@bitkyc08/opencodex 2.72.0 → 2.73.0

package/src/providers/api-key-resolve.ts

@@ -16,8 +16,8 @@
  * Policy: a reference that cannot be resolved fails closed (no key) and is warned once per
  * account; nothing ever rewrites plaintext into config or its backups.
  */
-import { createRequire } from "node:module";
 import { resolveEnvValue } from "../config/proxy-env";
+import { loadKeyringBinding } from "../lib/keyring-native";
 import type { OcxProviderConfig } from "../types";
 
 export const KEYCHAIN_REFERENCE_PREFIX = "keychain:";
@@ -31,10 +31,8 @@ export interface ProviderKeychainEntry {
 
 export type ProviderKeychainEntryFactory = (service: string, account: string) => ProviderKeychainEntry;
 
-const nodeRequire = createRequire(import.meta.url);
-
 function defaultEntryFactory(service: string, account: string): ProviderKeychainEntry {
-  const { Entry } = nodeRequire("@napi-rs/keyring") as { Entry: new (s: string, a: string) => ProviderKeychainEntry };
+  const { Entry } = loadKeyringBinding() as { Entry: new (s: string, a: string) => ProviderKeychainEntry };
   return new Entry(service, account);
 }
 

package/src/providers/codebuddy-models.ts

@@ -28,6 +28,8 @@ export const CODEBUDDY_GLOBAL_MODELS = [
   // 260923 preemptive: GPT-6 Sol and Luna (OpenAI announced 2026-09-22) added ahead of this provider's own catalog; mirrors the GPT-5.6 Sol/Luna rows.
   "gpt-6-sol",
   "gpt-6-luna",
+  // 260930 preemptive: GPT-6.1 Sol (OpenAI announced 2026-09-29); mirrors the GPT-6 Sol row.
+  "gpt-6.1-sol",
   "gpt-5.5",
   "gpt-5.4",
   "gpt-5.3-codex",
@@ -79,6 +81,7 @@ export const CODEBUDDY_GLOBAL_MODEL_CONTEXT_WINDOWS: Record<string, number> = {
   "gpt-5.6-luna": 1_000_000,
   "gpt-6-sol": 1_000_000,
   "gpt-6-luna": 1_000_000,
+  "gpt-6.1-sol": 1_000_000,
   "gpt-5.5": 1_000_000,
   "gpt-5.4": 272_000,
   "gpt-5.3-codex": 272_000,
@@ -101,6 +104,7 @@ export const CODEBUDDY_GLOBAL_MODEL_MAX_OUTPUT_TOKENS: Record<string, number> =
   "gpt-5.6-luna": 128_000,
   "gpt-6-sol": 128_000,
   "gpt-6-luna": 128_000,
+  "gpt-6.1-sol": 128_000,
   "gpt-5.5": 72_000,
   "gpt-5.4": 128_000,
   "gpt-5.3-codex": 128_000,
@@ -119,6 +123,7 @@ export const CODEBUDDY_GLOBAL_MODEL_REASONING_EFFORTS: Record<string, string[]>
   "gpt-5.6-luna": ["low", "medium", "high", "xhigh"],
   "gpt-6-sol": ["low", "medium", "high", "xhigh"],
   "gpt-6-luna": ["low", "medium", "high", "xhigh"],
+  "gpt-6.1-sol": ["low", "medium", "high", "xhigh"],
   "glm-5.3": ["low", "high", "max"],
   "glm-5.2": ["high", "xhigh"],
 };
@@ -129,6 +134,7 @@ export const CODEBUDDY_GLOBAL_MODEL_DEFAULT_REASONING_EFFORTS: Record<string, st
   "gpt-5.6-luna": "high",
   "gpt-6-sol": "high",
   "gpt-6-luna": "high",
+  "gpt-6.1-sol": "high",
   "glm-5.3": "high",
   "glm-5.2": "high",
 };

package/src/providers/kiro-models.ts

@@ -7,6 +7,9 @@ export const KIRO_MODELS = [
   // 260923 preemptive: GPT-6 Sol and Luna (OpenAI announced 2026-09-22) added ahead of this provider's own catalog; mirrors the GPT-5.6 Sol/Luna rows. Calls fail upstream until Kiro ships the models.
   "gpt-6-sol",
   "gpt-6-luna",
+  // 260930 preemptive: GPT-6.1 Sol (OpenAI announced 2026-09-29; kiro.dev did not list it on 2026-09-30).
+  // Mirrors gpt-6-sol; calls fail upstream until Kiro ships the model.
+  "gpt-6.1-sol",
   // 260929 preemptive: Claude Sonnet 5.5 added ahead of Kiro's catalog (kiro.dev did not list it on
   // 2026-09-29). Mirrors claude-sonnet-5; calls fail upstream until Kiro ships the model.
   "claude-sonnet-5.5",
@@ -40,6 +43,7 @@ export const KIRO_MODEL_CONTEXT_WINDOWS: Record<string, number> = {
   "gpt-5.6-luna": 1_000_000,
   "gpt-6-sol": 272_000,
   "gpt-6-luna": 272_000,
+  "gpt-6.1-sol": 272_000,
   "claude-sonnet-5.5": 1_000_000,
   "claude-sonnet-5": 1_000_000,
   "claude-opus-5.5": 1_000_000,

