@bitkyc08/opencodex 2.7.43-preview.20260728 → 2.8.0

package/src/providers/model-discovery.ts

@@ -0,0 +1,356 @@
+import type { OcxProviderConfig } from "../types";
+import {
+  getProviderRegistryEntry,
+  providerMatchesRegistryTransport,
+  type ProviderModelDiscoveryFilter,
+  type ProviderModelDiscoveryPredicate,
+  type ProviderModelDiscoveryScalar,
+  type ProviderModelDiscoverySpec,
+} from "./registry";
+
+/** Hard process-wide limits. Registry entries may lower, but never raise, these ceilings. */
+export const MODEL_DISCOVERY_MAX_RESPONSE_BYTES = 4 * 1024 * 1024;
+export const MODEL_DISCOVERY_MAX_MODELS = 2_000;
+export const MODEL_DISCOVERY_MAX_MODEL_ID_LENGTH = 1_024;
+const MODEL_DISCOVERY_MAX_FILTER_VALUES = 256;
+const MODEL_DISCOVERY_MAX_FILTER_STRING_LENGTH = 1_024;
+const MODEL_DISCOVERY_MODEL_ID_CONTROL_CHARS = /[\u0000-\u001f\u007f-\u009f\u2028\u2029]/;
+
+export interface ResolvedProviderModelDiscovery {
+  spec?: ProviderModelDiscoverySpec;
+  maxResponseBytes: number;
+  maxModels: number;
+}
+
+export type ProviderModelsApiItem = Record<string, unknown> & { id: string };
+
+export type ModelDiscoveryResponseFailure =
+  | "response_too_large"
+  | "invalid_json"
+  | "invalid_shape"
+  | "too_many_models";
+
+export type BoundedDiscoveryJsonResult =
+  | { ok: true; value: unknown }
+  | { ok: false; reason: "response_too_large" | "invalid_json" };
+
+export type ProviderModelItemsResult =
+  | { ok: true; items: ProviderModelsApiItem[]; rawCount: number }
+  | { ok: false; reason: "invalid_shape" | "too_many_models" };
+
+export type ModelEnvelopeRowsResult =
+  | { ok: true; rows: unknown[] }
+  | { ok: false; reason: "invalid_shape" | "too_many_models" };
+
+function positiveIntegerAtMost(value: number | undefined, hardLimit: number): number {
+  if (typeof value !== "number" || !Number.isFinite(value) || value <= 0) return hardLimit;
+  return Math.min(Math.floor(value), hardLimit);
+}
+
+function discoveryPredicateError(predicate: ProviderModelDiscoveryPredicate): string | null {
+  if (!Array.isArray(predicate.path) || predicate.path.length === 0 || predicate.path.length > 8) {
+    return "predicate path must contain 1-8 segments";
+  }
+  if (predicate.path.some(segment => typeof segment !== "string" || !segment.trim() || segment.length > 64)) {
+    return "predicate path segments must be nonblank strings up to 64 characters";
+  }
+  const values = "equalsAny" in predicate
+    ? predicate.equalsAny
+    : "containsAny" in predicate
+      ? predicate.containsAny
+      : predicate.containsAll;
+  if (!Array.isArray(values) || values.length === 0 || values.length > 32) {
+    return "predicate values must contain 1-32 scalars";
+  }
+  if (values.some(value => (
+    (typeof value !== "string" && typeof value !== "number" && typeof value !== "boolean")
+    || (typeof value === "string" && (!value.trim() || value.length > 128))
+    || (typeof value === "number" && !Number.isFinite(value))
+  ))) {
+    return "predicate values must be finite booleans/numbers or nonblank strings up to 128 characters";
+  }
+  return null;
+}
+
+/** Static registry validation used by parity tests; discovery metadata never comes from config. */
+export function providerModelDiscoverySpecError(spec: ProviderModelDiscoverySpec): string | null {
+  if (spec.url && spec.path) return "url and path are mutually exclusive";
+  if (spec.url !== undefined) {
+    try {
+      const parsed = new URL(spec.url);
+      if (parsed.protocol !== "https:") return "absolute discovery url must use https";
+      if (parsed.username || parsed.password || parsed.hash) return "absolute discovery url must not contain credentials or a fragment";
+    } catch {
+      return "absolute discovery url must be valid";
+    }
+  }
