@iislee/opencodex 2.11.0 → 2.35.0

package/src/claude/outbound.ts

@@ -2,13 +2,16 @@
  * Claude Code outbound: internal /v1/responses output -> Anthropic Messages API shapes.
  *
  * Wire contract pinned in devlog/260711_claude_inbound/003_evidence.md (all Tier 2):
- *  - SSE order: message_start -> (content_block_start -> deltas -> content_block_stop)*
- *    -> message_delta -> message_stop; any number of `ping`.
+ *  - Transport-only `ping` events may appear at any point, including before
+ *    message_start. Semantic framing stays message_start ->
+ *    (content_block_start -> deltas -> content_block_stop)* -> message_delta -> message_stop.
  *  - thinking blocks get thinking_delta(s) then ONE synthetic signature_delta just
  *    before content_block_stop (CCR precedent: Claude Code does not verify signatures).
  *  - message_delta.usage is cumulative; message_start embeds a full message snapshot.
  *  - errors: {type:"error", error:{type,message}}; may arrive mid-stream after HTTP 200.
  */
+import { createHash } from "node:crypto";
+import { httpStatusFromTerminalError } from "../lib/errors";
 import { isTransientUpstreamStatus } from "../lib/upstream-retry";
 import {
   isTranslatorBudgetExceededError,
@@ -16,6 +19,7 @@ import {
   TranslatorBudgetExceededError,
   type TranslatorBudget,
 } from "../lib/translator-budget";
+import { sseFieldOffset, sseFieldValue } from "../lib/sse-decoder";
 
 type Rec = Record<string, unknown>;
 
@@ -23,6 +27,27 @@ function isRec(v: unknown): v is Rec {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
 
+function reasoningIdentityDigest(value: string): string {
+  return createHash("sha256").update(value).digest("base64url");
+}
+
+/** Fixed-size identity that preserves protocol boundaries without retaining upstream strings. */
+function boundedReasoningIdentity(value: unknown): string {
+  if (typeof value === "number") {
+    if (Number.isSafeInteger(value) && value >= 0) return `n${value}`;
+    if (Number.isFinite(value)) return `d${value}`;
+    return Number.isNaN(value) ? "dnan" : value > 0 ? "dinf" : "d-inf";
+  }
+  if (typeof value === "string") {
+    return `s${reasoningIdentityDigest(value)}`;
+  }
+  if (value === null) return "z";
+  if (typeof value === "boolean") return value ? "b1" : "b0";
+  if (Array.isArray(value)) return `a${reasoningIdentityDigest(JSON.stringify(value) ?? "[]")}`;
+  // Preserve the prior String(record) category semantics without serializing untrusted trees.
+  return typeof value === "object" ? "o" : "u";
+}
+
 function uuid(): string {
   return crypto.randomUUID().replace(/-/g, "");
 }
@@ -187,6 +212,8 @@ interface OpenBlock {
   argsBufBytes?: number;
   webSearchArgsEmitted?: boolean;
   callId?: string;
+  /** Last fixed-size reasoning identity (item + summary/content index) seen by this block. */
+  reasoningPartKey?: string;
 }
 
 /** Streaming: Responses SSE bytes -> Anthropic Messages SSE bytes. */
@@ -242,14 +269,13 @@ export function responsesSseToAnthropicSse(
         emit("message_start", { type: "message_start", message: messageSnapshot(model) });
         emit("ping", { type: "ping" });
       };
-      // Idle keepalive (devlog 100): real Anthropic streams may interleave pings anywhere;
-      // synthesizing one during upstream silence protects remote deployments behind
-      // LB/NAT idle timeouts and covers slow first tokens. Cheap and spec-legal.
+      // Keepalive pings protect remote deployments behind LB/NAT idle timeouts even
+      // before semantic output. They are transport-only and must not manufacture a
+      // message before a possible initial error.
       if (pingIntervalMs > 0) {
         pingTimer = setInterval(() => {
-          if (terminated) return;
+          if (terminated || (controller.desiredSize ?? 0) <= 0) return;
           try {
-            ensureStarted();
             emit("ping", { type: "ping" });
           } catch { /* controller torn down; the read loop is ending anyway */ }
         }, pingIntervalMs);
@@ -325,20 +351,25 @@ export function responsesSseToAnthropicSse(
           ))));
           return;
         }
-        ensureStarted();
-        closeOpenBlock();
         const type = upstreamDerived && isTransientUpstreamStatus(status) ? "overloaded_error" : undefined;
+        if (!started) {
+          // An initial upstream failure is an Anthropic error stream, not a partial message.
+          // Do not manufacture message_start before the terminal error. Earlier transport-only
+          // pings remain valid and do not turn the failure into a partial message.
+          emit("error", anthropicErrorBody(status, message, type, code));
+          return;
+        }
+        closeOpenBlock();
         emit("error", anthropicErrorBody(status, message, type, code));
       };
 