package/src/providers/label.ts

@@ -1,4 +1,4 @@
-import { CODEX_ACCOUNT_LOG_LABEL_RE, KEY_ACCOUNT_LOG_LABEL_RE, apiKeyAccountLogLabel, oauthAccountLogLabel } from "../codex/account-label";
+import { ACCOUNT_LOG_LABEL_RE, CODEX_ACCOUNT_LOG_LABEL_RE, KEY_ACCOUNT_LOG_LABEL_RE, apiKeyAccountLogLabel, oauthAccountLogLabel } from "../codex/account-label";
 import type { OcxProviderConfig } from "../types";
 
 export function canonicalUsageProviderLabel(provider: string): string {
@@ -25,6 +25,25 @@ export function stampApiKeyAccountLabel(
   }
 }
 
+/**
+ * The account-qualified provider label a pool dispatch stamped for this request, or undefined.
+ *
+ * An account pool rewrites the logged provider to name the account that served the turn
+ * (`anthropic-p2e22d0`, `openai-main`); the configured provider name never does, so a label that
+ * differs from the configured one AND ends in an account label identifies exactly one account.
+ *
+ * Deliberately NOT `accountLogLabel`: that is stamped for a lone configured API key too, so it
+ * cannot tell a pooled account apart from a provider that has no pool to rotate within.
+ */
+export function poolAccountProviderLabel(
+  loggedProvider: string | undefined,
+  configuredProvider: string,
+): string | undefined {
+  if (!loggedProvider?.startsWith(`${configuredProvider}-`)) return undefined;
+  return ACCOUNT_LOG_LABEL_RE.test(loggedProvider.slice(configuredProvider.length + 1))
+    ? loggedProvider : undefined;
+}
+
 export function baseProviderLabel(provider: string): string {
   const canonical = canonicalUsageProviderLabel(provider);
   if (canonical !== provider) return canonical;

package/src/providers/quota/account-cache.ts

@@ -272,7 +272,8 @@ export function recordAnthropicAccountQuotaFromHeaders(
   // whole map. Landing before any reader has hydrated would persist this single row and erase
   // every other provider's saved row.
   hydrateAccountQuotaCache();
-  const previous = accountQuotaCache.get(key);
+  const candidate = accountQuotaCache.get(key);
+  const previous = candidate?.isCurrent?.() === false ? undefined : candidate;
   accountQuotaCache.set(key, {
     ...previous,
     // Headers do not prove that the last usage probe succeeded.

