) {
                                     try {
-                                        if (shouldRefreshToken(accountAuth, tokenRefreshSkewMs)) {
-                                            accountAuth = (await refreshAndUpdateToken(accountAuth, client));
-                                            accountManager.updateFromAuth(account, accountAuth);
-                                            accountManager.clearAuthFailures(account);
-                                            accountManager.saveToDiskDebounced();
-                                        }
+                                        originalBody = JSON.parse(init.body);
                                     }
-                                    catch (err) {
-                                        logDebug(`[${PLUGIN_NAME}] Auth refresh failed for account: ${err?.message ?? String(err)}`);
-                                        const failures = accountManager.incrementAuthFailures(account);
-                                        const accountLabel = formatAccountLabel(account, account.index);
-                                        if (failures >= ACCOUNT_LIMITS.MAX_AUTH_FAILURES_BEFORE_REMOVAL) {
-                                            accountManager.removeAccount(account);
-                                            accountManager.saveToDiskDebounced();
-                                            await showToast(`Removed ${accountLabel} after ${failures} consecutive auth failures. Run 'opencode auth login' to re-add.`, "error", { duration: toastDurationMs * 2 });
-                                            continue;
-                                        }
-                                        accountManager.markAccountCoolingDown(account, ACCOUNT_LIMITS.AUTH_FAILURE_COOLDOWN_MS, "auth-failure");
-                                        accountManager.saveToDiskDebounced();
-                                        continue;
-                                    }
-                                    const hadAccountId = !!account.accountId;
-                                    // Prefer fresh token-derived ID over stored ID (fixes Business plan workspace issues)
-                                    const accountId = extractAccountId(accountAuth.access) ?? account.accountId;
-                                    if (!accountId) {
-                                        accountManager.markAccountCoolingDown(account, ACCOUNT_LIMITS.AUTH_FAILURE_COOLDOWN_MS, "auth-failure");
-                                        accountManager.saveToDiskDebounced();
-                                        continue;
+                                    catch {
+                                        logWarn("Failed to parse request body, using empty object");
                                     }
-                                    account.accountId = accountId;
-                                    if (!hadAccountId) {
-                                        account.accountIdSource = account.accountIdSource ?? "token";
-                                    }
-                                    account.email =
-                                        extractAccountEmail(accountAuth.access) ?? account.email;
-                                    if (accountCount > 1 &&
-                                        accountManager.shouldShowAccountToast(account.index, rateLimitToastDebounceMs)) {
-                                        const accountLabel = formatAccountLabel(account, account.index);
-                                        await showToast(`Using ${accountLabel} (${account.index + 1}/${accountCount})`, "info");
-                                        accountManager.markToastShown(account.index);
+                                }
+                                const isStreaming = originalBody.stream === true;
+                                const transformation = await transformRequestForCodex(init, url, userConfig, codexMode, originalBody);
+                                const requestInit = transformation?.updatedInit ?? init;
+                                const promptCacheKey = transformation?.body?.prompt_cache_key;
+                                const model = transformation?.body.model;
+                                const modelFamily = model ? getModelFamily(model) : "gpt-5.1";
+                                const quotaKey = model ? `${modelFamily}:${model}` : modelFamily;
+                                const threadIdCandidate = (process.env.CODEX_THREAD_ID ?? promptCacheKey ?? "")
+                                    .toString()
+                                    .trim() || undefined;
+                                const requestCorrelationId = setCorrelationId(threadIdCandidate ? `${threadIdCandidate}:${Date.now()}` : undefined);
+                                runtimeMetrics.lastRequestAt = Date.now();
+                                const abortSignal = requestInit?.signal ?? init?.signal ?? null;
+                                const sleep = (ms) => new Promise((resolve, reject) => {
+                                    if (abortSignal?.aborted) {
+                                        reject(new Error("Aborted"));
+                                        return;
                                     }
-                                    const headers = createCodexHeaders(requestInit, accountId, accountAuth.access, {
-                                        model,
-                                        promptCacheKey,
-                                    });
-                                    // Consume a token before making the request for proactive rate limiting
-                                    accountManager.consumeToken(account, modelFamily, model);
-                                    while (true) {
-                                        let response;
-                                        const fetchStart = performance.now();
-                                        // Merge user AbortSignal with timeout (Node 18 compatible - no AbortSignal.any)
