@tokensrc/codex 1.14.4 → 1.14.6

package/dist/client.js

@@ -198,7 +198,7 @@ export class CodexServiceClient {
     async listV3CredentialAssignments() {
         const parsed = CodexV3CredentialAssignmentListResponseSchema.safeParse(await this.request(CODEX_V3_CREDENTIAL_ASSIGNMENTS_PATH));
         if (!parsed.success) {
-            throw new CodexServiceError("Invalid Codex v3 credential assignments response.", "invalid_codex_service_response");
+            throw new CodexServiceError("Invalid Codex v4 token-pool assignments response.", "invalid_codex_service_response");
         }
         return parsed.data;
     }
@@ -216,7 +216,7 @@ export class CodexServiceClient {
     requireV3Delivery(parsed, assignmentId, clientRequestId) {
         if (!parsed.success || parsed.data.delivery.assignmentId !== assignmentId
             || parsed.data.delivery.clientRequestId !== clientRequestId) {
-            throw new CodexServiceError("Invalid or mismatched Codex v3 full delivery response.", "invalid_codex_service_response");
+            throw new CodexServiceError("Invalid or mismatched Codex v4 full delivery response.", "invalid_codex_service_response");
         }
         return parsed.data;
     }
@@ -226,7 +226,7 @@ export class CodexServiceClient {
         const parsed = CodexV3FullCredentialDeliveryAckResponseSchema.safeParse(await this.request(codexV3FullCredentialDeliveryAckPath(deliveryId), { method: "POST", body, headers: { "Idempotency-Key": key } }));
         if (!parsed.success || parsed.data.delivery.id !== deliveryId
             || parsed.data.delivery.generationVersion !== body.generationVersion) {
-            throw new CodexServiceError("Invalid or mismatched Codex v3 delivery ACK response.", "invalid_codex_service_response");
+            throw new CodexServiceError("Invalid or mismatched Codex v4 delivery ACK response.", "invalid_codex_service_response");
         }
         return parsed.data;
     }
@@ -249,7 +249,7 @@ export class CodexServiceClient {
             || parsed.data.report.accessTokenHealth !== expected.accessTokenHealth
             || parsed.data.report.refreshTokenHealth !== expected.refreshTokenHealth
             || parsed.data.report.observedAt !== expected.observedAt) {
-            throw new CodexServiceError("Invalid or mismatched Codex v3 generation report response.", "invalid_codex_service_response");
+            throw new CodexServiceError("Invalid or mismatched Codex v4 generation report response.", "invalid_codex_service_response");
         }
         return parsed.data;
     }

package/dist/command-directory.js

@@ -3,7 +3,7 @@ const definitions = [
     { name: "login", description: "Enroll an unbound or explicitly assigned official Codex credential", command: "codex login", summary: "默认加入未绑定凭据池；可按用户名/邮箱或经确认的 Keycloak subject 直接分配，上传者仅作为审计身份", access: "authenticated", examples: ["numa codex login", "numa codex login --assign-to user@example.com", "numa codex login --assign-to-subject 01234567-89ab-cdef-0123-456789abcdef --yes"], nestedOnly: true },
     { name: "logout", description: "Remove the standalone OIDC token cache", command: "logout", summary: "退出独立 Codex CLI", access: "public", examples: ["tokensrc-codex logout"], standaloneOnly: true },
     { name: "list", description: "List available Codex accounts", command: "codex list [-u|--server <url>]", summary: "列出服务端 Codex 账号元数据，不传输 refresh token", access: "authenticated", examples: ["numa codex list --server https://platform.example/api"] },
-    { name: "upload", description: "Enroll the official Codex login or upload the legacy local pool", command: "codex upload [-u|--server <url>]", summary: "v3 读取官方 CODEX_HOME/auth.json 完整凭据并完成托管安装；旧 profile 保持批量池上传", access: "authenticated", examples: ["numa codex upload --server https://platform.example/api", "numa codex upload --storage ~/.codex/multi-auth/openai-codex-accounts.json"] },
+    { name: "upload", description: "Upload the legacy v1 local account pool", command: "codex upload [-u|--server <url>]", summary: "仅用于 v1 兼容账号批量导入；新账号统一运行 numa codex login 进入 v4 RT 池", access: "authenticated", examples: ["numa codex upload --storage ~/.codex/multi-auth/openai-codex-accounts.json"] },
     { name: "use", description: "Select an account and install official Codex credentials", command: "codex use [account]", summary: "选择服务端账号并写入官方 ChatGPT auth.json", access: "authenticated", examples: ["numa codex use acct_xxx"] },
     { name: "run", description: "Launch the official Codex CLI", command: "codex run [-s|--select-account|-a|--account <id>] [-u|--server <url>] [--] [codexArgs...]", summary: "选择或复用 ChatGPT 账号后启动官方 Codex；模型流量不经过宿主", access: "authenticated", examples: ["numa codex run -s", "numa codex run --account acct_xxx", "numa codex run -- exec \"完成长任务\""] },
     { name: "app", description: "Launch the official Codex desktop app", command: "codex app [workspace] [-s|--select-account|-a|--account <id>] [-u|--server <url>]", summary: "检查批准版本并使用官方 ChatGPT 登录启动 macOS/Windows Codex 桌面 App", access: "authenticated", examples: ["numa codex app . -s", "numa codex app . --account acct_xxx"] },

package/dist/command-directory.js.map

@@ -1 +1 @@
