@tokensrc/codex 1.14.16 → 1.14.18

package/dist/commands.js

@@ -4,31 +4,24 @@ import { join } from "node:path";
 import { getStoragePath, loadAccounts, setStoragePath, setStoragePathDirect } from "codex-multi-auth/storage";
 import { normalizeCodexServiceUrl } from "./client.js";
 import { CodexServiceError } from "./errors.js";
-import { backupCodexFileCredentials, codexFileCredentialsMatchAccount, discardCodexFileCredentialBackup, inspectLocalCodexCredentialStatus, readManagedCodexLineageState, resetManagedCodexFileCredentials, restoreCodexFileCredentials, writeCodexChatgptFileCredentials } from "./credentials.js";
+import { backupCodexFileCredentials, codexFileCredentialsMatchAccount, inspectLocalCodexCredentialStatus, resetManagedCodexFileCredentials, restoreCodexFileCredentials, writeCodexChatgptFileCredentials } from "./credentials.js";
 import { CODEX_DISTRIBUTION_SCHEMA_VERSION } from "./protocol.js";
 import { formatCodexAccountDisplayIdentity, resolveCodexAdminAccount, resolveCodexAccountDisplayName } from "./account-display.js";
 import { loadCodexQuotaUploads } from "./quota-cache.js";
 import { cleanupLegacyCodexProvider } from "./legacy-cleanup.js";
-import { executeCodexEnrollmentLogin } from "./enrollment-flow.js";
-import { executeCodexMigrationLoginBatch } from "./migration-login-batch.js";
-import { executeCodexShortLivedCredentialDelivery } from "./short-lived-delivery-flow.js";
 import { executeCodexTokenPoolV4Delivery, reconcilePendingManagedCodexV3Operation, reportManagedCodexV3Credentials } from "./managed-credential-v3-flow.js";
 import { resolveManagedCodexV3AssignmentTarget } from "./managed-credential-v3-assignment.js";
 import { executeCodexTokenPoolV4Login } from "./token-pool-v4-upload-flow.js";
 import { readManagedCodexV3State } from "./managed-credential-v3.js";
-import { profileAccountTokenPoolV4Enabled, profileMultiDeviceCredentialSyncEnabled } from "./profile.js";
+import { profileAccountTokenPoolV4Enabled, profileMultiDeviceCredentialSyncEnabled, profileRequestBoundDeviceCredentialsEnabled } from "./profile.js";
 import { superviseCodexV5Credentials, synchronizeCodexV5SelectionOnce } from "./multi-device-v5-flow.js";
-import { executeCodexAssignmentRetirementLocalDelete } from "./retirement-flow.js";
-import { clearCodexSelection, loadCodexSelection, rememberCodexSelectionProviderAccount, saveCodexSelection } from "./selection.js";
+import { clearCodexSelection, loadCodexSelection, saveCodexSelection } from "./selection.js";
 import { installCodexShortcuts, removeCodexShortcuts } from "./shortcuts.js";
 import { isCodexAccountAvailable, isCodexSubscriptionExpired, renderCodexAccountDashboard, selectCodexAccount } from "./tui.js";
-import { readCodexShortLivedDeliveryJournal } from "./short-lived-delivery-journal.js";
-import { superviseCodexShortLivedCredentials } from "./credential-supervisor.js";
+import { ensureCodexV6DeviceCredentials, reconcileCodexV6DeviceAccess, reportCodexV6DeviceCredentials, requireAvailableCodexV6DeviceAccess } from "./request-bound-device-v6-flow.js";
+import { getOrCreateCodexInstallationId } from "./multi-device-v5-state.js";
+import { resetCodexV6LocalState } from "./request-bound-device-v6-state.js";
 export const NO_AVAILABLE_CHATGPT_ACCOUNT_MESSAGE = "当前用户没有绑定可用的 ChatGPT 账号。请前往 OA 系统提交 IT11 工单，申请独享或共享的 ChatGPT 个人账号。";
-// The Server refreshes a user-bound lineage only inside its final 60-second
-// credential safety window. Asking for a new delivery earlier would merely
-// re-encrypt the same access/ID tokens and must not be treated as a renewal.
-const SERVER_MANAGED_SHORT_LIVED_REFRESH_WINDOW_MS = 60_000;
 const SCHEMA_V2_LEGACY_MANAGEMENT_DISABLED = "schema_v2_legacy_management_disabled";
 function findV3Assignment(input) {
     return input.assignments.items.find((item) => item.assignmentId === input.assignmentId
@@ -36,11 +29,6 @@ function findV3Assignment(input) {
         && item.providerAccountId === input.providerAccountId
         && item.lineageId === input.lineageId);
 }
-export function effectiveCodexCredentialRefreshBefore(requestedMs, serverManagedShortLived) {
-    return serverManagedShortLived
-        ? Math.min(requestedMs, SERVER_MANAGED_SHORT_LIVED_REFRESH_WINDOW_MS)
-        : requestedMs;
-}
 async function json(command, deps) {
     if (command.optsWithGlobals().json)
         return true;
@@ -59,31 +47,28 @@ function success(value) {
 function importFailures(credentials) {
     return credentials.filter(({ status }) => status === "REJECTED" || status === "UNKNOWN");
 }
-function schemaV2LifecycleEnabled(config) {
-    const capabilities = config.profile?.userBoundRefreshTokens;
-    return capabilities?.delivery === true || capabilities?.migrationPlans === true;
-}
 function accountTokenPoolV4Enabled(config) {
     return profileAccountTokenPoolV4Enabled(config.profile);
 }
 function multiDeviceCredentialSyncEnabled(config) {
     return profileMultiDeviceCredentialSyncEnabled(config.profile);
 }
+function requestBoundDeviceCredentialsEnabled(config) {
+    return profileRequestBoundDeviceCredentialsEnabled(config.profile);
+}
+function assertRequestBoundDeviceCredentialsEnabled(config) {
+    if (requestBoundDeviceCredentialsEnabled(config))
+        return;
+    throw new CodexServiceError("平台尚未启用请求绑定的独立设备 Token Set。", "codex_request_bound_device_v6_not_enabled", 409);
+}
 function codexConfigPathForEnv(env) {
     const codexHome = env.CODEX_HOME?.trim();
     return codexHome ? join(codexHome, "config.toml") : undefined;
 }
 function assertLegacyManagementEnabled(config) {
-    if (!schemaV2LifecycleEnabled(config))
+    if (!requestBoundDeviceCredentialsEnabled(config))
         return;
-    throw new CodexServiceError("Schema-v2 user-bound credentials are enabled; legacy refresh-token pool management is disabled.", SCHEMA_V2_LEGACY_MANAGEMENT_DISABLED, 409);
-}
-function assignmentCredentialStatus(assignment) {
-    if (isCodexSubscriptionExpired(assignment))
-        return "EXPIRED";
-    if (assignment.deliveryEligible)
-        return "AVAILABLE";
-    return ["NEEDS_REAUTH", "LOST", "DIVERGED", "COMPROMISED"].includes(assignment.lineageStatus ?? "") ? "NEEDS_REAUTH" : "TEMPORARILY_UNAVAILABLE";
+    throw new CodexServiceError("Request-bound per-device credentials are enabled; legacy direct assignment management is disabled.", SCHEMA_V2_LEGACY_MANAGEMENT_DISABLED, 409);
 }
 function assertCodexSubscriptionActive(subscription, label) {
     if (!isCodexSubscriptionExpired(subscription))
@@ -175,6 +160,61 @@ function parseSubscriptionRenewalExpiry(value) {
     }
     return expiresAt;
 }
+function parseRequestInstant(value, option) {
+    const normalized = value.trim();
+    const timestamp = Date.parse(normalized);
