@bitkyc08/opencodex 2.48.0 → 2.50.0

package/src/codex/auth-api.ts

@@ -12,6 +12,7 @@ import {
   isCodexAccountGenerationLive,
   forceRefreshCodexPoolToken,
   markCodexAccountValidated,
+  markCodexAccountValidationFailed,
   readCodexAccountRecord,
   saveCodexAccountCredential,
   CodexCredentialGenerationConflictError,
@@ -114,7 +115,7 @@ export { clearMainAccountInfoCache } from "./main-account-cache";
 import type { CodexQuotaRefreshOutcome } from "./quota-refresh-outcome";
 import { getMainAccountHardLockStatus, type MainAccountHardLockStatus } from "./main-account-hard-lock";
 import { observeMainReserveRevocation } from "./reserve-availability";
-import { maskEmail } from "../lib/privacy";
+import { emailMaskingEnabled, projectEmail } from "../lib/privacy";
 import { codexWarmupFailureReason, warmCodexAccount } from "./warmup";
 export { maskEmail } from "../lib/privacy";
 import type { CodexAccount, CodexAccountCredentials, OcxConfig } from "../types";
@@ -192,6 +193,7 @@ interface CodexLoginStateRow {
   code?: string;
   needsReauth?: boolean;
   catalogRefreshPending?: boolean;
+  validationPending?: boolean;
   doneAt?: number;
 }
 const codexAuthLoginState = new Map<string, CodexLoginStateRow>();
@@ -241,12 +243,15 @@ function codexAccountPersistenceConflict(
 }
 
 /**
- * The exact label `parseUsageQuota` emits for the Codex Spark window (quota.ts).
+ * The exact labels `parseUsageQuota` emits for the Codex Spark windows (quota.ts).
  * Matching on the label rather than on "is a custom window" is load-bearing: the same array
  * carries Cursor's First-party models / API usage, Anthropic's Fable / Opus / Sonnet,
  * Antigravity's Gem / Cla, Kimi's subscription credits and a dozen dynamic provider meters.
  */
-const CODEX_SPARK_WINDOW_LABEL = "GPT-5.3-Codex-Spark Weekly";
+const CODEX_SPARK_WINDOW_LABELS = new Set([
+  "GPT-5.3-Codex-Spark 5h",
+  "GPT-5.3-Codex-Spark Weekly",
+]);
 
 /**
  * Drop the Spark window unless the operator asked for it (default hidden).
@@ -264,7 +269,7 @@ export function withSparkVisibility<T extends Omit<StoredAccountQuota, "updatedA
 ): T {
   if (!quota?.customWindows?.length) return quota;
   if (loadConfig().showCodexSparkQuota === true) return quota;
-  const kept = quota.customWindows.filter(window => window.label !== CODEX_SPARK_WINDOW_LABEL);
+  const kept = quota.customWindows.filter(window => !CODEX_SPARK_WINDOW_LABELS.has(window.label));
   if (kept.length === quota.customWindows.length) return quota;
   // An empty list is dropped rather than serialized: an absent field and an empty array should
   // not be two different ways of saying "no custom windows" on the wire.
@@ -365,6 +370,7 @@ function poolAccountDto(
   hasCredential: boolean,
   paused: boolean,
   priority: number,
+  maskEmails: boolean,
 ): CodexAuthAccountDto {
   const plan = codexPlanValue(account.plan);
   const quota = quotaForPlan(quotaResult.quota, plan);
@@ -372,7 +378,7 @@ function poolAccountDto(
   const health = projectCodexAccountHealth({ accountId: account.id, needsReauth });
   return {
     id: account.id,
-    email: maskEmail(account.email) ?? account.email,
+    email: projectEmail(account.email, maskEmails) ?? account.email,
     ...(account.alias !== undefined ? { alias: account.alias } : {}),
     ...(plan !== undefined ? { plan } : {}),
     logLabel: codexAccountLogLabel(account),
@@ -380,7 +386,7 @@ function poolAccountDto(
     paused,
     priority,
     quota: quota ? { ...quota } : null,
-    needsReauth,
+    needsReauth: needsReauth || health.status === "reauth_required",
     hasCredential,
     ...(quotaResult.quotaProbeSkipped ? { quotaProbeSkipped: true as const } : {}),
     ...oauthAccountHealthFields("codex", account.id, health),
@@ -635,7 +641,7 @@ function saveRuntimeConfig(sourceConfig: OcxConfig, nextConfig: OcxConfig): void
 
