@bitkyc08/opencodex 2.63.0 → 2.64.0-preview.20260923

package/src/codex/log-guard/maintenance.ts

@@ -100,6 +100,7 @@ export interface CodexLogGuardMaintenanceDeps {
   ) => CodexLogGuardLockOutcome<T>;
   quickCheck?: (db: Database) => string[];
   openDatabase?: (databasePath: string, flags: number) => Database;
+  statDatabasePath?: (databasePath: string) => DatabasePathStat;
   batchPages?: number;
   maxPagesPerRun?: number;
 }
@@ -112,15 +113,30 @@ interface CheckpointRow {
 }
 
 interface DatabaseFileIdentity {
-  dev: number;
-  ino: number;
+  dev: bigint;
+  ino: bigint;
   realPath: string;
 }
 
-function databasePathIdentity(databasePath: string): DatabaseFileIdentity | null {
+interface DatabasePathStat {
+  dev?: bigint | null;
+  ino?: bigint | null;
+  isFile(): boolean;
+  isSymbolicLink(): boolean;
+}
+
+function databasePathIdentity(
+  databasePath: string,
+  deps: CodexLogGuardMaintenanceDeps,
+): DatabaseFileIdentity | null {
   try {
-    const stat = lstatSync(databasePath);
-    if (!stat.isFile() || stat.isSymbolicLink()) return null;
+    const stat = deps.statDatabasePath
+      ? deps.statDatabasePath(databasePath)
+      : lstatSync(databasePath, { bigint: true });
+    // Windows file IDs are 64-bit; a number can round adjacent IDs equal.
+    // Missing or zero means the filesystem did not supply an identity, so fail closed.
+    if (!stat.isFile() || stat.isSymbolicLink()
+      || typeof stat.dev !== "bigint" || typeof stat.ino !== "bigint" || stat.ino === 0n) return null;
     const realPath = realpathSync.native(databasePath);
     if (!sameLogGuardPathIdentity(realPath, databasePath)) return null;
     return { dev: stat.dev, ino: stat.ino, realPath };
@@ -129,15 +145,16 @@ function databasePathIdentity(databasePath: string): DatabaseFileIdentity | null
   }
 }
 
-function databasePathIsSafe(databasePath: string): boolean {
-  return databasePathIdentity(databasePath) !== null;
+function databasePathIsSafe(databasePath: string, deps: CodexLogGuardMaintenanceDeps): boolean {
+  return databasePathIdentity(databasePath, deps) !== null;
 }
 
 function databasePathStillMatches(
   databasePath: string,
   before: DatabaseFileIdentity,
+  deps: CodexLogGuardMaintenanceDeps,
 ): boolean {
-  const after = databasePathIdentity(databasePath);
+  const after = databasePathIdentity(databasePath, deps);
   return after !== null
     && after.dev === before.dev
     && after.ino === before.ino
@@ -228,15 +245,15 @@ function runCompaction(
   let probeOpen = false;
   let reportBusyPartial: (() => CodexLogGuardCompactionResult) | undefined;
   try {
-    const beforeOpenIdentity = databasePathIdentity(databasePath);
+    const beforeOpenIdentity = databasePathIdentity(databasePath, deps);
     if (!beforeOpenIdentity) return { ok: false, error: "unsafe_path" };
     const openDatabase = deps.openDatabase
       ?? ((path: string, flags: number) => new Database(path, flags));
     db = openDatabase(databasePath, sqliteConstants.SQLITE_OPEN_READWRITE);
     // The path is user-writable foreign state. Re-check its regular-file,
-    // canonical-path and st_dev/st_ino identity immediately after SQLite opens
-    // it, before issuing any pragma or write-capable statement.
-    if (!databasePathStillMatches(databasePath, beforeOpenIdentity)) {
+    // canonical-path and full-width st_dev/st_ino identity immediately after
+    // SQLite opens it, before issuing any pragma or write-capable statement.
+    if (!databasePathStillMatches(databasePath, beforeOpenIdentity, deps)) {
       return { ok: false, error: "unsafe_path" };
     }
     db.exec("PRAGMA busy_timeout = 0");
@@ -373,7 +390,7 @@ export function compactCodexLogs(
   if (inspection.capabilities.reclaim.state !== "supported") {
     return { ok: false, error: "unsupported_schema" };
   }
-  if (!databasePathIsSafe(databasePath)) return { ok: false, error: "unsafe_path" };
+  if (!databasePathIsSafe(databasePath, deps)) return { ok: false, error: "unsafe_path" };
 
