@bitkyc08/opencodex 2.72.0 → 2.73.0

package/src/providers/registry/entries-extended.ts

@@ -1156,6 +1156,17 @@ export const PROVIDER_REGISTRY_EXTENDED: readonly ProviderRegistryEntry[] = [
     modelContextWindows: { "gpt-5.6-terra": 1_050_000 },
     modelMaxOutputTokens: { "gpt-5.6-terra": 128_000 },
     modelInputModalities: { "gpt-5.6-terra": ["text", "image"] },
+    // Per-model wires from `tokenlab.accepted_request_formats` (GET /v1/models/{id}, 2026-09-30).
+    // The provider stays on Chat, the released and end-to-end verified path, and every model
+    // accepts it. Models that also declare Responses use it for Codex (Responses inbound) only,
+    // so Chat and Anthropic clients skip a translation hop; an explicit modelAdapters entry wins.
+    // Claude ids ride Anthropic Messages through the endpoint-bound pin in src/types/wire.ts.
+    // gemini-3.8-flash declares Chat + Gemini native and stays on Chat. No delivery-policy
+    // header is sent: the API key's own policy stays authoritative.
+    modelWireDefaults: Object.fromEntries([
+      "gpt-6-astra", "gpt-6.1-sol", "gpt-6-sol", "gpt-6-luna", "grok-4.7",
+      "deepseek-v4.1-flash", "deepseek-v4-pro", "kimi-k3", "glm-5.3",
+    ].map(id => [id, { wire: "openai-responses", inbound: ["responses"] }])),
     modelDiscovery: {
       path: "models",
       query: { category: "chat" },
@@ -1342,7 +1353,7 @@ export const PROVIDER_REGISTRY_EXTENDED: readonly ProviderRegistryEntry[] = [
     featured: false,
     dashboardUrl: "https://github.com/settings/copilot",
     liveModels: true,
-    models: ["gpt-4o", "gpt-4.1", "gpt-4.1-mini", "claude-sonnet-4", "gemini-2.5-pro", "gpt-5-mini", "gpt-5.3-codex", "gpt-5.4", "gpt-5.4-mini", "gpt-5.5", "gpt-5.6-luna", "gpt-5.6-sol", "gpt-5.6-terra", "gpt-6-sol", "gpt-6-luna"],
+    models: ["gpt-4o", "gpt-4.1", "gpt-4.1-mini", "claude-sonnet-4", "gemini-2.5-pro", "gpt-5-mini", "gpt-5.3-codex", "gpt-5.4", "gpt-5.4-mini", "gpt-5.5", "gpt-5.6-luna", "gpt-5.6-sol", "gpt-5.6-terra", "gpt-6.1-sol", "gpt-6-sol", "gpt-6-luna"],
     defaultModel: "gpt-4o",
     // Copilot fronts a mixed-wire catalog: these models reject /chat/completions for
     // real Codex-agent traffic (function tools + reasoning), so every inbound wire
@@ -1362,6 +1373,8 @@ export const PROVIDER_REGISTRY_EXTENDED: readonly ProviderRegistryEntry[] = [
       // 260923 preemptive: GPT-6 Sol/Luna ride Responses like every GPT-5.6/6 row above.
       "gpt-6-sol": "openai-responses",
       "gpt-6-luna": "openai-responses",
+      // GPT-6.1 Sol: GA in Copilot 2026-09-29 (github.blog changelog); rides Responses like GPT-6 Sol.
+      "gpt-6.1-sol": "openai-responses",
       "grok-4.5": "openai-responses",
       "grok-4.6": "openai-responses",
       "mai-code-1.1-flash": "openai-responses",

package/src/providers/registry/model-seeds.ts

@@ -164,8 +164,12 @@ export const OPENAI_API_GPT56_REASONING_EFFORTS = ["low", "medium", "high", "xhi
  * GPT-6 Sol and Luna on the OpenAI API (released 2026-09-22,
  * https://developers.openai.com/api/docs/changelog). Added 2026-09-23 ahead of live discovery; the
  * API window is not published yet, so the rows mirror gpt-6-astra's 1,050,000 / 922,000 API seed.
+ *
+ * GPT-6.1 Sol (released 2026-09-29) publishes the same numbers on its own model page:
+ * 1,050,000 context, 922,000 max input, 128,000 max output, efforts low..max
+ * (https://developers.openai.com/api/docs/models/gpt-6.1-sol, checked 2026-09-30).
  */
-export const OPENAI_GPT6_MODELS = ["gpt-6-sol", "gpt-6-luna"];
+export const OPENAI_GPT6_MODELS = ["gpt-6.1-sol", "gpt-6-sol", "gpt-6-luna"];
 /*
  * Meta Model API (https://api.meta.ai/v1) — published ladder, deliberately NOT the
  * house set. dev.meta.ai/docs/reasoning lists "none", "minimal", "low", "medium",
@@ -254,6 +258,8 @@ export const OPENROUTER_GPT56_CONTEXT_WINDOWS = {
   // 260923 preemptive: GPT-6 Sol/Luna ahead of OpenRouter's own listing; same window as GPT-5.6.
   "openai/gpt-6-sol": OPENROUTER_GPT56_CONTEXT_WINDOW,
   "openai/gpt-6-luna": OPENROUTER_GPT56_CONTEXT_WINDOW,
+  // Live /api/v1/models on 2026-09-30: context_length 1,050,000, max_completion_tokens 128,000.
+  "openai/gpt-6.1-sol": OPENROUTER_GPT56_CONTEXT_WINDOW,
 };
 
