@bitkyc08/opencodex 2.89.0 → 2.91.0

package/src/codex/auth-context.ts

@@ -97,6 +97,8 @@ import type { DataPlaneAdmission } from "../server/auth-cors";
 import { getMainReserveAuthorization, isMainReserveAuthorizationLive, nativeUserIdClaims, type MainReserveAuthorization } from "./reserve-availability";
 import { UpstreamRetryEvidenceError } from "../lib/upstream-retry";
 import { getEffectiveCodexAutoSwitchThreshold } from "./account-auto-switch";
+import { CODEX_MAIN_DUPLICATE_ACTION, configuredCodexMainDuplicate } from "./collision-identity";
+import { AgentAssertionUnsupportedError, authorizationCredential, hasAgentAssertionAuthorization } from "../lib/authorization-scheme";
 
 /**
  * A request-owned bearer cannot inspect the physical main credential for its plan, but cached
@@ -324,6 +326,8 @@ export type CodexAuthContext =
       writerGeneration: number;
       /** Captured before async credential work; never reconstructed after the upstream response. */
       mainQuotaWriter?: MainQuotaWriter;
+      /** Immutable credential proof captured while materializing this physical attempt's headers. */
+      mainQuotaDispatch?: MainQuotaDispatch;
       reserveAuthorization?: MainReserveAuthorization;
       accessToken: string;
       chatgptAccountId: string;
@@ -698,7 +702,7 @@ async function authorizeReserveCredential(
 
 function selectedCodexToken(headers: Headers): { accessToken: string; chatgptAccountId: string } {
   return {
-    accessToken: headers.get("authorization")?.replace(/^Bearer\s+/i, "").trim() ?? "",
+    accessToken: authorizationCredential(headers) ?? "",
     chatgptAccountId: headers.get("chatgpt-account-id") ?? "",
   };
 }
@@ -713,7 +717,7 @@ function selectedCodexToken(headers: Headers): { accessToken: string; chatgptAcc
 export function callerCodexWorkspaceAccountId(headers: Headers): string | undefined {
   const explicit = headers.get("chatgpt-account-id");
   if (explicit) return explicit;
-  const bearer = headers.get("authorization")?.replace(/^Bearer\s+/i, "").trim();
+  const bearer = authorizationCredential(headers);
   return bearer ? extractAccountId(undefined, bearer) : undefined;
 }
 
@@ -804,7 +808,7 @@ function assertMainAccountPolicy(
 
 /** No auth-file I/O: an unsigned claim alone never identifies a caller as stored main. */
 function callerMatchesObservedMain(headers: Headers): boolean {
-  const bearer = headers.get("authorization")?.replace(/^Bearer\s+/i, "").trim();
+  const bearer = authorizationCredential(headers);
   if (!bearer) return false;
   const effectiveAccountId = headers.get("chatgpt-account-id")
     ?? extractAccountId(undefined, bearer);
@@ -828,7 +832,7 @@ function sameCredentialMaterial(a: string, b: string): boolean {
  * cooldown — the safe direction.
  */
 function callerIsCooledPoolAccount(headers: Headers, config: OcxConfig, accountId: string): boolean {
-  const bearer = headers.get("authorization")?.replace(/^Bearer\s+/i, "").trim();
+  const bearer = authorizationCredential(headers);
   if (!bearer) return true;
   const callerAccountId = headers.get("chatgpt-account-id") ?? extractAccountId(undefined, bearer);
   if (callerAccountId === undefined) return true;
@@ -1080,6 +1084,33 @@ async function awaitMainAccountPolicyBindingSettled(
   if (!settled) throw new CodexMainProfileDrainingError();
 }
 
