@bitkyc08/opencodex 2.69.0 → 2.70.0

package/src/oauth/anthropic-model-routes.ts

@@ -0,0 +1,105 @@
+import type { AnthropicModelRoute, OcxConfig } from "../types/config";
+
+export interface AnthropicRouteDecision {
+  /** One-based position in the saved rule list; safe for request logs. */
+  position: number;
+  accounts: readonly string[];
+  fallback: boolean;
+}
+
+type ParseResult = { ok: true; routes: AnthropicModelRoute[] } | { ok: false; error: string };
+export type AnthropicRoutesRead = { routes: AnthropicModelRoute[] | null; routesError?: string };
+const MAX_ROUTES = 32;
+const MAX_ACCOUNTS = 32;
+const MAX_TEXT = 128;
+const NAME = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
+const PATTERN = /^[A-Za-z0-9_./:*?-]+$/;
+
+/** Validate the stored rule, not current roster membership: re-adding an account restores it. */
+export function parseAnthropicModelRoutes(raw: unknown): ParseResult {
+  if (!Array.isArray(raw) || raw.length > MAX_ROUTES) {
+    return { ok: false, error: `routes must be an array of at most ${MAX_ROUTES} rules` };
+  }
+  const names = new Set<string>();
+  const patterns = new Set<string>();
+  const routes: AnthropicModelRoute[] = [];
+  for (const [index, value] of raw.entries()) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) return { ok: false, error: `routes[${index}] must be an object` };
+    const row = value as Record<string, unknown>;
+    if (Object.keys(row).some(key => !["name", "match", "accounts", "fallback"].includes(key))) {
+      return { ok: false, error: `routes[${index}] has an unknown field` };
+    }
+    if (typeof row.name !== "string" || !NAME.test(row.name) || names.has(row.name)) {
+      return { ok: false, error: `routes[${index}].name must be unique, nonempty and at most 64 safe characters` };
+    }
+    if (typeof row.match !== "string" || !row.match || row.match.length > MAX_TEXT
+      || !PATTERN.test(row.match) || patterns.has(row.match)) {
+      return { ok: false, error: `routes[${index}].match must be a unique model glob of at most ${MAX_TEXT} characters` };
+    }
+    if (!Array.isArray(row.accounts) || row.accounts.length < 1 || row.accounts.length > MAX_ACCOUNTS
+      || row.accounts.some(id => typeof id !== "string" || !id || id.length > MAX_TEXT || id.trim() !== id || /[\x00-\x1f\x7f]/.test(id))
+      || new Set(row.accounts).size !== row.accounts.length) {
+      return { ok: false, error: `routes[${index}].accounts must contain 1-${MAX_ACCOUNTS} unique stored IDs` };
+    }
+    if (row.fallback !== undefined && typeof row.fallback !== "boolean") {
+      return { ok: false, error: `routes[${index}].fallback must be boolean` };
+    }
+    names.add(row.name);
+    patterns.add(row.match);
+    routes.push({ name: row.name, match: row.match, accounts: [...row.accounts], ...(row.fallback === undefined ? {} : { fallback: row.fallback }) });
+  }
+  return { ok: true, routes };
+}
+
+/** A malformed hand edit stays on disk for correction, but must never look valid to readers. */
+export function readAnthropicModelRoutes(raw: unknown): AnthropicRoutesRead {
+  if (raw === undefined) return { routes: null };
+  const parsed = parseAnthropicModelRoutes(raw);
+  return parsed.ok ? { routes: parsed.routes } : { routes: null, routesError: parsed.error };
+}
+
+function matches(pattern: string, modelId: string): boolean {
+  // Linear wildcard matching avoids regex backtracking on operator-declared glob strings.
+  let p = 0;
+  let m = 0;
+  let star = -1;
+  let resume = 0;
+  while (m < modelId.length) {
+    if (p < pattern.length && (pattern[p] === modelId[m] || pattern[p] === "?")) {
+      p++; m++;
+    } else if (pattern[p] === "*") {
+      star = p++;
+      resume = m;
+    } else if (star >= 0) {
+      p = star + 1;
+      m = ++resume;
+    } else return false;
+  }
+  while (pattern[p] === "*") p++;
+  return p === pattern.length;
+}
+
+export function resolveAnthropicModelRoute(
+  config: OcxConfig,
+  modelId: string,
+): { decision: AnthropicRouteDecision | null; error?: string } {
+  if (config.anthropicAccountPool?.enabled !== true) return { decision: null };
+  const raw = (config.anthropicAccountPool as { routes?: unknown } | undefined)?.routes;
+  if (raw === undefined) return { decision: null };
+  const parsed = parseAnthropicModelRoutes(raw);
+  if (!parsed.ok) return { decision: null, error: parsed.error };
+  for (const [index, route] of parsed.routes.entries()) {
+    if (matches(route.match, modelId)) {
+      return { decision: { position: index + 1, accounts: route.accounts, fallback: route.fallback === true } };
+    }
+  }
+  return { decision: null };
+}
+
+/** Preserve declared account order; widen only when the routed set is empty. */
+export function routeCandidates(eligible: readonly string[], decision: AnthropicRouteDecision | null): string[] {
+  if (!decision) return [...eligible];
+  const available = new Set(eligible);
+  const routed = decision.accounts.filter(id => available.has(id));
+  return routed.length > 0 || !decision.fallback ? routed : [...eligible];
+}