   const checkProcesses = deps.processCheck ?? listRunningCodexProcesses;
   const firstRefusal = processRefusal(checkProcesses());

package/src/codex/project-config-warnings.ts

@@ -1,4 +1,14 @@
-import { existsSync, readFileSync, realpathSync } from "node:fs";
+import {
+  closeSync,
+  constants,
+  existsSync,
+  fstatSync,
+  lstatSync,
+  openSync,
+  readFileSync,
+  readSync,
+  realpathSync,
+} from "node:fs";
 import path, { dirname, join, resolve } from "node:path";
 import { expandUserPath } from "../config";
 import { defaultCodexHome } from "./home";
@@ -8,6 +18,34 @@ import { truncateRetainedUtf8 } from "../lib/admission";
 const OCX_SECTION_MARKER = "# Auto-injected by opencodex";
 const DIAGNOSTICS_CACHE_TTL_MS = 30_000;
 const MAX_DIAGNOSTIC_VALUE_BYTES = 8 * 1024;
+const MAX_PROJECT_CONFIG_BYTES = 1024 * 1024;
+
+export function readBoundedProjectConfig(filePath: string): string | null {
+  let fd: number | undefined;
+  try {
+    // A candidate can become a FIFO after discovery; opening must not wait for a writer.
+    fd = openSync(filePath, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0) | (constants.O_NONBLOCK ?? 0));
+    const stat = fstatSync(fd);
+    if (!stat.isFile() || stat.size > MAX_PROJECT_CONFIG_BYTES) return null;
+
+    const buffer = Buffer.allocUnsafe(stat.size + 1);
+    let bytesRead = 0;
+    while (bytesRead < buffer.length) {
+      const count = readSync(fd, buffer, bytesRead, buffer.length - bytesRead, null);
+      if (count === 0) break;
+      bytesRead += count;
+    }
+    // Reject a file that changed while it was read, including a same-size rewrite.
+    const after = fstatSync(fd);
+    if (bytesRead !== stat.size || after.size !== stat.size
+      || after.mtimeMs !== stat.mtimeMs || after.ctimeMs !== stat.ctimeMs) return null;
+    return buffer.toString("utf-8", 0, bytesRead);
+  } catch {
+    return null;
+  } finally {
+    if (fd !== undefined) closeSync(fd);
+  }
+}
 
 function resolveCodexConfigPath(): string {
   const raw = process.env.CODEX_HOME?.trim();
@@ -359,6 +397,12 @@ export function discoverProjectCodexConfigPaths(options: {
   const globalConfigIdentity = normalizeExistingPath(codexConfigPath);
   const addIfExists = (projectRoot: string) => {
     const candidate = join(resolve(projectRoot), ".codex", "config.toml");
+    try {
+      const stat = lstatSync(candidate);
+      if (!stat.isFile() || stat.size > MAX_PROJECT_CONFIG_BYTES) return;
+    } catch {
+      return;
+    }
     const candidateIdentity = normalizeExistingPath(candidate);
     if (candidateIdentity && candidateIdentity !== globalConfigIdentity) found.add(candidate);
   };
@@ -397,12 +441,8 @@ export function collectProjectCodexConfigWarnings(options: {
 
   const warnings: ProjectCodexConfigWarning[] = [];
   for (const path of discoverProjectCodexConfigPaths({ cwd: options.cwd, codexConfigPath })) {
-    try {
-      const content = readFileSync(path, "utf-8");
-      warnings.push(...analyzeProjectCodexConfig(content, path));
-    } catch {
-      /* skip unreadable project config */
-    }
+    const content = readBoundedProjectConfig(path);
+    if (content !== null) warnings.push(...analyzeProjectCodexConfig(content, path));
   }
   return warnings;
 }