+/** Memory-only ownership check shared by Direct admission and pre-auth hard-lock routing. */
+export async function mainAccountHardLockAppliesToCaller(
+  headers: Headers,
+  policy: CodexAuthPolicyConfig,
+  options: Pick<ResolveCodexAuthContextOptions,
+    "substituteMainCredentialForDirect" | "signal" | "mainAccountPolicyBindingWaitMs"> = {},
+): Promise<boolean> {
+  if (options.substituteMainCredentialForDirect === true) return true;
+  if (!hasCallerCodexBearer(headers)) return false;
+  if (isMainAccountHardLockEnabled(policy)) await awaitMainAccountPolicyBindingSettled(options);
+  return callerMatchesObservedMain(headers);
+}
+
+/**
+ * Resolve ownership once, then hand back a synchronous proof. Main identity or its observed bearer
+ * can change across the await; the hard-lock reroute rechecks the proof with no await between it
+ * and the body rewrite, so a replacement main's lock never reroutes the original caller.
+ */
+export async function mainAccountHardLockCallerProof(
+  headers: Headers,
+  policy: CodexAuthPolicyConfig,
+  options: Parameters<typeof mainAccountHardLockAppliesToCaller>[2] = {},
+): Promise<(() => boolean) | null> {
+  if (!await mainAccountHardLockAppliesToCaller(headers, policy, options)) return null;
+  return options.substituteMainCredentialForDirect === true ? () => true : () => callerMatchesObservedMain(headers);
+}
+
 /**
  * Resolve the credential for one Codex turn. A main hard-lock reached through unpinned pool
  * selection is annotated with the earliest known pool recovery, so the refusal can name a retry
@@ -1172,8 +1203,7 @@ async function resolveCodexAuthContextUnannotated(
     // Trusted substitution still has to claim and validate stored main below.
     if (!substituteStoredMain && !hasCallerCodexBearer(headers)) throw new CodexDirectAuthenticationError();
     if (!substituteStoredMain) {
-      if (isMainAccountHardLockEnabled(policy)) await awaitMainAccountPolicyBindingSettled(options);
-      if (callerMatchesObservedMain(headers)) assertMainAccountPolicy(policy);
+      if (await mainAccountHardLockAppliesToCaller(headers, policy, options)) assertMainAccountPolicy(policy);
       assertCallerOwnedMainPoolNotCooled();
       if (reserve) {
         const selected = materializeCodexUpstreamAuth(headers, { kind: "main", accountId: null }, { config: policy });
@@ -1422,7 +1452,9 @@ async function resolveCodexAuthContextUnannotated(
     // cool down. Hand back any trial first -- no Pool account is being sent to.
     if (selected === MAIN_CODEX_ACCOUNT_ID && requestScopedMainCredential) {
       releaseTransientProbeGrant();
-      return await resolveCallerOwnedMainContext();
+      const context = await resolveCallerOwnedMainContext();
+      console.info("[codex] Pool selected caller-owned main credential.");
+      return context;
     }
     if (!selected) {
       // A retry that excluded a failed Pool account may still use the validated caller-owned
@@ -1432,9 +1464,12 @@ async function resolveCodexAuthContextUnannotated(
       if (
         requestScopedMainCredential
         && fixedAccountId === undefined
+        && !(callerMatchesObservedMain(headers) && policy.pausedCodexAccountIds?.includes(MAIN_CODEX_ACCOUNT_ID))
         && options.excludeAccountId !== MAIN_CODEX_ACCOUNT_ID
       ) {
-        return await resolveCallerOwnedMainContext();
+        const context = await resolveCallerOwnedMainContext();
+        console.info("[codex] Pool used caller-owned main credential: no selectable stored account.");
+        return context;
       }
       if (fixedAccountId !== undefined) {
         if (modelEligibleAccountIds && !modelEligibleAccountIds.has(fixedAccountId)) {
@@ -1533,6 +1568,7 @@ async function resolveCodexAuthContextUnannotated(
   // deferred credential must never become request auth through that fallback.
   try {
     assertCodexAccountValidationReady(accountId);
+    if (configuredCodexMainDuplicate(config, accountId)) throw new CodexPoolAuthenticationError(CODEX_MAIN_DUPLICATE_ACTION);
     assertPoolAccountCredits(accountId, poolCreditHoldResetAt(policy, accountId, config));
   } catch (cause) {
     // Nothing will reach upstream, so give the trial back instead of leaving the held account
@@ -1590,9 +1626,12 @@ async function resolveCodexAuthContextUnannotated(
       // alternate is eligible. A validated caller may still serve this request,
       // just as it can after an upstream rejection, without changing Pool state.
       if (requestScopedMainCredential && fixedAccountId === undefined
+        && !(callerMatchesObservedMain(headers) && policy.pausedCodexAccountIds?.includes(MAIN_CODEX_ACCOUNT_ID))
         && options.excludeAccountId !== MAIN_CODEX_ACCOUNT_ID
         && !callerIsCooledPoolAccount(headers, config, accountId)) {
-        return await resolveCallerOwnedMainContext();
+        const context = await resolveCallerOwnedMainContext();
+        console.info("[codex] Pool used caller-owned main credential: stored account cooldown.");
+        return context;
       }
       throw new CodexAccountCooldownError(accountId, cooldownUntil, cooldown?.cooldownSource, cooldown?.quotaScope);
     }
@@ -1660,6 +1699,7 @@ async function resolveCodexAuthContextUnannotated(
   try {
     const token = await getValidCodexToken(accountId, { signal: options.signal });
     assertCodexAccountValidationReady(accountId);
+    if (configuredCodexMainDuplicate(config, accountId)) throw new CodexPoolAuthenticationError(CODEX_MAIN_DUPLICATE_ACTION);
     assertPoolAccountCredits(accountId, poolCreditHoldResetAt(policy, accountId, config));
     return bindPoolCreditPolicy({
       kind: "pool",
@@ -1681,7 +1721,8 @@ async function resolveCodexAuthContextUnannotated(
     releaseTransientProbeGrant();
     if (probeLeaseId && probeQuotaScope) releaseCodexQuotaScopeProbeLease(accountId, probeQuotaScope, probeLeaseId);
     else if (probeLeaseId) releaseCodexQuotaProbeLease(accountId, probeLeaseId);
-    if (cause instanceof CodexPoolAccountCreditsOffError) throw cause;
+    // Post-refresh eligibility refusals do not invalidate a healthy credential.
+    if (cause instanceof CodexPoolAccountCreditsOffError || cause instanceof CodexPoolAuthenticationError) throw cause;
     if (!options.signal?.aborted && shouldMarkAccountNeedsReauthForCodexAuthFailure(cause)) {
       markAccountNeedsReauth(accountId, writerGeneration);
     }
@@ -1727,7 +1768,7 @@ export class CodexMainSubstitutionUnavailableError extends Error {
 
