@bitkyc08/opencodex 2.76.0 → 2.77.0

package/src/clients/config-export.ts

@@ -30,7 +30,7 @@ import { probeHostname } from "../server/proxy-liveness";
 import type { OcxConfig } from "../types";
 
 export type { ConfigFormat } from "../integrations/serialize";
-export type { ManagedFragment, ManagedContribution, BuildContribution, OpencodeLaunchEnv, OpencodeCatalogModel, ExportModel, ExportContext, ExportClientId, ExportClientSpec, PiModelEntry } from "./config-export/contracts";
+export type { ManagedFragment, ManagedContribution, BuildContribution, OpencodeLaunchEnv, OpencodeCatalogModel, ExportModel, ExportContext, ExportClientId, ExportClientSpec, PiModelEntry, DroidReasoningDefaults } from "./config-export/contracts";
 export { OPENCODE_PROVIDER_ID, OPENCODE_CONFIG_SCHEMA, OPENCODE_API_KEY_ENV, OPENCODE_API_KEY_ENV_REF, KILO_API_KEY_ENV, KILO_API_KEY_ENV_REF, KILO_CONFIG_SCHEMA, HERMES_API_KEY_ENV, HERMES_API_KEY_ENV_REF, OPENCLAW_API_KEY_ENV, OPENCLAW_API_KEY_ENV_REF, LOOPBACK_API_KEY_PLACEHOLDER, GAJAE_API_KEY_ENV, SCHEMA_REQUIRED_OUTPUT_BUDGET, OPENCODE_PROVIDER_BLOCK_DEFAULT_CONFIG } from "./config-export/constants";
 export { normalizeExportModels } from "./config-export/model-metadata";
 export type { OmpModelEntry, OmpProviderBlock, OmpGeneratedConfig } from "./config-export/omp";
@@ -51,12 +51,13 @@ export type { DshReasoningEffort, DshWireReasoningEffort, DshModelEntry, DshProv
 export type { McodeProviderBlock, McodeModelEntry, McodeGeneratedConfig } from "./config-export/mcode";
 export type { RaycastAbility, RaycastAbilityName, RaycastModelEntry, RaycastProviderEntry, RaycastGeneratedConfig } from "./config-export/raycast";
 export { buildRaycastClientConfig, summarizeRaycast, buildRaycastContribution } from "./config-export/raycast";
-export { droidHomeDir, droidConfigPath, buildDroidClientConfig, summarizeDroid, buildDroidContribution } from "./config-export/droid";
+export { droidHomeDir, droidConfigPath, buildDroidClientConfig, summarizeDroid, buildDroidContribution, droidReasoningModels, droidDefaultsFromOwnedRows, validateDroidReasoningDefaults } from "./config-export/droid";
 export type { DroidModelEntry, DroidGeneratedConfig } from "./config-export/droid";
 
 import type { OpencodeLaunchEnv, OpencodeCatalogModel, ExportContext, PiModelEntry, ManagedContribution, ManagedFragment, ExportClientId, ExportClientSpec } from "./config-export/contracts";
 import { OPENCODE_API_KEY_ENV_REF, OPENCODE_PROVIDER_BLOCK_DEFAULT_CONFIG, OPENCODE_CONFIG_SCHEMA, OPENCODE_PROVIDER_ID, PI_API_DIALECT, LOOPBACK_API_KEY_PLACEHOLDER, HERMES_API_KEY_ENV_REF, OPENCLAW_API_KEY_ENV_REF, OPENCODE_API_KEY_ENV, HERMES_API_KEY_ENV, OPENCLAW_API_KEY_ENV, KILO_API_KEY_ENV } from "./config-export/constants";
-import { exportModelLabel, authoritativeContextWindow, outputBudgetFor, normalizeExportModels, inputModalitiesForClient, opencodeModelCapabilities, proxyAdmissionHeaders, singleFragment } from "./config-export/model-metadata";
+import { exportModelLabel, authoritativeContextWindow, outputBudgetFor, inputBudgetFor, normalizeExportModels, inputModalitiesForClient, opencodeModelCapabilities, proxyAdmissionHeaders, singleFragment } from "./config-export/model-metadata";
+import { exportReasoningEfforts, exportDefaultReasoningEffort, legacyReasoningMetadata, type LegacyEffortVariant } from "./config-export/reasoning-metadata";
 import { buildOmpClientConfig, summarizeOmp, buildOmpContribution } from "./config-export/omp";
 import { buildDshClientConfig, summarizeDsh, buildDshContribution } from "./config-export/dsh";
 import { buildMcodeClientConfig, summarizeMcode, buildMcodeContribution } from "./config-export/mcode";
@@ -72,7 +73,7 @@ import { droidConfigPath, buildDroidClientConfig, summarizeDroid, buildDroidCont
 
 export interface OpencodeModelEntry {
   name: string;
-  limit?: { context: number; output: number };
+  limit?: { context: number; input?: number; output: number };
   /**
    * opencode's own capability fields, derived from the catalog row's declared input
    * modalities. Written only when the row declares at least one — an entry without them is
@@ -81,22 +82,30 @@ export interface OpencodeModelEntry {
    */
   attachment?: boolean;
   modalities?: { input: string[]; output: string[] };
+  tool_call?: boolean;
+  reasoning?: boolean;
+  interleaved?: { field: "reasoning_content" };
+  options?: { reasoningEffort: string };
+  variants?: Record<string, LegacyEffortVariant>;
 }
 
