@bitkyc08/opencodex 2.42.0 → 2.43.0

package/src/lib/redact.ts

@@ -1,3 +1,5 @@
+import { foldForMatching } from "./redact-folding";
+
 export const REDACTED_SECRET = "[REDACTED]";
 
 /**
@@ -43,76 +45,6 @@ const CREDENTIAL_HEADER_LABEL_RAW = "x-api-key|x-goog-api-key|x-amz-security-tok
 const CREDENTIAL_HEADER_LABEL = CREDENTIAL_HEADER_LABEL_RAW
   .replace(/(?<![\[\\])([A-Za-z])(?![\]\-])/g, "[$1\u0001]");
 
-/**
- * Characters that render as a colon separator. Folded to `:` in the matching
- * view so a look-alike cannot hide a header from the label pattern.
- */
-const COLON_CONFUSABLES = new Set([
-  "\uFF1A", "\uFE55", "\uFE13", "\uA789", "\u02D0", "\u2236",
-  "\u205A", "\u0589", "\u1361", "\u16EC", "\u1803", "\u2982", "\u2AF6", "\uFE30",
-]);
-
-/**
- * Characters dropped from the matching view: anything with no visible width
- * that could split a label into pieces the pattern no longer recognizes.
- * `\p{Default_Ignorable_Code_Point}` is the systematic answer — it covers the
- * zero-width set, the bidi isolates and marks, the Mongolian vowel separator,
- * and the variation selectors in one property instead of a list that review
- * keeps finding another member of. `\p{Cf}` and combining marks are folded too.
- */
-const INVISIBLE_FORMAT = /[\p{Default_Ignorable_Code_Point}\p{Cf}\p{Mn}\p{Me}]/u;
-
-/**
- * HTML named character references.
- *
- * A hand-picked list is a coverage promise nobody can keep — review found
- * `&ii;`, `&ee;`, and `&DifferentialD;` decoding to compatibility letters that
- * NFKD already maps onto `i`, `e`, and `d`, and the WHATWG table holds roughly
- * 2200 entries. Neither Bun nor Node exposes that table, and pulling in a
- * dependency to spell a header name is the wrong trade for this path.
- *
- * So names are not resolved at all. A named reference sitting inside a
- * credential label is folded to a single placeholder character of unknown
- * identity, and the label alternation accepts that placeholder wherever a
- * letter may appear. Every named entity is covered, present and future,
- * without claiming to know what any of them mean.
- */
-const NAMED_ENTITY_PLACEHOLDER = "\u0001";
-
-/**
- * The handful of named references that spell a SEPARATOR rather than a letter.
- * These have to resolve exactly, because the placeholder stands in for a letter
- * position and a separator is structure, not a character of the name.
- */
-const SEPARATOR_ENTITIES = new Map<string, string>([
-  ["colon", ":"], ["semi", ";"], ["equals", "="], ["quot", '"'], ["apos", "'"],
-  ["lt", "<"], ["gt", ">"], ["amp", "&"], ["sol", "/"], ["lowbar", "_"],
-  ["hyphen", "-"], ["dash", "-"], ["ndash", "-"], ["mdash", "-"], ["minus", "-"],
-  ["period", "."], ["comma", ","], ["num", "#"], ["nbsp", " "],
-]);
-
-/**
- * Latin look-alikes for the ASCII letters that appear in credential labels.
- * Cyrillic `а`/`е`, Greek `ο`, fullwidth forms and the mathematical alphabets
- * all render as the label to a human, so the matching view folds them back.
- * NFKD handles the width/font variants; this table covers the cross-script
- * homoglyphs NFKD deliberately leaves alone.
- */
-const LETTER_CONFUSABLES = new Map<string, string>([
-  // Cyrillic
-  ["\u0430", "a"], ["\u0435", "e"], ["\u043E", "o"], ["\u0440", "p"], ["\u0441", "c"],
-  ["\u0445", "x"], ["\u0443", "y"], ["\u04BB", "h"], ["\u0455", "s"], ["\u0456", "i"],
-  ["\u0458", "j"], ["\u043A", "k"], ["\u0442", "t"], ["\u0432", "b"], ["\u043C", "m"],
-  ["\u043D", "h"], ["\u0501", "d"], ["\u0503", "g"], ["\u051B", "q"], ["\u051D", "w"],
-  ["\u04CF", "l"], ["\u0261", "g"], ["\u04AB", "c"], ["\u04BD", "e"], ["\u0459", "k"],
-  // Greek
-  ["\u03B1", "a"], ["\u03BF", "o"], ["\u03C1", "p"], ["\u03BD", "v"], ["\u03BA", "k"],
-  ["\u03B5", "e"], ["\u03C4", "t"], ["\u03B9", "i"], ["\u03C5", "u"], ["\u03C7", "x"],
-  ["\u03B7", "n"], ["\u03BC", "u"], ["\u03C3", "o"], ["\u03B2", "b"], ["\u03B3", "y"],
-  // Latin extended / other
-  ["\u0131", "i"], ["\u0269", "i"], ["\u1D0F", "o"], ["\u0280", "r"], ["\u01BF", "p"],
-  ["\u0578", "n"], ["\u057D", "u"], ["\u0585", "o"], ["\u0581", "g"], ["\u2044", "/"],
-]);
 