 /** Dispatch identity comes only from an owned observation of the selected credential. */
 function selectedMainQuotaDispatch(selected: Headers): MainQuotaDispatch | undefined {
-  const bearer = selected.get("authorization")?.replace(/^Bearer\s+/i, "").trim();
+  const bearer = authorizationCredential(selected);
   if (!bearer) return undefined;
   const accountId = selected.get("chatgpt-account-id") ?? extractAccountId(undefined, bearer);
   return captureMainQuotaDispatch(bearer, accountId, captureConfigGeneration());
@@ -1752,6 +1793,8 @@ export function materializeCodexUpstreamAuth(
   ctx: CodexAuthContext,
   options: CodexAuthMaterializationOptions = {},
 ): Headers {
+  // assertion_only must never be answered with a pool, stored-main, or other substituted Bearer.
+  if (hasAgentAssertionAuthorization(headers)) throw new AgentAssertionUnsupportedError();
   if (ctx.kind === "main") ctx.mainQuotaDispatch = undefined;
   const selected = new Headers();
   for (const name of FORWARD_HEADERS) {
@@ -1766,13 +1809,15 @@ export function materializeCodexUpstreamAuth(
     if (ctx.kind === "main-pool") {
       ctx.mainQuotaWriter = observeSelectedMainCredential(ctx, ctx.mainQuotaWriter);
       assertMainAccountPolicy(options.config);
+      ctx.mainQuotaDispatch = ctx.mainQuotaWriter && isMainQuotaWriterLive(ctx.mainQuotaWriter)
+        ? selectedMainQuotaDispatch(selected) : undefined;
     }
     assertMaterializedReserve(selected, ctx, options);
     return selected;
   }
   if (ctx.kind === "main" && options.substituteMainCredential !== true
     && !selected.has("chatgpt-account-id")) {
-    const bearer = selected.get("authorization")?.replace(/^Bearer\s+/i, "").trim();
+    const bearer = authorizationCredential(selected);
     const accountId = bearer ? extractAccountId(undefined, bearer) : undefined;
     if (accountId) selected.set("chatgpt-account-id", accountId);
   }
@@ -1850,6 +1895,7 @@ export async function materializeCodexUpstreamAuthAsync(
   ctx: CodexAuthContext,
   options: CodexAuthMaterializationOptions = {},
 ): Promise<Headers> {
+  if (hasAgentAssertionAuthorization(headers)) throw new AgentAssertionUnsupportedError();
   if (ctx.kind === "main") ctx.mainQuotaDispatch = undefined;
   if (requiresReserveAuthorization(options.config, options.modelId, options.admission)) {
     return materializeReserveUpstreamAuth(headers, ctx, options);

package/src/codex/catalog/parsing.ts

@@ -809,6 +809,10 @@ export function normalizeRoutedCatalogEntry(
   delete entry.multi_agent_version;
   delete entry.multi_agent_reasoning_effort;
   delete entry.use_responses_lite;
+  // Codex 0.164 sends positional `configuration_update` effort items only for rows declaring this
+  // and freezes the request-level effort for the context window. A routed provider never
+  // negotiated that contract, so a row cloned from a GPT-6 template must not inherit it.
+  delete entry.supports_reasoning_effort_updates;
   delete entry.supports_websockets;
   // Routed rows cloned from native templates must not inherit OpenAI-only experimental context
   // delivery. Codex reads the flag as "this model accepts experimental context history" and drives

package/src/codex/cli-update-plan.ts

@@ -213,9 +213,15 @@ function npmTarget(args: readonly string[], env?: NodeJS.ProcessEnv): NpmTarget
  * reverse: they are output paths, so ambient values would write Node artifacts to
  * arbitrary external directories on exit. ELF/Darwin loader controls (LD_* and
  * DYLD_*) are also removed: they can load code or redirect loader output before
- * npm runs. This is a denylist for process-startup/output channels, not a claim
- * that every ambient variable is allowlisted. Ordinary OS environment, proxy
- * settings and the supported NODE_EXTRA_CA_CERTS extension remain available.
+ * npm runs. OpenSSL's startup inputs are removed with them: OPENSSL_CONF names
+ * a configuration file the crypto library reads at startup, OPENSSL_CONF_INCLUDE
+ * resolves relative includes inside that configuration, and OPENSSL_MODULES /
+ * OPENSSL_ENGINES name the directories its provider and engine search loads
+ * shared modules from. None of these is input the updater child needs, so
+ * ambient values stay out of the spawned npm. This is a denylist for
+ * process-startup/output channels, not a claim that every ambient variable is
+ * allowlisted. Ordinary OS environment, proxy settings and the supported
+ * NODE_EXTRA_CA_CERTS extension remain available.
  */
 const NPM_ENV_DROP_KEYS: ReadonlySet<string> = new Set([
   "node_options",
@@ -227,6 +233,15 @@ const NPM_ENV_DROP_KEYS: ReadonlySet<string> = new Set([
   // escaping the owned temp root regardless of the isolated --cache.
   "node_v8_coverage",
   "node_redirect_warnings",
+  // OpenSSL startup inputs: OPENSSL_CONF points the library at an ambient
+  // startup configuration file (OPENSSL_CONF_INCLUDE resolves that config's
+  // relative includes); OPENSSL_MODULES and OPENSSL_ENGINES point its
+  // provider/engine search at ambient directories that supply loadable
+  // shared modules.
+  "openssl_conf",
+  "openssl_conf_include",
+  "openssl_modules",
+  "openssl_engines",
 ]);
 
