@bitkyc08/opencodex 2.82.0 → 2.83.0

package/src/cli/account-auth.ts

@@ -6,6 +6,7 @@ import { warnIfCodexCatalogRefreshPending } from "./account-catalog-refresh";
 import { isCodexResetCreditOperationId } from "../codex/reset-credit-recovery";
 import { BROWSER_LAUNCH_FAILED_NOTICE } from "../lib/browser-launch-notice";
 import {
+  RuntimeApiError,
   CliUsageError,
   printData,
   readSecretLine,
@@ -465,18 +466,25 @@ async function grokResetCoupons(argv: string[], deps: RuntimeApiDeps): Promise<v
   }
   rejectArgs(args, USAGE);
   const accountId = rawId ? (rawId === "main" ? "__main__" : rawId) : undefined;
-  const result = consume
-    ? await runtimeRequest("/api/grok/reset-coupons/consume", {
-      method: "POST",
-      // Spread, not `operationId: undefined`: the server distinguishes an absent
-      // key from a caller who asked for a stable idempotency identity.
-      body: JSON.stringify({ accountId, tokenId, ...(operationId === undefined ? {} : { operationId }) }),
-    }, deps)
-    : await runtimeRequest(
-      `/api/grok/reset-coupons${accountId ? `?accountId=${encodeURIComponent(accountId)}` : ""}`,
-      {},
-      deps,
-    );
+  const effectiveOperationId = consume ? operationId ?? crypto.randomUUID() : undefined;
+  let result: unknown;
+  try {
+    result = consume
+      ? await runtimeRequest("/api/grok/reset-coupons/consume", {
+        method: "POST", body: JSON.stringify({ accountId, tokenId, operationId: effectiveOperationId }),
+      }, deps)
+      : await runtimeRequest(`/api/grok/reset-coupons${accountId ? `?accountId=${encodeURIComponent(accountId)}` : ""}`, {}, deps);
+  } catch (error) {
+    const apiError = error instanceof RuntimeApiError ? error : undefined;
+    const body = apiError?.body as { error?: { code?: string } } | null | undefined;
+    const code = body && typeof body === "object" ? body.error?.code : undefined;
+    if (consume && (!apiError || (!apiError.code && (
+      (!code && apiError.status >= 500) || ["attempt_unresolved", "attempt_in_progress", "attempt_reconcile_failed", "operation_state_changed", "redeem_failed"].includes(code ?? "")
+    )))) {
+      throw new RuntimeApiError(`Coupon redemption outcome is unconfirmed. Preserve --operation-id ${effectiveOperationId}; reuse it to inspect this attempt and do not create a replacement operation.`, apiError?.status ?? 503, apiError?.body ?? null);
+    }
+    throw error;
+  }
   printData(result, wantsJson);
 }
 

package/src/cli/resolve.ts

@@ -1,7 +1,7 @@
 /**
  * `ocx resolve` — the machine-readable runtime resolution surface for an embedding shell.
  *
- * D5 of devlog/_plan/260921_app_runtime_ownership/: the desktop shell must stop resolving
+ * D5 of devlog/_fin/260921_app_runtime_ownership/: the desktop shell must stop resolving
  * the config home, the port and liveness itself. The tuned probe budgets in
  * src/server/proxy-liveness.ts exist because a shell-side reimplementation answered
  * "nobody listening" twice and started duplicate proxies; this verb exposes that module's

package/src/clients/config-export/model-metadata.ts

@@ -2,6 +2,7 @@
 import { getModelMetadata, resolveMetadataProvider } from "../../generated/model-metadata";
 import { SCHEMA_REQUIRED_OUTPUT_BUDGET } from "./constants";
 import { expandFastExportModels } from "./fast-models";
+import { sanitizeCodexReasoningEfforts } from "../../reasoning-effort";
 import type { OpencodeCatalogModel, ExportModel, ExportClientId, ManagedContribution } from "./contracts";
 import type { OcxConfig } from "../../types";
 import { shouldInjectApiAuthHeader } from "../../codex/inject";
@@ -84,6 +85,21 @@ export function inputModalitiesForClient(
   return kept.length > 0 ? kept : null;
 }
 
