@bitkyc08/opencodex 2.89.0 → 2.91.0

package/src/codex/account-store.ts

@@ -136,25 +136,37 @@ export function peekCodexAccountRecordStore(): Record<string, CodexAccountCreden
 
 /** Read the Codex account record store from disk with hardened permissions, and hand it to the opt-in decision-quota slot (a no-op unless JEV quota signals are active). */
 function loadCodexAccountRecordStore(): CodexAccountStore {
+  const result = loadCodexAccountRecordStoreResult();
+  return result.status === "ok" ? result.records : {};
+}
+
+type CodexAccountRecordStoreResult = { status: "ok"; records: CodexAccountStore } | { status: "failed" };
+
+/** Retain read/parse failure separately for consumers that must preserve existing evidence. */
+function loadCodexAccountRecordStoreResult(): CodexAccountRecordStoreResult {
   const path = codexAccountsPath();
   hardenConfigDir();
   hardenExistingSecret(path);
-  if (!existsSync(path)) { notifyCodexStoreLoaded({}); return {}; }
   const normalized: CodexAccountStore = {};
   try {
     const raw = JSON.parse(readFileSync(path, "utf-8")) as RawCodexAccountStore;
+    if (!isObject(raw)) throw new Error("invalid Codex account store shape");
     for (const [id, value] of Object.entries(raw)) {
       const record = normalizeRecord(value);
       if (record) normalized[id] = record;
     }
-  } catch {
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") {
+      notifyCodexStoreLoaded({});
+      return { status: "ok", records: {} };
+    }
     backupInvalidConfig(path);
     notifyCodexStoreLoaded({});
-    return {};
+    return { status: "failed" };
   }
   // Outside the parse try: roster publication is advisory and must never route a loaded store into the invalid-config backup path.
   notifyCodexStoreLoaded(normalized);
-  return normalized;
+  return { status: "ok", records: normalized };
 }
 
 /** Atomically write the Codex account store, then hand it to the opt-in decision-quota slot so active advisory evidence tracks the persisted credentials. */
@@ -400,6 +412,10 @@ export function isCodexAccountGenerationLive(id: string, generation: number): bo
   return !!record?.credential && record.deletedAt == null && record.generation === generation;
 }
 
+/** Callable for existing liveness consumers; stateful consumers can distinguish unknown snapshots. */
+export type CodexAccountGenerationLiveCheck = ((id: string, generation: number) => boolean)
+  & { readonly snapshotStatus: "ok" | "failed" };
+
 /**
  * The same verdict as {@link isCodexAccountGenerationLive}, over ONE store load.
  *
@@ -409,12 +425,15 @@ export function isCodexAccountGenerationLive(id: string, generation: number): bo
  * several accounts in one synchronous pass on the request path, so it opens one checker and
  * closes over the snapshot instead.
  */
-export function beginCodexAccountGenerationLiveCheck(): (id: string, generation: number) => boolean {
-  const snapshot = loadCodexAccountRecordSnapshot();
-  return (id, generation) => {
+export function beginCodexAccountGenerationLiveCheck(): CodexAccountGenerationLiveCheck {
+  let result: CodexAccountRecordStoreResult;
+  try { result = loadCodexAccountRecordStoreResult(); }
+  catch { result = { status: "failed" }; }
+  const snapshot = result.status === "ok" ? result.records : {};
+  return Object.assign((id: string, generation: number) => {
     const record = snapshot[id];
     return !!record?.credential && record.deletedAt == null && record.generation === generation;
-  };
+  }, { snapshotStatus: result.status });
 }
 
 export function saveCodexAccountCredentialIfGeneration(

package/src/codex/account-usability.ts

@@ -9,6 +9,7 @@ import { hasLegacyMainCodexPoolAccount, isSelectableCodexPoolAccount } from "./a
 import type { OcxConfig } from "../types";
 import { isNativeMainTrafficBlocked } from "./native-profile-startup";
 import { isMainAccountHardLocked } from "./main-account-hard-lock";
+import { configuredCodexMainDuplicate } from "./collision-identity";
 
 export interface CodexAccountUsabilityOptions {
   /** Route using cached runtime state only; the caller must reject selected main before auth. */
@@ -64,7 +65,8 @@ export type CodexAccountUnusableReason =
   | "not_in_pool"
   | "missing_credential"
   | "deleted"
-  | "validation_pending";
+  | "validation_pending"
+  | "duplicate_main";
 
