@bitkyc08/opencodex 2.52.0-preview.20260912 → 2.53.0-preview.20260913

package/src/chat/outbound.ts

@@ -7,7 +7,7 @@
  */
 type Rec = Record<string, unknown>;
 
-import { decodeServerSentEvents, sseFieldValue } from "../lib/sse-decoder";
+import { decodeServerSentEvents } from "../lib/sse-decoder";
 import {
   isTranslatorBudgetExceededError,
   type TranslatorBudget,
@@ -21,6 +21,7 @@ import {
   isCyberPolicyMessage,
 } from "../lib/errors";
 import { redactSecretString } from "../lib/redact";
+import { createSseBlockBuffer, sseDataPayload } from "../server/sse-payload-rewrite";
 
 function isRec(v: unknown): v is Rec {
   return !!v && typeof v === "object" && !Array.isArray(v);
@@ -182,6 +183,10 @@ export function responsesSseToChatCompletionsSse(
   let cancelled = false;
   let started = false;
   let sawToolUse = false;
+  // The upstream response-level service-tier echo (xAI Priority Processing, OpenAI
+  // fast tier), captured from any response event and stamped on every emitted chunk,
+  // matching how the source annotates its own streamed chat chunks.
+  let serviceTier: string | undefined;
   const id = completionId();
   const created = Math.floor(Date.now() / 1000);
   // tool call_id -> streaming index (OpenAI requires stable indices per tool call)
@@ -298,9 +303,18 @@ export function responsesSseToChatCompletionsSse(
       if (existing && existing.parts.size > 0 && item.type !== undefined) throw refusalTranslationError();
       return;
     }
-    // Unrelated sparse text messages historically need no position metadata.
-    if (outputIndex === undefined && (!Array.isArray(item.content)
-      || !item.content.some(part => isRec(part) && part.type === "refusal"))) return;
+    // Only an item that actually carries refusal content belongs in the refusal ledger.
+    // The exit used to be the position guard alone, so every message that had an index
+    // was enrolled — ordinary assistant text included — and the id/index consistency
+    // checks inside refusalItem() then governed streams containing no refusal at all.
+    // One index legitimately carrying two item ids was then fatal: a bridge that flushes
+    // a hidden reasoning envelope at the index of a still-open message failed a healthy
+    // turn with invalid_refusal. `existing` keeps a ledger already opened by real refusal
+    // evidence under the same scrutiny as before. The non-streaming collector below has
+    // always scoped itself this way; this is the streaming path catching up.
+    const hasRefusalPart = Array.isArray(item.content)
+      && item.content.some(part => isRec(part) && part.type === "refusal");
+    if (!existing && !hasRefusalPart) return;
     const known = refusalItem(outputIndex, item, "id");
     if (!Array.isArray(item.content)) return;
     item.content.forEach((part: unknown, contentIndex: number) => {
@@ -366,6 +380,9 @@ export function responsesSseToChatCompletionsSse(
   };
       const emit = (payload: Rec | "[DONE]") => {
         if (failed) return;
+        if (serviceTier !== undefined && isRec(payload) && Array.isArray(payload.choices)) {
+          payload.service_tier = serviceTier;
+        }
         if (terminalBatch) {
           const serialized = dataFrame(payload);
           const stringReservation = translatorBudget.reserveTransient(Buffer.byteLength(serialized), { kind: "live_transient" });
@@ -530,6 +547,9 @@ export function responsesSseToChatCompletionsSse(
       };
 
