@bitkyc08/opencodex 2.88.0 → 2.90.0

package/src/oauth/account-auto-pause.ts

@@ -0,0 +1,171 @@
+import { captureAccountAutoPauseFence, accountAutoPauseFenceIsLocal, accountAutoPauseFenceMatchesDisk } from "../config/account-auto-pause-revisions";
+import type { OcxConfig, OcxProviderConfig } from "../types";
+import type { OAuthAccessSnapshot } from "./index";
+import type { CodexAuthContext } from "../codex/auth-context";
+import type { AccountPauseReason } from "../types/account-auto-pause";
+import { credentialGeneration, getAccountSet, setAccountPaused } from "./store";
+import { mutatePersistedConfig } from "../config";
+import { isCodexAccountGenerationLive, readCodexAccountRecord } from "../codex/account-store";
+import { captureMainQuotaDispatch, isMainQuotaDispatchLive } from "../codex/main-account-cache";
+import { isCodexAccountPaused, setCodexAccountPaused } from "../codex/account-pause";
+import { apiKeyPoolEntryId } from "../providers/api-keys";
+import { resolveProviderApiKey } from "../providers/api-key-resolve";
+import { createHash } from "node:crypto";
+import { setProviderApiKeyPaused } from "../providers/api-key-pause";
+import { AccountRefusalStreaks, autoPauseThreshold, permanentAccountRefusal } from "./account-auto-pause-policy";
+import { clearThreadAccountMapForAccount, reconcileCodexActiveAfterExclusion } from "../codex/routing";
+import { isNonReplayableResponse } from "../lib/upstream-retry";
+import { hasUpstreamRewriters, upstreamRewriterEpoch } from "../plugins/upstream-hooks";
+
+const streaks = new WeakMap<OcxConfig, AccountRefusalStreaks>();
+export { wasAccountAutoPaused, wasPermanentAccountRefusal } from "../lib/account-auto-pause-response";
+import { markAccountAutoPaused, markPermanentAccountRefusal } from "../lib/account-auto-pause-response";
+export interface AccountAutoPauseBinding {
+  config: OcxConfig;
+  oauth?: OAuthAccessSnapshot;
+  codex?: CodexAuthContext;
+}
+
+/** Capture before transport. A later response cannot acquire authority over a newer login/resume. */
+export type AccountAutoPauseObserver = ((response: Response) => Promise<Response>) & {
+  /** Final-send report: only a response whose wire credential and destination match is counted. */
+  physical: (sameDestination: boolean, headers: Headers) => void;
+};
+const CREDENTIAL_HEADERS = ["authorization", "x-api-key", "x-goog-api-key", "api-key"] as const;
+const CODEX_SELECTOR_HEADERS = ["openai-organization", "openai-project"] as const;
+// Nested capture sites (a providerFetch observer around a dispatchOverride's own observer) see the
+// same physical response. It counts once per account, and a response whose final send was reported
+// to any observer is never attributed by an observer that received no report.
+const countedResponses = new WeakMap<Response, Set<string>>();
+const reportedResponses = new WeakSet<Response>();
+export function captureAccountAutoPauseAttempt(name: string, provider: OcxProviderConfig, binding?: AccountAutoPauseBinding, headers?: Headers):
+  AccountAutoPauseObserver | undefined {
+  if (!binding) return;
+  const { config, oauth, codex } = binding;
+  const threshold = autoPauseThreshold(config.providers[name]?.accountAutoPause);
+  if (!threshold) return;
+  const configured = config.providers[name];
+  if (!configured || configured.disabled) return;
+  const fence = captureAccountAutoPauseFence(config, name);
+  if (!fence) return;
+  const route = JSON.stringify([configured.baseUrl, configured.adapter, configured.authMode]);
+  const policyCurrent = () => accountAutoPauseFenceIsLocal(name, fence) && !config.providers[name]?.disabled
+    && autoPauseThreshold(config.providers[name]?.accountAutoPause) === threshold
+    && JSON.stringify([config.providers[name]?.baseUrl, config.providers[name]?.adapter, config.providers[name]?.authMode]) === route;
+  let key: string, incarnation: string, current: () => boolean, owns: (wire: Headers) => boolean;
+  let pause: (reason: AccountPauseReason) => Promise<boolean>;
+  if (provider.authMode === "oauth") {
+    if (!oauth || oauth.provider !== name || headers?.get("authorization") !== `Bearer ${oauth.accessToken}` || headers.has("x-api-key")) return;
+    const row = getAccountSet(name)?.accounts.find(a => a.id === oauth.accountId);
+    if (!row || row.paused || credentialGeneration(row.credential) !== oauth.generation) return;
+    const revision = row.pauseRevision;
+    owns = wire => wire.get("authorization") === `Bearer ${oauth.accessToken}` && !wire.has("x-api-key");
+    key = `${name}\0oauth\0${oauth.accountId}`;
+    incarnation = `${row.loginId ?? row.addedAt ?? oauth.accountId}\0${revision ?? ""}`;
+    current = () => {
+      const live = getAccountSet(name)?.accounts.find(a => a.id === oauth.accountId);
+      return !!live && !live.paused && live.pauseRevision === revision && credentialGeneration(live.credential) === oauth.generation;
+    };
+    pause = async reason => (await setAccountPaused(name, oauth.accountId, true, {
+      generation: oauth.generation, pauseRevision: revision, isCurrent: policyCurrent,
+      assertPolicyBeforePersist: () => { if (!accountAutoPauseFenceMatchesDisk(name, fence)) throw new Error("Account auto-pause policy changed before persistence"); }, details: { reason, pausedAt: Date.now() },
+    })).status === "updated";
+  } else if (provider.authMode === "forward") {
+    if (!codex || codex.kind !== "pool" && codex.kind !== "main-pool") return;
+    const { accountId } = codex;
+    // The bearer and the workspace together name the Codex account; organization/project selectors
+    // must stay as captured, so a rewrite that keeps the bearer cannot redirect the refusal.
+    const selectors = CODEX_SELECTOR_HEADERS.map(header => headers?.get(header) ?? null);
+    const codexOwns = (wire: Headers) => wire.get("authorization") === `Bearer ${codex.accessToken}`
+      && wire.get("chatgpt-account-id") === codex.chatgptAccountId
