@coseung2/opencodex 2.8.0-cs.12 → 2.8.0-cs.14

package/src/codex/auth-api.ts

@@ -1,12 +1,15 @@
-import { ConfigMutationLockError, loadConfig, mutatePersistedConfig, saveConfigPreservingClaudeCode } from "../config";
+import { ConfigMutationLockError, loadConfig, mutatePersistedConfig, reconcileLiveConfigFromDisk, saveConfigPreservingClaudeCode } from "../config";
 import { withCodexAccountLogLabel } from "./account-label";
 import {
   getCodexAccountCredential,
   getValidCodexToken,
   isCodexAccountGenerationLive,
+  clearCodexAccountQuotaPauseOwnership,
+  markCodexAccountQuotaValidationPending,
   markCodexAccountValidated,
   readCodexAccountRecord,
   saveCodexAccountCredential,
+  tombstoneCodexAccountIfGeneration,
   CodexCredentialGenerationConflictError,
   CodexCredentialRefreshLockTimeoutError,
   CodexCredentialRefreshBusyError,
@@ -14,19 +17,36 @@ import {
   TokenRefreshError,
 } from "./account-store";
 import { deleteCodexAccount, reconcileMainCodexAccountRuntimeState } from "./account-lifecycle";
+import {
+  appendDefaultCodexAccountNamespace,
+  initializeDefaultCodexAccountNamespaces,
+} from "./account-namespaces";
 import { isCodexAccountPaused, setCodexAccountPaused } from "./account-pause";
+import {
+  clearCodexAccountPin,
+  getCodexAccountPriority,
+  isCodexAccountPriorityKey,
+  pinnedCodexAccountId,
+  setCodexAccountPin,
+  setCodexAccountPriority,
+} from "./account-priority";
 import {
   clearCodexAccountCooldown,
   clearThreadAccountMapForAccount,
   getEffectiveActiveCodexAccountId,
+  isEffectiveCodexAccountPinned,
   reconcileCodexActiveAfterExclusion,
   resetCodexRoutingForManualSelection,
 } from "./routing";
 import {
+  DEFAULT_ACCOUNT_PRIORITY,
+  MAX_ACCOUNT_PRIORITY,
+  MIN_ACCOUNT_PRIORITY,
   normalizeAccountPoolStickyLimit,
   normalizeAccountPoolStrategy,
   parseAccountPoolStickyLimit,
   parseAccountPoolStrategy,
+  parseAccountPriority,
 } from "./pool-rotation";
 import { checkAccountIdCollision, getMainChatgptAccountId, readCodexTokens, readCodexTokensResult } from "./auth-collision";
 export { checkAccountIdCollision, getMainChatgptAccountId } from "./auth-collision";
@@ -35,6 +55,7 @@ import { clearAccountNeedsReauth, isAccountNeedsReauth, markAccountNeedsReauth }
 import {
   clearAccountQuota,
   getAccountQuota,
+  isCodexFiveHourQuotaPlan,
   isCodexQuotaExhausted,
   listAccountQuotas,
   parseUsageQuota,
@@ -63,7 +84,7 @@ import {
 } from "./main-account-cache";
 export { clearMainAccountInfoCache } from "./main-account-cache";
 import { maskEmail } from "../lib/privacy";
-import { CodexWarmupError, codexWarmupFailureReason, warmCodexAccount } from "./warmup";
+import { codexWarmupFailureReason, isCodexWarmupQuotaFailure, warmCodexAccount } from "./warmup";
 export { maskEmail } from "../lib/privacy";
 import type { CodexAccount, OcxConfig } from "../types";
 import { isCanonicalOpenAiForwardProvider, OPENAI_CODEX_PROVIDER_ID } from "../providers/openai-tiers";
@@ -83,6 +104,7 @@ import {
 } from "./account-id";
 import { codexAccountIdNamespaceCollisionError } from "./account-namespace-match";
 import { ResourceAdmissionError } from "../lib/admission";
+import { requestCodexQuotaWarmupRetry } from "../oauth/token-guardian";
 
 function jsonResponse(data: unknown, status = 200): Response {
   return new Response(JSON.stringify(data), {
@@ -165,6 +187,7 @@ function poolAccountDto(
   quotaResult: PoolQuotaResult,
   hasCredential: boolean,