+  if (spec.path !== undefined) {
+    const path = spec.path.trim();
+    if (!path || path.length > 512) return "discovery path must be 1-512 characters";
+    if (/^[a-z][a-z\d+.-]*:/i.test(path) || path.startsWith("//") || path.includes("?") || path.includes("#")) {
+      return "discovery path must be a query-free relative/origin path";
+    }
+    if (path.includes("\\")) return "discovery path must use forward slashes";
+    if (path.split("/").some(segment => segment.replace(/%2e/gi, ".") === "..")) {
+      return "discovery path must not contain parent-directory segments";
+    }
+  }
+  const queryEntries = Object.entries(spec.query ?? {});
+  if (queryEntries.length > 32) return "discovery query may contain at most 32 entries";
+  if (queryEntries.some(([key, value]) => !key.trim() || key.length > 128 || typeof value !== "string" || value.length > 512)) {
+    return "discovery query keys/values exceed their bounds";
+  }
+  for (const [field, value, hardLimit] of [
+    ["maxResponseBytes", spec.maxResponseBytes, MODEL_DISCOVERY_MAX_RESPONSE_BYTES],
+    ["maxModels", spec.maxModels, MODEL_DISCOVERY_MAX_MODELS],
+  ] as const) {
+    if (value !== undefined && (!Number.isInteger(value) || value <= 0 || value > hardLimit)) {
+      return `${field} must be a positive integer no greater than ${hardLimit}`;
+    }
+  }
+  for (const [group, predicates] of Object.entries(spec.filter ?? {})) {
+    if (!Array.isArray(predicates) || predicates.length === 0 || predicates.length > 32) {
+      return `${group} must contain 1-32 predicates`;
+    }
+    for (const predicate of predicates) {
+      const error = discoveryPredicateError(predicate);
+      if (error) return `${group}: ${error}`;
+    }
+  }
+  return null;
+}
+
+export function resolveProviderModelDiscovery(
+  providerName: string,
+  provider: Pick<OcxProviderConfig, "baseUrl" | "adapter"> & Partial<Pick<OcxProviderConfig, "authMode">>,
+): ResolvedProviderModelDiscovery {
+  const entry = providerMatchesRegistryTransport(providerName, provider)
+    ? getProviderRegistryEntry(providerName)
+    : undefined;
+  const spec = entry?.modelDiscovery;
+  return {
+    ...(spec ? { spec } : {}),
+    maxResponseBytes: positiveIntegerAtMost(spec?.maxResponseBytes, MODEL_DISCOVERY_MAX_RESPONSE_BYTES),
+    maxModels: positiveIntegerAtMost(spec?.maxModels, MODEL_DISCOVERY_MAX_MODELS),
+  };
+}
+
+function appendDiscoveryQuery(url: URL, query: Readonly<Record<string, string>> | undefined): URL {
+  for (const [key, value] of Object.entries(query ?? {})) url.searchParams.set(key, value);
+  return url;
+}
+
+/** Apply a registry-owned URL/path/query policy to the adapter's normal discovery endpoint. */
+export function resolveProviderModelDiscoveryUrl(
+  providerName: string,
+  configuredProvider: Pick<OcxProviderConfig, "baseUrl" | "adapter"> & Partial<Pick<OcxProviderConfig, "authMode">>,
+  effectiveBaseUrl: string,
+  defaultUrl: string,
+): string {
+  const { spec } = resolveProviderModelDiscovery(providerName, configuredProvider);
+  if (!spec) return defaultUrl;
+
+  let resolved: URL;
+  if (spec.url) {
+    resolved = new URL(spec.url);
+  } else if (spec.path) {
+    const base = new URL(effectiveBaseUrl.endsWith("/") ? effectiveBaseUrl : `${effectiveBaseUrl}/`);
+    resolved = spec.path.startsWith("/")
+      ? new URL(spec.path, base.origin)
+      : new URL(spec.path, base);
+  } else {
+    resolved = new URL(defaultUrl);
+  }
+  return appendDiscoveryQuery(resolved, spec.query).toString();
+}
+
+function cancelWithoutWaiting(reader: ReadableStreamDefaultReader<Uint8Array>, reason: unknown): void {
+  try {
+    void reader.cancel(reason).catch(() => undefined);
+  } catch {
+    // A non-conforming stream may throw synchronously from cancel().