-                                        const fetchController = new AbortController();
-                                        const fetchTimeoutMs = 60000;
-                                        const fetchTimeoutId = setTimeout(() => fetchController.abort(new Error("Request timeout")), fetchTimeoutMs);
-                                        const onUserAbort = abortSignal
-                                            ? () => fetchController.abort(abortSignal.reason ?? new Error("Aborted by user"))
-                                            : null;
+                                    const timeout = setTimeout(() => {
+                                        cleanup();
+                                        resolve();
+                                    }, ms);
+                                    const onAbort = () => {
+                                        cleanup();
+                                        reject(new Error("Aborted"));
+                                    };
+                                    const cleanup = () => {
+                                        clearTimeout(timeout);
+                                        abortSignal?.removeEventListener("abort", onAbort);
+                                    };
+                                    abortSignal?.addEventListener("abort", onAbort, { once: true });
+                                });
+                                const sleepWithCountdown = async (totalMs, message, intervalMs = 5000) => {
+                                    const startTime = Date.now();
+                                    const endTime = startTime + totalMs;
+                                    while (Date.now() < endTime) {
                                         if (abortSignal?.aborted) {
-                                            clearTimeout(fetchTimeoutId);
-                                            fetchController.abort(abortSignal.reason ?? new Error("Aborted by user"));
+                                            throw new Error("Aborted");
                                         }
-                                        else if (abortSignal && onUserAbort) {
-                                            abortSignal.addEventListener("abort", onUserAbort, { once: true });
+                                        const remaining = Math.max(0, endTime - Date.now());
+                                        const waitLabel = formatWaitTime(remaining);
+                                        await showToast(`${message} (${waitLabel} remaining)`, "warning", { duration: Math.min(intervalMs + 1000, toastDurationMs) });
+                                        const sleepTime = Math.min(intervalMs, remaining);
+                                        if (sleepTime > 0) {
+                                            await sleep(sleepTime);
                                         }
-                                        try {
-                                            response = await fetch(url, {
-                                                ...requestInit,
-                                                headers,
-                                                signal: fetchController.signal,
-                                            });
+                                        else {
+                                            break;
                                         }
-                                        catch (networkError) {
-                                            const errorMsg = networkError instanceof Error ? networkError.message : String(networkError);
-                                            logWarn(`Network error for account ${account.index + 1}: ${errorMsg}`);
-                                            accountManager.refundToken(account, modelFamily, model);
-                                            accountManager.recordFailure(account, modelFamily, model);
+                                    }
+                                };
+                                let allRateLimitedRetries = 0;
+                                let emptyResponseRetries = 0;
+                                while (true) {
+                                    const accountCount = accountManager.getAccountCount();
+                                    const attempted = new Set();
+                                    while (attempted.size < Math.max(1, accountCount)) {
+                                        const account = accountManager.getCurrentOrNextForFamilyHybrid(modelFamily, model, { pidOffsetEnabled });
+                                        if (!account || attempted.has(account.index)) {
                                             break;
                                         }
-                                        finally {
-                                            clearTimeout(fetchTimeoutId);
-                                            if (abortSignal && onUserAbort) {
-                                                abortSignal.removeEventListener("abort", onUserAbort);
+                                        attempted.add(account.index);
+                                        // Log account selection for debugging rotation
+                                        logDebug(`Using account ${account.index + 1}/${accountCount}: ${account.email ?? "unknown"} for ${modelFamily}`);
+                                        let accountAuth = accountManager.toAuthDetails(account);
+                                        try {
+                                            if (shouldRefreshToken(accountAuth, tokenRefreshSkewMs)) {
+                                                accountAuth = (await refreshAndUpdateToken(accountAuth, client));
+                                                accountManager.updateFromAuth(account, accountAuth);
+                                                accountManager.clearAuthFailures(account);
+                                                accountManager.saveToDiskDebounced();
                                             }
                                         }