       const handleFrame = (eventName: string, data: Rec) => {
         switch (eventName) {
           case "response.created":
-            ensureStarted();
+            // Transport prelude only. Start Anthropic framing on semantic output or completion.
             break;
           case "response.heartbeat":
-            ensureStarted();
-            emit("ping", { type: "ping" });
+            if ((controller.desiredSize ?? 0) > 0) emit("ping", { type: "ping" });
             break;
           case "response.output_text.delta": {
             if (typeof data.delta !== "string" || data.delta.length === 0) break;
@@ -353,6 +384,24 @@ export function responsesSseToAnthropicSse(
           case "response.reasoning_text.delta": {
             if (typeof data.delta !== "string" || data.delta.length === 0) break;
             ensureBlock("thinking");
+            // The JSON path joins reasoning summary/content parts with "\n\n"
+            // (responsesJsonToAnthropicMessage); mirror that at part and item boundaries
+            // so multi-part summaries do not glue into one run-on paragraph. Frames
+            // without part indices produce a constant key and never get a separator.
+            const slot = eventName === "response.reasoning_summary_text.delta"
+              ? `s${boundedReasoningIdentity(data.summary_index)}`
+              : `c${boundedReasoningIdentity(data.content_index)}`;
+            // Upstream string metadata can be arbitrarily large. Hash strings into fixed-size
+            // components while retaining item and part equality, rather than dropping item_id and
+            // accidentally joining distinct malformed reasoning items.
+            const partKey = `${boundedReasoningIdentity(data.item_id)}:${slot}`;
+            if (open!.reasoningPartKey !== undefined && open!.reasoningPartKey !== partKey) {
+              emit("content_block_delta", {
+                type: "content_block_delta", index: open!.index,
+                delta: { type: "thinking_delta", thinking: "\n\n" },
+              });
+            }
+            open!.reasoningPartKey = partKey;
             emit("content_block_delta", {
               type: "content_block_delta", index: open!.index,
               delta: { type: "thinking_delta", thinking: data.delta },
@@ -507,9 +556,19 @@ export function responsesSseToAnthropicSse(
             }
             const status = code === "translation_buffer_limit"
               ? 413
-              : typeof error.status === "number" ? error.status : 500;
-            // status-absent response.failed (relaySseWithFailedTail synthetic tail) defaults
-            // to 500, which is in the transient set — the mid-stream reset shape maps to
+              : typeof error.status === "number"
+                ? error.status
+                // Internal response.failed envelopes carry the classified {type, code, message}
+                // but no numeric status. Derive it with the same mapping /api/logs uses so a
+                // classified 429/401/400 reaches Claude Code as its real Anthropic error type
+                // instead of being masked as retryable overload.
+                : httpStatusFromTerminalError({
+                  type: typeof error.type === "string" ? error.type : undefined,
+                  code: typeof error.code === "string" ? error.code : null,
+                  message,
+                });
+            // Unclassified status-absent response.failed (relaySseWithFailedTail synthetic
+            // tail) still lands on a transient 5xx here — the mid-stream reset shape maps to
             // overloaded_error by design.
             fail(
               status,
@@ -571,10 +630,16 @@ export function responsesSseToAnthropicSse(
                       while (lineStart <= rawFrame.length) {
                         const newline = rawFrame.indexOf("\n", lineStart);
                         const lineEnd = newline === -1 ? rawFrame.length : newline;
-                        if (rawFrame.startsWith("event: ", lineStart)) {
-                          eventName = rawFrame.slice(lineStart + 7, lineEnd).trim();
-                        } else if (rawFrame.startsWith("data: ", lineStart)) {
-                          const fragmentStart = lineStart + 6;
+                        // The space after the colon is optional in text/event-stream (#1170);
+                        // compute the value offset the same way sseFieldValue does, without
+                        // slicing the line first — the byte accounting below is keyed to
+                        // offsets into rawFrame.
+                        const eventOffset = sseFieldOffset(rawFrame, lineStart, lineEnd, "event");
+                        const dataOffset = sseFieldOffset(rawFrame, lineStart, lineEnd, "data");
+                        if (eventOffset !== -1) {
+                          eventName = rawFrame.slice(eventOffset, lineEnd).trim();
+                        } else if (dataOffset !== -1) {
+                          const fragmentStart = dataOffset;
                           const fragmentBytes = utf8SliceBytes(rawFrame, fragmentStart, lineEnd);
                           const fragmentReservation = translatorBudget.reserveTransient(fragmentBytes, { kind: "live_transient" });
                           let fragmentCommitted = false;
@@ -844,8 +909,10 @@ export async function collectAnthropicMessage(
         let eventName = "";
         let dataLine = "";
         for (const line of rawFrame.split("\n")) {
-          if (line.startsWith("event: ")) eventName = line.slice(7).trim();
-          else if (line.startsWith("data: ")) dataLine += line.slice(6);
+          const eventValue = sseFieldValue(line, "event");
+          if (eventValue !== null) { eventName = eventValue.trim(); continue; }
+          const dataValue = sseFieldValue(line, "data");
+          if (dataValue !== null) dataLine += dataValue;
         }
         if (!eventName || !dataLine) continue;
         let data: unknown;

