@bitkyc08/opencodex 2.35.0 → 2.36.0-preview.20260830

package/src/lib/windows-secret-acl.ts

@@ -33,6 +33,7 @@ import { existsSync, statSync } from "node:fs";
 import { env, platform } from "node:process";
 import { resolveTrustedWindowsIcaclsExe } from "./windows-elevation";
 import {
+  cachedCurrentWindowsIdentity,
   resolveCurrentWindowsPrincipal,
   resolveCurrentWindowsPrincipalAsync,
   setSyntheticWindowsPrincipalForTests,
@@ -500,6 +501,69 @@ function grantAce(user: string, directory: boolean): string {
   return directory ? `${user}:(OI)(CI)(F)` : `${user}:(F)`;
 }
 
+function existingAclIsCompliant(
+  targetPath: string,
+  directory: boolean,
+  stdout: string,
+  ownerName: string,
+): boolean {
+  const lines = stdout.replaceAll("\r", "").split("\n");
+  const first = lines.shift();
+  if (!first || first.slice(0, targetPath.length).toLowerCase() !== targetPath.toLowerCase()) {
+    return false;
+  }
+  const separator = first[targetPath.length];
+  if (separator !== undefined && !/\s/.test(separator)) return false;
+
+  const aceLines: string[] = [];
+  const firstAce = first.slice(targetPath.length).trim();
+  if (firstAce) aceLines.push(firstAce);
+  for (const line of lines) {
+    if (!line.trim()) break;
+    // Localized summary text is not indented like a continuation ACE.
+    if (!/^\s/.test(line)) break;
+    aceLines.push(line.trim());
+  }
+  if (aceLines.length !== 1) return false;
+
+  const match = /^([^:]+):((?:\([A-Z]+\))+)$/.exec(aceLines[0]!);
+  if (!match || match[1]!.trim().toLowerCase() !== ownerName.toLowerCase()) return false;
+  const rights = [...match[2]!.matchAll(/\(([A-Z]+)\)/g)].map(part => part[1]);
+  const expected = directory ? ["OI", "CI", "F"] : ["F"];
+  return rights.length === expected.length && rights.every((right, index) => right === expected[index]);
+}
+
+function shouldVerifyExistingAcl(): boolean {
+  return env["OPENCODEX_ACL_VERIFY_EXISTING"] === "1";
+}
+
+function existingAclAlreadyCompliant(targetPath: string, directory: boolean): boolean {
+  if (!shouldVerifyExistingAcl()) return false;
+  const identity = cachedCurrentWindowsIdentity();
+  if (!identity) return false;
+  try {
+    const result = icaclsRunner([targetPath], resolveHardenDeadlineMs());
+    return result.success && existingAclIsCompliant(targetPath, directory, result.stdout, identity.name);
+  } catch {
+    return false;
+  }
+}
+
+async function existingAclAlreadyCompliantAsync(
+  targetPath: string,
+  directory: boolean,
+): Promise<boolean> {
+  if (!shouldVerifyExistingAcl()) return false;
+  const identity = cachedCurrentWindowsIdentity();
+  if (!identity) return false;
+  try {
+    const result = await asyncIcaclsRunner([targetPath], resolveHardenDeadlineMs());
+    return result.success && existingAclIsCompliant(targetPath, directory, result.stdout, identity.name);
+  } catch {
+    return false;
+  }
+}
+
 function runIcacls(targetPath: string, directory: boolean, deadline: number): void {
   const principal = currentWindowsPrincipal(deadline);
 
@@ -724,6 +788,7 @@ function hardenEntry(
   if (!existsSync(targetPath)) { cache.delete(targetPath); return { ok: true }; }
   if (effectivePlatform() !== "win32") return { ok: true };
   if (memoSatisfied(cache, targetPath)) return { ok: true };
+  if (existingAclAlreadyCompliant(targetPath, directory)) return { ok: true };
   const memoKey = timeoutMemoKey(targetPath, opts);
   const timeoutMemoError = timeoutMemoErrorIfBlocked(memoKey, opts);
   if (timeoutMemoError) {
@@ -776,6 +841,7 @@ async function hardenEntryAsync(
   if (!existsSync(targetPath)) { cache.delete(targetPath); return { ok: true }; }
   if (effectivePlatform() !== "win32") return { ok: true };
   if (memoSatisfied(cache, targetPath)) return { ok: true };
+  if (await existingAclAlreadyCompliantAsync(targetPath, directory)) return { ok: true };
   const memoKey = timeoutMemoKey(targetPath, opts);
   const timeoutMemoError = timeoutMemoErrorIfBlocked(memoKey, opts);
   if (timeoutMemoError) {

