@bitkyc08/opencodex 2.63.0 → 2.64.0-preview.20260923

package/src/client/hub-client.ts

@@ -6,14 +6,8 @@ import { clearableDeadline } from "../lib/abort";
 import type { Desktop3pModelEntry } from "../claude/desktop-3p";
 import { assertDesktop3pModelsValid } from "../claude/desktop-3p-guard";
 
-/**
- * A pairing grant may cross loopback or authenticated HTTPS, and nothing else.
- *
- * Mirrors the hub-side rule in src/server/gui-session.ts. Checking here too is not
- * redundant: it keeps the client from spending a single-use code on a request the hub is
- * certain to refuse.
- */
-function isPairingTransportPermitted(origin: string): boolean {
+/** Hub traffic may cross loopback or authenticated HTTPS, and nothing else. */
+function isHubTransportPermitted(origin: string): boolean {
   let url: URL;
   try {
     url = new URL(origin);
@@ -103,7 +97,7 @@ async function fetchBounded(
     });
     headerDeadline?.clear();
     if (response.status >= 300 && response.status < 400 && response.status !== 304) {
-      try { await response.body?.cancel(); } catch { /* best effort */ }
+      try { void response.body?.cancel().catch(() => {}); } catch { /* best effort */ }
       throw new HubClientError("redirect_refused", "Hub request redirect was refused", response.status);
     }
     return response;
@@ -118,15 +112,16 @@ async function fetchBounded(
 async function boundedText(
   response: Response,
   maxBytes: number,
-  options: { inactivityTimeoutMs?: number } = {},
+  options: { signal?: AbortSignal; inactivityTimeoutMs?: number } = {},
 ): Promise<string> {
   const declared = Number(response.headers.get("content-length") ?? "0");
   if (Number.isFinite(declared) && declared > maxBytes) {
-    try { await response.body?.cancel(); } catch { /* best effort */ }
+    try { void response.body?.cancel().catch(() => {}); } catch { /* best effort */ }
     throw new HubClientError("body_too_large", "Hub response exceeded the allowed size", response.status);
   }
   const result = await readBoundedResponseBytes(response, {
     maxBytes,
+    ...(options.signal === undefined ? {} : { signal: options.signal }),
     ...(options.inactivityTimeoutMs === undefined ? {} : { inactivityTimeoutMs: options.inactivityTimeoutMs }),
   });
   if (result.oversized) {
@@ -193,6 +188,12 @@ export function normalizeHubOrigin(input: string): string {
       "Hub URL must be an HTTP(S) origin without credentials, query, fragment, or non-/v1 path",
     );
   }
+  if (!isHubTransportPermitted(parsed.origin)) {
+    throw new HubClientError(
+      "insecure_http_refused",
+      "Hub URLs require loopback or HTTPS; plaintext remote HTTP is not permitted",
+    );
+  }
   return parsed.origin;
 }
 
