@bitkyc08/opencodex 2.69.0 → 2.70.0

package/src/cli/tray-proxy.ts

@@ -40,6 +40,25 @@ export type ProxyRestartDiscovery =
   | { status: "absent" }
   | { status: "uncertain"; error?: unknown };
 
+export type ProxyRestartStartOutcome =
+  | { status: "started" }
+  | { status: "skipped" }
+  | { status: "failed"; launch: "never" | "exited" | "unknown"; error?: unknown };
+
+/** Only the launched child's observed exit (or no launch) permits another attempt. */
+export function restartStartOutcome(
+  started: boolean,
+  child: { exitCode: number | null; signalCode: string | null } | null,
+  error?: unknown,
+): ProxyRestartStartOutcome {
+  if (started) return { status: "started" };
+  return {
+    status: "failed",
+    launch: child === null ? "never" : child.exitCode !== null || child.signalCode !== null ? "exited" : "unknown",
+    error,
+  };
+}
+
 export interface ProxyRestartDiscoveryIo {
   findLive: () => Promise<ProxyRestartLive | null>;
   waitBetweenChecks?: () => Promise<void>;
@@ -48,11 +67,81 @@ export interface ProxyRestartDiscoveryIo {
 
 export interface ProxyRestartIo {
   findLive: () => Promise<ProxyRestartDiscovery>;
-  startWhenStopped: () => boolean | "skipped" | Promise<boolean | "skipped">;
+  startWhenStopped: (recoveringLiveRestart: boolean) => ProxyRestartStartOutcome | Promise<ProxyRestartStartOutcome>;
   requestInPlaceRestart: (
     previous: ProxyRestartLive,
   ) => ProxyRestartRequestOutcome | Promise<ProxyRestartRequestOutcome>;
   waitForReplacement: (previous: ProxyRestartLive) => Promise<ProxyRestartLive | null>;
+  /** Pause between start attempts; defaults to a short sleep. Tests pass a recorder. */
+  waitBetweenAttempts?: () => Promise<void>;
+  /**
+   * Strong re-observation after a missed replacement. Defaults to `findLive`, but the
+   * production wiring passes a fresh bounded window: by the time the replacement wait
+   * expires, the shared observe deadline has expired too, so reusing it would answer
+   * `uncertain` forever and the crash-recovery path could never run.
+   */
+  reobserveAfterReplacement?: (previous: ProxyRestartLive) => Promise<ProxyRestartDiscovery>;
+  /** A failed recovery start must recheck under a fresh window after the shared deadline. */
+  recheckAfterFailedStart?: () => Promise<ProxyRestartDiscovery>;
+}
+
+/**
+ * Poll for a departed predecessor inside a bounded confirmation window. Each round is
+ * already a strong observation (the caller supplies it); this only decides whether
+ * another round still fits: absent and valid-replacement verdicts return immediately,
+ * while the still-live old PID (or another uncertain round) keeps polling until the
+ * budget check refuses. A replacement that lands late in the window is still attested
+ * instead of being cut off by the wait that reserved the window.
+ */
+export async function pollReplacementDeparture(
+  observe: () => Promise<ProxyRestartDiscovery>,
+  previous: ProxyRestartLive,
+  shouldContinue: () => boolean,
+  wait: () => Promise<void>,
+): Promise<ProxyRestartDiscovery> {
+  for (;;) {
+    const round = await observe();
+    if (round.status === "absent") return round;
+    if (round.status === "live" && isProxyReplacement(previous, round.live)) return round;
+    if (!shouldContinue()) return round;
+    await wait();
+  }
+}
+
+export async function waitForProxyReplacement(
+  previous: ProxyRestartLive,
+  deadlineAt: number,
+  observe: (deadlineAt: number) => Promise<ProxyRestartLive | null>,
+): Promise<ProxyRestartLive | null> {
+  while (Date.now() < deadlineAt) {
+    const live = await observe(deadlineAt);
+    if (Date.now() >= deadlineAt) return null;
+    if (isProxyReplacement(previous, live)) return live;
+    const remainingMs = deadlineAt - Date.now();
+    if (remainingMs > 0) await Bun.sleep(Math.min(250, remainingMs));
+  }
+  return null;
+}
+
+export function reobserveRestartReplacement(
+  previous: ProxyRestartLive,
+  deadlineAt: number,
+  observe: (end: number) => Promise<ProxyRestartDiscovery>,
+): Promise<ProxyRestartDiscovery> {
+  const windowMs = Math.min(5_000, deadlineAt - Date.now());
+  if (windowMs < 1_500) return Promise.resolve({
+    status: "uncertain", error: new Error("restart_reobserve_window_exhausted"),
+  });
+  const end = Date.now() + windowMs;
+  return pollReplacementDeparture(() => observe(end), previous, () => Date.now() + 750 < end, () => Bun.sleep(250));
+}
+
+/** Production recovery recheck: the original restart deadline may already be spent. */
+export function recheckRestartFailedStart(
+  observe: (end: number) => Promise<ProxyRestartDiscovery>,
+): Promise<ProxyRestartDiscovery> {
+  const end = Date.now() + 5_000;
+  return observe(end);
 }
 