package/src/providers/quota/anthropic-cooldown-recovery.ts

@@ -0,0 +1,118 @@
+import { credentialGeneration, getAccountCredential, getAccountCredentialWithStatus } from "../../oauth/store";
+import type { ProviderQuota } from "../quota-types";
+
+export class AnthropicQuotaProbeOwnershipError extends Error {}
+
+/** Check live pause and bearer ownership at the last synchronous step before usage dispatch. */
+export function assertAnthropicQuotaSendAllowed(accountId: string, token: string): void {
+  const row = getAccountCredentialWithStatus("anthropic", accountId);
+  if (!row || row.paused || row.needsReauth || row.credential.access !== token) {
+    throw new AnthropicQuotaProbeOwnershipError("anthropic quota account is no longer eligible");
+  }
+}
+
+const cooldownGenerationByAccount = new Map<string, number>();
+let nextCooldownGeneration = 1;
+let afterSettlementForTests: (() => void) | undefined;
+
+export function setAnthropicQuotaAfterSettlementForTests(hook: (() => void) | undefined): void {
+  afterSettlementForTests = hook;
+}
+
+/** Monotonic per-account fence shared by routing mutations and quota publication. */
+export function anthropicCooldownGeneration(accountId: string): number {
+  return cooldownGenerationByAccount.get(accountId) ?? 0;
+}
+
+/** Keep same-state quota calls joinable while moving post-429 calls to a fresh flight. */
+export function anthropicCooldownFlightKey(baseKey: string, accountId: string): string {
+  return `${baseKey}\0anthropic-cooldown:${anthropicCooldownGeneration(accountId)}`;
+}
+
+export function noteAnthropicCooldownMutation(accountId: string): number {
+  const generation = nextCooldownGeneration++;
+  cooldownGenerationByAccount.set(accountId, generation);
+  return generation;
+}
+
+export function clearAnthropicCooldownGenerations(): void {
+  cooldownGenerationByAccount.clear();
+}
+
+export type AnthropicCooldownRecoveryProbe = Readonly<{
+  requiresFreshDispatch: boolean;
+  isCurrentCredential(): boolean;
+  isCurrent(): boolean;
+  settle(quota: ProviderQuota): "cleared" | "retained" | "superseded";
+}>;
+
+export type AnthropicQuotaRecoveryResult = Readonly<{
+  quota: ProviderQuota;
+  /** Must be checked synchronously at each publication boundary. */
+  isCurrent(): boolean;
+}>;
+
+/**
+ * Bind a quota probe to both the credential and cooldown generations it observed before
+ * dispatch. A successful response may otherwise arrive after either credential replacement
+ * or a newer 429 and incorrectly make unrelated state eligible.
+ */
+export async function captureAnthropicCooldownRecoveryProbe(
+  accountId: string,
+  accessToken: string,
+): Promise<AnthropicCooldownRecoveryProbe | null> {
+  const credential = getAccountCredential("anthropic", accountId);
+  if (!credential || credential.access !== accessToken) return null;
+  const generation = credentialGeneration(credential);
+  // Lazy because anthropic-routing reads the quota cache on normal request routing.
+  const routing = await import("../../oauth/anthropic-routing");
+  const cooldownGeneration = anthropicCooldownGeneration(accountId);
+  const claim = routing.captureAnthropicCooldownRecovery(accountId);
+  const isCurrentCredential = () => {
+    const current = getAccountCredential("anthropic", accountId);
+    return !!current && credentialGeneration(current) === generation;
+  };
+  return {
+    requiresFreshDispatch: claim !== null,
+    isCurrentCredential,
+    isCurrent: () => isCurrentCredential()
+      && anthropicCooldownGeneration(accountId) === cooldownGeneration,
+    settle: quota => claim === null ? "retained"
+      : routing.settleAnthropicCooldownRecovery(claim, quota),
+  };
+}
+
+/** Run one authoritative usage read and publish its recovery effect only while still owned. */
+export async function probeAnthropicQuotaWithRecovery(
+  accountId: string,
+  accessToken: string,
+  read: (requireFreshDispatch: boolean) => Promise<ProviderQuota | null>,
+  mayPublish: () => boolean,
+): Promise<AnthropicQuotaRecoveryResult | null> {
+  const probe = await captureAnthropicCooldownRecoveryProbe(accountId, accessToken);
+  if (!probe) throw new AnthropicQuotaProbeOwnershipError("anthropic quota probe lost credential ownership");
+  let quota: ProviderQuota | null;
+  try { quota = await read(probe.requiresFreshDispatch); }
+  catch (error) {
+    if (!probe.isCurrent() || !mayPublish()) throw new AnthropicQuotaProbeOwnershipError("anthropic quota probe failure is stale");
+    throw error;
+  }
+  if (!probe.isCurrent() || !mayPublish()) {
+    throw new AnthropicQuotaProbeOwnershipError("anthropic quota probe result is stale");
+  }
+  if (!quota) return null;
+  const settlement = probe.settle(quota);
+  if (settlement === "superseded") {
+    throw new AnthropicQuotaProbeOwnershipError("anthropic quota probe lost cooldown ownership");
+  }
+  // Clearing the claimed cooldown intentionally advances the fence. Adopt that exact new
+  // generation; any later observation/429 then invalidates publication before a cache write.
+  const publicationGeneration = anthropicCooldownGeneration(accountId);
+  afterSettlementForTests?.();
+  return {
+    quota,
+    isCurrent: () => probe.isCurrentCredential()
+      && anthropicCooldownGeneration(accountId) === publicationGeneration
+      && mayPublish(),
+  };
+}

package/src/providers/quota/vendor-probes-oauth.ts

@@ -1,7 +1,7 @@
 import { effectiveCodexAuthAccountId, fetchMainAccountInfoSnapshot, listCodexAuthAccountsSnapshot } from "../../codex/auth-api";
 import { MAIN_CODEX_ACCOUNT_ID } from "../../codex/main-account";
 import { getValidAccessToken } from "../../oauth";
-import { getAccountCredential, getAccountSet } from "../../oauth/store";
+import { captureOAuthAccountSelection, getAccountCredential, getAccountSet } from "../../oauth/store";
 import { hydrateKiroAccountState, persistKiroAccountState } from "../kiro-account-state-disk";
 import { kiroProbeCurrent, kiroProbeIdentity } from "./kiro-account-probe";
 import { fetchMuseKeyQuotaSnapshot } from "../muse-key-quota";
@@ -18,6 +18,7 @@ import { aggregateCodexPoolCapacity, CODEX_CAPACITY_MAX_QUOTA_AGE_MS, type Codex
 import { asRecord, normalizePercent, normalizeResetAt, readQuotaJson, REQUEST_TIMEOUT_MS, toFiniteNumber } from "../quota-wire";
 import { providerCodexAccountMode } from "../registry";
 import {
+  accountReportCurrent,
   TERMINAL_QUOTA_FAILURE,
   hasQuotaRows,
   providerLabel,
@@ -38,6 +39,7 @@ import {
 } from "./account-cache";
 import type { OcxConfig, OcxProviderConfig } from "../../types";
 import type { ProviderQuota, ProviderQuotaWindow } from "../quota-types";
+import { AnthropicQuotaProbeOwnershipError, assertAnthropicQuotaSendAllowed, probeAnthropicQuotaWithRecovery } from "./anthropic-cooldown-recovery";
 
 const XAI_BILLING_URL = "https://cli-chat-proxy.grok.com/v1/billing";
 const XAI_CREDITS_URL = `${XAI_BILLING_URL}?format=credits`;
@@ -262,6 +264,56 @@ function parseClaudeLimit(value: unknown): ProviderQuotaWindow | null {
 /** Claude's OAuth usage endpoint, probed with ONE account's own bearer token. */
 const anthropicUsageInflight = new Map<string, Promise<ProviderQuota | null>>();
 