+  }
+}
+
+/** Read a discovery response under a strict byte ceiling before JSON.parse can allocate freely. */
+export async function readBoundedDiscoveryJson(
+  response: Response,
+  maxResponseBytes: number,
+): Promise<BoundedDiscoveryJsonResult> {
+  const limit = positiveIntegerAtMost(maxResponseBytes, MODEL_DISCOVERY_MAX_RESPONSE_BYTES);
+  const declaredLength = Number(response.headers.get("content-length"));
+  if (Number.isFinite(declaredLength) && declaredLength > limit) {
+    try {
+      void response.body?.cancel(new DOMException("Model discovery response is too large", "QuotaExceededError"))
+        .catch(() => undefined);
+    } catch {
+      // Best-effort cancellation only.
+    }
+    return { ok: false, reason: "response_too_large" };
+  }
+
+  if (!response.body) return { ok: false, reason: "invalid_json" };
+  const reader = response.body.getReader();
+  const chunks: Uint8Array[] = [];
+  let total = 0;
+  try {
+    while (true) {
+      const { value, done } = await reader.read();
+      if (done) break;
+      if (!value || value.byteLength === 0) continue;
+      if (value.byteLength > limit - total) {
+        cancelWithoutWaiting(
+          reader,
+          new DOMException("Model discovery response is too large", "QuotaExceededError"),
+        );
+        return { ok: false, reason: "response_too_large" };
+      }
+      chunks.push(value);
+      total += value.byteLength;
+    }
+  } finally {
+    try {
+      reader.releaseLock();
+    } catch {
+      // Cancellation may keep the lock briefly.
+    }
+  }
+
+  const bytes = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  try {
+    const text = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    return { ok: true, value: JSON.parse(text) as unknown };
+  } catch {
+    return { ok: false, reason: "invalid_json" };
+  }
+}
+
+function valueAtPath(item: Record<string, unknown>, path: readonly string[]): unknown {
+  let current: unknown = item;
+  for (const segment of path) {
+    if (current === null || typeof current !== "object" || Array.isArray(current)) return undefined;
+    current = (current as Record<string, unknown>)[segment];
+  }
+  return current;
+}
+
+function comparableScalar(value: unknown, caseInsensitive: boolean): ProviderModelDiscoveryScalar | undefined {
+  if (typeof value !== "string" && typeof value !== "number" && typeof value !== "boolean") return undefined;
+  if (typeof value === "string" && value.length > MODEL_DISCOVERY_MAX_FILTER_STRING_LENGTH) return undefined;
+  return caseInsensitive && typeof value === "string" ? value.toLowerCase() : value;
+}
+
+function comparableNeedles(
+  values: readonly ProviderModelDiscoveryScalar[],
+  caseInsensitive: boolean,
+): ProviderModelDiscoveryScalar[] {
+  return values.map(value => caseInsensitive && typeof value === "string" ? value.toLowerCase() : value);
+}
+
+function predicateMatches(item: ProviderModelsApiItem, predicate: ProviderModelDiscoveryPredicate): boolean {
+  const caseInsensitive = predicate.caseInsensitive === true;