package/src/lib/windows-text.ts

@@ -53,14 +53,40 @@ function decodeUtf16Be(buffer: Uint8Array): string {
  * Western fallback deliberately narrow: treating CP932, CP1250, or CP1251
  * bytes as Windows-1252 can fabricate a different valid-looking filesystem
  * path, which is worse than the previous replacement-character refusal.
+ *
+ * The CJK double-byte pages are named for the same reason `euc-kr` is: they are
+ * the ANSI code page on their own hosts, they are unambiguous for that language
+ * tag, and `decodeStrict` rejects a mismatch instead of inventing a path. A
+ * zh-CN host's schtasks stderr is CP936 (`gbk`), which the UTF-8 attempt above
+ * fails on and which previously fell through to a lossy UTF-8 decode — the
+ * mojibake made every localized message unmatchable (#2914).
+ *
+ * zh-Hant is a separate page (`big5`), not a variant of the same one, so the
+ * region subtag decides: `zh-TW`/`zh-HK`/`zh-MO` are Big5, bare `zh` and
+ * `zh-CN`/`zh-SG` are GBK. Guessing wrong here is exactly the fabricated-path
+ * risk the Western note describes, so an unrecognized `zh-*` region keeps the
+ * mainland default rather than trying both.
  */
-function legacyEncodingForLocale(locale: string): "euc-kr" | "windows-1252" | null {
-  const language = locale.trim().split(/[-_]/, 1)[0]?.toLowerCase();
+function legacyEncodingForLocale(locale: string): LegacyWindowsEncoding | null {
+  const parts = locale.trim().split(/[-_]/);
+  const language = parts[0]?.toLowerCase();
   if (language === "ko") return "euc-kr";
+  if (language === "ja") return "shift_jis";
+  if (language === "zh") return traditionalChineseRegion(parts) ? "big5" : "gbk";
   if (language && WINDOWS_1252_LANGUAGES.has(language)) return "windows-1252";
   return null;
 }
 
+type LegacyWindowsEncoding = "euc-kr" | "shift_jis" | "gbk" | "big5" | "windows-1252";
+
+/** `zh-Hant`, or a region that ships Big5 as its ANSI code page. */
+function traditionalChineseRegion(parts: readonly string[]): boolean {
+  return parts.slice(1).some(part => {
+    const tag = part.toLowerCase();
+    return tag === "hant" || tag === "tw" || tag === "hk" || tag === "mo";
+  });
+}
+
 const WINDOWS_1252_LANGUAGES = new Set([
   "af", "br", "ca", "co", "cy", "da", "de", "en", "es", "eu", "fi", "fo", "fr",
   "ga", "gd", "gl", "id", "is", "it", "lb", "ms", "nl", "no", "oc", "pt", "sq",

package/src/lib/windows-user-principal.ts

@@ -29,8 +29,8 @@ import {
 } from "./windows-elevation";
 
 const SID_PATTERN = /^S-1-(?:\d+-)+\d+$/i;
-const SID_EXPRESSION =
-  "[System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value";
+const IDENTITY_EXPRESSION =
+  "$identity=[System.Security.Principal.WindowsIdentity]::GetCurrent();$identity.User.Value;$identity.Name";
 const DEFAULT_WINDOWS_ARM64_POWERSHELL = windowsPath.join(
   "C:\\Windows\\System32",
   "WindowsPowerShell",
@@ -106,7 +106,7 @@ const POWERSHELL_ARGS = [
   "-NoProfile",
   "-NonInteractive",
   "-Command",
-  SID_EXPRESSION,
+  IDENTITY_EXPRESSION,
 ] as const;
 
 function windowsPrincipalPowerShellCommand(): string[] {
@@ -167,7 +167,12 @@ async function defaultAsyncWindowsPrincipalRunner(
 
 let principalRunner: WindowsPrincipalRunner = defaultWindowsPrincipalRunner;
 let asyncPrincipalRunner: AsyncWindowsPrincipalRunner = defaultAsyncWindowsPrincipalRunner;
-let cachedPrincipal: string | null = null;
+export interface WindowsPrincipalIdentity {
+  readonly sid: string;
+  readonly name: string;
+}
+
+let cachedIdentity: WindowsPrincipalIdentity | null = null;
 let asyncLookupInFlight: Promise<string> | null = null;
 
