@bitkyc08/opencodex 2.90.0 → 2.92.0

package/src/client/runtime-restart.ts

@@ -0,0 +1,127 @@
+/**
+ * The connected client runtime's answer to the bound `POST /api/system/restart` (OCX-6).
+ *
+ * It is the same restart `ocx restart` drives on a standalone proxy, with one difference the
+ * Remote Link parity work requires: a failed restart keeps the old runtime. That is only possible
+ * when this process starts its own replacement, so:
+ *
+ * - Under the desktop app or a viable service supervisor the restart is refused (409
+ *   `restart_supervised`) and the runtime keeps serving. The supervisor owns this process and its
+ *   port; handing off to it means exiting before anything proves the replacement can start.
+ * - Otherwise the listener drains, a replacement `ocx start` is spawned and must answer within the
+ *   budget. Success exits this process. A replacement that exited, or never answered and was then
+ *   stopped, leaves this process to bind the port again, start a fresh tunnel supervisor and
+ *   republish its records: the old runtime keeps serving and the CLI, still seeing its pid,
+ *   reports the restart as failed.
+ *
+ * Everything runs inside {@link CLIENT_RESTART_BUDGET_MS} from acceptance.
+ */
+import {
+  CLIENT_RESTART_DRAIN_MS,
+  CLIENT_RESTART_READY_BY_MS,
+  isDesktopSupervised,
+} from "../lib/system-restart-contract";
+import type { OcxClientConnectionConfig } from "../types";
+import { sameClientConnectionOwner, type readClientConnectionState } from "./state";
+
+type ClientConnectionState = ReturnType<typeof readClientConnectionState>;
+
+export type ClientRestartSupervisor = "service" | "desktop";
+
+export type ClientRestartAdmission =
+  | { kind: "accepted"; alreadyRestarting: boolean }
+  | { kind: "supervised"; supervisor: ClientRestartSupervisor };
+
+export interface ClientRestartIo {
+  /** Which supervisor owns this process, or null when it starts its own replacement. */
+  supervisor(): Promise<ClientRestartSupervisor | null>;
+  /** Stop the tunnel supervisor and the listener, giving in-flight requests up to `drainMs`. */
+  stop(drainMs: number): Promise<void>;
+  /** Start the replacement; resolves once it answers, rejects when none survives. */
+  spawnReplacement(deadlineAt: number): Promise<void>;
+  /** Serve again on this process: listener, fresh tunnel supervisor, records. */
+  resume(): Promise<void>;
+  exitProcess(code: number): void;
+  now?: () => number;
+  sleep?: (ms: number) => Promise<void>;
+  warn?: (message: string) => void;
+}
+
+export interface ClientRestartController {
+  request(): Promise<ClientRestartAdmission>;
+  /** Settles when the restart in flight (if any) has finished or rolled back. Tests only. */
+  settled(): Promise<void>;
+}
+
+/** Stable, path-free label for a failure (an error message can carry a path). */
+function failureCode(error: unknown): string {
+  const code = error && typeof error === "object" && "code" in error ? (error as { code?: unknown }).code : undefined;
+  return typeof code === "string" && /^[A-Za-z0-9_]{1,64}$/.test(code) ? code : "failed";
+}
+
+export function createClientRestartController(io: ClientRestartIo): ClientRestartController {
+  const now = io.now ?? Date.now;
+  const sleep = io.sleep ?? Bun.sleep;
+  const warn = io.warn ?? ((message: string) => console.warn(message));
+  let flight: Promise<void> | null = null;
+
+  const run = async (acceptedAt: number): Promise<void> => {
+    // Let the 202 reach the CLI before the listener starts closing.
+    await sleep(200);
+    try {
+      await io.stop(CLIENT_RESTART_DRAIN_MS);
+    } catch (error) {
+      warn(`[client] restart: stopping the runtime failed (${failureCode(error)}); continuing`);
+    }
+    try {
+      await io.spawnReplacement(acceptedAt + CLIENT_RESTART_READY_BY_MS);
+    } catch (error) {
+      warn(`[client] restart: the replacement did not start (${failureCode(error)}); this runtime keeps serving`);
+      try {
+        await io.resume();
+      } catch (resumeError) {
+        warn(`[client] restart: this runtime could not serve again (${failureCode(resumeError)}); run 'ocx start'`);
+        io.exitProcess(1);
+      }
+      return;
+    }
+    io.exitProcess(0);
+  };
+
+  return {
+    async request() {
+      const supervisor = await io.supervisor();
+      if (supervisor) return { kind: "supervised", supervisor };
+      if (flight) return { kind: "accepted", alreadyRestarting: true };
+      flight = run(now()).finally(() => { flight = null; });
+      return { kind: "accepted", alreadyRestarting: false };
+    },
+    async settled() {
+      await flight;
+    },
+  };
+}
+
+/** Production supervision check: the desktop app, then a service that will really relaunch us. */
+export async function clientRestartSupervisor(): Promise<ClientRestartSupervisor | null> {
+  if (isDesktopSupervised()) return "desktop";
+  if (process.env.OCX_SERVICE !== "1") return null;
+  // Same viability test as the standalone restart: stale service assets would not relaunch.
+  const { isServiceViable } = await import("../service/orchestration");
+  return isServiceViable() ? "service" : null;
+}
+
+/**
+ * After a failed replacement: serve the same connection again only while it is still the durable
+ * one (same owner and link). Anything else, a disconnect or a different connection, goes to the
+ * recycle, which starts what the current state calls for instead of a stale client runtime.
+ */
+export function clientRestartRollbackAction(
+  served: OcxClientConnectionConfig,
+  current: ClientConnectionState,
+): "resume" | "recycle" {
+  return current.kind === "connected" && sameClientConnectionOwner(current.value, served)
+    && current.value.link?.linkId === served.link?.linkId
+    ? "resume"
+    : "recycle";
+}