 /**
  * One selectable reasoning effort.
  *
- * opencode V2 applies these only from the `providers` block: a `variants` array under the
- * legacy `provider` block is parsed and then dropped, so the V1 block stays variant-free
- * rather than carrying fields that look configured but never reach a request.
+ * Native V2 variants use settings; legacy clients receive a separate options map.
  */
 export interface OpencodeModelVariant {
   id: string;
   settings: { reasoningEffort: string };
 }
 
-export interface OpencodeV2ModelEntry extends OpencodeModelEntry {
-  variants?: OpencodeModelVariant[];
+export interface OpencodeV2ModelEntry {
+  name: string;
+  limit?: { context: number; input?: number; output: number };
+  capabilities?: { tools: boolean; input?: string[]; output?: string[] };
+  compatibility?: { reasoningField: "reasoning_content" };
+  settings?: { reasoningEffort: string };
+  variants: OpencodeModelVariant[];
 }
 
 /** Endpoint and admission, spelled once and shared by both block generations. */
@@ -114,7 +123,7 @@ export interface OpencodeProviderBlock {
   models: Record<string, OpencodeModelEntry>;
 }
 
-/** opencode V2 provider block: `package` + `settings`. The only form whose variants apply. */
+/** opencode V2 provider block: `package` + `settings` and native variant arrays. */
 export interface OpencodeV2ProviderBlock {
   package: string;
   name: string;
@@ -147,16 +156,10 @@ export interface OpencodeGeneratedConfig {
 const OPENCODE_PROVIDER_NPM = "@ai-sdk/openai-compatible";
 
 /**
- * opencode V2's spelling of the same runtime. V2 resolves providers through its own
- * package table and ignores the V1 `npm` field, so a V2 block has to name this package
- * or the provider is not loaded at all.
- *
- * Verified end-to-end against opencode 0.0.0-beta-18684: `GET /api/model` resolves this
- * package for the provider and applies the per-model `variants`. opencode changes its
- * provider package table between releases, so re-verify the supported range whenever it
- * moves; a stale string breaks only the V2 block, silently.
+ * Canonical V2 runtime spelling. Current clients alias the old @opencode-ai scope,
+ * but exported documents use the documented package rather than depending on that alias.
  */
-const OPENCODE_V2_PROVIDER_PACKAGE = "@opencode-ai/ai/providers/openai-compatible";
+const OPENCODE_V2_PROVIDER_PACKAGE = "@opencode/ai/providers/openai-compatible";
 
 /** Display name for the provider block, identical in both generations. */
 const OPENCODE_PROVIDER_NAME = "OpenCodex";
@@ -672,35 +675,11 @@ function opencodeProviderConnection(baseURL: string, config: OcxConfig): Opencod
 }
 
 /**
- * Selectable reasoning efforts for one model, in canonical ladder order.
- *
- * No model-level `settings.reasoningEffort` default is emitted: the proxy already applies
- * its own configured default when a request carries no effort, and pinning one here would
- * override a default the user controls in opencodex. Variants are opt-in per selection,
- * which is the same reason we never emit `defaultModel` for MCode.
- *
- * `none` is dropped even when a ladder declares it.
- *
- * The original reason no longer holds and is recorded here so it is not repeated: the chat
- * ingress `OUTPUT_CONFIG_EFFORTS` allowlist DID omit `none`, so selecting it sent no effort
- * at all and fell back to the proxy default. That allowlist now accepts `none` (audit F7),
- * because it is the runtime's disable sentinel and dropping it let a provider default
- * re-enable thinking a caller had turned off.
- *
- * The variant stays filtered anyway, deliberately and narrowly: emitting it would change
- * what this exporter writes into a user's opencode config, and whether opencode's own
- * picker round-trips `reasoningEffort: "none"` to the wire this proxy reads has not been
- * verified here. Re-enabling it is a scoped follow-up that needs that check first, not a
- * side effect of an ingress fix. MCode and ZCode filter `none` for their own separate
- * reasons, documented at their call sites.
+ * Exact declared choices. An empty array is intentional: omitting variants lets OpenCode
+ * synthesize low/medium/high, even for a model whose upstream declares no adjustable effort.
  */
-function opencodeEffortVariants(model: OpencodeCatalogModel): OpencodeModelVariant[] | undefined {
-  if (model.reasoningEfforts === undefined) return undefined;
-  // Canonical order (none, minimal, then low..ultra) and dedupe, so the picker order does
-  // not depend on whatever order a provider listed its efforts in.
-  const efforts = canonicalizeReasoningEfforts(model.reasoningEfforts).filter(effort => effort !== "none");
-  if (efforts.length === 0) return undefined;
-  return efforts.map(effort => ({ id: effort, settings: { reasoningEffort: effort } }));
+function opencodeEffortVariants(model: OpencodeCatalogModel): OpencodeModelVariant[] {
+  return (exportReasoningEfforts(model) ?? []).map(effort => ({ id: effort, settings: { reasoningEffort: effort } }));
 }
 
