@bitkyc08/opencodex 2.75.0 → 2.76.0

package/src/oauth/anthropic-routing.ts

@@ -1,9 +1,11 @@
+import { anthropicFamilyRejected, anthropicFamilyRetryAt, anthropicModelExhausted, anthropicModelPercents, anthropicModelWeeklyPercent, clearAnthropicFamilyQuota } from "./anthropic-model-quota";
 /**
  * Opt-in Anthropic OAuth account pool (#294).
  *
  * Default OFF. When enabled:
  * - Sticky session affinity across requests that share a session key
- * - 429 and classified pre-output account 403s cool the failed account and fail over
+ * - Shared-quota 429s and classified pre-output account 403s cool the sender and fail over
+ * - Transient throttles preserve affinity; family refusals apply only to their model family
  * - New sessions use `strategy` (default quota): lowest known fiveHour usage (#493),
  *   round-robin, or fill-first — affinity still wins for bound sessions
  *
@@ -15,6 +17,7 @@
  * backoff. Classified entitlement/billing 403s use a ten-minute default cooldown.
  * Token refresh failures retain the existing store needsReauth policy.
  */
+import { anthropicRatePauseUntil, clearAnthropicRatePauses, classifyAnthropic429, anthropicRetryAfterMs, pauseAnthropicRateAdmission } from "./anthropic-rate-limit-policy";
 import { createHash } from "node:crypto";
 import { captureOAuthAccountSelection, commitOAuthAccountSelection, credentialGeneration, getAccountSet, getAccountCredential, getAccountCredentialWithStatus } from "./store";
 import type { OAuthAccessSnapshot } from "./index";
@@ -33,7 +36,7 @@ import {
 import type { OcxAccountPoolQuotaWindow, OcxAccountPoolRotationStrategy, OcxConfig } from "../types";
 import { sweepExpiredOnWrite } from "../lib/state-store-sweeper";
 import { retainedUtf8Bytes } from "../lib/admission";
-import { routeCandidates, type AnthropicRouteDecision } from "./anthropic-model-routes";
+import { resolveAnthropicModelRoute, routeCandidates, type AnthropicRouteDecision } from "./anthropic-model-routes";
 import type { ProviderQuota } from "../providers/quota-types";
 import {
   anthropicCooldownGeneration,
@@ -185,6 +188,11 @@ function parseRateLimitReset(
     if (delayUntil(resetAt, now) === undefined) continue;
     if (latest === undefined || resetAt > latest) latest = resetAt;
   }
+  if (latest === undefined && !rejectedQuotaWindows.length
+    && headers.get("anthropic-ratelimit-unified-status")?.trim() === "rejected") {
+    const resetAt = Number(headers.get("anthropic-ratelimit-unified-reset")?.trim()) * 1000;
+    if (delayUntil(resetAt, now) !== undefined) latest = resetAt;
+  }
   if (latest === undefined) return undefined;
   return { delayMs: latest - now, rejectedQuotaWindows };
 }
@@ -271,6 +279,8 @@ export function sweepExpiredAnthropicRoutingHealth(now = Date.now()): number {
 /** Test / logout helper. */
 export function clearAnthropicAccountPoolState(): void {
   upstreamHealth.clear();
+  clearAnthropicRatePauses();
+  clearAnthropicFamilyQuota();
   clearAnthropicCooldownGenerations();
   sessionAffinity.clear();
   manualPreference = undefined;
@@ -313,7 +323,8 @@ function exhausted5h(accountId: string): boolean {
   return fiveHourKnown(accountId) && fiveHourScore(accountId) >= 100;
 }
 
-function hasKnownUsage(config: OcxConfig, accountId: string): boolean {
+function hasKnownUsage(config: OcxConfig, accountId: string, model?: string): boolean {
+  if (model) return hasKnownUsage(config, accountId) || anthropicModelWeeklyPercent(getCachedProviderAccountQuota(PROVIDER, accountId), model) !== undefined;
   const window = anthropicQuotaWindow(anthropicAccountPoolConfig(config));
   switch (window) {
     case "five-hour": return fiveHourKnown(accountId);
@@ -322,7 +333,12 @@ function hasKnownUsage(config: OcxConfig, accountId: string): boolean {
   }
 }
 
-function usageScore(config: OcxConfig, accountId: string): number {
+function usageScore(config: OcxConfig, accountId: string, model?: string): number {
+  if (model) {
+    const family = anthropicModelWeeklyPercent(getCachedProviderAccountQuota(PROVIDER, accountId), model);
+    if (family === undefined) return usageScore(config, accountId);
+    return hasKnownUsage(config, accountId) ? Math.max(family, usageScore(config, accountId)) : family;
+  }
   const window = anthropicQuotaWindow(anthropicAccountPoolConfig(config));
   switch (window) {
     case "five-hour": return fiveHourScore(accountId);
@@ -348,13 +364,13 @@ function isPoolCredentialUsable(accountId: string, now: number): boolean {
   return cred.expires > now + TOKEN_SKEW_MS;
 }
 
