@bitkyc08/opencodex 2.52.0 → 2.53.0-preview.20260913

package/src/providers/devin-provider-merge-migration.ts

@@ -0,0 +1,240 @@
+/**
+ * Merge the retired `devin-cli` provider id into `devin` at startup
+ * (devlog/_plan/260913_devin_provider_merge).
+ *
+ * The two registry entries were the same adapter, api-server, and credential
+ * shape — only the login path differed — so `devin-cli` was removed from the
+ * registry and survives as a deprecated alias. What remains is the saved
+ * state written under the old id: a `providers["devin-cli"]` config row,
+ * cross-config references, and the auth.json credential slot. All three move
+ * here because an alias can resolve lookups but cannot un-dangle a reference
+ * that validation requires to be a configured provider.
+ *
+ * Posture is Alibaba/OpenAI-tier fail-closed, not model-rename: this writes
+ * auth.json, so both files get an immutable copy-verify-link snapshot before
+ * any write, and a backup failure throws out of `startServer` rather than
+ * rewriting credentials with no rollback point. A rekey that fails AFTER the
+ * backup degrades to a warning instead — the old slot is still valid via the
+ * alias and the next boot retries.
+ *
+ * Collision posture matches the config half: a `devin` row or slot that
+ * already exists means two potentially different accounts, and choosing a
+ * survivor is a user decision, so the migration refuses and warns.
+ */
+import { copyFileSync, existsSync, linkSync, readFileSync, rmSync } from "node:fs";
+import { getConfigPath, saveConfig } from "../config";
+import { codexAccountNamespaceProviderCollisionError } from "../codex/account-namespace-match";
+import { DEVIN_DEFAULT_API_SERVER } from "../oauth/devin/api-base";
+import {
+  getAuthStorePath,
+  peekAuthStore,
+  rekeyProviderCredentials,
+  type ProviderCredentialRekeyOutcome,
+} from "../oauth/store";
+import { isRetiredDevinAcpIdentityUrl } from "./devin-cli-authmode-migration";
+import { rewriteProviderReferences } from "./provider-id-rewrite";
+import type { OcxConfig } from "../types";
+
+const FROM_ID = "devin-cli";
+const TO_ID = "devin";
+
+/**
+ * One snapshot suffix covers both files: the migration is not repeatable per
+ * file, and two suffixes would only say which file happened to snapshot first.
+ */
+const BACKUP_SUFFIX = ".pre-devin-provider-merge-v1.bak";
+
+/**
+ * Immutable pre-migration snapshot, published by copy-verify-link.
+ *
+ * Same construction as alibaba-region-backup.ts, kept as a local copy because
+ * that module's IO seam and error type are Alibaba-specific. The reasoning
+ * carries over unchanged: a bare exclusive create can publish a truncated
+ * file after a mid-copy crash, and an existing snapshot is reused rather than
+ * compared — the earliest snapshot is the best rollback point, and demanding
+ * equality would brick an install whose config legitimately changed after an
+ * aborted run.
+ */
+function snapshotOnce(path: string): "absent" | "created" | "reused" {
+  if (!existsSync(path)) return "absent";
+  const backup = `${path}${BACKUP_SUFFIX}`;
+  if (existsSync(backup)) return "reused";
+  const source = readFileSync(path);
+  const temp = `${backup}.${process.pid}.tmp`;
+  try {
+    copyFileSync(path, temp);
+    if (!readFileSync(temp).equals(source)) {
+      throw new Error(`failed to write a complete backup to ${temp}`);
+    }
+    linkSync(temp, backup);
+    return "created";
+  } catch (error) {