 /**
@@ -191,7 +196,7 @@ let syntheticPrincipalForTests: string | null = null;
  */
 export function setSyntheticWindowsPrincipalForTests(principal: string | null): void {
   syntheticPrincipalForTests = principal;
-  cachedPrincipal = null;
+  cachedIdentity = null;
 }
 
 /** True when an explicit runner override is installed and must take precedence. */
@@ -211,17 +216,27 @@ function identityError(reason: string): NodeJS.ErrnoException {
   return error;
 }
 
-function principalFromResult(result: WindowsPrincipalLookupResult): string {
+function identityFromResult(result: WindowsPrincipalLookupResult): WindowsPrincipalIdentity {
   if (!result.success) {
     throw identityError(result.timedOut
       ? "timed out"
       : `exited ${result.exitCode ?? "null"}`);
   }
-  const sid = result.stdout.trim();
+  const lines = result.stdout.trim().split(/\r?\n/);
+  const sid = lines[0]?.trim() ?? "";
+  const name = lines[1]?.trim() ?? "";
   if (!SID_PATTERN.test(sid)) {
     throw identityError(sid ? "returned an invalid SID" : "returned an empty SID");
   }
-  return `*${sid.toUpperCase()}`;
+  if (!name || lines.length !== 2) {
+    throw identityError(name ? "returned an ambiguous account name" : "returned an empty account name");
+  }
+  return Object.freeze({ sid: sid.toUpperCase(), name });
+}
+
+/** Read the effective-token identity only when an earlier lookup already cached it. */
+export function cachedCurrentWindowsIdentity(): WindowsPrincipalIdentity | null {
+  return cachedIdentity;
 }
 
 /** Resolve and process-cache the effective token SID for synchronous ACL paths. */
@@ -229,7 +244,7 @@ export function resolveCurrentWindowsPrincipal(timeoutMs: number): string {
   // Order matters: an explicitly injected runner outranks the synthetic value,
   // so a test can inject a FAILURE on a POSIX host. See the seam comment above.
   if (hasSyncRunnerOverride()) {
-    if (cachedPrincipal) return cachedPrincipal;
+    if (cachedIdentity) return `*${cachedIdentity.sid}`;
     if (timeoutMs <= 0) throw identityError("had no remaining deadline");
     let overridden: WindowsPrincipalLookupResult;
     try {
@@ -237,11 +252,10 @@ export function resolveCurrentWindowsPrincipal(timeoutMs: number): string {
     } catch {
       throw identityError("could not start");
     }
-    const principal = principalFromResult(overridden);
-    cachedPrincipal = principal;
-    return principal;
+    cachedIdentity = identityFromResult(overridden);
+    return `*${cachedIdentity.sid}`;
   }
-  if (cachedPrincipal) return cachedPrincipal;
+  if (cachedIdentity) return `*${cachedIdentity.sid}`;
   if (syntheticPrincipalForTests) return syntheticPrincipalForTests;
   if (timeoutMs <= 0) throw identityError("had no remaining deadline");
   let result: WindowsPrincipalLookupResult;
@@ -250,9 +264,8 @@ export function resolveCurrentWindowsPrincipal(timeoutMs: number): string {
   } catch {
     throw identityError("could not start");
   }
-  const principal = principalFromResult(result);
-  cachedPrincipal = principal;
-  return principal;
+  cachedIdentity = identityFromResult(result);
+  return `*${cachedIdentity.sid}`;
 }
 