 /**
  * The single source of truth for both selection and its explanation. `isCodexAccountUsable()` is
@@ -110,6 +112,7 @@ export function codexAccountUnusableReason(
   if (!record?.credential) return "missing_credential";
   if (record.deletedAt != null) return "deleted";
   if (record.codexValidationPending) return "validation_pending";
+  if (configuredCodexMainDuplicate(config, accountId)) return "duplicate_main";
   return undefined;
 }
 

package/src/codex/auth-api/account-list.ts

@@ -1,7 +1,6 @@
 import { getMainAccountExternalUsageWarning, type MainAccountExternalUsageWarning } from "../main-account-external-usage";
 import { codexCreditsDtoField, hasCodexCreditsObservation, pruneCodexCredits } from "../credits";
 import type { CodexCredits } from "../credits";
-import { getMainChatgptAccountId } from "../auth-collision";
 import { codexAccountLogLabel } from "../account-label";
 import { poolQuotaHistoryIdentity, getCodexAccountCredential, getValidCodexToken, isCodexAccountGenerationLive, readCodexAccountRecord } from "../account-store";
 import { getAccountQuota, isCodexQuotaExhausted, setAccountQuotaFromParsed, withoutRetiredCodexQuota } from "../quota";
@@ -35,6 +34,7 @@ import { fetchPoolAccountQuota, PoolQuotaProbeBusyError, POOL_QUOTA_REFRESH_CONC
 import type { PoolQuotaResult } from "./pool-quota-probe";
 import { getRuntimeConfig, configuredPoolAccount, mapWithConcurrency } from "./runtime-config";
 import { isPassiveRead } from "../../lib/passive-read";
+import { CODEX_MAIN_DUPLICATE_ACTION, configuredCodexMainDuplicate, getObservedMainCodexCollisionIdentity } from "../collision-identity";
 
 export function quotaForPlan<T extends Omit<StoredAccountQuota, "updatedAt"> | StoredAccountQuota | null>(
   quota: T,
@@ -133,6 +133,7 @@ export function poolAccountDto(
   // health projection. Emitting only the boolean is what left #4212's reporter guessing which
   // account took their model away and why, so name the cause they actually have to act on.
   const reauthReason: CodexAccountReauthReason | undefined = rawReauthReason ?? (health.status === "reauth_required" ? health.reason : undefined);
+  const duplicateMain = configuredCodexMainDuplicate(config, account.id);
   return {
     id: account.id,
     email: projectEmail(account.email, maskEmails) ?? account.email,
@@ -150,7 +151,10 @@ export function poolAccountDto(
     ...codexCreditsDtoField(config, account.id, poolQuotaHistoryIdentity(account.id) ?? null),
     needsReauth: needsReauth || health.status === "reauth_required",
     ...(reauthReason !== undefined ? { reauthReason } : {}),
-    ...(isCodexAccountPlanExcluded(config, account.id) ? {
+    ...(duplicateMain ? {
+      selectionExcludedReason: "duplicate_main" as const,
+      selectionExcludedAction: CODEX_MAIN_DUPLICATE_ACTION,
+    } : isCodexAccountPlanExcluded(config, account.id) ? {
       selectionExcludedReason: "plan_excluded" as const,
       selectionExcludedPlan: codexPlanValue(config.codexAccounts?.find(row => row.id === account.id)?.plan),
     } : {}),
@@ -184,8 +188,9 @@ export interface CodexAuthAccountDto {
    * needs the operator; `/api/oauth/accounts` already carries the same field name.
    */
   reauthReason?: CodexAccountReauthReason;
-  /** Automatic selection policy only; explicit routes retain their usual auth checks. */
-  selectionExcludedReason?: "plan_excluded";
+  /** Plan policy is automatic-only; duplicate-main exclusions also apply to explicit routes. */
+  selectionExcludedReason?: "plan_excluded" | "duplicate_main";
+  selectionExcludedAction?: string;
   selectionExcludedPlan?: string;
   hasCredential: boolean;
   health: OAuthAccountHealth;
@@ -418,7 +423,7 @@ export async function listCodexAuthAccountsSnapshot(
       quota: mainInfo.quota
         ? quotaForPlan(mainQuotaWithCarriedResetCredits(mainInfo.quota), mainInfo.plan)
         : null,
-      ...codexCreditsDtoField(runtimeConfig, MAIN_CODEX_ACCOUNT_ID, getMainChatgptAccountId()),
+      ...codexCreditsDtoField(runtimeConfig, MAIN_CODEX_ACCOUNT_ID, getObservedMainCodexCollisionIdentity()?.accountId ?? null),
       ...oauthAccountHealthFields("codex", MAIN_CODEX_ACCOUNT_ID, mainHealth),
     };
     return {

