@opengeni/api-router 0.30.3 → 1.0.0

package/src/routes/codex.ts

@@ -7,14 +7,19 @@
 // is added to isAuthExempt. Secrets never leave the server: status/usage read the
 // decrypted token only to call the codex backend; the token is never returned.
 
-import { environmentsEncryptionKeyBytes } from "@opengeni/config";
+import {
+  environmentsEncryptionKeyBytes,
+  configuredModels,
+  getSettings,
+  productLabelForModelId,
+  withCodexCatalogProvider,
+  type Settings,
+} from "@opengeni/config";
 import {
   accessTokenExpiry,
   buildCodexUsageWindowFromCache,
   CODEX_CLIENT_VERSION,
-  CODEX_FALLBACK_MODEL_SLUGS,
   CODEX_FIVE_HOUR_WINDOW_SECONDS,
-  CODEX_MODEL_ID_PREFIX,
   CODEX_PROVIDER_ID,
   CODEX_WEEKLY_WINDOW_SECONDS,
   CodexDeviceError,
@@ -39,8 +44,10 @@ import {
   designateCodexAppsCredential,
   disconnectAllCodexAccounts,
   disconnectCodexAccount,
+  disconnectOrganizationCodexAccount,
   encryptEnvironmentValue,
   ensureCodexRotationSettings,
+  ensureOrganizationCodexRotationSettings,
   fetchCodexUsageForAccount,
   fetchCodexRateLimitResetCreditsForAccount,
   fenceCodexResetRedemptionSend,
@@ -48,18 +55,30 @@ import {
   getCodexCredentialStatus,
   getCodexAppsSettings,
   getCodexRotationSettings,
+  getOrganizationCodexRotationSettings,
+  getWorkspaceCodexSubscriptionSource,
   listPendingCodexCapacityWakeTargets,
   listCodexAccountStatuses,
+  listOrganizationCodexAccountStatuses,
   listCodexResetRedemptionRecoveries,
+  nestedPostgresSqlState,
   releaseCodexResetRedemptionClaim,
   updateCodexAllocatorEligibility,
   loadCodexCredentialForRun,
   renameCodexAccount,
+  renameOrganizationCodexAccount,
   setActiveCodexCredential,
+  setActiveOrganizationCodexCredential,
   setInitialActiveCodexCredential,
+  setWorkspaceCodexSubscriptionMode,
+  setWorkspaceCodexSubscriptionModeInTransaction,
+  updateOrganizationCodexRotationSettings,
   updateCodexRotationSettings,
+  upsertOrganizationCodexSubscriptionCredential,
   upsertCodexSubscriptionCredential,
   withCodexCapacityMutation,
+  withSessionCodexCapacityMutation,
+  activeCodexPlanExclusions,
   type CodexAccountStatus,
   type CodexCapacityWakeTarget,
 } from "@opengeni/db";
@@ -71,7 +90,7 @@ const CODEX_PROVIDER_LABEL = "Codex subscription · no credits";
 // The wire shape for one Codex account (metadata only; never the secret column).
 // P2: fiveHour/weekly ride along, built from the CACHED usage columns (zero
 // provider calls, zero decrypts) so the bars render instantly off this read.
-function codexAccountJson(
+export function codexAccountJson(
   row: CodexAccountStatus,
   options: {
     appsCredentialId?: string | null;
@@ -81,10 +100,25 @@ function codexAccountJson(
 ) {
   return {
     id: row.id,
+    source: row.source,
     chatgptAccountId: row.chatgptAccountId,
     label: row.label,
     email: row.accountEmail,
     plan: row.planType,
+    planCheckedAt: row.planCheckedAt ?? null,
+    // The most recent observed plan change (for example "pro" before a move to
+    // "free"), kept as evidence until the plan changes again.
+    planChangedFrom: row.planPreviousType ?? null,
+    planChangedAt: row.planChangedAt ?? null,
+    // Models the CURRENT plan was proven not to include. Each leaves automatic
+    // selection until `retryAfter` (one request then re-checks it) or until a
+    // different plan is observed (refresh usage after an upgrade).
+    planExcludedModels: activeCodexPlanExclusions(row, new Date()).map((entry) => ({
+      model: entry.modelId,
+      label: productLabelForModelId(entry.modelId),
+      excludedAt: entry.excludedAt,
+      retryAfter: entry.expiresAt,
+    })),
     status: row.status,
     active: row.isActive,
     expiresAt: row.expiresAt,
@@ -110,6 +144,7 @@ function codexAccountJson(
     exhaustedUntil: row.exhaustedUntil,
     appsDesignated: options.appsCredentialId === row.id,
     canEnableApps:
+      row.source === "workspace" &&
       options.appsCredentialId === null &&
       options.canManageApps === true &&
       options.humanSubjectId !== null &&
@@ -119,6 +154,55 @@ function codexAccountJson(
   };
 }
 
+/**
+ * Derive the two distinct cached worker-readiness meanings exposed by the
+ * status route. `poolReady` means at least one effective-pool account passes
+ * the worker's cached admission predicate. `workerRoutable` additionally
+ * honors rotation-off's active-pointer-only rule; it says nothing about a
+ * session-specific manual pin.
+ */
+export function codexWorkerReadiness(input: {
+  effectiveSource: "workspace" | "organization" | "disabled";
+  rotationEnabled: boolean;
+  activeCredentialId: string | null;
+  accounts: ReadonlyArray<
+    Pick<
+      CodexAccountStatus,
+      | "id"
+      | "status"
+      | "allocatorEnabled"
+      | "primaryUsedPercent"
+      | "primaryResetAt"
+      | "secondaryUsedPercent"
+      | "secondaryResetAt"
+      | "exhaustedUntil"
+    >
+  >;
+  now: Date;
+}): { poolReady: boolean; workerRoutable: boolean } {
+  if (input.effectiveSource === "disabled") {
+    return { poolReady: false, workerRoutable: false };
+  }
+  const windowUsed = (used: number | null, resetAt: Date | null): number =>
+    resetAt !== null && resetAt.getTime() <= input.now.getTime() ? 0 : (used ?? 0);
+  const eligible = (account: (typeof input.accounts)[number]): boolean =>
+    account.status === "active" &&
+    account.allocatorEnabled &&
+    (account.exhaustedUntil === null || account.exhaustedUntil.getTime() <= input.now.getTime()) &&
+    Math.max(
+      windowUsed(account.primaryUsedPercent, account.primaryResetAt),
+      windowUsed(account.secondaryUsedPercent, account.secondaryResetAt),
+    ) < 100;
+  const poolReady = input.accounts.some(eligible);
+  const activePointerReady = input.accounts.some(
+    (account) => account.id === input.activeCredentialId && eligible(account),
+  );
+  return {
+    poolReady,
+    workerRoutable: input.rotationEnabled ? poolReady : activePointerReady,
+  };
+}
+
 // The /codex/usage{,/refresh,/:id} wire wrapper: the rich normalized payload
 // carries its own `status`, surfaced at the top level for back-compat with the
 // existing CodexUsage = { status; usage } shape.
@@ -129,35 +213,48 @@ function codexUsageJson(payload: CodexUsagePayload): {
   return { status: payload.status, usage: payload };
 }
 