+      && CODEX_SELECTOR_HEADERS.every((header, index) => wire.get(header) === selectors[index]);
+    if (!headers || !codexOwns(headers)) return;
+    owns = codexOwns;
+    const revision = config.codexAccountPauseState?.[accountId]?.revision;
+    const mainDispatch = codex.kind === "main-pool" ? captureMainQuotaDispatch(codex.accessToken, codex.chatgptAccountId, codex.writerGeneration) : undefined;
+    const credentialCurrent = () => codex.kind === "pool"
+      ? isCodexAccountGenerationLive(accountId, codex.generation)
+      : !!mainDispatch && isMainQuotaDispatchLive(mainDispatch);
+    key = `${name}\0codex\0${accountId}`;
+    incarnation = `${codex.kind === "pool" ? readCodexAccountRecord(accountId)?.quotaHistoryIdentity ?? codex.generation : mainDispatch?.credentialGeneration}\0${revision ?? ""}`;
+    current = () => !isCodexAccountPaused(config, accountId)
+      && config.codexAccountPauseState?.[accountId]?.revision === revision && credentialCurrent();
+    pause = async reason => {
+      let pauseState: OcxConfig["codexAccountPauseState"];
+      const outcome = mutatePersistedConfig(fresh => {
+        if (!policyCurrent() || !accountAutoPauseFenceMatchesDisk(name, fence, fresh) || !credentialCurrent() || isCodexAccountPaused(fresh, accountId)
+          || fresh.codexAccountPauseState?.[accountId]?.revision !== revision
+          || autoPauseThreshold(fresh.providers[name]?.accountAutoPause) !== threshold) return { changed: false, value: false };
+        setCodexAccountPaused(fresh, accountId, true, { reason, pausedAt: Date.now() });
+        pauseState = structuredClone(fresh.codexAccountPauseState);
+        return { changed: true, value: true };
+      });
+      if (outcome.status !== "committed" || !outcome.value) return false;
+      config.pausedCodexAccountIds = [...new Set([...(config.pausedCodexAccountIds ?? []), accountId])];
+      config.codexAccountPauseState = pauseState;
+      clearThreadAccountMapForAccount(accountId);
+      reconcileCodexActiveAfterExclusion(config, accountId);
+      return true;
+    };
+  } else {
+    const selection = provider._apiKeyAttempt;
+    if (!headers || !provider.apiKey || ![headers.get("authorization"), headers.get("x-api-key"), headers.get("x-goog-api-key")].some(value => value === provider.apiKey || value === `Bearer ${provider.apiKey}`)) return;
+    const entry = configured.apiKeyPool?.find(e => e.id === selection?.entryId && e.key === selection.reference)
+      ?? (!configured.apiKeyPool?.length && configured.apiKey ? { id: apiKeyPoolEntryId(configured.apiKey), key: configured.apiKey, disabled: false, pauseRevision: undefined } : undefined);
+    if (!entry || entry.disabled || !selection) return;
+    const { id, key: reference, pauseRevision } = entry;
+    key = `${name}\0key\0${id}`;
+    const resolvedKey = provider.apiKey;
+    owns = wire => {
+      const sent = CREDENTIAL_HEADERS.map(header => wire.get(header)).filter((value): value is string => value !== null);
+      return sent.length > 0 && sent.every(value => value === resolvedKey || value === `Bearer ${resolvedKey}`);
+    };
+    incarnation = `${createHash("sha256").update(resolvedKey).digest("hex")}\0${pauseRevision ?? ""}`;
+    current = () => {
+      const configured = config.providers[name];
+      const live = configured?.apiKeyPool?.find(e => e.id === id) ?? (!configured?.apiKeyPool?.length && configured?.apiKey === reference ? entry : undefined);
+      return !!live && !live.disabled && live.key === reference && live.pauseRevision === pauseRevision && resolveProviderApiKey(reference) === resolvedKey;
+    };
+    pause = async reason => setProviderApiKeyPaused(config, name, id, true, {
+      selection, pauseRevision, resolvedKey, fence, details: { reason, pausedAt: Date.now() },
+    });
+  }
+  incarnation += `\0${fence.diskRevision}\0${fence.localGen}`;
+  let tracker = streaks.get(config);
+  if (!tracker) { tracker = new AccountRefusalStreaks(); streaks.set(config, tracker); }
+  const observed = new WeakSet<Response>();
+  // undefined: no HTTP final-send report (Codex WebSocket). Such a send is attributable only when
+  // no rewriter was registered at capture and none was registered or removed before the response,
+  // so no plugin could have rewritten the dial in between.
+  const rewriterEpoch = hasUpstreamRewriters() ? undefined : upstreamRewriterEpoch();
+  let wireOwned: boolean | undefined;
+  const observer = (async (response: Response) => {
+    if (observed.has(response) || isNonReplayableResponse(response)) return response;
+    observed.add(response);
+    if (wireOwned !== undefined) reportedResponses.add(response);
+    else if (reportedResponses.has(response)) return response;
+    if (!(wireOwned ?? (rewriterEpoch !== undefined && upstreamRewriterEpoch() === rewriterEpoch))) return response;
+    const counted = countedResponses.get(response) ?? new Set<string>();
+    if (counted.has(key)) return response;
+    countedResponses.set(response, counted.add(key));
+    try {
+      const verdict = permanentAccountRefusal(response).then(reason => {
+        if (reason) markPermanentAccountRefusal(response);
+        return reason;
+      });
+      const paused = await tracker.observe(key, incarnation, threshold, verdict, response.ok,
+        () => policyCurrent() && current(), pause);
+      if (paused) {
+        markAccountAutoPaused(response);
+        // Fixed codes only. Never print the upstream body, provider label, or account identifier.
+        console.warn(`[account-auto-pause] paused after ${threshold} consecutive permanent account refusals`);
+      }
+    } catch {
+      // Optional persistence must preserve the original provider response.
+      console.warn("[account-auto-pause] could not persist account pause; upstream response preserved");
+    }
+    return response;
+  }) as AccountAutoPauseObserver;
+  observer.physical = (sameDestination, wire) => { wireOwned = sameDestination && owns(wire); };
+  return observer;
+}