       const handleFrame = (eventName: string, data: Rec) => {
+        if (isRec(data.response) && typeof data.response.service_tier === "string") {
+          serviceTier = data.response.service_tier;
+        }
         switch (eventName) {
           case "response.created":
           case "response.heartbeat":
@@ -565,7 +585,15 @@ export function responsesSseToChatCompletionsSse(
             const item = isRec(data.item) ? data.item : null;
             if (item?.type === "message") {
               snapshotRefusalItem(data.output_index, item);
-              if (Object.hasOwn(data, "item_id")) refusalItem(data.output_index, data, "item_id");
+              // Bind the event-level id only for an index the refusal ledger already
+              // tracks. Testing membership directly rather than through position()
+              // matters: position() throws on a malformed index, which would add a
+              // failure to refusal-free streams instead of removing one.
+              if (Object.hasOwn(data, "item_id")
+                && typeof data.output_index === "number"
+                && refusalItems.has(data.output_index)) {
+                refusalItem(data.output_index, data, "item_id");
+              }
             }
             if (!item || item.type !== "function_call") break;
             ensureRole();
@@ -611,7 +639,11 @@ export function responsesSseToChatCompletionsSse(
             const item = isRec(data.item) ? data.item : null;
             if (!item) break;
             snapshotRefusalItem(data.output_index, item);
-            if (item.type === "message" && Object.hasOwn(data, "item_id")) refusalItem(data.output_index, data, "item_id");
+            if (item.type === "message" && Object.hasOwn(data, "item_id")
+              && typeof data.output_index === "number"
+              && refusalItems.has(data.output_index)) {
+              refusalItem(data.output_index, data, "item_id");
+            }
             if (item.type === "function_call") {
               sawToolUse = true;
               const callId = typeof item.call_id === "string" ? item.call_id : "";
@@ -871,6 +903,10 @@ export function responsesJsonToChatCompletion(json: unknown, model: string, tran
       logprobs: null,
     }],
     usage: chatCompletionsUsage(body.usage),
+    // Relay the upstream service-tier echo (xAI Priority Processing, OpenAI fast tier)
+    // so a Chat Completions caller can confirm the tier the turn actually used, the
+    // same field the Responses lane already relays for responses-wire upstreams.
+    ...(typeof body.service_tier === "string" ? { service_tier: body.service_tier } : {}),
   };
 }
 
