@bitkyc08/opencodex 2.23.0-preview.20260816 → 2.24.0

package/src/chat/inbound.ts

@@ -99,17 +99,8 @@ function pushSystemText(parts: string[], content: unknown): void {
   if (text) parts.push(text);
 }
 
-function toolCallsToItems(toolCalls: unknown, input: Rec[]): void {
+function toolCallsToItems(toolCalls: unknown, input: Rec[], knownNameByCallId: Map<string, string>): void {
   if (!Array.isArray(toolCalls)) return;
-  // Recover names from earlier function_call items in the same transcript when a client
-  // re-sends tool_calls with only id/arguments (replace-style merge lost function.name).
-  const knownNameByCallId = new Map<string, string>();
-  for (const item of input) {
-    if (!isRec(item) || item.type !== "function_call") continue;
-    if (typeof item.call_id === "string" && typeof item.name === "string" && item.name.length > 0) {
-      knownNameByCallId.set(item.call_id, item.name);
-    }
-  }
   for (const raw of toolCalls) {
     if (!isRec(raw)) continue;
     const fn = isRec(raw.function) ? raw.function : null;
@@ -243,6 +234,9 @@ export function chatCompletionsToResponsesBody(raw: unknown): Rec {
 
   const systemParts: string[] = [];
   const input: Rec[] = [];
+  // Recover replace-style tool calls incrementally instead of rebuilding the
+  // call-id index from the entire translated transcript for every message.
+  const knownNameByCallId = new Map<string, string>();
 
   for (const msg of raw.messages) {
     if (!isRec(msg)) continue;
@@ -260,7 +254,7 @@ export function chatCompletionsToResponsesBody(raw: unknown): Rec {
       case "assistant": {
         const blocks = assistantContentToBlocks(msg.content);
         if (blocks.length > 0) input.push({ type: "message", role: "assistant", content: blocks });
-        if (msg.tool_calls !== undefined) toolCallsToItems(msg.tool_calls, input);
+        if (msg.tool_calls !== undefined) toolCallsToItems(msg.tool_calls, input, knownNameByCallId);
         break;
       }
       case "tool": {

package/src/claude/context-windows.ts

@@ -14,8 +14,20 @@ import { nativeOpenAiContextWindow, type CatalogModel } from "../codex/catalog";
 
 const ONE_MILLION = 1_000_000;
 
-/** Auto-context defaults (devlog 260712 020, user-approved). */
-export const AUTO_COMPACT_WINDOW_DEFAULT = 350_000;
+/**
+ * Auto-context defaults (devlog 260712 020, user-approved).
+ *
+ * The compact window is the token count at which Claude Code starts compacting, and it is
+ * also the floor `shouldMarkOneMillion` uses — a model may only carry the marker if it can
+ * host this window. 350,000 was chosen when the widest native row advertised 372,000.
+ *
+ * It now matches the auto-compaction limit the Codex catalog ships for the same models
+ * (`nativeAutoCompactLimit`: 829,800 against the 922,000 native window). Leaving the two
+ * apart meant one model compacting at 350k under Claude Code and at 829,800 under Codex.
+ * The value stays clear of the measured 922,000 ceiling by ~92k, so compaction still has
+ * room to run before the upstream refuses.
+ */
+export const AUTO_COMPACT_WINDOW_DEFAULT = 829_800;
 export const AUTO_CONTEXT_FLOOR = 200_000;
 /** Binary-verified accepted range for CLAUDE_CODE_AUTO_COMPACT_WINDOW (2.1.207: pSo=1e5, yDs=1e6). */
 export const AUTO_COMPACT_WINDOW_MIN = 100_000;
@@ -59,7 +71,7 @@ function inAutoCompactRange(value: number): boolean {
  * predicate so marker and threshold never separate (audit 021 #2); an invalid
  * value disables auto marking entirely (the CLI would ignore it, leaving marked
  * sub-1M models without their safety net). Out-of-range CONFIG values fall back
- * to the 350k default (the management API rejects them; this guards hand-edits).
+ * to AUTO_COMPACT_WINDOW_DEFAULT (the management API rejects them; this guards hand-edits).
  */
 export function resolveAutoContext(claudeCode: AutoContextConfigSlice | undefined, envOverride?: string): AutoContextMode {
   if (claudeCode?.autoContext === false) return AUTO_CONTEXT_OFF;
@@ -89,6 +101,10 @@ export function shouldMarkOneMillion(window: number | undefined, auto: AutoConte
 export function buildClaudeContextWindows(
   nativeSlugs: readonly string[],
   routedModels: readonly CatalogModel[],
+  // A configured providerContextCaps.openai has to reach the native rows here too. Without
+  // it the Claude surface keeps advertising the uncapped authoritative window while the
+  // Codex catalog advertises the capped one, and the two disagree about the same model.
+  nativeContextCap?: number,
 ): Record<string, number> {
   const out: Record<string, number> = {};
   const put = (key: string | null, value: number) => {
@@ -96,7 +112,7 @@ export function buildClaudeContextWindows(
     if (out[key] === undefined) out[key] = value; // first-wins (registry policy)
   };
   for (const slug of nativeSlugs) {
-    const window = nativeOpenAiContextWindow(slug);
+    const window = nativeOpenAiContextWindow(slug, nativeContextCap);
     if (typeof window !== "number" || window <= 0) continue;
     put(slug, window);
     put(desktop3pAlias("native", slug), window);