package/src/codex/prompt-layers/encoding.ts

@@ -78,3 +78,44 @@ export function decodeBasicString(literal: string): string | null {
   }
   return out;
 }
+
+/** Decode externally authored TOML basic strings on the read-only fallback path. */
+export function decodeTomlBasicString(literal: string): string | null {
+  if (literal.length < 2 || !literal.startsWith('"') || !literal.endsWith('"')) return null;
+  const inner = literal.slice(1, -1);
+  let out = "";
+  for (let i = 0; i < inner.length; i += 1) {
+    const ch = inner[i]!;
+    if (ch !== "\\") {
+      const code = inner.codePointAt(i)!;
+      if (ch === '"' || (code < 0x20 && code !== 0x09) || code === 0x7f
+        || (code >= 0xd800 && code <= 0xdfff)) return null;
+      out += String.fromCodePoint(code);
+      if (code > 0xffff) i += 1;
+      continue;
+    }
+    const escape = inner[++i];
+    switch (escape) {
+      case "b": out += "\b"; break;
+      case "t": out += "\t"; break;
+      case "n": out += "\n"; break;
+      case "f": out += "\f"; break;
+      case "r": out += "\r"; break;
+      case '"': out += '"'; break;
+      case "\\": out += "\\"; break;
+      case "u":
+      case "U": {
+        const digits = escape === "u" ? 4 : 8;
+        const hex = inner.slice(i + 1, i + 1 + digits);
+        if (hex.length !== digits || !/^[0-9a-fA-F]+$/.test(hex)) return null;
+        const code = Number.parseInt(hex, 16);
+        if (code > 0x10ffff || (code >= 0xd800 && code <= 0xdfff)) return null;
+        out += String.fromCodePoint(code);
+        i += digits;
+        break;
+      }
+      default: return null;
+    }
+  }
+  return out;
+}

package/src/codex/prompt-layers/toml-read.ts

@@ -38,7 +38,7 @@ export function rootArrayEntries(configBytes: string | null, key: string): strin
 const PARSE_FAILED = Symbol("toml-parse-failed");
 
 /** A root-scope value, `undefined` when the key is absent, `PARSE_FAILED` when the file will not parse. */
-function rootValue(configBytes: string | null, key: string): unknown {
+export function rootValue(configBytes: string | null, key: string): unknown {
   if (configBytes === null) return undefined;
   let parsed: unknown;
   try {

package/src/codex/prompt-layers.ts

@@ -149,8 +149,8 @@ export type { Ownership } from "./prompt-layers/toml-read";
 
 import { activeConfigPath, activeStorePath, activeBaseVariantDir, journalPathFor, lockPathFor, type Paths } from "./prompt-layers/paths";
 import { readFileOrNull, computeRevision, updateFingerprintField } from "./prompt-layers/revision";
-import { normalizeBody, findInvalidCharacter, decodeBasicString } from "./prompt-layers/encoding";
-import { rootArrayEntries, hasRootKey, rootLines, tableLines, boolInLines, inspectOwnership } from "./prompt-layers/toml-read";
+import { normalizeBody, findInvalidCharacter, decodeBasicString, decodeTomlBasicString } from "./prompt-layers/encoding";
+import { rootArrayEntries, hasRootKey, rootLines, rootValue, tableLines, boolInLines, inspectOwnership } from "./prompt-layers/toml-read";
 import { setRootBool, setRootString, setTableBool, setProjection, removeUnownedProjection } from "./prompt-layers/toml-edit";
 