 function codexCliUpdateNpmEnv(base: NodeJS.ProcessEnv = process.env): NodeJS.ProcessEnv {

package/src/codex/collision-identity.ts

@@ -0,0 +1,78 @@
+import { extractAccountIdClaims, extractEmail } from "../oauth/chatgpt";
+import type { CodexAccount, OcxConfig } from "../types";
+import { getCodexAccountCredential } from "./account-store";
+import type { CodexTokens } from "./auth-collision";
+import { captureMainAccountIdentityGeneration, isMainAccountIdentityGenerationLive } from "./main-account-cache";
+import { codexPlanKey, extractChatgptPlanType } from "./plan";
+
+export interface CodexCollisionIdentity {
+  accountId: string;
+  email?: string | null;
+  plan?: unknown;
+}
+
+function normalizedEmail(email: string | null | undefined): string | undefined {
+  return email?.trim().toLowerCase() || undefined;
+}
+
+function workspacePlan(plan: unknown): boolean {
+  return /team|business|enterprise|workspace|edu/.test(codexPlanKey(plan) ?? "");
+}
+
+/** Missing member evidence cannot establish a distinct subscription within one plan bucket. */
+export function sameCodexCollisionIdentity(a: CodexCollisionIdentity, b: CodexCollisionIdentity): boolean {
+  if (!a.accountId || a.accountId !== b.accountId || workspacePlan(a.plan) !== workspacePlan(b.plan)) return false;
+  const aEmail = normalizedEmail(a.email);
+  const bEmail = normalizedEmail(b.email);
+  return !aEmail || !bEmail || aEmail === bEmail;
+}
+
+// Ambient scope comparison is memory-only, including when the default-home resolver would probe WSL.
+function homeScope(): string {
+  return JSON.stringify([process.env.CODEX_HOME, process.env.HOME, process.env.USERPROFILE, process.env.OPENCODEX_HOME]);
+}
+
+let observed: { identity: CodexCollisionIdentity; homeScope: string; generation: number } | undefined;
+
+/** Only existing owned lifecycle observations may publish; never call with a request bearer. */
+export function observeMainCodexCollisionIdentity(tokens?: CodexTokens): void {
+  if (!tokens) { observed = undefined; return; }
+  if (typeof tokens.access_token !== "string" || typeof tokens.account_id !== "string"
+    || (tokens.id_token !== undefined && typeof tokens.id_token !== "string")) return;
+  const claims = [extractAccountIdClaims(tokens.id_token), extractAccountIdClaims(tokens.access_token)];
+  if (claims.some(claim => claim.conflict)) return;
+  const accountId = tokens.account_id || claims.find(claim => claim.accountId)?.accountId;
+  if (!accountId || claims.some(claim => claim.accountId && claim.accountId !== accountId)) return;
+  const emails = new Set([extractEmail(tokens.id_token), extractEmail(undefined, tokens.access_token)]
+    .flatMap(email => normalizedEmail(email) ? [normalizedEmail(email)!] : []));
+  if (emails.size > 1) return;
+  observed = { identity: { accountId, email: [...emails][0],
+    plan: extractChatgptPlanType(tokens.id_token, tokens.access_token) },
+    homeScope: homeScope(), generation: captureMainAccountIdentityGeneration() };
+}
+
+/** Compare known identity only. External logins become visible at the next owned observation. */
+export function getObservedMainCodexCollisionIdentity(): Readonly<CodexCollisionIdentity> | undefined {
+  return observed?.homeScope === homeScope() && isMainAccountIdentityGenerationLive(observed.generation)
+    ? observed.identity : undefined;
+}
+
+export function isStoredCodexMainDuplicate(account: CodexAccount): boolean {
+  const main = getObservedMainCodexCollisionIdentity();
+  if (account.isMain || !main) return false;
+  const credential = getCodexAccountCredential(account.id);
+  if (!credential?.chatgptAccountId) return false;
+  const storedEmail = normalizedEmail(account.email);
+  const email = storedEmail && storedEmail !== normalizedEmail(account.id)
+    ? storedEmail : extractEmail(undefined, credential.accessToken);
+  return sameCodexCollisionIdentity({ accountId: credential.chatgptAccountId, email,
+    plan: codexPlanKey(account.plan) ? account.plan : extractChatgptPlanType(undefined, credential.accessToken) }, main);
+}
+
+export const CODEX_MAIN_DUPLICATE_ACTION =
+  "Use the native Codex main account, or sign native Codex into a different account to use this stored Pool entry.";
+
+export function configuredCodexMainDuplicate(config: Pick<OcxConfig, "codexAccounts">, accountId: string): boolean {
+  const account = config.codexAccounts?.find(row => row.id === accountId);
+  return !!account && isStoredCodexMainDuplicate(account);
+}

