agent-control-plane 0.1.12 → 0.1.14

package/tools/bin/agent-project-reconcile-pr-session

@@ -227,23 +227,30 @@ schedule_provider_quota_cooldown() {
   local reason="${1:-provider-quota-limit}"
   [[ "${failure_reason:-}" == "provider-quota-limit" ]] || return 0
   [[ -x "${provider_cooldown_script}" ]] || return 0
+  [[ "${CODING_WORKER:-}" == "codex" ]] && return 0
 
   "${provider_cooldown_script}" schedule "${reason}" >/dev/null || true
 }
 
 clear_provider_quota_cooldown() {
   [[ -x "${provider_cooldown_script}" ]] || return 0
+  [[ "${CODING_WORKER:-}" == "codex" ]] && return 0
 
   "${provider_cooldown_script}" clear >/dev/null || true
 }
 
 blocked_runtime_reason=""
+host_github_rate_limited="no"
+host_github_rate_limit_detail=""
 
 owner="${repo_slug%%/*}"
 repo="${repo_slug#*/}"
 pr_view_json="$(flow_github_pr_view_json "$repo_slug" "$pr_number")"
 pr_state="$(jq -r '.state' <<<"$pr_view_json")"
-pr_base_ref="$(jq -r '.baseRefName // "main"' <<<"$pr_view_json")"
+pr_base_ref="$(jq -r '.baseRefName // empty' <<<"$pr_view_json")"
+if [[ -z "${pr_base_ref}" ]]; then
+  pr_base_ref="main"
+fi
 
 if [[ "$status" == "RUNNING" && "$pr_state" != "MERGED" && "$pr_state" != "CLOSED" ]]; then
   printf 'STATUS=%s\n' "$status"
@@ -395,7 +402,9 @@ post_pr_comment_if_present() {
   if pr_comment_already_posted; then
     return 0
   fi
-  flow_github_api_repo "${repo_slug}" "issues/${pr_number}/comments" --method POST -f body="$(cat "$comment_file")" >/dev/null
+  if ! host_github_post_issue_comment "${pr_number}" "$(cat "$comment_file")"; then
+    return 1
+  fi
 }
 
 pr_comment_already_posted() {
@@ -408,6 +417,120 @@ pr_comment_already_posted() {
   jq -e --arg body "$comment_body" 'any(.comments[]?; .body == $body)' >/dev/null <<<"$comments_json"
 }
 