package/src/codex/auth-api/account-pause-group.ts

@@ -1,35 +1,15 @@
 import { observeSignedInCodexIdentity } from "../signed-in-identity";
 import { lstatSync } from "node:fs";
 import type { OcxConfig } from "../../types";
-import { readCodexTokensResult } from "../auth-collision";
-import type { CodexTokenReadResult } from "../auth-collision";
+import { readMainAuth } from "../auth-collision";
 import { linkedCodexAccountIds } from "../account-identity";
 import { resolveCodexHomeDir } from "../home";
 import { tryAcquireNativeMainProfileClaim } from "../native-main-admission";
 import { withNativeMainSharedClaim } from "../native-main-claim";
-import { MAX_AUTH_BYTES, readBounded, resolveNativeProfileContext } from "../native-profile-store";
+import { resolveNativeProfileContext } from "../native-profile-store";
 import { NativeProfileError } from "../native-profile-types";
 import { isNativeMainClaimUnavailable, nativeMainProfileBusyResponse } from "./http";
 
-type MainAuth = CodexTokenReadResult | { status: "api-key-only" };
-
-/** A valid API-key login has no ChatGPT identity; anything else unreadable stays unknown. */
-function readMainAuth(authPath: string): MainAuth {
-  const main = readCodexTokensResult(authPath, { bounded: true });
-  if (main.status !== "invalid") return main;
-  try {
-    const j: unknown = JSON.parse(readBounded(authPath, MAX_AUTH_BYTES).toString("utf-8"));
-    if (j === null || typeof j !== "object" || Array.isArray(j)) return main;
-    const envelope = j as { auth_mode?: unknown; OPENAI_API_KEY?: unknown; tokens?: unknown };
-    const apiKeyOnly = envelope.tokens == null
-      && (envelope.auth_mode === undefined || envelope.auth_mode === "api_key")
-      && typeof envelope.OPENAI_API_KEY === "string" && envelope.OPENAI_API_KEY.trim() !== "";
-    return apiKeyOnly ? { status: "api-key-only" } : main;
-  } catch {
-    return main;
-  }
-}
-
 /** Hold admission throughout; claim the physical main whenever its home exists. */
 export async function withCodexAccountPauseGroup(
   config: OcxConfig,