-                                        const fetchLatencyMs = Math.round(performance.now() - fetchStart);
-                                        logRequest(LOG_STAGES.RESPONSE, {
-                                            status: response.status,
-                                            ok: response.ok,
-                                            statusText: response.statusText,
-                                            latencyMs: fetchLatencyMs,
-                                            headers: Object.fromEntries(response.headers.entries()),
+                                        catch (err) {
+                                            logDebug(`[${PLUGIN_NAME}] Auth refresh failed for account: ${err?.message ?? String(err)}`);
+                                            runtimeMetrics.authRefreshFailures++;
+                                            runtimeMetrics.failedRequests++;
+                                            runtimeMetrics.accountRotations++;
+                                            runtimeMetrics.lastError = err?.message ?? String(err);
+                                            const failures = accountManager.incrementAuthFailures(account);
+                                            const accountLabel = formatAccountLabel(account, account.index);
+                                            if (failures >= ACCOUNT_LIMITS.MAX_AUTH_FAILURES_BEFORE_REMOVAL) {
+                                                accountManager.removeAccount(account);
+                                                accountManager.saveToDiskDebounced();
+                                                await showToast(`Removed ${accountLabel} after ${failures} consecutive auth failures. Run 'opencode auth login' to re-add.`, "error", { duration: toastDurationMs * 2 });
+                                                continue;
+                                            }
+                                            accountManager.markAccountCoolingDown(account, ACCOUNT_LIMITS.AUTH_FAILURE_COOLDOWN_MS, "auth-failure");
+                                            accountManager.saveToDiskDebounced();
+                                            continue;
+                                        }
+                                        const hadAccountId = !!account.accountId;
+                                        // Prefer fresh token-derived ID over stored ID (fixes Business plan workspace issues)
+                                        const accountId = extractAccountId(accountAuth.access) ?? account.accountId;
+                                        if (!accountId) {
+                                            accountManager.markAccountCoolingDown(account, ACCOUNT_LIMITS.AUTH_FAILURE_COOLDOWN_MS, "auth-failure");
+                                            accountManager.saveToDiskDebounced();
+                                            continue;
+                                        }
+                                        account.accountId = accountId;
+                                        if (!hadAccountId) {
+                                            account.accountIdSource = account.accountIdSource ?? "token";
+                                        }
+                                        account.email =
+                                            extractAccountEmail(accountAuth.access) ?? account.email;
+                                        if (accountCount > 1 &&
+                                            accountManager.shouldShowAccountToast(account.index, rateLimitToastDebounceMs)) {
+                                            const accountLabel = formatAccountLabel(account, account.index);
+                                            await showToast(`Using ${accountLabel} (${account.index + 1}/${accountCount})`, "info");
+                                            accountManager.markToastShown(account.index);
+                                        }
+                                        const headers = createCodexHeaders(requestInit, accountId, accountAuth.access, {
+                                            model,
+                                            promptCacheKey,
                                         });
-                                        if (!response.ok) {
-                                            const contextOverflowResult = await handleContextOverflow(response, model);
-                                            if (contextOverflowResult.handled) {
-                                                return contextOverflowResult.response;
+                                        // Consume a token before making the request for proactive rate limiting
+                                        accountManager.consumeToken(account, modelFamily, model);
+                                        while (true) {
+                                            let response;
+                                            const fetchStart = performance.now();
+                                            // Merge user AbortSignal with timeout (Node 18 compatible - no AbortSignal.any)
+                                            const fetchController = new AbortController();
+                                            const requestTimeoutMs = fetchTimeoutMs;
+                                            const fetchTimeoutId = setTimeout(() => fetchController.abort(new Error("Request timeout")), requestTimeoutMs);
+                                            const onUserAbort = abortSignal
+                                                ? () => fetchController.abort(abortSignal.reason ?? new Error("Aborted by user"))
+                                                : null;
+                                            if (abortSignal?.aborted) {
+                                                clearTimeout(fetchTimeoutId);
+                                                fetchController.abort(abortSignal.reason ?? new Error("Aborted by user"));
                                             }