package/src/oauth/account-import/google-antigravity-adapter.ts

@@ -1,6 +1,7 @@
 import { validateAntigravityImportCredential } from "../google-antigravity";
 import { upsertCredentialByIdentity } from "../store";
 import type { OAuthCredentials } from "../types";
+import { probeAntigravityUsageQuota } from "../../providers/quota/antigravity";
 import {
   ACCOUNT_IMPORT_FORMAT,
   ACCOUNT_IMPORT_MAX_EMAIL_LENGTH,
@@ -14,6 +15,26 @@ import {
 export interface AntigravityImportAdapterDeps {
   validate(refreshToken: string, signal?: AbortSignal): Promise<ValidatedAntigravityCredential>;
   upsert(credential: OAuthCredentials): Promise<"inserted" | "updated">;
+  /**
+   * Prove that the freshly validated account token can use an operator-supplied project.
+   * Without this owner a fallback project is never admitted.
+   */
+  verifyProject?(accessToken: string, projectId: string, signal?: AbortSignal): Promise<boolean>;
+}
+
+/**
+ * The account-bound admission probe for a fallback project: the same Cloud Code Assist quota
+ * probe the account pool runs, authenticated with this account's own access token against the
+ * named project. Only a parsed quota answer admits it; denial, rate limiting, transport failure
+ * or an unusable body all keep the record out.
+ */
+export async function verifyAntigravityImportProject(accessToken: string, projectId: string, signal?: AbortSignal): Promise<boolean> {
+  if (signal?.aborted) return false;
+  try {
+    return (await probeAntigravityUsageQuota(accessToken, projectId, signal)).kind === "available" && !signal?.aborted;
+  } catch {
+    return false;
+  }
 }
 
