@bitkyc08/opencodex 2.58.0 → 2.60.0

package/src/codex/history-state-open.ts

@@ -0,0 +1,105 @@
+/**
+ * How the read-only Codex history preflight opens the state store.
+ *
+ * Split out of `history-provider.ts` deliberately. That file is the single largest module in
+ * `src/codex/` and sits just under the repository's 2000-line ratchet; the reasoning below is
+ * load-bearing and long, and appending it there would have pushed the file over. Keeping the
+ * open policy in one small module also puts the decision somewhere it can be read on its own,
+ * which matters because getting it wrong is silent in both directions.
+ */
+import { existsSync } from "node:fs";
+import { pathToFileURL } from "node:url";
+import { Database, constants as sqliteConstants } from "bun:sqlite";
+
+/**
+ * Read-only open flags that skip WAL shared memory entirely.
+ *
+ * `immutable=1` has to arrive as a `file:` URI, and a URI filename needs SQLITE_OPEN_URI.
+ * Same idiom as the storage scanner, the log-guard inspector and the coordinator doctor, for
+ * the same reason: never touch a foreign store's WAL protocol.
+ */
+const IMMUTABLE_READONLY_FLAGS = sqliteConstants.SQLITE_OPEN_READONLY | sqliteConstants.SQLITE_OPEN_URI;
+
+/** Is this the "there is no shared memory and I may not create it" open failure? */
+export function isStateDbCantOpenError(error: unknown): boolean {
+  const code = typeof error === "object" && error && "code" in error ? String((error as { code?: unknown }).code) : "";
+  const message = error instanceof Error ? error.message.toLowerCase() : String(error).toLowerCase();
+  // Matched on the code with a message fallback, exactly like classifyRecoverableHistoryError:
+  // the same SQLite condition reaches us as a code on some platforms and as bare text on others.
+  return code === "SQLITE_CANTOPEN" || message.includes("unable to open database file");
+}
+
+/** Which step of the primary attempt a test wants to fail. */
+export type StateDbPreflightOpenPhase = "open" | "first-read";
+
+/**
+ * Test-only knob: force the primary attempt to fail with a supplied error.
+ *
+ * The fallback below turns on a condition this repository cannot reproduce deterministically
+ * from a test: whether a plain read-only open of a cleanly-closed WAL store fails or quietly
+ * creates the `-shm` depends on the platform VFS and on the directory the store sits in.
+ * Pinning the NARROWING — sidecars absent admits the immutable read, either sidecar present
+ * still refuses — therefore needs the failure supplied rather than provoked, or the test would
+ * assert the host's SQLite build instead of this decision (#4943).
+ *
+ * The phase exists because the platforms disagree about WHEN the condition is raised, not only
+ * about whether it is: see the first-read note on `openCodexStateForPreflight`.
+ */
+let openFailureForTests: ((path: string, phase: StateDbPreflightOpenPhase) => unknown) | undefined;
+export function setStateDbPreflightOpenFailureForTests(hook: typeof openFailureForTests): void {
+  openFailureForTests = hook;
+}
+
+/**
+ * Open the Codex state store for the read-only preflight.
+ *
+ * `{ readonly: true }` is tried FIRST and stays the primary path, because it is the only mode
+ * that can see a live WAL: it joins the writer's shared memory, so a thread another process
+ * just migrated to paginated history is visible here and the preflight refuses on it. An
+ * immutable open reads the last checkpointed main database instead. Making that the primary
+ * path would trade a refusal for a stale snapshot, and a refusal this preflight fails to
+ * observe is a config transition that proceeds over history Codex owns — the exact outcome the
+ * whole guard exists to prevent.
+ *
+ * A WAL store closed cleanly is the case that has no shared memory to join. SQLite cannot
+ * create the `-shm` from a read-only connection, so the open fails SQLITE_CANTOPEN on a store
+ * that is perfectly healthy, the catch-all in the preflight folds that into
+ * `history_injection_preflight_unavailable`, and `ocx sync` refuses on every attempt with no
+ * way forward (#4943).
+ *
+ * So the fallback is admitted only in the state where the absent sidecars are what make an
+ * immutable read exact rather than stale: no `-wal` and no `-shm` on disk means no writer is
+ * attached and no committed content sits outside the main database, so the main file IS the
+ * whole store and the two modes cannot disagree. Either sidecar present keeps the original
+ * error and the refusal that follows from it — a `-wal` holds content this connection would
+ * not read, and a `-shm` means a writer is attached, and neither is a store this preflight
+ * may inspect from a snapshot.
+ *
+ * The first read belongs INSIDE this attempt. `sqlite3_open_v2` does not touch page 1, so a
+ * store whose header says WAL is not inspected until the first prepare — which is where the
+ * missing shared memory is discovered on macOS, one caller frame above this function. Opening
+ * here and reading there put the classification and the failure in different scopes: the
+ * fallback was never reached, and the operator got the catch-all refusal the fix was supposed
+ * to remove. Linux hides this because its SQLite materializes the sidecars on that first read
+ * and never fails at all (#4943, macOS CI).
+ */
+export function openCodexStateForPreflight(resolvedPath: string): Database {
+  let db: Database | undefined;
+  try {
+    const forced = openFailureForTests?.(resolvedPath, "open");
+    if (forced) throw forced;
+    db = new Database(resolvedPath, { readonly: true });
+    const forcedRead = openFailureForTests?.(resolvedPath, "first-read");
+    if (forcedRead) throw forcedRead;
+    // Page 1, read while the failure is still this function's to classify.
+    db.query<{ tables: number }, []>("SELECT count(*) AS tables FROM sqlite_master").get();
+    return db;
+  } catch (error) {
+    db?.close();
+    if (!isStateDbCantOpenError(error)) throw error;
+    if (existsSync(`${resolvedPath}-wal`) || existsSync(`${resolvedPath}-shm`)) throw error;
+    // pathToFileURL percent-encodes the reserved characters a naive `file:${path}` would
+    // misparse as a query or fragment.
+    return new Database(`${pathToFileURL(resolvedPath).href}?immutable=1`, IMMUTABLE_READONLY_FLAGS);
+  }
+}

