@bitkyc08/opencodex 2.7.42 → 2.7.43

package/src/oauth/store.ts

@@ -10,7 +10,7 @@
  * Exceptions:
  * - `chatgpt` stays single-slot (always replaced): codex-auth-api uses it as a scratch slot
  *   for Codex pool logins, which have their own ledger (codex-accounts.json).
- * - Credentials without identity (no accountId/email — e.g. kiro) replace the active slot
+ * - Credentials without identity (no accountId/email) replace the active slot
  *   instead of appending: their refresh tokens rotate, so a derived id would duplicate the
  *   same human on every re-login. Kimi extracts JWT `user_id`/`sub` as accountId; Cursor
  *   extracts JWT `sub` — both append distinct accounts under multiauth.
@@ -19,6 +19,7 @@ import { createHash, randomUUID } from "node:crypto";
 import { chmodSync, closeSync, copyFileSync, existsSync, fstatSync, mkdirSync, openSync, readFileSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { getConfigDir, atomicWriteFile, backupInvalidConfig, hardenConfigDir, hardenExistingSecret } from "../config";
+import { recordOwnedConfigPath } from "../lib/config-ownership";
 import { validateCopilotApiBaseUrl } from "./github-copilot";
 import type { OAuthCredentialSource, OAuthCredentials, ProviderAccount, ProviderAccountSet } from "./types";
 
@@ -150,7 +151,7 @@ function sameFd(a: LockSnapshot,b: ReturnType<typeof fstatSync>): boolean { retu
 export function createOAuthFileLock(options: OAuthFileLockOptions): { acquire(): Promise<OAuthFileLockGuard> } {
  const wait=options.waitTimeoutMs??5000, stale=options.staleAfterMs??120000, min=options.pollMinMs??25,max=options.pollMaxMs??100,sleep=options.sleep??(ms=>Bun.sleep(ms)),now=options.now??Date.now,random=options.random??Math.random,write=options.writeMetadata??((fd,b)=>writeFileSync(fd,b,"utf8"));
  if(wait<0||stale<=0||min<0||max<min) throw new OAuthFileLockError("Invalid OAuth file-lock timing options");
- return { async acquire() { hardenConfigDir(); if(!existsSync(getConfigDir())) mkdirSync(getConfigDir(),{recursive:true,mode:0o700}); const ownerId=randomUUID(),started=now(); for(;;){ let fd:number|undefined; try { fd=openSync(options.path,"wx",0o600); const bytes=`${JSON.stringify({version:1,ownerId,pid:process.pid,createdAt:now()})}\n`; write(fd,bytes); const fs=fstatSync(fd); closeSync(fd); fd=undefined; const owned=snapshot(options.path); if(owned.bytes!==bytes||!sameFd(owned,fs)) throw new OAuthFileLockError("OAuth lock changed during creation"); let released=false; return {ownerId,release(){if(released)return;released=true;try{const a=snapshot(options.path);if(!sameSnapshot(owned,a))return;options.beforeReleaseUnlink?.();const b=snapshot(options.path);if(sameSnapshot(owned,b))unlinkSync(options.path);}catch(e){if(errorCode(e)!=="ENOENT")console.warn(`[oauth] lock release failed: ${e instanceof Error?e.message:String(e)}`);}}}; } catch(e) { if(fd!==undefined){let fs;try{fs=fstatSync(fd);}catch{}try{closeSync(fd);}catch{}if(fs)try{const a=snapshot(options.path);if(sameFd(a,fs)){options.beforeFailedCreateUnlink?.();const b=snapshot(options.path);if(sameSnapshot(a,b)&&sameFd(b,fs))unlinkSync(options.path);}}catch{}} if(errorCode(e)!=="EEXIST")throw e instanceof OAuthFileLockError?e:new OAuthFileLockError("Could not create OAuth file lock",{cause:e}); }
