@bitkyc08/opencodex 2.52.0 → 2.53.0

package/src/codex/history-provider.ts

@@ -8,6 +8,7 @@ import { atomicWriteFile, getConfigDir } from "../config";
 import {
   CODEX_HISTORY_RESUMABLE_SOURCES,
   codexHistoryBackupId,
+  legacyCodexHistoryBackupId,
   sameCodexHistoryPath,
   validateCodexHistoryBackupManifest,
   type CodexHistoryBackupEntry,
@@ -32,6 +33,32 @@ export function historyBackupPathFor(stateDbPath: string): string {
   return join(getConfigDir(), `codex-history-backup-${codexHistoryBackupId(stateDbPath)}.json`);
 }
 
+/**
+ * Manifest name a database path spelled with the Win32 extended-length prefix
+ * (`\\?\C:\...`) received before that prefix was normalized out of the identity
+ * (#4442). Identical to historyBackupPathFor for every other spelling.
+ */
+export function legacyHistoryBackupPathFor(stateDbPath: string): string {
+  return join(getConfigDir(), `codex-history-backup-${legacyCodexHistoryBackupId(stateDbPath)}.json`);
+}
+
+/**
+ * The manifest that actually shadows one state database. Canonical name first; when
+ * only a pre-#4442 extended-length name exists, that manifest still shadows the
+ * database rather than reading as absent. When BOTH names exist the canonical
+ * manifest wins and the legacy file is left untouched — a conflict is resolved by
+ * keeping both, never by silently replacing one.
+ */
+export function resolveExistingHistoryBackupPath(
+  stateDbPath: string,
+  exists: (path: string) => boolean = existsSync,
+): string {
+  const canonical = historyBackupPathFor(stateDbPath);
+  if (exists(canonical)) return canonical;
+  const legacy = legacyHistoryBackupPathFor(stateDbPath);
+  return legacy !== canonical && exists(legacy) ? legacy : canonical;
+}
+
 /**
  * Open the live `state_5.sqlite` the way the Codex app expects a *secondary* writer to behave:
  * wait on the WAL/file lock instead of failing instantly, so we never race the app's own
@@ -318,7 +345,7 @@ export function preflightCodexHistoryInjection(
     // A partially restored row may already be native while its manifest still
     // owns work. Match the restore worker's target set before removing routing.
     const restoreEntries = providerTableMode ? []
-      : Object.values(readBackup(historyBackupPathFor(resolvedPath), resolvedPath).manifest.entries);
+      : Object.values(readBackup(resolveExistingHistoryBackupPath(resolvedPath), resolvedPath).manifest.entries);
     if (!existsSync(resolvedPath)) {
       return restoreEntries.length > 0 ? "history_state_database_missing" : null;
     }
@@ -1388,7 +1415,7 @@ function openaiRestoreIsNoop(stateDbPath: string, backupPath: string): boolean {
 export function syncCodexHistoryProvider(
   provider: CodexHistoryProvider,
   stateDbPath = resolveCodexStateDbPath(),
-  backupPath = historyBackupPathFor(stateDbPath),
+  backupPath = resolveExistingHistoryBackupPath(stateDbPath),
   opts: { skipWhenProvablyNoop?: boolean } = {},
 ): CodexHistorySyncResult {
   // Opt-in steady-state gate (Design B loopback callers only): default semantics of
@@ -1714,7 +1741,7 @@ export function restoreLegacyOpenaiHistory(stateDbPath = resolveCodexStateDbPath
  */
 export function migrateHistoryToOpenai(
   stateDbPath = resolveCodexStateDbPath(),
-  backupPath = historyBackupPathFor(stateDbPath),
+  backupPath = resolveExistingHistoryBackupPath(stateDbPath),
   opts: { attempts?: number; delayMs?: number; sleepFn?: (ms: number) => void } = {},
 ): CodexHistorySyncResult {
   // Steady-state gate: this migration is Design-B-specific (inject + guardian callers),
@@ -1747,7 +1774,7 @@ export function snapshotCodexHistoryNoop(
   const stateDbPresent = existsSync(stateDbPath);
   const backupPresent = existsSync(backupPath);
   const base = { canonicalStateDbPath, stateDbPresent, canonicalBackupPath, backupPresent };
-  if (!sameCodexHistoryPath(backupPath, historyBackupPathFor(stateDbPath))) {
+  if (!sameCodexHistoryPath(backupPath, resolveExistingHistoryBackupPath(stateDbPath))) {
     return { kind: "unknown", pendingRows: null, backupEntries: null, ...base, reason: "backup-path" };
   }
   const backup = inspectBackupForNoop(backupPath, stateDbPath);
@@ -1831,7 +1858,7 @@ export interface PendingHistoryCount {
  */
 export function countPendingOpencodexHistory(
   stateDbPath = resolveCodexStateDbPath(),
-  backupPath = historyBackupPathFor(stateDbPath),
+  backupPath = resolveExistingHistoryBackupPath(stateDbPath),
   opts: { validateRestoreTargets?: boolean } = {},
 ): PendingHistoryCount {
   const backup = readBackupStrict(backupPath, stateDbPath);