package/src/codex/auth-api/login-collision.ts

@@ -0,0 +1,59 @@
+import { lstatSync } from "node:fs";
+import { extractAccountId, extractAccountIdClaims, extractEmail } from "../../oauth/chatgpt";
+import { checkAccountIdCollision, readMainAuth } from "../auth-collision";
+import { resolveCodexHomeDir } from "../home";
+import { tryAcquireNativeMainProfileClaim } from "../native-main-admission";
+import { withNativeMainSharedClaim } from "../native-main-claim";
+import { resolveNativeProfileContext } from "../native-profile-store";
+import { NativeProfileError } from "../native-profile-types";
+import { extractChatgptPlanType } from "../plan";
+import { isNativeMainClaimUnavailable } from "./http";
+
+export class CodexCollisionReadBusyError extends Error {
+  constructor() { super("Native Codex login is busy or unreadable; retry login shortly."); }
+}
+
+/** Only admission owns physical reads; synchronous collision consumers use observed identity. */
+export async function checkAccountIdCollisionWithNativeMain(
+  accountId: string, email?: string | null, plan?: unknown, excludeAccountId?: string | null,
+): Promise<ReturnType<typeof checkAccountIdCollision>> {
+  const lease = tryAcquireNativeMainProfileClaim();
+  if (!lease) throw new CodexCollisionReadBusyError();
+  try {
+    const codexHome = resolveCodexHomeDir();
+    try { lstatSync(codexHome); } catch (error) {
+      if ((error as NodeJS.ErrnoException)?.code === "ENOENT") {
+        return checkAccountIdCollision(accountId, email, plan, excludeAccountId, null);
+      }
+      throw new CodexCollisionReadBusyError();
+    }
+    const context = resolveNativeProfileContext({ codexHome });
+    return await withNativeMainSharedClaim(context, async () => {
+      const main = readMainAuth(context.authPath);
+      if (main.status === "missing" || main.status === "api-key-only") {
+        return checkAccountIdCollision(accountId, email, plan, excludeAccountId, null);
+      }
+      if (main.status !== "ok") throw new CodexCollisionReadBusyError();
+      const tokens = main.tokens;
+      const nativeId = extractAccountId(tokens.id_token, tokens.access_token) ?? tokens.account_id;
+      const claims = [extractAccountIdClaims(tokens.id_token), extractAccountIdClaims(tokens.access_token)];
+      const emails = [extractEmail(tokens.id_token), extractEmail(undefined, tokens.access_token)].filter(Boolean);
+      if (!nativeId || typeof tokens.account_id !== "string" || typeof tokens.access_token !== "string"
+        || (tokens.id_token !== undefined && typeof tokens.id_token !== "string")
+        || claims.some(claim => claim.conflict || (claim.accountId && claim.accountId !== nativeId))
+        || (tokens.account_id && tokens.account_id !== nativeId) || new Set(emails).size > 1) {
+        throw new CodexCollisionReadBusyError();
+      }
+      return checkAccountIdCollision(accountId, email, plan, excludeAccountId, {
+        accountId: nativeId, email: extractEmail(tokens.id_token, tokens.access_token),
+        plan: extractChatgptPlanType(tokens.id_token, tokens.access_token),
+      });
+    });
+  } catch (error) {
+    if (isNativeMainClaimUnavailable(error)
+      || (error instanceof NativeProfileError && error.code === "CODEX_HOME_UNAVAILABLE")) {
+      throw new CodexCollisionReadBusyError();
+    }
+    throw error;
+  } finally { lease.release(); }
+}

package/src/codex/auth-api/login-flow.ts

@@ -5,7 +5,8 @@ import type { StoredAccountQuota, WhamUsageResponse } from "../quota";
 import { ConfigMutationLockError, withConfigMutationLockSync } from "../../config";
 import { appendDefaultCodexAccountNamespace, codexAccountPickerEnabled } from "../account-namespaces";
 import { catalogRefreshIsPending, normalizeCatalogDisposition } from "../catalog-refresh-status";
-import { checkAccountIdCollision } from "../auth-collision";
+import { checkAccountIdCollisionWithNativeMain as checkAccountIdCollision, CodexCollisionReadBusyError } from "./login-collision";
+import { extractChatgptPlanType } from "../plan";
 import { clearAccountNeedsReauth, isAccountNeedsReauth, markAccountNeedsReauth } from "../account-runtime-state";
 import { clearCodexPoolRefreshFailure } from "../pool-refresh-backoff";
 import { reconcileLiveStateStores } from "../../lib/state-store-registrations";
@@ -262,8 +263,8 @@ export async function handleCodexAuthLoginStart(req: Request, config: OcxConfig,
                 break;
               }
 
-              let email = cred.email || accountId;
-              let plan: string | undefined;
+              let email = cred.email?.trim() || "";
+              let plan = extractChatgptPlanType(undefined, cred.access);
               let quota: Omit<StoredAccountQuota, "updatedAt"> | null = null;
               let policyQuota: Omit<StoredAccountQuota, "updatedAt"> | null = null;
               try {
@@ -274,8 +275,8 @@ export async function handleCodexAuthLoginStart(req: Request, config: OcxConfig,
                 });
                 if (resp.ok) {
                   const data = (await resp.json()) as WhamUsageResponse;
-                  email = data.email ?? email;
-                  plan = nonEmptyPlan(data.plan_type) ?? undefined;
+                  email = data.email?.trim() || email;
+                  plan = nonEmptyPlan(data.plan_type) ?? plan;
                   quota = parseUsageQuota(data);
                   policyQuota = isValidWhamHistoryObservation(data) ? quota : null;
                 }
@@ -322,7 +323,7 @@ export async function handleCodexAuthLoginStart(req: Request, config: OcxConfig,
               }
 
               // 1.2: Duplicate check is scoped by personal vs workspace plan bucket.
-              const collision = checkAccountIdCollision(oauthAccountId, email, plan, reauth ? accountId : undefined);
+              const collision = await checkAccountIdCollision(oauthAccountId, email, plan, reauth ? accountId : undefined);
               if (collision.collision) {
                 setCodexLoginState(flowId, {
                   status: "error", error: collision.reason, doneAt: Date.now(),
@@ -331,6 +332,8 @@ export async function handleCodexAuthLoginStart(req: Request, config: OcxConfig,
                 break;
               }
 