package/src/claude/desktop-3p.ts

@@ -191,6 +191,7 @@ function collectDesktop3pModels(
   nativeSlugs: string[],
   routedModels: Array<Desktop3pRoutedModel>,
   profile?: OcxClaudeDesktopProfile,
+  nativeContextCap?: number,
 ): { models: Desktop3pModelEntry[]; registry: Map<string, string> } {
   const registry = new Map<string, string>();
   const models: Desktop3pModelEntry[] = [];
@@ -199,7 +200,7 @@ function collectDesktop3pModels(
     // Desktop DTO uses, so a native 1M/372k model resolves identically in the written
     // config and on the dashboard.
     ...nativeSlugs.map(id => {
-      const contextWindow = nativeOpenAiContextWindow(id);
+      const contextWindow = nativeOpenAiContextWindow(id, nativeContextCap);
       return { provider: "native", id, ...(contextWindow !== undefined ? { contextWindow } : {}) };
     }),
     ...routedModels,
@@ -292,8 +293,9 @@ export function buildDesktop3pRegistry(
   nativeSlugs: string[],
   routedModels: Array<Desktop3pRoutedModel>,
   profile?: OcxClaudeDesktopProfile,
+  nativeContextCap?: number,
 ): Map<string, string> {
-  const { registry } = collectDesktop3pModels(nativeSlugs, routedModels, profile);
+  const { registry } = collectDesktop3pModels(nativeSlugs, routedModels, profile, nativeContextCap);
   desktop3pRegistry = registry;
   return registry;
 }
@@ -303,8 +305,9 @@ export function generateDesktop3pModels(
   nativeSlugs: string[],
   routedModels: Array<Desktop3pRoutedModel>,
   profile?: OcxClaudeDesktopProfile,
+  nativeContextCap?: number,
 ): Desktop3pModelEntry[] {
-  const { models, registry } = collectDesktop3pModels(nativeSlugs, routedModels, profile);
+  const { models, registry } = collectDesktop3pModels(nativeSlugs, routedModels, profile, nativeContextCap);
   desktop3pRegistry = registry;
   return models;
 }
@@ -334,6 +337,7 @@ export function generateDesktop3pConfig(
   apiKey = "ocx",
   mode: Desktop3pConfigMode = "static",
   profile?: OcxClaudeDesktopProfile,
+  nativeContextCap?: number,
 ): object {
   const base = {
     inferenceProvider: "gateway",
@@ -343,14 +347,14 @@ export function generateDesktop3pConfig(
   };
   if (mode === "discovery") {
     // Build/refresh the decode registry even though no static list is emitted.
-    buildDesktop3pRegistry(nativeSlugs, routedModels, profile);
+    buildDesktop3pRegistry(nativeSlugs, routedModels, profile, nativeContextCap);
     return { ...base, modelDiscoveryEnabled: true };
   }
   return {
     ...base,
     modelDiscoveryEnabled: mode === "hybrid",
     inferenceModels: (() => {
-      const models = generateDesktop3pModels(nativeSlugs, routedModels, profile);
+      const models = generateDesktop3pModels(nativeSlugs, routedModels, profile, nativeContextCap);
       // Fail loud at the write boundary rather than ship a config Desktop rejects:
       // the output counterpart of the request-path guards.
       assertDesktop3pModelsValid(models);
@@ -554,6 +558,7 @@ export function writeDesktop3pConfig(
   apiKey?: string,
   mode: Desktop3pConfigMode = "static",
   profile?: OcxClaudeDesktopProfile,
+  nativeContextCap?: number,
 ): { written: boolean; path: string; reason?: string; fingerprint?: string } {
   const libraryPath = resolveDesktop3pConfigLibraryPath();
   const metadataPath = join(libraryPath, "_meta.json");
@@ -571,7 +576,7 @@ export function writeDesktop3pConfig(
       ? metadata.entries.map(current => current === existing ? entry : current)
       : [...metadata.entries, entry];
 
