@bitkyc08/opencodex 2.45.0 → 2.46.0-preview.20260907

package/src/integrations/raycast-detect.ts

@@ -0,0 +1,111 @@
+/**
+ * Detect a Raycast install and whether Custom Providers can take effect.
+ *
+ * Custom Providers is a Raycast Pro feature: Raycast reads
+ * `~/.config/raycast/ai/providers.yaml` only while a subscription is active, and
+ * the `ai` directory itself only exists once the user has clicked "Reveal
+ * Providers Config" in Settings > AI. Neither fact stops the writer — the plan
+ * (devlog/_plan/260904_raycast_integration/000_plan.md) makes a free plan a
+ * WARNING, never a refusal — so this module only answers what status and the
+ * GUI need to explain a file that is written but ignored.
+ *
+ * Detection is read-only and injectable, like cursor-detect.ts: nothing here
+ * writes to the Raycast install or its preferences, and the tests run against
+ * stubbed deps rather than the machine they execute on.
+ */
+import { existsSync } from "node:fs";
+import { homedir } from "node:os";
+import { posix, win32 } from "node:path";
+
+export type RaycastPlan = "pro" | "free" | "unknown";
+
+export interface RaycastInstall {
+  /** The app bundle or install directory, or null when none of the well-known locations exist. */
+  appPath: string | null;
+  /** `~/.config/raycast/ai` exists — the install signal the registry uses. */
+  aiDirPresent: boolean;
+  plan: RaycastPlan;
+}
+
+export interface RaycastDetectDeps {
+  platform: string;
+  homedir: string;
+  env: Record<string, string | undefined>;
+  exists(path: string): boolean;
+  /** stdout of `defaults read <domain> <key>` trimmed, or null when the command fails / is unavailable. */
+  readDefault(domain: string, key: string): string | null;
+}
+
+/**
+ * A private preference used only as an advisory subscription hint, not an
+ * entitlement API or a condition for writes. Read through
+ * `defaults` rather than by parsing the plist: cfprefsd caches writes, so the
+ * file on disk can lag what the running app believes.
+ */
+const RAYCAST_DEFAULTS_DOMAIN = "com.raycast.macos.v1";
+const RAYCAST_SUBSCRIPTION_KEY = "subscriptions_active";
+
+export function realRaycastDetectDeps(): RaycastDetectDeps {
+  return {
+    platform: process.platform,
+    homedir: homedir(),
+    env: process.env,
+    exists: path => {
+      try {
+        return existsSync(path);
+      } catch {
+        return false;
+      }
+    },
+    readDefault: (domain, key) => {
+      // `defaults` is macOS-only; elsewhere the plan is simply unknown.
+      if (process.platform !== "darwin") return null;
+      try {
+        const result = Bun.spawnSync(["defaults", "read", domain, key], { stdout: "pipe", stderr: "pipe" });
+        if (result.exitCode !== 0) return null;
+        return result.stdout.toString().trim();
+      } catch {
+        return null;
+      }
+    },
+  };
+}
+
+function appPathFor(deps: RaycastDetectDeps): string | null {
+  // Join with the target platform's separator so a test describing another OS
+  // gets that OS's paths, not the host's.
+  const { join } = deps.platform === "win32" ? win32 : posix;
+  if (deps.platform === "darwin") {
+    for (const candidate of ["/Applications/Raycast.app", join(deps.homedir, "Applications", "Raycast.app")]) {
+      if (deps.exists(candidate)) return candidate;
+    }
+    return null;
+  }
+  if (deps.platform === "win32") {
+    const local = deps.env.LOCALAPPDATA;
+    if (!local) return null;
+    const candidate = join(local, "Programs", "Raycast");
+    return deps.exists(candidate) ? candidate : null;
+  }
+  return null;
+}
+
+function planFor(deps: RaycastDetectDeps): RaycastPlan {
+  if (deps.platform !== "darwin") return "unknown";
+  // Read once: `defaults` spawns a process, and the answer cannot change
+  // between two reads inside one detection.
+  const value = deps.readDefault(RAYCAST_DEFAULTS_DOMAIN, RAYCAST_SUBSCRIPTION_KEY);
+  if (value === "1") return "pro";
+  if (value === "0") return "free";
+  return "unknown";
+}
+
+export function detectRaycast(deps: RaycastDetectDeps = realRaycastDetectDeps()): RaycastInstall {
+  const { join } = deps.platform === "win32" ? win32 : posix;
+  return {
+    appPath: appPathFor(deps),
+    // Raycast ignores XDG and uses this path on every platform it ships on.
+    aiDirPresent: deps.exists(join(deps.homedir, ".config", "raycast", "ai")),
+    plan: planFor(deps),
+  };
+}

