@bitkyc08/opencodex 2.10.0 → 2.10.1

package/src/codex/auth-context.ts

@@ -6,11 +6,13 @@ import {
   getValidCodexToken,
   isCodexAccountGenerationLive,
 } from "./account-store";
+import { isAccountNeedsReauth, markAccountNeedsReauth } from "./account-runtime-state";
+import { isCodexAccountPaused } from "./account-pause";
 import { ConfigMutationLockError } from "../config";
-import { markAccountNeedsReauth } from "./account-runtime-state";
 import { isCodexAccountUsable } from "./account-usability";
 import { reconcileMainCodexAccountRuntimeState } from "./account-lifecycle";
 import { MAIN_CODEX_ACCOUNT_ID, getMainAccountToken } from "./main-account";
+import { isNativeMainTrafficBlocked } from "./native-profile-startup";
 import {
   codexQuotaScopeForModel,
   getCodexQuotaHealthSnapshot,
@@ -38,6 +40,8 @@ export type CodexAuthContext =
       generation: number;
       accessToken: string;
       chatgptAccountId: string;
+      /** Bypass Pool selection and suppress quota/transient failover for an exact selector. */
+      fixedAccount?: boolean;
       /**
        * Set when this request was admitted through an active quota cooldown as
        * the account's single probe. Must be echoed into the upstream outcome so
@@ -57,6 +61,8 @@ export type CodexAuthContext =
       writerGeneration: number;
       accessToken: string;
       chatgptAccountId: string;
+      /** Bypass Pool selection and suppress quota/transient failover for an exact selector. */
+      fixedAccount?: boolean;
       /** See `pool.probeLeaseId`. */
       probeLeaseId?: string;
       quotaScope?: CodexQuotaScope;
@@ -100,12 +106,26 @@ export class CodexAuthContextError extends Error {
 }
 
 export class CodexPoolAuthenticationError extends Error {
-  constructor() {
-    super("OpenAI account pool has no usable account credential");
+  constructor(message = "OpenAI account pool has no usable account credential") {
+    super(message);
     this.name = "CodexPoolAuthenticationError";
   }
 }
 
+export class CodexMainProfileDrainingError extends Error {
+  constructor() {
+    super("Native Codex main profile is switching; retry this request");
+    this.name = "CodexMainProfileDrainingError";
+  }
+}
+
+export function codexMainProfileDrainingResponse(): Response {
+  const response = formatErrorResponse(503, "server_busy", "Native Codex main profile is switching; retry this request");
+  const headers = new Headers(response.headers);
+  headers.set("Retry-After", "1");
+  return new Response(response.body, { status: response.status, headers });
+}
+
 export class CodexDirectAuthenticationError extends Error {
   constructor() {
     super("Codex Direct requires a caller Authorization bearer token");
@@ -154,22 +174,31 @@ export function cooldownAccountLabel(accountId: string): string {
  * as HTTP. The bare "cooling down" string left users with no route but commenting out the
  * injected `openai_base_url` in config.toml.
  */
-export function cooldownErrorMessage(err: CodexAccountCooldownError): string {
+export function cooldownErrorMessage(err: CodexAccountCooldownError, accountSelector?: string): string {
   const until = new Date(err.cooldownUntil).toISOString();
   const scope = err.quotaScope === "spark"
     ? "Spark quota"
     : err.quotaScope === "shared"
       ? "shared native quota"
       : null;
-  return `Selected Codex account (${cooldownAccountLabel(err.accountId)})${scope ? ` ${scope} is` : " is"} cooling down until ${until}`
-    + ` (source: ${err.cooldownSource ?? "default"}).`
-    + ` Run 'ocx account list openai' to find the id, then`
-    + ` 'ocx account clear-cooldown openai <id>' to lift it, or switch accounts with 'ocx account use openai <id>'.`;
+  const selected = accountSelector
+    ? `Selected Codex account selector (${accountSelector})`
+    : `Selected Codex account (${cooldownAccountLabel(err.accountId)})`;
+  const recovery = accountSelector
+    ? " This request is pinned to that selector and will not switch accounts; choose another account-qualified model or retry later."
+    : " Run 'ocx account list openai' to find the id, then"
+      + " 'ocx account clear-cooldown openai <id>' to lift it, or switch accounts with 'ocx account use openai <id>'.";
+  return `${selected}${scope ? ` ${scope} is` : " is"} cooling down until ${until}`
+    + ` (source: ${err.cooldownSource ?? "default"}).${recovery}`;
 }
 
