fix: harden rate-limit and wrapper recovery

Author: ndycode

index.ts

@@ -1858,16 +1858,18 @@ export const OpenAIOAuthPlugin: Plugin = async ({ client }: PluginInput) => {
 													break;
 												}
 
-												if (rateLimit) {
+												if (response.status === 429) {
 													runtimeMetrics.rateLimitedResponses++;
+													const retryAfterMs =
+														rateLimit?.retryAfterMs ?? 60_000;
 													const { attempt, delayMs } = getRateLimitBackoff(
 														account.index,
 														quotaKey,
-														rateLimit.retryAfterMs,
+														retryAfterMs,
 													);
 													const cooldownMs = Math.max(
 														delayMs,
-														rateLimit.retryAfterMs,
+														retryAfterMs,
 													);
 													preemptiveQuotaScheduler.markRateLimited(
 														quotaScheduleKey,
@@ -1900,7 +1902,7 @@ export const OpenAIOAuthPlugin: Plugin = async ({ client }: PluginInput) => {
 														account,
 														cooldownMs,
 														modelFamily,
-														parseRateLimitReason(rateLimit.code),
+														parseRateLimitReason(rateLimit?.code),
 														model,
 													);
 													accountManager.recordRateLimit(
@@ -2183,6 +2185,7 @@ export const OpenAIOAuthPlugin: Plugin = async ({ client }: PluginInput) => {
 																			modelFamily,
 																			model,
 																		);
+																		accountManager.saveToDiskDebounced();
 																	} else {
 																		accountManager.recordFailure(
 																			fallbackAccount,

lib/config.ts

@@ -481,7 +481,7 @@ async function readConfigRecordForSave(
 				return { status: "invalid", errorMessage };
 			}
 			return { status: "ok", record: parsed };
-		} catch (error) {
+	} catch (error) {
 			const code = (error as NodeJS.ErrnoException | undefined)?.code;
 			if (code === "ENOENT") {
 				return { status: "missing" };
@@ -498,7 +498,10 @@ async function readConfigRecordForSave(
 				error instanceof Error ? error.message : String(error)
 			}`;
 			logConfigWarnOnce(errorMessage);
-			if (typeof code === "string" && RETRYABLE_CONFIG_READ_CODES.has(code)) {
+			if (error instanceof SyntaxError) {
+				return { status: "invalid", errorMessage };
+			}
+			if (typeof code === "string") {
 				return { status: "unreadable", errorMessage };
 			}
 			return { status: "invalid", errorMessage };

lib/request/fetch-helpers.ts

@@ -1240,6 +1240,13 @@ function parseRetryAfterMs(
 		if (normalized !== null) {
 			return normalized;
 		}
+		const parsedDate = Date.parse(retryAfterHeader);
+		if (Number.isFinite(parsedDate)) {
+			const normalizedDate = normalizeRetryAfterMs(parsedDate - Date.now());
+			if (normalizedDate !== null) {
+				return normalizedDate;
+			}
+		}
 	}
 
 	const resetAfterSecondsHeaders = [

lib/storage/flagged-storage-io.ts

@@ -4,6 +4,25 @@ import type { FlaggedAccountStorageV1 } from "../storage.js";
 
 const RETRYABLE_UNLINK_CODES = new Set(["EBUSY", "EAGAIN", "EPERM"]);
 
+function isValidFlaggedStorageCandidate(
+	data: unknown,
+	storage: FlaggedAccountStorageV1,
+): boolean {
+	if (
+		!data ||
+		typeof data !== "object" ||
+		!Object.hasOwn(data, "version") ||
+		!Object.hasOwn(data, "accounts")
+	) {
+		return false;
+	}
+	const candidate = data as { version?: unknown; accounts?: unknown };
+	if (candidate.version !== 1 || !Array.isArray(candidate.accounts)) {
+		return false;
+	}
+	return candidate.accounts.length === 0 || storage.accounts.length > 0;
+}
+
 /**
  * Return the ordered backup paths consulted for flagged-account recovery.
  */
@@ -55,6 +74,13 @@ export async function loadFlaggedAccountsState(params: {
 				const backupContent = await fs.readFile(backupPath, "utf-8");
 				const backupData = JSON.parse(backupContent) as unknown;
 				const recovered = params.normalizeFlaggedStorage(backupData);
+				if (!isValidFlaggedStorageCandidate(backupData, recovered)) {
+					params.logError("Skipping invalid flagged account backup payload", {
+						from: backupPath,
+						to: params.path,
+					});
+					continue;
+				}
 				if (existsSync(params.resetMarkerPath)) {
 					return empty;
 				}
@@ -79,6 +105,9 @@ export async function loadFlaggedAccountsState(params: {
 		const content = await fs.readFile(params.path, "utf-8");
 		const data = JSON.parse(content) as unknown;
 		const loaded = params.normalizeFlaggedStorage(data);
+		if (!isValidFlaggedStorageCandidate(data, loaded)) {
+			throw new Error("Invalid flagged account storage payload");
+		}
 		if (existsSync(params.resetMarkerPath)) {
 			return empty;
 		}