 function safeProviderEmail(value: unknown): string | null {
@@ -32,6 +53,7 @@ export function createAntigravityAccountImportAdapter(
   deps: AntigravityImportAdapterDeps = {
     validate: validateAntigravityImportCredential,
     upsert: credential => upsertCredentialByIdentity(ACCOUNT_IMPORT_PROVIDER, credential),
+    verifyProject: verifyAntigravityImportProject,
   },
 ): AccountImportAdapter {
   return {
@@ -52,15 +74,29 @@ export function createAntigravityAccountImportAdapter(
       const providerEmail = safeProviderEmail(credential.email);
       if (!providerEmail) return { status: "failed", code: "credential_rejected" };
       if (providerEmail !== record.email) return { status: "failed", code: "identity_mismatch" };
-      if (typeof credential.projectId !== "string" || credential.projectId.length === 0) {
-        return { status: "failed", code: "missing_project" };
+      // Automatic discovery wins: a discovered project is used as-is and the record's project_id
+      // is ignored. The record's project is a fallback only, admitted after an account-bound probe.
+      let projectId = typeof credential.projectId === "string" && credential.projectId.length > 0
+        ? credential.projectId
+        : undefined;
+      if (!projectId && record.projectId && deps.verifyProject) {
+        let admitted = false;
+        try {
+          admitted = await deps.verifyProject(credential.access, record.projectId, signal);
+        } catch {
+          admitted = false;
+        }
+        throwIfAccountImportAborted(signal);
+        if (admitted) projectId = record.projectId;
       }
+      if (!projectId) return { status: "failed", code: "missing_project" };
 
       throwIfAccountImportAborted(signal);
       try {
         const disposition = await deps.upsert({
           ...credential,
           email: providerEmail,
+          projectId,
           source: "credential-file",
         });
         return disposition === "updated"

package/src/oauth/account-import/parser.ts

@@ -1,13 +1,17 @@
 import {
   ACCOUNT_IMPORT_MAX_BYTES,
   ACCOUNT_IMPORT_MAX_EMAIL_LENGTH,
+  ACCOUNT_IMPORT_MAX_PROJECT_ID_LENGTH,
   ACCOUNT_IMPORT_MAX_RECORDS,
   ACCOUNT_IMPORT_MAX_REFRESH_TOKEN_BYTES,
   type ParsedCockpitRecord,
 } from "./types";
 
 const encoder = new TextEncoder();
-const ALLOWED_RECORD_KEYS = new Set(["email", "refresh_token", "tags", "notes"]);
+const ALLOWED_RECORD_KEYS = new Set(["email", "refresh_token", "project_id", "tags", "notes"]);
+// Google Cloud project id grammar: a lowercase letter, then lowercase letters, digits or hyphens,
+// not ending in a hyphen. Exact match only — no trimming, so whitespace or controls are rejected.
+const PROJECT_ID_SHAPE = /^[a-z][a-z0-9-]*[a-z0-9]$/;
 
 export type CockpitDocumentParseResult =
   | { ok: true; records: ParsedCockpitRecord[] }
@@ -50,10 +54,18 @@ function validMetadata(record: Record<string, unknown>): boolean {
   return record.notes === undefined || typeof record.notes === "string";
 }
 
+function validProjectId(value: unknown): value is string | undefined {
+  if (value === undefined) return true;
+  return typeof value === "string"
+    && value.length >= 6
+    && value.length <= ACCOUNT_IMPORT_MAX_PROJECT_ID_LENGTH
+    && PROJECT_ID_SHAPE.test(value);
+}
+
 function parseRecord(value: unknown, index: number): ParsedCockpitRecord {
   if (!isPlainRecord(value)) return { index, code: "invalid_record" };
   if (Object.keys(value).some(key => !ALLOWED_RECORD_KEYS.has(key))) return { index, code: "invalid_record" };
-  if (!validEmail(value.email) || !validRefreshToken(value.refresh_token) || !validMetadata(value)) {
+  if (!validEmail(value.email) || !validRefreshToken(value.refresh_token) || !validProjectId(value.project_id) || !validMetadata(value)) {
     return { index, code: "invalid_record" };
   }
   return {
@@ -61,6 +73,7 @@ function parseRecord(value: unknown, index: number): ParsedCockpitRecord {
     record: {
       email: value.email.toLowerCase(),
       refreshToken: value.refresh_token,
+      ...(typeof value.project_id === "string" ? { projectId: value.project_id } : {}),
     },
   };
 }

package/src/oauth/account-import/types.ts

@@ -11,6 +11,8 @@ export const ACCOUNT_IMPORT_MAX_REQUEST_BYTES = ACCOUNT_IMPORT_MAX_BYTES + 1024;
 export const ACCOUNT_IMPORT_DEADLINE_MS = 600_000;
 export const ACCOUNT_IMPORT_MAX_RECORDS = 25;
 export const ACCOUNT_IMPORT_MAX_EMAIL_LENGTH = 254;
+/** Google Cloud project ids are 6–30 characters; anything longer cannot name a project. */
+export const ACCOUNT_IMPORT_MAX_PROJECT_ID_LENGTH = 30;
 export const ACCOUNT_IMPORT_MAX_REFRESH_TOKEN_BYTES = 16 * 1024;
 
