@bitkyc08/opencodex 2.43.0 → 2.44.0

package/src/lib/proxy-env.ts

@@ -3,6 +3,73 @@ export const PROXY_ENV_KEYS = [...OUTBOUND_PROXY_ENV_KEYS, "NO_PROXY"] as const;
 
 export type ProxyEnvKey = typeof PROXY_ENV_KEYS[number];
 export type ProxyEnvMap = Record<string, string | undefined>;
+export type ProxyRoute =
+  | { kind: "direct" }
+  | { kind: "proxy"; proxy: string }
+  | { kind: "fallback" };
+
+export function normalizeProxyHostname(hostname: string): string {
+  const normalized = hostname.trim().toLowerCase().replace(/\.+$/, "");
+  return normalized.startsWith("[") && normalized.endsWith("]")
+    ? normalized.slice(1, -1)
+    : normalized;
+}
+
+export function noProxyMatches(
+  url: URL,
+  env: ProxyEnvMap = process.env,
+): boolean {
+  const raw = env.NO_PROXY ?? env.no_proxy ?? "";
+  const hostname = normalizeProxyHostname(url.hostname);
+  const port = url.port || (url.protocol === "https:" || url.protocol === "wss:" ? "443" : "80");
+  for (const rawEntry of raw.split(",")) {
+    let entry = rawEntry.trim().toLowerCase();
+    if (!entry) continue;
+    if (entry === "*") return true;
+    entry = entry.replace(/^(?:https?|wss?):\/\//, "").split("/", 1)[0]!;
+
+    let entryHost = entry;
+    let entryPort = "";
+    const bracketed = /^\[([^\]]+)](?::(\d+))?$/.exec(entry);
+    if (bracketed) {
+      entryHost = bracketed[1]!;
+      entryPort = bracketed[2] ?? "";
+    } else if ((entry.match(/:/g)?.length ?? 0) === 1) {
+      const separator = entry.lastIndexOf(":");
+      const possiblePort = entry.slice(separator + 1);
+      if (/^\d+$/.test(possiblePort)) {
+        entryHost = entry.slice(0, separator);
+        entryPort = possiblePort;
+      }
+    }
+    if (entryPort && entryPort !== port) continue;
+    entryHost = normalizeProxyHostname(entryHost.replace(/^\*?\./, ""));
+    if (entryHost && (hostname === entryHost || hostname.endsWith(`.${entryHost}`))) return true;
+  }
+  return false;
+}
+
+export function resolveProxyRoute(
+  url: URL,
+  env: ProxyEnvMap = process.env,
+): ProxyRoute {
+  if (noProxyMatches(url, env)) return { kind: "direct" };
+  const key = url.protocol === "https:" || url.protocol === "wss:"
+    ? "HTTPS_PROXY"
+    : "HTTP_PROXY";
+  const proxy = [key, key.toLowerCase(), "ALL_PROXY", "all_proxy"]
+    .map(candidate => env[candidate]?.trim())
+    .find(Boolean);
+  if (!proxy) return { kind: "direct" };
+  try {
+    const protocol = new URL(proxy).protocol;
+    return protocol === "http:" || protocol === "https:"
+      ? { kind: "proxy", proxy }
+      : { kind: "fallback" };
+  } catch {
+    return { kind: "fallback" };
+  }
+}
 
 export function proxyEnvPresent(
   key: ProxyEnvKey,

package/src/oauth/account-quota-rank.ts

@@ -67,6 +67,14 @@ function headroomOf(provider: string, accountId: string): number | null {
   return 100 - Math.max(...percents);
 }
 
+/** Unknown usage is not exhaustion; Kiro's explicit overage verdict is authoritative. */
+export function isAccountQuotaExhausted(provider: string, accountId: string): boolean {
+  const exhaustion = provider === "kiro" ? getKiroAccountExhaustion(`${provider}\u0000${accountId}`) : null;
+  if (exhaustion !== null) return exhaustion.exhausted;
+  const headroom = headroomOf(provider, accountId);
+  return headroom !== null && headroom <= 0;
+}
+
 /**
  * Order candidates best-first.
  *
@@ -90,7 +98,7 @@ export function rankAccountsByHeadroom(provider: string, ring: readonly string[]
     const headroom = headroomOf(provider, id);
     if (exhaustion !== null || headroom !== null) sawEvidence = true;
 
