[ntindle]

Why

Codex threads in T3 never show Limited when both ChatGPT logins are out of quota, and sit "running" for hours or days instead. While every Codex credential cools down on usage_limit_reached, the Gateway answers upstream's model_cooldown 429 with Retry-After set to the quota window. Codex 0.166 recognises a usage limit only by error.type, so it retries:

• over WebSocket the Gateway closes silently five times;
• over HTTPS Codex sleeps until Retry-After.

On rust-builder one turn waited 38½ hours, from 2026-10-31 02:10Z to 2026-11-01 16:49Z. Investigation: factory-notes incidents/2026-11-01-codex-quota-stops-not-limited.md.

This is not caused by a fork patch. #10's pass-through matches only Meta's refusal shape.

What

This is the change proposed upstream as router-for-me#7184, cherry-picked onto main. The selector.go conflict with #10's refusal field was resolved by keeping both. While a Codex pool's first reset is more than five minutes away:

• body: model_cooldown plus type: "usage_limit_reached", resets_at, retryable: false and limit_window_minutes, the same shape as fix(auth): report explicit quota exhaustion as a final usage limit router-for-me/CLIProxyAPI#6647;
• headers: X-Should-Retry: false and X-Codex-Primary-* (5-hour window) or X-Codex-Secondary-* (weekly), instead of Retry-After;
• WebSocket: the refusal goes out as an error event instead of a silent close.

Fork-only commits:

• FORK.md entry, fork-check.sh hook checks and TestFork* wrappers, so a sync cannot drop this while fix(auth): report exhausted Codex quota as a usage limit Codex clients stop on router-for-me/CLIProxyAPI#7184 is open;
• gofmt of an untouched upstream test file.

Verification

• Live, on rust-builder: Codex CLI 0.166.0 ran through a local build against a mock upstream returning OpenAI's usage_limit_reached.
  • Before: Reconnecting... 2/5–5/5 (Connection reset without closing handshake), then Reconnecting... 1/5 (exceeded retry limit, last status: 429) and a Retry-After: 10640 sleep, still waiting at 75 s.
  • After: You've hit your usage limit. Try again at 7:02 PM. and turn.failed within a second, over WebSocket and HTTPS.
• bash .github/scripts/fork-check.sh: exit 0 (blocking checks and the advisory upstream tests).
• go test -race on the new tests passes. Each production change was reverted in turn, and its tests failed.

Applying

Merging publishes :latest. Applying it recreates the Gateway container, which cuts in-flight Codex and Claude requests, T3 threads and Rocky Brain jobs. Apply when idle. No config change is needed.

T3 needs no update for this: current T3 already shows Codex's usageLimitExceeded as Limited, and the headers give it the reset time for "Resume at reset". T3's own fix for the current behaviour is being upstreamed separately.

🤖 Generated with Claude Code

[ntindle]

Update:

• 735796d4 adds the upstream bot's fixes. Every refusal envelope the executor stores is now read (error, top level, body.error, response.error), and a wrapped usage limit still answers with its own body. TestFork* pass.
• T3 side: [Bug]: A Codex turn retrying HTTP 429 sleeps as Working for hours instead of showing Limited pingdotgg/t3code#28936 (branch ntindle:t3/codex-429-retry-limited). Its PR waits for triage.

Verified live on rust-builder with Codex CLI 0.166.0 and an isolated T3 dev server:

Gateway	T3	Result
current	main	Working, "Retrying provider (1/5)", indefinitely
current	T3 branch	Limited after 5 min (no reset time)
this PR	main	Limited at once, "Resets 7:56 PM", Resume at reset
this PR	T3 branch	the same