+ return { async acquire() { hardenConfigDir(); recordOwnedConfigPath(getConfigDir(),options.path); if(!existsSync(getConfigDir())) mkdirSync(getConfigDir(),{recursive:true,mode:0o700}); const ownerId=randomUUID(),started=now(); for(;;){ let fd:number|undefined; try { fd=openSync(options.path,"wx",0o600); const bytes=`${JSON.stringify({version:1,ownerId,pid:process.pid,createdAt:now()})}\n`; write(fd,bytes); const fs=fstatSync(fd); closeSync(fd); fd=undefined; const owned=snapshot(options.path); if(owned.bytes!==bytes||!sameFd(owned,fs)) throw new OAuthFileLockError("OAuth lock changed during creation"); let released=false; return {ownerId,release(){if(released)return;released=true;try{const a=snapshot(options.path);if(!sameSnapshot(owned,a))return;options.beforeReleaseUnlink?.();const b=snapshot(options.path);if(sameSnapshot(owned,b))unlinkSync(options.path);}catch(e){if(errorCode(e)!=="ENOENT")console.warn(`[oauth] lock release failed: ${e instanceof Error?e.message:String(e)}`);}}}; } catch(e) { if(fd!==undefined){let fs;try{fs=fstatSync(fd);}catch{}try{closeSync(fd);}catch{}if(fs)try{const a=snapshot(options.path);if(sameFd(a,fs)){options.beforeFailedCreateUnlink?.();const b=snapshot(options.path);if(sameSnapshot(a,b)&&sameFd(b,fs))unlinkSync(options.path);}}catch{}} if(errorCode(e)!=="EEXIST")throw e instanceof OAuthFileLockError?e:new OAuthFileLockError("Could not create OAuth file lock",{cause:e}); }
  try{const a=snapshot(options.path);let created=a.mtimeMs;try{const p=JSON.parse(a.bytes);if(typeof p.createdAt==="number")created=Math.max(created,p.createdAt);}catch{}if(now()-created>stale){options.beforeStaleUnlink?.();const b=snapshot(options.path);if(sameSnapshot(a,b))unlinkSync(options.path);continue;}}catch(e){if(errorCode(e)==="ENOENT")continue;throw new OAuthFileLockError("Could not inspect OAuth file lock",{cause:e});} const elapsed=now()-started;if(elapsed>=wait)throw new OAuthFileLockError(`Timed out after ${wait}ms waiting for OAuth file lock`);await sleep(Math.min(wait-elapsed,min+Math.floor(random()*(max-min+1)))); } } };
 }
 /** Wait long enough for slow IdP refreshes (e.g. Cursor 15s × 3 attempts) before timing out. */
@@ -206,6 +207,28 @@ function normalizeCredential(cred: unknown): OAuthCredentials | null {
     const validated = validateCopilotApiBaseUrl(candidate.apiBaseUrl);
     if (validated) normalized.apiBaseUrl = validated;
   }
+  if (candidate.kiro && typeof candidate.kiro === "object") {
+    const kiro = candidate.kiro;
+    const clean = (value: unknown, max: number): string | undefined => {
+      if (typeof value !== "string") return undefined;
+      const trimmed = value.trim();
+      return trimmed && trimmed.length <= max && !/[\x00-\x1f\x7f]/.test(trimmed) ? trimmed : undefined;
+    };
+    const profileArn = clean(kiro.profileArn, 1024);
+    const ssoRegion = clean(kiro.ssoRegion, 64);
+    const apiRegion = clean(kiro.apiRegion, 64);
+    const clientId = clean(kiro.clientId, 4096);
+    const clientSecret = clean(kiro.clientSecret, 4096);
+    if (profileArn || ssoRegion || apiRegion || clientId || clientSecret) {
+      normalized.kiro = {
+        ...(profileArn ? { profileArn } : {}),
+        ...(ssoRegion ? { ssoRegion } : {}),
+        ...(apiRegion ? { apiRegion } : {}),
+        ...(clientId ? { clientId } : {}),
+        ...(clientSecret ? { clientSecret } : {}),
+      };
+    }
+  }
   return normalized;
 }
 