@@ -252,7 +253,7 @@ export async function exchangeConnectPairingGrant(
   // Deliberateness is not the control that matters: the grant is readable by anything on the
   // path and the session it mints is reusable. The hub refuses this exchange outright now, so
   // sending it would only burn a single-use code against a certain rejection.
-  if (!isPairingTransportPermitted(origin)) {
+  if (!isHubTransportPermitted(origin)) {
     throw new HubClientError("insecure_http_refused", "Pairing requires loopback or HTTPS; plaintext HTTP cannot carry a grant");
   }
   const response = await fetchBounded(options.fetchImpl ?? fetch, `${origin}/opencodex-session`, {
@@ -446,20 +447,26 @@ export async function downloadClientCatalog(
     headers,
   }, options.timeoutMs, "headers");
   if (response.status === 304) {
+    try { void response.body?.cancel().catch(() => {}); } catch { /* best effort */ }
     throw new HubClientError("catalog_unexpected_304", "Hub answered 304 to an unconditional catalog request", 304);
   }
   if (!response.ok) {
+    try { void response.body?.cancel().catch(() => {}); } catch { /* best effort */ }
     const code = response.status === 401 ? "catalog_unauthorized" : `catalog_http_${response.status}`;
     throw new HubClientError(code, `Hub catalog request failed (${response.status})`, response.status);
   }
   if (!jsonCompatibleContentType(response)) {
-    try { await response.body?.cancel(); } catch { /* best effort */ }
+    try { void response.body?.cancel().catch(() => {}); } catch { /* best effort */ }
     throw new HubClientError("catalog_content_type_invalid", "Hub catalog response was not JSON", response.status);
   }
   let body: string;
   try {
+    const inactivityTimeoutMs = safeTimeout(options.timeoutMs);
     body = await boundedText(response, options.maxBytes ?? MAX_REMOTE_CATALOG_BYTES, {
-      inactivityTimeoutMs: safeTimeout(options.timeoutMs),
+      // Permit active catalog transfers to span multiple inactivity windows,
+      // while retaining the client's established maximum request lifetime.
+      signal: AbortSignal.timeout(Math.min(inactivityTimeoutMs * 24, 120_000)),
+      inactivityTimeoutMs,
     });
   } catch (error) {
     if (error instanceof DOMException && error.name === "TimeoutError") {
@@ -481,7 +488,7 @@ export async function fetchHubUsage(
   options: { timeoutMs?: number; fetchImpl?: typeof fetch } = {},
 ): Promise<HubUsageReport> {
   const origin = normalizeHubOrigin(serverUrl);
-  if (!isPairingTransportPermitted(origin)) {
+  if (!isHubTransportPermitted(origin)) {
     throw new HubClientError("insecure_http_refused", "Client usage requires HTTPS or loopback HTTP");
   }
   const response = await fetchBounded(options.fetchImpl ?? fetch, `${origin}/v1/usage?${query}`, {
@@ -593,7 +600,7 @@ export async function downloadDesktop3pModels(
   options: { timeoutMs?: number; fetchImpl?: typeof fetch } = {},
 ): Promise<{ version: 1; models: Desktop3pModelEntry[] }> {
   const origin = normalizeHubOrigin(serverUrl);
-  if (!isPairingTransportPermitted(origin)) {
+  if (!isHubTransportPermitted(origin)) {
     throw new HubClientError("insecure_http_refused", "Desktop model snapshots require HTTPS or loopback HTTP");
   }
   try {
@@ -608,11 +615,11 @@ export async function downloadDesktop3pModels(
       }),
     }, options.timeoutMs);
     if (!response.ok || response.status === 304) {
-      try { await response.body?.cancel(); } catch { /* best effort */ }
+      try { void response.body?.cancel().catch(() => {}); } catch { /* best effort */ }
       throw new HubClientError(`desktop_snapshot_http_${response.status}`, "Hub Desktop model snapshot request failed", response.status);
     }
     if (!jsonCompatibleContentType(response)) {
-      try { await response.body?.cancel(); } catch { /* best effort */ }
+      try { void response.body?.cancel().catch(() => {}); } catch { /* best effort */ }
       throw new HubClientError("desktop_snapshot_invalid", "Hub Desktop model snapshot was invalid");
     }
     const body = await boundedText(response, DESKTOP_SNAPSHOT_MAX_BYTES, {

package/src/clients/config-export.ts

@@ -985,9 +985,15 @@ function buildPiClientConfig(ctx: ExportContext, sendSessionAffinityHeaders = fa
   };
 }
 
+/** Do not let provider-controlled catalog text become an environment lookup. */
+function containsEnvInterpolation(value: string): boolean {
+  return value.includes("${");
+}
+
 function buildHermesClientConfig(ctx: ExportContext): HermesGeneratedConfig {
   const models: Record<string, HermesModelEntry> = {};
   for (const model of normalizeExportModels(ctx.models)) {
+    if (containsEnvInterpolation(model.namespaced)) continue;
     const declared = model.inputModalities;
     models[model.namespaced] = declared && declared.length > 0
       ? { supports_vision: declared.includes("image") }
@@ -1009,15 +1015,17 @@ function buildHermesClientConfig(ctx: ExportContext): HermesGeneratedConfig {
 }
 
