@bitkyc08/opencodex 2.48.0 → 2.50.0

package/src/images/loop.ts

@@ -537,6 +537,7 @@ export async function runWithImageBridge(deps: ImageBridgeDeps): Promise<Respons
                 // hop-by-hop header alone (oven-sh/bun#20492).
                 return requestFetch(request.url, applyUpstreamRecoveryInit({
                   method: request.method,
+                  redirect: "manual",
                   headers: h,
                   body: request.body,
                   signal: headerDeadline.signal,

package/src/images/xai-video-client.ts

@@ -80,6 +80,7 @@ export async function submitVideoJob(
 
   const resp = await fetch(`${auth.baseUrl}/videos/generations`, {
     method: "POST",
+    redirect: "manual",
     headers: {
       "Authorization": `Bearer ${auth.token}`,
       "Content-Type": "application/json",
@@ -118,6 +119,7 @@ export async function pollVideoJob(
 
   const resp = await fetch(`${auth.baseUrl}/videos/${encodeURIComponent(requestId)}`, {
     method: "GET",
+    redirect: "manual",
     headers: {
       "Authorization": `Bearer ${auth.token}`,
     },

package/src/integrations/registry.ts

@@ -190,6 +190,7 @@ export const INTEGRATION_CLIENTS: Record<IntegrationClientId, IntegrationClientS
     id: "hermes",
     configPath: (env = process.env, home = homedir()) => hermesConfigPath(env, home),
     detectDir: (env = process.env, home = homedir()) => hermesHomeDir(env, home),
+    sourcePreservingYaml: { path: ["providers", "opencodex"] },
   },
   openclaw: {
     id: "openclaw",

package/src/lib/errors.ts

@@ -209,6 +209,14 @@ export function classifyError(status: number, type: string, message: string): Oc
   if (type === "input_admission_refused") {
     return { message, type: "invalid_request_error", code: "input_admission_refused" };
   }
+  // A LOCAL inbound admission refusal (#3573) keeps its own code for the same reason as the
+  // preflight refusal above. #4112 gave the UPSTREAM 413 on this surface
+  // `context_length_exceeded`; without a distinct code here a client cannot tell a body the
+  // proxy never read from a turn the provider itself rejected, and only one of the two is
+  // fixed by raising `maxInboundBodyBytes`.
+  if (type === "inbound_body_too_large") {
+    return { message, type: "invalid_request_error", code: "inbound_body_too_large" };
+  }
   if (
     text.includes("context_length_exceeded") ||
     text.includes("context window") ||

package/src/lib/privacy.ts

@@ -10,6 +10,31 @@ export function maskEmail(value: string | null | undefined): string | null {
   return `${local[0]}***${local[local.length - 1]}@${domain}`;
 }
 
+/**
+ * Whether stored account emails are masked in management and CLI projections (#3859).
+ *
+ * Fail closed on every ambiguity: a missing config, a missing `privacy` block, and a missing or
+ * malformed `maskEmails` all mask. Only the literal boolean `false` unmasks, so a hand-edited
+ * `"false"` string or a typo cannot silently disclose an address. Callers read this once at the
+ * request boundary and pass the answer down — the projection helpers take a boolean rather than
+ * a config so that `getLoginStatus` stays free of config I/O.
+ */
+export function emailMaskingEnabled(config: { privacy?: { maskEmails?: boolean } } | null | undefined): boolean {
+  return config?.privacy?.maskEmails !== false;
+}
+
+/**
+ * Project a stored account email for a surface outside the proxy (#3859).
+ *
+ * One redaction decision for every call site, rather than each one forking on the flag: an
+ * unmasked projection still normalises an empty or absent address to `null`, so a consumer's
+ * "is there an email" test cannot start answering differently just because masking is off.
+ */
+export function projectEmail(value: string | null | undefined, mask: boolean): string | null {
+  if (!mask) return value ? value : null;
+  return maskEmail(value);
+}
+
 export function maskAccountId(value: string | null | undefined): string | null {
   if (!value) return null;
   const id = value.trim();

package/src/lib/process-control.ts

@@ -66,12 +66,30 @@ export function gracefulStopHost(hostname: string | undefined): string {
 }
 