-    if (exhaustion?.exhausted === true) return { id, bucket: RANK_EXHAUSTED, headroom: 0, index };
+    if (isAccountQuotaExhausted(provider, id)) return { id, bucket: RANK_EXHAUSTED, headroom: 0, index };
     if (headroom === null) return { id, bucket: RANK_UNKNOWN, headroom: 0, index };
     return { id, bucket: RANK_HEALTHY, headroom, index };
   });

package/src/oauth/anthropic-routing.ts

@@ -15,7 +15,8 @@
  * store (existing OAuth path) so the account is excluded from eligibility.
  */
 import { createHash } from "node:crypto";
-import { setActiveAccount, getAccountSet, getAccountCredential } from "./store";
+import { captureOAuthAccountSelection, commitOAuthAccountSelection, credentialGeneration, getAccountSet, getAccountCredential, getAccountCredentialWithStatus } from "./store";
+import type { OAuthAccessSnapshot } from "./index";
 import { getCachedProviderAccountQuota } from "../providers/quota";
 import { fallbackCodexAccountLogLabel } from "../codex/account-label";
 import {
@@ -24,6 +25,7 @@ import {
   notePoolRotationFailure,
   notePoolRotationSuccess,
   pickRoundRobinAccount,
+  peekRoundRobinAccount,
   POOL_KEY_ANTHROPIC,
   seedPoolRotationAccount,
 } from "../codex/pool-rotation";
@@ -68,6 +70,10 @@ interface AffinityEntry {
 
 const upstreamHealth = new Map<string, AccountHealth>();
 const sessionAffinity = new Map<string, AffinityEntry>();
+type OAuthAccountSelection = NonNullable<ReturnType<typeof captureOAuthAccountSelection>>;
+// Undefined means this runtime has not admitted a selection yet; null means consumed.
+// The startup baseline comes from the authoritative store, never a second persisted pin.
+let manualPreference: OAuthAccountSelection | null | undefined;
 
 function normalizeAffinityComponent(value: string | null | undefined): string {
   const normalized = value?.trim() ?? "";
@@ -152,6 +158,7 @@ export function sweepExpiredAnthropicRoutingHealth(now = Date.now()): number {
 export function clearAnthropicAccountPoolState(): void {
   upstreamHealth.clear();
   sessionAffinity.clear();
+  manualPreference = undefined;
   quorumCache = null;
 }
 
@@ -409,7 +416,7 @@ function pickAlternateAnthropicAccount(
   const strategy = anthropicPoolStrategy(config);
   const eligible = getEligibleAnthropicAccounts(now).filter(id => id !== excludeId);
   if (strategy === "round-robin") {
-    return pickRoundRobinAccount(POOL_KEY_ANTHROPIC, eligible, stickyLimitForPool(config));
+    return peekRoundRobinAccount(POOL_KEY_ANTHROPIC, eligible, stickyLimitForPool(config));
   }
   if (strategy === "fill-first") {
     return pickNextFillFirstAnthropicAccount(config, excludeId, eligible);
@@ -434,6 +441,7 @@ export type AnthropicAccountSelectionReason =
   | "lowest-usage"
   | "only-eligible"
   | "round-robin"
+  | "manual"
   | "fill-first"
   | "none"
   | "all-cooled";
@@ -500,9 +508,8 @@ function pickUnboundStrategyAccount(
   if (strategy === "round-robin") {
     const eligible = getEligibleAnthropicAccounts(now);
     const limit = stickyLimitForPool(config);
-    const picked = pickRoundRobinAccount(POOL_KEY_ANTHROPIC, eligible, limit);
+    const picked = peekRoundRobinAccount(POOL_KEY_ANTHROPIC, eligible, limit);
     if (!picked) return null;
-    notePoolRotationSuccess(POOL_KEY_ANTHROPIC, picked, limit);
     return { accountId: picked, reason: "round-robin" };
   }
 
@@ -528,17 +535,39 @@ export function resolveAnthropicAccountForSession(
   const set = getAccountSet(PROVIDER);
   if (!set || set.accounts.length === 0) return { accountId: null, reason: "none" };
 
