@bitkyc08/opencodex 2.89.0 → 2.90.0

package/src/codex/auth-api/pool-mode-gate.ts

@@ -13,7 +13,7 @@ import { isAccountNeedsReauth } from "../account-runtime-state";
 import { getValidMainAccountToken, MAIN_CODEX_ACCOUNT_ID, getMainAccountPlan } from "../main-account";
 import { captureConfigGeneration, registerStateSweepAfterTick } from "../../lib/state-store-sweeper";
 import { observeMainQuotaCredential, getMainQuotaCredentialGeneration, captureMainAccountIdentityGeneration, isMainAccountIdentityGenerationLive } from "../main-account-cache";
-import { getMainAccountHardLockStatus } from "../main-account-hard-lock";
+import { getMainAccountHardLockStatus, latestMainBlockingResetAt } from "../main-account-hard-lock";
 import type { OcxConfig } from "../../types";
 import { isCanonicalOpenAiForwardProvider, OPENAI_CODEX_PROVIDER_ID } from "../../providers/openai-tiers";
 import { providerCodexAccountMode } from "../../providers/registry";
@@ -78,8 +78,55 @@ export async function runCodexCooldownRecoveryProbes(config: OcxConfig, now = Da
 
 const MAIN_CREDIT_RENEWAL_AGE_MS = 3 * 60_000;
 
+/** Traffic headers renew usage, never the independent credit observation (#7377). */
+function poolCreditRenewalDue(config: OcxConfig, accountId: string, now = Date.now()): boolean {
+  const account = configuredPoolAccount(config, accountId);
+  if (!account || !codexAccountUsesCreditsAfterLimit(config, accountId)
+    || isCodexAccountPaused(config, accountId) || isAccountNeedsReauth(accountId)) return false;
+  const quota = getAccountQuota(accountId);
+  if (codexUsageLimitResetAt(quota, account.plan, now) === undefined) return false;
+  const observedAt = quota?.credits?.observedAt;
+  if (observedAt !== undefined && Number.isFinite(observedAt)
+    && now - observedAt >= 0 && now - observedAt < MAIN_CREDIT_RENEWAL_AGE_MS) return false;
+  const attempt = poolQuotaPrimeAttemptedAt.get(accountId);
+  return !attempt || attempt.generation !== readCodexAccountRecord(accountId)?.generation
+    || now - attempt.at >= MAIN_CREDIT_RENEWAL_AGE_MS;
+}
+
 let mainHardLockRecoveryInFlight: Promise<void> | null = null;
-let mainHardLockRecoveryAttempt: { identity: number; credential: number; after: number; delay: number } | undefined;
+/** `floor` and `resetBound` apply only while a predicted reset is (or just was) holding the lock. */
+type MainRecoveryAttempt = { identity: number; credential: number; after: number; delay: number; floor?: number; resetBound?: number };
+let mainHardLockRecoveryAttempt: MainRecoveryAttempt | undefined;
+/** The identity/credential that already waited out its first hold interval. */
+let mainHardLockHoldSeen: { identity: number; credential: number } | undefined;
+const MAIN_HOLD_MIN_INTERVAL_MS = nextQuotaQueryDelay();
+
+/** The predicted reset of a blocked main, or undefined when no future reset is known. */
+function predictedMainResetHold(status: ReturnType<typeof getMainAccountHardLockStatus>): number | undefined {
+  return status.state === "blocked" && status.resetAt !== undefined && status.resetAt > Date.now()
+    ? status.resetAt : undefined;
+}
+
+/**
+ * A hold read is due at its backoff deadline, pulled in to the latest known predicted reset (even
+ * one that moved earlier or just passed) but never sooner than one base interval after the last read.
+ */
+function mainRecoveryDueAt(attempt: MainRecoveryAttempt, holdResetAt: number | undefined, config: OcxConfig): number {
+  // Once a hold elapses the status omits its reset; current evidence may still name a revised one.
+  const bound = holdResetAt ?? (attempt.resetBound === undefined ? undefined
+    : Math.min(attempt.resetBound, latestMainBlockingResetAt(config) ?? Infinity));
+  return bound === undefined ? attempt.after : Math.max(attempt.floor ?? 0, Math.min(attempt.after, bound));
+}
+
+/** First sight of a hold for this credential waits one base interval; transient retries do not re-arm it. */
+function armMainResetHold(identity: number, credential: number, holdResetAt: number): void {
+  const at = Date.now() + MAIN_HOLD_MIN_INTERVAL_MS;
+  mainHardLockHoldSeen = { identity, credential };
+  mainHardLockRecoveryAttempt = { identity, credential, delay: MAIN_HOLD_MIN_INTERVAL_MS, after: at, floor: at, resetBound: holdResetAt };
+}
+
+const mainHoldSeenFor = (identity: number, credential: number): boolean =>
+  mainHardLockHoldSeen?.identity === identity && mainHardLockHoldSeen.credential === credential;
 
