fix(codex): sustain and fence quota window activation

[lidge-jun]

Summary

• Sustain opted-in quota-window activation after idle resets: retain pending boundaries, refresh stale metadata at a bounded cadence, and publish completed warmup quota headers.
• Carries fix(codex): sustain quota window activation #3856 by @terrytan95 using cherry-pick -x, with follow-up main-account token preparation and credential-fenced completion handling. Closes bug(codex): automatic quota activation stalls after reset #3855.
• Maintainer-sponsored carry under the release-train delegation. Main session performs any integration under MAINTAINERS.md; no merge is performed by this lane.

Verification

• Local tests, typecheck, build, install and privacy scan: NOT RUN, explicitly prohibited by the maintainer's remote-only instruction.

• git diff --check origin/dev HEAD: passed (source formatting only).

• Independent astra-high security implementation review (James): PASS, reviewed 458598f692aabf3cca11dc512b12a11b64dce265..49f3a78c56743442b503bf3f0e3645d638eb2a37. Main token preparation precedes WHAM shared ownership; synchronous identity, bearer/workspace and credential-generation checks fence header publication, late 401, and completion. Five new main-specific regression cases cover the findings. blocking_issues: []. This source-review verdict does not replace CI.

• Cross-platform CI: run 34110334640, pending cumulative top b67f452c49904dbda2e0be435c2e34d5a064172f; only the top branch will dispatch ci.yml with lane=all, including Windows shards. Lower commits intentionally use [skip ci].

• Rebased onto dev d00615d5696a9c6b7f1a3006181e57569b012920 after main-lane integration. All eight carried/follow-up patches are identical by range-diff; reviewed runtime/test files are byte-identical. PR fix(codex): sustain and fence quota window activation #3871 head: 3955e10402dd12298a2fd6bf7cf9040daa02eb44; top fix(transport): admit canonical Mihomo IPv6 with validated pinning #3872 head: b67f452c49904dbda2e0be435c2e34d5a064172f.

Manual chain (stack: null; merge bottom-up after fresh cumulative-tree proof):

Layer	Source	PR/base
1	#3856 quota activation	This PR -> dev
2	#3849 Mihomo IPv6	#3872 -> codex/260907-b-quota-activation

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Co-authored-by: terrytan95 10609214+terrytan95@users.noreply.github.com

---

Maintainer integration decision (MAINTAINERS.md, dev-only admin integration): @lidge-jun integrates lane B's manual chain (#3871 → #3872) into dev bottom-up. Chain-top evidence at head b67f452c4: Cross-platform CI run 34111578200 — Linux test 1/4, 2/4, 4/4, macOS 1/2, 2/2, gates, storage policy, api usage, keyring ×3, npm-global ×3, docker smoke = success; test 3/4 failed only on tests/codex-integration/codex-prompt-text-probe.test.ts "admission stays occupied between child exit and close handling" (probe parent exit timeout under runner load; untouched by this chain and green at the same head in run 34110334640); Windows shards and macos control were deliberately cancelled — by maintainer instruction the Windows matrix and macos control run once on the final release-train head, not per chain. Prospective merge tree of origin/dev@d00615d56 + top = 58536270a = tested tree. Independent source/security review PASS per PR body. Local suites NOT RUN. This is maintainer integration, not self-approval.

Summary by CodeRabbit

• New Features

  • Idle quota windows can now activate automatically for opted-in accounts, including five-hour and weekly windows.
  • Successful activations update quota information immediately, while observed reset times remain reliable across restarts.
  • Stale quota metadata refreshes automatically at most once every five minutes, even without an open dashboard.

• Bug Fixes

  • Improved handling of credential changes, authentication failures, shifted reset times, and failed activation attempts.

• Documentation

  • Updated setup guidance across supported languages, including account selection behavior and downgrade instructions.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Team

Run ID: f58c6770-65fc-44d7-b4ea-69595dff9d08

📥 Commits

Reviewing files that changed from the base of the PR and between d00615d and 3955e10.