+  if (manualPreference === undefined) {
+    manualPreference = set.selectionRevision !== undefined
+      ? { accountId: set.activeAccountId, revision: set.selectionRevision }
+      : null;
+  }
+
   if (!isAnthropicAccountPoolEnabled(config)) {
     return { accountId: set.activeAccountId, reason: "pool-disabled" };
   }
 
+  // A manual choice is a one-dispatch preference, not a lower-priority quota hint.
+  // Consume it only after admission commits, so a failed token lookup cannot spend it.
+  if (manualPreference) {
+    if (manualPreference.accountId !== set.activeAccountId || manualPreference.revision !== set.selectionRevision) {
+      manualPreference = null;
+    } else {
+      const chosen = manualPreference.accountId;
+      const quota = getCachedProviderAccountQuota(PROVIDER, chosen);
+      const exhausted = [quota?.fiveHourPercent, quota?.weeklyPercent, quota?.monthlyPercent,
+        ...(quota?.customWindows ?? []).map(window => window.percent)]
+        .some(percent => typeof percent === "number" && percent >= 100);
+      if (!exhausted && getEligibleAnthropicAccounts(now).includes(chosen)) {
+        return { accountId: chosen, reason: "manual" };
+      }
+    }
+  }
+
   const key = normalizeAffinityComponent(sessionKey);
   if (key) {
     const affined = sessionAffinity.get(key);
     if (affined && now - affined.lastUsedAt <= AFFINITY_IDLE_TTL_MS) {
       const stillThere = set.accounts.some(a => a.id === affined.accountId && a.needsReauth !== true);
       if (stillThere && !isCooled(affined.accountId, now) && isPoolCredentialUsable(affined.accountId, now)) {
-        affined.lastUsedAt = now;
         return { accountId: affined.accountId, reason: "affinity" };
       }
       sessionAffinity.delete(key);
@@ -560,12 +589,6 @@ export function resolveAnthropicAccountForSession(
 
   const strategyPick = pickUnboundStrategyAccount(config, now);
   if (strategyPick) {
-    // Do not promote active here — token validation may still fail. Callers
-    // (responses/core) promote after getAnthropicPoolAccessToken succeeds.
-    if (key && normalizeAffinityComponent(strategyPick.accountId)) {
-      sessionAffinity.set(key, { accountId: strategyPick.accountId, lastUsedAt: now });
-      pruneExpiredAffinity(now);
-    }
     return { accountId: strategyPick.accountId, reason: strategyPick.reason };
   }
 
@@ -611,10 +634,6 @@ export function resolveAnthropicAccountForSession(
     return { accountId: null, reason: anyCooled ? "all-cooled" : "none" };
   }
 
-  if (key && normalizeAffinityComponent(accountId)) {
-    sessionAffinity.set(key, { accountId, lastUsedAt: now });
-    pruneExpiredAffinity(now);
-  }
   return { accountId, reason };
 }
 
@@ -684,20 +703,57 @@ export function rotateAnthropicAccountOn429(
     return null;
   }
 
-  const affinityKey = normalizeAffinityComponent(sessionKey);
-  if (affinityKey && normalizeAffinityComponent(next)) {
-    sessionAffinity.set(affinityKey, { accountId: next, lastUsedAt: now });
-    pruneExpiredAffinity(now);
-  }
   console.warn(
     `[anthropic-pool] 429 on ${formatAnthropicAccountOrdinal(failedAccountId)}; failing over to ${formatAnthropicAccountOrdinal(next)}`,
   );
   return next;
 }
 