package/src/cli/access.ts

@@ -17,6 +17,51 @@ const USAGE = `Usage:
   ocx access models [--json]
   ocx access test <model> [--protocol <chat|responses|messages>] [--json]`;
 
+/**
+ * Render the key table with the usage fields the API already returns (#2705).
+ *
+ * `usage` is a DISCRIMINATED UNION server-side (`api-key-usage.ts`): the `{ambiguous:true}`
+ * variant carries no numbers at all, because when two config entries share an id there IS no
+ * per-key total. The union exists specifically so a consumer cannot print a number beside an
+ * ambiguity marker, so this renders the word `ambiguous` across the numeric columns rather
+ * than a fabricated 0 -- reporting 0 requests for a key that may be in heavy use is the
+ * dangerous answer to hand someone deciding what to delete.
+ *
+ * `attributionSince` and `historyTruncated` describe the DATA SET, not a key, so they print
+ * once as a footer. Without `attributionSince`, an absent `lastUsedAt` is unreadable: it
+ * could mean "never used" or "nothing is attributable yet".
+ */
+function formatKeyRows(payload: Record<string, unknown>, keys: Array<Record<string, unknown>>): string[] {
+  const cells: string[][] = [["ID", "NAME", "PREFIX", "REQ 7D", "TOTAL", "LAST USED"]];
+  for (const entry of keys) {
+    const usage = (entry.usage ?? {}) as Record<string, unknown>;
+    const ambiguous = usage.ambiguous === true;
+    const num = (value: unknown): string => (typeof value === "number" ? value.toLocaleString("en-US") : "-");
+    cells.push([
+      String(entry.id ?? ""),
+      String(entry.name ?? ""),
+      String(entry.prefix ?? ""),
+      // One marker spanning both numeric columns: the union guarantees neither exists.
+      ambiguous ? "ambiguous" : num(usage.requests7d),
+      ambiguous ? "" : num(usage.totalRequests),
+      ambiguous ? "" : (typeof usage.lastUsedAt === "string" ? usage.lastUsedAt : "never"),
+    ]);
+  }
+  const widths = cells[0]!.map((_, column) => Math.max(...cells.map(row => (row[column] ?? "").length)));
+  const lines = cells.map(row => row.map((cell, i) => (cell ?? "").padEnd(widths[i]!)).join("  ").trimEnd());
+  const footer: string[] = [];
+  if (typeof payload.attributionSince === "string") {
+    footer.push(`attribution since ${payload.attributionSince}`);
+  }
+  if (payload.historyTruncated === true) {
+    footer.push("older history truncated");
+  }
+  if (keys.some(entry => (entry.usage as Record<string, unknown> | undefined)?.ambiguous === true)) {
+    footer.push("ambiguous: two configured keys share an id, so per-key totals do not exist");
+  }
+  return footer.length > 0 ? [...lines, "", ...footer] : lines;
+}
+
 async function key(argv: string[], deps: RuntimeApiDeps): Promise<void> {
   const args = [...argv];
   const action = (args.shift() ?? "list").toLowerCase();
@@ -25,9 +70,7 @@ async function key(argv: string[], deps: RuntimeApiDeps): Promise<void> {
     rejectArgs(args, USAGE);
     const result = await runtimeRequest<Record<string, unknown>>("/api/keys", {}, deps);
     const keys = Array.isArray(result.keys) ? result.keys as Array<Record<string, unknown>> : [];
-    printData(result, wantsJson, keys.length
-      ? keys.map(entry => `${String(entry.id)}  ${String(entry.name)}  ${String(entry.prefix ?? "")}`)
-      : ["No API access keys configured."]);
+    printData(result, wantsJson, keys.length ? formatKeyRows(result, keys) : ["No API access keys configured."]);
     return;
   }
   if (action === "create") {