-{"version":3,"file":"command-directory.js","sourceRoot":"","sources":["../src/command-directory.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,GAAsC;IACrD,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,wCAAwC,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,sBAAsB,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE;IACjM,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,oEAAoE,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,2DAA2D,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,kBAAkB,EAAE,+CAA+C,EAAE,iFAAiF,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE;IACjZ,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,wCAAwC,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,uBAAuB,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE;IACpM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,+BAA+B,EAAE,OAAO,EAAE,gCAAgC,EAAE,OAAO,EAAE,qCAAqC,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,uDAAuD,CAAC,EAAE;IACvP,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,iEAAiE,EAAE,OAAO,EAAE,kCAAkC,EAAE,OAAO,EAAE,4DAA4D,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,yDAAyD,EAAE,4EAA4E,CAAC,EAAE;IACpY,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,0DAA0D,EAAE,OAAO,EAAE,qBAAqB,EAAE,OAAO,EAAE,gCAAgC,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,yBAAyB,CAAC,EAAE;IACnO,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,+BAA+B,EAAE,OAAO,EAAE,2FAA2F,EAAE,OAAO,EAAE,uCAAuC,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,mBAAmB,EAAE,mCAAmC,EAAE,kCAAkC,CAAC,EAAE;IACxV,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,uCAAuC,EAAE,OAAO,EAAE,mFAAmF,EAAE,OAAO,EAAE,qDAAqD,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,qBAAqB,EAAE,qCAAqC,CAAC,EAAE;IACtU,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,sCAAsC,EAAE,OAAO,EAAE,qGAAqG,EAAE,OAAO,EAAE,yDAAyD,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,6BAA6B,EAAE,wDAAwD,EAAE,4BAA4B,CAAC,EAAE;IAClZ,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,+CAA+C,EAAE,OAAO,EAAE,4BAA4B,EAAE,OAAO,EAAE,oCAAoC,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,gDAAgD,EAAE,8CAA8C,CAAC,EAAE;IACjT,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,mDAAmD,EAAE,OAAO,EAAE,oCAAoC,EAAE,OAAO,EAAE,uCAAuC,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,gCAAgC,EAAE,wDAAwD,EAAE,4CAA4C,EAAE,mCAAmC,EAAE,mEAAmE,EAAE,oDAAoD,CAAC,EAAE;IACngB,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,6DAA6D,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,6CAA6C,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,0BAA0B,CAAC,EAAE;IACzO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,yCAAyC,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,gCAAgC,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,kBAAkB,CAAC,EAAE;CACtL,CAAC;AAEX,MAAM,UAAU,2BAA2B,CACzC,OAAO,GAA2C,EAAE;IAEpD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC;IACvC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;IACxE,OAAO,WAAW;SACf,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;SAClE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACd,GAAG,IAAI;QACP,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;QACvE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;KAC/E,CAAC,CAAC,CAAC;AACR,CAAC;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAG,2BAA2B,EAAE,CAAC;AACrE,MAAM,CAAC,MAAM,8BAA8B,GAAG,2BAA2B,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC"}
+{"version":3,"file":"command-directory.js","sourceRoot":"","sources":["../src/command-directory.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,GAAsC;IACrD,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,wCAAwC,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,sBAAsB,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE;IACjM,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,oEAAoE,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,2DAA2D,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,kBAAkB,EAAE,+CAA+C,EAAE,iFAAiF,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE;IACjZ,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,wCAAwC,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,uBAAuB,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE;IACpM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,+BAA+B,EAAE,OAAO,EAAE,gCAAgC,EAAE,OAAO,EAAE,qCAAqC,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,uDAAuD,CAAC,EAAE;IACvP,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,yCAAyC,EAAE,OAAO,EAAE,kCAAkC,EAAE,OAAO,EAAE,qDAAqD,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,4EAA4E,CAAC,EAAE;IAC1S,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,0DAA0D,EAAE,OAAO,EAAE,qBAAqB,EAAE,OAAO,EAAE,gCAAgC,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,yBAAyB,CAAC,EAAE;IACnO,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,+BAA+B,EAAE,OAAO,EAAE,2FAA2F,EAAE,OAAO,EAAE,uCAAuC,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,mBAAmB,EAAE,mCAAmC,EAAE,kCAAkC,CAAC,EAAE;IACxV,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,uCAAuC,EAAE,OAAO,EAAE,mFAAmF,EAAE,OAAO,EAAE,qDAAqD,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,qBAAqB,EAAE,qCAAqC,CAAC,EAAE;IACtU,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,sCAAsC,EAAE,OAAO,EAAE,qGAAqG,EAAE,OAAO,EAAE,yDAAyD,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,6BAA6B,EAAE,wDAAwD,EAAE,4BAA4B,CAAC,EAAE;IAClZ,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,+CAA+C,EAAE,OAAO,EAAE,4BAA4B,EAAE,OAAO,EAAE,oCAAoC,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,gDAAgD,EAAE,8CAA8C,CAAC,EAAE;IACjT,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,mDAAmD,EAAE,OAAO,EAAE,oCAAoC,EAAE,OAAO,EAAE,uCAAuC,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,gCAAgC,EAAE,wDAAwD,EAAE,4CAA4C,EAAE,mCAAmC,EAAE,mEAAmE,EAAE,oDAAoD,CAAC,EAAE;IACngB,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,6DAA6D,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,6CAA6C,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,0BAA0B,CAAC,EAAE;IACzO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,yCAAyC,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,gCAAgC,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,kBAAkB,CAAC,EAAE;CACtL,CAAC;AAEX,MAAM,UAAU,2BAA2B,CACzC,OAAO,GAA2C,EAAE;IAEpD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC;IACvC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;IACxE,OAAO,WAAW;SACf,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;SAClE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACd,GAAG,IAAI;QACP,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;QACvE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;KAC/E,CAAC,CAAC,CAAC;AACR,CAAC;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAG,2BAA2B,EAAE,CAAC;AACrE,MAAM,CAAC,MAAM,8BAA8B,GAAG,2BAA2B,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC"}