   paused: boolean,
+  priority: number,
 ): CodexAuthAccountDto {
   const quota = quotaForPlan(quotaResult.quota, account.plan);
   const needsReauth = !hasCredential || quotaResult.needsReauth || isAccountNeedsReauth(account.id);
@@ -177,6 +200,7 @@ function poolAccountDto(
     ...(account.logLabel !== undefined ? { logLabel: account.logLabel } : {}),
     isMain: false,
     paused,
+    priority,
     quota: quota ? { ...quota } : null,
     needsReauth,
     hasCredential,
@@ -248,19 +272,17 @@ async function verifyCodexAccountWarmup(
   accountId: string,
   accessToken: string,
   chatgptAccountId: string,
-): Promise<{ ok: true; validatedAt: number } | { ok: false; response: Response }> {
+): Promise<{ ok: true; validatedAt: number } | { ok: false; response: Response; error: unknown }> {
   try {
     await warmCodexAccount({ accessToken, chatgptAccountId });
     return { ok: true, validatedAt: Date.now() };
   } catch (err) {
     const reason = codexWarmupFailureReason(err);
-    const upstream = err instanceof CodexWarmupError ? err.upstreamDetail : undefined;
     return {
       ok: false,
+      error: err,
       response: jsonResponse({
-        error: upstream
-          ? `Codex account warmup failed: ${upstream}`
-          : "Codex account warmup failed. Reauthenticate the account and try again.",
+        error: "Codex account warmup failed. Reauthenticate the account and try again.",
         code: "codex_warmup_failed",
         reason,
         accountId,
@@ -269,6 +291,67 @@ async function verifyCodexAccountWarmup(
   }
 }
 
+interface FreshRegistrationQuota {
+  quota: Omit<StoredAccountQuota, "updatedAt">;
+  plan?: string;
+  email?: string;
+}
+
+async function fetchFreshRegistrationQuota(
+  accessToken: string,
+  chatgptAccountId: string,
+  configuredPlan?: string,
+): Promise<FreshRegistrationQuota | null> {
+  try {
+    const resp = await fetch("https://chatgpt.com/backend-api/wham/usage", {
+      headers: { Authorization: `Bearer ${accessToken}`, "ChatGPT-Account-Id": chatgptAccountId },
+      signal: AbortSignal.timeout(8000),
+    });
+    if (!resp.ok) return null;
+    const data = (await resp.json()) as WhamUsageResponse;
+    const plan = nonEmptyPlan(data.plan_type) ?? nonEmptyPlan(configuredPlan) ?? undefined;
+    const quota = parseUsageQuota({ ...data, ...(plan ? { plan_type: plan } : {}) });
+    if (!quota) return null;
+    return {
+      quota,
+      ...(plan ? { plan } : {}),
+      ...(typeof data.email === "string" && data.email.trim() ? { email: data.email } : {}),
+    };
+  } catch {
+    return null;
+  }
+}
+
+function exhaustedQuotaRetryAt(
+  quota: Omit<StoredAccountQuota, "updatedAt">,
+  plan?: string | null,
+  nowMs: number = Date.now(),
+): number | undefined {
+  const monthlyOnly = isThirtyDayOnlyPlan(plan);
+  const resetSeconds: number[] = [];
+  if (!monthlyOnly && isCodexFiveHourQuotaPlan(plan)
+    && quota.fiveHourPercent !== undefined && quota.fiveHourPercent >= 100
+    && quota.fiveHourResetAt !== undefined) resetSeconds.push(quota.fiveHourResetAt);
+  if (!monthlyOnly && quota.weeklyPercent !== undefined && quota.weeklyPercent >= 100
+    && quota.weeklyResetAt !== undefined) resetSeconds.push(quota.weeklyResetAt);
+  if (quota.monthlyPercent !== undefined && quota.monthlyPercent >= 100
+    && quota.monthlyResetAt !== undefined) resetSeconds.push(quota.monthlyResetAt);
+  const retryAtMs = resetSeconds.length > 0 ? Math.max(...resetSeconds) * 1000 : undefined;