package/src/cli/account-api.ts

@@ -21,13 +21,34 @@ export interface AccountRow {
   masked?: string;
   active: boolean;
   needsReauth?: boolean;
+  /** Codex pool selection order, higher used earlier. Absent where ordering does not apply. */
+  priority?: number;
   quota?: CodexQuotaDto | null;
+  /**
+   * Whether the pool is holding this account out of rotation.
+   *
+   * The server has always sent it (auth-api.ts:286 for pool accounts, :1315 for main) and the
+   * CLI dropped it, so a paused account was indistinguishable from an available one in every
+   * human listing (#2703).
+   */
+  paused?: boolean;
 }
 
 export type ClassifyResult = { type: AccountType } | { error: string };
 
 export type AccountStdin = NodeJS.ReadableStream & { isTTY?: boolean };
 
+export interface NativeMainLoginChild {
+  exited: Promise<number>;
+  kill(signal?: number | NodeJS.Signals): void;
+}
+
+export interface StageLeaseClock {
+  now(): number;
+  setTimeout(callback: () => void, ms: number): ReturnType<typeof setTimeout>;
+  clearTimeout(timer: ReturnType<typeof setTimeout>): void;
+}
+
 export interface AccountDeps {
   /** Test injection: skip findLiveProxy and call the API at this base URL. */
   baseUrl?: string;
@@ -35,6 +56,16 @@ export interface AccountDeps {
   loadConfigImpl?: () => OcxConfig;
   stdinImpl?: AccountStdin;
   stdinTimeoutMs?: number;
+  /** Internal test seam for the account-import POST; production is capped at ten minutes. */
+  importTimeoutMs?: number;
+  /** Test/platform injection for the official Codex login in a restricted staging home. */
+  spawnCodexLoginImpl?: (codexHome: string) => NativeMainLoginChild;
+  /** Legacy test seam. Production always uses the spawned child handle above. */
+  runCodexLoginImpl?: (codexHome: string) => Promise<number>;
+  /** Test-only heartbeat cadence floor. Production keeps the five-second floor. */
+  stageHeartbeatIntervalMinMs?: number;
+  /** Test-only clock for deterministic native-profile lease deadline coverage. */
+  stageLeaseClock?: StageLeaseClock;
 }
 
 export function classifyAccount(config: OcxConfig, name: string): ClassifyResult {
@@ -60,6 +91,12 @@ export interface ApiResult {
   /** 0 = network-level failure (proxy unreachable). */
   status: number;
   json: Record<string, unknown>;
+  /**
+   * Message from the thrown transport error when `status` is 0. Previously the
+   * error was swallowed by a catch block with an empty body, so an unreachable proxy, a DNS
+   * failure and a TLS error were indistinguishable (#2698).
+   */
+  transportError?: string;
 }
 