 /**
@@ -712,7 +691,7 @@ function opencodeEffortVariants(model: OpencodeCatalogModel): OpencodeModelVaria
  * the pair) clamped to the context window.
  *
  * Two blocks instead of one because opencode V2 reads the `providers` map and V1 reads
- * `provider`, and only the V2 form applies `variants`. Emitting both keeps V1 installs
+ * `provider`, with native arrays versus legacy maps for variants. Emitting both keeps V1 installs
  * working: V2 merges them by provider id and model id, so a model listed in both blocks
  * appears once, with the V2 entry's name, connection, and variants.
  */
@@ -725,36 +704,37 @@ export function opencodeProviderBlocks(
   const v2Models: Record<string, OpencodeV2ModelEntry> = {};
   for (const model of expandFastExportModels(catalogModels)) {
     const key = model.namespaced;
-    const entry: OpencodeModelEntry = { name: exportModelLabel(model) };
+    const entry: OpencodeModelEntry = { name: exportModelLabel(model), ...legacyReasoningMetadata(model) };
     const context = authoritativeContextWindow(model.contextWindow);
     if (context !== undefined) {
       entry.limit = { context, output: outputBudgetFor(context, model) };
+      const input = inputBudgetFor(context, model);
+      if (input !== undefined) entry.limit.input = input;
     }
-    // `attachment` / `modalities` are fields of opencode's V1 model schema — the shape its
-    // published config.json defines and the one its loader reads (verified against opencode
-    // 1.18.30, src/provider/provider.ts: `model.attachment ?? …` / `model.modalities?.input`).
-    // They ride on both generations anyway: the two blocks are two spellings of one model list,
-    // and the V2 model schema (capabilities.{tools,input,output}, which opencode fills by
-    // migrating this same `modalities` field) ignores keys it does not define — its loader
-    // decodes with `onExcessProperty: "ignore"`. Same values on both, so a merge cannot make
-    // the two entries disagree.
+    // Native V2 decoders ignore legacy attachment/modalities fields. Emit each generation's
+    // actual capability shape rather than relying on migration of the other provider block.
     const capabilities = opencodeModelCapabilities(model.inputModalities);
     if (capabilities) {
       entry.attachment = capabilities.attachment;
       entry.modalities = capabilities.modalities;
     }
+    if (typeof model.supportsTools === "boolean") entry.tool_call = model.supportsTools;
     v1Models[key] = entry;
-    const variants = opencodeEffortVariants(model);
-    // Own `limit` and `modalities` objects, not shared references: the two blocks are
-    // serialized and reasoned about separately, and an in-place edit of one must never move
-    // the other.
+    const defaultEffort = exportDefaultReasoningEffort(model);
+    // V2 requires tools whenever capabilities exists. A partial object discards the entire
+    // native block, losing explicit variants. Unknown tools use the legacy modality migration
+    // rather than inventing a tools flag to make the native schema accept the declaration.
+    const v2Capabilities: OpencodeV2ModelEntry["capabilities"] = typeof model.supportsTools === "boolean" ? {
+      tools: model.supportsTools,
+      ...(capabilities ? { input: [...capabilities.modalities.input], output: [...capabilities.modalities.output] } : {}),
+    } : undefined;
     v2Models[key] = {
-      ...entry,
+      name: entry.name,
       ...(entry.limit ? { limit: { ...entry.limit } } : {}),
-      ...(entry.modalities
-        ? { modalities: { input: [...entry.modalities.input], output: [...entry.modalities.output] } }
-        : {}),
-      ...(variants ? { variants } : {}),
+      ...(v2Capabilities ? { capabilities: v2Capabilities } : {}),
+      ...(entry.interleaved ? { compatibility: { reasoningField: "reasoning_content" } } : {}),
+      ...(defaultEffort !== undefined ? { settings: { reasoningEffort: defaultEffort } } : {}),
+      variants: opencodeEffortVariants(model),
     };
   }
   return {