package/src/codex/inject.ts

@@ -895,6 +895,8 @@ export function chooseCatalogPathForInjection(
 export interface CodexInjectResult {
   success: boolean;
   message: string;
+  /** Structured read-only history preflight refusal; never parsed from display text. */
+  historyPreflightFailureReason?: string;
   status?: "skipped";
   /** `hub-gated` is the hub-role gate (#4236), distinct from the user's own OFF switch. */
   skippedReason?: "desired_disabled" | "desired_enabled" | "hub-gated";
@@ -1192,6 +1194,7 @@ async function injectCodexConfigImpl(
   if (historyPreflightError) {
     return {
       success: false,
+      historyPreflightFailureReason: historyPreflightError,
       message: `Codex config injection refused: ${historyPreflightError}. `
         + "Existing provider definitions and conversation files were preserved. "
         + "Paginated history requires native-writer coordination; do not run legacy recovery or retry this transition blindly.",
@@ -1949,6 +1952,12 @@ function restoreCodexConfigInlineImpl(kind: string): CodexRestoreConfigResult {
     const restored = journal.configRestored
       ? { success: true, message: "Codex config restored from opencodex journal." }
       : removeCodexConfig({ preserveProfile: journal.profileRestored || journal.profileChanged });
+    if (restored.success) {
+      // A successful journal/fallback write can race native history migration too.
+      // Refuse here while preimage compensation and the remove transaction can roll back.
+      const finalHistoryError = preflightCodexHistoryInjection(false, false);
+      if (finalHistoryError) return { state: "failed", changed: false, action: "failed", message: `Codex configuration and journal preserved: ${finalHistoryError}.` };
+    }
     return restored.success
       ? {
           state: "ok",

package/src/codex/main-account.ts

@@ -21,6 +21,7 @@ import { clearAccountNeedsReauth } from "./account-runtime-state";
 import { advanceCodexCredentialMutationEpoch } from "./credential-mutation-epoch";
 import { withNativeMainExclusiveClaim } from "./native-main-claim";
 import { resolveNativeProfileContext } from "./native-profile-store";
+import { isNativeMainTrafficBlocked } from "./native-profile-startup";
 
 export { MAIN_CODEX_ACCOUNT_ID } from "./account-id";
 
@@ -218,6 +219,118 @@ export function setMainAuthJsonBeforeRenameHookForTests(hook: (() => void) | nul
   beforeMainAuthJsonRenameForTests = hook;
 }
 
