@bitkyc08/opencodex 2.37.0 → 2.39.0-preview.20260901

package/src/codex/reset-credit-recovery.ts

@@ -27,6 +27,20 @@ export type CodexResetCreditConsumeCode =
   | "nothing_to_reset"
   | "no_credit";
 
+declare const CODEX_RESERVED_OPERATION_ID_BRAND: unique symbol;
+
+/** An operation id whose durable reservation was validated by the operation ledger. */
+export type CodexReservedOperationId = string & {
+  readonly [CODEX_RESERVED_OPERATION_ID_BRAND]: true;
+};
+
+export const CODEX_RESET_CREDIT_OPERATION_ID_PATTERN =
+  /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+
+export function isCodexResetCreditOperationId(value: unknown): value is string {
+  return typeof value === "string" && CODEX_RESET_CREDIT_OPERATION_ID_PATTERN.test(value);
+}
+
 export type CodexResetCreditRecoveryAuthorization = Readonly<{
   enabled: boolean;
   /**
@@ -189,7 +203,9 @@ const RESET_ELIGIBLE_CODES = {
   insufficient_quota: true,
 } as const satisfies Record<CodexResetEligibleExhaustionCode, true>;
 
-function snapshotGeneration(input: unknown): CodexResetCreditRecoveryGeneration {
+export function snapshotCodexResetCreditRecoveryGeneration(
+  input: unknown,
+): CodexResetCreditRecoveryGeneration {
   if (!input || typeof input !== "object" || Array.isArray(input)) {
     throw new TypeError("generation must be an object");
   }
@@ -251,6 +267,8 @@ function compareGenerationOrder(
   return 0;
 }
 
+export const compareCodexResetCreditRecoveryGenerationOrder = compareGenerationOrder;
+
 function authorizedResetRejection(authorization: CodexResetCreditRecoveryAuthorization): boolean {
   const hasOwn = Object.prototype.hasOwnProperty;
   if (!hasOwn.call(authorization, "enabled")
@@ -507,7 +525,7 @@ export class CodexResetCreditRecoveryCoordinator {
     let requestSignal: AbortSignal | undefined;
     try {
       requestSignal = snapshotRequestSignal(options);
-      generationSnapshot = snapshotGeneration(generation);
+      generationSnapshot = snapshotCodexResetCreditRecoveryGeneration(generation);
     } catch (error) {
       rejectAttempt(error);
       return attempt;

package/src/codex/routing.ts

@@ -17,7 +17,7 @@ import {
   seedPoolRotationAccount,
   selectPriorityTier,
 } from "./pool-rotation";
-import { CODEX_UNKNOWN_USAGE_SCORE, getAccountQuota } from "./quota";
+import { CODEX_EXHAUSTED_USAGE_PERCENT, CODEX_UNKNOWN_USAGE_SCORE, getAccountQuota } from "./quota";
 import { isThirtyDayOnlyCodexPlan } from "./plan";
 import {
   MAIN_CODEX_ACCOUNT_ID,
@@ -364,7 +364,8 @@ export function computeCodexUsageScore(quota: {
   weeklyPercent?: number;
   monthlyPercent?: number;
   shortPercent?: number;
-} | null, plan?: unknown): number {
+  shortResetAt?: number;
+} | null, plan?: unknown, now: number = Date.now()): number {
   if (!quota) return CODEX_UNKNOWN_USAGE_SCORE;
   const finite = (value: unknown): value is number => typeof value === "number" && Number.isFinite(value);
   const longWindows = isThirtyDayOnlyCodexPlan(plan)
@@ -376,11 +377,50 @@ export function computeCodexUsageScore(quota: {
   // account whose weekly/monthly usage is entirely unverified look like the emptiest in the
   // pool, so `pickLowestUsageAmong` would send every request to it. Unknown has to stay
   // unknown until a governing window is actually observed.
-  if (knownLong.length === 0) return CODEX_UNKNOWN_USAGE_SCORE;
+  //
+  // A FULL burst window is the exception (#3029). It is not an optimistic guess about an
+  // unobserved window — it is a direct observation that the account cannot serve a request
+  // right now, whatever its monthly position turns out to be. Unknown-means-selectable is
+  // correct for uncertainty and wrong for a measured refusal: the account stays selected,
+  // `applyQuotaAutoSwitch` never fires, and the pool wedges on an exhausted credential.
+  if (knownLong.length === 0) {
+    return isTerminalShortWindow(quota, now) ? CODEX_EXHAUSTED_USAGE_PERCENT : CODEX_UNKNOWN_USAGE_SCORE;
+  }
   const values = finite(quota.shortPercent) ? [...knownLong, quota.shortPercent] : knownLong;
   return Math.max(...values);
 }
 
