npm - @bitkyc08/opencodex - Versions diffs - 2.6.12 → 2.6.14-preview.20260701 - Mend

@bitkyc08/opencodex 2.6.12 → 2.6.14-preview.20260701

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (23) hide show

package/gui/dist/assets/{index-CTjsL04v.js → index-Cy2tzg-5.js} +1 -1
package/gui/dist/index.html +1 -1
package/package.json +1 -1
package/src/adapters/anthropic.ts +8 -3
package/src/adapters/client-fingerprint.ts +4 -0
package/src/adapters/google.ts +0 -3
package/src/adapters/kiro-wire.ts +2 -2
package/src/adapters/kiro.ts +1 -1
package/src/adapters/openai-chat.ts +104 -69
package/src/adapters/openai-responses.ts +36 -1
package/src/cli-help.ts +2 -0
package/src/cli.ts +5 -0
package/src/codex-auth-api.ts +51 -0
package/src/codex-auth-collision.ts +3 -7
package/src/codex-auth-context.ts +11 -0
package/src/codex-routing.ts +64 -2
package/src/doctor.ts +173 -0
package/src/oauth/anthropic.ts +2 -2
package/src/oauth/google-antigravity.ts +4 -3
package/src/oauth/kimi.ts +2 -2
package/src/server/adapter-resolve.ts +43 -0
package/src/server/gui-static.ts +98 -0
package/src/server.ts +16 -125

package/gui/dist/index.html CHANGED Viewed

@@ -16,7 +16,7 @@
         } catch (e) {}
       })();
     </script>
-    <script type="module" crossorigin src="/assets/index-CTjsL04v.js"></script>
+    <script type="module" crossorigin src="/assets/index-Cy2tzg-5.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-DIBiVVC0.css">
   </head>
   <body>

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@bitkyc08/opencodex",
-  "version": "2.6.12",
+  "version": "2.6.14-preview.20260701",
   "description": "Universal provider proxy for OpenAI Codex — use any LLM with Codex CLI/App/SDK",
   "type": "module",
   "main": "./bin/package-main.mjs",

package/src/adapters/anthropic.ts CHANGED Viewed

@@ -40,7 +40,7 @@ const MIN_THINKING_BUDGET = 1024;
 const OUTPUT_HEADROOM = 8192;
 /** Minimum visible-output room kept below `max_tokens` (so `max_tokens > budget_tokens` always holds). */
 const OUTPUT_FLOOR = 4096;
-const COMPAT_TOOL_PREFIX = "ocx_";
+const COMPAT_TOOL_PREFIX = "cx_";
 /** Map a Responses reasoning effort to an Anthropic extended-thinking budget (tokens, >= 1024). */
 function reasoningBudget(effort: string): number {
@@ -172,7 +172,7 @@ function messagesToAnthropicFormat(
               resultBlocks.push({
                 type: "tool_result",
                 tool_use_id: id,
-                content: "[opencodex: missing tool_result for this tool_use in Codex history]",
+                content: "[missing tool_result for this tool_use in history]",
                 is_error: true,
               });
             }
@@ -240,7 +240,10 @@ export function createAnthropicAdapter(provider: OcxProviderConfig): ProviderAda
       if (parsed.options.topP !== undefined) body.top_p = parsed.options.topP;
       if (parsed.options.stopSequences) body.stop_sequences = parsed.options.stopSequences;
-      if (parsed.options.reasoning) {
+      // `reasoning` is a Codex effort string; "none" is the disable sentinel (see parser.ts
+      // REASONING_EFFORTS). A bare truthy check would treat "none" as truthy and wrongly enable
+      // extended thinking (and strip temperature/top_p), so gate on a real, non-disable effort.
+      if (typeof parsed.options.reasoning === "string" && parsed.options.reasoning !== "none") {
         // Anthropic requires max_tokens > thinking.budget_tokens (max_tokens caps thinking +
         // visible output) and budget_tokens >= 1024. Codex sends the SAME value for both, which
         // 400s ("max_tokens must be greater than thinking.budget_tokens"). Size them so max_tokens
@@ -270,6 +273,8 @@ export function createAnthropicAdapter(provider: OcxProviderConfig): ProviderAda
       const headers: Record<string, string> = {
         "Content-Type": "application/json",
         "anthropic-version": "2023-06-01",
+        "Accept": parsed.stream ? "text/event-stream" : "application/json",
+        "User-Agent": "@anthropic-ai/sdk/0.74.0",
       };
       if (isOAuth) {
         if (provider.apiKey) headers["Authorization"] = `Bearer ${provider.apiKey}`;