package/src/codex/inject/config-toml.ts

@@ -55,6 +55,46 @@ export function applyEol(content: string, eol: "\r\n" | "\n"): string {
   return eol === "\n" ? lf : lf.replace(/\n/g, "\r\n");
 }
 
+/** Label Codex shows for the injected provider when the operator has not chosen one. */
+export const DEFAULT_CODEX_PROVIDER_DISPLAY_NAME = "OpenCodex Proxy";
+
+/** Longest label accepted, matching the display-label policy used for provider names. */
+const MAX_CODEX_PROVIDER_DISPLAY_NAME_LENGTH = 128;
+
+/** Would this label put a control character into config.toml? */
+function hasControlCharacter(value: string): boolean {
+  // Checked by code point rather than by a control-character regex, which needs a lint
+  // suppression this repository's hygiene gate rejects — and which reads no more clearly.
+  for (const character of value) {
+    const code = character.codePointAt(0) ?? 0;
+    if (code < 0x20 || code === 0x7f) return true;
+  }
+  return false;
+}
+
+/**
+ * Which label to write, given whatever the config holds.
+ *
+ * Presentation only, and deliberately separate from identity: routing resolves through the
+ * provider id `opencodex` in the root `model_provider` line and the `[model_providers.opencodex]`
+ * header, neither of which is derived from this value. So a rename cannot reroute a thread or
+ * orphan a row that already names that id (#4810).
+ *
+ * Every rejected value falls back to the default rather than being emitted or omitted. Codex
+ * refuses to load a provider with no name, so writing a blank one would break the whole config
+ * file rather than one thread — strictly worse than the branding it was meant to remove. That is
+ * also why there is no way to suppress the field: suppression here means choosing a neutral
+ * label. A control character or an over-long value is rejected for the same reason, because
+ * `tomlString` would faithfully encode something Codex may still reject.
+ */
+export function resolveCodexProviderDisplayName(configured?: string): string {
+  const trimmed = (configured ?? "").trim();
+  if (!trimmed) return DEFAULT_CODEX_PROVIDER_DISPLAY_NAME;
+  if (trimmed.length > MAX_CODEX_PROVIDER_DISPLAY_NAME_LENGTH) return DEFAULT_CODEX_PROVIDER_DISPLAY_NAME;
+  if (hasControlCharacter(trimmed)) return DEFAULT_CODEX_PROVIDER_DISPLAY_NAME;
+  return trimmed;
+}
+
 export function buildProviderTableBlock(
   port: number,
   supportsWebsockets?: boolean,
@@ -84,12 +124,13 @@ export function buildProviderTableBlock(
 export function buildProviderTableBlockForTarget(
   target: CodexRoutingTarget,
   supportsWebsockets = false,
+  displayName?: string,
 ): string {
   const lines = [
     "",
     OCX_SECTION_MARKER,
     "[model_providers.opencodex]",
-    'name = "OpenCodex Proxy"',
+    `name = ${tomlString(resolveCodexProviderDisplayName(displayName))}`,
     `base_url = ${tomlString(target.baseUrl)}`,
     'wire_api = "responses"',
     // false only in the authless Desktop opt-in (#1107); true keeps the App/TUI account gate.
@@ -518,6 +559,7 @@ export function buildProfileFileForTarget(
   catalogPath?: string | null,
   supportsWebsockets = false,
   fastMode?: boolean,
+  displayName?: string,
 ): string {
   const origin = routingTargetOrigin(target);
   const host = new URL(origin).host;
@@ -542,7 +584,7 @@ export function buildProfileFileForTarget(
   ];
   if (catalogPath) lines.push(`model_catalog_json = ${tomlString(catalogPath)}`);
   if (fastMode !== undefined) lines.push("", "[features]", `fast_mode = ${fastMode ? "true" : "false"}`);
-  lines.push(buildProviderTableBlockForTarget(target, supportsWebsockets).trimEnd(), "");
+  lines.push(buildProviderTableBlockForTarget(target, supportsWebsockets, displayName).trimEnd(), "");
   return lines.join("\n");
 }
 

