@coseung2/opencodex 2.8.0-cs.13 → 2.8.0-cs.14

package/src/codex/auth-api.ts

@@ -17,19 +17,36 @@ import {
   TokenRefreshError,
 } from "./account-store";
 import { deleteCodexAccount, reconcileMainCodexAccountRuntimeState } from "./account-lifecycle";
+import {
+  appendDefaultCodexAccountNamespace,
+  initializeDefaultCodexAccountNamespaces,
+} from "./account-namespaces";
 import { isCodexAccountPaused, setCodexAccountPaused } from "./account-pause";
+import {
+  clearCodexAccountPin,
+  getCodexAccountPriority,
+  isCodexAccountPriorityKey,
+  pinnedCodexAccountId,
+  setCodexAccountPin,
+  setCodexAccountPriority,
+} from "./account-priority";
 import {
   clearCodexAccountCooldown,
   clearThreadAccountMapForAccount,
   getEffectiveActiveCodexAccountId,
+  isEffectiveCodexAccountPinned,
   reconcileCodexActiveAfterExclusion,
   resetCodexRoutingForManualSelection,
 } from "./routing";
 import {
+  DEFAULT_ACCOUNT_PRIORITY,
+  MAX_ACCOUNT_PRIORITY,
+  MIN_ACCOUNT_PRIORITY,
   normalizeAccountPoolStickyLimit,
   normalizeAccountPoolStrategy,
   parseAccountPoolStickyLimit,
   parseAccountPoolStrategy,
+  parseAccountPriority,
 } from "./pool-rotation";
 import { checkAccountIdCollision, getMainChatgptAccountId, readCodexTokens, readCodexTokensResult } from "./auth-collision";
 export { checkAccountIdCollision, getMainChatgptAccountId } from "./auth-collision";
@@ -38,6 +55,7 @@ import { clearAccountNeedsReauth, isAccountNeedsReauth, markAccountNeedsReauth }
 import {
   clearAccountQuota,
   getAccountQuota,
+  isCodexFiveHourQuotaPlan,
   isCodexQuotaExhausted,
   listAccountQuotas,
   parseUsageQuota,
@@ -66,7 +84,7 @@ import {
 } from "./main-account-cache";
 export { clearMainAccountInfoCache } from "./main-account-cache";
 import { maskEmail } from "../lib/privacy";
-import { CodexWarmupError, codexWarmupFailureReason, isCodexWarmupQuotaFailure, warmCodexAccount } from "./warmup";
+import { codexWarmupFailureReason, isCodexWarmupQuotaFailure, warmCodexAccount } from "./warmup";
 export { maskEmail } from "../lib/privacy";
 import type { CodexAccount, OcxConfig } from "../types";
 import { isCanonicalOpenAiForwardProvider, OPENAI_CODEX_PROVIDER_ID } from "../providers/openai-tiers";
@@ -169,6 +187,7 @@ function poolAccountDto(
   quotaResult: PoolQuotaResult,
   hasCredential: boolean,
   paused: boolean,
+  priority: number,
 ): CodexAuthAccountDto {
   const quota = quotaForPlan(quotaResult.quota, account.plan);
   const needsReauth = !hasCredential || quotaResult.needsReauth || isAccountNeedsReauth(account.id);
@@ -181,6 +200,7 @@ function poolAccountDto(
     ...(account.logLabel !== undefined ? { logLabel: account.logLabel } : {}),
     isMain: false,
     paused,
+    priority,
     quota: quota ? { ...quota } : null,
     needsReauth,
     hasCredential,
@@ -258,14 +278,11 @@ async function verifyCodexAccountWarmup(
     return { ok: true, validatedAt: Date.now() };
   } catch (err) {
     const reason = codexWarmupFailureReason(err);
-    const upstream = err instanceof CodexWarmupError ? err.upstreamDetail : undefined;
     return {
       ok: false,
       error: err,
       response: jsonResponse({
-        error: upstream
-          ? `Codex account warmup failed: ${upstream}`
-          : "Codex account warmup failed. Reauthenticate the account and try again.",
+        error: "Codex account warmup failed. Reauthenticate the account and try again.",
         code: "codex_warmup_failed",
         reason,
         accountId,
@@ -312,6 +329,9 @@ function exhaustedQuotaRetryAt(
 ): number | undefined {
   const monthlyOnly = isThirtyDayOnlyPlan(plan);
   const resetSeconds: number[] = [];
+  if (!monthlyOnly && isCodexFiveHourQuotaPlan(plan)
+    && quota.fiveHourPercent !== undefined && quota.fiveHourPercent >= 100
+    && quota.fiveHourResetAt !== undefined) resetSeconds.push(quota.fiveHourResetAt);
   if (!monthlyOnly && quota.weeklyPercent !== undefined && quota.weeklyPercent >= 100
     && quota.weeklyResetAt !== undefined) resetSeconds.push(quota.weeklyResetAt);
   if (quota.monthlyPercent !== undefined && quota.monthlyPercent >= 100
@@ -402,16 +422,23 @@ function commitCodexAccountConfig(
 
