@bitkyc08/opencodex 2.7.42 → 2.7.43

package/src/server/management/agent-settings-routes.ts

@@ -11,6 +11,7 @@ import {
   providerBaseUrlConfigError,
   providerHeadersConfigError,
   saveConfigPreservingClaudeCode,
+  subagentDefaultSyncEffective,
 } from "../../config";
 import {
   clearLoginState,
@@ -190,6 +191,7 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
       )));
     return jsonResponse({
       multiAgentGuidanceEnabled: multiAgentGuidanceEnabled(config),
+      syncCodexSubagentDefaults: subagentDefaultSyncEffective(config),
       model: config.injectionModel ?? null,
       effort: config.injectionEffort ?? null,
       prompt: config.injectionPrompt ?? null,
@@ -207,6 +209,7 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
     }
     const body = parsedBody as {
       multiAgentGuidanceEnabled?: unknown;
+      syncCodexSubagentDefaults?: unknown;
       model?: unknown;
       effort?: unknown;
       prompt?: unknown;
@@ -214,6 +217,9 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
     const { isCodexReasoningEffort } = await import("../../reasoning-effort");
 
     let nextEnabled = config.multiAgentGuidanceEnabled;
+    // Start from the effective state reported by GET. A stale hand-edited
+    // `true` without a model must not spring back on during a model-only PUT.
+    let nextSyncCodexSubagentDefaults = subagentDefaultSyncEffective(config);
     let nextModel = config.injectionModel;
     let nextEffort = config.injectionEffort;
     let nextPrompt = config.injectionPrompt;
@@ -224,10 +230,16 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
       }
       nextEnabled = body.multiAgentGuidanceEnabled;
     }
+    if ("syncCodexSubagentDefaults" in body) {
+      if (typeof body.syncCodexSubagentDefaults !== "boolean") {
+        return jsonResponse({ error: "syncCodexSubagentDefaults must be a boolean" }, 400);
+      }
+      nextSyncCodexSubagentDefaults = body.syncCodexSubagentDefaults;
+    }
     if ("model" in body) {
       if (body.model === null || body.model === "") nextModel = undefined;
-      else if (typeof body.model === "string" && body.model.length > 0) nextModel = body.model;
-      else return jsonResponse({ error: "model must be a non-empty string or null" }, 400);
+      else if (typeof body.model === "string" && body.model.trim().length > 0) nextModel = body.model;
+      else return jsonResponse({ error: "model must be a nonblank string or null" }, 400);
     }
     if ("effort" in body) {
       if (body.effort === null || body.effort === "") nextEffort = undefined;
@@ -242,10 +254,21 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
       else if (body.prompt === null || body.prompt === "") nextPrompt = undefined;
       else return jsonResponse({ error: "prompt must be a string or null" }, 400);
     }
-    // Clearing the model always clears the effort (it is meaningless alone).
-    if (!nextModel) nextEffort = undefined;
+    // Clearing the model always clears model-dependent settings before sync/effort gates.
+    if (!nextModel) {
+      nextEffort = undefined;
+      nextSyncCodexSubagentDefaults = false;
+    }
+    if (body.syncCodexSubagentDefaults === true && !nextModel?.trim()) {
+      return jsonResponse({ error: "syncCodexSubagentDefaults requires an injection model" }, 400);
+    }
+    if (nextSyncCodexSubagentDefaults && nextEffort !== undefined && !isCodexReasoningEffort(nextEffort)) {
+      return jsonResponse({ error: "syncCodexSubagentDefaults requires a supported Codex reasoning effort" }, 400);
+    }
 
     config.multiAgentGuidanceEnabled = nextEnabled;
+    if (nextSyncCodexSubagentDefaults) config.syncCodexSubagentDefaults = true;
+    else delete config.syncCodexSubagentDefaults;
     if (nextModel) config.injectionModel = nextModel;
     else delete config.injectionModel;
     if (nextEffort) config.injectionEffort = nextEffort;
@@ -257,6 +280,7 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
     return jsonResponse({
       ok: true,
       multiAgentGuidanceEnabled: multiAgentGuidanceEnabled(config),
+      syncCodexSubagentDefaults: subagentDefaultSyncEffective(config),
       model: config.injectionModel ?? null,
       effort: config.injectionEffort ?? null,
       prompt: config.injectionPrompt ?? null,