 /**
- * Outcome of a graceful stop attempt. `"refused"` is distinct from failure: the proxy answered
- * that it must NOT be stopped from here, so callers must not escalate to a forced kill.
+ * `"refused"` forbids forced stop. `"teardown-unconfirmed"` means the process exited,
+ * but its assigned shared teardown was not confirmed; callers must not kill it again.
  */
-export type GracefulStopResult = boolean | "refused";
+export type GracefulStopResult = boolean | "refused" | "teardown-unconfirmed";
 
-/** A proxy declined shutdown because a service under another home owns it (HTTP 409). */
+/**
+ * The server's own explanation for the most recent 409, captured so `stopProxy` can report
+ * the real reason. There is more than one: a scheduler wrapper under another home, or the
+ * proxy being the installed service itself (#4023). Module-scoped because
+ * `GracefulStopResult` is a public contract with several callers, and widening it to carry
+ * the text would change every one of them for a message only this file reports.
+ */
+let lastRefusalMessage: string | null = null;
+
+/** The server's explanation for the most recent 409, or `null` when it sent none. */
+export function lastStopRefusalMessage(): string | null {
+  return lastRefusalMessage;
+}
+
+/**
+ * A proxy declined shutdown (HTTP 409). There is more than one reason it can say no — a
+ * scheduler wrapper under another home, or the proxy being the installed service itself
+ * (#4023) — so the server's own message is carried through rather than guessed at.
+ */
 export class ProxyOwnershipRefusedError extends Error {}
 
 /**
@@ -82,6 +100,8 @@ export class ProxyOwnershipRefusedError extends Error {}
  * chance to run its shutdown handlers. Returns false when the proxy can't be reached
  * or doesn't exit in time — callers fall back to {@link killProxy}. Returns `"refused"`
  * when the proxy declines the stop (HTTP 409), which callers must NOT force past.
+ * True requires the expected shared-teardown response and an observed exit. It does not
+ * attest the process exit code or completion of every drain/shutdown hook.
  */
 export async function stopProxyGracefully(pid: number, io: GracefulStopIo = {}): Promise<GracefulStopResult> {
   const readRuntime = io.readRuntime ?? readRuntimePort;
@@ -92,6 +112,7 @@ export async function stopProxyGracefully(pid: number, io: GracefulStopIo = {}):
   const token = configuredAdminToken(env.OPENCODEX_HOME?.trim() || undefined, env as NodeJS.ProcessEnv);
   if (token) headers["x-opencodex-api-key"] = token;
   const fetchFn = io.fetchFn ?? fetch;
+  let sharedTeardownConfirmed = false;
   try {
     // `ocx stop` asks the proxy NOT to restore shared client config: it does that itself,
     // after verifying a stopped Task Scheduler did not respawn the proxy (#3008). Letting
@@ -111,8 +132,23 @@ export async function stopProxyGracefully(pid: number, io: GracefulStopIo = {}):
     // would respawn it anyway). That is a policy answer, not a dead endpoint — escalating to
     // SIGTERM here would run the daemon's cleanup and strip shared config out from under the
     // still-running service. Report the refusal instead of forcing.
-    if (res.status === 409) return "refused";
+    if (res.status === 409) {
+      lastRefusalMessage = await res.json()
+        .then(body => {
+          const message = (body as { message?: unknown } | null)?.message;
+          return typeof message === "string" && message.trim() ? message.trim() : null;
+        })
+        .catch(() => null);
+      return "refused";
+    }
     if (!res.ok) return false;
+    const body: unknown = await res.json().catch(() => null);
+    const expectedTeardown = io.deferSharedTeardownNonce ? "deferred" : "performed";
+    sharedTeardownConfirmed = body !== null
+      && typeof body === "object"
+      && !Array.isArray(body)
+      && "success" in body && body.success === true
+      && "sharedTeardown" in body && body.sharedTeardown === expectedTeardown;
   } catch {
     return false;
   }
@@ -120,7 +156,8 @@ export async function stopProxyGracefully(pid: number, io: GracefulStopIo = {}):
   // Honor the server's own drain window: /api/stop answers 200 first, then drains for
   // config.shutdownTimeoutMs. Waiting less than that hard-kills mid-drain.
   const exitTimeoutMs = io.exitTimeoutMs ?? drainDeadlineMs();
-  return waitExit(pid, exitTimeoutMs);
+  if (!waitExit(pid, exitTimeoutMs)) return false;
+  return sharedTeardownConfirmed ? true : "teardown-unconfirmed";
 }
 