package/src/integrations/registry.ts

@@ -35,6 +35,8 @@ import {
   piConfigPath,
   primeAgentDir,
   primeConfigPath,
+  raycastAiDir,
+  raycastConfigPath,
   zcodeConfigPath,
   zcodeHomeDir,
   type ExportClientId,
@@ -261,6 +263,22 @@ export const INTEGRATION_CLIENTS: Record<IntegrationClientId, IntegrationClientS
      */
     unresolvedPathHint: (env = process.env, home = homedir()) => join(asideHomeDir(env, home), "u"),
   },
+  raycast: {
+    id: "raycast",
+    configPath: (env = process.env, home = homedir()) => raycastConfigPath(env, home),
+    /*
+     * The `ai` directory, not `Raycast.app`. Raycast creates it only when the
+     * user clicks "Reveal Providers Config" in Settings > AI, which is exactly
+     * the signal that Custom Providers is reachable on this install; an app
+     * bundle alone says nothing about the plan or the feature.
+     *
+     * No `sourcePreservingYaml`: that patcher handles block-map leaves only,
+     * and our entry is a SEQUENCE item, so the file is re-rendered through
+     * `renderYaml` (block style). The `[id=opencodex]` selector keeps the user's
+     * other providers in place across that re-render.
+     */
+    detectDir: (env = process.env, home = homedir()) => raycastAiDir(env, home),
+  },
 };
 
 export const INTEGRATION_CLIENT_IDS: readonly IntegrationClientId[] =

package/src/integrations/state.ts

@@ -12,6 +12,7 @@ import { ClientPathError, EXPORT_CLIENTS, opencodeProxyBaseUrl, type ExportModel
 import type { OcxConfig } from "../types";
 import { PARSE_FAILED, loadTarget, parseConfig, type IntegrationIO } from "./config-io";
 import { SNAPSHOT_RETENTION } from "./journal";
+import { AmbiguousSelectorError, parseSegment, selectIndex, type PathSegment } from "./merge";
 import { canonicalContribution, fingerprint, semanticContribution, type OwnershipRecord } from "./ownership";
 import {
   protectedContributionFingerprint,
@@ -35,6 +36,7 @@ export type StateReason =
   | "unowned-key"
   /** A container we would have to write through holds a non-object value. */
   | "blocked-container"
+  | "ambiguous-selector"
   /** A path selector we cannot resolve, e.g. a relative OPENCLAW_CONFIG_PATH. */
   | "unresolvable-path";
 
@@ -52,11 +54,41 @@ export interface IntegrationStatus {
   retentionDegraded: boolean;
 }
 