-    const configJson = JSON.stringify(generateDesktop3pConfig(port, nativeSlugs, routedModels, apiKey, mode, profile), null, 2) + "\n";
+    const configJson = JSON.stringify(generateDesktop3pConfig(port, nativeSlugs, routedModels, apiKey, mode, profile, nativeContextCap), null, 2) + "\n";
     const fingerprint = createHash("sha256").update(configJson).digest("hex").slice(0, 16);
     const { backupPath } = atomicReplaceDesktopConfig(configPath, configJson);
     try {

package/src/claude/inbound.ts

@@ -25,7 +25,37 @@ function isRec(v: unknown): v is Rec {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
 
-/** Alias first, then modelMap: exact id, then date-suffix-stripped (`-\d{8}$`), else passthrough. */
+function isClaudeClassifierModel(model: string): boolean {
+  const stripped = model.replace(/-\d{8}$/, "");
+  return /^claude-opus-[45]/.test(stripped);
+}
+
+/**
+ * Explicitly configured classifier route for Claude Code Auto Mode safety checks (#1697).
+ *
+ * Only OPERATOR-DECLARED targets are used: `classifierModel`, then the ordered
+ * `classifierFallbacks`. Both are qualified `provider/model` strings the operator chose, so
+ * routing them crosses no boundary the operator did not ask for.
+ *
+ * Deliberately NOT here: inferring a provider from `claudeCode.model`. That value is the
+ * injected/default config slot, not the provider the live session actually selected, so it goes
+ * stale the moment the user changes the model picker -- and acting on it would silently move a
+ * classifier turn onto a provider with its own privacy and billing consequences. Live session
+ * affinity needs the request/session state this function does not have; it is tracked as
+ * follow-up work rather than approximated from static config.
+ */
+function configuredClassifierRoute(cc?: OcxClaudeCodeConfig): string | undefined {
+  const explicit = typeof cc?.classifierModel === "string" ? cc.classifierModel.trim() : "";
+  if (explicit.length > 0) return explicit;
+  if (Array.isArray(cc?.classifierFallbacks)) {
+    for (const candidate of cc.classifierFallbacks) {
+      if (typeof candidate === "string" && candidate.trim().length > 0) return candidate.trim();
+    }
+  }
+  return undefined;
+}
+
+/** Alias first, then modelMap: exact id, then date-suffix-stripped (`-\d{8}$`), then classifier affinity/config, else passthrough. */
 export function resolveInboundModel(model: string, cc?: OcxClaudeCodeConfig): string {
   // Defensive: Desktop/CLI strip the [1m] context-variant marker client-side, but a
   // leaking build must not break alias decode (devlog 138 — the 1M signal is the
@@ -47,6 +77,14 @@ export function resolveInboundModel(model: string, cc?: OcxClaudeCodeConfig): st
   const stripped = model.replace(/-\d{8}$/, "");
   const dateless = map[stripped];
   if (typeof dateless === "string" && dateless.length > 0) return dateless;
+
+  // Claude Code Auto Mode classifier routing (#1697). Bare classifier checks such as
+  // `claude-opus-5` carry no provider, so without this they fall through to defaultProvider --
+  // which may not speak Anthropic at all. Only an operator-declared target is used.
+  if (isClaudeClassifierModel(model)) {
+    const configured = configuredClassifierRoute(cc);
+    if (configured) return configured;
+  }
   return model;
 }
 

