@hienlh/ppm 0.23.1 → 0.23.2

package/src/providers/codex-app-server/codex-provider.ts

@@ -26,6 +26,10 @@ import {
 import { dailyGuardMessage, dailyGuardState } from "../../shared/codex-daily-guard.ts";
 import { isCodexAccountUsageLimited, markCodexAccountUsageLimited } from "../../services/codex-account-cooldown.ts";
 import { isCodexUsageLimit, codexErrorMessage, parseCodexUsageLimitReset } from "./codex-usage-limit.ts";
+import { isCodexAuthFailure, codexErrorText, codexSignedOutMessage } from "./codex-auth-failure.ts";
+import {
+  isCodexAccountAuthFailed, markCodexAccountAuthFailed, clearCodexAccountAuthFailure,
+} from "../../services/codex-account-auth-state.ts";
 import { killProcessTree } from "../../services/windows-process-tree.ts";
 import { homedir } from "node:os";
 import { join } from "node:path";
@@ -181,8 +185,16 @@ interface LiveSession {
   /** The turn currently in flight, kept so a rotation can send it again on the new
    *  account. Cleared when the turn ends — there is then nothing to replay. */
   lastTurnInput?: { message: string; opts?: SendMessageOpts };
+  /** The running turn has already been reported as failed (its account is signed out) and
+   *  interrupted. Codex keeps narrating it — more retry notices, a final error, then
+   *  `turn/completed` — none of which may reach the caller a second time. Cleared by that
+   *  `turn/completed`, which is also when the queue may move on. */
+  discardingTurn?: boolean;
 }
 
+/** Why a turn is being moved to another account. */
+type RotationKind = "usage" | "auth";
+
 /** A follow-up held back because a turn was already running. */
 interface QueuedTurn {
   message: string;
@@ -516,7 +528,15 @@ export class CodexAppServerProvider implements AIProvider {
       // A quota refusal can come back as the rejection of the request itself rather than
       // as an `error` notification, and it is the same situation either way — move the
       // turn to an account that still has room instead of showing the refusal.
-      if (isCodexUsageLimit(reason) && this.beginRotation(live, reason)) return;
+      if (isCodexUsageLimit(reason) && this.beginRotation(live, reason, "usage")) return;
+      if (isCodexAuthFailure(reason)) {
+        this.markSessionAccountSignedOut(live, reason);
+        if (this.beginRotation(live, reason, "auth")) return;
+        live.channel.push({ type: "error", message: codexSignedOutMessage(this.sessionAccountLabel(live)) });
+        live.channel.push({ type: "done", sessionId: live.threadId ?? "", resultSubtype: "error_during_execution" });
+        this.endTurn(live);
+        return;
+      }
       if (!live.client.isClosed) live.channel.push({ type: "error", message: redactTruncate(reason, 256) });
       // No turn is running, so nothing will report `turn/completed` — release the
       // queue here or every later follow-up waits on a turn that never existed.
@@ -556,6 +576,7 @@ export class CodexAppServerProvider implements AIProvider {
     live.turnInFlight = false;
     live.activeTurnId = null;
     live.interruptRequested = false;
+    live.discardingTurn = false;
     live.lastTurnInput = undefined;
     const next = live.pendingTurns.shift();
     if (next) void this.startTurn(live, next.message, next.opts);
@@ -575,29 +596,64 @@ export class CodexAppServerProvider implements AIProvider {
    * user untouched. That is the honest outcome: an error saying the quota is spent is worth
    * more than a silent retry on the account that just said so.
    */
-  private beginRotation(live: LiveSession, reason: string): boolean {
+  private beginRotation(live: LiveSession, reason: string, kind: RotationKind): boolean {
     const threadId = live.threadId;
     if (!threadId || live.rotating) return false;
     const currentId = getSessionCodexAccount(threadId);
     const candidates = listCodexAccounts().filter(
-      (a) => a.status !== "disabled" && a.id !== currentId && !isCodexAccountUsageLimited(a.id),
+      (a) => a.status !== "disabled" && a.id !== currentId
+        && !isCodexAccountUsageLimited(a.id) && !isCodexAccountAuthFailed(a.id),
     );
     if (candidates.length === 0) return false;
     live.rotating = true;
-    void this.rotateAccount(live, threadId, currentId, reason);
+    void this.rotateAccount(live, threadId, currentId, reason, kind);
     return true;
   }
 