+  const raw = valueAtPath(item, predicate.path);
+  if ("equalsAny" in predicate) {
+    const value = comparableScalar(raw, caseInsensitive);
+    return value !== undefined && comparableNeedles(predicate.equalsAny, caseInsensitive).includes(value);
+  }
+
+  const collection = Array.isArray(raw);
+  const values: ProviderModelDiscoveryScalar[] = [];
+  if (collection) {
+    for (let i = 0; i < raw.length && i < MODEL_DISCOVERY_MAX_FILTER_VALUES; i += 1) {
+      const value = comparableScalar(raw[i], caseInsensitive);
+      if (value !== undefined) values.push(value);
+    }
+  } else if (typeof raw === "string") {
+    values.push(caseInsensitive ? raw.toLowerCase() : raw);
+  }
+  const needles = comparableNeedles(
+    "containsAny" in predicate ? predicate.containsAny : predicate.containsAll,
+    caseInsensitive,
+  );
+  if ("containsAny" in predicate) {
+    return needles.some(needle => values.some(value => (
+      !collection && typeof value === "string" && typeof needle === "string" ? value.includes(needle) : value === needle
+    )));
+  }
+  return needles.every(needle => values.some(value => (
+    !collection && typeof value === "string" && typeof needle === "string" ? value.includes(needle) : value === needle
+  )));
+}
+
+export function providerModelMatchesDiscoveryFilter(
+  item: ProviderModelsApiItem,
+  filter: ProviderModelDiscoveryFilter | undefined,
+): boolean {
+  if (!filter) return true;
+  if (filter.allOf && !filter.allOf.every(predicate => predicateMatches(item, predicate))) return false;
+  if (filter.anyOf && filter.anyOf.length > 0 && !filter.anyOf.some(predicate => predicateMatches(item, predicate))) return false;
+  if (filter.noneOf?.some(predicate => predicateMatches(item, predicate))) return false;
+  return true;
+}
+
+/** Extract one allowlisted array envelope while enforcing the raw-row ceiling. */
+export function extractModelEnvelopeRows(
+  value: unknown,
+  maxModels: number,
+  envelopeKeys: readonly string[],
+): ModelEnvelopeRowsResult {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return { ok: false, reason: "invalid_shape" };
+  }
+  const record = value as Record<string, unknown>;
+  const rows = envelopeKeys.map(key => record[key]).find(Array.isArray);
+  if (!rows) return { ok: false, reason: "invalid_shape" };
+  const limit = positiveIntegerAtMost(maxModels, MODEL_DISCOVERY_MAX_MODELS);
+  if (rows.length > limit) return { ok: false, reason: "too_many_models" };
+  return { ok: true, rows };
+}
+
+/** Validate, bound, deduplicate, and declaratively filter OpenAI `{data:[...]}` or top-level arrays (Together `#617`). */
+export function extractProviderModelItems(
+  value: unknown,
+  discovery: ResolvedProviderModelDiscovery,
+): ProviderModelItemsResult {
+  const limit = positiveIntegerAtMost(discovery.maxModels, MODEL_DISCOVERY_MAX_MODELS);
+  let data: unknown[];
+  if (Array.isArray(value)) {
+    // Together-style top-level /models arrays. Catalog discovery must not treat a stray
+    // `models` key on openai-chat responses as valid — only `data` envelopes or top-level arrays.
