fix(codex): fence main quota publication after credential rotation

docs-site/src/content/docs/ko/reference/cli/providers-accounts.md

@@ -101,12 +101,18 @@ Pool 모드에서 사용량 조회의 `--refresh`는 캐시 유효기간을 무
 조회가 연기되면 새 진단 시도로 기록하지 않습니다.
 일시정지, 재인증, 서버의 사용량 제한은 별도로 적용됩니다.
 
-새로운 유효한 WHAM 사용량 응답 한 건에서 1차 창의 기간이 **24시간 이상**으로 명시되고,
+새로운 유효한 WHAM 사용량 응답 한 건에서 1차 창의 기간이 **24시간 이상**으로 명시되고 유효한 사용량 수치가 있으며,
 2차·3차 창이 명시적 `null`이거나 그 기간도 24시간 이상으로 명시되고 사용량 수치도 함께 오면 이전 5h 수치를 대체합니다.
 파서의 단기·장기 구분 기준을 따르므로 주간·월간뿐 아니라 하루짜리 창도 해당합니다.
 현재 창에는 동일한 98% 기준을 적용합니다. 이 판단은 응답 한 건의 정보에 의존하며 연속 관측을
 요구하지 않습니다. 2차·3차 필드가 생략되었거나, 1차 창의 기간을 모르거나, 응답 헤더만 일부
 도착한 경우에는 이전 차단을 해제하지 않습니다.
+지연 응답을 반영하기 전에 저장된 인증정보를 다시 확인합니다. 파일을 읽을 수 없거나 같은 계정의 인증 토큰이
+교체되었다면 별도 사용량 조회가 없어도 이전 응답은 사용량 캐시나 차단 상태를 갱신하거나 새 토큰을 재인증 대상으로 표시하지 않습니다.
+해당 요청자에게 파싱된 조회 결과를 반환할 수는 있지만, 공유 상태나 차단 해제 근거에는 반영하지 않습니다.
+계정 카드에는 공유 캐시에 반영된 사용량만 표시하여 차단 상태와 수치가 일치하도록 합니다.
+Direct 모드의 공급자 사용량 보고서에서도 공유 상태에 반영되지 않은 응답과 이전 캐시 보고서를 표시하지 않습니다.
+계정 정보가 충돌하거나 이전 토큰의 401/403 응답이 늦게 도착한 경우에는 현재 캐시를 유지하고 재인증 상태를 변경하지 않습니다.
 
 저장되는 옵션은 OpenCodex의 `config.json`에 있는 `"codexMainAccountHardLock"`입니다. 값이 없거나
 `true`이면 켜짐이고, `false`일 때만 꺼집니다. 스위치를 끄면 이 `false`가 저장됩니다. 기본값이

docs-site/src/content/docs/reference/cli/providers-accounts.md

@@ -168,6 +168,14 @@ or also explicitly last at least 24 hours and report their usage. This follows t
 one-day window qualifies as well as weekly/monthly windows. The current window still uses the same
 98% threshold. This relies on the single reported snapshot; repeated observations are not required.
 Omitted secondary/tertiary fields, an unknown primary duration, or partial response headers cannot clear a previous block.
+The proxy checks the stored credential again before applying a delayed response. An unreadable file
+or replaced bearer cannot update the usage cache, release the lock, or quarantine the new credential,
+even for the same account with no second quota read.
+Its parsed ordinary usage can still be returned to the requesting caller, without shared-state updates
+or recovery evidence. The account card shows the published cached usage, keeping its quota aligned
+with the lock status; Direct provider quota omits an unpublished response and its older cached report. Conflicting account
+identities and stale 401/403 replies retain the current
+cached info and cannot clear or set the current account's reauthentication state.
 