-  /** Park the spent account, move the session onto a fresh one, and send the turn again. */
+  /** Mark the account serving this session as signed out, if it is a managed one. */
+  private markSessionAccountSignedOut(live: LiveSession, reason: string): void {
+    const accountId = live.threadId ? getSessionCodexAccount(live.threadId) : null;
+    if (accountId) markCodexAccountAuthFailed(accountId, redactTruncate(reason, 256));
+  }
+
+  private sessionAccountLabel(live: LiveSession): string | null {
+    const accountId = live.threadId ? getSessionCodexAccount(live.threadId) : null;
+    return accountId ? getCodexAccount(accountId)?.label ?? null : null;
+  }
+
+  /**
+   * The running turn's account turned out to be signed out.
+   *
+   * Recognised on codex's FIRST retry notice rather than its final error: the notice already
+   * names the 401, and waiting out the rest of the loop is ~24s of a subprocess and a request
+   * held open for an answer that cannot come. Moves the turn to another account when one can
+   * take it; otherwise reports it and interrupts the turn, discarding what codex still says
+   * about it.
+   */
+  private handleAuthFailure(live: LiveSession, reason: string): void {
+    this.markSessionAccountSignedOut(live, reason);
+    if (this.beginRotation(live, reason, "auth")) return;
+    live.discardingTurn = true;
+    this.interruptActiveTurn(live);
+    live.channel.push({ type: "error", message: codexSignedOutMessage(this.sessionAccountLabel(live)) });
+    live.channel.push({ type: "done", sessionId: live.threadId ?? "", resultSubtype: "error_during_execution" });
+  }
+
+  /** Bench the refused account, move the session onto a fresh one, and send the turn again. */
   private async rotateAccount(
     live: LiveSession,
     threadId: string,
     currentId: string | null,
     reason: string,
+    kind: RotationKind,
   ): Promise<void> {
     const pending = live.lastTurnInput;
-    const reset = parseCodexUsageLimitReset(reason);
-    if (currentId) markCodexAccountUsageLimited(currentId, reset?.atMs);
+    const reset = kind === "usage" ? parseCodexUsageLimitReset(reason) : null;
+    // A signed-out account was already marked by the caller; only a quota refusal parks here.
+    if (currentId && kind === "usage") markCodexAccountUsageLimited(currentId, reset?.atMs);
+    const giveUp = (): void => this.abandonRotation(live, kind === "auth"
+      ? codexSignedOutMessage(currentId ? getCodexAccount(currentId)?.label : null)
+      : this.usageLimitMessage(reason, reset?.text));
 
     let next: CodexAccount | null = null;
     try {
@@ -612,12 +668,12 @@ export class CodexAppServerProvider implements AIProvider {
       next = selectCodexAccount(currentId ? { exclude: [currentId] } : undefined);
     }
 
-    if (!next) { this.abandonRotation(live, reason, reset?.text); return; }
+    if (!next) { giveUp(); return; }
 
-    console.warn(`[codex] session=${threadId} usage limit — switching to ${next.id} (${next.label})`);
+    console.warn(`[codex] session=${threadId} ${kind === "auth" ? "account signed out" : "usage limit"} — switching to ${next.id} (${next.label})`);
     live.channel.push({
       type: "account_retry",
-      reason: "Usage limit reached — switching account",
+      reason: kind === "auth" ? "Account signed out — switching account" : "Usage limit reached — switching account",
       accountId: next.id,
       accountLabel: next.label,
     });
@@ -626,7 +682,7 @@ export class CodexAppServerProvider implements AIProvider {
       await this.respawnOn(live, threadId, next);
     } catch (e) {
       console.error(`[codex] session=${threadId} rotation to ${next.id} failed: ${redactTruncate((e as Error)?.message, 200)}`);
-      this.abandonRotation(live, reason, reset?.text);
+      giveUp();
       return;
     }
 
@@ -639,14 +695,15 @@ export class CodexAppServerProvider implements AIProvider {
     else this.endTurn(live);
   }
 