+    if (!/(?:Z|[+-]\d{2}:\d{2})$/iu.test(normalized) || !Number.isFinite(timestamp)) {
+        throw new CodexServiceError(`${option} 必须是带时区的 ISO-8601 时间。`, "invalid_codex_account_request");
+    }
+    return new Date(timestamp).toISOString();
+}
+function parsePositiveInteger(value, option, maximum = 32) {
+    const parsed = Number.parseInt(value, 10);
+    if (!Number.isInteger(parsed) || parsed < 1 || parsed > maximum || String(parsed) !== value.trim()) {
+        throw new CodexServiceError(`${option} 必须是 1 到 ${maximum} 之间的整数。`, "invalid_codex_account_request");
+    }
+    return parsed;
+}
+function parseNonNegativeInteger(value, option) {
+    const parsed = Number.parseInt(value, 10);
+    if (!Number.isInteger(parsed) || parsed < 0 || String(parsed) !== value.trim()) {
+        throw new CodexServiceError(`${option} 必须是非负整数。`, "invalid_codex_account_request");
+    }
+    return parsed;
+}
+function v6Platform() {
+    return ["darwin", "linux", "win32"].includes(process.platform)
+        ? process.platform : "unknown";
+}
+function formatV6Request(request) {
+    const expiresAt = Date.parse(request.validUntil ?? request.requestedValidUntil);
+    const remainingDays = Math.ceil((expiresAt - Date.now()) / 86_400_000);
+    const expiryNotice = remainingDays <= 0 ? "EXPIRED"
+        : remainingDays <= 7 ? `URGENT:${remainingDays}d`
+            : remainingDays <= 30 ? `EXPIRING:${remainingDays}d` : `${remainingDays}d`;
+    return `${request.id}  ${request.status}/${request.availability}`
+        + `  user=${request.username} (${request.userSubject})`
+        + `  devices=${request.activeBindingCount}+${request.pendingBindingCount}`
+        + `/${request.approvedDeviceLimit ?? request.requestedDeviceCount}`
+        + `  valid-until=${request.validUntil ?? request.requestedValidUntil}`
+        + `  expiry=${expiryNotice}`
+        + `  version=${request.version}`;
+}
+function formatV6Binding(binding) {
+    return `${binding.id}  ${binding.status}  device=${binding.deviceLabel}`
+        + ` (${binding.installationId})  token-set=${binding.credentialLineageId ?? "WAITING"}`
+        + `${binding.accountExpiresAt ? `  account-expires=${binding.accountExpiresAt}` : ""}`
+        + `${binding.replacementDueAt ? `  replace-before=${binding.replacementDueAt}` : ""}`
+        + `${binding.predecessorBindingId ? `  replaces=${binding.predecessorBindingId}` : ""}`;
+}
+async function v6DeviceAccess(deps, options = {}, deviceLabel) {
+    return reconcileCodexV6DeviceAccess({
+        client: deps.clientFor(serviceConnection(options)),
+        tenantId: deps.config.connection.tenantId,
+        env: deps.env,
+        deviceLabel
+    });
+}
 async function loadAccountData(deps, options = {}, allowV4Replacement = false) {
     const previous = await loadCodexSelection(deps.config.persistence.configDirectory);
     if (accountTokenPoolV4Enabled(deps.config)) {
@@ -221,31 +261,6 @@ async function loadAccountData(deps, options = {}, allowV4Replacement = false) {
             preferredV3Assignments
         };
     }
-    if (deps.config.profile?.userBoundRefreshTokens?.delivery === true) {
-        const assignments = await deps.clientFor(serviceConnection(options)).listCredentialAssignments();
-        const accounts = assignments.items.map((assignment) => ({
-            id: assignment.managedAccountId,
-            accountId: assignment.assignmentId,
-            label: assignment.label,
-            isDefault: previous?.account.assignmentId === assignment.assignmentId,
-            ...(assignment.credentialExpiresAt
-                ? { accessExpiresAt: Date.parse(assignment.credentialExpiresAt) }
-                : {}),
-            ...subscriptionSummary(assignment),
-            credentialStatus: assignmentCredentialStatus(assignment),
-            lineageStatus: assignment.lineageStatus ?? undefined,
-            quota: null
-        }));
-        return {
-            response: {
-                schemaVersion: CODEX_DISTRIBUTION_SCHEMA_VERSION,
-                accounts,
-                defaultAccountId: previous?.account.managedAccountId ?? null
-            },
-            selectedAccountId: previous?.account.managedAccountId,
-            assignments
-        };
-    }
     const response = await deps.clientFor(serviceConnection(options)).listAccounts();
     return {
         response,
@@ -374,39 +389,6 @@ async function installCredentials(deps, selection, service, allowV4Replacement =
         });
         return { expiresAt: Date.parse(delivered.credentialExpiresAt), selection };
     }
-    if (deps.config.profile?.userBoundRefreshTokens?.delivery === true) {
-        await discardCodexFileCredentialBackup(deps.env);
-        if (selection.account.distributionMode !== "SERVER_MANAGED_SHORT_LIVED"
-            || !selection.account.assignmentId || !selection.account.managedAccountId) {
-            throw new CodexServiceError("The saved Codex selection is not a schema-v2 credential assignment.", "codex_assignment_not_found", 404);
-        }
-        const assignments = await client.listCredentialAssignments();
-        const assignment = assignments.items.find((item) => item.assignmentId === selection.account.assignmentId
-            && item.managedAccountId === selection.account.managedAccountId);
-        if (!assignment) {
-            throw new CodexServiceError("The selected schema-v2 credential assignment is no longer active.", "codex_assignment_not_found", 404);
-        }
-        const state = await readManagedCodexLineageState(deps.env);
-        const journal = await readCodexShortLivedDeliveryJournal(deps.env);
-        const recoverable = journal?.tenantId === deps.config.connection.tenantId
-            && journal.assignmentId === assignment.assignmentId
-            || state?.assignmentId === assignment.assignmentId
-                && (state.tenantId === deps.config.connection.tenantId || state.tenantId === null)
-                && (state.phase === "INSTALLING"
-                    || state.phase === "INSTALLED_PENDING_ACK" && Date.parse(state.ackExpiresAt) > Date.now());
-        if (!assignment.deliveryEligible && !recoverable) {
-            throw new CodexServiceError("The selected schema-v2 credential assignment is not ready for delivery.", "short_lived_credential_lineage_not_ready", 409);
-        }
-        const delivered = await executeCodexShortLivedCredentialDelivery({
-            client,
-            tenantId: deps.config.connection.tenantId,
-            assignmentId: assignment.assignmentId,
-            allowNewDelivery: assignment.deliveryEligible,
-            env: deps.env
-        });