+    if (value.length > limit) return { ok: false, reason: "too_many_models" };
+    data = value;
+  } else {
+    const envelope = extractModelEnvelopeRows(value, discovery.maxModels, ["data"]);
+    if (!envelope.ok) return envelope;
+    data = envelope.rows;
+  }
+
+  const items: ProviderModelsApiItem[] = [];
+  const seen = new Set<string>();
+  for (const raw of data) {
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+      return { ok: false, reason: "invalid_shape" };
+    }
+    const id = (raw as { id?: unknown }).id;
+    if (typeof id !== "string") return { ok: false, reason: "invalid_shape" };
+    const normalizedId = id.trim();
+    if (
+      !normalizedId
+      || normalizedId !== id
+      || normalizedId.length > MODEL_DISCOVERY_MAX_MODEL_ID_LENGTH
+      || MODEL_DISCOVERY_MODEL_ID_CONTROL_CHARS.test(normalizedId)
+    ) {
+      return { ok: false, reason: "invalid_shape" };
+    }
+    const item = raw as ProviderModelsApiItem;
+    if (!providerModelMatchesDiscoveryFilter(item, discovery.spec?.filter) || seen.has(normalizedId)) continue;
+    seen.add(normalizedId);
+    items.push(item);
+  }
+  return { ok: true, items, rawCount: data.length };
+}

package/src/providers/quota.ts

@@ -1,13 +1,16 @@
 import { fetchMainAccountInfo, listCodexAuthAccounts } from "../codex/auth-api";
 import { MAIN_CODEX_ACCOUNT_ID } from "../codex/main-account";
 import { resolveEnvValue } from "../config";
-import { getValidAccessToken } from "../oauth";
-import { getCredential } from "../oauth/store";
+import { getValidAccessToken, getValidAccessTokenForAccount } from "../oauth";
+import { getAccountCredential, getAccountSet, getCredential } from "../oauth/store";
 import { antigravityUserAgent } from "../adapters/client-fingerprint";
 import { getProviderRegistryEntry, providerCodexAccountMode } from "./registry";
 import type { OcxConfig, OcxProviderConfig } from "../types";
 import { isCanonicalOpenAiForwardProvider, OPENAI_CODEX_PROVIDER_ID } from "./openai-tiers";
 
+/** Match oauth/index REFRESH_SKEW_MS — use stored access without refresh when still fresh. */
+const ACCOUNT_TOKEN_SKEW_MS = 60_000;
+
 const CACHE_TTL_MS = 5 * 60_000;
 const REQUEST_TIMEOUT_MS = 8_000;
 const KIMI_CODE_BASE_URL = "https://api.kimi.com/coding/v1";
@@ -188,43 +191,244 @@ function parseClaudeBucket(value: unknown): { percent?: number; resetAt?: number
   return { percent, resetAt };
 }
 
+/** Claude's OAuth usage endpoint, probed with ONE account's own bearer token. */
+const anthropicUsageInflight = new Map<string, Promise<ProviderQuota | null>>();
+
+async function fetchAnthropicUsageQuota(accessToken: string): Promise<ProviderQuota | null> {
+  const joinable = anthropicUsageInflight.get(accessToken);
+  if (joinable) return joinable;
+
+  const probe = (async (): Promise<ProviderQuota | null> => {
+    const response = await fetch("https://api.anthropic.com/api/oauth/usage", {
+      headers: {
+        Accept: "application/json, text/plain, */*",
+        "Content-Type": "application/json",
+        "User-Agent": "claude-cli/2.1.63 (external, cli)",
+        "anthropic-beta": "claude-code-20250219,oauth-2025-04-20,interleaved-thinking-2025-05-14,context-management-2025-06-27,prompt-caching-scope-2026-01-05",
+        Authorization: `Bearer ${accessToken}`,
+      },
+      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+    });
+    if (!response.ok) return null;
+    const body = asRecord(await response.json().catch(() => null));
+    if (!body) return null;
+    const fiveHour = parseClaudeBucket(body.five_hour);
+    const sevenDay = parseClaudeBucket(body.seven_day);
+    const opus = parseClaudeBucket(body.seven_day_opus);
+    const sonnet = parseClaudeBucket(body.seven_day_sonnet);
+    const customWindows: ProviderQuotaWindow[] = [];
+    if (opus?.percent !== undefined) customWindows.push({ label: "Opus", percent: opus.percent, ...(opus.resetAt !== undefined ? { resetAt: opus.resetAt } : {}) });
+    if (sonnet?.percent !== undefined) customWindows.push({ label: "Sonnet", percent: sonnet.percent, ...(sonnet.resetAt !== undefined ? { resetAt: sonnet.resetAt } : {}) });
+    const quota: ProviderQuota = {
+      // Claude's 5-hour window is a first-class rate limit, same as the Codex login 5h/weekly
+      // rows: report it in the canonical fields so the dashboard renders it with the standard
+      // "5-hour limit" label and ordering instead of as a generic extra window.
