@bitkyc08/opencodex 2.86.0 → 2.88.0

package/src/cli/usage-model-search.ts

@@ -5,7 +5,7 @@ export interface UsageModelView {
   query: string;
   matchedModelCount: number;
   returnedModelCount: number;
-  limit: 100;
+  limit: number;
   truncated: boolean;
 }
 
@@ -36,7 +36,7 @@ export function takeUsageSearchOption(args: string[]): string | undefined {
   return value;
 }
 
-export function selectUsageModelView<T extends { models?: unknown }>(report: T, rawQuery: string): Omit<T, "models"> & { models: SearchableModel[]; modelView: UsageModelView } {
+export function selectUsageModelView<T extends { models?: unknown }>(report: T, rawQuery: string, limit = 100): Omit<T, "models"> & { models: SearchableModel[]; modelView: UsageModelView } {
   if (!report || !Array.isArray(report.models)) throw new Error("Invalid usage model rows; retry after checking the runtime.");
   const models = report.models.map((raw: unknown): SearchableModel => {
     if (!raw || typeof raw !== "object" || Array.isArray(raw)) throw new Error("Invalid usage model row.");
@@ -53,6 +53,6 @@ export function selectUsageModelView<T extends { models?: unknown }>(report: T,
   const matching = models.toSorted((a, b) => b.totalTokens - a.totalTokens).filter(row => !query
     || row.model.toLowerCase().includes(query) || row.provider.toLowerCase().includes(query)
     || (row.resolvedModel ?? "").toLowerCase().includes(query));
-  const selected = matching.slice(0, 100);
-  return { ...report, models: selected, modelView: { query, matchedModelCount: matching.length, returnedModelCount: selected.length, limit: 100, truncated: matching.length > selected.length } };
+  const selected = matching.slice(0, limit);
+  return { ...report, models: selected, modelView: { query, matchedModelCount: matching.length, returnedModelCount: selected.length, limit, truncated: matching.length > selected.length } };
 }

package/src/cli/usage-report.ts

@@ -113,7 +113,7 @@ function describeScope(data: UsageReportInput): string {
   return terminalText(parts.join(", "));
 }
 
-export function formatUsageReport(data: UsageReportInput, options?: { modelView?: UsageModelView }): string[] {
+export function formatUsageReport(data: UsageReportInput, options?: { modelView?: UsageModelView; modelRowLimit?: number }): string[] {
   const summary = data.summary ?? {};
   const lines: string[] = [describeScope(data), ""];
   if (data.source === "hub" && data.scope === "client") {
@@ -192,7 +192,7 @@ export function formatUsageReport(data: UsageReportInput, options?: { modelView?
   const models = view ? (data.models ?? []) : (data.models ?? []).filter(row => row.requests > 0);
   if (models.length > 0) {
     lines.push("");
-    const shown = models.slice(0, view?.limit ?? MAX_MODEL_ROWS);
+    const shown = models.slice(0, view?.limit ?? options?.modelRowLimit ?? MAX_MODEL_ROWS);
     lines.push(...table(
       ["MODEL", "PROVIDER", "REQUESTS", "TOKENS", "EST. COST"],
       shown.map(row => [row.model ?? "-", row.provider, count(row.requests), count(row.totalTokens), usd(row.estimatedCostUsd)]),

package/src/cli/v2.ts

@@ -148,7 +148,7 @@ function printLocalStatus(deps: V2CliDeps): number {
     const modeHint = getMultiAgentModeHintText();
     log.log(`multi_agent_mode_hint_text: ${modeHint === null ? "(unset — effort-derived policy: ultra=proactive, else explicit)" : JSON.stringify(modeHint)}`);
     if (isEnabled() && hasMaxThreads()) {
-      log.log("WARNING: [agents] max_threads is set — codex refuses to start while multi_agent_v2 is enabled. Remove it from config.toml (concurrency lives in features.multi_agent_v2.max_concurrent_threads_per_session).");
+      log.log("WARNING: [agents] max_concurrent_threads_per_session / max_threads is set — codex refuses to start while multi_agent_v2 is enabled. Remove the agents limit from config.toml (concurrency lives in features.multi_agent_v2.max_concurrent_threads_per_session).");
     }
     return 0;
 }