 /** HTTP form of {@link cooldownErrorMessage}, carrying Retry-After for well-behaved clients. */
-export function cooldownErrorResponse(err: CodexAccountCooldownError, now = Date.now()): Response {
-  const res = formatErrorResponse(429, "rate_limit_error", cooldownErrorMessage(err));
+export function cooldownErrorResponse(
+  err: CodexAccountCooldownError,
+  now = Date.now(),
+  accountSelector?: string,
+): Response {
+  const res = formatErrorResponse(429, "rate_limit_error", cooldownErrorMessage(err, accountSelector));
   const headers = new Headers(res.headers);
   headers.set("Retry-After", String(Math.max(1, Math.ceil((err.cooldownUntil - now) / 1000))));
   return new Response(res.body, { status: res.status, headers });
@@ -195,8 +224,22 @@ export function shouldMarkAccountNeedsReauthForCodexAuthFailure(cause: unknown):
 
 export interface ResolveCodexAuthContextOptions {
   excludeAccountId?: string;
+  /** Resolve exactly this account without consulting or mutating Pool selection. */
+  accountId?: string;
   /** Final native model selected for this request, used to select its quota group. */
   modelId?: string;
+  /** Short reservation converted to turn ownership before native `__main__` token materialization. */
+  beginCodexAccountSelection?: () => CodexAccountSelectionAdmission | undefined;
+  /** Test-only native credential read seams. */
+  isMainAccountTokenLive?: () => boolean;
+  getMainAccountToken?: typeof getMainAccountToken;
+  primeCodexPoolQuotas?: (config: OcxConfig, reason: string) => Promise<void>;
+}
+
+export interface CodexAccountSelectionAdmission {
+  readonly mainProfileDraining: boolean;
+  claimMainProfile(): boolean;
+  release(): void;
 }
 