package/src/oauth/anthropic-routing.ts

@@ -33,6 +33,7 @@ import {
 import type { OcxAccountPoolQuotaWindow, OcxAccountPoolRotationStrategy, OcxConfig } from "../types";
 import { sweepExpiredOnWrite } from "../lib/state-store-sweeper";
 import { retainedUtf8Bytes } from "../lib/admission";
+import { routeCandidates, type AnthropicRouteDecision } from "./anthropic-model-routes";
 
 /**
  * The read side of a `Headers` object, so a caller can pass the live upstream response's
@@ -54,17 +55,7 @@ const VALID_QUOTA_WINDOWS = new Set<OcxAccountPoolQuotaWindow>(["five-hour", "we
 /** Cap same-request 429 rotations so short Retry-After cannot infinite-loop. */
 export const ANTHROPIC_POOL_MAX_FAILOVERS_PER_REQUEST = 3;
 
-export interface AnthropicAccountPoolConfig {
-  enabled?: boolean;
-  /** Usage % for new-session pick. Default 80. 0 = disable quota-based pick (active / affinity only). */
-  autoSwitchThreshold?: number;
-  /** New-session rotation strategy. Default quota (today's behaviour). */
-  strategy?: OcxAccountPoolRotationStrategy;
-  /** Successful new-session binds retained on one round-robin selection. Default 1; range 1..100. */
-  stickyLimit?: number;
-  /** Usage window for quota-based scoring. Default "five-hour" (today's behaviour). */
-  quotaWindow?: OcxAccountPoolQuotaWindow;
-}
+export type AnthropicAccountPoolConfig = NonNullable<OcxConfig["anthropicAccountPool"]>;
 
 /**
  * Where a cooldown's length came from. Same vocabulary as `CodexCooldownSource`, because it
@@ -355,11 +346,17 @@ export function forgetAnthropicFailoverQuorum(): void {
 }
 
 /** Earliest remaining cooldown among cooled Anthropic accounts, for client Retry-After. */
-export function getAnthropicPoolRetryAfterSeconds(now = Date.now()): number | null {
+export function getAnthropicPoolRetryAfterSeconds(now = Date.now(), decision: AnthropicRouteDecision | null = null): number | null {
   const set = getAccountSet(PROVIDER);
   if (!set) return null;
+  // Once an explicit fallback route has no eligible declared account, selection may use
+  // the ordinary pool. Its earliest usable cooldown must determine the advertised wait.
+  const fallbackExpanded = decision?.fallback === true
+    && !getEligibleAnthropicAccounts(now).some(id => decision.accounts.includes(id));
   let earliest: number | null = null;
   for (const account of set.accounts) {
+    if (decision && !fallbackExpanded && !decision.accounts.includes(account.id)) continue;
+    if (fallbackExpanded && (account.needsReauth === true || !isPoolCredentialUsable(account.id, now))) continue;
     const snap = getAnthropicAccountHealthSnapshot(account.id, now);
     if (!snap?.cooldownUntil) continue;
     if (earliest === null || snap.cooldownUntil < earliest) earliest = snap.cooldownUntil;
@@ -388,9 +385,9 @@ function compareScoredAccounts(a: ScoredAccount, b: ScoredAccount): number {
   return a.score - b.score || a.fiveHourTieBreak - b.fiveHourTieBreak;
 }
 