     const accounts = persisted.codexAccounts ?? [];
     const existingIdx = accounts.findIndex(candidate => candidate.id === account.id);
+    let committedAccount: CodexAccount;
     if (existingIdx >= 0) {
-      accounts[existingIdx] = withCodexAccountLogLabel({
+      committedAccount = withCodexAccountLogLabel({
         ...accounts[existingIdx],
         ...account,
         isMain: false,
       }, accounts);
+      accounts[existingIdx] = committedAccount;
     } else {
-      accounts.push(withCodexAccountLogLabel({ ...account, isMain: false }, accounts));
+      committedAccount = withCodexAccountLogLabel({ ...account, isMain: false }, accounts);
+      accounts.push(committedAccount);
     }
     persisted.codexAccounts = accounts;
+    if (mode === "create" && persisted.codexAccountPickerEnabled !== undefined) {
+      initializeDefaultCodexAccountNamespaces(persisted);
+      appendDefaultCodexAccountNamespace(persisted, committedAccount);
+    }
     if (quotaPause === "add") setCodexAccountPaused(persisted, account.id, true);
     else if (quotaPause === "release") setCodexAccountPaused(persisted, account.id, false);
     return { changed: true, value: { ok: true } as CodexAccountConfigCommit };
@@ -485,7 +512,7 @@ interface MainAccountInfoFetchResult {
 }
 
 export async function fetchMainAccountInfo(forceRefresh = false): Promise<MainAccountInfo> {
-  const { info } = await fetchMainAccountInfoAttempt(forceRefresh, 1);
+  const { info } = await fetchMainAccountInfoAttempt(forceRefresh, 1, forceRefresh);
   return info;
 }
 
@@ -494,16 +521,21 @@ const EMPTY_MAIN_ACCOUNT_INFO: MainAccountInfo = { email: null, plan: null, quot
 async function retryMainAccountInfoIfIdentityChanged(
   requestAccountId: string | null,
   retriesRemaining: number,
+  explicitRefresh: boolean,
 ): Promise<MainAccountInfoFetchResult | null> {
   const currentAccountId = getMainChatgptAccountId();
   if (currentAccountId === null || currentAccountId === requestAccountId) return null;
   reconcileMainCodexAccountRuntimeState();
   return retriesRemaining > 0
-    ? fetchMainAccountInfoAttempt(true, retriesRemaining - 1)
+    ? fetchMainAccountInfoAttempt(true, retriesRemaining - 1, explicitRefresh)
     : { info: EMPTY_MAIN_ACCOUNT_INFO };
 }
 