package/src/server/management/combo-routes.ts

@@ -29,6 +29,10 @@ import { providerCodexAccountMode } from "../../providers/registry";
 import { routedSlug, slugEquals } from "../../providers/slug-codec";
 import { clearProviderQuotaCache, fetchProviderQuotaReports } from "../../providers/quota";
 import { isCanonicalOpenAiForwardProvider } from "../../providers/openai-tiers";
+import {
+  CODEX_ACCOUNT_NAMESPACE_COMBO_ALIAS_COLLISION_ERROR,
+  codexAccountNamespaceForModel,
+} from "../../codex/account-namespace-match";
 import { clearThreadAccountMap } from "../../codex/routing";
 import { primeCodexPoolQuotas } from "../../codex/auth-api";
 import { DEFAULT_PROVIDER_CONTEXT_CAP, globalContextCapValue, providerContextCap, providerContextCaps, setAllProviderContextCaps, setGlobalContextCapValue, setProviderContextCap } from "../../providers/context-cap";
@@ -123,6 +127,9 @@ export async function handleComboRoutes(ctx: ManagementContext): Promise<Respons
     const previous = config.combos?.[sourceId];
     const oldPublicModel = previous ? comboPublicModelId(sourceId, previous) : null;
     const newPublicModel = comboPublicModelId(id, normalized);
+    if (codexAccountNamespaceForModel(config.codexAccountNamespaces, newPublicModel)) {
+      return jsonResponse({ error: CODEX_ACCOUNT_NAMESPACE_COMBO_ALIAS_COLLISION_ERROR }, 409);
+    }
     const nextCombos = { ...(config.combos ?? {}) };
     if (renameFrom) delete nextCombos[renameFrom];
     nextCombos[id] = stored;

package/src/server/management/config-routes.ts

@@ -225,10 +225,13 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
 
   if (url.pathname === "/api/sync" && req.method === "POST") {
     const { syncModelsToCodex } = await import("../../codex/sync");
+    const { attachStaleAppServerHint } = await import("../../codex/app-server-processes");
     const result = await syncModelsToCodex(undefined, config, null);
+    // Hint only after a real catalog/cache write — never enumerate processes here
+    // (WMIC/PowerShell would block Bun's event loop on every dashboard sync).
     return jsonResponse({
-      ...result,
-      staleAppServerHint: "If Codex App still shows an older model list, restart its long-lived app-server process after sync.",
+      ...attachStaleAppServerHint(result),
+      ...(result.ok ? {} : { error: result.message }),
     }, result.ok ? 200 : 500);
   }
 