-/** Promote dashboard active account after a validated failover target is usable. */
-export function promoteAnthropicActiveAccount(accountId: string): void {
-  void setActiveAccount(PROVIDER, accountId).catch(() => { /* best-effort */ });
+export interface AnthropicSelectionRoutingOptions {
+  config: OcxConfig;
+  sessionKey?: string | null;
+  reason?: AnthropicAccountSelectionReason;
+  expectedCredentialGeneration?: string;
+}
+
+/** Commit the selected account before dispatch; rejected proposals have no routing side effects. */
+export async function promoteAnthropicActiveAccount(
+  accountId: string,
+  expectedSelection: OAuthAccountSelection | null,
+  options: AnthropicSelectionRoutingOptions,
+): Promise<OAuthAccountSelection | null> {
+  if (!expectedSelection || !isPoolCredentialUsable(accountId, Date.now()) || isCooled(accountId, Date.now())) return null;
+  const committed = await commitOAuthAccountSelection(PROVIDER, accountId, {
+    expectedSelection,
+    expectedCredentialGeneration: options.expectedCredentialGeneration,
+    requireUsableAccount: true,
+  });
+  if (!committed) return null;
+  return commitAnthropicSelectionRouting(accountId, expectedSelection, committed, options) ? committed : null;
+}
+
+/** Main's shared selection owner calls this only after its authoritative commit succeeds. */
+export function commitAnthropicSelectionRouting(
+  accountId: string,
+  expectedSelection: OAuthAccountSelection,
+  committed: OAuthAccountSelection,
+  options: AnthropicSelectionRoutingOptions,
+): boolean {
+  if (committed.accountId !== accountId) return false;
+  const current = captureOAuthAccountSelection(PROVIDER);
+  if (current?.accountId !== committed.accountId || current.revision !== committed.revision) return false;
+  if (isAnthropicAccountPoolEnabled(options.config)) {
+    if (anthropicPoolStrategy(options.config) === "round-robin" && options.reason !== "affinity") {
+      const limit = stickyLimitForPool(options.config);
+      const picked = pickRoundRobinAccount(POOL_KEY_ANTHROPIC, getEligibleAnthropicAccounts(), limit);
+      if (picked !== accountId) seedPoolRotationAccount(POOL_KEY_ANTHROPIC, accountId);
+      notePoolRotationSuccess(POOL_KEY_ANTHROPIC, accountId, limit);
+    }
+    bindAnthropicSessionAffinity(options.sessionKey, accountId);
+  }
+  if (manualPreference === undefined || (manualPreference?.accountId === expectedSelection.accountId
+    && manualPreference.revision === expectedSelection.revision)) manualPreference = null;
+  return true;
 }
 
 /**
@@ -706,6 +762,7 @@ export function promoteAnthropicActiveAccount(accountId: string): void {
  */
 export function resetAnthropicRoutingForManualSelection(accountId: string): void {
   sessionAffinity.clear();
+  manualPreference = captureOAuthAccountSelection(PROVIDER);
   seedPoolRotationAccount(POOL_KEY_ANTHROPIC, accountId);
   // A manual account selection is an operator statement about the roster; do not answer the
   // next activation question from a count read before it.
@@ -731,6 +788,17 @@ export async function getAnthropicPoolAccessToken(accountId: string): Promise<st
   return getValidAccessTokenForAccount(PROVIDER, accountId);
 }
 
+/** Resolve through the pool's local-CLI restrictions, then bind the exact returned generation. */
+export async function getAnthropicPoolAccessSnapshot(accountId: string): Promise<OAuthAccessSnapshot> {
+  const accessToken = await getAnthropicPoolAccessToken(accountId);
+  const row = getAccountCredentialWithStatus(PROVIDER, accountId);
+  if (!row || row.needsReauth || row.credential.access !== accessToken
+    || row.credential.expires <= Date.now()) {
+    throw new Error("Anthropic pool credential changed during account selection");
+  }
+  return { provider: PROVIDER, accountId, accessToken, generation: credentialGeneration(row.credential) };
+}
+
 /**
  * Whether the pool may refresh this account's token. Background `local-cli` slots must not
  * adopt the global Claude CLI credential (same fail-closed rule as quota probes).

package/src/oauth/generic-account-failover.ts

@@ -16,7 +16,7 @@
  */
 import { getAccountSet } from "./store";
 import { getValidAccessSnapshotForAccount, type OAuthAccessSnapshot } from "./index";
-import { exhaustedCooldownMs, hasHeadroomEvidence, rankAccountsByHeadroom } from "./account-quota-rank";
+import { exhaustedCooldownMs, hasHeadroomEvidence, isAccountQuotaExhausted, rankAccountsByHeadroom } from "./account-quota-rank";
 import { parseRetryAfterMs } from "../combos/failover";
 import { sweepExpiredOnWrite } from "../lib/state-store-sweeper";
 import type { OcxConfig, OcxProviderConfig } from "../types";
@@ -61,29 +61,12 @@ interface PresenceEntry {
   readAt: number;
 }
 