 function buildOpenclawClientConfig(ctx: ExportContext): OpenclawGeneratedConfig {
-  const models: OpenclawModelEntry[] = normalizeExportModels(ctx.models).map(model => {
+  const models: OpenclawModelEntry[] = normalizeExportModels(ctx.models).flatMap(model => {
+    const name = exportModelLabel(model);
+    if (containsEnvInterpolation(model.namespaced) || containsEnvInterpolation(name)) return [];
     const context = authoritativeContextWindow(model.contextWindow);
     const input = [...new Set(model.inputModalities?.filter(value => ["text", "image", "video", "audio"].includes(value)))];
-    return {
+    return [{
       id: model.namespaced,
-      name: exportModelLabel(model),
+      name,
       ...(context !== undefined ? { contextWindow: context } : {}),
       ...(input.length > 0 ? { input } : {}),
-    };
+    }];
   });
   const headers = proxyAdmissionHeaders(ctx.config, OPENCLAW_API_KEY_ENV_REF);
   return {

package/src/codex/account-auto-switch.ts

@@ -0,0 +1,59 @@
+import type { OcxConfig } from "../types";
+import { deleteConfigObjectChildKey } from "../config/rebase-provenance";
+import { isValidCodexAccountId, MAIN_CODEX_ACCOUNT_ID } from "./account-id";
+
+export const DEFAULT_CODEX_AUTO_SWITCH_THRESHOLD = 80;
+export const MIN_CODEX_AUTO_SWITCH_THRESHOLD = 0;
+export const MAX_CODEX_AUTO_SWITCH_THRESHOLD = 100;
+
+export function parseCodexAutoSwitchThreshold(value: unknown): number | null {
+  return typeof value === "number"
+    && Number.isInteger(value)
+    && value >= MIN_CODEX_AUTO_SWITCH_THRESHOLD
+    && value <= MAX_CODEX_AUTO_SWITCH_THRESHOLD
+    ? value
+    : null;
+}
+
+export function isCodexAccountAutoSwitchThresholdKey(key: unknown): key is string {
+  return key === MAIN_CODEX_ACCOUNT_ID || isValidCodexAccountId(key);
+}
+
+/** Null means this account inherits the global threshold. */
+export function getCodexAccountAutoSwitchThresholdOverride(
+  config: OcxConfig,
+  accountId: string,
+): number | null {
+  const thresholds = config.codexAccountAutoSwitchThresholds;
+  if (!thresholds || !Object.hasOwn(thresholds, accountId)) return null;
+  return parseCodexAutoSwitchThreshold(thresholds[accountId]);
+}
+
+/** Source-account threshold used by every usage-driven routing decision. */
+export function getEffectiveCodexAutoSwitchThreshold(
+  config: OcxConfig,
+  accountId: string,
+): number {
+  const override = getCodexAccountAutoSwitchThresholdOverride(config, accountId);
+  if (override !== null) return override;
+  return config.autoSwitchThreshold ?? DEFAULT_CODEX_AUTO_SWITCH_THRESHOLD;
+}
+
+/** Store a concrete override, or null to restore global inheritance. */
+export function setCodexAccountAutoSwitchThresholdOverride(
+  config: OcxConfig,
+  accountId: string,
+  threshold: number | null,
+): void {
+  if (threshold === null) {
+    deleteConfigObjectChildKey(config, "codexAccountAutoSwitchThresholds", accountId);
+    return;
+  }
+  const entries = new Map(Object.entries(config.codexAccountAutoSwitchThresholds ?? {}));
+  entries.set(accountId, threshold);
+  config.codexAccountAutoSwitchThresholds = Object.fromEntries(entries);
+}
+
+export function forgetCodexAccountAutoSwitchThreshold(config: OcxConfig, accountId: string): void {
+  setCodexAccountAutoSwitchThresholdOverride(config, accountId, null);
+}

package/src/codex/account-lifecycle.ts

@@ -5,6 +5,7 @@ import {
   saveConfigPreservingClaudeCode,
   withConfigMutationLockSync,
 } from "../config";
+import { captureConfigTopLevelRollback } from "../config/rebase-provenance";
 import { removeCodexAccountCredential } from "./account-store";
 import { clearAccountNeedsReauth } from "./account-runtime-state";
 import { getMainChatgptAccountId, readCodexTokensResult } from "./auth-collision";
@@ -19,6 +20,7 @@ import { extractAccountIdClaims } from "../oauth/chatgpt";
 import { forgetCodexAccountPause } from "./account-pause";
 import { clearCodexAccountPin, forgetCodexAccountPriority } from "./account-priority";
 import { forgetCodexQuotaAutoRefreshAccount } from "./quota-auto-refresh-state";
+import { forgetCodexAccountAutoSwitchThreshold } from "./account-auto-switch";
 import { codexAccountNamespaceEntries, codexAccountPickerEnabled } from "./account-namespaces";
 import type { OcxConfig } from "../types";
 