+/**
+ * Effort ladder a ZCode surface can offer as picker values, or undefined when the row
+ * has nothing selectable.
+ *
+ * Both ZCode exports — the legacy `v2/config.json` block's `reasoning.variants` and the
+ * `v2/provider_config.json` store's `optionSpecs.reasoningLevel.values` — carry the same
+ * Codex vocabulary: the client validates the chosen level against the emitted list and
+ * forwards it verbatim, and `/v1/responses` reads that vocabulary natively. `none` is a
+ * Codex omit-sentinel, not a picker option, so it never survives into the values.
+ */
+export function zcodeSelectableEfforts(efforts: readonly string[] | undefined): string[] | undefined {
+  const selectable = sanitizeCodexReasoningEfforts(efforts)?.filter(effort => effort !== "none");
+  return selectable && selectable.length > 0 ? selectable : undefined;
+}
+
 /**
  * Input modalities opencode's model schema accepts (opencode.ai/config.json, both
  * `modalities.input` and `modalities.output`). Wider than our internal `text | image | audio`

package/src/clients/config-export/zcode-store.ts

@@ -1,6 +1,6 @@
 // ZCode personal provider store export.
 import type { ExportContext, ManagedContribution, ManagedFragment } from "./contracts";
-import { authoritativeContextWindow, inputModalitiesForClient, normalizeExportModels } from "./model-metadata";
+import { authoritativeContextWindow, inputModalitiesForClient, normalizeExportModels, zcodeSelectableEfforts } from "./model-metadata";
 import { OPENCODE_PROVIDER_ID, LOOPBACK_API_KEY_PLACEHOLDER } from "./constants";
 import { formatSelectorConjunction } from "../../integrations/merge";
 
@@ -49,10 +49,30 @@ export interface ZcodeStoreProviderRule {
   };
 }
 
+/**
+ * One model rule, as the client's own store loader accepts it.
+ *
+ * The capability fields are the client's schema, not ours: ZCode 3.14's CLI
+ * bundle parses each `providerModelRules` entry with a strict object whose
+ * `config.properties` admits `inputFormat.{supportsText..supportsPdf}` (booleans)
+ * and whose `config.optionSpecs` admits `reasoningLevel.values` (non-empty,
+ * deduplicated) plus an optional compiled `map`. With no `map`, the chosen level
+ * is validated against `values` and forwarded verbatim to the wire field the
+ * `openai-responses` api type uses — `reasoning.effort`, which is exactly the
+ * Codex vocabulary our ladder already carries, so no mapping is emitted.
+ */
 export interface ZcodeStoreModelRule {
   providerId: string;
   modelId: string;
-  config: { properties: { contextWindow: number } };
+  config: {
+    properties: {
+      contextWindow?: number;
+      inputFormat?: { supportsImage: true };
+    };
+    optionSpecs?: {
+      reasoningLevel: { values: string[] };
+    };
+  };
 }
 
 /**
@@ -77,7 +97,7 @@ export function zcodeStoreSchemaEstablished(parsed: unknown): boolean {
  * carrying only the model would match another provider's rule for the same
  * model. The conjunction grammar reserves `,` and `]`, and a model id holding
  * either cannot be addressed unambiguously — that row ships without its
- * context window rather than with a selector that points somewhere else.
+ * model rule rather than with a selector that points somewhere else.
  */
 function modelRuleSelector(modelId: string): string | null {
   return formatSelectorConjunction([
@@ -128,12 +148,18 @@ export function buildZcodeStoreProviderRule(ctx: ExportContext): ZcodeStoreProvi
 