package/src/adapters/client-fingerprint.ts CHANGED Viewed

@@ -20,6 +20,10 @@ export const CLAUDE_CODE_HEADERS: Record<string, string> = {
   "X-Stainless-Runtime": "node",
   "X-Stainless-Lang": "js",
   "X-Stainless-Timeout": "600",
+  "X-Stainless-Arch": process.arch,
+  "X-Stainless-OS": process.platform,
+  "X-Stainless-Package-Version": "0.74.0",
+  "X-Stainless-Runtime-Version": process.version.slice(1),
 };
 /**

package/src/adapters/google.ts CHANGED Viewed

@@ -19,7 +19,6 @@ import { isVertexTruncationReason, vertexTruncationErrorMessage } from "./google
 import { ANTIGRAVITY_REQUEST_UA, antigravitySessionId, isLikelyRealThoughtSignature, sanitizeAntigravityClaudeSignatures } from "./google-antigravity-wire";
 import { sanitizeGeminiToolParameters } from "./google-tool-schema";
 import { neutralizeIdentity } from "./identity";
-import { ANTIGRAVITY_GOOG_API_CLIENT_UA } from "./client-fingerprint";
 import { antigravityUsesReplayCache, applyAntigravityReplay, clearAntigravityReplay, observeAntigravityReplay } from "./google-antigravity-replay";
 // Google-family models (Gemini/Vertex/Antigravity) tend to emit long running commentary between
@@ -264,8 +263,6 @@ export function createGoogleAdapter(provider: OcxProviderConfig): ProviderAdapte
           request,
         };
         headers["User-Agent"] = ANTIGRAVITY_REQUEST_UA;
-        // The Antigravity client library reports a secondary Google API client UA alongside the CLI UA.
-        headers["x-goog-api-client"] = ANTIGRAVITY_GOOG_API_CLIENT_UA;
         if (provider.apiKey) headers["Authorization"] = `Bearer ${provider.apiKey}`;
         return { url, method: "POST", headers, body: JSON.stringify(envelope) };
       }

package/src/adapters/kiro-wire.ts CHANGED Viewed

@@ -8,9 +8,9 @@ let cachedFp: string | undefined;
 export function fingerprint(): string {
   if (cachedFp) return cachedFp;
   try {
-    cachedFp = createHash("sha256").update(`${hostname()}-${userInfo().username}-kiro-ocx`).digest("hex");
+    cachedFp = createHash("sha256").update(`${hostname()}-${userInfo().username}-kiro`).digest("hex");
   } catch {
-    cachedFp = createHash("sha256").update("default-kiro-ocx").digest("hex");
+    cachedFp = createHash("sha256").update("default-kiro").digest("hex");
   }
   return cachedFp;
 }

package/src/adapters/kiro.ts CHANGED Viewed

@@ -33,7 +33,7 @@ import { neutralizeIdentity } from "./identity";
 const AMZ_TARGET = "AmazonCodeWhispererStreamingService.GenerateAssistantResponse";
 const SDK_VERSION = "1.0.27";
 const NODE_VERSION = "22.21.1";
-const KIRO_IDE_VERSION = "1.2.0";
+const KIRO_IDE_VERSION = "1.0.0";
 // Payload construction (conversationState)
 interface KiroToolUse {