package/src/client/machine-listener.ts

@@ -107,9 +107,7 @@ export function startMachineListener(
   const machineApiDeps: MachineApiDeps = {
     sync: deps.machineApi?.sync ?? syncConnectedClient,
     disconnect: deps.machineApi?.disconnect ?? disconnectClient,
-    scheduleStandaloneRecycle: deps.machineApi?.scheduleStandaloneRecycle ?? (tokenFingerprint => {
-      void import("./runtime").then(module => module.scheduleStandaloneRecycle(tokenFingerprint));
-    }),
+    scheduleStandaloneRecycle: deps.machineApi?.scheduleStandaloneRecycle ?? (() => {}),
     hubReachability: deps.machineApi?.hubReachability ?? (() => hubReachability),
     setHubReachability: deps.machineApi?.setHubReachability ?? (value => { hubReachability = value; }),
     ...(linkMode ? { linkHomeName: () => linkHomeName(connection, sidecarOrNull) } : {}),

package/src/client/runtime.ts

@@ -250,6 +250,7 @@ export async function bindClientListener(
     try {
       const server = startListener(port, {
         state: request.state,
+        machineApi: { scheduleStandaloneRecycle },
         ...(request.linkStatus ? { linkStatus: request.linkStatus } : {}),
         ...(request.linkKeySource ? { linkKeySource: request.linkKeySource } : {}),
         ...(request.linkTunnel ? { linkTunnel: request.linkTunnel } : {}),

package/src/clients/client-path.ts

@@ -0,0 +1,51 @@
+import { homedir } from "node:os";
+import { isAbsolute, join } from "node:path";
+import type { OpencodeLaunchEnv } from "./config-export/contracts";
+
+// Leaf owner of client path validation, shared by config-export and gentle-shell-path
+// without an import cycle between them.
+
+/**
+ * Expand `~` against the effective home; REFUSE anything still relative.
+ *
+ * A first attempt at this called `resolve()` and claimed the path would "mean
+ * the same thing next time". It does not: `resolve()` only anchors the current
+ * invocation, so applying from one directory and disabling from another still
+ * resolved two different files — the second reported "not applied" and left
+ * the managed block behind with nothing claiming it.
+ *
+ * There is no honest way to recover the other process's cwd, so a relative
+ * selector is refused at the boundary instead of being silently anchored to
+ * whichever directory we happened to start in. A `~` path IS stable, because
+ * it anchors to the effective home rather than the cwd.
+ */
+export class ClientPathError extends Error {}
+
+export function absoluteClientPath(raw: string, home: string, variable: string): string {
+  const trimmed = raw.trim();
+  if (trimmed === "~") return home;
+  if (trimmed.startsWith("~/") || trimmed.startsWith("~\\")) return join(home, trimmed.slice(2));
+  if (!isAbsolute(trimmed)) {
+    throw new ClientPathError(
+      `${variable} must be an absolute path or start with ~; "${trimmed}" depends on the working directory, `
+      + "so opencodex and the client would disagree about which file it names.",
+    );
+  }
+  return trimmed;
+}
+
+/**
+ * Pi resolves its agent directory from `PI_CODING_AGENT_DIR`, falling back to
+ * `~/.pi/agent`. `ompAgentDir` below already reads that variable — OMP is a Pi
+ * derivative — so Pi's own resolver honoring it is what makes the two agree
+ * rather than a new claim about Pi's contract.
+ *
+ * A relative override is refused for the same reason MCode's and ZCode's are: a
+ * background proxy and a foreground client can have different working
+ * directories, and would otherwise disagree about which file is named.
+ */
+export function piAgentDir(env: OpencodeLaunchEnv = process.env, home: string = homedir()): string {
+  const override = env.PI_CODING_AGENT_DIR?.trim();
+  if (override) return absoluteClientPath(override, home, "PI_CODING_AGENT_DIR");
+  return join(home, ".pi", "agent");
+}

package/src/clients/config-export/contracts.ts

@@ -220,7 +220,8 @@ export type ExportClientId =
   | "cline"
   | "commandcode"
   | "kilo"
-  | "droid";
+  | "droid"
+  | "gentle-shell";
 
 export interface ExportClientSpec {
   id: ExportClientId;

