@bitkyc08/opencodex 2.89.0 → 2.90.0

package/src/claude/desktop-picker-profile.ts

@@ -19,6 +19,7 @@ import {
   readDesktopLibraryText,
   resolveDesktop3pConfigLibraryPath,
   SAFE_DESKTOP_PROFILE_ID,
+  serializeDesktopLibraryJson,
   type Desktop3pConfigLibraryOptions,
   type Desktop3pMetadata,
   type Desktop3pMetadataEntry,
@@ -48,7 +49,7 @@ function metadataPath(libraryPath: string): string {
 }
 
 function metadataJson(metadata: Desktop3pMetadata): string {
-  return JSON.stringify(metadata, null, 2) + "\n";
+  return serializeDesktopLibraryJson(metadata);
 }
 
 function isValidMetadata(metadata: Desktop3pMetadata): boolean {
@@ -190,6 +191,10 @@ function applyDesktopPickerProfileLocked(options: { proxyPort: number } & Deskto
     const changed = !alreadySelected || !oldProfile.exists || oldProfile.content !== target;
     if (!changed) return { ok: true, changed: false, path: profile };
 
+    const entries = existing
+      ? metadata.entries.map(entry => entry.id === entryId ? { ...entry, name: DESKTOP_PICKER_ENTRY_NAME } : entry)
+      : [...metadata.entries, { id: entryId, name: DESKTOP_PICKER_ENTRY_NAME }];
+    const nextMetadataJson = metadataJson({ ...metadata, appliedId: entryId, entries });
     mkdirSync(join(configDir, PICKER_DIRECTORY), { recursive: true, mode: 0o700 });
     try {
       // Keep the same backup convention as the existing Desktop writer. It is removed with the
@@ -199,10 +204,7 @@ function applyDesktopPickerProfileLocked(options: { proxyPort: number } & Deskto
       if (!alreadySelected) {
         atomicWriteFile(previousStatePath, JSON.stringify({ entryId, previousAppliedId }) + "\n");
       }
-      const entries = existing
-        ? metadata.entries.map(entry => entry.id === entryId ? { ...entry, name: DESKTOP_PICKER_ENTRY_NAME } : entry)
-        : [...metadata.entries, { id: entryId, name: DESKTOP_PICKER_ENTRY_NAME }];
-      atomicWriteFile(metaPath, metadataJson({ ...metadata, appliedId: entryId, entries }));
+      atomicWriteFile(metaPath, nextMetadataJson);
     } catch {
       try {
         restoreFile(metaPath, oldMeta);
@@ -246,6 +248,8 @@ function removeDesktopPickerProfileLocked(options: DesktopPickerProfileOptions):
     try { state = readPickerState(statePath); } catch { return { ok: false, reason: "profile_state_unreadable" }; }
 
     let metadataAfterPivot = metadata;
+    let standardPath: string | undefined;
+    let pivotMetadataJson: string | undefined;
     if (selected) {
       const previous = state?.entryId === picker.id ? state.previousAppliedId : null;
       const previousExists = previous !== null && previous !== picker.id && metadata.entries.some(entry => entry.id === previous);
@@ -253,16 +257,22 @@ function removeDesktopPickerProfileLocked(options: DesktopPickerProfileOptions):
         metadataAfterPivot = { ...metadata, appliedId: previous };
       } else {
         const standardId = randomUUID();
-        atomicWriteFile(profilePath(libraryPath, standardId), "{}\n");
+        standardPath = profilePath(libraryPath, standardId);
         metadataAfterPivot = {
           ...metadata,
           appliedId: standardId,
           entries: [...metadata.entries, { id: standardId, name: "opencodex-standard" }],
         };
       }
-      atomicWriteFile(metaPath, metadataJson(metadataAfterPivot));
+      pivotMetadataJson = metadataJson(metadataAfterPivot);
     }
 