 /** Metadata-only recovery on the existing sweep; failures retain the observed policy block. */
 export async function runMainAccountHardLockRecovery(config: OcxConfig): Promise<void> {
@@ -98,10 +145,14 @@ export async function runMainAccountHardLockRecovery(config: OcxConfig): Promise
         || (observedAt !== undefined && now - observedAt >= MAIN_CREDIT_RENEWAL_AGE_MS));
   };
   const status = getMainAccountHardLockStatus(config);
+  if (status.state !== "blocked") mainHardLockHoldSeen = undefined;
   if (status.state !== "blocked" && !creditRecoveryNeeded()) { mainHardLockRecoveryAttempt = undefined; return; }
   if (isAccountNeedsReauth(MAIN_CODEX_ACCOUNT_ID)) return;
-  // A predicted reset is a scheduling hint, never proof that the hard lock can be lifted.
-  if (status.state === "blocked" && status.resetAt !== undefined && status.resetAt > Date.now()) return;
+  // A predicted reset is a scheduling hint, never proof that the hard lock can be lifted. The
+  // hold is rechecked on the capped WHAM schedule so an early reset redeemed elsewhere is
+  // learned from metadata (#7312); a paused main receives no hold rechecks.
+  const holdResetAt = predictedMainResetHold(status);
+  if (holdResetAt !== undefined && isCodexAccountPaused(config, MAIN_CODEX_ACCOUNT_ID)) return;
   // Reconcile the owned physical credential before skipping work for an older one.
   reconcileMainCodexAccountRuntimeState();
   const physical = readCodexTokens();
@@ -109,9 +160,14 @@ export async function runMainAccountHardLockRecovery(config: OcxConfig): Promise
   const identity = captureMainAccountIdentityGeneration();
   const credential = getMainQuotaCredentialGeneration();
   const previous = mainHardLockRecoveryAttempt;
+  if (holdResetAt !== undefined && !mainHoldSeenFor(identity, credential)) {
+    armMainResetHold(identity, credential, holdResetAt);
+    return;
+  }
+  const sameAttempt = previous?.identity === identity && previous.credential === credential;
+  if (sameAttempt && holdResetAt !== undefined) previous.resetBound = holdResetAt;
   const queryAfter = nextCodexUsageQueryAt(`main:${captureConfigGeneration()}:${credential}`) ?? 0;
-  if ((previous?.identity === identity && previous.credential === credential
-    && previous.after > Date.now()) || queryAfter > Date.now()) return;
+  if ((sameAttempt && mainRecoveryDueAt(previous, holdResetAt, config) > Date.now()) || queryAfter > Date.now()) return;
   const lease = tryAcquireNativeMainProfileClaim();
   if (!lease) return;
   mainHardLockRecoveryInFlight = (async () => {
@@ -130,16 +186,20 @@ export async function runMainAccountHardLockRecovery(config: OcxConfig): Promise
       // Native refresh retains its own grant-scoped refusal; global quarantine would outlive it.
       return;
     }
-    const currentStatus = getMainAccountHardLockStatus(config);
+    const currentHold = predictedMainResetHold(getMainAccountHardLockStatus(config));
     if (isAccountNeedsReauth(MAIN_CODEX_ACCOUNT_ID)
       || !isMainAccountIdentityGenerationLive(identityGeneration)
       || (passive && !creditRecoveryNeeded())
-      || (currentStatus.state === "blocked" && currentStatus.resetAt !== undefined
-        && currentStatus.resetAt > Date.now())) return;
+      || (currentHold !== undefined && isCodexAccountPaused(config, MAIN_CODEX_ACCOUNT_ID))) return;
     const credential = getMainQuotaCredentialGeneration();
+    // A hold that appeared during preparation is first seen now and waits its base interval.
+    if (currentHold !== undefined && !mainHoldSeenFor(identityGeneration, credential)) {
+      armMainResetHold(identityGeneration, credential, currentHold);
+      return;
+    }
     // Reconcile the physical bearer before consulting the previous credential's delay.
     if (previous?.identity === identityGeneration && previous.credential === credential