 /**

package/src/server/claude-messages.ts

@@ -14,6 +14,7 @@ import {
   resolveAdmissionModelScope,
 } from "./admission-model-scope";
 import { jsonUtf8Bytes } from "../lib/json-byte-size";
+import { redactSecretString } from "../lib/redact";
 import { sseFieldValue } from "../lib/sse-decoder";
 import { enforceAnthropicImageLimits, sniffImageDimensions } from "../adapters/anthropic-image-guard";
 import { normalizeAnthropicImages } from "../adapters/anthropic-image-normalize";
@@ -295,46 +296,55 @@ export interface PassthroughBodyGuard {
 }
 
 type PassthroughCloseReason = "terminal" | "client_cancel" | "body_stall" | "body_overflow";
+type PassthroughFinalizeMeta = { closeReason: PassthroughCloseReason; terminalStatus?: "failed" };
 
 /**
  * Tap an Anthropic-vocabulary SSE stream for the request log (usage + terminal),
  * bounding body occupancy: idle (silence-only, timed ONLY while a reader.read() is
  * pending so downstream backpressure never counts as upstream inactivity) and a
- * cumulative byte cap. On stall/overflow it appends a protocol-compatible Anthropic
- * `event: error` terminal frame after a blank-line boundary, closes, and cancels the
- * upstream reader — never a total-wall-clock bound (slow-but-alive streams live).
+ * cumulative byte cap. On stall/overflow, or when the upstream read fails after the
+ * headers went out, it appends a protocol-compatible Anthropic `event: error` terminal
+ * frame after a blank-line boundary, closes, and cancels the upstream reader — never a
+ * total-wall-clock bound (slow-but-alive streams live).
  * Exported for deterministic unit tests.
  */
 export function tapAnthropicSseForLog(
   upstream: ReadableStream<Uint8Array>,
   logCtx: RequestLogContext,
-  finalize: (status: number, meta: { closeReason: PassthroughCloseReason }) => void,
+  finalize: (status: number, meta: PassthroughFinalizeMeta) => void,
   guard?: PassthroughBodyGuard,
 ): ReadableStream<Uint8Array> {
   const decoder = new TextDecoder();
   const encoder = new TextEncoder();
   let buffer = "";
   let usageAcc: Rec = {};
+  // message_stop or an upstream error event: the turn's own terminal already went through.
+  let terminalSeen = false;
+  const inspectFrame = (frame: string) => {
+    const dataLine = frame
+      .split("\n")
+      .map(l => sseFieldValue(l, "data"))
+      .filter((v): v is string => v !== null)
+      .join("");
+    if (!dataLine) return;
+    let data: unknown;
+    try { data = JSON.parse(dataLine); } catch { return; }
+    if (!isRec(data)) return;
+    if (data.type === "message_start" && isRec(data.message) && isRec(data.message.usage)) {
+      usageAcc = { ...usageAcc, ...data.message.usage };
+    } else if (data.type === "message_delta" && isRec(data.usage)) {
+      usageAcc = { ...usageAcc, ...data.usage };
+    } else if (data.type === "message_stop" || data.type === "error") {
+      terminalSeen = true;
+    }
+  };
   const inspect = (chunk: Uint8Array) => {
     buffer += decoder.decode(chunk, { stream: true });
     let sep: number;
     while ((sep = buffer.indexOf("\n\n")) !== -1) {
       const frame = buffer.slice(0, sep);
       buffer = buffer.slice(sep + 2);
-      const dataLine = frame
-        .split("\n")
-        .map(l => sseFieldValue(l, "data"))
-        .filter((v): v is string => v !== null)
-        .join("");
-      if (!dataLine) continue;
-      let data: unknown;
-      try { data = JSON.parse(dataLine); } catch { continue; }
-      if (!isRec(data)) continue;
-      if (data.type === "message_start" && isRec(data.message) && isRec(data.message.usage)) {
-        usageAcc = { ...usageAcc, ...data.message.usage };
-      } else if (data.type === "message_delta" && isRec(data.usage)) {
-        usageAcc = { ...usageAcc, ...data.usage };
-      }
+      inspectFrame(frame);
     }
   };
   const reader = upstream.getReader();
@@ -345,13 +355,7 @@ export function tapAnthropicSseForLog(
   const recordUsage = () => {
     logCtx.usage = anthropicUsageToOcx(Object.keys(usageAcc).length > 0 ? usageAcc : undefined);
   };
-  const failBody = (closeReason: "body_stall" | "body_overflow", errType: string, message: string) => {
-    if (settled) return;