-export function codexModelsForPicker(liveSlugs: readonly string[]): Array<{
+export function codexModelsForPicker(
+  settings: Settings = getSettings(),
+  supportedSlugs?: readonly string[],
+): Array<{
   id: string;
   label: string;
   provider: string;
   providerLabel: string;
   api: "responses";
 }> {
-  const available = new Set(liveSlugs);
-  const missing = CODEX_FALLBACK_MODEL_SLUGS.filter((slug) => !available.has(slug));
-  if (missing.length > 0) {
-    throw new Error(`Codex catalog is missing required models: ${missing.join(", ")}`);
-  }
-  return CODEX_FALLBACK_MODEL_SLUGS.map((slug) => ({
-    id: `${CODEX_MODEL_ID_PREFIX}${slug}`,
-    label: slug.replace(/^gpt-/, "GPT-"),
-    provider: CODEX_PROVIDER_ID,
-    providerLabel: CODEX_PROVIDER_LABEL,
-    api: "responses" as const,
-  }));
+  return configuredModels(withCodexCatalogProvider(settings))
+    .filter(
+      (model) =>
+        model.providerId === CODEX_PROVIDER_ID &&
+        (supportedSlugs === undefined || supportedSlugs.includes(model.upstreamModelId)),
+    )
+    .map((model) => ({
+      id: model.id,
+      label: model.label,
+      provider: CODEX_PROVIDER_ID,
+      providerLabel: CODEX_PROVIDER_LABEL,
+      api: "responses" as const,
+    }));
 }
 import { createSignedState, readSignedState } from "@opengeni/github";
 import {
   getManagedSession,
   hasPermission,
   requireAccessGrant,
+  requireCanonicalLocalAccountAdministrator,
+  resolveCatalogSettings,
   type ApiRouteDeps,
 } from "@opengeni/core";
 import type { Context, Hono } from "hono";
 import { HTTPException } from "hono/http-exception";
+import {
+  agentActingAsPerson,
+  agentActingAsPersonBeforeGrantCheck,
+  isAgentActingAsPerson,
+  organizationSettingsPermission,
+  requireNotAgent,
+} from "../http/acting-person";
 import * as z from "zod/v4";
 import {
   hashCodexBrowserSession,
@@ -183,7 +280,7 @@ type ManagedCookieHuman = {
   browserSessionHash: string;
 };
 
-async function managedCookieHuman(
+export async function managedCookieHuman(
   c: Context,
   deps: ApiRouteDeps,
 ): Promise<ManagedCookieHuman | null> {
@@ -195,7 +292,11 @@ async function managedCookieHuman(
   ) {
     return null;
   }
-  const session = await getManagedSession(c, deps.managedAuth);
+  const session = await getManagedSession(c, deps.managedAuth, {
+    db: deps.db,
+    sessionAdapter: deps.managedAuthSessionAdapter,
+    sessionSetMode: deps.settings.managedAuthSessionSetMode,
+  });
   if (!session?.user?.id || !session.session?.id) return null;
   return {
     subjectId: `user:${session.user.id}`,
@@ -203,31 +304,202 @@ async function managedCookieHuman(
   };
 }
 
-function requireSameOriginBrowserMutation(c: Context, deps: ApiRouteDeps): void {
+/**
+ * The person in this browser, or an agent acting as them. Only for routes that
+ * then require the same person's workspace grant; provider sign-in steps keep
+ * managedCookieHuman. An agent has no browser session, so its hash never
+ * matches a sign-in started in one.
+ */
+export async function managedHumanOrAgent(
+  c: Context,
+  deps: ApiRouteDeps,
+): Promise<ManagedCookieHuman | null> {
+  const human = await managedCookieHuman(c, deps);
+  if (human) return human;
+  const agent = agentActingAsPersonBeforeGrantCheck(c);
+  return agent
+    ? {
+        subjectId: agent.subjectId,
+        browserSessionHash: await hashCodexBrowserSession(`agent:${crypto.randomUUID()}`),
+      }
+    : null;
+}
+
+export async function requireOrganizationCodexHuman(
+  c: Context,
+  deps: ApiRouteDeps,
+  organizationId: string,
+  options: {
+    /** A provider sign-in step: the person does it in the browser, never an agent. */
+    providerConsent?: boolean;
+  } = {},
+): Promise<ManagedCookieHuman> {
+  if (options.providerConsent) requireNotAgent(c, "Signing in to a provider");
+  const parsed = z.string().uuid().safeParse(organizationId);
+  if (!parsed.success) throw new HTTPException(422, { message: "invalid organization id" });
+  let human = await managedCookieHuman(c, deps);
+  if (!human) {
+    const agent = agentActingAsPerson(c, parsed.data, organizationSettingsPermission(c));
+    // An agent has no browser session, so it never matches a sign-in started in one.
+    if (agent) {
+      human = {
+        subjectId: agent.subjectId,
+        browserSessionHash: await hashCodexBrowserSession(`agent:${crypto.randomUUID()}`),
+      };
+    }
+  }
+  if (!human && deps.settings.productAccessMode === "local") {
+    const local = await requireCanonicalLocalAccountAdministrator(c, deps, organizationId);
+    human = {
+      subjectId: local.subjectId,
+      browserSessionHash: await hashCodexBrowserSession(`local:${local.subjectId}`),
+    };
+  }
+  if (!human) {
+    throw new HTTPException(401, {
+      message: "organization administrator session required",
+    });
+  }
+  try {
+    await getOrganizationCodexRotationSettings(deps.db, {
+      organizationId,
+      actorSubjectId: human.subjectId,
+    });
+  } catch (error) {
+    const state = nestedPostgresSqlState(error);
+    if (state === "42501") {
+      throw new HTTPException(403, {
+        message: "organization administration is not authorized",
+      });
+    }
+    if (state === "P0002") {
+      throw new HTTPException(404, { message: "organization not found" });
+    }
+    throw error;
+  }
+  return human;
+}
+
+async function requireWorkspaceCodexManagementSource(
+  deps: ApiRouteDeps,
+  workspaceId: string,
+): Promise<void> {
+  const source = await getWorkspaceCodexSubscriptionSource(deps.db, workspaceId);
+  if (source.effectiveSource === "organization") {
+    throw new HTTPException(409, {
+      message: "this Codex subscription is managed in Organization settings",
+    });
+  }
+  if (source.effectiveSource === "disabled") {
+    throw new HTTPException(409, {
+      message: "Codex is disabled for this workspace",
+    });
+  }
+}
+
+export function requireSameOriginBrowserMutation(c: Context, deps: ApiRouteDeps): void {
+  // Built in process for an agent acting as a person: no browser credentials
+  // ride along, so there is no cross-site request to guard against.
+  if (isAgentActingAsPerson(c)) return;
   const contentType = c.req.header("content-type")?.split(";", 1)[0]?.trim().toLowerCase();
   if (contentType !== "application/json") {
     throw new HTTPException(403, {
       message: "JSON browser request required",
     });
   }
-  if (!deps.settings.publicBaseUrl) {
+  if (deps.settings.productAccessMode !== "local" && !deps.settings.publicBaseUrl) {
     throw new HTTPException(503, {
       message: "managed browser origin is not configured",
     });
   }
-  const expectedOrigin = new URL(deps.settings.publicBaseUrl).origin;
-  if (c.req.header("origin") !== expectedOrigin) {
+  const origin = c.req.header("origin");
+  const localOriginMatches =
+    deps.settings.productAccessMode === "local" && localBrowserOriginMatchesRequest(c, origin);
+  if (
+    deps.settings.productAccessMode === "local"
+      ? !localOriginMatches
+      : origin !== new URL(deps.settings.publicBaseUrl!).origin
+  ) {
     throw new HTTPException(403, {
       message: "same-origin browser request required",
     });
   }
-  if (c.req.header("sec-fetch-site")?.toLowerCase() !== "same-origin") {
+  const fetchSite = c.req.header("sec-fetch-site")?.toLowerCase();
+  const localFetchSiteMatches =
+    localOriginMatches &&
+    (fetchSite === "same-origin" ||
+      fetchSite === "same-site" ||
+      (fetchSite === "cross-site" && localLoopbackOriginMatchesRequest(c, origin)));
+  if (
+    deps.settings.productAccessMode === "local"
+      ? !localFetchSiteMatches
+      : fetchSite !== "same-origin"
+  ) {
     throw new HTTPException(403, {
       message: "same-origin fetch metadata required",
     });
   }
 }
 