-async function fetchMainAccountInfoAttempt(forceRefresh: boolean, retriesRemaining: number): Promise<MainAccountInfoFetchResult> {
+async function fetchMainAccountInfoAttempt(
+  forceRefresh: boolean,
+  retriesRemaining: number,
+  explicitRefresh = forceRefresh,
+): Promise<MainAccountInfoFetchResult> {
   const writerGeneration = captureConfigGeneration();
   reconcileMainCodexAccountRuntimeState();
   const tokenRead = readCodexTokensResult();
@@ -530,7 +562,7 @@ async function fetchMainAccountInfoAttempt(forceRefresh: boolean, retriesRemaini
     });
     if (!resp.ok) {
       const terminalAuthFailure = await isTerminalMainAuthResponse(resp);
-      const retried = await retryMainAccountInfoIfIdentityChanged(requestAccountId, retriesRemaining);
+      const retried = await retryMainAccountInfoIfIdentityChanged(requestAccountId, retriesRemaining, explicitRefresh);
       if (retried) return retried;
       if (terminalAuthFailure) {
         clearMainAccountInfoCache();
@@ -539,7 +571,7 @@ async function fetchMainAccountInfoAttempt(forceRefresh: boolean, retriesRemaini
       return { info: EMPTY_MAIN_ACCOUNT_INFO };
     }
     const data = (await resp.json()) as WhamUsageResponse;
-    const retried = await retryMainAccountInfoIfIdentityChanged(requestAccountId, retriesRemaining);
+    const retried = await retryMainAccountInfoIfIdentityChanged(requestAccountId, retriesRemaining, explicitRefresh);
     if (retried) return retried;
     const plan = nonEmptyPlan(data.plan_type) ?? nonEmptyPlan(cached?.plan) ?? nonEmptyPlan(getMainAccountPlan());
     const quota = parseUsageQuota({ ...data, ...(plan ? { plan_type: plan } : {}) });
@@ -551,7 +583,9 @@ async function fetchMainAccountInfoAttempt(forceRefresh: boolean, retriesRemaini
       ts: Date.now(),
     };
     setMainAccountInfoCache(result);
-    clearAccountNeedsReauth(MAIN_CODEX_ACCOUNT_ID);
+    // A successful quota probe only proves /wham/usage accepted the token. Only an
+    // operator-requested refresh may retract a quarantine raised by Responses traffic.
+    if (explicitRefresh) clearAccountNeedsReauth(MAIN_CODEX_ACCOUNT_ID);
     // Mirror main quota + plan into the shared stores so the rotation engine can
     // score and auto-switch the main account exactly like a pool account (Option A).
     setMainAccountPlan(result.plan);
@@ -564,7 +598,7 @@ async function fetchMainAccountInfoAttempt(forceRefresh: boolean, retriesRemaini
       ...(freshResetCredits !== undefined ? { freshResetCredits } : {}),
     };
   } catch {
-    const retried = await retryMainAccountInfoIfIdentityChanged(requestAccountId, retriesRemaining);
+    const retried = await retryMainAccountInfoIfIdentityChanged(requestAccountId, retriesRemaining, explicitRefresh);
     return retried ?? { info: EMPTY_MAIN_ACCOUNT_INFO };
   }
 }
@@ -635,6 +669,8 @@ export interface CodexAuthAccountDto {
   logLabel?: string;
   isMain: boolean;
   paused: boolean;
+  /** Selection order; higher is considered first. */
+  priority: number;
   quota: (StoredAccountQuota | (Omit<StoredAccountQuota, "updatedAt"> & { updatedAt: number })) | null;
   needsReauth?: boolean;
   hasCredential: boolean;
@@ -871,6 +907,10 @@ export function clearCodexQuotaPrimeState(): void {
   primeInFlight = null;
 }
 
+export function effectiveCodexAuthAccountId(config: OcxConfig): string {
+  return getEffectiveActiveCodexAccountId(config) ?? MAIN_CODEX_ACCOUNT_ID;
+}
+
 export async function listCodexAuthAccounts(config: OcxConfig, forceRefresh = false): Promise<CodexAuthAccountDto[]> {
   const runtimeConfig = getRuntimeConfig(config);
   const poolAccounts = (runtimeConfig.codexAccounts ?? []).filter(isSelectableCodexPoolAccount);
@@ -917,6 +957,7 @@ export async function listCodexAuthAccounts(config: OcxConfig, forceRefresh = fa
         { quota: null, needsReauth: true },
         false,
         isCodexAccountPaused(runtimeConfig, accountId),
+        getCodexAccountPriority(runtimeConfig, accountId),
       )];
     }
     const resultGeneration = quotaResult.credentialGeneration ?? quotaResult.freshCredentialGeneration;
@@ -935,6 +976,7 @@ export async function listCodexAuthAccounts(config: OcxConfig, forceRefresh = fa
       effectiveQuotaResult,
       true,
       isCodexAccountPaused(runtimeConfig, accountId),
+      getCodexAccountPriority(runtimeConfig, accountId),
     )];
   });
   const hasMainCredential = readCodexTokens() !== null;
@@ -949,9 +991,15 @@ export async function listCodexAuthAccounts(config: OcxConfig, forceRefresh = fa
     plan: mainInfo.plan,
     isMain: true,
     paused: isCodexAccountPaused(runtimeConfig, MAIN_CODEX_ACCOUNT_ID),
+    priority: getCodexAccountPriority(runtimeConfig, MAIN_CODEX_ACCOUNT_ID),
     hasCredential: hasMainCredential,
     needsReauth: mainNeedsReauth,
-    quota: mainInfo.quota ? { ...quotaForPlan({ ...mainInfo.quota, updatedAt: Date.now() }, mainInfo.plan) } : null,
+    quota: mainInfo.quota ? {
+      ...quotaForPlan({
+        ...mainInfo.quota,
+        updatedAt: getAccountQuota(MAIN_CODEX_ACCOUNT_ID)?.updatedAt ?? Date.now(),
+      }, mainInfo.plan),
+    } : null,
     ...oauthAccountHealthFields("codex", MAIN_CODEX_ACCOUNT_ID, mainHealth),
   };
   return [main, ...withQuota];
@@ -1174,6 +1222,42 @@ export async function handleCodexAuthAPI(
     });
   }
 