+/**
+ * A short-only reading that proves the account is blocked NOW.
+ *
+ * Freshness is not optional. `getAccountQuota` performs no expiry check, partial updates
+ * carry the old short tuple forward, and disk hydration accepts a persisted reading for
+ * hours — so scoring 100 from `shortPercent` alone would keep excluding an account whose
+ * five-hour window has since reset. That is #3029 pointed the other way: the issue is that
+ * an exhausted account stays selected, and "a recovered account stays excluded" trades one
+ * unusable pool for another.
+ *
+ * A reading with no `shortResetAt` cannot be aged, so it stays unknown. The conservative
+ * direction here is the one that keeps an account selectable: a wrongly-selected account
+ * fails one request, while a wrongly-excluded one is invisible until someone reads the pool
+ * by hand.
+ */
+function isTerminalShortWindow(
+  quota: { shortPercent?: number; shortResetAt?: number },
+  now: number,
+): boolean {
+  if (typeof quota.shortPercent !== "number" || !Number.isFinite(quota.shortPercent)) return false;
+  if (quota.shortPercent < CODEX_EXHAUSTED_USAGE_PERCENT) return false;
+  const resetAt = quota.shortResetAt;
+  if (typeof resetAt !== "number" || !Number.isFinite(resetAt) || resetAt <= 0) return false;
+  // Both units reach storage: `normalizeResetAt` does not scale, and the GUI disambiguates
+  // by magnitude at read time. A comparison written against one assumption is off by 1000x
+  // against the other, and in the seconds-read-as-milliseconds direction every terminal
+  // reading looks like it reset in 1970 — a fix that passes its own test and does nothing.
+  const resetAtMs = resetAt < 10_000_000_000 ? resetAt * 1000 : resetAt;
+  return resetAtMs > now;
+}
+
 export function classifyCodexUpstreamOutcome(
   outcome: CodexUpstreamOutcome,
   denial?: "workspace" | "entitlement",
@@ -1131,7 +1171,7 @@ function getEligiblePoolAccounts(
   return selectPriorityTier(
     ids,
     codexAccountPriorityLookup(config),
-    id => hasCodexQuotaHeadroom(config, id, selectionOptions),
+    id => hasCodexQuotaHeadroom(config, id, selectionOptions, now),
     pinnedCodexAccountId(config),
   );
 }
@@ -1163,12 +1203,14 @@ function hasCodexQuotaHeadroom(
   config: OcxConfig,
   accountId: string,
   selectionOptions?: CodexAccountUsabilityOptions,
+  now: number = Date.now(),
 ): boolean {
   const threshold = config.autoSwitchThreshold ?? 80;
   if (threshold <= 0) return true;
   const usage = computeCodexUsageScore(
     getAccountQuota(accountId),
     getPoolAccountPlanForSelection(config, accountId, selectionOptions),
+    now,
   );
   if (isUnknownUsage(usage)) return true;
   return usage < threshold;
@@ -1188,7 +1230,7 @@ function pickFillFirstCodexAccount(
   if (eligible.length === 0) return null;
 
   const active = getEffectiveActiveCodexAccountId(config);
-  if (active && eligible.includes(active) && hasCodexQuotaHeadroom(config, active, selectionOptions)) {
+  if (active && eligible.includes(active) && hasCodexQuotaHeadroom(config, active, selectionOptions, now)) {
     return active;
   }
 