 /**
@@ -145,13 +234,110 @@ export async function runTrayProxyStart(io: TrayProxyStartIo): Promise<boolean>
  * child and lets ordinary /api/stop restore native routing between the two halves.
  * When no proxy is live there is nothing to recycle, so restart degrades to the
  * caller's normal start path.
+ *
+ * An uncertain discovery round is re-observed. A failed start is retried only after
+ * proof that it never launched or its child exited; a health miss is insufficient.
+ * A missed replacement gets a bounded re-observation. A live target is never stopped
+ * to make room, and absence is confirmed twice before any fresh start.
+ */
+/**
+ * A proven pre-launch refusal or observed child exit can be retried within this bound.
+ * A deliberate operator refusal (`"skipped"`) never retries.
  */
+const RESTART_START_ATTEMPTS = 3;
+
+/** Discovery rounds per restart transaction; an uncertain round is a transient race. */
+const RESTART_DISCOVERY_ATTEMPTS = 3;
+
+/**
+ * Start leg with phase evidence. A bare boolean cannot tell a pre-launch refusal from
+ * a child that was launched but is not healthy yet, or from post-health steps that
+ * threw on an already-live proxy — and blindly respawning on any of those risks a
+ * second proxy racing the first for the port. So every failed attempt is followed by a
+ * beat and a strong re-observation: a live proxy attests success (no second start),
+ * and only confirmed absence plus launch proof earns another attempt.
+ */
+async function startRestartedProxy(
+  io: ProxyRestartIo,
+  waitBetweenAttempts: () => Promise<void>,
+  recoveringLiveRestart: boolean,
+  /** The restarted proxy's identity; recovery success must be a different process. */
+  previous?: ProxyRestartLive,
+): Promise<ProxyRestartResult> {
+  let originalError: unknown;
+  for (let attempt = 0; attempt < RESTART_START_ATTEMPTS; attempt++) {
+    let outcome: ProxyRestartStartOutcome;
+    try {
+      outcome = await io.startWhenStopped(recoveringLiveRestart);
+    } catch (error) {
+      // An unstructured exception can have happened after launch.
+      outcome = { status: "failed", launch: "unknown", error };
+    }
+    if (outcome.status === "skipped") return recoveringLiveRestart
+      ? { ok: false, phase: "replacement" } : { ok: true, mode: "skipped" };
+    if (outcome.status === "started") {
+      if (!previous) return { ok: true, mode: "started" };
+      // Recovery after a live restart: the start path counts any healthy proxy it finds as
+      // started, and the ORIGINAL process reappearing would satisfy it. Success needs an
+      // identity-verified replacement — a different runtime PID on the original port —
+      // observed in a fresh window; anything else fails closed as a missed replacement.
+      let confirm: ProxyRestartDiscovery;
+      try {
+        confirm = await (io.recheckAfterFailedStart?.() ?? io.findLive());
+      } catch (error) {
+        return { ok: false, phase: "replacement", error };