+  return retryAtMs !== undefined && Number.isFinite(retryAtMs) && retryAtMs > nowMs
+    ? retryAtMs
+    : undefined;
+}
+
+function mayDeferQuotaWarmup(
+  warmup: { ok: false; error: unknown },
+  fresh: FreshRegistrationQuota | null,
+): fresh is FreshRegistrationQuota {
+  return isCodexWarmupQuotaFailure(warmup.error)
+    && fresh !== null
+    && isCodexQuotaExhausted(fresh.quota, fresh.plan)
+    && exhaustedQuotaRetryAt(fresh.quota, fresh.plan) !== undefined;
+}
+
 function expireCodexAuthFlow(flowId: string | null, error = "Login cancelled"): void {
   const ids = flowId
     ? [flowId]
@@ -311,6 +394,71 @@ function saveRuntimeConfig(sourceConfig: OcxConfig, nextConfig: OcxConfig): void
   Object.assign(sourceConfig, nextConfig);
 }
 
+type CodexAccountConfigCommit = { ok: true } | { ok: false; error: string };
+
+function commitCodexAccountConfig(
+  sourceConfig: OcxConfig,
+  account: CodexAccount,
+  mode: "create" | "reauth",
+  credentialGeneration: number,
+  quotaPause: "add" | "release" | "preserve",
+): CodexAccountConfigCommit {
+  const liveBaseline = structuredClone(sourceConfig);
+  const applyMutation = (persisted: OcxConfig) => {
+    if (!isCodexAccountGenerationLive(account.id, credentialGeneration)) {
+      return { changed: false, value: { ok: false, error: "Codex account changed while login was being saved" } as CodexAccountConfigCommit };
+    }
+    const conflict = mode === "create"
+      ? codexAccountIdNamespaceCollisionError(persisted.codexAccountNamespaces, account.id)
+        ?? ((persisted.codexAccounts ?? []).some(candidate => candidate.id === account.id)
+          ? `Account id already exists: ${account.id}`
+          : undefined)
+      : (configuredPoolAccount(persisted, account.id)
+        ? undefined
+        : "Pool account was removed while login was in progress. Add it again as a new account.");
+    if (conflict) {
+      return { changed: false, value: { ok: false, error: conflict } as CodexAccountConfigCommit };
+    }
+
+    const accounts = persisted.codexAccounts ?? [];
+    const existingIdx = accounts.findIndex(candidate => candidate.id === account.id);
+    let committedAccount: CodexAccount;
+    if (existingIdx >= 0) {
+      committedAccount = withCodexAccountLogLabel({
+        ...accounts[existingIdx],
+        ...account,
+        isMain: false,
+      }, accounts);
+      accounts[existingIdx] = committedAccount;
+    } else {
+      committedAccount = withCodexAccountLogLabel({ ...account, isMain: false }, accounts);
+      accounts.push(committedAccount);
+    }
+    persisted.codexAccounts = accounts;
+    if (mode === "create" && persisted.codexAccountPickerEnabled !== undefined) {
+      initializeDefaultCodexAccountNamespaces(persisted);
+      appendDefaultCodexAccountNamespace(persisted, committedAccount);
+    }
+    if (quotaPause === "add") setCodexAccountPaused(persisted, account.id, true);
+    else if (quotaPause === "release") setCodexAccountPaused(persisted, account.id, false);
+    return { changed: true, value: { ok: true } as CodexAccountConfigCommit };
+  };
+  const outcome = mutatePersistedConfig(applyMutation);
+  if (outcome.status === "unavailable") {
+    if (outcome.reason === "missing") {
+      const fallback = structuredClone(sourceConfig);
+      const applied = applyMutation(fallback);
+      if (!applied.value.ok) return applied.value;
+      saveRuntimeConfig(sourceConfig, fallback);