package/src/codex/desktop-compatibility/windows-key-protection.ts

@@ -10,17 +10,24 @@ const ENTROPY = new TextEncoder().encode(PURPOSE);
 // Only the PowerShell fallback is bounded by a clock. A cold Windows PowerShell that must also load
 // System.Security has been measured past 10s on a loaded machine (Windows CI run 38591626343).
 const DPAPI_TIMEOUT_MS = 20_000;
+// Cmdlet-free on purpose. The first cmdlet a PowerShell session runs (Add-Type, ConvertFrom-Json)
+// sends it through command discovery and module auto-loading, which without a module-analysis cache
+// for the profile scans the modules on PSModulePath. The test runner gives every run a fresh profile
+// and CI images carry large module sets, so that scan, not DPAPI, is what cold runs waited on.
+// Assembly loading, string splitting and base64 are plain .NET calls outside command discovery.
+// The request is "<operation>\n<base64 data>" on stdin.
 const SCRIPT = [
   "$ErrorActionPreference='Stop'",
-  "Add-Type -AssemblyName System.Security",
-  "$r=[Console]::In.ReadToEnd()|ConvertFrom-Json",
-  "$data=[Convert]::FromBase64String($r.data)",
+  "[void][Reflection.Assembly]::Load('System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a')",
+  "$r=[Console]::In.ReadToEnd().Split([char]10)",
+  "if($r.Length -ne 2){throw 'Invalid request'}",
+  "$data=[Convert]::FromBase64String($r[1])",
   `if($data.Length -eq 0 -or $data.Length -gt ${MAX_INPUT}){throw 'Invalid data size'}`,
   `$entropy=[Text.Encoding]::UTF8.GetBytes('${PURPOSE}')`,
   "$scope=[Security.Cryptography.DataProtectionScope]::CurrentUser",
-  "if($r.operation -eq 'protect'){",
+  "if($r[0] -ceq 'protect'){",
   " $out=[Security.Cryptography.ProtectedData]::Protect($data,$entropy,$scope)",
-  "}elseif($r.operation -eq 'unprotect'){",
+  "}elseif($r[0] -ceq 'unprotect'){",
   " $out=[Security.Cryptography.ProtectedData]::Unprotect($data,$entropy,$scope)",
   "}else{throw 'Invalid operation'}",
   "[Console]::Out.Write([Convert]::ToBase64String($out))",
@@ -126,7 +133,7 @@ function runPowerShellDpapi(operation: Operation, data: Uint8Array, timeoutMs =
       resolve(bytes);
     });
     child.stdin?.on("error", () => { /* execFile's completion reports the failed child. */ });
-    child.stdin?.end(JSON.stringify({ operation, data: Buffer.from(data).toString("base64") }));
+    child.stdin?.end(`${operation}\n${Buffer.from(data).toString("base64")}`);
   });
 }
 
@@ -163,3 +170,8 @@ export function powerShellAuthorityKeyProtectionForTests(timeoutMs: number): Aut
 export function usesNativeDpapiForTests(): boolean {
   return process.platform === "win32" && loadNativeDpapi() !== null;
 }
+
+/** Test-only: the PowerShell helper's script, so its cmdlet-free contract can be checked anywhere. */
+export function powerShellDpapiScriptForTests(): string {
+  return SCRIPT;
+}

package/src/codex/main-account-hard-lock.ts

@@ -121,3 +121,17 @@ export function getMainAccountHardLockStatus(
 export function isMainAccountHardLocked(config: PolicyConfig, now = Date.now()): boolean {
   return getMainAccountHardLockStatus(config, now).state === "blocked";
 }
+
+/**
+ * Scheduling evidence only: the latest blocking reset even after it has passed, so recovery can
+ * notice a revised reset that expired between sweeps. Never an admission or unlock signal.
+ */
+export function latestMainBlockingResetAt(config: PolicyConfig): number | undefined {
+  if (!isMainAccountHardLockEnabled(config)) return undefined;
+  const quota = getMainPolicyQuota();
+  if (!quota) return undefined;
+  const thresholds = resolveMainAccountHardLockThresholds(config);
+  const resets = governingWindows(quota)
+    .filter(w => validPercent(w.percent) && w.percent >= thresholds[w.kind]).map(w => resetTimestamp(w.resetAt));
+  return resets.length > 0 && resets.every(r => r !== undefined) ? Math.max(...(resets as number[])) : undefined;
+}

package/src/codex/quota-history.ts

@@ -92,6 +92,13 @@ export class CodexQuotaHistory {
     return { samples: structuredClone(bucket.samples.slice(-capped)), truncated: bucket.samples.length > capped };
   }
 