 async function waitForExistingLookup(
@@ -284,7 +297,7 @@ async function waitForExistingLookup(
  */
 export async function resolveCurrentWindowsPrincipalAsync(timeoutMs: number): Promise<string> {
   const overridden = hasAsyncRunnerOverride();
-  if (cachedPrincipal) return cachedPrincipal;
+  if (cachedIdentity) return `*${cachedIdentity.sid}`;
   if (asyncLookupInFlight) return waitForExistingLookup(asyncLookupInFlight, timeoutMs);
   // Same precedence rule as the sync path: an injected runner beats the synthetic.
   if (!overridden && syntheticPrincipalForTests) return syntheticPrincipalForTests;
@@ -297,9 +310,8 @@ export async function resolveCurrentWindowsPrincipalAsync(timeoutMs: number): Pr
     } catch {
       throw identityError("could not start");
     }
-    const principal = principalFromResult(result);
-    cachedPrincipal = principal;
-    return principal;
+    cachedIdentity = identityFromResult(result);
+    return `*${cachedIdentity.sid}`;
   })();
   asyncLookupInFlight = lookup;
   try {
@@ -317,7 +329,7 @@ export function setWindowsPrincipalRunnerForTests(
     throw new Error("Cannot replace the Windows principal runner while a lookup is in flight.");
   }
   principalRunner = runner ?? defaultWindowsPrincipalRunner;
-  cachedPrincipal = null;
+  cachedIdentity = null;
 }
 
 /** Test seam: replace the async resolver process and clear its successful cache. */
@@ -328,7 +340,7 @@ export function setAsyncWindowsPrincipalRunnerForTests(
     throw new Error("Cannot replace the Windows principal runner while a lookup is in flight.");
   }
   asyncPrincipalRunner = runner ?? defaultAsyncWindowsPrincipalRunner;
-  cachedPrincipal = null;
+  cachedIdentity = null;
 }
 
 /** Test seam: clear only process-local principal state. */
@@ -336,6 +348,6 @@ export function resetWindowsPrincipalForTests(): void {
   if (asyncLookupInFlight) {
     throw new Error("Cannot reset the Windows principal while a lookup is in flight.");
   }
-  cachedPrincipal = null;
+  cachedIdentity = null;
   syntheticPrincipalForTests = null;
 }