+async function readAnthropicUsageQuota(accessToken: string): Promise<ProviderQuota | null> {
+  const response = await fetch("https://api.anthropic.com/api/oauth/usage", {
+    headers: {
+      Accept: "application/json, text/plain, */*",
+      "Content-Type": "application/json",
+      "User-Agent": CLAUDE_CLI_USER_AGENT,
+      "anthropic-beta": "claude-code-20250219,oauth-2025-04-20,interleaved-thinking-2025-05-14,context-management-2025-06-27,prompt-caching-scope-2026-01-05",
+      Authorization: `Bearer ${accessToken}`,
+    },
+    signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+  });
+  if (!response.ok) return null;
+  const body = asRecord(await readQuotaJson(response));
+  if (!body) return null;
+  const fiveHour = parseClaudeBucket(body.five_hour);
+  const sevenDay = parseClaudeBucket(body.seven_day);
+  const fable = parseClaudeBucket(body.seven_day_fable);
+  const opus = parseClaudeBucket(body.seven_day_opus);
+  const sonnet = parseClaudeBucket(body.seven_day_sonnet);
+  const customWindows: ProviderQuotaWindow[] = [];
+  if (fable?.percent !== undefined) customWindows.push({ label: "Fable", scope: "model", percent: fable.percent, ...(fable.resetAt !== undefined ? { resetAt: fable.resetAt } : {}) });
+  if (opus?.percent !== undefined) customWindows.push({ label: "Opus", scope: "model", percent: opus.percent, ...(opus.resetAt !== undefined ? { resetAt: opus.resetAt } : {}) });
+  if (sonnet?.percent !== undefined) customWindows.push({ label: "Sonnet", scope: "model", percent: sonnet.percent, ...(sonnet.resetAt !== undefined ? { resetAt: sonnet.resetAt } : {}) });
+  const knownLabels = new Set(customWindows.map(window => window.label.toLowerCase()));
+  const limits = Array.isArray(body.limits) ? body.limits : [];
+  for (const rawLimit of limits) {
+    const limitRecord = asRecord(rawLimit);
+    // `session` and `weekly_all` mirror the canonical five-hour and weekly
+    // buckets above; only model-scoped weekly limits add a third window.
+    if (String(limitRecord?.kind ?? "").trim().toLowerCase() !== "weekly_scoped") continue;
+    const limit = parseClaudeLimit(rawLimit);
+    if (!limit || knownLabels.has(limit.label.toLowerCase())) continue;
+    knownLabels.add(limit.label.toLowerCase());
+    customWindows.push(limit);
+  }
+  const quota: ProviderQuota = {
+    // Claude's 5-hour window is a first-class rate limit, same as the Codex login 5h/weekly
+    // rows: report it in the canonical fields so the dashboard renders it with the standard
+    // "5-hour limit" label and ordering instead of as a generic extra window.
+    ...(fiveHour?.percent !== undefined ? { fiveHourPercent: fiveHour.percent } : {}),
+    ...(fiveHour?.resetAt !== undefined ? { fiveHourResetAt: fiveHour.resetAt } : {}),
+    ...(sevenDay?.percent !== undefined ? { weeklyPercent: sevenDay.percent } : {}),
+    ...(sevenDay?.resetAt !== undefined ? { weeklyResetAt: sevenDay.resetAt } : {}),
+    ...(customWindows.length > 0 ? { customWindows } : {}),
+    updatedAt: Date.now(),
+  };
+  // Empty / schema-changed payloads must not cache as "success with no bars".
+  return hasQuotaRows(quota) ? quota : null;
+}
+
 /**
  * Anthropic per-credential usage.
  *
@@ -277,59 +329,16 @@ const anthropicUsageInflight = new Map<string, Promise<ProviderQuota | null>>();
  * model-scoped window tracks entitlement rather than seat size. Populate `plan` only when
  * upstream returns the tier itself.
  */
-export async function fetchAnthropicUsageQuota(accessToken: string): Promise<ProviderQuota | null> {
-  const joinable = anthropicUsageInflight.get(accessToken);
+export async function fetchAnthropicUsageQuota(
+  accessToken: string,
+  requireFreshDispatch = false,
+): Promise<ProviderQuota | null> {
+  // Recovery evidence must be requested after the claimed cooldown. Joining an older request
+  // can return after the 429 while still describing provider state from before that refusal.
+  const joinable = requireFreshDispatch ? undefined : anthropicUsageInflight.get(accessToken);
   if (joinable) return joinable;
 