-    settled = true;
-    idle.cancel();
-    detachAbort();
-    recordUsage();
-    finalize(200, { closeReason });
+  const closeWithErrorFrame = (errType: string, message: string) => {
     const payload = JSON.stringify({ type: "error", error: { type: errType, message } });
     try {
       // Leading blank line terminates any partial SSE block so the frame parses cleanly
@@ -359,6 +363,15 @@ export function tapAnthropicSseForLog(
       tapController?.enqueue(encoder.encode(`\n\nevent: error\ndata: ${payload}\n\n`));
       tapController?.close();
     } catch { /* client already torn down */ }
+  };
+  const failBody = (closeReason: "body_stall" | "body_overflow", errType: string, message: string) => {
+    if (settled) return;
+    settled = true;
+    idle.cancel();
+    detachAbort();
+    recordUsage();
+    finalize(200, { closeReason });
+    closeWithErrorFrame(errType, message);
     reader.cancel(new DOMException(message, closeReason === "body_stall" ? "TimeoutError" : "QuotaExceededError")).catch(() => {});
   };
   const idle = idleDeadline(guard?.stallMs ?? 0, () => {
@@ -427,12 +440,56 @@ export function tapAnthropicSseForLog(
         controller.enqueue(value);
       } catch (err) {
         if (settled) return;
+        // Bun can settle a fetch body read before it dispatches the abort listeners
+        // (consumeForInspection in relay.ts): read the signal itself before calling this
+        // rejection an upstream failure.
+        if (guard?.reqSignal?.aborted) {
+          onClientAbort();
+          return;
+        }
         settled = true;
         idle.cancel();
         detachAbort();
+        // A read error can follow the last SSE block before its blank-line delimiter. Count
+        // that block before deciding how the turn ended, as the Responses relay does.
+        const terminalBeforeTail = terminalSeen;
+        const tail = buffer + decoder.decode();
+        buffer = "";
+        if (tail) inspectFrame(tail);
         recordUsage();
-        finalize(200, { closeReason: "terminal" });
-        try { controller.error(err); } catch { /* torn down */ }
+        if (isTranslatorBudgetExceededError(err)) {
+          // A local cap, not an upstream failure: the non-streaming native Messages fold
+          // maps this error to a 413 itself, so it still errors the stream.
+          finalize(200, { closeReason: "terminal" });
+          try { controller.error(err); } catch { /* torn down */ }
+          return;
+        }
+        if (terminalSeen) {
+          // Only the transport trailer was lost; the client already has the turn's terminal.
+          // The Responses relay likewise reports a read error only without a seen terminal.
+          finalize(200, { closeReason: "terminal" });
+          try {
+            // An SSE parser drops an event that EOF cuts off before its blank line, so restore
+            // the delimiter when the terminal was only found in that unterminated tail.
+            if (!terminalBeforeTail) controller.enqueue(encoder.encode("\n\n"));
+            controller.close();
+          } catch { /* torn down */ }
+          reader.cancel(err).catch(() => {});
+          return;
+        }
+        // The upstream read failed after the 200 went out (a mid-stream socket reset). Log it
+        // the way the Responses relay does (onReadError): a truncated body is a failed turn,
+        // not a completed one. The client gets the same Anthropic error terminal as a stall,
+        // instead of a connection reset — or, on some Bun releases, a bare EOF that reads as
+        // a finished message.
+        const message = redactSecretString(`anthropic passthrough upstream stream failed: ${err instanceof Error ? err.message : String(err)}`);
+        logCtx.transportPhase = "mid_stream";
+        logCtx.terminalSource = "synthetic";
+        logCtx.upstreamError = message.slice(0, 500);
+        if (logCtx.activeAttempt) logCtx.activeAttempt.streamAborted = true;
+        finalize(502, { terminalStatus: "failed", closeReason: "terminal" });
+        closeWithErrorFrame("api_error", message);
+        reader.cancel(err).catch(() => {});
       }
     },
     cancel(reason) {