 export async function apiJson(
@@ -68,6 +105,7 @@ export async function apiJson(
   method: "GET" | "PUT" | "POST" | "DELETE",
   path: string,
   body?: unknown,
+  options: { signal?: AbortSignal } = {},
 ): Promise<ApiResult> {
   const fetchImpl = deps.fetchImpl ?? fetch;
   try {
@@ -75,11 +113,18 @@ export async function apiJson(
       method,
       headers: runningProxyUpdateHeaders(),
       body: body === undefined ? undefined : JSON.stringify(body),
+      signal: options.signal,
     });
     const json = (await res.json().catch(() => ({}))) as Record<string, unknown>;
     return { status: res.status, json };
-  } catch {
-    return { status: 0, json: {} };
+  } catch (error) {
+    // status 0 stays the transport sentinel, but keep the cause: callers can now
+    // tell the operator why the request never reached the proxy (#2698).
+    return {
+      status: 0,
+      json: {},
+      transportError: error instanceof Error ? error.message : String(error),
+    };
   }
 }
 
@@ -90,15 +135,43 @@ export async function resolveBaseUrl(deps: AccountDeps): Promise<string | null>
   return `http://${probeHostname(live.hostname)}:${live.port}`;
 }
 
-export function proxyUnreachable(): number {
+export function proxyUnreachable(transportError?: string): number {
   console.error("Proxy not reachable. Start it with 'ocx start' or 'ocx ensure'.");
+  // Naming the transport cause distinguishes "nothing is listening" from a refused
+  // or reset connection, which is what made #2696-class breakage undiagnosable.
+  if (transportError) console.error(`reason: ${transportError}`);
   return 1;
 }
 
-export function apiError(json: Record<string, unknown>, fallback: string): number {
-  const message = typeof json.error === "string" ? json.error : fallback;
-  console.error(`Error: ${message}`);
-  return 1;
+function accountStringField(json: Record<string, unknown>, key: string): string | undefined {
+  const value = json[key];
+  return typeof value === "string" && value.trim() ? value.trim() : undefined;
+}
+
+/**
+ * Report a failed management call from the account family.
+ *
+ * `reason` and `hint` are the actionable fields on a refusal — the management plane
+ * sets both on a 503, and several routes return `reason` with no `error` key at all,
+ * which used to print only the generic fallback (#2698).
+ *
+ * `status` selects the exit code so the account client speaks the same vocabulary as
+ * runtime-api.ts: 4 for not-found, 5 for conflict, 1 otherwise. Previously every
+ * failure exited 1, so a script could not distinguish a missing account from a
+ * concurrent mutation.
+ */
+export function apiError(json: Record<string, unknown>, fallback: string, status: number): number {
+  const primary = accountStringField(json, "error") ?? fallback;
+  const lines = [`Error: ${primary}`];
+  const reason = accountStringField(json, "reason");
+  if (reason && reason !== primary) lines.push(`reason: ${reason}`);
+  const hint = accountStringField(json, "hint");
+  if (hint && hint !== primary) lines.push(`hint: ${hint}`);
+  for (const line of lines) console.error(line);
+  if (json.cleanupRequired === true) {
+    console.error("Warning: native-login staging cleanup is still required; run 'ocx account main doctor'.");
+  }
+  return status === 404 ? 4 : status === 409 ? 5 : 1;
 }
 
 export interface FamilyRows {
@@ -106,10 +179,12 @@ export interface FamilyRows {
   activeId: string | null;
   autoSwitchThreshold?: number;
   /** HTTP status for a completed family read, including failures. */
-  status?: number;
+  status: number;
   /** Set when the family endpoint returned an error. */
   errorJson?: Record<string, unknown>;
   networkDown?: boolean;
+  /** Transport cause when `networkDown` is set. Callers must forward this to `proxyUnreachable`. */
+  transportError?: string;
 }
 
 export interface CodexQuotaDto {
@@ -117,6 +192,18 @@ export interface CodexQuotaDto {
   monthlyPercent?: number;
   weeklyResetAt?: number;
   monthlyResetAt?: number;
+  /**
+   * Five-hour window, as the per-account provider probe reports it
+   * (`/api/oauth/accounts?quota=1`). Distinct from `shortPercent`, which is the Codex pool's
+   * self-declared burst window; the two surfaces name the same idea differently and both reach
+   * this DTO.
+   */
+  fiveHourPercent?: number;
+  fiveHourResetAt?: number;
+  /** Sub-day burst window, when upstream declares one (#1791). */
+  shortPercent?: number;
+  shortResetAt?: number;
+  shortWindowSeconds?: number;
 }
 