 interface StagedNewCodexAccountState {
   credential: CodexAccountCredentials;
-  validatedAt: number;
+  validatedAt?: number;
 }
 
 type PersistNewCodexAccountOutcome =
@@ -688,8 +694,10 @@ function persistNewCodexAccount(
     }
 
     try {
-      saveCodexAccountCredential(addedAccount.id, staged.credential);
-      markCodexAccountValidated(addedAccount.id, staged.validatedAt);
+      const generation = saveCodexAccountCredential(addedAccount.id, staged.credential, {
+        validationPending: staged.validatedAt === undefined,
+      });
+      if (staged.validatedAt !== undefined) markCodexAccountValidated(addedAccount.id, staged.validatedAt, generation);
       clearAccountNeedsReauth(addedAccount.id);
     } catch {
       // Config is already durable. Return the failure outcome through the coordinator so its
@@ -1098,6 +1106,7 @@ interface PoolQuotaRefreshFlight {
     superseded?: boolean;
     startCredentialGeneration?: number;
     resolvedCredentialGeneration?: number;
+    validatePending?: boolean;
   };
   promise: Promise<PoolQuotaResult>;
 }
@@ -1477,11 +1486,12 @@ async function fetchFreshPoolAccountQuota(
   }
 }
 
-async function fetchPoolAccountQuota(
+export async function fetchPoolAccountQuota(
   accountId: string,
   forceRefresh = false,
   configuredPlan?: string,
   getValidToken: typeof getValidCodexToken = getValidCodexToken,
+  validatePending = false,
   afterDispatchSequence?: number,
 ): Promise<PoolQuotaResult> {
   const existing = getAccountQuota(accountId);
@@ -1504,7 +1514,11 @@ async function fetchPoolAccountQuota(
       && (afterDispatchSequence === undefined || (flight.state.dispatchSequence ?? 0) > afterDispatchSequence)
       && generation !== undefined && isCodexAccountGenerationLive(accountId, generation);
   });
-  if (current) return current.promise;
+  if (current) {
+    // A manual refresh joining a passive read must not lose its validation intent.
+    current.state.validatePending ||= validatePending;
+    return current.promise;
+  }
   if (poolQuotaFlightCount() >= MAX_POOL_QUOTA_FLIGHTS) throw new PoolQuotaProbeBusyError();
 
   // A post-reset request must not let an older same-account response overwrite its evidence.
@@ -1514,6 +1528,7 @@ async function fetchPoolAccountQuota(
   }
   const state: PoolQuotaRefreshFlight["state"] = {
     startCredentialGeneration: record?.generation,
+    validatePending,
   };
   const refresh = fetchFreshPoolAccountQuota(
     accountId,
@@ -1525,18 +1540,54 @@ async function fetchPoolAccountQuota(
       onDispatch: sequence => { state.dispatchSequence = sequence; },
       mayPublish: () => state.superseded !== true,
     },
-  );
+  ).then(async result => {
+    // A passive flight has consumed its validation decision. Remove it before
+    // promise settlement queues other continuations, so a late explicit caller
+    // starts fresh work instead of setting an intent nobody will read again.
+    if (!state.validatePending) {
+      releaseFlight();
+      return result;
+    }
+    // Only an explicit account-list refresh finishes deferred registration. Passive quota
+    // polls and startup priming remain read-only with respect to inference spending.
+    const generation = result.freshCredentialGeneration;
+    const record = state.validatePending ? readCodexAccountRecord(accountId) : null;
+    if (record?.codexValidationPending && record.credential && record.deletedAt == null
+      && generation !== undefined && record.generation === generation
+      && isCompleteCodexQuotaRecoverySnapshot(result.freshQuota ?? null, result.freshPlan ?? configuredPlan)) {
+      try {
+        await warmCodexAccount({
+          accessToken: record.credential.accessToken,
+          chatgptAccountId: record.credential.chatgptAccountId,
+        });
+        markCodexAccountValidated(accountId, Date.now(), generation);
+        clearAccountNeedsReauth(accountId, generation);
+      } catch (error) {
+        // Keep the durable restriction on any failed/partial inference response, even
+        // when WHAM just reported headroom. No raw upstream text enters diagnostics.
+        const reason = codexWarmupFailureReason(error);
+        if (reason === "http_status:401" || reason === "http_status:403") {
+          markCodexAccountValidationFailed(accountId, reason, { expectedGeneration: generation });
+          markAccountNeedsReauth(accountId, captureConfigGeneration(), generation);
+        }
+      }
+    }
+    return result;
+  });
   const flight: PoolQuotaRefreshFlight = { state, promise: refresh };
   const activeFlights = flights ?? new Set<PoolQuotaRefreshFlight>();
   activeFlights.add(flight);
   if (!flights) poolQuotaRefreshInFlight.set(accountId, activeFlights);
-  try {
-    return await refresh;
-  } finally {
+  const releaseFlight = () => {
     activeFlights.delete(flight);
     if (activeFlights.size === 0 && poolQuotaRefreshInFlight.get(accountId) === activeFlights) {
       poolQuotaRefreshInFlight.delete(accountId);
     }
+  };
+  try {
+    return await refresh;
+  } finally {
+    releaseFlight();
   }
 }
 