-export function getEligibleAnthropicAccounts(now = Date.now()): string[] {
+export function getEligibleAnthropicAccounts(now = Date.now(), model?: string): string[] {
   const set = getAccountSet(PROVIDER);
   if (!set) return [];
   return set.accounts
     .filter(account =>
       account.paused !== true && account.needsReauth !== true
-      && !isCooled(account.id, now)
+      && !isCooled(account.id, now) && !anthropicRatePauseUntil(account.id, now) && !anthropicFamilyRejected(account.id, model, now)
       && isPoolCredentialUsable(account.id, now))
     .map(account => account.id);
 }
@@ -452,20 +468,21 @@ export function forgetAnthropicFailoverQuorum(): void {
 }
 
 /** Earliest remaining cooldown among cooled Anthropic accounts, for client Retry-After. */
-export function getAnthropicPoolRetryAfterSeconds(now = Date.now(), decision: AnthropicRouteDecision | null = null): number | null {
+export function getAnthropicPoolRetryAfterSeconds(now = Date.now(), decision: AnthropicRouteDecision | null = null, model?: string): number | null {
   const set = getAccountSet(PROVIDER);
   if (!set) return null;
   // Once an explicit fallback route has no eligible declared account, selection may use
   // the ordinary pool. Its earliest usable cooldown must determine the advertised wait.
   const fallbackExpanded = decision?.fallback === true
-    && !getEligibleAnthropicAccounts(now).some(id => decision.accounts.includes(id));
+    && !getEligibleAnthropicAccounts(now, model).some(id => decision.accounts.includes(id));
   let earliest: number | null = null;
   for (const account of set.accounts) {
     if (account.paused === true || account.needsReauth === true || !isPoolCredentialUsable(account.id, now)) continue;
     if (decision && !fallbackExpanded && !decision.accounts.includes(account.id)) continue;
     const snap = getAnthropicAccountHealthSnapshot(account.id, now);
-    if (!snap?.cooldownUntil) continue;
-    if (earliest === null || snap.cooldownUntil < earliest) earliest = snap.cooldownUntil;
+    const until = Math.max(snap?.cooldownUntil ?? 0, anthropicRatePauseUntil(account.id, now) ?? 0, anthropicFamilyRetryAt(account.id, model, now) ?? 0);
+    if (until <= now) continue;
+    if (earliest === null || until < earliest) earliest = until;
   }
   if (earliest === null || earliest <= now) return null;
   return Math.max(1, Math.ceil((earliest - now) / 1000));
@@ -491,23 +508,24 @@ function compareScoredAccounts(a: ScoredAccount, b: ScoredAccount): number {
   return a.score - b.score || a.fiveHourTieBreak - b.fiveHourTieBreak;
 }
 
-function pickLowestUsage(config: OcxConfig, excludeId: string | undefined, now: number, decision: AnthropicRouteDecision | null = null): string | null {
+function pickLowestUsage(config: OcxConfig, excludeId: string | undefined, now: number, decision: AnthropicRouteDecision | null = null, model?: string): string | null {
   const window = anthropicQuotaWindow(anthropicAccountPoolConfig(config));
-  const unfiltered = routeCandidates(getEligibleAnthropicAccounts(now), decision).filter(id => id !== excludeId);
+  const unfiltered = routeCandidates(getEligibleAnthropicAccounts(now, model), decision).filter(id => id !== excludeId);
   const available = window === "weekly" ? unfiltered.filter(id => !exhausted5h(id)
     || isAnthropicAccountPoolEnabled(config) && anthropicAccountAutoSwitchThreshold(config, id) === 0) : unfiltered;
-  const availableOrFallback = available.length > 0 ? available : unfiltered;
+  const modelAvailable = model ? available.filter(id => !anthropicModelExhausted(id, model)) : available;
+  const availableOrFallback = modelAvailable.length > 0 ? modelAvailable : available.length > 0 ? available : unfiltered;
   // Thresholds are preferences, never eligibility. Keep the old lowest-usage fallback
   // when every candidate is drained, and keep pool-off reactive recovery policy inert.
   const hasKnownUnderThreshold = isAnthropicAccountPoolEnabled(config)
-    && availableOrFallback.some(id => hasKnownUsage(config, id) && isActiveUnderFillFirstThreshold(config, id));
+    && availableOrFallback.some(id => hasKnownUsage(config, id, model) && isActiveUnderFillFirstThreshold(config, id, model));
   const eligible = hasKnownUnderThreshold
-    ? availableOrFallback.filter(id => isActiveUnderFillFirstThreshold(config, id)) : availableOrFallback;
+    ? availableOrFallback.filter(id => isActiveUnderFillFirstThreshold(config, id, model)) : availableOrFallback;
   if (eligible.length === 0) return null;
   const scored: ScoredAccount[] = eligible.map(accountId => ({
     accountId,
-    hasKnownUsage: hasKnownUsage(config, accountId),
-    score: usageScore(config, accountId),
+    hasKnownUsage: hasKnownUsage(config, accountId, model),
+    score: usageScore(config, accountId, model),
     fiveHourTieBreak: window === "five-hour" ? 0 : fiveHourScore(accountId),
     // Every window EXCEPT the legacy five-hour default is an explicit opt-in, so
     // known-before-unknown applies to all of them and to none of the default path.
@@ -533,11 +551,13 @@ function pickNextFillFirstAnthropicAccount(
   afterId: string,
   eligible: string[],
   decision: AnthropicRouteDecision | null,
+  model?: string,
 ): string | null {
   const window = anthropicQuotaWindow(anthropicAccountPoolConfig(config));
   const available = window === "weekly" ? eligible.filter(id => !exhausted5h(id)
     || anthropicAccountAutoSwitchThreshold(config, id) === 0) : eligible;
-  const candidates = available.length > 0 ? available : eligible;
+  const modelAvailable = model ? available.filter(id => !anthropicModelExhausted(id, model)) : available;
+  const candidates = modelAvailable.length > 0 ? modelAvailable : available.length > 0 ? available : eligible;
   if (candidates.length === 0) return null;
   const routeOrder = usesDeclaredRouteOrder(eligible, decision);
   const ordered = routeOrder ? candidates : [...candidates].sort((a, b) => a.localeCompare(b));
@@ -548,7 +568,7 @@ function pickNextFillFirstAnthropicAccount(
   const startIdx = stableAll.indexOf(afterId);
   if (startIdx < 0) {
     for (const id of ordered) {
-      if (isActiveUnderFillFirstThreshold(config, id)) return id;
+      if (isActiveUnderFillFirstThreshold(config, id, model)) return id;
     }
     return ordered[0] ?? null;
   }
@@ -558,26 +578,27 @@ function pickNextFillFirstAnthropicAccount(
     const candidate = stableAll[(startIdx + step) % stableAll.length]!;
     if (!candidates.includes(candidate)) continue;
     if (!fallback) fallback = candidate;
-    if (isActiveUnderFillFirstThreshold(config, candidate)) return candidate;
+    if (isActiveUnderFillFirstThreshold(config, candidate, model)) return candidate;
   }
   return fallback ?? ordered[0] ?? null;
 }
 