 export interface ProviderQuotaWindowDto {
@@ -148,13 +235,21 @@ interface CodexAccountDto {
   plan?: string;
   isMain?: boolean;
   needsReauth?: boolean;
+  priority?: number;
   quota?: CodexQuotaDto | null;
+  paused?: boolean;
 }
 
 function projectQuota(quota: CodexQuotaDto | null | undefined): CodexQuotaDto | null {
   if (!quota) return null;
   const projected: CodexQuotaDto = {};
-  for (const key of ["weeklyPercent", "monthlyPercent", "weeklyResetAt", "monthlyResetAt"] as const) {
+  // `fiveHourPercent`/`fiveHourResetAt` were declared on the DTO and read by two renderers
+  // -- `quotaText`'s `quota.fiveHourPercent ?? quota.shortPercent` (account.ts:89) and
+  // `quotaParts` (account-extended.ts:275) -- but omitted from this whitelist, so the first
+  // operand was unreachable and a 5h-only account rendered as unknown (#2703). A projection
+  // that silently drops a field its own type declares is worse than one that never had it:
+  // the type checks, the renderer looks correct, and only the output is wrong.
+  for (const key of ["fiveHourPercent", "fiveHourResetAt", "weeklyPercent", "monthlyPercent", "weeklyResetAt", "monthlyResetAt", "shortPercent", "shortResetAt", "shortWindowSeconds"] as const) {
     if (typeof quota[key] === "number" && Number.isFinite(quota[key])) projected[key] = quota[key];
   }
   return projected;
@@ -164,6 +259,7 @@ export async function fetchCodexRows(
   deps: AccountDeps,
   baseUrl: string,
   forceRefresh = false,
+  includeQuota = forceRefresh,
 ): Promise<FamilyRows> {
   const accountsPath = `/api/codex-auth/accounts${forceRefresh ? "?refresh=1" : ""}`;
   const [accountsRes, activeRes] = await Promise.all([
@@ -177,7 +273,13 @@ export async function fetchCodexRows(
     return { rows: [], activeId: null, status: activeRes.status, errorJson: activeRes.json };
   }
   if (accountsRes.status === 0 || activeRes.status === 0) {
-    return { rows: [], activeId: null, status: 0, networkDown: true };
+    return {
+      rows: [],
+      activeId: null,
+      status: 0,
+      networkDown: true,
+      transportError: accountsRes.transportError ?? activeRes.transportError,
+    };
   }
   const activeId = typeof activeRes.json.activeCodexAccountId === "string"
     ? activeRes.json.activeCodexAccountId
@@ -195,7 +297,9 @@ export async function fetchCodexRows(
     plan: a.plan,
     active: a.id === activeId,
     needsReauth: a.needsReauth,
-    ...(forceRefresh ? { quota: projectQuota(a.quota) } : {}),
+    priority: typeof a.priority === "number" ? a.priority : 0,
+    paused: a.paused === true,
+    ...(includeQuota ? { quota: projectQuota(a.quota) } : {}),
   }));
   return { rows, activeId, autoSwitchThreshold, status: 200 };
 }
@@ -206,11 +310,25 @@ interface OAuthAccountDto {
   email?: string;
   active?: boolean;
   needsReauth?: boolean;
+  quota?: CodexQuotaDto | null;
+  quotaUnavailable?: boolean;
 }
 
