@tokensrc/codex 1.14.3 → 1.14.5

package/dist/commands.js

@@ -12,9 +12,11 @@ import { cleanupLegacyCodexProvider } from "./legacy-cleanup.js";
 import { executeCodexEnrollmentLogin } from "./enrollment-flow.js";
 import { executeCodexMigrationLoginBatch } from "./migration-login-batch.js";
 import { executeCodexShortLivedCredentialDelivery } from "./short-lived-delivery-flow.js";
-import { executeManagedCodexV3Login, executeManagedCodexV3Upload, reportManagedCodexV3Credentials } from "./managed-credential-v3-flow.js";
+import { executeCodexTokenPoolV4Delivery, reportManagedCodexV3Credentials } from "./managed-credential-v3-flow.js";
+import { resolveManagedCodexV3AssignmentTarget } from "./managed-credential-v3-assignment.js";
+import { executeCodexTokenPoolV4Login } from "./token-pool-v4-upload-flow.js";
 import { readManagedCodexV3State } from "./managed-credential-v3.js";
-import { profileManagedCredentialsV3Enabled } from "./profile.js";
+import { profileAccountTokenPoolV4Enabled } from "./profile.js";
 import { executeCodexAssignmentRetirementLocalDelete } from "./retirement-flow.js";
 import { clearCodexSelection, loadCodexSelection, rememberCodexSelectionProviderAccount, saveCodexSelection } from "./selection.js";
 import { installCodexShortcuts, removeCodexShortcuts } from "./shortcuts.js";
@@ -33,43 +35,6 @@ function findV3Assignment(input) {
         && item.providerAccountId === input.providerAccountId
         && item.lineageId === input.lineageId);
 }
-async function saveManagedV3Selection(input) {
-    await saveCodexSelection(input.deps.config.persistence.configDirectory, {
-        serviceUrl: input.options.server ?? input.deps.config.connection.serverUrl,
-        allowInsecurePoc: Boolean(input.options.insecurePoc || input.options.insecureHttp
-            || input.deps.config.connection.allowInsecureHttp),
-        account: {
-            id: input.managedAccountId,
-            accountId: input.providerAccountId,
-            label: input.label,
-            distributionMode: "CLIENT_MANAGED_V3",
-            assignmentId: input.assignmentId,
-            managedAccountId: input.managedAccountId,
-            providerAccountId: input.providerAccountId
-        }
-    });
-}
-async function recoverManagedV3Selection(deps, options) {
-    const state = await readManagedCodexV3State(deps.env);
-    if (!state || state.phase !== "INSTALLED" || state.authorityMode !== "CLIENT_MANAGED")
-        return undefined;
-    const current = await loadCodexSelection(deps.config.persistence.configDirectory);
-    if (current?.account.distributionMode === "CLIENT_MANAGED_V3"
-        && current.account.assignmentId === state.assignmentId
-        && current.account.managedAccountId === state.managedAccountId
-        && current.account.providerAccountId === state.providerAccountId)
-        return undefined;
-    const assignments = await deps.clientFor(serviceConnection(options)).listV3CredentialAssignments();
-    const assignment = findV3Assignment({ assignments, ...state });
-    if (!assignment || assignment.authorityMode !== "CLIENT_MANAGED") {
-        throw new CodexServiceError("Installed v3 credentials have no matching server assignment.", "lineage_version_conflict", 409);
-    }
-    await saveManagedV3Selection({
-        deps, options, assignmentId: state.assignmentId, managedAccountId: state.managedAccountId,
-        providerAccountId: state.providerAccountId, label: assignment.label
-    });
-    return state;
-}
 export function effectiveCodexCredentialRefreshBefore(requestedMs, serverManagedShortLived) {
     return serverManagedShortLived
         ? Math.min(requestedMs, SERVER_MANAGED_SHORT_LIVED_REFRESH_WINDOW_MS)
@@ -97,8 +62,8 @@ function schemaV2LifecycleEnabled(config) {
     const capabilities = config.profile?.userBoundRefreshTokens;
     return capabilities?.delivery === true || capabilities?.migrationPlans === true;
 }
-function managedCredentialsV3Enabled(config) {
-    return profileManagedCredentialsV3Enabled(config.profile);
+function accountTokenPoolV4Enabled(config) {
+    return profileAccountTokenPoolV4Enabled(config.profile);
 }
 function codexConfigPathForEnv(env) {
     const codexHome = env.CODEX_HOME?.trim();
@@ -149,7 +114,7 @@ function formatAdminAccount(account) {
 }
 async function loadAccountData(deps, options = {}) {
     const previous = await loadCodexSelection(deps.config.persistence.configDirectory);