 The persisted option is `"codexMainAccountHardLock"` in OpenCodex's `config.json`. An absent key or
 `true` means on; only an explicit `false` turns it off, and that is what switching the setting off

src/codex/auth-api/account-list.ts

@@ -12,7 +12,7 @@ import { codexPlanValue, isThirtyDayOnlyCodexPlan } from "../plan";
 import { isAccountNeedsReauth, markAccountNeedsReauth } from "../account-runtime-state";
 import { getValidMainAccountToken, MainAccountTokenRefreshError, MAIN_CODEX_ACCOUNT_ID } from "../main-account";
 import { captureConfigGeneration } from "../../lib/state-store-sweeper";
-import { captureMainAccountIdentityGeneration, getMainAccountCredentialPresence, isMainAccountIdentityGenerationLive } from "../main-account-cache";
+import { captureMainAccountIdentityGeneration, getMainAccountCredentialPresence, getMainAccountInfoCache, isMainAccountIdentityGenerationLive } from "../main-account-cache";
 import type { CodexQuotaRefreshOutcome } from "../quota-refresh-outcome";
 import { getMainAccountHardLockStatus } from "../main-account-hard-lock";
 import type { MainAccountHardLockStatus } from "../main-account-hard-lock";
@@ -328,7 +328,11 @@ export async function listCodexAuthAccountsSnapshot(
   });
   const fetchedMainGeneration = mainResult.identityGeneration ?? captureMainAccountIdentityGeneration();
   const mainSnapshotLive = isMainAccountIdentityGenerationLive(fetchedMainGeneration);
-  const mainInfo = mainSnapshotLive ? mainResult.info : EMPTY_MAIN_ACCOUNT_INFO;
+  // An ordinary same-account return can be parsed after its credential was replaced.
+  // The card and hard-lock status must describe the same published quota snapshot.
+  const mainInfo = mainSnapshotLive
+    ? mainResult.infoUnpublished ? getMainAccountInfoCache() ?? EMPTY_MAIN_ACCOUNT_INFO : mainResult.info
+    : EMPTY_MAIN_ACCOUNT_INFO;
   const hasMainCredential = mainSnapshotLive && mainResult.credentialChecked
     ? mainResult.hasCredential
     : getMainAccountCredentialPresence() ?? false;

src/codex/auth-api/main-account-probe.ts

@@ -95,6 +95,8 @@ export interface MainResetQuotaProof {
 
 export interface MainAccountInfoFetchResult {
   info: MainAccountInfo;
+  /** Parsed ordinary info from a stale credential; callers must not display it as shared state. */
+  infoUnpublished?: true;
   resetRecoveryProof?: MainResetQuotaProof & { dispatchSequence: number };
   /** Ephemeral result of this attempt, omitted when no WHAM request was made. */
   quotaRefresh?: CodexQuotaRefreshOutcome;
@@ -106,14 +108,16 @@ export interface MainAccountInfoFetchResult {
   hasCredential: boolean;
   /** Main identity generation captured while the native-main claim was held. */
   identityGeneration?: number;
-  /** Present only when this call freshly parsed a WHAM usage response. */
+  /** Freshly parsed usage from the current credential; stale ordinary return values are excluded. */
   freshQuota?: Omit<StoredAccountQuota, "updatedAt">;
-  /** Present only when this call's WHAM response included `rate_limit_reset_credits.available_count`. */
+  /** Current-credential response's `rate_limit_reset_credits.available_count`, when present. */
   freshResetCredits?: number;
 }
 
 export interface MainAccountInfoSnapshot {
   info: MainAccountInfo;
+  /** Ordinary info that was never published and must not become provider quota. */
+  infoUnpublished?: true;
   mainIdentityGeneration: number;
   quotaRefresh?: CodexQuotaRefreshOutcome;
 }
@@ -122,6 +126,7 @@ export async function fetchMainAccountInfoSnapshot(forceRefresh = false, config?
   const result = await fetchMainAccountInfoAttempt(forceRefresh, 1, undefined, false, forceRefresh, false, config);
   return {
     info: result.info,
+    ...(result.infoUnpublished ? { infoUnpublished: true as const } : {}),
     ...(result.quotaRefresh && result.quotaRefreshGeneration !== undefined
       && isMainAccountIdentityGenerationLive(result.quotaRefreshGeneration)
       ? { quotaRefresh: result.quotaRefresh } : {}),
@@ -193,6 +198,11 @@ export async function fetchMainAccountInfoAttempt(
   }
 }
 