package/src/clients/omo-role-models.ts

@@ -6,7 +6,7 @@
  * dashboard or CLI pick, never creates the file, and refuses a file with comments: the write
  * re-serializes JSON, and a comment the user wrote would be lost without a word.
  */
-import { lstatSync, readFileSync } from "node:fs";
+import { closeSync, constants, fstatSync, lstatSync, openSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { atomicWriteFileNoFollowUnclaimed } from "../config/atomic-write";
@@ -40,12 +40,26 @@ type Loaded =
 
 function load(path: string): Loaded {
   let text: string;
+  let fd: number | undefined;
   try {
-    if (!lstatSync(path).isFile()) return { kind: "invalid" };
-    text = readFileSync(path, "utf8");
+    // POSIX FIFOs must not block before fstat can reject them. Windows omits
+    // these flags and retains the descriptor/path identity checks below.
+    const flags = process.platform === "win32"
+      ? constants.O_RDONLY
+      : constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK;
+    fd = openSync(path, flags);
+    const opened = fstatSync(fd, { bigint: true });
+    const current = lstatSync(path, { bigint: true });
+    if (!opened.isFile() || !current.isFile() || opened.dev !== current.dev || opened.ino !== current.ino) {
+      return { kind: "invalid" };
+    }
+    text = readFileSync(fd, "utf8");
   } catch (error) {
     if ((error as NodeJS.ErrnoException).code === "ENOENT") return { kind: "absent" };
+    if ((error as NodeJS.ErrnoException).code === "ELOOP") return { kind: "invalid" };
     throw error;
+  } finally {
+    if (fd !== undefined) closeSync(fd);
   }
   if (hasJsoncComments(text)) return { kind: "comments" };
   try {

package/src/codex/account-credit-use.ts

@@ -4,6 +4,7 @@ import { isThirtyDayOnlyCodexPlan } from "./plan";
 import {
   CODEX_EXHAUSTED_USAGE_PERCENT,
   isTerminalShortWindow,
+  hasSpendableCodexCredits,
   resetAtToMs,
   type StoredAccountQuota,
 } from "./quota-types";
@@ -14,7 +15,7 @@ import {
  * Upstream does not refuse an account that holds ChatGPT credits at 100%: it serves the request
  * and draws the balance. Selection only takes an account off on quota after a refusal, so an
  * account with credits was never moved off. Spending is opt-in: only the ids in
- * `creditCodexAccountIds` may keep serving from credits, and every other account leaves rotation
+ * `creditCodexAccountIds` may keep serving from fresh spendable credits, and every other account leaves rotation
  * at 100% and comes back after its reset. Pool accounts and the `__main__` login both carry the
  * switch; the main login is also checked where the main-account hard lock is.
  */
@@ -95,5 +96,6 @@ export function isCodexAccountHeldForCredits(
   plan: unknown,
   now: number,
 ): boolean {
-  return !codexAccountUsesCreditsAfterLimit(config, accountId) && isCodexUsageLimitReached(quota, plan, now);
+  return !(codexAccountUsesCreditsAfterLimit(config, accountId) && hasSpendableCodexCredits(quota, now))
+    && isCodexUsageLimitReached(quota, plan, now);
 }

package/src/codex/account-runtime-state.ts

@@ -18,6 +18,27 @@ const reauthAccounts = new Map<string, number | undefined>();
 let lastReconciledGeneration = 0;
 let liveAccountIds = new Set<string>();
 
+// Refusal evidence is independent of the ordinary quarantine flag. Profile switches make a key
+// inapplicable, not forgotten; the oldest of at most 64 records is evicted to bound process state.
+const refusedMainRefreshGrants = new Set<string>();
+const MAX_REFUSED_MAIN_REFRESH_GRANTS = 64;
+
+export function markMainRefreshGrantRejected(key: string): void {
+  refusedMainRefreshGrants.add(key);
+  if (refusedMainRefreshGrants.size > MAX_REFUSED_MAIN_REFRESH_GRANTS) {
+    refusedMainRefreshGrants.delete(refusedMainRefreshGrants.values().next().value!);
+  }
+}
+
+export function isMainRefreshGrantRejected(key: string): boolean {
+  return refusedMainRefreshGrants.has(key);
+}
+
+export function clearMainRefreshGrantRejection(key: string): void {
+  refusedMainRefreshGrants.delete(key);
+}
+
+
 export function markAccountNeedsReauth(
   id: string,
   writerGeneration = captureConfigGeneration(),

package/src/codex/account-store.ts

@@ -1,3 +1,6 @@
+import { classifyChatgptRefreshFailure, noteChatgptRefreshFailure, type ChatgptRefreshDiagnosticCode } from "./chatgpt-refresh-failure";
+import { readBoundedResponseBody } from "../lib/bounded-body";
+export { classifyChatgptRefreshFailure } from "./chatgpt-refresh-failure";
 import { readOrcaAuthSource } from "./orca-auth-source";
 import { createHash } from "node:crypto";
 import { closeSync, existsSync, fstatSync, readFileSync, mkdirSync, openSync, statSync, unlinkSync, writeFileSync } from "node:fs";
@@ -526,7 +529,8 @@ const CHATGPT_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
 
