oc-codex-multi-auth 6.0.0

package/dist/lib/accounts.js

@@ -0,0 +1,795 @@
+import { existsSync, promises as fs } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { createLogger } from "./logger.js";
+import { loadAccounts, saveAccounts, } from "./storage.js";
+import { MODEL_FAMILIES } from "./prompts/codex.js";
+import { getHealthTracker, getTokenTracker, selectHybridAccount, } from "./rotation.js";
+import { isRecord, nowMs } from "./utils.js";
+import { decodeJWT } from "./auth/auth.js";
+export { extractAccountId, extractAccountEmail, getAccountIdCandidates, selectBestAccountCandidate, shouldUpdateAccountIdFromToken, resolveRequestAccountId, sanitizeEmail, } from "./auth/token-utils.js";
+export { parseRateLimitReason, getQuotaKey, clampNonNegativeInt, clearExpiredRateLimits, isRateLimitedForQuotaKey, isRateLimitedForFamily, formatWaitTime, } from "./accounts/rate-limits.js";
+import { extractAccountId, extractAccountEmail, shouldUpdateAccountIdFromToken, sanitizeEmail, } from "./auth/token-utils.js";
+import { clampNonNegativeInt, getQuotaKey, clearExpiredRateLimits, isRateLimitedForFamily, formatWaitTime, } from "./accounts/rate-limits.js";
+const log = createLogger("accounts");
+const CODEX_CLI_ACCOUNTS_PATH = join(homedir(), ".codex", "accounts.json");
+const CODEX_CLI_CACHE_TTL_MS = 5_000;
+let codexCliTokenCache = null;
+let codexCliTokenCacheLoadedAt = 0;
+function extractExpiresAtFromAccessToken(accessToken) {
+    const decoded = decodeJWT(accessToken);
+    const exp = decoded?.exp;
+    if (typeof exp === "number" && Number.isFinite(exp)) {
+        // JWT exp is in seconds since epoch.
+        return exp * 1000;
+    }
+    return undefined;
+}
+async function getCodexCliTokenCache() {
+    const syncEnabled = process.env.CODEX_AUTH_SYNC_CODEX_CLI !== "0";
+    const skip = !syncEnabled ||
+        process.env.VITEST_WORKER_ID !== undefined ||
+        process.env.NODE_ENV === "test";
+    if (skip)
+        return null;
+    const now = nowMs();
+    if (codexCliTokenCache && now - codexCliTokenCacheLoadedAt < CODEX_CLI_CACHE_TTL_MS) {
+        return codexCliTokenCache;
+    }
+    codexCliTokenCacheLoadedAt = now;
+    if (!existsSync(CODEX_CLI_ACCOUNTS_PATH)) {
+        codexCliTokenCache = null;
+        return null;
+    }
+    try {
+        const raw = await fs.readFile(CODEX_CLI_ACCOUNTS_PATH, "utf-8");
+        const parsed = JSON.parse(raw);
+        if (!isRecord(parsed) || !Array.isArray(parsed.accounts)) {
+            codexCliTokenCache = null;
+            return null;
+        }
+        const next = new Map();
+        for (const entry of parsed.accounts) {
+            if (!isRecord(entry))
+                continue;
+            const email = sanitizeEmail(typeof entry.email === "string" ? entry.email : undefined);
+            if (!email)
+                continue;
+            const accountId = typeof entry.accountId === "string" && entry.accountId.trim() ? entry.accountId.trim() : undefined;
+            const auth = entry.auth;
+            const tokens = isRecord(auth) ? auth.tokens : undefined;
+            const accessToken = isRecord(tokens) && typeof tokens.access_token === "string" && tokens.access_token.trim()
+                ? tokens.access_token.trim()
+                : undefined;
+            const refreshToken = isRecord(tokens) && typeof tokens.refresh_token === "string" && tokens.refresh_token.trim()
+                ? tokens.refresh_token.trim()
+                : undefined;
+            if (!accessToken)
+                continue;
+            next.set(email, {
+                accessToken,
+                expiresAt: extractExpiresAtFromAccessToken(accessToken),
+                refreshToken,
+                accountId,
+            });
+        }
+        codexCliTokenCache = next;
+        return codexCliTokenCache;
+    }
+    catch (error) {
+        log.debug("Failed to read Codex CLI accounts cache", { error: String(error) });
+        codexCliTokenCache = null;
+        return null;
+    }
+}
+export async function lookupCodexCliTokensByEmail(email) {
+    const normalized = sanitizeEmail(email);
+    if (!normalized)
+        return null;
+    const cache = await getCodexCliTokenCache();
+    const cached = cache?.get(normalized);
+    return cached ? { ...cached } : null;