 export async function resolveCodexAuthContext(
@@ -206,33 +249,106 @@ export async function resolveCodexAuthContext(
   options: ResolveCodexAuthContextOptions = {},
 ): Promise<CodexAuthContext> {
   const writerGeneration = captureConfigGeneration();
-  if (mode === "direct") {
+  const fixedAccountId = options.accountId;
+  if (fixedAccountId !== undefined && options.excludeAccountId !== undefined) {
+    throw new Error("Codex auth context cannot select and exclude an account simultaneously");
+  }
+  // An explicit namespace binding is stronger than the provider's default mode. It must use the
+  // selected stored credential even while the canonical OpenAI provider is globally Direct.
+  if (mode === "direct" && fixedAccountId === undefined) {
     if (!hasCallerCodexBearer(headers)) throw new CodexDirectAuthenticationError();
     return { kind: "main", accountId: null };
   }
-  reconcileMainCodexAccountRuntimeState();
-  const threadId = headers.get("x-codex-parent-thread-id");
+  // Retained startup recovery makes the physical main identity ineligible. Routing
+  // can still preserve service by selecting a healthy configured pool account.
+  const nativeMainTrafficBlocked = isNativeMainTrafficBlocked();
+  const selectionAdmission = options.beginCodexAccountSelection?.();
+  const nativeMainReadsForbidden = nativeMainTrafficBlocked || selectionAdmission?.mainProfileDraining === true;
+  const selectionOptions = {
+    // Temporary switch drain keeps the candidate until the atomic claim rejects
+    // it. Retained recovery makes main wholly ineligible so pool routing continues.
+    nativeMainSelectionOnly: !nativeMainTrafficBlocked
+      && selectionAdmission?.mainProfileDraining === true,
+    isMainAccountTokenLive: options.isMainAccountTokenLive,
+  };
+  let accountId: string;
   const quotaScope = codexQuotaScopeForModel(options.modelId);
-  const resolution = options.excludeAccountId
-    ? (() => {
-        const accountId = pickAlternateCodexAccount(config, options.excludeAccountId!, Date.now(), quotaScope);
-        return accountId
-          ? { status: "selected" as const, accountId }
-          : { status: "none" as const };
-      })()
-    : resolveCodexAccountForThreadDetailed(threadId, config, Date.now(), quotaScope);
-  if (resolution.status === "expired") throw new CodexThreadAffinityExpiredError(resolution.accountId);
-  let accountId = resolution.status === "selected" ? resolution.accountId : null;
-  if (!accountId) throw new CodexPoolAuthenticationError();
+  try {
+    // A pre-drain selector reserves the native identity while reconciliation and
+    // routing inspect it. Selectors arriving after the fence skip reconciliation
+    // and may still route to non-main pool accounts without touching switch state.
+    if (!nativeMainReadsForbidden) reconcileMainCodexAccountRuntimeState();
+    const threadId = headers.get("x-codex-parent-thread-id");
+    const resolution = fixedAccountId !== undefined
+      ? { status: "selected" as const, accountId: fixedAccountId }
+      : options.excludeAccountId
+      ? (() => {
+          const selected = pickAlternateCodexAccount(
+            config,
+            options.excludeAccountId!,
+            Date.now(),
+            quotaScope,
+            selectionOptions,
+          );
+          return selected
+            ? { status: "selected" as const, accountId: selected }
+            : { status: "none" as const };
+        })()
+      : resolveCodexAccountForThreadDetailed(threadId, config, Date.now(), quotaScope, selectionOptions);
+    if (resolution.status === "expired") throw new CodexThreadAffinityExpiredError(resolution.accountId);
+    const selected = resolution.status === "selected" ? resolution.accountId : null;
+    if (!selected) {
+      if (fixedAccountId !== undefined) {
+        throw new CodexPoolAuthenticationError("Selected Codex account is unavailable");
+      }
+      // Recovery deliberately makes physical main ineligible. If no healthy
+      // pool route is configured and main is the intended route, report the
+      // temporary fence rather than misclassifying that credential as invalid.
+      // A configured pool retry/exclusion that finds no alternate preserves its
+      // ordinary pool-auth failure instead of being mislabeled as a main fence.
+      if (nativeMainTrafficBlocked && !options.excludeAccountId) {
+        throw new CodexMainProfileDrainingError();
+      }
+      throw new CodexPoolAuthenticationError();
+    }
+    accountId = selected;
+    if (accountId === MAIN_CODEX_ACCOUNT_ID && nativeMainTrafficBlocked) {
+      throw new CodexMainProfileDrainingError();
+    }
+    if (
+      accountId === MAIN_CODEX_ACCOUNT_ID
+      && selectionAdmission
+      && !selectionAdmission.claimMainProfile()
+    ) {
+      throw new CodexMainProfileDrainingError();
+    }
+    if (fixedAccountId !== undefined) {
+      if (isCodexAccountPaused(config, accountId)) {
+        throw new CodexPoolAuthenticationError("Selected Codex account is unavailable");
+      }
+      if (isAccountNeedsReauth(accountId)) {
+        throw new CodexPoolAuthenticationError("Selected Codex account needs reauthentication");
+      }
+      if (!isCodexAccountUsable(config, accountId, selectionOptions)) {
+        throw new CodexPoolAuthenticationError("Selected Codex account is unavailable");
+      }
+    }
+  } finally {
+    selectionAdmission?.release();
+  }
   // Lazy prime: if the selected account has no quota yet, the pool is likely
   // unprimed (dashboard never opened, or startup prime was blocked). Kick a
   // best-effort prime so the NEXT routing decision has real scores. This never
   // blocks the current request, and the helper's single-flight guard collapses
   // repeated triggers into one pass.
-  if (!getAccountQuota(accountId)) {
-    import("./auth-api")
-      .then(({ primeCodexPoolQuotas }) => primeCodexPoolQuotas(config, "pre-route"))
-      .catch(() => {});
+  if (fixedAccountId === undefined && !nativeMainReadsForbidden && !getAccountQuota(accountId)) {
+    if (options.primeCodexPoolQuotas) {
+      void options.primeCodexPoolQuotas(config, "pre-route").catch(() => {});
+    } else {
+      import("./auth-api")
+        .then(({ primeCodexPoolQuotas }) => primeCodexPoolQuotas(config, "pre-route"))
+        .catch(() => {});
+    }
   }
   // Snapshot (not just the deadline) so a refused request can report WHY it is cooled:
   // a literal Retry-After reads very differently to a user than a reset-derived guess.
@@ -244,6 +360,11 @@ export async function resolveCodexAuthContext(
   let probeLeaseId: string | undefined;
   let probeQuotaScope: CodexQuotaScope | undefined;
   if (cooldownUntil) {
+    // Exact bindings are not Pool recovery traffic. Fail closed instead of consuming the Pool's
+    // one probe lease or selecting another account.
+    if (fixedAccountId !== undefined) {
+      throw new CodexAccountCooldownError(accountId, cooldownUntil, cooldown?.cooldownSource, cooldown?.quotaScope);
+    }
     probeQuotaScope = cooldown?.quotaScope;
     probeLeaseId = probeQuotaScope
       ? tryAcquireCodexQuotaScopeProbeLease(accountId, probeQuotaScope) ?? undefined
@@ -255,12 +376,14 @@ export async function resolveCodexAuthContext(
 