+function localBrowserOriginMatchesRequest(c: Context, value: string | undefined): boolean {
+  if (!value) return false;
+  let origin: URL;
+  try {
+    origin = new URL(value);
+  } catch {
+    return false;
+  }
+  if (
+    origin.origin !== value ||
+    origin.origin === "null" ||
+    (origin.protocol !== "http:" && origin.protocol !== "https:")
+  ) {
+    return false;
+  }
+
+  const forwardedProtocol = c.req.header("x-forwarded-proto")?.trim().toLowerCase();
+  const protocol = forwardedProtocol ? `${forwardedProtocol}:` : new URL(c.req.url).protocol;
+  if (protocol !== "http:" && protocol !== "https:") return false;
+  const forwardedHost = c.req.header("x-forwarded-host") ?? c.req.header("host");
+  if (!forwardedHost || /[\s,/?#@\\]/u.test(forwardedHost)) return false;
+
+  let request: URL;
+  try {
+    request = new URL(`${protocol}//${forwardedHost}`);
+  } catch {
+    return false;
+  }
+  return (
+    origin.protocol === request.protocol &&
+    (origin.hostname === request.hostname ||
+      (isLoopbackHostname(origin.hostname) && isLoopbackHostname(request.hostname)))
+  );
+}
+
+function localLoopbackOriginMatchesRequest(c: Context, value: string | undefined): boolean {
+  if (!value) return false;
+  try {
+    const origin = new URL(value);
+    const forwardedProtocol = c.req.header("x-forwarded-proto")?.trim().toLowerCase();
+    const protocol = forwardedProtocol ? `${forwardedProtocol}:` : new URL(c.req.url).protocol;
+    const forwardedHost = c.req.header("x-forwarded-host") ?? c.req.header("host");
+    if (!forwardedHost || /[\s,/?#@\\]/u.test(forwardedHost)) return false;
+    const request = new URL(`${protocol}//${forwardedHost}`);
+    return (
+      origin.origin === value &&
+      origin.protocol === request.protocol &&
+      isLoopbackHostname(origin.hostname) &&
+      isLoopbackHostname(request.hostname)
+    );
+  } catch {
+    return false;
+  }
+}
+
+function isLoopbackHostname(value: string): boolean {
+  return value === "localhost" || value === "[::1]" || /^127(?:\.[0-9]{1,3}){3}$/u.test(value);
+}
+
 async function requireRedemptionHuman(
   c: Context,
   deps: ApiRouteDeps,
@@ -248,13 +520,13 @@ async function requireRedemptionHuman(
     });
   }
   requireSameOriginBrowserMutation(c, deps);
-  const human = await managedCookieHuman(c, deps);
+  const human = await managedHumanOrAgent(c, deps);
   if (!human) {
     throw new HTTPException(401, {
       message: "managed browser session required",
     });
   }
-  const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+  const grant = await requireAccessGrant(c, deps, workspaceId, "connections:write");
   if (grant.subjectId !== human.subjectId) {
     throw new HTTPException(403, {
       message: "managed browser identity mismatch",
@@ -274,13 +546,17 @@ async function requireCodexAppsHuman(
     });
   }
   requireSameOriginBrowserMutation(c, deps);
-  const human = await managedCookieHuman(c, deps);
+  const human = await managedHumanOrAgent(c, deps);
   if (!human) {
-    throw new HTTPException(401, { message: "managed browser session required" });
+    throw new HTTPException(401, {
+      message: "managed browser session required",
+    });
   }
   const grant = await requireAccessGrant(c, deps, workspaceId, "connections:write");
   if (grant.subjectId !== human.subjectId) {
-    throw new HTTPException(403, { message: "managed browser identity mismatch" });
+    throw new HTTPException(403, {
+      message: "managed browser identity mismatch",
+    });
   }
   return { human, accountId: grant.accountId };
 }
@@ -386,10 +662,46 @@ function createProviderCallLimiter(limit: number): CodexProviderCall {
   };
 }
 