+}
+function initFamilyState(defaultValue) {
+    return Object.fromEntries(MODEL_FAMILIES.map((family) => [family, defaultValue]));
+}
+export class AccountManager {
+    accounts = [];
+    cursorByFamily = initFamilyState(0);
+    currentAccountIndexByFamily = initFamilyState(-1);
+    lastToastAccountIndex = -1;
+    lastToastTime = 0;
+    saveDebounceTimer = null;
+    pendingSave = null;
+    authFailuresByRefreshToken = new Map();
+    static async loadFromDisk(authFallback) {
+        const stored = await loadAccounts();
+        const manager = new AccountManager(authFallback, stored);
+        await manager.hydrateFromCodexCli();
+        return manager;
+    }
+    hasRefreshToken(refreshToken) {
+        return this.accounts.some((account) => account.refreshToken === refreshToken);
+    }
+    async hydrateFromCodexCli() {
+        const cache = await getCodexCliTokenCache();
+        if (!cache || cache.size === 0)
+            return;
+        const now = nowMs();
+        let changed = false;
+        for (const account of this.accounts) {
+            const email = sanitizeEmail(account.email);
+            if (!email)
+                continue;
+            const cached = cache.get(email);
+            if (!cached)
+                continue;
+            if (typeof cached.expiresAt === "number" && cached.expiresAt <= now) {
+                continue;
+            }
+            const missingOrExpired = !account.access || account.expires === undefined || account.expires <= now;
+            if (missingOrExpired) {
+                account.access = cached.accessToken;
+                if (typeof cached.expiresAt === "number") {
+                    account.expires = cached.expiresAt;
+                }
+                changed = true;
+            }
+            if (!account.accountId &&
+                cached.accountId &&
+                shouldUpdateAccountIdFromToken(account.accountIdSource, account.accountId)) {
+                account.accountId = cached.accountId;
+                account.accountIdSource = account.accountIdSource ?? "token";
+                changed = true;
+            }
+        }
+        if (!changed)
+            return;
+        try {
+            await this.saveToDisk();
+        }
+        catch (error) {
+            log.debug("Failed to persist Codex CLI cache hydration", { error: String(error) });
+        }
+    }
+    constructor(authFallback, stored) {
+        const fallbackAccountId = extractAccountId(authFallback?.access);
+        const fallbackAccountEmail = sanitizeEmail(extractAccountEmail(authFallback?.access));
+        if (stored && stored.accounts.length > 0) {
+            const baseNow = nowMs();
+            this.accounts = stored.accounts
+                .map((account, index) => {
+                if (!account.refreshToken || typeof account.refreshToken !== "string") {
+                    return null;
+                }
+                const matchesFallback = !!authFallback &&
+                    ((fallbackAccountId && account.accountId === fallbackAccountId) ||
+                        account.refreshToken === authFallback.refresh ||
+                        (!!fallbackAccountEmail &&
+                            sanitizeEmail(account.email) === fallbackAccountEmail));
+                const refreshToken = matchesFallback && authFallback ? authFallback.refresh : account.refreshToken;
+                return {
+                    index,
+                    accountId: matchesFallback ? fallbackAccountId ?? account.accountId : account.accountId,
+                    organizationId: account.organizationId,
+                    accountIdSource: account.accountIdSource,
+                    accountLabel: account.accountLabel,
+                    accountTags: account.accountTags,
+                    accountNote: account.accountNote,
+                    email: matchesFallback
+                        ? fallbackAccountEmail ?? sanitizeEmail(account.email)
+                        : sanitizeEmail(account.email),
+                    refreshToken,
+                    enabled: account.enabled !== false,
+                    access: matchesFallback && authFallback ? authFallback.access : account.accessToken,