+    // A concurrent process won the publish race with the same verified copy.
+    if ((error as NodeJS.ErrnoException).code === "EEXIST") return "reused";
+    throw error;
+  } finally {
+    rmSync(temp, { force: true });
+  }
+}
+
+export function backupConfigBeforeDevinProviderMerge(configPath = getConfigPath()): "absent" | "created" | "reused" {
+  return snapshotOnce(configPath);
+}
+
+export function backupAuthBeforeDevinProviderMerge(authPath = getAuthStorePath()): "absent" | "created" | "reused" {
+  return snapshotOnce(authPath);
+}
+
+export interface DevinProviderMergeProjection {
+  config: OcxConfig;
+  changed: boolean;
+  warnings: string[];
+}
+
+/**
+ * Move `providers["devin-cli"]` to `providers["devin"]` and re-point every
+ * cross-config reference. Pure projection: the input is not mutated and the
+ * caller decides whether to persist the result.
+ *
+ * The moved row is normalized to the canonical entry's contract in the same
+ * pass — `authMode: "oauth"` and `adapter: "devin"` are the only values the
+ * `devin` registry entry admits, and a `cli.devin.ai` baseUrl was the retired
+ * ACP transport's identity placeholder, never a destination. This absorbs
+ * what `projectDevinCliAuthMode` used to do for the registry-id row; that
+ * projection keeps only the custom-named-row adapter repair.
+ */
+export function projectDevinProviderMerge(config: OcxConfig): DevinProviderMergeProjection {
+  const source = config.providers?.[FROM_ID];
+  if (!source) return { config, changed: false, warnings: [] };
+
+  if (codexAccountNamespaceProviderCollisionError(config.codexAccountNamespaces, TO_ID)) {
+    return {
+      config,
+      changed: false,
+      warnings: [
+        `provider "${FROM_ID}" needs to move to "${TO_ID}", but that destination is reserved `
+        + "by a configured Codex account namespace. Nothing was changed. Rename the account "
+        + "selector or move the provider manually, then restart.",
+      ],
+    };
+  }
+  if (config.providers[TO_ID]) {
+    return {
+      config,
+      changed: false,
+      warnings: [
+        `provider "${FROM_ID}" is merged into "${TO_ID}", but "${TO_ID}" already exists. Both `
+        + "were left untouched: merging two provider rows can merge two different accounts, "
+        + "which is not a decision this migration can make. Move any devin-cli-only settings "
+        + `onto "${TO_ID}" and delete the unused entry.`,
+      ],
+    };
+  }
+
+  const projected = structuredClone(config);
+  const moved = projected.providers[FROM_ID]!;
+  delete projected.providers[FROM_ID];
+  moved.adapter = "devin";
+  moved.authMode = "oauth";
+  if (isRetiredDevinAcpIdentityUrl(moved.baseUrl)) {
+    moved.baseUrl = DEVIN_DEFAULT_API_SERVER;
+  }
+  projected.providers[TO_ID] = moved;
+
+  const { changed: rewritten, collisions } = rewriteProviderReferences(projected, FROM_ID, TO_ID);
+  // The rewriter is not transactional, so the clone is already partly
+  // rewritten here. Returning the ORIGINAL config discards it.
+  if (collisions.length > 0) {
+    return {
+      config,
+      changed: false,
+      warnings: [
+        `provider "${FROM_ID}" needs to move to "${TO_ID}", but ${collisions.join(", ")} `
+        + "already hold values for the destination. Nothing was changed: choosing which value "
+        + "survives is not a decision this migration can make. Resolve those entries and restart.",
+      ],
+    };
+  }
+
+  return {
+    config: projected,