+  if (url.pathname === "/api/codex-auth/accounts/priority" && req.method === "PUT") {
+    let parsedBody: unknown;
+    try { parsedBody = await req.json(); } catch { return jsonResponse({ error: "Invalid JSON" }, 400); }
+    if (typeof parsedBody !== "object" || parsedBody === null || Array.isArray(parsedBody)) {
+      return jsonResponse({ error: "body must be an object" }, 400);
+    }
+    const body = parsedBody as { id?: unknown; priority?: unknown };
+    const id = typeof body.id === "string" ? body.id.trim() : "";
+    if (!isCodexAccountPriorityKey(id)) return jsonResponse({ error: "Invalid account id format" }, 400);
+
+    let priority = DEFAULT_ACCOUNT_PRIORITY;
+    if (body.priority !== null) {
+      const parsed = parseAccountPriority(body.priority);
+      if (parsed === null) {
+        return jsonResponse({
+          error: `priority must be null or an integer ${MIN_ACCOUNT_PRIORITY}-${MAX_ACCOUNT_PRIORITY}`,
+        }, 400);
+      }
+      priority = parsed;
+    }
+
+    const runtimeConfig = getRuntimeConfig(config);
+    const exists = id === MAIN_CODEX_ACCOUNT_ID
+      || (runtimeConfig.codexAccounts ?? []).some(account => isSelectableCodexPoolAccount(account) && account.id === id);
+    if (!exists) return jsonResponse({ error: "Account not found" }, 404);
+    setCodexAccountPriority(runtimeConfig, id, priority);
+    clearCodexAccountPin(runtimeConfig);
+    saveRuntimeConfig(config, runtimeConfig);
+    return jsonResponse({
+      ok: true,
+      id,
+      priority,
+      activeCodexAccountId: getEffectiveActiveCodexAccountId(runtimeConfig) ?? null,
+    });
+  }
+
   if (url.pathname === "/api/codex-auth/accounts/pause-exhausted" && req.method === "PUT") {
     const runtimeConfig = getRuntimeConfig(config);
     const result = await pauseExhaustedCodexAccounts(runtimeConfig);
@@ -1234,6 +1318,8 @@ export async function handleCodexAuthAPI(
       if (!exists) return jsonResponse({ error: "Account not found" }, 400);
     }
     runtimeConfig.activeCodexAccountId = body.accountId ?? undefined;
+    if (body.accountId == null) clearCodexAccountPin(runtimeConfig);
+    else setCodexAccountPin(runtimeConfig, targetAccountId);
     resetCodexRoutingForManualSelection(targetAccountId);
     saveRuntimeConfig(config, runtimeConfig);
     return jsonResponse({ ok: true, activeCodexAccountId: body.accountId, appliesImmediately: true });
@@ -1243,6 +1329,8 @@ export async function handleCodexAuthAPI(
     const runtimeConfig = getRuntimeConfig(config);
     return jsonResponse({
       activeCodexAccountId: getEffectiveActiveCodexAccountId(runtimeConfig) ?? null,
+      pinned: isEffectiveCodexAccountPinned(runtimeConfig),
+      pinnedAccountId: pinnedCodexAccountId(runtimeConfig) ?? null,
       autoSwitchThreshold: runtimeConfig.autoSwitchThreshold ?? 80,
       upstreamFailoverThreshold: runtimeConfig.upstreamFailoverThreshold ?? 3,
       accountPoolStrategy: normalizeAccountPoolStrategy(runtimeConfig.accountPoolStrategy),
@@ -1534,8 +1622,7 @@ export async function handleCodexAuthAPI(
 
                 const warmup = await verifyCodexAccountWarmup(accountId, cred.access, oauthAccountId);
                 const freshRegistrationQuota = quota ? { quota, ...(plan ? { plan } : {}) } : null;
-                const quotaDeferred = !reauth
-                  && !warmup.ok
+                const quotaDeferred = !warmup.ok
                   && mayDeferQuotaWarmup(warmup, freshRegistrationQuota);
                 if (!warmup.ok && !quotaDeferred) {
                   const body = await warmup.response.json().catch(() => ({})) as { error?: string; reason?: string };
@@ -1569,6 +1656,9 @@ export async function handleCodexAuthAPI(
 
                 const releaseOwnedQuotaPause = reauth
                   && readCodexAccountRecord(accountId)?.codexQuotaPauseOwned === true;
+                const quotaPauseOwned = !reauth
+                  || releaseOwnedQuotaPause
+                  || !isCodexAccountPaused(latestConfig, accountId);
                 const credentialGeneration = saveCodexAccountCredential(accountId, {
                   accessToken: cred.access,
                   refreshToken: cred.refresh,
@@ -1605,6 +1695,7 @@ export async function handleCodexAuthAPI(
                     accountId,
                     codexWarmupFailureReason(warmup.error),
                     exhaustedQuotaRetryAt(freshRegistrationQuota.quota, freshRegistrationQuota.plan),
+                    quotaPauseOwned,
                   );
                 } else if (warmup.ok) {
                   markCodexAccountValidated(accountId, warmup.validatedAt, credentialGeneration);