package/src/clients/config-export.ts

@@ -20,6 +20,9 @@
  * targeting it is the caller's explicit act.
  */
 import { homedir } from "node:os";
+import { gentleShellPaths } from "./gentle-shell-path";
+import { absoluteClientPath, ClientPathError, piAgentDir } from "./client-path";
+export { ClientPathError, piAgentDir } from "./client-path";
 import { existsSync, lstatSync, readFileSync, realpathSync, statSync } from "node:fs";
 import { basename, dirname, isAbsolute, join, resolve, win32 } from "node:path";
 import { shouldInjectApiAuthHeader, standaloneCodexRoutingTarget } from "../codex/inject";
@@ -213,21 +216,6 @@ function ompProfileName(env: OpencodeLaunchEnv): string | undefined {
   return profile;
 }
 
-/**
- * Pi resolves its agent directory from `PI_CODING_AGENT_DIR`, falling back to
- * `~/.pi/agent`. `ompAgentDir` below already reads that variable — OMP is a Pi
- * derivative — so Pi's own resolver honoring it is what makes the two agree
- * rather than a new claim about Pi's contract.
- *
- * A relative override is refused for the same reason MCode's and ZCode's are: a
- * background proxy and a foreground client can have different working
- * directories, and would otherwise disagree about which file is named.
- */
-export function piAgentDir(env: OpencodeLaunchEnv = process.env, home: string = homedir()): string {
-  const override = env.PI_CODING_AGENT_DIR?.trim();
-  if (override) return absoluteClientPath(override, home, "PI_CODING_AGENT_DIR");
-  return join(home, ".pi", "agent");
-}
 
 /** Pi's canonical custom-provider catalog. */
 export function piConfigPath(env: OpencodeLaunchEnv = process.env, home: string = homedir()): string {
@@ -289,35 +277,6 @@ export function hermesConfigPath(env: OpencodeLaunchEnv = process.env, home: str
   return join(hermesHomeDir(env, home), "config.yaml");
 }
 
-/**
- * Expand `~` against the effective home; REFUSE anything still relative.
- *
- * A first attempt at this called `resolve()` and claimed the path would "mean
- * the same thing next time". It does not: `resolve()` only anchors the current
- * invocation, so applying from one directory and disabling from another still
- * resolved two different files — the second reported "not applied" and left
- * the managed block behind with nothing claiming it.
- *
- * There is no honest way to recover the other process's cwd, so a relative
- * selector is refused at the boundary instead of being silently anchored to
- * whichever directory we happened to start in. A `~` path IS stable, because
- * it anchors to the effective home rather than the cwd.
- */
-export class ClientPathError extends Error {}
-
-function absoluteClientPath(raw: string, home: string, variable: string): string {
-  const trimmed = raw.trim();
-  if (trimmed === "~") return home;
-  if (trimmed.startsWith("~/") || trimmed.startsWith("~\\")) return join(home, trimmed.slice(2));
-  if (!isAbsolute(trimmed)) {
-    throw new ClientPathError(
-      `${variable} must be an absolute path or start with ~; "${trimmed}" depends on the working directory, `
-      + "so opencodex and the client would disagree about which file it names.",
-    );
-  }
-  return trimmed;
-}
-
 /**
  * OpenClaw's EFFECTIVE home: `OPENCLAW_HOME` outranks the OS home.
  *
@@ -1711,6 +1670,21 @@ export const EXPORT_CLIENTS: Record<ExportClientId, ExportClientSpec> = {
     buildContribution: buildDroidContribution,
     loopbackOnly: true,
   },
+  "gentle-shell": {
+    id: "gentle-shell",
+    filename: "gentle-shell-models.json",
+    destination: env => gentleShellPaths(env).configPath,
+    apiKeyEnv: "",
+    exportHint: "Gentle Shell uses its persistent selected home; restart the shell to load the catalog. Link/shared homes use the Pi integration.",
+    build: ctx => buildPiClientConfig(ctx, PI_EXPORT_OPTIONS),
+    format: "json",
+    summarize: summarizePi,
+    buildContribution: ctx => {
+      const doc = buildPiClientConfig(ctx, PI_EXPORT_OPTIONS);
+      return singleFragment("gentle-shell", ["providers", OPENCODE_PROVIDER_ID], doc.providers[OPENCODE_PROVIDER_ID]);
+    },
+    loopbackOnly: true,
+  },
 };
 
