fix(warmup): surface upstream error detail and retry fallback models on 400

- Read response body on non-2xx warmup and extract structured JSON error
  messages (never raw text — may contain tokens/credentials)
- Add upstreamDetail field to CodexWarmupError, surfaced in reason string
- auth-api.ts now shows upstream detail in user-facing error message instead
  of generic 'Reauthenticate' when structured detail is available
- Retry with fallback model (gpt-5.5) when default model (gpt-5.4-mini)
  returns 400 — accounts that lack mini access still warm up
- Add tests for body-reading, error propagation, and fallback retry

Addresses reported issue: second account add fails with http_status:400 on
Windows/Vision Pro — users now see the actual backend rejection reason and
the retry may succeed with a different model.

Author: lidge-jun

src/codex/auth-api.ts

@@ -27,7 +27,7 @@ export { clearAccountQuota, getAccountQuota, parseUsageQuota, updateAccountQuota
 import { extractAccountId, decodeJwtPayload } from "../oauth/chatgpt";
 import { MAIN_CODEX_ACCOUNT_ID, setMainAccountPlan } from "./main-account";
 import { maskEmail } from "../lib/privacy";
-import { codexWarmupFailureReason, warmCodexAccount } from "./warmup";
+import { CodexWarmupError, codexWarmupFailureReason, warmCodexAccount } from "./warmup";
 export { maskEmail } from "../lib/privacy";
 import type { CodexAccount, OcxConfig } from "../types";
 
@@ -149,12 +149,16 @@ async function verifyCodexAccountWarmup(
     await warmCodexAccount({ accessToken, chatgptAccountId });
     return { ok: true, validatedAt: Date.now() };
   } catch (err) {
+    const reason = codexWarmupFailureReason(err);
+    const upstream = err instanceof CodexWarmupError ? err.upstreamDetail : undefined;
     return {
       ok: false,
       response: jsonResponse({
-        error: "Codex account warmup failed. Reauthenticate the account and try again.",
+        error: upstream
+          ? `Codex account warmup failed: ${upstream}`
+          : "Codex account warmup failed. Reauthenticate the account and try again.",
         code: "codex_warmup_failed",
-        reason: codexWarmupFailureReason(err),
+        reason,
         accountId,
       }, 401),
     };

src/codex/warmup.ts

@@ -1,16 +1,19 @@
 export class CodexWarmupError extends Error {
   code: "http_status" | "missing_body" | "stream_failed" | "stream_incomplete" | "stream_error" | "invalid_sse" | "no_terminal" | "transport";
   status?: number;
+  /** Upstream error detail extracted from the response body (truncated to 512 chars). */
+  upstreamDetail?: string;
 
   constructor(
     code: CodexWarmupError["code"],
     message = "Codex warmup failed",
-    options: { status?: number; cause?: unknown } = {},
+    options: { status?: number; cause?: unknown; upstreamDetail?: string } = {},
   ) {
     super(message);
     this.name = "CodexWarmupError";
     this.code = code;
     this.status = options.status;
+    this.upstreamDetail = options.upstreamDetail;
     if (options.cause !== undefined) this.cause = options.cause;
   }
 }
@@ -24,11 +27,39 @@ export interface CodexWarmupOptions {
 
 const CODEX_RESPONSES_URL = "https://chatgpt.com/backend-api/codex/responses";
 const DEFAULT_MODEL = "gpt-5.4-mini";
+const FALLBACK_MODELS = ["gpt-5.5"];
 const DEFAULT_TIMEOUT_MS = 30_000;
+const MAX_ERROR_BODY_BYTES = 2048;
+
+/** Read the first MAX_ERROR_BODY_BYTES of a response body and extract an error message. */
+async function readErrorDetail(res: Response): Promise<string | undefined> {
+  try {
+    const text = await res.text();
+    const trimmed = text.slice(0, MAX_ERROR_BODY_BYTES);
+    try {
+      const json = JSON.parse(trimmed) as Record<string, unknown>;
+      // ChatGPT backend error shape: { error: { message: "..." } } or { detail: "..." }
+      const nested = json.error;
+      if (nested && typeof nested === "object" && typeof (nested as Record<string, unknown>).message === "string") {
+        return ((nested as Record<string, unknown>).message as string).slice(0, 512);
+      }
+      if (typeof json.detail === "string") return json.detail.slice(0, 512);
+      if (typeof json.error === "string") return (json.error as string).slice(0, 512);
+      if (typeof json.message === "string") return json.message.slice(0, 512);
+    } catch {
+      // Non-JSON response body may contain sensitive data (tokens, credentials).
+      // Only surface structured error messages, never raw text.
+    }
+    return undefined;
+  } catch {
+    return undefined;
+  }
+}
 
 function safeWarmupReason(err: unknown): string {
   if (err instanceof CodexWarmupError) {
-    return err.status ? `${err.code}:${err.status}` : err.code;
+    const base = err.status ? `${err.code}:${err.status}` : err.code;
+    return err.upstreamDetail ? `${base} — ${err.upstreamDetail}` : base;
   }
   return "transport";
 }
@@ -99,7 +130,7 @@ async function drainWarmupSse(body: ReadableStream<Uint8Array>): Promise<void> {
   }
 }
 