package/src/codex/inject.ts

@@ -369,7 +369,7 @@ async function injectCodexConfigImpl(
     content =
       content.trimEnd() +
       "\n" +
-      buildProviderTableBlockForTarget(routingTarget, websocketsEnabled(config ?? {}));
+      buildProviderTableBlockForTarget(routingTarget, websocketsEnabled(config ?? {}), config?.codexProviderDisplayName);
     // 3) Keep existing `openai`-tagged threads reaching the proxy (see above). Ownership rules
     // are the Design B ones: a user's own root line is never replaced.
     if (keepRootOverrideAlongsideTable) {
@@ -430,6 +430,7 @@ async function injectCodexConfigImpl(
     catalogPath,
     websocketsEnabled(config ?? {}),
     config?.fastMode,
+    config?.codexProviderDisplayName,
   );
   content = applyEol(content, eol);
 
@@ -492,7 +493,7 @@ async function injectCodexConfigImpl(
    */
   if (hadOcxProviderTableOnDisk && !providerTableMode) {
     content = applyEol(
-      content.trimEnd() + "\n" + buildProviderTableBlockForTarget(routingTarget, websocketsEnabled(config ?? {})),
+      content.trimEnd() + "\n" + buildProviderTableBlockForTarget(routingTarget, websocketsEnabled(config ?? {}), config?.codexProviderDisplayName),
       eol,
     );
   }

package/src/codex/internal/catalog-writer.ts

@@ -1,4 +1,4 @@
-import { chmodSync, linkSync, mkdirSync, truncateSync, unlinkSync, writeFileSync } from "node:fs";
+import { chmodSync, linkSync, mkdirSync, readFileSync, truncateSync, unlinkSync, writeFileSync } from "node:fs";
 import { dirname } from "node:path";
 
 import {
@@ -37,6 +37,38 @@ export interface CatalogBackupWriteIO {
 
 let backupTempSequence = 0;
 
+/**
+ * Do the prepared bytes differ from what is already on disk at `prepared.path`?
+ *
+ * The single no-op rule for both files the catalog layer owns — the active catalog
+ * and Codex's models cache — so the two writers cannot drift apart. Every
+ * mtime-keyed reader has to treat a rewrite as a change: the app-server staleness
+ * classifier (#857) compares a file's mtime against each running Codex's start
+ * time, so rewriting identical bytes marks every already-running Codex as stale
+ * even though nothing changed. #1459 established this rule for the catalog; the
+ * cache is the second writer that has to apply it, because
+ * `refreshCodexModelCatalog` reports `cacheSynced` straight into the startup
+ * warning in `handleStart`.
+ *
+ * Deliberately a Buffer rather than a decoded string: `readFileSync(path, "utf8")`
+ * substitutes U+FFFD for every invalid byte, so a file holding a raw 0x80 decodes
+ * equal to prepared content holding a legitimately encoded U+FFFD. Comparing
+ * decoded strings would then classify a malformed file as identical, skip the
+ * atomic repair write, and leave the corruption on disk.
+ *
+ * An unreadable or absent file reports "differs", so the caller performs the real
+ * write; that also converges a file that does not exist yet.
+ */
+export function preparedBytesDifferFromDisk(prepared: PreparedCatalogFileWrite): boolean {
+  let onDisk: Buffer;
+  try {
+    onDisk = readFileSync(prepared.path);
+  } catch {
+    return true;
+  }
+  return !onDisk.equals(Buffer.from(prepared.content, "utf8"));
+}
+
 function isMissingPathError(error: unknown): boolean {
   return (error as NodeJS.ErrnoException | undefined)?.code === "ENOENT";
 }