package/src/codex/auth-context.ts

@@ -7,7 +7,8 @@ import {
   isCodexAccountGenerationLive,
 } from "./account-store";
 import { ConfigMutationLockError } from "../config";
-import { markAccountNeedsReauth } from "./account-runtime-state";
+import { isAccountNeedsReauth, markAccountNeedsReauth } from "./account-runtime-state";
+import { isCodexAccountPaused } from "./account-pause";
 import { isCodexAccountUsable } from "./account-usability";
 import { reconcileMainCodexAccountRuntimeState } from "./account-lifecycle";
 import { MAIN_CODEX_ACCOUNT_ID, getMainAccountToken } from "./main-account";
@@ -38,6 +39,8 @@ export type CodexAuthContext =
       generation: number;
       accessToken: string;
       chatgptAccountId: string;
+      /** Exact account selector: suppresses Pool rotation and failover. */
+      fixedAccount?: boolean;
       /**
        * Set when this request was admitted through an active quota cooldown as
        * the account's single probe. Must be echoed into the upstream outcome so
@@ -57,6 +60,8 @@ export type CodexAuthContext =
       writerGeneration: number;
       accessToken: string;
       chatgptAccountId: string;
+      /** Exact account selector: suppresses Pool rotation and failover. */
+      fixedAccount?: boolean;
       /** See `pool.probeLeaseId`. */
       probeLeaseId?: string;
       quotaScope?: CodexQuotaScope;
@@ -100,8 +105,8 @@ export class CodexAuthContextError extends Error {
 }
 
 export class CodexPoolAuthenticationError extends Error {
-  constructor() {
-    super("OpenAI account pool has no usable account credential");
+  constructor(message = "OpenAI account pool has no usable account credential") {
+    super(message);
     this.name = "CodexPoolAuthenticationError";
   }
 }
@@ -154,22 +159,31 @@ export function cooldownAccountLabel(accountId: string): string {
  * as HTTP. The bare "cooling down" string left users with no route but commenting out the
  * injected `openai_base_url` in config.toml.
  */
-export function cooldownErrorMessage(err: CodexAccountCooldownError): string {
+export function cooldownErrorMessage(err: CodexAccountCooldownError, accountSelector?: string): string {
   const until = new Date(err.cooldownUntil).toISOString();
   const scope = err.quotaScope === "spark"
     ? "Spark quota"
     : err.quotaScope === "shared"
       ? "shared native quota"
       : null;
-  return `Selected Codex account (${cooldownAccountLabel(err.accountId)})${scope ? ` ${scope} is` : " is"} cooling down until ${until}`
-    + ` (source: ${err.cooldownSource ?? "default"}).`
-    + ` Run 'ocx account list openai' to find the id, then`
-    + ` 'ocx account clear-cooldown openai <id>' to lift it, or switch accounts with 'ocx account use openai <id>'.`;
+  const selected = accountSelector
+    ? `Selected Codex account selector (${accountSelector})`
+    : `Selected Codex account (${cooldownAccountLabel(err.accountId)})`;
+  const recovery = accountSelector
+    ? " This request is pinned to that selector and will not switch accounts; choose another account-qualified model or retry later."
+    : " Run 'ocx account list openai' to find the id, then"
+      + " 'ocx account clear-cooldown openai <id>' to lift it, or switch accounts with 'ocx account use openai <id>'.";
+  return `${selected}${scope ? ` ${scope} is` : " is"} cooling down until ${until}`
+    + ` (source: ${err.cooldownSource ?? "default"}).${recovery}`;
 }
 
 /** HTTP form of {@link cooldownErrorMessage}, carrying Retry-After for well-behaved clients. */
-export function cooldownErrorResponse(err: CodexAccountCooldownError, now = Date.now()): Response {
-  const res = formatErrorResponse(429, "rate_limit_error", cooldownErrorMessage(err));
+export function cooldownErrorResponse(
+  err: CodexAccountCooldownError,
+  now = Date.now(),
+  accountSelector?: string,
+): Response {
+  const res = formatErrorResponse(429, "rate_limit_error", cooldownErrorMessage(err, accountSelector));
   const headers = new Headers(res.headers);
   headers.set("Retry-After", String(Math.max(1, Math.ceil((err.cooldownUntil - now) / 1000))));
   return new Response(res.body, { status: res.status, headers });
@@ -195,6 +209,8 @@ export function shouldMarkAccountNeedsReauthForCodexAuthFailure(cause: unknown):
 