 // `\b` is the wrong left boundary for a header name: it matches after a `-` or
 // `_`, so `not-authorization:` and `internal_token:` were treated as the
@@ -240,111 +172,6 @@ function maskOtherFramingsOnce(value: string, decodeEscapes: boolean): string {
   return current;
 }
 
-/**
- * Build a folded copy plus an index map back to the original string, so the
- * match runs on normalized text while the output keeps every byte the match did
- * not cover.
- */
-function foldForMatching(value: string, decodeEscapes = true): { folded: string; map: number[] } {
-  let folded = "";
-  const map: number[] = [];
-  // Serialization escapes are ALIASES for the label, not decoration: a JSON
-  // `\u0069`, a percent-encoded `%69`, and an XML `&#105;` all spell the same
-  // field name to whatever parses the body, while spelling something else to a
-  // literal matcher. Decode them into the matching view (one folded character
-  // per escape, with the whole escape mapped back to its start) so
-  // `author\u0069zation`, `author%69zation`, and `author&#105;zation` are the
-  // label they claim to be.
-  const decodeEscape = (at: number): { ch: string; width: number } | null => {
-    // JSON `\uXXXX`, INCLUDING a surrogate pair. Decoding the halves
-    // independently left `\uD835\uDD69` as two lone surrogates, so the
-    // mathematical letter they spell was never normalized as one code point.
-    const json = /^\\u([0-9a-fA-F]{4})/.exec(value.slice(at, at + 6));
-    if (json) {
-      const high = parseInt(json[1]!, 16);
-      if (high >= 0xd800 && high <= 0xdbff) {
-        const low = /^\\u([0-9a-fA-F]{4})/.exec(value.slice(at + 6, at + 12));
-        const lowCode = low ? parseInt(low[1]!, 16) : NaN;
-        if (lowCode >= 0xdc00 && lowCode <= 0xdfff) {
-          return { ch: String.fromCharCode(high, lowCode), width: 12 };
-        }
-      }
-      return { ch: String.fromCharCode(high), width: 6 };
-    }
-    // Percent encoding is UTF-8: consecutive `%XX` bytes form ONE character.
-    // Decoding each byte on its own turned `%D0%B5` into two unrelated
-    // Latin-1 characters instead of the Cyrillic `е` the fold would have
-    // recognized.
-    const pct = /^(?:%[0-9a-fA-F]{2})+/.exec(value.slice(at, at + 24));
-    if (pct) {
-      try {
-        const decoded = decodeURIComponent(pct[0]);
-        if (decoded.length >= 1) {
-          // Consume only the bytes that produced the FIRST character, so the
-          // rest of the sequence is decoded on the next iteration.
-          const first = String.fromCodePoint(decoded.codePointAt(0)!);
-          const bytes = new TextEncoder().encode(first).length;
-          return { ch: first, width: bytes * 3 };
-        }
-      } catch {
-        const single = parseInt(pct[0].slice(1, 3), 16);
-        return { ch: String.fromCharCode(single), width: 3 };
-      }
-    }
-    const xml = /^&#(x[0-9a-fA-F]{1,6}|[0-9]{1,7});/.exec(value.slice(at, at + 11));
-    if (xml) {
-      const raw = xml[1]!;
-      const code = raw[0] === "x" || raw[0] === "X"
-        ? parseInt(raw.slice(1), 16)
-        : parseInt(raw, 10);
-      if (Number.isFinite(code) && code > 0 && code <= 0x10ffff) {
-        return { ch: String.fromCodePoint(code), width: xml[0].length };
-      }
-    }
-    // HTML named references. `&colon;` and the other separator names are
-    // resolved exactly; anything else folds to the opaque placeholder so the
-    // label still matches without pretending to know the character.
-    const named = /^&([A-Za-z][A-Za-z0-9]{1,31});/.exec(value.slice(at, at + 34));
-    if (named) {
-      const separator = SEPARATOR_ENTITIES.get(named[1]!.toLowerCase());
-      return { ch: separator ?? NAMED_ENTITY_PLACEHOLDER, width: named[0].length };
-    }
-    return null;
-  };
-  // Iterate by CODE POINT, not UTF-16 code unit: a supplementary character
-  // (mathematical letters, variation selectors above the BMP) is two units, so
-  // a per-unit loop hands each half to the property tests separately and
-  // neither half matches anything. `𝕩-api-key` and a U+E0100 inside a label
-  // both walked straight past the fold that way.
-  let i = 0;
-  while (i < value.length) {
-    const escaped = decodeEscapes ? decodeEscape(i) : null;
-    const ch = escaped ? escaped.ch : String.fromCodePoint(value.codePointAt(i)!);
-    const width = escaped ? escaped.width : ch.length;
-    if (INVISIBLE_FORMAT.test(ch)) {
-      i += width;
-      continue;
-    }
-    const mapped = COLON_CONFUSABLES.has(ch)
-      ? ":"
-      : LETTER_CONFUSABLES.get(ch.toLowerCase())
-        // NFKD collapses fullwidth, circled, and mathematical letter variants
-        // onto their ASCII base.
-        ?? (ch.normalize("NFKD").length === 1 ? ch.normalize("NFKD") : ch);
-    // One folded unit per source code point keeps the offset map aligned; a
-    // multi-unit fold would desynchronize it, so those keep the original.
-    folded += mapped.length === 1 ? mapped : ch;
-    // One map entry per EMITTED UTF-16 unit. An escaped supplementary
-    // character emits two units, and giving it one entry desynchronized every
-    // later offset — the mask then landed mid-token and left part of the
-    // credential behind.
-    const emittedText = mapped.length === 1 ? mapped : ch;
-    for (let k = 0; k < emittedText.length; k += 1) map.push(i);
-    i += width;
-  }
-  map.push(value.length);
-  return { folded, map };
-}
 