 /**
  * Everything this project owns inside the store: one provider rule, plus one
- * model rule per row that has an authoritative context window.
+ * model rule per row that has anything authoritative to assert.
  *
- * A row without one ships no model rule at all, which is the same
- * authoritative-window rule the legacy block follows — an emitted stand-in
- * would be a guessed capability. Reasoning ladders have no counterpart here
- * that this project has observed the client produce, so none is written.
+ * A model rule now exists when the row has any of: an authoritative context
+ * window, image input, or a selectable effort ladder. A row with none of the
+ * three ships no rule at all, which is the same no-guessed-capability rule the
+ * legacy block follows. Image input is asserted only when the catalog declares
+ * it — `supportsImage: true` is what gates the client's attachment UI, and a
+ * text-only row keeps the client's own defaults rather than being pinned to
+ * `false`. `reasoningLevel.values` carries the same ladder (minus the `none`
+ * sentinel) the legacy block's `reasoning.variants` carries, so both surfaces
+ * offer the picker the catalog declared instead of the store silently losing
+ * reasoning and vision the way #5348 lost the provider itself.
  */
 export function buildZcodeStoreContribution(ctx: ExportContext): ManagedContribution {
   const fragments: ManagedFragment[] = [{
@@ -141,15 +167,24 @@ export function buildZcodeStoreContribution(ctx: ExportContext): ManagedContribu
     value: buildZcodeStoreProviderRule(ctx),
   }];
   for (const model of normalizeExportModels(ctx.models)) {
-    if (inputModalitiesForClient("pi", model.inputModalities) === null) continue;
+    const input = inputModalitiesForClient("pi", model.inputModalities);
+    if (input === null) continue;
     const contextWindow = authoritativeContextWindow(model.contextWindow);
-    if (contextWindow === undefined) continue;
+    const supportsImage = input.includes("image");
+    const efforts = zcodeSelectableEfforts(model.reasoningEfforts);
+    if (contextWindow === undefined && !supportsImage && efforts === undefined) continue;
     const selector = modelRuleSelector(model.namespaced);
     if (selector === null) continue;
     const rule: ZcodeStoreModelRule = {
       providerId: OPENCODE_PROVIDER_ID,
       modelId: model.namespaced,
-      config: { properties: { contextWindow } },
+      config: {
+        properties: {
+          ...(contextWindow !== undefined ? { contextWindow } : {}),
+          ...(supportsImage ? { inputFormat: { supportsImage: true } } : {}),
+        },
+        ...(efforts !== undefined ? { optionSpecs: { reasoningLevel: { values: efforts } } } : {}),
+      },
     };
     fragments.push({ path: [...ZCODE_STORE_MODEL_RULES_PATH, selector], value: rule });
   }

package/src/clients/config-export/zcode.ts

@@ -1,7 +1,6 @@
 // ZCode config export.
 import type { ExportContext, ManagedContribution } from "./contracts";
-import { normalizeExportModels, inputModalitiesForClient, exportModelLabel, authoritativeContextWindow, singleFragment } from "./model-metadata";
-import { sanitizeCodexReasoningEfforts } from "../../reasoning-effort";
+import { normalizeExportModels, inputModalitiesForClient, exportModelLabel, authoritativeContextWindow, singleFragment, zcodeSelectableEfforts } from "./model-metadata";
 import { OPENCODE_PROVIDER_ID, LOOPBACK_API_KEY_PLACEHOLDER } from "./constants";
 
 
@@ -86,9 +85,8 @@ export function buildZcodeClientConfig(ctx: ExportContext): ZcodeGeneratedConfig
     // `ultra` when present: ZCode forwards the selected variant to the wire field its
     // kind uses — `reasoning.effort` on `openai`, which is what `/v1/responses` reads
     // natively. Set `defaultVariant` only when it survives that filter.
-    const efforts = sanitizeCodexReasoningEfforts(model.reasoningEfforts)
-      ?.filter(effort => effort !== "none");
-    if (efforts && efforts.length > 0) {
+    const efforts = zcodeSelectableEfforts(model.reasoningEfforts);
+    if (efforts !== undefined) {
       const defaultVariant = model.defaultReasoningEffort?.trim().toLowerCase();
       entry.reasoning = {
         enabled: true,

package/src/clients/config-export.ts

@@ -1367,7 +1367,7 @@ function buildAsideContribution(ctx: ExportContext): ManagedContribution {
  * the keyed `providers`, the `models` ARRAY whose identity is `id`, the
  * `openai-completions` dialect, the loopback placeholder, and the
  * `thinkingLevelMap` levels. Evidence:
- * `devlog/_plan/260912_omo_client_integration/001_omo_contract.md`.
+ * `devlog/_fin/260912_omo_client_integration/001_omo_contract.md`.
  *
  * The flag is passed HERE as well as in the spec's `build`, which is the one
  * thing Prime and Aside do not do. They pass the default on both paths, so they