-                                            const { response: errorResponse, rateLimit, errorBody } = await handleErrorResponse(response);
-                                            if (recoveryHook && errorBody && isRecoverableError(errorBody)) {
-                                                const errorType = detectErrorType(errorBody);
-                                                const toastContent = getRecoveryToastContent(errorType);
-                                                await showToast(`${toastContent.title}: ${toastContent.message}`, "warning", { duration: toastDurationMs });
-                                                logDebug(`[${PLUGIN_NAME}] Recoverable error detected: ${errorType}`);
+                                            else if (abortSignal && onUserAbort) {
+                                                abortSignal.addEventListener("abort", onUserAbort, { once: true });
                                             }
-                                            // Handle 5xx server errors by rotating to another account
-                                            if (response.status >= 500 && response.status < 600) {
-                                                logWarn(`Server error ${response.status} for account ${account.index + 1}. Rotating to next account.`);
+                                            try {
+                                                runtimeMetrics.totalRequests++;
+                                                response = await fetch(url, {
+                                                    ...requestInit,
+                                                    headers,
+                                                    signal: fetchController.signal,
+                                                });
+                                            }
+                                            catch (networkError) {
+                                                const errorMsg = networkError instanceof Error ? networkError.message : String(networkError);
+                                                logWarn(`Network error for account ${account.index + 1}: ${errorMsg}`);
+                                                runtimeMetrics.failedRequests++;
+                                                runtimeMetrics.networkErrors++;
+                                                runtimeMetrics.accountRotations++;
+                                                runtimeMetrics.lastError = errorMsg;
                                                 accountManager.refundToken(account, modelFamily, model);
                                                 accountManager.recordFailure(account, modelFamily, model);
                                                 break;
                                             }
-                                            if (rateLimit) {
-                                                const { attempt, delayMs } = getRateLimitBackoff(account.index, quotaKey, rateLimit.retryAfterMs);
-                                                const waitLabel = formatWaitTime(delayMs);
-                                                if (delayMs <= RATE_LIMIT_SHORT_RETRY_THRESHOLD_MS) {
-                                                    if (accountManager.shouldShowAccountToast(account.index, rateLimitToastDebounceMs)) {
-                                                        await showToast(`Rate limited. Retrying in ${waitLabel} (attempt ${attempt})...`, "warning", { duration: toastDurationMs });
+                                            finally {
+                                                clearTimeout(fetchTimeoutId);
+                                                if (abortSignal && onUserAbort) {
+                                                    abortSignal.removeEventListener("abort", onUserAbort);
+                                                }
+                                            }
+                                            const fetchLatencyMs = Math.round(performance.now() - fetchStart);
+                                            logRequest(LOG_STAGES.RESPONSE, {
+                                                status: response.status,
+                                                ok: response.ok,
+                                                statusText: response.statusText,
+                                                latencyMs: fetchLatencyMs,
+                                                headers: Object.fromEntries(response.headers.entries()),
+                                            });
+                                            if (!response.ok) {
+                                                const contextOverflowResult = await handleContextOverflow(response, model);
+                                                if (contextOverflowResult.handled) {
+                                                    return contextOverflowResult.response;
+                                                }
+                                                const { response: errorResponse, rateLimit, errorBody } = await handleErrorResponse(response, {
+                                                    requestCorrelationId,
+                                                    threadId: threadIdCandidate,
+                                                });
+                                                if (recoveryHook && errorBody && isRecoverableError(errorBody)) {
+                                                    const errorType = detectErrorType(errorBody);
+                                                    const toastContent = getRecoveryToastContent(errorType);
+                                                    await showToast(`${toastContent.title}: ${toastContent.message}`, "warning", { duration: toastDurationMs });
+                                                    logDebug(`[${PLUGIN_NAME}] Recoverable error detected: ${errorType}`);
+                                                }
+                                                // Handle 5xx server errors by rotating to another account