-/**
- * Ordered roster plus the active id, for the pre-dispatch preference.
- *
- * Same reasoning as the presence cache: `getAccountSet` reads through `loadAuthStore`,
- * which chmods and re-parses the whole credential file on every call. Selection needs the
- * ORDER and the active id, which the presence count cannot supply, so it gets its own
- * TTL-bounded row. Ids and an active pointer only — never a credential.
- */
-interface RosterEntry {
-  ids: string[];
-  activeId: string | null;
-  readAt: number;
-}
-
 /** Process-local, like the Anthropic pool's: a restart is allowed to forget a cooldown. */
 const health = new Map<string, AccountHealth>();
 
 /** Provider -> recent eligible-account count. TTL-bounded; never holds credential material. */
 const presence = new Map<string, PresenceEntry>();
 
-/** Provider -> recently read roster. TTL-bounded; never holds credential material. */
-const roster = new Map<string, RosterEntry>();
-
 const healthKey = (provider: string, accountId: string) => `${provider}\u0000${accountId}`;
 
 function isCooled(provider: string, accountId: string, now: number): boolean {
@@ -118,24 +101,6 @@ function eligibleAccountCount(providerName: string, now: number): number {
   return eligible;
 }
 
-/**
- * Roster ids and the active pointer, read at most once per TTL window.
- *
- * `needsReauth` accounts are excluded for the same reason the presence count excludes
- * them: a revoked credential cannot serve the request we are about to send.
- */
-function cachedRoster(providerName: string, now: number): { ids: string[]; activeId: string | null } {
-  const cached = roster.get(providerName);
-  if (cached && now >= cached.readAt && now - cached.readAt < PRESENCE_CACHE_TTL_MS) {
-    return { ids: cached.ids, activeId: cached.activeId };
-  }
-  const set = getAccountSet(providerName);
-  const ids = set ? set.accounts.filter(a => a.needsReauth !== true).map(a => a.id) : [];
-  const activeId = set?.activeAccountId ?? null;
-  roster.set(providerName, { ids, activeId, readAt: now });
-  return { ids, activeId };
-}
-
 /**
  * Presence IS consent (#2568d).
  *
@@ -192,8 +157,7 @@ function isProactivePreferenceEnabled(config: OcxConfig, providerName: string, n
   if (typeof perProvider === "boolean") {
     return perProvider && hasFailoverAccountQuorum(providerName, now);
   }
-  if (config.oauthAccountFailover?.enabled === false) return false;
-  return hasFailoverAccountQuorum(providerName, now);
+  return config.oauthAccountFailover?.enabled === true && hasFailoverAccountQuorum(providerName, now);
 }
 
 /** Accounts that may serve traffic right now: not cooled, not flagged for reauth. */
@@ -240,8 +204,6 @@ export function rotateGenericOAuthAccountOn429(
   // A rotation means the roster in use just changed; do not answer the next activation question
   // from a count read before the failure.
   presence.delete(providerName);
-  // Same for the selection roster: the next request must not pick from a pre-failure read.
-  roster.delete(providerName);
   // Deterministic: start after the failed account so repeated 429s walk the roster instead of
   // hammering whichever id happens to sort first. The ring is built BEFORE ranking — ranking
   // the store's own order would change which account a quota-less provider rotates to.
@@ -289,13 +251,19 @@ export function preferredInitialAccount(
   // The PROACTIVE predicate, not the reactive one: this steers a request upstream has not
   // refused, so `oauthAccountFailover.enabled: false` must still be able to refuse it.
   if (!isProactivePreferenceEnabled(config, providerName, now)) return null;
-  // This runs on the initial resolution of EVERY request, and `loadAuthStore` has no
-  // cache: each call chmods the config dir, chmods the secret, reads the whole file and
-  // normalizes it (store.ts:136-151). So the store is consulted at most ONCE here, behind
-  // the same TTL the presence check uses, and never at all for a single-account provider.
-  const { ids: order, activeId: active } = cachedRoster(providerName, now);
+  // Read the same authoritative selection the management writer commits. Caching the
+  // active id separately would delay manual selection and account removal.
+  const selected = getAccountSet(providerName);
+  if (!selected) return null;
+  const active = selected.activeAccountId;
+  const order = selected.accounts.filter(account => account.needsReauth !== true).map(account => account.id);
   if (order.length < 2) return null;
 