+host_github_output_indicates_rate_limit() {
+  grep -Eiq 'API rate limit exceeded|secondary rate limit|rate limit exceeded|HTTP 403' <<<"${1:-}"
+}
+
+record_host_github_rate_limit() {
+  local output="${1:-}"
+  local detail_file="${run_dir}/host-github-rate-limit.log"
+  host_github_rate_limited="yes"
+  host_github_rate_limit_detail="${output}"
+  printf '%s\n' "${output}" >"${detail_file}"
+}
+
+host_github_post_issue_comment() {
+  local issue_number="${1:?issue number required}"
+  local body="${2:-}"
+  local output=""
+
+  flow_export_github_cli_auth_env "${repo_slug}"
+  if output="$(
+    gh api "repos/${repo_slug}/issues/${issue_number}/comments" \
+      --method POST \
+      -f body="${body}" 2>&1
+  )"; then
+    return 0
+  fi
+
+  if host_github_output_indicates_rate_limit "${output}"; then
+    record_host_github_rate_limit "${output}"
+    return 1
+  fi
+
+  printf '%s\n' "${output}" >&2
+  return 1
+}
+
+host_github_submit_pr_approval() {
+  local output=""
+
+  flow_export_github_cli_auth_env "${repo_slug}"
+  if output="$(
+    gh api "repos/${repo_slug}/pulls/${pr_number}/reviews" \
+      --method POST \
+      -f event=APPROVE \
+      -f body="Automated final review passed. Safe low-risk scope, green checks, and host-side merge approved." \
+      2>&1
+  )"; then
+    return 0
+  fi
+
+  if grep -q "Can not approve your own pull request" <<<"${output}"; then
+    return 0
+  fi
+
+  if host_github_output_indicates_rate_limit "${output}"; then
+    record_host_github_rate_limit "${output}"
+    return 1
+  fi
+
+  printf '%s\n' "${output}" >&2
+  return 1
+}
+
+append_host_rate_limit_comment() {
+  local detail="${1:-GitHub API rate limit blocked host actions.}"
+  local reset_line=""
+
+  if grep -Eiq 'resets at ' <<<"${detail}"; then
+    reset_line="$(grep -Eio 'resets at [^.]+' <<<"${detail}" | head -n 1 || true)"
+  fi
+
+  {
+    if [[ -s "${pr_comment_file}" ]]; then
+      printf '\n\n'
+    fi
+    printf '## Host action blocked\n\n'
+    printf 'GitHub API rate limit blocked ACP from posting the PR review outcome or merge action.\n'
+    if [[ -n "${reset_line}" ]]; then
+      printf '\n- %s\n' "${reset_line}"
+    fi
+    printf -- '- ACP kept the local review artifacts and scheduled an automatic retry for the host action.\n'
+  } >>"${pr_comment_file}"
+}
+
+handle_host_github_rate_limit_retry() {
+  local reason="${1:-github-api-rate-limit}"
+  local result_action_override="${2:-host-rate-limit-retry}"
+
+  append_host_rate_limit_comment "${host_github_rate_limit_detail:-}"
+  require_transition "pr_schedule_retry" pr_schedule_retry "${reason}"
+  require_transition "pr_after_blocked" pr_after_blocked "${pr_number}"
+  cleanup_pr_session
+  result_outcome="blocked"
+  result_action="${result_action_override}"
+  failure_reason="${reason}"
+  notify_pr_reconciled
+  mark_reconciled
+  printf 'STATUS=FAILED\n'
+  printf 'PR_NUMBER=%s\n' "${pr_number}"
+  printf 'PR_STATE=%s\n' "${pr_state}"
+  printf 'OUTCOME=%s\n' "${result_outcome}"
+  printf 'ACTION=%s\n' "${result_action}"
+  printf 'FAILURE_REASON=%s\n' "${failure_reason}"
+  exit 0
+}
+
+maybe_handle_host_github_rate_limit() {
+  local reason="${1:-github-api-rate-limit}"
+  local result_action_override="${2:-host-rate-limit-retry}"
+  if [[ "${host_github_rate_limited}" == "yes" ]]; then
+    handle_host_github_rate_limit_retry "${reason}" "${result_action_override}"
+  fi
+  return 1
+}
+
 blocked_result_indicates_local_bind_failure() {
   local candidate_file
   for candidate_file in "$pr_comment_file" "$session_log_file"; do
@@ -774,23 +897,38 @@ pr_remote_already_has_final_head() {
 }
 
 approve_and_merge() {
-  local approve_output
   if ! pr_is_self_authored_for_current_actor; then
-    if ! approve_output="$(
-      flow_github_api_repo "${repo_slug}" "pulls/${pr_number}/reviews" \
-        --method POST \
-        -f event=APPROVE \
-        -f body="Automated final review passed. Safe low-risk scope, green checks, and host-side merge approved." \
-        2>&1
-    )"; then
-      if ! grep -q "Can not approve your own pull request" <<<"$approve_output"; then
-        printf '%s\n' "$approve_output" >&2
-        return 1
+    if ! host_github_submit_pr_approval; then
+      if [[ "${host_github_rate_limited}" == "yes" ]]; then
+        return 2
       fi
+      return 1
     fi
   fi
 
-  flow_github_pr_merge "$repo_slug" "$pr_number" "squash" "yes"
+  flow_export_github_cli_auth_env "${repo_slug}"
+  if ! gh pr merge "${pr_number}" -R "${repo_slug}" --squash --delete-branch --admin >"${run_dir}/host-github-merge.out" 2>"${run_dir}/host-github-merge.err"; then
+    local merge_output=""
+    merge_output="$(cat "${run_dir}/host-github-merge.err" 2>/dev/null || true)"
+    if host_github_output_indicates_rate_limit "${merge_output}"; then
+      record_host_github_rate_limit "${merge_output}"
+      return 2
+    fi
+    if flow_github_pr_merge "$repo_slug" "$pr_number" "squash" "yes" 2>"${run_dir}/host-github-merge.err"; then
+      return 0
+    fi
+    merge_output="$(cat "${run_dir}/host-github-merge.err" 2>/dev/null || true)"
+    if host_github_output_indicates_rate_limit "${merge_output}"; then
+      record_host_github_rate_limit "${merge_output}"
+      return 2
+    fi
+    if [[ -n "${merge_output}" ]]; then
+      printf '%s\n' "${merge_output}" >&2
+    fi
+    return 1
+  fi
+
+  return 0
 }
 