@@ -880,129 +916,125 @@ export async function collectChatCompletion(
   model: string,
   translatorBudget: TranslatorBudget,
 ): Promise<Rec> {
+  const reader = stream.getReader();
   const decoder = new TextDecoder();
-  let buffer = "";
+  const buffer = createSseBlockBuffer(translatorBudget);
   let content = "";
   let refusal: string | null = null;
   let reasoning = "";
+  const retainedBytes = { content: 0, refusal: 0, reasoning: 0 };
   const toolCalls = new Map<number, { id: string; name: string; arguments: string; argumentBytes: number }>();
   // Per-call budget scopes (2 MiB/call enforced by the budget): the map key is the
   // wire index, which is stable across deltas and present before the call id.
   const callScope = (index: number) => `chat_collect_${index}`;
   let finishReason = "stop";
   let usage: unknown;
-  const replaceRetained = (previous: string, next: string, kind: "live_transient" | "retained_collectors") => {
-    const reservation = translatorBudget.reserveTransient(Buffer.byteLength(next), { kind });
-    reservation.commitRetained();
-    translatorBudget.releaseRetained(Buffer.byteLength(previous), { kind });
-    return next;
+  let serviceTier: unknown;
+  const appendRetained = (key: keyof typeof retainedBytes, previous: string, fragment: string): string => {
+    const previousBytes = retainedBytes[key];
+    const nextBytes = appendedUtf8Bytes(previous, previousBytes, fragment);
+    const reservation = translatorBudget.reserveTransient(nextBytes, { kind: "retained_collectors" });
+    try {
+      const next = previous + fragment;
+      reservation.commitRetained();
+      translatorBudget.releaseRetained(previousBytes, { kind: "retained_collectors" });
+      retainedBytes[key] = nextBytes;
+      return next;
+    } catch (error) {
+      reservation.release();
+      throw error;
+    }
+  };
+  const releaseCollectors = () => {
+    translatorBudget.releaseRetained(retainedBytes.content + retainedBytes.refusal + retainedBytes.reasoning,
+      { kind: "retained_collectors" });
   };
-  const reader = stream.getReader();
   try {
+    // Share native relay framing, while retaining the collector's existing admission
+    // order: release each consumed input frame before accumulating its output fields.
+    // CRLF and multiline data obey the same contract as the streaming response.
     for (;;) {
-      let done = false;
-      let value: Uint8Array | undefined;
-      try {
-        ({ done, value } = await reader.read());
-      } catch (err) {
-        if (isChatCompletionsStreamError(err)) throw err;
-        if (isTranslatorBudgetExceededError(err)) {
-          // Provider-controlled overflow is an upstream failure, not a client
-          // request error: match the adapter/bridge contract (502 upstream_error).
-          throw new ChatCompletionsStreamError(err.message, {
-            status: 502,
-            type: "upstream_error",
-            code: err.code,
-          });
-        }
-        throw new ChatCompletionsStreamError(err instanceof Error ? err.message : String(err));
-      }
+      const { done, value } = await reader.read();
       if (done) break;
       if (!value) continue;
-      buffer = replaceRetained(buffer, buffer + decoder.decode(value, { stream: true }), "live_transient");
-      let sep: number;
-      while ((sep = buffer.indexOf("\n\n")) !== -1) {
-        const rawFrame = buffer.slice(0, sep);
-        buffer = replaceRetained(buffer, buffer.slice(sep + 2), "live_transient");
-        for (const line of rawFrame.split("\n")) {
-          const rawData = sseFieldValue(line, "data");
-          if (rawData === null) continue;
-          const data = rawData.trim();
-          if (!data || data === "[DONE]") continue;
-          let parsed: unknown;
-          try { parsed = JSON.parse(data); } catch { continue; }
-          if (!isRec(parsed)) continue;
-          if (isRec(parsed.error)) {
-            const message = typeof parsed.error.message === "string"
-              ? parsed.error.message
-              : "upstream request failed";
-            const type = typeof parsed.error.type === "string" ? parsed.error.type : "server_error";
-            const code = typeof parsed.error.code === "string" ? parsed.error.code : null;
-            const status = code === "translation_buffer_limit"
-              ? 502
-              : code === CYBER_POLICY_ERROR_CODE || isCyberPolicyMessage(message)
-                ? 400
-                : streamErrorStatus(message);
-            const streamError = new ChatCompletionsStreamError(message, {
-              status,
-              type: code === "translation_buffer_limit" ? "upstream_error" : type,
-              code,
-            });
-            throw streamError;
-          }
-          if (parsed.usage) usage = parsed.usage;
-          const choices = Array.isArray(parsed.choices) ? parsed.choices : [];
-          const choice = isRec(choices[0]) ? choices[0] : null;
-          if (!choice) continue;
-          if (typeof choice.finish_reason === "string") finishReason = choice.finish_reason;
-          const delta = isRec(choice.delta) ? choice.delta : null;
-          if (!delta) continue;
-          if (typeof delta.content === "string") content = replaceRetained(content, content + delta.content, "retained_collectors");
-          if (delta.refusal !== undefined && delta.refusal !== null) {
-            if (typeof delta.refusal !== "string") throw refusalTranslationError();
-            refusal = replaceRetained(refusal ?? "", (refusal ?? "") + delta.refusal, "retained_collectors");
-          }
-          if (typeof delta.reasoning_content === "string") reasoning = replaceRetained(reasoning, reasoning + delta.reasoning_content, "retained_collectors");
-          if (Array.isArray(delta.tool_calls)) {
-            for (const tc of delta.tool_calls) {
-              if (!isRec(tc)) continue;
-              const index = typeof tc.index === "number" ? tc.index : 0;
-              let current = toolCalls.get(index);
-              if (!current) {
-                current = { id: "", name: "", arguments: "", argumentBytes: 0 };
-                toolCalls.set(index, current);
-                translatorBudget.openCall(callScope(index));
-              }
-              if (typeof tc.id === "string") current.id = tc.id;
-              const fn = isRec(tc.function) ? tc.function : {};