package/src/server/management/logs-usage-routes.ts

@@ -34,7 +34,19 @@ import { primeCodexPoolQuotas } from "../../codex/auth-api";
 import { DEFAULT_PROVIDER_CONTEXT_CAP, globalContextCapValue, providerContextCap, providerContextCaps, setAllProviderContextCaps, setGlobalContextCapValue, setProviderContextCap } from "../../providers/context-cap";
 import { resolveCodexHomeDir } from "../../codex/home";
 import { scanStorage } from "../../storage/scanner";
-import { executeArchivedCleanup, pickWireCleanupTestHooks, previewArchivedCleanup, type CleanupMode } from "../../storage/cleanup";
+import { executeArchivedCleanup, listTrashEntries, pickWireCleanupTestHooks, previewArchivedCleanup, type CleanupMode, type RestoreErrorCode } from "../../storage/cleanup";
+import { runArchivedCleanupJob } from "../../storage/cleanup-job";
+import { getRestoreTrashTestStreamResponse, runRestoreTrashEntryJob } from "../../storage/restore-job";
+import {
+  normalizeStorageCleanupPolicy,
+  parseStorageCleanupPolicyInput,
+  writeStorageCleanupPolicyToConfig,
+} from "../../storage/policy";
+import {
+  getStorageCleanupPolicyJobState,
+  getStorageCleanupPolicyTestStreamResponse,
+  requestStorageCleanupPolicyRun,
+} from "../../storage/policy-job";
 import {
   currentUsageLogRevision,
   readUsageSnapshotForManagement,
@@ -278,7 +290,7 @@ export async function handleLogsUsageRoutes(ctx: ManagementContext): Promise<Res
         ? pickWireCleanupTestHooks(body._test)
         : undefined;
     try {
-      const result = executeArchivedCleanup({
+      const result = await runArchivedCleanupJob({
         percent,
         mode: mode as CleanupMode,
         digest,
@@ -286,14 +298,20 @@ export async function handleLogsUsageRoutes(ctx: ManagementContext): Promise<Res
       });
       if (!result.ok) {
         const status =
-          result.error === "codex_busy" || result.error === "stale_preview" || result.error === "referenced_history"
+          result.error === "codex_busy"
+            || result.error === "stale_preview"
+            || result.error === "referenced_history"
+            || result.error === "storage_mutation_busy"
+            || result.error === "restore_pending_overlap"
             ? 409
             : result.error === "invalid_mode" || result.error === "invalid_digest"
               ? 400
               : 500;
         const messages: Record<string, string> = {
           codex_busy: "Codex is using state.sqlite — try again after quitting Codex.",
+          storage_mutation_busy: "Another storage cleanup or restore is in progress — try again shortly.",
           stale_preview: "Archived files changed since preview — run Preview again.",
+          restore_pending_overlap: "Selected archives overlap an incomplete trash restore — finish or retry restore first.",
           referenced_history: "Selected archives are still referenced by forked or paginated history.",
           invalid_digest: "Preview digest is missing or invalid.",
           invalid_mode: "mode must be quarantine or permanent.",
@@ -326,5 +344,151 @@ export async function handleLogsUsageRoutes(ctx: ManagementContext): Promise<Res
     }
   }
 