package/src/adapters/openai-chat.ts CHANGED Viewed

@@ -223,92 +223,127 @@ export function createOpenAIChatAdapter(provider: OcxProviderConfig): ProviderAd
       let currentToolCallId = "";
       let currentToolCallName = "";
       let pendingUsage: OcxUsage | undefined;
+      // Track terminal signals so a socket EOF without any terminator can fail closed instead of
+      // being reported as a clean completion (silent truncation). A graceful close is either an
+      // explicit `[DONE]` sentinel OR a chunk carrying a non-null `finish_reason` (some
+      // OpenAI-compatible providers omit `[DONE]` but do send finish_reason).
+      let sawFinish = false;
-      try {
-        while (true) {
-          const { done, value } = await reader.read();
-          if (done) break;
-          buffer += decoder.decode(value, { stream: true });
-          const lines = buffer.split("\n");
-          buffer = lines.pop() ?? "";
+      // Single per-line handler shared by the streaming loop and the EOF residual-frame flush, so
+      // a final frame is parsed identically wherever it lands (no duplicated, drift-prone parsing).
+      // Yields adapter events and returns "terminate" for a terminal frame ([DONE] / error) that
+      // must end the stream, or "continue" otherwise. Mutates the closure's terminal-signal state.
+      const handleDataLine = function* (line: string): Generator<AdapterEvent, "continue" | "terminate"> {
+        if (!line.startsWith("data: ")) return "continue";
+        const payload = line.slice(6).trim();
+        if (payload === "[DONE]") {
+          if (currentToolCallId) {
+            yield { type: "tool_call_end" };
+            currentToolCallId = "";
+          }
+          yield { type: "done", usage: pendingUsage };
+          return "terminate";
+        }
-          for (const line of lines) {
-            if (!line.startsWith("data: ")) continue;
-            const payload = line.slice(6).trim();
-            if (payload === "[DONE]") {
-              if (currentToolCallId) {
-                yield { type: "tool_call_end" };
-                currentToolCallId = "";
-              }
-              yield { type: "done", usage: pendingUsage };
-              return;
-            }
+        let chunk: Record<string, unknown>;
+        try {
+          chunk = JSON.parse(payload) as Record<string, unknown>;
+        } catch {
+          debugDroppedFrame("openai-chat", payload);
+          return "continue";
+        }
-            let chunk: Record<string, unknown>;
-            try {
-              chunk = JSON.parse(payload) as Record<string, unknown>;
-            } catch {
-              debugDroppedFrame("openai-chat", payload);
-              continue;
-            }
+        // A 200/OK chat-completions stream may carry an inline provider error envelope
+        // instead of a clean [DONE]. Surface it as a terminal error so the bridge emits a
+        // classified response.failed (bridge case "error") — never a truncated completion.
+        if (chunk.error) {
+          const err = chunk.error as { message?: string } | undefined;
+          if (currentToolCallId) yield { type: "tool_call_end" };
+          yield { type: "error", message: err?.message ?? "upstream error" };
+          return "terminate";
+        }
-            // A 200/OK chat-completions stream may carry an inline provider error envelope
-            // instead of a clean [DONE]. Surface it as a terminal error so the bridge emits a
-            // classified response.failed (bridge case "error") — never a truncated completion.
-            if (chunk.error) {
-              const err = chunk.error as { message?: string } | undefined;
-              if (currentToolCallId) yield { type: "tool_call_end" };
-              yield { type: "error", message: err?.message ?? "upstream error" };
-              return;
-            }
+        if (chunk.usage) {
+          // Record usage but keep parsing: some providers send usage and the final content
+          // delta in the SAME chunk; a bail here would drop that content. The choices
+          // guard below no-ops a usage-only chunk.
+          pendingUsage = usageFromOpenAIChat(chunk.usage as Record<string, unknown>);
+        }
-            if (chunk.usage) {
-              // Record usage but keep parsing: some providers send usage and the final content
-              // delta in the SAME chunk; a `continue` here would drop that content. The choices
-              // guard below no-ops a usage-only chunk.
-              pendingUsage = usageFromOpenAIChat(chunk.usage as Record<string, unknown>);
-            }
+        const choices = chunk.choices as { delta?: Record<string, unknown>; finish_reason?: string }[] | undefined;
+        if (!choices || choices.length === 0) return "continue";
+        // Observe the terminator BEFORE the delta guard: a finish-only chunk (finish_reason set,
+        // no delta) is a graceful close and must mark sawFinish even though we skip it below.