 export class TokenRefreshError extends Error {
   reason: "expired" | "revoked" | "unknown";
-  constructor(reason: "expired" | "revoked" | "unknown", message: string) {
+  constructor(reason: "expired" | "revoked" | "unknown", message: string,
+    readonly status?: number, readonly code?: ChatgptRefreshDiagnosticCode) {
     super(message);
     this.name = "TokenRefreshError";
     this.reason = reason;
@@ -1322,52 +1326,12 @@ async function resolveCodexToken(
       signal,
     });
     if (!res.ok) {
-      const errText = await res.text().catch(() => "");
-      let errDesc: string;
-      let errCodeExact: string | undefined;
-      try {
-        const parsed = JSON.parse(errText) as {
-          error?: string | { code?: string; message?: string };
-          error_description?: string;
-        };
-        if (typeof parsed.error === "string") {
-          errCodeExact = parsed.error.trim();
-          errDesc = [parsed.error, parsed.error_description].filter(Boolean).join(": ");
-        } else if (parsed.error && typeof parsed.error === "object") {
-          errCodeExact = typeof parsed.error.code === "string" ? parsed.error.code.trim() : undefined;
-          errDesc = [parsed.error.code, parsed.error.message, parsed.error_description].filter(Boolean).join(": ");
-        } else {
-          errDesc = parsed.error_description || `HTTP ${res.status}`;
-        }
-        if (!errDesc) errDesc = `HTTP ${res.status}`;
-      } catch { errDesc = `HTTP ${res.status}`; }
-      // `invalid_grant` is the standard OAuth code for a refresh token that is no longer
-      // usable, and upstream sends it bare with no description. Without it here the dead
-      // grant is classified "unknown", which callers treat as transient — so the account
-      // is never retired and every request repeats the same doomed refresh (#2887).
-      //
-      // Matched on the exact `error` CODE, not anywhere in the combined text: a transient
-      // `server_error` whose description happens to mention invalid_grant would otherwise
-      // retire a healthy account, which is the failure this whole change exists to remove.
-      //
-      // That rule binds the DESCRIPTION words too. "invalidated", "revoked" and "expired" read
-      // as terminal prose, but upstream puts arbitrary text there: a `server_error` whose
-      // description says "token was revoked" or "session expired" is still a 5xx blip, and
-      // retiring the account on it is exactly the false quarantine #2887 exists to prevent.
-      // So a body that carries a structured code is classified by that code ALONE. The
-      // substring fallback survives only where there is no structured code to read at all --
-      // a description-only body, or one this parser could not decode -- because there the
-      // prose is the only signal upstream gave us.
-      const structuredCode = errCodeExact ? errCodeExact : undefined;
-      const proseIsOnlySignal = structuredCode === undefined;
-      const reason = structuredCode === "invalid_grant"
-          || structuredCode === "refresh_token_invalidated"
-          || (proseIsOnlySignal
-            && (errDesc.includes("invalidated") || errDesc.includes("revoked"))) ? "revoked" as const
-        : structuredCode === "refresh_token_expired"
-          || (proseIsOnlySignal && errDesc.includes("expired")) ? "expired" as const
-        : "unknown" as const;
-      throw new TokenRefreshError(reason, `Codex token refresh failed (${reason}); reauthenticate the account.`);
+      const body = await readBoundedResponseBody(res, { signal, maxBytes: 16_384, fatalUtf8: true })
+        .catch(() => undefined);
+      const failure = classifyChatgptRefreshFailure(res.status, body?.displaySafe ? body.text : "");
+      const { reason } = failure;
+      noteChatgptRefreshFailure("pool", res.status, failure);
+      throw new TokenRefreshError(reason, `Codex token refresh failed (${reason}); reauthenticate the account.`, res.status, failure.code);
     }
     const data = (await res.json()) as { access_token: string; refresh_token?: string; expires_in: number };
     // Guard against a missing/non-finite/negative expires_in (malformed upstream