-function pickAlternateAnthropicAccount(
+export function pickAlternateAnthropicAccount(
   config: OcxConfig,
   excludeId: string,
   now: number,
   decision: AnthropicRouteDecision | null,
+  model?: string,
 ): string | null {
   const strategy = anthropicPoolStrategy(config);
-  const eligible = routeCandidates(getEligibleAnthropicAccounts(now), decision).filter(id => id !== excludeId);
+  const eligible = routeCandidates(getEligibleAnthropicAccounts(now, model), decision).filter(id => id !== excludeId);
   if (strategy === "round-robin") {
     return peekRoundRobinAccount(POOL_KEY_ANTHROPIC, eligible, stickyLimitForPool(config));
   }
   if (strategy === "fill-first") {
-    return pickNextFillFirstAnthropicAccount(config, excludeId, eligible, decision);
+    return pickNextFillFirstAnthropicAccount(config, excludeId, eligible, decision, model);
   }
-  return pickLowestUsage(config, excludeId, now, decision);
+  return pickLowestUsage(config, excludeId, now, decision, model);
 }
 
 function pruneExpiredAffinity(now: number): void {
@@ -617,39 +638,39 @@ function anthropicPoolStrategy(config: OcxConfig): OcxAccountPoolRotationStrateg
   return normalizeAccountPoolStrategy(anthropicAccountPoolConfig(config).strategy);
 }
 
-function isActiveUnderFillFirstThreshold(config: OcxConfig, accountId: string): boolean {
+function isActiveUnderFillFirstThreshold(config: OcxConfig, accountId: string, model?: string): boolean {
   const threshold = anthropicAccountAutoSwitchThreshold(config, accountId);
   if (threshold <= 0) return true;
   const window = anthropicQuotaWindow(anthropicAccountPoolConfig(config));
   if (window === "weekly" && exhausted5h(accountId)) return false;
   // Unknown usage must not force fill-first to abandon the active account.
-  if (!hasKnownUsage(config, accountId)) return true;
-  return usageScore(config, accountId) < threshold;
+  if (!hasKnownUsage(config, accountId, model)) return true;
+  return usageScore(config, accountId, model) < threshold;
 }
 
 /**
  * Fill-first: keep eligible active under threshold; otherwise advance to the next
  * eligible id in stable sorted order after the current active (wrapping).
  */
-function pickFillFirstAnthropicAccount(config: OcxConfig, now: number, decision: AnthropicRouteDecision | null): string | null {
-  const eligible = routeCandidates(getEligibleAnthropicAccounts(now), decision);
+function pickFillFirstAnthropicAccount(config: OcxConfig, now: number, decision: AnthropicRouteDecision | null, model?: string): string | null {
+  const eligible = routeCandidates(getEligibleAnthropicAccounts(now, model), decision);
   if (eligible.length === 0) return null;
 
   const set = getAccountSet(PROVIDER);
   const active = set?.activeAccountId;
-  if (active && eligible.includes(active) && isActiveUnderFillFirstThreshold(config, active)) {
+  if (active && eligible.includes(active) && (!model || !anthropicModelExhausted(active, model)) && isActiveUnderFillFirstThreshold(config, active, model)) {
     return active;
   }
 
   if (!active || !set) {
     const ordered = usesDeclaredRouteOrder(eligible, decision) ? eligible : [...eligible].sort((a, b) => a.localeCompare(b));
     for (const id of ordered) {
-      if (isActiveUnderFillFirstThreshold(config, id)) return id;
+      if (isActiveUnderFillFirstThreshold(config, id, model)) return id;
     }
     return ordered[0] ?? null;
   }
 