+  private usageLimitMessage(reason: string, resetText?: string): string {
+    const suffix = resetText ? ` Try again ${resetText}.` : "";
+    return `${redactTruncate(reason, 512)}${suffix} Add another account in Settings → Accounts, or wait for the reset.`;
+  }
+
   /** No account could take the turn — report the refusal and close the turn out. */
-  private abandonRotation(live: LiveSession, reason: string, resetText?: string): void {
+  private abandonRotation(live: LiveSession, message: string): void {
     live.rotating = false;
-    const suffix = resetText ? ` Try again ${resetText}.` : "";
-    live.channel.push({
-      type: "error",
-      message: `${redactTruncate(reason, 512)}${suffix} Add another account in Settings → Accounts, or wait for the reset.`,
-    });
+    live.channel.push({ type: "error", message });
     live.channel.push({ type: "done", sessionId: live.threadId ?? "", resultSubtype: "error_during_execution" });
     this.endTurn(live);
   }
@@ -825,14 +882,35 @@ export class CodexAppServerProvider implements AIProvider {
   private handleNotification(live: LiveSession, notif: JsonRpcNotification): void {
     // A quota refusal is an ordinary `error` notification, so it has to be recognised
     // before the mapper turns it into a plain error card in front of the user.
-    if (notif.method === "error" && !live.rotating) {
+    if (notif.method === "error" && !live.rotating && !live.discardingTurn) {
+      // Retry notices count too: the headline says only "Reconnecting... N/5", but their
+      // details name the 401, and waiting for the final error costs the whole retry loop.
+      const authText = codexErrorText(notif.params);
+      if (isCodexAuthFailure(authText)) { this.handleAuthFailure(live, authText); return; }
       const reason = codexErrorMessage(notif.params);
-      if (isCodexUsageLimit(reason) && this.beginRotation(live, reason)) return;
+      if (isCodexUsageLimit(reason) && this.beginRotation(live, reason, "usage")) return;
     }
     // Mid-rotation the subprocess behind this session is being replaced. Anything it still
     // emits describes the turn that was refused — including its `turn/completed`, which
     // would close the turn the caller is about to be given a second time.
     if (live.rotating) return;
+    // A turn already reported as failed: swallow the rest of it, and let the queue move on
+    // only once codex confirms it is over.
+    if (live.discardingTurn) {
+      if (notif.method === "turn/completed") {
+        live.discardingTurn = false;
+        live.currentAssistant = "";
+        live.currentEvents = [];
+        this.endTurn(live);
+      }
+      return;
+    }
+    if (notif.method === "turn/completed"
+        && (notif.params as { turn?: { status?: string } })?.turn?.status === "completed" && live.threadId) {
+      // An answered turn is proof the login works, whatever was observed before.
+      const accountId = getSessionCodexAccount(live.threadId);
+      if (accountId) clearCodexAccountAuthFailure(accountId);
+    }
     if (notif.method === "item/agentMessage/delta") {
       const d = (notif.params as { delta?: string })?.delta;
       if (typeof d === "string") live.currentAssistant += d;

package/src/providers/codex-app-server/codex-usage-source.ts

@@ -3,6 +3,8 @@ import type { ProviderUsageSource } from "../../services/provider-usage/usage-so
 import { AMBIENT_ACCOUNT_KEY } from "../../services/provider-usage/usage-source.ts";
 import { listCodexAccounts, getCodexAccount } from "../../services/codex-account.service.ts";
 import { fetchCodexUsageLive } from "./codex-usage-fetch.ts";
+import { isCodexAuthFailure } from "./codex-auth-failure.ts";
+import { markCodexAccountAuthFailed, clearCodexAccountAuthFailure } from "../../services/codex-account-auth-state.ts";
 
 /**
  * Codex's plug into the shared usage layer.
@@ -29,7 +31,18 @@ export const codexUsageSource: ProviderUsageSource = {
     // object would be persisted as a real reading for an account that is gone.
     if (!account) throw new Error(`codex account ${accountId} no longer exists`);
 
-    const usage = await fetchCodexUsageLive(account.home);
+    let usage: UsageInfo;
+    try {
+      usage = await fetchCodexUsageLive(account.home);
+    } catch (e) {
+      // The sweep is the one thing that reads every account on a timer, so it is what keeps
+      // a signed-out account benched between turns — and what notices it first, before any
+      // turn is spent on it.
+      const message = (e as Error)?.message ?? String(e);
+      if (isCodexAuthFailure(message)) markCodexAccountAuthFailed(account.id, message.slice(0, 256));
+      throw e;
+    }
+    clearCodexAccountAuthFailure(account.id);
     // The rate-limit payload carries the plan name, which the parser puts in
     // activeAccountLabel; the account's own label is the truthful one.
     return { ...usage, activeAccountId: account.id, activeAccountLabel: account.label };