+                    expires: matchesFallback && authFallback ? authFallback.expires : account.expiresAt,
+                    addedAt: clampNonNegativeInt(account.addedAt, baseNow),
+                    lastUsed: clampNonNegativeInt(account.lastUsed, 0),
+                    lastSwitchReason: account.lastSwitchReason,
+                    rateLimitResetTimes: account.rateLimitResetTimes ?? {},
+                    coolingDownUntil: account.coolingDownUntil,
+                    cooldownReason: account.cooldownReason,
+                };
+            })
+                .filter((account) => account !== null);
+            const hasMatchingFallback = !!authFallback &&
+                this.accounts.some((account) => account.refreshToken === authFallback.refresh ||
+                    (fallbackAccountId && account.accountId === fallbackAccountId) ||
+                    (!!fallbackAccountEmail && account.email === fallbackAccountEmail));
+            if (authFallback && !hasMatchingFallback) {
+                const now = nowMs();
+                this.accounts.push({
+                    index: this.accounts.length,
+                    accountId: fallbackAccountId,
+                    organizationId: undefined,
+                    accountIdSource: fallbackAccountId ? "token" : undefined,
+                    email: fallbackAccountEmail,
+                    refreshToken: authFallback.refresh,
+                    enabled: true,
+                    access: authFallback.access,
+                    expires: authFallback.expires,
+                    addedAt: now,
+                    lastUsed: now,
+                    lastSwitchReason: "initial",
+                    rateLimitResetTimes: {},
+                });
+            }
+            if (this.accounts.length > 0) {
+                const defaultIndex = clampNonNegativeInt(stored.activeIndex, 0) % this.accounts.length;
+                for (const family of MODEL_FAMILIES) {
+                    const rawIndex = stored.activeIndexByFamily?.[family];
+                    const nextIndex = clampNonNegativeInt(rawIndex, defaultIndex) % this.accounts.length;
+                    this.currentAccountIndexByFamily[family] = nextIndex;
+                    this.cursorByFamily[family] = nextIndex;
+                }
+            }
+            return;
+        }
+        if (authFallback) {
+            const now = nowMs();
+            this.accounts = [
+                {
+                    index: 0,
+                    accountId: fallbackAccountId,
+                    organizationId: undefined,
+                    accountIdSource: fallbackAccountId ? "token" : undefined,
+                    email: fallbackAccountEmail,
+                    refreshToken: authFallback.refresh,
+                    enabled: true,
+                    access: authFallback.access,
+                    expires: authFallback.expires,
+                    addedAt: now,
+                    lastUsed: 0,
+                    lastSwitchReason: "initial",
+                    rateLimitResetTimes: {},
+                },
+            ];
+            for (const family of MODEL_FAMILIES) {
+                this.currentAccountIndexByFamily[family] = 0;
+                this.cursorByFamily[family] = 0;
+            }
+        }
+    }
+    getAccountCount() {
+        return this.accounts.length;
+    }
+    getActiveIndex() {
+        return this.getActiveIndexForFamily("codex");
+    }
+    getActiveIndexForFamily(family) {
+        const index = this.currentAccountIndexByFamily[family];
+        if (index < 0 || index >= this.accounts.length) {
+            return this.accounts.length > 0 ? 0 : -1;
+        }
+        return index;
+    }
+    getAccountsSnapshot() {
+        return this.accounts.map((account) => ({
+            ...account,
+            rateLimitResetTimes: { ...account.rateLimitResetTimes },
+        }));
+    }
+    getSelectionExplainability(family, model, now = nowMs()) {
+        const quotaKey = model ? `${family}:${model}` : family;
+        const baseQuotaKey = getQuotaKey(family);
+        const modelQuotaKey = model ? getQuotaKey(family, model) : null;
+        const currentIndex = this.currentAccountIndexByFamily[family];
+        const healthTracker = getHealthTracker();
+        const tokenTracker = getTokenTracker();