+  const activeRow = selected.accounts.find(account => account.id === active);
+  if (activeRow && activeRow.needsReauth !== true
+    && !isCooled(providerName, activeRow.id, now)
+    && !isAccountQuotaExhausted(providerName, activeRow.id)) return null;
+
   // Evidence is required BEFORE eligibility narrows the field. Without this, a provider
   // with no quota data at all could still be redirected: cool the active account with a
   // 429 and the eligible list collapses to one candidate, which any ranking returns
@@ -318,11 +286,8 @@ export function preferredInitialAccount(
   const best = rankAccountsByHeadroom(providerName, candidates)[0] ?? null;
   // Nothing to do when the ranking agrees with the account we would have used anyway.
   //
-  // The roster may be up to PRESENCE_CACHE_TTL_MS old, so this answer is a PREFERENCE the
-  // caller must be able to abandon: it resolves the account with `requireUsableAccount`,
-  // which rejects a removed or reauth-flagged account inside the store read it was already
-  // performing, and falls back to the active account. Validating here instead would mean a
-  // second uncached read of the credential file on every redirected request.
+  // A proposal still needs guarded selection commit after credential resolution: a
+  // removal, reauth verdict, or manual choice can arrive during that await.
   return best && best !== active ? best : null;
 }
 
@@ -341,7 +306,6 @@ export function genericFailoverRetryAfterSeconds(providerName: string, now = Dat
 
 /** Test seam and manual-recovery hook. */
 export function forgetGenericFailoverRoster(providerName: string): void {
-  roster.delete(providerName);
   presence.delete(providerName);
 }
 
@@ -350,11 +314,9 @@ export function clearGenericFailoverHealth(providerName?: string): void {
   if (!providerName) {
     health.clear();
     presence.clear();
-    roster.clear();
     return;
   }
   presence.delete(providerName);
-  roster.delete(providerName);
   for (const key of [...health.keys()]) {
     if (key.startsWith(`${providerName}\u0000`)) health.delete(key);
   }

package/src/oauth/index.ts

@@ -548,7 +548,7 @@ export async function getValidAccessTokenSnapshot(provider: string): Promise<OAu
 }
 
 /** Providers whose upstream-401 replay path may force a snapshot refresh. */
-const FORCE_REFRESH_PROVIDERS = new Set(["xai", "github-copilot", "kiro"]);
+const FORCE_REFRESH_PROVIDERS = new Set(["xai", "github-copilot", "kiro", "google-antigravity"]);
 
 export async function forceRefreshOAuthAccessSnapshot(
   rejected: OAuthAccessSnapshot,
@@ -1239,6 +1239,37 @@ function isLegacyAntigravityStaticCatalog(provider: OcxProviderConfig): boolean
     ]);
 }
 