 function drainDeadlineMs(): number {
@@ -140,10 +177,17 @@ export async function stopProxy(pid: number, io: GracefulStopIo = {}): Promise<b
     // The proxy refused on purpose (foreign service owns it). Forcing would strip shared
     // config while that service keeps the proxy alive.
     throw new ProxyOwnershipRefusedError(
-      "The running proxy refused to stop: a service installed under a different "
-      + "CODEX_HOME/OPENCODEX_HOME owns it. Run the stop from that home.",
+      lastRefusalMessage
+      ?? "The running proxy refused to stop: a service installed under a different "
+        + "CODEX_HOME/OPENCODEX_HOME owns it. Run the stop from that home.",
     );
   }
+  if (graceful === "teardown-unconfirmed") {
+    // Exit was observed, so do not enter the forced-stop fallback. Returning false keeps
+    // shared restoration with `ocx stop` instead of claiming that the proxy completed it.
+    await waitForStoppedPort(runtime, pid);
+    return false;
+  }
   if (graceful) {
     await waitForStoppedPort(runtime, pid);
     return true;

package/src/lib/upstream-retry.ts

@@ -226,6 +226,7 @@ export async function fetchWithAttemptDeadline(
     return await executor(url, {
       ...init,
       headers,
+      redirect: "manual",
       signal: attemptTimeout.signal,
     });
   } finally {

package/src/oauth/chatgpt.ts

@@ -40,6 +40,62 @@ export function extractAccountId(idToken?: string, accessToken?: string): string
   return undefined;
 }
 
+/**
+ * Three-way answer to "is this token marked as belonging to the ChatGPT account domain".
+ * Only ChatGPT-specific claims count as markers: a top-level chatgpt_account_id or the
+ * https://api.openai.com/auth namespace claim. A generic organizations claim is NOT domain
+ * evidence. JWT claims are decoded locally as routing markers, never as authenticity proof.
+ *
+ * absent  — no JWT, a payload that is not a JSON object, or an object carrying neither
+ *           marker key: the token may be a foreign credential and legacy foreign handling
+ *           applies. This function is total; it never throws on an attacker-shaped token.
+ * invalid — a marker key is present but yields no usable account id (non-string, blank,
+ *           namespace that is not an object, namespace without the claim) or the two
+ *           markers disagree. Presence is decided by the KEY, not by its shape, so a token
+ *           that claims this domain can never fall through to foreign handling just
+ *           because its marker is malformed.
+ * valid   — one consistent, non-blank ChatGPT account id.
+ */
+export type ChatGptDomainClaim =
+  | { kind: "absent" }
+  | { kind: "invalid" }
+  | { kind: "valid"; accountId: string };
+
+const CHATGPT_AUTH_NAMESPACE = "https://api.openai.com/auth";
+
+/** A usable account id is a non-blank string; blank or non-string values are malformed. */
+function usableAccountId(value: unknown): string | undefined {
+  return typeof value === "string" && value.trim() ? value.trim() : undefined;
+}
+
+export function inspectChatGptDomainClaim(token: string): ChatGptDomainClaim {
+  const payload: unknown = decodeJwtPayload(token);
+  // decodeJwtPayload returns whatever the payload segment parses to, which may be a
+  // primitive or an array. Those carry no marker and must not reach the key lookups,
+  // where `in`/hasOwn would throw and take the whole request down.
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) return { kind: "absent" };
+  const claims = payload as Record<string, unknown>;
+  // Presence is the KEY being there, as an own key. A reserved namespace that is null, a
+  // primitive, an array, or an object without the claim is a present-but-broken marker, so
+  // it stays invalid instead of being treated as a foreign token.
+  const topPresent = Object.hasOwn(claims, "chatgpt_account_id");
+  const nsPresent = Object.hasOwn(claims, CHATGPT_AUTH_NAMESPACE);
+  if (!topPresent && !nsPresent) return { kind: "absent" };
+  const topId = topPresent ? usableAccountId(claims.chatgpt_account_id) : undefined;
+  if (topPresent && !topId) return { kind: "invalid" };
+  let nsId: string | undefined;
+  if (nsPresent) {
+    const ns = claims[CHATGPT_AUTH_NAMESPACE];
+    const nsObj = ns !== null && typeof ns === "object" && !Array.isArray(ns)
+      ? ns as Record<string, unknown> : undefined;
+    nsId = nsObj ? usableAccountId(nsObj.chatgpt_account_id) : undefined;
+    if (!nsId) return { kind: "invalid" };
+  }
+  if (topId && nsId && topId !== nsId) return { kind: "invalid" };
+  const accountId = topId ?? nsId;
+  return accountId ? { kind: "valid", accountId } : { kind: "invalid" };
+}
+
 export function extractEmail(idToken?: string, accessToken?: string): string | undefined {
   for (const token of [idToken, accessToken]) {
     if (!token) continue;
@@ -50,6 +106,33 @@ export function extractEmail(idToken?: string, accessToken?: string): string | u
   return undefined;
 }
 