@@ -1200,7 +1242,7 @@ function pickNextFillFirstCodexAccount(
   config: OcxConfig,
   afterId: string | null,
   eligible: readonly string[] = listEligibleCodexAccountIds(config, Date.now()),
-  _now = Date.now(),
+  now = Date.now(),
   selectionOptions?: CodexAccountUsabilityOptions,
 ): string | null {
   if (eligible.length === 0) return null;
@@ -1208,7 +1250,7 @@ function pickNextFillFirstCodexAccount(
   if (!afterId) {
     // Prefer an under-threshold account when starting with no active cursor.
     for (const id of ordered) {
-      if (hasCodexQuotaHeadroom(config, id, selectionOptions)) return id;
+      if (hasCodexQuotaHeadroom(config, id, selectionOptions, now)) return id;
     }
     return ordered[0] ?? null;
   }
@@ -1223,7 +1265,7 @@ function pickNextFillFirstCodexAccount(
   const startIdx = stableAll.indexOf(afterId);
   if (startIdx < 0) {
     for (const id of ordered) {
-      if (hasCodexQuotaHeadroom(config, id, selectionOptions)) return id;
+      if (hasCodexQuotaHeadroom(config, id, selectionOptions, now)) return id;
     }
     return ordered[0] ?? null;
   }
@@ -1234,7 +1276,7 @@ function pickNextFillFirstCodexAccount(
     const candidate = stableAll[(startIdx + step) % stableAll.length]!;
     if (!eligible.includes(candidate)) continue;
     if (!fallback) fallback = candidate;
-    if (hasCodexQuotaHeadroom(config, candidate, selectionOptions)) return candidate;
+    if (hasCodexQuotaHeadroom(config, candidate, selectionOptions, now)) return candidate;
   }
   return fallback ?? ordered[0] ?? null;
 }
@@ -1356,6 +1398,7 @@ function pickLowerUsageAccount(
     const usage = computeCodexUsageScore(
       getAccountQuota(id),
       getPoolAccountPlanForSelection(config, id, selectionOptions),
+      now,
     );
     if (usage < bestUsage) {
       best = id;
@@ -1370,6 +1413,7 @@ function pickLowestUsageAmong(
   config: OcxConfig,
   ids: readonly string[],
   selectionOptions?: CodexAccountUsabilityOptions,
+  now: number = Date.now(),
 ): string | null {
   let best: string | null = null;
   let bestUsage = Number.POSITIVE_INFINITY;
@@ -1377,6 +1421,7 @@ function pickLowestUsageAmong(
     const usage = computeCodexUsageScore(
       getAccountQuota(id),
       getPoolAccountPlanForSelection(config, id, selectionOptions),
+      now,
     );
     if (usage < bestUsage) {
       best = id;
@@ -1397,6 +1442,7 @@ export function pickLowestUsageCodexAccount(
     config,
     getEligiblePoolAccounts(config, excludeId, now, quotaScope, selectionOptions),
     selectionOptions,
+    now,
   );
 }
 
@@ -1540,7 +1586,7 @@ function pickPriorityPreemption(
   if (
     pinned !== undefined
     && eligible.includes(pinned)
-    && hasCodexQuotaHeadroom(config, pinned, selectionOptions)
+    && hasCodexQuotaHeadroom(config, pinned, selectionOptions, now)
   ) return null;
   const priorityOf = codexAccountPriorityLookup(config);
   if (priorityOf(eligible[0]!) <= priorityOf(active)) return null;
@@ -1548,8 +1594,9 @@ function pickPriorityPreemption(
   // picking one would hand the request straight back to a drained account.
   return pickLowestUsageAmong(
     config,
-    eligible.filter(id => hasCodexQuotaHeadroom(config, id, selectionOptions)),
+    eligible.filter(id => hasCodexQuotaHeadroom(config, id, selectionOptions, now)),
     selectionOptions,
+    now,
   );
 }
 