package/src/server/routes/codex-accounts.ts

@@ -3,11 +3,20 @@ import { ok, err } from "../../types/api.ts";
 import { listCodexAccounts, removeCodexAccount, getAllCodexUsages, getCodexStrategy, setCodexStrategy, selectCodexAccount, setCodexAccountStatus, setCodexDailyGuard, codexUsageLevel, type CodexStrategy } from "../../services/codex-account.service.ts";
 import { addApiKeyAccount, startDeviceLogin, getDeviceLoginStatus, cancelDeviceLogin, startBrowserLogin, submitBrowserCallback, getBrowserLoginStatus, cancelBrowserLogin } from "../../services/codex-account-login.ts";
 import { exportCodexEncrypted, importCodexEncrypted } from "../../services/codex-account-portability.ts";
+import { isCodexAccountAuthFailed } from "../../services/codex-account-auth-state.ts";
 
 /** Codex multi-account management. Mounted under /api/codex-accounts (auth-guarded). */
 export const codexAccountsRoutes = new Hono();
 
-codexAccountsRoutes.get("/", (c) => c.json(ok({ accounts: listCodexAccounts(), strategy: getCodexStrategy() })));
+/**
+ * `signedOut` is the server's live observation (a revoked/expired login seen on a turn or a
+ * quota read), not a stored field. The usage endpoint keeps serving the last good reading
+ * for such an account, so without it the card looked healthy while every turn failed.
+ */
+codexAccountsRoutes.get("/", (c) => c.json(ok({
+  accounts: listCodexAccounts().map((a) => ({ ...a, signedOut: isCodexAccountAuthFailed(a.id) })),
+  strategy: getCodexStrategy(),
+})));
 
 /** Per-account quota map { [accountId]: UsageInfo }. */
 codexAccountsRoutes.get("/usage", async (c) => c.json(ok(await getAllCodexUsages())));
@@ -73,10 +82,12 @@ codexAccountsRoutes.post("/api-key", async (c) => {
   catch (e) { return c.json(err((e as Error).message), 400); }
 });
 
-/** Begin ChatGPT device-code login → returns { id, userCode, verificationUrl }. */
+/** Begin ChatGPT device-code login → returns { id, userCode, verificationUrl }.
+ *  With `accountId`, signs that existing account in again instead of adding one. */
 codexAccountsRoutes.post("/device-login", async (c) => {
-  const body = await c.req.json<{ label?: string }>().catch(() => ({} as { label?: string }));
-  try { return c.json(ok(await startDeviceLogin(body.label))); }
+  const body = await c.req.json<{ label?: string; accountId?: unknown }>().catch(() => ({} as { label?: string; accountId?: unknown }));
+  if (body.accountId !== undefined && typeof body.accountId !== "string") return c.json(err("accountId must be a string"), 400);
+  try { return c.json(ok(await startDeviceLogin(body.label, undefined, body.accountId))); }
   catch (e) { return c.json(err((e as Error).message), 400); }
 });
 
@@ -92,10 +103,11 @@ codexAccountsRoutes.delete("/device-login/:id", (c) => {
 
 /** Browser OAuth uses the same durable polling as device-code login. */
 codexAccountsRoutes.post("/browser-login", async (c) => {
-  const body = await c.req.json<{ label?: string }>().catch(() => ({} as { label?: string }));
+  const body = await c.req.json<{ label?: string; accountId?: unknown }>().catch(() => ({} as { label?: string; accountId?: unknown }));
   if (body.label !== undefined && typeof body.label !== "string") return c.json(err("label must be a string"), 400);
+  if (body.accountId !== undefined && typeof body.accountId !== "string") return c.json(err("accountId must be a string"), 400);
   c.header("Cache-Control", "no-store");
-  try { return c.json(ok(await startBrowserLogin(body.label))); }
+  try { return c.json(ok(await startBrowserLogin(body.label, undefined, body.accountId))); }
   catch (e) { return c.json(err((e as Error).message), 400); }
 });
 