package/src/claude/model-info.ts

@@ -15,7 +15,7 @@
  *  - created_at is a fixed constant; max_input_tokens is authoritative-or-null;
  *    max_tokens is always null (no authoritative output limit exists proxy-side).
  */
-import { catalogModelEfforts, nativeEffortClamp, nativeOpenAiContextWindow, type CatalogModel } from "../codex/catalog";
+import { catalogModelEfforts, nativeEffortClamp, nativeOpenAiContextWindow, nativeOpenAiMaxInputTokens, type CatalogModel } from "../codex/catalog";
 import { claudeCodeAlias, claudeCodeNativeAlias } from "./alias";
 import { desktop3pAlias } from "./desktop-3p";
 import { AUTO_CONTEXT_OFF, type AutoContextMode } from "./context-windows";
@@ -108,6 +108,7 @@ export function buildAnthropicModelInfos(
   auto: AutoContextMode = AUTO_CONTEXT_OFF,
   idStyle: AnthropicIdStyle = "desktop3p",
   aliasForRoute: (provider: string, modelId: string) => string = desktop3pAlias,
+  nativeContextCap?: number,
 ): AnthropicModelInfo[] {
   const out: AnthropicModelInfo[] = [];
   const seen = new Set<string>();
@@ -117,7 +118,7 @@ export function buildAnthropicModelInfos(
   // the auto-context widening that let a 372K route carry the marker (and be
   // over-filled) is the #854 defect and does not come back. Guards (audit R1#11):
   // same dedupe set, never double-suffix.
-  const push1mVariant = (base: AnthropicModelInfo, contextWindow: number | undefined) => {
+  const push1mVariant = (base: AnthropicModelInfo, contextWindow: number | undefined, maxInputTokens?: number) => {
     // The [1m] marker makes Claude Code account 1e6 tokens for the row, so it
     // may only name models whose AUTHORITATIVE effective window is >= 1M —
     // never the auto-context widening, which would mark a 372K route and have
@@ -127,16 +128,27 @@ export function buildAnthropicModelInfos(
     const id = `${base.id}[1m]`;
     if (seen.has(id)) return;
     seen.add(id);
-    const window = contextWindow as number;
-    out.push({ ...base, id, display_name: `${base.display_name} · 1M`, max_input_tokens: ONE_MILLION });
+    // The marker fixes Claude Code's accounting at 1e6, but a model may accept less input
+    // than that — a routed GPT-5.6 row runs a 1,050,000 window while refusing past 922,000
+    // (measured — see devlog/_plan/260817_native_gpt56_1m_context/001_measurement_evidence.md).
+    // Advertising the flat 1e6 there would invite mid-session context_length_exceeded, so the
+    // variant reports whichever of the two is smaller.
+    const advertised = typeof maxInputTokens === "number" && maxInputTokens > 0
+      ? Math.min(ONE_MILLION, maxInputTokens)
+      : ONE_MILLION;
+    out.push({ ...base, id, display_name: `${base.display_name} · 1M`, max_input_tokens: advertised });
   };
   for (const slug of nativeSlugs) {
     const id = idStyle === "readable" ? claudeCodeNativeAlias(slug) : aliasForRoute("native", slug);
     if (seen.has(id)) continue;
     seen.add(id);
-    const info = modelInfo(id, `${slug} (native)`, nativeEffectiveLadder(slug), true, nativeOpenAiContextWindow(slug));
+    const nativeWindow = nativeOpenAiContextWindow(slug, nativeContextCap);
+    const nativeMaxInput = nativeOpenAiMaxInputTokens(slug, nativeContextCap);
+    // max_input_tokens is an INPUT limit, so it follows the measured input ceiling rather
+    // than the total window whenever the model publishes one.
+    const info = modelInfo(id, `${slug} (native)`, nativeEffectiveLadder(slug), true, nativeMaxInput ?? nativeWindow);
     out.push(info);
-    push1mVariant(info, nativeOpenAiContextWindow(slug));
+    push1mVariant(info, nativeWindow, nativeMaxInput);
   }
   for (const m of routedModels) {
     const id = idStyle === "readable" ? claudeCodeAlias(m.provider, m.id) : aliasForRoute(m.provider, m.id);
@@ -144,11 +156,19 @@ export function buildAnthropicModelInfos(
     seen.add(id);
     const ladder = Array.isArray(m.reasoningEfforts) ? m.reasoningEfforts : [];
     const imageInput = Array.isArray(m.inputModalities) ? m.inputModalities.includes("image") : false;
-    const info = modelInfo(id, `${m.id} (${m.provider})`, ladder, imageInput, m.contextWindow);
+    // max_input_tokens is an input limit, so a row that publishes a lower input ceiling than
+    // its window (native GPT-5.6 forwarded through a provider: 922k under 1.05M) reports the
+    // ceiling. Rows without one keep reporting the window, as before.
+    const routedMaxInput = typeof m.maxInputTokens === "number" && m.maxInputTokens > 0
+      ? (typeof m.contextWindow === "number" && m.contextWindow > 0
+        ? Math.min(m.maxInputTokens, m.contextWindow)
+        : m.maxInputTokens)
+      : undefined;
+    const info = modelInfo(id, `${m.id} (${m.provider})`, ladder, imageInput, routedMaxInput ?? m.contextWindow);
     out.push(info);
     // Anthropic passthrough guard (audit 021 #3): never auto-widen canonical claude
     // routes — only a genuine >=1M window earns the variant row there.
-    push1mVariant(info, m.contextWindow);
+    push1mVariant(info, m.contextWindow, routedMaxInput);
   }
   return out;
 }

