@bitkyc08/opencodex 2.75.0 → 2.76.0

package/src/lib/spend-reservation-ledger.ts

@@ -442,17 +442,54 @@ function ledgerEntryExists(path: string): boolean {
   }
 }
 
-function assertSafeLedgerFile(path: string): void {
-  const stat = lstatSync(path);
-  if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1
-    || (process.platform !== "win32" && stat.uid !== process.getuid!())) {
-    throw new SpendLedgerOwnerError(
+/** Which ledger file a refusal is about. A role, never a path: the path names the user's home. */
+export type SpendLedgerFileRole = "journal" | "journal-compaction" | "salt";
+
+/** The one condition that refused the file, so a report can say which guard fired. */
+export type SpendLedgerFileRefusal =
+  | "not-regular-file"
+  | "symbolic-link"
+  | "extra-hard-link"
+  | "foreign-owner"
+  | "invalid-salt";
+
+/**
+ * A ledger file failed a safety condition.
+ *
+ * The guard is unchanged; this only says which file role and which condition refused it. Issue
+ * #6314 sat for days on "could not be opened safely" because the same sentence covered five
+ * conditions and two files, and the one that fired (a second hard link to the journal, most
+ * likely held briefly by a cloud-sync daemon) could only be found with an instrumented build.
+ * Role and condition are fixed vocabulary, so the message carries no path, salt, alias or
+ * request content.
+ */
+export class SpendLedgerFileRefusedError extends SpendLedgerOwnerError {
+  constructor(readonly role: SpendLedgerFileRole, readonly refusal: SpendLedgerFileRefusal) {
+    super(
       "SPEND_LEDGER_OWNER_UNAVAILABLE",
-      "Spend-ledger storage could not be opened safely.",
+      `Spend-ledger storage could not be opened safely (${role}: ${refusal}).`
+        + (refusal === "extra-hard-link"
+          ? " Another directory entry links to this file; if the opencodex state directory is inside an iCloud Drive or other synced folder, move it out."
+          : ""),
     );
+    this.name = "SpendLedgerFileRefusedError";
   }
 }
 