+/** Complete token set a native device reauth commits into the main slot (#3898). */
+export interface NativeMainReauthTokens {
+  accessToken: string;
+  refreshToken: string;
+  idToken: string;
+  chatgptAccountId: string;
+}
+
+export class NativeMainReauthUnavailableError extends Error {
+  constructor(message = "Native main credential cannot be reauthenticated in this state") {
+    super(message);
+    this.name = "NativeMainReauthUnavailableError";
+  }
+}
+
+export class NativeMainReauthIdentityMismatchError extends Error {
+  constructor() {
+    super("Device login completed for a different ChatGPT account than the native main identity");
+    this.name = "NativeMainReauthIdentityMismatchError";
+  }
+}
+
+/**
+ * The reauth twin of persistRefreshedMainAuthJson (#3898). That function
+ * spreads expected.tokens and never writes id_token, which would keep the
+ * OLD identity token beside the new grant; this sibling sets all four
+ * credential fields together and overwrites any prior id_token. Everything
+ * else — allowed root metadata, the pre-rename snapshot guards, the
+ * mutation epoch — follows the refresh path exactly.
+ */
+function persistNativeMainReauthTokens(
+  expected: MainAuthJsonCredential,
+  tokens: NativeMainReauthTokens,
+): void {
+  assertNotRealCodexHomeUnderTest(resolveCodexHomeDir());
+  const nextTokens = {
+    ...expected.tokens,
+    access_token: tokens.accessToken,
+    refresh_token: tokens.refreshToken,
+    id_token: tokens.idToken,
+    account_id: tokens.chatgptAccountId,
+  };
+  atomicWriteFile(
+    expected.path,
+    JSON.stringify({ ...expected.root, tokens: nextTokens }, null, 2) + "\n",
+    undefined,
+    {
+      beforeRename: () => {
+        assertMainAuthJsonSnapshotUnchanged(expected);
+        const hook = beforeMainAuthJsonRenameForTests;
+        beforeMainAuthJsonRenameForTests = null;
+        hook?.();
+      },
+      validateBeforeRename: () => assertMainAuthJsonSnapshotUnchanged(expected),
+    },
+  );
+  advanceCodexCredentialMutationEpoch();
+}
+
+/**
+ * Prepare a same-identity reauth of the native __main__ slot (#3898).
+ *
+ * The existing credential snapshot is captured NOW and held only inside the
+ * closure — callers (the device-reauth service) never see the expected
+ * account id, so a flow cannot be steered toward a different identity. No
+ * claim is held while the human completes the device page. The returned
+ * commit, called once the device grant exists:
+ *
+ *  1. requires the SAME chatgpt account identity as the snapshot;
+ *  2. acquires the owner-independent exclusive claim (native-main-claim) —
+ *     deliberately NOT assertNativeMainOwner, which a headless hub cannot
+ *     satisfy;
+ *  3. re-verifies the snapshot (path + hash + dev/ino) inside the claim;
+ *  4. writes access/refresh/id token + account_id atomically and clears the
+ *     main account's reauth quarantine for the new credential generation.
+ */
+export function beginNativeMainReauth(): {
+  commit: (tokens: NativeMainReauthTokens) => Promise<{ chatgptAccountId: string }>;
+} {
+  const expected = readMainAuthJsonCredential();
+  if (!expected || !expected.chatgptAccountId) {
+    throw new NativeMainReauthUnavailableError(
+      "No native main credential exists to reauthenticate; enrollment is the native profile workflow",
+    );
+  }
+  return {
+    async commit(tokens: NativeMainReauthTokens): Promise<{ chatgptAccountId: string }> {
+      if (!tokens.accessToken || !tokens.refreshToken || !tokens.idToken) {
+        throw new NativeMainReauthUnavailableError("Device grant did not produce a complete token set");
+      }
+      if (tokens.chatgptAccountId !== expected.chatgptAccountId) {
+        throw new NativeMainReauthIdentityMismatchError();
+      }
+      return withNativeMainExclusiveClaim(resolveNativeProfileContext(), async () => {
+        // Recovery/admission recheck (080): a recovery-blocked or not-ready
+        // home fails native_main_unavailable rather than rewriting auth.json
+        // underneath the gate. The claim waits bounded like the refresh path
+        // (30s) so a busy claim is not an instant refusal.
+        if (isNativeMainTrafficBlocked()) {
+          throw new NativeMainReauthUnavailableError(
+            "Native main traffic is blocked by startup or recovery state",
+          );
+        }
+        assertMainAuthJsonSnapshotUnchanged(expected);
+        persistNativeMainReauthTokens(expected, tokens);
+        clearAccountNeedsReauth(MAIN_CODEX_ACCOUNT_ID);
+        return { chatgptAccountId: tokens.chatgptAccountId };
+      }, { waitMs: 30_000 });
+    },
+  };
+}
+
 async function resolveMainAccountToken(
   dependencies: NativeMainRefreshDependencies = {},
   rejectedAccessToken?: string,