 cleanup_pr_session() {
@@ -829,7 +967,7 @@ handle_linked_issue_merge_cleanup() {
 handle_updated_branch_result() {
   if [[ -z "$pr_worktree" || ! -d "$pr_worktree" ]]; then
     if pr_remote_already_has_final_head; then
-      post_pr_comment_if_present
+      post_pr_comment_if_present || maybe_handle_host_github_rate_limit "github-api-rate-limit" "host-comment-rate-limit-retry"
       require_transition "pr_clear_retry" pr_clear_retry
       require_transition "pr_after_updated_branch" pr_after_updated_branch "$pr_number"
       cleanup_pr_session
@@ -895,7 +1033,7 @@ handle_updated_branch_result() {
   fi
 
   push_pr_branch
-  post_pr_comment_if_present
+  post_pr_comment_if_present || maybe_handle_host_github_rate_limit "github-api-rate-limit" "host-comment-rate-limit-retry"
   require_transition "pr_clear_retry" pr_clear_retry
   require_transition "pr_after_updated_branch" pr_after_updated_branch "$pr_number"
   cleanup_pr_session
@@ -936,7 +1074,7 @@ elif [[ "$pr_state" == "CLOSED" ]]; then
   result_action="${result_action:-cleaned-closed-pr}"
   notify_pr_reconciled
 elif [[ "$status" == "SUCCEEDED" && "$result_outcome" == "approved-local-review-passed" ]]; then
-  if ! review_pass_action="$(review_pass_action_from_result_action "${result_action:-}" 2>/dev/null)"; then
+      if ! review_pass_action="$(review_pass_action_from_result_action "${result_action:-}" 2>/dev/null)"; then
     review_pass_action="$(pr_review_pass_action "$pr_number")"
   fi
   case "$review_pass_action" in
@@ -963,8 +1101,13 @@ elif [[ "$status" == "SUCCEEDED" && "$result_outcome" == "approved-local-review-
       fi
 
       require_transition "pr_clear_retry" pr_clear_retry
-      approve_and_merge
-      pr_state="$(flow_github_pr_view_json "$repo_slug" "$pr_number" | jq -r '.state')"
+      if ! approve_and_merge; then
+        if [[ "${host_github_rate_limited}" == "yes" ]]; then
+          handle_host_github_rate_limit_retry "github-api-rate-limit" "host-merge-rate-limit-retry"
+        fi
+        exit 1
+      fi
+      pr_state="MERGED"
       if [[ "$pr_state" != "MERGED" ]]; then
         echo "PR ${pr_number} did not merge successfully" >&2
         exit 1
@@ -1018,7 +1161,7 @@ elif [[ "$status" == "SUCCEEDED" && "$result_outcome" == "no-change-needed" ]];
           result_action="host-rejected-noop-promotion"
         else
           push_pr_branch
-          post_pr_comment_if_present
+          post_pr_comment_if_present || maybe_handle_host_github_rate_limit "github-api-rate-limit" "host-comment-rate-limit-retry"
           require_transition "pr_clear_retry" pr_clear_retry
           require_transition "pr_after_updated_branch" pr_after_updated_branch "$pr_number"
           cleanup_pr_session
@@ -1041,7 +1184,7 @@ elif [[ "$status" == "SUCCEEDED" && "$result_outcome" == "no-change-needed" ]];
       result_action="host-rejected-no-change-needed"
       notify_pr_reconciled
     else
-      post_pr_comment_if_present
+      post_pr_comment_if_present || maybe_handle_host_github_rate_limit "github-api-rate-limit" "host-comment-rate-limit-retry"
       require_transition "pr_clear_retry" pr_clear_retry
       require_transition "pr_after_succeeded" pr_after_succeeded "$pr_number"
       cleanup_pr_session
@@ -1062,7 +1205,7 @@ elif [[ "$status" == "SUCCEEDED" && "$result_outcome" == "blocked" ]]; then
   elif attempt_blocked_pr_host_verification_recovery; then
     handle_updated_branch_result
   else
-    post_pr_comment_if_present
+    post_pr_comment_if_present || maybe_handle_host_github_rate_limit "github-api-rate-limit" "host-comment-rate-limit-retry"
     require_transition "pr_clear_retry" pr_clear_retry
     require_transition "pr_after_blocked" pr_after_blocked "$pr_number"
     cleanup_pr_session
@@ -1079,6 +1222,7 @@ elif [[ "$status" == "FAILED" ]]; then
   schedule_provider_quota_cooldown "${failure_reason:-worker-exit-failed}"
   require_transition "pr_schedule_retry" pr_schedule_retry "${failure_reason:-worker-exit-failed}"
   require_transition "pr_after_failed" pr_after_failed "$pr_number"
+  cleanup_pr_session
   notify_pr_reconciled
 fi
 