package/dist/commands.js

@@ -12,11 +12,11 @@ import { cleanupLegacyCodexProvider } from "./legacy-cleanup.js";
 import { executeCodexEnrollmentLogin } from "./enrollment-flow.js";
 import { executeCodexMigrationLoginBatch } from "./migration-login-batch.js";
 import { executeCodexShortLivedCredentialDelivery } from "./short-lived-delivery-flow.js";
-import { executeManagedCodexV3Upload, reportManagedCodexV3Credentials } from "./managed-credential-v3-flow.js";
+import { executeCodexTokenPoolV4Delivery, reportManagedCodexV3Credentials } from "./managed-credential-v3-flow.js";
 import { resolveManagedCodexV3AssignmentTarget } from "./managed-credential-v3-assignment.js";
 import { executeCodexTokenPoolV4Login } from "./token-pool-v4-upload-flow.js";
 import { readManagedCodexV3State } from "./managed-credential-v3.js";
-import { profileManagedCredentialsV3Enabled } from "./profile.js";
+import { profileAccountTokenPoolV4Enabled } from "./profile.js";
 import { executeCodexAssignmentRetirementLocalDelete } from "./retirement-flow.js";
 import { clearCodexSelection, loadCodexSelection, rememberCodexSelectionProviderAccount, saveCodexSelection } from "./selection.js";
 import { installCodexShortcuts, removeCodexShortcuts } from "./shortcuts.js";
@@ -35,43 +35,6 @@ function findV3Assignment(input) {
         && item.providerAccountId === input.providerAccountId
         && item.lineageId === input.lineageId);
 }
-async function saveManagedV3Selection(input) {
-    await saveCodexSelection(input.deps.config.persistence.configDirectory, {
-        serviceUrl: input.options.server ?? input.deps.config.connection.serverUrl,
-        allowInsecurePoc: Boolean(input.options.insecurePoc || input.options.insecureHttp
-            || input.deps.config.connection.allowInsecureHttp),
-        account: {
-            id: input.managedAccountId,
-            accountId: input.providerAccountId,
-            label: input.label,
-            distributionMode: "CLIENT_MANAGED_V3",
-            assignmentId: input.assignmentId,
-            managedAccountId: input.managedAccountId,
-            providerAccountId: input.providerAccountId
-        }
-    });
-}
-async function recoverManagedV3Selection(deps, options) {
-    const state = await readManagedCodexV3State(deps.env);
-    if (!state || state.phase !== "INSTALLED" || state.authorityMode !== "CLIENT_MANAGED")
-        return undefined;
-    const current = await loadCodexSelection(deps.config.persistence.configDirectory);
-    if (current?.account.distributionMode === "CLIENT_MANAGED_V3"
-        && current.account.assignmentId === state.assignmentId
-        && current.account.managedAccountId === state.managedAccountId
-        && current.account.providerAccountId === state.providerAccountId)
-        return undefined;
-    const assignments = await deps.clientFor(serviceConnection(options)).listV3CredentialAssignments();
-    const assignment = findV3Assignment({ assignments, ...state });
-    if (!assignment || assignment.authorityMode !== "CLIENT_MANAGED") {
-        throw new CodexServiceError("Installed v3 credentials have no matching server assignment.", "lineage_version_conflict", 409);
-    }
-    await saveManagedV3Selection({
-        deps, options, assignmentId: state.assignmentId, managedAccountId: state.managedAccountId,
-        providerAccountId: state.providerAccountId, label: assignment.label
-    });
-    return state;
-}
 export function effectiveCodexCredentialRefreshBefore(requestedMs, serverManagedShortLived) {
     return serverManagedShortLived
         ? Math.min(requestedMs, SERVER_MANAGED_SHORT_LIVED_REFRESH_WINDOW_MS)
@@ -99,8 +62,8 @@ function schemaV2LifecycleEnabled(config) {
     const capabilities = config.profile?.userBoundRefreshTokens;
     return capabilities?.delivery === true || capabilities?.migrationPlans === true;
 }
-function managedCredentialsV3Enabled(config) {
-    return profileManagedCredentialsV3Enabled(config.profile);
+function accountTokenPoolV4Enabled(config) {
+    return profileAccountTokenPoolV4Enabled(config.profile);
 }
 function codexConfigPathForEnv(env) {
     const codexHome = env.CODEX_HOME?.trim();
@@ -151,23 +114,26 @@ function formatAdminAccount(account) {
 }
 async function loadAccountData(deps, options = {}) {
     const previous = await loadCodexSelection(deps.config.persistence.configDirectory);
-    if (managedCredentialsV3Enabled(deps.config)) {
+    if (accountTokenPoolV4Enabled(deps.config)) {
         const v3Assignments = await deps.clientFor(serviceConnection(options)).listV3CredentialAssignments();
         const accounts = v3Assignments.items.map((assignment) => ({
             id: assignment.managedAccountId,
             accountId: assignment.assignmentId,
             label: assignment.label,
-            isDefault: true,
+            isDefault: previous?.account.distributionMode === "CLIENT_MANAGED_V4"
+                && previous.account.assignmentId === assignment.assignmentId,
             accessExpiresAt: Date.parse(assignment.credentialExpiresAt),