-async function fetchOAuthRows(deps: AccountDeps, baseUrl: string, name: string): Promise<FamilyRows> {
-  const res = await apiJson(deps, baseUrl, "GET", `/api/oauth/accounts?provider=${encodeURIComponent(name)}`);
-  if (res.status === 0) return { rows: [], activeId: null, status: 0, networkDown: true };
+async function fetchOAuthRows(
+  deps: AccountDeps,
+  baseUrl: string,
+  name: string,
+  quota?: { refresh?: boolean },
+): Promise<FamilyRows> {
+  // Quota is opt-in: the server probes the upstream once per stored credential when `quota=1`
+  // is present, so the default listing must stay a cheap local read (#2566).
+  const query = quota
+    ? `?provider=${encodeURIComponent(name)}&quota=1${quota.refresh ? "&refresh=1" : ""}`
+    : `?provider=${encodeURIComponent(name)}`;
+  const res = await apiJson(deps, baseUrl, "GET", `/api/oauth/accounts${query}`);
+  if (res.status === 0) {
+    return { rows: [], activeId: null, status: 0, networkDown: true, transportError: res.transportError };
+  }
   if (res.status !== 200) return { rows: [], activeId: null, status: res.status, errorJson: res.json };
   const activeId = typeof res.json.activeAccountId === "string" ? res.json.activeAccountId : null;
   const accounts = Array.isArray(res.json.accounts) ? res.json.accounts as OAuthAccountDto[] : [];
@@ -222,6 +340,8 @@ async function fetchOAuthRows(deps: AccountDeps, baseUrl: string, name: string):
     email: a.email,
     active: a.active ?? a.id === activeId,
     needsReauth: a.needsReauth,
+    ...(a.quota !== undefined ? { quota: a.quota } : {}),
+    ...(a.quotaUnavailable !== undefined ? { quotaUnavailable: a.quotaUnavailable } : {}),
   }));
   return { rows, activeId, status: 200 };
 }
@@ -235,7 +355,9 @@ interface ApiKeyDto {
 
 async function fetchKeyRows(deps: AccountDeps, baseUrl: string, name: string): Promise<FamilyRows> {
   const res = await apiJson(deps, baseUrl, "GET", `/api/providers/keys?name=${encodeURIComponent(name)}`);
-  if (res.status === 0) return { rows: [], activeId: null, status: 0, networkDown: true };
+  if (res.status === 0) {
+    return { rows: [], activeId: null, status: 0, networkDown: true, transportError: res.transportError };
+  }
   if (res.status !== 200) return { rows: [], activeId: null, status: res.status, errorJson: res.json };
   const activeId = typeof res.json.activeId === "string" ? res.json.activeId : null;
   const keys = Array.isArray(res.json.keys) ? res.json.keys as ApiKeyDto[] : [];
@@ -250,9 +372,15 @@ async function fetchKeyRows(deps: AccountDeps, baseUrl: string, name: string): P
   return { rows, activeId, status: 200 };
 }
 
-export function fetchRows(deps: AccountDeps, baseUrl: string, name: string, type: AccountType): Promise<FamilyRows> {
-  if (type === "codex") return fetchCodexRows(deps, baseUrl);
-  if (type === "oauth") return fetchOAuthRows(deps, baseUrl, name);
+export function fetchRows(
+  deps: AccountDeps,
+  baseUrl: string,
+  name: string,
+  type: AccountType,
+  quota?: { refresh?: boolean },
+): Promise<FamilyRows> {
+  if (type === "codex") return fetchCodexRows(deps, baseUrl, Boolean(quota?.refresh), quota !== undefined);
+  if (type === "oauth") return fetchOAuthRows(deps, baseUrl, name, quota);
   return fetchKeyRows(deps, baseUrl, name);
 }
 
@@ -260,8 +388,11 @@ export async function fetchProviderQuotaReport(
   deps: AccountDeps,
   baseUrl: string,
   name: string,
-): Promise<{ status: number; report: ProviderQuotaReportDto | null; errorJson?: Record<string, unknown> }> {
+): Promise<{ status: number; report: ProviderQuotaReportDto | null; errorJson?: Record<string, unknown>; transportError?: string }> {
   const res = await apiJson(deps, baseUrl, "GET", "/api/provider-quotas?refresh=1");
+  if (res.status === 0) {
+    return { status: 0, report: null, errorJson: res.json, transportError: res.transportError };
+  }
   if (res.status !== 200) return { status: res.status, report: null, errorJson: res.json };
   const reports = Array.isArray(res.json.reports) ? res.json.reports as ProviderQuotaReportDto[] : [];
   return { status: 200, report: reports.find(report => report?.provider === name) ?? null };

package/src/cli/account-auth.ts

@@ -1,3 +1,5 @@
+import { writeSync } from "node:fs";
+import { warnIfCodexCatalogRefreshPending } from "./account-catalog-refresh";
 import {
   CliUsageError,
   printData,
@@ -12,6 +14,22 @@ import {
   type RuntimeApiDeps,
 } from "./runtime-api";
 