-  return pickNextFillFirstAnthropicAccount(config, active, eligible, decision);
+  return pickNextFillFirstAnthropicAccount(config, active, eligible, decision, model);
 }
 
 /**
@@ -660,20 +681,22 @@ function pickUnboundStrategyAccount(
   config: OcxConfig,
   now: number,
   decision: AnthropicRouteDecision | null,
+  model?: string,
 ): { accountId: string; reason: "round-robin" | "fill-first" } | null {
   const strategy = anthropicPoolStrategy(config);
   if (strategy === "quota") return null;
 
   if (strategy === "round-robin") {
-    const eligible = routeCandidates(getEligibleAnthropicAccounts(now), decision);
+    const eligible = routeCandidates(getEligibleAnthropicAccounts(now, model), decision);
     const limit = stickyLimitForPool(config);
-    const picked = peekRoundRobinAccount(POOL_KEY_ANTHROPIC, eligible, limit);
+    const headroom = model ? eligible.filter(id => !anthropicModelExhausted(id, model)) : eligible;
+    const picked = peekRoundRobinAccount(POOL_KEY_ANTHROPIC, headroom.length ? headroom : eligible, limit);
     if (!picked) return null;
     return { accountId: picked, reason: "round-robin" };
   }
 
   if (strategy === "fill-first") {
-    const picked = pickFillFirstAnthropicAccount(config, now, decision);
+    const picked = pickFillFirstAnthropicAccount(config, now, decision, model);
     if (!picked) return null;
     return { accountId: picked, reason: "fill-first" };
   }
@@ -690,6 +713,7 @@ export function resolveAnthropicAccountForSession(
   config: OcxConfig,
   now = Date.now(),
   decision: AnthropicRouteDecision | null = null,
+  model?: string,
 ): AnthropicAccountSelection {
   pruneExpiredAffinity(now);
   const set = getAccountSet(PROVIDER);
@@ -706,21 +730,21 @@ export function resolveAnthropicAccountForSession(
       : null;
   }
 
-  const eligible = routeCandidates(getEligibleAnthropicAccounts(now), decision);
+  const eligible = routeCandidates(getEligibleAnthropicAccounts(now, model), decision);
   if (eligible.length === 0) {
     // Pause, removal and reauthentication are not cooldown evidence. Classify only
     // usable members of this strict route (or the ordinary pool after fallback widens).
     const recoverable = set.accounts.filter(account =>
       (!decision || decision.fallback || decision.accounts.includes(account.id))
       && account.paused !== true && account.needsReauth !== true && isPoolCredentialUsable(account.id, now));
-    const cooled = recoverable.length > 0 && recoverable.every(account => isCooled(account.id, now));
+    const cooled = recoverable.length > 0 && recoverable.every(account => isCooled(account.id, now) || anthropicRatePauseUntil(account.id, now) || anthropicFamilyRejected(account.id, model, now));
     if (cooled || decision) return { accountId: null, reason: cooled ? "all-cooled" : "none", routePosition: decision?.position };
   }
 
   if (!isAnthropicAccountPoolEnabled(config)) {
     const active = set.accounts.find(account => account.id === set.activeAccountId);
     // Disabled proactive rotation does not authorize a paused slot or an entirely cooled pool.
-    if (active?.paused || isCooled(set.activeAccountId, now)) {
+    if (active?.paused || isCooled(set.activeAccountId, now) || anthropicRatePauseUntil(set.activeAccountId, now) || anthropicFamilyRejected(set.activeAccountId, model, now)) {
       return { accountId: eligible[0] ?? null, reason: eligible.length > 0 ? "only-eligible" : "none" };
     }
     return { accountId: set.activeAccountId, reason: "pool-disabled" };
@@ -734,9 +758,7 @@ export function resolveAnthropicAccountForSession(
     } else {
       const chosen = manualPreference.accountId;
       const quota = getCachedProviderAccountQuota(PROVIDER, chosen);
-      const exhausted = [quota?.fiveHourPercent, quota?.weeklyPercent, quota?.monthlyPercent,
-        ...(quota?.customWindows ?? []).map(window => window.percent)]
-        .some(percent => typeof percent === "number" && percent >= 100);
+      const exhausted = anthropicModelPercents(quota, model).some(percent => percent >= 100);
       if (!exhausted && eligible.includes(chosen)) {
         return { accountId: chosen, reason: "manual", routePosition: decision?.position };
       }
@@ -750,7 +772,7 @@ export function resolveAnthropicAccountForSession(
       const stillThere = set.accounts.some(a => a.id === affined.accountId && a.paused !== true && a.needsReauth !== true);
       const stillUsable = stillThere && !isCooled(affined.accountId, now)
         && isPoolCredentialUsable(affined.accountId, now);
-      if (stillUsable && eligible.includes(affined.accountId)) {
+      if (stillUsable && eligible.includes(affined.accountId) && (!model || !anthropicModelExhausted(affined.accountId, model))) {
         return { accountId: affined.accountId, reason: "affinity", routePosition: decision?.position };
       }
       // A model route may exclude a healthy binding only for this request. Keep it for
@@ -766,13 +788,13 @@ export function resolveAnthropicAccountForSession(
   if (!key && (strategy === "round-robin" || strategy === "fill-first")) {
     const activeOk = set.accounts.some(a => a.id === set.activeAccountId && a.needsReauth !== true)
       && !isCooled(set.activeAccountId, now)
-      && eligible.includes(set.activeAccountId);
+      && eligible.includes(set.activeAccountId) && (!model || !anthropicModelExhausted(set.activeAccountId, model));
     if (activeOk) {
       return { accountId: set.activeAccountId, reason: "active", routePosition: decision?.position };
     }
   }
 