@@ -1591,8 +1642,10 @@ async function refreshAfterManualReset(
       }
       return { accessToken: auth.accessToken, chatgptAccountId: auth.chatgptAccountId, generation: auth.poolGeneration };
     };
+    // `validatePending` is false here: a manual reset settles cooldown, and finishing deferred
+    // registration stays reserved for an explicit dashboard account-list refresh.
     const result = await fetchPoolAccountQuota(accountId, true, account.plan, didReset ? resetToken : getValidCodexToken,
-      didReset ? afterDispatchSequence : undefined);
+      false, didReset ? afterDispatchSequence : undefined);
     const record = readCodexAccountRecord(accountId);
     const recovered = didReset && record?.credential?.chatgptAccountId === auth.chatgptAccountId
       && (result.quotaProbeAttempted?.dispatchSequence ?? 0) > afterDispatchSequence
@@ -1873,9 +1926,12 @@ export interface CodexAuthAccountsSnapshot {
 export async function listCodexAuthAccountsSnapshot(
   config: OcxConfig,
   forceRefresh = false,
+  options: { validatePending?: boolean } = {},
 ): Promise<CodexAuthAccountsSnapshot> {
   const runtimeConfig = getRuntimeConfig(config);
   const poolAccounts = (runtimeConfig.codexAccounts ?? []).filter(isSelectableCodexPoolAccount);
+  // One redaction decision for the whole snapshot, read once from the operator's config (#3859).
+  const maskEmails = emailMaskingEnabled(runtimeConfig);
   const mainResult = await fetchMainAccountInfoAttempt(forceRefresh, 1);
   const refreshedPool = await mapWithConcurrency(poolAccounts, POOL_QUOTA_REFRESH_CONCURRENCY, async account => {
     const cred = getCodexAccountCredential(account.id);
@@ -1884,7 +1940,7 @@ export async function listCodexAuthAccountsSnapshot(
       quotaResult = { quota: null, needsReauth: true };
     } else {
       try {
-        quotaResult = await fetchPoolAccountQuota(account.id, forceRefresh, account.plan);
+        quotaResult = await fetchPoolAccountQuota(account.id, forceRefresh, account.plan, getValidCodexToken, options.validatePending === true);
       } catch (error) {
         if (!(error instanceof PoolQuotaProbeBusyError)) throw error;
         quotaResult = {
@@ -1920,6 +1976,7 @@ export async function listCodexAuthAccountsSnapshot(
         false,
         isCodexAccountPaused(runtimeConfig, accountId),
         getCodexAccountPriority(runtimeConfig, accountId),
+        maskEmails,
       )];
     }
     const resultGeneration = quotaResult.credentialGeneration ?? quotaResult.freshCredentialGeneration;
@@ -1939,6 +1996,7 @@ export async function listCodexAuthAccountsSnapshot(
       true,
       isCodexAccountPaused(runtimeConfig, accountId),
       getCodexAccountPriority(runtimeConfig, accountId),
+      maskEmails,
     )];
   });
   const fetchedMainGeneration = mainResult.identityGeneration ?? captureMainAccountIdentityGeneration();
@@ -1955,7 +2013,7 @@ export async function listCodexAuthAccountsSnapshot(
   });
   const main: CodexAuthAccountDto = {
     id: MAIN_CODEX_ACCOUNT_ID,
-    email: maskEmail(mainInfo.email) ?? "Codex App login",
+    email: projectEmail(mainInfo.email, maskEmails) ?? "Codex App login",
     plan: mainInfo.plan,
     ...(mainSnapshotLive && mainResult.quotaRefresh && mainResult.quotaRefreshGeneration !== undefined
       && isMainAccountIdentityGenerationLive(mainResult.quotaRefreshGeneration)
@@ -2016,8 +2074,12 @@ export async function refreshCodexQuotaForActivation(config: OcxConfig, accountI
   }
 }
 