package/src/codex/account-usability.ts

@@ -2,8 +2,7 @@ import { readCodexAccountRecord } from "./account-store";
 import { isAccountNeedsReauth } from "./account-runtime-state";
 import {
   MAIN_CODEX_ACCOUNT_ID,
-  hasMainAccountRefreshGrant,
-  isMainAccountCredentialUsable,
+  getMainAccountCredentialStatus,
   isMainAccountTokenLive,
 } from "./main-account";
 import { hasLegacyMainCodexPoolAccount, isSelectableCodexPoolAccount } from "./account-id";
@@ -14,7 +13,7 @@ import { isMainAccountHardLocked } from "./main-account-hard-lock";
 export interface CodexAccountUsabilityOptions {
   /** Route using cached runtime state only; the caller must reject selected main before auth. */
   nativeMainSelectionOnly?: boolean;
-  /** Test seam for proving whether routing attempted a physical native-token read. */
+  /** Liveness override; ownership/read fences independently control physical credential reads. */
   isMainAccountTokenLive?: typeof isMainAccountTokenLive;
   /** Confirmed account ids for an account-gated model; omitted for ordinary native models. */
   modelEligibleAccountIds?: ReadonlySet<string>;
@@ -88,15 +87,19 @@ export function codexAccountUnusableReason(
     // A legacy pool row with the sentinel makes an active `__main__` ambiguous.
     // Fail closed until the authenticated compatibility-delete path removes it.
     if (hasLegacyMainCodexPoolAccount(config.codexAccounts)) return "legacy_pool_sentinel";
-    if (isAccountNeedsReauth(accountId) && !hasMainAccountRefreshGrant()) return "needs_reauth";
-    // A selection-only caller owns the recovery/drain fence and will reject main
-    // before reservation or token materialization. Treat cached main as a routing
-    // candidate without touching the credential file so affinity is not rebound.
+    // These scopes cannot consume physical stored-main state, even indirectly through an
+    // ordinary quarantine plus hasMainAccountRefreshGrant(). Caller liveness is request-owned.
     if (options.nativeMainSelectionOnly) return undefined;
+    if (options.requestOwnedMainCredential) {
+      return options.isMainAccountTokenLive?.() === false ? "main_credential_unavailable" : undefined;
+    }
+    const credential = getMainAccountCredentialStatus();
+    if (credential.refreshGrantRejected) return "needs_reauth";
+    if (isAccountNeedsReauth(accountId) && !credential.hasRefreshGrant) return "needs_reauth";
     // Main account: a refresh grant is enough to route; materialization refreshes before I/O.
     const mainLive = options.isMainAccountTokenLive
       ? options.isMainAccountTokenLive()
-      : isMainAccountCredentialUsable();
+      : credential.usable;
     return mainLive ? undefined : "main_credential_unavailable";
   }
   const exists = (config.codexAccounts ?? [])