-    if (managedCredentialsV3Enabled(deps.config)) {
+    if (accountTokenPoolV4Enabled(deps.config)) {
         const v3Assignments = await deps.clientFor(serviceConnection(options)).listV3CredentialAssignments();
         const accounts = v3Assignments.items.map((assignment) => ({
             id: assignment.managedAccountId,
@@ -232,7 +197,7 @@ async function chooseAccount(deps, requested, options = {}) {
             id: v3Assignment.managedAccountId,
             accountId: v3Assignment.providerAccountId,
             label: accountLabel,
-            distributionMode: "CLIENT_MANAGED_V3",
+            distributionMode: "CLIENT_MANAGED_V4",
             assignmentId: v3Assignment.assignmentId,
             managedAccountId: v3Assignment.managedAccountId,
             providerAccountId: v3Assignment.providerAccountId
@@ -258,22 +223,36 @@ async function chooseAccount(deps, requested, options = {}) {
 async function installCredentials(deps, selection, service) {
     const client = deps.clientFor(service);
     await cleanupLegacyCodexProvider(codexConfigPathForEnv(deps.env));
-    if (managedCredentialsV3Enabled(deps.config)) {
-        const state = await readManagedCodexV3State(deps.env);
-        if (!state || state.phase !== "INSTALLED" || state.authorityMode !== "CLIENT_MANAGED"
-            || selection.account.distributionMode !== "CLIENT_MANAGED_V3"
-            || selection.account.assignmentId !== state.assignmentId
-            || selection.account.managedAccountId !== state.managedAccountId
-            || selection.account.providerAccountId !== state.providerAccountId) {
-            throw new CodexServiceError("The selected v3 assignment does not match acknowledged local credentials; run `numa codex login` or `numa codex upload`.", "lineage_version_conflict", 409);
+    if (accountTokenPoolV4Enabled(deps.config)) {
+        if (selection.account.distributionMode !== "CLIENT_MANAGED_V4"
+            || !selection.account.assignmentId || !selection.account.managedAccountId
+            || !selection.account.providerAccountId) {
+            throw new CodexServiceError("The selected account is not a v4 token-pool assignment.", "codex_assignment_not_found", 404);
         }
         const assignments = await client.listV3CredentialAssignments();
-        const current = findV3Assignment({ assignments, ...state });
-        if (!current || current.assignmentId !== state.assignmentId || current.lineageId !== state.lineageId
-            || current.authorityMode !== "CLIENT_MANAGED") {
-            throw new CodexServiceError("The v3 credential assignment is no longer active.", "codex_assignment_not_found", 404);
+        const assignment = assignments.items.find((item) => item.assignmentId === selection.account.assignmentId
+            && item.managedAccountId === selection.account.managedAccountId
+            && item.providerAccountId === selection.account.providerAccountId);
+        if (!assignment) {
+            throw new CodexServiceError("The v4 token-pool assignment is no longer active.", "codex_assignment_not_found", 404);
         }
-        return { expiresAt: Date.parse(state.credentialExpiresAt), selection };
+        const state = await readManagedCodexV3State(deps.env);
+        if (state?.phase === "INSTALLED" && state.authorityMode === "CLIENT_MANAGED"
+            && selection.account.assignmentId === state.assignmentId
+            && selection.account.managedAccountId === state.managedAccountId
+            && selection.account.providerAccountId === state.providerAccountId
+            && assignment.lineageId === state.lineageId
+            && assignment.currentGenerationVersion === state.generationVersion
+            && assignment.authorityMode === "CLIENT_MANAGED") {
+            return { expiresAt: Date.parse(state.credentialExpiresAt), selection };
+        }
+        const delivered = await executeCodexTokenPoolV4Delivery({
+            client,
+            tenantId: deps.config.connection.tenantId,
+            assignment,
+            env: deps.env
+        });
+        return { expiresAt: Date.parse(delivered.credentialExpiresAt), selection };
     }
     if (deps.config.profile?.userBoundRefreshTokens?.delivery === true) {
         await discardCodexFileCredentialBackup(deps.env);
@@ -318,10 +297,11 @@ async function installCredentials(deps, selection, service) {
     return { expiresAt: response.expiresAt, selection };
 }