-export async function listCodexAuthAccounts(config: OcxConfig, forceRefresh = false): Promise<CodexAuthAccountDto[]> {
-  return (await listCodexAuthAccountsSnapshot(config, forceRefresh)).accounts;
+export async function listCodexAuthAccounts(
+  config: OcxConfig,
+  forceRefresh = false,
+  options: { validatePending?: boolean } = {},
+): Promise<CodexAuthAccountDto[]> {
+  return (await listCodexAuthAccountsSnapshot(config, forceRefresh, options)).accounts;
 }
 
 interface PauseExhaustedResult {
@@ -2126,6 +2188,7 @@ export async function handleCodexAuthAPI(
   url: URL,
   config: OcxConfig,
   convergeCodexCatalog?: CodexAuthCatalogConvergence,
+  principal?: import("../server/management-auth").ManagementPrincipal,
 ): Promise<Response | null> {
 
   if (url.pathname === "/api/codex-auth/accounts" && req.method === "GET") {
@@ -2133,6 +2196,14 @@ export async function handleCodexAuthAPI(
     return jsonResponse({ accounts: await listCodexAuthAccounts(config, forceRefresh) });
   }
 
+  if (url.pathname === "/api/codex-auth/accounts/refresh" && req.method === "POST") {
+    // Inference spends quota: only a dashboard session carries the consent
+    // required by AGENTS_INSTALL.md. Raw-admin/CLI refreshes remain observational.
+    return jsonResponse({ accounts: await listCodexAuthAccounts(config, true, {
+      validatePending: principal === "gui-session",
+    }) });
+  }
+
   if (url.pathname === "/api/codex-auth/accounts" && req.method === "POST") {
     return manualImportDisabledResponse();
   }
@@ -2310,6 +2381,9 @@ export async function handleCodexAuthAPI(
       const exists = (runtimeConfig.codexAccounts ?? [])
         .some(account => isSelectableCodexPoolAccount(account) && account.id === body.accountId);
       if (!exists) return jsonResponse({ error: "Account not found" }, 400);
+      if (readCodexAccountRecord(body.accountId)?.codexValidationPending) {
+        return jsonResponse({ error: "Account validation is pending. Refresh quota after recovery to validate it." }, 409);
+      }
     }
     runtimeConfig.activeCodexAccountId = body.accountId ?? undefined;
     // "Use this account now" outranks selection order until the account is spent:
@@ -2754,7 +2828,12 @@ export async function handleCodexAuthAPI(
                   break;
                 }
 
-                const warmup = await verifyCodexAccountWarmup(accountId, cred.access, oauthAccountId);
+                // A successful authenticated WHAM read can prove quota is exhausted without
+                // spending an inference request. Store the account, but defer inference validation
+                // and keep it unavailable to routing. Unknown/failed usage reads retain the gate.
+                const warmup = isCodexQuotaExhausted(quota, plan)
+                  ? { ok: true as const, validatedAt: undefined }
+                  : await verifyCodexAccountWarmup(accountId, cred.access, oauthAccountId);
                 if (!warmup.ok) {
                   const body = await warmup.response.json().catch(() => ({})) as { error?: string; reason?: string };
                   setCodexLoginState(flowId, {
@@ -2794,11 +2873,13 @@ export async function handleCodexAuthAPI(
                 };
 
