@bitkyc08/opencodex 2.76.0 → 2.77.0

package/src/oauth/health.ts

@@ -14,6 +14,22 @@ import { loadAuthStore, peekAuthStore, peekOAuthRefreshIntent, readOAuthRefreshI
 import type { ProviderAccount } from "./types";
 
 export type OAuthAccountHealth =
+  | { status: "healthy" }
+  | { status: "cooldown"; until: string; reason: "rate_limit" | "quota" }
+  | { status: "reauth_required"; reason: OAuthReauthReason }
+  | { status: "warning"; reason: "refresh_conflict" | "metadata_mismatch" | "stale_credentials" | "validation_pending" };
+
+/** Why an OAuth account needs reauthentication. `verify_account` is distinct from a dead
+ * credential: the grant is alive but the provider blocks the account until a human
+ * verifies it, so a plain re-login without that verification will not help. */
+export type OAuthReauthReason = "unauthorized" | "forbidden" | "refresh_failed" | "verify_account";
+
+/**
+ * Codex-pool health: the same shape minus the provider-verification cause, which only
+ * the generic OAuth quarantine produces. Narrowing the return keeps Codex DTOs on
+ * `CodexAccountReauthReason` without a lossy re-narrow at every consumer.
+ */
+export type CodexPoolAccountHealth =
   | { status: "healthy" }
   | { status: "cooldown"; until: string; reason: "rate_limit" | "quota" }
   | { status: "reauth_required"; reason: "unauthorized" | "forbidden" | "refresh_failed" }
@@ -24,6 +40,7 @@ export type OAuthHealthLabel =
   | "Rate limited"
   | "Quota limited"
   | "Reauthentication required"
+  | "Verification required"
   | "Refresh failed"
   | "Metadata mismatch"
   | "Credential conflict"
@@ -60,7 +77,7 @@ type OAuthWarningReason = "refresh_conflict" | "metadata_mismatch" | "stale_cred
 
 export function projectOAuthAccountHealth(input: {
   needsReauth?: boolean;
-  reauthReason?: "unauthorized" | "forbidden" | "refresh_failed";
+  reauthReason?: OAuthReauthReason;
   cooldownUntilMs?: number;
   cooldownReason?: "rate_limit" | "quota";
   warningReason?: OAuthWarningReason;
@@ -96,6 +113,9 @@ function actionFor(provider: string, health: OAuthAccountHealth): string | undef
   }
   if (health.status === "reauth_required") {
     if (provider === "codex") return CODEX_REAUTH_ACTION;
+    if (health.reason === "verify_account") {
+      return `verify the account with the provider in a browser, then run \`ocx login ${provider}\``;
+    }
     return `run \`ocx login ${provider}\``;
   }
   if (health.status === "cooldown") {
@@ -115,7 +135,9 @@ export function oauthHealthLabel(health: OAuthAccountHealth): OAuthHealthLabel {
     case "cooldown":
       return health.reason === "rate_limit" ? "Rate limited" : "Quota limited";
     case "reauth_required":
-      return health.reason === "refresh_failed" ? "Refresh failed" : "Reauthentication required";
+      if (health.reason === "refresh_failed") return "Refresh failed";
+      if (health.reason === "verify_account") return "Verification required";
+      return "Reauthentication required";
     case "warning":
       switch (health.reason) {
         case "validation_pending":
@@ -190,7 +212,9 @@ export function projectStoredOAuthAccountHealth(
     : null;
   return projectOAuthAccountHealth({
     needsReauth: account.needsReauth === true,
-    reauthReason: account.needsReauth === true ? "refresh_failed" : undefined,
+    reauthReason: account.needsReauth === true
+      ? (account.needsReauthReason ?? "refresh_failed")
+      : undefined,
     cooldownUntilMs: anthropicSnap?.cooldownUntil,
     // Same mapping as the Codex pool's `cooldownReasonFromSource`: only a Retry-After is
     // request-rate throttling. A reset-derived cooldown means a usage window is spent, which
@@ -206,7 +230,7 @@ export function projectCodexAccountHealth(input: {
   needsReauth: boolean;
   reauthReason?: "unauthorized" | "forbidden" | "refresh_failed";
   now?: number;
-}): OAuthAccountHealth {
+}): CodexPoolAccountHealth {
   // One read serves every verdict below. Each lookup re-reads and re-hardens the whole store
   // file, and the main account lives in the native Codex auth file rather than the pool store,
   // so a lookup for it could only ever miss.
@@ -250,13 +274,16 @@ export function projectCodexAccountHealth(input: {
   }
   const now = input.now ?? Date.now();
   const snap = getCodexAccountHealthSnapshot(input.accountId, now);
+  // Safe narrowing: every reason above is Codex-scoped (`verify_account` only enters
+  // through the generic OAuth quarantine path), so the shared projector cannot
+  // produce it here despite the wider return type.
   return projectOAuthAccountHealth({
     needsReauth,
     reauthReason: needsReauth ? (input.reauthReason ?? storedFailureReason ?? "refresh_failed") : undefined,
     cooldownUntilMs: snap?.cooldownUntil,
     cooldownReason: cooldownReasonFromSource(snap?.cooldownSource),
     now,
-  });
+  }) as CodexPoolAccountHealth;
 }
 