package/src/services/codex-account-auth-state.ts

@@ -0,0 +1,58 @@
+/**
+ * Codex accounts the server has seen refused for a revoked or expired login.
+ *
+ * Sibling of `codex-account-cooldown.ts`, and in memory for the same reason: this is the
+ * server's own observation, not the user's on/off switch, and writing it into the account
+ * row would show an account the user never touched as changed in Settings.
+ *
+ * Unlike a quota park this is a hard exclusion from selection. A spent quota still answers
+ * slowly; a signed-out account never answers at all, and every turn handed to it costs a
+ * subprocess and ~24s of codex retrying before it says so. That is what let a burst of
+ * proxy requests pin the server until the supervisor killed it.
+ *
+ * The mark lapses on its own so a misread error cannot bench an account forever, and the
+ * usage sweep (every 5 minutes) renews it for as long as the account really is signed out.
+ * A successful usage read, a completed turn or a fresh sign-in clears it at once.
+ */
+
+const MARK_TTL_MS = 15 * 60 * 1000;
+
+interface AuthFailure {
+  until: number;
+  reason: string;
+  since: number;
+}
+
+const failures = new Map<string, AuthFailure>();
+
+/** Record that this account's login was refused. */
+export function markCodexAccountAuthFailed(accountId: string, reason: string): void {
+  const now = Date.now();
+  const prev = failures.get(accountId);
+  const fresh = !prev || prev.until <= now;
+  failures.set(accountId, { until: now + MARK_TTL_MS, reason, since: fresh ? now : prev.since });
+  if (fresh) console.warn(`[codex] account ${accountId} is signed out — skipping it until it signs in again`);
+}
+
+/** Whether the account is currently known to be signed out. Lapsed marks drop as read. */
+export function isCodexAccountAuthFailed(accountId: string): boolean {
+  const f = failures.get(accountId);
+  if (!f) return false;
+  if (f.until <= Date.now()) { failures.delete(accountId); return false; }
+  return true;
+}
+
+/** When the account was first seen signed out, or null if it is not. */
+export function codexAccountAuthFailedSince(accountId: string): number | null {
+  return isCodexAccountAuthFailed(accountId) ? failures.get(accountId)!.since : null;
+}
+
+/** The account answered normally again — drop the mark. */
+export function clearCodexAccountAuthFailure(accountId: string): void {
+  if (failures.delete(accountId)) console.log(`[codex] account ${accountId} is signed in again`);
+}
+
+/** Test seam: forget every mark. */
+export function _resetCodexAuthFailuresForTesting(): void {
+  failures.clear();
+}

package/src/services/codex-account-login.ts

@@ -17,7 +17,9 @@ import { randomUUID } from "node:crypto";
 import { mkdirSync, rmSync } from "node:fs";
 import { buildCodexCallback, buildCodexSuccessCallback, checkCodexLoginPort, parseBrowserLogin, type BrowserLoginCallback } from "./codex-login-callback.ts";
 import { CodexJsonRpcClient, CONTROL_REQUEST_TIMEOUT_MS } from "../providers/codex-app-server/codex-jsonrpc-client.ts";
-import { codexAccountHome, createCodexAccount, type CodexAccount } from "./codex-account.service.ts";
+import { codexAccountHome, createCodexAccount, getCodexAccount, updateCodexAccountMeta, type CodexAccount } from "./codex-account.service.ts";
+import { clearCodexAccountAuthFailure } from "./codex-account-auth-state.ts";
+import { refreshUsage } from "./provider-usage/usage-registry.ts";
 
 const CLIENT_INFO = { name: "ppm", title: "PPM", version: "0.0.0" };
 const CAPABILITIES = { experimentalApi: true, requestAttestation: false, optOutNotificationMethods: null };
@@ -78,6 +80,9 @@ interface ChatGptLogin {
   browser?: BrowserLoginCallback;
   callbackAbort?: AbortController;
   client: LoginClient; home: string; label?: string;
+  /** Signing an existing account in again: the login runs in that account's own home and
+   *  finalises by updating its row instead of creating one. */
+  reloginId?: string;
   status: DeviceLoginStatus;
   timer: ReturnType<typeof setTimeout>;
   /** True from the completion notification until the account is written. The
@@ -116,7 +121,8 @@ function disposeLogin(id: string, rmHome: boolean): void {
   clearTimeout(p.timer);
   p.callbackAbort?.abort();
   try { p.client.close(); } catch { /* ignore */ }
-  if (rmHome) { try { rmSync(p.home, { recursive: true, force: true }); } catch { /* ignore */ } }
+  // A re-login borrows a live account's home; abandoning it must never delete that.
+  if (rmHome && !p.reloginId) { try { rmSync(p.home, { recursive: true, force: true }); } catch { /* ignore */ } }
 }
 