package/tools/bin/agent-project-run-codex-session

@@ -167,6 +167,8 @@ printf -v codex_bin_q '%q' "$codex_bin"
 printf -v runner_bin_q '%q' "$runner_bin"
 printf -v safe_profile_q '%q' "$safe_profile"
 printf -v bypass_profile_q '%q' "$bypass_profile"
+helper_bin_dir="${artifact_dir}/worker-bin"
+printf -v helper_bin_dir_q '%q' "$helper_bin_dir"
 
 {
   printf 'TASK_KIND=%s\n' "$task_kind_q"
@@ -274,6 +276,61 @@ cat >"$inner_script" <<EOF
 set -euo pipefail
 ${runtime_exports}
 ${context_exports}cd ${worktree_realpath_q}
+bootstrap_codex_helper_env() {
+  local helper_bin_dir=${helper_bin_dir_q}
+  local openspec_shim=""
+
+  mkdir -p "\${helper_bin_dir}"
+
+  if [[ -d ${worktree_realpath_q}/node_modules/.bin ]]; then
+    export PATH="${worktree_realpath_q}/node_modules/.bin:\${PATH}"
+  fi
+  export PATH="\${helper_bin_dir}:\${PATH}"
+
+  if command -v openspec >/dev/null 2>&1; then
+    return 0
+  fi
+
+  if [[ ! -d ${worktree_realpath_q}/openspec ]]; then
+    return 0
+  fi
+
+  openspec_shim="\${helper_bin_dir}/openspec"
+  cat >"\${openspec_shim}" <<'SHIM'
+#!/usr/bin/env bash
+set -euo pipefail
+
+repo_root="\${ACP_REPO_ROOT:-\${F_LOSNING_REPO_ROOT:-\$(pwd)}}"
+openspec_root="\${repo_root}/openspec"
+
+if [[ ! -d "\${openspec_root}" ]]; then
+  echo "openspec directory not found: \${openspec_root}" >&2
+  exit 1
+fi
+
+command_name="\${1:-}"
+case "\${command_name}" in
+  list)
+    shift || true
+    if [[ "\${1:-}" == "--specs" ]]; then
+      find "\${openspec_root}/specs" -mindepth 1 -maxdepth 1 -type d 2>/dev/null \
+        | xargs -n1 basename 2>/dev/null \
+        | sort
+      exit 0
+    fi
+    find "\${openspec_root}/changes" -mindepth 1 -maxdepth 1 -type d ! -name archive 2>/dev/null \
+      | xargs -n1 basename 2>/dev/null \
+      | sort
+    exit 0
+    ;;
+  *)
+    echo "openspec shim only supports 'list' and 'list --specs'; use direct file reads for other operations" >&2
+    exit 64
+    ;;
+esac
+SHIM
+  chmod +x "\${openspec_shim}"
+}
 reset_sandbox_run_dir() {
   mkdir -p ${sandbox_run_dir_q}
   find ${sandbox_run_dir_q} -mindepth 1 -maxdepth 1 -exec rm -rf {} + 2>/dev/null || true
@@ -331,6 +388,7 @@ record_final_git_state() {
   } >>"\${tmp_file}"
   mv "\${tmp_file}" ${meta_file_q}
 }
+bootstrap_codex_helper_env
 reset_sandbox_run_dir
 set +e
 bash ${runner_bin_q} \\

package/tools/bin/branch-verification-guard.sh

@@ -108,6 +108,7 @@ const dependencyInputsChanged = files.some(isDependencyManifest);
 const apiTouched = productNonTestFiles.some((file) => /^apps\/api\//.test(file));
 const webTouched = productNonTestFiles.some((file) => /^apps\/web\//.test(file));
 const mobileTouched = productNonTestFiles.some((file) => /^apps\/mobile\//.test(file));
+const apiProductFiles = productNonTestFiles.filter((file) => /^apps\/api\//.test(file));
 const packageNames = [
   ...new Set(
     productNonTestFiles
@@ -199,11 +200,23 @@ const changedTestCoverage = changedTestFiles.map((file) => {
   return { file, anchors, covered };
 });
 const missingChangedTestFiles = changedTestCoverage.filter(({ covered }) => !covered);
+const apiChangedTests = changedTestCoverage.filter(({ file }) => /^apps\/api\//.test(file));
 