+        if (typeof choices[0].finish_reason === "string" && choices[0].finish_reason) {
+          sawFinish = true;
+        }
+        const delta = choices[0].delta;
+        if (delta) {
+          if (typeof delta.content === "string" && delta.content.length > 0) {
+            yield { type: "text_delta", text: delta.content };
+          }
-            const choices = chunk.choices as { delta?: Record<string, unknown>; finish_reason?: string }[] | undefined;
-            if (!choices || choices.length === 0) continue;
-            const delta = choices[0].delta;
-            if (!delta) continue;
+          if (typeof delta.reasoning_content === "string" && delta.reasoning_content.length > 0) {
+            yield { type: "reasoning_raw_delta", text: delta.reasoning_content };
+          }
-            if (typeof delta.content === "string" && delta.content.length > 0) {
-              yield { type: "text_delta", text: delta.content };
+          const toolCalls = delta.tool_calls as { index: number; id?: string; function?: { name?: string; arguments?: string } }[] | undefined;
+          if (toolCalls) {
+            for (const tc of toolCalls) {
+              if (tc.id && tc.id !== currentToolCallId) {
+                if (currentToolCallId) yield { type: "tool_call_end" };
+                currentToolCallId = tc.id;
+                currentToolCallName = tc.function?.name ?? "";
+                yield { type: "tool_call_start", id: tc.id, name: currentToolCallName };
+              }
+              if (tc.function?.arguments) {
+                yield { type: "tool_call_delta", arguments: tc.function.arguments };
+              }
             }
+          }
+        }
-            if (typeof delta.reasoning_content === "string" && delta.reasoning_content.length > 0) {
-              yield { type: "reasoning_raw_delta", text: delta.reasoning_content };
-            }
+        if (choices[0].finish_reason === "tool_calls" && currentToolCallId) {
+          yield { type: "tool_call_end" };
+          currentToolCallId = "";
+        }
+        return "continue";
+      };
-            const toolCalls = delta.tool_calls as { index: number; id?: string; function?: { name?: string; arguments?: string } }[] | undefined;
-            if (toolCalls) {
-              for (const tc of toolCalls) {
-                if (tc.id && tc.id !== currentToolCallId) {
-                  if (currentToolCallId) yield { type: "tool_call_end" };
-                  currentToolCallId = tc.id;
-                  currentToolCallName = tc.function?.name ?? "";
-                  yield { type: "tool_call_start", id: tc.id, name: currentToolCallName };
-                }
-                if (tc.function?.arguments) {
-                  yield { type: "tool_call_delta", arguments: tc.function.arguments };
-                }
-              }
-            }
+      try {
+        while (true) {
+          const { done, value } = await reader.read();
+          if (done) break;
+          buffer += decoder.decode(value, { stream: true });
-            if (choices[0].finish_reason === "tool_calls" && currentToolCallId) {
-              yield { type: "tool_call_end" };
-              currentToolCallId = "";
-            }
+          const lines = buffer.split("\n");
+          buffer = lines.pop() ?? "";
+          for (const line of lines) {
+            if ((yield* handleDataLine(line)) === "terminate") return;
           }
         }
+        // Some providers send the terminal `data:` frame (carrying the final delta, finish_reason,
+        // and/or usage) WITHOUT a trailing newline before closing the socket, so it never crosses
+        // the split("\n") boundary and stays in `buffer`. Run it through the SAME handler so its
+        // content/tool-calls are emitted and its terminal signal observed — otherwise a genuinely
+        // complete stream loses its last frame and may be falsely failed below.
+        if (buffer.length > 0) {
+          if ((yield* handleDataLine(buffer)) === "terminate") return;
+        }
         if (currentToolCallId) {
           yield { type: "tool_call_end" };
         }
-        // EOF without a [DONE] sentinel: still surface any usage accumulated mid-stream.
+        // Reader EOF. A graceful close shows at least one terminal signal: `[DONE]` (returns above),
+        // a non-null finish_reason (sawFinish), or a trailing usage chunk (providers emit usage only
+        // at end-of-generation). If NONE of those were seen, the stream was cut mid-flight — fail
+        // closed so the bridge emits a classified response.failed rather than a silent truncation.
+        if (!sawFinish && pendingUsage === undefined) {
+          yield { type: "error", message: "upstream stream ended without a terminal signal ([DONE] or finish_reason) — possible truncation" };
+          return;
+        }
+        // Graceful close that omitted [DONE] but delivered finish_reason and/or final usage.
         yield { type: "done", usage: pendingUsage };
       } finally {
         reader.releaseLock();