+      ...(fiveHour?.percent !== undefined ? { fiveHourPercent: fiveHour.percent } : {}),
+      ...(fiveHour?.resetAt !== undefined ? { fiveHourResetAt: fiveHour.resetAt } : {}),
+      ...(sevenDay?.percent !== undefined ? { weeklyPercent: sevenDay.percent } : {}),
+      ...(sevenDay?.resetAt !== undefined ? { weeklyResetAt: sevenDay.resetAt } : {}),
+      ...(customWindows.length > 0 ? { customWindows } : {}),
+      updatedAt: Date.now(),
+    };
+    // Empty / schema-changed payloads must not cache as "success with no bars".
+    return hasQuotaRows(quota) ? quota : null;
+  })().finally(() => {
+    if (anthropicUsageInflight.get(accessToken) === probe) anthropicUsageInflight.delete(accessToken);
+  });
+  anthropicUsageInflight.set(accessToken, probe);
+  return probe;
+}
+
 async function fetchAnthropicQuota(provider: string): Promise<ProviderQuotaReport | null> {
+  // Capture the account we intend to probe before awaiting — a mid-flight active
+  // switch must not seed the wrong account's cache with this response.
+  const probedAccountId = getAccountSet("anthropic")?.activeAccountId;
   let accessToken: string;
   try {
     accessToken = await getValidAccessToken("anthropic");
   } catch {
     return null;
   }
-  const response = await fetch("https://api.anthropic.com/api/oauth/usage", {
-    headers: {
-      Accept: "application/json, text/plain, */*",
-      "Content-Type": "application/json",
-      "User-Agent": "claude-cli/2.1.63 (external, cli)",
-      "anthropic-beta": "claude-code-20250219,oauth-2025-04-20,interleaved-thinking-2025-05-14,context-management-2025-06-27,prompt-caching-scope-2026-01-05",
-      Authorization: `Bearer ${accessToken}`,
-    },
-    signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
-  });
-  if (!response.ok) return null;
-  const body = asRecord(await response.json().catch(() => null));
-  if (!body) return null;
-  const fiveHour = parseClaudeBucket(body.five_hour);
-  const sevenDay = parseClaudeBucket(body.seven_day);
-  const opus = parseClaudeBucket(body.seven_day_opus);
-  const sonnet = parseClaudeBucket(body.seven_day_sonnet);
-  const customWindows: ProviderQuotaWindow[] = [];
-  if (fiveHour?.percent !== undefined) customWindows.push({ label: "5h", percent: fiveHour.percent, ...(fiveHour.resetAt !== undefined ? { resetAt: fiveHour.resetAt } : {}) });
-  if (opus?.percent !== undefined) customWindows.push({ label: "Opus", percent: opus.percent, ...(opus.resetAt !== undefined ? { resetAt: opus.resetAt } : {}) });
-  if (sonnet?.percent !== undefined) customWindows.push({ label: "Sonnet", percent: sonnet.percent, ...(sonnet.resetAt !== undefined ? { resetAt: sonnet.resetAt } : {}) });
-  const quota: ProviderQuota = {
-    ...(sevenDay?.percent !== undefined ? { weeklyPercent: sevenDay.percent } : {}),
-    ...(sevenDay?.resetAt !== undefined ? { weeklyResetAt: sevenDay.resetAt } : {}),
-    ...(customWindows.length > 0 ? { customWindows } : {}),
-    updatedAt: Date.now(),
-  };
+  const quota = await fetchAnthropicUsageQuota(accessToken);
+  if (!quota) return null;
+  // Share the active-account probe with the per-account cache so Providers-page
+  // loads do not double-hit Anthropic's rate-limited usage endpoint.