package/src/cli/account-api.ts

@@ -145,6 +145,10 @@ export interface CodexQuotaDto {
   monthlyPercent?: number;
   weeklyResetAt?: number;
   monthlyResetAt?: number;
+  /** Sub-day burst window, when upstream declares one (#1791). */
+  shortPercent?: number;
+  shortResetAt?: number;
+  shortWindowSeconds?: number;
 }
 
 export interface ProviderQuotaWindowDto {
@@ -183,7 +187,7 @@ interface CodexAccountDto {
 function projectQuota(quota: CodexQuotaDto | null | undefined): CodexQuotaDto | null {
   if (!quota) return null;
   const projected: CodexQuotaDto = {};
-  for (const key of ["weeklyPercent", "monthlyPercent", "weeklyResetAt", "monthlyResetAt"] as const) {
+  for (const key of ["weeklyPercent", "monthlyPercent", "weeklyResetAt", "monthlyResetAt", "shortPercent", "shortResetAt", "shortWindowSeconds"] as const) {
     if (typeof quota[key] === "number" && Number.isFinite(quota[key])) projected[key] = quota[key];
   }
   return projected;

package/src/cli/claude-desktop.ts

@@ -15,6 +15,8 @@ import { filterCatalogVisibleModels, desktopVisibleNativeSlugs } from "../codex/
 import { buildClaudeDesktopState, fetchAllModels } from "../server/management-api";
 import { findLiveProxy } from "../server/proxy-liveness";
 import { runtimeRequest } from "./runtime-api";
+import { providerContextCap } from "../providers/context-cap";
+import { OPENAI_CODEX_PROVIDER_ID } from "../providers/openai-tiers";
 
 function isFamily(value: string | undefined): value is DesktopFamily {
   return !!value && (DESKTOP_FAMILIES as readonly string[]).includes(value);
@@ -98,6 +100,7 @@ export async function applyProfile(
     config.apiKeys?.[0]?.key,
     mode,
     state.profile,
+    providerContextCap(config, OPENAI_CODEX_PROVIDER_ID),
   );
   return { ok: result.written, path: result.path, reason: result.reason };
 }