package/src/client/runtime.ts

@@ -1,3 +1,4 @@
+import { flushLinkDiagnostics, recordLinkDiagnostic } from "../link/diagnostics";
 import { existsSync } from "node:fs";
 import type { Server } from "bun";
 import { siblingRuntimeField, withSiblingMarker } from "../codex/sibling-start";
@@ -9,6 +10,7 @@ import { createLocalAttestationSecret } from "../lib/local-management-attestatio
 import { loadServiceTokenFromFile, serviceApiTokenFingerprint } from "../lib/service-secrets";
 import { handledSignalExitCode } from "../lib/handled-signal-exit";
 import {
+  CLIENT_RESTART_REBIND_WAIT_MS,
   DESKTOP_RESTART_EXIT_CODE,
   DESKTOP_SUPERVISED_ENV,
   DESKTOP_SUPERVISED_PORT_WAIT_MS,
@@ -19,16 +21,27 @@ import type { ReplacementStartRequest } from "../server/restart-replacement";
 import type { OcxClientConnectionConfig } from "../types";
 import { createLinkKeySource } from "./link-ingress";
 import { HOME_INITIATED_LINK_TUNNEL } from "./link-relay";
+import { clientInitiatedLinkReadiness, createHomeInitiatedLinkReadiness } from "./link-readiness";
 import { createClientLinkSupervisor, type ClientLinkSupervisor } from "./link-tunnel";
 import { clientLinkStatePath, isChildInitiatedLink, recordChildInitiatedLink } from "./link-state";
 import { startMachineListener, type MachineListenerDeps } from "./machine-listener";
 import { isLinkConnection, readClientConnectionState } from "./state";
+import { withClientLifecycleSync } from "./lifecycle-lock";
+import { clientRestartRollbackAction, clientRestartSupervisor, createClientRestartController, type ClientRestartController } from "./runtime-restart";
+import { createLinkParityReporter, type LinkParityReporter } from "./link-parity-reporter";
 
 let activeServer: Server<unknown> | null = null;
 let activePort: number | null = null;
 let activeSupervisor: ClientLinkSupervisor | null = null;
+let activeReporter: LinkParityReporter | null = null;
 let recycleScheduled = false;
 
