feat(codex): add opt-in strict quota switching and resumable pool waits

[y2ambition-ai]

Summary

• Add opt-in codexAccountStrictQuota admission for the shared Codex account pool. Accounts must have fresh observed quota below the configured threshold in every relevant window; elapsed reset times, partial snapshots, and credits-only updates cannot silently restore a blocked account.
• Reuse existing routing strategies. With fill-first, keep the selected eligible account until its threshold is reached, then choose by existing priority rules (larger priority first); a recovered account does not preempt the current one.
• On an authoritative quota rejection before output, try remaining eligible accounts at most once. When all are quota-blocked, retain the original request and resume after verified recovery. Streaming waits use heartbeat events, preserve continuation history, and clean up on cancellation/drain; uncertain failures and partially emitted responses are not replayed.
• Refresh quota on demand with shared concurrency/backoff and quota-change notifications, without idle polling or automatic reset-credit redemption. Expose the opt-in flag through the existing auto-switch API and document the behavior.

Verification

• bun scripts/test.ts: 20,197 passed, 15 skipped, 0 failed on macOS.
• tsc --noEmit, bun scripts/privacy-scan.ts, and git diff --check: passed.
• Added coverage for per-window freshness, identity replacement, incomplete snapshots, fill-first/manual selection and priority recovery, dispatch rechecks, bounded retries, trusted wait markers, streaming/non-streaming cancellation, continuation-cache expiry and task isolation.
• Independent local review covered auth boundaries, request replay, wait cleanup, and quota refresh. This does not replace upstream maintainer review; platform-specific CI remains authoritative.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Review readiness checklist

This PR stays in draft until every box below is ticked. Tick all four boxes once the requirements are met:

• All CI tests are green on my local testing.

• I pushed my PR to the latest dev commit.

• I resolved all correct Codex and CodeRabbit findings.

• My PR is ready for review.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⚠️ Deterministic hygiene checks failed.

• unsponsored_surface — This changes an authentication, workflow, release-automation, or dependency surface. MAINTAINERS.md requires security review for these; ask a maintainer to apply maintainer-sponsored once they have reviewed it. Paths: src/codex/auth-api.ts, src/codex/auth-context.ts.

[github-actions]

⏳ DRAFT

• hygiene: unsponsored_surface.

What to do

• Fix unsponsored_surface — This changes an authentication, workflow, release-automation, or dependency surface. MAINTAINERS.md requires security review for these; ask a maintainer to apply maintainer-sponsored once they have reviewed it. Paths: src/codex/auth-api.ts, src/codex/auth-context.ts.
• Tick all four boxes in the PR description once you're done (currently 0/4).

Review readiness checklist

• ⬜ All CI tests are green on my local testing.
• ⬜ I pushed my PR to the latest dev commit.
• ⬜ I resolved all correct Codex and CodeRabbit findings.
• ⬜ My PR is ready for review.

0/4 boxes ticked.

This pull request was already a draft. Its draft status will be preserved after every issue above is resolved.
@y2ambition-ai Tick the boxes once your local CI is green, your branch is on the latest dev commit, and every correct Codex and CodeRabbit finding is resolved.

[lidge-jun]

리뷰 · 우선순위 42 / 80

이 PR은 Codex 공유 계정 풀에 옵트인 codexAccountStrictQuota 입학(admission)과, 전 계정이 막혔을 때 재개 가능한 대기(wait) 를 넣습니다. 창마다 신선한 관측 쿼터가 임계값 아래여야 하고, 리셋 시각만 지나거나 부분 스냅샷·크레딧만으로는 막힌 계정을 조용히 되살리지 않습니다. fill-first면 고른 계정을 임계까지 유지하고, 권위 있는 쿼터 거절이 출력 전에 오면 남은 적격 계정을 최대 한 바퀴 돌며, 전부 막히면 heartbeat로 기다렸다가 검증된 회복 후 이어갑니다. 변경 파일이 많고(+약 2000/−60) src/codex/auth-api.ts·auth-context.ts·quota.ts·새 strict-quota*.ts·src/server/responses/core.ts·wait/response 헬퍼·config 타입까지 한꺼번에 건드립니다.

지금 dev의 풀 라우팅·쿼터 자동 갱신·리셋 크레딧 경로는 이미 있지만, 이 “엄격 입학 + 스트리밍 대기” 스택은 없습니다. release-244의 070_quota_proxy는 Windows 쿼터 네트워크 경로 증거/문서 쪽이고, 이 PR과는 겹치는 sor가 다릅니다. 테스트 면적은 넓지만(통합·서버 wait·auth-context), checklist는 0/4이고 hygiene가 unsponsored_surface로 막혀 intake: hygiene-blocked입니다(인증 표면: auth-api/auth-context). enforce-target도 실패·draft 유지입니다.

우선순위 42인 이유다. 아이디어(관측 신선도·부분 스냅샷 거부·출력 전만 재시도·불확실 실패 미재현)는 풀 운영에 도움이 될 수 있으나, 한 번에 너무 크고, 로드맵 급한 칸(task-input 등)도 아니며, 스폰서·Ready·CI도 안 됐습니다. 인증/쿼터 표면이라 메인테이너 보안·동작 리뷰 없이 Ready로 올리면 안 됩니다. types/config에 플래그 한두 줄이 들어가지만 “대분할로 무효화” 수준의 PR은 아닙니다. 다만 큰 서버/코어 겹침이 있어 task-input·WS 픽스와 동시에 랜딩하면 충돌 비용이 큽니다.

경로/심볼 - codexAccountStrictQuota (src/types/config.ts / src/config.ts) - 옵트인 플래그. 기본 off여야 함
경로 - src/codex/auth-context.ts / auth-api.ts - unsponsored_surface 원인. 스폰서 필수
경로/심볼 - src/server/responses/strict-quota-wait.ts - 스트리밍 heartbeat·취소/drain 정리. 부분 emit 재현 금지 계약이 핵심
경로 - src/server/responses/core.ts - 응답 코어에 wait/재시도 삽입. 리뷰 면적 큼
경로 - hygiene intake: hygiene-blocked + checklist 0/4 - 머지 게이트 미충족

메인테이너의 판단이 필요한 지점

• 이 기능을 release-244 이후 별도 에픽으로 받을지, 조각을 더 쪼개 달라고 할지(admission vs wait vs refresh)
• maintainer-sponsored 전에 요구할 최소 증거(적대적 스냅샷·취소·drain·이중 재생 테스트)
• 기존 reset-credit auto-redeem·quota auto-refresh와의 상호작용을 같은 PR에서 증명할지

너의 추천
지금 머지하지 마세요. draft 유지 + 스폰서 리뷰 + checklist/CI를 먼저 채우게 하세요. 가능하면 admission/wait를 더 작은 PR로 나누길 권합니다. release-244의 task-input·kiro 칸이 끝날 때까지는 뒤로 미루는 편이 dev에 안전합니다.

이 댓글은 grok-bot이 작성했습니다