+/**
+ * Identity-agreement view of one token for security-sensitive bindings. `accountId` follows the
+ * existing extractAccountId precedence (top-level, then namespaced, then organizations[0]).
+ * `conflict` is true only when the two chatgpt_account_id encodings are both present and
+ * disagree — organizations entries are workspace memberships, not identity, so they never
+ * participate. Never logs token material.
+ */
+export function extractAccountIdClaims(token?: string): { accountId: string | undefined; conflict: boolean } {
+  if (!token) return { accountId: undefined, conflict: false };
+  const payload = decodeJwtPayload(token);
+  if (!payload) return { accountId: undefined, conflict: false };
+  const top = typeof payload.chatgpt_account_id === "string" ? payload.chatgpt_account_id : undefined;
+  const ns = payload["https://api.openai.com/auth"];
+  const namespaced = ns && typeof ns === "object"
+    && typeof (ns as Record<string, unknown>).chatgpt_account_id === "string"
+    ? (ns as Record<string, unknown>).chatgpt_account_id as string
+    : undefined;
+  const orgs = payload.organizations;
+  const org = Array.isArray(orgs) && orgs[0] && typeof orgs[0].id === "string"
+    ? orgs[0].id as string
+    : undefined;
+  return {
+    accountId: top ?? namespaced ?? org,
+    conflict: top !== undefined && namespaced !== undefined && top !== namespaced,
+  };
+}
+
 export function credsFromToken(data: Record<string, unknown>): OAuthCredentials {
   const idToken = typeof data.id_token === "string" ? data.id_token : undefined;
   // This parses a response from an external boundary, so the access token is

package/src/oauth/health.ts

@@ -1,7 +1,7 @@
 import { getCodexAccountHealthSnapshot, type CodexCooldownSource } from "../codex/routing";
 import { getAnthropicAccountHealthSnapshot } from "./anthropic-routing";
 import { isAccountNeedsReauth } from "../codex/account-runtime-state";
-import { getCodexAccountCredential, listCodexAccountIds } from "../codex/account-store";
+import { getCodexAccountCredential, listCodexAccountIds, readCodexAccountRecord } from "../codex/account-store";
 import { MAIN_CODEX_ACCOUNT_ID } from "../codex/main-account";
 import { readRuntimePort } from "../config/process-state";
 import { LOCAL_MANAGEMENT_READ_PATHS } from "../lib/local-management-capability";
@@ -15,7 +15,7 @@ export type OAuthAccountHealth =
   | { status: "healthy" }
   | { status: "cooldown"; until: string; reason: "rate_limit" | "quota" }
   | { status: "reauth_required"; reason: "unauthorized" | "forbidden" | "refresh_failed" }
-  | { status: "warning"; reason: "refresh_conflict" | "metadata_mismatch" | "stale_credentials" };
+  | { status: "warning"; reason: "refresh_conflict" | "metadata_mismatch" | "stale_credentials" | "validation_pending" };
 
 export type OAuthHealthLabel =
   | "Healthy"
@@ -24,7 +24,8 @@ export type OAuthHealthLabel =
   | "Reauthentication required"
   | "Refresh failed"
   | "Metadata mismatch"
-  | "Credential conflict";
+  | "Credential conflict"
+  | "Validation pending";
 
 /** Shared masked-id fallback when `maskAccountId` returns nullish. */
 export const MASKED_ACCOUNT_FALLBACK = "account-…????";
@@ -88,6 +89,9 @@ export function projectOAuthAccountHealth(input: {
 export const CODEX_REAUTH_ACTION = "reauthenticate via the dashboard Codex account pool";
 