+              email ||= accountId;
+
               // A successful authenticated WHAM read can prove quota is exhausted without
               // spending an inference request. Store the account, but defer inference validation
               // and keep it unavailable to routing. Unknown/failed usage reads retain the gate.
@@ -470,7 +473,9 @@ export async function handleCodexAuthLoginStart(req: Request, config: OcxConfig,
           });
         }
       } catch (error) {
-        const message = error instanceof ConfigMutationLockError
+        const message = error instanceof CodexCollisionReadBusyError
+          ? "Native Codex login is busy or unreadable; retry login shortly."
+          : error instanceof ConfigMutationLockError
           || error instanceof CodexCredentialRefreshLockTimeoutError
           ? "Configuration is busy; retry login shortly."
           : error instanceof CodexCredentialRefreshBusyError || error instanceof CodexCredentialRefreshStaleError

package/src/codex/auth-api/pool-mode-gate.ts

@@ -13,7 +13,7 @@ import { isAccountNeedsReauth } from "../account-runtime-state";
 import { getValidMainAccountToken, MAIN_CODEX_ACCOUNT_ID, getMainAccountPlan } from "../main-account";
 import { captureConfigGeneration, registerStateSweepAfterTick } from "../../lib/state-store-sweeper";
 import { observeMainQuotaCredential, getMainQuotaCredentialGeneration, captureMainAccountIdentityGeneration, isMainAccountIdentityGenerationLive } from "../main-account-cache";
-import { getMainAccountHardLockStatus } from "../main-account-hard-lock";
+import { getMainAccountHardLockStatus, latestMainBlockingResetAt } from "../main-account-hard-lock";
 import type { OcxConfig } from "../../types";
 import { isCanonicalOpenAiForwardProvider, OPENAI_CODEX_PROVIDER_ID } from "../../providers/openai-tiers";
 import { providerCodexAccountMode } from "../../providers/registry";
@@ -78,8 +78,55 @@ export async function runCodexCooldownRecoveryProbes(config: OcxConfig, now = Da
 
 const MAIN_CREDIT_RENEWAL_AGE_MS = 3 * 60_000;
 
+/** Traffic headers renew usage, never the independent credit observation (#7377). */
+function poolCreditRenewalDue(config: OcxConfig, accountId: string, now = Date.now()): boolean {
+  const account = configuredPoolAccount(config, accountId);
+  if (!account || !codexAccountUsesCreditsAfterLimit(config, accountId)
+    || isCodexAccountPaused(config, accountId) || isAccountNeedsReauth(accountId)) return false;
+  const quota = getAccountQuota(accountId);
+  if (codexUsageLimitResetAt(quota, account.plan, now) === undefined) return false;
+  const observedAt = quota?.credits?.observedAt;
+  if (observedAt !== undefined && Number.isFinite(observedAt)
+    && now - observedAt >= 0 && now - observedAt < MAIN_CREDIT_RENEWAL_AGE_MS) return false;
+  const attempt = poolQuotaPrimeAttemptedAt.get(accountId);
+  return !attempt || attempt.generation !== readCodexAccountRecord(accountId)?.generation
+    || now - attempt.at >= MAIN_CREDIT_RENEWAL_AGE_MS;
+}
+
 let mainHardLockRecoveryInFlight: Promise<void> | null = null;
-let mainHardLockRecoveryAttempt: { identity: number; credential: number; after: number; delay: number } | undefined;
+/** `floor` and `resetBound` apply only while a predicted reset is (or just was) holding the lock. */
+type MainRecoveryAttempt = { identity: number; credential: number; after: number; delay: number; floor?: number; resetBound?: number };
+let mainHardLockRecoveryAttempt: MainRecoveryAttempt | undefined;
+/** The identity/credential that already waited out its first hold interval. */
+let mainHardLockHoldSeen: { identity: number; credential: number } | undefined;
+const MAIN_HOLD_MIN_INTERVAL_MS = nextQuotaQueryDelay();
+
+/** The predicted reset of a blocked main, or undefined when no future reset is known. */
+function predictedMainResetHold(status: ReturnType<typeof getMainAccountHardLockStatus>): number | undefined {
+  return status.state === "blocked" && status.resetAt !== undefined && status.resetAt > Date.now()
+    ? status.resetAt : undefined;
+}
+
+/**
+ * A hold read is due at its backoff deadline, pulled in to the latest known predicted reset (even
+ * one that moved earlier or just passed) but never sooner than one base interval after the last read.
+ */
+function mainRecoveryDueAt(attempt: MainRecoveryAttempt, holdResetAt: number | undefined, config: OcxConfig): number {
+  // Once a hold elapses the status omits its reset; current evidence may still name a revised one.
+  const bound = holdResetAt ?? (attempt.resetBound === undefined ? undefined
+    : Math.min(attempt.resetBound, latestMainBlockingResetAt(config) ?? Infinity));
+  return bound === undefined ? attempt.after : Math.max(attempt.floor ?? 0, Math.min(attempt.after, bound));
+}
+
+/** First sight of a hold for this credential waits one base interval; transient retries do not re-arm it. */
+function armMainResetHold(identity: number, credential: number, holdResetAt: number): void {
+  const at = Date.now() + MAIN_HOLD_MIN_INTERVAL_MS;
+  mainHardLockHoldSeen = { identity, credential };
+  mainHardLockRecoveryAttempt = { identity, credential, delay: MAIN_HOLD_MIN_INTERVAL_MS, after: at, floor: at, resetBound: holdResetAt };
+}
+
+const mainHoldSeenFor = (identity: number, credential: number): boolean =>
+  mainHardLockHoldSeen?.identity === identity && mainHardLockHoldSeen.credential === credential;
 
