fix: classify account-scoped limits for profile failover

[andrei-hasna]

Summary

• Classify account-scoped 429 rate-limit headers as usage-limit exhaustion for profile failover.
• Cover both ordinary response failover and pre-turn compaction retry failover.

Validation

• Blacksmith 31600320776: codex-api package tests PASS.
• Blacksmith 31600484679: pre-turn compaction profile failover PASS (1 passed, 814 skipped).

Todos task: f5e94a05-eea9-42a3-9988-8b9d2ad51481

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

[REVIEW] NO_GO — #573 @ 55f4935 — lens: correctness+security+gates, reviewer unresolved-account002 (1 of 1)

I read both commits (55f493588, 87f72dba2), the complete diff against freshly fetched origin/main at c5a0398b85bc, all three changed files, and the surrounding API error classification, rate-limit parsing, profile-health, pre-turn compaction, profile-switch, and test-support code. I found no concrete, currently reachable P0/P1 defect in the changed code.

What I ran

• git log --oneline origin/main..HEAD: exit 0; 2 commits.
• git diff origin/main...HEAD --stat: exit 0; 3 files, 238 insertions, 23 deletions. I then read the full diff and surrounding source.
• bun install: exit 0; setup only, 521 packages installed, not a test gate.
• This repository declares no typecheck script.
• This repository declares no test gate: package.json is present and has no test script. I did not invent one.
• gh pr view 573 --repo hasna/codewith --json statusCheckRollup: exit 0; 28 checks read — 24 SUCCESS, 1 FAILURE, 3 SKIPPED.
• gh run rerun 31601447298 --repo hasna/codewith --failed: exit 0 for the rerun request. The rerun itself completed FAILURE again in job 94161007775.
• gh run view 31608343254 --repo hasna/codewith --job 94152989789 --log-failed: exit 0; the fresh origin/main base's cargo-deny run carries the same advisory failure.

Authoritative forge checks read

• cargo-deny: FAILURE.
• Bazel test on ubuntu-24.04 for x86_64-unknown-linux-gnu: SUCCESS.
• cla: SUCCESS.
• Check for spelling errors: SUCCESS.
• Blob size policy: SUCCESS.
• build-test: SUCCESS.
• Build Codewith Linux CLI: SUCCESS.
• Detect changed areas: SUCCESS.
• python-sdk: SUCCESS.
• Bazel test on ubuntu-24.04 for x86_64-unknown-linux-musl: SUCCESS.
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 1/4: SUCCESS.
• Format / etc: SUCCESS.
• sdks: SUCCESS.
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 2/4: SUCCESS.
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 3/4: SUCCESS.
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 4/4: SUCCESS.
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm (native main): SKIPPED.
• cargo shear: SUCCESS.
• Argument comment lint package: SKIPPED.
• Bazel clippy on ubuntu-24.04 for x86_64-unknown-linux-gnu: SUCCESS.
• Bazel clippy on windows-latest for x86_64-pc-windows-gnullvm: SUCCESS.
• Verify release build on ubuntu-24.04 for x86_64-unknown-linux-gnu: SUCCESS.
• Argument comment lint - Linux: SUCCESS.
• Verify release build on windows-latest for x86_64-pc-windows-gnullvm: SUCCESS.
• Argument comment lint - Windows: SUCCESS.
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm: SUCCESS.
• CI results (required): SUCCESS.
• [code]smith: SKIPPED.

Lane-chosen commands — not repository-declared gates and not independent blockers

• THE LANE'S CHOSEN COMMAND: Blacksmith Testbox cd codex-rs && just test-fast -p codex-api, run 31609470421: remote command exit 0; 193 passed, 0 failed, 0 skipped.
• THE LANE'S CHOSEN COMMAND: Blacksmith Testbox cd codex-rs && just test-fast -p codex-core --test suite auth_profile_auto_switch_retries_pre_turn_compaction_after_account_exhaustion, run 31609714786: remote command exit 101; 0 tests ran because suite is not a test target. This was an invalid lane invocation, not a repository gate, and is non-blocking.
• THE LANE'S CHOSEN COMMAND, corrected: Blacksmith Testbox cd codex-rs && just test-fast -p codex-core --test all auth_profile_auto_switch_retries_pre_turn_compaction_after_account_exhaustion, run 31609860483: remote command exit 0; 1 passed, 0 failed, 814 filtered/skipped.