lib/unified-settings.ts

@@ -68,10 +68,14 @@ function parseSettingsRecord(content: string): JsonRecord {
  * cannot be parsed into the expected object shape.
  */
 function readSettingsRecordSyncFromPath(filePath: string): JsonRecord | null {
-	if (!existsSync(filePath)) {
-		return null;
+	try {
+		return parseSettingsRecord(readFileSync(filePath, "utf8"));
+	} catch (error) {
+		if ((error as NodeJS.ErrnoException | undefined)?.code === "ENOENT") {
+			return null;
+		}
+		throw error;
 	}
-	return parseSettingsRecord(readFileSync(filePath, "utf8"));
 }
 
 /**
@@ -80,10 +84,14 @@ function readSettingsRecordSyncFromPath(filePath: string): JsonRecord | null {
 async function readSettingsRecordAsyncFromPath(
 	filePath: string,
 ): Promise<JsonRecord | null> {
-	if (!existsSync(filePath)) {
-		return null;
+	try {
+		return parseSettingsRecord(await fs.readFile(filePath, "utf8"));
+	} catch (error) {
+		if ((error as NodeJS.ErrnoException | undefined)?.code === "ENOENT") {
+			return null;
+		}
+		throw error;
 	}
-	return parseSettingsRecord(await fs.readFile(filePath, "utf8"));
 }
 
 /**

scripts/codex.js

@@ -7,6 +7,7 @@ import {
 	existsSync,
 	mkdirSync,
 	mkdtempSync,
+	renameSync,
 	readFileSync,
 	rmSync,
 	statSync,
@@ -215,6 +216,47 @@ const REASONING_FALLBACKS = {
 };
 
 const KNOWN_REASONING_EFFORTS = new Set(Object.keys(REASONING_FALLBACKS));
+const REQUESTED_MODEL_ALIASES = new Map();
+
+function addRequestedModelAlias(alias, normalizedModel) {
+	REQUESTED_MODEL_ALIASES.set(alias, normalizedModel);
+}
+
+function addRequestedModelReasoningAliases(alias, normalizedModel) {
+	addRequestedModelAlias(alias, normalizedModel);
+	for (const effort of KNOWN_REASONING_EFFORTS) {
+		addRequestedModelAlias(`${alias}-${effort}`, normalizedModel);
+	}
+}
+
+function seedRequestedModelAliases() {
+	addRequestedModelReasoningAliases("gpt-5.4", "gpt-5.4");
+	addRequestedModelReasoningAliases("gpt-5.4-pro", "gpt-5.4-pro");
+	addRequestedModelReasoningAliases("gpt-5.2-pro", "gpt-5.2-pro");
+	addRequestedModelReasoningAliases("gpt-5-pro", "gpt-5-pro");
+	addRequestedModelReasoningAliases("gpt-5.2", "gpt-5.2");
+	addRequestedModelReasoningAliases("gpt-5.1", "gpt-5.1");
+	addRequestedModelReasoningAliases("gpt-5", "gpt-5");
+	addRequestedModelReasoningAliases("gpt-5-mini", "gpt-5-mini");
+	addRequestedModelReasoningAliases("gpt-5-nano", "gpt-5-nano");
+	addRequestedModelReasoningAliases("gpt-5.1-chat-latest", "gpt-5.1");
+	addRequestedModelReasoningAliases("gpt-5-chat-latest", "gpt-5");
+	addRequestedModelReasoningAliases("gpt-5.4-mini", "gpt-5-mini");
+	addRequestedModelReasoningAliases("gpt-5.4-nano", "gpt-5-nano");
+	addRequestedModelReasoningAliases("gpt-5-codex", "gpt-5-codex");
+	addRequestedModelReasoningAliases("gpt-5.3-codex-spark", "gpt-5-codex");
+	addRequestedModelReasoningAliases("gpt-5.3-codex", "gpt-5-codex");
+	addRequestedModelReasoningAliases("gpt-5.2-codex", "gpt-5-codex");
+	addRequestedModelReasoningAliases("gpt-5.1-codex", "gpt-5-codex");
+	addRequestedModelAlias("gpt_5_codex", "gpt-5-codex");
+	addRequestedModelReasoningAliases("codex-max", "gpt-5.1-codex-max");
+	addRequestedModelReasoningAliases("gpt-5.1-codex-max", "gpt-5.1-codex-max");
+	addRequestedModelAlias("codex-mini-latest", "gpt-5.1-codex-mini");
+	addRequestedModelReasoningAliases("gpt-5-codex-mini", "gpt-5.1-codex-mini");
+	addRequestedModelReasoningAliases("gpt-5.1-codex-mini", "gpt-5.1-codex-mini");
+}
+
+seedRequestedModelAliases();
 