                 if (existingIdx >= 0) {
-                  saveCodexAccountCredential(accountId, credential);
+                  const generation = saveCodexAccountCredential(accountId, credential, {
+                    validationPending: warmup.validatedAt === undefined,
+                  });
                   // A successful reauthentication replaces the credential generation. Do not let a
                   // failed optional WHAM probe make the replacement inherit quota from the old record.
                   if (reauth) clearAccountQuota(accountId);
-                  markCodexAccountValidated(accountId, warmup.validatedAt);
+                  if (warmup.validatedAt !== undefined) markCodexAccountValidated(accountId, warmup.validatedAt, generation);
                   clearAccountNeedsReauth(accountId);
                   if (quota) setAccountQuotaFromParsed(accountId, quota);
                   // Keep the pool id stable; refresh display metadata after a successful login/reauth.
@@ -2849,6 +2930,7 @@ export async function handleCodexAuthAPI(
                     status: "done",
                     accountId,
                     email,
+                    ...(warmup.validatedAt === undefined ? { validationPending: true } : {}),
                     ...(catalogRefreshPending ? { catalogRefreshPending: true } : {}),
                     doneAt: Date.now(),
                   });
@@ -2949,6 +3031,9 @@ export async function handleCodexAuthAPI(
   if (url.pathname === "/api/codex-auth/login-status" && req.method === "GET") {
     const flowId = url.searchParams.get("flowId");
     const accountId = url.searchParams.get("accountId")?.trim();
+    // Transient flow state carries the address of the account being added, so it follows the
+    // same operator policy as the stored accounts it is about to become.
+    const maskFlowEmails = emailMaskingEnabled(config);
     // Reauth always has a pre-existing credential; never treat "credential exists" as success
     // when the flow map entry is gone (would false-complete on lost/expired flow state).
     const reauthStatus = url.searchParams.get("reauth") === "1";
@@ -2961,13 +3046,15 @@ export async function handleCodexAuthAPI(
         && !isAccountNeedsReauth(accountId)
         && getCodexAccountCredential(accountId)
       ) {
-        return jsonResponse({ status: "done", accountId });
+        return jsonResponse({ status: "done", accountId,
+          ...(readCodexAccountRecord(accountId)?.codexValidationPending ? { validationPending: true } : {}),
+        });
       }
-      return jsonResponse(st ? { ...st, email: maskEmail(st.email) ?? undefined } : { status: "expired" });
+      return jsonResponse(st ? { ...st, email: projectEmail(st.email, maskFlowEmails) ?? undefined } : { status: "expired" });
     }
     // Legacy fallback: return latest pending flow
     for (const [, st] of codexAuthLoginState) {
-      if (st.status === "pending") return jsonResponse({ ...st, email: maskEmail(st.email) ?? undefined });
+      if (st.status === "pending") return jsonResponse({ ...st, email: projectEmail(st.email, maskFlowEmails) ?? undefined });
     }
     return jsonResponse({ status: "idle" });
   }

package/src/codex/auth-collision.ts

@@ -6,6 +6,7 @@ import { resolveCodexHomeDir } from "./home";
 import { extractAccountId } from "../oauth/chatgpt";
 import { isSelectableCodexPoolAccount } from "./account-id";
 import { codexPlanKey } from "./plan";
+import { MAX_AUTH_BYTES, readBounded } from "./native-profile-store";
 
 export interface CodexTokens {
   access_token: string;
@@ -31,12 +32,21 @@ function hasErrnoCode(error: unknown, code: string): boolean {
 /**
  * Reads the Codex CLI credential file and classifies the outcome. Reads once instead of doing an
  * `existsSync` pre-check, so a file replaced between check and read cannot be misread as absent.
+ * An already-owned lifecycle may supply its pinned auth path instead of resolving ambient home.
+ * `bounded` opts into the native-profile bounded reader (regular file, size-capped, no-follow,
+ * non-blocking) for startup observation paths that run inside the owner claim; bounded violations
+ * classify as `unreadable`. Legacy callers keep the unbounded read.
  * Never returns or logs the raw error or any token material.
  */
-export function readCodexTokensResult(): CodexTokenReadResult {
+export function readCodexTokensResult(
+  authPath = join(resolveCodexHomeDir(), "auth.json"),
+  options?: { bounded?: boolean },
+): CodexTokenReadResult {
   let raw: string;
   try {
-    raw = readFileSync(join(resolveCodexHomeDir(), "auth.json"), "utf-8");
+    raw = options?.bounded === true
+      ? readBounded(authPath, MAX_AUTH_BYTES).toString("utf-8")
+      : readFileSync(authPath, "utf-8");
   } catch (error) {
     return { status: hasErrnoCode(error, "ENOENT") ? "missing" : "unreadable" };
   }