@@ -1566,6 +1613,7 @@ function releaseDrainedCodexAccountPin(
     CodexAccountUsabilityOptions,
     "nativeMainSelectionOnly" | "isMainAccountTokenLive"
   >,
+  now: number = Date.now(),
 ): void {
   const pinned = pinnedCodexAccountId(config);
   if (pinned === undefined) return;
@@ -1580,7 +1628,7 @@ function releaseDrainedCodexAccountPin(
   // is readable. Cached reauth and configured pause state were handled above.
   if (pinned === MAIN_CODEX_ACCOUNT_ID && selectionOptions?.nativeMainSelectionOnly === true) return;
   const drained = !isCodexAccountUsable(config, pinned, selectionOptions)
-    || !hasCodexQuotaHeadroom(config, pinned, selectionOptions);
+    || !hasCodexQuotaHeadroom(config, pinned, selectionOptions, now);
   if (!drained) return;
   clearCodexAccountPin(config);
   saveConfigPreservingClaudeCode(config);
@@ -1600,6 +1648,7 @@ function applyQuotaAutoSwitch(
   const activeUsage = computeCodexUsageScore(
     quota,
     getPoolAccountPlanForSelection(config, active, selectionOptions),
+    now,
   );
   // Unknown usage is not evidence that a user's explicit selection crossed the
   // threshold. Wait for quota priming instead of rotating among guesses.
@@ -1633,7 +1682,7 @@ function isHealthySharedCodexSelection(
   selectionOptions: CodexAccountUsabilityOptions | undefined,
 ): boolean {
   return isCodexAccountSelectable(config, accountId, now, quotaScope, selectionOptions)
-    && hasCodexQuotaHeadroom(config, accountId, selectionOptions)
+    && hasCodexQuotaHeadroom(config, accountId, selectionOptions, now)
     && !shouldFailover(config, accountId, now);
 }
 
@@ -1720,6 +1769,7 @@ function previewReusableAffinityAccount(
       const usage = computeCodexUsageScore(
         getAccountQuota(entry.accountId),
         getPoolAccountPlanForSelection(config, entry.accountId, selectionOptions),
+      now,
       );
       if (!isUnknownUsage(usage) && usage >= threshold) {
         const best = pickLowerUsageAccount(
@@ -1755,6 +1805,7 @@ function reevaluateAffinityQuota(
     ? computeCodexUsageScore(
         getAccountQuota(entry.accountId),
         getPoolAccountPlanForSelection(config, entry.accountId, selectionOptions),
+      now,
       )
     : 0;
   const overThreshold = threshold > 0 && !isUnknownUsage(usage) && usage >= threshold;
@@ -1848,6 +1899,7 @@ export function previewCodexAccountForRequest(
     const usage = computeCodexUsageScore(
       getAccountQuota(active),
       getPoolAccountPlanForSelection(config, active, selectionOptions),
+      now,
     );
     if (!isUnknownUsage(usage) && usage >= threshold) {
       active = pickLowerUsageAccount(config, active, usage, now, quotaScope, selectionOptions);
@@ -1887,7 +1939,7 @@ export function resolveCodexAccountForThreadDetailed(
   // revive after quota resets. Independent model scopes must never persist a
   // change to shared routing state.
   if (!isIndependentCodexQuotaScope(quotaScope)) {
-    releaseDrainedCodexAccountPin(config, sharedStateSelectionOptions(selectionOptions));
+    releaseDrainedCodexAccountPin(config, sharedStateSelectionOptions(selectionOptions), now);
   }
   const sharedActiveBeforeSelection = getEffectiveActiveCodexAccountId(config);
   const preserveSharedSelectionForModelDetour = modelScopedSelection && (
@@ -1945,7 +1997,7 @@ export function resolveCodexAccountForThreadDetailed(
       && isCodexAccountSelectable(config, entry.accountId, now, quotaScope, selectionOptions);
     const failoverReady = shouldFailover(config, entry.accountId, now);
     const healthyForSharedAffinity = selectableForSharedState
-      && hasCodexQuotaHeadroom(config, entry.accountId, sharedSelectionOptions)
+      && hasCodexQuotaHeadroom(config, entry.accountId, sharedSelectionOptions, now)
       && !failoverReady;
     if (
       selectableForRequest
@@ -2041,7 +2093,7 @@ export function resolveCodexAccountForThreadDetailed(
     sharedSelectionOptions,
   );
   const activeHealthyForSharedSelection = activeSelectableForSharedState
-    && hasCodexQuotaHeadroom(config, active, sharedSelectionOptions)
+    && hasCodexQuotaHeadroom(config, active, sharedSelectionOptions, now)
     && !shouldFailover(config, active, now);
   if (!isCodexAccountSelectable(config, active, now, quotaScope, selectionOptions)) {
     const fallback = pickLowestUsageCodexAccount(config, active, now, quotaScope, selectionOptions);

package/src/codex/shim.ts

@@ -1,7 +1,7 @@
 import { randomUUID } from "node:crypto";
 import { spawnSync } from "node:child_process";
 import { tmpdir } from "node:os";
-import { basename, delimiter, dirname, extname, join, posix } from "node:path";
+import { basename, delimiter, dirname, extname, join, posix, win32 } from "node:path";
 import {
   chmodSync,
   closeSync,
@@ -264,6 +264,28 @@ interface ShimFileState {
   preserveOnly?: boolean;
 }
 
