[Feature]: Auto-pause an account after repeated permanent refusals (403 permission_error, expired subscription) #7101

Area

Account pool / OAuth failover (all providers: Codex pool, Anthropic, Antigravity, Command Code, api-key pools)

What are you trying to accomplish?

Run unattended workers on two hosts against one OCX account pool without a human having to run ocx account pause when an account becomes permanently unusable.

What prevents this today?

Paused accounts are skipped correctly (oauth/index.ts selection throws OAuthAccountPausedError; codex/account-pause.ts checks pausedCodexAccountIds; api-key pools honour disabled). But nothing pauses an account automatically when the upstream answers with a permanent, account-scoped refusal. Observed on 2026-10-14 with OpenCodex 2.83.0/2.84.0 on Windows 11 and macOS 15: an Anthropic OAuth account whose organisation forbids OAuth returned 403 permission_error: OAuth authentication is currently not allowed for this organization on every selection; round-robin kept selecting it, every Claude request through the proxy failed until an operator ran ocx account pause anthropic <id>. A similar case: a ChatGPT free-plan account whose subscription lapsed stays in rotation as needs-reauth and is retried.

What should OpenCodex do?

Add an opt-in auto-pause policy per provider (default off):

• Classify permanent account-scoped refusals: HTTP 401/403 with permission_error, organisation/OAuth-not-allowed, subscription inactive/expired, plan downgraded to free without credits.
• On N consecutive such refusals from the same account (N configurable, default 2), mark the account paused with a reason and timestamp, select the next eligible account for the in-flight request, and emit one log line plus a dashboard badge.
• Never auto-pause on 429/overload/5xx (those already go through cooldown/failover).
• ocx account list shows the pause reason; ocx account resume clears it.

Example usage or interface

ocx config set accountAutoPause.enabled true
ocx config set accountAutoPause.consecutiveFailures 2
# log
[account-auto-pause] anthropic e449…: paused after 2x 403 permission_error (org forbids OAuth); rotated to d***5

Alternatives or workarounds

External watcher that tails service.log and runs ocx account pause; a pre-dispatch probe per provider. Both add latency or a second process and cannot rotate the in-flight request.

Additional context

Happy to submit a PR if the maintainers agree on the classification list and config keys. No credentials or account identifiers beyond masked prefixes are included.

Checks

• I searched existing issues and documentation.
• This request describes a concrete OpenCodex workflow rather than merely naming a desired technology.
• I removed secrets and personal data.