package/src/cli/config-command.ts

@@ -1,6 +1,6 @@
 import { readFileSync, writeFileSync } from "node:fs";
 import { clearCodexAccountPin } from "../codex/account-priority";
-import { getConfigPath, readConfigDiagnostics, sanitizeModelCostsForDisplay, saveConfig, validateConfigCandidate } from "../config";
+import { getConfigPath, mutatePersistedConfig, readConfigDiagnostics, sanitizeModelCostsForDisplay, saveConfig, validateConfigCandidate } from "../config";
 import { VISION_REASONING_EFFORTS, isVisionReasoningEffort } from "../reasoning-effort";
 import type { OcxConfig } from "../types";
 import { normalizeVisionReasoningForModel } from "../vision/reasoning";
@@ -130,19 +130,42 @@ export async function handleConfigCommand(argv: string[]): Promise<number> {
       const raw = action === "set" ? args.shift() : undefined;
       if (!path || (action === "set" && raw === undefined)) throw new CliUsageError("config path and value are required", USAGE);
       rejectArgs(args, USAGE);
-      const candidate = structuredClone(readConfigDiagnostics().config) as unknown as Record<string, unknown>;
-      setPath(candidate, path, raw === undefined ? undefined : parseValue(raw), action === "unset");
-      const config = validate(candidate);
-      const savedValue = action === "unset" ? null : getPath(config, path);
-      // Setting the order here is the operator restating it, exactly as through
-      // `ocx account priority` or the management route, so it releases the manual pin
-      // for the same reason those do: a pin made before any order existed would
-      // otherwise outrank every order set afterwards, capping the pool at the pinned
-      // account's tier with nothing on any surface explaining why. `import` is
-      // deliberately not covered — that file supplies its own pin, so there is no
-      // stale one to release.
-      if (pathSegments(path)[0] === "codexAccountPriorities") clearCodexAccountPin(config);
-      saveConfig(config);
+      // #1835/#1838: the read used to happen OUTSIDE the mutation lock, so a concurrent
+      // edit landing between it and the save was reverted by this whole-snapshot write.
+      // `mutatePersistedConfig` reruns this callback against the latest validated disk
+      // state, so the operation is applied to what is actually there at commit time.
+      let savedValue: unknown = null;
+      const outcome = mutatePersistedConfig(fresh => {
+        // Snapshot BEFORE mutating: comparing after the write compares a value with
+        // itself and would report every no-op as a change, bumping the generation.
+        const before = JSON.stringify(fresh);
+        const candidate = structuredClone(fresh) as unknown as Record<string, unknown>;
+        setPath(candidate, path, raw === undefined ? undefined : parseValue(raw), action === "unset");
+        const config = validate(candidate);
+        savedValue = action === "unset" ? null : getPath(config, path);
+        // Setting the order here is the operator restating it, exactly as through
+        // `ocx account priority` or the management route, so it releases the manual pin
+        // for the same reason those do: a pin made before any order existed would
+        // otherwise outrank every order set afterwards, capping the pool at the pinned
+        // account's tier with nothing on any surface explaining why. `import` is
+        // deliberately not covered — that file supplies its own pin, so there is no
+        // stale one to release.
+        if (pathSegments(path)[0] === "codexAccountPriorities") clearCodexAccountPin(config);
+        // REPLACE rather than merge: `Object.assign` alone cannot remove a key that
+        // `unset` deleted, which would make unset silently succeed while changing nothing.
+        for (const key of Object.keys(fresh)) {
+          if (!(key in (config as unknown as Record<string, unknown>))) {
+            delete (fresh as unknown as Record<string, unknown>)[key];
+          }
+        }
+        Object.assign(fresh, config);
+        return { changed: JSON.stringify(fresh) !== before, value: undefined };
+      });
+      if (outcome.status === "unavailable") {
+        throw new Error(outcome.reason === "conflict"
+          ? "config changed while applying this update; retry"
+          : `config is ${outcome.reason}`);
+      }
       printData({ ok: true, path, value: redact(savedValue, path.split(".").at(-1)) }, wantsJson,
         [`${action === "unset" ? "Unset" : "Set"} ${path}.`]);
       return;

package/src/codex/app-server-restart-service.ts

@@ -16,7 +16,7 @@
  * mocking modules — a route test that could not stub this would really terminate
  * the developer's own Codex.
  *
- * Plan and audit history: `devlog/_plan/260815_gui_codex_restart/010_phase1_backend_endpoint.md`.
+ * Plan and audit history: `devlog/_fin/260815_gui_codex_restart/010_phase1_backend_endpoint.md`.
  */
 import {
   collectCodexAppServerCatalogState,