@@ -293,7 +316,11 @@ export function getCredential(provider: string): OAuthCredentials | null {
  * (rotating refresh tokens would fabricate duplicates) and single-slot providers replace the
  * active slot / whole set instead.
  */
-export async function saveCredential(provider: string, cred: OAuthCredentials): Promise<void> {
+export async function saveCredential(
+  provider: string,
+  cred: OAuthCredentials,
+  opts: { preserveIdentityless?: boolean } = {},
+): Promise<void> {
   const safe = normalizeCredential(cred);
   if (!safe) return;
   await mutateStore(store => {
@@ -317,7 +344,7 @@ export async function saveCredential(provider: string, cred: OAuthCredentials):
       // active identity-less row in place prevents a stale duplicate that stays selectable
       // and would re-refresh into a second row with the same identity.
       const active = set.accounts.find(a => a.id === set.activeAccountId);
-      if (active && active.credential.accountId === undefined && active.credential.email === undefined) {
+      if (!opts.preserveIdentityless && active && active.credential.accountId === undefined && active.credential.email === undefined) {
         active.credential = safe;
         delete active.needsReauth;
         return;
@@ -418,6 +445,29 @@ export async function removeAccount(provider: string, accountId: string): Promis
   });
 }
 
+/** Replace or clear a provider account set (used for transactional Kiro add-account rollback). */
+export async function replaceProviderAccountSet(
+  provider: string,
+  set: ProviderAccountSet | null,
+): Promise<void> {
+  await mutateStore(store => {
+    if (!set || set.accounts.length === 0) {
+      delete store[provider];
+      return;
+    }
+    store[provider] = {
+      activeAccountId: set.activeAccountId,
+      accounts: set.accounts.map(account => ({
+        id: account.id,
+        credential: { ...account.credential, ...(account.credential.kiro ? { kiro: { ...account.credential.kiro } } : {}) },
+        ...(account.alias ? { alias: account.alias } : {}),
+        ...(account.needsReauth ? { needsReauth: true } : {}),
+        ...(account.addedAt !== undefined ? { addedAt: account.addedAt } : {}),
+      })),
+    };
+  });
+}
+
 export async function markAccountNeedsReauth(provider: string, accountId: string, needsReauth: boolean): Promise<void> {
   await mutateStore(store => {
     const account = store[provider]?.accounts.find(a => a.id === accountId);

package/src/oauth/types.ts

@@ -1,6 +1,15 @@
 /** Minimal OAuth types, ported from jawcode packages/ai/src/utils/oauth/types.ts. */
 export type OAuthCredentialSource = "oauth" | "local-cli" | "credential-file" | "environment" | "manual";
 
+/** Account-scoped Kiro data required for refresh and request routing. */
+export interface KiroOAuthMetadata {
+  profileArn?: string;
+  ssoRegion?: string;
+  apiRegion?: string;
+  clientId?: string;
+  clientSecret?: string;
+}
+
 export type OAuthCredentials = {
   refresh: string;
   access: string;
@@ -15,6 +24,8 @@ export type OAuthCredentials = {
    * Never reuse for Antigravity projectId; validated on write and again at request time.
    */
   apiBaseUrl?: string;
+  /** Never returned by management APIs; persisted only inside the protected auth-store boundary. */
+  kiro?: KiroOAuthMetadata;
 };
 
 /** One logged-in account inside a provider's account set (multiauth). */

package/src/providers/alibaba-region-migration.ts

@@ -2,6 +2,7 @@ import { ALIBABA_INTL_BASE_URL_CHOICES } from "./base-url-choices";
 import { providerConfigSeed } from "./derive";
 import { rewriteProviderReferences } from "./provider-id-rewrite";
 import { PROVIDER_REGISTRY } from "./registry";
+import { codexAccountNamespaceProviderCollisionError } from "../codex/account-namespace-match";
 import type { OcxConfig, OcxProviderConfig } from "../types";
 
 const BEIJING_ID = "alibaba-token-plan";
@@ -91,9 +92,10 @@ function buildIntlRow(source: OcxProviderConfig): OcxProviderConfig {
  * those contracts across. That override fix shipped once, was backed out twice,
  * and was refused again when PR #459 closed.
  *
- * Refuses to act when the destination already holds a value — a provider row or a
- * key the reference rewrite would land on — because merging two settings is a
- * user decision, not a migration's.
+ * Refuses to act when the destination is reserved by an account namespace or
+ * already holds a value — a provider row or a key the reference rewrite would
+ * land on — because choosing which setting wins is a user decision, not a
+ * migration's.
  */
 export function projectAlibabaRegionMigration(config: OcxConfig): AlibabaRegionMigrationProjection {
   const beijing = config.providers[BEIJING_ID];
@@ -101,6 +103,17 @@ export function projectAlibabaRegionMigration(config: OcxConfig): AlibabaRegionM
   if (!beijing || !savedBaseUrl || !isInternationalEndpoint(savedBaseUrl)) {
     return { config, changed: false, warnings: [] };
   }
+  if (codexAccountNamespaceProviderCollisionError(config.codexAccountNamespaces, INTL_ID)) {
+    return {
+      config,
+      changed: false,
+      warnings: [
+        `provider "${BEIJING_ID}" needs to move to "${INTL_ID}", but that destination is reserved `
+        + `by a configured Codex account namespace. Nothing was changed. Rename the account `
+        + `selector or move the provider manually, then restart.`,
+      ],
+    };
+  }
   if (config.providers[INTL_ID]) {
     return {
       config,

package/src/providers/antigravity-models.ts

@@ -13,6 +13,7 @@ const ANTIGRAVITY_WIRE_MODELS = [
   "gemini-3.6-flash-high",
   "gemini-3.1-pro-low",
   "gemini-pro-agent",
+  "gemini-3.1-flash-image",
   "claude-sonnet-4-6",
   "claude-opus-4-6-thinking",
   "gpt-oss-120b-medium",
@@ -85,6 +86,7 @@ export const ANTIGRAVITY_MODEL_ALIASES: Record<string, string> = {
 export const ANTIGRAVITY_MODELS = [
   "gemini-3.6-flash",
   "gemini-3.1-pro",
+  "gemini-3.1-flash-image",
   "claude-sonnet-4-6",
   "claude-opus-4-6-thinking",
   "gpt-oss-120b-medium",
@@ -97,6 +99,7 @@ const ANTIGRAVITY_WIRE_MODEL_CONTEXT_WINDOWS: Record<string, number> = {
   "gemini-3.6-flash-high": 1_048_576,
   "gemini-3.1-pro-low": 1_048_576,
   "gemini-pro-agent": 1_048_576,
+  "gemini-3.1-flash-image": 1_048_576,
   "claude-sonnet-4-6": 200_000,
   "claude-opus-4-6-thinking": 1_000_000,
   "gpt-oss-120b-medium": 131_072,

package/src/providers/api-keys.ts

@@ -30,7 +30,7 @@ export function maskApiKey(value: string): string {
 }
 
 /** Content-derived id: re-adding the same key upserts instead of duplicating. */
-function keyId(key: string): string {
+export function apiKeyPoolEntryId(key: string): string {
   return createHash("sha256").update(key).digest("hex").slice(0, 8);
 }
 