-      && previous.after > Date.now()) return;
+      && mainRecoveryDueAt(previous, currentHold, config) > Date.now()) return;
     const currentQueryAfter = nextCodexUsageQueryAt(`main:${captureConfigGeneration()}:${credential}`) ?? 0;
     if (currentQueryAfter > Date.now()) {
       mainHardLockRecoveryAttempt = { identity: identityGeneration, credential,
@@ -162,8 +222,10 @@ export async function runMainAccountHardLockRecovery(config: OcxConfig): Promise
         if (transientAuth) mainHardLockRecoveryAttempt = undefined;
         else {
           const delay = nextQuotaQueryDelay(previousDelay || undefined);
+          const hold = predictedMainResetHold(getMainAccountHardLockStatus(config));
           mainHardLockRecoveryAttempt = getMainAccountHardLockStatus(config).state === "blocked" || creditRecoveryNeeded()
-            ? { identity: identityGeneration, credential, delay, after: Math.max(Date.now() + delay, queryAfter) }
+            ? { identity: identityGeneration, credential, delay, after: Math.max(Date.now() + delay, queryAfter),
+              ...(hold !== undefined ? { floor: Date.now() + MAIN_HOLD_MIN_INTERVAL_MS, resetBound: hold } : {}) }
             : undefined;
         }
       } else if (queryAfter > Date.now()) {
@@ -186,6 +248,7 @@ export function registerCodexCooldownRecoveryProbeWorker(config: OcxConfig): voi
     afterTick: () => {
       void runCodexCooldownRecoveryProbes(config);
       void runMainAccountHardLockRecovery(config);
+      void primeCodexPoolQuotas(config, "credit-renewal");
     },
   });
 }
@@ -265,6 +328,7 @@ export async function primeCodexPoolQuotas(
   primeInFlight = trackBackgroundWork(`codex-pool-quota-prime:${reason}`, (async () => {
     const pool = (runtimeConfig.codexAccounts ?? []).filter(isSelectableCodexPoolAccount);
     const stale = pool.filter(a => {
+      if (reason === "credit-renewal") return poolCreditRenewalDue(runtimeConfig, a.id);
       const q = getAccountQuota(a.id);
       const observationStale = reason === "priority-failback" && q
         && !codexQuotaHasFreshUsage(q, a.plan, Date.now(), CODEX_PRIORITY_FAILBACK_REFRESH_MS);
@@ -278,7 +342,10 @@ export async function primeCodexPoolQuotas(
       if (lastAttempt.generation !== readCodexAccountRecord(a.id)?.generation) return true;
       return Date.now() - lastAttempt.at >= POOL_CACHE_TTL;
     });
+    if (reason === "credit-renewal" && stale.length === 0) return;
     const primeMain = async () => {
+      // Main renewal owns its physical-identity claims and passive probe separately.
+      if (reason === "credit-renewal") return;
       const mainLease = tryAcquireNativeMainPrimeLease();
       if (!mainLease) return;
       try {
@@ -311,11 +378,12 @@ export async function primeCodexPoolQuotas(
         primeMain(),
         mapWithConcurrency(stale, POOL_QUOTA_REFRESH_CONCURRENCY, async a => {
           if (!getCodexAccountCredential(a.id)) return;
+          if (reason === "credit-renewal" && !poolCreditRenewalDue(getRuntimeConfig(config), a.id)) return;
           let result: PoolQuotaResult;
           try {
             const quota = getAccountQuota(a.id);
-            const bypassCachedQuota = reason === "priority-failback" && quota !== null
-              && !codexQuotaHasFreshUsage(quota, a.plan, Date.now(), CODEX_PRIORITY_FAILBACK_REFRESH_MS);
+            const bypassCachedQuota = reason === "credit-renewal" || (reason === "priority-failback" && quota !== null
+              && !codexQuotaHasFreshUsage(quota, a.plan, Date.now(), CODEX_PRIORITY_FAILBACK_REFRESH_MS));
             result = await fetchPoolAccountQuota(a.id, bypassCachedQuota, a.plan, getValidPoolTokenForPrime);
           } catch (error) {
             // Local quota-flight saturation proves no WHAM request existed for this account.