+/**
+ * When this runtime's process started (OCX-6, P5): what `/healthz` reports as `startedAt` and the
+ * Child reports to its Home. A Home settings apply recorded after it means this runtime predates it.
+ */
+export const CLIENT_RUNTIME_STARTED_AT = new Date(Date.now() - process.uptime() * 1000).toISOString();
+
 /**
  * How long link mode waits for its configured port: the budget a hard-pinned `ocx start --port`
  * gives `reclaimListenPort` (`src/cli/index.ts`).
@@ -53,6 +66,8 @@ export interface ClientRuntimeIo {
   /** Link-mode port budget; defaults to {@link LINK_PORT_WAIT_MS}. */
   portWaitMs?: number;
   startListener?: typeof startMachineListener;
+  /** Which supervisor owns this process for a bound restart; tests replace the production check. */
+  restartSupervisor?: () => Promise<"service" | "desktop" | null>;
 }
 
 export interface StandaloneRecycleIo {
@@ -151,6 +166,7 @@ export async function recycleStandalone(
     console.warn(`[client] listener stop failed: ${error instanceof Error ? error.message : String(error)}`);
   }
   cleanup();
+  await flushLinkDiagnostics();
   // Recycling back to standalone after `ocx disconnect` must actually bring a standalone
   // proxy back, under every launch shape.
   //
@@ -214,7 +230,7 @@ export async function bindClientListener(
     preferred: number;
     explicitPort: boolean;
     configuredPort: number;
-  } & Pick<MachineListenerDeps, "linkStatus" | "linkKeySource" | "linkTunnel">,
+  } & Pick<MachineListenerDeps, "linkStatus" | "linkKeySource" | "linkTunnel" | "linkReadiness" | "restart">,
   io: ClientRuntimeIo = {},
 ): Promise<{ server: Server<unknown>; port: number }> {
   const { linkMode } = request;
@@ -254,6 +270,8 @@ export async function bindClientListener(
         ...(request.linkStatus ? { linkStatus: request.linkStatus } : {}),
         ...(request.linkKeySource ? { linkKeySource: request.linkKeySource } : {}),
         ...(request.linkTunnel ? { linkTunnel: request.linkTunnel } : {}),
+        ...(request.linkReadiness ? { linkReadiness: request.linkReadiness } : {}),
+        ...(request.restart ? { restart: request.restart } : {}),
       });
       return { server, port: server.port ?? port };
     } catch (error) {
@@ -286,33 +304,142 @@ export async function startClientRuntime(
   if (linkMode && state.value.link) {
     try { recordChildInitiatedLink(state.value.link.linkId); } catch { /* the sidecar check below still applies */ }
   }
-  const supervisor = linkMode && existsSync(clientLinkStatePath())
-    ? createClientLinkSupervisor({
-      onLinkEnded: () => scheduleStandaloneRecycle(state.value.tokenFingerprint),
-      linkKey,
-    })
-    : null;
+  const supervised = linkMode && existsSync(clientLinkStatePath());
   // A Child with no sidecar and no record of joining itself was connected by its Home over
   // `ssh -R`; that link keeps 2.67.0's unproven forward. A Child-initiated link that lost its
   // sidecar gets no gate at all, so the relay refuses it.
-  const homeInitiated = linkMode && !supervisor && !!state.value.link
+  const homeInitiated = linkMode && !supervised && !!state.value.link
     && !isChildInitiatedLink(state.value.link.linkId);
-  const { server, port: boundPort } = await bindClientListener({
-    state: state.value,
-    linkMode,
-    preferred,
-    explicitPort: options.port !== undefined,
-    configuredPort: config.port,
-    ...(linkMode ? { linkStatus: () => supervisor?.status() ?? { kind: "stopped" as const }, linkKeySource: linkKey } : {}),
-    ...(supervisor ? { linkTunnel: supervisor } : homeInitiated ? { linkTunnel: HOME_INITIATED_LINK_TUNNEL } : {}),
-  }, io);
-  activeServer = server;
-  activePort = boundPort;
-  activeSupervisor = supervisor;
-  supervisor?.start();
+  // One secret for the life of this process: a rollback republishes the same identity.
+  const attestationSecret = createLocalAttestationSecret();
+
+  // Bind, start a fresh tunnel supervisor and publish. Runs once at start and again when a failed
+  // restart rolls back (OCX-6); the stopped supervisor cannot be started twice, so each call builds one.
+  // The port this process actually serves on; a rollback binds exactly this one again.
+  let servedPort = preferred;
+  // Returns false only for a rollback whose connection changed while it was binding: the new
+  // listener is then closed unpublished and the caller recycles.
+  const serve = async (rollback?: { port: number; portWaitMs: number }): Promise<boolean> => {
+    const supervisor = supervised
+      ? createClientLinkSupervisor({
+        diagnostic: recordLinkDiagnostic,
+        onLinkEnded: () => scheduleStandaloneRecycle(state.value.tokenFingerprint),
+        linkKey,
+      })
+      : null;
+    // What `/readyz` reports about the link: the supervisor's tunnel, or for a Home-initiated
+    // link the shared relay preflight. A link with neither refuses every relayed request.
+    const link = state.value.link;
+    const linkReadiness: MachineListenerDeps["linkReadiness"] = !linkMode ? undefined