@@ -39,11 +39,18 @@ export function isKeyAuthProvider(provider: OcxProviderConfig): boolean {
   return provider.authMode !== "oauth" && provider.authMode !== "forward";
 }
 
+/** Trim and reject blank / CRLF-bearing secrets. Shared by pool writes and OAuth upsert. */
+export function sanitizeApiKeyValue(value: unknown): string | undefined {
+  if (typeof value !== "string") return undefined;
+  const trimmed = value.trim();
+  return trimmed && !/[\r\n]/.test(trimmed) ? trimmed : undefined;
+}
+
 /** Seed the pool from a legacy bare `apiKey`, and keep `apiKey` mirrored to the active entry. */
 function ensurePool(provider: OcxProviderConfig): NonNullable<OcxProviderConfig["apiKeyPool"]> {
   if (!provider.apiKeyPool) provider.apiKeyPool = [];
   if (provider.apiKeyPool.length === 0 && provider.apiKey) {
-    provider.apiKeyPool.push({ id: keyId(provider.apiKey), key: provider.apiKey });
+    provider.apiKeyPool.push({ id: apiKeyPoolEntryId(provider.apiKey), key: provider.apiKey });
   }
   return provider.apiKeyPool;
 }
@@ -75,11 +82,11 @@ export function listProviderApiKeys(config: OcxConfig, name: string): { activeId
 export function addProviderApiKey(config: OcxConfig, name: string, key: string, label?: string): { id: string } | { error: string } {
   const provider = config.providers[name];
   if (!provider || !isKeyAuthProvider(provider)) return { error: "provider does not use API-key auth" };
-  const trimmed = key.trim();
-  if (!trimmed) return { error: "key is required" };
-  if (/[\r\n]/.test(trimmed)) return { error: "key must not include line breaks" };
+  if (typeof key !== "string" || !key.trim()) return { error: "key is required" };
+  const trimmed = sanitizeApiKeyValue(key);
+  if (!trimmed) return { error: "key must not include line breaks" };
   const pool = ensurePool(provider);
-  const id = keyId(trimmed);
+  const id = apiKeyPoolEntryId(trimmed);
   const existing = pool.find(e => e.id === id);
   if (existing) {
     if (label?.trim()) existing.label = label.trim();

package/src/providers/derive.ts

@@ -5,6 +5,7 @@ export interface DerivedKeyLoginProvider {
   label: string;
   baseUrl: string;
   adapter: string;
+  apiKeyTransport?: OcxProviderConfig["apiKeyTransport"];
   dashboardUrl: string;
   models?: string[];
   liveModels?: boolean;
@@ -103,6 +104,7 @@ export function providerConfigSeed(entry: ProviderRegistryEntry): OcxProviderCon
   return {
     adapter: entry.adapter,
     baseUrl: entry.baseUrl,
+    ...(entry.apiKeyTransport !== undefined ? { apiKeyTransport: entry.apiKeyTransport } : {}),
     authMode: entry.authKind === "local" ? undefined : entry.authKind,
     ...(entry.codexAccountMode ? { codexAccountMode: entry.codexAccountMode } : {}),
     ...(entry.keyOptional !== undefined ? { keyOptional: entry.keyOptional } : {}),
@@ -129,6 +131,7 @@ export function providerConfigSeed(entry: ProviderRegistryEntry): OcxProviderCon
     ...(entry.noTopPModels ? { noTopPModels: [...entry.noTopPModels] } : {}),
     ...(entry.noPenaltyModels ? { noPenaltyModels: [...entry.noPenaltyModels] } : {}),
     ...(entry.parallelToolCalls !== undefined ? { parallelToolCalls: entry.parallelToolCalls } : {}),
+    ...(entry.promptCacheKey !== undefined ? { promptCacheKey: entry.promptCacheKey } : {}),
     ...(entry.autoToolChoiceOnlyModels ? { autoToolChoiceOnlyModels: [...entry.autoToolChoiceOnlyModels] } : {}),
     ...(entry.preserveReasoningContentModels ? { preserveReasoningContentModels: [...entry.preserveReasoningContentModels] } : {}),
     ...(entry.reasoningSplitModels ? { reasoningSplitModels: [...entry.reasoningSplitModels] } : {}),
@@ -150,6 +153,7 @@ export function deriveKeyLoginMap(): Record<string, DerivedKeyLoginProvider> {
       label: entry.label,
       baseUrl: entry.baseUrl,
       adapter: entry.adapter,
+      ...(entry.apiKeyTransport !== undefined ? { apiKeyTransport: entry.apiKeyTransport } : {}),
       dashboardUrl: entry.dashboardUrl,
       ...(entry.models ? { models: [...entry.models] } : {}),
       ...(entry.liveModels !== undefined ? { liveModels: entry.liveModels } : {}),
@@ -221,6 +225,7 @@ export function enrichProviderFromRegistry(name: string, prov: OcxProviderConfig
   const entry = PROVIDER_REGISTRY.find(row => row.id === name);
   if (!entry) return;
   const seed = providerConfigSeed(entry);
+  if (prov.apiKeyTransport === undefined && seed.apiKeyTransport !== undefined) prov.apiKeyTransport = seed.apiKeyTransport;
   if (!prov.defaultModel && seed.defaultModel) prov.defaultModel = seed.defaultModel;
   // Fill mode only when absent: an explicit persisted `direct` must never be overwritten.
   if (prov.codexAccountMode === undefined && seed.codexAccountMode !== undefined) prov.codexAccountMode = seed.codexAccountMode;
@@ -242,6 +247,7 @@ export function enrichProviderFromRegistry(name: string, prov: OcxProviderConfig
   if (!prov.noTopPModels && seed.noTopPModels) prov.noTopPModels = [...seed.noTopPModels];
   if (!prov.noPenaltyModels && seed.noPenaltyModels) prov.noPenaltyModels = [...seed.noPenaltyModels];
   if (prov.parallelToolCalls === undefined && seed.parallelToolCalls !== undefined) prov.parallelToolCalls = seed.parallelToolCalls;
+  if (prov.promptCacheKey === undefined && seed.promptCacheKey !== undefined) prov.promptCacheKey = seed.promptCacheKey;
   if (!prov.autoToolChoiceOnlyModels && seed.autoToolChoiceOnlyModels) prov.autoToolChoiceOnlyModels = [...seed.autoToolChoiceOnlyModels];
   if (!prov.preserveReasoningContentModels && seed.preserveReasoningContentModels) prov.preserveReasoningContentModels = [...seed.preserveReasoningContentModels];
   if (!prov.reasoningSplitModels && seed.reasoningSplitModels) prov.reasoningSplitModels = [...seed.reasoningSplitModels];

