oc-codex-multi-auth 6.14.1 → 6.14.3

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAMH,OAAO,KAAK,EAAE,MAAM,EAAe,MAAM,qBAAqB,CAAC;AA2V/D;;;;;;;;;;;;;;;GAeG;AAEH,eAAO,MAAM,iBAAiB,EAAE,MAq5H/B,CAAC;AAEF,eAAO,MAAM,gBAAgB,QAAoB,CAAC;AAElD,eAAe,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAMH,OAAO,KAAK,EAAE,MAAM,EAAe,MAAM,qBAAqB,CAAC;AAsU/D;;;;;;;;;;;;;;;GAeG;AAEH,eAAO,MAAM,iBAAiB,EAAE,MAq8H/B,CAAC;AAEF,eAAO,MAAM,gBAAgB,QAAoB,CAAC;AAElD,eAAe,iBAAiB,CAAC"}

package/dist/index.js

@@ -103,27 +103,14 @@ function isLoopbackGatewayHost(hostname) {
     }
     return LOOPBACK_GATEWAY_HOSTS.has(hostname);
 }
-/**
- * Stable per-account identity for the terminal-error diagnostics counters.
- *
- * `account.index` is not usable here: `AccountManager.removeAccount` reindexes
- * the survivors, so an index recorded before a mid-traversal removal silently
- * refers to a different account afterwards. The model-pool identity survives
- * that reindex; the refresh token is the last-resort fallback for records that
- * have not resolved an account id yet.
- */
+/** Stable per-seat identity used only for in-memory traversal diagnostics. */
 function getAccountDiagnosticsKey(account) {
-    return getModelPoolAccountKey(account) ?? `refresh:${account.refreshToken}`;
-}
-/**
- * How many live accounts the configured pool keys actually resolve to.
- *
- * Pool keys and accounts are not 1:1 — a legacy `accountId` key matches every
- * Business seat in that workspace, and two keys can resolve to the same seat —
- * so pool size must be counted over accounts, never over `poolKeys.length`.
- */
-function countResolvedPoolAccounts(accounts, poolKeys) {
-    return accounts.filter((account) => poolKeys.some((key) => matchesModelPoolAccountKey(account, key))).length;
+    return JSON.stringify([
+        getModelPoolAccountKey(account) ?? "unresolved",
+        account.organizationId ?? null,
+        account.email ?? null,
+        account.addedAt,
+    ]);
 }
 /** Configured pool keys matching no live account (typo, or account removed). */
 function countUnresolvedPoolKeys(accounts, poolKeys) {
@@ -442,26 +429,43 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
      * Take an account out of rotation whenever the backend reports one of its
      * quota windows as fully spent (issue #218).
      *
-     * Every Codex response — success or 429 — carries `x-codex-*-used-percent`
-     * and the matching reset time, so the moment an account hits 0% left we
-     * can record it instead of rediscovering it with a failed request on every
-     * subsequent prompt. The block lands on the persisted `rateLimitResetTimes`
-     * map, so it is remembered across restarts and shared with other processes,
-     * and it clears itself once the window rolls over.
+     * Codex carries `x-codex-*-used-percent` and the matching reset time on a
+     * served request and on a refused one alike, so the moment an account hits
+     * 0% left we can record it instead of rediscovering it with a failed request
+     * on every subsequent prompt. The block lands on the persisted
+     * `rateLimitResetTimes` map, so it is remembered across restarts and shared
+     * with other processes, and it clears itself once the window rolls over.
+     *
+     * Call this only for responses whose headers are authoritative: one the
+     * backend served, or one it refused for a confirmed usage limit. Every other
+     * error class — entitlement (issues #16/#17), auth, 5xx, or an upstream
+     * overload dressed up as a 429 — can echo a stale quota snapshot next to an
+     * unrelated failure, and writing that echo locked healthy accounts out for
+     * hours. `handleErrorResponse` makes that call once and reports it back as
+     * `quotaHeadersAuthoritative`.
+     *
+     * The resulting gap is deliberate: an account that really is spent but gets
+     * a 5xx stays selectable until its next genuine 429, which costs one wasted
+     * request — cheaper than a false multi-hour block on a healthy account.
+     *
+     * @returns true when the headers report a spent window, whether or not the
+     *   stored block moved. Callers use it to stop retrying this account.
      */
     const applyQuotaExhaustion = (manager, headers, account, family, model) => {
         try {
             const resetAtMs = getQuotaExhaustedResetAtMs(headers);
             if (resetAtMs === undefined)
-                return;
+                return false;
             if (!manager.markQuotaExhausted(account, resetAtMs, family, model))
-                return;
+                return true;
             account.lastSwitchReason = "rate-limit";
             manager.saveToDiskDebounced();
             logWarn(`Account ${account.index + 1} (${account.email ?? "unknown"}) has no ${family} quota left; skipping it for ${formatWaitTime(resetAtMs - Date.now())}.`);
+            return true;
         }
         catch (error) {
             logDebug(`[${PLUGIN_NAME}] Failed to apply quota exhaustion: ${error instanceof Error ? error.message : String(error)}`);
+            return false;
         }
     };
     const resolveActiveIndex = (storage, family = "codex") => {
@@ -1610,9 +1614,9 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                 while (true) {
                                     let accountCount = accountManager.getAccountCount();
                                     const attempted = new Set();
-                                    // Diagnostics for the terminal error message below. Keyed on a stable
-                                    // account identity, not `account.index`, so the two `attempted.clear()`
-                                    // sites that follow a mid-traversal account removal cannot desync them.
+                                    // Diagnostics for the terminal error message below. The composite key keeps
+                                    // legacy Business seats distinct and can also be compared with snapshots
+                                    // after a mid-traversal account removal.
                                     // Deliberately scoped to this traversal: a fallback restart re-enters
                                     // the loop with a different model, and the message names that model.
                                     const fetchedAccountKeys = new Set();
@@ -1950,17 +1954,27 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                                 latencyMs: fetchLatencyMs,
                                                 headers: Object.fromEntries(response.headers.entries()),
                                             });
-                                            void recordPromptQuotaHeaders(response, account, accountCount);
-                                            applyQuotaExhaustion(accountManager, response.headers, account, modelFamily, model);
-                                            if (!response.ok) {
+                                            // The TUI snapshot and the durable rotation block read the same