package/src/codex/lineage.ts

@@ -14,9 +14,11 @@
  *
  * What it is for, and what it is not for:
  *
- * - FIRST PLACEMENT. A child with no binding of its own may start where its family is already
- *   warm; see `pickLineageServingAccount` in ./routing. Once bound, the child is an ordinary
- *   binding, so a later move of the parent does not drag it.
+ * - FIRST PLACEMENT. Largely subsumed by cohort keying (#4780): a member of a tree that any
+ *   other member has already bound resolves to that same binding, so there is nothing to place.
+ *   `pickLineageServingAccount` in ./routing remains for the one case cohort keying cannot
+ *   unify -- a session-less chain whose parent is not recorded in this scope -- and is gated on
+ *   the parent's key actually differing from this request's.
  * - COST ATTRIBUTION. {@link codexThreadLineageLookup} and {@link codexLineageRootForRequest}
  *   answer which root workflow a conversation belongs to, so a grandchild's spend aggregates
  *   onto the root. No budget is implemented here.
@@ -155,30 +157,83 @@ export function codexConversationKeyFor(familyId: string, threadId: string): str
     .digest("base64url")}`;
 }
 
+/**
+ * The cohort anchor's key: the same string on both sides of the derivation.
+ *
+ * A cohort is identified by one value the whole tree shares, so the key is that value keyed
+ * against itself rather than against a member. Using {@link codexConversationKeyFor} keeps one
+ * derivation in the module, which is what guarantees a lineage record's `conversationKey` stays
+ * byte-identical to the key the thread actually binds under.
+ */
+function cohortKeyFromAnchor(sessionId: string | undefined, fallbackAnchor: string): string {
+  const anchor = sessionId ?? fallbackAnchor;
+  return codexConversationKeyFor(anchor, anchor);
+}
+
+/**
+ * The cohort this request belongs to, or undefined when it names no cohort at all.
+ *
+ * The session IS the cohort, which is exactly how upstream keys the prompt cache:
+ * `prompt_cache_key()` returns `responses_metadata.session_id` (or `{source}:{parent_thread_id}`
+ * for an internal session), and `AgentControl.session_id` is the root thread's id, shared with
+ * every sub-agent spawned from that root. Two requests carrying the same `prompt_cache_key` must
+ * not be served by different accounts, and keying on the session is what makes that structural
+ * rather than a hint (#4780).
+ *
+ * Without a session there is nothing in the headers that names the tree, so the cohort is
+ * whatever the parent is already bound to. That lookup is what keeps a chain of parent-only
+ * turns converging on one key: anchoring each depth on its own parent would split the cohort
+ * again at every hop. When the parent has not been seen in this scope the parent id anchors it,
+ * which is the same key that parent derives for itself.
+ */
+function cohortConversationKey(
+  headers: Headers,
+  sessionId: string | undefined,
+  parentThreadId: string | undefined,
+  now: number,
+): string | undefined {
+  if (sessionId !== undefined) return cohortKeyFromAnchor(sessionId, sessionId);
+  if (parentThreadId === undefined) return undefined;
+  const recorded = liveLineageRecord(
+    lineageByScope.get(codexLineageScopeKey(headers)),
+    parentThreadId,
+    now,
+  );
+  return recorded?.conversationKey ?? cohortKeyFromAnchor(undefined, parentThreadId);
+}
+
 /**
  * Resolve a request's conversation identity, or undefined when it carries no bindable thread
  * identity at all.
  *
- * The set of requests that produce NO key is deliberately unchanged from the pre-#4546 rule: a
- * bare `thread-id` with neither a session nor a parent stays unbound, exactly as the Desktop
- * fallback required both halves of its pair. Only the VALUE moves, and only for requests that
- * name a parent:
+ * The set of requests that produce NO key is deliberately unchanged, through both #4546 and
+ * #4780: a bare `thread-id` with neither a session nor a parent stays unbound, exactly as the
+ * Desktop fallback required both halves of its pair. Only the VALUE moves.
+ *
+ * Every member of one tree resolves to the SAME key, because the cohort is the binding unit
+ * (#4780):
+ *
+ * - root (`session-id` + `thread-id`) -> the session's cohort key;
+ * - child and grandchild (parent + own `thread-id`) -> the same cohort key, since they carry the
+ *   same session;
+ * - parent-only (no `thread-id`) -> the same cohort key, derived from the session or, without