+function ledgerFileRefusal(path: string): SpendLedgerFileRefusal | undefined {
+  const stat = lstatSync(path);
+  if (stat.isSymbolicLink()) return "symbolic-link";
+  if (!stat.isFile()) return "not-regular-file";
+  if (stat.nlink !== 1) return "extra-hard-link";
+  if (process.platform !== "win32" && stat.uid !== process.getuid!()) return "foreign-owner";
+  return undefined;
+}
+
+function assertSafeLedgerFile(path: string, role: SpendLedgerFileRole): void {
+  const refusal = ledgerFileRefusal(path);
+  if (refusal !== undefined) throw new SpendLedgerFileRefusedError(role, refusal);
+}
+
 /**
  * The production journal. Its location comes from the owned state directory and every touch
  * proves that ownership, so there is no entrypoint here that writes a caller-chosen path.
@@ -471,7 +508,7 @@ export function createOwnedFileSpendJournal(storage: SpendLedgerStorage): SpendJ
     read(): string[] {
       assertStorageOwned(storage);
       if (!ledgerEntryExists(path)) return [];
-      assertSafeLedgerFile(path);
+      assertSafeLedgerFile(path, "journal");
       // Replay is once per process and is the moment a journal inherited from an older build
       // or a restored backup first passes through here.
       hardenLedgerFile(path, { force: true });
@@ -481,9 +518,9 @@ export function createOwnedFileSpendJournal(storage: SpendLedgerStorage): SpendJ
       assertStorageOwned(storage);
       ensureDir();
       const created = !ledgerEntryExists(path);
-      if (!created) assertSafeLedgerFile(path);
+      if (!created) assertSafeLedgerFile(path, "journal");
       appendFileSync(path, line + "\n", { encoding: "utf8", mode: 0o600 });
-      assertSafeLedgerFile(path);
+      assertSafeLedgerFile(path, "journal");
       hardenLedgerFile(path, { force: created });
     },
     rewrite(lines: string[]): void {
@@ -491,7 +528,7 @@ export function createOwnedFileSpendJournal(storage: SpendLedgerStorage): SpendJ
       ensureDir();
       // Same directory, so the rename is atomic on the same filesystem: a crash mid-compaction
       // leaves either the old journal or the new one, never a half-written ledger.
-      if (ledgerEntryExists(path)) assertSafeLedgerFile(path);
+      if (ledgerEntryExists(path)) assertSafeLedgerFile(path, "journal");
       const temp = `${path}.compact-${process.pid}-${randomBytes(6).toString("hex")}`;
       // The creation is INSIDE the cleanup, not before it. The name carries random bytes, so a
       // failure anywhere after the entry exists used to leave a uniquely named file and the next
@@ -514,7 +551,7 @@ export function createOwnedFileSpendJournal(storage: SpendLedgerStorage): SpendJ
         closeSync(fd);
         fd = undefined;
         journalFaultForTests?.("validate", temp);
-        assertSafeLedgerFile(temp);
+        assertSafeLedgerFile(temp, "journal-compaction");
         journalFaultForTests?.("harden", temp);
         hardenLedgerFile(temp, { force: true });
         journalFaultForTests?.("rename", temp);
@@ -528,7 +565,7 @@ export function createOwnedFileSpendJournal(storage: SpendLedgerStorage): SpendJ
           try { unlinkSync(temp); } catch { /* same */ }
         }
       }
-      assertSafeLedgerFile(path);
+      assertSafeLedgerFile(path, "journal");
       hardenLedgerFile(path, { force: true });
     },
   };
@@ -545,14 +582,11 @@ export function loadOrCreateSpendLedgerSalt(storage: SpendLedgerStorage): string
   assertStorageOwned(storage);
   const path = spendLedgerStoragePath(storage);
   if (ledgerEntryExists(path)) {
-    assertSafeLedgerFile(path);
+    assertSafeLedgerFile(path, "salt");
     hardenLedgerFile(path, { force: true });
     const existing = readFileSync(path, "utf8").trim();
     if (/^[0-9a-f]{32,}$/.test(existing)) return existing;
-    throw new SpendLedgerOwnerError(
-      "SPEND_LEDGER_OWNER_UNAVAILABLE",
-      "Spend-ledger storage could not be opened safely.",
-    );
+    throw new SpendLedgerFileRefusedError("salt", "invalid-salt");
   }
   const dir = dirname(path);
   assertStorageOwned(storage);
@@ -560,7 +594,7 @@ export function loadOrCreateSpendLedgerSalt(storage: SpendLedgerStorage): string
   mkdirSync(dir, { recursive: true, mode: 0o700 });
   const salt = randomBytes(32).toString("hex");
   writeFileSync(path, salt + "\n", { encoding: "utf8", mode: 0o600, flag: "wx" });
-  assertSafeLedgerFile(path);
+  assertSafeLedgerFile(path, "salt");
   hardenLedgerFile(path, { force: true });
   return salt;
 }
@@ -1205,8 +1239,8 @@ export function sharedSpendLedger(): SpendReservationLedger {
     const saltPath = spendLedgerStoragePath(saltStorage);
     const assertOwnedAccounting = (): void => {
       assertStorageOwned(journalStorage);
-      if (ledgerEntryExists(journalPath)) assertSafeLedgerFile(journalPath);
-      if (ledgerEntryExists(saltPath)) assertSafeLedgerFile(saltPath);
+      if (ledgerEntryExists(journalPath)) assertSafeLedgerFile(journalPath, "journal");
+      if (ledgerEntryExists(saltPath)) assertSafeLedgerFile(saltPath, "salt");
     };
     sharedLedger = createSpendReservationLedger({
       journal: createOwnedFileSpendJournal(journalStorage),

package/src/lib/sse-decoder.ts

@@ -56,6 +56,7 @@ export function sseFieldOffset(text: string, lineStart: number, lineEnd: number,
 