 /**
@@ -367,22 +367,23 @@ function readToggle(configBytes: string | null, id: ToggleId): ToggleState {
 
 function readModelInstructionsFile(configBytes: string | null): string | null {
   if (configBytes === null) return null;
+  const parsed = rootValue(configBytes, "model_instructions_file");
+  if (typeof parsed === "string") return parsed;
+  if (parsed === undefined) return null;
   for (const line of rootLines(configBytes)) {
     // Capture the whole literal INCLUDING its quotes and decode it, rather than
     // returning the raw inner text. `setRootString` writes this key through
     // `encodeBasicString`, which escapes backslashes, so on Windows the stored
-    // literal is "C:\\Users\\..." while the path is "C:\Users\...". Reading the
-    // inner text verbatim returned the doubled form: the round trip did not
-    // survive, `baseSelection` compared a doubled path against the real variant
-    // path and reported `external` for a variant this code had just selected.
+    // literal is "C:\\Users\\..." while the path is "C:\Users\...".
     //
-    // `[^"]*` cannot span an escaped quote either. That is not a new limit -- it
-    // is the same one the writer's restricted escape set is built around, and
-    // `decodeBasicString` refuses anything outside it rather than guessing.
-    const m = /^\s*model_instructions_file\s*=\s*("[^"]*")\s*(?:#.*)?$/.exec(line);
-    if (m) return decodeBasicString(m[1]!);
+    // Bun may reject an unrelated safe-for-Codex integer. Decode the standard
+    // TOML escapes here, and never mistake an undecodable literal for a path.
+    const m = /^\s*model_instructions_file\s*=\s*("(?:[^"\\]|\\.)*")\s*(?:#.*)?$/.exec(line);
+    if (m) return decodeTomlBasicString(m[1]!) ?? "<unreadable model_instructions_file>";
   }
-  return null;
+  // A present non-string value or unrecognised spelling fails closed. Only
+  // `undefined` above proves that the setting is absent.
+  return "<unreadable model_instructions_file>";
 }
 
 /** Variant ids are ours to generate, so they stay in one narrow shape. */
@@ -875,7 +876,10 @@ export function writeBaseVariant(
     ? input.id
     : input.id ?? newBaseVariantId(existing);
   if (!BASE_VARIANT_ID.test(targetId)) return { ok: false, error: "unknown_layer", detail: targetId };
-  if (deleting && !existing.some(v => v.id === targetId)) {
+  // A caller-supplied id is an edit (or delete), never an alternate create path.
+  // Requiring it to exist keeps the generated-id path as the sole place where a
+  // new variant can enter, and therefore makes the cap impossible to bypass.
+  if (input.id !== null && !existing.some(v => v.id === targetId)) {
     return { ok: false, error: "unknown_layer", detail: targetId };
   }
   if (!deleting && input.id === null && existing.length >= MAX_BASE_VARIANTS) {

package/src/codex/prompt-text-probe.ts

@@ -49,6 +49,9 @@ const LAYER_SECTION_TAGS: Record<string, string> = {
   skills: "skills_instructions",
   apps: "apps_instructions",
   plugins: "plugins_instructions",
+  // Context-dependent: it is absent when the active collaboration mode adds no
+  // instructions, but Codex wraps it in this tag when it does render.
+  collaboration: "collaboration_mode",
   environment: "environment_context",
   permissions: "permissions instructions",
   // Synthetic: the project doc carries no tag of its own (see extractSections).
@@ -71,7 +74,6 @@ const UNMAPPED_LAYER_IDS = [
   // truth is that this extractor has no verified tag for them.
   "personality",
   "realtime",
-  "collaboration",
   // The Rust source names a <git_attribution> marker pair, but a world-state section is
   // DIFF-rendered: it emits nothing on a turn where its state has not changed. Live
   // `codex debug prompt-input` (codex-cli 0.145.0, 32978 bytes) showed no such block and
@@ -802,6 +804,22 @@ function extractSections(raw: string): Map<string, string> {
 /** Test seam: the extraction is the part worth pinning, not the spawn. */
 export const extractSectionsForTests = extractSections;
 