 async function selectedCredentials(deps, requested, options = {}) {
-    if (managedCredentialsV3Enabled(deps.config)) {
+    if (accountTokenPoolV4Enabled(deps.config)) {
         const state = await readManagedCodexV3State(deps.env);
         if (!state || state.phase !== "INSTALLED" || state.authorityMode !== "CLIENT_MANAGED") {
-            throw new CodexServiceError("No acknowledged v3 Codex credential is installed; run `numa codex login` or `numa codex upload`.", "managed_codex_v3_login_required", 409);
+            const selection = (await chooseAccount(deps, requested, options)).selection;
+            return installCredentials(deps, selection, serviceConnection(options));
         }
         if (requested && ![
             state.assignmentId,
@@ -329,7 +309,8 @@ async function selectedCredentials(deps, requested, options = {}) {
             state.providerAccountId,
             state.lineageId
         ].includes(requested)) {
-            throw new CodexServiceError("The requested account is not the active v3 lineage.", "codex_account_not_found", 404);
+            const selection = (await chooseAccount(deps, requested, options)).selection;
+            return installCredentials(deps, selection, serviceConnection(options));
         }
         const assignments = await deps.clientFor(serviceConnection(options)).listV3CredentialAssignments();
         const assignment = findV3Assignment({ assignments, ...state });
@@ -338,7 +319,7 @@ async function selectedCredentials(deps, requested, options = {}) {
             || assignment.providerAccountId !== state.providerAccountId
             || assignment.lineageId !== state.lineageId
             || assignment.authorityMode !== "CLIENT_MANAGED") {
-            throw new CodexServiceError("The local v3 lineage no longer matches the server assignment.", "lineage_version_conflict", 409);
+            throw new CodexServiceError("The local v4 lineage no longer matches the server assignment.", "lineage_version_conflict", 409);
         }
         const selection = await saveCodexSelection(deps.config.persistence.configDirectory, {
             serviceUrl: options.server ?? deps.config.connection.serverUrl,
@@ -347,7 +328,7 @@ async function selectedCredentials(deps, requested, options = {}) {
                 id: state.managedAccountId,
                 accountId: state.providerAccountId,
                 label: assignment.label,
-                distributionMode: "CLIENT_MANAGED_V3",
+                distributionMode: "CLIENT_MANAGED_V4",
                 assignmentId: state.assignmentId,
                 managedAccountId: state.managedAccountId,
                 providerAccountId: state.providerAccountId
@@ -420,7 +401,7 @@ async function selectedCredentials(deps, requested, options = {}) {
     return { selection, expiresAt: local.expiresAt };
 }
 async function launchWithSelectedCredentials(deps, selected, launch) {
-    if (managedCredentialsV3Enabled(deps.config)) {
+    if (accountTokenPoolV4Enabled(deps.config)) {
         try {
             return await launch();
         }
@@ -479,57 +460,43 @@ export function registerCodexCommands(program, deps, options = {}) {
             else
                 deps.output.write("Logged out.\n");
         });
-    if (!includeAuthCommands && managedCredentialsV3Enabled(deps.config))
+    if (!includeAuthCommands && accountTokenPoolV4Enabled(deps.config))
         serviceOptions(codex.command("login")
-            .description("Run an isolated official Codex login and install client-managed credentials"))
+            .description("Run an isolated official Codex login and enroll an unbound or explicitly assigned credential"))
             .option("--device-auth", "use the official Codex device authorization flow")
+            .option("--assign-to <username-or-email>", "assign by exact username or email instead of adding to the unbound pool")
+            .option("--assign-to-subject <uuid>", "assign directly to a canonical Keycloak subject UUID")
+            .option("--yes", "confirm direct subject assignment")
             .action(async (opts, command) => {
-            if (!managedCredentialsV3Enabled(deps.config)) {
-                throw new CodexServiceError("Managed Codex credential v3 is not enabled by the verified platform profile.", "managed_codex_v3_not_enabled", 409);
+            if (!accountTokenPoolV4Enabled(deps.config)) {