@@ -163,6 +165,7 @@ export function deleteCodexAccount(runtimeConfig: OcxConfig, accountId: string):
   let cleanupFailed = false;
   const pickerVisibilityChanged = withConfigMutationLockSync(() => {
     const previousConfig = structuredClone(runtimeConfig);
+    const restoreDeletionProvenance = captureConfigTopLevelRollback(runtimeConfig, []);
     const configPath = getConfigPath();
     const hasPersistedConfig = existsSync(configPath);
     const previousPersistedConfig = hasPersistedConfig ? readFileSync(configPath) : undefined;
@@ -177,6 +180,7 @@ export function deleteCodexAccount(runtimeConfig: OcxConfig, accountId: string):
       .filter(account => account.isMain || account.id !== accountId);
     forgetCodexAccountPause(runtimeConfig, accountId);
     forgetCodexAccountPriority(runtimeConfig, accountId);
+    forgetCodexAccountAutoSwitchThreshold(runtimeConfig, accountId);
     if (runtimeConfig.codexQuotaAutoRefresh?.[accountId]) {
       const retained = { ...runtimeConfig.codexQuotaAutoRefresh };
       delete retained[accountId];
@@ -193,6 +197,9 @@ export function deleteCodexAccount(runtimeConfig: OcxConfig, accountId: string):
         saveConfigPreservingClaudeCode(runtimeConfig);
       } catch (error) {
         restoreRuntimeConfig(runtimeConfig, previousConfig);
+        // The value snapshot cannot restore WeakMap-backed deletion intent. Retaining a
+        // rejected reset would erase a later disk override when this account inherited.
+        restoreDeletionProvenance();
         try {
           assertPersistedConfigUnchanged(configPath, previousPersistedConfig);
         } catch {

package/src/codex/account-priority.ts

@@ -2,6 +2,16 @@ import { isValidCodexAccountId, MAIN_CODEX_ACCOUNT_ID } from "./account-id";
 import { DEFAULT_ACCOUNT_PRIORITY, normalizeAccountPriority } from "./pool-rotation";
 import type { OcxConfig } from "../types";
 import { deleteConfigTopLevelKey } from "../config/rebase-provenance";
+import { getEffectiveCodexAutoSwitchThreshold } from "./account-auto-switch";
+
+/** Shared cadence for the opt-in live priority recheck and its observation freshness. */
+export const CODEX_PRIORITY_FAILBACK_REFRESH_MS = 5 * 60_000;
+
+export function codexAccountPriorityFailbackEnabled(config: OcxConfig, accountId: string): boolean {
+  return config.codexAccountPriorityFailback === true
+    && (config.accountPoolStrategy ?? "quota") === "quota"
+    && getEffectiveCodexAutoSwitchThreshold(config, accountId) > 0;
+}
 
 /**
  * Which ids may carry a selection order: any pool account, plus the synthetic

package/src/codex/account-usability.ts

@@ -39,6 +39,15 @@ export interface CodexAccountUsabilityOptions {
    * account can always become unable to serve.
    */
   retainAccountForUploadedFiles?: boolean;
+  /**
+   * Main is live for this request only because the request carries its own main bearer (#5019).
+   *
+   * Main may then win this request's selection, but that credential belongs to the request, not
+   * to the Pool: selecting it must never be written back as the shared active account. Persisting
+   * it made every later request -- including one whose caller identity is unreadable, or one that
+   * owns the cooled subscription -- follow a main the operator never chose.
+   */
+  requestOwnedMainCredential?: boolean;
 }
 