+      return { ok: true };
+    }
+    return { ok: false, error: `Configuration could not be updated (${outcome.reason})` };
+  }
+  if (!outcome.value.ok) return outcome.value;
+  reconcileLiveConfigFromDisk(sourceConfig, liveBaseline);
+  return { ok: true };
+}
+
 async function mapWithConcurrency<T, R>(
   items: T[],
   concurrency: number,
@@ -364,7 +512,7 @@ interface MainAccountInfoFetchResult {
 }
 
 export async function fetchMainAccountInfo(forceRefresh = false): Promise<MainAccountInfo> {
-  const { info } = await fetchMainAccountInfoAttempt(forceRefresh, 1);
+  const { info } = await fetchMainAccountInfoAttempt(forceRefresh, 1, forceRefresh);
   return info;
 }
 
@@ -373,16 +521,21 @@ const EMPTY_MAIN_ACCOUNT_INFO: MainAccountInfo = { email: null, plan: null, quot
 async function retryMainAccountInfoIfIdentityChanged(
   requestAccountId: string | null,
   retriesRemaining: number,
+  explicitRefresh: boolean,
 ): Promise<MainAccountInfoFetchResult | null> {
   const currentAccountId = getMainChatgptAccountId();
   if (currentAccountId === null || currentAccountId === requestAccountId) return null;
   reconcileMainCodexAccountRuntimeState();
   return retriesRemaining > 0
-    ? fetchMainAccountInfoAttempt(true, retriesRemaining - 1)
+    ? fetchMainAccountInfoAttempt(true, retriesRemaining - 1, explicitRefresh)
     : { info: EMPTY_MAIN_ACCOUNT_INFO };
 }
 
-async function fetchMainAccountInfoAttempt(forceRefresh: boolean, retriesRemaining: number): Promise<MainAccountInfoFetchResult> {
+async function fetchMainAccountInfoAttempt(
+  forceRefresh: boolean,
+  retriesRemaining: number,
+  explicitRefresh = forceRefresh,
+): Promise<MainAccountInfoFetchResult> {
   const writerGeneration = captureConfigGeneration();
   reconcileMainCodexAccountRuntimeState();
   const tokenRead = readCodexTokensResult();
@@ -409,7 +562,7 @@ async function fetchMainAccountInfoAttempt(forceRefresh: boolean, retriesRemaini
     });
     if (!resp.ok) {
       const terminalAuthFailure = await isTerminalMainAuthResponse(resp);
-      const retried = await retryMainAccountInfoIfIdentityChanged(requestAccountId, retriesRemaining);
+      const retried = await retryMainAccountInfoIfIdentityChanged(requestAccountId, retriesRemaining, explicitRefresh);
       if (retried) return retried;
       if (terminalAuthFailure) {
         clearMainAccountInfoCache();
@@ -418,7 +571,7 @@ async function fetchMainAccountInfoAttempt(forceRefresh: boolean, retriesRemaini
       return { info: EMPTY_MAIN_ACCOUNT_INFO };
     }
     const data = (await resp.json()) as WhamUsageResponse;
-    const retried = await retryMainAccountInfoIfIdentityChanged(requestAccountId, retriesRemaining);
+    const retried = await retryMainAccountInfoIfIdentityChanged(requestAccountId, retriesRemaining, explicitRefresh);
     if (retried) return retried;
     const plan = nonEmptyPlan(data.plan_type) ?? nonEmptyPlan(cached?.plan) ?? nonEmptyPlan(getMainAccountPlan());
     const quota = parseUsageQuota({ ...data, ...(plan ? { plan_type: plan } : {}) });
@@ -430,7 +583,9 @@ async function fetchMainAccountInfoAttempt(forceRefresh: boolean, retriesRemaini
       ts: Date.now(),
     };
     setMainAccountInfoCache(result);
-    clearAccountNeedsReauth(MAIN_CODEX_ACCOUNT_ID);
+    // A successful quota probe only proves /wham/usage accepted the token. Only an
+    // operator-requested refresh may retract a quarantine raised by Responses traffic.