-function pickLowestUsage(config: OcxConfig, excludeId: string | undefined, now: number): string | null {
+function pickLowestUsage(config: OcxConfig, excludeId: string | undefined, now: number, decision: AnthropicRouteDecision | null = null): string | null {
   const window = anthropicQuotaWindow(anthropicAccountPoolConfig(config));
-  const unfiltered = getEligibleAnthropicAccounts(now).filter(id => id !== excludeId);
+  const unfiltered = routeCandidates(getEligibleAnthropicAccounts(now), decision).filter(id => id !== excludeId);
   const available = window === "weekly" ? unfiltered.filter(id => !exhausted5h(id)) : unfiltered;
   const eligible = available.length > 0 ? available : unfiltered;
   if (eligible.length === 0) return null;
@@ -412,19 +409,26 @@ function pickLowestUsage(config: OcxConfig, excludeId: string | undefined, now:
   return best.accountId;
 }
 
+/** A fallback route uses ordinary ordering only after it widens beyond its declared accounts. */
+function usesDeclaredRouteOrder(eligible: readonly string[], decision: AnthropicRouteDecision | null): boolean {
+  return decision !== null && (!decision.fallback || eligible.some(id => decision.accounts.includes(id)));
+}
+
 /** Next eligible Anthropic account in stable order after `afterId` (wrapping). */
 function pickNextFillFirstAnthropicAccount(
   config: OcxConfig,
   afterId: string,
   eligible: string[],
+  decision: AnthropicRouteDecision | null,
 ): string | null {
   const window = anthropicQuotaWindow(anthropicAccountPoolConfig(config));
   const available = window === "weekly" ? eligible.filter(id => !exhausted5h(id)) : eligible;
   const candidates = available.length > 0 ? available : eligible;
   if (candidates.length === 0) return null;
-  const ordered = [...candidates].sort((a, b) => a.localeCompare(b));
+  const routeOrder = usesDeclaredRouteOrder(eligible, decision);
+  const ordered = routeOrder ? candidates : [...candidates].sort((a, b) => a.localeCompare(b));
   const set = getAccountSet(PROVIDER);
-  const stableAll = set
+  const stableAll = routeOrder ? [...decision!.accounts] : set
     ? [...set.accounts.map(a => a.id)].sort((a, b) => a.localeCompare(b))
     : ordered;
   const startIdx = stableAll.indexOf(afterId);
@@ -449,16 +453,17 @@ function pickAlternateAnthropicAccount(
   config: OcxConfig,
   excludeId: string,
   now: number,
+  decision: AnthropicRouteDecision | null,
 ): string | null {
   const strategy = anthropicPoolStrategy(config);
-  const eligible = getEligibleAnthropicAccounts(now).filter(id => id !== excludeId);
+  const eligible = routeCandidates(getEligibleAnthropicAccounts(now), decision).filter(id => id !== excludeId);
   if (strategy === "round-robin") {
     return peekRoundRobinAccount(POOL_KEY_ANTHROPIC, eligible, stickyLimitForPool(config));
   }
   if (strategy === "fill-first") {
-    return pickNextFillFirstAnthropicAccount(config, excludeId, eligible);
+    return pickNextFillFirstAnthropicAccount(config, excludeId, eligible, decision);
   }
-  return pickLowestUsage(config, excludeId, now);
+  return pickLowestUsage(config, excludeId, now, decision);
 }
 
 function pruneExpiredAffinity(now: number): void {
@@ -486,6 +491,7 @@ export type AnthropicAccountSelectionReason =
 export interface AnthropicAccountSelection {
   accountId: string | null;
   reason: AnthropicAccountSelectionReason;
+  routePosition?: number;
 }
 
 function stickyLimitForPool(config: OcxConfig): number {
@@ -510,8 +516,8 @@ function isActiveUnderFillFirstThreshold(config: OcxConfig, accountId: string):
  * Fill-first: keep eligible active under threshold; otherwise advance to the next
  * eligible id in stable sorted order after the current active (wrapping).
  */
-function pickFillFirstAnthropicAccount(config: OcxConfig, now: number): string | null {
-  const eligible = getEligibleAnthropicAccounts(now);
+function pickFillFirstAnthropicAccount(config: OcxConfig, now: number, decision: AnthropicRouteDecision | null): string | null {
+  const eligible = routeCandidates(getEligibleAnthropicAccounts(now), decision);
   if (eligible.length === 0) return null;
 
   const set = getAccountSet(PROVIDER);
@@ -521,14 +527,14 @@ function pickFillFirstAnthropicAccount(config: OcxConfig, now: number): string |
   }
 
   if (!active || !set) {
-    const ordered = [...eligible].sort((a, b) => a.localeCompare(b));
+    const ordered = usesDeclaredRouteOrder(eligible, decision) ? eligible : [...eligible].sort((a, b) => a.localeCompare(b));
     for (const id of ordered) {
       if (isActiveUnderFillFirstThreshold(config, id)) return id;
     }
     return ordered[0] ?? null;
   }
 