 const rootTypecheck = hasCommand(/\bpnpm (?:run )?typecheck\b/, /\bturbo\b.*\btypecheck\b/);
 const rootBuild = hasCommand(/\bpnpm (?:run )?build\b/, /\bturbo\b.*\bbuild\b/);
 const rootLint = hasCommand(/\bpnpm (?:run )?lint\b/, /\bturbo\b.*\blint\b/);
 const rootTest = hasCommand(/\bpnpm (?:run )?test\b/, /\bturbo\b.*\btest\b/);
+const scopedApiTypecheck =
+  hasScopedCommand(apiScopePattern, /\btypecheck\b/, /\btsc --noemit\b/, /\btsc --noemit\b/);
+const scopedApiConfidence =
+  hasScopedCommand(apiScopePattern, /\blint\b/, /\bbuild\b/, /\btest\b/, /\bjest\b/, /\bvitest\b/);
+const apiNarrowSliceTargetedCoverage =
+  apiProductFiles.length > 0 &&
+  apiProductFiles.length <= 2 &&
+  apiProductFiles.every((file) => /(?:^|\/)(?:services?|utils?|helpers?|policies?)\/|(?:\.service|\.util|\.helper|\.policy)\.[cm]?[jt]s$/.test(file)) &&
+  apiChangedTests.length > 0 &&
+  apiChangedTests.every(({ covered }) => covered) &&
+  scopedApiConfidence;
 
 const reasons = [];
 if (passedCommands.length === 0) {
@@ -242,10 +255,10 @@ if (localeTouched) {
 }
 
 if (apiTouched) {
-  if (!(hasScopedCommand(apiScopePattern, /\btypecheck\b/, /\btsc --noemit\b/, /\btsc --noemit\b/) || rootTypecheck)) {
+  if (!(scopedApiTypecheck || rootTypecheck || apiNarrowSliceTargetedCoverage)) {
     reasons.push('missing API typecheck or repo typecheck for API changes');
   }
-  if (!(hasScopedCommand(apiScopePattern, /\blint\b/, /\bbuild\b/, /\btest\b/, /\bjest\b/, /\bvitest\b/) || rootBuild || rootLint || rootTest)) {
+  if (!(scopedApiConfidence || rootBuild || rootLint || rootTest)) {
     reasons.push('missing API confidence verification (lint, build, or test) for API changes');
   }
 }

package/tools/bin/ensure-runtime-sync.sh

@@ -84,6 +84,11 @@ resolve_source_skill_dir() {
   local skill_name=""
   local root="${1:?source home required}"
 
+  if flow_is_skill_root "${root}"; then
+    printf '%s\n' "${root}"
+    return 0
+  fi
+
   for skill_name in "$(flow_canonical_skill_name)" "$(flow_compat_skill_alias)"; do
     [[ -n "${skill_name}" ]] || continue
     candidate="${root}/skills/openclaw/${skill_name}"
@@ -93,11 +98,6 @@ resolve_source_skill_dir() {
     fi
   done
 
-  if flow_is_skill_root "${root}"; then
-    printf '%s\n' "${root}"
-    return 0
-  fi
-
   return 1
 }
 

package/tools/bin/heartbeat-safe-auto.sh

@@ -345,24 +345,28 @@ PY
   local effective_pools=""
   healthy_pools="$(
     jq -r --argjson primaryThresh "${CODEX_QUOTA_THRESHOLD}" --argjson weeklyThresh "${CODEX_QUOTA_WEEKLY_THRESHOLD}" '
-      group_by(.accountId)
+      map(. + {poolKey: (.label // .trackedLabel // .email // .accountId // "")})
       | map(select(
-          ((.[0].usage.rate_limit.limit_reached // false) | not)
-          and ((.[0].usage.rate_limit.primary_window.used_percent // 100) < $primaryThresh)
-          and ((.[0].usage.rate_limit.secondary_window.used_percent // 100) < $weeklyThresh)
-        ))
+          (.poolKey != "")
+          and ((.usage.rate_limit.limit_reached // false) | not)
+          and ((.usage.rate_limit.primary_window.used_percent // 100) < $primaryThresh)
+          and ((.usage.rate_limit.secondary_window.used_percent // 100) < $weeklyThresh)
+        ) | .poolKey)
+      | unique
       | length
     ' "${CODEX_QUOTA_FULL_CACHE_FILE}" 2>/dev/null || true
   )"
 