+    if (explicitRefresh) clearAccountNeedsReauth(MAIN_CODEX_ACCOUNT_ID);
     // Mirror main quota + plan into the shared stores so the rotation engine can
     // score and auto-switch the main account exactly like a pool account (Option A).
     setMainAccountPlan(result.plan);
@@ -443,7 +598,7 @@ async function fetchMainAccountInfoAttempt(forceRefresh: boolean, retriesRemaini
       ...(freshResetCredits !== undefined ? { freshResetCredits } : {}),
     };
   } catch {
-    const retried = await retryMainAccountInfoIfIdentityChanged(requestAccountId, retriesRemaining);
+    const retried = await retryMainAccountInfoIfIdentityChanged(requestAccountId, retriesRemaining, explicitRefresh);
     return retried ?? { info: EMPTY_MAIN_ACCOUNT_INFO };
   }
 }
@@ -514,6 +669,8 @@ export interface CodexAuthAccountDto {
   logLabel?: string;
   isMain: boolean;
   paused: boolean;
+  /** Selection order; higher is considered first. */
+  priority: number;
   quota: (StoredAccountQuota | (Omit<StoredAccountQuota, "updatedAt"> & { updatedAt: number })) | null;
   needsReauth?: boolean;
   hasCredential: boolean;
@@ -750,6 +907,10 @@ export function clearCodexQuotaPrimeState(): void {
   primeInFlight = null;
 }
 
+export function effectiveCodexAuthAccountId(config: OcxConfig): string {
+  return getEffectiveActiveCodexAccountId(config) ?? MAIN_CODEX_ACCOUNT_ID;
+}
+
 export async function listCodexAuthAccounts(config: OcxConfig, forceRefresh = false): Promise<CodexAuthAccountDto[]> {
   const runtimeConfig = getRuntimeConfig(config);
   const poolAccounts = (runtimeConfig.codexAccounts ?? []).filter(isSelectableCodexPoolAccount);
@@ -796,6 +957,7 @@ export async function listCodexAuthAccounts(config: OcxConfig, forceRefresh = fa
         { quota: null, needsReauth: true },
         false,
         isCodexAccountPaused(runtimeConfig, accountId),
+        getCodexAccountPriority(runtimeConfig, accountId),
       )];
     }
     const resultGeneration = quotaResult.credentialGeneration ?? quotaResult.freshCredentialGeneration;
@@ -814,6 +976,7 @@ export async function listCodexAuthAccounts(config: OcxConfig, forceRefresh = fa
       effectiveQuotaResult,
       true,
       isCodexAccountPaused(runtimeConfig, accountId),
+      getCodexAccountPriority(runtimeConfig, accountId),
     )];
   });
   const hasMainCredential = readCodexTokens() !== null;
@@ -828,9 +991,15 @@ export async function listCodexAuthAccounts(config: OcxConfig, forceRefresh = fa
     plan: mainInfo.plan,
     isMain: true,
     paused: isCodexAccountPaused(runtimeConfig, MAIN_CODEX_ACCOUNT_ID),
+    priority: getCodexAccountPriority(runtimeConfig, MAIN_CODEX_ACCOUNT_ID),
     hasCredential: hasMainCredential,
     needsReauth: mainNeedsReauth,
-    quota: mainInfo.quota ? { ...quotaForPlan({ ...mainInfo.quota, updatedAt: Date.now() }, mainInfo.plan) } : null,
+    quota: mainInfo.quota ? {
+      ...quotaForPlan({
+        ...mainInfo.quota,
+        updatedAt: getAccountQuota(MAIN_CODEX_ACCOUNT_ID)?.updatedAt ?? Date.now(),
+      }, mainInfo.plan),
+    } : null,
     ...oauthAccountHealthFields("codex", MAIN_CODEX_ACCOUNT_ID, mainHealth),
   };
   return [main, ...withQuota];
@@ -937,24 +1106,52 @@ export async function handleCodexAuthAPI(
     const payload = decodeJwtPayload(body.accessToken);
     const exp = typeof payload?.exp === "number" ? payload.exp * 1000 : Date.now() + 3600_000;
     const warmup = await verifyCodexAccountWarmup(body.id, body.accessToken, derivedAccountId);
-    if (!warmup.ok) return warmup.response;
+    const freshQuota = !warmup.ok && isCodexWarmupQuotaFailure(warmup.error)
+      ? await fetchFreshRegistrationQuota(body.accessToken, derivedAccountId, body.plan)
+      : null;