+  if (url.pathname === "/api/storage/trash" && req.method === "GET") {
+    try {
+      const entries = listTrashEntries();
+      return jsonResponse({
+        entries: entries.map(({ id, epoch, fileCount, bytes, quarantinedAt, mode }) => ({
+          id,
+          epoch,
+          fileCount,
+          bytes,
+          ...(quarantinedAt !== undefined ? { quarantinedAt } : {}),
+          ...(mode ? { mode } : {}),
+        })),
+      });
+    } catch {
+      return jsonResponse({ error: "trash_list_failed", entries: [] }, 500);
+    }
+  }
+
+  if (url.pathname === "/api/storage/trash/restore/test-stream" && req.method === "GET") {
+    if (process.env.OPENCODEX_CLEANUP_TEST_HOOKS === "1") {
+      const stream = getRestoreTrashTestStreamResponse();
+      if (stream) return stream;
+    }
+    // Always answer this test-only path — never fall through to the GUI SPA (200 HTML).
+    return jsonResponse({ error: "not_available" }, 404);
+  }
+
+  if (url.pathname === "/api/storage/trash/restore" && req.method === "POST") {
+    let body: { id?: unknown };
+    try { body = await req.json(); } catch { return jsonResponse({ error: "invalid_json" }, 400); }
+    const id = typeof body?.id === "string" ? body.id : "";
+    if (!id.trim()) {
+      return jsonResponse({ error: "invalid_trash", message: "Trash entry id is required." }, 400);
+    }
+    try {
+      const result = await runRestoreTrashEntryJob(id);
+      if (!result.ok) {
+        const status =
+          result.error === "codex_busy"
+            || result.error === "dest_exists"
+            || result.error === "storage_mutation_busy"
+            ? 409
+            : result.error === "missing_trash"
+              ? 404
+              : result.error === "invalid_trash"
+                ? 400
+                : 500;
+        const messages: Record<RestoreErrorCode, string> = {
+          invalid_trash: "Trash entry id is missing or invalid.",
+          missing_trash: "Trash entry was not found.",
+          codex_busy: "Codex is using state.sqlite — try again after quitting Codex.",
+          storage_mutation_busy: "Another storage cleanup or restore is in progress — try again shortly.",
+          dest_exists: "Restore destination already exists — remove or rename the archived file and retry.",
+          fs_failed: "Filesystem restore failed. Some files may already be restored — check archived_sessions and .trash.",
+          db_reconcile_failed: "Could not restore Codex state database rows.",
+          restore_failed: "Restore failed.",
+          restore_worker_timeout: "Restore took too long (over 10 minutes) and was stopped.",
+          restore_worker_aborted: "Restore was cancelled during shutdown.",
+          restore_worker_failed: "Restore worker crashed or failed unexpectedly.",
+        };
+        const errorCode = result.error ?? "restore_failed";
+        const baseMessage = messages[errorCode] ?? messages.restore_failed;
+        const message =
+          result.message && errorCode === "restore_worker_failed"
+            ? `${baseMessage} (${result.message})`
+            : baseMessage;
+        return jsonResponse({
+          ok: false,
+          error: errorCode,
+          message,
+          count: result.count,
+          bytes: result.bytes,
+          restoredPaths: result.restoredPaths,
+          ...(result.trashDir ? { trashDir: result.trashDir } : {}),
+        }, status);
+      }
+      return jsonResponse({
+        ok: true,
+        trashDir: result.trashDir,
+        count: result.count,
+        bytes: result.bytes,
+        restoredPaths: result.restoredPaths,
+      });
+    } catch {
+      return jsonResponse({
+        ok: false,
+        error: "restore_failed",
+        message: "Restore failed.",
+      }, 500);
+    }
+  }
+
+  if (url.pathname === "/api/storage/cleanup-policy/test-stream" && req.method === "GET") {
+    const stream = getStorageCleanupPolicyTestStreamResponse();
+    if (stream) return stream;
+    // Production: hook is off. Return an explicit JSON 404 — do not fall through to the GUI.
+    return jsonResponse({ error: "not_found" }, 404);
+  }
+
+  if (url.pathname === "/api/storage/cleanup-policy" && req.method === "GET") {
+    const policy = normalizeStorageCleanupPolicy(config.storageCleanupPolicy);
+    return jsonResponse({
+      ...policy,
+      job: getStorageCleanupPolicyJobState(),
+    });
+  }
+
+  if (url.pathname === "/api/storage/cleanup-policy" && req.method === "PUT") {
+    let raw: unknown;
+    try { raw = await req.json(); } catch { return jsonResponse({ error: "invalid_json" }, 400); }
+    const previous = normalizeStorageCleanupPolicy(config.storageCleanupPolicy);
+    const parsed = parseStorageCleanupPolicyInput(raw, previous);
+    if (!parsed.ok) return jsonResponse({ error: parsed.error }, 400);
+    // Never enable implicitly: if client omitted enabled, keep previous (default false).
+    const body = raw as Record<string, unknown>;
+    if (body.enabled === undefined) parsed.policy.enabled = previous.enabled;
+    const saved = writeStorageCleanupPolicyToConfig(parsed.policy);
+    config.storageCleanupPolicy = saved;
+    return jsonResponse({ ok: true, policy: saved, job: getStorageCleanupPolicyJobState() });
+  }
+
+  if (url.pathname === "/api/storage/cleanup-policy/run" && req.method === "POST") {
+    try {
+      const accepted = requestStorageCleanupPolicyRun({ reason: "manual", force: true });
+      if (!accepted.accepted) {
+        return jsonResponse({
+          ok: false,
+          started: false,
+          error: "already_running",
+          message: "A cleanup policy run is already in progress.",
+          job: accepted.state,
+          policy: normalizeStorageCleanupPolicy(config.storageCleanupPolicy),
+        }, 409);
+      }
+      // Return promptly — clients poll GET for skip/defer/success/error outcomes.
+      return jsonResponse({
+        ok: true,
+        started: true,
+        job: accepted.state,
+        policy: normalizeStorageCleanupPolicy(config.storageCleanupPolicy),
+      });
+    } catch {
+      return jsonResponse({ ok: false, error: "cleanup_failed" }, 500);
+    }
+  }
+
   return null;
 }