-        const updated = await rememberCodexSelectionProviderAccount(deps.config.persistence.configDirectory, assignment.assignmentId, delivered.providerAccountId);
-        return { expiresAt: Date.parse(delivered.credentialExpiresAt), selection: updated };
-    }
     await backupCodexFileCredentials(deps.env);
     const response = await client.getLoginCredentials(selection.account.id);
     await writeCodexChatgptFileCredentials({
@@ -417,6 +399,45 @@ async function installCredentials(deps, selection, service, allowV4Replacement =
     return { expiresAt: response.expiresAt, selection };
 }
 async function selectedCredentials(deps, requested, options = {}) {
+    if (requestBoundDeviceCredentialsEnabled(deps.config)) {
+        const client = deps.clientFor(serviceConnection(options));
+        const ensured = await ensureCodexV6DeviceCredentials({
+            client,
+            tenantId: deps.config.connection.tenantId,
+            env: deps.env
+        });
+        if (ensured.replacementDeferredWarningCode) {
+            deps.errorOutput.write(`新设备 Token Set 暂时无法交付 (${ensured.replacementDeferredWarningCode})；`
+                + "本次继续使用尚有效的旧 Token Set，稍后会自动重试。\n");
+        }
+        const binding = ensured.binding;
+        if (requested && ![
+            binding.id,
+            binding.requestId,
+            binding.managedAccountId,
+            binding.providerAccountId,
+            binding.credentialLineageId
+        ].includes(requested)) {
+            throw new CodexServiceError("当前设备只能使用管理员为它绑定的独立 Token Set。", "codex_device_binding_not_found", 404);
+        }
+        const selection = await saveCodexSelection(deps.config.persistence.configDirectory, {
+            serviceUrl: options.server ?? deps.config.connection.serverUrl,
+            allowInsecurePoc: Boolean(options.insecurePoc || options.insecureHttp || deps.config.connection.allowInsecureHttp),
+            account: {
+                id: binding.managedAccountId,
+                accountId: binding.providerAccountId,
+                label: `${binding.deviceLabel} / ${binding.requestId}`,
+                distributionMode: "REQUEST_BOUND_DEVICE_V6",
+                managedAccountId: binding.managedAccountId,
+                providerAccountId: binding.providerAccountId,
+                requestId: binding.requestId,
+                bindingId: binding.id,
+                installationId: binding.installationId,
+                credentialLineageId: binding.credentialLineageId
+            }
+        });
+        return { selection, expiresAt: Date.parse(ensured.credentialExpiresAt) };
+    }
     if (accountTokenPoolV4Enabled(deps.config)) {
         const client = deps.clientFor(serviceConnection(options));
         const recovered = await reconcilePendingManagedCodexV3Operation({
@@ -525,43 +546,6 @@ async function selectedCredentials(deps, requested, options = {}) {
     if (!selection || serviceChanged || requested && !requestedMatchesSelection) {
         selection = (await chooseAccount(deps, requested, options)).selection;
     }
-    if (deps.config.profile?.userBoundRefreshTokens?.delivery === true) {
-        if (selection.account.distributionMode !== "SERVER_MANAGED_SHORT_LIVED") {
-            selection = (await chooseAccount(deps, requested, options)).selection;
-        }
-        const assignments = await deps.clientFor({
-            serverUrl: selection.serviceUrl,
-            allowInsecureHttp: selection.allowInsecurePoc
-        }).listCredentialAssignments();
-        const assignment = assignments.items.find((item) => item.assignmentId === selection.account.assignmentId
-            && item.managedAccountId === selection.account.managedAccountId);
-        if (!assignment) {
-            throw new CodexServiceError("The selected schema-v2 credential assignment is no longer active.", "codex_assignment_not_found", 404);
-        }
-        assertCodexSubscriptionActive(assignment, assignment.label);
-        const state = await readManagedCodexLineageState(deps.env);
-        const journal = await readCodexShortLivedDeliveryJournal(deps.env);
-        const stateMatches = state !== undefined
-            && (state.tenantId === deps.config.connection.tenantId || state.tenantId === null)
-            && state.assignmentId === assignment.assignmentId
-            && state.managedAccountId === assignment.managedAccountId;
-        const local = await inspectLocalCodexCredentialStatus(stateMatches ? state.providerAccountId : selection.account.providerAccountId, deps.env);
-        const pending = journal?.tenantId === deps.config.connection.tenantId
-            && journal.assignmentId === assignment.assignmentId
-            || stateMatches && state.phase !== "INSTALLED";
-        if (!assignment.deliveryEligible || !stateMatches || !local.usable
-            || local.matchesExpectedAccount !== true || pending) {
-            return installCredentials(deps, selection, {
-                serverUrl: selection.serviceUrl,
-                allowInsecureHttp: selection.allowInsecurePoc
-            });
-        }
-        const matchingState = state;
-        if (selection.account.providerAccountId !== matchingState.providerAccountId) {
-            selection = await rememberCodexSelectionProviderAccount(deps.config.persistence.configDirectory, assignment.assignmentId, matchingState.providerAccountId);
-        }
-        return { selection, expiresAt: local.expiresAt ?? Date.parse(matchingState.credentialExpiresAt) };
-    }
     if (!selection.account.accountId) {
         throw new CodexServiceError("The saved Codex selection has no provider account.", "invalid_configuration");
     }
@@ -592,6 +576,24 @@ async function selectedCredentials(deps, requested, options = {}) {
     return { selection, expiresAt: local.expiresAt };
 }
 async function launchWithSelectedCredentials(deps, selected, launch) {
+    if (requestBoundDeviceCredentialsEnabled(deps.config)) {
+        try {
+            return await launch();
+        }
+        finally {
+            const report = await reportCodexV6DeviceCredentials({
+                client: deps.clientFor({
+                    serverUrl: selected.selection.serviceUrl,
+                    allowInsecureHttp: selected.selection.allowInsecurePoc
+                }),
+                tenantId: deps.config.connection.tenantId,
+                env: deps.env
+            });
+            if (!report.reported && report.warningCode) {
+                deps.errorOutput.write(`Codex 独立设备 Token 代际上报暂缓 (${report.warningCode})；其他设备不会受影响。\n`);
+            }
+        }
+    }
     if (multiDeviceCredentialSyncEnabled(deps.config)) {
         const client = deps.clientFor({
             serverUrl: selected.selection.serviceUrl,