 /** Record the outcome and stop the app-server. First settle wins, so the close
@@ -131,7 +137,8 @@ function settle(id: string, status: Exclude<DeviceLoginStatus, { state: "pending
   try { p.client.close(); } catch { /* ignore */ }
   // A failure leaves no account owning the dir, so the half-built home goes now.
   // A success must keep it: createCodexAccount adopted it as the account's home.
-  if (status.state === "error") { try { rmSync(p.home, { recursive: true, force: true }); } catch { /* ignore */ } }
+  // A failed re-login leaves the account's home alone — it still belongs to the account.
+  if (status.state === "error" && !p.reloginId) { try { rmSync(p.home, { recursive: true, force: true }); } catch { /* ignore */ } }
   p.timer = unref(setTimeout(() => { pendingLogins.delete(id); }, RESULT_GRACE_MS));
 }
 
@@ -147,6 +154,21 @@ async function finalizeLogin(id: string, notif: CompletionNotification): Promise
     const read = await p.client.request<AccountRead>("account/read", {}, CONTROL_REQUEST_TIMEOUT_MS);
     if (!read?.account) throw new Error("login completed but account is empty");
     if (p.status.state !== "pending") return;
+    if (p.reloginId) {
+      const existing = getCodexAccount(p.reloginId);
+      if (!existing) throw new Error("That account was removed while signing in. Add it again.");
+      updateCodexAccountMeta(existing.id, {
+        // The label is the user's name for this account ("Work"), not a copy of the email.
+        label: p.label || existing.label,
+        planType: read.account.planType ?? existing.planType ?? null,
+      });
+      // The fresh login is the proof: stop skipping the account and read its quota now,
+      // rather than showing the stale reading until the next five-minute sweep.
+      clearCodexAccountAuthFailure(existing.id);
+      void refreshUsage("codex", existing.id);
+      settle(id, { state: "done", account: getCodexAccount(existing.id)! });
+      return;
+    }
     const account = createCodexAccount({
       id, label: p.label || read.account.email || "ChatGPT", type: "chatgpt",
       planType: read.account.planType ?? null,
@@ -163,12 +185,19 @@ async function startChatGptLogin(
   method: "device" | "browser",
   label: string | undefined,
   makeClient: () => LoginClient,
+  reloginId?: string,
 ): Promise<ChatGptLoginStart> {
   if (method === "browser" && hasPendingBrowserLogin()) {
     throw new Error("A browser login is already in progress. Finish or cancel it first.");
   }
+  // Re-login signs the SAME account in again, in its own CODEX_HOME: the id, the sessions
+  // bound to it, its transcripts and its settings all stay. Removing and re-adding was the
+  // only way before, and it cost every one of those.
+  const target = reloginId ? getCodexAccount(reloginId) : null;
+  if (reloginId && !target) throw new Error("Account not found");
+  if (target && target.type !== "chatgpt") throw new Error("Only a ChatGPT sign-in can be renewed; replace an API key by adding it again.");
   const id = randomUUID();
-  const home = codexAccountHome(id);
+  const home = target ? target.home : codexAccountHome(id);
   mkdirSync(home, { recursive: true, mode: 0o700 });
   const client = makeClient();
   client.onNotification((n) => {
@@ -178,7 +207,10 @@ async function startChatGptLogin(
   });
   client.onClose(() => settle(id, { state: "error", error: "login process exited" }));
   const timer = unref(setTimeout(() => settle(id, { state: "error", error: "timed out" }), method === "browser" ? BROWSER_LOGIN_TTL : DEVICE_LOGIN_TTL));
-  const pending: ChatGptLogin = { method, client, home, label, status: { state: "pending" }, timer, finalizing: false };
+  const pending: ChatGptLogin = {
+    method, client, home, label, status: { state: "pending" }, timer, finalizing: false,
+    ...(target ? { reloginId: target.id } : {}),
+  };
   pendingLogins.set(id, pending);
   try {
     if (method === "browser") await checkCodexLoginPort();
@@ -195,13 +227,14 @@ async function startChatGptLogin(
   }
 }
 
-export async function startDeviceLogin(label?: string, makeClient: () => LoginClient = () => new CodexJsonRpcClient()) {
-  const { id, userCode, verificationUrl } = await startChatGptLogin("device", label, makeClient);
+/** `reloginId` signs that existing ChatGPT account in again instead of adding a new one. */
+export async function startDeviceLogin(label?: string, makeClient: () => LoginClient = () => new CodexJsonRpcClient(), reloginId?: string) {
+  const { id, userCode, verificationUrl } = await startChatGptLogin("device", label, makeClient, reloginId);
   return { id, userCode, verificationUrl };
 }
 