+    changed: true,
+    warnings: [
+      `moved provider "${FROM_ID}" to "${TO_ID}": the two registry entries were merged and `
+      + `"${FROM_ID}" is now a deprecated alias. ${rewritten} reference(s) were re-pointed.`,
+    ],
+  };
+}
+
+export interface DevinProviderMergeStartupDeps {
+  project: typeof projectDevinProviderMerge;
+  /** config.json snapshot; runs only when the projection changed something. */
+  backupConfig: () => void;
+  /** auth.json snapshot; runs only when a `devin-cli` credential slot exists. */
+  backupAuth: () => void;
+  save: (config: OcxConfig) => void;
+  /** Sync peek so the auth backup is not taken for a slot that is not there. */
+  hasAuthSlot: (provider: string) => boolean;
+  rekey: (from: string, to: string) => Promise<ProviderCredentialRekeyOutcome>;
+}
+
+const DEFAULT_DEPS: DevinProviderMergeStartupDeps = {
+  project: projectDevinProviderMerge,
+  backupConfig: () => { backupConfigBeforeDevinProviderMerge(); },
+  backupAuth: () => { backupAuthBeforeDevinProviderMerge(); },
+  save: saveConfig,
+  hasAuthSlot: provider => peekAuthStore()[provider] !== undefined,
+  rekey: rekeyProviderCredentials,
+};
+
+/**
+ * Run the merge at startup, before `reconcileOAuthProviders` in the
+ * `startServer` chain.
+ *
+ * The config half is synchronous and fail-closed like the Alibaba migration:
+ * the snapshot is taken strictly before the save, and a backup failure throws
+ * rather than writing without a rollback point.
+ *
+ * The auth half is deliberately detached. `startServer` is synchronous — an
+ * `await` in the boot window would suspend the composition root — and
+ * `mutateStore` is async-only, so the rekey is fired after its snapshot and
+ * its outcome is logged when it lands. That is safe here: the credential is
+ * valid under either slot name while the `devin-cli` alias exists, a conflict
+ * refuses by design, and a failed rekey simply retries on the next boot.
+ */
+export function runDevinProviderMergeStartupMigration(
+  config: OcxConfig,
+  deps: DevinProviderMergeStartupDeps = DEFAULT_DEPS,
+): OcxConfig {
+  const projection = deps.project(config);
+  // Warnings are emitted even on a no-op: the collision case IS the warning.
+  for (const warning of projection.warnings) console.warn(`[devin-provider-merge] ${warning}`);
+  let result = config;
+  if (projection.changed) {
+    deps.backupConfig();
+    deps.save(projection.config);
+    result = projection.config;
+  }
+
+  // The auth rekey runs even when the config half refused or had nothing to
+  // do: a `devin-cli` credential slot is orphaned state regardless of whether
+  // a provider row still points at it, and the conflict check inside the
+  // rekey is the same refuse-on-occupied rule the config half applies.
+  if (!deps.hasAuthSlot(FROM_ID)) return result;
+  deps.backupAuth();
+  void deps.rekey(FROM_ID, TO_ID).then(outcome => {
+    if (outcome === "conflict") {
+      console.warn(
+        `[devin-provider-merge] auth.json already has a "${TO_ID}" credential slot; the `
+        + `"${FROM_ID}" slot was left in place. Merging two credential sets is not a decision `
+        + "this migration can make — remove the unused slot manually.",
+      );
+    }
+  }).catch((error: unknown) => {
+    console.warn(
+      `[devin-provider-merge] credential rekey failed and will retry on the next start: `
+      + `${error instanceof Error ? error.message : String(error)}`,
+    );
+  });
+  return result;
+}