 function actionFor(provider: string, health: OAuthAccountHealth): string | undefined {
+  if (health.status === "warning" && health.reason === "validation_pending") {
+    return "wait for quota recovery, then click Refresh quotas in the dashboard Codex account pool to finish validation";
+  }
   if (health.status === "reauth_required") {
     if (provider === "codex") return CODEX_REAUTH_ACTION;
     return `run \`ocx login ${provider}\``;
@@ -112,6 +116,8 @@ export function oauthHealthLabel(health: OAuthAccountHealth): OAuthHealthLabel {
       return health.reason === "refresh_failed" ? "Refresh failed" : "Reauthentication required";
     case "warning":
       switch (health.reason) {
+        case "validation_pending":
+          return "Validation pending";
         case "refresh_conflict":
           return "Credential conflict";
         case "metadata_mismatch":
@@ -198,11 +204,42 @@ export function projectCodexAccountHealth(input: {
   needsReauth: boolean;
   now?: number;
 }): OAuthAccountHealth {
+  // One read serves every verdict below. Each lookup re-reads and re-hardens the whole store
+  // file, and the main account lives in the native Codex auth file rather than the pool store,
+  // so a lookup for it could only ever miss.
+  const stored = input.accountId !== MAIN_CODEX_ACCOUNT_ID ? readCodexAccountRecord(input.accountId) : null;
+  const record = stored?.deletedAt == null ? stored : null;
+
+  // A successful quota read is not evidence that model authorization recovered.
+  // Preserve this guidance until validation succeeds or reauthentication replaces it.
+  const validationAuthFailed = record !== null
+    && record.codexValidationPending === true
+    && record.lastCodexValidationStatus === "failed"
+    && (record.lastCodexValidationError === "http_status:401" || record.lastCodexValidationError === "http_status:403");
+
+  // A persisted terminal verdict outranks the in-memory reauth flag rather than duplicating it:
+  // the flag lives in this process and a revoked grant does not. Without it, an account whose
+  // grant was revoked upstream keeps its login-time `lastCodexValidationStatus: "ok"` and every
+  // surface reports it healthy until someone tries to use it (#4120). Only a re-login clears the
+  // marker, so `reauth_required` is the accurate projection — and it is deliberately checked
+  // ahead of any cooldown, because telling an operator to wait out a rate limit on a credential
+  // that will never work again is a false promise.
+  const terminalGrantFailure = record !== null
+    && record.lastCodexValidationTerminal === true
+    && record.lastCodexValidationStatus === "failed";
+
+  const needsReauth = input.needsReauth || validationAuthFailed || terminalGrantFailure;
+
+  // Deferred validation is only worth reporting while the credential itself is still viable. A
+  // revoked grant needs a re-login, not a "Refresh quotas" click, so reauth is resolved first.
+  if (!needsReauth && record?.codexValidationPending) {
+    return { status: "warning", reason: "validation_pending" };
+  }
   const now = input.now ?? Date.now();
   const snap = getCodexAccountHealthSnapshot(input.accountId, now);
   return projectOAuthAccountHealth({
-    needsReauth: input.needsReauth,
-    reauthReason: input.needsReauth ? "refresh_failed" : undefined,
+    needsReauth,
+    reauthReason: needsReauth ? "refresh_failed" : undefined,
     cooldownUntilMs: snap?.cooldownUntil,
     cooldownReason: cooldownReasonFromSource(snap?.cooldownSource),
     now,
@@ -272,13 +309,11 @@ function collectLocalCodexEntries(now: number): OAuthHealthEntry[] {
     const hasPoolCredential = accountId !== MAIN_CODEX_ACCOUNT_ID && getCodexAccountCredential(accountId) !== null;
     if (!hasPoolCredential && !needsReauth && !snap) continue;
 
-    const health = projectOAuthAccountHealth({
-      needsReauth,
-      reauthReason: needsReauth ? "refresh_failed" : undefined,
-      cooldownUntilMs: snap?.cooldownUntil,
-      cooldownReason: cooldownReasonFromSource(snap?.cooldownSource),
-      now,
-    });
+    // Call the projector rather than inlining a second copy of it. This collector serves the CLI
+    // (`ocx status`, `ocx doctor`) while the dashboard DTO goes through projectCodexAccountHealth,
+    // and the duplicated body is exactly how the CLI would have kept reporting a revoked account
+    // as healthy after the dashboard stopped.
+    const health = projectCodexAccountHealth({ accountId, needsReauth, now });
     pushEntry(entries, "codex", accountId, health);
   }
   return entries;