+export type CodexShimBackingForCommand =
+  | Readonly<{ status: "not-tracked" }>
+  | Readonly<{
+      status: "matched";
+      selectedRole: "wrapper" | "backing";
+      backingPath: string;
+      backingKind: "backup" | "real";
+    }>
+  | Readonly<{
+      status: "unknown";
+      reason:
+        | "state_invalid"
+        | "platform_mismatch"
+        | "ambiguous_match"
+        | "preserve_only"
+        | "backing_missing"
+        | "backing_mismatch"
+        | "binding_unavailable"
+        | "wrapper_unhealthy"
+        | "version_manager_refused";
+    }>;
+
 interface ShimPathFingerprint {
   dev: number;
   ino: number;
@@ -616,8 +638,13 @@ function backupPathFor(path: string): string {
  * deliberately excluded: a false positive here refuses a restore that would
  * otherwise be correct.
  */
-export function isVersionManagerOwnedCodexPath(path: string): boolean {
-  const normalized = path.replace(/\\/g, "/").toLowerCase();
+export function isVersionManagerOwnedCodexPath(
+  path: string,
+  platform: NodeJS.Platform = process.platform,
+): boolean {
+  const normalized = (platform === "win32"
+    ? win32.normalize(path).replace(/\\/g, "/")
+    : posix.normalize(path)).toLowerCase();
   return normalized.includes("/mise/installs/")
     || normalized.includes("/mise/shims/")
     || normalized.includes("/.asdf/installs/")
@@ -1078,6 +1105,7 @@ exit $LASTEXITCODE
 
 interface ShimStateReadResult {
   state: ShimState | null;
+  present: boolean;
   warning?: string;
 }
 
@@ -1087,7 +1115,17 @@ function fileErrorCode(error: unknown): string | undefined {
     : undefined;
 }
 
-function readBoundedRegularFile(path: string, maxBytes: number): { content: string } | { warning: string } | null {
+function readBoundedRegularFile(path: string, maxBytes: number): { bytes: Buffer; content: string } | { warning: string } | null {
+  let lexicalBefore: Stats;
+  try {
+    lexicalBefore = lstatSync(path);
+    if (lexicalBefore.isSymbolicLink() || !lexicalBefore.isFile()) {
+      return { warning: `Codex shim state is not a direct regular file at ${path}; auto-restore skipped.` };
+    }
+  } catch (error) {
+    if (fileErrorCode(error) === "ENOENT") return null;
+    return { warning: `Codex shim state could not be inspected at ${path}.` };
+  }
   let fd: number;
   try {
     fd = openSync(path, "r");
@@ -1113,25 +1151,33 @@ function readBoundedRegularFile(path: string, maxBytes: number): { content: stri
       return { warning: `Codex shim state exceeds the 1 MiB startup limit at ${path}; auto-restore skipped.` };
     }
     const after = fstatSync(fd);
+    let lexicalAfter: Stats;
+    try {
+      lexicalAfter = lstatSync(path);
+    } catch {
+      return { warning: `Codex shim state changed while being read at ${path}; auto-restore skipped.` };
+    }
     if (before.dev !== after.dev || before.ino !== after.ino || before.size !== after.size
-      || before.mtimeMs !== after.mtimeMs || before.ctimeMs !== after.ctimeMs) {
+      || before.mtimeMs !== after.mtimeMs || before.ctimeMs !== after.ctimeMs
+      || lexicalBefore.dev !== before.dev || lexicalBefore.ino !== before.ino
+      || lexicalAfter.isSymbolicLink() || lexicalAfter.dev !== after.dev || lexicalAfter.ino !== after.ino) {
       return { warning: `Codex shim state changed while being read at ${path}; auto-restore skipped.` };
     }
-    return { content: buffer.toString("utf8") };
+    return { bytes: buffer, content: buffer.toString("utf8") };
   } finally {
     closeSync(fd);
   }
 }
 