package/src/oauth/account-quota-rank.ts

@@ -0,0 +1,107 @@
+/**
+ * Order failover candidates by what we know about their remaining allowance.
+ *
+ * Rotation without this walks the roster blind: the account right after the one that just
+ * 429'd may itself be spent, so the request burns a second rotation from a budget of three
+ * to learn what a cached quota row already knew.
+ *
+ * Deliberately NOT a scoring function. Percentages from different providers measure
+ * different things, and a weight would invite tuning a number nobody can validate. Three
+ * categories answer the only question rotation asks — "which of these is most likely to
+ * serve the retry" — and within the healthy group a simple headroom sort is enough.
+ */
+import { getCachedProviderAccountQuota } from "../providers/quota";
+import { getKiroAccountExhaustion } from "../providers/kiro-usage";
+
+/** Lower sorts earlier. Unknown sits between measured-healthy and measured-empty. */
+const RANK_HEALTHY = 0;
+const RANK_UNKNOWN = 1;
+const RANK_EXHAUSTED = 2;
+
+interface Ranked {
+  id: string;
+  bucket: number;
+  /** Remaining percentage points, descending within the healthy bucket. */
+  headroom: number;
+  /** Preserves the caller's ring order for ties. */
+  index: number;
+}
+
+/**
+ * Remaining headroom across every window the provider reports.
+ *
+ * The minimum wins: an account at 5% of its five-hour window is unusable right now even if
+ * its monthly allowance is barely touched.
+ */
+function headroomOf(provider: string, accountId: string): number | null {
+  const quota = getCachedProviderAccountQuota(provider, accountId);
+  if (!quota) return null;
+  const percents = [
+    quota.fiveHourPercent,
+    quota.weeklyPercent,
+    quota.monthlyPercent,
+    ...(quota.customWindows ?? []).map(window => window.percent),
+  ].filter((value): value is number => typeof value === "number");
+  if (percents.length === 0) return null;
+  return 100 - Math.max(...percents);
+}
+
+/**
+ * Order candidates best-first.
+ *
+ * Returns the input untouched when no candidate has quota evidence, which keeps every
+ * provider without per-account quota on exactly the behaviour it has today.
+ */
+export function rankAccountsByHeadroom(provider: string, ring: readonly string[]): string[] {
+  if (ring.length < 2) return [...ring];
+
+  let sawEvidence = false;
+  const ranked: Ranked[] = ring.map((id, index) => {
+    // A provider-declared exhaustion verdict outranks the percentage: an account may sit at
+    // 100% and still be servable when overage is enabled, and the verdict knows that.
+    const exhaustion = provider === "kiro" ? getKiroAccountExhaustion(`${provider}\u0000${id}`) : null;
+    const headroom = headroomOf(provider, id);
+    if (exhaustion !== null || headroom !== null) sawEvidence = true;
+
+    if (exhaustion?.exhausted === true) return { id, bucket: RANK_EXHAUSTED, headroom: 0, index };
+    if (headroom === null) return { id, bucket: RANK_UNKNOWN, headroom: 0, index };
+    return { id, bucket: RANK_HEALTHY, headroom, index };
+  });
+
+  if (!sawEvidence) return [...ring];
+
+  return ranked
+    .sort((a, b) => (a.bucket - b.bucket) || (b.headroom - a.headroom) || (a.index - b.index))
+    .map(entry => entry.id);
+}
+
+/**
+ * Do we hold any measurement at all for these accounts?
+ *
+ * Ranking a single candidate is trivially the identity, which makes it useless as an
+ * evidence test: a caller that has already filtered its list down to one account would be
+ * told "ranked" when nothing was measured. Pre-dispatch selection asks this first so it
+ * can decline to act on a roster it knows nothing about.
+ */
+export function hasHeadroomEvidence(provider: string, ids: readonly string[]): boolean {
+  return ids.some(id =>
+    headroomOf(provider, id) !== null
+    || (provider === "kiro" && getKiroAccountExhaustion(`${provider}\u0000${id}`) !== null));
+}
+/**
+ * How long to cool an account that just 429'd, when we know its allowance is spent.
+ *
+ * A monthly-exhausted account retried every minute is pure waste, but an upstream reset
+ * date is not something to trust unbounded — the clamp keeps a bogus far-future value from
+ * parking an account for weeks, and a near-instant one from being pointless.
+ */
+const MIN_EXHAUSTED_COOLDOWN_MS = 5 * 60_000;
+const MAX_EXHAUSTED_COOLDOWN_MS = 24 * 60 * 60_000;
+
+export function exhaustedCooldownMs(provider: string, accountId: string, now = Date.now()): number | null {
+  if (provider !== "kiro") return null;
+  const exhaustion = getKiroAccountExhaustion(`${provider}\u0000${accountId}`, now);
+  if (!exhaustion?.exhausted) return null;
+  const untilReset = exhaustion.nextResetAt === undefined ? MIN_EXHAUSTED_COOLDOWN_MS : exhaustion.nextResetAt - now;
+  return Math.min(Math.max(untilReset, MIN_EXHAUSTED_COOLDOWN_MS), MAX_EXHAUSTED_COOLDOWN_MS);
+}

package/src/oauth/anthropic-routing.ts

@@ -27,7 +27,7 @@ import {
   POOL_KEY_ANTHROPIC,
   seedPoolRotationAccount,
 } from "../codex/pool-rotation";
-import type { OcxAccountPoolRotationStrategy, OcxConfig } from "../types";
+import type { OcxAccountPoolQuotaWindow, OcxAccountPoolRotationStrategy, OcxConfig } from "../types";
 import { sweepExpiredOnWrite } from "../lib/state-store-sweeper";
 import { retainedUtf8Bytes } from "../lib/admission";
 
@@ -39,6 +39,8 @@ const MAX_AFFINITY_ENTRIES = 2_000;
 const MAX_AFFINITY_COMPONENT_BYTES = 512;
 const UNKNOWN_USAGE_SCORE = 100;
 const DEFAULT_AUTO_SWITCH_THRESHOLD = 80;
+const DEFAULT_QUOTA_WINDOW: OcxAccountPoolQuotaWindow = "five-hour";
+const VALID_QUOTA_WINDOWS = new Set<OcxAccountPoolQuotaWindow>(["five-hour", "weekly", "max-utilization"]);
 /** Cap same-request 429 rotations so short Retry-After cannot infinite-loop. */
 export const ANTHROPIC_POOL_MAX_FAILOVERS_PER_REQUEST = 3;
 