+/**
+ * Write the whole block to fd 1 synchronously (#1007). `console.log` can
+ * buffer behind a pipe, which hid the authorization URL for the entire
+ * polling window under non-TTY stdout. A partial write loops; a zero-byte
+ * write is a hard failure, never silent progress.
+ */
+function writeStdoutFully(text: string): void {
+  const bytes = Buffer.from(text, "utf8");
+  let offset = 0;
+  while (offset < bytes.length) {
+    const written = writeSync(1, bytes, offset, bytes.length - offset);
+    if (written <= 0) throw new CliUsageError("failed to write login instructions to stdout");
+    offset += written;
+  }
+}
+
 const USAGE = `Usage:
   ocx account login <provider> [--id <account-id>] [--reauth] [--code -] [--no-wait] [--json]
   ocx account code <provider> [--flow <flow-id>] [--json]   (reads the code from stdin)
@@ -82,9 +100,14 @@ async function login(argv: string[], deps: RuntimeApiDeps): Promise<void> {
       body: JSON.stringify({ ...(id ? { id } : {}), ...(reauth ? { reauth: true } : {}) }),
     }, deps);
     if (!wantsJson) {
-      if (start.url) console.log(`Open this URL to sign in:\n${start.url}`);
-      if (start.instructions) console.log(start.instructions);
-      if (start.flowId) console.log(`Flow: ${start.flowId}`);
+      // One atomic pre-poll block, flushed synchronously so a piped parent
+      // reads the URL before the polling window starts (#1007).
+      const block = [
+        start.url ? `Open this URL to sign in:\n${start.url}` : "",
+        start.instructions ?? "",
+        start.flowId ? `Flow: ${start.flowId}` : "",
+      ].filter(line => line !== "").join("\n");
+      if (block) writeStdoutFully(`${block}\n`);
     }
     if (code && start.flowId) {
       await runtimeRequest("/api/codex-auth/login/code", {
@@ -105,6 +128,7 @@ async function login(argv: string[], deps: RuntimeApiDeps): Promise<void> {
       );
       if (state.status === "done") {
         printData(state, wantsJson, [`Logged in${state.email ? ` as ${String(state.email)}` : ""}.`]);
+        if (!wantsJson) warnIfCodexCatalogRefreshPending(state);
         return;
       }
       if (state.status === "error" || state.status === "expired") {
@@ -120,9 +144,12 @@ async function login(argv: string[], deps: RuntimeApiDeps): Promise<void> {
     body: JSON.stringify({ provider, addAccount: !reauth, ...(reauth && id ? { accountId: id, reauth: true } : {}) }),
   }, deps);
   if (!wantsJson) {
-    if (start.url) console.log(`Open this URL to sign in:\n${start.url}`);
-    if (start.instructions) console.log(start.instructions);
-    if (start.deviceCode) console.log(`Device code: ${start.deviceCode}`);
+    const block = [
+      start.url ? `Open this URL to sign in:\n${start.url}` : "",
+      start.instructions ?? "",
+      start.deviceCode ? `Device code: ${start.deviceCode}` : "",
+    ].filter(line => line !== "").join("\n");
+    if (block) writeStdoutFully(`${block}\n`);
   }
   if (code) {
     await runtimeRequest("/api/oauth/login/code", {

package/src/cli/account-catalog-refresh.ts

@@ -0,0 +1,14 @@
+export const CODEX_CATALOG_REFRESH_PENDING_WARNING =
+  "Warning: the account change was saved, but the Codex model catalog refresh is pending. Run 'ocx sync' to retry.";
+
+/** Read only the public completion flag from an account mutation response. */
+export function codexCatalogRefreshPending(value: unknown): boolean {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+  const descriptor = Object.getOwnPropertyDescriptor(value, "catalogRefreshPending");
+  return descriptor !== undefined && "value" in descriptor && descriptor.value === true;
+}
+
+/** Print fixed recovery guidance without reflecting server or account details. */
+export function warnIfCodexCatalogRefreshPending(value: unknown): void {
+  if (codexCatalogRefreshPending(value)) console.error(CODEX_CATALOG_REFRESH_PENDING_WARNING);
+}