package/src/codex/auth-api/pool-mode-gate.ts

@@ -88,14 +88,13 @@ export async function runMainAccountHardLockRecovery(config: OcxConfig): Promise
     const now = Date.now();
     const quota = getMainPolicyQuota();
     const observedAt = quota?.credits?.observedAt;
-    // getMainPolicyQuota binds evidence to the observed physical identity. Only renew
-    // valid formerly spendable funds; admission retains the actual five-minute clock.
+    // Positive evidence renews before expiry; unavailable evidence keeps discovery
+    // eligible under the same pacing. Admission still requires fresh spendable funds.
     return codexAccountUsesCreditsAfterLimit(config, MAIN_CODEX_ACCOUNT_ID)
       && !isCodexAccountPaused(config, MAIN_CODEX_ACCOUNT_ID)
       && codexUsageLimitResetAt(quota, undefined, now) !== undefined
-      && observedAt !== undefined && observedAt > 0
-      && now - observedAt >= MAIN_CREDIT_RENEWAL_AGE_MS
-      && hasSpendableCodexCredits(quota, observedAt);
+      && (!hasSpendableCodexCredits(quota, now)
+        || (observedAt !== undefined && now - observedAt >= MAIN_CREDIT_RENEWAL_AGE_MS));
   };
   const status = getMainAccountHardLockStatus(config);
   if (status.state !== "blocked" && !creditRecoveryNeeded()) { mainHardLockRecoveryAttempt = undefined; return; }

package/src/codex/auth-context.ts

@@ -1,5 +1,6 @@
 import { bindPoolCreditPolicy, poolCreditHoldResetAt, poolContextCreditHoldResetAt } from "./pool-credit-policy";
 import { hasSpendableCodexCredits } from "./quota-types";
+import { nextQuotaQueryDelay } from "./quota-query-backoff";
 import { noteMainAccountActivity } from "./main-account-external-usage";
 import { codexAccountPriorityFailbackEnabled } from "./account-priority";
 import type { PoolQuotaWriter } from "./quota-types";
@@ -553,8 +554,11 @@ function assertPoolAccountCredits(accountId: string, resetAt: number | undefined
 export class CodexMainAccountCreditsOffError extends CodexAccountCooldownError {
   readonly resetAt?: number;
 
-  constructor(resetAt?: number) {
-    super(MAIN_CODEX_ACCOUNT_ID, resetAt ?? 0);
+  constructor(resetAt?: number, creditRecovery = false) {
+    // Keep the included reset as policy evidence, but let consented callers retry
+    // within the base metadata recovery interval even when backoff grows longer.
+    super(MAIN_CODEX_ACCOUNT_ID, creditRecovery
+      ? Math.min(resetAt ?? Infinity, Date.now() + nextQuotaQueryDelay()) : resetAt ?? 0);
     this.name = "CodexMainAccountCreditsOffError";
     this.resetAt = resetAt;
     this.message = "Codex main account reached its usage limit, and spending ChatGPT credits is off or no fresh spendable balance is available."
@@ -778,7 +782,8 @@ function assertMainAccountPolicy(
     const status = getMainAccountHardLockStatus(config);
     if (status.state === "blocked") throw new CodexMainAccountHardLockError(status.resetAt, status.thresholds);
     const creditsResetAt = mainCreditsHoldResetAt(config);
-    if (creditsResetAt !== undefined) throw new CodexMainAccountCreditsOffError(creditsResetAt);
+    if (creditsResetAt !== undefined) throw new CodexMainAccountCreditsOffError(creditsResetAt,
+      codexAccountUsesCreditsAfterLimit(config, MAIN_CODEX_ACCOUNT_ID));
   }
   // Only an admitted request is opencodex's own use of the main account. Counting a refused one
   // would hide outside usage from the warning exactly while the lock is holding.

package/src/codex/catalog/native-models.ts

@@ -93,7 +93,7 @@ export const CONFIGURED_NATIVE_OPENAI_TEMPLATE_MODEL = NATIVE_GPT61_SOL_MODEL;
  *
  * `gpt-daybreak-blue-latest` stays gated. It has no shipped catalog row anywhere, so absence is
  * the only signal that exists for it, and the ungating decision was scoped to the flagships.
- * Evidence: devlog/_plan/260904_flagship_native_always_visible/.
+ * Evidence: devlog/_fin/260904_flagship_native_always_visible/.
  */
 export const ACCOUNT_GATED_NATIVE_OPENAI_MODELS: ReadonlySet<string> = new Set([
   NATIVE_DAYBREAK_BLUE_MODEL,