   if (accountId === MAIN_CODEX_ACCOUNT_ID) {
     // Main account in rotation: inject the read-only auth.json token and fail closed if it vanished.
-    const token = getMainAccountToken();
+    const token = (options.getMainAccountToken ?? getMainAccountToken)();
     if (!token) {
       // Nothing will reach upstream, so give the probe back instead of burning it.
       if (probeLeaseId && probeQuotaScope) releaseCodexQuotaScopeProbeLease(accountId, probeQuotaScope, probeLeaseId);
       else if (probeLeaseId) releaseCodexQuotaProbeLease(accountId, probeLeaseId);
-      throw new CodexPoolAuthenticationError();
+      throw new CodexPoolAuthenticationError(
+        fixedAccountId !== undefined ? "Selected Codex account is unavailable" : undefined,
+      );
     }
     return {
       kind: "main-pool",
@@ -268,6 +391,7 @@ export async function resolveCodexAuthContext(
       writerGeneration,
       accessToken: token.accessToken,
       chatgptAccountId: token.chatgptAccountId,
+      ...(fixedAccountId !== undefined ? { fixedAccount: true } : {}),
       ...(quotaScope ? { quotaScope } : {}),
       ...(probeLeaseId ? { probeLeaseId } : {}),
       ...(probeQuotaScope ? { probeQuotaScope } : {}),
@@ -283,6 +407,7 @@ export async function resolveCodexAuthContext(
       generation: token.generation,
       accessToken: token.accessToken,
       chatgptAccountId: token.chatgptAccountId,
+      ...(fixedAccountId !== undefined ? { fixedAccount: true } : {}),
       ...(quotaScope ? { quotaScope } : {}),
       ...(probeLeaseId ? { probeLeaseId } : {}),
       ...(probeQuotaScope ? { probeQuotaScope } : {}),

package/src/codex/autostart-health.ts

@@ -47,6 +47,7 @@ export interface StartupHealth {
   recommendedCommand: string | null;
   commands: {
     installService: string;
+    repairService: string;
     installShim: string;
     restoreNative: string;
   };
@@ -54,6 +55,7 @@ export interface StartupHealth {
 
 const COMMANDS = {
   installService: "ocx service install",
+  repairService: "ocx service repair",
   installShim: "ocx codex-shim install",
   restoreNative: "ocx restore",
 } as const;
@@ -88,7 +90,12 @@ export function deriveStartupHealth(inputs: StartupHealthInputs): StartupHealth
     : inputs.routingKind === "custom-local" || inputs.routingKind === "unknown"
       ? COMMANDS.restoreNative
     : inputs.serviceSupported
-      ? COMMANDS.installService
+      // An already-registered service is refreshed in place: `repair` rewrites its assets
+      // and restarts it without re-registering, so it needs no elevation on Windows and
+      // cannot switch a WinSW install to Task Scheduler the way `install` would. Only a
+      // genuinely absent (or conflicting, which needs uninstall-then-install) service
+      // gets the registering command.
+      ? (inputs.serviceInstalled && !inputs.serviceConflict ? COMMANDS.repairService : COMMANDS.installService)
       : COMMANDS.restoreNative;
   return {
     ...inputs,