+    const quotaDeferred = !warmup.ok && mayDeferQuotaWarmup(warmup, freshQuota);
+    if (!warmup.ok && !quotaDeferred) return warmup.response;
     const latestConfig = getRuntimeConfig(config);
     const commitConflict = codexAccountPersistenceConflict(latestConfig, body.id, "create");
     if (commitConflict) return jsonResponse({ error: commitConflict }, 400);
-    saveCodexAccountCredential(body.id, {
+    const credentialGeneration = saveCodexAccountCredential(body.id, {
       accessToken: body.accessToken,
       refreshToken: body.refreshToken,
       expiresAt: exp,
       chatgptAccountId: derivedAccountId,
     });
-    markCodexAccountValidated(body.id, warmup.validatedAt);
+    const commit = commitCodexAccountConfig(
+      config,
+      {
+        id: body.id,
+        email: body.email,
+        plan: freshQuota?.plan ?? body.plan,
+        isMain: false,
+      },
+      "create",
+      credentialGeneration,
+      quotaDeferred ? "add" : "preserve",
+    );
+    if (!commit.ok) {
+      tombstoneCodexAccountIfGeneration(body.id, credentialGeneration);
+      return jsonResponse({ error: commit.error }, 409);
+    }
+    if (quotaDeferred) {
+      markCodexAccountQuotaValidationPending(
+        body.id,
+        codexWarmupFailureReason(warmup.error),
+        exhaustedQuotaRetryAt(freshQuota.quota, freshQuota.plan),
+      );
+    } else if (warmup.ok) {
+      markCodexAccountValidated(body.id, warmup.validatedAt, credentialGeneration);
+    }
     clearAccountNeedsReauth(body.id);
-    const accounts = latestConfig.codexAccounts ?? [];
-    accounts.push(withCodexAccountLogLabel({ id: body.id, email: body.email, plan: body.plan, isMain: false }, accounts));
-    latestConfig.codexAccounts = accounts;
-    saveRuntimeConfig(config, latestConfig);
     reconcileLiveStateStores();
-    return jsonResponse({ ok: true });
+    if (quotaDeferred) {
+      setAccountQuotaFromParsed(body.id, freshQuota.quota);
+      requestCodexQuotaWarmupRetry();
+    }
+    return jsonResponse({ ok: true, ...(quotaDeferred ? { validation: "pending_quota_reset" } : {}) });
   }
 
   if (url.pathname === "/api/codex-auth/accounts" && req.method === "DELETE") {
@@ -1002,6 +1199,13 @@ export async function handleCodexAuthAPI(
     const exists = id === MAIN_CODEX_ACCOUNT_ID
       || (runtimeConfig.codexAccounts ?? []).some(account => isSelectableCodexPoolAccount(account) && account.id === id);
     if (!exists) return jsonResponse({ error: "Account not found" }, 404);
+    const record = id === MAIN_CODEX_ACCOUNT_ID ? null : readCodexAccountRecord(id);
+    if (body.paused === false && record?.lastCodexValidationStatus === "quota_pending") {
+      return jsonResponse({ error: "Account validation is waiting for its quota reset" }, 409);
+    }
+    if (body.paused === true && record?.codexQuotaPauseOwned === true) {
+      clearCodexAccountQuotaPauseOwnership(id);
+    }
 
     setCodexAccountPaused(runtimeConfig, id, body.paused);
     if (body.paused) {
@@ -1018,6 +1222,42 @@ export async function handleCodexAuthAPI(
     });
   }
 
+  if (url.pathname === "/api/codex-auth/accounts/priority" && req.method === "PUT") {
+    let parsedBody: unknown;
+    try { parsedBody = await req.json(); } catch { return jsonResponse({ error: "Invalid JSON" }, 400); }
+    if (typeof parsedBody !== "object" || parsedBody === null || Array.isArray(parsedBody)) {
+      return jsonResponse({ error: "body must be an object" }, 400);
+    }
+    const body = parsedBody as { id?: unknown; priority?: unknown };
+    const id = typeof body.id === "string" ? body.id.trim() : "";
+    if (!isCodexAccountPriorityKey(id)) return jsonResponse({ error: "Invalid account id format" }, 400);
+