-  const strategyPick = pickUnboundStrategyAccount(config, now, decision);
+  const strategyPick = pickUnboundStrategyAccount(config, now, decision, model);
   if (strategyPick) {
     return { accountId: strategyPick.accountId, reason: strategyPick.reason, routePosition: decision?.position };
   }
@@ -780,7 +802,7 @@ export function resolveAnthropicAccountForSession(
   const threshold = anthropicAccountAutoSwitchThreshold(config, set.activeAccountId);
   const activeOk = set.accounts.some(a => a.id === set.activeAccountId && a.needsReauth !== true)
     && !isCooled(set.activeAccountId, now)
-    && eligible.includes(set.activeAccountId);
+    && eligible.includes(set.activeAccountId) && (!model || !anthropicModelExhausted(set.activeAccountId, model));
 
   let accountId: string | null = null;
   let reason: AnthropicAccountSelectionReason = "none";
@@ -790,11 +812,11 @@ export function resolveAnthropicAccountForSession(
     // Unknown usage must NOT force a switch away from the healthy active account.
     if (activeOk
       && !(window === "weekly" && exhausted5h(set.activeAccountId))
-      && (!hasKnownUsage(config, set.activeAccountId) || usageScore(config, set.activeAccountId) < threshold)) {
+      && (!hasKnownUsage(config, set.activeAccountId, model) || usageScore(config, set.activeAccountId, model) < threshold)) {
       accountId = set.activeAccountId;
       reason = "active";
     } else {
-      const picked = pickLowestUsage(config, undefined, now, decision);
+      const picked = pickLowestUsage(config, undefined, now, decision, model);
       if (picked) {
         accountId = picked;
         reason = activeOk && picked === set.activeAccountId ? "active" : "lowest-usage";
@@ -807,7 +829,7 @@ export function resolveAnthropicAccountForSession(
     accountId = set.activeAccountId;
     reason = "active";
   } else {
-    const picked = pickLowestUsage(config, set.activeAccountId, now, decision);
+    const picked = pickLowestUsage(config, set.activeAccountId, now, decision, model);
     if (picked) {
       accountId = picked;
       reason = "only-eligible";
@@ -827,13 +849,14 @@ export async function resolveAnthropicDispatchAccountId(
   config: OcxConfig,
   sessionKey: string | null = null,
   decision: AnthropicRouteDecision | null = null,
+  model?: string,
 ): Promise<string> {
   const now = Date.now();
-  const selection = resolveAnthropicAccountForSession(sessionKey, config, now, decision);
+  const selection = resolveAnthropicAccountForSession(sessionKey, config, now, decision, model);
   if (selection.reason === "all-cooled") {
-    throw new AnthropicAccountCooldownError(getAnthropicPoolRetryAfterSeconds(now, decision), decision?.position);
+    throw new AnthropicAccountCooldownError(getAnthropicPoolRetryAfterSeconds(now, decision, model), decision?.position);
   }
-  if (selection.reason === "paused" || !selection.accountId || !getEligibleAnthropicAccounts(now).includes(selection.accountId)) {
+  if (selection.reason === "paused" || !selection.accountId || !getEligibleAnthropicAccounts(now, model).includes(selection.accountId)) {
     const { OAuthAccountPausedError, OAuthLoginRequiredError } = await import("./index");
     const active = getAccountSet(PROVIDER)?.activeAccountId;
     // Pool-off fresh admission resolves the active credential first. Preserve that
@@ -879,8 +902,9 @@ export function rotateAnthropicAccountOn429(
   now = Date.now(),
   rateLimitHeaders?: AnthropicRateLimitHeaders | null,
   decision: AnthropicRouteDecision | null = null,
+  model?: string,
 ): string | null {
-  return rotateAnthropicAccountOnRefusal(config, failedAccountId, 429, retryAfterHeader, sessionKey, now, rateLimitHeaders, decision);
+  return rotateAnthropicAccountOnRefusal(config, failedAccountId, 429, retryAfterHeader, sessionKey, now, rateLimitHeaders, decision, model);
 }
 
 /** The caller proves that a 403 is an account refusal before entering this pool policy. */
@@ -893,6 +917,7 @@ export function rotateAnthropicAccountOnRefusal(
   now = Date.now(),
   rateLimitHeaders?: AnthropicRateLimitHeaders | null,
   decision: AnthropicRouteDecision | null = null,
+  model?: string,
 ): string | null {
   if (!recordAnthropicAccountRefusal(config, failedAccountId, status, retryAfterHeader, now, rateLimitHeaders)) return null;
 