+      }
+      return confirm.status === "live" && isProxyReplacement(previous, confirm.live)
+        ? { ok: true, mode: "started" }
+        : { ok: false, phase: "replacement" };
+    }
+    if (attempt === 0) originalError = outcome.error;
+    // Beat first: a child that was just launched may still be binding, and post-health
+    // steps may have thrown on an already-live proxy. Re-observe before deciding: live
+    // attests success (never a second start), only confirmed absence earns a retry.
+    await waitBetweenAttempts();
+    let recheck: ProxyRestartDiscovery;
+    try {
+      recheck = await (io.recheckAfterFailedStart?.() ?? io.findLive());
+    } catch {
+      return { ok: false, phase: "start", error: originalError };
+    }
+    // Runtime-attested only: a config-sourced observation is not proof a proxy serves,
+    // so it keeps the start failure instead of reporting a success nobody earned.
+    // A throw on an attested-live proxy is different from a clean refusal: post-health
+    // work failed on a serving process, so the error propagates instead of converting
+    // to success — still without spawning again.
+    const attested = recheck.status === "live"
+      && recheck.live.pid !== null
+      && recheck.live.source === "runtime";
+    // Recovery after a live restart: the old PID coming back is not a replacement this
+    // command started. It is serving, so never start another over it, and never call it
+    // success either.
+    if (attested && previous && recheck.status === "live" && !isProxyReplacement(previous, recheck.live)) {
+      return { ok: false, phase: "replacement" };
+    }
+    if (attested && outcome.error !== undefined) return { ok: false, phase: "start", error: originalError };
+    if (attested) return { ok: true, mode: "started" };
+    if (outcome.launch === "unknown" || recheck.status !== "absent") {
+      return { ok: false, phase: "start", error: originalError };
+    }
+  }
+  return { ok: false, phase: "start", error: originalError };
+}
+
 export async function runProxyRestart(io: ProxyRestartIo): Promise<ProxyRestartResult> {
-  let discovery: ProxyRestartDiscovery;
-  try {
-    discovery = await io.findLive();
-  } catch (error) {
-    return { ok: false, phase: "request", error };
+  const waitBetweenAttempts = io.waitBetweenAttempts ?? (() => Bun.sleep(500));
+  // An uncertain round is a transient appear/vanish race, not a verdict: re-observe a
+  // few times before failing, so one invocation survives a supervisor mid-handoff.
+  let discovery: ProxyRestartDiscovery = { status: "uncertain", error: new Error("restart_discovery_no_attempt") };
+  for (let attempt = 0; attempt < RESTART_DISCOVERY_ATTEMPTS; attempt++) {
+    if (attempt > 0) await waitBetweenAttempts();
+    try {
+      discovery = await io.findLive();
+    } catch (error) {
+      discovery = { status: "uncertain", error };
+    }
+    if (discovery.status !== "uncertain") break;
   }
 