 /**
  * Run the header rule over BOTH matching views and take the union.

package/src/lib/state-store-sweeper.ts

@@ -35,7 +35,13 @@ export interface StateStoreSweeperOptions {
 }
 
 const registrations = new Map<string, StateStoreRegistration>();
-const afterTickRegistrations = new Map<string, StateSweepAfterTickRegistration>();
+interface AfterTickRegistrationNode {
+  registration: StateSweepAfterTickRegistration;
+  previous: AfterTickRegistrationNode | null;
+  active: boolean;
+}
+
+const afterTickRegistrations = new Map<string, AfterTickRegistrationNode>();
 let configGeneration = 0;
 let attemptSequence = 0;
 let generationContextBuilder: (() => GenerationContext) | null = null;
@@ -56,11 +62,19 @@ export function registerStateStore(registration: StateStoreRegistration): () =>
 }
 
 export function registerStateSweepAfterTick(registration: StateSweepAfterTickRegistration): () => void {
-  afterTickRegistrations.set(registration.name, registration);
+  const node: AfterTickRegistrationNode = {
+    registration,
+    previous: afterTickRegistrations.get(registration.name) ?? null,
+    active: true,
+  };
+  afterTickRegistrations.set(registration.name, node);
   return () => {
-    if (afterTickRegistrations.get(registration.name) === registration) {
-      afterTickRegistrations.delete(registration.name);
-    }
+    node.active = false;
+    if (afterTickRegistrations.get(registration.name) !== node) return;
+    let previous = node.previous;
+    while (previous && !previous.active) previous = previous.previous;
+    if (previous) afterTickRegistrations.set(registration.name, previous);
+    else afterTickRegistrations.delete(registration.name);
   };
 }
 