@@ -901,8 +926,8 @@ export function rotateAnthropicAccountOnRefusal(
   // because those dormant values remain in config. The quota picker is the neutral
   // recovery policy already used by the default strategy.
   const next = isAnthropicAccountPoolEnabled(config)
-    ? pickAlternateAnthropicAccount(config, failedAccountId, now, decision)
-    : pickLowestUsage(config, failedAccountId, now);
+    ? pickAlternateAnthropicAccount(config, failedAccountId, now, decision, model)
+    : pickLowestUsage(config, failedAccountId, now, null, model);
   if (!next) {
     console.warn(`[anthropic-pool] ${decision ? `route:#${decision.position} ` : ""}no eligible replacement; returning ${status}`);
     return null;
@@ -946,6 +971,15 @@ export function recordAnthropicAccountRefusal(
   if (!isAnthropicAccountPoolEnabled(config) && !hasAnthropicFailoverQuorum(now)
     && !getAccountCredentialWithStatus(PROVIDER, failedAccountId)?.paused) return false;
 
+  if (status === 429) {
+    const headers = rateLimitHeaders ?? new Headers();
+    const kind = classifyAnthropic429({ get: name => name === "retry-after" ? retryAfterHeader ?? null : headers.get(name) }, now);
+    if (kind !== "shared-quota") {
+      if (kind === "transient-rate") pauseAnthropicRateAdmission(failedAccountId, now + (anthropicRetryAfterMs(retryAfterHeader, now) ?? 100));
+      return false;
+    }
+  }
+
   // Retry-After first: it is the header written FOR this decision. The rejected window's
   // reset is the fallback, because a 429 that omits Retry-After still carries it -- and
   // without that fallback such a refusal cools for the 60s default and the exhausted
@@ -977,6 +1011,7 @@ export interface AnthropicSelectionRoutingOptions {
   reason?: AnthropicAccountSelectionReason;
   expectedCredentialGeneration?: string;
   routeDecision?: AnthropicRouteDecision | null;
+  model?: string;
 }
 
 /** Commit the selected account before dispatch; rejected proposals have no routing side effects. */
@@ -985,7 +1020,7 @@ export async function promoteAnthropicActiveAccount(
   expectedSelection: OAuthAccountSelection | null,
   options: AnthropicSelectionRoutingOptions,
 ): Promise<OAuthAccountSelection | null> {
-  if (!expectedSelection || !routeCandidates(getEligibleAnthropicAccounts(), options.routeDecision ?? null).includes(accountId)) return null;
+  if (!expectedSelection || !routeCandidates(getEligibleAnthropicAccounts(Date.now(), options.model), options.routeDecision ?? null).includes(accountId)) return null;
   const committed = await commitOAuthAccountSelection(PROVIDER, accountId, {
     expectedSelection,
     expectedCredentialGeneration: options.expectedCredentialGeneration,
@@ -1003,13 +1038,13 @@ export function commitAnthropicSelectionRouting(
   options: AnthropicSelectionRoutingOptions,
 ): boolean {
   if (getAccountCredentialWithStatus(PROVIDER, accountId)?.paused || committed.accountId !== accountId || (options.routeDecision
-    && !routeCandidates(getEligibleAnthropicAccounts(), options.routeDecision).includes(accountId))) return false;
+    && !routeCandidates(getEligibleAnthropicAccounts(Date.now(), options.model), options.routeDecision).includes(accountId))) return false;
   const current = captureOAuthAccountSelection(PROVIDER);
   if (current?.accountId !== committed.accountId || current.revision !== committed.revision) return false;
   if (isAnthropicAccountPoolEnabled(options.config)) {
     if (anthropicPoolStrategy(options.config) === "round-robin" && options.reason !== "affinity") {
       const limit = stickyLimitForPool(options.config);
-      const picked = pickRoundRobinAccount(POOL_KEY_ANTHROPIC, routeCandidates(getEligibleAnthropicAccounts(), options.routeDecision ?? null), limit);
+      const picked = pickRoundRobinAccount(POOL_KEY_ANTHROPIC, routeCandidates(getEligibleAnthropicAccounts(Date.now(), options.model), options.routeDecision ?? null), limit);
       if (picked !== accountId) seedPoolRotationAccount(POOL_KEY_ANTHROPIC, accountId);
       notePoolRotationSuccess(POOL_KEY_ANTHROPIC, accountId, limit);
     }
@@ -1020,7 +1055,9 @@ export function commitAnthropicSelectionRouting(
       && Date.now() - bound.lastUsedAt <= AFFINITY_IDLE_TTL_MS
       && eligibleAtCommit.includes(bound.accountId)
       && !routeCandidates(eligibleAtCommit, options.routeDecision).includes(bound.accountId);
-    if (!preserveExcludedAffinity) bindAnthropicSessionAffinity(options.sessionKey, accountId);
+    const preservePausedAffinity = bound && (anthropicRatePauseUntil(bound.accountId) !== undefined
+      || anthropicFamilyRejected(bound.accountId, options.model));
+    if (!preserveExcludedAffinity && !preservePausedAffinity) bindAnthropicSessionAffinity(options.sessionKey, accountId);
   }
   if (manualPreference === undefined || (manualPreference?.accountId === expectedSelection.accountId
     && manualPreference.revision === expectedSelection.revision)) manualPreference = null;
@@ -1079,6 +1116,23 @@ export async function getAnthropicPoolAccessSnapshot(accountId: string): Promise
   return { provider: PROVIDER, accountId, accessToken, generation: credentialGeneration(row.credential) };
 }
 