 export const EXPORT_CLIENT_IDS: readonly ExportClientId[] = Object.keys(EXPORT_CLIENTS) as ExportClientId[];

package/src/clients/gentle-shell-path.ts

@@ -0,0 +1,87 @@
+import { realpathSync, statSync } from "node:fs";
+import { homedir } from "node:os";
+import { basename, dirname, isAbsolute, join, resolve } from "node:path";
+import { readBoundedRegularFileSync } from "../lib/bounded-file-read";
+import { ClientPathError, piAgentDir } from "./client-path";
+
+interface BootstrapIO {
+  readText(path: string): { kind: "text"; text: string } | { kind: "missing" } | { kind: "failed" };
+}
+
+function absolute(raw: string, label: string): string {
+  // Unlike Pi's resolver, the Shell launcher does not expand a literal '~'.
+  if (!isAbsolute(raw)) throw new ClientPathError(`${label} must be an absolute path; the proxy cannot infer the launcher's working directory.`);
+  return resolve(raw);
+}
+
+function readBootstrap(path: string, io?: BootstrapIO): string | undefined {
+  try {
+    if (!io) return readBoundedRegularFileSync(path, 64 * 1024).toString("utf8");
+    const read = io.readText(path);
+    if (read.kind === "missing") return undefined;
+    if (read.kind === "text" && Buffer.byteLength(read.text, "utf8") <= 64 * 1024) return read.text;
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") return undefined;
+  }
+  throw new ClientPathError(`Cannot read Gentle Shell launcher config at ${path}; no catalog was selected.`);
+}
+
+/** Resolve existing ancestors too, so a not-yet-created catalog cannot hide a directory alias. */
+function canonical(path: string): string {
+  const missing: string[] = [];
+  let current = resolve(path);
+  for (;;) {
+    try {
+      const value = join(realpathSync.native(current), ...missing);
+      return process.platform === "win32" ? value.toLowerCase() : value;
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== "ENOENT" || dirname(current) === current) {
+        throw new ClientPathError(`Cannot verify Gentle Shell destination ${path}.`);
+      }
+      missing.unshift(basename(current));
+      current = dirname(current);
+    }
+  }
+}
+
+function sameFile(left: string, right: string): boolean {
+  if (canonical(left) === canonical(right)) return true;
+  // Hard-linked catalogs can have different canonical names but the same identity.
+  try {
+    const a = statSync(left, { bigint: true });
+    const b = statSync(right, { bigint: true });
+    return a.ino !== 0n && a.dev === b.dev && a.ino === b.ino;
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") return false;
+    throw new ClientPathError("Cannot verify Gentle Shell and Pi catalog identities.");
+  }
+}
+
+/** Persistent selectors only: a proxy cannot observe one-off `gentle-shell --home` flags. */
+export function gentleShellPaths(
+  env: NodeJS.ProcessEnv = process.env,
+  home: string = homedir(),
+  io?: BootstrapIO,
+): { configPath: string; detectDir: string } {
+  const config = env.GENTLE_SHELL_CONFIG
+    ? absolute(env.GENTLE_SHELL_CONFIG, "GENTLE_SHELL_CONFIG")
+    : join(home, ".gentle-shell", "config.json");
+  const text = readBootstrap(config, io);
+  let selector: unknown;
+  try {
+    const parsed: unknown = text === undefined ? undefined : JSON.parse(text);
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) selector = (parsed as Record<string, unknown>).home;
+  } catch { /* The launcher also falls back to isolated for malformed JSON. */ }
+  const shared = "Gentle Shell uses a Pi destination; use the Pi integration for link/shared homes.";
+  if (selector === "link") throw new ClientPathError(shared);
+  const dir = typeof selector === "string" && selector.length > 0 && selector !== "isolated"
+    ? absolute(selector, "Gentle Shell saved home")
+    : env.GENTLE_SHELL_HOME
+      ? absolute(env.GENTLE_SHELL_HOME, "GENTLE_SHELL_HOME")
+      : join(home, ".gentle-shell", "agent");
+  const configPath = join(dir, "models.json");
+  const piHomes = [join(home, ".pi", "agent"), piAgentDir(env, home)];
+  if (env.GENTLE_SHELL_USER_PI_HOME) piHomes.push(absolute(env.GENTLE_SHELL_USER_PI_HOME, "GENTLE_SHELL_USER_PI_HOME"));
+  if (piHomes.some(pi => sameFile(configPath, join(pi, "models.json")))) throw new ClientPathError(shared);
+  return { configPath, detectDir: dir };
+}