   rotation_pools="$(
     jq -r --argjson weeklyThresh "${CODEX_QUOTA_WEEKLY_THRESHOLD}" '
-      group_by(.accountId)
+      map(. + {poolKey: (.label // .trackedLabel // .email // .accountId // "")})
       | map(select(
-          ((.[0].usage.rate_limit.limit_reached // false) | not)
-          and ((.[0].usage.rate_limit.secondary_window.used_percent // 100) < $weeklyThresh)
-          and ((.[0].planType // "") != "free")
-        ))
+          (.poolKey != "")
+          and ((.usage.rate_limit.limit_reached // false) | not)
+          and ((.usage.rate_limit.secondary_window.used_percent // 100) < $weeklyThresh)
+          and ((.planType // "") != "free")
+        ) | .poolKey)
+      | unique
       | length
     ' "${CODEX_QUOTA_FULL_CACHE_FILE}" 2>/dev/null || true
   )"
@@ -471,6 +475,12 @@ fi
 
 run_codex_quota_preflight
 
+# Sync skill files to runtime-home if source has changed since last sync.
+# This ensures start-issue-worker.sh and other scripts are always up to date.
+if [[ -x "${FLOW_TOOLS_DIR}/ensure-runtime-sync.sh" ]]; then
+  "${FLOW_TOOLS_DIR}/ensure-runtime-sync.sh" --quiet 2>/dev/null || true
+fi
+
 acquire_lock
 
 reap_orphan_shared_loop_groups

package/tools/bin/provider-cooldown-state.sh

@@ -20,6 +20,7 @@ backend=""
 model=""
 action=""
 reason=""
+label=""
 
 case "$#" in
   1)
@@ -77,6 +78,33 @@ resolve_backend() {
   flow_config_get "${CONFIG_YAML}" "execution.coding_worker"
 }
 
+resolve_codex_label() {
+  local configured_label="${ACP_ACTIVE_PROVIDER_LABEL:-${F_LOSNING_ACTIVE_PROVIDER_LABEL:-}}"
+  local codex_quota_bin=""
+  local active_label=""
+
+  if [[ -n "${configured_label}" ]]; then
+    printf '%s\n' "${configured_label}"
+    return 0
+  fi
+
+  if [[ -n "${ACP_CODEX_QUOTA_LABEL:-${F_LOSNING_CODEX_QUOTA_LABEL:-}}" ]]; then
+    printf '%s\n' "${ACP_CODEX_QUOTA_LABEL:-${F_LOSNING_CODEX_QUOTA_LABEL:-}}"
+    return 0
+  fi
+
+  codex_quota_bin="$(flow_resolve_codex_quota_bin "${SCRIPT_DIR}")"
+  if [[ -n "${codex_quota_bin}" && -x "${codex_quota_bin}" ]]; then
+    active_label="$("${codex_quota_bin}" codex list --json 2>/dev/null | jq -r '.activeInfo.trackedLabel // .activeInfo.activeLabel // empty' 2>/dev/null || true)"
+    if [[ -n "${active_label}" ]]; then
+      printf '%s\n' "${active_label}"
+      return 0
+    fi
+  fi
+
+  return 1
+}
+
 resolve_model() {
   local resolved_backend="${1:?backend required}"
   local raw_model="${2:-}"
@@ -147,7 +175,16 @@ case "${action}" in
     ;;
 esac
 
-provider_key="$(flow_sanitize_provider_key "${backend}-${model}")"
+if [[ "${backend}" == "codex" ]]; then
+  label="$(resolve_codex_label || true)"
+fi
+
+provider_key_source="${backend}-${model}"
+if [[ "${backend}" == "codex" && -n "${label}" ]]; then
+  provider_key_source="${provider_key_source}-${label}"
+fi
+
+provider_key="$(flow_sanitize_provider_key "${provider_key_source}")"
 out="$(
   ACP_STATE_ROOT="${STATE_ROOT}" \
   ACP_PROVIDER_QUOTA_COOLDOWNS="${COOLDOWNS}" \
@@ -162,5 +199,6 @@ out="$(
 
 printf 'BACKEND=%s\n' "${backend}"
 printf 'MODEL=%s\n' "${model}"
+printf 'LABEL=%s\n' "${label}"
 printf 'PROVIDER_KEY=%s\n' "${provider_key}"
 printf '%s\n' "${out}"