+type CodexRedemptionAccess = {
+  ownership: "current_human" | "unowned" | "different_human" | "managed_human_unavailable";
+  canClaimUnownedViaReconnect: boolean;
+};
+
+function codexRedemptionAccess(input: {
+  connectedBySubjectId: string | null;
+  grantSubjectId: string;
+  managedHumanSubjectId: string | null;
+  canManage: boolean;
+}): CodexRedemptionAccess {
+  if (
+    input.managedHumanSubjectId === null ||
+    input.managedHumanSubjectId !== input.grantSubjectId
+  ) {
+    return {
+      ownership: "managed_human_unavailable",
+      canClaimUnownedViaReconnect: false,
+    };
+  }
+  if (input.connectedBySubjectId === null) {
+    return {
+      ownership: "unowned",
+      canClaimUnownedViaReconnect: input.canManage,
+    };
+  }
+  return {
+    ownership:
+      input.connectedBySubjectId === input.managedHumanSubjectId
+        ? "current_human"
+        : "different_human",
+    canClaimUnownedViaReconnect: false,
+  };
+}
+
 async function fetchCodexAccountOverview(
   deps: ApiRouteDeps,
   workspaceId: string,
   row: CodexAccountStatus,
+  redemptionAccess: CodexRedemptionAccess,
   canRedeem: boolean,
   canResumeRedemption: boolean,
   redemptions: Awaited<ReturnType<typeof listCodexResetRedemptionRecoveries>> = [],
@@ -496,6 +808,7 @@ async function fetchCodexAccountOverview(
       })),
     },
     canRedeem,
+    redemptionAccess,
     canResumeRedemption,
     redemptions: redemptions.map((redemption) => ({
       attemptId: redemption.attemptId,
@@ -512,6 +825,8 @@ async function fetchCodexAccountOverview(
 
 type CodexConnectState = {
   workspaceId?: string;
+  organizationId?: string;
+  actorSubjectId?: string;
   deviceAuthId?: string;
   userCode?: string;
   iat?: number;
@@ -556,11 +871,306 @@ const CODEX_DEVICE_EXPIRY_SECONDS = 15 * 60; // the device code expires 15 min a
 export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
   const { db, settings, githubStateSecret } = deps;
 