+function mapSectionsToLayers(sections: Map<string, string>): Record<string, LayerText> {
+  const layers: Record<string, LayerText> = {};
+  for (const [layerId, tag] of Object.entries(LAYER_SECTION_TAGS)) {
+    const text = sections.get(tag) ?? null;
+    layers[layerId] = text === null
+      // Registered but not rendered on this turn, which is an ordinary state for
+      // a diff-rendered section rather than an error.
+      ? { text: null, reason: "not-rendered", bytes: 0 }
+      : { text, reason: "ok", bytes: Buffer.byteLength(text, "utf8") };
+  }
+  return layers;
+}
+
+/** Test seam: pin section-to-layer projection independently of the subprocess. */
+export const mapSectionsToLayersForTests = mapSectionsToLayers;
+
 /**
  * Probe once and map every known layer to its rendered text.
  *
@@ -915,15 +933,7 @@ export async function probePromptText(
       detail: "prompt output could not be parsed",
     };
   }
-  const layers: Record<string, LayerText> = {};
-  for (const [layerId, tag] of Object.entries(LAYER_SECTION_TAGS)) {
-    const text = sections.get(tag) ?? null;
-    layers[layerId] = text === null
-      // Registered but not rendered on this turn, which is an ordinary state for
-      // a diff-rendered section rather than an error.
-      ? { text: null, reason: "not-rendered", bytes: 0 }
-      : { text, reason: "ok", bytes: Buffer.byteLength(text, "utf8") };
-  }
+  const layers = mapSectionsToLayers(sections);
 
   // A file that exists and is empty is not the same as a layer that chose to send
   // nothing. Reporting "sent nothing" for an empty AGENTS.md tells the user their

package/src/codex/quota-observation-freshness.ts

@@ -0,0 +1,34 @@
+import { isThirtyDayOnlyCodexPlan } from "./plan";
+import type { StoredAccountQuota } from "./quota-types";
+
+type Window = "weeklyPercent" | "monthlyPercent" | "shortPercent";
+// Failback needs observations, not a recent cache write. Keep this request-policy evidence
+// process-local: hydrated display bars do not prove a fresh observation in this process.
+const observed = new WeakMap<StoredAccountQuota, Partial<Record<Window, number>>>();
+const windows: Window[] = ["weeklyPercent", "monthlyPercent", "shortPercent"];
+const finite = (value: unknown): value is number => typeof value === "number" && Number.isFinite(value);
+
+export function stampCodexQuotaUsageObservation(
+  next: StoredAccountQuota,
+  incoming: Pick<StoredAccountQuota, Window>,
+  existing?: StoredAccountQuota,
+): StoredAccountQuota {
+  const previous = existing && observed.get(existing);
+  const timestamps: Partial<Record<Window, number>> = {};
+  for (const window of windows) {
+    if (!finite(next[window])) continue;
+    if (finite(incoming[window])) timestamps[window] = next.updatedAt;
+    else if (previous?.[window] !== undefined) timestamps[window] = previous[window];
+  }
+  observed.set(next, timestamps);
+  return next;
+}
+
+export function codexQuotaHasFreshUsage(quota: StoredAccountQuota, plan: unknown, now: number, maxAgeMs: number): boolean {
+  const long: Window[] = isThirtyDayOnlyCodexPlan(plan) ? ["monthlyPercent"] : ["weeklyPercent", "monthlyPercent"];
+  const relevant = long.filter(window => finite(quota[window]));
+  if (relevant.length === 0) return false;
+  if (finite(quota.shortPercent)) relevant.push("shortPercent");
+  const timestamps = observed.get(quota);
+  return relevant.every(window => finite(timestamps?.[window]) && now - timestamps![window]! < maxAgeMs);
+}

package/src/codex/quota-rejection.ts

@@ -349,9 +349,10 @@ export async function codexScopedExhaustionCode(
  * Status alone and message text are intentionally insufficient. The broad
  * alternate-account retry remains eligible for 429/402 to preserve #584.
  *
- * The one carve-out from that breadth is an organization- or project-scoped exhaustion
- * ({@link SCOPED_EXHAUSTION_CODE_VALUES}), which reports `alternateRetryEligible: false`
- * because every credential inside the refusing limit would be refused by the same counter.
+ * Organization- or project-scoped exhaustion ({@link SCOPED_EXHAUSTION_CODE_VALUES}) remains
+ * alternate-retry eligible here because the response does not identify the refusing scope. The
+ * account-rotation path may suppress the send later when the resolved alternate carries binding
+ * evidence that it shares an organization-level counter.
  */
 export async function classifyCodexPreStreamRejection(
   response: Response,
@@ -377,7 +378,10 @@ export async function classifyCodexPreStreamRejection(
     });
   }
   if (scoped) {
-    return rejection(status, "scoped-quota-exhaustion", { scopedExhaustionCode: scoped });
+    return rejection(status, "scoped-quota-exhaustion", {
+      alternateRetryEligible: true,
+      scopedExhaustionCode: scoped,
+    });
   }
   return rejection(
     status,