package/src/adapters/openai-responses.ts CHANGED Viewed

@@ -42,6 +42,41 @@ function sanitizeReasoningInputContent(body: unknown): unknown {
   return changed ? { ...raw, input } : body;
 }
+/**
+ * Hosted (OpenAI-executed) tool types that specific native slugs reject at request time. Codex
+ * attaches these for app skills (e.g. `image_generation` for imagegen) regardless of the target
+ * model, and the passthrough path forwards the raw body untouched — so a slug that doesn't support
+ * the tool 400s (`Tool 'image_generation' is not supported with gpt-5.3-codex-spark.`). Each entry
+ * maps a model-slug matcher to the hosted tool types that must be stripped before forwarding.
+ * Extend this when another native slug rejects a hosted tool (e.g. `code_interpreter`).
+ */
+const UNSUPPORTED_HOSTED_TOOLS: ReadonlyArray<{ match: (model: string) => boolean; tools: ReadonlySet<string> }> = [
+  { match: model => model.includes("codex-spark"), tools: new Set(["image_generation"]) },
+];
+function isPlainObject(v: unknown): v is Record<string, unknown> {
+  return !!v && typeof v === "object" && !Array.isArray(v);
+}
+/**
+ * Remove hosted tool entries the target native slug rejects, so the OAuth-passthrough body never
+ * carries a tool the upstream model 400s on. No-op (returns the original reference) when nothing
+ * matches, keeping the common path allocation-free.
+ */
+function stripUnsupportedHostedTools(body: unknown): unknown {
+  if (!isPlainObject(body) || !Array.isArray(body.tools)) return body;
+  const model = typeof body.model === "string" ? body.model : "";
+  const unsupported = UNSUPPORTED_HOSTED_TOOLS.filter(e => e.match(model));
+  if (unsupported.length === 0) return body;
+  const tools = body.tools.filter(t => {
+    const type = isPlainObject(t) && typeof t.type === "string" ? t.type : undefined;
+    if (!type) return true;
+    return !unsupported.some(e => e.tools.has(type));
+  });
+  return tools.length === body.tools.length ? body : { ...body, tools };
+}
 export function createResponsesPassthroughAdapter(provider: OcxProviderConfig): ProviderAdapter & { passthrough: true } {
   return {
     name: "openai-responses",
@@ -82,7 +117,7 @@ export function createResponsesPassthroughAdapter(provider: OcxProviderConfig):
         url,
         method: "POST",
         headers,
-        body: JSON.stringify(sanitizeReasoningInputContent(parsed._rawBody)),
+        body: JSON.stringify(stripUnsupportedHostedTools(sanitizeReasoningInputContent(parsed._rawBody))),
       };
     },

package/src/cli-help.ts CHANGED Viewed

@@ -44,6 +44,7 @@ const helpEntries: Record<string, HelpEntry> = {
   sync: { usage: "ocx sync", summary: "Fetch provider models and inject them into Codex config." },
   "sync-cache": { usage: "ocx sync-cache", summary: "Refresh Codex's model cache from the active catalog." },
   status: { usage: "ocx status", summary: "Check proxy server status." },
+  doctor: { usage: "ocx doctor", summary: "Diagnose environment/network issues (paths, WSL /mnt, proxy env, ChatGPT reachability)." },
   login: { usage: "ocx login <provider>", summary: "OAuth or API-key login for a provider." },
   logout: { usage: "ocx logout <provider>", summary: "Remove a stored provider login." },
   gui: { usage: "ocx gui", summary: "Open the opencodex dashboard." },
@@ -80,6 +81,7 @@ Usage:
   ocx sync                    Fetch models from providers and inject into Codex config
   ocx sync-cache              Refresh Codex's model cache from the active catalog
   ocx status                  Check proxy server status
+  ocx doctor                  Diagnose environment/network issues (WSL, proxy, ChatGPT reachability)
   ocx login <provider>        OAuth login (xai) — opens browser, stores token in ~/.opencodex/auth.json
   ocx logout <provider>       Remove a stored OAuth login
   ocx gui                     Open the opencodex dashboard