             credentialStatus: assignment.lineageStatus === "NEEDS_REAUTH"
+                || assignment.refreshTokenHealth === "REJECTED"
                 ? "NEEDS_REAUTH"
-                : assignment.authorityMode === "CLIENT_MANAGED" ? "AVAILABLE" : "TEMPORARILY_UNAVAILABLE",
+                : assignment.deliveryEligible || assignment.authorityMode === "CLIENT_MANAGED"
+                    ? "AVAILABLE" : "TEMPORARILY_UNAVAILABLE",
             lineageStatus: assignment.lineageStatus === "STALE" ? "SYNC_LAGGING" : assignment.lineageStatus,
-            quota: null
+            quota: assignment.quota ?? null
         }));
         return {
             response: { schemaVersion: CODEX_DISTRIBUTION_SCHEMA_VERSION, accounts,
-                defaultAccountId: accounts[0]?.id ?? null },
+                defaultAccountId: previous?.account.managedAccountId ?? null },
             selectedAccountId: previous?.account.managedAccountId,
             v3Assignments
         };
@@ -234,7 +200,7 @@ async function chooseAccount(deps, requested, options = {}) {
             id: v3Assignment.managedAccountId,
             accountId: v3Assignment.providerAccountId,
             label: accountLabel,
-            distributionMode: "CLIENT_MANAGED_V3",
+            distributionMode: "CLIENT_MANAGED_V4",
             assignmentId: v3Assignment.assignmentId,
             managedAccountId: v3Assignment.managedAccountId,
             providerAccountId: v3Assignment.providerAccountId
@@ -260,22 +226,36 @@ async function chooseAccount(deps, requested, options = {}) {
 async function installCredentials(deps, selection, service) {
     const client = deps.clientFor(service);
     await cleanupLegacyCodexProvider(codexConfigPathForEnv(deps.env));
-    if (managedCredentialsV3Enabled(deps.config)) {
-        const state = await readManagedCodexV3State(deps.env);
-        if (!state || state.phase !== "INSTALLED" || state.authorityMode !== "CLIENT_MANAGED"
-            || selection.account.distributionMode !== "CLIENT_MANAGED_V3"
-            || selection.account.assignmentId !== state.assignmentId
-            || selection.account.managedAccountId !== state.managedAccountId
-            || selection.account.providerAccountId !== state.providerAccountId) {
-            throw new CodexServiceError("The selected v3 assignment does not match acknowledged local credentials; run `numa codex login` or `numa codex upload`.", "lineage_version_conflict", 409);
+    if (accountTokenPoolV4Enabled(deps.config)) {
+        if (selection.account.distributionMode !== "CLIENT_MANAGED_V4"
+            || !selection.account.assignmentId || !selection.account.managedAccountId
+            || !selection.account.providerAccountId) {
+            throw new CodexServiceError("The selected account is not a v4 token-pool assignment.", "codex_assignment_not_found", 404);
         }
         const assignments = await client.listV3CredentialAssignments();
-        const current = findV3Assignment({ assignments, ...state });
-        if (!current || current.assignmentId !== state.assignmentId || current.lineageId !== state.lineageId
-            || current.authorityMode !== "CLIENT_MANAGED") {
-            throw new CodexServiceError("The v3 credential assignment is no longer active.", "codex_assignment_not_found", 404);
+        const assignment = assignments.items.find((item) => item.assignmentId === selection.account.assignmentId
+            && item.managedAccountId === selection.account.managedAccountId
+            && item.providerAccountId === selection.account.providerAccountId);
+        if (!assignment) {
+            throw new CodexServiceError("The v4 token-pool assignment is no longer active.", "codex_assignment_not_found", 404);
+        }
+        const state = await readManagedCodexV3State(deps.env);
+        if (state?.phase === "INSTALLED" && state.authorityMode === "CLIENT_MANAGED"
+            && selection.account.assignmentId === state.assignmentId
+            && selection.account.managedAccountId === state.managedAccountId
+            && selection.account.providerAccountId === state.providerAccountId
+            && assignment.lineageId === state.lineageId
+            && assignment.currentGenerationVersion === state.generationVersion
+            && assignment.authorityMode === "CLIENT_MANAGED") {
+            return { expiresAt: Date.parse(state.credentialExpiresAt), selection };
         }
-        return { expiresAt: Date.parse(state.credentialExpiresAt), selection };
+        const delivered = await executeCodexTokenPoolV4Delivery({
+            client,
+            tenantId: deps.config.connection.tenantId,
+            assignment,
+            env: deps.env
+        });
+        return { expiresAt: Date.parse(delivered.credentialExpiresAt), selection };
     }
     if (deps.config.profile?.userBoundRefreshTokens?.delivery === true) {
         await discardCodexFileCredentialBackup(deps.env);
@@ -320,10 +300,11 @@ async function installCredentials(deps, selection, service) {
     return { expiresAt: response.expiresAt, selection };
 }
 async function selectedCredentials(deps, requested, options = {}) {
-    if (managedCredentialsV3Enabled(deps.config)) {
+    if (accountTokenPoolV4Enabled(deps.config)) {
         const state = await readManagedCodexV3State(deps.env);
         if (!state || state.phase !== "INSTALLED" || state.authorityMode !== "CLIENT_MANAGED") {
-            throw new CodexServiceError("No acknowledged v3 Codex credential is installed; run `numa codex login` or `numa codex upload`.", "managed_codex_v3_login_required", 409);
+            const selection = (await chooseAccount(deps, requested, options)).selection;