-function readStateResult(): ShimStateReadResult {
-  const bounded = readBoundedRegularFile(statePath(), CODEX_SHIM_STATE_MAX_BYTES);
-  if (!bounded) return { state: null };
-  if ("warning" in bounded) return { state: null, warning: bounded.warning };
+function readStateResult(path = statePath()): ShimStateReadResult {
+  const bounded = readBoundedRegularFile(path, CODEX_SHIM_STATE_MAX_BYTES);
+  if (!bounded) return { state: null, present: false };
+  if ("warning" in bounded) return { state: null, present: true, warning: bounded.warning };
   try {
     const value = JSON.parse(bounded.content) as unknown;
-    if (!value || typeof value !== "object") return { state: null };
+    if (!value || typeof value !== "object") return { state: null, present: true };
     const state = value as Record<string, unknown>;
-    if (typeof state.platform !== "string") return { state: null };
+    if (typeof state.platform !== "string") return { state: null, present: true };
     const validFile = (item: unknown): item is ShimFileState => {
       if (!item || typeof item !== "object") return false;
       const file = item as Record<string, unknown>;
@@ -1142,13 +1188,13 @@ function readStateResult(): ShimStateReadResult {
         && (file.preserveOnly === undefined || typeof file.preserveOnly === "boolean");
     };
     if (state.wrappers !== undefined) {
-      if (!Array.isArray(state.wrappers) || state.wrappers.length === 0 || !state.wrappers.every(validFile)) return { state: null };
+      if (!Array.isArray(state.wrappers) || state.wrappers.length === 0 || !state.wrappers.every(validFile)) return { state: null, present: true };
     } else if (!validFile(state)) {
-      return { state: null };
+      return { state: null, present: true };
     }
-    return { state: state as unknown as ShimState };
+    return { state: state as unknown as ShimState, present: true };
   } catch {
-    return { state: null };
+    return { state: null, present: true };
   }
 }
 
@@ -1156,6 +1202,146 @@ function readState(): ShimState | null {
   return readStateResult().state;
 }
 