-  return pickNextFillFirstAnthropicAccount(config, active, eligible);
+  return pickNextFillFirstAnthropicAccount(config, active, eligible, decision);
 }
 
 /**
@@ -538,12 +544,13 @@ function pickFillFirstAnthropicAccount(config: OcxConfig, now: number): string |
 function pickUnboundStrategyAccount(
   config: OcxConfig,
   now: number,
+  decision: AnthropicRouteDecision | null,
 ): { accountId: string; reason: "round-robin" | "fill-first" } | null {
   const strategy = anthropicPoolStrategy(config);
   if (strategy === "quota") return null;
 
   if (strategy === "round-robin") {
-    const eligible = getEligibleAnthropicAccounts(now);
+    const eligible = routeCandidates(getEligibleAnthropicAccounts(now), decision);
     const limit = stickyLimitForPool(config);
     const picked = peekRoundRobinAccount(POOL_KEY_ANTHROPIC, eligible, limit);
     if (!picked) return null;
@@ -551,7 +558,7 @@ function pickUnboundStrategyAccount(
   }
 
   if (strategy === "fill-first") {
-    const picked = pickFillFirstAnthropicAccount(config, now);
+    const picked = pickFillFirstAnthropicAccount(config, now, decision);
     if (!picked) return null;
     return { accountId: picked, reason: "fill-first" };
   }
@@ -567,10 +574,11 @@ export function resolveAnthropicAccountForSession(
   sessionKey: string | null | undefined,
   config: OcxConfig,
   now = Date.now(),
+  decision: AnthropicRouteDecision | null = null,
 ): AnthropicAccountSelection {
   pruneExpiredAffinity(now);
   const set = getAccountSet(PROVIDER);
-  if (!set || set.accounts.length === 0) return { accountId: null, reason: "none" };
+  if (!set || set.accounts.length === 0) return { accountId: null, reason: "none", ...(decision ? { routePosition: decision.position } : {}) };
 
   if (manualPreference === undefined) {
     manualPreference = set.selectionRevision !== undefined
@@ -582,6 +590,21 @@ export function resolveAnthropicAccountForSession(
     return { accountId: set.activeAccountId, reason: "pool-disabled" };
   }
 
+  const eligible = routeCandidates(getEligibleAnthropicAccounts(now), decision);
+  if (decision && eligible.length === 0) {
+    let cooled: boolean;
+    if (decision.fallback) {
+      // A removed route member is not a candidate, but fallback can still use the
+      // ordinary pool once those accounts recover. Only usable stored accounts count.
+      const ordinary = set.accounts.filter(account =>
+        account.needsReauth !== true && isPoolCredentialUsable(account.id, now));
+      cooled = ordinary.length > 0 && ordinary.every(account => isCooled(account.id, now));
+    } else {
+      cooled = decision.accounts.every(id => set.accounts.some(account => account.id === id && isCooled(id, now)));
+    }
+    return { accountId: null, reason: cooled ? "all-cooled" : "none", routePosition: decision.position };
+  }
+
   // A manual choice is a one-dispatch preference, not a lower-priority quota hint.
   // Consume it only after admission commits, so a failed token lookup cannot spend it.
   if (manualPreference) {
@@ -593,8 +616,8 @@ export function resolveAnthropicAccountForSession(
       const exhausted = [quota?.fiveHourPercent, quota?.weeklyPercent, quota?.monthlyPercent,
         ...(quota?.customWindows ?? []).map(window => window.percent)]
         .some(percent => typeof percent === "number" && percent >= 100);
-      if (!exhausted && getEligibleAnthropicAccounts(now).includes(chosen)) {
-        return { accountId: chosen, reason: "manual" };
+      if (!exhausted && eligible.includes(chosen)) {
+        return { accountId: chosen, reason: "manual", routePosition: decision?.position };
       }
     }
   }
@@ -604,10 +627,14 @@ export function resolveAnthropicAccountForSession(
     const affined = sessionAffinity.get(key);
     if (affined && now - affined.lastUsedAt <= AFFINITY_IDLE_TTL_MS) {
       const stillThere = set.accounts.some(a => a.id === affined.accountId && a.needsReauth !== true);
-      if (stillThere && !isCooled(affined.accountId, now) && isPoolCredentialUsable(affined.accountId, now)) {
-        return { accountId: affined.accountId, reason: "affinity" };
+      const stillUsable = stillThere && !isCooled(affined.accountId, now)
+        && isPoolCredentialUsable(affined.accountId, now);
+      if (stillUsable && eligible.includes(affined.accountId)) {
+        return { accountId: affined.accountId, reason: "affinity", routePosition: decision?.position };
       }
-      sessionAffinity.delete(key);
+      // A model route may exclude a healthy binding only for this request. Keep it for
+      // another model; remove bindings only when the account itself became unusable.
+      if (!stillUsable) sessionAffinity.delete(key);
     }
   }
 