+function isPlainRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function assertNever(segment: never): never {
+  throw new Error(`unknown path segment ${JSON.stringify(segment)}`);
+}
+
+/** The element a selector names, or `undefined` when none matches. */
+function selectElement(items: readonly unknown[], segment: PathSegment & { kind: "select" }): unknown {
+  return items[selectIndex(items, segment.field, segment.value)];
+}
+
+/**
+ * Same segment grammar as `setPath`: a plain key reads through a record, a
+ * `[field=value]` selector reads through an array. Because the classifier and
+ * the writer share this one function, status and mutation cannot disagree
+ * about which element is ours.
+ */
 export function readPath(doc: unknown, path: readonly string[]): unknown {
   let cursor: unknown = doc;
-  for (const key of path) {
-    if (typeof cursor !== "object" || cursor === null || Array.isArray(cursor)) return undefined;
-    cursor = (cursor as Record<string, unknown>)[key];
+  for (const raw of path) {
+    const segment = parseSegment(raw);
+    switch (segment.kind) {
+      case "key":
+        if (!isPlainRecord(cursor)) return undefined;
+        cursor = cursor[segment.key];
+        break;
+      case "select":
+        if (!Array.isArray(cursor)) return undefined;
+        cursor = selectElement(cursor, segment);
+        break;
+      default:
+        return assertNever(segment);
+    }
     if (cursor === undefined) return undefined;
   }
   return cursor;
@@ -82,10 +114,35 @@ export function blockedContainerPath(
   doc: unknown,
   contribution: ManagedContribution,
 ): readonly string[] | null {
+  /*
+   * What a segment needs the value it walks through to BE: a record for a key,
+   * an array for a selector. `typeof null === "object"`, so null is excluded
+   * by both checks rather than walking straight into the dereference below.
+   */
+  const holds = (segment: PathSegment, value: unknown): boolean => {
+    switch (segment.kind) {
+      case "key":
+        return isPlainRecord(value);
+      case "select":
+        return Array.isArray(value);
+      default:
+        return assertNever(segment);
+    }
+  };
+  const step = (segment: PathSegment, value: unknown): unknown => {
+    switch (segment.kind) {
+      case "key":
+        return (value as Record<string, unknown>)[segment.key];
+      case "select":
+        return selectElement(value as readonly unknown[], segment);
+      default:
+        return assertNever(segment);
+    }
+  };
   for (const fragment of contribution.fragments) {
     let cursor: unknown = doc;
     for (let depth = 0; depth < fragment.path.length - 1; depth += 1) {
-      const key = fragment.path[depth]!;
+      const segment = parseSegment(fragment.path[depth]!);
       /*
        * ONLY `undefined` means absent. A missing file parses as `{}`, so an
        * absent prefix reads `undefined` — but a parsed `null` is a value the
@@ -94,14 +151,10 @@ export function blockedContainerPath(
        * "successful" apply.
        */
       if (cursor === undefined) break;
-      // `typeof null === "object"`, so null has to be named explicitly or it
-      // walks straight into the dereference below.
-      if (cursor === null || typeof cursor !== "object" || Array.isArray(cursor)) {
-        return fragment.path.slice(0, depth);
-      }
-      const next = (cursor as Record<string, unknown>)[key];
+      if (!holds(segment, cursor)) return fragment.path.slice(0, depth);
+      const next = step(segment, cursor);
       if (next === undefined) break;
-      if (typeof next !== "object" || next === null || Array.isArray(next)) {
+      if (!holds(parseSegment(fragment.path[depth + 1]!), next)) {
         return fragment.path.slice(0, depth + 1);
       }
       cursor = next;
@@ -239,8 +292,24 @@ export function classifyIntegration(input: {
    * Checked BEFORE `absent`: our leaf is missing in exactly this case, so the
    * absent branch would authorize an apply that replaces the user's value.
    */
-  if (blockedContainerPath(input.parsed, input.contribution)) {
-    return { state: "unsafe", reason: "blocked-container" };
+  try {
+    if (blockedContainerPath(input.parsed, input.contribution)) {
+      return { state: "unsafe", reason: "blocked-container" };
+    }
+    // Check every selector before presence/fingerprint short-circuits, including
+    // paths an older ownership record may remove during refresh or disable.
+    const paths = [
+      ...input.contribution.fragments.map(fragment => fragment.path),
+      ...(input.record?.fragmentPaths ?? []),
+    ];
+    for (const path of paths) {
+      if (Array.isArray(path) && path.every(key => typeof key === "string")) {
+        readPath(input.parsed, path);
+      }
+    }
+  } catch (error) {
+    if (!(error instanceof AmbiguousSelectorError)) throw error;
+    return { state: "unsafe", reason: "ambiguous-selector" };
   }
   if (!hasOurFragments(input.parsed, input.contribution)) return { state: "absent" };
 