📒 Files selected for processing (18)

• devlog/_plan/260907_release_train_b/000_plan.md
• devlog/_plan/260907_release_train_b/010_carry.md
• devlog/_plan/260907_release_train_b/020_carry.md
• docs-site/src/content/docs/getting-started/how-it-works.mdx
• docs-site/src/content/docs/ja/getting-started/how-it-works.mdx
• docs-site/src/content/docs/ko/getting-started/how-it-works.mdx
• docs-site/src/content/docs/ru/getting-started/how-it-works.mdx
• docs-site/src/content/docs/zh-cn/getting-started/how-it-works.mdx
• src/codex/auth-api.ts
• src/codex/quota-auto-refresh-state.ts
• src/codex/quota-auto-refresh.ts
• src/codex/warmup.ts
• src/config.ts
• src/types/config.ts
• structure/08_openai-provider-tiers.md
• tests/codex-integration/codex-quota-auto-refresh-main-admission.test.ts
• tests/codex-integration/codex-quota-auto-refresh.test.ts
• tests/codex-integration/codex-warmup.test.ts

---

📝 Walkthrough

Walkthrough

The change strengthens Codex idle quota auto-activation. It preserves pending reset boundaries, refreshes stale metadata, publishes completed warmup headers, fences credential updates, handles rejected credentials, adds regression coverage, updates documentation, and adds Lane B release-train planning files.

Changes

Codex quota activation

Layer / File(s)	Summary
Quota schedule contracts src/codex/quota-auto-refresh-state.ts, src/config.ts, src/types/config.ts	Adds persisted nextFiveHourResetAt and nextWeeklyResetAt fields, in-memory schedules, and metadata-refresh timestamps.
Warmup and credential publication src/codex/auth-api.ts, src/codex/warmup.ts, src/codex/quota-auto-refresh.ts	Adds activation-specific quota refresh. Completed warmups publish response headers. Credential-generation checks prevent stale responses from updating quota or reauthentication state.
Worker scheduling and activation src/codex/quota-auto-refresh.ts	Retains pending windows across metadata changes and restarts, throttles stale metadata refresh, rechecks eligibility, batches work, and records safe failure reasons.
Regression coverage and documentation tests/codex-integration/*, structure/08_openai-provider-tiers.md, docs-site/src/content/docs/**/*	Covers successive windows, restart persistence, refresh throttling, 401 handling, credential replacement races, and warmup failures. Documents the new behavior and downgrade requirements.

Lane B release-train planning

Layer / File(s)	Summary
Lane B roadmap and carry records devlog/_plan/260907_release_train_b/*	Adds release-train scope, evidence rules, remote CI procedures, and carry records for quota activation and Mihomo IPv6 work.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant QuotaWorker
  participant QuotaRefresh
  participant Warmup
  participant AccountState
  QuotaWorker->>QuotaRefresh: Refresh stale quota metadata
  QuotaWorker->>Warmup: Send activation warmup
  Warmup-->>QuotaWorker: Return completed response headers
  QuotaWorker->>AccountState: Persist quota and completion markers

Loading

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/260907-b-quota-activation

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[lidge-jun]

리뷰 · 우선순위 73 / 80

이 PR은 #3856(terrytan95)을 cherry-pick -x로 Lane B 맨 아래(base=dev)에 올린 캐리입니다. #3855(자동 쿼터 창 활성화가 idle 리셋 뒤 멈추거나, 메타데이터가 앞으로 밀리면 pending이 사라지고, 로컬로 아직 유효한 bearer가 업스트림 401을 받아도 같은 자격으로 재시도하던 구멍)를 닫습니다. 지금 dev HEAD는 ece556a6e(2.47.0 + #3854 code-mode host contract)이고, 워커는 여전히 last* 완료 마커와 캐시 reset 비교 위주라서 successive idle·pending 보존·헤더 반영·401 reauth가 없습니다. 이 캐리는 그 구멍을 그대로 메웁니다.

