Client or integration
Codex CLI / Codex desktop through native Pool routing
Area
Authentication and account pool
Summary
A fresh request can be rejected locally because the selected stored Pool account is cooling down even when that request carries an eligible native main credential. The same credential can already be selected by the existing post-upstream-failure path, so one request can recover through main while its next request fails before any upstream send.
The missing branch is in resolveCodexAuthContext: when selection retains the stored account and no recovery probe lease is available, it throws CodexAccountCooldownError without trying the existing caller-owned-main resolver.
Reproduction
Reproduced with fixtures on Windows; no live credit or account mutation is needed.
- Configure Pool mode with one selected stored account, no exact account binding, and
autoSwitchThreshold: 0.
- Give that account a shared
reset-derived 429 cooldown. Issue the next request before a recovery probe is eligible.
- Supply a valid caller main bearer through the existing
requestScopedMainCredential admission path.
- Resolving with the stored account excluded succeeds as main, matching the existing retry behavior. Resolving the next fresh request without that exclusion throws the local cooldown error.
Expected: use the already validated caller main context when no eligible stored alternative or probe is available. Preserve model entitlement checks, the main 99% policy, exact account bindings, Pool selection and the existing cooldown. This is distinct from #3973, which reconciles cooldown after a confirmed manual credit reset; this request does not clear cooldowns or consume credits. The broader strict-quota policy proposal #3738 is also separate.
Version
Reproduced on dev 9e1468d4b7a41b498ed2aca98507ada2c741afea. The relevant auth-context.ts blob is identical on dev abb46a1599ec0d0bbfbe03905114178df92e67f5.
Operating system
Windows 11 Pro, version 10.0.26200.
Provider and model
Native Codex Pool routing; ordinary Codex quota scope. The fixture uses gpt-5.6-terra.
Logs or error output
Mock baseline: CodexAccountCooldownError: Selected Codex account is cooling down, source reset-derived, scope shared, thrown by resolveCodexAuthContext before an upstream send. The regression fails on the original source and passes after reusing the existing caller-main resolver at this branch.
Screenshots and supporting files
No account captures or credentials are attached. The focused regression checks the fresh-request path and preserved routing state; additional cases cover the main policy boundary at 98.99% and 99%.
Redacted configuration
Pool mode, one selected stored account, no pin or exact account binding, autoSwitchThreshold: 0. The inbound main credential is a fixture passed through existing request-scoped validation, not copied into Pool configuration.
Checks
Client or integration
Codex CLI / Codex desktop through native Pool routing
Area
Authentication and account pool
Summary
A fresh request can be rejected locally because the selected stored Pool account is cooling down even when that request carries an eligible native main credential. The same credential can already be selected by the existing post-upstream-failure path, so one request can recover through main while its next request fails before any upstream send.
The missing branch is in
resolveCodexAuthContext: when selection retains the stored account and no recovery probe lease is available, it throwsCodexAccountCooldownErrorwithout trying the existing caller-owned-main resolver.Reproduction
Reproduced with fixtures on Windows; no live credit or account mutation is needed.
autoSwitchThreshold: 0.reset-derived429 cooldown. Issue the next request before a recovery probe is eligible.requestScopedMainCredentialadmission path.Expected: use the already validated caller main context when no eligible stored alternative or probe is available. Preserve model entitlement checks, the main 99% policy, exact account bindings, Pool selection and the existing cooldown. This is distinct from #3973, which reconciles cooldown after a confirmed manual credit reset; this request does not clear cooldowns or consume credits. The broader strict-quota policy proposal #3738 is also separate.
Version
Reproduced on dev
9e1468d4b7a41b498ed2aca98507ada2c741afea. The relevantauth-context.tsblob is identical on devabb46a1599ec0d0bbfbe03905114178df92e67f5.Operating system
Windows 11 Pro, version 10.0.26200.
Provider and model
Native Codex Pool routing; ordinary Codex quota scope. The fixture uses
gpt-5.6-terra.Logs or error output
Mock baseline:
CodexAccountCooldownError: Selected Codex account is cooling down, sourcereset-derived, scopeshared, thrown byresolveCodexAuthContextbefore an upstream send. The regression fails on the original source and passes after reusing the existing caller-main resolver at this branch.Screenshots and supporting files
No account captures or credentials are attached. The focused regression checks the fresh-request path and preserved routing state; additional cases cover the main policy boundary at 98.99% and 99%.
Redacted configuration
Pool mode, one selected stored account, no pin or exact account binding,
autoSwitchThreshold: 0. The inbound main credential is a fixture passed through existing request-scoped validation, not copied into Pool configuration.Checks