 /**
  * Decode text/event-stream records across arbitrary fetch chunk boundaries.
+ * CR, LF and CRLF terminate lines; a split CRLF is one delimiter.
  *
  * The final record is dispatched at EOF even when the upstream omits the trailing blank line or
  * final newline. That matters for compatible APIs that place a terminal event in the last bytes of
@@ -77,6 +78,7 @@ export async function* decodeServerSentEvents(
   const reader = source.getReader();
   const decoder = new TextDecoder();
   let lineBuffer = "";
+  let skipLineFeed = false;
   let lineRawBytes = 0;
   let lineRetainedBytes = 0;
   let event: string | undefined;
@@ -183,8 +185,8 @@ export async function* decodeServerSentEvents(
   };
 
   const acceptLine = (): { record: ServerSentEvent | SseRecord; bytes: number } | undefined => {
-    let line = lineBuffer;
-    let retainedLineBytes = lineRetainedBytes;
+    const line = lineBuffer;
+    const retainedLineBytes = lineRetainedBytes;
     let lineOwned = true;
     const releaseLine = (): void => {
       if (!lineOwned) return;
@@ -195,20 +197,6 @@ export async function* decodeServerSentEvents(
     lineRawBytes = 0;
     lineRetainedBytes = 0;
     try {
-      if (line.endsWith("\r")) {
-        const nextLineBytes = retainedLineBytes - 1;
-        const reservation = translatorBudget.reserveTransient(nextLineBytes, scope);
-        try {
-          const nextLine = line.slice(0, -1);
-          reservation.commitRetained();
-          translatorBudget.releaseRetained(retainedLineBytes, scope);
-          line = nextLine;
-          retainedLineBytes = nextLineBytes;
-        } catch (error) {
-          reservation.release();
-          throw error;
-        }
-      }
       if (line === "") {
         releaseLine();
         return dispatch();
@@ -296,13 +284,28 @@ export async function* decodeServerSentEvents(
     decoded: string,
   ): AsyncGenerator<ServerSentEvent | SseRecord> {
     let offset = 0;
+    // Cached positions of the next CR and LF at or after `offset`, found with the native search so
+    // every stream keeps linear scanning. -1 means this decoded string has none left; it is never
+    // searched again, which keeps LF-only and CR-only chunks linear too.
+    let nextCr = decoded.indexOf("\r");
+    let nextLf = decoded.indexOf("\n");
     while (offset < decoded.length) {
-      const newline = decoded.indexOf("\n", offset);
+      if (skipLineFeed) {
+        skipLineFeed = false;
+        if (decoded[offset] === "\n") {
+          offset++;
+          continue;
+        }
+      }
+      if (nextCr >= 0 && nextCr < offset) nextCr = decoded.indexOf("\r", offset);
+      if (nextLf >= 0 && nextLf < offset) nextLf = decoded.indexOf("\n", offset);
+      const newline = nextCr < 0 ? nextLf : nextLf < 0 ? nextCr : Math.min(nextCr, nextLf);
       if (newline < 0) {
         appendLine(decoded, offset, decoded.length);
         return;
       }
       appendLine(decoded, offset, newline);
+      skipLineFeed = decoded[newline] === "\r";
       const accepted = acceptLine();
       if (accepted) {
         try {