+    const entries = metadataAfterPivot.entries.filter(entry => entry.id !== picker.id);
+    const finalMetadataJson = metadataJson({ ...metadataAfterPivot, entries });
+
+    if (standardPath !== undefined) atomicWriteFile(standardPath, "{}\n");
+    if (pivotMetadataJson !== undefined) atomicWriteFile(metaPath, pivotMetadataJson);
+
     const residualPaths: string[] = [];
     for (const path of [profilePath(libraryPath, picker.id), `${profilePath(libraryPath, picker.id)}.bak`]) {
       try { unlinkIfPresent(path); } catch { /* report the path without exposing file contents */ }
@@ -272,9 +282,8 @@ function removeDesktopPickerProfileLocked(options: DesktopPickerProfileOptions):
       return { ok: false, reason: "cleanup_incomplete", residualPaths };
     }
 
-    const entries = metadataAfterPivot.entries.filter(entry => entry.id !== picker.id);
     try {
-      atomicWriteFile(metaPath, metadataJson({ ...metadataAfterPivot, entries }));
+      atomicWriteFile(metaPath, finalMetadataJson);
       try { unlinkIfPresent(statePath); } catch { /* residual is reported below */ }
       if (existsSync(statePath)) return { ok: false, reason: "cleanup_incomplete", residualPaths: [statePath] };
     } catch {

package/src/claude/desktop-remote-store-io.ts

@@ -2,7 +2,7 @@ import { chmodSync, lstatSync, mkdirSync, realpathSync, unlinkSync } from "node:
 import { basename, dirname, join, resolve } from "node:path";
 import { atomicWriteFile, getConfigDir } from "../config";
 import { hardenSecretDir } from "../lib/windows-secret-acl";
-import { isRecord, readDesktopLibraryBytes, resolveDesktop3pConfigLibraryPath, SAFE_DESKTOP_PROFILE_ID, type Desktop3pMetadata } from "./desktop-3p-library";
+import { isRecord, MAX_DESKTOP_PROFILE_FILE_BYTES, readDesktopLibraryBytes, resolveDesktop3pConfigLibraryPath, SAFE_DESKTOP_PROFILE_ID, type Desktop3pMetadata } from "./desktop-3p-library";
 import { DesktopStoreError, digest } from "./desktop-remote-store-state";
 
 export const MAX_DESKTOP_METADATA_ENTRIES = 256;
@@ -45,7 +45,7 @@ export class StoreIO {
     try {
       // The shared verified regular-file read keeps a swapped FIFO from parking this
       // open before the post-read identity recheck below can run.
-      const bytes = readDesktopLibraryBytes(path);
+      const bytes = readDesktopLibraryBytes(path, Math.min(maxBytes, MAX_DESKTOP_PROFILE_FILE_BYTES));
       if (bytes.byteLength > maxBytes || identity(lstatSync(path)) !== identity(stat)) throw new DesktopStoreError("conflict");
       const value: unknown = JSON.parse(bytes.toString("utf8"));
       if (!isRecord(value)) throw new DesktopStoreError("unsafe");

package/src/cli/ensure-desktop-cold-start.ts

@@ -241,12 +241,12 @@ function consentedDesktopBundle(home: string, installId: string, run: Execute):
   const plistPath = realpathSync(join(home, "Library", "LaunchAgents", `${DESKTOP_PLIST_LABEL}.plist`));
   const registration = JSON.parse(
     run("/usr/bin/plutil", ["-convert", "json", "-o", "-", plistPath], 3_000),
-  ) as { Label?: unknown; ProgramArguments?: unknown; Program?: unknown };
+  ) as { Label?: unknown; RunAtLoad?: unknown; ProgramArguments?: unknown; Program?: unknown };
   const args = registration.ProgramArguments;
   // The shapes auto-launch writes: [program] or [program, "--autostart"]; see the migration
   // rules in desktop/src-tauri/src/login_registration.rs, which classify anything else Leave.
   // This is a macOS plist path, regardless of the host running an injected launch probe.
-  if (registration.Label !== DESKTOP_PLIST_LABEL || !Array.isArray(args)
+  if (registration.Label !== DESKTOP_PLIST_LABEL || registration.RunAtLoad !== true || !Array.isArray(args)
     || (args.length !== 1 && args.length !== 2) || typeof args[0] !== "string" || !posix.isAbsolute(args[0])
     || (args.length === 2 && args[1] !== "--autostart")
     || (registration.Program !== undefined && registration.Program !== args[0])) return null;