@@ -636,21 +638,7 @@ async function launchWithSelectedCredentials(deps, selected, launch) {
             }
         }
     }
-    if (deps.config.profile?.userBoundRefreshTokens?.delivery !== true)
-        return launch();
-    let current = selected;
-    return superviseCodexShortLivedCredentials({
-        initialExpiresAt: current.expiresAt,
-        launch: (signal) => launch(signal),
-        renew: async () => {
-            const installed = await installCredentials(deps, current.selection, {
-                serverUrl: current.selection.serviceUrl,
-                allowInsecureHttp: current.selection.allowInsecurePoc
-            });
-            current = installed;
-            return { expiresAt: installed.expiresAt };
-        }
-    });
+    return launch();
 }
 export function registerCodexCommands(program, deps, options = {}) {
     const codex = options.nested === false
@@ -677,18 +665,25 @@ export function registerCodexCommands(program, deps, options = {}) {
             else
                 deps.output.write("Logged out.\n");
         });
-    if (!includeAuthCommands && accountTokenPoolV4Enabled(deps.config))
-        serviceOptions(codex.command("login")
-            .description("Run an isolated official Codex login and enroll an unbound or explicitly assigned credential"))
-            .option("--device-auth", "use the official Codex device authorization flow")
-            .option("--assign-to <username-or-email>", "assign by exact username or email instead of adding to the unbound pool")
-            .option("--assign-to-subject <uuid>", "assign directly to a canonical Keycloak subject UUID")
-            .option("--yes", "confirm direct subject assignment")
-            .action(async (opts, command) => {
+    if (!includeAuthCommands && accountTokenPoolV4Enabled(deps.config)) {
+        let managedLogin = serviceOptions(codex.command("login")
+            .description(requestBoundDeviceCredentialsEnabled(deps.config)
+            ? "Run an isolated official Codex login and add one complete token set to the unbound pool"
+            : "Run an isolated official Codex login and enroll an unbound or explicitly assigned credential"))
+            .option("--device-auth", "use the official Codex device authorization flow");
+        if (!requestBoundDeviceCredentialsEnabled(deps.config)) {
+            managedLogin = managedLogin
+                .option("--assign-to <username-or-email>", "assign by exact username or email instead of adding to the unbound pool")
+                .option("--assign-to-subject <uuid>", "assign directly to a canonical Keycloak subject UUID")
+                .option("--yes", "confirm direct subject assignment");
+        }
+        managedLogin.action(async (opts, command) => {
             if (!accountTokenPoolV4Enabled(deps.config)) {
                 throw new CodexServiceError("The Codex v4 account token pool is not enabled by the verified platform profile.", "codex_token_pool_v4_not_enabled", 409);
             }
-            const target = resolveManagedCodexV3AssignmentTarget(opts);
+            const target = requestBoundDeviceCredentialsEnabled(deps.config)
+                ? { mode: "UNBOUND_POOL" }
+                : resolveManagedCodexV3AssignmentTarget(opts);
             const result = await executeCodexTokenPoolV4Login({
                 client: deps.clientFor(serviceConnection(opts)),
                 tenantId: deps.config.connection.tenantId,
@@ -715,8 +710,131 @@ export function registerCodexCommands(program, deps, options = {}) {
             else
                 deps.output.write(`Codex credential uploaded to token pool; status=${result.status}, placement=${result.placement}.\n`);
         });
+    }
+    const requests = codex.command("request")
+        .description("Apply for Codex access and manage request-bound device token sets");
+    serviceOptions(requests.command("create")
+        .description("Submit an account request and identify this device as the initial binding candidate")
+        .requiredOption("--reason <text>", "申请原因，至少 5 个字符")
+        .requiredOption("--until <timestamp>", "申请有效期结束时间，必须包含时区")
+        .option("--devices <count>", "申请的设备数量", "1")
+        .option("--device-label <label>", "当前设备名称")
+        .option("--idempotency-key <key>", "重试时复用同一个幂等键"))
+        .action(async (opts, command) => {
+        assertRequestBoundDeviceCredentialsEnabled(deps.config);
+        const requestedValidUntil = parseRequestInstant(opts.until, "--until");
+        if (Date.parse(requestedValidUntil) <= Date.now())
+            throw new CodexServiceError("--until 必须晚于当前时间。", "invalid_codex_account_request");
+        const installationId = await getOrCreateCodexInstallationId(deps.env);
+        const clientRequestId = randomUUID();
+        const result = await deps.clientFor(serviceConnection(opts)).createV6AccountRequest({
+            schemaVersion: 6,
+            clientRequestId,
+            reason: opts.reason,
+            requestedDeviceCount: parsePositiveInteger(opts.devices, "--devices"),
+            requestedValidUntil,
+            initialDevice: {
+                installationId,
+                label: (opts.deviceLabel?.trim() || hostname() || "Codex device").slice(0, 128),
+                platform: v6Platform()
+            }
+        }, opts.idempotencyKey?.trim() || clientRequestId);
+        if (await json(command, deps))
+            print(deps.output, success({
+                ...result, installationId
+            }));
+        else
+            deps.output.write(`申请已提交：${formatV6Request(result.request)}\n`
+                + `首台设备候选：${installationId}。审批后每个设备将获得独立完整 Token Set。\n`);
+    });
+    serviceOptions(requests.command("list").description("List the current user's Codex account requests"))
+        .action(async (opts, command) => {
+        assertRequestBoundDeviceCredentialsEnabled(deps.config);
+        const result = await deps.clientFor(serviceConnection(opts)).listV6AccountRequests();
+        if (await json(command, deps))
+            print(deps.output, success(result));
+        else if (result.items.length === 0)
+            deps.output.write("当前用户没有 ChatGPT/Codex 账号申请。\n");
+        else
+            for (const item of result.items)
+                deps.output.write(`${formatV6Request(item)}\n`);
+    });
+    serviceOptions(requests.command("show <requestId>").description("Show one account request"))
+        .action(async (requestId, opts, command) => {
+        assertRequestBoundDeviceCredentialsEnabled(deps.config);
+        const result = await deps.clientFor(serviceConnection(opts)).getV6AccountRequest(requestId);
+        if (await json(command, deps))
+            print(deps.output, success(result));