@@ -50,6 +52,8 @@ export interface AnthropicAccountPoolConfig {
   strategy?: OcxAccountPoolRotationStrategy;
   /** Successful new-session binds retained on one round-robin selection. Default 1; range 1..100. */
   stickyLimit?: number;
+  /** Usage window for quota-based scoring. Default "five-hour" (today's behaviour). */
+  quotaWindow?: OcxAccountPoolQuotaWindow;
 }
 
 interface AccountHealth {
@@ -86,6 +90,22 @@ export function anthropicAutoSwitchThreshold(config: OcxConfig): number {
   return DEFAULT_AUTO_SWITCH_THRESHOLD;
 }
 
+/** Strict parse for management APIs — returns null instead of defaulting. */
+export function parseAccountPoolQuotaWindow(raw: unknown): OcxAccountPoolQuotaWindow | null {
+  if (typeof raw === "string" && VALID_QUOTA_WINDOWS.has(raw as OcxAccountPoolQuotaWindow)) {
+    return raw as OcxAccountPoolQuotaWindow;
+  }
+  return null;
+}
+
+export function normalizeAccountPoolQuotaWindow(raw: unknown): OcxAccountPoolQuotaWindow {
+  return parseAccountPoolQuotaWindow(raw) ?? DEFAULT_QUOTA_WINDOW;
+}
+
+export function anthropicQuotaWindow(config: AnthropicAccountPoolConfig): OcxAccountPoolQuotaWindow {
+  return normalizeAccountPoolQuotaWindow(config.quotaWindow);
+}
+
 function parseRetryAfterMs(value: string | null | undefined, now: number): number | undefined {
   const text = value?.trim();
   if (!text) return undefined;
@@ -142,17 +162,56 @@ function isCooled(accountId: string, now: number): boolean {
   return getAnthropicAccountHealthSnapshot(accountId, now) !== null;
 }
 
-function hasKnownUsage(accountId: string): boolean {
-  const quota = getCachedProviderAccountQuota(PROVIDER, accountId);
-  return typeof quota?.fiveHourPercent === "number" && Number.isFinite(quota.fiveHourPercent);
+function fiveHourKnown(accountId: string): boolean {
+  const percent = getCachedProviderAccountQuota(PROVIDER, accountId)?.fiveHourPercent;
+  return typeof percent === "number" && Number.isFinite(percent);
+}
+
+function weeklyKnown(accountId: string): boolean {
+  const percent = getCachedProviderAccountQuota(PROVIDER, accountId)?.weeklyPercent;
+  return typeof percent === "number" && Number.isFinite(percent);
+}
+
+function fiveHourScore(accountId: string): number {
+  const percent = getCachedProviderAccountQuota(PROVIDER, accountId)?.fiveHourPercent;
+  return typeof percent === "number" && Number.isFinite(percent)
+    ? Math.max(0, Math.min(100, percent))
+    : UNKNOWN_USAGE_SCORE;
+}
+
+function weeklyScore(accountId: string): number {
+  const percent = getCachedProviderAccountQuota(PROVIDER, accountId)?.weeklyPercent;
+  return typeof percent === "number" && Number.isFinite(percent)
+    ? Math.max(0, Math.min(100, percent))
+    : UNKNOWN_USAGE_SCORE;
 }
 
-function usageScore(accountId: string): number {
-  const quota = getCachedProviderAccountQuota(PROVIDER, accountId);
-  if (!quota || typeof quota.fiveHourPercent !== "number" || !Number.isFinite(quota.fiveHourPercent)) {
-    return UNKNOWN_USAGE_SCORE;
+function exhausted5h(accountId: string): boolean {
+  return fiveHourKnown(accountId) && fiveHourScore(accountId) >= 100;
+}
+
+function hasKnownUsage(config: OcxConfig, accountId: string): boolean {
+  const window = anthropicQuotaWindow(anthropicAccountPoolConfig(config));
+  switch (window) {
+    case "five-hour": return fiveHourKnown(accountId);
+    case "weekly": return weeklyKnown(accountId);
+    case "max-utilization": return fiveHourKnown(accountId) || weeklyKnown(accountId);
+  }
+}
+
+function usageScore(config: OcxConfig, accountId: string): number {
+  const window = anthropicQuotaWindow(anthropicAccountPoolConfig(config));
+  switch (window) {
+    case "five-hour": return fiveHourScore(accountId);
+    case "weekly": return weeklyScore(accountId);
+    case "max-utilization": {
+      const scores = [
+        ...(fiveHourKnown(accountId) ? [fiveHourScore(accountId)] : []),
+        ...(weeklyKnown(accountId) ? [weeklyScore(accountId)] : []),
+      ];
+      return scores.length > 0 ? Math.max(...scores) : UNKNOWN_USAGE_SCORE;
+    }
   }
-  return Math.max(0, Math.min(100, quota.fiveHourPercent));
 }
 