+        return this.accounts.map((account) => {
+            clearExpiredRateLimits(account);
+            const enabled = account.enabled !== false;
+            const reasons = [];
+            let rateLimitedUntil;
+            const baseRateLimit = account.rateLimitResetTimes[baseQuotaKey];
+            const modelRateLimit = modelQuotaKey ? account.rateLimitResetTimes[modelQuotaKey] : undefined;
+            if (typeof baseRateLimit === "number" && baseRateLimit > now) {
+                rateLimitedUntil = baseRateLimit;
+            }
+            if (typeof modelRateLimit === "number" &&
+                modelRateLimit > now &&
+                (rateLimitedUntil === undefined || modelRateLimit > rateLimitedUntil)) {
+                rateLimitedUntil = modelRateLimit;
+            }
+            const coolingDownUntil = typeof account.coolingDownUntil === "number" && account.coolingDownUntil > now
+                ? account.coolingDownUntil
+                : undefined;
+            if (!enabled)
+                reasons.push("disabled");
+            if (rateLimitedUntil !== undefined)
+                reasons.push("rate-limited");
+            if (coolingDownUntil !== undefined) {
+                reasons.push(account.cooldownReason ? `cooldown:${account.cooldownReason}` : "cooldown");
+            }
+            const tokensAvailable = tokenTracker.getTokens(account.index, quotaKey);
+            if (tokensAvailable < 1)
+                reasons.push("token-bucket-empty");
+            const eligible = enabled &&
+                rateLimitedUntil === undefined &&
+                coolingDownUntil === undefined &&
+                tokensAvailable >= 1;
+            if (reasons.length === 0)
+                reasons.push("eligible");
+            return {
+                index: account.index,
+                enabled,
+                isCurrentForFamily: currentIndex === account.index,
+                eligible,
+                reasons,
+                healthScore: healthTracker.getScore(account.index, quotaKey),
+                tokensAvailable,
+                rateLimitedUntil,
+                coolingDownUntil,
+                cooldownReason: coolingDownUntil !== undefined ? account.cooldownReason : undefined,
+                lastUsed: account.lastUsed,
+            };
+        });
+    }
+    setActiveIndex(index) {
+        if (!Number.isFinite(index))
+            return null;
+        if (index < 0 || index >= this.accounts.length)
+            return null;
+        const account = this.accounts[index];
+        if (!account)
+            return null;
+        if (account.enabled === false)
+            return null;
+        for (const family of MODEL_FAMILIES) {
+            this.currentAccountIndexByFamily[family] = index;
+            this.cursorByFamily[family] = index;
+        }
+        account.lastUsed = nowMs();
+        account.lastSwitchReason = "rotation";
+        return account;
+    }
+    getCurrentAccount() {
+        return this.getCurrentAccountForFamily("codex");
+    }
+    getCurrentAccountForFamily(family) {
+        const index = this.currentAccountIndexByFamily[family];
+        if (index < 0 || index >= this.accounts.length) {
+            return null;
+        }
+        const account = this.accounts[index];
+        if (!account || account.enabled === false) {
+            return null;
+        }
+        return account;
+    }
+    getCurrentOrNext() {
+        return this.getCurrentOrNextForFamily("codex");
+    }
+    getCurrentOrNextForFamily(family, model) {
+        const count = this.accounts.length;
+        if (count === 0)
+            return null;
+        const cursor = this.cursorByFamily[family];
+        for (let i = 0; i < count; i++) {
+            const idx = (cursor + i) % count;
+            const account = this.accounts[idx];
+            if (!account)
+                continue;
+            if (account.enabled === false)
+                continue;
+            clearExpiredRateLimits(account);
+            if (isRateLimitedForFamily(account, family, model) || this.isAccountCoolingDown(account)) {
+                continue;
+            }
+            this.cursorByFamily[family] = (idx + 1) % count;
+            this.currentAccountIndexByFamily[family] = idx;