+      : supervisor ? () => clientInitiatedLinkReadiness(supervisor.status())
+      : homeInitiated && link && linkKey
+        ? createHomeInitiatedLinkReadiness({ target: { tunnelPort: link.tunnelPort, linkId: link.linkId, apiKeyId: state.value.apiKeyId }, linkKey })
+        : () => ({ ready: false, reason: "tunnel_unavailable" });
+    const { server, port: boundPort } = await bindClientListener({
+      state: state.value,
+      linkMode,
+      // A rollback takes back exactly the port it gave up: never the preferred one, never another.
+      preferred: rollback?.port ?? preferred,
+      explicitPort: rollback !== undefined || options.port !== undefined,
+      configuredPort: config.port,
+      restart: { attestationSecret, startedAt: CLIENT_RUNTIME_STARTED_AT, request: () => restartController.request() },
+      ...(linkMode ? { linkStatus: () => activeSupervisor?.status() ?? { kind: "stopped" as const }, linkKeySource: linkKey } : {}),
+      ...(supervisor ? { linkTunnel: supervisor } : homeInitiated ? { linkTunnel: HOME_INITIATED_LINK_TUNNEL } : {}),
+      ...(linkReadiness ? { linkReadiness } : {}),
+    }, rollback === undefined ? io : { ...io, portWaitMs: rollback.portWaitMs });
+    const publish = (): void => {
+      activeServer = server;
+      activePort = boundPort;
+      servedPort = boundPort;
+      activeSupervisor = supervisor;
+      supervisor?.start();
+      writePid(process.pid);
+      writeRuntimePort(clientRuntimeRecord(process.pid, boundPort, attestationSecret));
+      if (linkMode && state.value.link && linkKey) {
+        activeReporter = createLinkParityReporter({ connection: state.value, linkKey, runtimeStartedAt: CLIENT_RUNTIME_STARTED_AT });
+        activeReporter.start();
+      }
+    };
+    if (!rollback) {
+      publish();
+      return true;
+    }
+    // A rollback publishes under the client lifecycle lock, after rechecking the connection there,
+    // so a disconnect or connect that committed during the bind can never be served over. A lock
+    // held by such an operation counts as a change.
+    let published = false;
+    try {
+      published = withClientLifecycleSync(() => {
+        if (clientRestartRollbackAction(state.value, readClientConnectionState()) === "recycle") return false;
+        publish();
+        return true;
+      });
+    } catch {
+      published = false;
+    }
+    if (!published) {
+      try { await server.stop(true); } catch { /* never published */ }
+    }
+    return published;
+  };
+
+  // Stop everything this process serves, giving in-flight requests up to `drainMs`.
+  const stopServing = async (drainMs: number): Promise<void> => {
+    activeReporter?.stop();
+    activeReporter = null;
+    try {
+      await activeSupervisor?.stop();
+    } catch (error) {
+      console.warn(`[client] link supervisor stop failed: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    activeSupervisor = null;
+    const server = activeServer;
+    activeServer = null;
+    if (!server) return;
+    let timer: ReturnType<typeof setTimeout> | undefined;
+    try {
+      await Promise.race([
+        Promise.resolve(server.stop(false)),
+        new Promise<void>(resolve => { timer = setTimeout(resolve, drainMs); }),
+      ]);
+    } catch { /* closed below */ } finally {
+      if (timer) clearTimeout(timer);
+    }
+    try { await server.stop(true); } catch { /* already closed */ }
+  };
+
+  const restartController: ClientRestartController = createClientRestartController({
+    supervisor: io.restartSupervisor ?? clientRestartSupervisor,
+    stop: stopServing,
+    spawnReplacement: async deadlineAt => {
+      const { replacementStartEnvironment } = await import("../server/management/system-restart");
+      const { spawnReplacementStart } = await import("../server/restart-replacement");
+      await spawnReplacementStart(
+        { port: activePort ?? config.port, waitForHealth: true, env: replacementStartEnvironment(true), notReady: "terminate" },
+        { deadlineAt },
+      );
+    },
+    resume: async () => {
+      // The connection may have changed while the replacement was starting (`ocx disconnect`, a
+      // new connect). Serving the old one again would be a stale runtime nothing recycles; hand
+      // off to the recycle, which starts whatever the durable state now calls for.
+      if (clientRestartRollbackAction(state.value, readClientConnectionState()) === "recycle") {
+        await recycleStandalone(state.value.tokenFingerprint);
+        return;
+      }
+      if (!(await serve({ port: servedPort, portWaitMs: CLIENT_RESTART_REBIND_WAIT_MS }))) {
+        await recycleStandalone(state.value.tokenFingerprint);
+      }
+    },
+    exitProcess: async code => {
+      await flushLinkDiagnostics();
+      process.exit(code);
+    },
+  });
+
   installCrashGuards();
-  writePid(process.pid);
-  writeRuntimePort(clientRuntimeRecord(process.pid, boundPort));
+  // serve() publishes the pid and runtime record; the ownership lease is released only after it.
+  await serve();
   options.afterPublish?.();
 