package/src/providers/key-failover.ts

@@ -10,7 +10,7 @@
  */
 import { saveConfigPreservingClaudeCode } from "../config";
 import type { OcxConfig, OcxProviderConfig } from "../types";
-import { resolveProviderTransport } from "./xai-transport";
+import { resolveProviderTransport, type OcxProviderTransport } from "./xai-transport";
 
 // ---- cooldown state (in-memory, same as codex/routing.ts) ----
 
@@ -69,6 +69,11 @@ export function hasKeyPoolFailover(provider: OcxProviderConfig): boolean {
  *
  * @returns A new OcxProviderConfig with the swapped key (and mutated config on disk),
  *          or `null` when no alternative key is available (all in cooldown or pool < 2).
+ *
+ * The returned object is a snapshot of the PERSISTED config — it carries none of the
+ * registry backfills `routedProviderConfig` merges in at request time. Request paths must
+ * not assign it to an active route wholesale; use `rotateProviderTransportOn429`, which
+ * takes only the swapped key and keeps the routed provider intact.
  */
 export function rotateKeyOn429(
   config: OcxConfig,
@@ -133,12 +138,23 @@ interface RotateProviderTransportOptions {
   promptCacheKey?: string;
 }
 
-/** Rotate a failed key and re-apply provider-specific transport metadata to the replacement. */
+/**
+ * Rotate a failed key and re-apply provider-specific transport metadata to the replacement.
+ *
+ * `routedProvider` is the request's active provider (the `routedProviderConfig` output the
+ * route was built with). The result inherits it and swaps ONLY the API key: the persisted
+ * config that `rotateKeyOn429` snapshots predates registry backfill, so building the retry
+ * provider from that snapshot would silently drop every field the registry merged in at
+ * routing time (scalar flags like `promptCacheKey`/`parallelToolCalls`, merged model
+ * metadata such as `noTemperatureModels`, a pinned baseUrl). Mirrors the OAuth-401 replay
+ * path in src/server/responses/core.ts, which spreads `route.provider` for the same reason.
+ */
 export function rotateProviderTransportOn429(
   config: OcxConfig,
   providerName: string,
+  routedProvider: OcxProviderTransport,
   options: RotateProviderTransportOptions = {},
-): OcxProviderConfig | null {
+): OcxProviderTransport | null {
   const rotated = rotateKeyOn429(
     config,
     providerName,
@@ -147,7 +163,11 @@ export function rotateProviderTransportOn429(
     options.attemptedKey,
   );
   return rotated
-    ? resolveProviderTransport(providerName, rotated, options.promptCacheKey)
+    ? resolveProviderTransport(
+        providerName,
+        { ...routedProvider, apiKey: rotated.apiKey },
+        options.promptCacheKey,
+      )
     : null;
 }
 