 /**

package/src/codex/auth-api/account-list.ts

@@ -6,6 +6,7 @@ import { ConfigMutationLockError, mutatePersistedConfig } from "../../config";
 import { reconcileMainCodexAccountRuntimeState } from "../account-lifecycle";
 import { isCodexAccountPaused, setCodexAccountPaused } from "../account-pause";
 import { getCodexAccountPriority } from "../account-priority";
+import { getCodexAccountAutoSwitchThresholdOverride } from "../account-auto-switch";
 import { clearThreadAccountMapForAccount, isCodexAccountPlanExcluded, reconcileCodexActiveAfterExclusion } from "../routing";
 import { codexPlanValue, isThirtyDayOnlyCodexPlan } from "../plan";
 import { isAccountNeedsReauth, markAccountNeedsReauth } from "../account-runtime-state";
@@ -134,6 +135,7 @@ export function poolAccountDto(
     isMain: false,
     paused,
     priority,
+    autoSwitchThresholdOverride: getCodexAccountAutoSwitchThresholdOverride(config, account.id),
     quota: quota ? { ...quota } : null,
     needsReauth: needsReauth || health.status === "reauth_required",
     ...(reauthReason !== undefined ? { reauthReason } : {}),
@@ -157,6 +159,8 @@ export interface CodexAuthAccountDto {
   paused: boolean;
   /** Selection order; higher is used earlier. Always present, 0 when unset. */
   priority: number;
+  /** Null inherits the global usage-switch threshold; 0 disables it for this account. */
+  autoSwitchThresholdOverride: number | null;
   quota: (StoredAccountQuota | (Omit<StoredAccountQuota, "updatedAt"> & { updatedAt: number })) | null;
   needsReauth?: boolean;
   /**
@@ -353,6 +357,7 @@ export async function listCodexAuthAccountsSnapshot(
     paused: isCodexAccountPaused(runtimeConfig, MAIN_CODEX_ACCOUNT_ID),
     mainAccountHardLock: getMainAccountHardLockStatus(runtimeConfig),
     priority: getCodexAccountPriority(runtimeConfig, MAIN_CODEX_ACCOUNT_ID),
+    autoSwitchThresholdOverride: getCodexAccountAutoSwitchThresholdOverride(runtimeConfig, MAIN_CODEX_ACCOUNT_ID),
     hasCredential: hasMainCredential,
     needsReauth: mainNeedsReauth,
     ...(mainReauthReason !== undefined ? { reauthReason: mainReauthReason } : {}),

package/src/codex/auth-api/login-flow.ts

@@ -216,7 +216,7 @@ export async function handleCodexAuthLoginStart(req: Request, config: OcxConfig,
     const result = await startLoginFlow("chatgpt", {
       forceLogin: true,
       ...(useDeviceFlow ? { flow: "device" as const } : {}),
-    });
+    }, { flowId });
 
     // Open the browser server-side (same pattern as /api/oauth/login in management-api.ts).
     // The GUI's window.open is popup-blocked because it runs after an await, not a direct click.
@@ -532,11 +532,21 @@ export async function handleCodexAuthLoginCode(req: Request): Promise<Response>
 }
 
 export async function handleCodexAuthLoginCancel(req: Request): Promise<Response> {
-  const body = (await req.json().catch(() => ({}))) as { flowId?: string };
+  const body: unknown = await req.json().catch(() => null);
+  const suppliedId = body && typeof body === "object" && !Array.isArray(body)
+    ? (body as { flowId?: unknown }).flowId : undefined;
+  const flowId = typeof suppliedId === "string" ? suppliedId.trim() : "";
+  if (!flowId) return jsonResponse({ error: "flowId required" }, 400);
   const { cancelLoginFlow } = await import("../../oauth");
-  const cancelled = cancelLoginFlow("chatgpt");
-  expireCodexAuthFlow(body.flowId ?? null);
-  return jsonResponse({ ok: true, cancelled });
+  const flow = codexAuthLoginState.get(flowId);
+  if (!flow || flow.status !== "pending") {
+    return jsonResponse({ error: "login flow expired or unknown" }, 400);
+  }
+  if (!cancelLoginFlow("chatgpt", flowId)) {
+    return jsonResponse({ error: "login flow expired or unknown" }, 400);
+  }
+  expireCodexAuthFlow(flowId);
+  return jsonResponse({ ok: true, cancelled: true });
 }
 
 export async function handleCodexAuthLoginStatus(req: Request, url: URL, config: OcxConfig): Promise<Response> {

package/src/codex/auth-api/login-state.ts

@@ -36,21 +36,11 @@ export function pruneCodexLoginState(now = Date.now()): void {
   }
 }
 