+            return installCredentials(deps, selection, serviceConnection(options));
         }
         if (requested && ![
             state.assignmentId,
@@ -331,7 +312,8 @@ async function selectedCredentials(deps, requested, options = {}) {
             state.providerAccountId,
             state.lineageId
         ].includes(requested)) {
-            throw new CodexServiceError("The requested account is not the active v3 lineage.", "codex_account_not_found", 404);
+            const selection = (await chooseAccount(deps, requested, options)).selection;
+            return installCredentials(deps, selection, serviceConnection(options));
         }
         const assignments = await deps.clientFor(serviceConnection(options)).listV3CredentialAssignments();
         const assignment = findV3Assignment({ assignments, ...state });
@@ -340,7 +322,7 @@ async function selectedCredentials(deps, requested, options = {}) {
             || assignment.providerAccountId !== state.providerAccountId
             || assignment.lineageId !== state.lineageId
             || assignment.authorityMode !== "CLIENT_MANAGED") {
-            throw new CodexServiceError("The local v3 lineage no longer matches the server assignment.", "lineage_version_conflict", 409);
+            throw new CodexServiceError("The local v4 lineage no longer matches the server assignment.", "lineage_version_conflict", 409);
         }
         const selection = await saveCodexSelection(deps.config.persistence.configDirectory, {
             serviceUrl: options.server ?? deps.config.connection.serverUrl,
@@ -349,7 +331,7 @@ async function selectedCredentials(deps, requested, options = {}) {
                 id: state.managedAccountId,
                 accountId: state.providerAccountId,
                 label: assignment.label,
-                distributionMode: "CLIENT_MANAGED_V3",
+                distributionMode: "CLIENT_MANAGED_V4",
                 assignmentId: state.assignmentId,
                 managedAccountId: state.managedAccountId,
                 providerAccountId: state.providerAccountId
@@ -422,7 +404,7 @@ async function selectedCredentials(deps, requested, options = {}) {
     return { selection, expiresAt: local.expiresAt };
 }
 async function launchWithSelectedCredentials(deps, selected, launch) {
-    if (managedCredentialsV3Enabled(deps.config)) {
+    if (accountTokenPoolV4Enabled(deps.config)) {
         try {
             return await launch();
         }
@@ -481,7 +463,7 @@ export function registerCodexCommands(program, deps, options = {}) {
             else
                 deps.output.write("Logged out.\n");
         });
-    if (!includeAuthCommands && managedCredentialsV3Enabled(deps.config))
+    if (!includeAuthCommands && accountTokenPoolV4Enabled(deps.config))
         serviceOptions(codex.command("login")
             .description("Run an isolated official Codex login and enroll an unbound or explicitly assigned credential"))
             .option("--device-auth", "use the official Codex device authorization flow")
@@ -489,8 +471,8 @@ export function registerCodexCommands(program, deps, options = {}) {
             .option("--assign-to-subject <uuid>", "assign directly to a canonical Keycloak subject UUID")
             .option("--yes", "confirm direct subject assignment")
             .action(async (opts, command) => {
-            if (!managedCredentialsV3Enabled(deps.config)) {
-                throw new CodexServiceError("Managed Codex credential v3 is not enabled by the verified platform profile.", "managed_codex_v3_not_enabled", 409);
+            if (!accountTokenPoolV4Enabled(deps.config)) {
+                throw new CodexServiceError("The Codex v4 account token pool is not enabled by the verified platform profile.", "codex_token_pool_v4_not_enabled", 409);
             }
             const target = resolveManagedCodexV3AssignmentTarget(opts);
             const result = await executeCodexTokenPoolV4Login({
@@ -652,7 +634,7 @@ export function registerCodexCommands(program, deps, options = {}) {
             throw new Error("auth-agent replaces the current login; add --replace-login to confirm.");
         if (opts.credentialStore !== "file")
             throw new Error("ChatGPT auth.json 同步目前仅支持 --credential-store file。");
-        if (managedCredentialsV3Enabled(deps.config)) {
+        if (accountTokenPoolV4Enabled(deps.config)) {
             const interval = Number(opts.interval) * 1_000;
             if (!Number.isFinite(interval) || interval <= 0)
                 throw new Error("--interval must be positive.");
@@ -725,55 +707,12 @@ export function registerCodexCommands(program, deps, options = {}) {
             await new Promise((resolve) => setTimeout(resolve, interval));
         } while (true);
     });
-    serviceOptions(codex.command("upload").description("Enroll official Codex credentials (v3) or upload the legacy local pool"))
+    serviceOptions(codex.command("upload").description("Upload the legacy v1 local account pool"))
         .option("--storage <path>", "account storage path")
         .option("--source <name>", "upload source")
         .action(async (opts, command) => {
-        if (managedCredentialsV3Enabled(deps.config)) {
-            if (opts.storage || opts.source) {
-                throw new CodexServiceError("Managed credential v3 upload reads only the official CODEX_HOME/auth.json.", "invalid_configuration");
-            }
-            const recovered = await recoverManagedV3Selection(deps, opts);
-            if (recovered) {
-                if (await json(command, deps))
-                    print(deps.output, success({
-                        assignmentId: recovered.assignmentId,