package/src/codex/main-device-reauth-api.ts

@@ -0,0 +1,89 @@
+import type { OcxConfig } from "../types";
+import { jsonResponse } from "../server/auth-cors";
+import {
+  cancelMainDeviceReauth,
+  getMainDeviceReauthStatus,
+  MainDeviceReauthFlowBusyError,
+  startMainDeviceReauth,
+} from "./main-device-reauth";
+import { NativeMainReauthUnavailableError } from "./main-account";
+
+/**
+ * Dedicated native-main device reauth route (#3898).
+ *
+ * `/api/codex-auth/login` stays pool-only and keeps rejecting __main__;
+ * this namespace is the only device-reauth surface for the native main slot.
+ * DTOs carry flowId/status/verificationUrl/deviceCode and safe failure codes
+ * — never tokens, emails, or raw account ids. The route is registered in
+ * management-api ahead of the generic /api/codex-auth/* dispatch, so the
+ * existing management origin/auth/session controls wrap it unchanged.
+ */
+
+const ROUTE = "/api/codex-auth/main/reauth-device";
+
+function errorResponse(
+  req: Request,
+  config: OcxConfig,
+  message: string,
+  code: string,
+  status: number,
+): Response {
+  return jsonResponse({ error: message, code }, status, req, config);
+}
+
+function flowIdFromQuery(url: URL): string | null {
+  for (const key of url.searchParams.keys()) {
+    if (key !== "flowId") return null;
+  }
+  const flowId = url.searchParams.get("flowId");
+  return flowId && flowId.trim() ? flowId : null;
+}
+
+export async function handleMainDeviceReauthAPI(
+  req: Request,
+  url: URL,
+  config: OcxConfig,
+): Promise<Response | null> {
+  if (url.pathname !== ROUTE) return null;
+
+  if (req.method === "POST") {
+    // Strict body: no request keys exist for start; anything supplied is an error.
+    const text = await req.text();
+    if (text.trim()) {
+      return errorResponse(req, config, "The reauth-device start takes no request body", "invalid_request", 400);
+    }
+    try {
+      return jsonResponse(startMainDeviceReauth(), 200, req, config);
+    } catch (error) {
+      if (error instanceof MainDeviceReauthFlowBusyError) {
+        return errorResponse(req, config, error.message, error.code, 409);
+      }
+      if (error instanceof NativeMainReauthUnavailableError) {
+        return errorResponse(req, config, error.message, "native_main_unavailable", 503);
+      }
+      throw error;
+    }
+  }
+
+  if (req.method === "GET") {
+    const flowId = flowIdFromQuery(url);
+    if (!flowId) {
+      return errorResponse(req, config, "An exact flowId query is required", "invalid_request", 400);
+    }
+    const status = getMainDeviceReauthStatus(flowId);
+    if (!status) return errorResponse(req, config, "Unknown or expired reauth flow", "unknown_flow", 404);
+    return jsonResponse(status, 200, req, config);
+  }
+
+  if (req.method === "DELETE") {
+    const flowId = flowIdFromQuery(url);
+    if (!flowId) {
+      return errorResponse(req, config, "An exact flowId query is required", "invalid_request", 400);
+    }
+    const status = cancelMainDeviceReauth(flowId);
+    if (!status) return errorResponse(req, config, "Unknown or expired reauth flow", "unknown_flow", 404);
+    return jsonResponse(status, 200, req, config);
+  }
+
+  return errorResponse(req, config, "Method not allowed", "method_not_allowed", 405);
+}