+  app.get("/v1/workspaces/:workspaceId/codex/source", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    await requireAccessGrant(c, deps, workspaceId, "workspace:read");
+    return c.json(await getWorkspaceCodexSubscriptionSource(db, workspaceId));
+  });
+
+  app.patch("/v1/workspaces/:workspaceId/codex/source", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "connections:write");
+    const parsed = z
+      .object({
+        mode: z.enum(["automatic", "workspace", "organization", "disabled"]),
+      })
+      .safeParse(await c.req.json().catch(() => null));
+    if (!parsed.success) {
+      throw new HTTPException(400, {
+        message: "a valid Codex source mode is required",
+      });
+    }
+    try {
+      return c.json(
+        await setWorkspaceCodexSubscriptionMode(db, {
+          accountId: grant.accountId,
+          workspaceId,
+          subjectId: grant.subjectId,
+          mode: parsed.data.mode,
+        }),
+      );
+    } catch (error) {
+      if (
+        error instanceof Error &&
+        (error.message.includes("personal workspaces") ||
+          error.message.includes("active turns are using it"))
+      ) {
+        throw new HTTPException(409, { message: error.message });
+      }
+      throw error;
+    }
+  });
+
+  app.get("/v1/organizations/:organizationId/codex/accounts", async (c) => {
+    const organizationId = c.req.param("organizationId");
+    const human = await requireOrganizationCodexHuman(c, deps, organizationId);
+    const [accounts, rotation] = await Promise.all([
+      listOrganizationCodexAccountStatuses(db, {
+        organizationId,
+        actorSubjectId: human.subjectId,
+      }),
+      getOrganizationCodexRotationSettings(db, {
+        organizationId,
+        actorSubjectId: human.subjectId,
+      }),
+    ]);
+    return c.json({
+      accounts: accounts.map((account) => codexAccountJson(account)),
+      activeAccountId: rotation?.activeCredentialId ?? null,
+      settings: {
+        rotationEnabled: rotation?.rotationEnabled ?? false,
+        rotationStrategy: "sharded",
+        activeCredentialId: rotation?.activeCredentialId ?? null,
+      },
+    });
+  });
+
+  app.post("/v1/organizations/:organizationId/codex/connect/start", async (c) => {
+    const organizationId = c.req.param("organizationId");
+    requireSameOriginBrowserMutation(c, deps);
+    const human = await requireOrganizationCodexHuman(c, deps, organizationId, {
+      providerConsent: true,
+    });
+    let start: Awaited<ReturnType<typeof startDeviceCode>>;
+    try {
+      start = await startDeviceCode();
+    } catch (error) {
+      throw new HTTPException(502, {
+        message:
+          error instanceof CodexDeviceError ? error.message : "failed to start Codex device login",
+      });
+    }
+    return c.json({
+      userCode: start.userCode,
+      verificationUri: start.verificationUri,
+      intervalSeconds: start.intervalSeconds,
+      state: createSignedState(githubStateSecret, {
+        organizationId,
+        actorSubjectId: human.subjectId,
+        deviceAuthId: start.deviceAuthId,
+        userCode: start.userCode,
+      }),
+    });
+  });
+
+  app.post("/v1/organizations/:organizationId/codex/connect/poll", async (c) => {
+    const organizationId = c.req.param("organizationId");
+    requireSameOriginBrowserMutation(c, deps);
+    const human = await requireOrganizationCodexHuman(c, deps, organizationId, {
+      providerConsent: true,
+    });
+    const { state } = (await c.req.json().catch(() => null)) as {
+      state?: string;
+    };
+    const payload = (state
+      ? readSignedState(state, githubStateSecret)
+      : null) as unknown as CodexConnectState | null;
+    if (
+      !payload ||
+      payload.organizationId !== organizationId ||
+      payload.actorSubjectId !== human.subjectId ||
+      !payload.deviceAuthId ||
+      !payload.userCode
+    ) {
+      throw new HTTPException(400, {
+        message: "codex connect state is invalid or expired",
+      });
+    }
+    if (
+      typeof payload.iat === "number" &&
+      Date.now() / 1000 - payload.iat > CODEX_DEVICE_EXPIRY_SECONDS
+    ) {
+      return c.json({ status: "expired" });
+    }
+    let poll: Awaited<ReturnType<typeof pollDeviceCode>>;
+    try {
+      poll = await pollDeviceCode({
+        deviceAuthId: payload.deviceAuthId,
+        userCode: payload.userCode,
+      });
+    } catch (error) {
+      throw new HTTPException(502, {
+        message: error instanceof CodexDeviceError ? error.message : "codex device poll failed",
+      });
+    }
+    if (poll.status === "pending") return c.json({ status: "pending" });
+    if (poll.status === "expired") return c.json({ status: "expired" });
+    let tokens: Awaited<ReturnType<typeof exchangeDeviceCode>>;
+    try {
+      tokens = await exchangeDeviceCode({
+        authorizationCode: poll.authorizationCode,
+        codeVerifier: poll.codeVerifier,
+      });
+    } catch (error) {
+      throw new HTTPException(502, {
+        message: error instanceof CodexDeviceError ? error.message : "codex token exchange failed",
+      });
+    }
+    const key = environmentsEncryptionKeyBytes(settings);
+    if (!key) {
+      throw new HTTPException(500, {
+        message: "OPENGENI_ENVIRONMENTS_ENCRYPTION_KEY is not configured",
+      });
+    }
+    const id = parseIdToken(tokens.idToken);
+    await ensureOrganizationCodexRotationSettings(db, {
+      organizationId,
+      actorSubjectId: human.subjectId,
+    });
+    let upserted: Awaited<ReturnType<typeof upsertOrganizationCodexSubscriptionCredential>>;
+    try {
+      upserted = await upsertOrganizationCodexSubscriptionCredential(db, {
+        organizationId,
+        actorSubjectId: human.subjectId,
+        credentialEncrypted: encryptEnvironmentValue(
+          key,
+          JSON.stringify({
+            access_token: tokens.accessToken,
+            refresh_token: tokens.refreshToken,
+            id_token: tokens.idToken,
+          }),
+        ),
+        chatgptAccountId: id.chatgptAccountId,
+        scopes: null,
+        planType: id.planType,
+        isFedramp: id.isFedramp,
+        expiresAt: accessTokenExpiry(tokens.accessToken),
+        lastRefreshAt: new Date(),
+        accountEmail: id.email ?? null,
+        label: id.email ?? id.chatgptAccountId ?? null,
+      });
+    } catch (error) {
+      const cause = (error as { cause?: unknown } | null)?.cause;
+      const message =
+        cause instanceof Error ? cause.message : error instanceof Error ? error.message : "";
+      if (message.includes("active turns are using it")) {
+        throw new HTTPException(409, {
+          message: "Codex subscription source cannot change while active turns are using it",
+        });
+      }
+      throw error;
+    }
+    await signalCodexCapacityTargets(deps, upserted.wakeTargets);
+    const rotation = await getOrganizationCodexRotationSettings(db, {
+      organizationId,
+      actorSubjectId: human.subjectId,
+    });
+    return c.json({
+      status: "connected",
+      plan: id.planType,
+      accountId: upserted.id,
+      isActive: rotation?.activeCredentialId === upserted.id,
+    });
+  });
+
+  app.post("/v1/organizations/:organizationId/codex/accounts/:accountId/activate", async (c) => {
+    const organizationId = c.req.param("organizationId");
+    requireSameOriginBrowserMutation(c, deps);
+    const human = await requireOrganizationCodexHuman(c, deps, organizationId);
+    const credentialId = c.req.param("accountId");
+    const activation = await setActiveOrganizationCodexCredential(db, {
+      organizationId,
+      actorSubjectId: human.subjectId,
+      credentialId,
+    });
+    if (!activation.activated) {
+      throw new HTTPException(404, { message: "codex account not found" });
+    }
+    await signalCodexCapacityTargets(deps, activation.wakeTargets);
+    return c.json({ activated: true, accountId: credentialId });
+  });
+
+  app.patch("/v1/organizations/:organizationId/codex/settings", async (c) => {
+    const organizationId = c.req.param("organizationId");
+    requireSameOriginBrowserMutation(c, deps);
+    const human = await requireOrganizationCodexHuman(c, deps, organizationId);
+    const parsed = z
+      .object({ rotationEnabled: z.boolean() })
+      .safeParse(await c.req.json().catch(() => null));
+    if (!parsed.success) {
+      throw new HTTPException(400, { message: "rotationEnabled is required" });
+    }
+    const updated = await updateOrganizationCodexRotationSettings(db, {
+      organizationId,
+      actorSubjectId: human.subjectId,
+      rotationEnabled: parsed.data.rotationEnabled,
+    });
+    if (!updated) throw new HTTPException(404, { message: "Codex settings not found" });
+    await signalCodexCapacityTargets(deps, updated.wakeTargets);
+    return c.json({
+      rotationEnabled: updated.rotationEnabled,
+      rotationStrategy: "sharded",
+      activeCredentialId: updated.activeCredentialId,
+    });
+  });
+
+  app.patch("/v1/organizations/:organizationId/codex/accounts/:accountId", async (c) => {
+    const organizationId = c.req.param("organizationId");
+    requireSameOriginBrowserMutation(c, deps);
+    const human = await requireOrganizationCodexHuman(c, deps, organizationId);
+    const body = (await c.req.json().catch(() => null)) as {
+      label?: unknown;
+    } | null;
+    const renamed = await renameOrganizationCodexAccount(db, {
+      organizationId,
+      actorSubjectId: human.subjectId,
+      credentialId: c.req.param("accountId"),
+      label: typeof body?.label === "string" ? body.label : null,
+    });
+    if (!renamed) throw new HTTPException(404, { message: "codex account not found" });
+    const accounts = await listOrganizationCodexAccountStatuses(db, {
+      organizationId,
+      actorSubjectId: human.subjectId,
+    });
+    const row = accounts.find((account) => account.id === c.req.param("accountId"));
+    if (!row) throw new HTTPException(404, { message: "codex account not found" });
+    return c.json(codexAccountJson(row));
+  });
+
+  app.delete("/v1/organizations/:organizationId/codex/accounts/:accountId", async (c) => {
+    const organizationId = c.req.param("organizationId");
+    requireSameOriginBrowserMutation(c, deps);
+    const human = await requireOrganizationCodexHuman(c, deps, organizationId);
+    let result: Awaited<ReturnType<typeof disconnectOrganizationCodexAccount>>;
+    try {
+      result = await disconnectOrganizationCodexAccount(db, {
+        organizationId,
+        actorSubjectId: human.subjectId,
+        credentialId: c.req.param("accountId"),
+      });
+    } catch (error) {
+      const cause = (error as { cause?: unknown } | null)?.cause;
+      const message =
+        cause instanceof Error ? cause.message : error instanceof Error ? error.message : "";
+      if (message.includes("active turns are using it")) {
+        throw new HTTPException(409, {
+          message: "Codex subscription cannot disconnect while active turns are using it",
+        });
+      }
+      throw error;
+    }
+    await signalCodexCapacityTargets(deps, result.wakeTargets);
+    return c.json({
+      disconnected: result.removed,
+      newActiveId: result.newActiveCredentialId,
+    });
+  });
+
   // Begin device-code login: returns the user code + verification URL and a
   // signed state that carries the device_auth_id back to `poll`.
   app.post("/v1/workspaces/:workspaceId/codex/connect/start", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    await requireAccessGrant(c, deps, workspaceId, "connections:write");
     let start: Awaited<ReturnType<typeof startDeviceCode>>;
     try {
       start = await startDeviceCode();
@@ -586,7 +1196,7 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
   // Poll for authorization: pending | expired | connected (persists on success).
   app.post("/v1/workspaces/:workspaceId/codex/connect/poll", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "connections:write");
     const { state } = (await c.req.json()) as { state?: string };
     const payload = (state
       ? readSignedState(state, githubStateSecret)
@@ -647,58 +1257,79 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
         message: "OPENGENI_ENVIRONMENTS_ENCRYPTION_KEY is not configured",
       });
     }
-    await ensureCodexRotationSettings(db, grant.accountId, workspaceId);
-    const mutation = await withCodexCapacityMutation(
-      db,
-      { workspaceId, reason: "codex_credential_connected" },
-      async (tx) => {
-        const upserted = await upsertCodexSubscriptionCredential(tx, {
-          accountId: grant.accountId,
-          workspaceId,
-          credentialEncrypted: encryptEnvironmentValue(
-            key,
-            JSON.stringify({
-              access_token: tokens.accessToken,
-              refresh_token: tokens.refreshToken,
-              id_token: tokens.idToken,
-            }),
-          ),
-          chatgptAccountId: id.chatgptAccountId,
-          scopes: null, // device grant scopes are discovered at runtime, not asserted here
-          planType: id.planType,
-          isFedramp: id.isFedramp,
-          expiresAt: accessTokenExpiry(tokens.accessToken),
-          lastRefreshAt: new Date(),
-          accountEmail: id.email ?? null,
-          label: id.email ?? id.chatgptAccountId ?? null,
-          connectedBySubjectId:
-            connectingHuman?.subjectId === grant.subjectId ? connectingHuman.subjectId : null,
-        });
-        return { result: upserted, changed: upserted.kind === "upserted" };
-      },
-    );
-    const upserted = mutation.result;
+    const mutation = await withSessionCodexCapacityMutation<{
+      upserted: Awaited<ReturnType<typeof upsertCodexSubscriptionCredential>>;
+      isActive: boolean;
+    }>(db, { workspaceId, reason: "codex_credential_connected" }, async (tx) => {
+      // The capacity mutation holds the source lock before entering this callback.
+      const sourceBeforeConnect = await getWorkspaceCodexSubscriptionSource(tx, workspaceId);
+      const upserted = await upsertCodexSubscriptionCredential(tx, {
+        accountId: grant.accountId,
+        workspaceId,
+        credentialEncrypted: encryptEnvironmentValue(
+          key,
+          JSON.stringify({
+            access_token: tokens.accessToken,
+            refresh_token: tokens.refreshToken,
+            id_token: tokens.idToken,
+          }),
+        ),
+        chatgptAccountId: id.chatgptAccountId,
+        scopes: null, // device grant scopes are discovered at runtime, not asserted here
+        planType: id.planType,
+        isFedramp: id.isFedramp,
+        expiresAt: accessTokenExpiry(tokens.accessToken),
+        lastRefreshAt: new Date(),
+        accountEmail: id.email ?? null,
+        label: id.email ?? id.chatgptAccountId ?? null,
+        connectedBySubjectId:
+          connectingHuman?.subjectId === grant.subjectId ? connectingHuman.subjectId : null,
+      });
+      if (upserted.kind === "unresolved_redemption") {
+        return { result: { upserted, isActive: false }, changed: false };
+      }
+      await ensureCodexRotationSettings(tx, grant.accountId, workspaceId);
+      await setInitialActiveCodexCredential(tx, workspaceId, upserted.id);
+      await setWorkspaceCodexSubscriptionModeInTransaction(tx, {
+        accountId: grant.accountId,
+        workspaceId,
+        subjectId: grant.subjectId,
+        // Connecting local capacity does not override an explicit source choice.
+        // Automatic naturally prefers the newly connected workspace pool.
+        mode: sourceBeforeConnect.mode,
+        effectiveSourceBeforeMutation: sourceBeforeConnect.effectiveSource,
+      });
+      const rotation = await getCodexRotationSettings(tx, workspaceId);
+      return {
+        result: {
+          upserted,
+          isActive: rotation?.activeCredentialId === upserted.id,
+        },
+        changed: true,
+      };
+    }).catch((error: unknown) => {
+      const cause = (error as { cause?: unknown } | null)?.cause;
+      const message =
+        cause instanceof Error ? cause.message : error instanceof Error ? error.message : "";
+      if (message.includes("active turns are using it")) {
+        throw new HTTPException(409, { message });
+      }
+      throw error;
+    });
+    const { upserted, isActive } = mutation.result;
     if (upserted.kind === "unresolved_redemption") {
       throw new HTTPException(409, {
         message:
           "this subscription has an unresolved reset redemption; recover it before changing ownership",
       });
     }
-    // Ensure the per-workspace rotation-settings row exists, then auto-activate
-    // the FIRST account only. Additional new accounts do NOT auto-activate — a
-    // manual switch is required (no auto-rotation in P1). A re-connect of the
-    // already-active account is a no-op for the pointer.
-    // Keep both rotation bits false on first connect. The deployment flag makes
-    // the compatible allocator available, but the workspace-local cutover bit
-    // is enabled only by an explicit settings write after every worker replica
-    // understands leasing.
-    const rotation = await getCodexRotationSettings(db, workspaceId);
-    let isActive = rotation?.activeCredentialId === upserted.id;
-    if (!isActive && rotation?.activeCredentialId == null) {
-      isActive = await setInitialActiveCodexCredential(db, workspaceId, upserted.id);
-    }
     await signalCodexCapacityTargets(deps, mutation.wakeTargets);
-    return c.json({ status: "connected", plan: id.planType, accountId: upserted.id, isActive });
+    return c.json({
+      status: "connected",
+      plan: id.planType,
+      accountId: upserted.id,
+      isActive,
+    });
   });
 