 export type AccountImportStatus = "imported" | "updated" | "failed" | "unsupported";
@@ -65,6 +67,11 @@ export function throwIfAccountImportAborted(signal?: AbortSignal): void {
 export interface CockpitAccountRecord {
   email: string;
   refreshToken: string;
+  /**
+   * Operator-supplied Cloud Code Assist project, used only when automatic discovery finds none
+   * and only after the account's own token proves it can use that project.
+   */
+  projectId?: string;
 }
 
 export type ParsedCockpitRecord =

package/src/oauth/account-quota-rank.ts

@@ -153,7 +153,8 @@ export function accountResetTimestamp(
   const quota = getCachedProviderAccountQuota(provider, accountId);
   if (!quota) return null;
   const family = classifyModelFamilyForQuota(provider, requestedModelId);
-  const windows = (quota.customWindows ?? []).filter(w => !family || windowMatchesFamily(w.label, family));
+  // Model-attributed rows are diagnostics; one must never become the account's reset time.
+  const windows = (quota.customWindows ?? []).filter(w => w.modelId === undefined && (!family || windowMatchesFamily(w.label, family)));
   const weekly = windows.find(w => /week/i.test(w.label));
   let rawReset = weekly?.resetAt ?? quota.weeklyResetAt;
   if (rawReset === undefined && provider !== "google-antigravity" && provider !== "anthropic") {

package/src/oauth/anthropic-account-refusal.ts

@@ -1,3 +1,4 @@
+import { wasAccountAutoPaused } from "./account-auto-pause";
 import { anthropicModelFamily } from "./anthropic-model-quota";
 /** Narrow pre-output account recovery, fenced to the bearer that physically sent the turn. */
 import { readBoundedResponseBody } from "../lib/bounded-body";
@@ -117,6 +118,11 @@ export async function rotateAnthropicAccountOnResponseForInstance(
   const { pauseAnthropicRateAdmission, anthropicRatePauseUntil } = anthropicRatePolicyFor(instance);
   const { recordAnthropicAccountRefusal, rotateAnthropicAccountOnRefusal,
     hasAnthropicFailoverQuorum, isAnthropicAccountPoolEnabled, pickAlternateAnthropicAccount } = routing;
+  if (wasAccountAutoPaused(response)) {
+    if (!options.canRetry || options.signal?.aborted) return null;
+    return pickAlternateAnthropicAccount(options.config, sent.accountId, Date.now(),
+      options.currentDecision ? options.currentDecision() : options.decision ?? null, options.model, options.excludedAccountIds);
+  }
   const ownedCurrent = () => {
     if (configuredAnthropicInstance(options.config, instance) !== instance
       || !anthropicPhysicalSendOwnershipIsCurrent(sent)) return undefined;

package/src/oauth/anthropic-model-family.ts

@@ -0,0 +1,8 @@
+/** Pure family identity shared by existing hard policy and loaded-only advisory evidence. */
+export type AnthropicModelFamily = "Fable" | "Opus" | "Sonnet";
+/** Return the Anthropic model family (Fable, Opus or Sonnet) named by a model id, or undefined for other models. */
+export function anthropicModelFamily(model?: string): AnthropicModelFamily | undefined {
+  return /(?:^|[/])claude-fable-5(?:-|$)/i.test(model ?? "") ? "Fable"
+    : /(?:^|[/])claude-opus-/i.test(model ?? "") ? "Opus"
+      : /(?:^|[/])claude-sonnet-/i.test(model ?? "") ? "Sonnet" : undefined;
+}

package/src/oauth/anthropic-model-quota.ts

@@ -6,12 +6,8 @@ import type { AnthropicInstanceId } from "../providers/anthropic-instance-id";
 import type { GenerationContext } from "../lib/state-store-sweeper";
 
 export const ANTHROPIC_PASSIVE_FAMILY_MAX_AGE_MS = 30 * 60_000;
-export type AnthropicModelFamily = "Fable" | "Opus" | "Sonnet";
-export function anthropicModelFamily(model?: string): AnthropicModelFamily | undefined {
-  return /(?:^|[/])claude-fable-5(?:-|$)/i.test(model ?? "") ? "Fable"
-    : /(?:^|[/])claude-opus-/i.test(model ?? "") ? "Opus"
-      : /(?:^|[/])claude-sonnet-/i.test(model ?? "") ? "Sonnet" : undefined;
-}
+import { anthropicModelFamily } from "./anthropic-model-family";
+export { anthropicModelFamily, type AnthropicModelFamily } from "./anthropic-model-family";
 
 export function anthropicModelPercents(quota: ProviderQuota | null, model?: string): number[] {
   const family = anthropicModelFamily(model);