package/src/codex/account-lifecycle.ts

@@ -1,4 +1,5 @@
 import { observeSignedInCodexIdentity } from "./signed-in-identity";
+import { observeMainCodexCollisionIdentity } from "./collision-identity";
 import { existsSync, readFileSync } from "node:fs";
 import {
   deleteConfigTopLevelKey,
@@ -9,11 +10,12 @@ import {
 import { captureConfigTopLevelRollback } from "../config/rebase-provenance";
 import { removeCodexAccountCredential } from "./account-store";
 import { clearAccountNeedsReauth } from "./account-runtime-state";
-import { readCodexTokensResult } from "./auth-collision";
+import { readMainAuth } from "./auth-collision";
 import { MAIN_CODEX_ACCOUNT_ID, setMainAccountPlan } from "./main-account";
 import { clearAccountQuota } from "./quota";
 import { forgetManualPreference } from "./routing/active-account";
 import { deleteAllHealthForAccount } from "./routing/health-store";
+import { forgetCodexFailureWindow } from "./routing/failure-window";
 import { clearThreadAccountMapForAccount } from "./routing/thread-affinity";
 
 import { clearCodexPoolRefreshFailure } from "./pool-refresh-backoff";
@@ -49,11 +51,15 @@ export function purgeCodexAccountRuntimeState(accountId: string): void {
   clearAccountNeedsReauth(accountId);
   clearAccountQuota(accountId);
   clearThreadAccountMapForAccount(accountId);
-  // Deliberately not via `./routing`: the account-delete path only needs the health rows and
-  // the manual preference gone, and importing the router here closed a cycle through
-  // routing/health-store and routing/active-account.
+  // Deliberately not via `./routing`: the account-delete path only needs the health rows
+  // and their sibling routing state gone, and importing the router barrel here closed a
+  // cycle through routing/health-store and routing/active-account. The leaf imports below
+  // carry every per-account forget that barrel helper used to perform — including the
+  // failure window, whose degrade and pin-warning state must not leak into a replacement
+  // account or a new physical login behind __main__.
   deleteAllHealthForAccount(accountId);
   forgetManualPreference(accountId);
+  forgetCodexFailureWindow(accountId);
   clearCodexPoolRefreshFailure(accountId);
   if (accountId === MAIN_CODEX_ACCOUNT_ID) {
     clearMainAccountInfoCache();
@@ -74,7 +80,8 @@ function purgeMainCodexAccountRuntimeState(): void {
  * cooldown, quota, reauth, and thread affinity do not leak across accounts.
  */
 export function reconcileMainCodexAccountRuntimeState(): boolean {
-  const read = readCodexTokensResult();
+  const read = readMainAuth();
+  if (read.status === "missing" || read.status === "api-key-only") observeMainCodexCollisionIdentity();
   const currentAccountId = read.status === "ok"
     ? extractAccountId(read.tokens.id_token, read.tokens.access_token) ?? (read.tokens.account_id || null)
     : null;
@@ -86,11 +93,13 @@ export function reconcileMainCodexAccountRuntimeState(): boolean {
   observedMainChatgptAccountId = currentAccountId;
   if (previousAccountId === undefined || previousAccountId === currentAccountId) {
     observeMainQuotaIdentity(currentAccountId);
+    if (read.status === "ok") observeMainCodexCollisionIdentity(read.tokens);
     return false;
   }
 
   purgeMainCodexAccountRuntimeState();
   observeMainQuotaIdentity(currentAccountId);
+  if (read.status === "ok") observeMainCodexCollisionIdentity(read.tokens);
   return true;
 }
 