@@ -618,21 +645,21 @@ export function resolveAnthropicAccountForSession(
   if (!key && (strategy === "round-robin" || strategy === "fill-first")) {
     const activeOk = set.accounts.some(a => a.id === set.activeAccountId && a.needsReauth !== true)
       && !isCooled(set.activeAccountId, now)
-      && isPoolCredentialUsable(set.activeAccountId, now);
+      && eligible.includes(set.activeAccountId);
     if (activeOk) {
-      return { accountId: set.activeAccountId, reason: "active" };
+      return { accountId: set.activeAccountId, reason: "active", routePosition: decision?.position };
     }
   }
 
-  const strategyPick = pickUnboundStrategyAccount(config, now);
+  const strategyPick = pickUnboundStrategyAccount(config, now, decision);
   if (strategyPick) {
-    return { accountId: strategyPick.accountId, reason: strategyPick.reason };
+    return { accountId: strategyPick.accountId, reason: strategyPick.reason, routePosition: decision?.position };
   }
 
   const threshold = anthropicAutoSwitchThreshold(config);
   const activeOk = set.accounts.some(a => a.id === set.activeAccountId && a.needsReauth !== true)
     && !isCooled(set.activeAccountId, now)
-    && isPoolCredentialUsable(set.activeAccountId, now);
+    && eligible.includes(set.activeAccountId);
 
   let accountId: string | null = null;
   let reason: AnthropicAccountSelectionReason = "none";
@@ -646,7 +673,7 @@ export function resolveAnthropicAccountForSession(
       accountId = set.activeAccountId;
       reason = "active";
     } else {
-      const picked = pickLowestUsage(config, undefined, now);
+      const picked = pickLowestUsage(config, undefined, now, decision);
       if (picked) {
         accountId = picked;
         reason = activeOk && picked === set.activeAccountId ? "active" : "lowest-usage";
@@ -659,7 +686,7 @@ export function resolveAnthropicAccountForSession(
     accountId = set.activeAccountId;
     reason = "active";
   } else {
-    const picked = pickLowestUsage(config, set.activeAccountId, now);
+    const picked = pickLowestUsage(config, set.activeAccountId, now, decision);
     if (picked) {
       accountId = picked;
       reason = "only-eligible";
@@ -667,11 +694,11 @@ export function resolveAnthropicAccountForSession(
   }
 
   if (!accountId) {
-    const anyCooled = set.accounts.some(a => isCooled(a.id, now));
-    return { accountId: null, reason: anyCooled ? "all-cooled" : "none" };
+    const anyCooled = set.accounts.some(a => (!decision || decision.accounts.includes(a.id)) && isCooled(a.id, now));
+    return { accountId: null, reason: anyCooled ? "all-cooled" : "none", routePosition: decision?.position };
   }
 
-  return { accountId, reason };
+  return { accountId, reason, routePosition: decision?.position };
 }
 