-export function expireCodexAuthFlow(flowId: string | null, error = "Login cancelled"): void {
-  const ids = flowId
-    ? [flowId]
-    : [...codexAuthLoginState].filter(([, state]) => state.status === "pending").map(([id]) => id);
-  for (const id of ids) {
-    let owner = codexAuthLoginState.get(id);
-    if (!owner) {
-      pruneCodexLoginState();
-      if (codexAuthLoginState.size >= MAX_CODEX_LOGIN_STATE_ROWS) continue;
-      owner = { status: "error", startedAt: Date.now() };
-      codexAuthLoginState.set(id, owner);
-    }
-    Object.assign(owner, { status: "error", error, doneAt: Date.now() });
-    setTimeout(() => { if (codexAuthLoginState.get(id) === owner) codexAuthLoginState.delete(id); }, 30_000);
-  }
+export function expireCodexAuthFlow(flowId: string, error = "Login cancelled"): void {
+  const owner = codexAuthLoginState.get(flowId);
+  if (!owner || owner.status !== "pending") return;
+  Object.assign(owner, { status: "error", error, doneAt: Date.now() });
+  setTimeout(() => { if (codexAuthLoginState.get(flowId) === owner) codexAuthLoginState.delete(flowId); }, 30_000);
 }
 /** Package-internal admission-test seam: seed synthetic login-flow rows and return a prefix-scoped cleanup. */
 export function seedLoginRowsForTests(prefix: string, count: number): () => void {
@@ -61,4 +51,3 @@ export function seedLoginRowsForTests(prefix: string, count: number): () => void
     for (const key of [...codexAuthLoginState.keys()]) if (key.startsWith(prefix)) codexAuthLoginState.delete(key);
   };
 }
-

package/src/codex/auth-api/pool-mode-gate.ts

@@ -1,10 +1,12 @@
+import { CODEX_PRIORITY_FAILBACK_REFRESH_MS } from "../account-priority";
+import { codexQuotaHasFreshUsage } from "../quota-observation-freshness";
 import { getCodexAccountCredential, getValidCodexToken, readCodexAccountRecord } from "../account-store";
 import { getAccountQuota, isCompleteCodexQuotaRecoverySnapshot } from "../quota";
 import { reconcileMainCodexAccountRuntimeState } from "../account-lifecycle";
 import { claimDueCodexQuotaRecoveryProbes, settleCodexQuotaRecoveryProbe } from "../routing";
 import { readCodexTokens } from "../auth-collision";
 import { isAccountNeedsReauth, markAccountNeedsReauth } from "../account-runtime-state";
-import { getValidMainAccountToken, MainAccountTokenRefreshError, MAIN_CODEX_ACCOUNT_ID } from "../main-account";
+import { getValidMainAccountToken, MainAccountTokenRefreshError, MAIN_CODEX_ACCOUNT_ID, getMainAccountPlan } from "../main-account";
 import { captureConfigGeneration, registerStateSweepAfterTick } from "../../lib/state-store-sweeper";
 import { captureMainAccountIdentityGeneration, isMainAccountIdentityGenerationLive } from "../main-account-cache";
 import { getMainAccountHardLockStatus } from "../main-account-hard-lock";
@@ -16,11 +18,12 @@ import type { AdmissionLease } from "../../lib/admission";
 import { tryAcquireNativeMainProfileClaim } from "../native-main-admission";
 import { withNativeMainCredentialClaim, isNativeMainClaimUnavailable } from "./http";
 import type { PoolQuotaResult } from "./pool-quota-probe";
-import { fetchMainAccountInfoAttempt, fetchMainAccountInfo } from "./main-account-probe";
+import { fetchMainAccountInfoAttempt, fetchMainAccountInfo, MAIN_CACHE_TTL } from "./main-account-probe";
 import { fetchPoolAccountQuota, PoolQuotaProbeBusyError, POOL_CACHE_TTL, POOL_QUOTA_REFRESH_CONCURRENCY } from "./pool-quota-probe";
 import { getRuntimeConfig, configuredPoolAccount, mapWithConcurrency } from "./runtime-config";
 