-                        managedAccountId: recovered.managedAccountId,
-                        providerAccountId: recovered.providerAccountId,
-                        lineageId: recovered.lineageId,
-                        generationVersion: recovered.generationVersion,
-                        authorityMode: recovered.authorityMode,
-                        credentialExpiresAt: recovered.credentialExpiresAt,
-                        selectionRecovered: true
-                    }));
-                else
-                    deps.output.write(`Official Codex credentials were already installed; recovered their local selection; generation=${recovered.generationVersion}.\n`);
-                return;
-            }
-            const result = await executeManagedCodexV3Upload({
-                client: deps.clientFor(serviceConnection(opts)),
-                tenantId: deps.config.connection.tenantId,
-                env: deps.env
-            });
-            await saveManagedV3Selection({
-                deps, options: opts, assignmentId: result.assignmentId, managedAccountId: result.managedAccountId,
-                providerAccountId: result.providerAccountId, label: "Codex account"
-            });
-            const output = {
-                enrollmentId: result.enrollmentId,
-                assignmentId: result.assignmentId,
-                managedAccountId: result.managedAccountId,
-                providerAccountId: result.providerAccountId,
-                lineageId: result.lineageId,
-                generationVersion: result.generationVersion,
-                authorityMode: result.authorityMode,
-                credentialExpiresAt: result.credentialExpiresAt
-            };
-            if (await json(command, deps))
-                print(deps.output, success(output));
-            else
-                deps.output.write(`Official Codex credentials enrolled, installed, and acknowledged; generation=${result.generationVersion}.\n`);
-            return;
+        if (accountTokenPoolV4Enabled(deps.config)) {
+            throw new CodexServiceError("This tenant uses the v4 RT pool. Administrators must run `numa codex login`; v1 pool upload is compatibility-only.", "codex_token_pool_v4_login_required", 409);
         }
         assertLegacyManagementEnabled(deps.config);
         if (opts.storage)
@@ -833,124 +772,126 @@ export function registerCodexCommands(program, deps, options = {}) {
         if (failures.length > 0)
             process.exitCode = 1;
     });
-    const enrollment = codex.command("enrollment")
-        .description("Execute administrator-created one-shot Codex login intents");
-    serviceOptions(enrollment.command("status <intent>").description("Show redacted enrollment intent status"))
-        .action(async (intent, opts, command) => {
-        const result = await deps.clientFor(serviceConnection(opts)).getEnrollmentIntent(intent);
-        if (await json(command, deps)) {
-            print(deps.output, { ok: true, ...result });
-            return;
-        }
-        deps.output.write(`${result.intent.id}  ${result.intent.type}  ${result.intent.status}`
-            + `  revision=${result.intent.revision}\n`);
-        deps.output.write(`expires=${result.intent.expiresAt}`
-            + `${result.intent.assignmentId ? `  assignment=${result.intent.assignmentId}` : ""}`
-            + `${result.intent.managedAccountId ? `  account=${result.intent.managedAccountId}` : ""}\n`);
-        if (!result.capabilities.candidateUpload) {
-            deps.output.write("安全候选上传尚未启用；当前任务只能查询或取消，不会启动 OpenAI 登录。\n");
-        }
-    });
-    serviceOptions(enrollment.command("login <intent>")
-        .description("Run one isolated official Codex login for an enrollment intent"))
-        .option("--device-auth", "use the official Codex device authorization flow")
-        .action(async (intent, _opts, command) => {
-        const result = await executeCodexEnrollmentLogin({
-            client: deps.clientFor(serviceConnection(_opts)),
-            tenantId: deps.config.connection.tenantId,
-            intentId: intent,
-            deviceAuth: _opts.deviceAuth
+    if (schemaV2LifecycleEnabled(deps.config)) {
+        const enrollment = codex.command("enrollment")
+            .description("Execute administrator-created one-shot Codex login intents");
+        serviceOptions(enrollment.command("status <intent>").description("Show redacted enrollment intent status"))
+            .action(async (intent, opts, command) => {
+            const result = await deps.clientFor(serviceConnection(opts)).getEnrollmentIntent(intent);
+            if (await json(command, deps)) {
+                print(deps.output, { ok: true, ...result });
+                return;
+            }
+            deps.output.write(`${result.intent.id}  ${result.intent.type}  ${result.intent.status}`
+                + `  revision=${result.intent.revision}\n`);
+            deps.output.write(`expires=${result.intent.expiresAt}`
+                + `${result.intent.assignmentId ? `  assignment=${result.intent.assignmentId}` : ""}`
+                + `${result.intent.managedAccountId ? `  account=${result.intent.managedAccountId}` : ""}\n`);
+            if (!result.capabilities.candidateUpload) {
+                deps.output.write("安全候选上传尚未启用；当前任务只能查询或取消，不会启动 OpenAI 登录。\n");
+            }
         });
-        if (await json(command, deps))
-            print(deps.output, { ok: true, ...result });
-        else {
-            deps.output.write(`${result.intent.id} 登录候选已处理；状态=${result.intent.status}`
-                + `${result.result.managedAccountId ? `，账号=${result.result.managedAccountId}` : ""}`