package/src/codex/main-device-reauth.ts

@@ -0,0 +1,217 @@
+import { randomUUID } from "node:crypto";
+import { loginChatGPTNativeDevice, type NativeDeviceLogin } from "../oauth/chatgpt-device";
+import type { OAuthController } from "../oauth/types";
+import {
+  beginNativeMainReauth,
+  MainAuthJsonChangedDuringRefreshError,
+  NativeMainReauthIdentityMismatchError,
+  NativeMainReauthUnavailableError,
+  type NativeMainReauthTokens,
+} from "./main-account";
+
+/**
+ * Process-owned native-main device reauth flow (#3898).
+ *
+ * Exactly one active flow per process, started from the management API or the
+ * CLI. The human-facing DTO carries only flowId, status, the verification
+ * URL and the device code: tokens, emails, and raw account ids never leave
+ * the device/grant layer, and the opaque device_auth_id never leaves
+ * chatgpt-device.ts at all. The grant runs on this flow's own
+ * AbortController — deliberately NOT through startLoginFlow("chatgpt"),
+ * which would overwrite the pool scratch slot and collide with pool logins.
+ */
+
+export type MainDeviceReauthStatus =
+  | { flowId: string; status: "pending"; verificationUrl: string; deviceCode: string }
+  | { flowId: string; status: "committing" }
+  | { flowId: string; status: "succeeded"; credentialUpdated: true }
+  | { flowId: string; status: "cancelled" }
+  | {
+      flowId: string;
+      status: "failed";
+      credentialUpdated?: true;
+      code:
+        | "identity_mismatch"
+        | "credential_changed"
+        | "native_main_unavailable"
+        | "device_authorization_failed"
+        | "publication_failed"
+        | "reconciliation_failed";
+    };
+
+export class MainDeviceReauthFlowBusyError extends Error {
+  readonly code = "flow_in_progress";
+  constructor() {
+    super("A native main device reauth is already in progress");
+    this.name = "MainDeviceReauthFlowBusyError";
+  }
+}
+
+interface ActiveFlow {
+  flowId: string;
+  controller: AbortController;
+  status: MainDeviceReauthStatus;
+  /** Set once auth.json has been replaced; cancellation can no longer win. */
+  published: boolean;
+  /** Snapshot-holding commit prepared at start; closure-private identity. */
+  prepared?: { commit: (tokens: NativeMainReauthTokens) => Promise<{ chatgptAccountId: string }> };
+}
+
+/** Bounded terminal retention so status/cancel stay answerable after completion. */
+const TERMINAL_RETENTION_MS = 300_000;
+
+let activeFlow: ActiveFlow | null = null;
+const terminalFlows = new Map<string, { status: MainDeviceReauthStatus; expiresAt: number }>();
+
+export interface MainDeviceReauthDeps {
+  login?: (ctrl: OAuthController) => Promise<NativeDeviceLogin>;
+  beginCommit?: () => { commit: (tokens: NativeMainReauthTokens) => Promise<{ chatgptAccountId: string }> };
+  flowId?: () => string;
+  now?: () => number;
+}
+
+function isTerminal(status: MainDeviceReauthStatus): boolean {
+  return status.status === "succeeded" || status.status === "cancelled" || status.status === "failed";
+}
+
+function sweepTerminal(now: number): void {
+  for (const [flowId, row] of terminalFlows) {
+    if (row.expiresAt <= now) terminalFlows.delete(flowId);
+  }
+}
+
+function finish(flow: ActiveFlow, status: MainDeviceReauthStatus, now: number): void {
+  // Publication beats a racing cancellation: once auth.json was replaced the
+  // honest terminal is succeeded, never cancelled (080). Every other terminal
+  // is first-write-wins so a superseded or cancelled completion cannot
+  // publish a later result.
+  if (isTerminal(flow.status)) {
+    if (!(flow.published && status.status === "succeeded")) return;
+  }
+  if (status.status === "succeeded") flow.published = true;
+  flow.status = status;
+  terminalFlows.set(flow.flowId, { status, expiresAt: now + TERMINAL_RETENTION_MS });
+}
+
+function mapFailure(flowId: string, error: unknown): MainDeviceReauthStatus {
+  if (error instanceof NativeMainReauthIdentityMismatchError) {
+    return { flowId, status: "failed", code: "identity_mismatch" };
+  }
+  if (error instanceof MainAuthJsonChangedDuringRefreshError) {
+    return { flowId, status: "failed", code: "credential_changed" };
+  }
+  if (error instanceof NativeMainReauthUnavailableError) {
+    return { flowId, status: "failed", code: "native_main_unavailable" };
+  }
+  const code = (error as { code?: unknown } | null)?.code;
+  if (code === "NATIVE_MAIN_CLAIM_UNAVAILABLE" || code === "NATIVE_MAIN_OWNER_UNAVAILABLE") {
+    return { flowId, status: "failed", code: "native_main_unavailable" };
+  }
+  const name = (error as { name?: unknown } | null)?.name;