   let shuttingDown = false;
@@ -320,18 +447,21 @@ export async function startClientRuntime(
     if (shuttingDown) return;
     shuttingDown = true;
     void (async () => {
+      activeReporter?.stop();
+      activeReporter = null;
       try {
-        await supervisor?.stop();
+        await activeSupervisor?.stop();
       } catch (error) {
         console.warn(`[client] link supervisor stop failed: ${error instanceof Error ? error.message : String(error)}`);
       }
       activeSupervisor = null;
       try {
-        server.stop(true);
+        activeServer?.stop(true);
       } catch (error) {
         console.warn(`[client] listener stop failed: ${error instanceof Error ? error.message : String(error)}`);
       } finally {
         cleanup();
+        await flushLinkDiagnostics();
         // launchd relaunches only unsuccessful exits; an external signal must still count.
         process.exit(handledSignalExitCode(signal));
       }

package/src/codex/account-store.ts

@@ -12,13 +12,15 @@ import {
   backupInvalidConfig,
   hardenConfigDir,
   hardenExistingSecret,
+  loadConfig,
   withConfigMutationLockSync,
 } from "../config";
 import { notifyCodexStoreLoaded } from "../lib/decision-quota-sink";
 import { assertNotRealHomeUnderTest } from "../lib/test-home-guard";
-import type { CodexAccountCredentialRecord, CodexAccountCredentials } from "../types";
+import type { CodexAccount, CodexAccountCredentialRecord, CodexAccountCredentials } from "../types";
 import { advanceCodexCredentialMutationEpoch } from "./credential-mutation-epoch";
 import { isValidCodexAccountId } from "./account-id";
+import { codexAccountLogLabel, fallbackCodexAccountLogLabel } from "./account-label";
 import type { PoolQuotaWriter } from "./quota-types";
 import { CODEX_REFRESH_FLIGHT_CEILING_MS } from "./quota-recovery-timing";
 
@@ -183,6 +185,18 @@ function persistCredentialMutation(store: CodexAccountStore): void {
   advanceCodexCredentialMutationEpoch();
 }
 