package/src/providers/muse-key-quota.ts

@@ -0,0 +1,117 @@
+/**
+ * On-demand Muse Code quota, read from the subscription key endpoint.
+ *
+ * Until now this provider's quota could only be OBSERVED: Meta publishes no quota
+ * endpoint (17 REST paths probed, all 404 — devlog/_fin/260903_muse_spark_plan_oauth/003
+ * E), so the only measurement arrived mid-stream and a dashboard load could not refresh
+ * it without spending an inference turn (src/providers/quota.ts:1606-1613).
+ *
+ * A device-logged-in account changes that, because it holds the Meta ACCOUNT token and the
+ * key-mint response carries `subs_usage` (001 B-C). That makes this an auth-plane read,
+ * not an inference call.
+ *
+ * Three properties matter:
+ *
+ * 1. NEVER THROWS. A quota probe runs behind a dashboard poll. A failure must cost a row,
+ *    not a page.
+ * 2. BACKS OFF. The mint endpoint is rate-limited, and this is the first quota source in
+ *    this repository with a real failure backoff — quota.ts:2171 negative-caches by TTL,
+ *    which is not the same thing.
+ * 3. DISCARDS THE KEY. The response contains `api_key`. It is never read here, never
+ *    logged, and never returned.
+ */
+import { mintMuseApiKey } from "../oauth/meta-muse-device";
+import { museUsageWindowsToQuota } from "./muse-subscription-usage";
+import type { ProviderQuota } from "./quota-types";
+
+/** Matches the reference implementation's own bound for the same endpoint. */
+const FAILURE_BACKOFF_MS = 5 * 60_000;
+
+/**
+ * [audit fold] Minimum spacing between two SUCCESSFUL mints for one account.
+ *
+ * A failure backoff alone is not enough. Two callers bypass the ordinary quota cache:
+ * GET /api/provider-quotas?refresh=1 (src/server/management/provider-routes.ts:747-748)
+ * and the reset poller, which forces every tick (src/quota/reset-poller.ts:83). Without
+ * this, a user holding down a refresh button would drive one key-mint per click.
+ *
+ * This TTL is deliberately NOT conditioned on forceRefresh: a forced refresh may skip a
+ * display cache, but it may not spend another mint. When the TTL holds, the probe returns
+ * null and the caller serves the row this probe already wrote to the account cache.
+ */
+const SUCCESS_TTL_MS = 5 * 60_000;
+
+export interface MuseKeyQuotaDeps {
+  fetchImpl?: typeof fetch;
+  now?: () => number;
+}
+
+/** Keyed by account id: one account's rate limit must not silence another's. */
+const backoffUntil = new Map<string, number>();
+const lastSuccessAt = new Map<string, number>();
+/**
+ * One in-flight probe per account.
+ *
+ * The TTL check alone is not atomic: `?refresh=1` and the reset poller can both pass it
+ * before either writes `lastSuccessAt`, which would spend two mints inside one window.
+ * Concurrent callers share the first request instead of racing it.
+ */
+const inFlight = new Map<string, Promise<ProviderQuota | null>>();
+
+/** Test seam only. */
+export function resetMuseKeyQuotaBackoff(): void {
+  backoffUntil.clear();
+  lastSuccessAt.clear();
+  inFlight.clear();
+}
+
+export function museKeyQuotaBackoffRemainingMs(accountId: string, now = Date.now()): number {
+  return Math.max(0, (backoffUntil.get(accountId) ?? 0) - now);
+}
+
+export async function fetchMuseKeyQuotaSnapshot(
+  accountId: string,
+  oauthAccessToken: string,
+  deps: MuseKeyQuotaDeps = {},
+  signal?: AbortSignal,
+): Promise<ProviderQuota | null> {
+  const now = deps.now ?? Date.now;
+  const at = now();
+  if (museKeyQuotaBackoffRemainingMs(accountId, at) > 0) return null;
+  // Success spacing, enforced even for a forced refresh. See SUCCESS_TTL_MS.
+  const last = lastSuccessAt.get(accountId);
+  if (last !== undefined && at - last < SUCCESS_TTL_MS) return null;
+  const running = inFlight.get(accountId);
+  if (running) return await running;
+  const attempt = probe(accountId, oauthAccessToken, deps, signal);
+  inFlight.set(accountId, attempt);
+  try {
+    return await attempt;
+  } finally {
+    inFlight.delete(accountId);
+  }
+}
+
+async function probe(
+  accountId: string,
+  oauthAccessToken: string,
+  deps: MuseKeyQuotaDeps,
+  signal?: AbortSignal,
+): Promise<ProviderQuota | null> {
+  const now = deps.now ?? Date.now;
+  try {
+    // No `onboard`: this is a read, not a login. Onboarding on a poll would be a
+    // side effect on the user's account.
+    const payload = await mintMuseApiKey(oauthAccessToken, {}, deps, signal);
+    backoffUntil.delete(accountId);
+    lastSuccessAt.set(accountId, now());
+    if (payload.isSubsActive === false) return null;
+    return museUsageWindowsToQuota(payload.subsUsage);
+  } catch {
+    // Every failure backs off, including 401/403. An expired account token cannot be
+    // refreshed (001 A), so retrying it on the next poll is pure noise; the next real
+    // request surfaces the auth problem through the existing reauth path.
+    backoffUntil.set(accountId, now() + FAILURE_BACKOFF_MS);
+    return null;
+  }
+}