 let primeInFlight: Promise<void> | null = null;
+let lastPriorityFailbackPrimeAt: number | undefined;
 /**
  * Last prime attempt per pool account. A failed WHAM lookup stores no quota, so
  * without this the account stays "unknown" and every later prime trigger re-selects
@@ -176,11 +179,20 @@ export async function primeCodexPoolQuotas(
     || providerCodexAccountMode(OPENAI_CODEX_PROVIDER_ID, openai) !== "pool"
   ) return;
   if (primeInFlight) return primeInFlight;
+  // Count attempted passes, including failed reads; incoming traffic must not flood WHAM.
+  if (reason === "priority-failback") {
+    const now = Date.now();
+    if (lastPriorityFailbackPrimeAt !== undefined
+      && now - lastPriorityFailbackPrimeAt < CODEX_PRIORITY_FAILBACK_REFRESH_MS) return;
+    lastPriorityFailbackPrimeAt = now;
+  }
   primeInFlight = (async () => {
     const pool = (runtimeConfig.codexAccounts ?? []).filter(isSelectableCodexPoolAccount);
     const stale = pool.filter(a => {
       const q = getAccountQuota(a.id);
-      if (q) return Date.now() - q.updatedAt >= POOL_CACHE_TTL;
+      const observationStale = reason === "priority-failback" && q
+        && !codexQuotaHasFreshUsage(q, a.plan, Date.now(), CODEX_PRIORITY_FAILBACK_REFRESH_MS);
+      if (q && !observationStale) return Date.now() - q.updatedAt >= POOL_CACHE_TTL;
       // No stored quota: either never primed, or the last attempt failed. Retry only
       // once per TTL window so an unreachable or rejecting account cannot turn every
       // prime trigger into another upstream request.
@@ -199,10 +211,16 @@ export async function primeCodexPoolQuotas(
             // Keep one local owner and one cross-process reader from physical
             // identity reconciliation through WHAM and all quota publication.
             (options.reconcileMainAccount ?? reconcileMainCodexAccountRuntimeState)();
-            if (getAccountQuota(MAIN_CODEX_ACCOUNT_ID)) return;
+            const quota = getAccountQuota(MAIN_CODEX_ACCOUNT_ID);
+            const observationStale = reason === "priority-failback" && quota
+              && !codexQuotaHasFreshUsage(quota, getMainAccountPlan(), Date.now(), CODEX_PRIORITY_FAILBACK_REFRESH_MS);
+            if (quota && (reason !== "priority-failback"
+              || (!observationStale && Date.now() - quota.updatedAt < MAIN_CACHE_TTL))) return;
             if (!(options.readMainTokens ?? readCodexTokens)()) return;
-            if (options.fetchMainInfo) await options.fetchMainInfo(false);
-            else await fetchMainAccountInfoAttempt(false, 1, mainLease, true);
+            const bypassCachedQuota = !!observationStale;
+            if (options.fetchMainInfo) await options.fetchMainInfo(bypassCachedQuota);
+            // Cache bypass is passive observation, never an explicit reauthentication recovery.
+            else await fetchMainAccountInfoAttempt(bypassCachedQuota, 1, mainLease, true, false);
           });
         } catch (error) {
           if (!isNativeMainClaimUnavailable(error)) throw error;
@@ -218,7 +236,10 @@ export async function primeCodexPoolQuotas(
           if (!getCodexAccountCredential(a.id)) return;
           let result: PoolQuotaResult;
           try {
-            result = await fetchPoolAccountQuota(a.id, false, a.plan, getValidPoolTokenForPrime);
+            const quota = getAccountQuota(a.id);
+            const bypassCachedQuota = reason === "priority-failback" && quota !== null
+              && !codexQuotaHasFreshUsage(quota, a.plan, Date.now(), CODEX_PRIORITY_FAILBACK_REFRESH_MS);
+            result = await fetchPoolAccountQuota(a.id, bypassCachedQuota, a.plan, getValidPoolTokenForPrime);
           } catch (error) {
             // Local quota-flight saturation proves no WHAM request existed for this account.
             // Consume it per item so sibling workers remain inside the shared prime lifetime.
@@ -257,6 +278,7 @@ export async function primeCodexPoolQuotas(
  * from another suite cannot coalesce into the next prime. */
 export function clearCodexQuotaPrimeState(): void {
   primeInFlight = null;
+  lastPriorityFailbackPrimeAt = undefined;
   poolQuotaPrimeAttemptedAt.clear();
   getValidPoolTokenForPrime = getValidCodexToken;
 }
@@ -266,6 +288,7 @@ export function clearCodexQuotaPrimeState(): void {
  * the throttle a production caller would see. */
 export function clearCodexQuotaPrimeSingleFlightForTests(): void {
   primeInFlight = null;
+  lastPriorityFailbackPrimeAt = undefined;
 }
 