+/**
+ * The durable `p<hex6>` label the dashboard and usage log show for this pool account, so a refresh
+ * failure line can be matched to the account row (#7592). The id hash is only the label of a
+ * legacy row that never received one. A config read failure must not replace the refresh error
+ * being reported, so it degrades to that same hash.
+ */
+function poolAccountLogLabel(id: string): string {
+  let account: CodexAccount | undefined;
+  try { account = loadConfig().codexAccounts?.find(row => row.id === id); } catch { account = undefined; }
+  return account ? codexAccountLogLabel(account) : fallbackCodexAccountLogLabel(id);
+}
+
 /**
  * Validation metadata that survives a credential write.
  *
@@ -1055,7 +1069,7 @@ export async function forceRefreshCodexPoolToken(
       if (isTerminalCodexPoolRefreshFailure(error) || isOperationalCodexPoolRefreshFailure(error)) {
         if (isTerminalCodexPoolRefreshFailure(error)) clearCodexPoolRefreshFailure(id);
       } else {
-        noteCodexPoolRefreshFailure(id, classifyCodexPoolRefreshFailureReason(error), undefined, refreshFence);
+        noteCodexPoolRefreshFailure(id, classifyCodexPoolRefreshFailureReason(error), undefined, refreshFence, poolAccountLogLabel);
       }
       settle({ kind: "failed", error });
     },
@@ -1376,7 +1390,7 @@ async function resolveCodexToken(
         .catch(() => undefined);
       const failure = classifyChatgptRefreshFailure(res.status, body?.displaySafe ? body.text : "");
       const { reason } = failure;
-      noteChatgptRefreshFailure("pool", res.status, failure);
+      noteChatgptRefreshFailure("pool", res.status, failure, poolAccountLogLabel(id));
       throw new TokenRefreshError(reason, `Codex token refresh failed (${reason}); reauthenticate the account.`, res.status, failure.code);
     }
     const data = (await res.json()) as { access_token: string; refresh_token?: string; expires_in: number };

package/src/codex/app-server-restart-service.ts

@@ -182,11 +182,12 @@ async function runCodexRestart(io: CodexRestartServiceIo): Promise<CodexRestartR
   // Decided here, before the early returns, because the model picker lives in the DESKTOP
   // app: "no app-server is running" is not a reason to leave a stale roster on screen.
   //
-  // The shell restarts only when its picker predates the catalog (#4761). Quitting it
-  // discards composer drafts, unsent picker selections and pending approvals, and when
-  // the picker is already current the app-server restart below is all the operator
-  // needs: the desktop respawns its app-server child, which rereads config and catalog.
-  // An unreadable picker state takes the full restart, the behaviour before #4761.
+  // The shell gets a restart attempt whenever its picker cannot be proven current: at
+  // or before the catalog mtime it is stale, and newer is unknown because an earlier
+  // sync may have rebound an already-existing catalog file (#4761). Quitting it
+  // discards composer drafts, unsent picker selections and pending approvals. The
+  // attempt is explicit, not a guarantee: the restart helper can refuse or partially
+  // fail, and desktopApp reports that outcome.
   //
   // allowHandoff is false and that is deliberate. The handoff waits for the CALLING
   // process to exit, and this runs inside a long-lived proxy that does not, so every

package/src/codex/auth-context.ts

@@ -98,6 +98,7 @@ import { getMainReserveAuthorization, isMainReserveAuthorizationLive, nativeUser
 import { UpstreamRetryEvidenceError } from "../lib/upstream-retry";
 import { getEffectiveCodexAutoSwitchThreshold } from "./account-auto-switch";
 import { CODEX_MAIN_DUPLICATE_ACTION, configuredCodexMainDuplicate } from "./collision-identity";
+import { AgentAssertionUnsupportedError, authorizationCredential, hasAgentAssertionAuthorization } from "../lib/authorization-scheme";
 
 /**
  * A request-owned bearer cannot inspect the physical main credential for its plan, but cached
@@ -701,7 +702,7 @@ async function authorizeReserveCredential(
 
 function selectedCodexToken(headers: Headers): { accessToken: string; chatgptAccountId: string } {
   return {
-    accessToken: headers.get("authorization")?.replace(/^Bearer\s+/i, "").trim() ?? "",
+    accessToken: authorizationCredential(headers) ?? "",
     chatgptAccountId: headers.get("chatgpt-account-id") ?? "",
   };
 }
@@ -716,7 +717,7 @@ function selectedCodexToken(headers: Headers): { accessToken: string; chatgptAcc
 export function callerCodexWorkspaceAccountId(headers: Headers): string | undefined {
   const explicit = headers.get("chatgpt-account-id");
   if (explicit) return explicit;
-  const bearer = headers.get("authorization")?.replace(/^Bearer\s+/i, "").trim();
+  const bearer = authorizationCredential(headers);
   return bearer ? extractAccountId(undefined, bearer) : undefined;
 }
 