package/src/codex/auth-collision.ts

@@ -4,8 +4,9 @@ import { getCodexAccountCredential } from "./account-store";
 import { loadConfig } from "../config";
 import { resolveCodexHomeDir } from "./home";
 import { extractAccountId } from "../oauth/chatgpt";
-import { isSelectableCodexPoolAccount } from "./account-id";
+import { isSelectableCodexPoolAccount, MAIN_CODEX_ACCOUNT_ID } from "./account-id";
 import { codexPlanKey } from "./plan";
+import { getObservedMainCodexCollisionIdentity, sameCodexCollisionIdentity, type CodexCollisionIdentity } from "./collision-identity";
 import { MAX_AUTH_BYTES, readBounded } from "./native-profile-store";
 
 export interface CodexTokens {
@@ -94,17 +95,23 @@ function isWorkspacePlan(plan: unknown): boolean {
   return !!key && /team|business|enterprise|workspace|edu/.test(key);
 }
 
-// Main login and managed pool accounts are separate duplicate buckets.
-// Inside the pool, personal and workspace subscriptions are also separate buckets.
-// Within each pool bucket, keep the original ChatGPT account id + email collision guard.
+// Main login and pool accounts share the account id + email collision guard.
+// Personal and workspace subscriptions remain separate buckets.
 export function checkAccountIdCollision(
   chatgptAccountId: string,
   email?: string | null,
   plan?: unknown,
   excludeAccountId?: string | null,
+  main: CodexCollisionIdentity | null = getObservedMainCodexCollisionIdentity() ?? null,
 ): { collision: true; reason: string } | { collision: false } {
   const candidateEmail = normalizedEmail(email);
   const candidateWorkspace = isWorkspacePlan(plan);
+
+  if (excludeAccountId !== MAIN_CODEX_ACCOUNT_ID && main
+    && sameCodexCollisionIdentity({ accountId: chatgptAccountId, email, plan }, main)) {
+    return { collision: true, reason: "Account is already configured as the native Codex main account." };
+  }
+
   for (const account of loadConfig().codexAccounts ?? []) {
     if (excludeAccountId && account.id === excludeAccountId) continue;
     if (!isSelectableCodexPoolAccount(account)) continue;
@@ -117,3 +124,23 @@ export function checkAccountIdCollision(
   }
   return { collision: false };
 }
+
+export type MainAuth = CodexTokenReadResult | { status: "api-key-only" };
+
+/** A valid API-key login has no ChatGPT identity; anything else unreadable stays unknown. */
+export function readMainAuth(authPath = join(resolveCodexHomeDir(), "auth.json")): MainAuth {
+  const main = readCodexTokensResult(authPath, { bounded: true });
+  if (main.status !== "invalid") return main;
+  try {
+    const j: unknown = JSON.parse(readBounded(authPath, MAX_AUTH_BYTES).toString("utf-8"));
+    if (j === null || typeof j !== "object" || Array.isArray(j)) return main;
+    const envelope = j as { auth_mode?: unknown; OPENAI_API_KEY?: unknown; tokens?: unknown };
+    const apiKeyOnly = envelope.tokens == null
+      && (envelope.auth_mode === undefined || envelope.auth_mode === "api_key")
+      && typeof envelope.OPENAI_API_KEY === "string" && envelope.OPENAI_API_KEY.trim() !== "";
+    return apiKeyOnly ? { status: "api-key-only" } : main;
+  } catch {
+    return main;
+  }
+}
+

package/src/codex/auth-context.ts

@@ -97,6 +97,7 @@ import type { DataPlaneAdmission } from "../server/auth-cors";
 import { getMainReserveAuthorization, isMainReserveAuthorizationLive, nativeUserIdClaims, type MainReserveAuthorization } from "./reserve-availability";
 import { UpstreamRetryEvidenceError } from "../lib/upstream-retry";
 import { getEffectiveCodexAutoSwitchThreshold } from "./account-auto-switch";
+import { CODEX_MAIN_DUPLICATE_ACTION, configuredCodexMainDuplicate } from "./collision-identity";
 
 /**
  * A request-owned bearer cannot inspect the physical main credential for its plan, but cached
@@ -324,6 +325,8 @@ export type CodexAuthContext =
       writerGeneration: number;
       /** Captured before async credential work; never reconstructed after the upstream response. */
       mainQuotaWriter?: MainQuotaWriter;
+      /** Immutable credential proof captured while materializing this physical attempt's headers. */
+      mainQuotaDispatch?: MainQuotaDispatch;
       reserveAuthorization?: MainReserveAuthorization;
       accessToken: string;
       chatgptAccountId: string;
@@ -1080,6 +1083,33 @@ async function awaitMainAccountPolicyBindingSettled(
   if (!settled) throw new CodexMainProfileDrainingError();
 }
 