package/src/codex/auth-api/account-list.ts

@@ -15,7 +15,7 @@ import { getCodexAccountAutoSwitchThresholdOverride } from "../account-auto-swit
 import { clearThreadAccountMapForAccount, isCodexAccountPlanExcluded, reconcileCodexActiveAfterExclusion } from "../routing";
 import { codexPlanValue, isThirtyDayOnlyCodexPlan } from "../plan";
 import { isAccountNeedsReauth, markAccountNeedsReauth } from "../account-runtime-state";
-import { getValidMainAccountToken, MainAccountTokenRefreshError, MAIN_CODEX_ACCOUNT_ID } from "../main-account";
+import { getValidMainAccountToken, isMainAccountRefreshGrantRejected, MAIN_CODEX_ACCOUNT_ID } from "../main-account";
 import { captureConfigGeneration } from "../../lib/state-store-sweeper";
 import { captureMainAccountIdentityGeneration, getMainAccountCredentialPresence, getMainAccountInfoCache, getObservedMainQuotaIdentityKey, isMainAccountIdentityGenerationLive } from "../main-account-cache";
 import type { CodexQuotaRefreshOutcome } from "../quota-refresh-outcome";
@@ -342,60 +342,76 @@ export async function listCodexAuthAccountsSnapshot(
       maskEmails,
     )];
   });
-  const fetchedMainGeneration = mainResult.identityGeneration ?? captureMainAccountIdentityGeneration();
-  const mainSnapshotLive = isMainAccountIdentityGenerationLive(fetchedMainGeneration);
-  // An ordinary same-account return can be parsed after its credential was replaced.
-  // The card and hard-lock status must describe the same published quota snapshot.
-  const mainInfo = mainSnapshotLive
-    ? mainResult.infoUnpublished ? getMainAccountInfoCache() ?? EMPTY_MAIN_ACCOUNT_INFO : mainResult.info
-    : EMPTY_MAIN_ACCOUNT_INFO;
-  const hasMainCredential = mainSnapshotLive && mainResult.credentialChecked
-    ? mainResult.hasCredential
-    : getMainAccountCredentialPresence() ?? false;
-  const mainMissingCredential = mainSnapshotLive && mainResult.credentialChecked && !hasMainCredential;
-  const mainNeedsReauth = mainMissingCredential || isAccountNeedsReauth(MAIN_CODEX_ACCOUNT_ID);
-  const mainHealth = projectCodexAccountHealth({
-    accountId: MAIN_CODEX_ACCOUNT_ID,
-    needsReauth: mainNeedsReauth,
-  });
-  // The main row carries the same attribution as a pool row. Reaching this point without
-  // `mainMissingCredential` means the runtime reauth flag is what set `mainNeedsReauth`, so the
-  // cause is a refresh that did not complete.
-  const mainReauthReason: CodexAccountReauthReason | undefined = mainMissingCredential
-    ? "missing_credential"
-    : mainNeedsReauth
-      ? "refresh_failed"
-      : mainHealth.status === "reauth_required" ? mainHealth.reason : undefined;
-  const main: CodexAuthAccountDto = {
-    id: MAIN_CODEX_ACCOUNT_ID,
-    email: projectEmail(mainInfo.email, maskEmails) ?? "Codex App login",
-    plan: mainInfo.plan,
-    ...(mainSnapshotLive && mainResult.quotaRefresh && mainResult.quotaRefreshGeneration !== undefined
+  const projectSnapshot = (mainRefreshRefused = false): CodexAuthAccountsSnapshot => {
+    const fetchedMainGeneration = mainResult.identityGeneration ?? captureMainAccountIdentityGeneration();
+    const mainSnapshotLive = isMainAccountIdentityGenerationLive(fetchedMainGeneration);
+    // An ordinary same-account return can be parsed after its credential was replaced.
+    // The card and hard-lock status must describe the same published quota snapshot.
+    const mainInfo = mainSnapshotLive
+      ? mainResult.infoUnpublished ? getMainAccountInfoCache() ?? EMPTY_MAIN_ACCOUNT_INFO : mainResult.info
+      : EMPTY_MAIN_ACCOUNT_INFO;
+    const hasMainCredential = mainSnapshotLive && mainResult.credentialChecked
+      ? mainResult.hasCredential
+      : getMainAccountCredentialPresence() ?? false;
+    const mainMissingCredential = mainSnapshotLive && mainResult.credentialChecked && !hasMainCredential;
+    const liveQuotaRefresh = mainSnapshotLive && mainResult.quotaRefreshGeneration !== undefined
       && isMainAccountIdentityGenerationLive(mainResult.quotaRefreshGeneration)
-      ? { quotaRefresh: mainResult.quotaRefresh } : {}),
-    logLabel: "main",
-    isMain: true,
-    paused: isCodexAccountPaused(runtimeConfig, MAIN_CODEX_ACCOUNT_ID),
-    mainAccountHardLock: { ...getMainAccountHardLockStatus(runtimeConfig),
-      externalUsage: getMainAccountExternalUsageWarning(getObservedMainQuotaIdentityKey()) },
-    priority: getCodexAccountPriority(runtimeConfig, MAIN_CODEX_ACCOUNT_ID),
-    autoSwitchThresholdOverride: getCodexAccountAutoSwitchThresholdOverride(runtimeConfig, MAIN_CODEX_ACCOUNT_ID),
-    creditsAfterLimit: codexAccountUsesCreditsAfterLimit(runtimeConfig, MAIN_CODEX_ACCOUNT_ID),
-    hasCredential: hasMainCredential,
-    needsReauth: mainNeedsReauth,
-    ...(mainReauthReason !== undefined ? { reauthReason: mainReauthReason } : {}),
-    quota: mainInfo.quota
-      ? quotaForPlan(mainQuotaWithCarriedResetCredits(mainInfo.quota), mainInfo.plan)
-      : null,
-    ...codexCreditsDtoField(runtimeConfig, MAIN_CODEX_ACCOUNT_ID, getMainChatgptAccountId()),
-    ...oauthAccountHealthFields("codex", MAIN_CODEX_ACCOUNT_ID, mainHealth),
-  };
-  return {
-    accounts: [main, ...withQuota],
-    mainIdentityGeneration: mainSnapshotLive
-      ? fetchedMainGeneration
-      : captureMainAccountIdentityGeneration(),
+      ? mainResult.quotaRefresh : undefined;
+    const mainNeedsReauth = mainMissingCredential || mainRefreshRefused || isAccountNeedsReauth(MAIN_CODEX_ACCOUNT_ID);
+    const mainHealth = projectCodexAccountHealth({
+      accountId: MAIN_CODEX_ACCOUNT_ID,
+      needsReauth: mainNeedsReauth,
+    });
+    // The main row carries the same attribution as a pool row. Reaching this point without
+    // Only a current terminal usage probe can attribute the reauth cause. A transient status
+    // never replaces a refresh failure, including a separately recorded refused grant.
+    const mainReauthReason: CodexAccountReauthReason | undefined = mainMissingCredential
+      ? "missing_credential"
+      : mainNeedsReauth
+        ? mainResult.terminalAuthFailure === true && liveQuotaRefresh?.status === "http_error"
+          ? "unauthorized" : "refresh_failed"
+        : mainHealth.status === "reauth_required" ? mainHealth.reason : undefined;
+    const main: CodexAuthAccountDto = {
+      id: MAIN_CODEX_ACCOUNT_ID,
+      email: projectEmail(mainInfo.email, maskEmails) ?? "Codex App login",
+      plan: mainInfo.plan,
+      ...(liveQuotaRefresh ? { quotaRefresh: liveQuotaRefresh } : {}),
+      logLabel: "main",
+      isMain: true,
+      paused: isCodexAccountPaused(runtimeConfig, MAIN_CODEX_ACCOUNT_ID),
+      mainAccountHardLock: { ...getMainAccountHardLockStatus(runtimeConfig),
+        externalUsage: getMainAccountExternalUsageWarning(getObservedMainQuotaIdentityKey()) },
+      priority: getCodexAccountPriority(runtimeConfig, MAIN_CODEX_ACCOUNT_ID),
+      autoSwitchThresholdOverride: getCodexAccountAutoSwitchThresholdOverride(runtimeConfig, MAIN_CODEX_ACCOUNT_ID),
+      creditsAfterLimit: codexAccountUsesCreditsAfterLimit(runtimeConfig, MAIN_CODEX_ACCOUNT_ID),
+      hasCredential: hasMainCredential,
+      needsReauth: mainNeedsReauth,
+      ...(mainReauthReason !== undefined ? { reauthReason: mainReauthReason } : {}),
+      quota: mainInfo.quota
+        ? quotaForPlan(mainQuotaWithCarriedResetCredits(mainInfo.quota), mainInfo.plan)
+        : null,
+      ...codexCreditsDtoField(runtimeConfig, MAIN_CODEX_ACCOUNT_ID, getMainChatgptAccountId()),
+      ...oauthAccountHealthFields("codex", MAIN_CODEX_ACCOUNT_ID, mainHealth),
+    };
+    return {
+      accounts: [main, ...withQuota],
+      mainIdentityGeneration: mainSnapshotLive
+        ? fetchedMainGeneration
+        : captureMainAccountIdentityGeneration(),
+    };
   };
+  // Project the refusal and DTO in the same owned synchronous observation. A same-account grant
+  // replacement during earlier pool probes must not inherit the previous grant's refusal.
+  const projectionLease = tryAcquireNativeMainProfileClaim();
+  if (!projectionLease) return projectSnapshot();
+  try {
+    return await withNativeMainCredentialClaim(async () => projectSnapshot(isMainAccountRefreshGrantRejected()));
+  } catch (error) {
+    if (isNativeMainClaimUnavailable(error)) return projectSnapshot();
+    throw error;
+  } finally {
+    projectionLease.release();
+  }
 }
 