package/src/oauth/api-key-pool-preserve.ts

@@ -0,0 +1,37 @@
+import type { OcxProviderConfig } from "../types";
+import { sanitizeApiKeyValue } from "../providers/api-keys";
+import { accountPauseDetailsSchema } from "../config/schema/account-auto-pause";
+
+/** Runtime guards: provider config is intentionally passthrough, so persisted fields may be malformed. */
+export function preservableApiKeyPool(value: unknown): NonNullable<OcxProviderConfig["apiKeyPool"]> | undefined {
+  if (!Array.isArray(value)) return undefined;
+  const pool: NonNullable<OcxProviderConfig["apiKeyPool"]> = [];
+  const ids = new Set<string>();
+  const keys = new Set<string>();
+  for (const entry of value as unknown[]) {
+    if (!entry || typeof entry !== "object" || Array.isArray(entry)) continue;
+    const candidate = entry as Record<string, unknown>;
+    const id = typeof candidate.id === "string" ? candidate.id.trim() : "";
+    const key = sanitizeApiKeyValue(candidate.key);
+    if (!id || !key || ids.has(id) || keys.has(key)) continue;
+    const label = typeof candidate.label === "string" ? candidate.label : undefined;
+    const addedAt = typeof candidate.addedAt === "number" && Number.isFinite(candidate.addedAt)
+      ? candidate.addedAt
+      : undefined;
+    const details = accountPauseDetailsSchema.safeParse(candidate.pauseDetails);
+    ids.add(id);
+    keys.add(key);
+    pool.push({
+      id,
+      key,
+      ...(label !== undefined ? { label } : {}),
+      ...(addedAt !== undefined ? { addedAt } : {}),
+      ...(typeof candidate.disabled === "boolean" ? { disabled: candidate.disabled } : {}),
+      ...(typeof candidate.pauseRevision === "string" ? { pauseRevision: candidate.pauseRevision } : {}),
+      ...(details.success ? { pauseDetails: details.data } : {}),
+    });
+  }
+  // Retain paused slots too: their metadata and credentials are needed for explicit resume.
+  return pool.length > 0 ? pool : undefined;
+}
+

package/src/oauth/chatgpt-shared.ts

@@ -46,7 +46,16 @@ export function extractEmail(idToken?: string, accessToken?: string): string | u
     if (!token) continue;
     const payload = decodeJwtPayload(token);
     if (!payload) continue;
-    if (typeof payload.email === "string") return payload.email.toLowerCase();
+    if (typeof payload.email === "string" && payload.email.trim()) {
+      return payload.email.trim().toLowerCase();
+    }
+    const profile = payload["https://api.openai.com/profile"];
+    if (profile && typeof profile === "object" && !Array.isArray(profile)) {
+      const email = (profile as Record<string, unknown>).email;
+      if (typeof email === "string" && email.trim()) {
+        return email.trim().toLowerCase();
+      }
+    }
   }
   return undefined;
 }

package/src/oauth/dsh.ts

@@ -9,6 +9,7 @@
  */
 
 import type { OAuthController, OAuthCredentials } from "./types";
+import { readBoundedResponseBody } from "../lib/bounded-body";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { existsSync, readFileSync } from "node:fs";
@@ -16,6 +17,20 @@ import { existsSync, readFileSync } from "node:fs";
 export const DSH_PLATFORM_ORIGIN = "https://platform.deepseek.com";
 export const DSH_INFERENCE_ORIGIN = "https://api.deepseek.com/anthropic";
 
+/**
+ * Byte ceiling for the profile document returned by /auth-api/v0/users/current.
+ *
+ * A legitimate profile is a small fixed-shape JSON object (code, data.biz_code,
+ * biz_data.id/email/id_profile{name,picture}) well under a few KiB; 64 KiB matches
+ * the shared bounded-body ceiling and still leaves orders of magnitude of
+ * headroom. Anything larger is rejected before parsing so a hostile or broken
+ * upstream cannot turn an import validation into unbounded memory work.
+ */
+export const DSH_PROFILE_MAX_BYTES = 64 * 1024;
+
+/** Wall-clock budget for the profile request and its body read, in milliseconds. */
+const DSH_PROFILE_FETCH_TIMEOUT_MS = 10_000;
+
 export interface DshAccountDetectionResult {
   detected: boolean;
   token?: string;
@@ -80,7 +95,7 @@ export async function validateDshAccountToken(
   signal?: AbortSignal,
 ): Promise<DshValidatedAccountIdentity> {
   try {
-    const timeoutSignal = AbortSignal.timeout(10_000);
+    const timeoutSignal = AbortSignal.timeout(DSH_PROFILE_FETCH_TIMEOUT_MS);
     const combinedSignal = signal ? AbortSignal.any([signal, timeoutSignal]) : timeoutSignal;
     const response = await fetch(`${DSH_PLATFORM_ORIGIN}/auth-api/v0/users/current`, {
       method: "GET",
@@ -99,7 +114,35 @@ export async function validateDshAccountToken(
       return { valid: false, error: `Platform returned HTTP ${response.status}` };
     }
 