@@ -103,7 +112,8 @@ export function reconcileMainCodexAccountRuntimeState(): boolean {
 export function initializeMainAccountPolicyBinding(authPath: string): boolean {
   // Startup observes the pinned owned path inside the exclusive claim: bound the read so a
   // replaced non-regular or oversized file cannot stall startup inside that claim.
-  const result = readCodexTokensResult(authPath, { bounded: true });
+  const result = readMainAuth(authPath);
+  if (result.status === "missing" || result.status === "api-key-only") observeMainCodexCollisionIdentity();
   if (result.status !== "ok") return false;
   const { tokens } = result;
   if (typeof tokens.access_token !== "string" || !tokens.access_token
@@ -124,6 +134,7 @@ export function initializeMainAccountPolicyBinding(authPath: string): boolean {
   if (previousAccountId !== undefined && previousAccountId !== accountId) purgeMainCodexAccountRuntimeState();
   observeSignedInCodexIdentity(tokens);
   observeMainQuotaIdentity(accountId);
+  observeMainCodexCollisionIdentity(tokens);
   return observeMainQuotaCredential(tokens.access_token, accountId) !== undefined;
 }
 
@@ -136,6 +147,7 @@ export function applyConfirmedMainCodexAccountTransition(
   toAccountId: string,
 ): boolean {
   observeSignedInCodexIdentity();
+  observeMainCodexCollisionIdentity();
   if (!fromAccountId || !toAccountId || fromAccountId === toAccountId) {
     if (toAccountId) {
       observedMainChatgptAccountId = toAccountId;
@@ -150,6 +162,7 @@ export function applyConfirmedMainCodexAccountTransition(
 }
 
 export function resetMainCodexAccountIdentityTrackingForTests(): void {
+  observeMainCodexCollisionIdentity();
   observedMainChatgptAccountId = undefined;
   observeSignedInCodexIdentity();
   clearMainAccountCredentialPresence();

package/src/codex/account-store.ts

@@ -136,25 +136,37 @@ export function peekCodexAccountRecordStore(): Record<string, CodexAccountCreden
 
 /** Read the Codex account record store from disk with hardened permissions, and hand it to the opt-in decision-quota slot (a no-op unless JEV quota signals are active). */
 function loadCodexAccountRecordStore(): CodexAccountStore {
+  const result = loadCodexAccountRecordStoreResult();
+  return result.status === "ok" ? result.records : {};
+}
+
+type CodexAccountRecordStoreResult = { status: "ok"; records: CodexAccountStore } | { status: "failed" };
+
+/** Retain read/parse failure separately for consumers that must preserve existing evidence. */
+function loadCodexAccountRecordStoreResult(): CodexAccountRecordStoreResult {
   const path = codexAccountsPath();
   hardenConfigDir();
   hardenExistingSecret(path);
-  if (!existsSync(path)) { notifyCodexStoreLoaded({}); return {}; }
   const normalized: CodexAccountStore = {};
   try {
     const raw = JSON.parse(readFileSync(path, "utf-8")) as RawCodexAccountStore;
+    if (!isObject(raw)) throw new Error("invalid Codex account store shape");
     for (const [id, value] of Object.entries(raw)) {
       const record = normalizeRecord(value);
       if (record) normalized[id] = record;
     }
-  } catch {
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") {
+      notifyCodexStoreLoaded({});
+      return { status: "ok", records: {} };
+    }
     backupInvalidConfig(path);
     notifyCodexStoreLoaded({});
-    return {};
+    return { status: "failed" };
   }
   // Outside the parse try: roster publication is advisory and must never route a loaded store into the invalid-config backup path.
   notifyCodexStoreLoaded(normalized);
-  return normalized;
+  return { status: "ok", records: normalized };
 }
 
 /** Atomically write the Codex account store, then hand it to the opt-in decision-quota slot so active advisory evidence tracks the persisted credentials. */
@@ -400,6 +412,10 @@ export function isCodexAccountGenerationLive(id: string, generation: number): bo
   return !!record?.credential && record.deletedAt == null && record.generation === generation;
 }
 