package/src/oauth/index.ts

@@ -4,7 +4,7 @@ import { parseCallbackInput } from "./callback-server";
 import type { OcxConfig, OcxProviderConfig, RefreshPolicy } from "../types";
 import { ConfigMutationLockError, loadConfig, mutatePersistedConfig, saveConfig } from "../config";
 import { resolveProviderApiKey } from "../providers/key-store";
-import { maskEmail } from "../lib/privacy";
+import { projectEmail } from "../lib/privacy";
 import { KiroTokenRefreshError, environmentKiroRoutingMetadata, loginKiro, refreshKiroToken, settleKiroLoginTransaction } from "./kiro";
 import {
   OAuthMutationBusyError,
@@ -1781,19 +1781,54 @@ export function submitManualLoginCode(provider: string, input: string): { ok: tr
   return { ok: true };
 }
 
-export interface OAuthAccountSummary { id: string; alias?: string; email?: string; active: boolean; needsReauth?: boolean; expiresAt?: number }
+export interface OAuthAccountSummary {
+  id: string;
+  alias?: string;
+  email?: string;
+  active: boolean;
+  needsReauth?: boolean;
+  expiresAt?: number;
+  /**
+   * Subscription tier, mirroring the field the OpenAI/Codex provider reports, so a consumer
+   * weighting a multi-account pool by seat size needs no per-provider branching (#3777).
+   *
+   * Always present and explicitly `null` when the tier is unknown. The distinction matters:
+   * an ABSENT key means the proxy is too old to report a tier at all, while `null` means this
+   * version looked and upstream did not say. Omitting it would make those indistinguishable and
+   * invite a consumer to assume a tier.
+   *
+   * Every OAuth provider reports `null` today. Anthropic's `/api/oauth/usage` returns quota
+   * buckets only — `five_hour`, `seven_day`, the model-scoped weekly windows and `limits[]` —
+   * and carries no subscription/tier field, and its token response carries none either. See
+   * `fetchAnthropicUsageQuota` in `src/providers/quota.ts`.
+   */
+  plan: string | null;
+}
 
-export function getLoginStatus(provider: string): { loggedIn: boolean; email?: string; source?: OAuthCredentials["source"]; error?: string; done: boolean; activeAccountId?: string; accounts?: OAuthAccountSummary[] } {
+/**
+ * Token-safe login state for one provider.
+ *
+ * `maskEmails` is an explicit boolean rather than a config read (#3859). This module must not
+ * acquire a dependency on config I/O to answer a redaction question: the caller already holds
+ * the config at its request boundary and resolves the policy there with `emailMaskingEnabled`.
+ * The default masks, so every existing caller keeps today's behaviour.
+ */
+export function getLoginStatus(provider: string, maskEmails = true): { loggedIn: boolean; email?: string; source?: OAuthCredentials["source"]; error?: string; done: boolean; activeAccountId?: string; accounts?: OAuthAccountSummary[] } {
   const cred = getCredential(provider);
   const st = loginState.get(provider);
   const set = getAccountSet(provider);
   const accounts: OAuthAccountSummary[] | undefined = set?.accounts.map(a => ({
     id: a.id,
     ...(a.alias ? { alias: a.alias } : {}),
-    email: maskEmail(a.credential.email) ?? undefined,
+    email: projectEmail(a.credential.email, maskEmails) ?? undefined,
     active: a.id === set.activeAccountId,
     ...(a.needsReauth ? { needsReauth: true } : {}),
     expiresAt: a.credential.expires,
+    // Explicitly null rather than omitted — see OAuthAccountSummary.plan. No OAuth provider
+    // exposes a subscription tier today, so there is nothing truthful to put here; deriving one
+    // from quota percentages is not possible, because they are normalized per account and a
+    // half-consumed small seat is indistinguishable from a half-consumed large one.
+    plan: null,
   }));
 
   // A stored credential counts as "logged in" when it exists and is not marked for
@@ -1805,7 +1840,7 @@ export function getLoginStatus(provider: string): { loggedIn: boolean; email?: s
     .find(a => a.id === set.activeAccountId)?.needsReauth === true;
   return {
     loggedIn: !!cred && !activeNeedsReauth,
-    email: maskEmail(cred?.email) ?? undefined,
+    email: projectEmail(cred?.email, maskEmails) ?? undefined,
     source: cred?.source,
     error: st?.error,
     done: st?.done ?? false,
@@ -1813,10 +1848,13 @@ export function getLoginStatus(provider: string): { loggedIn: boolean; email?: s
   };
 }
 