+/** Memory-only ownership check shared by Direct admission and pre-auth hard-lock routing. */
+export async function mainAccountHardLockAppliesToCaller(
+  headers: Headers,
+  policy: CodexAuthPolicyConfig,
+  options: Pick<ResolveCodexAuthContextOptions,
+    "substituteMainCredentialForDirect" | "signal" | "mainAccountPolicyBindingWaitMs"> = {},
+): Promise<boolean> {
+  if (options.substituteMainCredentialForDirect === true) return true;
+  if (!hasCallerCodexBearer(headers)) return false;
+  if (isMainAccountHardLockEnabled(policy)) await awaitMainAccountPolicyBindingSettled(options);
+  return callerMatchesObservedMain(headers);
+}
+
+/**
+ * Resolve ownership once, then hand back a synchronous proof. Main identity or its observed bearer
+ * can change across the await; the hard-lock reroute rechecks the proof with no await between it
+ * and the body rewrite, so a replacement main's lock never reroutes the original caller.
+ */
+export async function mainAccountHardLockCallerProof(
+  headers: Headers,
+  policy: CodexAuthPolicyConfig,
+  options: Parameters<typeof mainAccountHardLockAppliesToCaller>[2] = {},
+): Promise<(() => boolean) | null> {
+  if (!await mainAccountHardLockAppliesToCaller(headers, policy, options)) return null;
+  return options.substituteMainCredentialForDirect === true ? () => true : () => callerMatchesObservedMain(headers);
+}
+
 /**
  * Resolve the credential for one Codex turn. A main hard-lock reached through unpinned pool
  * selection is annotated with the earliest known pool recovery, so the refusal can name a retry
@@ -1172,8 +1202,7 @@ async function resolveCodexAuthContextUnannotated(
     // Trusted substitution still has to claim and validate stored main below.
     if (!substituteStoredMain && !hasCallerCodexBearer(headers)) throw new CodexDirectAuthenticationError();
     if (!substituteStoredMain) {
-      if (isMainAccountHardLockEnabled(policy)) await awaitMainAccountPolicyBindingSettled(options);
-      if (callerMatchesObservedMain(headers)) assertMainAccountPolicy(policy);
+      if (await mainAccountHardLockAppliesToCaller(headers, policy, options)) assertMainAccountPolicy(policy);
       assertCallerOwnedMainPoolNotCooled();
       if (reserve) {
         const selected = materializeCodexUpstreamAuth(headers, { kind: "main", accountId: null }, { config: policy });
@@ -1422,7 +1451,9 @@ async function resolveCodexAuthContextUnannotated(
     // cool down. Hand back any trial first -- no Pool account is being sent to.
     if (selected === MAIN_CODEX_ACCOUNT_ID && requestScopedMainCredential) {
       releaseTransientProbeGrant();
-      return await resolveCallerOwnedMainContext();
+      const context = await resolveCallerOwnedMainContext();
+      console.info("[codex] Pool selected caller-owned main credential.");
+      return context;
     }
     if (!selected) {
       // A retry that excluded a failed Pool account may still use the validated caller-owned
@@ -1432,9 +1463,12 @@ async function resolveCodexAuthContextUnannotated(
       if (
         requestScopedMainCredential
         && fixedAccountId === undefined
+        && !(callerMatchesObservedMain(headers) && policy.pausedCodexAccountIds?.includes(MAIN_CODEX_ACCOUNT_ID))
         && options.excludeAccountId !== MAIN_CODEX_ACCOUNT_ID
       ) {
-        return await resolveCallerOwnedMainContext();
+        const context = await resolveCallerOwnedMainContext();
+        console.info("[codex] Pool used caller-owned main credential: no selectable stored account.");
+        return context;
       }
       if (fixedAccountId !== undefined) {
         if (modelEligibleAccountIds && !modelEligibleAccountIds.has(fixedAccountId)) {
@@ -1533,6 +1567,7 @@ async function resolveCodexAuthContextUnannotated(
   // deferred credential must never become request auth through that fallback.
   try {
     assertCodexAccountValidationReady(accountId);
+    if (configuredCodexMainDuplicate(config, accountId)) throw new CodexPoolAuthenticationError(CODEX_MAIN_DUPLICATE_ACTION);
     assertPoolAccountCredits(accountId, poolCreditHoldResetAt(policy, accountId, config));
   } catch (cause) {
     // Nothing will reach upstream, so give the trial back instead of leaving the held account
@@ -1590,9 +1625,12 @@ async function resolveCodexAuthContextUnannotated(
       // alternate is eligible. A validated caller may still serve this request,
       // just as it can after an upstream rejection, without changing Pool state.
       if (requestScopedMainCredential && fixedAccountId === undefined
+        && !(callerMatchesObservedMain(headers) && policy.pausedCodexAccountIds?.includes(MAIN_CODEX_ACCOUNT_ID))
         && options.excludeAccountId !== MAIN_CODEX_ACCOUNT_ID
         && !callerIsCooledPoolAccount(headers, config, accountId)) {
-        return await resolveCallerOwnedMainContext();
+        const context = await resolveCallerOwnedMainContext();
+        console.info("[codex] Pool used caller-owned main credential: stored account cooldown.");
+        return context;
       }
       throw new CodexAccountCooldownError(accountId, cooldownUntil, cooldown?.cooldownSource, cooldown?.quotaScope);
     }
@@ -1660,6 +1698,7 @@ async function resolveCodexAuthContextUnannotated(
   try {
     const token = await getValidCodexToken(accountId, { signal: options.signal });
     assertCodexAccountValidationReady(accountId);
+    if (configuredCodexMainDuplicate(config, accountId)) throw new CodexPoolAuthenticationError(CODEX_MAIN_DUPLICATE_ACTION);
     assertPoolAccountCredits(accountId, poolCreditHoldResetAt(policy, accountId, config));
     return bindPoolCreditPolicy({
       kind: "pool",
@@ -1681,7 +1720,8 @@ async function resolveCodexAuthContextUnannotated(
     releaseTransientProbeGrant();
     if (probeLeaseId && probeQuotaScope) releaseCodexQuotaScopeProbeLease(accountId, probeQuotaScope, probeLeaseId);
     else if (probeLeaseId) releaseCodexQuotaProbeLease(accountId, probeLeaseId);
-    if (cause instanceof CodexPoolAccountCreditsOffError) throw cause;
+    // Post-refresh eligibility refusals do not invalidate a healthy credential.
+    if (cause instanceof CodexPoolAccountCreditsOffError || cause instanceof CodexPoolAuthenticationError) throw cause;
     if (!options.signal?.aborted && shouldMarkAccountNeedsReauthForCodexAuthFailure(cause)) {
       markAccountNeedsReauth(accountId, writerGeneration);
     }
@@ -1766,6 +1806,8 @@ export function materializeCodexUpstreamAuth(
     if (ctx.kind === "main-pool") {
       ctx.mainQuotaWriter = observeSelectedMainCredential(ctx, ctx.mainQuotaWriter);
       assertMainAccountPolicy(options.config);
+      ctx.mainQuotaDispatch = ctx.mainQuotaWriter && isMainQuotaWriterLive(ctx.mainQuotaWriter)
+        ? selectedMainQuotaDispatch(selected) : undefined;
     }
     assertMaterializedReserve(selected, ctx, options);
     return selected;