-  const probe = (async (): Promise<ProviderQuota | null> => {
-    const response = await fetch("https://api.anthropic.com/api/oauth/usage", {
-      headers: {
-        Accept: "application/json, text/plain, */*",
-        "Content-Type": "application/json",
-        "User-Agent": CLAUDE_CLI_USER_AGENT,
-        "anthropic-beta": "claude-code-20250219,oauth-2025-04-20,interleaved-thinking-2025-05-14,context-management-2025-06-27,prompt-caching-scope-2026-01-05",
-        Authorization: `Bearer ${accessToken}`,
-      },
-      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
-    });
-    if (!response.ok) return null;
-    const body = asRecord(await readQuotaJson(response));
-    if (!body) return null;
-    const fiveHour = parseClaudeBucket(body.five_hour);
-    const sevenDay = parseClaudeBucket(body.seven_day);
-    const fable = parseClaudeBucket(body.seven_day_fable);
-    const opus = parseClaudeBucket(body.seven_day_opus);
-    const sonnet = parseClaudeBucket(body.seven_day_sonnet);
-    const customWindows: ProviderQuotaWindow[] = [];
-    if (fable?.percent !== undefined) customWindows.push({ label: "Fable", scope: "model", percent: fable.percent, ...(fable.resetAt !== undefined ? { resetAt: fable.resetAt } : {}) });
-    if (opus?.percent !== undefined) customWindows.push({ label: "Opus", scope: "model", percent: opus.percent, ...(opus.resetAt !== undefined ? { resetAt: opus.resetAt } : {}) });
-    if (sonnet?.percent !== undefined) customWindows.push({ label: "Sonnet", scope: "model", percent: sonnet.percent, ...(sonnet.resetAt !== undefined ? { resetAt: sonnet.resetAt } : {}) });
-    const knownLabels = new Set(customWindows.map(window => window.label.toLowerCase()));
-    const limits = Array.isArray(body.limits) ? body.limits : [];
-    for (const rawLimit of limits) {
-      const limitRecord = asRecord(rawLimit);
-      // `session` and `weekly_all` mirror the canonical five-hour and weekly
-      // buckets above; only model-scoped weekly limits add a third window.
-      if (String(limitRecord?.kind ?? "").trim().toLowerCase() !== "weekly_scoped") continue;
-      const limit = parseClaudeLimit(rawLimit);
-      if (!limit || knownLabels.has(limit.label.toLowerCase())) continue;
-      knownLabels.add(limit.label.toLowerCase());
-      customWindows.push(limit);
-    }
-    const quota: ProviderQuota = {
-      // Claude's 5-hour window is a first-class rate limit, same as the Codex login 5h/weekly
-      // rows: report it in the canonical fields so the dashboard renders it with the standard
-      // "5-hour limit" label and ordering instead of as a generic extra window.
-      ...(fiveHour?.percent !== undefined ? { fiveHourPercent: fiveHour.percent } : {}),
-      ...(fiveHour?.resetAt !== undefined ? { fiveHourResetAt: fiveHour.resetAt } : {}),
-      ...(sevenDay?.percent !== undefined ? { weeklyPercent: sevenDay.percent } : {}),
-      ...(sevenDay?.resetAt !== undefined ? { weeklyResetAt: sevenDay.resetAt } : {}),
-      ...(customWindows.length > 0 ? { customWindows } : {}),
-      updatedAt: Date.now(),
-    };
-    // Empty / schema-changed payloads must not cache as "success with no bars".
-    return hasQuotaRows(quota) ? quota : null;
-  })().finally(() => {
+  const probe = readAnthropicUsageQuota(accessToken).finally(() => {
     if (anthropicUsageInflight.get(accessToken) === probe) anthropicUsageInflight.delete(accessToken);
   });
   anthropicUsageInflight.set(accessToken, probe);
@@ -339,7 +348,8 @@ export async function fetchAnthropicUsageQuota(accessToken: string): Promise<Pro
 export async function fetchAnthropicQuota(provider: string): Promise<ProviderQuotaReport | null> {
   // Capture the account we intend to probe before awaiting — a mid-flight active
   // switch must not seed the wrong account's cache with this response.
-  const probedAccountId = getAccountSet("anthropic")?.activeAccountId;
+  const selection = captureOAuthAccountSelection("anthropic");
+  const probedAccountId = selection?.accountId;
   const probedAccountKey = probedAccountId ? accountCacheKey("anthropic", probedAccountId) : null;
   const writerGeneration = captureConfigGeneration();
   let accessToken: string;
@@ -348,17 +358,34 @@ export async function fetchAnthropicQuota(provider: string): Promise<ProviderQuo
   } catch {
     return null;
   }
-  const quota = await fetchAnthropicUsageQuota(accessToken);
+  if (!probedAccountId || !probedAccountKey) return null;
+  let quota: ProviderQuota | null;
+  let anthropicCurrent: (() => boolean) | undefined;
+  try {
+    const result = await probeAnthropicQuotaWithRecovery(probedAccountId, accessToken,
+      fresh => { assertAnthropicQuotaSendAllowed(probedAccountId, accessToken); return fetchAnthropicUsageQuota(accessToken, fresh); },
+      () => mayCommitAccountQuotaKey(probedAccountKey, writerGeneration));
+    if (result && !result.isCurrent()) return null;
+    quota = result?.quota ?? null;
+    anthropicCurrent = result?.isCurrent;
+  } catch (error) {
+    if (error instanceof AnthropicQuotaProbeOwnershipError) return null;
+    throw error;
+  }
   if (!quota) return null;
   // Share the active-account probe with the per-account cache so Providers-page
   // loads do not double-hit Anthropic's rate-limited usage endpoint.
   if (probedAccountId && probedAccountKey) {
     const stillOwnsToken = getAccountCredential("anthropic", probedAccountId)?.access === accessToken;
-    if (stillOwnsToken && mayCommitAccountQuotaKey(probedAccountKey, writerGeneration)) {
-      accountQuotaCache.set(probedAccountKey, { ts: Date.now(), quota });
+    if (stillOwnsToken && anthropicCurrent?.() && mayCommitAccountQuotaKey(probedAccountKey, writerGeneration)) {
+      accountQuotaCache.set(probedAccountKey, { ts: Date.now(), quota, isCurrent: anthropicCurrent });
     }
   }
-  return report(provider, "anthropic:oauth-usage", quota);
+  const quotaReport = report(provider, "anthropic:oauth-usage", quota);
+  if (quotaReport && anthropicCurrent) {
+    accountReportCurrent.set(quotaReport, () => anthropicCurrent() && getAccountSet("anthropic")?.activeAccountId === probedAccountId);
+  }
+  return quotaReport;
 }
 