+                                                if (response.status >= 500 && response.status < 600) {
+                                                    logWarn(`Server error ${response.status} for account ${account.index + 1}. Rotating to next account.`);
+                                                    runtimeMetrics.failedRequests++;
+                                                    runtimeMetrics.serverErrors++;
+                                                    runtimeMetrics.accountRotations++;
+                                                    runtimeMetrics.lastError = `HTTP ${response.status}`;
+                                                    accountManager.refundToken(account, modelFamily, model);
+                                                    accountManager.recordFailure(account, modelFamily, model);
+                                                    break;
+                                                }
+                                                if (rateLimit) {
+                                                    runtimeMetrics.rateLimitedResponses++;
+                                                    const { attempt, delayMs } = getRateLimitBackoff(account.index, quotaKey, rateLimit.retryAfterMs);
+                                                    const waitLabel = formatWaitTime(delayMs);
+                                                    if (delayMs <= RATE_LIMIT_SHORT_RETRY_THRESHOLD_MS) {
+                                                        if (accountManager.shouldShowAccountToast(account.index, rateLimitToastDebounceMs)) {
+                                                            await showToast(`Rate limited. Retrying in ${waitLabel} (attempt ${attempt})...`, "warning", { duration: toastDurationMs });
+                                                            accountManager.markToastShown(account.index);
+                                                        }
+                                                        await sleep(addJitter(Math.max(MIN_BACKOFF_MS, delayMs), 0.2));
+                                                        continue;
+                                                    }
+                                                    accountManager.markRateLimitedWithReason(account, delayMs, modelFamily, parseRateLimitReason(rateLimit.code), model);
+                                                    accountManager.recordRateLimit(account, modelFamily, model);
+                                                    account.lastSwitchReason = "rate-limit";
+                                                    runtimeMetrics.accountRotations++;
+                                                    accountManager.saveToDiskDebounced();
+                                                    logWarn(`Rate limited. Rotating account ${account.index + 1} (${account.email ?? "unknown"}).`);
+                                                    if (accountManager.getAccountCount() > 1 &&
+                                                        accountManager.shouldShowAccountToast(account.index, rateLimitToastDebounceMs)) {
+                                                        await showToast(`Rate limited. Switching accounts (retry in ${waitLabel}).`, "warning", { duration: toastDurationMs });
                                                         accountManager.markToastShown(account.index);
                                                     }
-                                                    await sleep(addJitter(Math.max(MIN_BACKOFF_MS, delayMs), 0.2));
-                                                    continue;
+                                                    break;
                                                 }
-                                                accountManager.markRateLimitedWithReason(account, delayMs, modelFamily, parseRateLimitReason(rateLimit.code), model);
-                                                accountManager.recordRateLimit(account, modelFamily, model);
-                                                account.lastSwitchReason = "rate-limit";
-                                                accountManager.saveToDiskDebounced();
-                                                logWarn(`Rate limited. Rotating account ${account.index + 1} (${account.email ?? "unknown"}).`);
-                                                if (accountManager.getAccountCount() > 1 &&
-                                                    accountManager.shouldShowAccountToast(account.index, rateLimitToastDebounceMs)) {
-                                                    await showToast(`Rate limited. Switching accounts (retry in ${waitLabel}).`, "warning", { duration: toastDurationMs });
-                                                    accountManager.markToastShown(account.index);
+                                                runtimeMetrics.failedRequests++;
+                                                runtimeMetrics.lastError = `HTTP ${response.status}`;
+                                                return errorResponse;
+                                            }
+                                            resetRateLimitBackoff(account.index, quotaKey);
+                                            runtimeMetrics.cumulativeLatencyMs += fetchLatencyMs;
+                                            const successResponse = await handleSuccessResponse(response, isStreaming, {
+                                                streamStallTimeoutMs,
+                                            });
+                                            if (!isStreaming && emptyResponseMaxRetries > 0) {
+                                                const clonedResponse = successResponse.clone();
+                                                try {
+                                                    const bodyText = await clonedResponse.text();
+                                                    const parsedBody = bodyText ? JSON.parse(bodyText) : null;