package/src/cli.ts CHANGED Viewed

@@ -396,6 +396,11 @@ switch (command) {
   case "status":
     await handleStatus();
     break;
+  case "doctor": {
+    const { runDoctor } = await import("./doctor");
+    await runDoctor();
+    break;
+  }
   case "ensure":
     await handleEnsure();
     break;

package/src/codex-auth-api.ts CHANGED Viewed

@@ -262,6 +262,57 @@ async function fetchPoolAccountQuota(accountId: string, forceRefresh = false, co
   }
 }
+let primeInFlight: Promise<void> | null = null;
+/**
+ * Best-effort prime of pool-account (and main) quota so the rotation engine has
+ * real usage scores instead of leaving every account at the unknown sentinel.
+ *
+ * Quota is otherwise populated only from live upstream headers (an idle pool
+ * account never serves traffic, so it never gets scored) or from the dashboard
+ * WHAM fetch (a CLI-only user never opens it). Without priming, every account
+ * stays unknown and auto-switch cannot move (see Phase 10). This runs at startup
+ * and lazily before routing when the active account is unknown.
+ *
+ * Single-flight: concurrent callers share one pass instead of stampeding N WHAM
+ * fetches. Per-fetch 8s timeouts and the 5-minute POOL_CACHE_TTL already bound
+ * cost, so the worst case is one WHAM call per account per TTL window. Failures
+ * are swallowed: a blocked WSL network must never crash startup or a request.
+ */
+export async function primeCodexPoolQuotas(config: OcxConfig, reason: string): Promise<void> {
+  if (primeInFlight) return primeInFlight;
+  primeInFlight = (async () => {
+    const runtimeConfig = getRuntimeConfig(config);
+    const pool = (runtimeConfig.codexAccounts ?? []).filter(a => !a.isMain);
+    const stale = pool.filter(a => {
+      const q = getAccountQuota(a.id);
+      return !q || Date.now() - q.updatedAt >= POOL_CACHE_TTL;
+    });
+    const primeMain = !!readCodexTokens() && !getAccountQuota(MAIN_CODEX_ACCOUNT_ID);
+    try {
+      await Promise.allSettled([
+        primeMain ? fetchMainAccountInfo(false) : Promise.resolve(),
+        mapWithConcurrency(stale, POOL_QUOTA_REFRESH_CONCURRENCY, async a => {
+          if (!getCodexAccountCredential(a.id)) return;
+          await fetchPoolAccountQuota(a.id, false, a.plan);
+        }),
+      ]);
+    } catch {
+      // Priming is best-effort; never propagate.
+    }
+    if (process.env.OPENCODEX_DEBUG_QUOTA === "1") {
+      console.warn(`[codex-quota] prime done (reason=${reason}, pool=${pool.length}, refreshed=${stale.length})`);
+    }
+  })().finally(() => { primeInFlight = null; });
+  return primeInFlight;
+}
+/** Test-only: drop any in-flight prime pass so a leaked single-flight promise
+ * from another suite cannot coalesce into the next prime. */
+export function clearCodexQuotaPrimeState(): void {
+  primeInFlight = null;
+}
 export async function handleCodexAuthAPI(
   req: Request,
   url: URL,