   if (discovery.status === "uncertain") {
@@ -159,13 +345,7 @@ export async function runProxyRestart(io: ProxyRestartIo): Promise<ProxyRestartR
   }
 
   if (discovery.status === "absent") {
-    try {
-      const started = await io.startWhenStopped();
-      if (started === "skipped") return { ok: true, mode: "skipped" };
-      return started ? { ok: true, mode: "started" } : { ok: false, phase: "start" };
-    } catch (error) {
-      return { ok: false, phase: "start", error };
-    }
+    return startRestartedProxy(io, waitBetweenAttempts, false);
   }
 
   const previous = discovery.live;
@@ -187,13 +367,36 @@ export async function runProxyRestart(io: ProxyRestartIo): Promise<ProxyRestartR
     return { ok: false, phase: "request", error: request.error };
   }
 
+  let replacement: ProxyRestartLive | null;
   try {
-    const replacement = await io.waitForReplacement(previous);
-    if (replacement) return { ok: true, mode: "restarted", live: replacement };
-    return request.accepted
-      ? { ok: false, phase: "replacement" }
-      : { ok: false, phase: "request", error: request.error };
+    replacement = await io.waitForReplacement(previous);
   } catch (error) {
     return { ok: false, phase: "replacement", error };
   }
+  if (replacement) return { ok: true, mode: "restarted", live: replacement };
+  // The replacement never arrived: re-observe once instead of failing blind. A proxy
+  // that crashed mid-restart reads absent (safe to start fresh — nothing live can race
+  // the bind); a replacement that landed just past the deadline still proves success;
+  // the same PID or another uncertain round fails closed exactly as before. A live
+  // target is never stopped to make room: the no-stop/start-fallback invariant holds.
+  const reobserveHook = io.reobserveAfterReplacement;
+  const reobserve = reobserveHook ? () => reobserveHook(previous) : io.findLive;
+  let again: ProxyRestartDiscovery;
+  try {
+    again = await reobserve();
+  } catch (error) {
+    return { ok: false, phase: "replacement", error };
+  }
+  if (again.status === "absent") {
+    // Only an ACCEPTED restart earns a recovery start. After an uncertain request the old
+    // proxy may merely be mid-restart and reappear; starting one here could race it.
+    if (!request.accepted) return { ok: false, phase: "request", error: request.error };
+    return startRestartedProxy(io, waitBetweenAttempts, true, previous);
+  }
+  if (again.status === "live" && isProxyReplacement(previous, again.live)) {
+    return { ok: true, mode: "restarted", live: again.live };
+  }
+  return request.accepted
+    ? { ok: false, phase: "replacement" }
+    : { ok: false, phase: "request", error: request.error };
 }

package/src/cli/version-skew.ts

@@ -9,16 +9,31 @@
  * comparison instead of reimplementing it -- two diagnostics disagreeing about whether an
  * install is stale would be worse than neither reporting it.
  */
-import { parseStrictSemver, type StrictSemver } from "../lib/strict-semver";
+import { compareStrictSemver, parseStrictSemver } from "../lib/strict-semver";
 
 /** Placeholder versions that mean "unknown", not "different". */
 const PLACEHOLDERS = new Set(["unknown", "0.0.0"]);
 
+/**
+ * Which side of the comparison runs newer, so a consumer does not reparse the warning to
+ * find the direction. `"match"` is a real, non-placeholder equality; placeholders and a
+ * missing proxy version are `"unknown"`, and `"incomparable"` covers versions that
+ * differ but do not order under strict semver. The desktop shell reads this field to
+ * keep a takeover from silently downgrading a newer runtime.
+ */
+export type VersionRelation =
+  | "match"
+  | "cli-newer"
+  | "proxy-newer"
+  | "incomparable"
+  | "unknown";
+
 export interface VersionSkew {
   readonly cliVersion: string;
   /** Version the live proxy reported, or null when nothing is live or it reported none. */
   readonly proxyVersion: string | null;
   readonly skewed: boolean;
+  readonly relation: VersionRelation;
   /** Operator-facing explanation; null when there is nothing to report. */
   readonly warning: string | null;
 }
@@ -28,25 +43,6 @@ export function isConfirmedVersionMatch(skew: VersionSkew): boolean {
   return skew.proxyVersion === skew.cliVersion && !PLACEHOLDERS.has(skew.cliVersion);
 }
 