+/** Resolve a direct Anthropic helper send through the same model route as primary traffic. */
+export async function getAnthropicSidecarAccessToken(
+  providerName: string,
+  model: string,
+  config?: OcxConfig,
+): Promise<string> {
+  if (providerName !== PROVIDER || !config || !isAnthropicAccountPoolEnabled(config)) {
+    const { getValidAccessToken } = await import("./index");
+    return getValidAccessToken(providerName);
+  }
+  const route = resolveAnthropicModelRoute(config, model);
+  if (route.error) throw new Error("Invalid Anthropic model route configuration");
+  const selection = resolveAnthropicAccountForSession(null, config, Date.now(), route.decision, model);
+  if (!selection.accountId) throw new Error("No permitted Anthropic account is available for this model");
+  return (await getAnthropicPoolAccessSnapshot(selection.accountId)).accessToken;
+}
+
 /**
  * Whether the pool may refresh this account's token. Background `local-cli` slots must not
  * adopt the global Claude CLI credential (same fail-closed rule as quota probes).

package/src/oauth/health.ts

@@ -1,3 +1,5 @@
+import type { MainAccountHardLockStatus } from "../codex/main-account-hard-lock";
+import type { MainAccountExternalUsageWarning } from "../codex/main-account-external-usage";
 import { getCodexAccountHealthSnapshot, type CodexCooldownSource } from "../codex/routing";
 import { getAnthropicAccountHealthSnapshot } from "./anthropic-routing";
 import { isAccountNeedsReauth } from "../codex/account-runtime-state";
@@ -353,7 +355,10 @@ export function collectOAuthHealthEntries(
   return entries;
 }
 
+export type CodexMainAccountPolicyHealth = MainAccountHardLockStatus & { externalUsage?: MainAccountExternalUsageWarning };
+
 type ProxyCodexAccountHealth = {
+  mainAccountHardLock?: unknown;
   id: string;
   health?: OAuthAccountHealth;
   needsReauth?: boolean;
@@ -372,11 +377,37 @@ function coerceRemoteAccountHealth(
 }
 
 type LiveProxyCodexHealthResult = {
+  mainAccountHardLock?: CodexMainAccountPolicyHealth;
   source: CodexHealthSource;
   entries: OAuthHealthEntry[] | null;
 };
 
-async function fetchCodexHealthFromLiveProxy(
+/** Whitelisted projection: never forward account metadata or arbitrary management fields. */
+export function projectMainAccountPolicyHealth(value: unknown): CodexMainAccountPolicyHealth | undefined {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return undefined;
+  const raw = value as Record<string, unknown>;
+  const thresholds = raw.thresholds as { short?: unknown; long?: unknown } | undefined;
+  const percent = (n: unknown): n is number => typeof n === "number" && Number.isFinite(n) && n >= 0 && n <= 100;
+  if (typeof raw.enabled !== "boolean" || typeof raw.state !== "string"
+    || !(raw.enabled ? ["unknown", "ready", "blocked"] : ["off"]).includes(raw.state)
+    || !thresholds || !percent(thresholds.short) || !percent(thresholds.long)
+    || !Number.isInteger(thresholds.short) || !Number.isInteger(thresholds.long)
+    || thresholds.short < 80 || thresholds.short > thresholds.long) return undefined;
+  const result: CodexMainAccountPolicyHealth = { enabled: raw.enabled,
+    state: raw.state as MainAccountHardLockStatus["state"], thresholds: { short: thresholds.short, long: thresholds.long } };
+  if (raw.window === "short" || raw.window === "long") result.window = raw.window;
+  if (typeof raw.resetAt === "number" && Number.isFinite(raw.resetAt)) result.resetAt = raw.resetAt;
+  const warning = raw.externalUsage as Partial<MainAccountExternalUsageWarning> | undefined;
+  if (warning && (warning.window === "short" || warning.window === "long")
+    && percent(warning.fromPercent) && percent(warning.toPercent)
+    && typeof warning.observedAt === "number" && Number.isFinite(warning.observedAt)) {
+    result.externalUsage = { window: warning.window, fromPercent: warning.fromPercent,
+      toPercent: warning.toPercent, observedAt: warning.observedAt };
+  }
+  return result;
+}
+
+export async function fetchCodexHealthFromLiveProxy(
   fetchImpl: typeof fetch | undefined = undefined,
   findLiveProxyImpl: typeof findLiveProxy = findLiveProxy,
   readRuntimePortImpl: typeof readRuntimePort = readRuntimePort,
@@ -404,7 +435,10 @@ async function fetchCodexHealthFromLiveProxy(
       if (!account?.id || typeof account.id !== "string") continue;
       pushEntry(entries, "codex", account.id, coerceRemoteAccountHealth(account));
     }
-    return { source: "management-api", entries };
+    const mainAccountHardLock = projectMainAccountPolicyHealth(
+      json.accounts.find(account => account?.id === MAIN_CODEX_ACCOUNT_ID)?.mainAccountHardLock,
+    );
+    return { source: "management-api", entries, ...(mainAccountHardLock ? { mainAccountHardLock } : {}) };
   } catch {
     return { source: "management-api-unavailable", entries: null };
   }
@@ -418,6 +452,7 @@ export type CodexHealthSource =
   | "management-api-unavailable";
 