package/src/server/management/anthropic-account-threshold.ts

@@ -0,0 +1,27 @@
+import type { OcxConfig } from "../../types";
+import { effectiveAnthropicAccountThreshold, parseAnthropicAccountThreshold } from "../../oauth/anthropic-account-threshold";
+import { OAUTH_PROVIDERS } from "../../oauth";
+import { setAnthropicAccountThreshold } from "../../oauth/store";
+import { jsonResponse } from "../auth-cors";
+import { readManagementJsonBodyOr } from "./body";
+
+/** Account-owned policy writes share the auth-store lock, not a config/auth split transaction. */
+export async function handleAnthropicAccountThreshold(req: Request, config: OcxConfig): Promise<Response> {
+  const body = await readManagementJsonBodyOr(req, {});
+  if (!body || typeof body !== "object" || Array.isArray(body)) return jsonResponse({ error: "body must be an object" }, 400);
+  const fields = body as Record<string, unknown>;
+  const definition = OAUTH_PROVIDERS.anthropic;
+  const effectiveProvider = config.providers.anthropic
+    ?? definition?.resolveProviderConfig?.(config) ?? definition?.providerConfig;
+  if (fields.provider !== "anthropic" || effectiveProvider?.authMode !== "oauth") {
+    return jsonResponse({ error: "account threshold requires Anthropic OAuth" }, 400);
+  }
+  if (typeof fields.accountId !== "string" || !fields.accountId.trim()) return jsonResponse({ error: "missing accountId" }, 400);
+  const threshold = parseAnthropicAccountThreshold(fields.threshold);
+  if (fields.threshold !== null && threshold === null) return jsonResponse({ error: "threshold must be an integer 0-100 or null" }, 400);
+  if (!await setAnthropicAccountThreshold(fields.accountId, threshold)) return jsonResponse({ error: "account not found" }, 404);
+  return jsonResponse({ ok: true, provider: "anthropic", accountId: fields.accountId,
+    autoSwitchThresholdOverride: threshold,
+    effectiveAutoSwitchThreshold: effectiveAnthropicAccountThreshold(config, { autoSwitchThresholdOverride: threshold ?? undefined }),
+    autoSwitchThreshold: effectiveAnthropicAccountThreshold(config) });
+}

package/src/server/management/oauth-account-routes.ts

@@ -1,4 +1,6 @@
 import { parseAnthropicModelRoutes, readAnthropicModelRoutes } from "../../oauth/anthropic-model-routes";
+import { effectiveAnthropicAccountThreshold } from "../../oauth/anthropic-account-threshold";
+import { handleAnthropicAccountThreshold } from "./anthropic-account-threshold";
 import { randomBytes, randomUUID } from "node:crypto";
 import { readFileSync } from "node:fs";
 import type { CatalogModel } from "../../codex/catalog";
@@ -396,7 +398,8 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     const { isGenericFailoverProvider, kiroAutoSelection } = await import("../../oauth/generic-account-failover");
     const effectiveProvider = genericOAuthProviderConfig(provider, config);
     const supportsPause = effectiveProvider !== undefined
-      && isGenericFailoverProvider(provider, effectiveProvider);
+      && (provider === "anthropic" && effectiveProvider.authMode === "oauth"
+        || isGenericFailoverProvider(provider, effectiveProvider));
     const {
       oauthAccountHealthFields,
       projectOAuthAccountHealth,
@@ -417,6 +420,9 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
             });
           return { ...summary, ...oauthAccountHealthFields(provider, summary.id, health), quotaMode,
             ...(supportsPause ? { paused: full?.paused === true } : {}),
+            ...(provider === "anthropic" && supportsPause ? { autoSwitchThresholdOverride: full?.autoSwitchThresholdOverride ?? null,
+              effectiveAutoSwitchThreshold: effectiveAnthropicAccountThreshold(config, full),
+              autoSwitchThreshold: effectiveAnthropicAccountThreshold(config) } : {}),
             ...(provider === "kiro" && full ? kiroAutoSelection(full) : {}) };
         }),
       };
@@ -492,6 +498,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     return jsonResponse({ ok: true, provider, activeAccountId: body.accountId });
   }
 