-/** SemVer precedence ignores build metadata; raw equality is handled separately. */
-function compareVersions(cli: StrictSemver, proxy: StrictSemver): number {
-  for (let i = 0; i < cli.core.length; i++) {
-    if (cli.core[i]! !== proxy.core[i]!) return cli.core[i]! > proxy.core[i]! ? 1 : -1;
-  }
-  if (cli.prerelease.length === 0) return proxy.prerelease.length === 0 ? 0 : 1;
-  if (proxy.prerelease.length === 0) return -1;
-  for (let i = 0; i < Math.max(cli.prerelease.length, proxy.prerelease.length); i++) {
-    const left = cli.prerelease[i];
-    const right = proxy.prerelease[i];
-    if (left === right) continue;
-    if (left === undefined) return -1;
-    if (right === undefined) return 1;
-    if (typeof left !== typeof right) return typeof left === "bigint" ? -1 : 1;
-    return left > right ? 1 : -1;
-  }
-  return 0;
-}
-
 /**
  * Compare the running CLI against the live proxy.
  *
@@ -58,12 +54,17 @@ function compareVersions(cli: StrictSemver, proxy: StrictSemver): number {
  */
 export function computeVersionSkew(cliVersion: string, proxyVersion: string | undefined): VersionSkew {
   const proxy = proxyVersion ?? null;
-  if (proxy === null || PLACEHOLDERS.has(proxy) || PLACEHOLDERS.has(cliVersion) || proxy === cliVersion) {
-    return { cliVersion, proxyVersion: proxy, skewed: false, warning: null };
+  if (proxy === null || PLACEHOLDERS.has(proxy) || PLACEHOLDERS.has(cliVersion)) {
+    return { cliVersion, proxyVersion: proxy, skewed: false, relation: "unknown", warning: null };
+  }
+  if (proxy === cliVersion) {
+    return { cliVersion, proxyVersion: proxy, skewed: false, relation: "match", warning: null };
   }
   const cliSemver = parseStrictSemver(cliVersion);
   const proxySemver = parseStrictSemver(proxy);
-  const order = cliSemver && proxySemver ? compareVersions(cliSemver, proxySemver) : 0;
+  const order = cliSemver && proxySemver ? compareStrictSemver(cliSemver, proxySemver) : 0;
+  const relation: VersionRelation =
+    order > 0 ? "cli-newer" : order < 0 ? "proxy-newer" : "incomparable";
   const advice = order > 0
     ? "the running proxy is older than this CLI. Restart the proxy using the intended current installation. "
       // `restart`, not `repair`: a version skew leaves the service DEFINITION unchanged, and
@@ -77,6 +78,7 @@ export function computeVersionSkew(cliVersion: string, proxyVersion: string | un
     cliVersion,
     proxyVersion: proxy,
     skewed: true,
+    relation,
     warning: `CLI ${cliVersion} does not match the running proxy ${proxy} — ${advice}`,
   };
 }

package/src/client/runtime.ts

@@ -7,6 +7,7 @@ import { removePid, removeRuntimePort, writePid, writeRuntimePort, type RuntimeP
 import { installCrashGuards } from "../lib/crash-guard";
 import { createLocalAttestationSecret } from "../lib/local-management-attestation";
 import { loadServiceTokenFromFile, serviceApiTokenFingerprint } from "../lib/service-secrets";
+import { handledSignalExitCode } from "../lib/handled-signal-exit";
 import {
   DESKTOP_RESTART_EXIT_CODE,
   DESKTOP_SUPERVISED_ENV,
@@ -169,7 +170,8 @@ export async function recycleStandalone(
   // operator noticed. Exit 1 is what those configs are watching for, and it is the same
   // policy the dashboard recycle already uses (src/server/management/system-restart.ts).
   //
-  // launchd's KeepAlive restarts on any exit, so it is correct under both branches.
+  // launchd's KeepAlive is failure-only too (`SuccessfulExit` false), so exit 1 is what
+  // relaunches it as well; an exit 0 would leave the job stopped.
   if (process.env.OCX_SERVICE === "1") {
     exit(1);
     return;
@@ -266,7 +268,7 @@ export async function bindClientListener(
 }
 
 export async function startClientRuntime(
-  options: { port?: number; block?: boolean } = {},
+  options: { port?: number; block?: boolean; afterPublish?: () => void } = {},
   io: ClientRuntimeIo = {},
 ): Promise<void> {
   const state = readClientConnectionState();
@@ -310,9 +312,10 @@ export async function startClientRuntime(
   installCrashGuards();
   writePid(process.pid);
   writeRuntimePort(clientRuntimeRecord(process.pid, boundPort));
+  options.afterPublish?.();
 