 /** Metadata-only recovery on the existing sweep; failures retain the observed policy block. */
 export async function runMainAccountHardLockRecovery(config: OcxConfig): Promise<void> {
@@ -98,10 +145,14 @@ export async function runMainAccountHardLockRecovery(config: OcxConfig): Promise
         || (observedAt !== undefined && now - observedAt >= MAIN_CREDIT_RENEWAL_AGE_MS));
   };
   const status = getMainAccountHardLockStatus(config);
+  if (status.state !== "blocked") mainHardLockHoldSeen = undefined;
   if (status.state !== "blocked" && !creditRecoveryNeeded()) { mainHardLockRecoveryAttempt = undefined; return; }
   if (isAccountNeedsReauth(MAIN_CODEX_ACCOUNT_ID)) return;
-  // A predicted reset is a scheduling hint, never proof that the hard lock can be lifted.
-  if (status.state === "blocked" && status.resetAt !== undefined && status.resetAt > Date.now()) return;
+  // A predicted reset is a scheduling hint, never proof that the hard lock can be lifted. The
+  // hold is rechecked on the capped WHAM schedule so an early reset redeemed elsewhere is
+  // learned from metadata (#7312); a paused main receives no hold rechecks.
+  const holdResetAt = predictedMainResetHold(status);
+  if (holdResetAt !== undefined && isCodexAccountPaused(config, MAIN_CODEX_ACCOUNT_ID)) return;
   // Reconcile the owned physical credential before skipping work for an older one.
   reconcileMainCodexAccountRuntimeState();
   const physical = readCodexTokens();
@@ -109,9 +160,14 @@ export async function runMainAccountHardLockRecovery(config: OcxConfig): Promise
   const identity = captureMainAccountIdentityGeneration();
   const credential = getMainQuotaCredentialGeneration();
   const previous = mainHardLockRecoveryAttempt;
+  if (holdResetAt !== undefined && !mainHoldSeenFor(identity, credential)) {
+    armMainResetHold(identity, credential, holdResetAt);
+    return;
+  }
+  const sameAttempt = previous?.identity === identity && previous.credential === credential;
+  if (sameAttempt && holdResetAt !== undefined) previous.resetBound = holdResetAt;
   const queryAfter = nextCodexUsageQueryAt(`main:${captureConfigGeneration()}:${credential}`) ?? 0;
-  if ((previous?.identity === identity && previous.credential === credential
-    && previous.after > Date.now()) || queryAfter > Date.now()) return;
+  if ((sameAttempt && mainRecoveryDueAt(previous, holdResetAt, config) > Date.now()) || queryAfter > Date.now()) return;
   const lease = tryAcquireNativeMainProfileClaim();
   if (!lease) return;
   mainHardLockRecoveryInFlight = (async () => {
@@ -130,16 +186,20 @@ export async function runMainAccountHardLockRecovery(config: OcxConfig): Promise
       // Native refresh retains its own grant-scoped refusal; global quarantine would outlive it.
       return;
     }
-    const currentStatus = getMainAccountHardLockStatus(config);
+    const currentHold = predictedMainResetHold(getMainAccountHardLockStatus(config));
     if (isAccountNeedsReauth(MAIN_CODEX_ACCOUNT_ID)
       || !isMainAccountIdentityGenerationLive(identityGeneration)
       || (passive && !creditRecoveryNeeded())
-      || (currentStatus.state === "blocked" && currentStatus.resetAt !== undefined
-        && currentStatus.resetAt > Date.now())) return;
+      || (currentHold !== undefined && isCodexAccountPaused(config, MAIN_CODEX_ACCOUNT_ID))) return;
     const credential = getMainQuotaCredentialGeneration();
+    // A hold that appeared during preparation is first seen now and waits its base interval.
+    if (currentHold !== undefined && !mainHoldSeenFor(identityGeneration, credential)) {
+      armMainResetHold(identityGeneration, credential, currentHold);
+      return;
+    }
     // Reconcile the physical bearer before consulting the previous credential's delay.
     if (previous?.identity === identityGeneration && previous.credential === credential