   // Connection health: the cheapest real call is GET /codex/models (a 200 proves
@@ -706,12 +1337,13 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
   app.get("/v1/workspaces/:workspaceId/codex/status", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     await requireAccessGrant(c, deps, workspaceId, "workspace:read");
-    const status = await getCodexCredentialStatus(db, workspaceId);
-    if (!status) {
-      return c.json({ connected: false });
-    }
-    const accounts = await listCodexAccountStatuses(db, workspaceId);
-    const activeRow = accounts.find((account) => account.id === status.credentialId) ?? null;
+    const [status, accounts, source, rotation] = await Promise.all([
+      getCodexCredentialStatus(db, workspaceId),
+      listCodexAccountStatuses(db, workspaceId),
+      getWorkspaceCodexSubscriptionSource(db, workspaceId),
+      getCodexRotationSettings(db, workspaceId),
+    ]);
+    const activeRow = accounts.find((account) => account.id === status?.credentialId) ?? null;
     const activeAccount = activeRow
       ? {
           id: activeRow.id,
@@ -723,23 +1355,33 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
           chatgptAccountId: activeRow.chatgptAccountId,
         }
       : null;
+    const activeCredentialId = status?.credentialId ?? rotation?.activeCredentialId ?? null;
+    const readiness = codexWorkerReadiness({
+      effectiveSource: source.effectiveSource,
+      rotationEnabled: rotation?.rotationEnabled ?? false,
+      activeCredentialId,
+      accounts,
+      now: new Date(),
+    });
     let valid = false;
+    const catalogSettings = (await resolveCatalogSettings(db, settings)).settings;
     let models: ReturnType<typeof codexModelsForPicker> = [];
     let catalogError: string | null = null;
     try {
-      const cred = status.credentialId
+      const cred = status?.credentialId
         ? await loadCodexCredentialForRun(db, settings, workspaceId, status.credentialId)
         : null;
       if (cred) {
+        const token = await buildCodexTokenResolver(db, settings, workspaceId, cred.id).getToken();
         const live = await fetchCodexModels({
-          accessToken: cred.tokens.accessToken,
-          chatgptAccountId: cred.chatgptAccountId,
-          isFedramp: cred.isFedramp,
+          accessToken: token.accessToken,
+          chatgptAccountId: token.chatgptAccountId,
+          isFedramp: token.isFedramp,
           clientVersion: CODEX_CLIENT_VERSION,
         });
         if (live.ok) {
-          models = codexModelsForPicker(live.slugs);
           valid = true;
+          models = codexModelsForPicker(catalogSettings, live.slugs);
         } else {
           catalogError = `Codex models request failed with status ${live.status}`;
         }
@@ -749,14 +1391,18 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
       catalogError = error instanceof Error ? error.message : String(error);
     }
     return c.json({
-      connected: status.connected,
-      plan: status.planType,
+      connected: status?.connected ?? false,
+      plan: status?.planType ?? null,
       valid,
-      expiresAt: status.expiresAt,
-      lastError: catalogError ?? status.lastError,
+      activeAccountValid: valid,
+      poolReady: readiness.poolReady,
+      workerRoutable: readiness.workerRoutable,
+      expiresAt: status?.expiresAt ?? null,
+      lastError: catalogError ?? status?.lastError ?? null,
       models, // ClientModel[] the picker surfaces under the "no credits" group
       activeAccount, // the account a session runs on when unpinned (label for the indicator)
       accountCount: accounts.length,
+      source,
     });
   });
 