package/src/integrations/writer.ts

@@ -27,7 +27,7 @@ import {
   refreshablePathsOf,
   semanticProtectedContributionFingerprint,
 } from "./ownership-policy";
-import { createdContainerPaths, mergeContribution, removeFragments } from "./merge";
+import { AmbiguousSelectorError, createdContainerPaths, mergeContribution, removeFragments } from "./merge";
 import { INTEGRATION_CLIENTS, isLoopbackOnly, resolveIntegrationPaths, type IntegrationClientId } from "./registry";
 import { classifyIntegration, exportContextOf } from "./state";
 import type { IntegrationState } from "./state";
@@ -321,7 +321,9 @@ function applyOrRefreshIntegration(
     return refuse(clientId, "unsafe", "unsafe",
       classified.reason === "blocked-container"
         ? `${configPath} holds a value where opencodex would have to write a section, so applying would replace it`
-        : `${configPath} cannot be changed safely`);
+        : classified.reason === "ambiguous-selector"
+          ? `${configPath} has more than one entry matching a managed selector`
+          : `${configPath} cannot be changed safely`);
   }
   /*
    * An implicit catalog sync is refresh-only. Keeping this decision inside the
@@ -352,36 +354,39 @@ function applyOrRefreshIntegration(
    * concludes the user owns it, and the replacement record forgets we made it
    * — so a later disable strands it forever.
    */
-  const base = classified.state === "stale" && record
-    ? removeFragments(parsed, record.fragmentPaths, new Set(record.createdContainers ?? [])).doc
-    : classified.state === "conflict" && record
-      /*
-       * A forced overwrite of a `foreign-edit` conflict drops what the previous
-       * record owned for the same reason a stale refresh does: the replacement
-       * record covers the paths we are about to write, so a path the old record
-       * owned and the new one does not would be stranded forever, unremovable by
-       * any later disable.
-       *
-       * With NO record -- an `unowned-key` conflict -- there is nothing to drop and
-       * the merge runs against the user's document directly. That is correct:
-       * createdContainerPaths then attributes every container they already had to
-       * them, so a later disable removes our leaves and leaves their structure
-       * standing.
-       */
-      ? removeFragments(parsed, record.fragmentPaths, new Set(record.createdContainers ?? [])).doc
-      : parsed;
-  // Computed against the document as it stands BEFORE the merge: afterwards
-  // every container exists and "did we create this?" is unanswerable.
-  const created = createdContainerPaths(base, contribution);
   /*
    * A document can hold a value its own format cannot round-trip through our
    * renderers. That used to throw straight out of the writer and reach the
    * user as a 500 with no path and no advice; it is a refusal like any other,
-   * and the file is untouched because this happens before any write.
+   * and the file is untouched because this happens before any write. The
+   * removal and merge sit inside the same guard: a sequence holding two
+   * entries our selector matches is equally unwritable, and equally untouched.
    */
-  const nextDocument = mergeContribution(base, contribution);
+  let created: string[];
   let text: string;
   try {
+    const base = classified.state === "stale" && record
+      ? removeFragments(parsed, record.fragmentPaths, new Set(record.createdContainers ?? [])).doc
+      : classified.state === "conflict" && record
+        /*
+         * A forced overwrite of a `foreign-edit` conflict drops what the previous
+         * record owned for the same reason a stale refresh does: the replacement
+         * record covers the paths we are about to write, so a path the old record
+         * owned and the new one does not would be stranded forever, unremovable by
+         * any later disable.
+         *
+         * With NO record -- an `unowned-key` conflict -- there is nothing to drop and
+         * the merge runs against the user's document directly. That is correct:
+         * createdContainerPaths then attributes every container they already had to
+         * them, so a later disable removes our leaves and leaves their structure
+         * standing.
+         */
+        ? removeFragments(parsed, record.fragmentPaths, new Set(record.createdContainers ?? [])).doc
+        : parsed;
+    // Computed against the document as it stands BEFORE the merge: afterwards
+    // every container exists and "did we create this?" is unanswerable.
+    created = createdContainerPaths(base, contribution);
+    const nextDocument = mergeContribution(base, contribution);
     if (spec.sourcePreservingYaml && before !== null) {
       const value = sourcePreservingFragmentValue(contribution, spec.sourcePreservingYaml.path);
       const patched = value === undefined
@@ -401,6 +406,10 @@ function applyOrRefreshIntegration(
       text = serializeDocument(nextDocument, exportSpec.format);
     }
   } catch (error) {
+    if (error instanceof AmbiguousSelectorError) {
+      return refuse(clientId, "unsafe", "unsafe",
+        `${configPath} holds more than one entry matching ours, so it was left alone`);
+    }
     if (!(error instanceof UnserializableValueError)) throw error;
     return refuse(clientId, "unsafe", "unsafe",
       `${configPath} contains something opencodex cannot rewrite safely (${error.message}), so it was left alone`);
@@ -504,7 +513,9 @@ export function disableIntegration(input: IntegrationWriteInput): WriteOutcome {
     return refuse(clientId, "unsafe", "unsafe",
       classified.reason === "blocked-container"
         ? `${configPath} holds a value where opencodex would have to read a section, so nothing can be removed safely`
-        : `${configPath} cannot be changed safely`);
+        : classified.reason === "ambiguous-selector"
+          ? `${configPath} has more than one entry matching a managed selector`
+          : `${configPath} cannot be changed safely`);
   }
 