package/src/codex/cli-update-plan.ts

@@ -213,9 +213,15 @@ function npmTarget(args: readonly string[], env?: NodeJS.ProcessEnv): NpmTarget
  * reverse: they are output paths, so ambient values would write Node artifacts to
  * arbitrary external directories on exit. ELF/Darwin loader controls (LD_* and
  * DYLD_*) are also removed: they can load code or redirect loader output before
- * npm runs. This is a denylist for process-startup/output channels, not a claim
- * that every ambient variable is allowlisted. Ordinary OS environment, proxy
- * settings and the supported NODE_EXTRA_CA_CERTS extension remain available.
+ * npm runs. OpenSSL's startup inputs are removed with them: OPENSSL_CONF names
+ * a configuration file the crypto library reads at startup, OPENSSL_CONF_INCLUDE
+ * resolves relative includes inside that configuration, and OPENSSL_MODULES /
+ * OPENSSL_ENGINES name the directories its provider and engine search loads
+ * shared modules from. None of these is input the updater child needs, so
+ * ambient values stay out of the spawned npm. This is a denylist for
+ * process-startup/output channels, not a claim that every ambient variable is
+ * allowlisted. Ordinary OS environment, proxy settings and the supported
+ * NODE_EXTRA_CA_CERTS extension remain available.
  */
 const NPM_ENV_DROP_KEYS: ReadonlySet<string> = new Set([
   "node_options",
@@ -227,6 +233,15 @@ const NPM_ENV_DROP_KEYS: ReadonlySet<string> = new Set([
   // escaping the owned temp root regardless of the isolated --cache.
   "node_v8_coverage",
   "node_redirect_warnings",
+  // OpenSSL startup inputs: OPENSSL_CONF points the library at an ambient
+  // startup configuration file (OPENSSL_CONF_INCLUDE resolves that config's
+  // relative includes); OPENSSL_MODULES and OPENSSL_ENGINES point its
+  // provider/engine search at ambient directories that supply loadable
+  // shared modules.
+  "openssl_conf",
+  "openssl_conf_include",
+  "openssl_modules",
+  "openssl_engines",
 ]);
 
 function codexCliUpdateNpmEnv(base: NodeJS.ProcessEnv = process.env): NodeJS.ProcessEnv {

package/src/codex/collision-identity.ts

@@ -0,0 +1,78 @@
+import { extractAccountIdClaims, extractEmail } from "../oauth/chatgpt";
+import type { CodexAccount, OcxConfig } from "../types";
+import { getCodexAccountCredential } from "./account-store";
+import type { CodexTokens } from "./auth-collision";
+import { captureMainAccountIdentityGeneration, isMainAccountIdentityGenerationLive } from "./main-account-cache";
+import { codexPlanKey, extractChatgptPlanType } from "./plan";
+
+export interface CodexCollisionIdentity {
+  accountId: string;
+  email?: string | null;
+  plan?: unknown;
+}
+
+function normalizedEmail(email: string | null | undefined): string | undefined {
+  return email?.trim().toLowerCase() || undefined;
+}
+
+function workspacePlan(plan: unknown): boolean {
+  return /team|business|enterprise|workspace|edu/.test(codexPlanKey(plan) ?? "");
+}
+
+/** Missing member evidence cannot establish a distinct subscription within one plan bucket. */
+export function sameCodexCollisionIdentity(a: CodexCollisionIdentity, b: CodexCollisionIdentity): boolean {
+  if (!a.accountId || a.accountId !== b.accountId || workspacePlan(a.plan) !== workspacePlan(b.plan)) return false;
+  const aEmail = normalizedEmail(a.email);
+  const bEmail = normalizedEmail(b.email);
+  return !aEmail || !bEmail || aEmail === bEmail;
+}
+
+// Ambient scope comparison is memory-only, including when the default-home resolver would probe WSL.
+function homeScope(): string {
+  return JSON.stringify([process.env.CODEX_HOME, process.env.HOME, process.env.USERPROFILE, process.env.OPENCODEX_HOME]);
+}
+
+let observed: { identity: CodexCollisionIdentity; homeScope: string; generation: number } | undefined;
+
+/** Only existing owned lifecycle observations may publish; never call with a request bearer. */
+export function observeMainCodexCollisionIdentity(tokens?: CodexTokens): void {
+  if (!tokens) { observed = undefined; return; }
+  if (typeof tokens.access_token !== "string" || typeof tokens.account_id !== "string"
+    || (tokens.id_token !== undefined && typeof tokens.id_token !== "string")) return;
+  const claims = [extractAccountIdClaims(tokens.id_token), extractAccountIdClaims(tokens.access_token)];
+  if (claims.some(claim => claim.conflict)) return;
+  const accountId = tokens.account_id || claims.find(claim => claim.accountId)?.accountId;
+  if (!accountId || claims.some(claim => claim.accountId && claim.accountId !== accountId)) return;
+  const emails = new Set([extractEmail(tokens.id_token), extractEmail(undefined, tokens.access_token)]
+    .flatMap(email => normalizedEmail(email) ? [normalizedEmail(email)!] : []));
+  if (emails.size > 1) return;
+  observed = { identity: { accountId, email: [...emails][0],
+    plan: extractChatgptPlanType(tokens.id_token, tokens.access_token) },
+    homeScope: homeScope(), generation: captureMainAccountIdentityGeneration() };
+}
+
+/** Compare known identity only. External logins become visible at the next owned observation. */
+export function getObservedMainCodexCollisionIdentity(): Readonly<CodexCollisionIdentity> | undefined {
+  return observed?.homeScope === homeScope() && isMainAccountIdentityGenerationLive(observed.generation)
+    ? observed.identity : undefined;
+}
+
+export function isStoredCodexMainDuplicate(account: CodexAccount): boolean {
+  const main = getObservedMainCodexCollisionIdentity();
+  if (account.isMain || !main) return false;
+  const credential = getCodexAccountCredential(account.id);
+  if (!credential?.chatgptAccountId) return false;
+  const storedEmail = normalizedEmail(account.email);
+  const email = storedEmail && storedEmail !== normalizedEmail(account.id)
+    ? storedEmail : extractEmail(undefined, credential.accessToken);
+  return sameCodexCollisionIdentity({ accountId: credential.chatgptAccountId, email,
+    plan: codexPlanKey(account.plan) ? account.plan : extractChatgptPlanType(undefined, credential.accessToken) }, main);
+}
+
+export const CODEX_MAIN_DUPLICATE_ACTION =
+  "Use the native Codex main account, or sign native Codex into a different account to use this stored Pool entry.";
+
+export function configuredCodexMainDuplicate(config: Pick<OcxConfig, "codexAccounts">, accountId: string): boolean {
+  const account = config.codexAccounts?.find(row => row.id === accountId);
+  return !!account && isStoredCodexMainDuplicate(account);
+}