 export interface ResolveCodexAuthContextOptions {
   excludeAccountId?: string;
+  /** Resolve exactly this account without consulting or mutating Pool selection. */
+  accountId?: string;
   /** Final native model selected for this request, used to select its quota group. */
   modelId?: string;
 }
@@ -206,14 +222,20 @@ export async function resolveCodexAuthContext(
   options: ResolveCodexAuthContextOptions = {},
 ): Promise<CodexAuthContext> {
   const writerGeneration = captureConfigGeneration();
-  if (mode === "direct") {
+  const fixedAccountId = options.accountId;
+  if (fixedAccountId !== undefined && options.excludeAccountId !== undefined) {
+    throw new Error("Codex auth context cannot select and exclude an account simultaneously");
+  }
+  if (mode === "direct" && fixedAccountId === undefined) {
     if (!hasCallerCodexBearer(headers)) throw new CodexDirectAuthenticationError();
     return { kind: "main", accountId: null };
   }
   reconcileMainCodexAccountRuntimeState();
   const threadId = headers.get("x-codex-parent-thread-id");
   const quotaScope = codexQuotaScopeForModel(options.modelId);
-  const resolution = options.excludeAccountId
+  const resolution = fixedAccountId !== undefined
+    ? { status: "selected" as const, accountId: fixedAccountId }
+    : options.excludeAccountId
     ? (() => {
         const accountId = pickAlternateCodexAccount(config, options.excludeAccountId!, Date.now(), quotaScope);
         return accountId
@@ -223,13 +245,28 @@ export async function resolveCodexAuthContext(
     : resolveCodexAccountForThreadDetailed(threadId, config, Date.now(), quotaScope);
   if (resolution.status === "expired") throw new CodexThreadAffinityExpiredError(resolution.accountId);
   let accountId = resolution.status === "selected" ? resolution.accountId : null;
-  if (!accountId) throw new CodexPoolAuthenticationError();
+  if (!accountId) {
+    throw new CodexPoolAuthenticationError(
+      fixedAccountId !== undefined ? "Selected Codex account is unavailable" : undefined,
+    );
+  }
+  if (fixedAccountId !== undefined) {
+    if (isCodexAccountPaused(config, accountId)) {
+      throw new CodexPoolAuthenticationError("Selected Codex account is unavailable");
+    }
+    if (isAccountNeedsReauth(accountId)) {
+      throw new CodexPoolAuthenticationError("Selected Codex account needs reauthentication");
+    }
+    if (!isCodexAccountUsable(config, accountId)) {
+      throw new CodexPoolAuthenticationError("Selected Codex account is unavailable");
+    }
+  }
   // Lazy prime: if the selected account has no quota yet, the pool is likely
   // unprimed (dashboard never opened, or startup prime was blocked). Kick a
   // best-effort prime so the NEXT routing decision has real scores. This never
   // blocks the current request, and the helper's single-flight guard collapses
   // repeated triggers into one pass.
-  if (!getAccountQuota(accountId)) {
+  if (fixedAccountId === undefined && !getAccountQuota(accountId)) {
     import("./auth-api")
       .then(({ primeCodexPoolQuotas }) => primeCodexPoolQuotas(config, "pre-route"))
       .catch(() => {});
@@ -244,6 +281,9 @@ export async function resolveCodexAuthContext(
   let probeLeaseId: string | undefined;
   let probeQuotaScope: CodexQuotaScope | undefined;
   if (cooldownUntil) {
+    if (fixedAccountId !== undefined) {
+      throw new CodexAccountCooldownError(accountId, cooldownUntil, cooldown?.cooldownSource, cooldown?.quotaScope);
+    }
     probeQuotaScope = cooldown?.quotaScope;
     probeLeaseId = probeQuotaScope
       ? tryAcquireCodexQuotaScopeProbeLease(accountId, probeQuotaScope) ?? undefined
@@ -260,7 +300,9 @@ export async function resolveCodexAuthContext(
       // Nothing will reach upstream, so give the probe back instead of burning it.
       if (probeLeaseId && probeQuotaScope) releaseCodexQuotaScopeProbeLease(accountId, probeQuotaScope, probeLeaseId);
       else if (probeLeaseId) releaseCodexQuotaProbeLease(accountId, probeLeaseId);
-      throw new CodexPoolAuthenticationError();
+      throw new CodexPoolAuthenticationError(
+        fixedAccountId !== undefined ? "Selected Codex account is unavailable" : undefined,
+      );
     }
     return {
       kind: "main-pool",
@@ -268,6 +310,7 @@ export async function resolveCodexAuthContext(
       writerGeneration,
       accessToken: token.accessToken,
       chatgptAccountId: token.chatgptAccountId,
+      ...(fixedAccountId !== undefined ? { fixedAccount: true } : {}),
       ...(quotaScope ? { quotaScope } : {}),
       ...(probeLeaseId ? { probeLeaseId } : {}),
       ...(probeQuotaScope ? { probeQuotaScope } : {}),
@@ -283,6 +326,7 @@ export async function resolveCodexAuthContext(
       generation: token.generation,
       accessToken: token.accessToken,
       chatgptAccountId: token.chatgptAccountId,
+      ...(fixedAccountId !== undefined ? { fixedAccount: true } : {}),
       ...(quotaScope ? { quotaScope } : {}),
       ...(probeLeaseId ? { probeLeaseId } : {}),
       ...(probeQuotaScope ? { probeQuotaScope } : {}),
@@ -312,7 +356,8 @@ export function applyCodexAuthContextToProvider(
   ctx: CodexAuthContext,
   mode: CodexAccountMode | undefined,
 ): OcxRuntimeProviderConfig {
-  if (mode !== "pool" || (ctx.kind !== "pool" && ctx.kind !== "main-pool") || provider.authMode !== "forward") return provider;
+  if ((ctx.kind !== "pool" && ctx.kind !== "main-pool") || provider.authMode !== "forward") return provider;
+  if (mode !== "pool" && ctx.fixedAccount !== true) return provider;
   return {
     ...provider,
     _codexAccountOverride: {