+/**
+ * Read native-main usage while ownership is held, publishing only current credential evidence.
+ * A replaced same-account bearer may return its parsed ordinary info without mutating shared
+ * state or supplying recovery proof. Conflicting identities and stale errors return cached info.
+ */
 export async function fetchMainAccountInfoWhileOwned(
   forceRefresh: boolean,
   retriesRemaining: number,
@@ -234,6 +244,19 @@ export async function fetchMainAccountInfoWhileOwned(
     ? observeMainQuotaCredential(tokens.access_token, tokens.account_id)
     : undefined;
   const mainQuotaCredentialGeneration = getMainQuotaCredentialGeneration();
+  /** A disk replacement may have no second probe to advance the credential generation. */
+  const credentialIsCurrent = (): boolean => {
+    const current = readCodexTokensResult(undefined, { bounded: true });
+    if (current.status !== "ok") return false;
+    const effectiveAccountId = extractAccountId(current.tokens.id_token, current.tokens.access_token)
+      ?? (current.tokens.account_id || null);
+    if (effectiveAccountId !== current.tokens.account_id || effectiveAccountId !== requestAccountId) return false;
+    observeMainQuotaCredential(current.tokens.access_token, current.tokens.account_id);
+    return mainQuotaWriter !== undefined
+      && isMainQuotaWriterLive(mainQuotaWriter)
+      && mainQuotaCredentialGeneration === getMainQuotaCredentialGeneration()
+      && matchesMainQuotaCredential(tokens.access_token, tokens.account_id);
+  };
   // Keep diagnostics separate from authentication and freshness policy. Never serialize errors.
   const quotaSignal = AbortSignal.timeout(WHAM_REQUEST_TIMEOUT_MS);
   let quotaPhase: "request" | "body" | "decode" | "publish" = "request";
@@ -250,11 +273,10 @@ export async function fetchMainAccountInfoWhileOwned(
         signal: quotaSignal,
       }, () => { dispatchSequence = nextQuotaDispatchSequence(); },
       paced ? { pacingKey: baseKey } : { unpaced: true });
-      if (!admission) return { info: cached ?? EMPTY_MAIN_ACCOUNT_INFO, credentialChecked: true, hasCredential: true };
+      if (!admission) return { info: getMainAccountInfoCache() ?? EMPTY_MAIN_ACCOUNT_INFO,
+        credentialChecked: true, hasCredential: true };
       if (admission.kind === "joined") {
-        const current = mainQuotaCredentialGeneration === getMainQuotaCredentialGeneration()
-          && matchesMainQuotaCredential(tokens.access_token, tokens.account_id)
-          && writerGeneration === captureConfigGeneration();
+        const current = credentialIsCurrent() && writerGeneration === captureConfigGeneration();
         if (!current) return { info: getMainAccountInfoCache() ?? EMPTY_MAIN_ACCOUNT_INFO,
           credentialChecked: true, hasCredential: true };
         if (explicitRefresh && (admission.result.quotaRefresh?.status === "ok"
@@ -268,7 +290,7 @@ export async function fetchMainAccountInfoWhileOwned(
         const terminalAuthFailure = await isTerminalMainAuthResponse(resp, isMainAccountTokenVerifiablyLive());
         const retried = await retryMainAccountInfoIfIdentityChanged(requestAccountId, retriesRemaining, nativeMainLease, explicitRefresh, paced);
         if (retried) return retried;
-        if (!isQuotaDispatchCurrent(dispatchSequence)) {
+        if (!isQuotaDispatchCurrent(dispatchSequence) || !credentialIsCurrent()) {
           return { info: getMainAccountInfoCache() ?? EMPTY_MAIN_ACCOUNT_INFO,
             credentialChecked: true, hasCredential: true };
         }
@@ -294,17 +316,15 @@ export async function fetchMainAccountInfoWhileOwned(
       if (data === null || typeof data !== "object" || Array.isArray(data)) {
         throw new Error("Invalid WHAM usage object");
       }
-      // Check after body/retry awaits and before any cache, credits, policy or