+        else
+            deps.output.write(`${formatV6Request(result.request)}\n`);
+    });
+    serviceOptions(requests.command("bindings <requestId>")
+        .description("List independent device token-set bindings under one request"))
+        .action(async (requestId, opts, command) => {
+        assertRequestBoundDeviceCredentialsEnabled(deps.config);
+        const result = await deps.clientFor(serviceConnection(opts)).listV6DeviceBindings(requestId);
+        if (await json(command, deps))
+            print(deps.output, success(result));
+        else if (result.items.length === 0)
+            deps.output.write("该申请尚无设备绑定。\n");
+        else
+            for (const binding of result.items)
+                deps.output.write(`${formatV6Binding(binding)}\n`);
+    });
+    serviceOptions(requests.command("reconcile")
+        .description("Reconcile this installation and automatically adopt one legacy distributed token set")
+        .option("--device-label <label>", "当前设备名称"))
+        .action(async (opts, command) => {
+        assertRequestBoundDeviceCredentialsEnabled(deps.config);
+        const access = await v6DeviceAccess(deps, opts, opts.deviceLabel);
+        if (await json(command, deps))
+            print(deps.output, success({
+                installationId: access.installationId, ...access.response
+            }));
+        else if (access.response.accessStatus === "AVAILABLE") {
+            const { request, binding } = requireAvailableCodexV6DeviceAccess(access);
+            deps.output.write(`${formatV6Request(request)}\n设备绑定：${binding.id} (${binding.installationId})`
+                + `，迁移结果=${access.response.migration}。\n`);
+        }
+        else
+            requireAvailableCodexV6DeviceAccess(access);
+    });
+    serviceOptions(requests.command("cancel <requestId>")
+        .description("Cancel a still-submitted account request")
+        .requiredOption("--version <number>", "当前请求版本")
+        .option("--idempotency-key <key>", "重试时复用同一个幂等键"))
+        .action(async (requestId, opts, command) => {
+        assertRequestBoundDeviceCredentialsEnabled(deps.config);
+        const result = await deps.clientFor(serviceConnection(opts)).cancelV6AccountRequest(requestId, { schemaVersion: 6, expectedRequestVersion: parseNonNegativeInteger(opts.version, "--version") }, opts.idempotencyKey?.trim() || randomUUID());
+        if (await json(command, deps))
+            print(deps.output, success(result));
+        else
+            deps.output.write(`申请已取消：${formatV6Request(result.request)}\n`);
+    });
     serviceOptions(codex.command("list").description("List available Codex accounts without downloading credentials"))
         .action(async (opts, command) => {
+        if (requestBoundDeviceCredentialsEnabled(deps.config)) {
+            const access = await v6DeviceAccess(deps, opts);
+            if (await json(command, deps)) {
+                print(deps.output, success({
+                    credentialModel: "REQUEST_BOUND_DEVICE_V6",
+                    installationId: access.installationId,
+                    ...access.response
+                }));
+                return;
+            }
+            if (access.response.accessStatus !== "AVAILABLE") {
+                requireAvailableCodexV6DeviceAccess(access);
+            }
+            const { request, binding } = requireAvailableCodexV6DeviceAccess(access);
+            deps.output.write(`${formatV6Request(request)}\n`
+                + `${binding.id}  device=${binding.deviceLabel} (${binding.installationId})`
+                + `  token-set=${binding.credentialLineageId}  ${binding.status}\n`);
+            if (access.response.migration === "AUTO_MIGRATED") {
+                deps.output.write("既有本机凭据已自动转换为该申请下的第一个独立设备绑定。\n");
+            }
+            return;
+        }
         const { response: result, selectedAccountId, assignments, v3Assignments } = await loadAccountData(deps, opts);
         const hasAvailableAccount = result.accounts.some(isCodexAccountAvailable);
         const shouldRequestAccount = result.accounts.length === 0
@@ -739,6 +857,21 @@ export function registerCodexCommands(program, deps, options = {}) {
     serviceOptions(codex.command("use [account]").description("Select an account and update the official Codex auth.json"))
         .option("--takeover", "explicitly replace a v4 credential active on another host")
         .action(async (account, opts, command) => {
+        if (requestBoundDeviceCredentialsEnabled(deps.config)) {
+            if (opts.takeover)
+                throw new CodexServiceError("v6 每台设备使用独立 Token Set，不支持接管其他设备的凭据。", "codex_device_takeover_not_allowed", 409);
+            const selected = await selectedCredentials(deps, account, opts);
+            if (await json(command, deps))
+                print(deps.output, success({
+                    account: selected.selection.account,
+                    auth_mode: "chatgpt",
+                    credential_model: "REQUEST_BOUND_DEVICE_V6"
+                }));
+            else
+                deps.output.write(`已安装当前设备的独立 Token Set：${selected.selection.account.label}`
+                    + ` (${selected.selection.account.bindingId})\n`);
+            return;
+        }
         const v4 = accountTokenPoolV4Enabled(deps.config);
         if (opts.takeover && !v4)
             throw new CodexServiceError("Credential takeover requires the v4 token-pool capability.", "codex_token_pool_v4_not_enabled", 409);
@@ -822,9 +955,8 @@ export function registerCodexCommands(program, deps, options = {}) {
         .action(async (_options, command) => {
         const selection = await loadCodexSelection(deps.config.persistence.configDirectory);
         const cleanup = await cleanupLegacyCodexProvider(codexConfigPathForEnv(deps.env));
-        if (schemaV2LifecycleEnabled(deps.config))
-            await discardCodexFileCredentialBackup(deps.env);
         const auth = await resetManagedCodexFileCredentials(selection?.account.providerAccountId ?? selection?.account.accountId, deps.env);
+        await resetCodexV6LocalState(deps.env);
         await clearCodexSelection(deps.config.persistence.configDirectory);
         if (await json(command, deps))
             print(deps.output, success({ reset: true, auth_action: auth.action, legacy_provider_removed: cleanup.changed }));
@@ -852,6 +984,40 @@ export function registerCodexCommands(program, deps, options = {}) {
             throw new Error("auth-agent replaces the current login; add --replace-login to confirm.");
         if (opts.credentialStore !== "file")
             throw new Error("ChatGPT auth.json 同步目前仅支持 --credential-store file。");
+        if (requestBoundDeviceCredentialsEnabled(deps.config)) {