-    const body = (await response.json()) as {
+    // A declared length past the cap is rejected without touching the stream.
+    const declaredLength = Number(response.headers.get("content-length"));
+    if (Number.isFinite(declaredLength) && declaredLength > DSH_PROFILE_MAX_BYTES) {
+      try {
+        void response.body?.cancel(
+          new DOMException("DSH profile response is too large", "QuotaExceededError"),
+        ).catch(() => undefined);
+      } catch {
+        // Best-effort cancellation only.
+      }
+      return { valid: false, error: "PROFILE_VALIDATION_FAILED" };
+    }
+
+    // Missing or understated Content-Length still meets the cap on the decoded
+    // stream itself: once an over-limit byte is observed the retained buffer is
+    // discarded and cancellation is requested on the body. Malformed UTF-8 fails
+    // closed so a replacement character can never alter the authoritative ID.
+    const bounded = await readBoundedResponseBody(response, {
+      signal: combinedSignal,
+      maxBytes: DSH_PROFILE_MAX_BYTES,
+      totalTimeoutMs: DSH_PROFILE_FETCH_TIMEOUT_MS,
+      inactivityTimeoutMs: DSH_PROFILE_FETCH_TIMEOUT_MS,
+      fatalUtf8: true,
+    });
+    if (bounded.oversized || bounded.truncated || !bounded.displaySafe) {
+      return { valid: false, error: "PROFILE_VALIDATION_FAILED" };
+    }
+
+    const body = JSON.parse(bounded.text) as {
       code?: number;
       data?: {
         biz_code?: number;

package/src/oauth/index.ts

@@ -55,6 +55,7 @@ import { loginOrcaRouter, orcaRouterInferenceBaseUrl, refreshOrcaRouterKey } fro
 import { ANTIGRAVITY_DISCOVERY_UA } from "../adapters/google-antigravity-wire";
 import { deriveOAuthDefaultModel, deriveOAuthProviderConfig } from "../providers/derive";
 import { apiKeyPoolEntryId, sanitizeApiKeyValue } from "../providers/api-keys";
+import { preservableApiKeyPool } from "./api-key-pool-preserve";
 import { effectiveGoogleMode, getProviderRegistryEntry, mergeRegistryStaticHeaders, providerMatchesRegistryTransport } from "../providers/registry";
 import { providerModelsUrl, resolveProviderModelDiscoveryUrl } from "../providers/model-discovery";
 import { resolveProviderTransport } from "../providers/xai-transport";
@@ -1513,36 +1514,6 @@ export function reconcileOAuthProviders(config: OcxConfig, persist = true): bool
   return true;
 }
 
-/** Runtime guards: provider config is intentionally passthrough, so persisted fields may be malformed. */
-function preservableApiKeyPool(value: unknown): NonNullable<OcxProviderConfig["apiKeyPool"]> | undefined {
-  if (!Array.isArray(value)) return undefined;
-  const pool: NonNullable<OcxProviderConfig["apiKeyPool"]> = [];
-  const ids = new Set<string>();
-  const keys = new Set<string>();
-  for (const entry of value as unknown[]) {
-    if (!entry || typeof entry !== "object" || Array.isArray(entry)) continue;
-    const candidate = entry as Record<string, unknown>;
-    const id = typeof candidate.id === "string" ? candidate.id.trim() : "";
-    const key = sanitizeApiKeyValue(candidate.key);
-    if (!id || !key || ids.has(id) || keys.has(key)) continue;
-    const label = typeof candidate.label === "string" ? candidate.label : undefined;
-    const addedAt = typeof candidate.addedAt === "number" && Number.isFinite(candidate.addedAt)
-      ? candidate.addedAt
-      : undefined;
-    ids.add(id);
-    keys.add(key);
-    pool.push({
-      id,
-      key,
-      ...(label !== undefined ? { label } : {}),
-      ...(addedAt !== undefined ? { addedAt } : {}),
-    });
-  }
-  // `apiKey` remains the routing source of truth. Keep valid alternate slots even when a
-  // hand-edited config left the pool out of sync, rather than deleting usable credentials.
-  return pool.length > 0 ? pool : undefined;
-}
-
 const OAUTH_LOGIN_OWNED_PROVIDER_FIELDS = [
   "adapter",
   "baseUrl",
@@ -1597,11 +1568,10 @@ export function upsertOAuthProvider(config: OcxConfig, provider: string): void {
     // Shared sanitizeApiKeyValue trim / no-CRLF checks from api-key pool writes.
     let storedApiKey = sanitizeApiKeyValue(existing.apiKey);
     const storedApiKeyPool = preservableApiKeyPool(existing.apiKeyPool);
-    // Unsafe/blank active key with a usable pool: promote the first safe pool entry so
-    // key billing keeps working instead of falling back to oauth while pool keys remain.
-    if (storedApiKey === undefined && storedApiKeyPool && storedApiKeyPool.length > 0) {
-      storedApiKey = storedApiKeyPool[0]!.key;
-    }
+    // Retain all-paused pools without activating any paused credential during login.
+    if (storedApiKeyPool?.some(entry => entry.key === storedApiKey && entry.disabled)) storedApiKey = undefined;
+    if (storedApiKey === undefined) storedApiKey = storedApiKeyPool?.find(entry => !entry.disabled)?.key;
+    if (storedApiKeyPool) next.apiKeyPool = storedApiKeyPool;
     if (storedApiKey !== undefined) {
       const pool = storedApiKeyPool ? [...storedApiKeyPool] : [];
       // Keep routing and listProviderApiKeys in sync: never leave a hidden active key that