-              // Done-frame final arguments are authoritative last-write-wins snapshots.
-              if (typeof fn.name === "string" && fn.name.length > 0) current.name = fn.name;
-              if (typeof fn.arguments === "string") {
-                const replace = fn.arguments.startsWith("{") || fn.arguments.startsWith("[") || current.arguments.length === 0;
-                const nextBytes = replace
-                  ? Buffer.byteLength(fn.arguments)
-                  : appendedUtf8Bytes(current.arguments, current.argumentBytes, fn.arguments);
-                const reservation = translatorBudget.reserveTransient(nextBytes, { kind: "tool_args", callId: callScope(index) });
-                try {
-                  current.arguments = replace ? fn.arguments : current.arguments + fn.arguments;
-                  reservation.commitRetained();
-                  translatorBudget.releaseRetained(current.argumentBytes, { kind: "tool_args", callId: callScope(index) });
-                  current.argumentBytes = nextBytes;
-                } catch (error) {
-                  reservation.release();
-                  throw error;
-                }
+      buffer.append(decoder.decode(value, { stream: true }));
+      for (let frame = buffer.next(); frame; frame = buffer.next()) {
+        const data = sseDataPayload(frame.block)?.trim();
+        if (!data || data === "[DONE]") continue;
+        let parsed: unknown;
+        try { parsed = JSON.parse(data); } catch { continue; }
+        if (!isRec(parsed)) continue;
+        if (isRec(parsed.error)) {
+          const message = typeof parsed.error.message === "string"
+            ? parsed.error.message
+            : "upstream request failed";
+          const type = typeof parsed.error.type === "string" ? parsed.error.type : "server_error";
+          const code = typeof parsed.error.code === "string" ? parsed.error.code : null;
+          const status = code === "translation_buffer_limit"
+            ? 502
+            : code === CYBER_POLICY_ERROR_CODE || isCyberPolicyMessage(message)
+              ? 400
+              : streamErrorStatus(message);
+          const streamError = new ChatCompletionsStreamError(message, {
+            status,
+            type: code === "translation_buffer_limit" ? "upstream_error" : type,
+            code,
+          });
+          throw streamError;
+        }
+        if (parsed.usage) usage = parsed.usage;
+        if (typeof parsed.service_tier === "string") serviceTier = parsed.service_tier;
+        const choices = Array.isArray(parsed.choices) ? parsed.choices : [];
+        const choice = isRec(choices[0]) ? choices[0] : null;
+        if (!choice) continue;
+        if (typeof choice.finish_reason === "string") finishReason = choice.finish_reason;
+        const delta = isRec(choice.delta) ? choice.delta : null;
+        if (!delta) continue;
+        if (typeof delta.content === "string") content = appendRetained("content", content, delta.content);
+        if (delta.refusal !== undefined && delta.refusal !== null) {
+          if (typeof delta.refusal !== "string") throw refusalTranslationError();
+          refusal = appendRetained("refusal", refusal ?? "", delta.refusal);
+        }
+        if (typeof delta.reasoning_content === "string") reasoning = appendRetained("reasoning", reasoning, delta.reasoning_content);
+        if (Array.isArray(delta.tool_calls)) {
+          for (const tc of delta.tool_calls) {
+            if (!isRec(tc)) continue;
+            const index = typeof tc.index === "number" ? tc.index : 0;
+            let current = toolCalls.get(index);
+            if (!current) {
+              current = { id: "", name: "", arguments: "", argumentBytes: 0 };
+              toolCalls.set(index, current);
+              translatorBudget.openCall(callScope(index));
+            }
+            if (typeof tc.id === "string") current.id = tc.id;
+            const fn = isRec(tc.function) ? tc.function : {};
+            // Done-frame final arguments are authoritative last-write-wins snapshots.
+            if (typeof fn.name === "string" && fn.name.length > 0) current.name = fn.name;
+            if (typeof fn.arguments === "string") {
+              const replace = fn.arguments.startsWith("{") || fn.arguments.startsWith("[") || current.arguments.length === 0;
+              const nextBytes = replace
+                ? Buffer.byteLength(fn.arguments)
+                : appendedUtf8Bytes(current.arguments, current.argumentBytes, fn.arguments);
+              const reservation = translatorBudget.reserveTransient(nextBytes, { kind: "tool_args", callId: callScope(index) });
+              try {
+                current.arguments = replace ? fn.arguments : current.arguments + fn.arguments;
+                reservation.commitRetained();
+                translatorBudget.releaseRetained(current.argumentBytes, { kind: "tool_args", callId: callScope(index) });
+                current.argumentBytes = nextBytes;
+              } catch (error) {
+                reservation.release();
+                throw error;
               }
             }
           }
         }
       }
+      buffer.compact();
     }
   } catch (error) {
-    // Processing may fail between reads; cancel while we still own the lock so the
-    // upstream translator releases its maps and stops any pending provider read.
+    // Cancel while we still own the reader so a failed collection releases its upstream.
     try { await reader.cancel(error); } catch { /* preserve the original failure */ }
-    translatorBudget.releaseRetained(Buffer.byteLength(refusal ?? ""), { kind: "retained_collectors" });
+    releaseCollectors();
     // Never leak an open call scope on the error path; the turn budget's
     // dispose is a backstop, not the owner of this transfer.
     for (const index of toolCalls.keys()) translatorBudget.closeCall(callScope(index));
@@ -1015,8 +1047,12 @@ export async function collectChatCompletion(
         code: error.code,
       });
     }
-    throw error;
+    if (isChatCompletionsStreamError(error)) throw error;
+    throw new ChatCompletionsStreamError(error instanceof Error ? error.message : String(error));
   } finally {
+    // Preserve the previous EOF contract: only delimiter-terminated events are collected.
+    // A partial final frame is discarded, with its retained input ownership released.
+    buffer.clear();
     reader.releaseLock();
   }
 