+  if (probedAccountId) {
+    const stillOwnsToken = getAccountCredential("anthropic", probedAccountId)?.access === accessToken;
+    if (stillOwnsToken) {
+      accountQuotaCache.set(accountCacheKey("anthropic", probedAccountId), { ts: Date.now(), quota });
+    }
+  }
   return report(provider, "anthropic:oauth-usage", quota);
 }
 
+// ---------------------------------------------------------------------------
+// Per-account quota (multiauth)
+// ---------------------------------------------------------------------------
+
+/**
+ * Anthropic reports usage per CREDENTIAL, so every logged-in account can be probed with its
+ * own bearer token — the active-account selection and the local usage log are irrelevant here.
+ * Mirrors the Codex pool behaviour (codex/auth-api.ts:fetchPoolAccountQuota), including a
+ * per-account TTL so N accounts cost at most N upstream calls per window.
+ *
+ * The TTL is deliberately longer than the provider-level one: this path multiplies by account
+ * count, and Anthropic rate-limits the usage endpoint (observed 429 under repeated probing).
+ */
+const ACCOUNT_QUOTA_TTL_MS = 10 * 60_000;
+type AccountQuotaCacheEntry = {
+  ts: number;
+  quota: ProviderQuota | null;
+  /** Last probe failed (429 / network / expired login); still may hold last-good quota. */
+  unavailable?: true;
+};
+const accountQuotaCache = new Map<string, AccountQuotaCacheEntry>();
+const accountQuotaInflight = new Map<string, Promise<AccountQuotaCacheEntry>>();
+
+export interface ProviderAccountQuota {
+  accountId: string;
+  quota: ProviderQuota | null;
+  /** Set when the probe could not reach upstream (expired login, 429, network). */
+  unavailable?: true;
+}
+
+/** Providers whose per-account quota can be probed. Extend as other OAuth APIs are covered. */
+export function supportsPerAccountQuota(provider: string): boolean {
+  return provider === "anthropic";
+}
+
+function accountCacheKey(provider: string, accountId: string): string {
+  return `${provider}\u0000${accountId}`;
+}
+
+/**
+ * Synchronous last-good per-account quota read for routing. Never probes the network.
+ * Returns null when nothing is cached (or the cached row has no bars).
+ */
+export function getCachedProviderAccountQuota(provider: string, accountId: string): ProviderQuota | null {
+  const entry = accountQuotaCache.get(accountCacheKey(provider, accountId));
+  return entry?.quota ?? null;
+}
+
+/** Test-only: seed or clear the per-account quota cache without probing upstream. */
+export function setCachedProviderAccountQuotaForTests(
+  provider: string,
+  accountId: string,
+  quota: ProviderQuota | null,
+): void {
+  const key = accountCacheKey(provider, accountId);
+  if (quota === null) {
+    accountQuotaCache.delete(key);
+    return;
+  }
+  accountQuotaCache.set(key, { ts: Date.now(), quota });
+}
+
+/** Drop cached per-account rows (all, or just one provider's). */
+export function clearAccountQuotaCache(provider?: string): void {
+  if (!provider) {
+    accountQuotaCache.clear();
+    accountQuotaInflight.clear();
+    return;
+  }
+  const prefix = `${provider}\u0000`;
+  for (const key of [...accountQuotaCache.keys()]) {
+    if (key.startsWith(prefix)) accountQuotaCache.delete(key);
+  }
+  // Drop in-flight probes too so a late resolve cannot repopulate after logout/remove.