package/src/server/management/oauth-account-routes.ts

@@ -10,6 +10,8 @@ import {
   multiAgentGuidanceEnabled,
   providerBaseUrlConfigError,
   providerHeadersConfigError,
+  readConfigDiagnostics,
+  reconcileLiveConfigFromDisk,
   saveConfigPreservingClaudeCode,
 } from "../../config";
 import {
@@ -19,7 +21,6 @@ import {
   listOAuthProviders,
   startLoginFlow,
   submitManualLoginCode,
-  upsertOAuthProvider,
 } from "../../oauth";
 import { removeCredential } from "../../oauth/store";
 import { providerDestinationResolvedError } from "../../lib/destination-policy";
@@ -27,9 +28,15 @@ import { enrichProviderFromCatalog, listKeyLoginProviders } from "../../oauth/ke
 import { deriveProviderPresets } from "../../providers/derive";
 import { providerCodexAccountMode } from "../../providers/registry";
 import { routedSlug, slugEquals } from "../../providers/slug-codec";
-import { clearProviderQuotaCache, fetchProviderQuotaReports } from "../../providers/quota";
+import { clearProviderQuotaCache, fetchProviderAccountQuotas, fetchProviderQuotaReports, supportsPerAccountQuota } from "../../providers/quota";
 import { isCanonicalOpenAiForwardProvider } from "../../providers/openai-tiers";
 import { clearThreadAccountMap } from "../../codex/routing";
+import {
+  normalizeAccountPoolStickyLimit,
+  normalizeAccountPoolStrategy,
+  parseAccountPoolStickyLimit,
+  parseAccountPoolStrategy,
+} from "../../codex/pool-rotation";
 import { primeCodexPoolQuotas } from "../../codex/auth-api";
 import { DEFAULT_PROVIDER_CONTEXT_CAP, globalContextCapValue, providerContextCap, providerContextCaps, setAllProviderContextCaps, setGlobalContextCapValue, setProviderContextCap } from "../../providers/context-cap";
 import { resolveCodexHomeDir } from "../../codex/home";
@@ -59,6 +66,7 @@ import { buildApiAccessEndpoints } from "./api-access";
 import { isPlainRecord, parseDebugLogQuery, tokPerSecondResult, unavailableCostReason, costResult, requestLogDto, stripRegistryOnlyStaticHeaders, fetchAllModels } from "./shared";
 import type { MetricUnavailableReason, TokPerSecondResult, CostEstimateReason, CostResult, MetricSource } from "./shared";
 import type { ManagementContext } from "./context";
+import { codexAccountNamespaceProviderCollisionError } from "../../codex/account-namespace-match";
 