package/src/lib/synced-state-location.ts

@@ -0,0 +1,96 @@
+import { lstatSync, realpathSync } from "node:fs";
+import { homedir } from "node:os";
+// POSIX path operations on purpose: every path this module classifies is a macOS path. The
+// host's own path module would build backslash or drive-letter paths on Windows and make the
+// injected-platform tests compare different strings there (dev CI windows 5/9 after #6398).
+import { posix } from "node:path";
+
+const { join, resolve } = posix;
+
+/**
+ * Where a state directory sits relative to the folders macOS keeps in sync with a cloud.
+ *
+ * A sync daemon can hold a second hard link to a file while it stages or uploads a change. The
+ * spend ledger refuses a journal with a second link on purpose, so a state directory inside a
+ * synced folder turns ordinary requests into intermittent 502s (#6314). This only answers
+ * "is it likely synced"; the guard itself stays strict.
+ */
+export type SyncedStateLocation = "icloud-drive" | "file-provider" | "icloud-desktop-documents";
+
+export interface SyncedStateLocationProbe {
+  readonly platform?: NodeJS.Platform;
+  readonly home?: string;
+  /** Resolve symlinks. Throws when the path does not exist yet. */
+  readonly realpath?: (path: string) => string;
+  /** Whether a directory entry exists at the path, without following it. */
+  readonly entryExists?: (path: string) => boolean;
+}
+
+const defaultEntryExists = (path: string): boolean => {
+  try { lstatSync(path); return true; } catch { return false; }
+};
+
+/**
+ * Advisory only. Apple publishes no API a CLI can ask, so this reads the observed layout:
+ * iCloud Drive lives under ~/Library/Mobile Documents, File Provider clients (OneDrive, Dropbox,
+ * Google Drive) under ~/Library/CloudStorage, and with "Desktop & Documents Folders" turned on
+ * iCloud Drive holds a Desktop/Documents entry of its own. A false positive costs one warning
+ * line; nothing is refused on the strength of it.
+ */
+export function syncedStateLocation(dir: string, probe: SyncedStateLocationProbe = {}): SyncedStateLocation | undefined {
+  if ((probe.platform ?? process.platform) !== "darwin") return undefined;
+  const realpath = probe.realpath ?? ((path: string) => realpathSync.native(path));
+  const entryExists = probe.entryExists ?? defaultEntryExists;
+  const canonical = (path: string): string => {
+    try { return realpath(path); } catch { return resolve(path); }
+  };
+  // The default APFS volume is case-insensitive, so ~/documents and ~/Documents are one folder.
+  const fold = (path: string): string => path.toLowerCase();
+  const home = canonical(probe.home ?? homedir());
+  const target = fold(canonical(dir));
+  const within = (root: string): boolean => {
+    const folded = fold(root);
+    return target === folded || target.startsWith(folded + "/");
+  };
+  const mobileDocuments = join(home, "Library", "Mobile Documents");
+  if (within(mobileDocuments)) return "icloud-drive";
+  if (within(join(home, "Library", "CloudStorage"))) return "file-provider";
+  for (const folder of ["Desktop", "Documents"]) {
+    if (within(join(home, folder)) && entryExists(join(mobileDocuments, "com~apple~CloudDocs", folder))) {
+      return "icloud-desktop-documents";
+    }
+  }
+  return undefined;
+}
+
+const LOCATION_LABEL: Record<SyncedStateLocation, string> = {
+  "icloud-drive": "inside iCloud Drive",
+  "file-provider": "inside a cloud-storage (File Provider) folder",
+  "icloud-desktop-documents": "in Desktop or Documents, which iCloud Drive appears to sync",
+};
+
+/** The startup warning. Names the location kind, never the path. */
+export function syncedStateWarning(location: SyncedStateLocation): string[] {
+  return [
+    `⚠️  The opencodex state directory (OPENCODEX_HOME) is ${LOCATION_LABEL[location]}.`,
+    "   A sync service can briefly add a second link to the spend ledger, which opencodex",
+    "   refuses, so requests may fail intermittently. Set OPENCODEX_HOME to a folder outside",
+    "   synced locations (the default ~/.opencodex is not synced).",
+  ];
+}
+
+let warned = false;
+
+/** Warn once per process when the state directory looks synced. Never throws. */
+export function warnIfSyncedStateDirectory(dir: string, warn: (line: string) => void = console.warn): void {
+  if (warned) return;
+  let location: SyncedStateLocation | undefined;
+  try { location = syncedStateLocation(dir); } catch { return; }
+  if (location === undefined) return;
+  warned = true;
+  // Runs while the startup owner lease is held and before its rollback is registered, so a
+  // throwing sink must not escape and strand the lease.
+  try {
+    for (const line of syncedStateWarning(location)) warn(line);
+  } catch { /* advisory output only */ }
+}

package/src/lib/winsw.ts

@@ -179,8 +179,16 @@ export async function ensureWinswBinary(fetchImpl: typeof fetch = fetch): Promis
   return exe;
 }
 