+                                                    if (isEmptyResponse(parsedBody)) {
+                                                        if (emptyResponseRetries < emptyResponseMaxRetries) {
+                                                            emptyResponseRetries++;
+                                                            runtimeMetrics.emptyResponseRetries++;
+                                                            logWarn(`Empty response received (attempt ${emptyResponseRetries}/${emptyResponseMaxRetries}). Retrying...`);
+                                                            await showToast(`Empty response. Retrying (${emptyResponseRetries}/${emptyResponseMaxRetries})...`, "warning", { duration: toastDurationMs });
+                                                            accountManager.refundToken(account, modelFamily, model);
+                                                            accountManager.recordFailure(account, modelFamily, model);
+                                                            await sleep(addJitter(emptyResponseRetryDelayMs, 0.2));
+                                                            break;
+                                                        }
+                                                        logWarn(`Empty response after ${emptyResponseMaxRetries} retries. Returning as-is.`);
+                                                    }
+                                                }
+                                                catch {
+                                                    // Intentionally empty: non-JSON response bodies should be returned as-is
                                                 }
-                                                break;
                                             }
-                                            return errorResponse;
+                                            accountManager.recordSuccess(account, modelFamily, model);
+                                            runtimeMetrics.successfulRequests++;
+                                            runtimeMetrics.lastError = null;
+                                            return successResponse;
                                         }
-                                        resetRateLimitBackoff(account.index, quotaKey);
-                                        const successResponse = await handleSuccessResponse(response, isStreaming);
-                                        accountManager.recordSuccess(account, modelFamily, model);
-                                        return successResponse;
                                     }
+                                    const waitMs = accountManager.getMinWaitTimeForFamily(modelFamily, model);
+                                    const count = accountManager.getAccountCount();
+                                    if (retryAllAccountsRateLimited &&
+                                        count > 0 &&
+                                        waitMs > 0 &&
+                                        (retryAllAccountsMaxWaitMs === 0 ||
+                                            waitMs <= retryAllAccountsMaxWaitMs) &&
+                                        allRateLimitedRetries < retryAllAccountsMaxRetries) {
+                                        const countdownMessage = `All ${count} account(s) rate-limited. Waiting`;
+                                        await sleepWithCountdown(addJitter(waitMs, 0.2), countdownMessage);
+                                        allRateLimitedRetries++;
+                                        continue;
+                                    }
+                                    const waitLabel = waitMs > 0 ? formatWaitTime(waitMs) : "a bit";
+                                    const message = count === 0
+                                        ? "No Codex accounts configured. Run `opencode auth login`."
+                                        : waitMs > 0
+                                            ? `All ${count} account(s) are rate-limited. Try again in ${waitLabel} or add another account with \`opencode auth login\`.`
+                                            : `All ${count} account(s) failed (server errors or auth issues). Check account health with \`codex-health\`.`;
+                                    runtimeMetrics.failedRequests++;
+                                    runtimeMetrics.lastError = message;
+                                    return new Response(JSON.stringify({ error: { message } }), {
+                                        status: waitMs > 0 ? 429 : 503,
+                                        headers: {
+                                            "content-type": "application/json; charset=utf-8",
+                                        },
+                                    });
                                 }
-                                const waitMs = accountManager.getMinWaitTimeForFamily(modelFamily, model);
-                                const count = accountManager.getAccountCount();
-                                if (retryAllAccountsRateLimited &&
-                                    count > 0 &&
-                                    waitMs > 0 &&
-                                    (retryAllAccountsMaxWaitMs === 0 ||
-                                        waitMs <= retryAllAccountsMaxWaitMs) &&
-                                    allRateLimitedRetries < retryAllAccountsMaxRetries) {
-                                    const countdownMessage = `All ${count} account(s) rate-limited. Waiting`;
-                                    await sleepWithCountdown(addJitter(waitMs, 0.2), countdownMessage);
-                                    allRateLimitedRetries++;
-                                    continue;
-                                }
-                                const waitLabel = waitMs > 0 ? formatWaitTime(waitMs) : "a bit";
-                                const message = count === 0
-                                    ? "No Codex accounts configured. Run `opencode auth login`."