 export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<Response | null> {
   const { req, url, config, deps, refreshCodexCatalogBestEffort, syncClaudeAgentDefsBestEffort } = ctx;
@@ -80,6 +88,8 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     const body = await req.json().catch(() => ({})) as { provider?: string; addAccount?: boolean; accountId?: string; reauth?: boolean };
     const provider = (body.provider ?? "").trim().toLowerCase();
     if (!isPublicOAuthProvider(provider)) return jsonResponse({ error: "unknown oauth provider" }, 400);
+    const namespaceCollision = codexAccountNamespaceProviderCollisionError(config.codexAccountNamespaces, provider);
+    if (namespaceCollision) return jsonResponse({ error: namespaceCollision }, 409);
     const accountId = body.accountId?.trim();
     const reauth = body.reauth === true || Boolean(accountId);
     try {
@@ -90,12 +100,19 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
           return jsonResponse({ error: "Unknown account for reauth" }, 404);
         }
       }
+      // Use persisted state, not the live object, as the merge base: another management
+      // request may already have mutated live config and yielded before its save.
+      const persistedBaseline = readConfigDiagnostics().config;
       // addAccount / reauth forces a fresh browser identity (skips local-CLI token import).
       const { url: authUrl, instructions, deviceCode } = await startLoginFlow(provider, {
         forceLogin: body.addAccount === true || reauth,
         ...(accountId ? { reauthAccountId: accountId } : {}),
+      }, {
+        // startLoginFlow returns the authorization URL before background persistence completes.
+        // Three-way reconcile settled disk changes so a failed login cannot leave a provider
+        // live-only and an in-flight management mutation cannot be erased before it saves.
+        onSettled: () => reconcileLiveConfigFromDisk(config, persistedBaseline),
       });
-      upsertOAuthProvider(config, provider); // mutate LIVE config — routing sees it without restart
       if (authUrl && !deviceCode) {
         // Open the browser server-side (the proxy runs on the user's machine) — the GUI's
         // window.open is popup-blocked because it runs after an await, not a direct click.
@@ -146,8 +163,9 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     await removeCredential(provider);
     clearLoginState(provider);
     // Drop cached/last-good quota rows tied to the removed credential.
-    const { clearProviderQuotaCache } = await import("../../providers/quota");
+    const { clearProviderQuotaCache, clearAccountQuotaCache } = await import("../../providers/quota");
     clearProviderQuotaCache();
+    clearAccountQuotaCache(provider);
     return jsonResponse({ success: true });
   }
 