 const TOKEN_SKEW_MS = 60_000;
@@ -191,20 +250,48 @@ export function getAnthropicPoolRetryAfterSeconds(now = Date.now()): number | nu
   return Math.max(1, Math.ceil((earliest - now) / 1000));
 }
 
-function pickLowestUsage(excludeId: string | undefined, now: number): string | null {
-  const eligible = getEligibleAnthropicAccounts(now).filter(id => id !== excludeId);
+interface ScoredAccount {
+  accountId: string;
+  hasKnownUsage: boolean;
+  score: number;
+  fiveHourTieBreak: number;
+  /** True only under the opt-in weekly window; see compareScoredAccounts. */
+  knownFirst: boolean;
+}
+
+function compareScoredAccounts(a: ScoredAccount, b: ScoredAccount): number {
+  // known-before-unknown belongs to the OPT-IN windows (weekly, max-utilization), not the
+  // legacy five-hour default. Applying it unconditionally changed ordering for operators who
+  // never opted in: an account measured at 100% would sort ahead of an unmeasured one purely
+  // because it had a reading. The accepted scope preserves the five-hour default exactly.
+  if (a.knownFirst && b.knownFirst && a.hasKnownUsage !== b.hasKnownUsage) {
+    return a.hasKnownUsage ? -1 : 1;
+  }
+  return a.score - b.score || a.fiveHourTieBreak - b.fiveHourTieBreak;
+}
+
+function pickLowestUsage(config: OcxConfig, excludeId: string | undefined, now: number): string | null {
+  const window = anthropicQuotaWindow(anthropicAccountPoolConfig(config));
+  const unfiltered = getEligibleAnthropicAccounts(now).filter(id => id !== excludeId);
+  const available = window === "weekly" ? unfiltered.filter(id => !exhausted5h(id)) : unfiltered;
+  const eligible = available.length > 0 ? available : unfiltered;
   if (eligible.length === 0) return null;
-  let best = eligible[0]!;
-  let bestScore = usageScore(best);
-  for (let i = 1; i < eligible.length; i++) {
-    const id = eligible[i]!;
-    const score = usageScore(id);
-    if (score < bestScore) {
-      best = id;
-      bestScore = score;
-    }
+  const scored: ScoredAccount[] = eligible.map(accountId => ({
+    accountId,
+    hasKnownUsage: hasKnownUsage(config, accountId),
+    score: usageScore(config, accountId),
+    fiveHourTieBreak: window === "five-hour" ? 0 : fiveHourScore(accountId),
+    // Every window EXCEPT the legacy five-hour default is an explicit opt-in, so
+    // known-before-unknown applies to all of them and to none of the default path.
+    knownFirst: window !== "five-hour",
+  }));
+  let best = scored[0]!;
+  for (let i = 1; i < scored.length; i++) {
+    const candidate = scored[i]!;
+    // Strict `< 0` keeps the earliest eligible account on an exact tie.
+    if (compareScoredAccounts(candidate, best) < 0) best = candidate;
   }
-  return best;
+  return best.accountId;
 }
 