@@ -106,7 +120,7 @@ export function sweepLiveness(): StateSweepResult {
 }
 
 function runAfterTickCallbacks(): void {
-  for (const registration of afterTickRegistrations.values()) {
+  for (const { registration } of afterTickRegistrations.values()) {
     try {
       registration.afterTick();
     } catch {

package/src/lib/token-estimate.ts

@@ -9,50 +9,112 @@
  * ~GPT 3.6, ~Gemini 3.8 chars/token (within ~10%). Code / JSON / tool-args (the dominant Codex
  * traffic) pack MORE tokens per char, so a lower chars-per-token ratio is used for those models.
  * Over-counting fails safe (auto-compact fires earlier); under-counting risks context overflow.
+ *
+ * ## Why the estimate is segmented by script rather than a single divisor
+ *
+ * A single chars-per-token divisor cannot describe mixed text. Latin prose and code run near
+ * 3.2 chars/token; Hangul and Han run near 1.2-1.5, because a Latin-trained BPE spends a token
+ * on roughly every CJK character. That is a ~2.5x spread inside one blob, and essentially all
+ * real agent traffic is mixed: English code and JSON framing with Korean prose threaded through
+ * it.
+ *
+ * The earlier model divided the whole blob by one ratio and then clamped to a denser ratio only
+ * when a SAMPLED CJK share crossed 30%. Two failures followed from that shape. The clamp was a
+ * cliff: 29% CJK counted at the sparse ratio, 31% at the dense one, and the band where real
+ * traffic actually sits (roughly 1-30% CJK) never triggered it at all. And the sampler read
+ * every stride-th character on long blobs, so the share it measured was noisy — a payload of
+ * fixed-width records could sample as 100% CJK while being 1.6% CJK, a case still documented in
+ * `server/responses/input-admission.ts`.
+ *
+ * Counting the two scripts separately and adding them removes both problems at once. There is no
+ * threshold to sit beside, no sampling error, and the result is continuous in the CJK share, so a
+ * blob that gains one Korean character gains a fraction of a token instead of jumping a ratio.
  */
 
 /** Generic English-prose fallback ratio (chars per token). */
 const DEFAULT_CHARS_PER_TOKEN = 4;
 
 /**
- * Kiro routes code/JSON-heavy agent traffic whose true ratio is ~3.0-3.3 chars/token. 3.5 keeps a
- * small safety margin (slight over-count) without wildly inflating; tune toward 3.3 if overflow is
- * ever observed. All kiro models are text LLMs, so a single ratio applies to the whole family.
+ * Kiro routes code/JSON-heavy agent traffic: diffs, file paths, tool arguments, identifiers.
+ * That material tokenizes markedly denser than the "4 chars per token" English-prose rule.
+ *
+ * Measured two independent ways, which agree. Recorded conversations pair exact text with the
+ * provider's authoritative input-token count; over 5,799 pure-Latin samples that aggregates to
+ * 2.80 chars/token. Separately, recorded Kiro request bodies charge ~2.43 bytes per token, and
+ * those bodies run ~1.12 bytes per counted character of JSON escaping and framing, which implies
+ * ~2.17 chars/token at the wire.
+ *
+ * 2.8 takes the conservative end of that pair. All kiro models are text LLMs, so one Latin ratio
+ * applies to the whole family.
+ *
+ * Applied ONLY to `kiro/`-prefixed ids. The measurement is Kiro's charge for Kiro's payload
+ * shape, and the id families below (`claude`, `deepseek`, `qwen`, ...) are also routed by
+ * Cursor, Anthropic direct and Antigravity, whose consumers read this same helper to size
+ * admission ceilings, `count_tokens` answers, and overflow-vs-429 classification. Widening a
+ * Kiro-derived constant to those callers would retune three unrelated subsystems from evidence
+ * that says nothing about them.
+ */
+const KIRO_CHARS_PER_TOKEN = 2.8;
+
+/**
+ * Ratio for the model families Kiro shares with other providers, when NOT routed through Kiro.
+ *
+ * These are code-heavy agent models, so 3.5 remains right for them; it is the value every
+ * non-Kiro consumer of this helper was calibrated against.
  */
-const KIRO_CHARS_PER_TOKEN = 3.5;
+const AGENT_MODEL_CHARS_PER_TOKEN = 3.5;
 
-const KIRO_MODEL_PREFIXES = ["kiro", "claude", "deepseek", "minimax", "glm", "qwen"];
+const AGENT_MODEL_PREFIXES = ["kiro", "claude", "deepseek", "minimax", "glm", "qwen"];
 