-      // Reserve publication. Returning cached state supplies no fresh recovery proof.
+      // A newer published response wins over this attempt, including its returned display info.
       if (!isQuotaDispatchCurrent(dispatchSequence)) {
         return { info: getMainAccountInfoCache() ?? EMPTY_MAIN_ACCOUNT_INFO,
           credentialChecked: true, hasCredential: true };
       }
       quotaPhase = "publish";
       // A delayed response from a replaced bearer cannot revoke a newer Reserve grant,
       // even in the same workspace or after an A→B→A credential transition.
-      if (mainQuotaCredentialGeneration === getMainQuotaCredentialGeneration()
-        && matchesMainQuotaCredential(tokens.access_token, tokens.account_id)) {
+      if (credentialIsCurrent()) {
         observeMainReserveRevocation(data, mainQuotaWriter);
       }
       quotaPhase = "decode";
@@ -313,16 +333,24 @@ export async function fetchMainAccountInfoWhileOwned(
       const quota = parseUsageQuota(usage);
       const policyQuota = parseMainPolicyUsageQuota(usage);
       quotaPhase = "publish";
-      const freshResetCredits = quota?.resetCredits;
-      // Tag the count with the identity it was read from, so a later response that omits the
-      // summary can restore the badge without ever crossing an account boundary.
-      rememberMainResetCredits(requestAccountId, freshResetCredits);
       const result = {
         email: data.email ?? null,
         plan,
         quota,
         ts: Date.now(),
       };
+      if (!credentialIsCurrent()) {
+        // Preserve same-identity ordinary info, but never publish stale evidence or state.
+        if (mainQuotaWriter && isMainQuotaWriterLive(mainQuotaWriter)) {
+          return { info: result, infoUnpublished: true, credentialChecked: true, hasCredential: true };
+        }
+        return { info: getMainAccountInfoCache() ?? EMPTY_MAIN_ACCOUNT_INFO,
+          credentialChecked: true, hasCredential: true };
+      }
+      const freshResetCredits = quota?.resetCredits;
+      // Tag the count with the identity it was read from, so a later response that omits the
+      // summary can restore the badge without ever crossing an account boundary.
+      rememberMainResetCredits(requestAccountId, freshResetCredits);
       setMainAccountInfoCache(result);
       // Only an explicit refresh may retract a reauth quarantine. A 200 from
       // /wham/usage proves the token authenticates to the usage endpoint; it does not
@@ -349,16 +377,18 @@ export async function fetchMainAccountInfoWhileOwned(
         credentialChecked: true,
         hasCredential: true,
         ...(quota ? { freshQuota: quota } : {}),
-        ...(quota && mainQuotaWriter && isMainQuotaWriterLive(mainQuotaWriter)
-          && mainQuotaCredentialGeneration === getMainQuotaCredentialGeneration()
-          && matchesMainQuotaCredential(tokens.access_token, tokens.account_id)
+        ...(quota && mainQuotaWriter && credentialIsCurrent()
           ? { resetRecoveryProof: { writer: mainQuotaWriter, credentialGeneration: mainQuotaCredentialGeneration, dispatchSequence } }
           : {}),
         ...(freshResetCredits !== undefined ? { freshResetCredits } : {}),
       };
     } catch (error) {
       const retried = await retryMainAccountInfoIfIdentityChanged(requestAccountId, retriesRemaining, nativeMainLease, explicitRefresh, paced);
       if (retried) return retried;
+      if (!credentialIsCurrent()) {
+        return { info: getMainAccountInfoCache() ?? EMPTY_MAIN_ACCOUNT_INFO,
+          credentialChecked: true, hasCredential: true };
+      }
       let status: CodexQuotaRefreshOutcome["status"] = "internal_error";
       if ((quotaPhase === "request" || quotaPhase === "body") && quotaSignal.aborted) status = "timeout";
       else if (quotaPhase === "request") status = "network_error";