 function stripProviderPrefix(model) {
 	return typeof model === "string" && model.includes("/")
@@ -226,6 +268,10 @@ function normalizeRequestedModel(model) {
 	const stripped = stripProviderPrefix(model ?? "");
 	const normalized = stripped.trim().toLowerCase();
 	if (normalized.length === 0) return "";
+	const exactMatch = REQUESTED_MODEL_ALIASES.get(normalized);
+	if (exactMatch) {
+		return exactMatch;
+	}
 
 	if (
 		normalized.includes("gpt-5.1-codex-max") ||
@@ -442,6 +488,47 @@ function ensureTrailingNewline(value) {
 	return value.endsWith("\n") ? value : `${value}\n`;
 }
 
+function captureShadowHomeState(filePath) {
+	try {
+		if (!existsSync(filePath)) {
+			return { exists: false, content: null };
+		}
+		return {
+			exists: true,
+			content: readFileSync(filePath, "utf8"),
+		};
+	} catch {
+		return { exists: true, content: null, unreadable: true };
+	}
+}
+
+function shadowHomeStateMatches(left, right) {
+	return (
+		left.exists === right.exists &&
+		left.content === right.content &&
+		Boolean(left.unreadable) === Boolean(right.unreadable)
+	);
+}
+
+function syncShadowHomeStateFile(sourcePath, destinationPath) {
+	const tempPath = join(
+		dirname(destinationPath),
+		`.${basename(destinationPath)}.codex-multi-auth-sync-${process.pid}.tmp`,
+	);
+	try {
+		mkdirSync(dirname(destinationPath), { recursive: true });
+		copyFileSync(sourcePath, tempPath);
+		renameSync(tempPath, destinationPath);
+	} catch (error) {
+		try {
+			rmSync(tempPath, { force: true });
+		} catch {
+			// Best-effort cleanup only.
+		}
+		throw error;
+	}
+}
+
 function rewriteConfigTomlReasoningEffort(rawConfig, requestedModel) {
 	const lineEnding = rawConfig.includes("\r\n") ? "\r\n" : "\n";
 	let changed = false;
@@ -503,6 +590,12 @@ function createCompatibilityCodexHome(
 	if (!existsSync(configPath)) {
 		return { args: processedArgs, env: baseEnv, cleanup: undefined };
 	}
+	const originalShadowHomeState = new Map(
+		SHADOW_HOME_STATE_FILES.map((name) => [
+			name,
+			captureShadowHomeState(join(originalCodexHome, name)),
+		]),
+	);
 
 	const rawConfig = readFileSync(configPath, "utf8");
 	const compatConfig = rewriteConfigTomlReasoningEffort(
@@ -531,20 +624,23 @@ function createCompatibilityCodexHome(
 	const syncShadowHomeStateBack = () => {
 		for (const name of SHADOW_HOME_STATE_FILES) {
 			const shadowPath = join(shadowCodexHome, name);
-			if (!existsSync(shadowPath)) {
+			const shadowState = captureShadowHomeState(shadowPath);
+			if (!shadowState.exists || shadowState.unreadable) {
 				continue;
 			}
 
 			try {
-				const shadowStats = statSync(shadowPath);
 				const originalPath = join(originalCodexHome, name);
-				if (existsSync(originalPath)) {
-					const originalStats = statSync(originalPath);
-					if (originalStats.isFile() && originalStats.mtimeMs > shadowStats.mtimeMs) {
-						continue;
-					}
+				const originalSnapshot =
+					originalShadowHomeState.get(name) ?? { exists: false, content: null };
+				const currentOriginalState = captureShadowHomeState(originalPath);
+				if (!shadowHomeStateMatches(currentOriginalState, originalSnapshot)) {
+					continue;
+				}
+				if (shadowHomeStateMatches(shadowState, originalSnapshot)) {
+					continue;
 				}
-				copyFileSync(shadowPath, originalPath);
+				syncShadowHomeStateFile(shadowPath, originalPath);
 				tightenShadowHomePermissions(originalPath);
 			} catch {
 				// Best-effort only; runtime auth refreshes should not fail cleanup.