-      && previous.after > Date.now()) return;
+      && mainRecoveryDueAt(previous, currentHold, config) > Date.now()) return;
     const currentQueryAfter = nextCodexUsageQueryAt(`main:${captureConfigGeneration()}:${credential}`) ?? 0;
     if (currentQueryAfter > Date.now()) {
       mainHardLockRecoveryAttempt = { identity: identityGeneration, credential,
@@ -162,8 +222,10 @@ export async function runMainAccountHardLockRecovery(config: OcxConfig): Promise
         if (transientAuth) mainHardLockRecoveryAttempt = undefined;
         else {
           const delay = nextQuotaQueryDelay(previousDelay || undefined);
+          const hold = predictedMainResetHold(getMainAccountHardLockStatus(config));
           mainHardLockRecoveryAttempt = getMainAccountHardLockStatus(config).state === "blocked" || creditRecoveryNeeded()
-            ? { identity: identityGeneration, credential, delay, after: Math.max(Date.now() + delay, queryAfter) }
+            ? { identity: identityGeneration, credential, delay, after: Math.max(Date.now() + delay, queryAfter),
+              ...(hold !== undefined ? { floor: Date.now() + MAIN_HOLD_MIN_INTERVAL_MS, resetBound: hold } : {}) }
             : undefined;
         }
       } else if (queryAfter > Date.now()) {
@@ -186,6 +248,7 @@ export function registerCodexCooldownRecoveryProbeWorker(config: OcxConfig): voi
     afterTick: () => {
       void runCodexCooldownRecoveryProbes(config);
       void runMainAccountHardLockRecovery(config);
+      void primeCodexPoolQuotas(config, "credit-renewal");
     },
   });
 }
@@ -265,6 +328,7 @@ export async function primeCodexPoolQuotas(
   primeInFlight = trackBackgroundWork(`codex-pool-quota-prime:${reason}`, (async () => {
     const pool = (runtimeConfig.codexAccounts ?? []).filter(isSelectableCodexPoolAccount);
     const stale = pool.filter(a => {
+      if (reason === "credit-renewal") return poolCreditRenewalDue(runtimeConfig, a.id);
       const q = getAccountQuota(a.id);
       const observationStale = reason === "priority-failback" && q
         && !codexQuotaHasFreshUsage(q, a.plan, Date.now(), CODEX_PRIORITY_FAILBACK_REFRESH_MS);
@@ -278,7 +342,10 @@ export async function primeCodexPoolQuotas(
       if (lastAttempt.generation !== readCodexAccountRecord(a.id)?.generation) return true;
       return Date.now() - lastAttempt.at >= POOL_CACHE_TTL;
     });
+    if (reason === "credit-renewal" && stale.length === 0) return;
     const primeMain = async () => {
+      // Main renewal owns its physical-identity claims and passive probe separately.
+      if (reason === "credit-renewal") return;
       const mainLease = tryAcquireNativeMainPrimeLease();
       if (!mainLease) return;
       try {
@@ -311,11 +378,12 @@ export async function primeCodexPoolQuotas(
         primeMain(),
         mapWithConcurrency(stale, POOL_QUOTA_REFRESH_CONCURRENCY, async a => {
           if (!getCodexAccountCredential(a.id)) return;
+          if (reason === "credit-renewal" && !poolCreditRenewalDue(getRuntimeConfig(config), a.id)) return;
           let result: PoolQuotaResult;
           try {
             const quota = getAccountQuota(a.id);
-            const bypassCachedQuota = reason === "priority-failback" && quota !== null
-              && !codexQuotaHasFreshUsage(quota, a.plan, Date.now(), CODEX_PRIORITY_FAILBACK_REFRESH_MS);
+            const bypassCachedQuota = reason === "credit-renewal" || (reason === "priority-failback" && quota !== null
+              && !codexQuotaHasFreshUsage(quota, a.plan, Date.now(), CODEX_PRIORITY_FAILBACK_REFRESH_MS));
             result = await fetchPoolAccountQuota(a.id, bypassCachedQuota, a.plan, getValidPoolTokenForPrime);
           } catch (error) {
             // Local quota-flight saturation proves no WHAM request existed for this account.