   /*
@@ -527,11 +538,15 @@ export function disableIntegration(input: IntegrationWriteInput): WriteOutcome {
     return refuse(clientId, "unsafe", "unsafe",
       `${configPath} uses YAML source opencodex cannot patch without risking unrelated comments or formatting, so nothing was removed`);
   }
-  const { doc, removed } = removeFragments(
-    parsed,
-    record!.fragmentPaths,
-    new Set(prunableCreated),
-  );
+  let doc: unknown;
+  let removed: boolean;
+  try {
+    ({ doc, removed } = removeFragments(parsed, record!.fragmentPaths, new Set(prunableCreated)));
+  } catch (error) {
+    if (!(error instanceof AmbiguousSelectorError)) throw error;
+    return refuse(clientId, "unsafe", "unsafe",
+      `${configPath} holds more than one entry matching ours, so nothing was removed`);
+  }
   if (!removed) {
     return { ok: true, changed: false, state: "absent", clientId, message: "nothing to remove" };
   }

package/src/lib/bounded-body.ts

@@ -212,13 +212,28 @@ export async function readBoundedResponseBytes(
 	}
 }
 
-function decodeUtf8(chunks: readonly Uint8Array[], fatal: boolean): string {
+// Mark only exceptions thrown by our decoder, preserving their identity and TypeError contract.
+// Timeout-path flushing may fail too; retain that origin so callers do not lose the deadline.
+const decodeFailures = new WeakMap<object, "invalid_utf8" | "timeout">();
+
+export function boundedBodyDecodeFailure(error: unknown): "invalid_utf8" | "timeout" | undefined {
+	return error !== null && typeof error === "object" ? decodeFailures.get(error) : undefined;
+}
+
+function decodeUtf8(chunks: readonly Uint8Array[], fatal: boolean, timedOut = false): string {
 	const decoder = new TextDecoder("utf-8", { fatal });
-	let text = "";
-	for (const chunk of chunks) text += decoder.decode(chunk, { stream: true });
-	// Flush an incomplete trailing UTF-8 sequence deterministically.
-	text += decoder.decode();
-	return text;
+	try {
+		let text = "";
+		for (const chunk of chunks) text += decoder.decode(chunk, { stream: true });
+		// Flush an incomplete trailing UTF-8 sequence deterministically.
+		text += decoder.decode();
+		return text;
+	} catch (error) {
+		if (error !== null && typeof error === "object") {
+			decodeFailures.set(error, timedOut ? "timeout" : "invalid_utf8");
+		}
+		throw error;
+	}
 }
 