package/src/providers/muse-subscription-usage.ts

@@ -45,8 +45,8 @@ export function isMuseSubscriptionUsagePayload(payload: unknown): boolean {
  * `subscription.tier` is deliberately dropped. It is an opaque numeric id, not the plan
  * label the Muse CLI prints, so surfacing it would show a meaningless number.
  */
-export function parseMuseSubscriptionUsage(payload: unknown): ProviderQuota | null {
-  const subscription = asRecord(asRecord(payload)?.subscription);
+export function museUsageWindowsToQuota(usage: unknown): ProviderQuota | null {
+  const subscription = asRecord(usage);
   if (!subscription) return null;
 
   const quota: ProviderQuota = { updatedAt: Date.now() };
@@ -93,3 +93,15 @@ export function parseMuseSubscriptionUsage(payload: unknown): ProviderQuota | nu
   // would render as a quota with no bars.
   return sawWindow ? quota : null;
 }
+
+/**
+ * The streaming-frame entry point.
+ *
+ * Kept as a thin adapter over the shared mapper: the frame nests the same two windows
+ * under `subscription`, the muse-code/key response nests them under `subs_usage`
+ * (devlog/_plan/260912_muse_device_oauth/001 C). Two parsers would drift, and the
+ * five-hour-window discrimination above is the part that must not.
+ */
+export function parseMuseSubscriptionUsage(payload: unknown): ProviderQuota | null {
+  return museUsageWindowsToQuota(asRecord(payload)?.subscription);
+}