   let shuttingDown = false;
-  const shutdown = () => {
+  const shutdown = (signal?: NodeJS.Signals) => {
     if (shuttingDown) return;
     shuttingDown = true;
     void (async () => {
@@ -328,7 +331,8 @@ export async function startClientRuntime(
         console.warn(`[client] listener stop failed: ${error instanceof Error ? error.message : String(error)}`);
       } finally {
         cleanup();
-        process.exit(0);
+        // launchd relaunches only unsuccessful exits; an external signal must still count.
+        process.exit(handledSignalExitCode(signal));
       }
     })();
   };

package/src/codex/auth-api/account-list.ts

@@ -12,7 +12,7 @@ import { codexPlanValue, isThirtyDayOnlyCodexPlan } from "../plan";
 import { isAccountNeedsReauth, markAccountNeedsReauth } from "../account-runtime-state";
 import { getValidMainAccountToken, MainAccountTokenRefreshError, MAIN_CODEX_ACCOUNT_ID } from "../main-account";
 import { captureConfigGeneration } from "../../lib/state-store-sweeper";
-import { captureMainAccountIdentityGeneration, getMainAccountCredentialPresence, isMainAccountIdentityGenerationLive } from "../main-account-cache";
+import { captureMainAccountIdentityGeneration, getMainAccountCredentialPresence, getMainAccountInfoCache, isMainAccountIdentityGenerationLive } from "../main-account-cache";
 import type { CodexQuotaRefreshOutcome } from "../quota-refresh-outcome";
 import { getMainAccountHardLockStatus } from "../main-account-hard-lock";
 import type { MainAccountHardLockStatus } from "../main-account-hard-lock";
@@ -256,7 +256,8 @@ export async function listCodexAuthAccountsSnapshot(
   const poolAccounts = (runtimeConfig.codexAccounts ?? []).filter(isSelectableCodexPoolAccount);
   // One redaction decision for the whole snapshot, read once from the operator's config (#3859).
   const maskEmails = emailMaskingEnabled(runtimeConfig);
-  const mainResult = await fetchMainAccountInfoAttempt(forceRefresh, 1);
+  const mainResult = await fetchMainAccountInfoAttempt(forceRefresh, 1, undefined, false,
+    forceRefresh, false, runtimeConfig);
   const refreshedPool = await mapWithConcurrency(poolAccounts, POOL_QUOTA_REFRESH_CONCURRENCY, async account => {
     const cred = getCodexAccountCredential(account.id);
     let quotaResult: PoolQuotaResult;
@@ -327,7 +328,11 @@ export async function listCodexAuthAccountsSnapshot(
   });
   const fetchedMainGeneration = mainResult.identityGeneration ?? captureMainAccountIdentityGeneration();
   const mainSnapshotLive = isMainAccountIdentityGenerationLive(fetchedMainGeneration);
-  const mainInfo = mainSnapshotLive ? mainResult.info : EMPTY_MAIN_ACCOUNT_INFO;
+  // An ordinary same-account return can be parsed after its credential was replaced.
+  // The card and hard-lock status must describe the same published quota snapshot.
+  const mainInfo = mainSnapshotLive
+    ? mainResult.infoUnpublished ? getMainAccountInfoCache() ?? EMPTY_MAIN_ACCOUNT_INFO : mainResult.info
+    : EMPTY_MAIN_ACCOUNT_INFO;
   const hasMainCredential = mainSnapshotLive && mainResult.credentialChecked
     ? mainResult.hasCredential
     : getMainAccountCredentialPresence() ?? false;
@@ -395,7 +400,7 @@ export async function refreshCodexQuotaForActivation(config: OcxConfig, accountI
         return;
       }
       if (isAccountNeedsReauth(accountId)) return;
-      await fetchMainAccountInfoAttempt(true, 1, lease, false, false);
+      await fetchMainAccountInfoAttempt(true, 1, lease, false, false, false, config);
     } finally {
       lease.release();
     }
@@ -442,7 +447,8 @@ export async function pauseExhaustedCodexAccounts(
         failedAccountCount: number;
       }> => {
         if (!mainLease) return { shouldPause: false, checkedAccountCount: 0, failedAccountCount: 1 };
-        const mainResult = await fetchMainAccountInfoAttempt(true, 1, mainLease, true);
+        const mainResult = await fetchMainAccountInfoAttempt(true, 1, mainLease, true,
+          true, false, config);
         if (!mainResult.credentialChecked || !mainResult.hasCredential) {
           return { shouldPause: false, checkedAccountCount: 0, failedAccountCount: 0 };
         }