@@ -163,18 +181,46 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
       projectOAuthAccountHealth,
       projectStoredOAuthAccountHealth,
     } = await import("../../oauth/health");
-    const set = getAccountSet(provider);
-    const accounts = (status.accounts ?? []).map(summary => {
-      const full = set?.accounts.find(account => account.id === summary.id);
-      const health = full
-        ? projectStoredOAuthAccountHealth(provider, full)
-        : projectOAuthAccountHealth({
-          needsReauth: summary.needsReauth === true,
-          reauthReason: summary.needsReauth === true ? "refresh_failed" : undefined,
-        });
-      return { ...summary, ...oauthAccountHealthFields(provider, summary.id, health) };
+    const projectAccounts = () => {
+      const set = getAccountSet(provider);
+      const current = getLoginStatus(provider);
+      return {
+        activeAccountId: current.activeAccountId ?? null,
+        accounts: (current.accounts ?? []).map(summary => {
+          const full = set?.accounts.find(account => account.id === summary.id);
+          const health = full
+            ? projectStoredOAuthAccountHealth(provider, full)
+            : projectOAuthAccountHealth({
+              needsReauth: summary.needsReauth === true,
+              reauthReason: summary.needsReauth === true ? "refresh_failed" : undefined,
+            });
+          return { ...summary, ...oauthAccountHealthFields(provider, summary.id, health) };
+        }),
+      };
+    };
+    // Per-account rate limits: Anthropic reports usage per credential, so every logged-in
+    // account can show its own 5h/weekly bars (not just the active one). Opt-in via ?quota=1
+    // so the plain account list stays a cheap local read; ?refresh=1 bypasses the TTL.
+    const wantQuota = url.searchParams.get("quota") === "1" && supportsPerAccountQuota(provider);
+    if (!wantQuota) return jsonResponse(projectAccounts());
+    const forceRefresh = url.searchParams.get("refresh") === "1";
+    // Probing may refresh the active credential and mark needsReauth — project health
+    // from the post-probe store so the response is not stale.
+    const rows = await fetchProviderAccountQuotas(provider, forceRefresh);
+    const byId = new Map(rows.map(row => [row.accountId, row]));
+    const projected = projectAccounts();
+    return jsonResponse({
+      activeAccountId: projected.activeAccountId,
+      accounts: projected.accounts.map(account => {
+        const row = byId.get(account.id);
+        if (!row) return account;
+        return {
+          ...account,
+          quota: row.quota,
+          ...(row.unavailable ? { quotaUnavailable: true } : {}),
+        };
+      }),
     });
-    return jsonResponse({ activeAccountId: status.activeAccountId ?? null, accounts });
   }
   if (url.pathname === "/api/oauth/accounts/active" && req.method === "PUT") {
     const body = await req.json().catch(() => ({})) as { provider?: string; accountId?: string };
@@ -183,10 +229,104 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     if (!body.accountId) return jsonResponse({ error: "missing accountId" }, 400);
     const { setActiveAccount } = await import("../../oauth/store");
     if (!(await setActiveAccount(provider, body.accountId))) return jsonResponse({ error: "account not found" }, 404);
+    if (provider === "anthropic") {
+      const { resetAnthropicRoutingForManualSelection } = await import("../../oauth/anthropic-routing");
+      resetAnthropicRoutingForManualSelection(body.accountId);
+    }
     const { clearProviderQuotaCache } = await import("../../providers/quota");
     clearProviderQuotaCache();
     return jsonResponse({ ok: true, provider, activeAccountId: body.accountId });
   }
+
+  // Opt-in Anthropic OAuth account pool (#294): enable/threshold/strategy + clear cooldown.
+  if (url.pathname === "/api/oauth/accounts/pool" && req.method === "GET") {
+    const provider = (url.searchParams.get("provider") ?? "").trim().toLowerCase();
+    if (provider !== "anthropic") return jsonResponse({ error: "pool config is only supported for anthropic" }, 400);
+    const pool = config.anthropicAccountPool ?? {};
+    return jsonResponse({
+      provider,
+      enabled: pool.enabled === true,
+      autoSwitchThreshold: typeof pool.autoSwitchThreshold === "number" ? pool.autoSwitchThreshold : 80,
+      strategy: normalizeAccountPoolStrategy(pool.strategy),
+      stickyLimit: normalizeAccountPoolStickyLimit(pool.stickyLimit),
+      experimental: true,
+    });
+  }
+  if (url.pathname === "/api/oauth/accounts/pool" && (req.method === "PUT" || req.method === "PATCH")) {
+    const parsedBody = await req.json().catch(() => ({}));
+    if (!isPlainRecord(parsedBody)) {
+      return jsonResponse({ error: "body must be an object" }, 400);
+    }
+    const body = parsedBody as {
+      provider?: unknown;
+      enabled?: unknown;