+            account.lastUsed = nowMs();
+            return account;
+        }
+        return null;
+    }
+    getNextForFamily(family, model) {
+        const count = this.accounts.length;
+        if (count === 0)
+            return null;
+        const cursor = this.cursorByFamily[family];
+        for (let i = 0; i < count; i++) {
+            const idx = (cursor + i) % count;
+            const account = this.accounts[idx];
+            if (!account)
+                continue;
+            if (account.enabled === false)
+                continue;
+            clearExpiredRateLimits(account);
+            if (isRateLimitedForFamily(account, family, model) || this.isAccountCoolingDown(account)) {
+                continue;
+            }
+            this.cursorByFamily[family] = (idx + 1) % count;
+            account.lastUsed = nowMs();
+            return account;
+        }
+        return null;
+    }
+    getCurrentOrNextForFamilyHybrid(family, model, options) {
+        const count = this.accounts.length;
+        if (count === 0)
+            return null;
+        const currentIndex = this.currentAccountIndexByFamily[family];
+        if (currentIndex >= 0 && currentIndex < count) {
+            const currentAccount = this.accounts[currentIndex];
+            if (currentAccount) {
+                if (currentAccount.enabled === false) {
+                    // Fall through to hybrid selection.
+                }
+                else {
+                    clearExpiredRateLimits(currentAccount);
+                    if (!isRateLimitedForFamily(currentAccount, family, model) &&
+                        !this.isAccountCoolingDown(currentAccount)) {
+                        currentAccount.lastUsed = nowMs();
+                        return currentAccount;
+                    }
+                }
+            }
+        }
+        const quotaKey = model ? `${family}:${model}` : family;
+        const healthTracker = getHealthTracker();
+        const tokenTracker = getTokenTracker();
+        const accountsWithMetrics = this.accounts
+            .map((account) => {
+            if (!account)
+                return null;
+            if (account.enabled === false)
+                return null;
+            clearExpiredRateLimits(account);
+            const isAvailable = !isRateLimitedForFamily(account, family, model) && !this.isAccountCoolingDown(account);
+            return {
+                index: account.index,
+                isAvailable,
+                lastUsed: account.lastUsed,
+            };
+        })
+            .filter((a) => a !== null);
+        const selected = selectHybridAccount(accountsWithMetrics, healthTracker, tokenTracker, quotaKey, {}, options);
+        if (!selected)
+            return null;
+        const account = this.accounts[selected.index];
+        if (!account)
+            return null;
+        this.currentAccountIndexByFamily[family] = account.index;
+        this.cursorByFamily[family] = (account.index + 1) % count;
+        account.lastUsed = nowMs();
+        return account;
+    }
+    recordSuccess(account, family, model) {
+        const quotaKey = model ? `${family}:${model}` : family;
+        const healthTracker = getHealthTracker();
+        healthTracker.recordSuccess(account.index, quotaKey);
+    }
+    recordRateLimit(account, family, model) {
+        const quotaKey = model ? `${family}:${model}` : family;
+        const healthTracker = getHealthTracker();
+        const tokenTracker = getTokenTracker();
+        healthTracker.recordRateLimit(account.index, quotaKey);
+        tokenTracker.drain(account.index, quotaKey);
+    }
+    recordFailure(account, family, model) {
+        const quotaKey = model ? `${family}:${model}` : family;
+        const healthTracker = getHealthTracker();
+        healthTracker.recordFailure(account.index, quotaKey);
+    }
+    consumeToken(account, family, model) {
+        const quotaKey = model ? `${family}:${model}` : family;
+        const tokenTracker = getTokenTracker();
+        return tokenTracker.tryConsume(account.index, quotaKey);
+    }
+    /**
+     * Refund a token consumed within the refund window (30 seconds).
+     * Use this when a request fails due to network errors (not rate limits).