@@ -1048,6 +1084,7 @@ export async function collectChatCompletion(
           return copy;
         });
     } catch (error) {
+      releaseCollectors();
       for (const copyBytes of chargedCopies) {
         translatorBudget.releaseRetained(copyBytes, { kind: "retained_collectors" });
       }
@@ -1076,5 +1113,6 @@ export async function collectChatCompletion(
       logprobs: null,
     }],
     usage: usage && isRec(usage) ? usage : chatCompletionsUsage(undefined),
+    ...(typeof serviceTier === "string" ? { service_tier: serviceTier } : {}),
   };
 }

package/src/claude/desktop-profile.ts

@@ -103,12 +103,10 @@ export function parseDesktopProfile(value: unknown): DesktopProfile {
   if (!isPlainObject(value.assignments)) throw new DesktopProfileError("must be an object", "profile.assignments");
   if (!isPlainObject(value.defaults)) throw new DesktopProfileError("must be an object", "profile.defaults");
   assertExactKeys(value.defaults, DESKTOP_FAMILIES, "profile.defaults");
-  if (value.appliedFingerprint !== undefined && typeof value.appliedFingerprint !== "string") {
-    throw new DesktopProfileError("must be a string", "profile.appliedFingerprint");
-  }
-  if (value.appliedAt !== undefined && typeof value.appliedAt !== "string") {
-    throw new DesktopProfileError("must be a string", "profile.appliedAt");
-  }
+  // JSON null (and any other non-string) is unset, not fatal. Older builds and several
+  // writers persisted appliedFingerprint/appliedAt as JSON null; treating those as a
+  // document-level parse failure made loadConfig replace the whole operator config with
+  // defaults (#4430). appliedMarkers() already drops non-strings when copying.
 