package/src/codex/catalog/account-models.ts

@@ -0,0 +1,62 @@
+import type { OcxConfig } from "../../types";
+import { isMainCodexAccountTarget } from "../account-namespaces";
+import type { RawEntry } from "./parsing";
+
+/** Stable nonsemantic marker used to distinguish generated rows from provider-owned rows. */
+export const CODEX_ACCOUNT_BOUND_CATALOG_KIND = "account-selector-v1";
+
+/**
+ * Public selectors whose configured account row still exists.
+ *
+ * Stale mappings stay in config so exact routing keeps failing closed, but they must not advertise
+ * a deleted account. Credential health, pause, and reauthentication state intentionally do not
+ * churn catalog identity. Selector keys have already passed config's nonempty, single-segment
+ * namespace validation. Only those public keys leave this boundary; private account ids do not.
+ */
+export function visibleCodexAccountSelectors(
+  config: Pick<OcxConfig, "codexAccounts" | "codexAccountNamespaces">,
+): string[] {
+  const storedPoolAccounts = new Set(
+    (config.codexAccounts ?? [])
+      .filter(account => !account.isMain)
+      .map(account => account.id),
+  );
+  return Object.entries(config.codexAccountNamespaces ?? {})
+    .filter(([, accountId]) =>
+      isMainCodexAccountTarget(accountId) || storedPoolAccounts.has(accountId)
+    )
+    .map(([selector]) => selector);
+}
+
+export function accountBoundNativeDisplayName(selector: string, native: RawEntry): string {
+  const rawModel = typeof native.display_name === "string"
+    ? native.display_name
+    : String(native.slug ?? "");
+  const model = rawModel
+    .replace(/^gpt-/i, "")
+    .split("-")
+    .filter(Boolean)
+    .map(part => /^[a-z]/.test(part) ? part.charAt(0).toUpperCase() + part.slice(1) : part)
+    .join(" ");
+  return `${selector} / ${model}`;
+}
+
+/** Identify current generated rows without changing Codex's semantic model fields. */
+export function trustedAccountBoundNativeCatalogSlug(entry: RawEntry): string | undefined {
+  if (entry.opencodex_catalog_kind !== CODEX_ACCOUNT_BOUND_CATALOG_KIND
+    || typeof entry.slug !== "string") return undefined;
+  const slash = entry.slug.indexOf("/");
+  if (slash <= 0 || slash !== entry.slug.lastIndexOf("/") || slash === entry.slug.length - 1) {
+    return undefined;
+  }
+  return entry.slug.slice(slash + 1);
+}
+
+export function accountBoundNativeModelSlugs(
+  config: Pick<OcxConfig, "codexAccounts" | "codexAccountNamespaces">,
+  nativeSlugs: Iterable<string>,
+): string[] {
+  const natives = [...nativeSlugs];
+  return visibleCodexAccountSelectors(config)
+    .flatMap(selector => natives.map(slug => `${selector}/${slug}`));
+}

package/src/codex/catalog/aggregation.ts

@@ -281,6 +281,8 @@ export function resetOpenAiApiCatalogWarningStateForTests(): void {
 export const slugAliasCollisionWarnings = new Set<string>();
 
 export const comboMasqueradeCollisionWarnings = new Set<string>();
+
+export const accountSelectorShadowCollisionWarnings = new Set<string>();
 let lastWarningReconciledGeneration = 0;
 
 export function reconcileCatalogWarningMemos(generation: number): number {
@@ -288,11 +290,13 @@ export function reconcileCatalogWarningMemos(generation: number): number {
   const removed = openAiApiCollisionWarnings.size
     + comboCatalogWarningSignatures.size
     + slugAliasCollisionWarnings.size
-    + comboMasqueradeCollisionWarnings.size;
+    + comboMasqueradeCollisionWarnings.size
+    + accountSelectorShadowCollisionWarnings.size;
   openAiApiCollisionWarnings.clear();
   comboCatalogWarningSignatures.clear();
   slugAliasCollisionWarnings.clear();
   comboMasqueradeCollisionWarnings.clear();
+  accountSelectorShadowCollisionWarnings.clear();
   lastWarningReconciledGeneration = generation;
   return removed;
 }
@@ -305,6 +309,15 @@ export function warnComboMasqueradeCollisionOnce(slug: string): void {
   );
 }
 
+/** Warn once when a live provider row loses its reserved slug to an account selector. */
+export function warnAccountSelectorShadowedProviderOnce(slug: string): void {
+  if (accountSelectorShadowCollisionWarnings.has(slug)) return;
+  accountSelectorShadowCollisionWarnings.add(slug);
+  console.warn(
+    `[opencodex] account selector collision on "${safeCatalogWarningLabel(slug)}": the account-bound native model wins and the shadowed provider model is omitted from the catalog. Rename the provider or account selector.`,
+  );
+}
+
 export function resolveSlugAliasCollisions(goModels: CatalogModel[]): Set<CatalogModel> {
   const skipped = new Set<CatalogModel>();
   const winnerByAlias = new Map<string, CatalogModel>();