+  if (url.pathname === "/api/oauth/accounts/auto-switch" && req.method === "PUT") return handleAnthropicAccountThreshold(req, config);
   if (url.pathname === "/api/oauth/accounts/pause" && req.method === "PUT") {
     const body = await readManagementJsonBodyOr(req, {});
     if (!isPlainRecord(body)) return jsonResponse({ error: "body must be an object" }, 400);
@@ -504,7 +511,8 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
 
     const { isGenericFailoverProvider } = await import("../../oauth/generic-account-failover");
     const effectiveProvider = genericOAuthProviderConfig(provider, config);
-    if (!effectiveProvider || !isGenericFailoverProvider(provider, effectiveProvider)) {
+    if (!effectiveProvider || !(provider === "anthropic" && effectiveProvider.authMode === "oauth"
+      || isGenericFailoverProvider(provider, effectiveProvider))) {
       return jsonResponse({ error: "account pause is not supported for this OAuth provider" }, 400);
     }
 
@@ -513,8 +521,13 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     if (result.status === "not-found") return jsonResponse({ error: "account not found" }, 404);
 
     if (result.activeAccountChanged) {
-      const { genericPoolKey, seedPoolRotationAccount } = await import("../../oauth/pool-kernel");
-      seedPoolRotationAccount(genericPoolKey(provider), result.activeAccountId);
+      if (provider === "anthropic") {
+        const { resetAnthropicRoutingForManualSelection } = await import("../../oauth/anthropic-routing");
+        resetAnthropicRoutingForManualSelection(result.activeAccountId);
+      } else {
+        const { genericPoolKey, seedPoolRotationAccount } = await import("../../oauth/pool-kernel");
+        seedPoolRotationAccount(genericPoolKey(provider), result.activeAccountId);
+      }
       const { clearModelCache } = await import("../../codex/model-cache");
       const { clearGatherRoutedModelsInflight } = await import("../../codex/catalog");
       clearModelCache(provider);

package/src/server/management/route-registry.ts

@@ -323,6 +323,7 @@ export const MANAGEMENT_ROUTES: readonly ManagementRoute[] = [
   { method: "PUT", path: "/api/oauth/accounts/active", module: "server/management/oauth-account-routes", mutates: true },
   { method: "PUT", path: "/api/oauth/accounts/alias", module: "server/management/oauth-account-routes", mutates: true },
   { method: "PUT", path: "/api/oauth/accounts/pause", module: "server/management/oauth-account-routes", mutates: true },
+  { method: "PUT", path: "/api/oauth/accounts/auto-switch", module: "server/management/oauth-account-routes", mutates: true },
   { method: "PUT", path: "/api/oauth/accounts/pool", module: "server/management/oauth-account-routes", mutates: true },
   { method: "PUT", path: "/api/providers/keys/active", module: "server/management/oauth-account-routes", mutates: true },
   { method: "PUT", path: "/api/providers/keys/alias", module: "server/management/oauth-account-routes", mutates: true },

