feat(codex): let fresh spendable credits override the main-account hard lock

[jasperlnz]

Summary

Fixes #6845.

The main-account hard lock (#6363) and the credits switch are independent by design, so a hard-locked main account that still holds spendable ChatGPT credits is refused before any upstream send — the reported local 429 returned within 3–23 ms — even with "Use credits" on. The only workaround is disabling the lock entirely.

This adds an opt-in codexMainAccountCreditsOverrideHardLock (default off). When on, a blocked main account whose credits are consented and freshly observed as spendable is treated as usable by both selection (codexAccountUnusableReason) and admission (assertMainAccountPolicy), so the request reaches upstream and the overage draws credits. The release is only as fresh as the credit observation; a spent, refused, or stale balance re-arms the lock.

• Default behaviour is unchanged; the existing "allowing credits does not lift the main lock" test still passes.
• Surfaced as a second switch on the main-account protection card (all 11 locales) and via ocx system settings --main-account-credits-override-hardlock on|off.
• Billing note: credits are an overage mechanism — upstream draws included quota first, so the release lets the account reach 100% and then spends credits. That tradeoff is why it is off by default.

Verification

• bun run typecheck, GUI tsc -b, bun run lint:i18n, GUI bun run build, bun run structure:check, bun run privacy:scan — pass.
• Focused tests: tests/codex-integration/codex-credits-after-limit-main.test.ts (4 new), adjacent credit/hard-lock suites (270 pass), GUI main-account-hard-lock-setting.test.tsx (2 new) + locale parity.
• Local runtime check through a proxy with the real account: switch off → 429 hard-lock refusal; switch on → 200 served from credits.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed. (docs-site not included yet — happy to add a short page on request.)
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Review readiness checklist

This PR stays in draft until every box below is ticked. Tick all four boxes once the requirements are met:

• Required local validation passed; commands, results, and any full-suite exception are documented.

• I pushed my PR to a recent dev commit (at most 10 behind; a maintainer may still ask for the exact tip before merge).

• I resolved all correct Codex and CodeRabbit findings.

• My PR is ready for review.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⚠️ Deterministic hygiene checks failed.

• unsponsored_surface — This changes an authentication, workflow, release-automation, or dependency surface. MAINTAINERS.md requires security review for these; ask a maintainer to apply maintainer-sponsored once they have reviewed it. Paths: src/codex/auth-context.ts.

[github-actions]

⏳ DRAFT

• UI screenshot required. hygiene: unsponsored_surface.

What to do

• Add a screenshot of the UI change to the PR description.
• Fix unsponsored_surface — This changes an authentication, workflow, release-automation, or dependency surface. MAINTAINERS.md requires security review for these; ask a maintainer to apply maintainer-sponsored once they have reviewed it. Paths: src/codex/auth-context.ts.
• Tick all four boxes in the PR description once you're done (currently 0/4).

Review readiness checklist

• ⬜ Required local validation passed; commands, results, and any full-suite exception are documented.
• ⬜ I pushed my PR to a recent dev commit (at most 10 behind; a maintainer may still ask for the exact tip before merge).
• ⬜ I resolved all correct Codex and CodeRabbit findings.
• ⬜ My PR is ready for review.

0/4 boxes ticked.

This pull request was already a draft. Its draft status will be preserved after every issue above is resolved.
@jasperlnz Tick the boxes once required local validation has passed with commands, results, and any full-suite exception documented, your branch is on the latest dev commit, and every correct Codex and CodeRabbit finding is resolved.

[jasperlnz]

Withdrawing — the credits-before-exhaustion premise doesn't hold upstream.