+                throw new CodexServiceError("The Codex v4 account token pool is not enabled by the verified platform profile.", "codex_token_pool_v4_not_enabled", 409);
             }
-            const recovered = await recoverManagedV3Selection(deps, opts);
-            if (recovered) {
-                const output = {
-                    enrollmentId: recovered.enrollmentId,
-                    assignmentId: recovered.assignmentId,
-                    managedAccountId: recovered.managedAccountId,
-                    providerAccountId: recovered.providerAccountId,
-                    lineageId: recovered.lineageId,
-                    generationVersion: recovered.generationVersion,
-                    authorityMode: recovered.authorityMode,
-                    credentialExpiresAt: recovered.credentialExpiresAt,
-                    selectionRecovered: true
-                };
-                if (await json(command, deps))
-                    print(deps.output, success(output));
-                else
-                    deps.output.write(`Codex login was already installed; recovered its local selection; generation=${recovered.generationVersion}.\n`);
-                return;
-            }
-            const result = await executeManagedCodexV3Login({
+            const target = resolveManagedCodexV3AssignmentTarget(opts);
+            const result = await executeCodexTokenPoolV4Login({
                 client: deps.clientFor(serviceConnection(opts)),
                 tenantId: deps.config.connection.tenantId,
+                target,
                 env: deps.env,
                 deviceAuth: opts.deviceAuth
             });
-            await saveManagedV3Selection({
-                deps, options: opts, assignmentId: result.assignmentId, managedAccountId: result.managedAccountId,
-                providerAccountId: result.providerAccountId, label: "Codex account"
-            });
             const output = {
-                enrollmentId: result.enrollmentId,
+                uploadId: result.uploadId,
+                status: result.status,
+                placement: result.placement,
                 assignmentId: result.assignmentId,
                 managedAccountId: result.managedAccountId,
                 providerAccountId: result.providerAccountId,
-                lineageId: result.lineageId,
-                generationVersion: result.generationVersion,
-                authorityMode: result.authorityMode,
-                credentialExpiresAt: result.credentialExpiresAt
+                poolEntryId: result.poolEntryId,
+                assignedUserSubject: result.assignedUserSubject,
+                reservedLineageId: result.reservedLineageId,
+                target: result.target,
+                completedAt: result.completedAt,
+                replayed: result.replayed
             };
             if (await json(command, deps))
                 print(deps.output, success(output));
             else
-                deps.output.write(`Codex login installed and acknowledged for ${result.providerAccountId}; generation=${result.generationVersion}.\n`);
+                deps.output.write(`Codex credential uploaded to token pool; status=${result.status}, placement=${result.placement}.\n`);
         });
     serviceOptions(codex.command("list").description("List available Codex accounts without downloading credentials"))
         .action(async (opts, command) => {
@@ -664,7 +631,7 @@ export function registerCodexCommands(program, deps, options = {}) {
             throw new Error("auth-agent replaces the current login; add --replace-login to confirm.");
         if (opts.credentialStore !== "file")
             throw new Error("ChatGPT auth.json 同步目前仅支持 --credential-store file。");
-        if (managedCredentialsV3Enabled(deps.config)) {
+        if (accountTokenPoolV4Enabled(deps.config)) {
             const interval = Number(opts.interval) * 1_000;
             if (!Number.isFinite(interval) || interval <= 0)
                 throw new Error("--interval must be positive.");
@@ -737,55 +704,12 @@ export function registerCodexCommands(program, deps, options = {}) {
             await new Promise((resolve) => setTimeout(resolve, interval));
         } while (true);
     });
-    serviceOptions(codex.command("upload").description("Enroll official Codex credentials (v3) or upload the legacy local pool"))
+    serviceOptions(codex.command("upload").description("Upload the legacy v1 local account pool"))