package/src/server/messages-native-oauth.ts

@@ -4,8 +4,8 @@
  *
  * Credential. The account is the one the existing OAuth selection chooses for this request, by
  * the same steps the Responses pipeline's transport takes for an unpooled Anthropic OAuth route
- * (`prepareResponsesTransport`): capture the committed selection, resolve the active account's
- * access snapshot (refreshing it through the OAuth owner when it is due), and commit that
+ * (`prepareResponsesTransport`): capture the committed selection, resolve an eligible account's
+ * access snapshot (including pause/cooldown recovery), and commit that
  * proposal against the captured selection so a concurrent manual switch wins. Nothing here picks
  * an account of its own, and nothing runs at planning time: the planner and eligibility read
  * config only, and this module is reached from the lane's dispatch alone.
@@ -13,7 +13,8 @@
  * Pools. A pooled account set (the opt-in Anthropic account pool, or two or more usable accounts,
  * which turns on reactive 429 rotation) is declined before this lane is chosen
  * (`oauth-account-pool`). Should one appear between that decision and dispatch, resolution fails
- * closed rather than serve a pooled account without the pool's rotation and affinity.
+ * closed rather than serve a pooled account without the pool's rotation and affinity. This
+ * lane-change 409 is distinct from the shared local authentication/pause/cooldown refusals.
  *
  * Tool names. An OAuth request carries client tool names under the Claude OAuth prefix, as the
  * adapter sends them; the answer's `tool_use` names are mapped back here, for exactly the names
@@ -21,10 +22,12 @@
  *
  * No token, account id or body content is logged or returned in an error message.
  */
-import { getValidAccessTokenSnapshot, type OAuthAccessSnapshot } from "../oauth";
+import type { OAuthAccessSnapshot } from "../oauth";
 import {
   commitAnthropicSelectionRouting,
   getAnthropicPoolAccessSnapshot,
+  getAnthropicAccountHealthSnapshot,
+  resolveAnthropicDispatchAccountId,
   hasAnthropicFailoverQuorum,
   isAnthropicAccountPoolEnabled,
 } from "../oauth/anthropic-routing";
@@ -72,17 +75,14 @@ function pooled(config: OcxConfig): boolean {
  * selection could not be committed.
  */
 export async function resolveNativeOAuthBinding(config: OcxConfig): Promise<NativeOAuthBinding> {
-  if (pooled(config)) throw new NativeOAuthSelectionChangedError();
-  let selection: Selection | null = captureOAuthAccountSelection(PROVIDER);
-  let candidate = await getValidAccessTokenSnapshot(PROVIDER);
   for (let attempt = 0; attempt < MAX_SELECTION_ATTEMPTS; attempt++) {
-    if (!selection) break;
-    if (candidate.accountId !== selection.accountId) {
-      // The active account moved between capture and resolution: serve the committed one.
-      selection = captureOAuthAccountSelection(PROVIDER);
-      if (!selection) break;
-      candidate = await getAnthropicPoolAccessSnapshot(selection.accountId);
-    }
+    const selection = captureOAuthAccountSelection(PROVIDER);
+    // Resolve eligibility before the lane guard: a local 401/403/429 must not turn
+    // into a generic lane-change 409 merely because it appeared during pacing.
+    const accountId = await resolveAnthropicDispatchAccountId(config);
+    if (pooled(config)) throw new NativeOAuthSelectionChangedError();
+    if (!selection) continue;
+    const candidate = await getAnthropicPoolAccessSnapshot(accountId);
     const committed = await commitOAuthAccountSelection(PROVIDER, candidate.accountId, {
       expectedSelection: selection,
       expectedCredentialGeneration: candidate.generation,
@@ -93,14 +93,12 @@ export async function resolveNativeOAuthBinding(config: OcxConfig): Promise<Nati
         config,
         sessionKey: null,
         expectedCredentialGeneration: candidate.generation,
-      })) break;
+      })) continue;
       if (pooled(config)) break;
-      return { selection: committed, snapshot: candidate };
+      const binding = { selection: committed, snapshot: candidate };
+      if (nativeOAuthBindingIsCurrent(binding)) return binding;
     }
-    // A newer manual choice wins over this request's proposal.
-    selection = captureOAuthAccountSelection(PROVIDER);
-    if (!selection) break;
-    candidate = await getAnthropicPoolAccessSnapshot(selection.accountId);
+    // Re-read after a lost commit or a health change during credential resolution.
   }
   throw new NativeOAuthSelectionChangedError();
 }
@@ -114,7 +112,8 @@ export function nativeOAuthBindingIsCurrent(binding: NativeOAuthBinding): boolea
   const row = getAccountCredentialWithStatus(PROVIDER, binding.snapshot.accountId);
   return selected?.accountId === binding.selection.accountId
     && selected?.revision === binding.selection.revision
-    && !!row && !row.needsReauth && row.credential.expires > Date.now()
+    && !!row && !row.paused && !row.needsReauth && row.credential.expires > Date.now()
+    && !getAnthropicAccountHealthSnapshot(binding.snapshot.accountId)
     && credentialGeneration(row.credential) === binding.snapshot.generation;
 }
 

package/src/server/messages-native.ts

@@ -58,9 +58,9 @@ import {
   selectProactiveApiKeyTransport,
   transientRetryPolicyFor,
 } from "../providers/key-failover";
-import { stampApiKeyAccountLabel, stampOAuthAccountLabel } from "../providers/label";
-import { publicOAuthAuthenticationErrorMessage } from "../oauth";
-import { hasAnthropicFailoverQuorum } from "../oauth/anthropic-routing";
+import { stampApiKeyAccountLabel } from "../providers/label";
+import { OAuthAccountPausedError, OAuthLoginRequiredError, publicOAuthAuthenticationErrorMessage } from "../oauth";
+import { AnthropicAccountCooldownError, formatAnthropicProviderForLog, hasAnthropicFailoverQuorum } from "../oauth/anthropic-routing";
 import { resolveProtocolSettings } from "../protocols/settings";
 import { addProtocolEntryReason, markProtocolBlocked } from "../protocols/trace";
 import type { OcxProviderTransport } from "../providers/xai-transport";
@@ -150,7 +150,7 @@ export interface HandleNativeMessagesOptions {
   callerAnthropicBeta?: string | null;
 }
 
-type FinishLog = (status: number, message?: string, closeReason?: FinalRequestLogMeta["closeReason"]) => void;
+type FinishLog = (status: number, message?: string, meta?: FinalRequestLogMeta) => void;
 