-export async function startBrowserLogin(label?: string, makeClient: () => LoginClient = () => new CodexJsonRpcClient()) {
-  const { id, authUrl } = await startChatGptLogin("browser", label, makeClient);
+export async function startBrowserLogin(label?: string, makeClient: () => LoginClient = () => new CodexJsonRpcClient(), reloginId?: string) {
+  const { id, authUrl } = await startChatGptLogin("browser", label, makeClient, reloginId);
   return { id, authUrl };
 }
 

package/src/services/codex-account.service.ts

@@ -16,6 +16,8 @@ import { configService } from "./config.service.ts";
 import { encrypt, decrypt } from "../lib/account-crypto.ts";
 import { getOrFetchUsage } from "./provider-usage/usage-registry.ts";
 import { isCodexAccountUsageLimited } from "./codex-account-cooldown.ts";
+import { isCodexAccountAuthFailed } from "./codex-account-auth-state.ts";
+import { codexSignedOutMessage } from "../providers/codex-app-server/codex-auth-failure.ts";
 import { dailyGuardMessage, dailyGuardState } from "../shared/codex-daily-guard.ts";
 import type { UsageInfo } from "../providers/provider.interface.ts";
 
@@ -149,6 +151,35 @@ export function setCodexDailyGuard(id: string, enabled: boolean): CodexAccount |
 
 export class CodexDailyGuardError extends Error {}
 
+/** Every managed account that could serve is signed out. */
+export class CodexSignedOutError extends Error {}
+
+/**
+ * Accounts that can be handed a turn at all: switched on, and not known to be signed out.
+ *
+ * Both exclusions are hard. Off is the user's say-so; signed out is an account that will
+ * refuse every turn after ~24s of codex retrying, so handing it back "because nothing else
+ * was left" buys a slow failure instead of a fast one.
+ */
+function servableAccounts(): CodexAccount[] {
+  return listCodexAccounts().filter((a) => a.status !== "disabled" && !isCodexAccountAuthFailed(a.id));
+}
+
+/**
+ * Throw when accounts are enabled but every one of them is signed out.
+ *
+ * Without this the selector finds nothing, the caller falls back to the ambient ~/.codex
+ * login — usually absent or stale on a machine that manages accounts — and the turn fails
+ * with an error that names neither account.
+ */
+function assertSomeAccountSignedIn(): void {
+  const enabled = listCodexAccounts().filter((a) => a.status !== "disabled");
+  if (enabled.length === 0 || enabled.some((a) => !isCodexAccountAuthFailed(a.id))) return;
+  throw new CodexSignedOutError(enabled.length === 1
+    ? codexSignedOutMessage(enabled[0]!.label)
+    : `Every Codex account is signed out (${enabled.map((a) => a.label).join(", ")}). Press "Sign in again" on their cards in Settings → Accounts → Codex.`);
+}
+
 /** Remove the account row and its CODEX_HOME dir. */
 export function removeCodexAccount(id: string): void {
   const acct = getCodexAccount(id);
@@ -242,7 +273,7 @@ export function selectCodexAccount(opts?: { strategy?: CodexStrategy; usageOf?:
   // `exclude` is hard for the same reason: its only caller is the rotation away from an
   // account that just refused the turn, and falling back to it would rotate in a circle.
   const excluded = new Set(opts?.exclude ?? []);
-  const all = listCodexAccounts().filter((a) => a.status !== "disabled" && !excluded.has(a.id));
+  const all = servableAccounts().filter((a) => !excluded.has(a.id));
   if (all.length === 0) return null;
   if (all.length === 1) return all[0]!;
   const strategy = opts?.strategy ?? getCodexStrategy();
@@ -276,7 +307,7 @@ export function peekCodexAccount(): CodexAccount | null {
   // Status and the quota park are the two things this can filter on without going async, so
   // it does both. Usage lives behind a fetch and stays out of reach here; the consuming pick
   // endpoint reads it instead.
-  const accts = withQuotaLeft(listCodexAccounts().filter((a) => a.status !== "disabled"));
+  const accts = withQuotaLeft(servableAccounts());
   if (accts.length === 0) return null;
   if (accts.length === 1) return accts[0]!;
   return getCodexStrategy() === "fill-first" ? accts[0]! : null;
@@ -287,6 +318,11 @@ export async function resolveCodexAccountForSession(sessionId?: string): Promise
   // Session-less callers (the model list) have nothing sticky to honour and fall
   // straight through to the configured strategy.
   const sticky = sessionId ? getSessionCodexAccount(sessionId) : null;
+  // A signed-out account lets go of its sessions too: it would refuse the turn after
+  // codex's full retry loop, and there is no quota reset to wait for.
+  assertSomeAccountSignedIn();
+  const keepable = (a: CodexAccount | null): a is CodexAccount =>
+    !!a && a.status !== "disabled" && !isCodexAccountUsageLimited(a.id) && !isCodexAccountAuthFailed(a.id);
   // A binding is held for the prompt cache, not honoured unconditionally: an account the
   // user has switched off has to let go of the sessions sitting on it, or turning it off
   // would do nothing for exactly the conversations already using it. An account parked for
@@ -296,7 +332,7 @@ export async function resolveCodexAccountForSession(sessionId?: string): Promise
   // account able to serve it cannot. Parked accounts count as unable for the same reason
   // they are skipped below, so a pool of two where one is out of quota resolves without a
   // network read at all.
-  const usable = listCodexAccounts().filter((a) => a.status !== "disabled" && !isCodexAccountUsageLimited(a.id));
+  const usable = servableAccounts().filter((a) => !isCodexAccountUsageLimited(a.id));
   const guarded = usable.filter((a) => a.dailyGuardEnabled);
   if (guarded.length > 0) {
     const usages = await getAllCodexUsages();
@@ -309,8 +345,7 @@ export async function resolveCodexAccountForSession(sessionId?: string): Promise
     });
     if (blocked.length > 0) {
       const stickyAccount = sticky ? getCodexAccount(sticky) : null;
-      if (stickyAccount && !blocked.includes(stickyAccount.id)
-          && stickyAccount.status !== "disabled" && !isCodexAccountUsageLimited(stickyAccount.id)) return stickyAccount;
+      if (keepable(stickyAccount) && !blocked.includes(stickyAccount.id)) return stickyAccount;
       if (blocked.length === usable.length && sessionId) {
         const account = getCodexAccount(blocked[0]!);
         const usage = account ? usages[account.id] : undefined;
@@ -321,13 +356,13 @@ export async function resolveCodexAccountForSession(sessionId?: string): Promise
     }
     if (sticky) {
       const a = getCodexAccount(sticky);
-      if (a && a.status !== "disabled" && !isCodexAccountUsageLimited(a.id)) return a;
+      if (keepable(a)) return a;
     }
     return selectCodexAccount({ usageOf: (id) => codexUsageLevel(usages[id]) });
   }
   if (sticky) {
     const a = getCodexAccount(sticky);
-    if (a && a.status !== "disabled" && !isCodexAccountUsageLimited(a.id)) return a;
+    if (keepable(a)) return a;
   }
   if (usable.length <= 1) return selectCodexAccount();
   // Usage is read for every strategy, not just lowest-usage: it is also what lets the