-/** Token-safe per-provider login state for the CLI `ocx status` logins section (no tokens, masked email). */
-export function oauthLoginSummary(): Array<{ provider: string; loggedIn: boolean; email?: string }> {
+/**
+ * Token-safe per-provider login state for the CLI `ocx status` logins section. Never tokens; the
+ * email follows the operator's `privacy.maskEmails` policy, masked by default (#3859).
+ */
+export function oauthLoginSummary(maskEmails = true): Array<{ provider: string; loggedIn: boolean; email?: string }> {
   return listOAuthProviders().map(provider => {
-    const status = getLoginStatus(provider);
+    const status = getLoginStatus(provider, maskEmails);
     return { provider, loggedIn: status.loggedIn, ...(status.email ? { email: status.email } : {}) };
   });
 }

package/src/oauth/token-guardian.ts

@@ -211,21 +211,30 @@ export async function guardianSweep(nowMs: number = Date.now()): Promise<Guardia
       if (!cred) continue;
       const needsRefresh = cred.expiresAt <= nowMs + horizonMs;
       const needsWarmup = opts.codexWarmupEnabled
+        && !record.codexValidationPending
         && (record.lastCodexValidatedAt === undefined || nowMs - record.lastCodexValidatedAt > opts.codexWarmupMaxAgeSeconds * 1000);
       if (!needsRefresh && !needsWarmup) continue;
       const key = `codex:${id}`;
       if (inBackoff(key, nowMs)) { result.skippedBackoff.push(key); continue; }
+      // The generation this sweep is acting on. A successful refresh commits a new one, and a
+      // failure that follows belongs to THAT credential, so the fence has to move with it.
+      let observedGeneration = record.generation;
       tasks.push(async () => {
+        let warmupGeneration: number | undefined;
         try {
           const token = await getValidCodexToken(id);
+          observedGeneration = token.generation;
           if (needsRefresh) result.refreshed.push(key);
-          if (needsWarmup) {
+          const current = readCodexAccountRecord(id);
+          if (needsWarmup && current?.credential && current.deletedAt == null
+            && !current.codexValidationPending && current.generation === token.generation) {
+            warmupGeneration = token.generation;
             await warmCodexAccount({
               accessToken: token.accessToken,
               chatgptAccountId: token.chatgptAccountId,
               model: opts.codexWarmupModel,
             });
-            markCodexAccountValidated(id, Date.now());
+            markCodexAccountValidated(id, Date.now(), token.generation);
             result.warmed.push(key);
           }
           backoff.delete(key);
@@ -235,11 +244,28 @@ export async function guardianSweep(nowMs: number = Date.now()): Promise<Guardia
             result.skippedBackoff.push(key);
             return;
           }
-          const permanent = err instanceof TokenRefreshError && (err.reason === "revoked" || err.reason === "expired");
-          if (needsWarmup && !(err instanceof TokenRefreshError)) {
-            markCodexAccountValidationFailed(id, codexWarmupFailureReason(err));
+          const terminal = err instanceof TokenRefreshError && (err.reason === "revoked" || err.reason === "expired")
+            ? err
+            : undefined;
+          if (terminal) {
+            // A revoked or expired refresh grant is the strongest terminal evidence there is, and
+            // it used to be the one class that never reached the record: the persisted-verdict
+            // branch below requires `needsWarmup`, which is false in the default configuration,
+            // and additionally excluded every TokenRefreshError. The verdict landed only in the
+            // in-memory backoff map, which no health surface reads and no restart survives, so the
+            // account kept its login-time "ok" while every request with it 401'd (#4120).
+            markCodexAccountValidationFailed(id, `refresh_${terminal.reason}`, {
+              expectedGeneration: observedGeneration,
+              terminal: true,
+            });
+          } else if (warmupGeneration !== undefined && !(err instanceof TokenRefreshError)) {
+            // warmupGeneration is set only once the warmup actually started against a record
+            // still at the token's generation, so it is a tighter fence than the pre-sweep read.
+            markCodexAccountValidationFailed(id, codexWarmupFailureReason(err), {
+              expectedGeneration: warmupGeneration,
+            });
           }
-          recordFailure(key, nowMs, opts.backoffBaseSeconds, opts.backoffMaxSeconds, permanent, writerGeneration);
+          recordFailure(key, nowMs, opts.backoffBaseSeconds, opts.backoffMaxSeconds, terminal !== undefined, writerGeneration);
           result.failed.push(key);
         }
       });