 /** Next eligible Anthropic account in stable order after `afterId` (wrapping). */
@@ -213,8 +300,11 @@ function pickNextFillFirstAnthropicAccount(
   afterId: string,
   eligible: string[],
 ): string | null {
-  if (eligible.length === 0) return null;
-  const ordered = [...eligible].sort((a, b) => a.localeCompare(b));
+  const window = anthropicQuotaWindow(anthropicAccountPoolConfig(config));
+  const available = window === "weekly" ? eligible.filter(id => !exhausted5h(id)) : eligible;
+  const candidates = available.length > 0 ? available : eligible;
+  if (candidates.length === 0) return null;
+  const ordered = [...candidates].sort((a, b) => a.localeCompare(b));
   const set = getAccountSet(PROVIDER);
   const stableAll = set
     ? [...set.accounts.map(a => a.id)].sort((a, b) => a.localeCompare(b))
@@ -230,7 +320,7 @@ function pickNextFillFirstAnthropicAccount(
   let fallback: string | null = null;
   for (let step = 1; step <= stableAll.length; step++) {
     const candidate = stableAll[(startIdx + step) % stableAll.length]!;
-    if (!eligible.includes(candidate)) continue;
+    if (!candidates.includes(candidate)) continue;
     if (!fallback) fallback = candidate;
     if (isActiveUnderFillFirstThreshold(config, candidate)) return candidate;
   }
@@ -250,7 +340,7 @@ function pickAlternateAnthropicAccount(
   if (strategy === "fill-first") {
     return pickNextFillFirstAnthropicAccount(config, excludeId, eligible);
   }
-  return pickLowestUsage(excludeId, now);
+  return pickLowestUsage(config, excludeId, now);
 }
 
 function pruneExpiredAffinity(now: number): void {
@@ -290,9 +380,11 @@ function anthropicPoolStrategy(config: OcxConfig): OcxAccountPoolRotationStrateg
 function isActiveUnderFillFirstThreshold(config: OcxConfig, accountId: string): boolean {
   const threshold = anthropicAutoSwitchThreshold(config);
   if (threshold <= 0) return true;
+  const window = anthropicQuotaWindow(anthropicAccountPoolConfig(config));
+  if (window === "weekly" && exhausted5h(accountId)) return false;
   // Unknown usage must not force fill-first to abandon the active account.
-  if (!hasKnownUsage(accountId)) return true;
-  return usageScore(accountId) < threshold;
+  if (!hasKnownUsage(config, accountId)) return true;
+  return usageScore(config, accountId) < threshold;
 }
 
 /**
@@ -412,12 +504,15 @@ export function resolveAnthropicAccountForSession(
   let reason: AnthropicAccountSelectionReason = "none";
 
   if (threshold > 0) {
+    const window = anthropicQuotaWindow(anthropicAccountPoolConfig(config));
     // Unknown usage must NOT force a switch away from the healthy active account.
-    if (activeOk && (!hasKnownUsage(set.activeAccountId) || usageScore(set.activeAccountId) < threshold)) {
+    if (activeOk
+      && !(window === "weekly" && exhausted5h(set.activeAccountId))
+      && (!hasKnownUsage(config, set.activeAccountId) || usageScore(config, set.activeAccountId) < threshold)) {
       accountId = set.activeAccountId;
       reason = "active";
     } else {
-      const picked = pickLowestUsage(undefined, now);
+      const picked = pickLowestUsage(config, undefined, now);
       if (picked) {
         accountId = picked;
         reason = activeOk && picked === set.activeAccountId ? "active" : "lowest-usage";
@@ -430,7 +525,7 @@ export function resolveAnthropicAccountForSession(
     accountId = set.activeAccountId;
     reason = "active";
   } else {
-    const picked = pickLowestUsage(set.activeAccountId, now);
+    const picked = pickLowestUsage(config, set.activeAccountId, now);
     if (picked) {
       accountId = picked;
       reason = "only-eligible";

package/src/oauth/chatgpt.ts

@@ -143,7 +143,10 @@ export async function loginChatGPT(ctrl: OAuthController, opts?: { forceLogin?:
 
 // Note: uses form-urlencoded per OAuth 2.0 spec (RFC 6749 §6).
 // Codex-rs uses JSON for refresh — intentional divergence; both accepted by auth.openai.com.
-export async function refreshChatGPTToken(refreshToken: string): Promise<OAuthCredentials> {
+export async function refreshChatGPTToken(
+  refreshToken: string,
+  options: { signal?: AbortSignal } = {},
+): Promise<OAuthCredentials> {
   const resp = await fetch(TOKEN_URL, {
     method: "POST",
     headers: { "Content-Type": "application/x-www-form-urlencoded" },
@@ -152,6 +155,7 @@ export async function refreshChatGPTToken(refreshToken: string): Promise<OAuthCr
       client_id: CLIENT_ID,
       refresh_token: refreshToken,
     }).toString(),
+    signal: options.signal,
   });
   if (!resp.ok) {
     const errDesc = await safeErrorDescription(resp);