@@ -807,7 +808,7 @@ function assertMainAccountPolicy(
 
 /** No auth-file I/O: an unsigned claim alone never identifies a caller as stored main. */
 function callerMatchesObservedMain(headers: Headers): boolean {
-  const bearer = headers.get("authorization")?.replace(/^Bearer\s+/i, "").trim();
+  const bearer = authorizationCredential(headers);
   if (!bearer) return false;
   const effectiveAccountId = headers.get("chatgpt-account-id")
     ?? extractAccountId(undefined, bearer);
@@ -831,7 +832,7 @@ function sameCredentialMaterial(a: string, b: string): boolean {
  * cooldown — the safe direction.
  */
 function callerIsCooledPoolAccount(headers: Headers, config: OcxConfig, accountId: string): boolean {
-  const bearer = headers.get("authorization")?.replace(/^Bearer\s+/i, "").trim();
+  const bearer = authorizationCredential(headers);
   if (!bearer) return true;
   const callerAccountId = headers.get("chatgpt-account-id") ?? extractAccountId(undefined, bearer);
   if (callerAccountId === undefined) return true;
@@ -1767,7 +1768,7 @@ export class CodexMainSubstitutionUnavailableError extends Error {
 
 /** Dispatch identity comes only from an owned observation of the selected credential. */
 function selectedMainQuotaDispatch(selected: Headers): MainQuotaDispatch | undefined {
-  const bearer = selected.get("authorization")?.replace(/^Bearer\s+/i, "").trim();
+  const bearer = authorizationCredential(selected);
   if (!bearer) return undefined;
   const accountId = selected.get("chatgpt-account-id") ?? extractAccountId(undefined, bearer);
   return captureMainQuotaDispatch(bearer, accountId, captureConfigGeneration());
@@ -1792,6 +1793,8 @@ export function materializeCodexUpstreamAuth(
   ctx: CodexAuthContext,
   options: CodexAuthMaterializationOptions = {},
 ): Headers {
+  // assertion_only must never be answered with a pool, stored-main, or other substituted Bearer.
+  if (hasAgentAssertionAuthorization(headers)) throw new AgentAssertionUnsupportedError();
   if (ctx.kind === "main") ctx.mainQuotaDispatch = undefined;
   const selected = new Headers();
   for (const name of FORWARD_HEADERS) {
@@ -1814,7 +1817,7 @@ export function materializeCodexUpstreamAuth(
   }
   if (ctx.kind === "main" && options.substituteMainCredential !== true
     && !selected.has("chatgpt-account-id")) {
-    const bearer = selected.get("authorization")?.replace(/^Bearer\s+/i, "").trim();
+    const bearer = authorizationCredential(selected);
     const accountId = bearer ? extractAccountId(undefined, bearer) : undefined;
     if (accountId) selected.set("chatgpt-account-id", accountId);
   }
@@ -1892,6 +1895,7 @@ export async function materializeCodexUpstreamAuthAsync(
   ctx: CodexAuthContext,
   options: CodexAuthMaterializationOptions = {},
 ): Promise<Headers> {
+  if (hasAgentAssertionAuthorization(headers)) throw new AgentAssertionUnsupportedError();
   if (ctx.kind === "main") ctx.mainQuotaDispatch = undefined;
   if (requiresReserveAuthorization(options.config, options.modelId, options.admission)) {
     return materializeReserveUpstreamAuth(headers, ctx, options);