+                                            // `x-codex-*` headers, so they share one authority decision — gating
+                                            // only the block would leave the status line reporting "0% left" for
+                                            // an account the router considers healthy.
+                                            const recordQuotaHeaders = () => {
+                                                void recordPromptQuotaHeaders(response, account, accountCount);
+                                                return applyQuotaExhaustion(accountManager, response.headers, account, modelFamily, model);
+                                            };
+                                            if (response.ok) {
+                                                recordQuotaHeaders();
+                                            }
+                                            else {
                                                 const contextOverflowResult = await handleContextOverflow(response, model);
                                                 if (contextOverflowResult.handled) {
                                                     return contextOverflowResult.response;
                                                 }
-                                                const { response: errorResponse, rateLimit, errorBody, retryAsServerError } = await handleErrorResponse(response, {
+                                                const { response: errorResponse, rateLimit, errorBody, retryAsServerError, quotaHeadersAuthoritative, } = await handleErrorResponse(response, {
                                                     requestCorrelationId,
                                                     threadId: threadIdCandidate,
                                                 });
+                                                const quotaExhausted = quotaHeadersAuthoritative === true && recordQuotaHeaders();
                                                 const workspaceDeactivated = isDeactivatedWorkspaceError(errorBody, response.status);
                                                 if (workspaceDeactivated) {
                                                     const accountLabel = formatAccountLabel(account, account.index, {
@@ -2203,7 +2217,12 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                                     runtimeMetrics.rateLimitedResponses++;
                                                     const { attempt, delayMs } = getRateLimitBackoff(account.index, quotaKey, rateLimit.retryAfterMs);
                                                     const waitLabel = formatWaitTime(delayMs);
-                                                    if (delayMs <= RATE_LIMIT_SHORT_RETRY_THRESHOLD_MS &&
+                                                    // A spent window will still be spent in a second, and the block
+                                                    // just written for it is monotonic — a short retry that happened
+                                                    // to succeed could not walk it back, so the account would serve
+                                                    // traffic while rotation still considers it blocked. Rotate.
+                                                    if (!quotaExhausted &&
+                                                        delayMs <= RATE_LIMIT_SHORT_RETRY_THRESHOLD_MS &&
                                                         consumeRetryBudget("rateLimitShort", `Short 429 retry for account ${account.index + 1} after ${delayMs}ms`)) {
                                                         if (accountManager.shouldShowAccountToast(account.index, rateLimitToastDebounceMs)) {
                                                             await showToast(`Rate limited. Retrying in ${waitLabel} (attempt ${attempt})...`, "warning", { duration: toastDurationMs });
@@ -2384,10 +2403,11 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                     if (strictAccountPool) {
                                         const poolWaitMs = accountManager.getMinWaitTimeForFamily(modelFamily, model, preferredAccountIds);
                                         const effectiveModel = model ?? requestedModel ?? "requested model";
-                                        const poolAccounts = accountManager.getAccountsSnapshot();
-                                        const poolAccountCount = countResolvedPoolAccounts(poolAccounts, preferredAccountIds);
-                                        const unresolvedKeyCount = countUnresolvedPoolKeys(poolAccounts, preferredAccountIds);
-                                        const unavailableCount = Math.max(0, poolAccountCount - attemptedCount);
+                                        const accountSnapshot = accountManager.getAccountsSnapshot();
+                                        const poolAccounts = accountSnapshot.filter((account) => preferredAccountIds.some((key) => matchesModelPoolAccountKey(account, key)));
+                                        const poolAccountCount = poolAccounts.length;
+                                        const unresolvedKeyCount = countUnresolvedPoolKeys(accountSnapshot, preferredAccountIds);
+                                        const unavailableCount = poolAccounts.filter((account) => !fetchedAccountKeys.has(getAccountDiagnosticsKey(account))).length;
                                         const waitDetail = poolWaitMs > 0
                                             ? ` Try again in ${formatWaitTime(poolWaitMs)}.`
                                             : " Check the pooled accounts with `codex-health`.";
@@ -2431,7 +2451,14 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                     }
                                     const waitMs = accountManager.getMinWaitTimeForFamily(modelFamily, model);
                                     const count = accountManager.getAccountCount();
-                                    const unavailableCount = Math.max(0, count - attemptedCount);
+                                    // Counted over the accounts that are still live rather than as
+                                    // `count - attemptedCount`: an account removed mid-traversal was
+                                    // genuinely attempted but is no longer one of the `count`
+                                    // configured accounts, and that arithmetic would hide a live
+                                    // account that never got a turn.
+                                    const unavailableCount = accountManager
+                                        .getAccountsSnapshot()
+                                        .filter((account) => !fetchedAccountKeys.has(getAccountDiagnosticsKey(account))).length;
                                     if (retryAllAccountsRateLimited &&
                                         count > 0 &&
                                         waitMs > 0 &&