package/src/providers/quota.ts

@@ -1,13 +1,16 @@
 import { fetchMainAccountInfo, listCodexAuthAccounts } from "../codex/auth-api";
 import { MAIN_CODEX_ACCOUNT_ID } from "../codex/main-account";
 import { resolveEnvValue } from "../config";
-import { getValidAccessToken } from "../oauth";
-import { getCredential } from "../oauth/store";
+import { getValidAccessToken, getValidAccessTokenForAccount } from "../oauth";
+import { getAccountCredential, getAccountSet, getCredential } from "../oauth/store";
 import { antigravityUserAgent } from "../adapters/client-fingerprint";
 import { getProviderRegistryEntry, providerCodexAccountMode } from "./registry";
 import type { OcxConfig, OcxProviderConfig } from "../types";
 import { isCanonicalOpenAiForwardProvider, OPENAI_CODEX_PROVIDER_ID } from "./openai-tiers";
 
+/** Match oauth/index REFRESH_SKEW_MS — use stored access without refresh when still fresh. */
+const ACCOUNT_TOKEN_SKEW_MS = 60_000;
+
 const CACHE_TTL_MS = 5 * 60_000;
 const REQUEST_TIMEOUT_MS = 8_000;
 const KIMI_CODE_BASE_URL = "https://api.kimi.com/coding/v1";
@@ -188,43 +191,244 @@ function parseClaudeBucket(value: unknown): { percent?: number; resetAt?: number
   return { percent, resetAt };
 }
 
+/** Claude's OAuth usage endpoint, probed with ONE account's own bearer token. */
+const anthropicUsageInflight = new Map<string, Promise<ProviderQuota | null>>();
+
+async function fetchAnthropicUsageQuota(accessToken: string): Promise<ProviderQuota | null> {
+  const joinable = anthropicUsageInflight.get(accessToken);
+  if (joinable) return joinable;
+
+  const probe = (async (): Promise<ProviderQuota | null> => {
+    const response = await fetch("https://api.anthropic.com/api/oauth/usage", {
+      headers: {
+        Accept: "application/json, text/plain, */*",
+        "Content-Type": "application/json",
+        "User-Agent": "claude-cli/2.1.63 (external, cli)",
+        "anthropic-beta": "claude-code-20250219,oauth-2025-04-20,interleaved-thinking-2025-05-14,context-management-2025-06-27,prompt-caching-scope-2026-01-05",
+        Authorization: `Bearer ${accessToken}`,
+      },
+      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+    });
+    if (!response.ok) return null;
+    const body = asRecord(await response.json().catch(() => null));
+    if (!body) return null;
+    const fiveHour = parseClaudeBucket(body.five_hour);
+    const sevenDay = parseClaudeBucket(body.seven_day);
+    const opus = parseClaudeBucket(body.seven_day_opus);
+    const sonnet = parseClaudeBucket(body.seven_day_sonnet);
+    const customWindows: ProviderQuotaWindow[] = [];
+    if (opus?.percent !== undefined) customWindows.push({ label: "Opus", percent: opus.percent, ...(opus.resetAt !== undefined ? { resetAt: opus.resetAt } : {}) });
+    if (sonnet?.percent !== undefined) customWindows.push({ label: "Sonnet", percent: sonnet.percent, ...(sonnet.resetAt !== undefined ? { resetAt: sonnet.resetAt } : {}) });
+    const quota: ProviderQuota = {
+      // Claude's 5-hour window is a first-class rate limit, same as the Codex login 5h/weekly
+      // rows: report it in the canonical fields so the dashboard renders it with the standard
+      // "5-hour limit" label and ordering instead of as a generic extra window.
+      ...(fiveHour?.percent !== undefined ? { fiveHourPercent: fiveHour.percent } : {}),
+      ...(fiveHour?.resetAt !== undefined ? { fiveHourResetAt: fiveHour.resetAt } : {}),
