fix: auto-remove invalid oauth pool keys

crates/aether-admin/src/provider/quota.rs

@@ -914,8 +914,8 @@ mod tests {
     use super::{
         codex_build_invalid_state, codex_runtime_invalid_reason,
         parse_chatgpt_web_conversation_init_response, parse_codex_wham_usage_response,
-        OAUTH_ACCOUNT_BLOCK_PREFIX, OAUTH_EXPIRED_PREFIX, OAUTH_REFRESH_FAILED_PREFIX,
-        OAUTH_REQUEST_FAILED_PREFIX,
+        should_auto_remove_structured_reason, OAUTH_ACCOUNT_BLOCK_PREFIX, OAUTH_EXPIRED_PREFIX,
+        OAUTH_REFRESH_FAILED_PREFIX, OAUTH_REQUEST_FAILED_PREFIX,
     };
     use aether_data_contracts::repository::provider_catalog::StoredProviderCatalogKey;
     use serde_json::json;
@@ -1010,6 +1010,23 @@ mod tests {
         );
     }
 
+    #[test]
+    fn auto_remove_structured_reason_removes_oauth_expired_token_invalid() {
+        assert!(should_auto_remove_structured_reason(Some(
+            "[OAUTH_EXPIRED] token invalidated"
+        )));
+    }
+
+    #[test]
+    fn auto_remove_structured_reason_keeps_request_and_refresh_failures() {
+        assert!(!should_auto_remove_structured_reason(Some(
+            "[REQUEST_FAILED] 账号状态检查失败"
+        )));
+        assert!(!should_auto_remove_structured_reason(Some(
+            "[REFRESH_FAILED] Token 续期失败 (401): refresh_token 已失效"
+        )));
+    }
+
     #[test]
     fn parses_codex_spark_quota_from_additional_rate_limits() {
         let parsed = parse_codex_wham_usage_response(

crates/aether-admin/src/provider/status.rs

@@ -42,6 +42,7 @@ const AUTO_REMOVABLE_ACCOUNT_STATE_CODES: &[&str] = &[
     "account_disabled",
     "workspace_deactivated",
     "account_forbidden",
+    "oauth_token_invalid",
 ];
 
 #[derive(Debug, Clone, Default, PartialEq, Eq)]
@@ -602,6 +603,19 @@ mod tests {
         assert!(!snapshot.recoverable);
     }
 
+    #[test]
+    fn oauth_expired_state_is_auto_removed() {
+        let state = resolve_pool_account_state(
+            Some("codex"),
+            None,
+            Some("[OAUTH_EXPIRED] token invalidated"),
+        );
+
+        assert!(state.blocked);
+        assert_eq!(state.code.as_deref(), Some("oauth_token_invalid"));
+        assert!(should_auto_remove_account_state(&state));
+    }
+
     #[test]
     fn account_snapshot_detects_account_block_and_verification() {
         let snapshot = resolve_account_status_snapshot(