+     * @returns true if refund was successful, false if no valid consumption found
+     */
+    refundToken(account, family, model) {
+        const quotaKey = model ? `${family}:${model}` : family;
+        const tokenTracker = getTokenTracker();
+        return tokenTracker.refundToken(account.index, quotaKey);
+    }
+    markSwitched(account, reason, family) {
+        account.lastSwitchReason = reason;
+        this.currentAccountIndexByFamily[family] = account.index;
+    }
+    markRateLimited(account, retryAfterMs, family, model) {
+        this.markRateLimitedWithReason(account, retryAfterMs, family, "unknown", model);
+    }
+    markRateLimitedWithReason(account, retryAfterMs, family, reason, model) {
+        const retryMs = Math.max(0, Math.floor(retryAfterMs));
+        const resetAt = nowMs() + retryMs;
+        const baseKey = getQuotaKey(family);
+        account.rateLimitResetTimes[baseKey] = resetAt;
+        if (model) {
+            const modelKey = getQuotaKey(family, model);
+            account.rateLimitResetTimes[modelKey] = resetAt;
+        }
+        account.lastRateLimitReason = reason;
+    }
+    markAccountCoolingDown(account, cooldownMs, reason) {
+        const ms = Math.max(0, Math.floor(cooldownMs));
+        account.coolingDownUntil = nowMs() + ms;
+        account.cooldownReason = reason;
+    }
+    /**
+     * Mark every in-memory account sharing a refresh token as cooling down.
+     * @returns Number of live accounts updated.
+     */
+    markAccountsWithRefreshTokenCoolingDown(refreshToken, cooldownMs, reason) {
+        const matches = this.accounts.filter((account) => account.refreshToken === refreshToken);
+        for (const account of matches) {
+            this.markAccountCoolingDown(account, cooldownMs, reason);
+        }
+        return matches.length;
+    }
+    isAccountCoolingDown(account) {
+        if (account.coolingDownUntil === undefined)
+            return false;
+        if (nowMs() >= account.coolingDownUntil) {
+            this.clearAccountCooldown(account);
+            return false;
+        }
+        return true;
+    }
+    clearAccountCooldown(account) {
+        delete account.coolingDownUntil;
+        delete account.cooldownReason;
+    }
+    incrementAuthFailures(account) {
+        const currentFailures = this.authFailuresByRefreshToken.get(account.refreshToken) ?? 0;
+        const newFailures = currentFailures + 1;
+        this.authFailuresByRefreshToken.set(account.refreshToken, newFailures);
+        return newFailures;
+    }
+    /**
+     * Clear the authentication failure counter for the given account's refresh token.
+     *
+     * Notes:
+     * - Failure counts are tracked per refresh token (not per account), so this clears
+     *   shared failure state for all org variants that reuse the same token.
+     * - Failure counts are in-memory only for the current AccountManager instance.
+     */
+    clearAuthFailures(account) {
+        this.authFailuresByRefreshToken.delete(account.refreshToken);
+    }
+    shouldShowAccountToast(accountIndex, debounceMs = 30000) {
+        const now = nowMs();
+        if (accountIndex === this.lastToastAccountIndex && now - this.lastToastTime < debounceMs) {
+            return false;
+        }
+        return true;
+    }
+    markToastShown(accountIndex) {
+        this.lastToastAccountIndex = accountIndex;
+        this.lastToastTime = nowMs();
+    }
+    updateFromAuth(account, auth) {
+        const previousRefreshToken = account.refreshToken;
+        account.refreshToken = auth.refresh;
+        account.access = auth.access;
+        account.expires = auth.expires;
+        if (previousRefreshToken !== account.refreshToken) {
+            this.authFailuresByRefreshToken.delete(previousRefreshToken);
+        }
+        const tokenAccountId = extractAccountId(auth.access);
+        if (tokenAccountId &&
+            (shouldUpdateAccountIdFromToken(account.accountIdSource, account.accountId))) {