 export function bindAnthropicSessionAffinity(
@@ -707,6 +734,7 @@ export function rotateAnthropicAccountOn429(
   sessionKey?: string | null,
   now = Date.now(),
   rateLimitHeaders?: AnthropicRateLimitHeaders | null,
+  decision: AnthropicRouteDecision | null = null,
 ): string | null {
   // Reactive 429 failover is NOT gated on the pool flag. That flag buys PROACTIVE routing --
   // session affinity, quota-ranked new-session selection, autoSwitchThreshold, strategy -- all
@@ -741,15 +769,15 @@ export function rotateAnthropicAccountOn429(
   // because those dormant values remain in config. The quota picker is the neutral
   // recovery policy already used by the default strategy.
   const next = isAnthropicAccountPoolEnabled(config)
-    ? pickAlternateAnthropicAccount(config, failedAccountId, now)
+    ? pickAlternateAnthropicAccount(config, failedAccountId, now, decision)
     : pickLowestUsage(config, failedAccountId, now);
   if (!next) {
-    console.warn("[anthropic-pool] all eligible Anthropic OAuth accounts are in cooldown; returning 429");
+    console.warn(`[anthropic-pool] ${decision ? `route:#${decision.position} ` : ""}no eligible replacement; returning 429`);
     return null;
   }
 
   console.warn(
-    `[anthropic-pool] 429 on ${formatAnthropicAccountOrdinal(failedAccountId)}; failing over to ${formatAnthropicAccountOrdinal(next)}`,
+    `[anthropic-pool] ${decision ? `route:#${decision.position} ` : ""}429 on ${formatAnthropicAccountOrdinal(failedAccountId)}; failing over to ${formatAnthropicAccountOrdinal(next)}`,
   );
   return next;
 }
@@ -759,6 +787,7 @@ export interface AnthropicSelectionRoutingOptions {
   sessionKey?: string | null;
   reason?: AnthropicAccountSelectionReason;
   expectedCredentialGeneration?: string;
+  routeDecision?: AnthropicRouteDecision | null;
 }
 
 /** Commit the selected account before dispatch; rejected proposals have no routing side effects. */
@@ -767,7 +796,7 @@ export async function promoteAnthropicActiveAccount(
   expectedSelection: OAuthAccountSelection | null,
   options: AnthropicSelectionRoutingOptions,
 ): Promise<OAuthAccountSelection | null> {
-  if (!expectedSelection || !isPoolCredentialUsable(accountId, Date.now()) || isCooled(accountId, Date.now())) return null;
+  if (!expectedSelection || !routeCandidates(getEligibleAnthropicAccounts(), options.routeDecision ?? null).includes(accountId)) return null;
   const committed = await commitOAuthAccountSelection(PROVIDER, accountId, {
     expectedSelection,
     expectedCredentialGeneration: options.expectedCredentialGeneration,
@@ -784,17 +813,25 @@ export function commitAnthropicSelectionRouting(
   committed: OAuthAccountSelection,
   options: AnthropicSelectionRoutingOptions,
 ): boolean {
-  if (committed.accountId !== accountId) return false;
+  if (committed.accountId !== accountId || (options.routeDecision
+    && !routeCandidates(getEligibleAnthropicAccounts(), options.routeDecision).includes(accountId))) return false;
   const current = captureOAuthAccountSelection(PROVIDER);
   if (current?.accountId !== committed.accountId || current.revision !== committed.revision) return false;
   if (isAnthropicAccountPoolEnabled(options.config)) {
     if (anthropicPoolStrategy(options.config) === "round-robin" && options.reason !== "affinity") {
       const limit = stickyLimitForPool(options.config);
-      const picked = pickRoundRobinAccount(POOL_KEY_ANTHROPIC, getEligibleAnthropicAccounts(), limit);
+      const picked = pickRoundRobinAccount(POOL_KEY_ANTHROPIC, routeCandidates(getEligibleAnthropicAccounts(), options.routeDecision ?? null), limit);
       if (picked !== accountId) seedPoolRotationAccount(POOL_KEY_ANTHROPIC, accountId);
       notePoolRotationSuccess(POOL_KEY_ANTHROPIC, accountId, limit);
     }
-    bindAnthropicSessionAffinity(options.sessionKey, accountId);
+    const key = normalizeAffinityComponent(options.sessionKey);
+    const bound = key ? sessionAffinity.get(key) : undefined;
+    const eligibleAtCommit = options.routeDecision && bound ? getEligibleAnthropicAccounts() : [];
+    const preserveExcludedAffinity = options.routeDecision && bound && bound.accountId !== accountId
+      && Date.now() - bound.lastUsedAt <= AFFINITY_IDLE_TTL_MS
+      && eligibleAtCommit.includes(bound.accountId)
+      && !routeCandidates(eligibleAtCommit, options.routeDecision).includes(bound.accountId);
+    if (!preserveExcludedAffinity) bindAnthropicSessionAffinity(options.sessionKey, accountId);
   }
   if (manualPreference === undefined || (manualPreference?.accountId === expectedSelection.accountId
     && manualPreference.revision === expectedSelection.revision)) manualPreference = null;