-/** Model-aware chars-per-token ratio. Unknown models fall back to the generic English ratio. */
+/**
+ * Model-aware chars-per-token ratio for LATIN text. Unknown models fall back to the generic
+ * English ratio.
+ *
+ * This is the sparse-script ratio only. It stays exported, and keeps returning a single number,
+ * because callers and tests use it to compare model families; the CJK component is applied by
+ * `estimateTokens` per character rather than by rewriting this ratio.
+ */
 export function charsPerToken(modelId?: string): number {
   if (!modelId) return DEFAULT_CHARS_PER_TOKEN;
   const id = modelId.toLowerCase();
-  if (KIRO_MODEL_PREFIXES.some(p => id.startsWith(p))) return KIRO_CHARS_PER_TOKEN;
+  // `estimateKiroTokens` always prefixes `kiro/`, so the Kiro-measured ratio reaches Kiro traffic
+  // and only Kiro traffic.
+  if (id.startsWith("kiro")) return KIRO_CHARS_PER_TOKEN;
+  if (AGENT_MODEL_PREFIXES.some(p => id.startsWith(p))) return AGENT_MODEL_CHARS_PER_TOKEN;
   return DEFAULT_CHARS_PER_TOKEN;
 }
 
 /**
- * CJK-aware ratio (devlog 260712 B3, audit R2#7): Korean/Chinese/Japanese text packs
- * roughly one token per 1.5-3 chars, so a CJK-heavy blob estimated at English ratios
- * badly undercounts. When >30% of chars are CJK, clamp DOWN to 2.5 chars/token —
- * `min(model ratio, 2.5)` so per-model ratios (Claude 3.5, Kiro family) never rise.
+ * Chars per token for CJK text, applied to the CJK characters alone.
+ *
+ * Solved from the same recorded ground truth: holding the Latin ratio fixed and attributing the
+ * remainder of CJK-heavy samples to their Hangul/Han characters gives ~1.50 chars/token. A Korean
+ * character therefore costs roughly TWICE what a Latin character does, which is precisely what a
+ * single blended divisor cannot express.
  */
-const CJK_CHARS_PER_TOKEN = 2.5;
-const CJK_RATIO_THRESHOLD = 0.3;
-// Hangul syllables/jamo, CJK unified ideographs (+ext A), hiragana/katakana.
-const CJK_RE = /[\uAC00-\uD7A3\u1100-\u11FF\u3130-\u318F\u4E00-\u9FFF\u3400-\u4DBF\u3040-\u30FF]/;
+const CJK_CHARS_PER_TOKEN = 1.5;
 
-function cjkRatio(text: string): number {
-  if (text.length === 0) return 0;
-  // Sample long blobs for O(1) cost: every char up to 2k, then a stride.
-  const stride = text.length > 2048 ? Math.ceil(text.length / 2048) : 1;
+/**
+ * Count CJK characters exactly, in one pass, with no allocation and no regex object per char.
+ *
+ * Ranges: Hangul syllables and jamo, CJK unified ideographs and extension A, hiragana/katakana.
+ * Surrogate pairs (rare CJK extensions beyond the BMP) are counted as their two code units,
+ * which slightly over-counts them — again the safe direction.
+ */
+function countCjk(text: string): number {
   let cjk = 0;
-  let sampled = 0;
-  for (let i = 0; i < text.length; i += stride) {
-    sampled++;
-    if (CJK_RE.test(text[i]!)) cjk++;
+  for (let i = 0; i < text.length; i++) {
+    const c = text.charCodeAt(i);
+    if (
+      (c >= 0xac00 && c <= 0xd7a3)
+      || (c >= 0x1100 && c <= 0x11ff)
+      || (c >= 0x3130 && c <= 0x318f)
+      || (c >= 0x4e00 && c <= 0x9fff)
+      || (c >= 0x3400 && c <= 0x4dbf)
+      || (c >= 0x3040 && c <= 0x30ff)
+    ) cjk++;
   }
-  return sampled === 0 ? 0 : cjk / sampled;
+  return cjk;
 }
 
 /**
@@ -80,7 +142,12 @@ export function estimateTokens(text: string, modelId?: string, contextWindow?: n
   if (!text) return 0;
   const len = text.length;
   if (len === 0) return 0;
-  let ratio = charsPerToken(modelId);
-  if (cjkRatio(text) > CJK_RATIO_THRESHOLD) ratio = Math.min(ratio, CJK_CHARS_PER_TOKEN);
-  return capEstimateAtContextWindow(Math.max(1, Math.ceil(len / ratio)), contextWindow);
+  const latinRatio = charsPerToken(modelId);
+  const cjk = countCjk(text);
+  // Continuous in the CJK share: no threshold, so one added Korean character moves the estimate
+  // by a fraction of a token instead of switching the whole blob to a different divisor.
+  const estimate = cjk === 0
+    ? Math.ceil(len / latinRatio)
+    : Math.ceil((len - cjk) / latinRatio + cjk / CJK_CHARS_PER_TOKEN);
+  return capEstimateAtContextWindow(Math.max(1, estimate), contextWindow);
 }