package/src/codex-auth-collision.ts CHANGED Viewed

@@ -37,18 +37,14 @@ function isWorkspacePlan(plan: string | undefined | null): boolean {
   return !!plan && /team|business|enterprise|workspace|edu/i.test(plan);
 }
-// Personal and workspace subscriptions are separate duplicate buckets.
-// Within each bucket, keep the original ChatGPT account id + email collision guard.
+// Main login and managed pool accounts are separate duplicate buckets.
+// Inside the pool, personal and workspace subscriptions are also separate buckets.
+// Within each pool bucket, keep the original ChatGPT account id + email collision guard.
 export function checkAccountIdCollision(
   chatgptAccountId: string,
   email?: string | null,
   plan?: string | null,
 ): { collision: true; reason: string } | { collision: false } {
-  const mainAccountId = getMainChatgptAccountId();
-  if (mainAccountId && mainAccountId === chatgptAccountId) {
-    return { collision: true, reason: "Account is already used by the main Codex login." };
-  }
   const candidateEmail = normalizedEmail(email);
   const candidateWorkspace = isWorkspacePlan(plan);
   for (const account of loadConfig().codexAccounts ?? []) {

package/src/codex-auth-context.ts CHANGED Viewed

@@ -8,6 +8,7 @@ import { markAccountNeedsReauth } from "./codex-account-runtime-state";
 import { isCodexAccountUsable } from "./codex-account-usability";
 import { MAIN_CODEX_ACCOUNT_ID, getMainAccountToken } from "./codex-main-account";
 import { getCodexAccountCooldownUntil, resolveCodexAccountForThreadDetailed } from "./codex-routing";
+import { getAccountQuota } from "./codex-quota";
 import type { OcxConfig, OcxProviderConfig } from "./types";
 import { FORWARD_HEADERS } from "./adapters/openai-responses";
@@ -76,6 +77,16 @@ export async function resolveCodexAuthContext(headers: Headers, config: OcxConfi
   if (resolution.status === "expired") throw new CodexThreadAffinityExpiredError(resolution.accountId);
   const accountId = resolution.status === "selected" ? resolution.accountId : null;
   if (!accountId) return { kind: "main", accountId: null };
+  // Lazy prime: if the selected account has no quota yet, the pool is likely
+  // unprimed (dashboard never opened, or startup prime was blocked). Kick a
+  // best-effort prime so the NEXT routing decision has real scores. This never
+  // blocks the current request, and the helper's single-flight guard collapses
+  // repeated triggers into one pass.
+  if (!getAccountQuota(accountId)) {
+    import("./codex-auth-api")
+      .then(({ primeCodexPoolQuotas }) => primeCodexPoolQuotas(config, "pre-route"))
+      .catch(() => {});
+  }
   const cooldownUntil = getCodexAccountCooldownUntil(accountId);
   if (cooldownUntil) throw new CodexAccountCooldownError(accountId, cooldownUntil);