package/src/codex/auth-api.ts

@@ -217,6 +217,11 @@ function quotaForPlan<T extends Omit<StoredAccountQuota, "updatedAt"> | StoredAc
   return {
     ...(quota.monthlyPercent !== undefined ? { monthlyPercent: quota.monthlyPercent } : {}),
     ...(quota.monthlyResetAt !== undefined ? { monthlyResetAt: quota.monthlyResetAt } : {}),
+    // A 30-day plan can still carry a burst window, and it blocks the account on its own.
+    // Dropping it here would show a healthy card for an account upstream is refusing (#1791).
+    ...(quota.shortPercent !== undefined ? { shortPercent: quota.shortPercent } : {}),
+    ...(quota.shortResetAt !== undefined ? { shortResetAt: quota.shortResetAt } : {}),
+    ...(quota.shortWindowSeconds !== undefined ? { shortWindowSeconds: quota.shortWindowSeconds } : {}),
     ...(quota.resetCredits !== undefined ? { resetCredits: quota.resetCredits } : {}),
     ...("updatedAt" in quota ? { updatedAt: quota.updatedAt } : {}),
   } as T;

package/src/codex/auth-context.ts

@@ -11,7 +11,7 @@ import { isCodexAccountPaused } from "./account-pause";
 import { ConfigMutationLockError } from "../config";
 import { isCodexAccountUsable } from "./account-usability";
 import { reconcileMainCodexAccountRuntimeState } from "./account-lifecycle";
-import { MAIN_CODEX_ACCOUNT_ID, getMainAccountToken } from "./main-account";
+import { MAIN_CODEX_ACCOUNT_ID, getMainAccountToken, isMainAccountTokenLive } from "./main-account";
 import { isNativeMainTrafficBlocked } from "./native-profile-startup";
 import {
   codexQuotaScopeForModel,
@@ -451,7 +451,32 @@ export function applyCodexAuthContextToProvider(
   };
 }
 
-export function headersForCodexAuthContext(headers: Headers, ctx: CodexAuthContext): Headers {
+export class CodexMainSubstitutionUnavailableError extends Error {
+  constructor() {
+    super("No usable Codex main credential to substitute for an admission bearer");
+    this.name = "CodexMainSubstitutionUnavailableError";
+  }
+}
+
+/**
+ * Build the upstream auth headers for one Codex turn.
+ *
+ * The two credential domains meet here, and only here:
+ *
+ * - `pool` / `main-pool` always OVERWRITE with the stored account credential. Whatever the
+ *   caller sent is irrelevant to what we send upstream.
+ * - `main` with an admission-bearer caller (#1686) must substitute the stored main credential.
+ *   The caller proved admission with one of OUR secrets, which must never leave the process, so
+ *   the only two acceptable outcomes are replaced-with-stored-main or fail-before-any-IO.
+ *   Silently forwarding would be the leak validateForwardAdmissionCredential exists to prevent.
+ * - `main` with a dedicated-header caller keeps the existing intentional passthrough: the bearer
+ *   there is the user's own ChatGPT credential, not ours.
+ */
+export function materializeCodexUpstreamAuth(
+  headers: Headers,
+  ctx: CodexAuthContext,
+  options: { substituteMainCredential?: boolean } = {},
+): Headers {
   const selected = new Headers();
   for (const name of FORWARD_HEADERS) {
     const value = headers.get(name);
@@ -460,10 +485,26 @@ export function headersForCodexAuthContext(headers: Headers, ctx: CodexAuthConte
   if (ctx.kind === "pool" || ctx.kind === "main-pool") {
     selected.set("authorization", `Bearer ${ctx.accessToken}`);
     selected.set("chatgpt-account-id", ctx.chatgptAccountId);
+    return selected;
+  }
+  if (ctx.kind === "main" && options.substituteMainCredential === true) {
+    const stored = getMainAccountToken();
+    // Fail BEFORE any upstream I/O. Falling through here would send the admission secret.
+    if (!stored?.accessToken || !isMainAccountTokenLive()) {
+      throw new CodexMainSubstitutionUnavailableError();
+    }
+    selected.set("authorization", `Bearer ${stored.accessToken}`);
+    if (stored.chatgptAccountId) selected.set("chatgpt-account-id", stored.chatgptAccountId);
+    return selected;
   }
   return selected;
 }
 
+/** @deprecated Prefer materializeCodexUpstreamAuth; kept for call sites without admission context. */
+export function headersForCodexAuthContext(headers: Headers, ctx: CodexAuthContext): Headers {
+  return materializeCodexUpstreamAuth(headers, ctx);
+}
+
 export function isCodexAuthContextUsable(ctx: CodexAuthContext, config: OcxConfig): boolean {
   if (ctx.kind === "main") return true;
   if (ctx.kind === "main-pool") return isCodexAccountUsable(config, ctx.accountId);