-export async function warmCodexAccount(options: CodexWarmupOptions): Promise<void> {
+async function tryWarmup(options: CodexWarmupOptions, model: string): Promise<void> {
   let res: Response;
   try {
     res = await fetch(CODEX_RESPONSES_URL, {
@@ -110,7 +141,7 @@ export async function warmCodexAccount(options: CodexWarmupOptions): Promise<voi
         "Content-Type": "application/json",
       },
       body: JSON.stringify({
-        model: options.model?.trim() || DEFAULT_MODEL,
+        model,
         instructions: "Reply with OK.",
         input: "hi",
         stream: true,
@@ -123,8 +154,11 @@ export async function warmCodexAccount(options: CodexWarmupOptions): Promise<voi
   }
 
   if (!res.ok) {
-    await res.body?.cancel().catch(() => {});
-    throw new CodexWarmupError("http_status", "Codex warmup was rejected", { status: res.status });
+    const upstreamDetail = await readErrorDetail(res);
+    throw new CodexWarmupError("http_status", "Codex warmup was rejected", {
+      status: res.status,
+      upstreamDetail,
+    });
   }
   if (!res.body) throw new CodexWarmupError("missing_body");
 
@@ -135,3 +169,25 @@ export async function warmCodexAccount(options: CodexWarmupOptions): Promise<voi
   }
 }
 
+export async function warmCodexAccount(options: CodexWarmupOptions): Promise<void> {
+  const primaryModel = options.model?.trim() || DEFAULT_MODEL;
+  try {
+    await tryWarmup(options, primaryModel);
+    return;
+  } catch (err) {
+    // Retry with fallback models on 400 (model may not be available for this account).
+    if (!(err instanceof CodexWarmupError) || err.status !== 400) throw err;
+    let lastErr = err;
+    for (const fallback of FALLBACK_MODELS) {
+      if (fallback === primaryModel) continue;
+      try {
+        await tryWarmup(options, fallback);
+        return;
+      } catch (retryErr) {
+        if (retryErr instanceof CodexWarmupError) lastErr = retryErr;
+      }
+    }
+    throw lastErr;
+  }
+}
+

tests/warmup.test.ts

@@ -0,0 +1,91 @@
+import { afterEach, describe, expect, mock, spyOn, test } from "bun:test";
+import { CodexWarmupError, codexWarmupFailureReason, warmCodexAccount } from "../src/codex/warmup";
+
+const originalFetch = globalThis.fetch;
+
+function sseResponse(frame = 'data: {"type":"response.completed"}\n\n'): Response {
+  const encoder = new TextEncoder();
+  return new Response(new ReadableStream<Uint8Array>({
+    start(controller) {
+      controller.enqueue(encoder.encode(frame));
+      controller.close();
+    },
+  }), { status: 200, headers: { "Content-Type": "text/event-stream" } });
+}
+
+afterEach(() => {
+  globalThis.fetch = originalFetch;
+});
+
+describe("codex warmup improvements", () => {
+  test("CodexWarmupError exposes upstreamDetail", () => {
+    const err = new CodexWarmupError("http_status", "Codex warmup was rejected", {
+      status: 400,
+      upstreamDetail: "model is not enabled",
+    });
+
+    expect(err.upstreamDetail).toBe("model is not enabled");
+  });
+
+  test("codexWarmupFailureReason includes upstream detail when present", () => {
+    const err = new CodexWarmupError("http_status", "Codex warmup was rejected", {
+      status: 400,
+      upstreamDetail: "model is not enabled",
+    });
+
+    expect(codexWarmupFailureReason(err)).toBe("http_status:400 — model is not enabled");
+  });
+
+  test("codexWarmupFailureReason preserves the old format without upstream detail", () => {
+    const err = new CodexWarmupError("http_status", "Codex warmup was rejected", {
+      status: 400,
+    });
+
+    expect(codexWarmupFailureReason(err)).toBe("http_status:400");
+  });
+
+  test("warmCodexAccount reports detail parsed from JSON error bodies", async () => {
+    const fetchMock = mock(async () =>
+      new Response(JSON.stringify({ error: { message: "model gpt-5.4-mini is unavailable" } }), {
+        status: 401,
+        headers: { "Content-Type": "application/json" },
+      }));
+    globalThis.fetch = fetchMock as unknown as typeof fetch;
+
+    try {
+      await warmCodexAccount({ accessToken: "access-test", chatgptAccountId: "acct-test" });
+      throw new Error("expected warmup to reject");
+    } catch (err) {
+      expect(err).toBeInstanceOf(CodexWarmupError);
+      expect((err as CodexWarmupError).code).toBe("http_status");
+      expect((err as CodexWarmupError).status).toBe(401);
+      expect((err as CodexWarmupError).upstreamDetail).toBe("model gpt-5.4-mini is unavailable");
+      expect(codexWarmupFailureReason(err)).toBe("http_status:401 — model gpt-5.4-mini is unavailable");
+    }
+  });
+
+  test("warmCodexAccount retries FALLBACK_MODELS when the default model returns 400", async () => {
+    const parsedBodies: Record<string, unknown>[] = [];
+    const fetchMock = mock(async (_input: RequestInfo | URL, init?: RequestInit) => {
+      const body = JSON.parse(String(init?.body)) as Record<string, unknown>;
+      parsedBodies.push(body);
+
+      if (body.model === "gpt-5.4-mini") {
+        return new Response(JSON.stringify({ detail: "unknown model" }), { status: 400 });
+      }
+
+      if (body.model === "gpt-5.5") return sseResponse();
+      return new Response("unexpected model", { status: 500 });
+    });
+    const fetchSpy = spyOn(globalThis, "fetch").mockImplementation(fetchMock as unknown as typeof fetch);
+
+    try {
+      await warmCodexAccount({ accessToken: "access-test", chatgptAccountId: "acct-test" });
+    } finally {
+      fetchSpy.mockRestore();
+    }
+
+    expect(fetchMock).toHaveBeenCalledTimes(2);
+    expect(parsedBodies.map(body => body.model)).toEqual(["gpt-5.4-mini", "gpt-5.5"]);
+  });
+});