+            const interval = Number(opts.interval) * 1_000;
+            if (!Number.isFinite(interval) || interval <= 0)
+                throw new Error("--interval must be positive.");
+            do {
+                await ensureCodexV6DeviceCredentials({
+                    client: deps.clientFor(serviceConnection(opts)),
+                    tenantId: deps.config.connection.tenantId,
+                    env: deps.env
+                });
+                const result = await reportCodexV6DeviceCredentials({
+                    client: deps.clientFor(serviceConnection(opts)),
+                    tenantId: deps.config.connection.tenantId,
+                    env: deps.env
+                });
+                const event = {
+                    level: result.warningCode ? "WARN" : "INFO",
+                    event: result.reported
+                        ? "device_token_set.generation_reported"
+                        : "device_token_set.current",
+                    at: new Date().toISOString(),
+                    ...(result.warningCode ? { warningCode: result.warningCode } : {})
+                };
+                if (await json(command, deps))
+                    print(deps.output, success(event));
+                else
+                    deps.output.write(`${event.at} ${event.level} ${event.event}`
+                        + `${result.warningCode ? ` (${result.warningCode})` : ""}; other devices unaffected\n`);
+                if (opts.once)
+                    break;
+                await new Promise((resolve) => setTimeout(resolve, interval));
+            } while (true);
+            return;
+        }
         if (accountTokenPoolV4Enabled(deps.config)) {
             const interval = Number(opts.interval) * 1_000;
             if (!Number.isFinite(interval) || interval <= 0)
@@ -887,7 +1053,7 @@ export function registerCodexCommands(program, deps, options = {}) {
         if (!Number.isFinite(requestedRefreshBefore) || requestedRefreshBefore <= 0) {
             throw new Error("--refresh-before must be positive.");
         }
-        const refreshBefore = effectiveCodexCredentialRefreshBefore(requestedRefreshBefore, deps.config.profile?.userBoundRefreshTokens?.delivery === true);
+        const refreshBefore = requestedRefreshBefore;
         let expiresAt = selected.expiresAt;
         do {
             const timestamp = Date.now();
@@ -990,128 +1156,168 @@ export function registerCodexCommands(program, deps, options = {}) {
         if (failures.length > 0)
             process.exitCode = 1;
     });
-    if (schemaV2LifecycleEnabled(deps.config)) {
-        const enrollment = codex.command("enrollment")
-            .description("Execute administrator-created one-shot Codex login intents");
-        serviceOptions(enrollment.command("status <intent>").description("Show redacted enrollment intent status"))
-            .action(async (intent, opts, command) => {
-            const result = await deps.clientFor(serviceConnection(opts)).getEnrollmentIntent(intent);
-            if (await json(command, deps)) {
-                print(deps.output, { ok: true, ...result });
-                return;
-            }
-            deps.output.write(`${result.intent.id}  ${result.intent.type}  ${result.intent.status}`
-                + `  revision=${result.intent.revision}\n`);
-            deps.output.write(`expires=${result.intent.expiresAt}`
-                + `${result.intent.assignmentId ? `  assignment=${result.intent.assignmentId}` : ""}`
-                + `${result.intent.managedAccountId ? `  account=${result.intent.managedAccountId}` : ""}\n`);
-            if (!result.capabilities.candidateUpload) {
-                deps.output.write("安全候选上传尚未启用；当前任务只能查询或取消，不会启动 OpenAI 登录。\n");
-            }
-        });
-        serviceOptions(enrollment.command("login <intent>")
-            .description("Run one isolated official Codex login for an enrollment intent"))
-            .option("--device-auth", "use the official Codex device authorization flow")
-            .action(async (intent, _opts, command) => {
-            const result = await executeCodexEnrollmentLogin({
-                client: deps.clientFor(serviceConnection(_opts)),
-                tenantId: deps.config.connection.tenantId,
-                intentId: intent,
-                deviceAuth: _opts.deviceAuth
-            });
-            if (await json(command, deps))
-                print(deps.output, { ok: true, ...result });
-            else {
-                deps.output.write(`${result.intent.id} 登录候选已处理；状态=${result.intent.status}`
-                    + `${result.result.managedAccountId ? `，账号=${result.result.managedAccountId}` : ""}`
-                    + `${result.result.lineageId ? `，lineage=${result.result.lineageId}` : ""}`
-                    + "。\n");
-                if (result.result.outcome === "TEMPORARILY_UNAVAILABLE") {
-                    deps.output.write("同一进程内的安全重试已耗尽；请取消并新建任务，不能用另一次登录覆盖已保留的候选。\n");
-                }
-            }
-        });
-        serviceOptions(enrollment.command("login-batch <planId>")
-            .description("Sequentially execute isolated logins from a migration plan queue")
-            .option("--device-auth", "use the official Codex device authorization flow")
-            .option("--dry-run", "show the redacted sequential plan without starting login")
-            .option("--page-size <count>", "migration queue page size", "100"))
-            .action(async (planId, opts, command) => {
-            if (deps.config.profile?.userBoundRefreshTokens?.migrationPlans !== true) {
-                throw new CodexServiceError("The selected tenant has not enabled schema-v2 migration login plans.", "capability_not_enabled", 409);
-            }
-            const pageSize = Number(opts.pageSize);
-            if (!Number.isInteger(pageSize) || pageSize < 1 || pageSize > 100) {
-                throw new CodexServiceError("--page-size must be an integer from 1 to 100.", "invalid_configuration");
-            }
-            const batch = await executeCodexMigrationLoginBatch({
-                client: deps.clientFor(serviceConnection(opts)),
-                tenantId: deps.config.connection.tenantId,
-                planId,
-                deviceAuth: opts.deviceAuth,
-                dryRun: opts.dryRun,
-                pageSize
-            });
-            const failed = batch.counts.failed > 0
-                || ["TARGET_UNCERTAIN", "AUTHENTICATION_ERROR", "SERVICE_ERROR", "LOGIN_ERROR"]
-                    .includes(batch.stopReason);
-            if (await json(command, deps)) {
-                print(deps.output, { ok: !failed, ...batch });