package/src/codex/auth-collision.ts

@@ -4,8 +4,9 @@ import { getCodexAccountCredential } from "./account-store";
 import { loadConfig } from "../config";
 import { resolveCodexHomeDir } from "./home";
 import { extractAccountId } from "../oauth/chatgpt";
-import { isSelectableCodexPoolAccount } from "./account-id";
+import { isSelectableCodexPoolAccount, MAIN_CODEX_ACCOUNT_ID } from "./account-id";
 import { codexPlanKey } from "./plan";
+import { getObservedMainCodexCollisionIdentity, sameCodexCollisionIdentity, type CodexCollisionIdentity } from "./collision-identity";
 import { MAX_AUTH_BYTES, readBounded } from "./native-profile-store";
 
 export interface CodexTokens {
@@ -94,17 +95,23 @@ function isWorkspacePlan(plan: unknown): boolean {
   return !!key && /team|business|enterprise|workspace|edu/.test(key);
 }
 
-// Main login and managed pool accounts are separate duplicate buckets.
-// Inside the pool, personal and workspace subscriptions are also separate buckets.
-// Within each pool bucket, keep the original ChatGPT account id + email collision guard.
+// Main login and pool accounts share the account id + email collision guard.
+// Personal and workspace subscriptions remain separate buckets.
 export function checkAccountIdCollision(
   chatgptAccountId: string,
   email?: string | null,
   plan?: unknown,
   excludeAccountId?: string | null,
+  main: CodexCollisionIdentity | null = getObservedMainCodexCollisionIdentity() ?? null,
 ): { collision: true; reason: string } | { collision: false } {
   const candidateEmail = normalizedEmail(email);
   const candidateWorkspace = isWorkspacePlan(plan);
+
+  if (excludeAccountId !== MAIN_CODEX_ACCOUNT_ID && main
+    && sameCodexCollisionIdentity({ accountId: chatgptAccountId, email, plan }, main)) {
+    return { collision: true, reason: "Account is already configured as the native Codex main account." };
+  }
+
   for (const account of loadConfig().codexAccounts ?? []) {
     if (excludeAccountId && account.id === excludeAccountId) continue;
     if (!isSelectableCodexPoolAccount(account)) continue;
@@ -117,3 +124,23 @@ export function checkAccountIdCollision(
   }
   return { collision: false };
 }
+
+export type MainAuth = CodexTokenReadResult | { status: "api-key-only" };
+
+/** A valid API-key login has no ChatGPT identity; anything else unreadable stays unknown. */
+export function readMainAuth(authPath = join(resolveCodexHomeDir(), "auth.json")): MainAuth {
+  const main = readCodexTokensResult(authPath, { bounded: true });
+  if (main.status !== "invalid") return main;
+  try {
+    const j: unknown = JSON.parse(readBounded(authPath, MAX_AUTH_BYTES).toString("utf-8"));
+    if (j === null || typeof j !== "object" || Array.isArray(j)) return main;
+    const envelope = j as { auth_mode?: unknown; OPENAI_API_KEY?: unknown; tokens?: unknown };
+    const apiKeyOnly = envelope.tokens == null
+      && (envelope.auth_mode === undefined || envelope.auth_mode === "api_key")
+      && typeof envelope.OPENAI_API_KEY === "string" && envelope.OPENAI_API_KEY.trim() !== "";
+    return apiKeyOnly ? { status: "api-key-only" } : main;
+  } catch {
+    return main;
+  }
+}
+