 /** Test-only reset for the worker-level single-flight. */

package/src/codex/auth-api/routes.ts

@@ -21,6 +21,8 @@ import type { CodexAuthCatalogConvergence } from "./login-flow";
 import { PoolQuotaProbeBusyError } from "./pool-quota-probe";
 import { inspectResetCredits, consumeResetCredits } from "./reset-credit-service";
 import { getRuntimeConfig, saveRuntimeConfig, configuredPoolAccount } from "./runtime-config";
+import { captureConfigTopLevelRollback } from "../../config/rebase-provenance";
+import { getEffectiveCodexAutoSwitchThreshold, isCodexAccountAutoSwitchThresholdKey, parseCodexAutoSwitchThreshold, setCodexAccountAutoSwitchThresholdOverride } from "../account-auto-switch";
 
 export async function handleCodexAuthAPI(
   req: Request,
@@ -272,12 +274,46 @@ export async function handleCodexAuthAPI(
   }
 
   if (url.pathname === "/api/codex-auth/auto-switch" && req.method === "PUT") {
-    let body: { threshold: number };
-    try { body = (await req.json()) as typeof body; } catch { return jsonResponse({ error: "Invalid JSON" }, 400); }
+    let parsedBody: unknown;
+    try { parsedBody = await req.json(); } catch { return jsonResponse({ error: "Invalid JSON" }, 400); }
+    if (typeof parsedBody !== "object" || parsedBody === null || Array.isArray(parsedBody)) {
+      return jsonResponse({ error: "body must be an object" }, 400);
+    }
+    const body = parsedBody as { id?: unknown; threshold?: unknown };
+    const runtimeConfig = getRuntimeConfig(config);
+    if (Object.hasOwn(body, "id")) {
+      if (!isCodexAccountAutoSwitchThresholdKey(body.id)) {
+        return jsonResponse({ error: "id must be a Codex account id" }, 400);
+      }
+      const threshold = body.threshold === null ? null : parseCodexAutoSwitchThreshold(body.threshold);
+      if (body.threshold !== null && threshold === null) {
+        return jsonResponse({ error: "threshold must be null or an integer 0-100" }, 400);
+      }
+      if (body.id !== MAIN_CODEX_ACCOUNT_ID && !configuredPoolAccount(runtimeConfig, body.id)) {
+        return jsonResponse({ error: "Codex account not found" }, 404);
+      }
+      const rollback = captureConfigTopLevelRollback(runtimeConfig, ["codexAccountAutoSwitchThresholds"]);
+      try {
+        // Inheritance resets delete children in place; keep the previous map intact for rollback.
+        if (runtimeConfig.codexAccountAutoSwitchThresholds) {
+          runtimeConfig.codexAccountAutoSwitchThresholds = { ...runtimeConfig.codexAccountAutoSwitchThresholds };
+        }
+        setCodexAccountAutoSwitchThresholdOverride(runtimeConfig, body.id, threshold);
+        saveRuntimeConfig(config, runtimeConfig);
+      } catch (error) {
+        rollback();
+        throw error;
+      }
+      return jsonResponse({
+        ok: true,
+        id: body.id,
+        autoSwitchThresholdOverride: threshold,
+        autoSwitchThreshold: getEffectiveCodexAutoSwitchThreshold(runtimeConfig, body.id),
+      });
+    }
     if (typeof body.threshold !== "number" || !Number.isInteger(body.threshold) || body.threshold < 0 || body.threshold > 100) {
       return jsonResponse({ error: "Threshold must be an integer 0-100" }, 400);
     }
-    const runtimeConfig = getRuntimeConfig(config);
     runtimeConfig.autoSwitchThreshold = body.threshold;
     saveRuntimeConfig(config, runtimeConfig);
     return jsonResponse({ ok: true });