         .option("--storage <path>", "account storage path")
         .option("--source <name>", "upload source")
         .action(async (opts, command) => {
-        if (managedCredentialsV3Enabled(deps.config)) {
-            if (opts.storage || opts.source) {
-                throw new CodexServiceError("Managed credential v3 upload reads only the official CODEX_HOME/auth.json.", "invalid_configuration");
-            }
-            const recovered = await recoverManagedV3Selection(deps, opts);
-            if (recovered) {
-                if (await json(command, deps))
-                    print(deps.output, success({
-                        assignmentId: recovered.assignmentId,
-                        managedAccountId: recovered.managedAccountId,
-                        providerAccountId: recovered.providerAccountId,
-                        lineageId: recovered.lineageId,
-                        generationVersion: recovered.generationVersion,
-                        authorityMode: recovered.authorityMode,
-                        credentialExpiresAt: recovered.credentialExpiresAt,
-                        selectionRecovered: true
-                    }));
-                else
-                    deps.output.write(`Official Codex credentials were already installed; recovered their local selection; generation=${recovered.generationVersion}.\n`);
-                return;
-            }
-            const result = await executeManagedCodexV3Upload({
-                client: deps.clientFor(serviceConnection(opts)),
-                tenantId: deps.config.connection.tenantId,
-                env: deps.env
-            });
-            await saveManagedV3Selection({
-                deps, options: opts, assignmentId: result.assignmentId, managedAccountId: result.managedAccountId,
-                providerAccountId: result.providerAccountId, label: "Codex account"
-            });
-            const output = {
-                enrollmentId: result.enrollmentId,
-                assignmentId: result.assignmentId,
-                managedAccountId: result.managedAccountId,
-                providerAccountId: result.providerAccountId,
-                lineageId: result.lineageId,
-                generationVersion: result.generationVersion,
-                authorityMode: result.authorityMode,
-                credentialExpiresAt: result.credentialExpiresAt
-            };
-            if (await json(command, deps))
-                print(deps.output, success(output));
-            else
-                deps.output.write(`Official Codex credentials enrolled, installed, and acknowledged; generation=${result.generationVersion}.\n`);
-            return;
+        if (accountTokenPoolV4Enabled(deps.config)) {
+            throw new CodexServiceError("This tenant uses the v4 RT pool. Administrators must run `numa codex login`; v1 pool upload is compatibility-only.", "codex_token_pool_v4_login_required", 409);
         }
         assertLegacyManagementEnabled(deps.config);
         if (opts.storage)
@@ -845,124 +769,126 @@ export function registerCodexCommands(program, deps, options = {}) {
         if (failures.length > 0)
             process.exitCode = 1;
     });
-    const enrollment = codex.command("enrollment")
-        .description("Execute administrator-created one-shot Codex login intents");
-    serviceOptions(enrollment.command("status <intent>").description("Show redacted enrollment intent status"))
-        .action(async (intent, opts, command) => {
-        const result = await deps.clientFor(serviceConnection(opts)).getEnrollmentIntent(intent);
-        if (await json(command, deps)) {
-            print(deps.output, { ok: true, ...result });
-            return;
-        }
-        deps.output.write(`${result.intent.id}  ${result.intent.type}  ${result.intent.status}`
-            + `  revision=${result.intent.revision}\n`);
-        deps.output.write(`expires=${result.intent.expiresAt}`
-            + `${result.intent.assignmentId ? `  assignment=${result.intent.assignmentId}` : ""}`
-            + `${result.intent.managedAccountId ? `  account=${result.intent.managedAccountId}` : ""}\n`);
-        if (!result.capabilities.candidateUpload) {
-            deps.output.write("安全候选上传尚未启用；当前任务只能查询或取消，不会启动 OpenAI 登录。\n");
-        }
-    });
-    serviceOptions(enrollment.command("login <intent>")