+      autoSwitchThreshold?: unknown;
+      strategy?: unknown;
+      stickyLimit?: unknown;
+    };
+    const provider = typeof body.provider === "string" ? body.provider.trim().toLowerCase() : "";
+    if (provider !== "anthropic") return jsonResponse({ error: "pool config is only supported for anthropic" }, 400);
+    let enabled = config.anthropicAccountPool?.enabled === true;
+    if (body.enabled !== undefined) {
+      if (typeof body.enabled !== "boolean") return jsonResponse({ error: "enabled must be a boolean" }, 400);
+      enabled = body.enabled;
+    }
+    let threshold = config.anthropicAccountPool?.autoSwitchThreshold ?? 80;
+    if (body.autoSwitchThreshold !== undefined) {
+      if (
+        typeof body.autoSwitchThreshold !== "number"
+        || !Number.isInteger(body.autoSwitchThreshold)
+        || body.autoSwitchThreshold < 0
+        || body.autoSwitchThreshold > 100
+      ) {
+        return jsonResponse({ error: "autoSwitchThreshold must be an integer 0-100" }, 400);
+      }
+      threshold = body.autoSwitchThreshold;
+    }
+    let strategy = config.anthropicAccountPool?.strategy;
+    if (body.strategy !== undefined) {
+      const parsed = parseAccountPoolStrategy(body.strategy);
+      if (parsed === null) {
+        return jsonResponse({ error: "strategy must be one of: quota, round-robin, fill-first" }, 400);
+      }
+      strategy = parsed;
+    }
+    let stickyLimit = config.anthropicAccountPool?.stickyLimit;
+    if (body.stickyLimit !== undefined) {
+      const parsed = parseAccountPoolStickyLimit(body.stickyLimit);
+      if (parsed === null) {
+        return jsonResponse({ error: "stickyLimit must be an integer 1-100" }, 400);
+      }
+      stickyLimit = parsed;
+    }
+    config.anthropicAccountPool = {
+      enabled,
+      autoSwitchThreshold: threshold,
+      ...(strategy !== undefined ? { strategy } : {}),
+      ...(stickyLimit !== undefined ? { stickyLimit } : {}),
+    };
+    saveConfigPreservingClaudeCode(config);
+    return jsonResponse({
+      ok: true,
+      provider,
+      enabled,
+      autoSwitchThreshold: threshold,
+      strategy: normalizeAccountPoolStrategy(strategy),
+      stickyLimit: normalizeAccountPoolStickyLimit(stickyLimit),
+      experimental: true,
+    });
+  }
+  if (url.pathname === "/api/oauth/accounts/clear-cooldown" && req.method === "POST") {
+    const body = await req.json().catch(() => ({})) as { provider?: unknown; accountId?: unknown };
+    const provider = typeof body.provider === "string" ? body.provider.trim().toLowerCase() : "";
+    const accountId = typeof body.accountId === "string" ? body.accountId.trim() : "";
+    if (provider !== "anthropic") return jsonResponse({ error: "clear-cooldown is only supported for anthropic" }, 400);
+    if (!accountId) return jsonResponse({ error: "missing accountId" }, 400);
+    const { clearAnthropicAccountCooldown } = await import("../../oauth/anthropic-routing");
+    const cleared = clearAnthropicAccountCooldown(accountId);
+    return jsonResponse({ ok: true, cleared });
+  }
+
   if (url.pathname === "/api/oauth/accounts/alias" && req.method === "PUT") {
     const body = await req.json().catch(() => ({})) as { provider?: unknown; accountId?: unknown; alias?: unknown };
     const provider = typeof body.provider === "string" ? body.provider.trim().toLowerCase() : "";
@@ -208,9 +348,15 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     if (!id) return jsonResponse({ error: "missing id" }, 400);
     const { removeAccount, getAccountSet } = await import("../../oauth/store");
     if (!(await removeAccount(provider, id))) return jsonResponse({ error: "account not found" }, 404);
+    if (provider === "anthropic") {
+      const { clearAnthropicAccountCooldown, clearAnthropicSessionAffinityForAccount } = await import("../../oauth/anthropic-routing");
+      clearAnthropicAccountCooldown(id);
+      clearAnthropicSessionAffinityForAccount(id);
+    }
     if (!getAccountSet(provider)) clearLoginState(provider);
-    const { clearProviderQuotaCache } = await import("../../providers/quota");
+    const { clearProviderQuotaCache, clearAccountQuotaCache } = await import("../../providers/quota");
     clearProviderQuotaCache();
+    clearAccountQuotaCache(provider);
     return jsonResponse({ ok: true });
   }
 
@@ -308,7 +454,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     const salt = crypto.randomUUID();
     const hashInput = `${providerKeys}|${salt}|${Date.now()}`;
     const hashBuf = new Bun.CryptoHasher("sha256").update(hashInput).digest();
-    const key = "ocx_" + Buffer.from(hashBuf).toString("hex").slice(0, 40);
+    const key = "ocx_data_" + Buffer.from(hashBuf).toString("hex").slice(0, 40);
     const entry = { id: crypto.randomUUID(), name, key, createdAt: new Date().toISOString() };
     config.apiKeys = [...(config.apiKeys ?? []), entry];
     saveConfigPreservingClaudeCode(config);