+export function isLocalAbsoluteInspectionPath(path: string, platform: NodeJS.Platform): boolean {
+  if (platform !== "win32") return posix.isAbsolute(path);
+  const normalized = path.replace(/\//g, "\\");
+  // UNC and device namespaces can initiate remote I/O while a nominally local
+  // inspection is resolving user-controlled paths. Root-relative paths are
+  // drive-context dependent, so require an explicit local drive as well.
+  return win32.isAbsolute(path)
+    && /^[a-z]:\\/i.test(normalized)
+    && !normalized.startsWith("\\\\");
+}
+
+function windowsShimInspectionIsDeferred(platform: NodeJS.Platform): boolean {
+  return platform === "win32";
+}
+
+/** Resolve one selected command through already-recorded shim state, without repair. */
+export function inspectCodexShimBackingForCommand(
+  selectedCommand: string,
+  platform: NodeJS.Platform = process.platform,
+  configDir: string = getConfigDir(),
+): CodexShimBackingForCommand {
+  // Pathname prechecks cannot prevent a writable Windows ancestor from being
+  // replaced with a remote reparse point before the later state/fingerprint
+  // reads. Keep the exported read-only helper fail-closed until those reads are
+  // performed through a handle-bound Windows provenance layer.
+  if (windowsShimInspectionIsDeferred(platform)) {
+    return Object.freeze({ status: "unknown" as const, reason: "binding_unavailable" as const });
+  }
+  if (!isLocalAbsoluteInspectionPath(configDir, platform)) {
+    return Object.freeze({ status: "unknown" as const, reason: "state_invalid" as const });
+  }
+  const stateFile = join(configDir, "codex-shim.json");
+  try {
+    const stateEntry = lstatSync(stateFile);
+    if (stateEntry.isSymbolicLink()) {
+      return Object.freeze({ status: "unknown" as const, reason: "state_invalid" as const });
+    }
+  } catch (error) {
+    if (fileErrorCode(error) !== "ENOENT") {
+      return Object.freeze({ status: "unknown" as const, reason: "state_invalid" as const });
+    }
+  }
+  const result = readStateResult(stateFile);
+  if (!result.state) {
+    return result.present
+      ? Object.freeze({ status: "unknown" as const, reason: "state_invalid" as const })
+      : Object.freeze({ status: "not-tracked" as const });
+  }
+  const pathApi = platform === "win32" ? win32 : posix;
+  const samePath = (left: string, right: string): boolean => {
+    const normalizedLeft = pathApi.resolve(left);
+    const normalizedRight = pathApi.resolve(right);
+    return platform === "win32"
+      ? normalizedLeft.toLowerCase() === normalizedRight.toLowerCase()
+      : normalizedLeft === normalizedRight;
+  };
+  const files = stateFiles(result.state);
+  if (files.some(file => !file.wrapperPath || !file.originalPath || !file.backupPath
+    || ![file.wrapperPath, file.originalPath, file.backupPath, file.realPath]
+      .filter((path): path is string => typeof path === "string")
+      .every(path => isLocalAbsoluteInspectionPath(path, platform)))) {
+    return Object.freeze({ status: "unknown" as const, reason: "state_invalid" as const });
+  }
+  const wrapperKeys = files.map(file => platform === "win32"
+    ? pathApi.resolve(file.wrapperPath).toLowerCase()
+    : pathApi.resolve(file.wrapperPath));
+  if (new Set(wrapperKeys).size !== wrapperKeys.length) {
+    return Object.freeze({ status: "unknown" as const, reason: "state_invalid" as const });
+  }
+  const selectedFingerprint = shimPathFingerprint(selectedCommand);
+  if (!selectedFingerprint) {
+    return Object.freeze({ status: "unknown" as const, reason: "binding_unavailable" as const });
+  }
+  const selectedIdentity = selectedFingerprint.target ?? selectedFingerprint;
+  const sameEffectiveIdentity = (fingerprint: ShimPathFingerprint | null): boolean => {
+    if (!fingerprint) return false;
+    const identity = fingerprint.target ?? fingerprint;
+    return identity.dev === selectedIdentity.dev && identity.ino === selectedIdentity.ino;
+  };
+  const matches = files.flatMap(file => {
+    const backingPath = file.realPath ?? file.backupPath;
+    const roles: Array<"wrapper" | "backing"> = [];
+    if (samePath(file.wrapperPath, selectedCommand)
+      || sameEffectiveIdentity(shimPathFingerprint(file.wrapperPath))) {
+      roles.push("wrapper");
+    }
+    if (samePath(backingPath, selectedCommand)
+      || sameEffectiveIdentity(shimPathFingerprint(backingPath))) {
+      roles.push("backing");
+    }
+    return roles.map(selectedRole => ({ file, backingPath, selectedRole }));
+  });
+  if (matches.length === 0) return Object.freeze({ status: "not-tracked" as const });
+  if (result.state.platform !== platform) {
+    return Object.freeze({ status: "unknown" as const, reason: "platform_mismatch" as const });
+  }
+  if (matches.length !== 1) {
+    return Object.freeze({ status: "unknown" as const, reason: "ambiguous_match" as const });
+  }
+  const { file, backingPath, selectedRole } = matches[0]!;
+  if (file.preserveOnly === true) {
+    return Object.freeze({ status: "unknown" as const, reason: "preserve_only" as const });
+  }
+  const backing = statFingerprint(backingPath, true);
+  if (!backing || backing.size <= 0 || samePath(backingPath, file.wrapperPath)) {
+    return Object.freeze({ status: "unknown" as const, reason: "backing_missing" as const });
+  }
+  const wrapperProbe = stableShimPathProbe(file.wrapperPath);
+  if (!wrapperProbe || !isHealthyShimProbe(wrapperProbe, result.state.platform)) {
+    return Object.freeze({
+      status: "unknown" as const,
+      reason: isVersionManagerOwnedCodexPath(file.wrapperPath)
+        ? "version_manager_refused" as const
+        : "wrapper_unhealthy" as const,
+    });
+  }
+  const wrapperIdentity = wrapperProbe.fingerprint.target ?? wrapperProbe.fingerprint;
+  if (backing.dev === wrapperIdentity.dev && backing.ino === wrapperIdentity.ino) {
+    return Object.freeze({ status: "unknown" as const, reason: "backing_mismatch" as const });
+  }
+  const wrapperExt = extname(file.wrapperPath).toLowerCase();
+  const invokesBacking = platform !== "win32"
+    ? wrapperProbe.prefix.includes(`exec ${shQuote(backingPath)} "$@"`)
+    : wrapperExt === ".cmd" || wrapperExt === ".bat"
+      ? wrapperProbe.prefix.includes(windowsBatchSet("OCX_REAL_CODEX", backingPath))
+        && wrapperProbe.prefix.includes('"%OCX_REAL_CODEX%" %*')
+      : wrapperExt === ".ps1"
+        ? wrapperProbe.prefix.includes(`& ${psString(backingPath)} @args`)
+        : wrapperProbe.prefix.includes(`exec ${shQuote(gitBashPath(backingPath))} "$@"`);
+  if (!invokesBacking) {
+    return Object.freeze({ status: "unknown" as const, reason: "backing_mismatch" as const });
+  }
+  return Object.freeze({
+    status: "matched" as const,
+    selectedRole,
+    backingPath,
+    backingKind: file.realPath !== undefined ? "real" as const : "backup" as const,
+  });
+}
+
 function statePath(): string {
   return join(getConfigDir(), "codex-shim.json");
 }
@@ -1283,7 +1469,7 @@ function stateFiles(state: ShimState): ShimFileState[] {
 }
 