 /** One opted-in account's metadata; reuse the bounded WHAM 401 recovery and generation fence. */
@@ -406,16 +422,10 @@ export async function refreshCodexQuotaForActivation(config: OcxConfig, accountI
     try {
       reconcileMainCodexAccountRuntimeState();
       if (isAccountNeedsReauth(accountId)) return;
-      const identityGeneration = captureMainAccountIdentityGeneration();
-      const writerGeneration = captureConfigGeneration();
       try {
-        // Refresh may need an exclusive claim; prepare before WHAM takes its shared claim.
+        // Refresh owns credential-scoped refusal evidence; do not recreate a global quarantine.
         if (!await getValidMainAccountToken({ preserveReauth: true })) return;
-      } catch (error) {
-        if (error instanceof MainAccountTokenRefreshError && error.reason === "reauth"
-          && isMainAccountIdentityGenerationLive(identityGeneration)) {
-          markAccountNeedsReauth(accountId, writerGeneration);
-        }
+      } catch {
         return;
       }
       if (isAccountNeedsReauth(accountId)) return;
@@ -476,7 +486,7 @@ export async function pauseExhaustedCodexAccounts(
         }
         return {
           shouldPause: !isCodexAccountPaused(config, MAIN_CODEX_ACCOUNT_ID)
-            && isCodexQuotaExhausted(mainResult.freshQuota, mainResult.info.plan),
+            && isCodexQuotaExhausted(mainResult.freshQuota, mainResult.info.plan, codexAccountUsesCreditsAfterLimit(config, MAIN_CODEX_ACCOUNT_ID)),
           checkedAccountCount: 1,
           failedAccountCount: 0,
         };
@@ -511,7 +521,7 @@ export async function pauseExhaustedCodexAccounts(
           continue;
         }
         checkedAccountCount += 1;
-        if (!isCodexAccountPaused(config, account.id) && isCodexQuotaExhausted(quotaResult.freshQuota, plan)) {
+        if (!isCodexAccountPaused(config, account.id) && isCodexQuotaExhausted(quotaResult.freshQuota, plan, codexAccountUsesCreditsAfterLimit(config, account.id))) {
           exhaustedIds.push(account.id);
         }
       }