src/providers/quota/vendor-probes-oauth.ts

@@ -18,13 +18,15 @@ import { aggregateCodexPoolCapacity, CODEX_CAPACITY_MAX_QUOTA_AGE_MS, type Codex
 import { asRecord, normalizePercent, normalizeResetAt, readQuotaJson, REQUEST_TIMEOUT_MS, toFiniteNumber } from "../quota-wire";
 import { providerCodexAccountMode } from "../registry";
 import {
+  TERMINAL_QUOTA_FAILURE,
   hasQuotaRows,
   providerLabel,
   providerQuotaFromCodexQuota,
   publicCapacityAggregation,
   report,
   tagNativeMainReport,
   type CodexAuthAccountsSnapshotPromise,
+  type ProviderQuotaProbeResult,
   type ProviderQuotaReport,
 } from "./report-cache";
 import {
@@ -46,9 +48,11 @@ export async function fetchChatGptForwardQuota(
   providerConfig: OcxProviderConfig,
   forceRefresh: boolean,
   prefetchedSnapshot?: CodexAuthAccountsSnapshotPromise,
-): Promise<ProviderQuotaReport | null> {
+): Promise<ProviderQuotaProbeResult> {
   if (providerCodexAccountMode(provider, providerConfig) === "direct") {
     const snapshot = await fetchMainAccountInfoSnapshot(forceRefresh, config);
+    // A parsed return from a replaced credential cannot retain an older cached report either.
+    if (snapshot.infoUnpublished) return TERMINAL_QUOTA_FAILURE;
     const quota = providerQuotaFromCodexQuota(snapshot.info.quota);
     if (quota) quota.updatedAt = Date.now();
     return quota

structure/providers/openai-tiers.md

@@ -377,6 +377,20 @@ invalidates old evidence. Request-owned bearers are matched only against a crede
 workspace already observed under native ownership; an unrelated or unmatched keyring credential
 is not attributed to stored main and introduces no physical-main read. Credential equality tags
 remain process-local and never enter disk, logs, or management DTOs.
+`src/codex/auth-api/main-account-probe.ts` re-reads the bounded stored main credential and
+rechecks its writer, bearer and generation after body/retry awaits, before publishing main usage,
+credits, plan, reauth or Reserve state, including terminal 401/403 mutations. An unreadable file
+or missing identity writer cannot bypass this check. A same-account bearer replacement is detected
+even with no second probe; an observed A→B→A transition remains fenced by its generation. An
+unchanged credential still permits an older success.
+Successful same-identity responses may still return parsed ordinary info to their caller, without
+shared-state updates, fresh quota or recovery proof. The account-list card uses the published cache
+for such a return, so its displayed quota agrees with the hard-lock state. The snapshot retains the
+unpublished marker, and Direct provider quota drops that response and any older cached report
+rather than reporting stale windows. Conflicting identities
+and stale errors return cached info. The request/body races and card projection are covered by
+`tests/codex-integration/main-account-hard-lock-recovery.test.ts`; the ordinary return and Reserve
+revocation contract remains covered by `tests/codex-integration/reserve-passive-revocation.test.ts`.
 
 Owned startup rebuilds this binding from its pinned auth path under the native owner and exclusive
 claim, after journal recovery and stage cleanup, before publishing ready. That work now runs for

tests/codex-integration/codex-auth-api.test.ts

@@ -484,8 +484,8 @@ describe("main quota refresh diagnostics", () => {
       } else {
         expect(result).not.toHaveProperty("quotaRefresh");
       }
-      // The existing terminal-auth decision still applies, independently of diagnostic freshness.
-      if (outcome === "terminal_http") expect(isAccountNeedsReauth(MAIN_CODEX_ACCOUNT_ID)).toBe(true);
+      // Terminal errors can quarantine only the still-current identity and credential.
+      if (outcome === "terminal_http") expect(isAccountNeedsReauth(MAIN_CODEX_ACCOUNT_ID)).toBe(invalidation === "none");
       expect(result).not.toHaveProperty("quotaRefreshGeneration");
       expect(JSON.stringify(result)).not.toContain("quotaRefreshGeneration");
       expect(JSON.stringify(result)).not.toContain("canary");