 /** Relay an upstream body unchanged, recording first output on its first non-empty chunk. */
 function observeFirstChunk(body: ReadableStream<Uint8Array>, onFirst: () => void): ReadableStream<Uint8Array> {
@@ -311,10 +311,10 @@ export async function handleNativeMessages(options: HandleNativeMessagesOptions)
   attemptHandle.seal(logCtx.accountLogLabel);
   const { attempt } = attemptHandle;
   const finalLog = createFinalRequestLog(logIds, logCtx);
-  const finishLog: FinishLog = (status, message, closeReason = "non_stream") => {
+  const finishLog: FinishLog = (status, message, meta = { closeReason: "non_stream" }) => {
     if (finalLog.finished()) return;
     if (message) logCtx.upstreamError = redactSecretString(message).slice(0, 500);
-    finalLog.finish(status, { closeReason });
+    finalLog.finish(status, meta);
   };
   const bindUsage = (usage: OcxUsage | undefined) => {
     if (!usage) return;
@@ -328,6 +328,16 @@ export async function handleNativeMessages(options: HandleNativeMessagesOptions)
     finishLog(status, safeMessage);
     return anthropicErrorResponse(status, safeMessage, type, code);
   };
+  const localOAuthFailure = (error: unknown): Response | null => {
+    if (error instanceof AnthropicAccountCooldownError) {
+      const response = fail(429, error.message, "rate_limit_error");
+      if (error.retryAfterSeconds !== null) response.headers.set("retry-after", String(error.retryAfterSeconds));
+      return response;
+    }
+    if (error instanceof OAuthAccountPausedError) return fail(403, publicOAuthAuthenticationErrorMessage(error), "permission_error");
+    if (error instanceof OAuthLoginRequiredError) return fail(401, publicOAuthAuthenticationErrorMessage(error), "authentication_error");
+    return null;
+  };
 
   try {
     await prepareNativeBody(body, req.signal);
@@ -366,6 +376,8 @@ export async function handleNativeMessages(options: HandleNativeMessagesOptions)
       cleanupAbort();
       upstream.abort();
       if (req.signal.aborted) return fail(499, "Client cancelled request", "api_error");
+      const localRefusal = localOAuthFailure(error);
+      if (localRefusal) return localRefusal;
       if (error instanceof NativeOAuthSelectionChangedError) return fail(409, error.message, "api_error");
       return fail(401, publicOAuthAuthenticationErrorMessage(error), "authentication_error");
     }
@@ -376,7 +388,7 @@ export async function handleNativeMessages(options: HandleNativeMessagesOptions)
   }
   let activeProvider: OcxProviderConfig = oauthBinding ? oauthProvider(oauthBinding) : route.provider;
   stampApiKeyAccountLabel(logCtx, route.providerName, activeProvider);
-  if (oauthBinding) stampOAuthAccountLabel(logCtx, route.providerName, activeProvider, oauthBinding.snapshot.accountId);
+  if (oauthBinding) logCtx.provider = formatAnthropicProviderForLog(route.providerName, oauthBinding.snapshot.accountId, config);
   const spendTracker = attachRequestSpendTracker(req, logCtx);
   let activeRequest: AnthropicMessagesPassthroughRequest;
   let retainedRequestBytes = 0;
@@ -460,14 +472,17 @@ export async function handleNativeMessages(options: HandleNativeMessagesOptions)
             if (oauthBinding) {
               // The OAuth twin of the key check below: re-resolve through the same selection
               // owner when the committed account or its credential moved since the build.
-              if (!nativeOAuthBindingIsCurrent(oauthBinding)) {
+              for (let attempt = 0; !nativeOAuthBindingIsCurrent(oauthBinding); attempt++) {
+                if (attempt >= 3) throw new NativeOAuthSelectionChangedError();
                 try {
                   oauthBinding = await resolveNativeOAuthBinding(config);
-                } catch {
+                } catch (error) {
+                  if (error instanceof OAuthAccountPausedError || error instanceof OAuthLoginRequiredError
+                    || error instanceof AnthropicAccountCooldownError) throw error;
                   throw new NativeOAuthSelectionChangedError();
                 }
                 rebuildFor(oauthProvider(oauthBinding));
-                stampOAuthAccountLabel(logCtx, route.providerName, activeProvider, oauthBinding.snapshot.accountId);
+                logCtx.provider = formatAnthropicProviderForLog(route.providerName, oauthBinding.snapshot.accountId, config);
               }
             } else if (!providerApiKeySelectionIsCurrent(config, route.providerName, activeProvider)) {
               const current = resolveCurrentProviderApiKeyTransport(config, route.providerName, activeProvider);
@@ -569,6 +584,8 @@ export async function handleNativeMessages(options: HandleNativeMessagesOptions)
       finishLog(429);
       return refusal;
     }
+    const localRefusal = localOAuthFailure(sendError);
+    if (localRefusal) return localRefusal;
     if (sendError instanceof NativeOAuthSelectionChangedError) return fail(409, sendError.message, "api_error");
     if (sendError instanceof NativeOpaqueStateRefusal) {
       logCtx.errorCode = "unsupported_feature";
@@ -597,7 +614,9 @@ export async function handleNativeMessages(options: HandleNativeMessagesOptions)
 