package/src/lib/windows-user-principal.ts

@@ -23,6 +23,7 @@
 import { existsSync } from "node:fs";
 import { win32 as windowsPath } from "node:path";
 import { waitForSubprocessExit } from "./bounded-subprocess";
+import { decodeWindowsTextBytes } from "./windows-text";
 
 import {
   resolveTrustedWindowsPowerShellExe,
@@ -98,7 +99,12 @@ export interface WindowsPrincipalLookupResult {
   success: boolean;
   exitCode: number | null;
   timedOut: boolean;
-  stdout: string;
+  /**
+   * Raw child stdout. Bytes are allowed because `powershell.exe` writes the console
+   * output code page, not UTF-8, and the decode below is the thing under test: a seam
+   * that only carried a decoded string could never exercise it.
+   */
+  stdout: string | Uint8Array;
 }
 
 export type WindowsPrincipalRunner = (
@@ -138,7 +144,10 @@ function defaultWindowsPrincipalRunner(timeoutMs: number): WindowsPrincipalLooku
     success: result.success,
     exitCode: result.exitCode,
     timedOut: result.exitedDueToTimeout ?? false,
-    stdout: result.stdout ? result.stdout.toString() : "",
+    // Bytes, NOT .toString(): that is UTF-8, and Windows PowerShell 5.1 emits the
+    // console output code page. A non-ASCII account name decoded as UTF-8 becomes
+    // U+FFFD and is then frozen into the identity cache.
+    stdout: result.stdout ?? new Uint8Array(),
   };
 }
 
@@ -152,8 +161,9 @@ async function defaultAsyncWindowsPrincipalRunner(
     windowsHide: true,
   });
   const { exitCode, timedOut } = await waitForSubprocessExit(proc, timeoutMs);
-  const stdout = !timedOut && proc.stdout
-    ? await new Response(proc.stdout).text().catch(() => "")
+  // `.bytes()` rather than `.text()`, for the same reason as the sync runner above.
+  const stdout: string | Uint8Array = !timedOut && proc.stdout
+    ? await new Response(proc.stdout).bytes().catch(() => new Uint8Array())
     : "";
   return {
     success: !timedOut && exitCode === 0,
@@ -165,6 +175,24 @@ async function defaultAsyncWindowsPrincipalRunner(
 
 let principalRunner: WindowsPrincipalRunner = defaultWindowsPrincipalRunner;
 let asyncPrincipalRunner: AsyncWindowsPrincipalRunner = defaultAsyncWindowsPrincipalRunner;
+let principalLocaleForTests: string | undefined;
+
+/**
+ * Decode child stdout the way the rest of this repository already decodes Windows
+ * console output: UTF-16 with or without a BOM, then STRICT UTF-8, then the locale's
+ * legacy code page. Strict-UTF-8-first is what keeps an ordinary UTF-8 host unaffected.
+ *
+ * The SID on the first line is ASCII by construction and survives either way, which is
+ * why this corruption stayed silent: only the account name on the second line breaks.
+ */
+function decodePrincipalStdout(stdout: string | Uint8Array): string {
+  if (typeof stdout === "string") return stdout;
+  return decodeWindowsTextBytes(
+    stdout,
+    principalLocaleForTests ? { locale: principalLocaleForTests } : {},
+  );
+}
+
 export interface WindowsPrincipalIdentity {
   readonly sid: string;
   readonly name: string;
@@ -220,7 +248,7 @@ function identityFromResult(result: WindowsPrincipalLookupResult): WindowsPrinci
       ? "timed out"
       : `exited ${result.exitCode ?? "null"}`);
   }
-  const lines = result.stdout.trim().split(/\r?\n/);
+  const lines = decodePrincipalStdout(result.stdout).trim().split(/\r?\n/);
   const sid = lines[0]?.trim() ?? "";
   const name = lines[1]?.trim() ?? "";
   if (!SID_PATTERN.test(sid)) {
@@ -341,6 +369,26 @@ export function setAsyncWindowsPrincipalRunnerForTests(
   cachedIdentity = null;
 }
 