+ *   one, read from the parent's record.
  *
- * - root (`session-id` + `thread-id`) -> HMAC(session, thread), unchanged;
- * - child (parent + own `thread-id`) -> HMAC(session ?? parent, thread), previously the raw parent
- *   id, which is what made siblings share one entry and made a child's first turn land on a key
- *   the root had never bound;
- * - parent-only (no `thread-id`) -> the parent's OWN recorded key when this scope has one, and
- *   otherwise HMAC(session ?? parent, parent).
+ * THIS IS NOT A REVERT OF #4546 wp8, and reading it as one would flip it straight back. wp8
+ * fixed a real incoherence: a child keyed under the RAW parent id, which is a different identity
+ * from the root's own `app:HMAC(session, thread)` binding, so siblings shared an entry unrelated
+ * to the root's and a grandchild keying on its own parent landed on a key nobody had ever bound.
+ * A cohort key cannot produce that, because the root's own binding IS the cohort key: there is
+ * one identity for the tree rather than two competing ones. What wp8 additionally gave each
+ * thread -- a binding of its own -- is what #4780 deliberately gives up, and the reason is that
+ * upstream never agreed to it: `prompt_cache_key` is keyed on the session the whole tree shares,
+ * so a proxy that splits the tree makes every split member assert a warm prefix that is cold on
+ * its account.
  *
- * That last case is the one with a trap in it. A parent-only turn belongs to the parent's
- * conversation, so it has to land on the binding the parent is already using -- but the parent's
- * key is HMAC(session, thread), and HMAC(parent, parent) reproduces it only when the session id
- * and the thread id are the same string. Codex's own root happens to satisfy that, which is
- * exactly why deriving the key looks correct until a caller whose session differs from its thread
- * starts a COLD conversation on every parent-only turn and overwrites the parent's record on the
- * way through. So the recorded key wins, the session-derived key is the fallback that reproduces
- * it when the parent has not been seen in this scope, and the raw parent id is never the answer.
+ * The parent-only case keeps the trap it always had. Such a turn belongs to the parent's
+ * conversation, so it must land on the binding the parent is already using. With a session in
+ * hand that is immediate, since both derive the same cohort key. Without one, the recorded key
+ * wins and the parent id anchors the fallback; the raw parent id is never the answer.
  */
 export function codexConversationIdentity(
   headers: Headers,
@@ -190,24 +245,20 @@ export function codexConversationIdentity(
 
   if (threadId === undefined) {
     if (parentThreadId === undefined) return undefined;
-    const recorded = liveLineageRecord(
-      lineageByScope.get(codexLineageScopeKey(headers)),
-      parentThreadId,
-      now,
-    );
+    const parentOnlyKey = cohortConversationKey(headers, sessionId, parentThreadId, now);
+    if (parentOnlyKey === undefined) return undefined;
     return {
-      conversationKey: recorded?.conversationKey
-        ?? codexConversationKeyFor(sessionId ?? parentThreadId, parentThreadId),
+      conversationKey: parentOnlyKey,
       recordThreadId: parentThreadId,
       ...(sessionId !== undefined ? { sessionId } : {}),
       legacyConversationKey: parentThreadId,
       declaresParent: false,
     };
   }
-  const familyId = sessionId ?? parentThreadId;
-  if (familyId === undefined) return undefined;
+  const conversationKey = cohortConversationKey(headers, sessionId, parentThreadId, now);
+  if (conversationKey === undefined) return undefined;
   return {
-    conversationKey: codexConversationKeyFor(familyId, threadId),
+    conversationKey,
     recordThreadId: threadId,
     ...(sessionId !== undefined ? { sessionId } : {}),
     ...(parentThreadId !== undefined ? { parentThreadId } : {}),
@@ -313,7 +364,7 @@ function lineageFor(
   const parentConversationKey = parentThreadId === undefined
     ? undefined
     : parentRecord?.conversationKey
-      ?? codexConversationKeyFor(identity.sessionId ?? parentThreadId, parentThreadId);
+      ?? cohortKeyFromAnchor(identity.sessionId, parentThreadId);
   const rootSessionKey = parentConversationKey === undefined
     ? identity.conversationKey
     : parentRecord?.rootSessionKey ?? parentConversationKey;

