fix(codex): map refresh lock timeouts and empty WHAM plans

Treat credential-writer lock remaps as retryable 503s at the management
boundary, normalize OAuth WHAM plan_type via nonEmptyPlan, and cover the
busy path with a Host-aware management API regression.

Author: Wibias

src/codex/auth-api.ts

@@ -1211,7 +1211,7 @@ export async function handleCodexAuthAPI(
                   if (resp.ok) {
                     const data = (await resp.json()) as WhamUsageResponse;
                     email = data.email ?? email;
-                    plan = data.plan_type ?? undefined;
+                    plan = nonEmptyPlan(data.plan_type) ?? undefined;
                     quota = parseUsageQuota(data);
                   }
                 } catch { /* wham fetch is non-blocking */ }

src/server/management-api.ts

@@ -168,10 +168,13 @@ export async function handleManagementAPI(req: Request, url: URL, config: OcxCon
   if (url.pathname.startsWith("/api/codex-auth/")) {
     const { handleCodexAuthAPI } = await import("../codex/auth-api");
     const { ConfigMutationLockError } = await import("../config");
+    const { CodexCredentialRefreshLockTimeoutError } = await import("../codex/account-store");
     try {
       return await handleCodexAuthAPI(req, url, config);
     } catch (error) {
-      if (error instanceof ConfigMutationLockError) {
+      // Credential writers remap ConfigMutationLockError to CodexCredentialRefreshLockTimeoutError;
+      // treat both as the same retryable busy response.
+      if (error instanceof ConfigMutationLockError || error instanceof CodexCredentialRefreshLockTimeoutError) {
         return jsonResponse(
           { error: "Configuration is busy; retry shortly", code: "CONFIG_MUTATION_LOCK_UNAVAILABLE" },
           503,

tests/config-mutation-lock.test.ts

@@ -5,6 +5,7 @@ import { pathToFileURL } from "node:url";
 import { ConfigMutationLockError, loadConfig, saveConfig, withConfigMutationLockSync } from "../src/config";
 import { CodexCredentialRefreshLockTimeoutError, getCodexAccountCredential, saveCodexAccountCredential } from "../src/codex/account-store";
 import type { OcxConfig } from "../src/types";
+import { ManagementRequest, managementHeaders } from "./helpers/management-auth";
 
 let testRoot = "";
 let previousOpencodexHome: string | undefined;
@@ -135,3 +136,48 @@ test("a throwing mutation releases the lock and leaves writers available", () =>
   expect(() => saveConfig(config(50500))).not.toThrow();
   expect(loadConfig().port).toBe(50500);
 });
+
+test("management API maps config mutation lock contention to retryable 503", async () => {
+  saveConfig(config());
+  const readyPath = join(testRoot, "mgmt-holder-ready");
+  const releasePath = join(testRoot, "mgmt-holder-release");
+  const configModuleUrl = pathToFileURL(join(import.meta.dir, "../src/config.ts")).href;
+  const childSource = `
+    import { existsSync, writeFileSync } from "node:fs";
+    import { withConfigMutationLockSync } from ${JSON.stringify(configModuleUrl)};
+    withConfigMutationLockSync(() => {
+      writeFileSync(${JSON.stringify(readyPath)}, "ready");
+      while (!existsSync(${JSON.stringify(releasePath)})) Bun.sleepSync(10);
+    });
+  `;
+  const child = Bun.spawn([process.execPath, "-e", childSource], {
+    cwd: join(import.meta.dir, ".."),
+    env: { ...process.env, OPENCODEX_HOME: testRoot },
+    stdin: "ignore",
+    stdout: "pipe",
+    stderr: "pipe",
+  });
+
+  try {
+    await waitForPath(readyPath);
+    const { handleManagementAPI } = await import("../src/server/management-api");
+    const url = new URL("http://localhost/api/codex-auth/auto-switch");
+    const response = await handleManagementAPI(
+      new ManagementRequest(url, {
+        method: "PUT",
+        headers: managementHeaders({ "content-type": "application/json" }),
+        body: JSON.stringify({ threshold: 50 }),
+      }),
+      url,
+      config(),
+    );
+    expect(response?.status).toBe(503);
+    expect(await response!.json()).toMatchObject({
+      error: "Configuration is busy; retry shortly",
+      code: "CONFIG_MUTATION_LOCK_UNAVAILABLE",
+    });
+  } finally {
+    writeFileSync(releasePath, "release");
+    expect(await waitForOwnedChild(child)).toBe(0);
+  }
+});