package/src/codex/catalog/effort.ts

@@ -55,6 +55,12 @@ import {
 export function nativeEffortClamp(slug: string, effort: string | undefined): string | null {
   if (!effort || (effort !== "max" && effort !== "ultra")) return null;
   if (slug.includes("/")) return null; // routed models map efforts in their adapters
+  // `ultra` is a client-facing catalog choice (max reasoning plus proactive delegation) that
+  // codex-rs converts to `max` before any request (core/src/client.rs
+  // `reasoning_effort_for_request`). The ChatGPT backend rejects it with HTTP 400 even for a
+  // model whose pinned ladder lists it (#7590), so it is never a native wire value: fold it to
+  // `max`, then clamp `max` like a direct selection.
+  const wire = "max";
   const entry = UPSTREAM_NATIVE_ENTRIES.get(slug);
   const levels = Array.isArray(entry?.supported_reasoning_levels)
     ? entry.supported_reasoning_levels as Array<{ effort?: string }>
@@ -65,10 +71,11 @@ export function nativeEffortClamp(slug: string, effort: string | undefined): str
     // a retired slug a client still asks for, and future old-ladder slugs)
     // really stops at xhigh — the ChatGPT backend error names exactly none..xhigh — so clamp
     // the synthetic top tier.
-    return isGpt56NativeSlug(slug) ? null : "xhigh";
+    if (!isGpt56NativeSlug(slug)) return "xhigh";
+    return effort === wire ? null : wire;
   }
   const supported = levels.flatMap(l => typeof l.effort === "string" ? [l.effort] : []);
-  if (supported.includes(effort)) return null;
+  if (supported.includes(wire)) return effort === wire ? null : wire;
   const rank = ["minimal", "low", "medium", "high", "xhigh", "max"];
   const highest = supported
     .filter(e => rank.includes(e))

package/src/codex/catalog/gather-capture.ts

@@ -119,6 +119,7 @@ export interface CatalogGatherProviderModelOutcome {
   readonly state: "authoritative" | "degraded";
 }
 export interface ModelsAuthResolution {
+  readonly workbuddy?: import("../../oauth/types").WorkBuddyOAuthMetadata;
   readonly apiKey: string | undefined;
   readonly observed: boolean;
   readonly oauthAccountId?: string;
@@ -334,8 +335,9 @@ export function captureModelsRequest(
   name: string,
   provider: OcxProviderConfig,
   oauthApiBaseUrl: string | undefined,
+  workbuddy?: import("../../oauth/types").WorkBuddyOAuthMetadata,
 ): CapturedModelsRequest {
-  const observed = { oauthApiBaseUrl };
+  const observed = { oauthApiBaseUrl, workbuddy };
   const withoutCredential = buildModelsRequest(provider, undefined, name, observed);
   const withCredential = buildModelsRequest(provider, REQUEST_CREDENTIAL_SENTINEL, name, observed);
   const method = withoutCredential.method ?? "GET";
@@ -400,7 +402,7 @@ export function captureProviderGather(
     : authResolver.kind === "refreshing" && provider.authMode === "oauth" && mayResolveModelsOAuth(name, provider)
       ? getOAuthCredentialApiBaseUrl(name)
       : undefined;
-  const request = captureModelsRequest(name, provider, oauthApiBaseUrl);
+  const request = captureModelsRequest(name, provider, oauthApiBaseUrl, observedAuth?.workbuddy);
   const refreshingOAuthAccountId = !observedAuth && authResolver.kind === "refreshing" && provider.authMode === "oauth" && mayResolveModelsOAuth(name, provider)
     ? getAccountSet(name)?.activeAccountId
     : undefined;

package/src/codex/catalog/parsing.ts

@@ -809,6 +809,10 @@ export function normalizeRoutedCatalogEntry(
   delete entry.multi_agent_version;
   delete entry.multi_agent_reasoning_effort;
   delete entry.use_responses_lite;
+  // Codex 0.164 sends positional `configuration_update` effort items only for rows declaring this
+  // and freezes the request-level effort for the context window. A routed provider never
+  // negotiated that contract, so a row cloned from a GPT-6 template must not inherit it.
+  delete entry.supports_reasoning_effort_updates;
   delete entry.supports_websockets;
   // Routed rows cloned from native templates must not inherit OpenAI-only experimental context
   // delivery. Codex reads the flag as "this model accepts experimental context history" and drives