+/** SCM round-trips are sub-second on a healthy system; a wedged service controller must not block a guarded stop forever — a killed command still classifies fail-closed. */
+const SERVICE_COMMAND_TIMEOUT_MS = 15_000;
+/** `stopwait` outlasts the SCM `<stoptimeout>` (20s in the generated service definition) plus overhead; still bounded so a wedged SCM cannot hang the CLI. */
+const SERVICE_STOPWAIT_TIMEOUT_MS = 40_000;
+
 function runWinsw(args: string[]): string {
-  return execFileSync(winswExePath(), args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], windowsHide: true }).trim();
+  const timeoutMs = args[0] === "stopwait" ? SERVICE_STOPWAIT_TIMEOUT_MS : SERVICE_COMMAND_TIMEOUT_MS;
+  return execFileSync(winswExePath(), args, {
+    encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], windowsHide: true, timeout: timeoutMs,
+  }).trim();
 }
 
 /** `install /p` prompts for the service-account password on the console — stdin must be inherited. */
@@ -191,13 +199,14 @@ function runWinswInteractive(args: string[]): void {
         + "Run `ocx service install --native` from an elevated Command Prompt or PowerShell window, not a hidden or piped session.",
     );
   }
+  // Unbounded by design: the service-account password prompt waits on the user.
   execFileSync(winswExePath(), args, { stdio: "inherit" });
 }
 
 function scQc(): string {
   const sc = join(process.env.SystemRoot ?? "C:\\Windows", "System32", "sc.exe");
   return execFileSync(existsSync(sc) ? sc : "sc.exe", ["qc", WINSW_SERVICE_ID], {
-    encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], windowsHide: true,
+    encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], windowsHide: true, timeout: SERVICE_COMMAND_TIMEOUT_MS,
   });
 }
 
@@ -269,7 +278,7 @@ function scExePath(): string {
 
 function queryScmForService(): string {
   return execFileSync(scExePath(), ["query", WINSW_SERVICE_ID], {
-    encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], windowsHide: true,
+    encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], windowsHide: true, timeout: SERVICE_COMMAND_TIMEOUT_MS,
   });
 }
 
@@ -370,9 +379,9 @@ export function uninstallWinswService(): void {
       }
       if (probe === true) {
         try {
-          execFileSync(scExePath(), ["stop", WINSW_SERVICE_ID], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], windowsHide: true });
+          execFileSync(scExePath(), ["stop", WINSW_SERVICE_ID], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], windowsHide: true, timeout: SERVICE_COMMAND_TIMEOUT_MS });
         } catch { /* not running */ }
-        execFileSync(scExePath(), ["delete", WINSW_SERVICE_ID], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], windowsHide: true });
+        execFileSync(scExePath(), ["delete", WINSW_SERVICE_ID], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], windowsHide: true, timeout: SERVICE_COMMAND_TIMEOUT_MS });
       }
     }
     return;

package/src/oauth/anthropic-account-refusal.ts

@@ -1,13 +1,16 @@
+import { anthropicModelFamily } from "./anthropic-model-quota";
 /** Narrow pre-output account recovery, fenced to the bearer that physically sent the turn. */
 import { readBoundedResponseBody } from "../lib/bounded-body";
-import { isNonReplayableResponse } from "../lib/upstream-retry";
+import { classifyAnthropic429, anthropicRetryAfterMs, pauseAnthropicRateAdmission, anthropicRatePauseUntil, ANTHROPIC_SHORT_RETRY_MS, ANTHROPIC_MAX_INLINE_THROTTLE_MS } from "./anthropic-rate-limit-policy";
+import { isNonReplayableResponse, sleepWithAbort } from "../lib/upstream-retry";
 import { credentialGeneration, getAccountCredentialWithStatus } from "./store";
 import type { OAuthAccessSnapshot } from "./index";
 import type { OcxConfig } from "../types";
 import type { AnthropicRouteDecision } from "./anthropic-model-routes";
-import { recordAnthropicAccountRefusal, rotateAnthropicAccountOnRefusal } from "./anthropic-routing";
+import { recordAnthropicAccountRefusal, rotateAnthropicAccountOnRefusal, hasAnthropicFailoverQuorum, isAnthropicAccountPoolEnabled, pickAlternateAnthropicAccount } from "./anthropic-routing";
 
 const responseCredentials = new WeakMap<Response, Pick<OAuthAccessSnapshot, "accountId" | "generation">>();
+const retryStates = new WeakMap<object, { firstAccountId: string; sameAccount: boolean; detour: boolean }>();
 const verdicts = new WeakMap<Response, Promise<boolean>>();
 