+/** Callable for existing liveness consumers; stateful consumers can distinguish unknown snapshots. */
+export type CodexAccountGenerationLiveCheck = ((id: string, generation: number) => boolean)
+  & { readonly snapshotStatus: "ok" | "failed" };
+
 /**
  * The same verdict as {@link isCodexAccountGenerationLive}, over ONE store load.
  *
@@ -409,12 +425,15 @@ export function isCodexAccountGenerationLive(id: string, generation: number): bo
  * several accounts in one synchronous pass on the request path, so it opens one checker and
  * closes over the snapshot instead.
  */
-export function beginCodexAccountGenerationLiveCheck(): (id: string, generation: number) => boolean {
-  const snapshot = loadCodexAccountRecordSnapshot();
-  return (id, generation) => {
+export function beginCodexAccountGenerationLiveCheck(): CodexAccountGenerationLiveCheck {
+  let result: CodexAccountRecordStoreResult;
+  try { result = loadCodexAccountRecordStoreResult(); }
+  catch { result = { status: "failed" }; }
+  const snapshot = result.status === "ok" ? result.records : {};
+  return Object.assign((id: string, generation: number) => {
     const record = snapshot[id];
     return !!record?.credential && record.deletedAt == null && record.generation === generation;
-  };
+  }, { snapshotStatus: result.status });
 }
 
 export function saveCodexAccountCredentialIfGeneration(

package/src/codex/account-usability.ts

@@ -9,6 +9,7 @@ import { hasLegacyMainCodexPoolAccount, isSelectableCodexPoolAccount } from "./a
 import type { OcxConfig } from "../types";
 import { isNativeMainTrafficBlocked } from "./native-profile-startup";
 import { isMainAccountHardLocked } from "./main-account-hard-lock";
+import { configuredCodexMainDuplicate } from "./collision-identity";
 
 export interface CodexAccountUsabilityOptions {
   /** Route using cached runtime state only; the caller must reject selected main before auth. */
@@ -64,7 +65,8 @@ export type CodexAccountUnusableReason =
   | "not_in_pool"
   | "missing_credential"
   | "deleted"
-  | "validation_pending";
+  | "validation_pending"
+  | "duplicate_main";
 
 /**
  * The single source of truth for both selection and its explanation. `isCodexAccountUsable()` is
@@ -110,6 +112,7 @@ export function codexAccountUnusableReason(
   if (!record?.credential) return "missing_credential";
   if (record.deletedAt != null) return "deleted";
   if (record.codexValidationPending) return "validation_pending";
+  if (configuredCodexMainDuplicate(config, accountId)) return "duplicate_main";
   return undefined;
 }
 

package/src/codex/auth-api/account-list.ts

@@ -1,7 +1,6 @@
 import { getMainAccountExternalUsageWarning, type MainAccountExternalUsageWarning } from "../main-account-external-usage";
 import { codexCreditsDtoField, hasCodexCreditsObservation, pruneCodexCredits } from "../credits";
 import type { CodexCredits } from "../credits";
-import { getMainChatgptAccountId } from "../auth-collision";
 import { codexAccountLogLabel } from "../account-label";
 import { poolQuotaHistoryIdentity, getCodexAccountCredential, getValidCodexToken, isCodexAccountGenerationLive, readCodexAccountRecord } from "../account-store";
 import { getAccountQuota, isCodexQuotaExhausted, setAccountQuotaFromParsed, withoutRetiredCodexQuota } from "../quota";
@@ -35,6 +34,7 @@ import { fetchPoolAccountQuota, PoolQuotaProbeBusyError, POOL_QUOTA_REFRESH_CONC
 import type { PoolQuotaResult } from "./pool-quota-probe";
 import { getRuntimeConfig, configuredPoolAccount, mapWithConcurrency } from "./runtime-config";
 import { isPassiveRead } from "../../lib/passive-read";
+import { CODEX_MAIN_DUPLICATE_ACTION, configuredCodexMainDuplicate, getObservedMainCodexCollisionIdentity } from "../collision-identity";
 