+      ...(sevenDay?.percent !== undefined ? { weeklyPercent: sevenDay.percent } : {}),
+      ...(sevenDay?.resetAt !== undefined ? { weeklyResetAt: sevenDay.resetAt } : {}),
+      ...(customWindows.length > 0 ? { customWindows } : {}),
+      updatedAt: Date.now(),
+    };
+    // Empty / schema-changed payloads must not cache as "success with no bars".
+    return hasQuotaRows(quota) ? quota : null;
+  })().finally(() => {
+    if (anthropicUsageInflight.get(accessToken) === probe) anthropicUsageInflight.delete(accessToken);
+  });
+  anthropicUsageInflight.set(accessToken, probe);
+  return probe;
+}
+
 async function fetchAnthropicQuota(provider: string): Promise<ProviderQuotaReport | null> {
+  // Capture the account we intend to probe before awaiting — a mid-flight active
+  // switch must not seed the wrong account's cache with this response.
+  const probedAccountId = getAccountSet("anthropic")?.activeAccountId;
   let accessToken: string;
   try {
     accessToken = await getValidAccessToken("anthropic");
   } catch {
     return null;
   }
-  const response = await fetch("https://api.anthropic.com/api/oauth/usage", {
-    headers: {
-      Accept: "application/json, text/plain, */*",
-      "Content-Type": "application/json",
-      "User-Agent": "claude-cli/2.1.63 (external, cli)",
-      "anthropic-beta": "claude-code-20250219,oauth-2025-04-20,interleaved-thinking-2025-05-14,context-management-2025-06-27,prompt-caching-scope-2026-01-05",
-      Authorization: `Bearer ${accessToken}`,
-    },
-    signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
-  });
-  if (!response.ok) return null;
-  const body = asRecord(await response.json().catch(() => null));
-  if (!body) return null;
-  const fiveHour = parseClaudeBucket(body.five_hour);
-  const sevenDay = parseClaudeBucket(body.seven_day);
-  const opus = parseClaudeBucket(body.seven_day_opus);
-  const sonnet = parseClaudeBucket(body.seven_day_sonnet);
-  const customWindows: ProviderQuotaWindow[] = [];
-  if (fiveHour?.percent !== undefined) customWindows.push({ label: "5h", percent: fiveHour.percent, ...(fiveHour.resetAt !== undefined ? { resetAt: fiveHour.resetAt } : {}) });
-  if (opus?.percent !== undefined) customWindows.push({ label: "Opus", percent: opus.percent, ...(opus.resetAt !== undefined ? { resetAt: opus.resetAt } : {}) });
-  if (sonnet?.percent !== undefined) customWindows.push({ label: "Sonnet", percent: sonnet.percent, ...(sonnet.resetAt !== undefined ? { resetAt: sonnet.resetAt } : {}) });
-  const quota: ProviderQuota = {
-    ...(sevenDay?.percent !== undefined ? { weeklyPercent: sevenDay.percent } : {}),
-    ...(sevenDay?.resetAt !== undefined ? { weeklyResetAt: sevenDay.resetAt } : {}),
-    ...(customWindows.length > 0 ? { customWindows } : {}),
-    updatedAt: Date.now(),
-  };
+  const quota = await fetchAnthropicUsageQuota(accessToken);
+  if (!quota) return null;
+  // Share the active-account probe with the per-account cache so Providers-page
+  // loads do not double-hit Anthropic's rate-limited usage endpoint.
+  if (probedAccountId) {
+    const stillOwnsToken = getAccountCredential("anthropic", probedAccountId)?.access === accessToken;
+    if (stillOwnsToken) {
+      accountQuotaCache.set(accountCacheKey("anthropic", probedAccountId), { ts: Date.now(), quota });
+    }
+  }
   return report(provider, "anthropic:oauth-usage", quota);
 }
 