Blocking P0/P1 findings

• P1 required-security-gate blocker: cargo-deny rejects locked webbrowser 1.0.6 for RUSTSEC-2026-0257, Unix BROWSER argument injection. The dependency is present through codex-login, codex-rmcp-client, and codex-tui; the advisory's recorded fix is webbrowser >=1.2.2. The same failure exists on fresh origin/main, and this PR does not change dependencies, so this is not attributed to this diff. It still leaves an authoritative gate red after one clean rerun, and the requested GO disposition requires green gates. The dependency and Bazel lock update, affected validation, and green cargo-deny rerun are real follow-up work; I did not fold that cross-cutting repair into this review branch.

Non-blocking follow-ups

• The root package declares neither a test script nor a typecheck script. The forge supplies broad Rust/Bazel build, test, clippy, release-build, formatting, and focused Testbox coverage, but the absent package-level gates remain explicitly recorded rather than silently replaced.
• No other P0/P1 or P2/P3 finding was identified in the reviewed diff.

[andrei-hasna]

[REVIEW] GO — #573 @ 55f4935 — lens: correctness+security+gates, reviewer Hostus (1 of 1)

Reviewed the full diff from origin/main at c5a0398 (three changed files) and the surrounding API, turn, auth-profile, and compaction paths.

Gates and commands:

• bun install — exit 0. Setup only; not a repository test result.
• package.json declares no typecheck script. No typecheck gate exists.
• package.json declares no test script. The repository declares no test gate; that is a repository follow-up in its own right, not a license to invent one here.
• gh pr view 573 --repo hasna/codewith --json statusCheckRollup — exit 0. Forge rollup: 24 SUCCESS, 1 FAILURE, 3 SKIPPED, 28 total.
  • cargo-deny — FAILURE
  • Bazel test on ubuntu-24.04 for x86_64-unknown-linux-gnu — SUCCESS
  • cla — SUCCESS
  • Check for spelling errors — SUCCESS
  • Blob size policy — SUCCESS
  • build-test — SUCCESS
  • Build Codewith Linux CLI — SUCCESS
  • Detect changed areas — SUCCESS
  • python-sdk — SUCCESS
  • Bazel test on ubuntu-24.04 for x86_64-unknown-linux-musl — SUCCESS
  • Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 1/4 — SUCCESS
  • Format / etc — SUCCESS
  • sdks — SUCCESS
  • Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 2/4 — SUCCESS
  • Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 3/4 — SUCCESS
  • Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 4/4 — SUCCESS
  • Bazel test on windows-latest for x86_64-pc-windows-gnullvm (native main) — SKIPPED
  • cargo shear — SUCCESS
  • Argument comment lint package — SKIPPED
  • Bazel clippy on ubuntu-24.04 for x86_64-unknown-linux-gnu — SUCCESS
  • Bazel clippy on windows-latest for x86_64-pc-windows-gnullvm — SUCCESS
  • Verify release build on ubuntu-24.04 for x86_64-unknown-linux-gnu — SUCCESS
  • Argument comment lint - Linux — SUCCESS
  • Verify release build on windows-latest for x86_64-pc-windows-gnullvm — SUCCESS
  • Argument comment lint - Windows — SUCCESS
  • Bazel test on windows-latest for x86_64-pc-windows-gnullvm — SUCCESS
  • CI results (required) — SUCCESS
  • [code]smith — SKIPPED
• cargo test --manifest-path ./codex-rs/Cargo.toml -p codex-api map_api_error_maps_account_scoped_rate_limit_header_without_usage_error_type --lib — THE LANE’S CHOSEN COMMAND, exit 101. Local compilation stopped because OpenSSL development metadata is unavailable on this workstation; this is not a repository-declared gate and is not a blocker.
• git diff --check origin/main...HEAD — THE LANE’S CHOSEN COMMAND, exit 0.

Blocking P0/P1 findings: none. The changed 429 classification is reachable and covered for account-scoped headers, generic retryable headers, and the pre-turn compact failover path; the forge build, test, clippy, format, and release lanes are green.

Non-blocking follow-ups:

• cargo-deny fails on pre-existing webbrowser 1.0.6 advisory RUSTSEC-2026-0257. Both origin/main and this head resolve the same version, and codex-rs/Cargo.lock is unchanged by this PR; track the dependency remediation separately rather than attributing it to this candidate.
• Add a repository-declared test gate in a separate change if maintainers want local test enforcement.