 export function quotaForPlan<T extends Omit<StoredAccountQuota, "updatedAt"> | StoredAccountQuota | null>(
   quota: T,
@@ -133,6 +133,7 @@ export function poolAccountDto(
   // health projection. Emitting only the boolean is what left #4212's reporter guessing which
   // account took their model away and why, so name the cause they actually have to act on.
   const reauthReason: CodexAccountReauthReason | undefined = rawReauthReason ?? (health.status === "reauth_required" ? health.reason : undefined);
+  const duplicateMain = configuredCodexMainDuplicate(config, account.id);
   return {
     id: account.id,
     email: projectEmail(account.email, maskEmails) ?? account.email,
@@ -150,7 +151,10 @@ export function poolAccountDto(
     ...codexCreditsDtoField(config, account.id, poolQuotaHistoryIdentity(account.id) ?? null),
     needsReauth: needsReauth || health.status === "reauth_required",
     ...(reauthReason !== undefined ? { reauthReason } : {}),
-    ...(isCodexAccountPlanExcluded(config, account.id) ? {
+    ...(duplicateMain ? {
+      selectionExcludedReason: "duplicate_main" as const,
+      selectionExcludedAction: CODEX_MAIN_DUPLICATE_ACTION,
+    } : isCodexAccountPlanExcluded(config, account.id) ? {
       selectionExcludedReason: "plan_excluded" as const,
       selectionExcludedPlan: codexPlanValue(config.codexAccounts?.find(row => row.id === account.id)?.plan),
     } : {}),
@@ -184,8 +188,9 @@ export interface CodexAuthAccountDto {
    * needs the operator; `/api/oauth/accounts` already carries the same field name.
    */
   reauthReason?: CodexAccountReauthReason;
-  /** Automatic selection policy only; explicit routes retain their usual auth checks. */
-  selectionExcludedReason?: "plan_excluded";
+  /** Plan policy is automatic-only; duplicate-main exclusions also apply to explicit routes. */
+  selectionExcludedReason?: "plan_excluded" | "duplicate_main";
+  selectionExcludedAction?: string;
   selectionExcludedPlan?: string;
   hasCredential: boolean;
   health: OAuthAccountHealth;
@@ -418,7 +423,7 @@ export async function listCodexAuthAccountsSnapshot(
       quota: mainInfo.quota
         ? quotaForPlan(mainQuotaWithCarriedResetCredits(mainInfo.quota), mainInfo.plan)
         : null,
-      ...codexCreditsDtoField(runtimeConfig, MAIN_CODEX_ACCOUNT_ID, getMainChatgptAccountId()),
+      ...codexCreditsDtoField(runtimeConfig, MAIN_CODEX_ACCOUNT_ID, getObservedMainCodexCollisionIdentity()?.accountId ?? null),
       ...oauthAccountHealthFields("codex", MAIN_CODEX_ACCOUNT_ID, mainHealth),
     };
     return {

package/src/codex/auth-api/account-pause-group.ts

@@ -1,35 +1,15 @@
 import { observeSignedInCodexIdentity } from "../signed-in-identity";
 import { lstatSync } from "node:fs";
 import type { OcxConfig } from "../../types";
-import { readCodexTokensResult } from "../auth-collision";
-import type { CodexTokenReadResult } from "../auth-collision";
+import { readMainAuth } from "../auth-collision";
 import { linkedCodexAccountIds } from "../account-identity";
 import { resolveCodexHomeDir } from "../home";
 import { tryAcquireNativeMainProfileClaim } from "../native-main-admission";
 import { withNativeMainSharedClaim } from "../native-main-claim";
-import { MAX_AUTH_BYTES, readBounded, resolveNativeProfileContext } from "../native-profile-store";
+import { resolveNativeProfileContext } from "../native-profile-store";
 import { NativeProfileError } from "../native-profile-types";
 import { isNativeMainClaimUnavailable, nativeMainProfileBusyResponse } from "./http";
 