package/src/services/proxy-agent-anthropic-bridge.ts

@@ -7,7 +7,7 @@
  * setting that base to `…/proxy/<provider>`.
  */
 import {
-  startAgentTurn, usageOf, resolveProvider, proxyableProviderIds,
+  startAgentTurn, usageOf, resolveProvider, proxyableProviderIds, turnFailureResponse,
 } from "./proxy-agent-turn.ts";
 import {
   buildPromptFromAnthropicMessages, hasUnsupportedAnthropicBlocks, messageResponse, anthropicError,
@@ -99,6 +99,6 @@ export async function forwardAgentMessages(
       ? await runStreaming(providerId, body)
       : await runNonStreaming(providerId, body);
   } catch (e) {
-    return anthropicError(502, (e as Error).message);
+    return turnFailureResponse(e, anthropicError);
   }
 }

package/src/services/proxy-agent-bridge.ts

@@ -15,7 +15,7 @@ import { mkdtempSync, writeFileSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import {
-  startAgentTurn, usageOf, resolveProvider, proxyableProviderIds,
+  startAgentTurn, usageOf, resolveProvider, proxyableProviderIds, turnFailureResponse,
 } from "./proxy-agent-turn.ts";
 import { decodeImagePayload } from "./proxy-image-bridge.ts";
 import {
@@ -140,7 +140,7 @@ export async function forwardAgentChatCompletions(
       ? await runStreaming(providerId, body)
       : await runNonStreaming(providerId, body);
   } catch (e) {
-    return openAiError(502, (e as Error).message);
+    return turnFailureResponse(e, openAiError);
   }
 }