+/** Refresh registry-owned catalog fields while preserving valid operator selections. */
+function applyOAuthPresetCatalog(
+  provider: OcxProviderConfig,
+  preset: OcxProviderConfig,
+): void {
+  for (const field of OAUTH_RECONCILE_FIELDS) {
+    if (JSON.stringify(provider[field]) === JSON.stringify(preset[field])) continue;
+    if (preset[field] !== undefined) {
+      provider[field] = cloneProviderField(preset[field]) as never;
+    } else {
+      delete provider[field];
+    }
+  }
+  if (provider.liveModels === undefined && preset.liveModels !== undefined) {
+    provider.liveModels = preset.liveModels;
+  }
+  // Heal only a selection that the refreshed static catalog no longer contains. Providers
+  // with live discovery do not expose an enumerable account catalog here, so their saved
+  // default remains operator-owned.
+  if (
+    provider.liveModels !== true &&
+    provider.defaultModel
+    && preset.defaultModel
+    && preset.models
+    && preset.models.length > 0
+    && !(provider.models ?? []).includes(provider.defaultModel)
+  ) {
+    provider.defaultModel = preset.defaultModel;
+  }
+}
+
 /** Promote only the versioned canonical static seed; unmarked `liveModels: false` remains user intent. */
 function migrateLegacyAntigravityStaticCatalog(config: OcxConfig): boolean {
   if (config.googleAntigravityStaticCatalogVersion !== 1) return false;
@@ -1277,24 +1308,7 @@ function projectOAuthProviderReconciliation(config: OcxConfig): OAuthReconcilePr
     }
     if (def && prov.authMode === "oauth") {
       const preset = def.providerConfig;
-      for (const field of OAUTH_RECONCILE_FIELDS) {
-        if (JSON.stringify(prov[field]) === JSON.stringify(preset[field])) continue;
-        if (preset[field] !== undefined) {
-          prov[field] = cloneProviderField(preset[field]) as never;
-        } else {
-          delete prov[field];
-        }
-      }
-      if (prov.liveModels === undefined && preset.liveModels !== undefined) {
-        prov.liveModels = preset.liveModels;
-      }
-      // Heal a defaultModel that no longer exists in the refreshed list (e.g. a deprecated snapshot).
-      // Skip providers without a static preset `models` list: for live-discovery providers
-      // (e.g. command-code OAuth) the account-scoped catalog is not enumerable here, so any
-      // persisted defaultModel is a user selection and must not be overwritten by the seed.
-      if (prov.defaultModel && preset.defaultModel && preset.models && preset.models.length > 0 && !(prov.models ?? []).includes(prov.defaultModel)) {
-        prov.defaultModel = preset.defaultModel;
-      }
+      applyOAuthPresetCatalog(prov, preset);
     }
     if (JSON.stringify(prov) !== beforeProvider) {
       changed = true;
@@ -1408,24 +1422,18 @@ function preservableApiKeyPool(value: unknown): NonNullable<OcxProviderConfig["a
   return pool.length > 0 ? pool : undefined;
 }
 