+  /** The newest sample's origin, without pruning or clearing: a passive read changes nothing. */
+  peekLatestSource(accountId: string, identity: string | undefined): QuotaHistorySample["source"] | undefined {
+    const bucket = this.accounts.get(accountId);
+    if (!identity || !bucket || bucket.identity !== identity) return undefined;
+    return bucket.samples.at(-1)?.source;
+  }
+
   clear(accountId?: string): number {
     if (accountId === undefined) {
       const count = this.accounts.size;

package/src/codex/quota.ts

@@ -1099,3 +1099,13 @@ export function getAccountQuotaHistory(accountId: string, limit: number = QUOTA_
   return { observations: result.samples.map(({ credentialGeneration: _generation, ...sample }) => sample),
     truncated: result.truncated, retention: { maxObservations: QUOTA_HISTORY_LIMITS.perAccount, maxAgeDays: 30 } };
 }
+
+/**
+ * Where the newest stored reading for a pool account came from (a WHAM usage body or upstream
+ * response headers), or undefined when no current history exists. Read-only: unlike
+ * `getAccountQuotaHistory` it never prunes or clears a mismatched bucket.
+ */
+export function latestCodexQuotaObservationSource(accountId: string): "wham" | "response-header" | undefined {
+  hydrateAccountQuotasFromDisk();
+  return quotaHistory.peekLatestSource(accountId, poolQuotaHistoryIdentity(accountId));
+}

package/src/codex/routing/cooldown-math.ts

@@ -6,6 +6,7 @@ import { isThirtyDayOnlyCodexPlan } from "../plan";
 import { hasSpendableCodexCredits, isTerminalShortWindow, type CodexSpendableCredits } from "../quota-types";
 import type { CodexQuotaScope } from "./health-store";
 import type { TransientProbeGrant } from "./thread-affinity";
+import type { MainQuotaDispatch } from "../main-account-cache";
 
 export { TERMINAL_SHORT_WINDOW_FRESHNESS_MS } from "../quota-types";
 
@@ -99,6 +100,10 @@ export type CodexUpstreamOutcomeMeta = {
    * means the caller cannot supply lineage and the historical unfenced handling stands.
    */
   credentialGeneration?: number;
+  /** Main credential proof captured before dispatch; null means no owned proof was available. */
+  mainFailureWindowDispatch?: MainQuotaDispatch | null;
+  /** Pool sample provenance retained by a terminal callback even if its context is reused. */
+  failureWindowCredentialGeneration?: number;
 };
 
 export function computeCodexUsageScore(quota: {

package/src/codex/routing/failure-window.ts

@@ -1,5 +1,9 @@
 import { pinnedCodexAccountId } from "../account-priority";
 import type { OcxConfig } from "../../types";
+import { beginCodexAccountGenerationLiveCheck, isCodexAccountGenerationLive } from "../account-store";
+import { isMainQuotaDispatchLive } from "../main-account-cache";
+import type { CodexAuthContext } from "../auth-context";
+import type { CodexUpstreamOutcomeMeta } from "./cooldown-math";
 import {
   deleteAccountHealth,
   setAccountHealth,
@@ -14,12 +18,31 @@ export const CODEX_SLIDING_FAILURE_RECOVER_RATIO = 0.1;
 export const CODEX_SLIDING_FAILURE_RECOVER_SUSTAIN_MS = 30_000;
 const MAX_SAMPLES = 512;
 
-type Sample = { at: number; failed: boolean };
-type WindowState = { samples: Sample[]; degraded: boolean; healthySince?: number };
+type Sample = { at: number; failed: boolean; credentialGeneration?: number };
+type WindowState = { samples: Sample[]; degraded: boolean; healthySince?: number; credentialGeneration?: number };
 
 const windows = new Map<string, WindowState>();
 const pinnedDegradeWarned = new Set<string>();
 
+/** Read only dispatch-time provenance retained by auth materialization, never recapture at arrival. */
+export function codexFailureWindowOutcomeMeta(
+  context: CodexAuthContext,
+): Pick<CodexUpstreamOutcomeMeta, "failureWindowCredentialGeneration" | "mainFailureWindowDispatch"> {
+  if (context.kind === "pool") return { failureWindowCredentialGeneration: context.generation };
+  return context.kind === "main-pool" ? { mainFailureWindowDispatch: context.mainQuotaDispatch ?? null } : {};
+}
+
+/** Fence window samples only; other health and recovery-lease semantics stay with their owners. */
+export function noteCodexFailureWindowOutcome(
+  config: OcxConfig, accountId: string, failed: boolean, now: number, meta: CodexUpstreamOutcomeMeta,
+): void {
+  if (meta.mainFailureWindowDispatch !== undefined
+    && (!meta.mainFailureWindowDispatch || !isMainQuotaDispatchLive(meta.mainFailureWindowDispatch))) return;
+  const generation = meta.failureWindowCredentialGeneration ?? meta.credentialGeneration;
+  if (generation !== undefined && !isCodexAccountGenerationLive(accountId, generation)) return;
+  appendSample(config, accountId, failed, now, generation);
+}
+
 export function codexFailureWindowEnabled(config: OcxConfig): boolean {
   return config.codexFailureWindow !== false;
 }
@@ -33,11 +56,27 @@ function stateFor(accountId: string): WindowState {
   return state;
 }
 