-type MainAuth = CodexTokenReadResult | { status: "api-key-only" };
-
-/** A valid API-key login has no ChatGPT identity; anything else unreadable stays unknown. */
-function readMainAuth(authPath: string): MainAuth {
-  const main = readCodexTokensResult(authPath, { bounded: true });
-  if (main.status !== "invalid") return main;
-  try {
-    const j: unknown = JSON.parse(readBounded(authPath, MAX_AUTH_BYTES).toString("utf-8"));
-    if (j === null || typeof j !== "object" || Array.isArray(j)) return main;
-    const envelope = j as { auth_mode?: unknown; OPENAI_API_KEY?: unknown; tokens?: unknown };
-    const apiKeyOnly = envelope.tokens == null
-      && (envelope.auth_mode === undefined || envelope.auth_mode === "api_key")
-      && typeof envelope.OPENAI_API_KEY === "string" && envelope.OPENAI_API_KEY.trim() !== "";
-    return apiKeyOnly ? { status: "api-key-only" } : main;
-  } catch {
-    return main;
-  }
-}
-
 /** Hold admission throughout; claim the physical main whenever its home exists. */
 export async function withCodexAccountPauseGroup(
   config: OcxConfig,

package/src/codex/auth-api/login-collision.ts

@@ -0,0 +1,59 @@
+import { lstatSync } from "node:fs";
+import { extractAccountId, extractAccountIdClaims, extractEmail } from "../../oauth/chatgpt";
+import { checkAccountIdCollision, readMainAuth } from "../auth-collision";
+import { resolveCodexHomeDir } from "../home";
+import { tryAcquireNativeMainProfileClaim } from "../native-main-admission";
+import { withNativeMainSharedClaim } from "../native-main-claim";
+import { resolveNativeProfileContext } from "../native-profile-store";
+import { NativeProfileError } from "../native-profile-types";
+import { extractChatgptPlanType } from "../plan";
+import { isNativeMainClaimUnavailable } from "./http";
+
+export class CodexCollisionReadBusyError extends Error {
+  constructor() { super("Native Codex login is busy or unreadable; retry login shortly."); }
+}
+
+/** Only admission owns physical reads; synchronous collision consumers use observed identity. */
+export async function checkAccountIdCollisionWithNativeMain(
+  accountId: string, email?: string | null, plan?: unknown, excludeAccountId?: string | null,
+): Promise<ReturnType<typeof checkAccountIdCollision>> {
+  const lease = tryAcquireNativeMainProfileClaim();
+  if (!lease) throw new CodexCollisionReadBusyError();
+  try {
+    const codexHome = resolveCodexHomeDir();
+    try { lstatSync(codexHome); } catch (error) {
+      if ((error as NodeJS.ErrnoException)?.code === "ENOENT") {
+        return checkAccountIdCollision(accountId, email, plan, excludeAccountId, null);
+      }
+      throw new CodexCollisionReadBusyError();
+    }
+    const context = resolveNativeProfileContext({ codexHome });
+    return await withNativeMainSharedClaim(context, async () => {
+      const main = readMainAuth(context.authPath);
+      if (main.status === "missing" || main.status === "api-key-only") {
+        return checkAccountIdCollision(accountId, email, plan, excludeAccountId, null);
+      }
+      if (main.status !== "ok") throw new CodexCollisionReadBusyError();
+      const tokens = main.tokens;
+      const nativeId = extractAccountId(tokens.id_token, tokens.access_token) ?? tokens.account_id;
+      const claims = [extractAccountIdClaims(tokens.id_token), extractAccountIdClaims(tokens.access_token)];
+      const emails = [extractEmail(tokens.id_token), extractEmail(undefined, tokens.access_token)].filter(Boolean);
+      if (!nativeId || typeof tokens.account_id !== "string" || typeof tokens.access_token !== "string"
+        || (tokens.id_token !== undefined && typeof tokens.id_token !== "string")
+        || claims.some(claim => claim.conflict || (claim.accountId && claim.accountId !== nativeId))
+        || (tokens.account_id && tokens.account_id !== nativeId) || new Set(emails).size > 1) {
+        throw new CodexCollisionReadBusyError();
+      }
+      return checkAccountIdCollision(accountId, email, plan, excludeAccountId, {
+        accountId: nativeId, email: extractEmail(tokens.id_token, tokens.access_token),
+        plan: extractChatgptPlanType(tokens.id_token, tokens.access_token),
+      });
+    });
+  } catch (error) {
+    if (isNativeMainClaimUnavailable(error)
+      || (error instanceof NativeProfileError && error.code === "CODEX_HOME_UNAVAILABLE")) {
+      throw new CodexCollisionReadBusyError();
+    }
+    throw error;
+  } finally { lease.release(); }
+}