 export type OAuthCliHealthReport = {
+  mainAccountHardLock?: CodexMainAccountPolicyHealth;
   entries: OAuthHealthEntry[];
   codexHealthSource: CodexHealthSource;
 };
@@ -450,7 +485,8 @@ export async function collectOAuthHealthEntriesForCli(
   );
   if (remote.entries) {
     for (const entry of remote.entries) entries.push(entry);
-    return { entries, codexHealthSource: "management-api" };
+    return { entries, codexHealthSource: "management-api",
+      ...(remote.mainAccountHardLock ? { mainAccountHardLock: remote.mainAccountHardLock } : {}) };
   }
   return { entries, codexHealthSource: remote.source };
 }

package/src/oauth/index.ts

@@ -39,6 +39,7 @@ import { loginNous, NousTokenError, refreshNousToken, clearNousRefreshIntent, Re
 import { loginChatGPT, refreshChatGPTToken, type ChatGPTLoginFlow } from "./chatgpt";
 import { loginAntigravity, refreshAntigravityToken } from "./google-antigravity";
 import { loginCursor, refreshCursorToken } from "./cursor";
+import { loginZed, refreshZedToken } from "./zed";
 import { assertDevinCliAdoptionOwnership, loginDevin, refreshDevinToken } from "./devin";
 import { validateDevinApiBaseUrl } from "./devin/api-base";
 import { loginGithubCopilot, refreshGithubCopilotToken, validateCopilotApiBaseUrl } from "./github-copilot";
@@ -100,6 +101,11 @@ export interface OAuthAccessSnapshot {
    * concurrent switch (#2568d).
    */
   apiBaseUrl?: string;
+  /**
+   * The upstream's own user id for providers that sign requests with it (Zed's `user_id`).
+   * `accountId` is the local store slot key, a hash, and must never stand in for it.
+   */
+  providerUserId?: string;
 }
 
 export interface ObservedOAuthAccessSnapshot extends OAuthAccessSnapshot {
@@ -319,6 +325,13 @@ export const OAUTH_PROVIDERS: Record<string, OAuthProviderDef> = {
     providerConfig: oauthConfig("cursor"),
     defaultModel: oauthDefaultModel("cursor"),
   },
+  zed: {
+    login: ctrl => loginZed(ctrl),
+    refresh: refreshZedToken,
+    providerConfig: oauthConfig("zed"),
+    defaultModel: oauthDefaultModel("zed"),
+    defaultRefreshPolicy: "disabled",
+  },
   devin: {
     // Import-first: adopts a signed-in Devin CLI credential when one exists and
     // only then falls back to the Auth0 browser flow. forceLogin skips the
@@ -511,6 +524,7 @@ function accessSnapshot(provider: string, accountId: string, cred: OAuthCredenti
     accessToken: cred.access,
     ...(cred.projectId ? { projectId: cred.projectId } : {}),
     ...(accountApiBaseUrl ? { apiBaseUrl: accountApiBaseUrl } : {}),
+    ...(oauthProvider === "zed" && cred.accountId ? { providerUserId: cred.accountId } : {}),
     // Stored account metadata remains authoritative. Metadata-less legacy/environment credentials
     // may use explicit environment routing, but never borrow the currently signed-in local CLI account.
     ...(provider === "kiro"

package/src/oauth/kiro-account-load.ts

@@ -21,6 +21,15 @@ interface AccountState { records: Map<number, LeaseRecord>; waiters: Waiter[] }
 const accounts = new Map<string, AccountState>();
 let nextLeaseId = 0;
 const keyOf = (provider: string, accountId: string) => `${provider}\u0000${accountId}`;
+type QueuedHook = (provider: string, accountId: string) => void;
+let queuedHookForTests: QueuedHook | undefined;
+
+/** Observe capacity admission without replacing the real lease handoff. */
+export function observeQueuedAccountLeaseForTests(hook: QueuedHook): () => void {
+  const previous = queuedHookForTests;
+  queuedHookForTests = hook;
+  return () => { queuedHookForTests = previous; };
+}
 
 function handoff(state: AccountState, now: number): void {
   while (state.waiters.length > 0) {
@@ -103,5 +112,6 @@ export async function acquireAccountLease(
     const timer = setTimeout(() => finish(null), remaining);
     opts.signal?.addEventListener("abort", abort, { once: true });
     if (opts.signal?.aborted) finish(null);
+    if (!settled) queuedHookForTests?.(provider, accountId);
   });
 }