package/src/codex/loopback-target.ts

@@ -5,6 +5,37 @@ import { NATIVE_RESERVE_MODEL } from "./catalog/native-models";
 export const CODEX_RESERVE_HELPER_UNSUPPORTED_MESSAGE =
   "Luna Reserve compatibility is only available as a conversation model, not a vision helper. Choose another vision model.";
 
+export const CODEX_RESERVE_OPT_IN_REQUIRED_MESSAGE =
+  "Luna Reserve (gpt-reserve) is not forwarded without the local Desktop authless opt-in."
+  + " OpenCodex holds no Reserve entitlement to send for this request, so the upstream would answer with a"
+  + " usage-limit error that names neither the cause nor the fix."
+  + " Enable the opt-in with 'ocx system settings --desktop-authless on' (or set codexDesktopAuthless to true"
+  + " in config.json), then retry. Choose another model to keep working without it.";
+
+/**
+ * Strict complement of {@link isCodexReserveRequestEligible} for the FLAG reason ONLY (#4940).
+ *
+ * Read the two together. This answers a narrower question: Reserve was asked for, every ingress
+ * condition eligibility requires already holds, and the single missing piece is the operator
+ * opt-in. Flipping `codexDesktopAuthless` to true therefore always turns a true here into a true
+ * from {@link isCodexReserveRequestEligible}, which is what makes it honest for the refusal to
+ * name that one setting. The other two ineligibility reasons are deliberately not covered: a
+ * client role and a non-loopback admission source are different situations, and the correct
+ * answer for both is still to forward exactly as before.
+ *
+ * Callers classify the concrete destination as canonical forward before using this predicate, the
+ * same obligation {@link isCodexReserveHelperUnsupported} carries. An operator who has aliased or
+ * routed `gpt-reserve` onto some other provider owns a path that works, and it must keep working.
+ */
+export function isCodexReserveOptInMissing(
+  config: Pick<OcxConfig, "codexDesktopAuthless" | "runtimeRole">,
+  modelId: string,
+  admission: Pick<DataPlaneAdmission, "source"> | undefined,
+): boolean {
+  return modelId === NATIVE_RESERVE_MODEL && config.codexDesktopAuthless !== true
+    && config.runtimeRole !== "client" && admission?.source === "loopback";
+}
+
 /** Callers classify the concrete destination as canonical forward before using this predicate. */
 export function isCodexReserveHelperUnsupported(
   config: Pick<OcxConfig, "codexDesktopAuthless" | "runtimeRole">,

package/src/codex/main-account-hard-lock.ts

@@ -1,7 +1,8 @@
 import type { OcxConfig } from "../types";
 import { getMainPolicyQuota } from "./quota";
+import { MAIN_ACCOUNT_HARD_LOCK_PERCENT } from "./quota-types";
 
-export const MAIN_ACCOUNT_HARD_LOCK_PERCENT = 99;
+export { MAIN_ACCOUNT_HARD_LOCK_PERCENT };
 
 export interface MainAccountHardLockStatus {
   enabled: boolean;