-        .description("Run one isolated official Codex login for an enrollment intent"))
-        .option("--device-auth", "use the official Codex device authorization flow")
-        .action(async (intent, _opts, command) => {
-        const result = await executeCodexEnrollmentLogin({
-            client: deps.clientFor(serviceConnection(_opts)),
-            tenantId: deps.config.connection.tenantId,
-            intentId: intent,
-            deviceAuth: _opts.deviceAuth
+    if (schemaV2LifecycleEnabled(deps.config)) {
+        const enrollment = codex.command("enrollment")
+            .description("Execute administrator-created one-shot Codex login intents");
+        serviceOptions(enrollment.command("status <intent>").description("Show redacted enrollment intent status"))
+            .action(async (intent, opts, command) => {
+            const result = await deps.clientFor(serviceConnection(opts)).getEnrollmentIntent(intent);
+            if (await json(command, deps)) {
+                print(deps.output, { ok: true, ...result });
+                return;
+            }
+            deps.output.write(`${result.intent.id}  ${result.intent.type}  ${result.intent.status}`
+                + `  revision=${result.intent.revision}\n`);
+            deps.output.write(`expires=${result.intent.expiresAt}`
+                + `${result.intent.assignmentId ? `  assignment=${result.intent.assignmentId}` : ""}`
+                + `${result.intent.managedAccountId ? `  account=${result.intent.managedAccountId}` : ""}\n`);
+            if (!result.capabilities.candidateUpload) {
+                deps.output.write("安全候选上传尚未启用；当前任务只能查询或取消，不会启动 OpenAI 登录。\n");
+            }
         });
-        if (await json(command, deps))
-            print(deps.output, { ok: true, ...result });
-        else {
-            deps.output.write(`${result.intent.id} 登录候选已处理；状态=${result.intent.status}`
-                + `${result.result.managedAccountId ? `，账号=${result.result.managedAccountId}` : ""}`
-                + `${result.result.lineageId ? `，lineage=${result.result.lineageId}` : ""}`
-                + "。\n");
-            if (result.result.outcome === "TEMPORARILY_UNAVAILABLE") {
-                deps.output.write("同一进程内的安全重试已耗尽；请取消并新建任务，不能用另一次登录覆盖已保留的候选。\n");
+        serviceOptions(enrollment.command("login <intent>")
+            .description("Run one isolated official Codex login for an enrollment intent"))
+            .option("--device-auth", "use the official Codex device authorization flow")
+            .action(async (intent, _opts, command) => {
+            const result = await executeCodexEnrollmentLogin({
+                client: deps.clientFor(serviceConnection(_opts)),
+                tenantId: deps.config.connection.tenantId,
+                intentId: intent,
+                deviceAuth: _opts.deviceAuth
+            });
+            if (await json(command, deps))
+                print(deps.output, { ok: true, ...result });
+            else {
+                deps.output.write(`${result.intent.id} 登录候选已处理；状态=${result.intent.status}`
+                    + `${result.result.managedAccountId ? `，账号=${result.result.managedAccountId}` : ""}`
+                    + `${result.result.lineageId ? `，lineage=${result.result.lineageId}` : ""}`
+                    + "。\n");
+                if (result.result.outcome === "TEMPORARILY_UNAVAILABLE") {
+                    deps.output.write("同一进程内的安全重试已耗尽；请取消并新建任务，不能用另一次登录覆盖已保留的候选。\n");
+                }
             }
-        }
-    });
-    serviceOptions(enrollment.command("login-batch <planId>")
-        .description("Sequentially execute isolated logins from a migration plan queue")
-        .option("--device-auth", "use the official Codex device authorization flow")
-        .option("--dry-run", "show the redacted sequential plan without starting login")
-        .option("--page-size <count>", "migration queue page size", "100"))
-        .action(async (planId, opts, command) => {
-        if (deps.config.profile?.userBoundRefreshTokens?.migrationPlans !== true) {
-            throw new CodexServiceError("The selected tenant has not enabled schema-v2 migration login plans.", "capability_not_enabled", 409);
-        }
-        const pageSize = Number(opts.pageSize);
-        if (!Number.isInteger(pageSize) || pageSize < 1 || pageSize > 100) {
-            throw new CodexServiceError("--page-size must be an integer from 1 to 100.", "invalid_configuration");