package/src/codex/auth-context.ts

@@ -1,11 +1,13 @@
-import { createHmac, randomBytes } from "node:crypto";
+import { createHash, createHmac, randomBytes, timingSafeEqual } from "node:crypto";
 import {
   CodexCredentialGenerationConflictError,
   CodexCredentialRefreshLockTimeoutError,
   CodexCredentialRefreshBusyError,
   CodexCredentialRefreshStaleError,
+  getCodexAccountCredential,
   getValidCodexToken,
   isCodexAccountGenerationLive,
+  readCodexAccountRecord,
 } from "./account-store";
 import { isAccountNeedsReauth, markAccountNeedsReauth } from "./account-runtime-state";
 import { ConfigMutationLockError } from "../config";
@@ -21,7 +23,7 @@ import {
   isMainAccountTokenLive,
   type NativeMainRefreshDependencies,
 } from "./main-account";
-import { isNativeMainTrafficBlocked, nativeMainStartupGateSnapshot } from "./native-profile-startup";
+import { isMainAccountPolicyBindingPending, isNativeMainTrafficBlocked, nativeMainStartupGateSnapshot } from "./native-profile-startup";
 import type { NativeMainStartupBlockReason } from "./native-profile-startup";
 import {
   codexQuotaScopeForModel,
@@ -49,7 +51,7 @@ import type { CodexAccountMode, OcxConfig, OcxProviderConfig } from "../types";
 import { FORWARD_HEADERS } from "../adapters/openai-responses";
 import { captureConfigGeneration } from "../lib/state-store-sweeper";
 import { retainedUtf8Bytes } from "../lib/admission";
-import { extractAccountId } from "../oauth/chatgpt";
+import { extractAccountId, extractEmail } from "../oauth/chatgpt";
 import { getMainAccountHardLockStatus, isMainAccountHardLocked } from "./main-account-hard-lock";
 import {
   captureMainAccountIdentityGeneration,
@@ -62,7 +64,7 @@ import {
 } from "./main-account-cache";
 import { CODEX_RESERVE_HELPER_UNSUPPORTED_MESSAGE, isCodexReserveHelperUnsupported, isCodexReserveRequestEligible } from "./loopback-target";
 import type { DataPlaneAdmission } from "../server/auth-cors";
-import { getMainReserveAuthorization, isMainReserveAuthorizationLive, type MainReserveAuthorization } from "./reserve-availability";
+import { getMainReserveAuthorization, isMainReserveAuthorizationLive, nativeUserIdClaims, type MainReserveAuthorization } from "./reserve-availability";
 import { UpstreamRetryEvidenceError } from "../lib/upstream-retry";
 
 const CODEX_AFFINITY_COMPONENT_MAX_BYTES = 512;
@@ -199,6 +201,19 @@ export class CodexPoolAuthenticationError extends Error {
   }
 }
 
+class CodexAccountValidationPendingError extends CodexPoolAuthenticationError {
+  constructor() {
+    super("Codex account validation is pending; refresh quota after recovery to validate it");
+    this.name = "CodexAccountValidationPendingError";
+  }
+}
+
+function assertCodexAccountValidationReady(accountId: string): void {
+  if (accountId !== MAIN_CODEX_ACCOUNT_ID && readCodexAccountRecord(accountId)?.codexValidationPending) {
+    throw new CodexAccountValidationPendingError();
+  }
+}
+
 export const CODEX_MAIN_PROFILE_MAINTENANCE_MESSAGE =
   "OpenCodex local native-main profile maintenance is active; retry this request";
 
@@ -455,6 +470,54 @@ function callerMatchesObservedMain(headers: Headers): boolean {
   return matchesMainQuotaCredential(bearer, effectiveAccountId);
 }
 