+            account.accountId = tokenAccountId;
+            account.accountIdSource = "token";
+        }
+        account.email = sanitizeEmail(extractAccountEmail(auth.access)) ?? account.email;
+    }
+    toAuthDetails(account) {
+        return {
+            type: "oauth",
+            access: account.access ?? "",
+            refresh: account.refreshToken,
+            expires: account.expires ?? 0,
+        };
+    }
+    getMinWaitTime() {
+        return this.getMinWaitTimeForFamily("codex");
+    }
+    getMinWaitTimeForFamily(family, model) {
+        const now = nowMs();
+        const enabledAccounts = this.accounts.filter((account) => account.enabled !== false);
+        const available = enabledAccounts.filter((account) => {
+            clearExpiredRateLimits(account);
+            return !isRateLimitedForFamily(account, family, model) && !this.isAccountCoolingDown(account);
+        });
+        if (available.length > 0)
+            return 0;
+        if (enabledAccounts.length === 0)
+            return 0;
+        const waitTimes = [];
+        const baseKey = getQuotaKey(family);
+        const modelKey = model ? getQuotaKey(family, model) : null;
+        for (const account of enabledAccounts) {
+            const baseResetAt = account.rateLimitResetTimes[baseKey];
+            if (typeof baseResetAt === "number") {
+                waitTimes.push(Math.max(0, baseResetAt - now));
+            }
+            if (modelKey) {
+                const modelResetAt = account.rateLimitResetTimes[modelKey];
+                if (typeof modelResetAt === "number") {
+                    waitTimes.push(Math.max(0, modelResetAt - now));
+                }
+            }
+            if (typeof account.coolingDownUntil === "number") {
+                waitTimes.push(Math.max(0, account.coolingDownUntil - now));
+            }
+        }
+        return waitTimes.length > 0 ? Math.min(...waitTimes) : 0;
+    }
+    removeAccount(account) {
+        const idx = this.accounts.indexOf(account);
+        if (idx < 0) {
+            return false;
+        }
+        this.accounts.splice(idx, 1);
+        this.accounts.forEach((acc, index) => {
+            acc.index = index;
+        });
+        if (this.accounts.length === 0) {
+            for (const family of MODEL_FAMILIES) {
+                this.cursorByFamily[family] = 0;
+                this.currentAccountIndexByFamily[family] = -1;
+            }
+            return true;
+        }
+        for (const family of MODEL_FAMILIES) {
+            if (this.cursorByFamily[family] > idx) {
+                this.cursorByFamily[family] = Math.max(0, this.cursorByFamily[family] - 1);
+            }
+        }
+        for (const family of MODEL_FAMILIES) {
+            this.cursorByFamily[family] = this.cursorByFamily[family] % this.accounts.length;
+        }
+        for (const family of MODEL_FAMILIES) {
+            if (this.currentAccountIndexByFamily[family] > idx) {
+                this.currentAccountIndexByFamily[family] -= 1;
+            }
+            if (this.currentAccountIndexByFamily[family] >= this.accounts.length) {
+                this.currentAccountIndexByFamily[family] = -1;
+            }
+        }
+        return true;
+    }
+    removeAccountByIndex(index) {
+        if (!Number.isFinite(index))
+            return false;
+        if (index < 0 || index >= this.accounts.length)
+            return false;
+        const account = this.accounts[index];
+        if (!account)
+            return false;
+        return this.removeAccount(account);
+    }
+    /**
+     * Remove all accounts that share the same refreshToken as the given account.
+     * This is used when auth refresh fails to remove all org variants together.
+     * @returns Number of accounts removed
+     */
+    removeAccountsWithSameRefreshToken(account) {
+        const refreshToken = account.refreshToken;
+        // Snapshot first because removeAccount mutates this.accounts.