-        }
-        const batch = await executeCodexMigrationLoginBatch({
-            client: deps.clientFor(serviceConnection(opts)),
-            tenantId: deps.config.connection.tenantId,
-            planId,
-            deviceAuth: opts.deviceAuth,
-            dryRun: opts.dryRun,
-            pageSize
         });
-        const failed = batch.counts.failed > 0
-            || ["TARGET_UNCERTAIN", "AUTHENTICATION_ERROR", "SERVICE_ERROR", "LOGIN_ERROR"]
-                .includes(batch.stopReason);
-        if (await json(command, deps)) {
-            print(deps.output, { ok: !failed, ...batch });
-        }
-        else {
-            deps.output.write(`migration=${batch.plan.id} status=${batch.plan.status} revision=${batch.plan.revision}`
-                + ` stop=${batch.stopReason}${batch.dryRun ? " dry-run" : ""}\n`);
-            deps.output.write(`capacity: verifiedMinimum=${batch.capacity.verifiedMinimum}, verifiedLimit=unknown,`
-                + ` sequentialRequired=${batch.capacity.sequentialRequired}; verifiedMinimum 不是上限。\n`);
-            for (const item of batch.items) {
-                deps.output.write(`${item.assignmentId} ${item.action}/${item.status}`
-                    + `${item.intentId ? ` intent=${item.intentId}` : ""}`
-                    + `${item.outcome ? ` outcome=${item.outcome}` : ""}`
-                    + `${item.skipReason ? ` skip=${item.skipReason}` : ""}`
-                    + `${item.safeErrorCode ? ` error=${item.safeErrorCode}` : ""}\n`);
+        serviceOptions(enrollment.command("login-batch <planId>")
+            .description("Sequentially execute isolated logins from a migration plan queue")
+            .option("--device-auth", "use the official Codex device authorization flow")
+            .option("--dry-run", "show the redacted sequential plan without starting login")
+            .option("--page-size <count>", "migration queue page size", "100"))
+            .action(async (planId, opts, command) => {
+            if (deps.config.profile?.userBoundRefreshTokens?.migrationPlans !== true) {
+                throw new CodexServiceError("The selected tenant has not enabled schema-v2 migration login plans.", "capability_not_enabled", 409);
             }
-            deps.output.write(`summary: attempted=${batch.counts.attempted}, completed=${batch.counts.completed},`
-                + ` failed=${batch.counts.failed}, skipped=${batch.counts.skipped}.\n`);
-        }
-        if (failed)
-            process.exitCode = 1;
-    });
-    serviceOptions(enrollment.command("cancel <intent>").description("Cancel an enrollment intent"))
-        .option("--idempotency-key <key>", "reuse a prior cancellation idempotency key")
-        .action(async (intent, opts, command) => {
-        const client = deps.clientFor(serviceConnection(opts));
-        const current = await client.getEnrollmentIntent(intent);
-        const result = await client.cancelEnrollmentIntent(intent, {
-            idempotencyKey: opts.idempotencyKey?.trim() || randomUUID(),
-            revision: current.intent.revision
+            const pageSize = Number(opts.pageSize);
+            if (!Number.isInteger(pageSize) || pageSize < 1 || pageSize > 100) {
+                throw new CodexServiceError("--page-size must be an integer from 1 to 100.", "invalid_configuration");
+            }
+            const batch = await executeCodexMigrationLoginBatch({
+                client: deps.clientFor(serviceConnection(opts)),
+                tenantId: deps.config.connection.tenantId,
+                planId,
+                deviceAuth: opts.deviceAuth,
+                dryRun: opts.dryRun,
+                pageSize
+            });
+            const failed = batch.counts.failed > 0
+                || ["TARGET_UNCERTAIN", "AUTHENTICATION_ERROR", "SERVICE_ERROR", "LOGIN_ERROR"]
+                    .includes(batch.stopReason);
+            if (await json(command, deps)) {
+                print(deps.output, { ok: !failed, ...batch });
+            }
+            else {
+                deps.output.write(`migration=${batch.plan.id} status=${batch.plan.status} revision=${batch.plan.revision}`
+                    + ` stop=${batch.stopReason}${batch.dryRun ? " dry-run" : ""}\n`);
+                deps.output.write(`capacity: verifiedMinimum=${batch.capacity.verifiedMinimum}, verifiedLimit=unknown,`
+                    + ` sequentialRequired=${batch.capacity.sequentialRequired}; verifiedMinimum 不是上限。\n`);