 /** Called only when the outgoing headers prove ownership of the selected stored bearer. */
@@ -43,15 +46,61 @@ export async function rotateAnthropicAccountOnResponse(
   options: {
     config: OcxConfig;
     accountId: string;
+    model?: string;
     sessionKey?: string | null;
     decision?: AnthropicRouteDecision | null;
     signal?: AbortSignal;
     canRetry: boolean;
+    /** Shared by main, continuation and sidecar consumers of one logical request. */
+    requestKey?: object;
+    allow429Recovery?: boolean;
     allowAccountRefusal?: boolean;
   },
 ): Promise<string | null> {
   if (options.signal?.aborted || isNonReplayableResponse(response)) return null;
-  if (response.status !== 429) {
+  if (response.status === 429) {
+    const sent = responseCredentials.get(response);
+    const current = sent && getAccountCredentialWithStatus("anthropic", sent.accountId);
+    if (!sent || sent.accountId !== options.accountId || !current || current.needsReauth
+      || credentialGeneration(current.credential) !== sent.generation) return null;
+    const kind = classifyAnthropic429(response.headers);
+    if (kind === "family-quota") {
+      if (anthropicModelFamily(options.model) !== "Fable" || !options.canRetry || options.allow429Recovery === false) return null;
+      return pickAlternateAnthropicAccount(options.config, sent.accountId, Date.now(), options.decision ?? null, options.model);
+    }
+    if (kind !== "shared-quota") {
+      if (!isAnthropicAccountPoolEnabled(options.config) && !hasAnthropicFailoverQuorum() && !current.paused) return null;
+      const now = Date.now();
+      const delay = anthropicRetryAfterMs(response.headers.get("retry-after"), now) ?? ANTHROPIC_SHORT_RETRY_MS;
+      if (kind === "transient-rate") pauseAnthropicRateAdmission(sent.accountId, now + delay);
+      if (!options.canRetry || options.allow429Recovery === false || !options.requestKey) return null;
+      let state = retryStates.get(options.requestKey);
+      if (!state) { state = { firstAccountId: sent.accountId, sameAccount: false, detour: false }; retryStates.set(options.requestKey, state); }
+      // A concurrent committed selection may have moved the same-account proposal.
+      if (state.firstAccountId !== sent.accountId) state.detour = true;
+      const wait = Math.max(delay, (anthropicRatePauseUntil(sent.accountId) ?? now) - now);
+      if (!state.sameAccount && wait <= ANTHROPIC_MAX_INLINE_THROTTLE_MS && !current.paused) {
+        state.sameAccount = true;
+        // Millisecond rounding can wake just before this deadline; later extensions still bind.
+        const retryAt = now + wait;
+        try { await sleepWithAbort(wait, options.signal); } catch { return null; }
+        const live = getAccountCredentialWithStatus("anthropic", sent.accountId);
+        if (!live || live.paused || live.needsReauth || options.signal?.aborted
+          || credentialGeneration(live.credential) !== sent.generation
+          || anthropicRatePauseUntil(sent.accountId, Math.max(Date.now(), retryAt))) return null;
+        return sent.accountId;
+      }
+      if (kind === "transient-rate" && !state.detour) {
+        state.detour = true;
+        return pickAlternateAnthropicAccount(options.config, sent.accountId, Date.now(), options.decision ?? null, options.model);
+      }
+      return null;
+    }
+    if (options.allow429Recovery === false) {
+      recordAnthropicAccountRefusal(options.config, options.accountId, 429, response.headers.get("retry-after"), Date.now(), response.headers);
+      return null;
+    }
+  } else {
     if (response.status !== 403 || options.allowAccountRefusal === false) return null;
     const sent = responseCredentials.get(response);
     if (!sent || sent.accountId !== options.accountId) return null;
@@ -72,5 +121,5 @@ export async function rotateAnthropicAccountOnResponse(
     return null;
   }
   return rotateAnthropicAccountOnRefusal(options.config, options.accountId, status,
-    response.headers.get("retry-after"), options.sessionKey, Date.now(), response.headers, options.decision);
+    response.headers.get("retry-after"), options.sessionKey, Date.now(), response.headers, options.decision, options.model);
 }