+        const accountsToRemove = this.accounts.filter((acc) => acc.refreshToken === refreshToken);
+        let removedCount = 0;
+        for (const accountToRemove of accountsToRemove) {
+            if (this.removeAccount(accountToRemove)) {
+                removedCount++;
+            }
+        }
+        // Clear stale auth failure state for this refresh token
+        this.authFailuresByRefreshToken.delete(refreshToken);
+        return removedCount;
+    }
+    setAccountEnabled(index, enabled) {
+        if (!Number.isFinite(index))
+            return null;
+        if (index < 0 || index >= this.accounts.length)
+            return null;
+        const account = this.accounts[index];
+        if (!account)
+            return null;
+        account.enabled = enabled;
+        return account;
+    }
+    async saveToDisk() {
+        const activeIndexByFamily = {};
+        for (const family of MODEL_FAMILIES) {
+            const raw = this.currentAccountIndexByFamily[family];
+            activeIndexByFamily[family] = clampNonNegativeInt(raw, 0);
+        }
+        const activeIndex = clampNonNegativeInt(activeIndexByFamily.codex, 0);
+        const storage = {
+            version: 3,
+            accounts: this.accounts.map((account) => ({
+                accountId: account.accountId,
+                organizationId: account.organizationId,
+                accountIdSource: account.accountIdSource,
+                accountLabel: account.accountLabel,
+                accountTags: account.accountTags,
+                accountNote: account.accountNote,
+                email: account.email,
+                refreshToken: account.refreshToken,
+                accessToken: account.access,
+                expiresAt: account.expires,
+                enabled: account.enabled === false ? false : undefined,
+                addedAt: account.addedAt,
+                lastUsed: account.lastUsed,
+                lastSwitchReason: account.lastSwitchReason,
+                rateLimitResetTimes: Object.keys(account.rateLimitResetTimes).length > 0 ? account.rateLimitResetTimes : undefined,
+                coolingDownUntil: account.coolingDownUntil,
+                cooldownReason: account.cooldownReason,
+            })),
+            activeIndex,
+            activeIndexByFamily,
+        };
+        await saveAccounts(storage);
+    }
+    saveToDiskDebounced(delayMs = 500) {
+        if (this.saveDebounceTimer) {
+            clearTimeout(this.saveDebounceTimer);
+        }
+        this.saveDebounceTimer = setTimeout(() => {
+            this.saveDebounceTimer = null;
+            const doSave = async () => {
+                try {
+                    if (this.pendingSave) {
+                        await this.pendingSave;
+                    }
+                    this.pendingSave = this.saveToDisk().finally(() => {
+                        this.pendingSave = null;
+                    });
+                    await this.pendingSave;
+                }
+                catch (error) {
+                    log.warn("Debounced save failed", { error: error instanceof Error ? error.message : String(error) });
+                }
+            };
+            void doSave();
+        }, delayMs);
+    }
+    async flushPendingSave() {
+        if (this.saveDebounceTimer) {
+            clearTimeout(this.saveDebounceTimer);
+            this.saveDebounceTimer = null;
+            await this.saveToDisk();
+        }
+        if (this.pendingSave) {
+            await this.pendingSave;
+        }
+    }
+}
+export function formatAccountLabel(account, index) {
+    const accountLabel = account?.accountLabel?.trim();
+    const email = account?.email?.trim();
+    const accountId = account?.accountId?.trim();
+    const idSuffix = accountId ? (accountId.length > 6 ? accountId.slice(-6) : accountId) : null;
+    if (accountLabel && email && idSuffix) {
+        return `Account ${index + 1} (${accountLabel}, ${email}, id:${idSuffix})`;
+    }
+    if (accountLabel && email)
+        return `Account ${index + 1} (${accountLabel}, ${email})`;
+    if (accountLabel && idSuffix)
+        return `Account ${index + 1} (${accountLabel}, id:${idSuffix})`;
+    if (accountLabel)
+        return `Account ${index + 1} (${accountLabel})`;
+    if (email && idSuffix)
+        return `Account ${index + 1} (${email}, id:${idSuffix})`;
+    if (email)
+        return `Account ${index + 1} (${email})`;
+    if (idSuffix)
+        return `Account ${index + 1} (${idSuffix})`;
+    return `Account ${index + 1}`;
+}
+export function formatCooldown(account, now = nowMs()) {
+    if (typeof account.coolingDownUntil !== "number")
+        return null;
+    const remaining = account.coolingDownUntil - now;
+    if (remaining <= 0)
+        return null;
+    const reason = account.cooldownReason ? ` (${account.cooldownReason})` : "";
+    return `${formatWaitTime(remaining)}${reason}`;
+}
+//# sourceMappingURL=accounts.js.map