+  if (name === "TimeoutError" || name === "AbortError") {
+    return { flowId, status: "failed", code: "device_authorization_failed" };
+  }
+  if (error instanceof Error && /device authorization/.test(error.message)) {
+    return { flowId, status: "failed", code: "device_authorization_failed" };
+  }
+  return { flowId, status: "failed", code: "publication_failed" };
+}
+
+/**
+ * Start the one active flow. Returns the pending status; the URL/code arrive
+ * with the usercode response and are visible through the status endpoint.
+ */
+export function startMainDeviceReauth(deps: MainDeviceReauthDeps = {}): MainDeviceReauthStatus {
+  const now = (deps.now ?? Date.now)();
+  sweepTerminal(now);
+  if (activeFlow && !isTerminal(activeFlow.status)) throw new MainDeviceReauthFlowBusyError();
+  const flowId = (deps.flowId ?? randomUUID)();
+  const flow: ActiveFlow = {
+    flowId,
+    controller: new AbortController(),
+    status: { flowId, status: "pending", verificationUrl: "", deviceCode: "" },
+    published: false,
+  };
+  // Claim the singleflight slot BEFORE preparing: two overlapping starts must
+  // not both snapshot and then have one throw flow_in_progress after the
+  // other already began polling.
+  activeFlow = flow;
+  try {
+    // Prepare NOW: the existing credential snapshot is captured at start (080),
+    // so a hub with no reauthenticatable main credential fails fast with
+    // native_main_unavailable instead of after the human completes the page.
+    flow.prepared = (deps.beginCommit ?? beginNativeMainReauth)();
+  } catch (error) {
+    activeFlow = null;
+    throw error;
+  }
+  const login = deps.login ?? loginChatGPTNativeDevice;
+  const clock = deps.now ?? Date.now;
+  void (async () => {
+    try {
+      const grant = await login({
+        signal: flow.controller.signal,
+        onAuth: info => {
+          // A superseded or cancelled flow may not publish its URL/code.
+          if (activeFlow !== flow || isTerminal(flow.status)) return;
+          flow.status = {
+            flowId,
+            status: "pending",
+            verificationUrl: info.url,
+            deviceCode: info.deviceCode ?? "",
+          };
+        },
+      });
+      if (flow.controller.signal.aborted) return;
+      if (!isTerminal(flow.status)) flow.status = { flowId, status: "committing" };
+      // Recheck immediately before the write: a cancel that landed while the
+      // grant was resolving must not reach auth.json. Once the commit DOES
+      // publish, the terminal is succeeded even if a cancel raced it (080).
+      if (activeFlow !== flow || flow.controller.signal.aborted || isTerminal(flow.status)) return;
+      await flow.prepared!.commit({
+        accessToken: grant.credential.access,
+        refreshToken: grant.credential.refresh,
+        idToken: grant.idToken,
+        chatgptAccountId: grant.credential.accountId!,
+      });
+      flow.published = true;
+      finish(flow, { flowId, status: "succeeded", credentialUpdated: true }, clock());
+    } catch (error) {
+      if (flow.controller.signal.aborted && !flow.published) return;
+      finish(flow, mapFailure(flowId, error), clock());
+    }
+  })();
+  return flow.status;
+}
+
+export function getMainDeviceReauthStatus(flowId: string, deps: MainDeviceReauthDeps = {}): MainDeviceReauthStatus | null {
+  const now = (deps.now ?? Date.now)();
+  sweepTerminal(now);
+  if (activeFlow?.flowId === flowId) return activeFlow.status;
+  return terminalFlows.get(flowId)?.status ?? null;
+}
+
+/**
+ * Cancel the flow. Cancellation after publication returns the published
+ * terminal (succeeded), never cancelled; a pending/committing flow aborts its
+ * grant and settles cancelled.
+ */
+export function cancelMainDeviceReauth(flowId: string, deps: MainDeviceReauthDeps = {}): MainDeviceReauthStatus | null {
+  const now = (deps.now ?? Date.now)();
+  sweepTerminal(now);
+  if (activeFlow?.flowId === flowId && !isTerminal(activeFlow.status)) {
+    activeFlow.controller.abort();
+    finish(activeFlow, { flowId, status: "cancelled" }, now);
+    return activeFlow.status;
+  }
+  return terminalFlows.get(flowId)?.status ?? null;
+}
+
+/** Test hook: drop all in-memory flow state. Production never calls this. */
+export function resetMainDeviceReauthForTests(): void {
+  // Abort first: a reset that only clears the maps leaves a pending grant
+  // polling against real timers for up to the 15-minute device TTL.
+  activeFlow?.controller.abort();
+  activeFlow = null;
+  terminalFlows.clear();
+}