@@ -765,11 +1411,12 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
   app.get("/v1/workspaces/:workspaceId/codex/accounts", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:read");
-    const [accounts, rotation, apps, human] = await Promise.all([
+    const [accounts, rotation, apps, human, source] = await Promise.all([
       listCodexAccountStatuses(db, workspaceId),
       getCodexRotationSettings(db, workspaceId),
       getCodexAppsSettings(db, workspaceId),
-      managedCookieHuman(c, deps),
+      managedHumanOrAgent(c, deps),
+      getWorkspaceCodexSubscriptionSource(db, workspaceId),
     ]);
     const activeAccountId = rotation?.activeCredentialId ?? null;
     const humanSubjectId = human?.subjectId === grant.subjectId ? human.subjectId : null;
@@ -784,6 +1431,7 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
         }),
       ),
       activeAccountId,
+      source,
       apps: {
         available: settings.codexConnectedAppsEnabled,
         credentialId: apps.credentialId,
@@ -803,8 +1451,11 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
 
   app.post("/v1/workspaces/:workspaceId/codex/apps", async (c) => {
     const workspaceId = c.req.param("workspaceId");
+    await requireWorkspaceCodexManagementSource(deps, workspaceId);
     if (!settings.codexConnectedAppsEnabled) {
-      throw new HTTPException(409, { message: "Codex Apps is disabled for this deployment" });
+      throw new HTTPException(409, {
+        message: "Codex Apps is disabled for this deployment",
+      });
     }
     const { human, accountId } = await requireCodexAppsHuman(c, deps, workspaceId);
     const parsed = z
@@ -814,7 +1465,9 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
       })
       .safeParse(await c.req.json().catch(() => null));
     if (!parsed.success) {
-      throw new HTTPException(400, { message: "accountId and expectedVersion are required" });
+      throw new HTTPException(400, {
+        message: "accountId and expectedVersion are required",
+      });
     }
     const result = await designateCodexAppsCredential(db, {
       accountId,
@@ -832,10 +1485,14 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
       });
     }
     if (result.kind === "forbidden") {
-      throw new HTTPException(403, { message: "missing permission: connections:write" });
+      throw new HTTPException(403, {
+        message: "missing permission: connections:write",
+      });
     }
     if (result.kind === "unavailable") {
-      throw new HTTPException(409, { message: "codex account requires relogin" });
+      throw new HTTPException(409, {
+        message: "codex account requires relogin",
+      });
     }
     const response = {
       credentialId: result.credentialId,
@@ -848,6 +1505,7 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
 
   app.delete("/v1/workspaces/:workspaceId/codex/apps", async (c) => {
     const workspaceId = c.req.param("workspaceId");
+    await requireWorkspaceCodexManagementSource(deps, workspaceId);
     const { human, accountId } = await requireCodexAppsHuman(c, deps, workspaceId);
     const parsed = z
       .object({ expectedVersion: z.number().int().nonnegative() })
@@ -862,7 +1520,9 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
       expectedVersion: parsed.data.expectedVersion,
     });
     if (result.kind === "forbidden") {
-      throw new HTTPException(403, { message: "missing permission: connections:write" });
+      throw new HTTPException(403, {
+        message: "missing permission: connections:write",
+      });
     }
     const response = {
       credentialId: result.credentialId,
@@ -877,7 +1537,8 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
   // Pure pointer flip; in-flight turns pick it up on their next token fetch.
   app.post("/v1/workspaces/:workspaceId/codex/accounts/:accountId/activate", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    await requireAccessGrant(c, deps, workspaceId, "connections:write");
+    await requireWorkspaceCodexManagementSource(deps, workspaceId);
     const accountId = c.req.param("accountId");
     const mutation = await withCodexCapacityMutation(
       db,
@@ -895,14 +1556,15 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
     return c.json({ activated: true, accountId });
   });
 
-  // Update rotation settings. admin access. sharded-rotation policy: the strategy picker is GONE —
+  // Update rotation settings. Connection-management access. Sharded-rotation policy: the strategy picker is GONE —
   // rotation-enabled always behaves as sticky-sharded (worker-side
   // effectiveRotationStrategy normalization). `rotationStrategy` in the body is
   // ACCEPTED-BUT-IGNORED so no existing SDK/UI caller breaks (deprecation), and
   // the stored column is only legacy residue kept for old-binary rollback.
   app.patch("/v1/workspaces/:workspaceId/codex/settings", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "connections:write");
+    await requireWorkspaceCodexManagementSource(deps, workspaceId);
     const body = (await c.req.json().catch(() => ({}))) as {
       rotationEnabled?: unknown;
       rotationStrategy?: unknown;
@@ -917,7 +1579,10 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
     if (patch.rotationEnabled === undefined) {
       // Strategy-only writes are a deprecated no-op (no db touch): report the
       // (only) truth. Callers that also flip rotationEnabled fall through.
-      return c.json({ rotationStrategy: "sharded", rotationStrategyDeprecated: true });
+      return c.json({
+        rotationStrategy: "sharded",
+        rotationStrategyDeprecated: true,
+      });
     }
     await ensureCodexRotationSettings(db, grant.accountId, workspaceId);
     const mutation = await withCodexCapacityMutation(
@@ -946,7 +1611,8 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
   // Rename an account (label only in P1).
   app.patch("/v1/workspaces/:workspaceId/codex/accounts/:accountId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    await requireAccessGrant(c, deps, workspaceId, "connections:write");
+    await requireWorkspaceCodexManagementSource(deps, workspaceId);
     const accountId = c.req.param("accountId");
     const body = (await c.req.json()) as { label?: string | null };
     const label = typeof body.label === "string" ? body.label : null;
@@ -967,7 +1633,8 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
   // an explicit 409 carrying the current version.
   app.patch("/v1/workspaces/:workspaceId/codex/accounts/:accountId/allocator", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "connections:write");
+    await requireWorkspaceCodexManagementSource(deps, workspaceId);
     const parsed = z
       .object({
         enabled: z.boolean(),
@@ -1005,7 +1672,8 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
   // row was active (FK ON DELETE SET NULL + re-pick in the same RLS txn).
   app.delete("/v1/workspaces/:workspaceId/codex/accounts/:accountId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "connections:write");
+    await requireWorkspaceCodexManagementSource(deps, workspaceId);
     const accountId = c.req.param("accountId");
     const mutation = await withCodexCapacityMutation(
       db,
@@ -1023,14 +1691,18 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
       });
     }
     await signalCodexCapacityTargets(deps, mutation.wakeTargets);
-    return c.json({ disconnected: result.removed, newActiveId: result.newActiveCredentialId });
+    return c.json({
+      disconnected: result.removed,
+      newActiveId: result.newActiveCredentialId,
+    });
   });
 