package/src/codex/catalog/metadata.ts

@@ -35,14 +35,18 @@ import { filterSupportedNativeSlugs } from "./parsing";
 import type { RawEntry } from "./parsing";
 import { readCurrentCatalogOrCache, unique } from "./bundled";
 
+export const NATIVE_DAYBREAK_BLUE_MODEL = "gpt-daybreak-blue-latest";
+
 export const NATIVE_OPENAI_MODELS = [
   "gpt-5.5", "gpt-5.4", "gpt-5.4-mini", "gpt-5.3-codex-spark",
   "gpt-5.6-sol", "gpt-5.6-terra", "gpt-5.6-luna",
+  NATIVE_DAYBREAK_BLUE_MODEL,
 ];
 
 export const DOCUMENTED_NATIVE_OPENAI_ADDITIONS = [
   "gpt-5.3-codex-spark",
   "gpt-5.6-sol", "gpt-5.6-terra", "gpt-5.6-luna",
+  NATIVE_DAYBREAK_BLUE_MODEL,
 ];
 
 export const SUPPORTED_NATIVE_OPENAI_SLUGS = new Set(NATIVE_OPENAI_MODELS);
@@ -53,15 +57,18 @@ export function isUnsupportedOpenAiNativeSlug(slug: string): boolean {
   return /^(?:gpt|codex)-/.test(slug);
 }
 
-export const NATIVE_GPT56_CONTEXT_WINDOW = 372_000;
+/** Measured native family contract: 922k input plus up to 128k output. */
+export const NATIVE_GPT56_CONTEXT_WINDOW = 1_050_000;
+export const NATIVE_GPT56_MAX_INPUT_TOKENS = 922_000;
 
-export const NATIVE_OPENAI_CONTEXT_OVERRIDES: Record<string, { contextWindow?: number; maxContextWindow?: number }> = {
+export const NATIVE_OPENAI_CONTEXT_OVERRIDES: Record<string, { contextWindow?: number; maxContextWindow?: number; maxInputTokens?: number }> = {
   "gpt-5.5": { contextWindow: 272_000, maxContextWindow: 272_000 },
   "gpt-5.4": { contextWindow: 1_000_000, maxContextWindow: 1_000_000 },
   "gpt-5.3-codex-spark": { contextWindow: 100_000, maxContextWindow: 100_000 },
-  "gpt-5.6-sol": { contextWindow: NATIVE_GPT56_CONTEXT_WINDOW, maxContextWindow: NATIVE_GPT56_CONTEXT_WINDOW },
-  "gpt-5.6-terra": { contextWindow: NATIVE_GPT56_CONTEXT_WINDOW, maxContextWindow: NATIVE_GPT56_CONTEXT_WINDOW },
-  "gpt-5.6-luna": { contextWindow: NATIVE_GPT56_CONTEXT_WINDOW, maxContextWindow: NATIVE_GPT56_CONTEXT_WINDOW },
+  "gpt-5.6-sol": { contextWindow: NATIVE_GPT56_CONTEXT_WINDOW, maxContextWindow: NATIVE_GPT56_CONTEXT_WINDOW, maxInputTokens: NATIVE_GPT56_MAX_INPUT_TOKENS },
+  "gpt-5.6-terra": { contextWindow: NATIVE_GPT56_CONTEXT_WINDOW, maxContextWindow: NATIVE_GPT56_CONTEXT_WINDOW, maxInputTokens: NATIVE_GPT56_MAX_INPUT_TOKENS },
+  "gpt-5.6-luna": { contextWindow: NATIVE_GPT56_CONTEXT_WINDOW, maxContextWindow: NATIVE_GPT56_CONTEXT_WINDOW, maxInputTokens: NATIVE_GPT56_MAX_INPUT_TOKENS },
+  [NATIVE_DAYBREAK_BLUE_MODEL]: { contextWindow: NATIVE_GPT56_CONTEXT_WINDOW, maxContextWindow: NATIVE_GPT56_CONTEXT_WINDOW, maxInputTokens: NATIVE_GPT56_MAX_INPUT_TOKENS },
 };
 
