feat(codex): classify reset-eligible quota rejection

[luvs01]

Summary

• implement the first maintainer-requested slice from Add opt-in rejection-only quota recovery with automatic reset-credit redemption #657: semantic classification of reset-eligible pre-stream Codex exhaustion
• recognize only exact structured usage_limit_exceeded and insufficient_quota codes on HTTP 429/402 as reset-credit eligible
• keep status-only or message-only 429 responses classified as generic rate limits
• classify unverified 402, transient 5xx, 401, 403, and unrelated failures separately
• connect the bounded classifier to the existing Multi-account failover issue: Session freezes on depleted primary account despite active secondary Pro account #584 pre-stream Codex Pool alternate-account retry without changing that retry policy

Safety boundary

• reads only a bounded clone of the upstream error response
• malformed, oversized, consumed, or cancelled bodies fail closed and never become reset-credit eligible
• message text cannot authorize reset-credit eligibility
• HTTP status remains authoritative: a quota-looking body under 401/403/5xx is not reset eligible
• the original response remains available for passthrough when no alternate account exists
• no raw body, account identifier, credential, or token is logged or persisted

Explicit non-goals

This PR deliberately does not implement:

• automatic reset-credit redemption
• reset-credit balance or consume calls
• natural-reset waiting
• idempotency or single-flight redemption
• cancellation-bound replay
• recovery priority configuration
• GUI or documentation controls

Those remain separate follow-up slices under the maintainer direction in #657.

Compatibility

The existing #584 behavior is preserved: pre-stream 429/402 still permits one bounded alternate-account attempt even when the rejection is generic or unverified. This PR only establishes the semantic boundary future irreversible recovery must require.

Verification

• Bun 1.4.0-canary.1: 69 focused classifier and server-auth tests passed
• bundled Bun 1.3.14: the same 69 tests passed
• TypeScript typecheck passed
• privacy scan passed on both Bun runtimes

Refs #657

[coderabbitai]

Warning

Review limit reached

@luvs01, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 5 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 389ae2d0-f753-4312-99e0-ebbdd7c450fb

📥 Commits

Reviewing files that changed from the base of the PR and between aae9426 and 0b10fe1.

📒 Files selected for processing (3)

• src/codex/quota-rejection.ts
• src/server/responses/core.ts
• tests/codex-quota-rejection.test.ts

---

_{Comment @coderabbitai help to get the list of available commands.}

[luvs01]

@codex review

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[lidge-jun]

Pre-merge review result: not merge-ready yet. CI is green and the bounded body handling, privacy posture, and Bun compatibility all check out — but the classifier does not hold the fail-closed boundary the PR description promises:

1. src/codex/quota-rejection.ts:59 normalizes with trim().toLowerCase(), so near-miss values like " Usage_Limit_Exceeded " or "USAGE_LIMIT_EXCEEDED" classify as reset-credit eligible. Eligibility must be exact, case-sensitive, and allowlisted.
2. src/codex/quota-rejection.ts:51-63 accepts both root and nested error shapes and both code and type fields, so ambiguous or contradictory payloads (e.g. {error: "opaque", code: "usage_limit_exceeded"}, {error: {code: "unknown", type: "insufficient_quota"}}) are treated as eligible. Unknown or conflicting shapes must fail closed.
3. tests/codex-quota-rejection.test.ts has no negative coverage for casing/whitespace near-misses or ambiguous/conflicting shapes, so the current suite passes while the boundary leaks.

Please: exact-match allowlisted values within explicitly supported response schemas, reject on conflict, and add the negative tests. This is the semantic foundation for the #657 recovery family, so it is worth getting airtight — happy to re-review quickly once updated.