 /**

package/src/providers/quota.ts

@@ -68,7 +68,7 @@ import { fetchCommandCodeQuota, fetchKimiQuota, keyQuotaReaderForProvider } from
 import { antigravityQuotaDiagnosticIdentity, fetchAntigravityQuota, probeAntigravityUsageQuota } from "./quota/antigravity";
 import { persistKiroAccountState } from "./kiro-account-state-disk";
 import { kiroProbeCurrent, kiroProbeIdentity } from "./quota/kiro-account-probe";
-
+import { AnthropicQuotaProbeOwnershipError, anthropicCooldownFlightKey, assertAnthropicQuotaSendAllowed, probeAnthropicQuotaWithRecovery } from "./quota/anthropic-cooldown-recovery";
 export type { ProviderQuota, ProviderQuotaCreditsUsd, ProviderQuotaWindow } from "./quota-types";
 export { QUOTA_RESPONSE_MAX_BYTES } from "./quota-wire";
 export {
@@ -98,7 +98,6 @@ export {
 export { fetchAntigravityUsageQuota, isCanonicalAntigravityQuotaUrl, setAntigravityAccountQuotaTransportForTests } from "./quota/antigravity";
 export { parseOllamaCloudQuota, parseZaiQuotaLimits, providerApiKeyQuotaMode } from "./quota/vendor-probes-key";
 export { parseXaiCreditsResponse } from "./quota/vendor-probes-oauth";
-
 export async function fetchProviderApiKeyQuotas(config: OcxConfig, name: string, forceRefresh = false): Promise<ProviderApiKeyQuota[]> {
   const provider = config.providers[name];
   if (!provider || !keyQuotaReaderForProvider(name, provider)) return [];
@@ -109,7 +108,6 @@ export async function fetchProviderApiKeyQuotas(config: OcxConfig, name: string,
     return result ? { kind: "quota", quota: result.quota } : { kind: "unavailable" };
   });
 }
-
 async function maybeFetchProviderQuota(
   name: string,
   provider: OcxProviderConfig,
@@ -338,7 +336,6 @@ export async function fetchProviderQuotaReports(config: OcxConfig, forceRefresh
     if (inflight.get(key) === entry) inflight.delete(key);
   }
 }
-
 async function readExplicitAccountQuota(provider: string, accountId: string, configured?: OcxProviderConfig): Promise<{
   result: ProviderQuotaProbeResult;
   identity: string | undefined;
@@ -367,7 +364,6 @@ async function readExplicitAccountQuota(provider: string, accountId: string, con
   }
   return { result, identity, isCurrent };
 }
-
 async function fetchExplicitAccountQuota(provider: string, accountId: string, force: boolean, configured?: OcxProviderConfig): Promise<AccountQuotaCacheEntry> {
   const key = accountCacheKey(provider, accountId);
   const identity = explicitQuotaIdentity(provider, accountId, configured);
@@ -403,7 +399,6 @@ async function fetchExplicitAccountQuota(provider: string, accountId: string, fo
   accountQuotaInflight.set(flightKey, flight);
   return flight;
 }
-
 async function fetchExplicitCurrentQuota(provider: string, config: OcxProviderConfig, liveConfig: OcxConfig): Promise<ProviderQuotaProbeResult> {
   const id = getAccountSet(provider)?.activeAccountId;
   if (!id) return null;
@@ -428,18 +423,22 @@ async function fetchAccountQuota(
   const writerGeneration = captureConfigGeneration();
   const kiroIdentity = provider === "kiro" ? kiroProbeIdentity(accountId) : undefined;
   const cachedCandidate = accountQuotaCache.get(key);
-  const cached = provider !== "kiro" || cachedCandidate?.identity === kiroIdentity ? cachedCandidate : undefined;
+  const cached = (provider !== "kiro" || cachedCandidate?.identity === kiroIdentity)
+    && (provider !== "anthropic" || cachedCandidate?.isCurrent?.() !== false) ? cachedCandidate : undefined;
   if (!forceRefresh && cached && Date.now() - cached.ts < ACCOUNT_QUOTA_TTL_MS) {
     if (provider === "google-antigravity" && cached.quotaFailure && cached.quotaFailureIsCurrent?.() !== true) return { ...cached, quotaFailure: undefined };
     return provider === "anthropic" ? { ...cached, quota: normalizeAnthropicQuota(cached.quota, Date.now()) } : cached;
   }
-  const joinable = accountQuotaInflight.get(key);
+  const flightKey = provider === "anthropic" ? anthropicCooldownFlightKey(key, accountId) : key;
+  const flightCurrent = () => provider !== "anthropic" || anthropicCooldownFlightKey(key, accountId) === flightKey;
+  const joinable = accountQuotaInflight.get(flightKey);
   if (joinable) {
     const joined = await joinable;
+    const joinedCurrent = joined.isCurrent?.();
+    if (joinedCurrent === false || (!flightCurrent() && joinedCurrent !== true)) return { ts: Date.now(), quota: null, unavailable: true };
     return provider !== "kiro" || joined.identity === kiroIdentity
       ? joined : fetchAccountQuota(provider, accountId, true, providerConfig);
   }
-
   const epoch = explicitAccountEpoch;
   const probe = (async (): Promise<AccountQuotaCacheEntry> => {
     let diagnosticIdentity: string | undefined;
@@ -449,15 +448,36 @@ async function fetchAccountQuota(
       catch { return false; }
     };
     const diagnosticFields = () => quotaFailure && quotaFailureIsCurrent() ? { quotaFailure, quotaFailureIsCurrent } : {};
+    const unavailable = (): AccountQuotaCacheEntry => {
+      if (!flightCurrent()) return { ts: Date.now(), quota: null, unavailable: true };
+      const previous = accountQuotaCache.get(key);
+      const retained = provider === "anthropic" && previous?.isCurrent?.() === false ? undefined : previous;
+      const entry: AccountQuotaCacheEntry = {
+        ts: Date.now(),
+        quota: provider === "anthropic" ? normalizeAnthropicQuota(retained?.quota, Date.now()) : cached?.quota ?? null,
+        unavailable: true,
+        ...(provider === "anthropic" && retained?.isCurrent ? { isCurrent: retained.isCurrent } : {}),
+        ...(provider === "kiro" ? { identity: kiroIdentity } : {}),
+        ...diagnosticFields(),
+      };
+      if (mayCommitAccountQuotaKey(key, writerGeneration) && (provider !== "kiro" || kiroProbeCurrent(accountId, kiroIdentity))) {