-                + `${result.result.lineageId ? `，lineage=${result.result.lineageId}` : ""}`
-                + "。\n");
-            if (result.result.outcome === "TEMPORARILY_UNAVAILABLE") {
-                deps.output.write("同一进程内的安全重试已耗尽；请取消并新建任务，不能用另一次登录覆盖已保留的候选。\n");
+        serviceOptions(enrollment.command("login <intent>")
+            .description("Run one isolated official Codex login for an enrollment intent"))
+            .option("--device-auth", "use the official Codex device authorization flow")
+            .action(async (intent, _opts, command) => {
+            const result = await executeCodexEnrollmentLogin({
+                client: deps.clientFor(serviceConnection(_opts)),
+                tenantId: deps.config.connection.tenantId,
+                intentId: intent,
+                deviceAuth: _opts.deviceAuth
+            });
+            if (await json(command, deps))
+                print(deps.output, { ok: true, ...result });
+            else {
+                deps.output.write(`${result.intent.id} 登录候选已处理；状态=${result.intent.status}`
+                    + `${result.result.managedAccountId ? `，账号=${result.result.managedAccountId}` : ""}`
+                    + `${result.result.lineageId ? `，lineage=${result.result.lineageId}` : ""}`
+                    + "。\n");
+                if (result.result.outcome === "TEMPORARILY_UNAVAILABLE") {
+                    deps.output.write("同一进程内的安全重试已耗尽；请取消并新建任务，不能用另一次登录覆盖已保留的候选。\n");
+                }
             }
-        }
-    });
-    serviceOptions(enrollment.command("login-batch <planId>")
-        .description("Sequentially execute isolated logins from a migration plan queue")
-        .option("--device-auth", "use the official Codex device authorization flow")
-        .option("--dry-run", "show the redacted sequential plan without starting login")
-        .option("--page-size <count>", "migration queue page size", "100"))
-        .action(async (planId, opts, command) => {
-        if (deps.config.profile?.userBoundRefreshTokens?.migrationPlans !== true) {
-            throw new CodexServiceError("The selected tenant has not enabled schema-v2 migration login plans.", "capability_not_enabled", 409);
-        }
-        const pageSize = Number(opts.pageSize);
-        if (!Number.isInteger(pageSize) || pageSize < 1 || pageSize > 100) {
-            throw new CodexServiceError("--page-size must be an integer from 1 to 100.", "invalid_configuration");
-        }
-        const batch = await executeCodexMigrationLoginBatch({
-            client: deps.clientFor(serviceConnection(opts)),
-            tenantId: deps.config.connection.tenantId,
-            planId,
-            deviceAuth: opts.deviceAuth,
-            dryRun: opts.dryRun,
-            pageSize
         });
-        const failed = batch.counts.failed > 0
-            || ["TARGET_UNCERTAIN", "AUTHENTICATION_ERROR", "SERVICE_ERROR", "LOGIN_ERROR"]
-                .includes(batch.stopReason);
-        if (await json(command, deps)) {
-            print(deps.output, { ok: !failed, ...batch });
-        }
-        else {
-            deps.output.write(`migration=${batch.plan.id} status=${batch.plan.status} revision=${batch.plan.revision}`
-                + ` stop=${batch.stopReason}${batch.dryRun ? " dry-run" : ""}\n`);
-            deps.output.write(`capacity: verifiedMinimum=${batch.capacity.verifiedMinimum}, verifiedLimit=unknown,`
-                + ` sequentialRequired=${batch.capacity.sequentialRequired}; verifiedMinimum 不是上限。\n`);
-            for (const item of batch.items) {
-                deps.output.write(`${item.assignmentId} ${item.action}/${item.status}`
-                    + `${item.intentId ? ` intent=${item.intentId}` : ""}`
-                    + `${item.outcome ? ` outcome=${item.outcome}` : ""}`
-                    + `${item.skipReason ? ` skip=${item.skipReason}` : ""}`
-                    + `${item.safeErrorCode ? ` error=${item.safeErrorCode}` : ""}\n`);
+        serviceOptions(enrollment.command("login-batch <planId>")
+            .description("Sequentially execute isolated logins from a migration plan queue")
+            .option("--device-auth", "use the official Codex device authorization flow")
+            .option("--dry-run", "show the redacted sequential plan without starting login")
+            .option("--page-size <count>", "migration queue page size", "100"))
+            .action(async (planId, opts, command) => {
+            if (deps.config.profile?.userBoundRefreshTokens?.migrationPlans !== true) {
+                throw new CodexServiceError("The selected tenant has not enabled schema-v2 migration login plans.", "capability_not_enabled", 409);
             }
-            deps.output.write(`summary: attempted=${batch.counts.attempted}, completed=${batch.counts.completed},`
-                + ` failed=${batch.counts.failed}, skipped=${batch.counts.skipped}.\n`);
-        }
-        if (failed)
-            process.exitCode = 1;
-    });
-    serviceOptions(enrollment.command("cancel <intent>").description("Cancel an enrollment intent"))
-        .option("--idempotency-key <key>", "reuse a prior cancellation idempotency key")
-        .action(async (intent, opts, command) => {
-        const client = deps.clientFor(serviceConnection(opts));
-        const current = await client.getEnrollmentIntent(intent);
-        const result = await client.cancelEnrollmentIntent(intent, {
-            idempotencyKey: opts.idempotencyKey?.trim() || randomUUID(),
-            revision: current.intent.revision
+            const pageSize = Number(opts.pageSize);
+            if (!Number.isInteger(pageSize) || pageSize < 1 || pageSize > 100) {