+                for (const item of batch.items) {
+                    deps.output.write(`${item.assignmentId} ${item.action}/${item.status}`
+                        + `${item.intentId ? ` intent=${item.intentId}` : ""}`
+                        + `${item.outcome ? ` outcome=${item.outcome}` : ""}`
+                        + `${item.skipReason ? ` skip=${item.skipReason}` : ""}`
+                        + `${item.safeErrorCode ? ` error=${item.safeErrorCode}` : ""}\n`);
+                }
+                deps.output.write(`summary: attempted=${batch.counts.attempted}, completed=${batch.counts.completed},`
+                    + ` failed=${batch.counts.failed}, skipped=${batch.counts.skipped}.\n`);
+            }
+            if (failed)
+                process.exitCode = 1;
         });
-        if (await json(command, deps))
-            print(deps.output, { ok: true, ...result });
-        else
-            deps.output.write(`${result.intent.id} 已取消；状态=${result.intent.status}。\n`);
-    });
-    const retirement = codex.command("retirement")
-        .description("Remove an exact locally installed lineage for a Server retirement request");
-    serviceOptions(retirement.command("acknowledge <retirement>")
-        .description("Delete the matching managed short-lived credentials and append local evidence")
-        .option("--idempotency-key <key>", "reuse a prior local deletion acknowledgement key"))
-        .action(async (retirementId, opts, command) => {
-        const result = await executeCodexAssignmentRetirementLocalDelete({
-            client: deps.clientFor(serviceConnection(opts)),
-            retirementId,
-            env: deps.env,
-            ...(opts.idempotencyKey?.trim() ? { idempotencyKey: opts.idempotencyKey.trim() } : {})
+        serviceOptions(enrollment.command("cancel <intent>").description("Cancel an enrollment intent"))
+            .option("--idempotency-key <key>", "reuse a prior cancellation idempotency key")
+            .action(async (intent, opts, command) => {
+            const client = deps.clientFor(serviceConnection(opts));
+            const current = await client.getEnrollmentIntent(intent);
+            const result = await client.cancelEnrollmentIntent(intent, {
+                idempotencyKey: opts.idempotencyKey?.trim() || randomUUID(),
+                revision: current.intent.revision
+            });
+            if (await json(command, deps))
+                print(deps.output, { ok: true, ...result });
+            else
+                deps.output.write(`${result.intent.id} 已取消；状态=${result.intent.status}。\n`);
         });
-        if (await json(command, deps))
-            print(deps.output, { ok: true, ...result });
-        else
-            deps.output.write(`本机匹配的短效凭据已删除并记录证据；retirement=${result.retirement.id}`
-                + `，revision=${result.retirement.revision}，状态=${result.retirement.status}。\n`
-                + "该证据不代表其他终端已清理；最终退役仍等待全部已披露短效凭据自然过期。\n");
-    });
+        const retirement = codex.command("retirement")
+            .description("Remove an exact locally installed lineage for a Server retirement request");
+        serviceOptions(retirement.command("acknowledge <retirement>")
+            .description("Delete the matching managed short-lived credentials and append local evidence")
+            .option("--idempotency-key <key>", "reuse a prior local deletion acknowledgement key"))
+            .action(async (retirementId, opts, command) => {
+            const result = await executeCodexAssignmentRetirementLocalDelete({
+                client: deps.clientFor(serviceConnection(opts)),
+                retirementId,
+                env: deps.env,
+                ...(opts.idempotencyKey?.trim() ? { idempotencyKey: opts.idempotencyKey.trim() } : {})
+            });
+            if (await json(command, deps))
+                print(deps.output, { ok: true, ...result });
+            else
+                deps.output.write(`本机匹配的短效凭据已删除并记录证据；retirement=${result.retirement.id}`
+                    + `，revision=${result.retirement.revision}，状态=${result.retirement.status}。\n`
+                    + "该证据不代表其他终端已清理；最终退役仍等待全部已披露短效凭据自然过期。\n");
+        });
+    }
     const admin = codex.command("admin")
         .description("Administer server-managed Codex accounts and assignments");
     const adminAccounts = admin.command("accounts")