-function recompute(state: WindowState, now: number): void {
-  const cutoff = now - CODEX_SLIDING_FAILURE_WINDOW_MS;
-  if (state.samples.length > 0 && state.samples[0]!.at <= cutoff) {
-    state.samples = state.samples.filter(sample => sample.at > cutoff);
+function recompute(
+  accountId: string, state: WindowState, now: number,
+  generationLive?: ReturnType<typeof beginCodexAccountGenerationLiveCheck>,
+): void {
+  // One store snapshot per insertion/read, never one file load per retained sample. The
+  // unlocked insertion precheck can race another process; provenance must survive it.
+  const tagged = state.credentialGeneration !== undefined
+    || state.samples.some(sample => sample.credentialGeneration !== undefined);
+  const live = generationLive ?? (tagged ? beginCodexAccountGenerationLiveCheck() : undefined);
+  // Unknown evidence is not a credential removal: preserve samples and all derived state.
+  if (live?.snapshotStatus === "failed") return;
+  if (state.credentialGeneration !== undefined && !live?.(accountId, state.credentialGeneration)) {
+    state.degraded = false;
+    state.healthySince = undefined;
+    state.credentialGeneration = undefined;
+    pinnedDegradeWarned.delete(accountId);
   }
+  const cutoff = now - CODEX_SLIDING_FAILURE_WINDOW_MS;
+  state.samples = state.samples.filter(sample => sample.at > cutoff
+    && (sample.credentialGeneration === undefined || live?.(accountId, sample.credentialGeneration)));
+  state.credentialGeneration ??= state.samples.find(sample => sample.credentialGeneration !== undefined)?.credentialGeneration;
   const samples = state.samples.length;
   const failed = state.samples.reduce((count, sample) => count + (sample.failed ? 1 : 0), 0);
   const degraded = samples >= CODEX_SLIDING_FAILURE_MIN_SAMPLES
@@ -71,19 +110,32 @@ export function noteCodexFailureWindowSample(
   accountId: string,
   failed: boolean,
   now: number,
+): void {
+  appendSample(config, accountId, failed, now);
+}
+
+function appendSample(
+  config: OcxConfig, accountId: string, failed: boolean, now: number, credentialGeneration?: number,
 ): void {
   if (!codexFailureWindowEnabled(config)) return;
+  const existing = windows.get(accountId);
+  const tagged = credentialGeneration !== undefined || existing?.credentialGeneration !== undefined
+    || existing?.samples.some(sample => sample.credentialGeneration !== undefined);
+  const live = tagged ? beginCodexAccountGenerationLiveCheck() : undefined;
+  if (live?.snapshotStatus === "failed") return;
+  // A stale arrival is not an ownership transition and must not delete a live replacement's state.
+  if (credentialGeneration !== undefined && !live?.(accountId, credentialGeneration)) return;
   const state = stateFor(accountId);
-  state.samples.push({ at: now, failed });
+  state.samples.push({ at: now, failed, ...(credentialGeneration === undefined ? {} : { credentialGeneration }) });
   if (state.samples.length > MAX_SAMPLES) state.samples.splice(0, state.samples.length - MAX_SAMPLES);
-  recompute(state, now);
+  recompute(accountId, state, now, live);
   if (!state.degraded) pinnedDegradeWarned.delete(accountId);
 }
 
 export function isCodexFailureWindowDegraded(accountId: string, now = Date.now()): boolean {
   const state = windows.get(accountId);
   if (!state) return false;
-  recompute(state, now);
+  recompute(accountId, state, now);
   if (!state.degraded) pinnedDegradeWarned.delete(accountId);
   return state.degraded;
 }

package/src/codex/routing.ts

@@ -23,7 +23,7 @@ import {
   failureWindowSteersNewThreads,
   forgetCodexFailureWindow,
   forgetCodexFailureWindows,
-  noteCodexFailureWindowSample,
+  noteCodexFailureWindowOutcome,
   settleCodexSuccessStreak,
 } from "./routing/failure-window";
 
@@ -220,6 +220,7 @@ export {
   isEffectiveCodexAccountPinned,
 } from "./routing/active-account";
 export { codexAccountPinDrainReason } from "./routing/pin-drain";
+export { codexFailureWindowOutcomeMeta } from "./routing/failure-window";
 export type { CodexPinDrainReason } from "./routing/pin-drain";
 