   const assignments: Record<string, OcxClaudeDesktopAssignment> = {};
   const aliases = new Set<string>();

package/src/cli/account-api.ts

@@ -1,3 +1,4 @@
+import { parseQuotaFailureCode, type QuotaFailureCode } from "../providers/quota-types";
 /**
  * Data-access layer for `ocx account` (issue #180) — live-proxy HTTP client and
  * per-family account readers. Kept separate from account.ts (command handlers)
@@ -26,12 +27,16 @@ export interface AccountRow {
   masked?: string;
   active: boolean;
   needsReauth?: boolean;
+  selectionExcludedReason?: "plan_excluded";
+  selectionExcludedPlan?: string;
   /** Registered credential that is still excluded from routing until validation completes. */
   validationPending?: boolean;
   /** Codex pool selection order, higher used earlier. Absent where ordering does not apply. */
   priority?: number;
   quota?: CodexQuotaDto | null;
   quotaRefresh?: CodexQuotaRefreshOutcome;
+  quotaUnavailable?: boolean;
+  quotaFailure?: QuotaFailureCode;
   /**
    * Whether the pool is holding this account out of rotation.
    *
@@ -243,6 +248,8 @@ interface CodexAccountDto {
   plan?: string;
   isMain?: boolean;
   needsReauth?: boolean;
+  selectionExcludedReason?: "plan_excluded";
+  selectionExcludedPlan?: string;
   health?: { reason?: string };
   priority?: number;
   quota?: CodexQuotaDto | null;
@@ -309,6 +316,10 @@ export async function fetchCodexRows(
     plan: a.plan,
     active: a.id === activeId,
     needsReauth: a.needsReauth,
+    ...(a.selectionExcludedReason === "plan_excluded" ? {
+      selectionExcludedReason: "plan_excluded" as const,
+      ...(typeof a.selectionExcludedPlan === "string" ? { selectionExcludedPlan: a.selectionExcludedPlan } : {}),
+    } : {}),
     ...(a.health?.reason === "validation_pending" ? { validationPending: true } : {}),
     priority: typeof a.priority === "number" ? a.priority : 0,
     paused: a.paused === true,
@@ -330,6 +341,7 @@ interface OAuthAccountDto {
   plan?: string | null;
   quota?: CodexQuotaDto | null;
   quotaUnavailable?: boolean;
+  quotaFailure?: unknown;
 }
 
 async function fetchOAuthRows(
@@ -363,6 +375,8 @@ async function fetchOAuthRows(
     plan: a.plan ?? null,
     ...(a.quota !== undefined ? { quota: a.quota } : {}),
     ...(a.quotaUnavailable !== undefined ? { quotaUnavailable: a.quotaUnavailable } : {}),
+    ...(a.quotaUnavailable === true && parseQuotaFailureCode(a.quotaFailure)
+      ? { quotaFailure: parseQuotaFailureCode(a.quotaFailure) } : {}),
   }));
   return { rows, activeId, status: 200 };
 }

package/src/cli/account-extended.ts

@@ -44,7 +44,7 @@ const EXTENDED_USAGE = `Usage:
   ocx account pause <provider> <id|main> [--json]
   ocx account resume <provider> <id|main> [--json]
   ocx account pause-exhausted <provider> [--json]
-  ocx account strategy <provider> [<quota|round-robin|fill-first>] [--json]
+  ocx account strategy <provider> [<quota|round-robin|fill-first|reset-first>] [--json]
   ocx account sticky <provider> [<1-100>] [--json]
   ocx account remove <provider> <id|main> --yes [--json]
   ocx account clear-cooldown <provider> <id|main> [--json]

