Repository navigation
[Feature]: Recognize confirmed Google account-level refusal texts for account auto-pause #7803
Description
Area
Authentication and account pool
What are you trying to accomplish?
Pause a Google OAuth account after repeated confirmed account-level suspension or disablement refusals. Model-level permission errors must not pause the account.
What prevents this today?
In published 2.92.0, src/oauth/account-auto-pause-policy.ts:19 matches only a narrow whole-message pattern. Synthetic results of classifyPermanentAccountRefusal:
- 403
PERMISSION_DENIEDwithYour account is suspended.returnsaccount_permission_denied. - 403
PERMISSION_DENIEDwithThis Google account has been suspended.returns nothing. - 401
UNAUTHENTICATEDwithYour account is suspended.returns nothing. - 403
PERMISSION_DENIEDwithAccess to this model is denied.returns nothing (correct).
These messages are synthetic. We have not seen a live Google suspension or disablement response, so we do not know the real wording or status code.
What should OpenCodex do?
Accept documented Google account-level patterns once a real response is known, or allow a configured per-provider pattern policy. Keep the repeated-refusal threshold and generation fencing. Require positive account-level evidence; do not pause for model permissions, transient failures or ambiguous text. Define how an operator clears the pause.
Example usage or interface
Feed the classifier the synthetic responses above. A supported account-level refusal pauses only the affected account after the configured threshold. Access to this model is denied. never pauses it. Add tests for 401 and 403, account and model scope, false positives and stale credential generations.
Alternatives or workarounds
An operator pauses an affected account by hand after checking the refusal. Do not assume that every Google 403 means a suspension.
Additional context
Live Google response envelopes are unverified. This asks to extend the narrow detection once real envelopes are known; it does not claim that every Google 403 is missed.
Related: #7101 and #7153 (auto-pause after repeated permanent refusals), #6749 (Anthropic pool did not eject a revoked-token account), #5991 (Kiro failover on suspension refusals).
Checks
- I searched existing issues and documentation.
- This request describes a concrete OpenCodex workflow rather than merely naming a desired technology.
- I removed secrets and personal data.
Activity
fix(google): honor Retry-After floor and recognize the Cloud Code Ass…
lidge-jun commentedon Oct 27, 2026
#7819, merged to
devas 98e6f0c, adds the confirmed Google envelope to the opt-inaccountAutoPauseclassifier: HTTP 403, numericcode: 403,status: PERMISSION_DENIED, and exactly the Cloud Code Assist Terms of Service ban message Google has returned, alone or with its fixed contact or appeal sentence (google-gemini/gemini-cli #19501, #20813, #27199, #27388). It maps toaccount_permission_denied; the threshold, wire ownership and generation fences are unchanged, and resume clears it as for other reasons.Deliberately not added:
CONSUMER_SUSPENDED(Google documents it for a suspended consumer project, not the sending identity), service-enablement and model-permission errors, 401 variants, and any wording without a real observed envelope. That matches the request here (confirmed texts only), so closing; a new real envelope can be added the same way with its source.