 function primaryState(files: ShimFileState[]): ShimState {
-  const first = files[0];
+  const first = files[0]!;
   return { platform: process.platform, ...first, wrappers: files };
 }
 
@@ -2067,7 +2253,7 @@ export function autoRestoreCodexShim(options: {
   const state = stateRead.state;
   if (!state) {
     if (stateRead.warning) return { status: "ineligible", message: stateRead.warning };
-    return { status: existsSync(statePath()) ? "ineligible" : "not-installed" };
+    return { status: stateRead.present ? "ineligible" : "not-installed" };
   }
   if (state.platform !== process.platform) return { status: "ineligible" };
 

package/src/codex/subagent-model-fallback.ts

@@ -226,7 +226,10 @@ export function isNativeModelQuotaExhausted(
   const resolvedAccountId = resolveRouteFallbackAccountId(route, config, accountId);
   if (!resolvedAccountId) return false;
   const quota = getAccountQuota(resolvedAccountId);
-  const usage = computeCodexUsageScore(quota, getPoolAccountPlan(config, resolvedAccountId));
+  // Subagent fallback reads the same score, so a stale terminal reading would push
+  // subagents off a native model whose window has already reset. Thread the caller's clock
+  // rather than letting the scorer read wall time - the two would silently diverge.
+  const usage = computeCodexUsageScore(quota, getPoolAccountPlan(config, resolvedAccountId), now);
   if (usage >= CODEX_UNKNOWN_USAGE_SCORE) return false;
   return usage >= quotaThreshold(config);
 }

package/src/codex/user-identity.ts

@@ -18,6 +18,7 @@ import {
 import { isAbsolute, join, resolve } from "node:path";
 
 import { resolveTrustedWindowsPowerShellExe } from "../lib/windows-elevation";
+import { WINDOWS_PRINCIPAL_LOOKUP_TIMEOUT_MS } from "../lib/windows-user-principal";
 
 import type {
   ResolveCodexCoordinatorDatabasePath,
@@ -55,7 +56,7 @@ const SID_PATTERN = /^S-1-(?:\d+-)+\d+$/i;
  * fails the lookup and the caller still refuses rather than writing. Only the
  * ceiling moved, and it moved for the case where the lookup would have succeeded.
  */
-const WINDOWS_POWERSHELL_LOOKUP_TIMEOUT_MS = 30_000;
+const WINDOWS_POWERSHELL_LOOKUP_TIMEOUT_MS = WINDOWS_PRINCIPAL_LOOKUP_TIMEOUT_MS;
 
 function windowsIdentityLookupTimeoutMs(): number {
   return WINDOWS_POWERSHELL_LOOKUP_TIMEOUT_MS;