package/src/codex/account-auto-switch.ts

@@ -1,6 +1,7 @@
 import type { OcxConfig } from "../types";
 import { deleteConfigObjectChildKey } from "../config/rebase-provenance";
 import { isValidCodexAccountId, MAIN_CODEX_ACCOUNT_ID } from "./account-id";
+import { codexAccountUsesRemainingQuota } from "./account-use-remaining";
 
 export const DEFAULT_CODEX_AUTO_SWITCH_THRESHOLD = 80;
 export const MIN_CODEX_AUTO_SWITCH_THRESHOLD = 0;
@@ -34,6 +35,7 @@ export function getEffectiveCodexAutoSwitchThreshold(
   config: OcxConfig,
   accountId: string,
 ): number {
+  if (codexAccountUsesRemainingQuota(config, accountId)) return 0;
   const override = getCodexAccountAutoSwitchThresholdOverride(config, accountId);
   if (override !== null) return override;
   return config.autoSwitchThreshold ?? DEFAULT_CODEX_AUTO_SWITCH_THRESHOLD;

package/src/codex/account-identity.ts

@@ -0,0 +1,29 @@
+import type { OcxConfig } from "../types";
+import { codexLoginIdentity as identity, codexTokenIdentity, type CodexLoginIdentity } from "./signed-in-identity";
+import { MAIN_CODEX_ACCOUNT_ID, isSelectableCodexPoolAccount } from "./account-id";
+import type { CodexTokenReadResult } from "./auth-collision";
+import { getCodexAccountCredential } from "./account-store";
+
+/** Match existing entries from an already-owned main observation, without exposing identity fields. */
+export function linkedCodexAccountIds(config: OcxConfig, selectedId: string, main: CodexTokenReadResult | { status: "api-key-only" }): string[] | undefined {
+  // Unknown main identity must not produce a successful but incomplete pause.
+  if (main.status === "unreadable" || main.status === "invalid") return undefined;
+  const identities = new Map<string, CodexLoginIdentity | undefined>();
+  if (main.status === "ok") {
+    const selected = codexTokenIdentity(main.tokens);
+    if (selected === null) return undefined;
+    identities.set(MAIN_CODEX_ACCOUNT_ID, selected);
+  }
+  for (const account of config.codexAccounts ?? []) {
+    if (!isSelectableCodexPoolAccount(account)) continue;
+    const credential = getCodexAccountCredential(account.id);
+    identities.set(account.id, identity(credential?.chatgptAccountId, account.email));
+  }
+  const selected = identities.get(selectedId);
+  // Missing identity evidence never links unrelated logins, including members of one workspace.
+  if (!selected) return [selectedId];
+  return [selectedId, ...[...identities].flatMap(([id, candidate]) => (
+    id !== selectedId && candidate?.accountId === selected.accountId && candidate.email === selected.email
+      ? [id] : []
+  ))];
+}

package/src/codex/account-label.ts

@@ -2,7 +2,7 @@ import { createHash, randomBytes } from "node:crypto";
 import type { CodexAccount, OcxConfig } from "../types";
 import type { CodexAuthContext } from "./auth-context";
 import type { ProviderApiKeySelection } from "../types/provider";
-import { MAIN_CODEX_ACCOUNT_ID } from "./main-account";
+import { MAIN_CODEX_ACCOUNT_ID } from "./account-id";
 
 export const CODEX_ACCOUNT_LOG_LABEL_RE = /^p[a-f0-9]{6}$/;
 