   const contentType = response.headers.get("content-type")?.toLowerCase() ?? "";
   if (contentType.includes("text/event-stream") && response.body) {
-    const bodyGuard = resolvePassthroughBodyGuard(config, req.signal);
+    // `upstream` follows req.signal and is also what shutdown and turn release abort, so both
+    // the client leaving and this lane's own abort read as a cancel, not as a failed stream.
+    const bodyGuard = resolvePassthroughBodyGuard(config, upstream.signal);
     const observed = logIds ? observeFirstChunk(response.body, () => recordFirstOutput(logCtx, logIds.start)) : response.body;
     const renamed = activeRequest.oauthToolNames
       ? restoreOAuthToolNamesInSse(observed, activeRequest.oauthToolNames, translatorBudget)
@@ -609,7 +628,7 @@ export async function handleNativeMessages(options: HandleNativeMessagesOptions)
         try {
           cleanupAbort();
           bindUsage(logCtx.usage);
-          finishLog(status, undefined, meta.closeReason);
+          finishLog(status, undefined, meta);
           if (meta.closeReason !== "terminal") upstream.abort();
         } finally {
           releaseStreamTurn();
@@ -621,9 +640,10 @@ export async function handleNativeMessages(options: HandleNativeMessagesOptions)
       });
     }
     // A non-streaming caller whose upstream streamed anyway: fold the stream into one message.
-    const tapState: { closeReason?: FinalRequestLogMeta["closeReason"] } = {};
+    const tapState: { closeReason?: FinalRequestLogMeta["closeReason"]; meta?: FinalRequestLogMeta } = {};
     const tapped = tapAnthropicSseForLog(source, logCtx, (_status, meta) => {
       tapState.closeReason = meta.closeReason;
+      tapState.meta = meta;
     }, bodyGuard);
     try {
       const message = await collectAnthropicMessage(tapped, requestedModel, translatorBudget);
@@ -634,7 +654,12 @@ export async function handleNativeMessages(options: HandleNativeMessagesOptions)
       bindUsage(logCtx.usage);
       if (message.type === "error") {
         const error = isRec(message.error) ? message.error : {};
-        return fail(502, typeof error.message === "string" ? error.message : "upstream stream failed", "api_error");
+        const text = typeof error.message === "string" ? error.message : "upstream stream failed";
+        // The tap's own verdict (a reset, a stall, the byte cap) closes this row with the same meta
+        // as the streaming lane's row; a plain upstream error event keeps the non_stream row.
+        const tapMeta = tapState.meta;
+        if (tapMeta && (tapMeta.terminalStatus || tapMeta.closeReason !== "terminal")) finishLog(502, text, tapMeta);
+        return fail(502, text, "api_error");
       }
       finishLog(200);
       return Response.json(message);

package/src/server/relay-eager.ts

@@ -88,6 +88,8 @@ export type EagerRelayOptions = {
   upstreamError?: string;
   /** Optional client-facing hint policy; inspection retains original frames. */
   terminalBoundary?: CodexSafetyBufferingFilterOptions;
+  /** Mask the selected outbound credential in synthetic failures. */
+  maskCredential?: (text: string) => string;
   /** Injectable clock for tests. */
   now?: () => number;
 };
@@ -123,7 +125,7 @@ export function relaySseEagerBounded(
     ?? (hooks.rewritePayload ? payloadRewriteAsBlockRewrite(hooks.rewritePayload) : undefined);
   const encodeFailedTail = (error: unknown): Uint8Array | null => {
     try {
-      return failedTailFrame(terminalEncoder, error);
+      return failedTailFrame(terminalEncoder, error, opts?.maskCredential);
     } catch {
       return null;
     }
@@ -140,7 +142,7 @@ export function relaySseEagerBounded(
       return encodeFailedTail(error);
     }
     try {
-      return refusalFailedTailFrame(terminalEncoder, refusalMessage, refusalCode);
+      return refusalFailedTailFrame(terminalEncoder, refusalMessage, refusalCode, opts?.maskCredential);
     } catch {
       return null;
     }
@@ -335,6 +337,7 @@ export function relaySseEagerBounded(
                 terminalEncoder,
                 upstreamError,
                 terminalBoundary.upstreamRefusalCode(),
+                opts?.maskCredential,
               );
             queuedBytes += upstreamErrorFrame.byteLength + terminalSentinel.byteLength;
             try {