 /**
@@ -297,7 +312,7 @@ export async function readBoundedResponseBody(
 					"TimeoutError",
 				);
 				return {
-					text: decodeUtf8([retained.subarray(0, retainedBytes)], options.fatalUtf8 === true),
+					text: decodeUtf8([retained.subarray(0, retainedBytes)], options.fatalUtf8 === true, true),
 					truncated: true,
 					timedOut: true,
 					totalTimedOut: outcome === TOTAL_TIMEOUT,

package/src/oauth/anthropic-routing.ts

@@ -10,9 +10,10 @@
  * Intentionally narrower than the Codex pool: no mid-session quota rotation,
  * soft-avoid ladders, or probe leases. Anthropic OAuth is ToS-sensitive.
  *
- * Affinity is process-local (lost on restart). Cooldown uses Retry-After when present,
- * otherwise a default backoff. 401/403 credential failures should set needsReauth on the
- * store (existing OAuth path) so the account is excluded from eligibility.
+ * Affinity is process-local (lost on restart). Cooldown uses Retry-After when present, else
+ * the reset time of whichever rate-limit window upstream reports as rejected, else a default
+ * backoff. 401/403 credential failures should set needsReauth on the store (existing OAuth
+ * path) so the account is excluded from eligibility.
  */
 import { createHash } from "node:crypto";
 import { captureOAuthAccountSelection, commitOAuthAccountSelection, credentialGeneration, getAccountSet, getAccountCredential, getAccountCredentialWithStatus } from "./store";
@@ -33,9 +34,16 @@ import type { OcxAccountPoolQuotaWindow, OcxAccountPoolRotationStrategy, OcxConf
 import { sweepExpiredOnWrite } from "../lib/state-store-sweeper";
 import { retainedUtf8Bytes } from "../lib/admission";
 
+/**
+ * The read side of a `Headers` object, so a caller can pass the live upstream response's
+ * headers without this module importing anything from the server layer -- and so a test can
+ * hand it a plain `new Headers({...})`.
+ */
+export type AnthropicRateLimitHeaders = Pick<Headers, "get">;
+
 const PROVIDER = "anthropic";
+/** Backoff only when upstream supplies no usable deadline. */
 const DEFAULT_COOLDOWN_MS = 60_000;
-const MAX_COOLDOWN_MS = 15 * 60_000;
 const AFFINITY_IDLE_TTL_MS = 24 * 60 * 60_000;
 const MAX_AFFINITY_ENTRIES = 2_000;
 const MAX_AFFINITY_COMPONENT_BYTES = 512;
@@ -58,9 +66,19 @@ export interface AnthropicAccountPoolConfig {
   quotaWindow?: OcxAccountPoolQuotaWindow;
 }
 
+/**
+ * Where a cooldown's length came from. Same vocabulary as `CodexCooldownSource`, because it
+ * answers the same question for the same reason: `retry-after` is upstream answering THIS
+ * refusal, `reset-derived` is upstream stating when the spent window reopens, and `default`
+ * is our own guess. The dashboard renders the first as a rate limit and the rest as quota,
+ * which is exactly the distinction a reset-derived cooldown carries -- collapsing it into
+ * `retry-after` would report a drained five-hour window as request-rate throttling.
+ */
+type AnthropicCooldownSource = "retry-after" | "reset-derived" | "default";
+
 interface AccountHealth {
   cooldownUntil: number;
-  cooldownSource: "retry-after" | "default";
+  cooldownSource: AnthropicCooldownSource;
 }
 
 interface AffinityEntry {
@@ -112,19 +130,38 @@ export function anthropicQuotaWindow(config: AnthropicAccountPoolConfig): OcxAcc
   return normalizeAccountPoolQuotaWindow(config.quotaWindow);
 }
 