package/src/codex/account-lifecycle.ts

@@ -1,3 +1,4 @@
+import { observeSignedInCodexIdentity } from "./signed-in-identity";
 import { existsSync, readFileSync } from "node:fs";
 import {
   deleteConfigTopLevelKey,
@@ -8,17 +9,20 @@ import {
 import { captureConfigTopLevelRollback } from "../config/rebase-provenance";
 import { removeCodexAccountCredential } from "./account-store";
 import { clearAccountNeedsReauth } from "./account-runtime-state";
-import { getMainChatgptAccountId, readCodexTokensResult } from "./auth-collision";
+import { readCodexTokensResult } from "./auth-collision";
 import { MAIN_CODEX_ACCOUNT_ID, setMainAccountPlan } from "./main-account";
 import { clearAccountQuota } from "./quota";
-import { clearCodexUpstreamHealthForAccount, clearThreadAccountMapForAccount } from "./routing";
+import { forgetManualPreference } from "./routing/active-account";
+import { deleteAllHealthForAccount } from "./routing/health-store";
+import { clearThreadAccountMapForAccount } from "./routing/thread-affinity";
 
 import { clearCodexPoolRefreshFailure } from "./pool-refresh-backoff";
 import { invalidateCodexWebSocketsForAccount } from "./websocket-registry";
 import { clearMainAccountCredentialPresence, clearMainAccountInfoCache, observeMainQuotaCredential, observeMainQuotaIdentity } from "./main-account-cache";
-import { extractAccountIdClaims } from "../oauth/chatgpt";
+import { extractAccountId, extractAccountIdClaims } from "../oauth/chatgpt";
 import { forgetCodexAccountPause } from "./account-pause";
 import { forgetCodexAccountCreditUse } from "./account-credit-use";
+import { setCodexAccountUseRemainingQuota } from "./account-use-remaining";
 import { clearCodexAccountPin, forgetCodexAccountPriority } from "./account-priority";
 import { forgetCodexQuotaAutoRefreshAccount } from "./quota-auto-refresh-state";
 import { forgetCodexAccountAutoSwitchThreshold } from "./account-auto-switch";
@@ -45,7 +49,11 @@ export function purgeCodexAccountRuntimeState(accountId: string): void {
   clearAccountNeedsReauth(accountId);
   clearAccountQuota(accountId);
   clearThreadAccountMapForAccount(accountId);
-  clearCodexUpstreamHealthForAccount(accountId);
+  // Deliberately not via `./routing`: the account-delete path only needs the health rows and
+  // the manual preference gone, and importing the router here closed a cycle through
+  // routing/health-store and routing/active-account.
+  deleteAllHealthForAccount(accountId);
+  forgetManualPreference(accountId);
   clearCodexPoolRefreshFailure(accountId);
   if (accountId === MAIN_CODEX_ACCOUNT_ID) {
     clearMainAccountInfoCache();
@@ -66,7 +74,11 @@ function purgeMainCodexAccountRuntimeState(): void {
  * cooldown, quota, reauth, and thread affinity do not leak across accounts.
  */
 export function reconcileMainCodexAccountRuntimeState(): boolean {
-  const currentAccountId = getMainChatgptAccountId();
+  const read = readCodexTokensResult();
+  const currentAccountId = read.status === "ok"
+    ? extractAccountId(read.tokens.id_token, read.tokens.access_token) ?? (read.tokens.account_id || null)
+    : null;
+  if (read.status === "ok") observeSignedInCodexIdentity(read.tokens);
   // A missing/malformed auth.json is an unknown identity, not a confirmed account switch. Keep the
   // prior observation and its safety state until a real account id can be read again.
   if (currentAccountId === null) return false;
@@ -110,6 +122,7 @@ export function initializeMainAccountPolicyBinding(authPath: string): boolean {
   const previousAccountId = observedMainChatgptAccountId;
   observedMainChatgptAccountId = accountId;
   if (previousAccountId !== undefined && previousAccountId !== accountId) purgeMainCodexAccountRuntimeState();
+  observeSignedInCodexIdentity(tokens);
   observeMainQuotaIdentity(accountId);
   return observeMainQuotaCredential(tokens.access_token, accountId) !== undefined;
 }
@@ -122,6 +135,7 @@ export function applyConfirmedMainCodexAccountTransition(
   fromAccountId: string,
   toAccountId: string,
 ): boolean {
+  observeSignedInCodexIdentity();
   if (!fromAccountId || !toAccountId || fromAccountId === toAccountId) {
     if (toAccountId) {
       observedMainChatgptAccountId = toAccountId;
@@ -137,6 +151,7 @@ export function applyConfirmedMainCodexAccountTransition(
 
 export function resetMainCodexAccountIdentityTrackingForTests(): void {
   observedMainChatgptAccountId = undefined;
+  observeSignedInCodexIdentity();
   clearMainAccountCredentialPresence();
 }
 