package/src/codex/main-account.ts

@@ -296,7 +296,10 @@ function persistNativeMainReauthTokens(
  *     main account's reauth quarantine for the new credential generation.
  */
 export function beginNativeMainReauth(): {
-  commit: (tokens: NativeMainReauthTokens) => Promise<{ chatgptAccountId: string }>;
+  commit: (
+    tokens: NativeMainReauthTokens,
+    options?: { signal?: AbortSignal },
+  ) => Promise<{ chatgptAccountId: string }>;
 } {
   const expected = readMainAuthJsonCredential();
   if (!expected || !expected.chatgptAccountId) {
@@ -305,7 +308,10 @@ export function beginNativeMainReauth(): {
     );
   }
   return {
-    async commit(tokens: NativeMainReauthTokens): Promise<{ chatgptAccountId: string }> {
+    async commit(
+      tokens: NativeMainReauthTokens,
+      options: { signal?: AbortSignal } = {},
+    ): Promise<{ chatgptAccountId: string }> {
       if (!tokens.accessToken || !tokens.refreshToken || !tokens.idToken) {
         throw new NativeMainReauthUnavailableError("Device grant did not produce a complete token set");
       }
@@ -322,11 +328,12 @@ export function beginNativeMainReauth(): {
             "Native main traffic is blocked by startup or recovery state",
           );
         }
+        if (options.signal?.aborted) throw options.signal.reason;
         assertMainAuthJsonSnapshotUnchanged(expected);
         persistNativeMainReauthTokens(expected, tokens);
         clearAccountNeedsReauth(MAIN_CODEX_ACCOUNT_ID);
         return { chatgptAccountId: tokens.chatgptAccountId };
-      }, { waitMs: 30_000 });
+      }, { waitMs: 30_000, signal: options.signal });
     },
   };
 }

package/src/codex/main-device-reauth.ts

@@ -54,7 +54,9 @@ interface ActiveFlow {
   /** Set once auth.json has been replaced; cancellation can no longer win. */
   published: boolean;
   /** Snapshot-holding commit prepared at start; closure-private identity. */
-  prepared?: { commit: (tokens: NativeMainReauthTokens) => Promise<{ chatgptAccountId: string }> };
+  prepared?: {
+    commit: (tokens: NativeMainReauthTokens, options?: { signal?: AbortSignal }) => Promise<{ chatgptAccountId: string }>;
+  };
 }
 
 /** Bounded terminal retention so status/cancel stay answerable after completion. */
@@ -65,7 +67,9 @@ const terminalFlows = new Map<string, { status: MainDeviceReauthStatus; expiresA
 
 export interface MainDeviceReauthDeps {
   login?: (ctrl: OAuthController) => Promise<NativeDeviceLogin>;
-  beginCommit?: () => { commit: (tokens: NativeMainReauthTokens) => Promise<{ chatgptAccountId: string }> };
+  beginCommit?: () => {
+    commit: (tokens: NativeMainReauthTokens, options?: { signal?: AbortSignal }) => Promise<{ chatgptAccountId: string }>;
+  };
   flowId?: () => string;
   now?: () => number;
 }
@@ -81,10 +85,13 @@ function sweepTerminal(now: number): void {
 }
 
 function finish(flow: ActiveFlow, status: MainDeviceReauthStatus, now: number): void {
-  // Publication beats a racing cancellation: once auth.json was replaced the
-  // honest terminal is succeeded, never cancelled (080). Every other terminal
-  // is first-write-wins so a superseded or cancelled completion cannot
-  // publish a later result.
+  // Terminal results are first-write-wins, with one exception (080): once the
+  // commit actually replaced auth.json, the honest terminal is succeeded. The
+  // signal now fences the claim wait and the pre-write recheck, but it cannot
+  // fence the gap between the synchronous write and this call — the claim
+  // teardown and the promise resolution both yield, so a cancel arriving there
+  // would otherwise report "cancelled" for a credential that was replaced and
+  // a reauth quarantine that was cleared.
   if (isTerminal(flow.status)) {
     if (!(flow.published && status.status === "succeeded")) return;
   }
@@ -165,15 +172,16 @@ export function startMainDeviceReauth(deps: MainDeviceReauthDeps = {}): MainDevi
       if (flow.controller.signal.aborted) return;
       if (!isTerminal(flow.status)) flow.status = { flowId, status: "committing" };
       // Recheck immediately before the write: a cancel that landed while the
-      // grant was resolving must not reach auth.json. Once the commit DOES
-      // publish, the terminal is succeeded even if a cancel raced it (080).
+      // grant was resolving must not reach auth.json. The commit itself is
+      // fenced by the same signal, so a cancel delivered while the claim
+      // waits aborts the publication instead of racing it.
       if (activeFlow !== flow || flow.controller.signal.aborted || isTerminal(flow.status)) return;
       await flow.prepared!.commit({
         accessToken: grant.credential.access,
         refreshToken: grant.credential.refresh,
         idToken: grant.idToken,
         chatgptAccountId: grant.credential.accountId!,
-      });
+      }, { signal: flow.controller.signal });
       flow.published = true;
       finish(flow, { flowId, status: "succeeded", credentialUpdated: true }, clock());
     } catch (error) {