package/src/providers/openai-sidecar.ts

@@ -5,6 +5,7 @@ import {
   hasCallerCodexBearer,
   isCodexAuthContextUsable,
   resolveCodexAuthContext,
+  releaseCodexAuthContextProbeLease,
   type CodexAccountSelectionAdmission,
   type CodexAuthContext,
   type CodexAuthPolicyConfig,
@@ -129,6 +130,7 @@ export async function resolveFirstUsableOpenAiSidecar(
     admission?: Pick<DataPlaneAdmission, "source">;
     codexAuthPolicy?: CodexAuthPolicyConfig;
     beginCodexAccountSelection?: () => CodexAccountSelectionAdmission | undefined;
+    signal?: AbortSignal;
   } = {},
 ): Promise<ResolvedOpenAiForwardSidecar | undefined> {
   const { exactAccount } = options;
@@ -151,12 +153,21 @@ export async function resolveFirstUsableOpenAiSidecar(
         modelId: exactAccount.modelId,
         admission: options.admission,
         beginCodexAccountSelection: options.beginCodexAccountSelection,
+        signal: options.signal,
       });
-      const selectedHeaders = headersForCodexAuthContext(incomingHeaders, authContext, policy, exactAccount.modelId, options.admission);
+      let selectedHeaders: Headers;
+      try {
+        options.signal?.throwIfAborted();
+        selectedHeaders = headersForCodexAuthContext(incomingHeaders, authContext, policy, exactAccount.modelId, options.admission);
+      } catch (error) {
+        releaseCodexAuthContextProbeLease(authContext);
+        throw error;
+      }
       if ((authContext.kind !== "pool" && authContext.kind !== "main-pool")
         || !isCodexAuthContextUsable(authContext, config)) {
         // Exact selection is fail-closed. A generation/runtime-state race must not fall through
         // to the caller-bearer error or let a later candidate select another account.
+        releaseCodexAuthContextProbeLease(authContext);
         throw new CodexPoolAuthenticationError("Selected Codex account is unavailable");
       }
       return {
@@ -194,9 +205,20 @@ export async function resolveFirstUsableOpenAiSidecar(
       codexAuthPolicy: policy,
       admission: options.admission,
       beginCodexAccountSelection: options.beginCodexAccountSelection,
+      signal: options.signal,
     });
-    const selectedHeaders = headersForCodexAuthContext(incomingHeaders, authContext, policy, undefined, options.admission);
-    if (!isCodexAuthContextUsable(authContext, config)) continue;
+    let selectedHeaders: Headers;
+    try {
+      options.signal?.throwIfAborted();
+      selectedHeaders = headersForCodexAuthContext(incomingHeaders, authContext, policy, undefined, options.admission);
+    } catch (error) {
+      releaseCodexAuthContextProbeLease(authContext);
+      throw error;
+    }
+    if (!isCodexAuthContextUsable(authContext, config)) {
+      releaseCodexAuthContextProbeLease(authContext);
+      continue;
+    }
     return {
       ...candidate,
       authContext,

package/src/providers/opencode-zen-rate-limit.ts

@@ -175,3 +175,61 @@ export function enrichOpenCodeZenUpstreamMessage(
 ): string {
   return enrichOpenCodeZenFreeTierMessage(enrichOpenCodeZenRateLimitMessage(message, opts), opts);
 }
+
+/** The effective HTTP endpoint, never the configured row name, identifies Console. */
+export function isConsoleGoDestination(outboundUrl: string | undefined): boolean {
+  if (!outboundUrl) return false;
+  try {
+    const url = new URL(outboundUrl);
+    return url.protocol === "https:" && url.hostname === "opencode.ai"
+      && url.port === "" && url.username === "" && url.password === ""
+      && url.search === "" && url.hash === ""
+      && /^\/zen\/(?:go\/)?v1\/(?:responses|chat\/completions|messages)$/.test(url.pathname);
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * The canonical refusal envelope, as served on both Console routes:
+ *   {"error":{"param":null,"type":"invalid_request_error","message":"Error from provider
+ *   (Console Go): Upstream request failed: [invalid_request_error] Invalid upload request."}}
+ *
+ * The gateway names itself Console on the Zen key route and Console Go on the Go route, so the
+ * anchor is the shared product name plus the refusal sentence. The message is matched whole: a
+ * bare string, a suffix, or any other envelope is a different refusal and must not be replayed.
+ * Being stricter than necessary is the safe direction: a missed match leaves the turn failing
+ * exactly as it does today, while a loose match spends an extra request on unrelated 400s.
+ */
+const CONSOLE_UPLOAD_REFUSALS = new Set([
+  "Error from provider (Console Go): Upstream request failed: [invalid_request_error] Invalid upload request.",
+  "Error from provider (Console): Upstream request failed: [invalid_request_error] Invalid upload request.",
+]);
+
+/**
+ * True only for the canonical Console upload refusal on a canonical Console destination.
+ * Route-gated on purpose: the message alone would let any other upstream that happens to answer
+ * with this English sentence trigger a second send from an unrelated provider.
+ */
+export function isTransientConsoleGoUploadRejection(opts: {
+  status: number;
+  errorBody: string | undefined;
+  outboundUrl?: string;
+}): boolean {
+  if (opts.status !== 400 || !opts.errorBody) return false;
+  if (!isConsoleGoDestination(opts.outboundUrl)) return false;
+  let payload: unknown;
+  try {
+    payload = JSON.parse(opts.errorBody);
+  } catch {
+    return false;
+  }
+  const error = (payload as { error?: unknown } | null)?.error;
+  if (!error || typeof error !== "object" || Array.isArray(error)) return false;
+  // The whole envelope, not just the sentence: Console always answers this refusal as
+  // invalid_request_error with a null param, so a partial envelope is a different error.
+  const envelope = error as { param?: unknown; type?: unknown; message?: unknown };
+  if (envelope.type !== "invalid_request_error" || envelope.param !== null) return false;
+  // Matched without trimming: padding means the gateway wrapped or appended something.
+  return typeof envelope.message === "string" && CONSOLE_UPLOAD_REFUSALS.has(envelope.message);
+}