package/src/oauth/devin.ts

@@ -19,7 +19,8 @@ import { DEFAULT_REGION, type WindsurfRegion } from "./devin/types";
 import { registerUser } from "./devin/register-user";
 import { DEVIN_DEFAULT_API_SERVER, resolveDevinApiBaseUrl, validateDevinApiBaseUrl } from "./devin/api-base";
 import { readDevinCliCredentialOutcome } from "./devin/cli-import";
-import { getCredential, listAccounts } from "./store";
+import { CloudAuthError, mintUserJwt } from "../adapters/devin/cloud-direct/auth";
+import { getCredential, listAccounts, type AuthStore } from "./store";
 import { DEPRECATED_OAUTH_PROVIDER_ALIASES } from "./index";
 
 export { DEVIN_DEFAULT_API_SERVER } from "./devin/api-base";
@@ -263,14 +264,143 @@ export async function loginDevin(
   return loginDevinBrowser(ctrl, DEFAULT_REGION);
 }
 
+/**
+ * A CLI-imported account follows the CLI: after `devin auth login` rewrites the
+ * credential file, the copy stored at import time is stale while the file holds
+ * a live key. The session JWT carries no expiry, so the upstream 401 is the only
+ * signal, and this re-read runs only on that forced refresh.
+ *
+ * Adoption fails closed on identity. The session token carries only a
+ * session_id, so the file key's account is established by minting a user_jwt
+ * with it (GetUserJwt answers with auth_uid and email). A key Cognition refuses
+ * (401/403) or whose token lacks auth_uid is refused; a mint that fails for any
+ * other reason throws a non-terminal error, so the account is not flagged and
+ * the next 401 retries. The minted identity must then
+ * not contradict the slot's recorded accountId or email, and no other stored
+ * account may own the key or that identity.
+ *
+ * A CLI-imported slot has no bound identity. It cannot adopt a changed key;
+ * explicit `ocx login devin` is required after its first rotation.
+ */
+/** An identity probe must not hold the per-account refresh lock for the mint's full 30s. */
+const DEVIN_IDENTITY_MINT_TIMEOUT_MS = 5_000;
+
+/** Neither a live key nor a dead one: the refresh must fail without flagging the account. */
+class DevinIdentityProbeUnavailableError extends Error {
+  constructor() {
+    super("Could not confirm the Devin CLI session identity right now; retry shortly.");
+    this.name = "DevinIdentityProbeUnavailableError";
+  }
+}
+
+const normalizedEmail = (value: string | undefined): string | undefined =>
+  value?.trim().toLowerCase() || undefined;
+
+const devinMintedIdentities = new WeakMap<OAuthCredentials, ReadonlySet<string>>();
+
+/** Recheck the minted identity and key against the locked, freshly read store. */
+export function assertDevinCliAdoptionOwnership(
+  store: AuthStore,
+  provider: string,
+  accountId: string,
+  credential: OAuthCredentials,
+): void {
+  const mintedIds = devinMintedIdentities.get(credential);
+  if (!mintedIds) return;
+  const email = normalizedEmail(credential.email);
+  for (const slot of [provider, ...devinAliasCredentialSlots(provider)]) {
+    for (const row of store[slot]?.accounts ?? []) {
+      // A legacy alias can still hold the same account id during rekey.
+      if (row.id === accountId) continue;
+      if (row.credential.access === credential.access
+        || (row.credential.accountId !== undefined && mintedIds.has(row.credential.accountId))
+        || (email !== undefined && normalizedEmail(row.credential.email) === email)) {
+        throw new DevinIdentityProbeUnavailableError();
+      }
+    }
+  }
+}
+
+async function rereadDevinCliCredential(
+  stored: OAuthCredentials,
+  signal: AbortSignal | undefined,
+  currentAccountId: string | undefined,
+): Promise<OAuthCredentials | undefined> {
+  const outcome = readDevinCliCredentialOutcome();
+  // A file that exists but cannot be read or parsed may be mid-write by `devin auth login`
+  // or briefly locked; like a failed identity mint, that says nothing about the key.
+  if (outcome.kind === "unreadable" || outcome.kind === "incomplete") throw new DevinIdentityProbeUnavailableError();
+  if (outcome.kind !== "ok" || outcome.file.apiKey === stored.access) return undefined;
+  // Without a stored identity, the CLI file may now belong to another user.