+/**
+ * Test seam: pin the locale that selects the legacy code page.
+ *
+ * Required rather than convenient. `decodeWindowsTextBytes` picks ONE legacy encoding
+ * from the ambient locale, so CP949, CP932 and CP936 fixtures cannot all decode
+ * correctly in a single process without being told which to expect. Production passes
+ * nothing and keeps the ambient locale.
+ *
+ * Clears the cache and refuses mid-flight for the same reasons the runner setters do:
+ * a successful identity is returned from cache BEFORE any decode, and the async path
+ * decodes after its runner resolves.
+ */
+export function setWindowsPrincipalLocaleForTests(locale: string | null): void {
+  if (asyncLookupInFlight) {
+    throw new Error("Cannot change the Windows principal locale while a lookup is in flight.");
+  }
+  principalLocaleForTests = locale ?? undefined;
+  cachedIdentity = null;
+}
+
 /** Test seam: clear only process-local principal state. */
 export function resetWindowsPrincipalForTests(): void {
   if (asyncLookupInFlight) {

package/src/oauth/anthropic-routing.ts

@@ -152,6 +152,7 @@ export function sweepExpiredAnthropicRoutingHealth(now = Date.now()): number {
 export function clearAnthropicAccountPoolState(): void {
   upstreamHealth.clear();
   sessionAffinity.clear();
+  quorumCache = null;
 }
 
 export function anthropicSessionAffinitySizeForTests(): number {
@@ -236,6 +237,79 @@ export function getEligibleAnthropicAccounts(now = Date.now()): string[] {
     .map(account => account.id);
 }
 
+/**
+ * How long a quorum answer may be reused before the store is consulted again.
+ *
+ * This predicate now runs on the INITIAL resolution of every Anthropic request, not just after a
+ * 429, so an uncached implementation puts a synchronous file read in front of ordinary traffic:
+ * `getAccountSet` goes through `loadAuthStore`, which has no cache of its own and chmods the
+ * config dir, chmods the secret, reads the whole file and normalizes it on every call.
+ *
+ * Two seconds matches the generic module's `PRESENCE_CACHE_TTL_MS` for the same reason: short
+ * enough that a login in another window is visible before the operator can switch back and send a
+ * prompt, long enough that a burst of requests shares one read. The cache holds a BOOLEAN derived
+ * from a count — never a credential, never an account id.
+ *
+ * Staleness is bounded by consequence, not only by the TTL. Explicit invalidation covers the
+ * roster mutations this module can see (rotation, pool-state reset, affinity clear on account
+ * removal, manual selection), but not one it cannot: a 401 elsewhere flagging an account
+ * `needsReauth` drops the real quorum to one while a cached `true` survives for up to 2s.
+ *
+ * That window is harmless in both directions, which is why it is left rather than plumbed
+ * through the store. A stale `true` only lets the caller ASK for an alternate;
+ * `pickAlternateAnthropicAccount` re-reads the roster through `getEligibleAnthropicAccounts`,
+ * skips the reauth-flagged account and returns `null`, so the 429 surfaces exactly as it would
+ * have. A stale `false` costs one un-rotated 429 and self-corrects on the next read. Neither
+ * can dispatch on an unusable credential, which is the only outcome worth adding a store hook
+ * to prevent.
+ */
+const QUORUM_CACHE_TTL_MS = 2_000;
+
+let quorumCache: { value: boolean; readAt: number } | null = null;
+
+/**
+ * Whether a 429 has somewhere to go: two or more accounts that could serve traffic if asked.
+ *
+ * Reactive failover is a safety net, not a routing policy. It runs only AFTER upstream refused,
+ * it cannot spread load across a healthy session, and it cannot fire at all unless the operator
+ * deliberately logged in twice. So it activates on presence, exactly like an `apiKeyPool` of two
+ * keys does in `providers/key-failover.ts` -- and unlike the PROACTIVE pool (affinity,
+ * quota-ranked new-session picks, `autoSwitchThreshold`, `strategy`), which changes which
+ * account serves a healthy request and therefore stays behind `anthropicAccountPool.enabled`.
+ *
+ * Cooldowns are deliberately ignored here. They are transient and per-request, while this
+ * answers the durable question "did the operator store a second account". Counting a cooled
+ * account as absent would switch the feature off for the length of the cooldown -- precisely
+ * when it is needed.
+ *
+ * `isPoolCredentialUsable` is still applied, so the fail-closed background `local-cli` rule
+ * holds: an expired background slot is not a quorum and cannot be adopted.
+ */
+export function hasAnthropicFailoverQuorum(now = Date.now()): boolean {
+  // Monotonic guard: a caller-supplied `now` that predates the cached read (tests pass explicit
+  // clocks) must not be served from a future entry.
+  if (quorumCache && now >= quorumCache.readAt && now - quorumCache.readAt < QUORUM_CACHE_TTL_MS) {
+    return quorumCache.value;
+  }
+  const set = getAccountSet(PROVIDER);
+  let value = false;
+  if (set) {
+    let usable = 0;
+    for (const account of set.accounts) {
+      if (account.needsReauth === true) continue;
+      if (!isPoolCredentialUsable(account.id, now)) continue;
+      if (++usable >= 2) { value = true; break; }
+    }
+  }
+  quorumCache = { value, readAt: now };
+  return value;
+}
+
+/** Test seam and manual-recovery hook: force the next quorum question to re-read the store. */
+export function forgetAnthropicFailoverQuorum(): void {
+  quorumCache = null;
+}
+
 /** Earliest remaining cooldown among cooled Anthropic accounts, for client Retry-After. */
 export function getAnthropicPoolRetryAfterSeconds(now = Date.now()): number | null {
   const set = getAccountSet(PROVIDER);
@@ -559,6 +633,10 @@ export function clearAnthropicSessionAffinityForAccount(accountId: string): void
   for (const [key, entry] of sessionAffinity) {
     if (entry.accountId === accountId) sessionAffinity.delete(key);
   }
+  // The roster just lost or changed a member. This is the account-removal path, so the next
+  // activation question must re-read rather than answer from a count taken while the account
+  // was still present -- otherwise a delete leaves a stale quorum for the length of the TTL.
+  quorumCache = null;
 }
 