   // Legacy "disconnect all" (old workspace-wide behavior), deprecated in favor of
   // the by-id route above.
   app.delete("/v1/workspaces/:workspaceId/codex", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "connections:write");
+    await requireWorkspaceCodexManagementSource(deps, workspaceId);
     const mutation = await withCodexCapacityMutation(
       db,
       { workspaceId, reason: "codex_credentials_disconnected" },
@@ -1135,12 +1807,12 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
   app.get("/v1/workspaces/:workspaceId/codex/overview", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:read");
-    const human = await managedCookieHuman(c, deps);
+    const human = await managedHumanOrAgent(c, deps);
     const accounts = await listCodexAccountStatuses(db, workspaceId);
     const ownerRecoveries =
       human &&
       human.subjectId === grant.subjectId &&
-      hasPermission(grant.permissions, "workspace:admin")
+      hasPermission(grant.permissions, "connections:write")
         ? await listCodexResetRedemptionRecoveries(db, {
             accountId: grant.accountId,
             workspaceId,
@@ -1160,16 +1832,30 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
         const account = queue.shift();
         if (!account) return;
         const canResumeRedemption = Boolean(
+          account.source === "workspace" &&
           human &&
           human.subjectId === grant.subjectId &&
           human.subjectId === account.connectedBySubjectId &&
-          hasPermission(grant.permissions, "workspace:admin"),
+          hasPermission(grant.permissions, "connections:write"),
         );
         const canRedeem = canResumeRedemption && account.status === "active";
+        const redemptionAccess: CodexRedemptionAccess =
+          account.source === "organization"
+            ? {
+                ownership: "managed_human_unavailable",
+                canClaimUnownedViaReconnect: false,
+              }
+            : codexRedemptionAccess({
+                connectedBySubjectId: account.connectedBySubjectId,
+                grantSubjectId: grant.subjectId,
+                managedHumanSubjectId: human?.subjectId ?? null,
+                canManage: hasPermission(grant.permissions, "connections:write"),
+              });
         overview[account.id] = await fetchCodexAccountOverview(
           deps,
           workspaceId,
           account,
+          redemptionAccess,
           canRedeem,
           canResumeRedemption,
           canResumeRedemption
@@ -1207,15 +1893,27 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
           .filter((account) => overview[account.id] == null)
           .map(async (account) => {
             const canResumeRedemption = Boolean(
+              account.source === "workspace" &&
               human &&
               human.subjectId === grant.subjectId &&
               human.subjectId === account.connectedBySubjectId &&
-              hasPermission(grant.permissions, "workspace:admin"),
+              hasPermission(grant.permissions, "connections:write"),
             );
             const fallback = await fetchCodexAccountOverview(
               deps,
               workspaceId,
               account,
+              account.source === "organization"
+                ? {
+                    ownership: "managed_human_unavailable",
+                    canClaimUnownedViaReconnect: false,
+                  }
+                : codexRedemptionAccess({
+                    connectedBySubjectId: account.connectedBySubjectId,
+                    grantSubjectId: grant.subjectId,
+                    managedHumanSubjectId: human?.subjectId ?? null,
+                    canManage: hasPermission(grant.permissions, "connections:write"),
+                  }),
               false,
               canResumeRedemption,
               canResumeRedemption
@@ -1257,6 +1955,11 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
       const accounts = await listCodexAccountStatuses(db, workspaceId);
       const account = accounts.find((candidate) => candidate.id === credentialId);
       if (!account) throw new HTTPException(404, { message: "codex account not found" });
+      if (account.source === "organization") {
+        throw new HTTPException(409, {
+          message: "organization Codex subscriptions are managed in Organization settings",
+        });
+      }
       let existing = await getCodexResetRedemptionAttempt(db, workspaceId, parsed.data.attemptId);
       if (account.connectedBySubjectId !== human.subjectId) {
         throw new HTTPException(403, {
@@ -1289,10 +1992,14 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
           });
         }
         if (adoption.kind === "not_found") {
-          throw new HTTPException(409, { message: "redemption recovery state changed" });
+          throw new HTTPException(409, {
+            message: "redemption recovery state changed",
+          });
         }
         if (adoption.kind === "forbidden") {
-          throw new HTTPException(403, { message: "redemption owner is unavailable" });
+          throw new HTTPException(403, {
+            message: "redemption owner is unavailable",
+          });
         }
         if (adoption.kind === "conflict") {
           throw new HTTPException(409, {
@@ -1306,7 +2013,9 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
       // and a lost HTTP response must remain replayable after a later health
       // transition without another consume call.
       if (account.status !== "active" && existing?.status !== "completed") {
-        throw new HTTPException(403, { message: "redemption credential is unavailable" });
+        throw new HTTPException(403, {
+          message: "redemption credential is unavailable",
+        });
       }
       const secret = settings.betterAuthSecret;
       if (!secret) {
@@ -1505,13 +2214,21 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
       if (fenced.kind !== "ready") {
         if (fenced.reason === "confirmation_expired") {
           return c.json(
-            { status: "confirmation_expired", attemptId: attempt.id, retryable: true },
+            {
+              status: "confirmation_expired",
+              attemptId: attempt.id,
+              retryable: true,
+            },
             403,
           );
         }
         if (fenced.reason === "credential_unavailable") {
           return c.json(
-            { status: "provider_unavailable", attemptId: attempt.id, retryable: true },
+            {
+              status: "provider_unavailable",
+              attemptId: attempt.id,
+              retryable: true,
+            },
             503,
           );
         }