package/src/providers/provider-id-rewrite.ts

@@ -20,11 +20,13 @@ export interface ProviderRewriteResult {
  *
  * Three shapes exist and the difference matters: routed model strings
  * (`"<provider>/<model>"`), bare provider ids (`customModels[].provider`,
- * `combos[*].targets[].provider`), and keys that ARE provider ids or routes
- * (`providerContextCaps`, `claudeCode.desktopProfile.assignments`). A rewrite
- * that handles only the first leaves an orphaned context cap and — worse — a
- * combo target naming a provider that no longer exists, which fails validation
- * in `src/combos/types.ts` and makes `loadConfig` discard the whole config.
+ * `combos[*].targets[].provider`, `routingProfiles[*].candidates[].provider`),
+ * and keys that ARE provider ids or routes (`providerContextCaps`,
+ * `claudeCode.desktopProfile.assignments`). A rewrite that handles only the
+ * first leaves an orphaned context cap and — worse — a combo target or routing
+ * candidate naming a provider that no longer exists, which fails validation in
+ * `src/combos/types.ts` / `src/routing/profile.ts` and makes `loadConfig`
+ * discard the whole config.
  *
  * `providers[*].selectedModels` is deliberately NOT rewritten: those are
  * per-provider native model ids, and upstream ids may themselves contain a
@@ -110,6 +112,19 @@ export function rewriteProviderReferences(config: OcxConfig, from: string, to: s
     }
   }
 
+  // Routing-profile candidates carry a bare provider id next to a bare model
+  // id (OcxRoutingProfileCandidate), and profile validation requires the
+  // provider to be configured — so an unrewritten candidate is the same
+  // load-failing dangling reference a stale combo target is.
+  for (const profile of Object.values(config.routingProfiles ?? {})) {
+    for (const candidate of profile.candidates ?? []) {
+      if (candidate.provider === from) {
+        candidate.provider = to;
+        changed += 1;
+      }
+    }
+  }
+
   // Keys. `providerContextCaps` is KEYED by provider id — a prefix rewrite would
   // silently orphan the cap — and a destination key may already be occupied.
   for (const field of ["providerContextCaps", "providerContextCapValues"] as const) {

package/src/providers/quota-types.ts

@@ -49,4 +49,16 @@ export interface AccountQuotaFields {
   quotaMode?: AccountQuotaMode;
   quota?: ProviderQuota | null;
   quotaUnavailable?: boolean;
+  quotaFailure?: QuotaFailureCode;
+}
+
+
+/** Closed account-probe diagnoses; never upstream text, URLs, credentials or routing policy. */
+export const QUOTA_FAILURE_CODES = [
+  "account_unavailable", "access_denied", "rate_limited", "upstream_error", "redirect_blocked",
+  "destination_blocked", "dns_failed", "timeout", "transport_error", "response_unusable",
+] as const;
+export type QuotaFailureCode = typeof QUOTA_FAILURE_CODES[number];
+export function parseQuotaFailureCode(value: unknown): QuotaFailureCode | undefined {
+  return QUOTA_FAILURE_CODES.find(code => code === value);
 }