package/src/oauth/anthropic-model-quota.ts

@@ -0,0 +1,83 @@
+/** Model-scoped passive quota evidence. Reimplemented from documented behavior, not ported code. */
+import { credentialGeneration, getAccountCredential } from "./store";
+import { getCachedProviderAccountQuota } from "../providers/quota/account-cache";
+import type { ProviderQuota, ProviderQuotaWindow } from "../providers/quota-types";
+
+export const ANTHROPIC_PASSIVE_FAMILY_MAX_AGE_MS = 30 * 60_000;
+export type AnthropicModelFamily = "Fable" | "Opus" | "Sonnet";
+export function anthropicModelFamily(model?: string): AnthropicModelFamily | undefined {
+  return /(?:^|[/])claude-fable-5(?:-|$)/i.test(model ?? "") ? "Fable"
+    : /(?:^|[/])claude-opus-/i.test(model ?? "") ? "Opus"
+      : /(?:^|[/])claude-sonnet-/i.test(model ?? "") ? "Sonnet" : undefined;
+}
+
+export function anthropicModelPercents(quota: ProviderQuota | null, model?: string): number[] {
+  const family = anthropicModelFamily(model);
+  return [quota?.fiveHourPercent, quota?.weeklyPercent, ...(!model ? [quota?.monthlyPercent] : []),
+    ...(quota?.customWindows ?? []).filter(window => !model || window.scope !== "model" || (family && window.label === family)).map(window => window.percent)]
+    .filter((value): value is number => typeof value === "number" && Number.isFinite(value));
+}
+export function anthropicModelExhausted(accountId: string, model?: string): boolean {
+  return anthropicModelPercents(getCachedProviderAccountQuota("anthropic", accountId), model).some(percent => percent >= 100);
+}
+
+interface FamilyObservation { generation: string; seenAt: number; resetAt?: number; busy: boolean; }
+const spentFamilies = new Map<string, FamilyObservation>();
+const familyGenerations = new Map<string, number>();
+let nextFamilyGeneration = 1;
+export function anthropicFamilyQuotaGeneration(id: string): number { return familyGenerations.get(id) ?? 0; }
+const keyFor = (id: string, family: string) => `${id}\0${family}`;
+function ownedObservation(id: string, family: string): FamilyObservation | undefined {
+  const key = keyFor(id, family);
+  const entry = spentFamilies.get(key);
+  if (!entry) return undefined;
+  const credential = getAccountCredential("anthropic", id);
+  if (!credential || credentialGeneration(credential) !== entry.generation) { spentFamilies.delete(key); return undefined; }
+  return entry;
+}
+export function observeAnthropicFamilyQuota(id: string, windows: ProviderQuotaWindow[], now: number, authoritative = false): void {
+  const credential = getAccountCredential("anthropic", id);
+  if (!credential) return;
+  if (authoritative || windows.some(window => window.scope === "model")) familyGenerations.set(id, nextFamilyGeneration++);
+  if (authoritative) for (const key of spentFamilies.keys()) if (key.startsWith(`${id}\0`)) spentFamilies.delete(key);
+  for (const window of windows) {
+    if (window.scope !== "model") continue;
+    const key = keyFor(id, window.label);
+    if (!window.rejected) { spentFamilies.delete(key); continue; }
+    spentFamilies.set(key, { generation: credentialGeneration(credential), seenAt: now, resetAt: window.resetAt, busy: false });
+  }
+}
+export function anthropicFamilyRejected(id: string, model?: string, now = Date.now()): boolean {
+  const family = anthropicModelFamily(model);
+  const entry = family && ownedObservation(id, family);
+  if (!entry) return false;
+  if (entry.resetAt !== undefined && entry.resetAt <= now) return entry.busy;
+  return entry.busy || now - entry.seenAt < ANTHROPIC_PASSIVE_FAMILY_MAX_AGE_MS;
+}
+/** Only stale passive family exclusions require a request-driven single-flight physical send. */
+export function claimAnthropicFamilyRevalidation(id: string, model?: string, now = Date.now()): (() => void) | null {
+  const family = anthropicModelFamily(model);
+  const entry = family && ownedObservation(id, family);
+  if (!entry) return () => {};
+  if (anthropicFamilyRejected(id, model, now)) return null;
+  entry.busy = true;
+  return () => { entry.busy = false; };
+}
+/** An owned successful send proves admission for its requested family even without headers. */
+export function clearAnthropicRequestedFamilyQuota(id: string, model?: string): void {
+  const family = anthropicModelFamily(model);
+  if (family && spentFamilies.delete(keyFor(id, family))) familyGenerations.set(id, nextFamilyGeneration++);
+}
+export function clearAnthropicFamilyQuota(): void { spentFamilies.clear(); familyGenerations.clear(); }
+
+export function anthropicModelWeeklyPercent(quota: ProviderQuota | null, model?: string): number | undefined {
+  const family = anthropicModelFamily(model);
+  return family ? quota?.customWindows?.find(window => window.scope === "model" && window.label === family)?.percent : undefined;
+}
+
+export function anthropicFamilyRetryAt(id: string, model?: string, now = Date.now()): number | undefined {
+  const family = anthropicModelFamily(model);
+  const entry = family && ownedObservation(id, family);
+  if (!entry || !anthropicFamilyRejected(id, model, now)) return undefined;
+  return entry.busy ? now + 1000 : Math.min(entry.resetAt ?? Infinity, entry.seenAt + ANTHROPIC_PASSIVE_FAMILY_MAX_AGE_MS);
+}