-            }
-            else {
-                deps.output.write(`migration=${batch.plan.id} status=${batch.plan.status} revision=${batch.plan.revision}`
-                    + ` stop=${batch.stopReason}${batch.dryRun ? " dry-run" : ""}\n`);
-                deps.output.write(`capacity: verifiedMinimum=${batch.capacity.verifiedMinimum}, verifiedLimit=unknown,`
-                    + ` sequentialRequired=${batch.capacity.sequentialRequired}; verifiedMinimum 不是上限。\n`);
-                for (const item of batch.items) {
-                    deps.output.write(`${item.assignmentId} ${item.action}/${item.status}`
-                        + `${item.intentId ? ` intent=${item.intentId}` : ""}`
-                        + `${item.outcome ? ` outcome=${item.outcome}` : ""}`
-                        + `${item.skipReason ? ` skip=${item.skipReason}` : ""}`
-                        + `${item.safeErrorCode ? ` error=${item.safeErrorCode}` : ""}\n`);
-                }
-                deps.output.write(`summary: attempted=${batch.counts.attempted}, completed=${batch.counts.completed},`
-                    + ` failed=${batch.counts.failed}, skipped=${batch.counts.skipped}.\n`);
-            }
-            if (failed)
-                process.exitCode = 1;
-        });
-        serviceOptions(enrollment.command("cancel <intent>").description("Cancel an enrollment intent"))
-            .option("--idempotency-key <key>", "reuse a prior cancellation idempotency key")
-            .action(async (intent, opts, command) => {
-            const client = deps.clientFor(serviceConnection(opts));
-            const current = await client.getEnrollmentIntent(intent);
-            const result = await client.cancelEnrollmentIntent(intent, {
-                idempotencyKey: opts.idempotencyKey?.trim() || randomUUID(),
-                revision: current.intent.revision
-            });
-            if (await json(command, deps))
-                print(deps.output, { ok: true, ...result });
-            else
-                deps.output.write(`${result.intent.id} 已取消；状态=${result.intent.status}。\n`);
-        });
-        const retirement = codex.command("retirement")
-            .description("Remove an exact locally installed lineage for a Server retirement request");
-        serviceOptions(retirement.command("acknowledge <retirement>")
-            .description("Delete the matching managed short-lived credentials and append local evidence")
-            .option("--idempotency-key <key>", "reuse a prior local deletion acknowledgement key"))
-            .action(async (retirementId, opts, command) => {
-            const result = await executeCodexAssignmentRetirementLocalDelete({
-                client: deps.clientFor(serviceConnection(opts)),
-                retirementId,
-                env: deps.env,
-                ...(opts.idempotencyKey?.trim() ? { idempotencyKey: opts.idempotencyKey.trim() } : {})
-            });
-            if (await json(command, deps))
-                print(deps.output, { ok: true, ...result });
-            else
-                deps.output.write(`本机匹配的短效凭据已删除并记录证据；retirement=${result.retirement.id}`
-                    + `，revision=${result.retirement.revision}，状态=${result.retirement.status}。\n`
-                    + "该证据不代表其他终端已清理；最终退役仍等待全部已披露短效凭据自然过期。\n");
-        });
-    }
     const admin = codex.command("admin")
         .description("Administer server-managed Codex accounts and assignments");
+    const adminRequests = admin.command("requests")
+        .description("Review account requests and create independent device token-set bindings");
+    serviceOptions(adminRequests.command("list").description("List tenant requests, ordered by nearest expiry")
+        .option("--expiring-within <days>", "只显示指定天数内到期的非终态申请"))
+        .action(async (opts, command) => {
+        assertRequestBoundDeviceCredentialsEnabled(deps.config);
+        const expiresBefore = opts.expiringWithin
+            ? new Date(Date.now() + parsePositiveInteger(opts.expiringWithin, "--expiring-within", 3_650) * 86_400_000).toISOString()
+            : undefined;
+        const result = await deps.clientFor(serviceConnection(opts)).listV6AdminAccountRequests(expiresBefore ? { expiresBefore, includeTerminal: false } : {});
+        const items = [...result.items].sort((left, right) => Date.parse(left.validUntil ?? left.requestedValidUntil) - Date.parse(right.validUntil ?? right.requestedValidUntil));
+        if (await json(command, deps))
+            print(deps.output, success({ ...result, items }));
+        else if (items.length === 0)
+            deps.output.write(opts.expiringWithin
+                ? `未来 ${opts.expiringWithin} 天内没有即将到期的 ChatGPT/Codex 申请。\n`
+                : "当前租户没有 ChatGPT/Codex 账号申请。\n");
+        else
+            for (const item of items)
+                deps.output.write(`${formatV6Request(item)}\n`);
+    });
+    serviceOptions(adminRequests.command("replacement-candidates")
+        .description("List device bindings whose ChatGPT account needs pre-expiry replacement")
+        .option("--within <days>", "替换观察窗口天数", "30"))
+        .action(async (opts, command) => {
+        assertRequestBoundDeviceCredentialsEnabled(deps.config);
+        const replaceBefore = new Date(Date.now() + parsePositiveInteger(opts.within, "--within", 3_650) * 86_400_000).toISOString();
+        const result = await deps.clientFor(serviceConnection(opts))
+            .listV6AdminReplacementCandidates({ replaceBefore });
+        const items = [...result.items].sort((left, right) => Date.parse(left.replaceBefore) - Date.parse(right.replaceBefore));
+        if (await json(command, deps))
+            print(deps.output, success({ ...result, items }));
+        else if (items.length === 0) {
+            deps.output.write(`未来 ${opts.within} 天没有需要提前替换的设备账号。\n`);
+        }
+        else
+            for (const item of items) {
+                deps.output.write(`${item.recommendedReason}  replace-before=${item.replaceBefore}  `
+                    + `request=${item.request.id}  ${formatV6Binding(item.binding)}\n`);
+            }
+    });
+    serviceOptions(adminRequests.command("show <requestId>").description("Show one tenant account request"))
+        .action(async (requestId, opts, command) => {
+        assertRequestBoundDeviceCredentialsEnabled(deps.config);
+        const client = deps.clientFor(serviceConnection(opts));
+        const [requestResult, bindingResult] = await Promise.all([
+            client.getV6AdminAccountRequest(requestId),
+            client.listV6AdminDeviceBindings(requestId)
+        ]);
+        if (await json(command, deps))
+            print(deps.output, success({