핵심은 src/codex/quota-auto-refresh.ts입니다. rememberWindows가 observed next 경계를 scheduledByAccount와 nextFiveHourResetAt/nextWeeklyResetAt에 남기고, opted-in eligible 계정만 5분 간격으로 stale 메타데이터를 WHAM/풀 경로로 refresh합니다. 성공 워밍업의 쿼터 헤더는 warmup.ts의 onCompleted로만 올라가고, pool은 isCodexAccountGenerationLive, main은 observeMainQuotaCredential/credentialStillLive 펜스 아래에서 applyAccountQuotaFromUpstreamHeaders를 호출합니다. 추론 401은 markAccountNeedsReauth로 격리하고, 실패 로그는 opaque 라벨+안전 reason만 남깁니다. auth-api.ts의 refreshCodexQuotaForActivation은 main에서 토큰 prepare를 WHAM shared claim 앞에 두고, identity/bearer/workspace·credential-generation 검사를 재사용합니다. 상태 맵은 quota-auto-refresh-state.ts에 scheduledByAccount·quotaRefreshAfterByAccount를 추가했고, src/types/config.ts·src/config.ts에는 last와 대칭인 optional next 두 필드만 늘렸습니다. types/config 분할로 close-don't-rebase 할 대상은 아닙니다.

원본 #3856 리뷰에서 막았던 “영구 회귀 테스트 없음”도 이 캐리에서 메워졌습니다. codex-quota-auto-refresh.test.ts에 successive idle 헤더 반영·shifted metadata/restart 생존·bounded stale refresh·401 quarantine, codex-quota-auto-refresh-main-admission.test.ts에 expired main token prepare-before-WHAM·late 401이 교체 credential을 quarantine하지 못함을 추가했습니다. astra-high 구현 리뷰(James)도 PASS이고 blocking_issues는 비어 있습니다. draft·BLOCKED는 Cross-platform CI(top head 3074a96, run 34107416671)와 트레인 정책 때문으로 보이며, 로컬 suite는 메인테이너 remote-only 지시로 돌리지 않았습니다. Lane B는 이 PR → #3872 순서입니다.

quota-auto-refresh.ts rememberWindows/eligible - pending 보존과 opted-in 가드가 #3855 A/B에 직접 대응. refresh 후 eligible 재검사 위치가 맞음
warmup.ts onCompleted + generation/credential fence - 성공 헤더만 반영. 실패 스트림에 쿼터를 쓰지 않음
auth-api.ts refreshCodexQuotaForActivation - main prepare-before-WHAM, pool credentialGeneration reauth. unsponsored_surface 성격은 유지되나 캐리·회귀로 완화
types/config.ts·config.ts next* - last* 대칭 optional. 분할 캠페인과 충돌 시 필드만 재적용
테스트 A/B/C·main admission 5건 - 원본 draft 유지 사유였던 회귀 공백을 닫음

메인테이너의 판단이 필요한 지점

• Lane B bottom으로 top CI(3074a96 / fix(transport): admit canonical Mihomo IPv6 with validated pinning #3872 head) 초록 후 dev에 넣을지
• 머지 직후 원본 #3856을 Landed via #3871 at <commit> + landed-via-maintainer로 닫을지(#3855도 closes)
• next* 영속화의 다운그레이드 안내를 릴리스 노트에 한 줄 남길지
• auth-api 터치에 maintainer-sponsored 라벨을 캐리에도 유지할지

너의 추천
Lane B 1층으로 머지하세요. #3855를 닫는 정확한 캐리이고, 원본이 비워 둔 A/B/C·main admission 회귀까지 들어 있습니다. top CI 확인 뒤 undraft·머지하고, 원본 #3856은 landed-via로 닫으세요. types/config 분할 때문에 닫을 필요는 없습니다. 이어서 #3872(IPv6)를 같은 체인으로 올리세요.

이 댓글은 grok-bot이 작성했습니다

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-07T10:52:14.202886Z	3955e10	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.