package/src/codex/quota.ts

@@ -3,6 +3,7 @@ import { join } from "node:path";
 import { atomicWriteFile, getConfigDir } from "../config";
 import { captureConfigGeneration, type GenerationContext } from "../lib/state-store-sweeper";
 import { isThirtyDayOnlyCodexPlan } from "./plan";
+import { stampCodexQuotaUsageObservation } from "./quota-observation-freshness";
 import { MAIN_CODEX_ACCOUNT_ID } from "./account-id";
 import { getObservedMainQuotaIdentityKey, isMainQuotaWriterLive, type MainQuotaWriter } from "./main-account-cache";
 
@@ -333,7 +334,7 @@ function mergeAccountQuota(
     assignCarriedShort(next, existing, updatedAt, policyEvidence);
     if (existing?.customWindows !== undefined) next.customWindows = existing.customWindows;
     next.resetCredits = quota.resetCredits;
-    return next;
+    return stampCodexQuotaUsageObservation(next, quota, existing);
   }
 
   if (snapshotHasWeekly(quota)) {
@@ -393,7 +394,7 @@ function mergeAccountQuota(
   if (quota.resetCredits !== undefined) next.resetCredits = quota.resetCredits;
   else if (existing?.resetCredits !== undefined) next.resetCredits = existing.resetCredits;
 
-  return next;
+  return stampCodexQuotaUsageObservation(next, quota, existing);
 }
 
 /**
@@ -612,6 +613,7 @@ export function updateAccountQuota(
   }
   if (resetCredits !== undefined) quota.resetCredits = resetCredits;
 
+  stampCodexQuotaUsageObservation(quota, { weeklyPercent: nextWeekly, monthlyPercent: nextMonthly }, existing);
   accountQuota.set(accountId, quota);
   // This legacy writer has no physical credential provenance.
   if (accountId === MAIN_CODEX_ACCOUNT_ID) mainPolicyQuota = null;

package/src/codex/routing/selection.ts

@@ -1,3 +1,4 @@
+import { getEffectiveCodexAutoSwitchThreshold } from "../account-auto-switch";
 import { isCodexAccountPaused } from "../account-pause";
 import { codexAccountPriorityLookup, pinnedCodexAccountId } from "../account-priority";
 import { isSelectableCodexPoolAccount } from "../account-id";
@@ -250,7 +251,7 @@ export function hasCodexQuotaHeadroom(
   selectionOptions?: CodexAccountUsabilityOptions,
   now: number = Date.now(),
 ): boolean {
-  const threshold = config.autoSwitchThreshold ?? 80;
+  const threshold = getEffectiveCodexAutoSwitchThreshold(config, accountId);
   if (threshold <= 0) return true;
   const usage = computeCodexUsageScore(
     getAccountQuota(accountId),
@@ -440,7 +441,7 @@ export function pickUnboundStrategyAccount(
     }
     picked = pickRoundRobinAccount(poolKey, eligible, limit);
     if (!picked) return null;
-    if (commitSharedActive) {
+    if (commitSharedActive && sharesActiveSelection(picked, selectionOptions)) {
       if (!isIndependentCodexQuotaScope(quotaScope)
         && !manualPreferenceBlocks(codexPoolKeyForScope(quotaScope), picked)) {
         rememberActiveCodexAccount(config, picked);
@@ -456,7 +457,7 @@ export function pickUnboundStrategyAccount(
       ? pickResetFirstCodexAccount(config, listEligibleCodexAccountIds(config, now, quotaScope, selectionOptions), now, selectionOptions)
       : pickFillFirstCodexAccount(config, now, quotaScope, selectionOptions);
     if (!picked) return null;
-    if (commitSharedActive) {
+    if (commitSharedActive && sharesActiveSelection(picked, selectionOptions)) {
       if (!isIndependentCodexQuotaScope(quotaScope)
         && !manualPreferenceBlocks(codexPoolKeyForScope(quotaScope), picked)) {
         rememberActiveCodexAccount(config, picked);
@@ -475,13 +476,21 @@ export function getPoolAccountPlan(config: OcxConfig, accountId: string): string
     .find(account => isSelectableCodexPoolAccount(account) && account.id === accountId)?.plan;
 }
 