+        accountQuotaCache.set(key, entry);
+        if (provider === "kiro") persistKiroAccountState();
+        sweepExpiredOnWrite(entry.ts);
+      }
+      return entry;
+    };
     try {
       if (provider === "google-antigravity") diagnosticIdentity = antigravityQuotaDiagnosticIdentity(accountId);
       let quota: ProviderQuota | null;
+      let anthropicCurrent: (() => boolean) | undefined;
       let kiroSnapshot: KiroUsageSnapshot | null = null;
       if (provider === "kiro") {
         kiroSnapshot = await fetchKiroUsageSnapshot(await kiroUsageContextForAccount(accountId));
         quota = kiroSnapshot?.quota ?? null;
       } else {
         const token = await getTokenForAccountQuotaProbe(provider, accountId);
+        if (!flightCurrent()) throw new AnthropicQuotaProbeOwnershipError("anthropic quota flight is stale");
         if (provider === "google-antigravity") {
           // Per-account Gem/Cla windows (#1082). The project id is part of the stored
           // credential; without it the probe cannot be made, and that is "unavailable",
@@ -469,62 +489,40 @@ async function fetchAccountQuota(
           quota = result.kind === "available" ? result.quota : null;
           if (result.kind === "unavailable") quotaFailure = result.failure;
         } else if (provider === "anthropic") {
-          quota = await fetchAnthropicUsageQuota(token);
+          const result = await probeAnthropicQuotaWithRecovery(accountId, token,
+            fresh => { assertAnthropicQuotaSendAllowed(accountId, token); return fetchAnthropicUsageQuota(token, fresh); },
+            () => mayCommitAccountQuotaKey(key, writerGeneration));
+          if (result && !result.isCurrent()) throw new AnthropicQuotaProbeOwnershipError("anthropic quota probe lost publication ownership");
+          quota = result?.quota ?? null;
+          anthropicCurrent = result?.isCurrent;
         } else {
           return { ts: Date.now(), quota: null, unavailable: true };
         }
       }
-      if (!quota) {
-        // Preserve last-good bars while negative-caching the failed probe.
-        const entry: AccountQuotaCacheEntry = {
-          ts: Date.now(),
-          quota: provider === "anthropic"
-            ? normalizeAnthropicQuota(accountQuotaCache.get(key)?.quota, Date.now()) : cached?.quota ?? null,
-          unavailable: true,
-          ...(provider === "kiro" ? { identity: kiroIdentity } : {}),
-          ...diagnosticFields(),
-        };
-        if (mayCommitAccountQuotaKey(key, writerGeneration) && (provider !== "kiro" || kiroProbeCurrent(accountId, kiroIdentity))) {
-          accountQuotaCache.set(key, entry);
-          if (provider === "kiro") persistKiroAccountState();
-          sweepExpiredOnWrite(entry.ts);
-        }
-        return entry;
-      }
+      if (!quota) return unavailable();
       const entry: AccountQuotaCacheEntry = {
         ts: Date.now(), quota: provider === "anthropic" ? normalizeAnthropicQuota(quota, Date.now()) : quota,
         ...(provider === "kiro" ? { identity: kiroIdentity } : {}),
+        ...(anthropicCurrent ? { isCurrent: anthropicCurrent } : {}),
       };
-      if (mayCommitAccountQuotaKey(key, writerGeneration) && (provider !== "kiro" || kiroProbeCurrent(accountId, kiroIdentity))) {
+      if (mayCommitAccountQuotaKey(key, writerGeneration)
+        && (provider !== "kiro" || kiroProbeCurrent(accountId, kiroIdentity))) {
         accountQuotaCache.set(key, entry);
         if (provider === "kiro") { commitKiroAccountUsageState(key, kiroSnapshot, kiroIdentity); persistKiroAccountState(); }
         sweepExpiredOnWrite(entry.ts);
       }
       return entry;
-    } catch {
+    } catch (error) {
+      if (provider === "anthropic" && error instanceof AnthropicQuotaProbeOwnershipError) return { ts: Date.now(), quota: null, unavailable: true };
       if (provider === "google-antigravity") quotaFailure = "account_unavailable";
-      const entry: AccountQuotaCacheEntry = {
-        ts: Date.now(),
-        quota: provider === "anthropic"
-          ? normalizeAnthropicQuota(accountQuotaCache.get(key)?.quota, Date.now()) : cached?.quota ?? null,
-        unavailable: true,
-        ...(provider === "kiro" ? { identity: kiroIdentity } : {}),
-        ...diagnosticFields(),
-      };
-      if (mayCommitAccountQuotaKey(key, writerGeneration) && (provider !== "kiro" || kiroProbeCurrent(accountId, kiroIdentity))) {
-        accountQuotaCache.set(key, entry);
-        if (provider === "kiro") persistKiroAccountState();
-        sweepExpiredOnWrite(entry.ts);
-      }
-      return entry;
+      return unavailable();
     }
   })().finally(() => {
-    if (accountQuotaInflight.get(key) === probe) accountQuotaInflight.delete(key);
+    if (accountQuotaInflight.get(flightKey) === probe) accountQuotaInflight.delete(flightKey);
   });
-  accountQuotaInflight.set(key, probe);
+  accountQuotaInflight.set(flightKey, probe);
   return probe;
 }
-
 /**
  * Per-account quota rows for a provider's logged-in accounts. Probes run in parallel; a
  * single failing account never blocks the others.
@@ -546,6 +544,7 @@ export async function fetchProviderAccountQuotas(
       ...(entry.unavailable && entry.quotaFailure && entry.quotaFailureIsCurrent?.() === true ? { quotaFailure: entry.quotaFailure } : {}),
     };
     if (entry.quotaFailureIsCurrent) Object.defineProperty(result, "quotaFailureIsCurrent", { value: entry.quotaFailureIsCurrent });
+    if (provider === "anthropic" && entry.isCurrent) Object.defineProperty(result, "isCurrent", { value: entry.isCurrent });
     if (!explicitAccountReader(provider)) return result;
     const identity = entry.identity;
     Object.defineProperty(result, "isCurrent", { value: () => {