package/src/oauth/anthropic-rate-limit-policy.ts

@@ -0,0 +1,37 @@
+/** Response-header policy for managed Anthropic sends; no account or request payload data. */
+export type AnthropicRateLimitKind = "shared-quota" | "family-quota" | "transient-rate" | "request-scoped-unknown";
+export type RateLimitHeaders = Pick<Headers, "get">;
+export const ANTHROPIC_SHORT_RETRY_MS = 100;
+export const ANTHROPIC_MAX_INLINE_THROTTLE_MS = 1_000;
+
+export function anthropicRetryAfterMs(value: string | null | undefined, now: number): number | undefined {
+  const text = value?.trim();
+  if (!text || text.length > 128) return undefined;
+  const at = /^\d+(?:\.\d+)?$/.test(text) ? now + Number(text) * 1000 : Date.parse(text);
+  return Number.isFinite(new Date(at).getTime()) && at > now ? Math.ceil(at - now) : undefined;
+}
+
+export function classifyAnthropic429(headers: RateLimitHeaders, now = Date.now()): AnthropicRateLimitKind {
+  const rejected = (window: string) => headers.get(`anthropic-ratelimit-unified-${window}-status`)?.trim() === "rejected";
+  if (rejected("5h") || rejected("7d")) return "shared-quota";
+  if (rejected("7d_oi")) return "family-quota";
+  if (headers.get("anthropic-ratelimit-unified-status")?.trim() === "rejected") return "shared-quota";
+  // Retry-After is an account-local admission pause, not proof of spent subscription quota.
+  if (anthropicRetryAfterMs(headers.get("retry-after"), now) !== undefined
+    || headers.get("anthropic-ratelimit-unified-status")?.trim() === "allowed") return "transient-rate";
+  return "request-scoped-unknown";
+}
+
+const pauses = new Map<string, number>();
+export function pauseAnthropicRateAdmission(accountId: string, until: number): void {
+  const now = Date.now();
+  for (const [id, deadline] of pauses) if (deadline <= now) pauses.delete(id);
+  pauses.set(accountId, Math.max(pauses.get(accountId) ?? 0, until));
+}
+export function anthropicRatePauseUntil(accountId: string, now = Date.now()): number | undefined {
+  const until = pauses.get(accountId);
+  if (until === undefined) return undefined;
+  if (until <= now) { pauses.delete(accountId); return undefined; }
+  return until;
+}
+export function clearAnthropicRatePauses(): void { pauses.clear(); }