+/** Constant-time digest comparison so bearer bytes never drive branch timing. */
+function sameCredentialMaterial(a: string, b: string): boolean {
+  return timingSafeEqual(createHash("sha256").update(a).digest(), createHash("sha256").update(b).digest());
+}
+
+/**
+ * The early-cooldown caller-main fallback must not resurrect the subscription that is cooling
+ * down. Fail closed on ambiguity: an unreadable caller identity cannot be distinguished from the
+ * cooled account. A distinct workspace account id is always safe; an exact materialized
+ * bearer + account tuple marks the same subscription. Beyond that, the stable native user id is
+ * the strongest available evidence: it survives an email change and a token rotation, and it
+ * separates members who share one workspace account id even when neither credential carries an
+ * email. Email remains the fallback when no comparable user id exists on both sides. Coexisting
+ * personal/business registrations with the same email and account id over-deny during the
+ * cooldown — the safe direction.
+ */
+function callerIsCooledPoolAccount(headers: Headers, config: OcxConfig, accountId: string): boolean {
+  const bearer = headers.get("authorization")?.replace(/^Bearer\s+/i, "").trim();
+  if (!bearer) return true;
+  const callerAccountId = headers.get("chatgpt-account-id") ?? extractAccountId(undefined, bearer);
+  if (callerAccountId === undefined) return true;
+  if (accountId === MAIN_CODEX_ACCOUNT_ID) {
+    // No physical-main read to identify the caller: the observed-main equality tag suffices.
+    return callerMatchesObservedMain(headers);
+  }
+  const stored = getCodexAccountCredential(accountId);
+  const entry = config.codexAccounts?.find(account => account.id === accountId);
+  const cooledAccountId = stored?.chatgptAccountId || entry?.chatgptAccountId;
+  if (!cooledAccountId) return true;
+  if (cooledAccountId !== callerAccountId) return false;
+  if (stored?.accessToken && sameCredentialMaterial(bearer, stored.accessToken)) return true;
+  // Same namespace on both sides, never `sub`: this is the ChatGPT per-user identity the reserve
+  // path already trusts. A credential whose own two encodings of it disagree cannot identify
+  // anyone, so it fails closed even when the disagreement is on the stored side.
+  const callerUser = nativeUserIdClaims(bearer);
+  const cooledUser = stored?.accessToken
+    ? nativeUserIdClaims(stored.accessToken)
+    : { userId: undefined, conflict: false };
+  if (callerUser.conflict || cooledUser.conflict) return true;
+  if (callerUser.userId !== undefined && cooledUser.userId !== undefined) {
+    return callerUser.userId === cooledUser.userId;
+  }
+  const callerEmail = extractEmail(undefined, bearer)?.trim().toLowerCase() || undefined;
+  const cooledEmail = entry?.email?.trim().toLowerCase() || undefined;
+  if (callerEmail !== undefined && cooledEmail !== undefined) return callerEmail === cooledEmail;
+  return true;
+}
+
 function captureObservedMainWriter(): MainQuotaWriter | undefined {
   const identityKey = getObservedMainQuotaIdentityKey();
   return identityKey === undefined ? undefined : {
@@ -536,6 +599,7 @@ export class CodexThreadAffinityExpiredError extends Error {
 
 export function shouldMarkAccountNeedsReauthForCodexAuthFailure(cause: unknown): boolean {
   return !(cause instanceof CodexMainAccountHardLockError)
+    && !(cause instanceof CodexAccountValidationPendingError)
     && !(cause instanceof CodexReserveUnavailableError)
     && !(cause instanceof CodexCredentialGenerationConflictError)
     && !(cause instanceof CodexCredentialRefreshLockTimeoutError)
@@ -598,20 +662,31 @@ export async function resolveCodexAuthContext(
     throw new CodexReserveUnavailableError();
   }
   const fixedAccountId = reserve ? MAIN_CODEX_ACCOUNT_ID : options.accountId;
-  const preserveRequestOwnedMainPin = requestScopedMainCredential
+  const requestOwnedMainPinCandidate = requestScopedMainCredential
     && fixedAccountId === undefined
     && config.activeCodexAccountPinned === MAIN_CODEX_ACCOUNT_ID
     && isEffectiveCodexAccountPinned(config)
     && !policy.pausedCodexAccountIds?.includes(MAIN_CODEX_ACCOUNT_ID)
-    && !(callerMatchesObservedMain(headers) && isMainAccountHardLocked(policy))
     && requestOwnedMainPinHasQuotaHeadroom(config);
+  // During an owned startup, equality cannot be established until recovery and the
+  // memory-only policy binding finish. This read-only fence never probes a foreign home.
+  if (policy.codexMainAccountHardLock === true && requestOwnedMainPinCandidate && isMainAccountPolicyBindingPending()) {
+    throw new CodexMainProfileDrainingError();
+  }
+  const preserveRequestOwnedMainPin = requestOwnedMainPinCandidate
+    && !(callerMatchesObservedMain(headers) && isMainAccountHardLocked(policy));
   if (fixedAccountId !== undefined && options.excludeAccountId !== undefined) {
     throw new Error("Codex auth context cannot select and exclude an account simultaneously");
   }
   const resolveCallerOwnedMainContext = async (): Promise<CodexAuthContext> => {
-    if (!hasCallerCodexBearer(headers)) throw new CodexDirectAuthenticationError();
     const substituteStoredMain = options.substituteMainCredentialForDirect === true;
+    // An internal route change can strip the admission bearer before this point.
+    // Trusted substitution still has to claim and validate stored main below.
+    if (!substituteStoredMain && !hasCallerCodexBearer(headers)) throw new CodexDirectAuthenticationError();
     if (!substituteStoredMain) {
+      if (policy.codexMainAccountHardLock === true && isMainAccountPolicyBindingPending()) {
+        throw new CodexMainProfileDrainingError();
+      }
       if (callerMatchesObservedMain(headers)) assertMainAccountPolicy(policy);
       if (reserve) {
         const selected = materializeCodexUpstreamAuth(headers, { kind: "main", accountId: null }, { config: policy });
@@ -851,6 +926,9 @@ export async function resolveCodexAuthContext(
   } finally {
     selectionAdmission?.release();
   }
+  // Legacy selectors may retain an unusable account for actionable errors. A
+  // deferred credential must never become request auth through that fallback.
+  assertCodexAccountValidationReady(accountId);
   // Lazy prime: if the selected account has no quota yet, the pool is likely
   // unprimed (dashboard never opened, or startup prime was blocked). Kick a
   // best-effort prime so the NEXT routing decision has real scores. This never
@@ -885,6 +963,14 @@ export async function resolveCodexAuthContext(
       ? tryAcquireCodexQuotaScopeProbeLease(accountId, probeQuotaScope) ?? undefined
       : tryAcquireCodexQuotaProbeLease(accountId) ?? undefined;
     if (!probeLeaseId) {
+      // The selector can retain the configured Pool account when no stored
+      // alternate is eligible. A validated caller may still serve this request,
+      // just as it can after an upstream rejection, without changing Pool state.
+      if (requestScopedMainCredential && fixedAccountId === undefined
+        && options.excludeAccountId !== MAIN_CODEX_ACCOUNT_ID
+        && !callerIsCooledPoolAccount(headers, config, accountId)) {
+        return await resolveCallerOwnedMainContext();
+      }
       throw new CodexAccountCooldownError(accountId, cooldownUntil, cooldown?.cooldownSource, cooldown?.quotaScope);
     }
   }
@@ -938,6 +1024,7 @@ export async function resolveCodexAuthContext(
 