package/src/codex/auth-api/login-flow.ts

@@ -5,7 +5,8 @@ import type { StoredAccountQuota, WhamUsageResponse } from "../quota";
 import { ConfigMutationLockError, withConfigMutationLockSync } from "../../config";
 import { appendDefaultCodexAccountNamespace, codexAccountPickerEnabled } from "../account-namespaces";
 import { catalogRefreshIsPending, normalizeCatalogDisposition } from "../catalog-refresh-status";
-import { checkAccountIdCollision } from "../auth-collision";
+import { checkAccountIdCollisionWithNativeMain as checkAccountIdCollision, CodexCollisionReadBusyError } from "./login-collision";
+import { extractChatgptPlanType } from "../plan";
 import { clearAccountNeedsReauth, isAccountNeedsReauth, markAccountNeedsReauth } from "../account-runtime-state";
 import { clearCodexPoolRefreshFailure } from "../pool-refresh-backoff";
 import { reconcileLiveStateStores } from "../../lib/state-store-registrations";
@@ -262,8 +263,8 @@ export async function handleCodexAuthLoginStart(req: Request, config: OcxConfig,
                 break;
               }
 
-              let email = cred.email || accountId;
-              let plan: string | undefined;
+              let email = cred.email?.trim() || "";
+              let plan = extractChatgptPlanType(undefined, cred.access);
               let quota: Omit<StoredAccountQuota, "updatedAt"> | null = null;
               let policyQuota: Omit<StoredAccountQuota, "updatedAt"> | null = null;
               try {
@@ -274,8 +275,8 @@ export async function handleCodexAuthLoginStart(req: Request, config: OcxConfig,
                 });
                 if (resp.ok) {
                   const data = (await resp.json()) as WhamUsageResponse;
-                  email = data.email ?? email;
-                  plan = nonEmptyPlan(data.plan_type) ?? undefined;
+                  email = data.email?.trim() || email;
+                  plan = nonEmptyPlan(data.plan_type) ?? plan;
                   quota = parseUsageQuota(data);
                   policyQuota = isValidWhamHistoryObservation(data) ? quota : null;
                 }
@@ -322,7 +323,7 @@ export async function handleCodexAuthLoginStart(req: Request, config: OcxConfig,
               }
 
               // 1.2: Duplicate check is scoped by personal vs workspace plan bucket.
-              const collision = checkAccountIdCollision(oauthAccountId, email, plan, reauth ? accountId : undefined);
+              const collision = await checkAccountIdCollision(oauthAccountId, email, plan, reauth ? accountId : undefined);
               if (collision.collision) {
                 setCodexLoginState(flowId, {
                   status: "error", error: collision.reason, doneAt: Date.now(),
@@ -331,6 +332,8 @@ export async function handleCodexAuthLoginStart(req: Request, config: OcxConfig,
                 break;
               }
 
+              email ||= accountId;
+
               // A successful authenticated WHAM read can prove quota is exhausted without
               // spending an inference request. Store the account, but defer inference validation
               // and keep it unavailable to routing. Unknown/failed usage reads retain the gate.
@@ -470,7 +473,9 @@ export async function handleCodexAuthLoginStart(req: Request, config: OcxConfig,
           });
         }
       } catch (error) {
-        const message = error instanceof ConfigMutationLockError
+        const message = error instanceof CodexCollisionReadBusyError
+          ? "Native Codex login is busy or unreadable; retry login shortly."
+          : error instanceof ConfigMutationLockError
           || error instanceof CodexCredentialRefreshLockTimeoutError
           ? "Configuration is busy; retry login shortly."
           : error instanceof CodexCredentialRefreshBusyError || error instanceof CodexCredentialRefreshStaleError