Fresh requests can reject a cooled-down Pool before using their valid main credential #3996

Client or integration

Codex CLI / Codex desktop through native Pool routing

Area

Authentication and account pool

Summary

A fresh request can be rejected locally because the selected stored Pool account is cooling down even when that request carries an eligible native main credential. The same credential can already be selected by the existing post-upstream-failure path, so one request can recover through main while its next request fails before any upstream send.

The missing branch is in resolveCodexAuthContext: when selection retains the stored account and no recovery probe lease is available, it throws CodexAccountCooldownError without trying the existing caller-owned-main resolver.

Reproduction

Reproduced with fixtures on Windows; no live credit or account mutation is needed.

1. Configure Pool mode with one selected stored account, no exact account binding, and autoSwitchThreshold: 0.
2. Give that account a shared reset-derived 429 cooldown. Issue the next request before a recovery probe is eligible.
3. Supply a valid caller main bearer through the existing requestScopedMainCredential admission path.
4. Resolving with the stored account excluded succeeds as main, matching the existing retry behavior. Resolving the next fresh request without that exclusion throws the local cooldown error.

Expected: use the already validated caller main context when no eligible stored alternative or probe is available. Preserve model entitlement checks, the main 99% policy, exact account bindings, Pool selection and the existing cooldown. This is distinct from #3973, which reconciles cooldown after a confirmed manual credit reset; this request does not clear cooldowns or consume credits. The broader strict-quota policy proposal #3738 is also separate.

Version

Reproduced on dev 9e1468d4b7a41b498ed2aca98507ada2c741afea. The relevant auth-context.ts blob is identical on dev abb46a1599ec0d0bbfbe03905114178df92e67f5.

Operating system

Windows 11 Pro, version 10.0.26200.

Provider and model

Native Codex Pool routing; ordinary Codex quota scope. The fixture uses gpt-5.6-terra.

Logs or error output

Mock baseline: CodexAccountCooldownError: Selected Codex account is cooling down, source reset-derived, scope shared, thrown by resolveCodexAuthContext before an upstream send. The regression fails on the original source and passes after reusing the existing caller-main resolver at this branch.

Screenshots and supporting files

No account captures or credentials are attached. The focused regression checks the fresh-request path and preserved routing state; additional cases cover the main policy boundary at 98.99% and 99%.

Redacted configuration

Pool mode, one selected stored account, no pin or exact account binding, autoSwitchThreshold: 0. The inbound main credential is a fixture passed through existing request-scoped validation, not copied into Pool configuration.

Checks

• I searched existing issues and documentation.
• I removed secrets, tokens, account details, request credentials, and personal data.