-/** Selection-only main routing must not lazily read the fenced native credential for its plan. */
+/**
+ * Selection-only main routing must not lazily read the fenced native credential for its plan, and
+ * neither may a request whose main candidacy comes from its own bearer (#5019): that request is
+ * forbidden to read the physical main credential, so main is ranked without a plan.
+ */
 export function getPoolAccountPlanForSelection(
   config: OcxConfig,
   accountId: string,
   selectionOptions?: CodexAccountUsabilityOptions,
 ): string | undefined {
-  if (accountId === MAIN_CODEX_ACCOUNT_ID && selectionOptions?.nativeMainSelectionOnly === true) {
+  if (
+    accountId === MAIN_CODEX_ACCOUNT_ID
+    && (selectionOptions?.nativeMainSelectionOnly === true
+      || selectionOptions?.requestOwnedMainCredential === true)
+  ) {
     return undefined;
   }
   return getPoolAccountPlan(config, accountId);
@@ -505,6 +514,18 @@ export function sharedStateSelectionOptions(
   };
 }
 
+/**
+ * A main that is live only through this request's own credential serves this request alone.
+ * Recording it as the shared active account would route later requests through a credential
+ * they do not carry (see CodexAccountUsabilityOptions.requestOwnedMainCredential).
+ */
+export function sharesActiveSelection(
+  accountId: string,
+  selectionOptions?: CodexAccountUsabilityOptions,
+): boolean {
+  return !(accountId === MAIN_CODEX_ACCOUNT_ID && selectionOptions?.requestOwnedMainCredential === true);
+}
+
 export function pickLowerUsageAccount(
   config: OcxConfig,
   active: string,
@@ -681,7 +702,7 @@ export function preferModelEntitledAccount(
  *
  * Downward moves are deliberately left to {@link applyQuotaAutoSwitch}: this only
  * fires when the tier filter has already excluded `active`, and only toward a
- * tier that strictly outranks it. Threads bound by affinity never reach here.
+ * tier that strictly outranks it. Bound threads reach it only through explicit priority failback.
  */
 export function pickPriorityPreemption(
   config: OcxConfig,
@@ -721,7 +742,7 @@ export function applyQuotaAutoSwitch(
   selectionOptions?: CodexAccountUsabilityOptions,
   commitSharedSelection = true,
 ): string {
-  const threshold = config.autoSwitchThreshold ?? 80;
+  const threshold = getEffectiveCodexAutoSwitchThreshold(config, active);
   if (threshold <= 0) return active;
   const quota = getAccountQuota(active);
   const activeUsage = computeCodexUsageScore(
@@ -735,7 +756,8 @@ export function applyQuotaAutoSwitch(
   if (activeUsage < threshold) return active;
   const best = pickLowerUsageAccount(config, active, activeUsage, now, quotaScope, selectionOptions);
   if (best !== active) {
-    if (commitSharedSelection && !isIndependentCodexQuotaScope(quotaScope)) {
+    if (commitSharedSelection && !isIndependentCodexQuotaScope(quotaScope)
+      && sharesActiveSelection(best, selectionOptions)) {
       setActiveCodexAccount(config, best);
     }
     return best;
@@ -807,7 +829,8 @@ export function applyFailureFailover(
     // the moment of the failure; the streak outlives the soft avoid, so a later
     // scoped resolve reaches here with the streak still tripped and would otherwise
     // move the shared cursor after all.
-    if (commitSharedSelection && !isIndependentCodexQuotaScope(quotaScope)) {
+    if (commitSharedSelection && !isIndependentCodexQuotaScope(quotaScope)
+      && sharesActiveSelection(best, selectionOptions)) {
       promoteActiveCodexAccount(config, best);
     }
     return best;