 // A shared refresh can outlive the request that opened it. Register the affinity
@@ -1305,7 +1306,7 @@ export function recordCodexUpstreamOutcome(
    */
   dropSpentCredentialFailure(accountId);
   if (outcomeClass === "success") {
-    noteCodexFailureWindowSample(config, accountId, false, now);
+    noteCodexFailureWindowOutcome(config, accountId, false, now, meta);
     // The operator's one-shot is spent by a dispatch that actually worked, and only by that.
     // A failed lookup leaves it unspent so the intent survives the failure.
     consumeManualPreference(accountId, codexPoolKeyForScope(quotaScope));
@@ -1555,7 +1556,7 @@ export function recordCodexUpstreamOutcome(
   // A transient failure concludes an owning probe; an unrelated 5xx must not
   // consume someone else's live lease or drop hard-cooldown bookkeeping (#433).
   const transientBase = ownsProbeLease(current, meta) ? withProbeLeaseReleased(current!, now) : current;
-  noteCodexFailureWindowSample(config, accountId, true, now);
+  noteCodexFailureWindowOutcome(config, accountId, true, now, meta);
   const stale = current?.lastFailureAt ? now - current.lastFailureAt > CODEX_FAILURE_WINDOW_MS : false;
   const hardCooldownUntil = getCodexAccountCooldownUntil(accountId, now) ?? undefined;
   // Soft avoid + affinity clears are part of failover. When threshold is 0, leave

package/src/codex/shim-diagnostics.ts

@@ -1,5 +1,5 @@
 import { existsSync, lstatSync, readFileSync } from "node:fs";
-import { SHIM_MARKER, UNIX_SHIM_REVISION_MARKER } from "./shim-templates";
+import { SHIM_MARKER, UNIX_SHIM_REVISION_MARKER, WINDOWS_SHIM_REVISION_MARKER } from "./shim-templates";
 import { readStateResult, stateFiles, statePath } from "./shim-state-file";
 import { overlayDiagnostic } from "./shim-overlay";
 
@@ -16,6 +16,7 @@ function isHealthyShim(path: string, platform: NodeJS.Platform): boolean {
     const content = readFileSync(path, "utf8");
     if (content.length < 180 || !content.includes(SHIM_MARKER) || !content.includes("ensure")) return false;
     if (platform !== "win32" && !content.includes(UNIX_SHIM_REVISION_MARKER)) return false;
+    if (platform === "win32" && !content.includes(WINDOWS_SHIM_REVISION_MARKER) && !content.includes(UNIX_SHIM_REVISION_MARKER)) return false;
     if (platform !== "win32" && (lstatSync(path).mode & 0o111) === 0) return false;
     return true;
   } catch {

package/src/codex/shim-fingerprint.ts

@@ -13,7 +13,7 @@ import {
   unlinkSync,
 } from "node:fs";
 import { posix, win32 } from "node:path";
-import { SHIM_MARKER, UNIX_SHIM_REVISION_MARKER } from "./shim-templates";
+import { SHIM_MARKER, UNIX_SHIM_REVISION_MARKER, WINDOWS_SHIM_REVISION_MARKER } from "./shim-templates";
 import type { ShimFileState } from "./shim-state-file";
 
 const CODEX_SHIM_PROBE_BYTES = 16 * 1024;
@@ -188,6 +188,15 @@ function isCurrentUnixShimProbe(probe: StableShimPathProbe): boolean {
   return probe.prefix.includes(UNIX_SHIM_REVISION_MARKER);
 }
 
+/** A Windows wrapper is current when it carries its flavor's revision (CMD/PowerShell, or Git-Bash's Unix one). */
+function isCurrentWindowsShimProbe(probe: StableShimPathProbe): boolean {
+  return probe.prefix.includes(WINDOWS_SHIM_REVISION_MARKER) || probe.prefix.includes(UNIX_SHIM_REVISION_MARKER);
+}
+
+function isCurrentShimProbe(probe: StableShimPathProbe, platform: NodeJS.Platform): boolean {
+  return platform === "win32" ? isCurrentWindowsShimProbe(probe) : isCurrentUnixShimProbe(probe);
+}
+
 function hasUsableBackingPath(file: ShimFileState): boolean {
   return [existsSync(file.backupPath) ? file.backupPath : undefined, file.realPath]
     .some(path => {
@@ -225,4 +234,4 @@ export function isVersionManagerOwnedCodexPath(
 }
 
 export type { ShimPathFingerprint, StableShimPathProbe };
-export { statFingerprint, sameFingerprint, sameFingerprintAfterRename, stableShimPathProbe, sameStableShimPathProbe, shimPathFingerprint, restoreWithoutReplacing, isHealthyShimProbe, isCurrentUnixShimProbe, hasUsableBackingPath };
+export { statFingerprint, sameFingerprint, sameFingerprintAfterRename, stableShimPathProbe, sameStableShimPathProbe, shimPathFingerprint, restoreWithoutReplacing, isHealthyShimProbe, isCurrentUnixShimProbe, isCurrentShimProbe, hasUsableBackingPath };