+// ---------------------------------------------------------------------------
+// Per-account quota (multiauth)
+// ---------------------------------------------------------------------------
+
+/**
+ * Anthropic reports usage per CREDENTIAL, so every logged-in account can be probed with its
+ * own bearer token — the active-account selection and the local usage log are irrelevant here.
+ * Mirrors the Codex pool behaviour (codex/auth-api.ts:fetchPoolAccountQuota), including a
+ * per-account TTL so N accounts cost at most N upstream calls per window.
+ *
+ * The TTL is deliberately longer than the provider-level one: this path multiplies by account
+ * count, and Anthropic rate-limits the usage endpoint (observed 429 under repeated probing).
+ */
+const ACCOUNT_QUOTA_TTL_MS = 10 * 60_000;
+type AccountQuotaCacheEntry = {
+  ts: number;
+  quota: ProviderQuota | null;
+  /** Last probe failed (429 / network / expired login); still may hold last-good quota. */
+  unavailable?: true;
+};
+const accountQuotaCache = new Map<string, AccountQuotaCacheEntry>();
+const accountQuotaInflight = new Map<string, Promise<AccountQuotaCacheEntry>>();
+
+export interface ProviderAccountQuota {
+  accountId: string;
+  quota: ProviderQuota | null;
+  /** Set when the probe could not reach upstream (expired login, 429, network). */
+  unavailable?: true;
+}
+
+/** Providers whose per-account quota can be probed. Extend as other OAuth APIs are covered. */
+export function supportsPerAccountQuota(provider: string): boolean {
+  return provider === "anthropic";
+}
+
+function accountCacheKey(provider: string, accountId: string): string {
+  return `${provider}\u0000${accountId}`;
+}
+
+/**
+ * Synchronous last-good per-account quota read for routing. Never probes the network.
+ * Returns null when nothing is cached (or the cached row has no bars).
+ */
+export function getCachedProviderAccountQuota(provider: string, accountId: string): ProviderQuota | null {
+  const entry = accountQuotaCache.get(accountCacheKey(provider, accountId));
+  return entry?.quota ?? null;
+}
+
+/** Test-only: seed or clear the per-account quota cache without probing upstream. */
+export function setCachedProviderAccountQuotaForTests(
+  provider: string,
+  accountId: string,
+  quota: ProviderQuota | null,
+): void {
+  const key = accountCacheKey(provider, accountId);
+  if (quota === null) {
+    accountQuotaCache.delete(key);
+    return;
+  }
+  accountQuotaCache.set(key, { ts: Date.now(), quota });
+}
+
+/** Drop cached per-account rows (all, or just one provider's). */
+export function clearAccountQuotaCache(provider?: string): void {
+  if (!provider) {
+    accountQuotaCache.clear();
+    accountQuotaInflight.clear();
+    return;
+  }
+  const prefix = `${provider}\u0000`;
+  for (const key of [...accountQuotaCache.keys()]) {
+    if (key.startsWith(prefix)) accountQuotaCache.delete(key);
+  }
+  // Drop in-flight probes too so a late resolve cannot repopulate after logout/remove.
+  for (const key of [...accountQuotaInflight.keys()]) {
+    if (key.startsWith(prefix)) accountQuotaInflight.delete(key);
+  }
+}
+
+/**
+ * Resolve a bearer for quota probing without silently adopting a newer global
+ * Claude CLI credential into a background multiauth slot.
+ *
+ * - Fresh stored access → use as-is (no refresh).
+ * - Active account with expired access → normal refresh path.
+ * - Background `local-cli` with expired access → fail closed (unavailable):
+ *   `getValidAccessTokenForAccount` can persist a mismatched Claude CLI identity.
+ * - Background ordinary OAuth (`source !== "local-cli"`) → safe to refresh;
+ *   Anthropic's lock only adopts disk credentials for `local-cli` rows.
+ */
+async function getTokenForAccountQuotaProbe(provider: string, accountId: string): Promise<string> {
+  const stored = getAccountCredential(provider, accountId);
+  if (!stored) throw new Error("account credential missing");
+  if (stored.expires > Date.now() + ACCOUNT_TOKEN_SKEW_MS) return stored.access;
+  const activeId = getAccountSet(provider)?.activeAccountId;
+  if (activeId !== accountId && stored.source === "local-cli") {
+    throw new Error("background local-cli token expired; skip CLI-adopting refresh for quota probe");
+  }
+  return getValidAccessTokenForAccount(provider, accountId);
+}
+
+async function fetchAccountQuota(
+  provider: string,
+  accountId: string,
+  forceRefresh: boolean,
+): Promise<AccountQuotaCacheEntry> {
+  const key = accountCacheKey(provider, accountId);
+  const cached = accountQuotaCache.get(key);
+  if (!forceRefresh && cached && Date.now() - cached.ts < ACCOUNT_QUOTA_TTL_MS) return cached;
+  const joinable = accountQuotaInflight.get(key);
+  if (joinable) return joinable;
+
+  const probe = (async (): Promise<AccountQuotaCacheEntry> => {
+    try {
+      const token = await getTokenForAccountQuotaProbe(provider, accountId);
+      const quota = await fetchAnthropicUsageQuota(token);
+      if (!quota) {
+        // Preserve last-good bars and mark unavailable; advance TTL so failures
+        // negative-cache instead of re-probing on every GUI poll.
+        const entry: AccountQuotaCacheEntry = {
+          ts: Date.now(),
+          quota: cached?.quota ?? null,
+          unavailable: true,
+        };
+        accountQuotaCache.set(key, entry);
+        return entry;
+      }
+      const entry: AccountQuotaCacheEntry = { ts: Date.now(), quota };
+      accountQuotaCache.set(key, entry);
+      return entry;
+    } catch {
+      const entry: AccountQuotaCacheEntry = {
+        ts: Date.now(),
+        quota: cached?.quota ?? null,
+        unavailable: true,
+      };
+      accountQuotaCache.set(key, entry);
+      return entry;
+    }
+  })().finally(() => {
+    if (accountQuotaInflight.get(key) === probe) accountQuotaInflight.delete(key);
+  });
+  accountQuotaInflight.set(key, probe);
+  return probe;
+}
+
+/**
+ * Per-account quota rows for a provider's logged-in accounts. Probes run in parallel; a
+ * single failing account never blocks the others.
+ */
+export async function fetchProviderAccountQuotas(
+  provider: string,
+  forceRefresh = false,
+): Promise<ProviderAccountQuota[]> {
+  if (!supportsPerAccountQuota(provider)) return [];
+  const set = getAccountSet(provider);
+  if (!set) return [];
+  return await Promise.all(set.accounts.map(async account => {
+    const entry = await fetchAccountQuota(provider, account.id, forceRefresh);
+    return {
+      accountId: account.id,
+      quota: entry.quota,
+      ...(entry.unavailable ? { unavailable: true as const } : {}),
+    };
+  }));
+}
+
 function normalizedBaseUrl(value: string): string | null {
   try {
     const url = new URL(value);