 /**
@@ -573,7 +651,13 @@ export function rotateAnthropicAccountOn429(
   sessionKey?: string | null,
   now = Date.now(),
 ): string | null {
-  if (!isAnthropicAccountPoolEnabled(config)) return null;
+  // Reactive 429 failover is NOT gated on the pool flag. That flag buys PROACTIVE routing --
+  // session affinity, quota-ranked new-session selection, autoSwitchThreshold, strategy -- all
+  // of which move a HEALTHY request and stay opt-in. Rotating away from an account upstream has
+  // just rate-limited is a different thing: it only ever runs after a refusal, and stranding a
+  // 429 while a second logged-in account sits idle is a defect, not a configuration choice.
+  // Presence is the activation rule, the same one an apiKeyPool of two keys already uses.
+  if (!isAnthropicAccountPoolEnabled(config) && !hasAnthropicFailoverQuorum(now)) return null;
 
   const parsedRetry = parseRetryAfterMs(retryAfterHeader, now);
   const cooldownMs = parsedRetry ?? DEFAULT_COOLDOWN_MS;
@@ -584,8 +668,17 @@ export function rotateAnthropicAccountOn429(
   sweepExpiredOnWrite(now);
   clearAnthropicSessionAffinityForAccount(failedAccountId);
   notePoolRotationFailure(POOL_KEY_ANTHROPIC, failedAccountId);
-
-  const next = pickAlternateAnthropicAccount(config, failedAccountId, now);
+  // A rotation means the roster in use just changed; do not answer the next activation question
+  // from a count read taken before the failure.
+  quorumCache = null;
+
+  // The pool's strategy is a PROACTIVE policy. When the pool is disabled, reactive
+  // presence-only recovery must not silently reactivate round-robin/fill-first merely
+  // because those dormant values remain in config. The quota picker is the neutral
+  // recovery policy already used by the default strategy.
+  const next = isAnthropicAccountPoolEnabled(config)
+    ? pickAlternateAnthropicAccount(config, failedAccountId, now)
+    : pickLowestUsage(config, failedAccountId, now);
   if (!next) {
     console.warn("[anthropic-pool] all eligible Anthropic OAuth accounts are in cooldown; returning 429");
     return null;
@@ -614,6 +707,9 @@ export function promoteAnthropicActiveAccount(accountId: string): void {
 export function resetAnthropicRoutingForManualSelection(accountId: string): void {
   sessionAffinity.clear();
   seedPoolRotationAccount(POOL_KEY_ANTHROPIC, accountId);
+  // A manual account selection is an operator statement about the roster; do not answer the
+  // next activation question from a count read before it.
+  quorumCache = null;
 }
 
 /**