@@ -183,6 +198,7 @@ export function deleteCodexAccount(runtimeConfig: OcxConfig, accountId: string):
     forgetCodexAccountCreditUse(runtimeConfig, accountId);
     forgetCodexAccountPriority(runtimeConfig, accountId);
     forgetCodexAccountAutoSwitchThreshold(runtimeConfig, accountId);
+    setCodexAccountUseRemainingQuota(runtimeConfig, accountId, false);
     if (runtimeConfig.codexQuotaAutoRefresh?.[accountId]) {
       const retained = { ...runtimeConfig.codexQuotaAutoRefresh };
       delete retained[accountId];

package/src/codex/account-preservation.ts

@@ -0,0 +1,28 @@
+import type { OcxConfig } from "../types";
+import { MAIN_CODEX_ACCOUNT_ID, isSelectableCodexPoolAccount } from "./account-id";
+import { getCodexAccountCredential } from "./account-store";
+import { codexAccountPriorityLookup } from "./account-priority";
+import { MIN_ACCOUNT_PRIORITY, MAX_ACCOUNT_PRIORITY } from "./pool-rotation";
+import { codexLoginIdentity, getSignedInCodexIdentity, sameCodexLogin } from "./signed-in-identity";
+
+/** Resolve current rows afresh: a pool replacement must not inherit the prior login's role. */
+export function signedInCodexAccountIds(config: OcxConfig): ReadonlySet<string> {
+  const ids = new Set([MAIN_CODEX_ACCOUNT_ID]);
+  const main = getSignedInCodexIdentity();
+  if (!main) return ids;
+  for (const account of config.codexAccounts ?? []) {
+    if (!isSelectableCodexPoolAccount(account)) continue;
+    const credential = getCodexAccountCredential(account.id);
+    if (sameCodexLogin(main, codexLoginIdentity(credential?.chatgptAccountId, account.email))) ids.add(account.id);
+  }
+  return ids;
+}
+
+/** Two disjoint bands, preserving custom order inside each; never writes the stored priorities. */
+export function codexSelectionPriorityLookup(config: OcxConfig): (id: string) => number {
+  const priority = codexAccountPriorityLookup(config);
+  if (config.codexPreserveSignedInAccount !== true) return priority;
+  const reserved = signedInCodexAccountIds(config);
+  const band = MAX_ACCOUNT_PRIORITY - MIN_ACCOUNT_PRIORITY + 1;
+  return id => priority(id) - (reserved.has(id) ? band : 0);
+}

package/src/codex/account-use-remaining.ts

@@ -0,0 +1,23 @@
+import type { OcxConfig } from "../types";
+import { deleteConfigTopLevelKey } from "../config/rebase-provenance";
+import { isValidCodexAccountId, MAIN_CODEX_ACCOUNT_ID } from "./account-id";
+
+type Policy = Pick<OcxConfig, "codexUseRemainingQuotaAccountIds">;
+
+/** Included-quota preference only; never grants permission to spend credits. */
+export function codexAccountUsesRemainingQuota(config: Policy | undefined, accountId: string): boolean {
+  return config?.codexUseRemainingQuotaAccountIds?.includes(accountId) ?? false;
+}
+
+export function validRemainingQuotaAccountIds(value: unknown): value is string[] {
+  return Array.isArray(value) && value.every(id => id === MAIN_CODEX_ACCOUNT_ID || isValidCodexAccountId(id));
+}
+
+/** Preserve the underlying thresholds so turning this off restores their current values. */
+export function setCodexAccountUseRemainingQuota(config: OcxConfig, accountId: string, enabled: boolean): void {
+  const ids = new Set(config.codexUseRemainingQuotaAccountIds ?? []);
+  if (enabled) ids.add(accountId);
+  else ids.delete(accountId);
+  if (ids.size) config.codexUseRemainingQuotaAccountIds = [...ids];
+  else deleteConfigTopLevelKey(config, "codexUseRemainingQuotaAccountIds");
+}