+                throw new CodexServiceError("--page-size must be an integer from 1 to 100.", "invalid_configuration");
+            }
+            const batch = await executeCodexMigrationLoginBatch({
+                client: deps.clientFor(serviceConnection(opts)),
+                tenantId: deps.config.connection.tenantId,
+                planId,
+                deviceAuth: opts.deviceAuth,
+                dryRun: opts.dryRun,
+                pageSize
+            });
+            const failed = batch.counts.failed > 0
+                || ["TARGET_UNCERTAIN", "AUTHENTICATION_ERROR", "SERVICE_ERROR", "LOGIN_ERROR"]
+                    .includes(batch.stopReason);
+            if (await json(command, deps)) {
+                print(deps.output, { ok: !failed, ...batch });
+            }
+            else {
+                deps.output.write(`migration=${batch.plan.id} status=${batch.plan.status} revision=${batch.plan.revision}`
+                    + ` stop=${batch.stopReason}${batch.dryRun ? " dry-run" : ""}\n`);
+                deps.output.write(`capacity: verifiedMinimum=${batch.capacity.verifiedMinimum}, verifiedLimit=unknown,`
+                    + ` sequentialRequired=${batch.capacity.sequentialRequired}; verifiedMinimum 不是上限。\n`);
+                for (const item of batch.items) {
+                    deps.output.write(`${item.assignmentId} ${item.action}/${item.status}`
+                        + `${item.intentId ? ` intent=${item.intentId}` : ""}`
+                        + `${item.outcome ? ` outcome=${item.outcome}` : ""}`
+                        + `${item.skipReason ? ` skip=${item.skipReason}` : ""}`
+                        + `${item.safeErrorCode ? ` error=${item.safeErrorCode}` : ""}\n`);
+                }
+                deps.output.write(`summary: attempted=${batch.counts.attempted}, completed=${batch.counts.completed},`
+                    + ` failed=${batch.counts.failed}, skipped=${batch.counts.skipped}.\n`);
+            }
+            if (failed)
+                process.exitCode = 1;
         });
-        if (await json(command, deps))
-            print(deps.output, { ok: true, ...result });
-        else
-            deps.output.write(`${result.intent.id} 已取消；状态=${result.intent.status}。\n`);
-    });
-    const retirement = codex.command("retirement")
-        .description("Remove an exact locally installed lineage for a Server retirement request");
-    serviceOptions(retirement.command("acknowledge <retirement>")
-        .description("Delete the matching managed short-lived credentials and append local evidence")
-        .option("--idempotency-key <key>", "reuse a prior local deletion acknowledgement key"))
-        .action(async (retirementId, opts, command) => {
-        const result = await executeCodexAssignmentRetirementLocalDelete({
-            client: deps.clientFor(serviceConnection(opts)),
-            retirementId,
-            env: deps.env,
-            ...(opts.idempotencyKey?.trim() ? { idempotencyKey: opts.idempotencyKey.trim() } : {})
+        serviceOptions(enrollment.command("cancel <intent>").description("Cancel an enrollment intent"))
+            .option("--idempotency-key <key>", "reuse a prior cancellation idempotency key")
+            .action(async (intent, opts, command) => {
+            const client = deps.clientFor(serviceConnection(opts));
+            const current = await client.getEnrollmentIntent(intent);
+            const result = await client.cancelEnrollmentIntent(intent, {
+                idempotencyKey: opts.idempotencyKey?.trim() || randomUUID(),
+                revision: current.intent.revision
+            });
+            if (await json(command, deps))
+                print(deps.output, { ok: true, ...result });
+            else
+                deps.output.write(`${result.intent.id} 已取消；状态=${result.intent.status}。\n`);
         });
-        if (await json(command, deps))
-            print(deps.output, { ok: true, ...result });
-        else
-            deps.output.write(`本机匹配的短效凭据已删除并记录证据；retirement=${result.retirement.id}`
-                + `，revision=${result.retirement.revision}，状态=${result.retirement.status}。\n`
-                + "该证据不代表其他终端已清理；最终退役仍等待全部已披露短效凭据自然过期。\n");
-    });
+        const retirement = codex.command("retirement")
+            .description("Remove an exact locally installed lineage for a Server retirement request");
+        serviceOptions(retirement.command("acknowledge <retirement>")
+            .description("Delete the matching managed short-lived credentials and append local evidence")
+            .option("--idempotency-key <key>", "reuse a prior local deletion acknowledgement key"))
+            .action(async (retirementId, opts, command) => {
+            const result = await executeCodexAssignmentRetirementLocalDelete({
+                client: deps.clientFor(serviceConnection(opts)),
+                retirementId,
+                env: deps.env,
+                ...(opts.idempotencyKey?.trim() ? { idempotencyKey: opts.idempotencyKey.trim() } : {})
+            });
+            if (await json(command, deps))
+                print(deps.output, { ok: true, ...result });
+            else
+                deps.output.write(`本机匹配的短效凭据已删除并记录证据；retirement=${result.retirement.id}`
+                    + `，revision=${result.retirement.revision}，状态=${result.retirement.status}。\n`
+                    + "该证据不代表其他终端已清理；最终退役仍等待全部已披露短效凭据自然过期。\n");
+        });
+    }
     const admin = codex.command("admin")
         .description("Administer server-managed Codex accounts and assignments");
     const adminAccounts = admin.command("accounts")