-/**
- * Add/refresh an OAuth provider's config entry on a config object (does not persist).
- *
- * Providers whose registry entry sets `allowKeyAuthOverride` (xai, github-copilot) can be
- * billed through a stored API key instead of the OAuth login (router.ts honors
- * `authMode: "key"` for them). A blind preset overwrite here deletes `apiKey`/`apiKeyPool`
- * on every OAuth login, silently destroying the stored key and forcing a re-paste — and it
- * flips billing back to the subscription without the user asking. Carry the key fields over
- * and keep key billing while usable key material remains and the user was not explicitly on
- * oauth. If the final key was removed and only the old key mode remains, let the OAuth
- * preset restore `authMode: "oauth"` so the newly saved OAuth credential can be used.
- *
- * After preservation, `apiKey` always has exactly one matching pool entry (inserting via the
- * same content-derived id as the API-key manager when the active key was missing from the
- * pool). Key mode reflects stored user intent (explicit `"key"` or omitted mode with safe
- * key material) — never whether the login CLI process can resolve an env reference. Env-backed
- * availability is decided at proxy routing time in `router.ts`.
- */
+const OAUTH_LOGIN_OWNED_PROVIDER_FIELDS = [
+  "adapter",
+  "baseUrl",
+  "authMode",
+  "headers",
+  "apiKeyTransport",
+  "responsesPath",
+  "googleMode",
+  "keyOptional",
+] as const satisfies readonly (keyof OcxProviderConfig)[];
+
+/** Add/refresh only an OAuth provider's login-owned config fields (does not persist). */
 export function upsertOAuthProvider(config: OcxConfig, provider: string): void {
   if (provider === "chatgpt") return;
   const def = OAUTH_PROVIDERS[provider];
@@ -1434,40 +1442,31 @@ export function upsertOAuthProvider(config: OcxConfig, provider: string): void {
   const namespaceCollision = codexAccountNamespaceProviderCollisionError(config.codexAccountNamespaces, provider);
   if (namespaceCollision) throw new Error(namespaceCollision);
   const existing = config.providers[provider];
-  const next: OcxProviderConfig = { ...def.providerConfig };
-  // `liveModels` is a user-facing provider toggle. Preserve either explicit setting across login;
-  // Antigravity's CCA discovery now uses its real RPC, so legacy `true` remains a valid choice.
-  if (typeof existing?.liveModels === "boolean" && !isLegacyCommandCodeStaticCatalog(existing)) {
-    next.liveModels = existing.liveModels;
-  }
-  // The Command Code protocol-version pin is an operator compatibility control. A re-login,
-  // add-account, or reauth rebuilds the row from the preset, which has no version; carry the
-  // existing pin so authentication changes do not silently revert the documented control.
-  if (existing?.commandCodeVersion !== undefined) {
-    next.commandCodeVersion = existing.commandCodeVersion;
-  }
-  // Reauth/add-account refreshes credentials, not the operator's post-upgrade wire choice.
-  if (provider === "xai") {
-    if (existing?.modelAdapters !== undefined) next.modelAdapters = { ...existing.modelAdapters };
-    if (existing?.xaiResponsesDefaultVersion !== undefined) {
-      next.xaiResponsesDefaultVersion = existing.xaiResponsesDefaultVersion;
-    }
-  }
-  // User-configured price overlays are operator data, not preset state; a
-  // re-login, add-account, or reauth must not silently drop them from the
-  // Logs/Usage estimates.
-  if (existing?.modelCosts !== undefined) {
-    next.modelCosts = existing.modelCosts;
+  // Clone operator state, including xAI wire choices and their migration version.
+  const next: OcxProviderConfig = structuredClone(existing ?? def.providerConfig);
+  for (const field of OAUTH_LOGIN_OWNED_PROVIDER_FIELDS) {
+    const value = def.providerConfig[field];
+    if (value === undefined) delete next[field];
+    else next[field] = structuredClone(value) as never;
   }
-  // The per-provider account-failover opt-out is operator intent about SPENDING, and the login
-  // path is exactly where losing it does damage: adding a second account both rebuilds this row
-  // from the preset and creates the 2-account quorum that turns presence-driven rotation on
-  // (#2568d). Dropping the opt-out here would enable the thing the operator switched off, at the
-  // moment they were doing something unrelated.
-  if (existing?.oauthAccountFailover !== undefined) {
-    next.oauthAccountFailover = existing.oauthAccountFailover;
+  // A login may activate a different account. CCA dispatch must take that account's
+  // project from its credential snapshot, never retain the previous account's project.
+  if (next.googleMode === "cloud-code-assist") delete next.project;
+  // Login used to rebuild the whole row from the preset, so catalog data refreshed
+  // immediately. Keep that timing without overwriting unrelated operator-owned fields.
+  applyOAuthPresetCatalog(next, def.providerConfig);
+  // The original Command Code seed was an implementation-owned static catalog, not an
+  // operator opt-out. Promote that exact legacy shape when OAuth login refreshes the row.
+  if (provider === "command-code" && existing && isLegacyCommandCodeStaticCatalog(existing)) {
+    next.liveModels = def.providerConfig.liveModels;
   }
+  // OAuth-only providers must never retain credentials for a different auth mechanism.
+  delete next.apiKey;
+  delete next.apiKeyPool;
+  delete (next as unknown as Record<string, unknown>).azureCredential;
   if (existing && getProviderRegistryEntry(provider)?.allowKeyAuthOverride === true) {
+    // Retain stored key billing intent without resolving env references in the login process.
+    // An explicit OAuth choice stays OAuth even when usable key material is retained.
     // Shared sanitizeApiKeyValue trim / no-CRLF checks from api-key pool writes.
     let storedApiKey = sanitizeApiKeyValue(existing.apiKey);
     const storedApiKeyPool = preservableApiKeyPool(existing.apiKeyPool);

package/src/oauth/pool-settings-capability.ts

@@ -10,7 +10,8 @@ import type { OcxProviderConfig } from "../types";
  *
  * `strategy` and `autoSwitchThreshold` are still a declared contract the selector does not
  * consume — that is what `inert` reports. `enabled` is NOT inert any more: an explicit
- * `false` refuses the pre-dispatch account preference (`preferredInitialAccount`). What it can
+ * `true` enables pre-dispatch exhaustion avoidance (`preferredInitialAccount`); absence is off.
+ * Healthy manual selections remain authoritative. What the switch can
  * no longer do is refuse reactive 429 rotation, which activates on account presence and is not
  * disableable.
  */