package/src/providers/registry/entries-core.ts

@@ -190,7 +190,7 @@ export const PROVIDER_REGISTRY_CORE: readonly ProviderRegistryEntry[] = [
     // (it is the current catalog, so its default ordering wins), then the ids
     // only the old devin entry carried. Degraded-mode seed only either way —
     // `liveModels` discovers the account's real roster.
-    models: ["swe-2", "swe-1-7", "gpt-5-6-sol", "gpt-6-astra", "gpt-6-sol", "gpt-6-luna", "claude-opus-5-5", "claude-opus-5", "claude-fable-5-1", "claude-sonnet-5-5", "claude-sonnet-5", "glm-5-3", "kimi-k3", "gemini-3-8-flash", "grok-4-6", "grok-4-7", "swe-1-7-lightning", "gpt-5-6-luna", "gpt-5-6-terra", "claude-opus-4-8", "glm-5-2", "kimi-k2-7", "grok-4-5"],
+    models: ["swe-2", "swe-1-7", "gpt-5-6-sol", "gpt-6-astra", "gpt-6-1-sol", "gpt-6-sol", "gpt-6-luna", "claude-opus-5-5", "claude-opus-5", "claude-fable-5-1", "claude-sonnet-5-5", "claude-sonnet-5", "glm-5-3", "kimi-k3", "gemini-3-8-flash", "grok-4-6", "grok-4-7", "swe-1-7-lightning", "gpt-5-6-luna", "gpt-5-6-terra", "claude-opus-4-8", "glm-5-2", "kimi-k2-7", "grok-4-5"],
     liveModels: true,
     defaultModel: "swe-2",
     modelContextWindows: DEVIN_MODEL_CONTEXT_WINDOWS,
@@ -1025,6 +1025,8 @@ export const PROVIDER_REGISTRY_CORE: readonly ProviderRegistryEntry[] = [
       // 260923 preemptive: GPT-6 Sol/Luna are OpenAI-backed routes like the GPT-5.6 rows above.
       "openai/gpt-6-sol": true,
       "openai/gpt-6-luna": true,
+      // Listed 2026-09-29 as an OpenAI-backed route like GPT-6 Sol.
+      "openai/gpt-6.1-sol": true,
     },
     // Deliberately no OpenRouter route pin: it bills the endpoint actually used and reports the
     // actual service_tier. B0 confirmation therefore owns downgrade safety. Forcing `only` plus