 export function nativeOpenAiContextWindow(slug: string): number | undefined {
@@ -71,6 +78,10 @@ export function nativeOpenAiContextWindow(slug: string): number | undefined {
       : undefined);
 }
 
+export function nativeOpenAiMaxInputTokens(slug: string): number | undefined {
+  return NATIVE_OPENAI_CONTEXT_OVERRIDES[slug]?.maxInputTokens;
+}
+
 export function nativeInputModalities(slug: string): string[] {
   const upstream = UPSTREAM_NATIVE_ENTRIES.get(slug);
   if (Array.isArray(upstream?.input_modalities) && upstream!.input_modalities!.length > 0) {
@@ -144,13 +155,24 @@ export function applyNativeVisibility(entries: RawEntry[], disabledNative: Set<s
   return entries;
 }
 
-export const UPSTREAM_NATIVE_ENTRIES: Map<string, RawEntry> = new Map(
-  ((upstreamModelsSnapshot as unknown as { models?: RawEntry[] }).models ?? [])
-    .filter(m => typeof m.slug === "string"
-      && SUPPORTED_NATIVE_OPENAI_SLUGS.has(m.slug as string)
-      && (m.slug as string).startsWith("gpt-5.6-"))
-    .map(m => [m.slug as string, m]),
-);
+export const UPSTREAM_NATIVE_ENTRIES: Map<string, RawEntry> = (() => {
+  const entries = new Map(
+    ((upstreamModelsSnapshot as unknown as { models?: RawEntry[] }).models ?? [])
+      .filter(m => typeof m.slug === "string"
+        && SUPPORTED_NATIVE_OPENAI_SLUGS.has(m.slug as string)
+        && (m.slug as string).startsWith("gpt-5.6-"))
+      .map(m => [m.slug as string, m] as const),
+  );
+  const sol = entries.get("gpt-5.6-sol");
+  if (sol) {
+    entries.set(NATIVE_DAYBREAK_BLUE_MODEL, {
+      ...JSON.parse(JSON.stringify(sol)) as RawEntry,
+      slug: NATIVE_DAYBREAK_BLUE_MODEL,
+      display_name: "GPT Daybreak Blue",
+    });
+  }
+  return entries;
+})();
 
 export function upstreamNativeEntry(slug: string): RawEntry | null {
   const entry = UPSTREAM_NATIVE_ENTRIES.get(slug);

package/src/codex/catalog/parsing.ts

@@ -243,13 +243,20 @@ export function isNativeOpenAiEntry(entry: RawEntry): boolean {
   return typeof entry.slug === "string" && !entry.slug.includes("/");
 }
 
+function nativeAutoCompactLimit(contextWindow: number, maxInputTokens?: number): number {
+  const ninetyPercent = Math.floor(contextWindow * 0.9);
+  return typeof maxInputTokens === "number" && maxInputTokens > 0
+    ? Math.min(ninetyPercent, maxInputTokens, contextWindow)
+    : ninetyPercent;
+}
+
 export function applyNativeOpenAiContextOverride(entry: RawEntry): void {
   if (!isNativeOpenAiEntry(entry)) return;
   const override = NATIVE_OPENAI_CONTEXT_OVERRIDES[entry.slug as string];
   if (!override) return;
   if (typeof override.contextWindow === "number") {
     entry.context_window = override.contextWindow;
-    entry.auto_compact_token_limit = Math.floor(override.contextWindow * 0.9);
+    entry.auto_compact_token_limit = nativeAutoCompactLimit(override.contextWindow, override.maxInputTokens);
   }
   if (typeof override.maxContextWindow === "number") {
     entry.max_context_window = override.maxContextWindow;