package/src/codex/native-residue.ts

@@ -1,5 +1,6 @@
 import {
   closeSync,
+  existsSync,
   fstatSync,
   lstatSync,
   openSync,
@@ -16,7 +17,7 @@ import { Database } from "bun:sqlite";
 
 import { getConfigDir } from "../config";
 import { catalogHasRoutedEntries, parseCatalogJson } from "./catalog/parsing";
-import { codexHistoryBackupId, validateCodexHistoryBackupManifest } from "./history-manifest";
+import { codexHistoryBackupId, legacyCodexHistoryBackupId, validateCodexHistoryBackupManifest } from "./history-manifest";
 import {
   hasInjectedCodexRouting,
   OCX_SECTION_MARKER,
@@ -590,7 +591,13 @@ function classifyHistoryDatabase(path: string): NativeRoutedResidueResult {
 }
 
 function historyBackupPath(stateDatabasePath: string): string {
-  return join(getConfigDir(), `codex-history-backup-${codexHistoryBackupId(stateDatabasePath)}.json`);
+  const canonical = join(getConfigDir(), `codex-history-backup-${codexHistoryBackupId(stateDatabasePath)}.json`);
+  if (existsSync(canonical)) return canonical;
+  // A database path spelled with the Win32 extended-length prefix hashed to a different
+  // manifest name before #4442; that manifest still shadows the database (and a canonical
+  // file always wins over it, with the legacy one left in place).
+  const legacy = join(getConfigDir(), `codex-history-backup-${legacyCodexHistoryBackupId(stateDatabasePath)}.json`);
+  return legacy !== canonical && existsSync(legacy) ? legacy : canonical;
 }
 
 function classifyHistoryBackup(path: string, stateDatabasePath: string): NativeRoutedResidueResult {

package/src/codex/quota-auto-refresh.ts

@@ -8,7 +8,7 @@ import { isSelectableCodexPoolAccount } from "./account-id";
 import { reconcileMainCodexAccountRuntimeState } from "./account-lifecycle";
 import { isCodexAccountPaused } from "./account-pause";
 import { isAccountNeedsReauth, markAccountNeedsReauth } from "./account-runtime-state";
-import { getValidCodexToken, isCodexAccountGenerationLive, readCodexAccountRecord } from "./account-store";
+import { capturePoolQuotaWriter, getValidCodexToken, isCodexAccountGenerationLive, readCodexAccountRecord } from "./account-store";
 import { codexAccountLogLabel } from "./account-label";
 import { getMainAccountToken, getValidMainAccountToken, MAIN_CODEX_ACCOUNT_ID } from "./main-account";
 import { isMainAccountHardLocked } from "./main-account-hard-lock";
@@ -170,10 +170,11 @@ async function warmAccount(config: OcxConfig, accountId: string): Promise<void |
     if (!record?.credential || record.deletedAt != null || record.codexValidationPending
       || record.generation !== token.generation) return false;
     if (isCodexAccountPaused(config, accountId) || isAccountNeedsReauth(accountId)) return false;
+    const poolWriter = capturePoolQuotaWriter(accountId, token);
     try {
       await warmCodexAccount({ ...token, onCompleted: headers => {
         if (isCodexAccountGenerationLive(accountId, token.generation)) {
-          applyAccountQuotaFromUpstreamHeaders(accountId, headers, writerGeneration);
+          applyAccountQuotaFromUpstreamHeaders(accountId, headers, writerGeneration, undefined, { poolWriter });
         }
       } });
     } catch (error) {