package/src/codex/main-account-hard-lock.ts

@@ -121,3 +121,17 @@ export function getMainAccountHardLockStatus(
 export function isMainAccountHardLocked(config: PolicyConfig, now = Date.now()): boolean {
   return getMainAccountHardLockStatus(config, now).state === "blocked";
 }
+
+/**
+ * Scheduling evidence only: the latest blocking reset even after it has passed, so recovery can
+ * notice a revised reset that expired between sweeps. Never an admission or unlock signal.
+ */
+export function latestMainBlockingResetAt(config: PolicyConfig): number | undefined {
+  if (!isMainAccountHardLockEnabled(config)) return undefined;
+  const quota = getMainPolicyQuota();
+  if (!quota) return undefined;
+  const thresholds = resolveMainAccountHardLockThresholds(config);
+  const resets = governingWindows(quota)
+    .filter(w => validPercent(w.percent) && w.percent >= thresholds[w.kind]).map(w => resetTimestamp(w.resetAt));
+  return resets.length > 0 && resets.every(r => r !== undefined) ? Math.max(...(resets as number[])) : undefined;
+}

package/src/codex/routing/cooldown-math.ts

@@ -6,6 +6,7 @@ import { isThirtyDayOnlyCodexPlan } from "../plan";
 import { hasSpendableCodexCredits, isTerminalShortWindow, type CodexSpendableCredits } from "../quota-types";
 import type { CodexQuotaScope } from "./health-store";
 import type { TransientProbeGrant } from "./thread-affinity";
+import type { MainQuotaDispatch } from "../main-account-cache";
 
 export { TERMINAL_SHORT_WINDOW_FRESHNESS_MS } from "../quota-types";
 
@@ -99,6 +100,10 @@ export type CodexUpstreamOutcomeMeta = {
    * means the caller cannot supply lineage and the historical unfenced handling stands.
    */
   credentialGeneration?: number;
+  /** Main credential proof captured before dispatch; null means no owned proof was available. */
+  mainFailureWindowDispatch?: MainQuotaDispatch | null;
+  /** Pool sample provenance retained by a terminal callback even if its context is reused. */
+  failureWindowCredentialGeneration?: number;
 };
 
 export function computeCodexUsageScore(quota: {

package/src/codex/routing/failure-window.ts

@@ -1,5 +1,9 @@
 import { pinnedCodexAccountId } from "../account-priority";
 import type { OcxConfig } from "../../types";
+import { beginCodexAccountGenerationLiveCheck, isCodexAccountGenerationLive } from "../account-store";
+import { isMainQuotaDispatchLive } from "../main-account-cache";
+import type { CodexAuthContext } from "../auth-context";
+import type { CodexUpstreamOutcomeMeta } from "./cooldown-math";
 import {
   deleteAccountHealth,
   setAccountHealth,
@@ -14,12 +18,31 @@ export const CODEX_SLIDING_FAILURE_RECOVER_RATIO = 0.1;
 export const CODEX_SLIDING_FAILURE_RECOVER_SUSTAIN_MS = 30_000;
 const MAX_SAMPLES = 512;
 
-type Sample = { at: number; failed: boolean };
-type WindowState = { samples: Sample[]; degraded: boolean; healthySince?: number };
+type Sample = { at: number; failed: boolean; credentialGeneration?: number };
+type WindowState = { samples: Sample[]; degraded: boolean; healthySince?: number; credentialGeneration?: number };
 
 const windows = new Map<string, WindowState>();
 const pinnedDegradeWarned = new Set<string>();
 