package/src/cli/account-history.ts

@@ -0,0 +1,60 @@
+import { parseCapacityReason } from "../codex/quota-capacity";
+import { isValidCodexAccountId } from "../codex/account-id";
+import { apiError, apiJson, proxyUnreachable, resolveBaseUrl, type AccountDeps } from "./account-api";
+
+function historyDate(value: unknown): string {
+  if (typeof value !== "number" || !Number.isFinite(value)) return "unknown";
+  const date = new Date(value);
+  return Number.isFinite(date.getTime()) ? date.toISOString() : "unknown";
+}
+
+/** Read cached pool observations without refreshing credentials or spending quota. */
+export async function cmdAccountHistory(args: string[], deps: AccountDeps): Promise<number> {
+  const [provider, accountId, ...flags] = args;
+  let json = false;
+  let limit = 200;
+  let hasLimit = false;
+  let valid = provider === "openai" && isValidCodexAccountId(accountId);
+  for (let index = 0; index < flags.length; index++) {
+    if (flags[index] === "--json" && !json) json = true;
+    else if (flags[index] === "--limit" && !hasLimit && /^(?:[1-9]|[1-9][0-9]|1[0-9]{2}|200)$/.test(flags[index + 1] ?? "")) {
+      limit = Number(flags[++index]); hasLimit = true;
+    } else valid = false;
+  }
+  if (!valid) {
+    console.error("Usage: ocx account history openai <pool-account-id> [--limit <1-200>] [--json]");
+    return 1;
+  }
+  const baseUrl = await resolveBaseUrl(deps);
+  if (!baseUrl) return proxyUnreachable();
+  const result = await apiJson(deps, baseUrl, "GET", `/api/codex-auth/quota/history?accountId=${encodeURIComponent(accountId)}&limit=${limit}`);
+  if (result.status === 0) return proxyUnreachable(result.transportError);
+  if (result.status !== 200) return apiError(result.json, "Quota history unavailable", result.status);
+  if (json) { console.log(JSON.stringify(result.json, null, 2)); return 0; }
+  const observations = result.json.observations;
+  if (!Array.isArray(observations)) return apiError({}, "Invalid quota history response", 502);
+  console.log("OBSERVED\tSOURCE\tWINDOW\tUSED\tRESET");
+  if (!observations.length) console.log("No quota observations for this credential publication.");
+  for (const observation of observations) {
+    if (!observation || typeof observation !== "object" || !Array.isArray(observation.windows)
+      || !Number.isFinite(observation.observedAt)) return apiError({}, "Invalid quota history response", 502);
+    for (const window of observation.windows) {
+      console.log(`${historyDate(observation.observedAt)}\t${observation.source}\t${window.family}/${window.window}\t${window.usedPercent}%\t${historyDate(window.resetAtMs)}`);
+    }
+  }
+  const capacity = result.json.capacity;
+  if (capacity && typeof capacity === "object" && "status" in capacity && capacity.status === "estimated"
+    && "estimates" in capacity && Array.isArray(capacity.estimates)) {
+    console.log("Effective capacity estimate (low confidence; not a provider token limit):");
+    for (const estimate of capacity.estimates) {
+      if (estimate && Number.isFinite(estimate.estimatedTokens) && Number.isSafeInteger(estimate.sampleCount)) {
+        console.log(`${estimate.window}\t~${estimate.estimatedTokens} reported tokens / 100%\t${estimate.sampleCount} samples`);
+      }
+    }
+  }
+  if (capacity && typeof capacity === "object" && "status" in capacity && capacity.status === "insufficient-evidence") {
+    const reason = "reason" in capacity ? parseCapacityReason(capacity.reason) : undefined;
+    console.log(`Effective capacity: insufficient evidence${reason ? ` (${reason})` : ""}.`);
+  }
+  return 0;
+}

package/src/cli/account-main.ts

@@ -17,6 +17,9 @@ const USAGE = `Usage:
   ocx account main list [--json]
   ocx account main register <label> [--json]
   ocx account main add <label>
+  ocx account main reauth --device [--no-wait] [--json]
+  ocx account main reauth status --flow <id> [--json]
+  ocx account main reauth cancel --flow <id> [--json]
   ocx account main switch <profile-id-or-label> --yes [--json]
   ocx account main recover [--rollback --yes] [--json]
 
@@ -186,6 +189,83 @@ export async function cmdNativeMainAccount(args: string[], deps: AccountDeps): P
   const baseUrl = await resolveBaseUrl(deps);
   if (!baseUrl) return proxyUnreachable();
 