package/src/codex-routing.ts CHANGED Viewed

@@ -12,6 +12,9 @@ type ThreadAffinityEntry = {
   generation: number;
   createdAt: number;
   lastUsedAt: number;
+  // Last time the bound account's quota threshold was re-evaluated for this
+  // thread (interval-gated to avoid per-request flapping). See REEVAL_INTERVAL_MS.
+  lastReevalAt: number;
 };
 export type CodexThreadResolution =
@@ -32,6 +35,9 @@ const CODEX_MAX_QUOTA_COOLDOWN_MS = 24 * 60 * 60_000;
 export const CODEX_FAILURE_WINDOW_MS = 5 * 60_000;
 export const CODEX_THREAD_AFFINITY_IDLE_TTL_MS = 24 * 60 * 60_000;
 export const CODEX_THREAD_AFFINITY_MAX_ENTRIES = 2048;
+// Min interval between quota threshold re-evaluations for a single bound thread.
+// Well under the 5h/weekly quota windows, but enough to stop per-request flapping.
+export const CODEX_THREAD_AFFINITY_REEVAL_INTERVAL_MS = 60_000;
 const upstreamHealth = new Map<string, CodexUpstreamHealth>();
@@ -200,6 +206,7 @@ function bindThreadAffinity(threadId: string, accountId: string, now: number): v
     generation: record.generation,
     createdAt: previous?.createdAt ?? now,
     lastUsedAt: now,
+    lastReevalAt: now,
   });
   pruneLruThreadAffinities();
 }
@@ -260,6 +267,20 @@ function setActiveCodexAccount(config: OcxConfig, accountId: string): void {
   saveConfig(config);
 }
+function isUnknownUsage(usage: number): boolean {
+  return usage >= CODEX_UNKNOWN_USAGE_SCORE;
+}
+// Round-robin among eligible unknown-quota candidates. `getEligiblePoolAccounts`
+// already returns a deterministic order (config order, main unshifted first) and
+// excludes the active id, so taking the first eligible unknown is a stable rotation
+// without any new per-account state.
+function pickNextUnknownAccount(config: OcxConfig, active: string, now: number): string | null {
+  const eligible = getEligiblePoolAccounts(config, active, now)
+    .filter(id => isUnknownUsage(computeCodexUsageScore(getAccountQuota(id), getPoolAccountPlan(config, id))));
+  return eligible.length > 0 ? eligible[0]! : null;
+}
 function applyQuotaAutoSwitch(config: OcxConfig, active: string, now: number): string {
   const threshold = config.autoSwitchThreshold ?? 80;
   if (threshold <= 0) return active;
@@ -267,8 +288,27 @@ function applyQuotaAutoSwitch(config: OcxConfig, active: string, now: number): s
   const activeUsage = computeCodexUsageScore(quota, getPoolAccountPlan(config, active));
   if (activeUsage < threshold) return active;
   const best = pickLowerUsageAccount(config, active, activeUsage, now);
-  if (best !== active) setActiveCodexAccount(config, best);
-  return best;
+  if (best !== active) {
+    setActiveCodexAccount(config, best);
+    return best;
+  }
+  // Deadlock guard: active is over threshold but no candidate scored strictly
+  // lower. When the active itself is unknown, every candidate is likely unknown
+  // too (100 < 100 never fires), which pins the pool to one account whose real
+  // usage we cannot see (e.g. quota never primed on WSL). Rotate to the next
+  // eligible unknown so rotation is not stuck; known-but-saturated accounts are
+  // intentionally left alone so a genuinely hot pool stays visible.
+  if (isUnknownUsage(activeUsage)) {
+    const next = pickNextUnknownAccount(config, active, now);
+    if (next) {
+      console.warn(`[codex-routing] quota unknown for active "${active}"; rotating to "${next}" (all candidates unknown, threshold=${threshold})`);
+      setActiveCodexAccount(config, next);
+      return next;
+    }
+    console.warn(`[codex-routing] quota unknown for active "${active}" and no eligible rotation target; staying put`);
+  }
+  return active;
 }
 function shouldFailover(config: OcxConfig, accountId: string, now: number): boolean {
@@ -314,6 +354,28 @@ export function resolveCodexAccountForThreadDetailed(
       && isCodexAccountSelectable(config, entry.accountId, now)
     ) {
       entry.lastUsedAt = now;
+      // Periodic quota re-eval: a long-lived bound thread must still switch when
+      // it crosses autoSwitchThreshold and a strictly-cooler account exists.
+      // Without this the reuse branch returns before applyQuotaAutoSwitch and the
+      // thread stays pinned for the full idle TTL (the WSL "never switches" report).
+      if (now - entry.lastReevalAt >= CODEX_THREAD_AFFINITY_REEVAL_INTERVAL_MS) {
+        entry.lastReevalAt = now;
+        const threshold = config.autoSwitchThreshold ?? 80;
+        if (threshold > 0) {
+          const usage = computeCodexUsageScore(
+            getAccountQuota(entry.accountId),
+            getPoolAccountPlan(config, entry.accountId),
+          );
+          if (usage >= threshold) {
+            const best = pickLowerUsageAccount(config, entry.accountId, usage, now);
+            if (best !== entry.accountId) {
+              setActiveCodexAccount(config, best);
+              bindThreadAffinity(threadId, best, now); // rebinds + resets clocks
+              return { status: "selected", accountId: best };
+            }
+          }
+        }
+      }
       return { status: "selected", accountId: entry.accountId };
     }
     threadAccountMap.delete(threadId);