+  if (!stored.accountId && !normalizedEmail(stored.email)?.includes("@")) return undefined;
+  const apiBaseUrl = validateDevinApiBaseUrl(outcome.file.apiServerUrl);
+  if (apiBaseUrl === undefined) return undefined;
+  // A detached alias rekey can already hold this account's new key. Only a
+  // different account's key is a conflict; the locked write checks again.
+  for (const slot of ["devin", ...devinAliasCredentialSlots("devin")]) {
+    if (listAccounts(slot).some(({ id, credential }) =>
+      id !== currentAccountId && credential.access === outcome.file.apiKey)) return undefined;
+  }
+  let minted: Record<string, unknown> | undefined;
+  try {
+    const timeout = AbortSignal.timeout(DEVIN_IDENTITY_MINT_TIMEOUT_MS);
+    const probeSignal = signal ? AbortSignal.any([signal, timeout]) : timeout;
+    minted = decodeJwtPayload((await mintUserJwt(outcome.file.apiKey, apiBaseUrl, probeSignal)).jwt);
+  } catch (error) {
+    // Only Cognition refusing the key is evidence the file holds no live session. A timeout,
+    // DNS failure, 5xx or 429 says nothing about the key; flagging the account on one would
+    // strand it, because a needsReauth slot is never refreshed again.
+    if (error instanceof CloudAuthError && (error.status === 401 || error.status === 403)) return undefined;
+    throw new DevinIdentityProbeUnavailableError();
+  }
+  const authUid = typeof minted?.auth_uid === "string" && minted.auth_uid ? minted.auth_uid : undefined;
+  if (authUid === undefined) return undefined;
+  // identityFromApiKey records `sub ?? auth_uid`, so a stored id may be either claim.
+  const mintedIds = new Set([authUid, ...(typeof minted?.sub === "string" && minted.sub ? [minted.sub] : [])]);
+  const rawEmail = typeof minted?.email === "string" ? minted.email.trim() : "";
+  const email = rawEmail || undefined;
+  if (stored.accountId && !mintedIds.has(stored.accountId)) return undefined;
+  const storedEmail = normalizedEmail(stored.email);
+  if (storedEmail?.includes("@") && storedEmail !== normalizedEmail(email)) return undefined;
+  if (devinIdentityOwnedElsewhere(stored, currentAccountId, mintedIds, normalizedEmail(email))) return undefined;
+  const adopted = { ...credentialsFromApiKey(outcome.file.apiKey, apiBaseUrl, "local-cli"), accountId: authUid, ...(email ? { email } : {}) };
+  devinMintedIdentities.set(adopted, mintedIds);
+  return adopted;
+}
+
+/**
+ * Every stored Devin row except the one being refreshed, across the alias-linked slots
+ * (the active row `getCredential` reads is one of these). Rows are skipped by id; only a
+ * caller that cannot name the row falls back to matching its key.
+ */
+function devinIdentityOwnedElsewhere(
+  stored: OAuthCredentials,
+  currentAccountId: string | undefined,
+  mintedIds: ReadonlySet<string>,
+  email: string | undefined,
+): boolean {
+  for (const slot of ["devin", ...devinAliasCredentialSlots("devin")]) {
+    for (const { id, credential } of listAccounts(slot)) {
+      if (currentAccountId !== undefined ? id === currentAccountId : credential.access === stored.access) continue;
+      if (credential.accountId !== undefined && mintedIds.has(credential.accountId)) return true;
+      if (email && normalizedEmail(credential.email) === email) return true;
+    }
+  }
+  return false;
+}
+
 export async function refreshDevinToken(
   _refreshToken: string,
-  _signal?: AbortSignal,
-  _credential?: OAuthCredentials,
+  signal?: AbortSignal,
+  credential?: OAuthCredentials,
+  accountId?: string,
 ): Promise<OAuthCredentials> {
+  const reread = credential?.source === "local-cli"
+    ? await rereadDevinCliCredential(credential, signal, accountId) : undefined;
+  if (reread) return reread;
   // Cognition has no refresh endpoint. Extending the stored expiry here is what
   // the carried implementation did, and it makes a revoked key look valid
-  // forever. Throwing lets the request path mark the account needsReauth the
-  // first time a forced refresh happens.
+  // forever. Throwing on the upstream-401 forced refresh is what marks the
+  // account needsReauth.
   throw new Error("invalid_grant: Devin API keys do not refresh. Run ocx login devin again.");
 }