+    let priority = DEFAULT_ACCOUNT_PRIORITY;
+    if (body.priority !== null) {
+      const parsed = parseAccountPriority(body.priority);
+      if (parsed === null) {
+        return jsonResponse({
+          error: `priority must be null or an integer ${MIN_ACCOUNT_PRIORITY}-${MAX_ACCOUNT_PRIORITY}`,
+        }, 400);
+      }
+      priority = parsed;
+    }
+
+    const runtimeConfig = getRuntimeConfig(config);
+    const exists = id === MAIN_CODEX_ACCOUNT_ID
+      || (runtimeConfig.codexAccounts ?? []).some(account => isSelectableCodexPoolAccount(account) && account.id === id);
+    if (!exists) return jsonResponse({ error: "Account not found" }, 404);
+    setCodexAccountPriority(runtimeConfig, id, priority);
+    clearCodexAccountPin(runtimeConfig);
+    saveRuntimeConfig(config, runtimeConfig);
+    return jsonResponse({
+      ok: true,
+      id,
+      priority,
+      activeCodexAccountId: getEffectiveActiveCodexAccountId(runtimeConfig) ?? null,
+    });
+  }
+
   if (url.pathname === "/api/codex-auth/accounts/pause-exhausted" && req.method === "PUT") {
     const runtimeConfig = getRuntimeConfig(config);
     const result = await pauseExhaustedCodexAccounts(runtimeConfig);
@@ -1078,6 +1318,8 @@ export async function handleCodexAuthAPI(
       if (!exists) return jsonResponse({ error: "Account not found" }, 400);
     }
     runtimeConfig.activeCodexAccountId = body.accountId ?? undefined;
+    if (body.accountId == null) clearCodexAccountPin(runtimeConfig);
+    else setCodexAccountPin(runtimeConfig, targetAccountId);
     resetCodexRoutingForManualSelection(targetAccountId);
     saveRuntimeConfig(config, runtimeConfig);
     return jsonResponse({ ok: true, activeCodexAccountId: body.accountId, appliesImmediately: true });
@@ -1087,6 +1329,8 @@ export async function handleCodexAuthAPI(
     const runtimeConfig = getRuntimeConfig(config);
     return jsonResponse({
       activeCodexAccountId: getEffectiveActiveCodexAccountId(runtimeConfig) ?? null,
+      pinned: isEffectiveCodexAccountPinned(runtimeConfig),
+      pinnedAccountId: pinnedCodexAccountId(runtimeConfig) ?? null,
       autoSwitchThreshold: runtimeConfig.autoSwitchThreshold ?? 80,
       upstreamFailoverThreshold: runtimeConfig.upstreamFailoverThreshold ?? 3,
       accountPoolStrategy: normalizeAccountPoolStrategy(runtimeConfig.accountPoolStrategy),
@@ -1377,7 +1621,10 @@ export async function handleCodexAuthAPI(
                 }
 
                 const warmup = await verifyCodexAccountWarmup(accountId, cred.access, oauthAccountId);
-                if (!warmup.ok) {
+                const freshRegistrationQuota = quota ? { quota, ...(plan ? { plan } : {}) } : null;
+                const quotaDeferred = !warmup.ok
+                  && mayDeferQuotaWarmup(warmup, freshRegistrationQuota);
+                if (!warmup.ok && !quotaDeferred) {
                   const body = await warmup.response.json().catch(() => ({})) as { error?: string; reason?: string };
                   setCodexLoginState(flowId, {
                     status: "error",
@@ -1391,6 +1638,7 @@ export async function handleCodexAuthAPI(
                 const latestConfig = getRuntimeConfig(config);
                 const accounts = latestConfig.codexAccounts ?? [];
                 const existingIdx = accounts.findIndex(account => account.id === accountId);
+                const existingAccount = existingIdx >= 0 ? accounts[existingIdx] : undefined;
                 const commitConflict = codexAccountPersistenceConflict(
                   latestConfig,
                   accountId,
@@ -1406,37 +1654,56 @@ export async function handleCodexAuthAPI(
                   break;
                 }
 
-                saveCodexAccountCredential(accountId, {