+  for (const key of [...accountQuotaInflight.keys()]) {
+    if (key.startsWith(prefix)) accountQuotaInflight.delete(key);
+  }
+}
+
+/**
+ * Resolve a bearer for quota probing without silently adopting a newer global
+ * Claude CLI credential into a background multiauth slot.
+ *
+ * - Fresh stored access → use as-is (no refresh).
+ * - Active account with expired access → normal refresh path.
+ * - Background `local-cli` with expired access → fail closed (unavailable):
+ *   `getValidAccessTokenForAccount` can persist a mismatched Claude CLI identity.
+ * - Background ordinary OAuth (`source !== "local-cli"`) → safe to refresh;
+ *   Anthropic's lock only adopts disk credentials for `local-cli` rows.
+ */
+async function getTokenForAccountQuotaProbe(provider: string, accountId: string): Promise<string> {
+  const stored = getAccountCredential(provider, accountId);
+  if (!stored) throw new Error("account credential missing");
+  if (stored.expires > Date.now() + ACCOUNT_TOKEN_SKEW_MS) return stored.access;
+  const activeId = getAccountSet(provider)?.activeAccountId;
+  if (activeId !== accountId && stored.source === "local-cli") {
+    throw new Error("background local-cli token expired; skip CLI-adopting refresh for quota probe");
+  }
+  return getValidAccessTokenForAccount(provider, accountId);
+}
+
+async function fetchAccountQuota(
+  provider: string,
+  accountId: string,
+  forceRefresh: boolean,
+): Promise<AccountQuotaCacheEntry> {
+  const key = accountCacheKey(provider, accountId);
+  const cached = accountQuotaCache.get(key);
+  if (!forceRefresh && cached && Date.now() - cached.ts < ACCOUNT_QUOTA_TTL_MS) return cached;
+  const joinable = accountQuotaInflight.get(key);
+  if (joinable) return joinable;
+
+  const probe = (async (): Promise<AccountQuotaCacheEntry> => {
+    try {
+      const token = await getTokenForAccountQuotaProbe(provider, accountId);
+      const quota = await fetchAnthropicUsageQuota(token);
+      if (!quota) {
+        // Preserve last-good bars and mark unavailable; advance TTL so failures
+        // negative-cache instead of re-probing on every GUI poll.
+        const entry: AccountQuotaCacheEntry = {
+          ts: Date.now(),
+          quota: cached?.quota ?? null,
+          unavailable: true,
+        };
+        accountQuotaCache.set(key, entry);
+        return entry;
+      }
+      const entry: AccountQuotaCacheEntry = { ts: Date.now(), quota };
+      accountQuotaCache.set(key, entry);
+      return entry;
+    } catch {
+      const entry: AccountQuotaCacheEntry = {
+        ts: Date.now(),
+        quota: cached?.quota ?? null,
+        unavailable: true,
+      };
+      accountQuotaCache.set(key, entry);
+      return entry;
+    }
+  })().finally(() => {
+    if (accountQuotaInflight.get(key) === probe) accountQuotaInflight.delete(key);
+  });
+  accountQuotaInflight.set(key, probe);
+  return probe;
+}
+
+/**
+ * Per-account quota rows for a provider's logged-in accounts. Probes run in parallel; a
+ * single failing account never blocks the others.
+ */
+export async function fetchProviderAccountQuotas(
+  provider: string,
+  forceRefresh = false,
+): Promise<ProviderAccountQuota[]> {
+  if (!supportsPerAccountQuota(provider)) return [];
+  const set = getAccountSet(provider);
+  if (!set) return [];
+  return await Promise.all(set.accounts.map(async account => {
+    const entry = await fetchAccountQuota(provider, account.id, forceRefresh);
+    return {
+      accountId: account.id,
+      quota: entry.quota,
+      ...(entry.unavailable ? { unavailable: true as const } : {}),
+    };
+  }));
+}
+
 function normalizedBaseUrl(value: string): string | null {
   try {
     const url = new URL(value);