+                request: requestResult.request, bindings: bindingResult.items
+            }));
+        else {
+            deps.output.write(`${formatV6Request(requestResult.request)}\n`);
+            for (const binding of bindingResult.items) {
+                deps.output.write(`- ${formatV6Binding(binding)}\n`);
+            }
+        }
+    });
+    serviceOptions(adminRequests.command("review <requestId>")
+        .description("Approve or reject an account request")
+        .requiredOption("--decision <decision>", "APPROVE 或 REJECT")
+        .requiredOption("--reason <text>", "审批原因，至少 5 个字符")
+        .requiredOption("--version <number>", "当前请求版本")
+        .option("--device-limit <count>", "批准的设备数量")
+        .option("--valid-from <timestamp>", "批准生效时间，必须包含时区")
+        .option("--valid-until <timestamp>", "批准到期时间，必须包含时区")
+        .option("--idempotency-key <key>", "重试时复用同一个幂等键"))
+        .action(async (requestId, opts, command) => {
+        assertRequestBoundDeviceCredentialsEnabled(deps.config);
+        const decision = opts.decision.trim().toUpperCase();
+        if (!["APPROVE", "REJECT"].includes(decision)) {
+            throw new CodexServiceError("--decision 必须是 APPROVE 或 REJECT。", "invalid_codex_account_request_review");
+        }
+        const approve = decision === "APPROVE";
+        if (approve && (!opts.deviceLimit || !opts.validFrom || !opts.validUntil)) {
+            throw new CodexServiceError("批准申请必须同时提供 --device-limit、--valid-from 和 --valid-until。", "invalid_codex_account_request_review");
+        }
+        const validFrom = approve ? parseRequestInstant(opts.validFrom, "--valid-from") : null;
+        const validUntil = approve ? parseRequestInstant(opts.validUntil, "--valid-until") : null;
+        if (validFrom && validUntil && Date.parse(validUntil) <= Date.parse(validFrom)) {
+            throw new CodexServiceError("--valid-until 必须晚于 --valid-from。", "invalid_codex_account_request_review");
+        }
+        const result = await deps.clientFor(serviceConnection(opts)).reviewV6AdminAccountRequest(requestId, {
+            schemaVersion: 6,
+            expectedRequestVersion: parseNonNegativeInteger(opts.version, "--version"),
+            decision: decision,
+            reason: opts.reason,
+            approvedDeviceLimit: approve
+                ? parsePositiveInteger(opts.deviceLimit, "--device-limit") : null,
+            validFrom,
+            validUntil
+        }, opts.idempotencyKey?.trim() || randomUUID());
+        if (await json(command, deps))
+            print(deps.output, success(result));
+        else
+            deps.output.write(`审批完成：${formatV6Request(result.request)}\n`);
+    });
+    serviceOptions(adminRequests.command("bind-device <requestId>")
+        .description("Bind another installation with its own independent complete token set")
+        .requiredOption("--installation <id>", "用户设备上显示的 installationId")
+        .requiredOption("--device-label <label>", "设备名称")
+        .requiredOption("--version <number>", "当前请求版本")
+        .option("--platform <platform>", "darwin|linux|win32|unknown", "unknown")
+        .option("--pool-entry <id>", "立即预留的独立 Token Pool entry；省略则进入等待")
+        .option("--idempotency-key <key>", "重试时复用同一个幂等键"))
+        .action(async (requestId, opts, command) => {
+        assertRequestBoundDeviceCredentialsEnabled(deps.config);
+        const platform = opts.platform.trim().toLowerCase();
+        if (!["darwin", "linux", "win32", "unknown"]
+            .includes(platform)) {
+            throw new CodexServiceError("--platform 必须是 darwin、linux、win32 或 unknown。", "invalid_codex_device_binding");
+        }
+        const result = await deps.clientFor(serviceConnection(opts)).createV6AdminDeviceBinding(requestId, {
+            schemaVersion: 6,
+            expectedRequestVersion: parseNonNegativeInteger(opts.version, "--version"),
+            device: {
+                installationId: opts.installation,
+                label: opts.deviceLabel,
+                platform: platform
+            },
+            poolEntryId: opts.poolEntry?.trim() || null
+        }, opts.idempotencyKey?.trim() || randomUUID());
+        if (await json(command, deps))
+            print(deps.output, success(result));
+        else
+            deps.output.write(`设备已绑定：${result.binding.id}  installation=${result.binding.installationId}`
+                + `  token-set=${result.binding.credentialLineageId ?? "WAITING_FOR_TOKEN"}\n`);
+    });
+    serviceOptions(adminRequests.command("replace-device-token <requestId> <bindingId>")
+        .description("Prepare an independent successor token set and switch only after device ACK")
+        .requiredOption("--version <number>", "当前请求版本")
+        .requiredOption("--reason <reason>", "SUBSCRIPTION_EXPIRING、CREDENTIAL_UNHEALTHY 或 ADMIN_REQUESTED")
+        .requiredOption("--replace-before <timestamp>", "最迟替换时间，必须包含时区")
+        .option("--pool-entry <id>", "立即预留的新独立 Token Pool entry；省略则进入等待")
+        .option("--idempotency-key <key>", "重试时复用同一个幂等键"))
+        .action(async (requestId, bindingId, opts, command) => {
+        assertRequestBoundDeviceCredentialsEnabled(deps.config);
+        const reason = opts.reason.trim().toUpperCase();
+        if (!["SUBSCRIPTION_EXPIRING", "CREDENTIAL_UNHEALTHY", "ADMIN_REQUESTED"]
+            .includes(reason)) {
+            throw new CodexServiceError("--reason 必须是 SUBSCRIPTION_EXPIRING、CREDENTIAL_UNHEALTHY 或 ADMIN_REQUESTED。", "invalid_codex_device_replacement");
+        }
+        const result = await deps.clientFor(serviceConnection(opts)).replaceV6AdminDeviceToken(requestId, bindingId, {
+            schemaVersion: 6,
+            expectedRequestVersion: parseNonNegativeInteger(opts.version, "--version"),
+            reason: reason,
+            replaceBefore: parseRequestInstant(opts.replaceBefore, "--replace-before"),
+            poolEntryId: opts.poolEntry?.trim() || null
+        }, opts.idempotencyKey?.trim() || randomUUID());
+        if (await json(command, deps))
+            print(deps.output, success(result));
+        else
+            deps.output.write("已准备设备 Token 替换：current=" + result.currentBinding.id
+                + " successor=" + result.replacementBinding.id
+                + " status=" + result.replacementBinding.status
+                + " token-set=" + (result.replacementBinding.credentialLineageId ?? "WAITING_FOR_TOKEN")
+                + "。\n旧 Token Set 会保持有效，直到该设备安装并 ACK 新 Token Set。\n");
+    });
     const adminAccounts = admin.command("accounts")
         .description("Inspect accounts, credential history, and refresh state");
     serviceOptions(adminAccounts.command("list").description("List all tenant Codex accounts"))