+  if (sub === "reauth") {
+    // #3898: same-identity device reauth of the native __main__ slot via the
+    // dedicated management namespace; /api/codex-auth/login stays pool-only.
+    if (confirmed || rollback) return reject(args);
+    const noWait = flag(args, "--no-wait");
+    const device = flag(args, "--device");
+    const flowIndex = args.indexOf("--flow");
+    const flowId = flowIndex >= 0 ? args.splice(flowIndex, 2)[1] : undefined;
+    const action = args.shift();
+    if (args.length > 0) return reject(args);
+
+    const printStatus = (status: Record<string, unknown>): void => {
+      if (wantsJson) { console.log(JSON.stringify(status, null, 2)); return; }
+      console.log("status: " + String(status.status ?? "unknown"));
+      if (typeof status.verificationUrl === "string" && status.verificationUrl) {
+        console.log("url: " + status.verificationUrl);
+      }
+      if (typeof status.deviceCode === "string" && status.deviceCode) {
+        console.log("deviceCode: " + status.deviceCode);
+      }
+      if (typeof status.code === "string" && status.code) {
+        console.log("failure: " + status.code);
+      }
+    };
+
+    if (action === "status" || action === "cancel") {
+      if (!flowId || device || noWait) return reject(args);
+      const query = "/api/codex-auth/main/reauth-device?flowId=" + encodeURIComponent(flowId);
+      const result = action === "status"
+        ? await apiJson(deps, baseUrl, "GET", query)
+        : await apiJson(deps, baseUrl, "DELETE", query);
+      if (result.status === 0) return proxyUnreachable(result.transportError);
+      if (result.status !== 200) return apiError(result.json, "failed to " + action + " the native main reauth", result.status);
+      printStatus(result.json);
+      return 0;
+    }
+
+    if (action !== undefined || !device) return reject(args);
+    const started = await apiJson(deps, baseUrl, "POST", "/api/codex-auth/main/reauth-device");
+    if (started.status === 0) return proxyUnreachable(started.transportError);
+    if (started.status !== 200) return apiError(started.json, "failed to start the native main device reauth", started.status);
+    const startFlowId = typeof started.json.flowId === "string" ? started.json.flowId : "";
+    if (!startFlowId) {
+      console.error("The proxy returned an invalid reauth flow.");
+      return 1;
+    }
+    // The URL and human code arrive with the usercode response, a beat after start.
+    let pending = started.json;
+    const statusQuery = "/api/codex-auth/main/reauth-device?flowId=" + encodeURIComponent(startFlowId);
+    for (let attempt = 0; attempt < 50 && !pending.deviceCode; attempt += 1) {
+      await Bun.sleep(200);
+      const polled = await apiJson(deps, baseUrl, "GET", statusQuery);
+      if (polled.status === 200) pending = polled.json;
+    }
+    if (noWait) {
+      printStatus({ flowId: startFlowId, ...pending });
+      console.log("follow up: ocx account main reauth status --flow " + startFlowId);
+      return 0;
+    }
+    // Blocking wait bounded by the service flow expiry (15-minute grant + margin).
+    const deadline = Date.now() + 16 * 60_000;
+    for (;;) {
+      if (pending.status !== "pending" && pending.status !== "committing") break;
+      if (Date.now() >= deadline) {
+        console.error("The reauth flow did not finish within the device grant window; check status with --flow " + startFlowId + ".");
+        return 1;
+      }
+      await Bun.sleep(2_000);
+      const polled = await apiJson(deps, baseUrl, "GET", statusQuery);
+      if (polled.status === 0) return proxyUnreachable(polled.transportError);
+      if (polled.status !== 200) return apiError(polled.json, "failed to poll the native main reauth", polled.status);
+      pending = polled.json;
+    }
+    printStatus({ flowId: startFlowId, ...pending });
+    return pending.status === "succeeded" ? 0 : 1;
+  }
+
   if (sub === "doctor" || sub === "list") {
     if (args.length > 0 || confirmed || rollback) return reject(args);
     const path = sub === "doctor" ? "/api/native-main-profiles/doctor" : "/api/native-main-profiles";