-                                    : waitMs > 0
-                                        ? `All ${count} account(s) are rate-limited. Try again in ${waitLabel} or add another account with \`opencode auth login\`.`
-                                        : `All ${count} account(s) failed (server errors or auth issues). Check account health with \`codex-health\`.`;
-                                return new Response(JSON.stringify({ error: { message } }), {
-                                    status: waitMs > 0 ? 429 : 503,
-                                    headers: {
-                                        "content-type": "application/json; charset=utf-8",
-                                    },
-                                });
+                            }
+                            finally {
+                                clearCorrelationId();
                             }
                         },
                     };
@@ -1057,6 +1139,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                     lines.push("  - Add account: opencode auth login");
                     lines.push("  - Switch account: codex-switch");
                     lines.push("  - Status details: codex-status");
+                    lines.push("  - Runtime metrics: codex-metrics");
                     return lines.join("\n");
                 },
             }),
@@ -1158,6 +1241,44 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                     return lines.join("\n");
                 },
             }),
+            "codex-metrics": tool({
+                description: "Show runtime request metrics for this plugin process.",
+                args: {},
+                execute() {
+                    const now = Date.now();
+                    const uptimeMs = Math.max(0, now - runtimeMetrics.startedAt);
+                    const total = runtimeMetrics.totalRequests;
+                    const successful = runtimeMetrics.successfulRequests;
+                    const successRate = total > 0 ? ((successful / total) * 100).toFixed(1) : "0.0";
+                    const avgLatencyMs = successful > 0
+                        ? Math.round(runtimeMetrics.cumulativeLatencyMs / successful)
+                        : 0;
+                    const lastRequest = runtimeMetrics.lastRequestAt !== null
+                        ? `${formatWaitTime(now - runtimeMetrics.lastRequestAt)} ago`
+                        : "never";
+                    const lines = [
+                        "Codex Plugin Metrics:",
+                        "",
+                        `Uptime: ${formatWaitTime(uptimeMs)}`,
+                        `Total upstream requests: ${total}`,
+                        `Successful responses: ${successful}`,
+                        `Failed responses: ${runtimeMetrics.failedRequests}`,
+                        `Success rate: ${successRate}%`,
+                        `Average successful latency: ${avgLatencyMs}ms`,
+                        `Rate-limited responses: ${runtimeMetrics.rateLimitedResponses}`,
+                        `Server errors (5xx): ${runtimeMetrics.serverErrors}`,
+                        `Network errors: ${runtimeMetrics.networkErrors}`,
+                        `Auth refresh failures: ${runtimeMetrics.authRefreshFailures}`,
+                        `Account rotations: ${runtimeMetrics.accountRotations}`,
+                        `Empty-response retries: ${runtimeMetrics.emptyResponseRetries}`,
+                        `Last upstream request: ${lastRequest}`,
+                    ];
+                    if (runtimeMetrics.lastError) {
+                        lines.push(`Last error: ${runtimeMetrics.lastError}`);
+                    }
+                    return Promise.resolve(lines.join("\n"));
+                },
+            }),
             "codex-health": tool({
                 description: "Check health of all Codex accounts by validating refresh tokens.",
                 args: {},