package/src/oauth/kiro.ts

@@ -205,11 +205,54 @@ function profileArnFromWhoami(parsed: Record<string, unknown>): string | undefin
       : undefined);
 }
 
+/**
+ * `kiro-cli whoami --format json` prints its identity as one JSON object, but once an IAM Identity
+ * Center profile is selected kiro-cli 2.32 follows that object with a human-readable `Profile:`
+ * block on stdout. Parsing the whole stream then failed, which silently dropped the user email that
+ * tells organization users apart (#6641). Only the leading top-level object is identity evidence;
+ * it must start the output and end its line, so text on later lines is ignored while a second
+ * value on the same line makes the identity unreadable.
+ */
+function parseWhoamiObject(stdout: string): Record<string, unknown> | undefined {
+  const start = stdout.search(/\S/);
+  if (start < 0 || stdout[start] !== "{") return undefined;
+  let depth = 0;
+  let inString = false;
+  let escaped = false;
+  for (let index = start; index < stdout.length; index++) {
+    const char = stdout[index];
+    if (inString) {
+      if (escaped) escaped = false;
+      else if (char === "\\") escaped = true;
+      else if (char === "\"") inString = false;
+      continue;
+    }
+    if (char === "\"") inString = true;
+    else if (char === "{" || char === "[") depth++;
+    else if (char === "}" || char === "]") {
+      depth--;
+      if (depth > 0) continue;
+      if (!/^[ \t]*(?:\r?\n|$)/.test(stdout.slice(index + 1))) return undefined;
+      const parsed: unknown = JSON.parse(stdout.slice(start, index + 1));
+      return parsed && typeof parsed === "object" && !Array.isArray(parsed)
+        ? parsed as Record<string, unknown>
+        : undefined;
+    }
+  }
+  return undefined;
+}
+
+/**
+ * Same-session identity reported by `kiro-cli whoami --format json`: the lower-cased user email
+ * and a structurally valid profile ARN. Any failure (non-zero exit, unreadable output, a thrown
+ * runner) yields an empty identity, so a login falls back to the SQLite import instead of failing.
+ */
 async function readKiroCliIdentity(runner: KiroCliRunner, signal?: AbortSignal): Promise<{ email?: string; profileArn?: string }> {
   try {
     const result = await runner(["whoami", "--format", "json"], signal);
     if (result.exitCode !== 0) return {};
-    const parsed = JSON.parse(result.stdout) as Record<string, unknown>;
+    const parsed = parseWhoamiObject(result.stdout);
+    if (!parsed) return {};
     const email = typeof parsed.email === "string" ? parsed.email.trim().toLowerCase() : "";
     const profileArn = profileArnFromWhoami(parsed);
     return {

package/src/oauth/login-flow-state.ts

@@ -297,14 +297,23 @@ export function clearLoginState(provider: string): void {
 /**
  * Cancel one login. `flowId` names it exactly; without one the provider's newest in-flight flow
  * is cancelled, which is every single-flow caller (GUI, CLI) unchanged. A flow id belonging to a
- * different provider is refused rather than cancelled.
+ * different provider is refused rather than cancelled. Only the public OAuth cancellation
+ * endpoint opts into failed-outcome dismissal; callers using this boolean as proof of an
+ * aborted controller (Codex flow ownership) retain their original contract.
  */
-export function cancelLoginFlow(provider: string, flowId?: string): boolean {
+export function cancelLoginFlow(provider: string, flowId?: string, options?: { dismissSettledFailure?: boolean }): boolean {
   const flowKey = flowId ?? latestLoginFlowKey(provider);
   if (flowKey === undefined) return false;
   const active = loginAbort.get(flowKey);
   const existing = loginState.get(flowKey);
   if ((active?.provider ?? loginFlowProvider(flowKey)) !== provider) return false;
+  if (options?.dismissSettledFailure && !active && existing?.done && existing.error) {
+    // A failed add-account attempt does not invalidate a previously signed-in account. Let
+    // its owner dismiss the stale UI outcome without erasing credentials or another flow.
+    clearManualCodeSlot(flowKey);
+    dropLoginFlow(flowKey);
+    return true;
+  }
   if (!active && (!existing || existing.done)) return false;
   abandonLoginFlow(flowKey, { error: "Login cancelled", errorCode: "no_pending_login" });
   return true;