+/** Accept upstream deadlines within the runtime's date range, without a policy ceiling. */
+function delayUntil(timestamp: number, now: number): number | undefined {
+  const delay = timestamp - now;
+  return Number.isFinite(new Date(timestamp).getTime()) && Number.isFinite(delay) && delay > 0
+    ? delay : undefined;
+}
+
 function parseRetryAfterMs(value: string | null | undefined, now: number): number | undefined {
   const text = value?.trim();
   if (!text) return undefined;
   if (/^\d+(?:\.\d+)?$/.test(text)) {
     const seconds = Number(text);
-    if (Number.isFinite(seconds) && seconds > 0) {
-      return Math.min(Math.max(Math.ceil(seconds * 1000), 1), MAX_COOLDOWN_MS);
-    }
+    if (!Number.isFinite(seconds) || seconds <= 0) return undefined;
+    return delayUntil(now + Math.max(Math.ceil(seconds * 1000), 1), now);
   }
-  const timestamp = Date.parse(text);
-  if (!Number.isFinite(timestamp)) return undefined;
-  const delay = timestamp - now;
-  return delay > 0 ? Math.min(delay, MAX_COOLDOWN_MS) : undefined;
+  return delayUntil(Date.parse(text), now);
+}
+
+/** Only rejected windows constrain recovery; all must reopen, so take the latest reset. */
+function parseRateLimitResetMs(headers: AnthropicRateLimitHeaders | null | undefined, now: number): number | undefined {
+  if (!headers) return undefined;
+  let latest: number | undefined;
+  for (const window of ["5h", "7d"] as const) {
+    if (headers.get(`anthropic-ratelimit-unified-${window}-status`)?.trim() !== "rejected") continue;
+    const resetSeconds = Number(headers.get(`anthropic-ratelimit-unified-${window}-reset`)?.trim());
+    if (!Number.isFinite(resetSeconds) || resetSeconds <= 0) continue;
+    const resetAt = resetSeconds * 1000;
+    if (delayUntil(resetAt, now) === undefined) continue;
+    if (latest === undefined || resetAt > latest) latest = resetAt;
+  }
+  if (latest === undefined) return undefined;
+  return latest - now;
 }
 
 export function getAnthropicAccountHealthSnapshot(
@@ -669,6 +706,7 @@ export function rotateAnthropicAccountOn429(
   retryAfterHeader: string | null | undefined,
   sessionKey?: string | null,
   now = Date.now(),
+  rateLimitHeaders?: AnthropicRateLimitHeaders | null,
 ): string | null {
   // Reactive 429 failover is NOT gated on the pool flag. That flag buys PROACTIVE routing --
   // session affinity, quota-ranked new-session selection, autoSwitchThreshold, strategy -- all
@@ -678,11 +716,18 @@ export function rotateAnthropicAccountOn429(
   // Presence is the activation rule, the same one an apiKeyPool of two keys already uses.
   if (!isAnthropicAccountPoolEnabled(config) && !hasAnthropicFailoverQuorum(now)) return null;
 
+  // Retry-After first: it is the header written FOR this decision. The rejected window's
+  // reset is the fallback, because a 429 that omits Retry-After still carries it -- and
+  // without that fallback such a refusal cools for the 60s default and the exhausted
+  // account is back in the rotation a minute later.
   const parsedRetry = parseRetryAfterMs(retryAfterHeader, now);
-  const cooldownMs = parsedRetry ?? DEFAULT_COOLDOWN_MS;
+  const resetDerived = parsedRetry === undefined ? parseRateLimitResetMs(rateLimitHeaders, now) : undefined;
+  const cooldownMs = parsedRetry ?? resetDerived ?? DEFAULT_COOLDOWN_MS;
   upstreamHealth.set(failedAccountId, {
     cooldownUntil: now + cooldownMs,
-    cooldownSource: parsedRetry ? "retry-after" : "default",
+    cooldownSource: parsedRetry !== undefined
+      ? "retry-after"
+      : resetDerived !== undefined ? "reset-derived" : "default",
   });
   sweepExpiredOnWrite(now);
   clearAnthropicSessionAffinityForAccount(failedAccountId);

package/src/oauth/health.ts

@@ -184,6 +184,9 @@ export function projectStoredOAuthAccountHealth(
     needsReauth: account.needsReauth === true,
     reauthReason: account.needsReauth === true ? "refresh_failed" : undefined,
     cooldownUntilMs: anthropicSnap?.cooldownUntil,
+    // Same mapping as the Codex pool's `cooldownReasonFromSource`: only a Retry-After is
+    // request-rate throttling. A reset-derived cooldown means a usage window is spent, which
+    // is quota, and reporting it as a rate limit would tell the operator to retry shortly.
     cooldownReason: anthropicSnap?.cooldownSource === "retry-after" ? "rate_limit" : anthropicSnap ? "quota" : undefined,
     warningReason: detectOAuthWarning(provider, account, opts.observeOnly === true, now),
     now,