package/src/codex/catalog/provider-models.ts

@@ -1,3 +1,6 @@
+import { fetchCopilotAutoModels, copilotPickerModels, copilotRequiresAuto } from "../../providers/github-copilot-auto";
+import { resolveGithubCopilotTransport } from "../../providers/github-copilot-transport";
+import { resolveCopilotApiBaseUrl } from "../../oauth/github-copilot";
 import { isAnthropicOAuthInstance } from "../../providers/anthropic-instance";
 import { effectiveProviderAlias, effectiveProviderAliasDecision } from "../../providers/default-aliases";
 import { initialModelSelectionPending } from "../../providers/initial-model-selection";
@@ -164,6 +167,7 @@ export function observedModelsAuthResolver(
     },
   };
 }
+/** Project captured discovery through config hints and retention; Auto-only Copilot exposes only Auto. */
 export async function fetchProviderModelsWithAuth(
   captured: CapturedProviderGather,
   ttlMs: number,
@@ -282,6 +286,27 @@ export async function fetchProviderModelsWithAuth(
       : { apiKey: await resolveModelsAuthToken(name, prov), observed: false }
     : resolveAuth.resolve(name, prov));
   const apiKey = auth.apiKey;
+  if (name === "github-copilot" && apiKey) {
+    const transport = resolveGithubCopilotTransport({ ...prov, apiKey }, prov.authMode === "oauth"
+      ? resolveCopilotApiBaseUrl(auth.oauthApiBaseUrl) : undefined);
+    try {
+      const models = await fetchCopilotAutoModels(transport, AbortSignal.timeout(8_000), undefined, ttlMs);
+      const picker = copilotPickerModels(prov, models).map(/** Apply configured hints to the permission-filtered account catalog without changing upstream metadata. */
+        model => applyProviderConfigHints(name, prov, {
+        id: model.id, provider: name,
+        ...catalogHintsFromModelsApiItem(name, model as ProviderModelsApiItem),
+      }, contextCap, metadataModelIdCaseFold, captured.effectiveAlias));
+      if (!isCurrentCacheGeneration()) return observed(configured, "degraded");
+      markProviderDiscoveryOk(name, picker.length);
+      // Retain callable manual/combo selectors, but do not advertise named selection
+      // for an Auto-only account even when its saved configuration still contains it.
+      return observed(copilotRequiresAuto(prov, models)
+        ? picker : withConfiguredRetention(picker, { warnDrops: true }), "authoritative");
+    } catch {
+      if (isCurrentCacheGeneration()) markProviderDiscoveryFailed(name, { reason: "provider" });
+      return observed(configured, "degraded");
+    }
+  }
   const maySendAnthropicDiscovery = () => {
     if (!isAnthropicOAuthInstance(name) || prov.authMode !== "oauth") return true;
     if (!mayResolveModelsOAuth(name, prov)) return false;

package/src/codex/desktop-app/darwin.ts

@@ -1,7 +1,7 @@
 /**
  * macOS adapter for the Codex desktop-app restart.
  *
- * Measured shape (devlog/_plan/260913_cross_platform_desktop_app_restart/001_platform_topology.md):
+ * Measured shape (devlog/_fin/260913_cross_platform_desktop_app_restart/001_platform_topology.md):
  *
  *   15901     1  /Applications/ChatGPT.app/Contents/MacOS/ChatGPT
  *   16733 15901  /Applications/ChatGPT.app/Contents/Resources/codex ... app-server ...

package/src/codex/desktop-app/handoff.ts

@@ -23,7 +23,7 @@
  *   it passes `allowHandoff: false` so it can only ever take the direct path or refuse.
  *   Recursion is structurally impossible rather than merely unlikely.
  *
- * Design: devlog/_plan/260913_cross_platform_desktop_app_restart/020_phase2_detached_self_handoff.md
+ * Design: devlog/_fin/260913_cross_platform_desktop_app_restart/020_phase2_detached_self_handoff.md
  */
 import { spawn } from "node:child_process";
 import { appendFileSync, closeSync, existsSync, mkdirSync, openSync, readFileSync, unlinkSync, writeSync } from "node:fs";

package/src/codex/desktop-app/linux.ts

@@ -1,7 +1,7 @@
 /**
  * Linux adapter for the Codex desktop-app restart.
  *
- * Measured shape (devlog/_plan/260913_cross_platform_desktop_app_restart/001_platform_topology.md):
+ * Measured shape (devlog/_fin/260913_cross_platform_desktop_app_restart/001_platform_topology.md):
  *
  *   /usr/bin/chatgpt -> /usr/lib/chatgpt/codex-launcher  (2-line sh script)
  *   that execs /usr/lib/chatgpt/ChatGPT