+/** Read only dispatch-time provenance retained by auth materialization, never recapture at arrival. */
+export function codexFailureWindowOutcomeMeta(
+  context: CodexAuthContext,
+): Pick<CodexUpstreamOutcomeMeta, "failureWindowCredentialGeneration" | "mainFailureWindowDispatch"> {
+  if (context.kind === "pool") return { failureWindowCredentialGeneration: context.generation };
+  return context.kind === "main-pool" ? { mainFailureWindowDispatch: context.mainQuotaDispatch ?? null } : {};
+}
+
+/** Fence window samples only; other health and recovery-lease semantics stay with their owners. */
+export function noteCodexFailureWindowOutcome(
+  config: OcxConfig, accountId: string, failed: boolean, now: number, meta: CodexUpstreamOutcomeMeta,
+): void {
+  if (meta.mainFailureWindowDispatch !== undefined
+    && (!meta.mainFailureWindowDispatch || !isMainQuotaDispatchLive(meta.mainFailureWindowDispatch))) return;
+  const generation = meta.failureWindowCredentialGeneration ?? meta.credentialGeneration;
+  if (generation !== undefined && !isCodexAccountGenerationLive(accountId, generation)) return;
+  appendSample(config, accountId, failed, now, generation);
+}
+
 export function codexFailureWindowEnabled(config: OcxConfig): boolean {
   return config.codexFailureWindow !== false;
 }
@@ -33,11 +56,27 @@ function stateFor(accountId: string): WindowState {
   return state;
 }
 
-function recompute(state: WindowState, now: number): void {
-  const cutoff = now - CODEX_SLIDING_FAILURE_WINDOW_MS;
-  if (state.samples.length > 0 && state.samples[0]!.at <= cutoff) {
-    state.samples = state.samples.filter(sample => sample.at > cutoff);
+function recompute(
+  accountId: string, state: WindowState, now: number,
+  generationLive?: ReturnType<typeof beginCodexAccountGenerationLiveCheck>,
+): void {
+  // One store snapshot per insertion/read, never one file load per retained sample. The
+  // unlocked insertion precheck can race another process; provenance must survive it.
+  const tagged = state.credentialGeneration !== undefined
+    || state.samples.some(sample => sample.credentialGeneration !== undefined);
+  const live = generationLive ?? (tagged ? beginCodexAccountGenerationLiveCheck() : undefined);
+  // Unknown evidence is not a credential removal: preserve samples and all derived state.
+  if (live?.snapshotStatus === "failed") return;
+  if (state.credentialGeneration !== undefined && !live?.(accountId, state.credentialGeneration)) {
+    state.degraded = false;
+    state.healthySince = undefined;
+    state.credentialGeneration = undefined;
+    pinnedDegradeWarned.delete(accountId);
   }
+  const cutoff = now - CODEX_SLIDING_FAILURE_WINDOW_MS;
+  state.samples = state.samples.filter(sample => sample.at > cutoff
+    && (sample.credentialGeneration === undefined || live?.(accountId, sample.credentialGeneration)));
+  state.credentialGeneration ??= state.samples.find(sample => sample.credentialGeneration !== undefined)?.credentialGeneration;
   const samples = state.samples.length;
   const failed = state.samples.reduce((count, sample) => count + (sample.failed ? 1 : 0), 0);
   const degraded = samples >= CODEX_SLIDING_FAILURE_MIN_SAMPLES
@@ -71,19 +110,32 @@ export function noteCodexFailureWindowSample(
   accountId: string,
   failed: boolean,
   now: number,
+): void {
+  appendSample(config, accountId, failed, now);
+}
+
+function appendSample(
+  config: OcxConfig, accountId: string, failed: boolean, now: number, credentialGeneration?: number,
 ): void {
   if (!codexFailureWindowEnabled(config)) return;
+  const existing = windows.get(accountId);
+  const tagged = credentialGeneration !== undefined || existing?.credentialGeneration !== undefined
+    || existing?.samples.some(sample => sample.credentialGeneration !== undefined);
+  const live = tagged ? beginCodexAccountGenerationLiveCheck() : undefined;
+  if (live?.snapshotStatus === "failed") return;
+  // A stale arrival is not an ownership transition and must not delete a live replacement's state.
+  if (credentialGeneration !== undefined && !live?.(accountId, credentialGeneration)) return;
   const state = stateFor(accountId);
-  state.samples.push({ at: now, failed });
+  state.samples.push({ at: now, failed, ...(credentialGeneration === undefined ? {} : { credentialGeneration }) });
   if (state.samples.length > MAX_SAMPLES) state.samples.splice(0, state.samples.length - MAX_SAMPLES);
-  recompute(state, now);
+  recompute(accountId, state, now, live);
   if (!state.degraded) pinnedDegradeWarned.delete(accountId);
 }
 
 export function isCodexFailureWindowDegraded(accountId: string, now = Date.now()): boolean {
   const state = windows.get(accountId);
   if (!state) return false;
-  recompute(state, now);
+  recompute(accountId, state, now);
   if (!state.degraded) pinnedDegradeWarned.delete(accountId);
   return state.degraded;
 }