package/src/codex/auth-api/login-flow.ts

@@ -1,6 +1,6 @@
 import { withCodexAccountLogLabel } from "../account-label";
 import { getCodexAccountCredential, markCodexAccountValidated, readCodexAccountRecord, saveCodexAccountCredential, CodexCredentialRefreshLockTimeoutError, CodexCredentialRefreshBusyError, CodexCredentialRefreshStaleError } from "../account-store";
-import { clearAccountQuota, isCodexQuotaExhausted, parseUsageQuota, setAccountQuotaFromParsed } from "../quota";
+import { clearAccountQuota, isCodexQuotaExhausted, isValidWhamHistoryObservation, parseUsageQuota, setAccountQuotaFromParsed } from "../quota";
 import type { StoredAccountQuota, WhamUsageResponse } from "../quota";
 import { ConfigMutationLockError, withConfigMutationLockSync } from "../../config";
 import { appendDefaultCodexAccountNamespace, codexAccountPickerEnabled } from "../account-namespaces";
@@ -265,6 +265,7 @@ export async function handleCodexAuthLoginStart(req: Request, config: OcxConfig,
               let email = cred.email || accountId;
               let plan: string | undefined;
               let quota: Omit<StoredAccountQuota, "updatedAt"> | null = null;
+              let policyQuota: Omit<StoredAccountQuota, "updatedAt"> | null = null;
               try {
                 const tokens = { access_token: cred.access, account_id: oauthAccountId };
                 const resp = await fetch("https://chatgpt.com/backend-api/wham/usage", {
@@ -276,6 +277,7 @@ export async function handleCodexAuthLoginStart(req: Request, config: OcxConfig,
                   email = data.email ?? email;
                   plan = nonEmptyPlan(data.plan_type) ?? undefined;
                   quota = parseUsageQuota(data);
+                  policyQuota = isValidWhamHistoryObservation(data) ? quota : null;
                 }
               } catch { /* wham fetch is non-blocking */ }
               // Reauth must refresh the same ChatGPT identity already bound to this pool slot.
@@ -390,7 +392,7 @@ export async function handleCodexAuthLoginStart(req: Request, config: OcxConfig,
                 clearCodexPoolRefreshFailure(accountId);
                 if (warmup.validatedAt !== undefined) markCodexAccountValidated(accountId, warmup.validatedAt, generation);
                 clearAccountNeedsReauth(accountId);
-                if (quota) setAccountQuotaFromParsed(accountId, quota);
+                if (quota) setAccountQuotaFromParsed(accountId, quota, undefined, undefined, policyQuota);
                 // Keep the pool id stable; refresh display metadata after a successful login/reauth.
                 accounts[existingIdx] = withCodexAccountLogLabel({
                   ...accounts[existingIdx],
@@ -420,7 +422,7 @@ export async function handleCodexAuthLoginStart(req: Request, config: OcxConfig,
               // A new quota row is generation-gated by live account ownership. Reconcile the
               // durable config owner first so a partial prior sweep cannot reject this write.
               if (newAccountPersistence?.status === "committed" && quota) {
-                setAccountQuotaFromParsed(accountId, quota);
+                setAccountQuotaFromParsed(accountId, quota, undefined, undefined, policyQuota);
               }
               const { catalogRefreshPending } = await convergeAccountNamespaceCatalog(
                 latestConfig,