package/src/codex/desktop-app/lock.ts

@@ -22,7 +22,7 @@
  *   itself. An unconditional unlink would let a late release destroy somebody else's
  *   live lock, which is exactly the mutual exclusion this file exists to provide.
  *
- * Design: `devlog/_plan/260913_cross_platform_desktop_app_restart/020_phase2_detached_self_handoff.md` §4.1.
+ * Design: `devlog/_fin/260913_cross_platform_desktop_app_restart/020_phase2_detached_self_handoff.md` §4.1.
  */
 import { mkdirSync, openSync, closeSync, writeSync, readFileSync, unlinkSync, renameSync } from "node:fs";
 import { join, dirname } from "node:path";

package/src/codex/desktop-app/types.ts

@@ -7,7 +7,7 @@
  * PID-reuse and fail-closed reasoning from being re-derived three times, once per
  * operating system, with two of the three getting it subtly wrong.
  *
- * Design and audit history: `devlog/_plan/260913_cross_platform_desktop_app_restart/`.
+ * Design and audit history: `devlog/_fin/260913_cross_platform_desktop_app_restart/`.
  */
 import { sep } from "node:path";
 

package/src/codex/desktop-app/windows.ts

@@ -7,7 +7,7 @@
  * AUMID. The shape is DesktopAppAdapter so the ladder, not this file, owns
  * PID-reuse re-verification and the fail-closed sequencing.
  *
- * Measured (devlog/_plan/260913_cross_platform_desktop_app_restart/001_platform_topology.md §3):
+ * Measured (devlog/_fin/260913_cross_platform_desktop_app_restart/001_platform_topology.md §3):
  * OpenAI.Codex MSIX, ChatGPT.exe, InstallLocation under WindowsApps.
  */
 import { execFileSync } from "node:child_process";

package/src/codex/desktop-app-restart.ts

@@ -29,7 +29,7 @@
  * never reported as "nothing to do". A stale picker is a much smaller problem than a
  * wrongly killed process.
  *
- * Design and audit history: devlog/_plan/260913_cross_platform_desktop_app_restart/.
+ * Design and audit history: devlog/_fin/260913_cross_platform_desktop_app_restart/.
  */
 import {
   acquireDesktopRestartLock,

package/src/codex/main-account.ts

@@ -510,8 +510,9 @@ async function resolveMainAccountToken(
         }
         const refresh = dependencies.refreshToken ?? refreshNativeMainGrant;
         let refreshed: OAuthCredentials;
+        if (signal.aborted) throw signal.reason;
         try {
-          refreshed = await refresh(locked.refreshToken, { signal });
+          refreshed = await refresh(locked.refreshToken, { signal: refreshTimeout });
         } catch (cause) {
           // A refusal already classified at the endpoint keeps that verdict. An injected refresh
           // threw an ordinary Error and has only its message, so prose still decides there --
@@ -535,16 +536,14 @@ async function resolveMainAccountToken(
           }
           throw new MainAccountTokenRefreshError(reason, { cause });
         }
-        // The refresh may resolve after the caller went away (an implementation that does
-        // not observe the signal, or an abort landing in the window between resolution and
-        // commit). A cancelled request's late refresh must not rewrite auth.json on behalf
-        // of a request that no longer exists -- the same fence the reauth twin applies
-        // before its own commit above.
-        if (dependencies.signal?.aborted) throw dependencies.signal.reason;
+        // Once the exchange starts, only its own timeout may abort it: a successful
+        // rotating grant retires the old refresh token. Save the only live grant before
+        // honoring caller cancellation, while retaining the external-writer guards.
         const result = persistRefreshedMainAuthJson(locked, refreshed);
         // A permitted in-flight success speaks only for its own profile and grant.
         clearMainRefreshGrantRejection(mainRefreshGrantKey(locked)!);
         if (dependencies.preserveReauth !== true) clearAccountNeedsReauth(MAIN_CODEX_ACCOUNT_ID);
+        if (dependencies.signal?.aborted) throw dependencies.signal.reason;
         return result;
       }),
       { waitMs: 30_000, signal },