   try {
     const token = await getValidCodexToken(accountId);
+    assertCodexAccountValidationReady(accountId);
     return {
       kind: "pool",
       accountId,
@@ -977,6 +1064,7 @@ export function applyCodexAuthContextToProvider(
   mode: CodexAccountMode | undefined,
 ): OcxRuntimeProviderConfig {
   if (mode !== "pool" || (ctx.kind !== "pool" && ctx.kind !== "main-pool") || provider.authMode !== "forward") return provider;
+  assertCodexAccountValidationReady(ctx.accountId);
   return {
     ...provider,
     _codexAccountOverride: {
@@ -1019,6 +1107,7 @@ export function materializeCodexUpstreamAuth(
     if (value) selected.set(name, value);
   }
   if (ctx.kind === "pool" || ctx.kind === "main-pool") {
+    assertCodexAccountValidationReady(ctx.accountId);
     selected.set("authorization", `Bearer ${ctx.accessToken}`);
     selected.set("chatgpt-account-id", ctx.chatgptAccountId);
     if (ctx.kind === "main-pool") {

package/src/codex/catalog/parsing.ts

@@ -144,6 +144,29 @@ export interface CatalogModel {
   codexToolMode?: "code_mode_only" | "shell";
   /** Normalized upstream capability names retained for management/API consumers (#485 follow-up). */
   capabilities?: string[];
+  /**
+   * This row is listed but cannot currently serve a request (#1711). Today the only value is
+   * "no_credit", set when every usable target has positive quota-exhaustion evidence.
+   *
+   * It is NOT visibility. The row stays `visibility: "list"` on purpose: the issue explicitly
+   * rejects hiding, and Codex Desktop only understands "list" and "hide" anyway, so hiding would
+   * be the one outcome the reporter asked not to have. An OpenCodex-aware consumer greys the
+   * entry; the native picker ignores the field, which is the honest limit of what a custom
+   * catalog field can do.
+   */
+  quotaInactiveReason?: "no_credit";
+  /**
+   * Discovered per-token cost class for this routed model (#3666). "free" means the provider's
+   * own /models row reported a numeric zero for BOTH the prompt and the completion rate;
+   * "paid" means at least one rate is above zero. ABSENT means unknown — the provider published
+   * no usable pair, or this row never came from a models API at all.
+   *
+   * Fail closed: a partial, non-numeric, or negative rate leaves the field absent, never "free",
+   * because showing a paid model under a Free filter costs the user money while hiding a free
+   * one costs a click. This is a management/Dashboard projection only — deriveEntry never
+   * serializes it into the Codex catalog, and it never affects routing or visibility.
+   */
+  pricingStatus?: "free" | "paid";
   /** OpenCodex-only catalog ownership marker; Codex ignores the serialized extension field. */
   catalogKind?: typeof CODEX_CUSTOM_MODEL_CATALOG_KIND | typeof CODEX_PROVIDER_MODEL_CATALOG_KIND;
 }