+                const releaseOwnedQuotaPause = reauth
+                  && readCodexAccountRecord(accountId)?.codexQuotaPauseOwned === true;
+                const quotaPauseOwned = !reauth
+                  || releaseOwnedQuotaPause
+                  || !isCodexAccountPaused(latestConfig, accountId);
+                const credentialGeneration = saveCodexAccountCredential(accountId, {
                   accessToken: cred.access,
                   refreshToken: cred.refresh,
                   expiresAt: cred.expires,
                   chatgptAccountId: oauthAccountId,
                 });
+                const configCommit = commitCodexAccountConfig(
+                  config,
+                  {
+                    id: accountId,
+                    email,
+                    plan: plan ?? existingAccount?.plan,
+                    isMain: false,
+                  },
+                  reauth ? "reauth" : "create",
+                  credentialGeneration,
+                  quotaDeferred ? "add" : releaseOwnedQuotaPause ? "release" : "preserve",
+                );
+                if (!configCommit.ok) {
+                  if (!reauth) tombstoneCodexAccountIfGeneration(accountId, credentialGeneration);
+                  setCodexLoginState(flowId, {
+                    status: "error",
+                    error: configCommit.error,
+                    doneAt: Date.now(),
+                  });
+                  completed = true;
+                  break;
+                }
                 // A successful reauthentication replaces the credential generation. Do not let a
                 // failed optional WHAM probe make the replacement inherit quota from the old record.
                 if (reauth) clearAccountQuota(accountId);
-                markCodexAccountValidated(accountId, warmup.validatedAt);
-                clearAccountNeedsReauth(accountId);
-                if (quota) {
-                  setAccountQuotaFromParsed(accountId, quota);
-                }
-
-                if (existingIdx >= 0) {
-                  // Keep the pool id stable; refresh display metadata after a successful login/reauth.
-                  accounts[existingIdx] = withCodexAccountLogLabel({
-                    ...accounts[existingIdx],
-                    email,
-                    plan: plan ?? accounts[existingIdx].plan,
-                    isMain: false,
-                  }, accounts);
-                  latestConfig.codexAccounts = accounts;
-                  saveRuntimeConfig(config, latestConfig);
-                } else {
-                  accounts.push(withCodexAccountLogLabel({ id: accountId, email, plan, isMain: false }, accounts));
-                  latestConfig.codexAccounts = accounts;
-                  saveRuntimeConfig(config, latestConfig);
+                if (quotaDeferred) {
+                  markCodexAccountQuotaValidationPending(
+                    accountId,
+                    codexWarmupFailureReason(warmup.error),
+                    exhaustedQuotaRetryAt(freshRegistrationQuota.quota, freshRegistrationQuota.plan),
+                    quotaPauseOwned,
+                  );
+                } else if (warmup.ok) {
+                  markCodexAccountValidated(accountId, warmup.validatedAt, credentialGeneration);
                 }
+                clearAccountNeedsReauth(accountId);
                 reconcileLiveStateStores();
+                if (quota) setAccountQuotaFromParsed(accountId, quota);
+                if (quotaDeferred) requestCodexQuotaWarmupRetry();
                 setCodexLoginState(flowId, { status: "done", accountId, email, doneAt: Date.now() });
                 completed = true;
               }