 /**

package/src/oauth/index.ts

@@ -52,7 +52,7 @@ import { apiKeyPoolEntryId, sanitizeApiKeyValue } from "../providers/api-keys";
 import { effectiveGoogleMode, getProviderRegistryEntry, mergeRegistryStaticHeaders, providerMatchesRegistryTransport } from "../providers/registry";
 import { providerModelsUrl, resolveProviderModelDiscoveryUrl } from "../providers/model-discovery";
 import { resolveProviderTransport } from "../providers/xai-transport";
-import { detectClaudeCodeToken, detectGrokCliToken, hasComparableGrokIdentity, isSameGrokIdentity, shouldAdoptGrokGeneration } from "./local-token-detect";
+import { detectGrokCliToken, hasComparableGrokIdentity, isSameGrokIdentity, shouldAdoptGrokGeneration } from "./local-token-detect";
 import { logOAuthEvent } from "./log";
 import { captureConfigGeneration, sweepExpiredOnWrite } from "../lib/state-store-sweeper";
 import { clearManualCodeSlot, ensureManualCodeSlot, kiroLoginSettling, loginAbort, loginState, waitForManualLoginCode, type OAuthLoginHint } from "./login-flow-state";
@@ -82,7 +82,9 @@ export {
 export { OAUTH_REFRESH_LOCK_WAIT_MS, peekAuthStore, peekOAuthRefreshIntent } from "./store";
 import { codexAccountNamespaceProviderCollisionError } from "../codex/account-namespace-match";
 
-const REFRESH_SKEW_MS = 60_000;
+import { REFRESH_SKEW_MS } from "./refresh-policy";
+import { newerClaudeCredential, captureAnthropicCredentialOwner } from "./anthropic-continuity";
+import { mergeAnthropicIdentity, type AnthropicIdentityResolver } from "./anthropic-identity";
 export interface OAuthAccessSnapshot {
   provider: string;
   accountId: string;
@@ -169,7 +171,7 @@ export function seedOAuthTokenRefreshFlightsForTests(rows: Array<{ key: string;
 const XAI_PERMANENT_FAILURE_TTL_MS=30_000;
 const permanentRefreshFailures=new Map<string,number>();
 interface XaiRefreshDeps { intentLock?:ReturnType<typeof createOAuthRefreshIntentLock>; now?:()=>number; afterPrePersistRead?:()=>void|Promise<void>; signal?: AbortSignal }
-interface AnthropicRefreshDeps { intentLock?:ReturnType<typeof createOAuthRefreshIntentLock>; now?:()=>number; afterPrePersistRead?:()=>void|Promise<void>; signal?: AbortSignal; flight?: OAuthRefreshFlightEvidence; replacedStaleFlight?: OAuthRefreshFlightEvidence }
+interface AnthropicRefreshDeps { resolveIdentity?: AnthropicIdentityResolver; intentLock?:ReturnType<typeof createOAuthRefreshIntentLock>; now?:()=>number; afterPrePersistRead?:()=>void|Promise<void>; signal?: AbortSignal; flight?: OAuthRefreshFlightEvidence; replacedStaleFlight?: OAuthRefreshFlightEvidence }
 interface GenericRefreshDeps { intentLock?:ReturnType<typeof createOAuthRefreshIntentLock>; afterPrePersistRead?:()=>void|Promise<void>; signal?: AbortSignal }
 function verdictKey(p:string,a:string,c:OAuthCredentials){return `${p}\0${a}\0${credentialGeneration(c)}`;}
 function cached(p:string,a:string,c:OAuthCredentials,now:()=>number){const k=verdictKey(p,a,c),u=permanentRefreshFailures.get(k);if(u===undefined)return false;if(u<=now()){permanentRefreshFailures.delete(k);return false;}return true;}
@@ -866,6 +868,7 @@ function authoritative(stored:OAuthCredentials,active:boolean,now:()=>number):OA
 function merged(fresh: OAuthCredentials, previous: OAuthCredentials): OAuthCredentials {
   return {
     ...fresh,
+    ...mergeAnthropicIdentity(fresh, previous),
     // Shared: a refresh function returns "local-cli" only when the credential it hands back
     // still is the local CLI's (Devin re-reading the CLI file, Meta Muse echoing its durable
     // CLI key). Relabelling that "oauth" would stop the next forced refresh from re-reading it.
@@ -880,12 +883,6 @@ function merged(fresh: OAuthCredentials, previous: OAuthCredentials): OAuthCrede
 }
 export async function refreshXaiAccountWithLock(provider:string,accountId:string,def:OAuthProviderDef,callerCredential:OAuthCredentials,deps:XaiRefreshDeps={}):Promise<string>{const writerGeneration=captureConfigGeneration();const now=deps.now??Date.now;const guard=await(deps.intentLock??createOAuthRefreshIntentLock(provider,accountId)).acquire();try{const row=getAccountCredentialWithStatus(provider,accountId);if(!row)throw new OAuthLoginRequiredError(provider);if(row.paused)throw new OAuthAccountPausedError();const stored=row.credential;const active=getAccountSet(provider)?.activeAccountId===accountId,candidate=authoritative(stored,active,now);if(credentialGeneration(candidate)!==credentialGeneration(callerCredential)&&candidate.expires>now()+REFRESH_SKEW_MS){if(credentialGeneration(candidate)!==credentialGeneration(stored)){const o=await mergeAccountCredential(provider,accountId,candidate,{expectedGeneration:credentialGeneration(stored),afterPrePersistRead:deps.afterPrePersistRead});if(o.superseded){if(o.stored.expires>now()+REFRESH_SKEW_MS)return o.stored.access;throw new OAuthLoginRequiredError(provider);}}return candidate.access;}if(cached(provider,accountId,candidate,now))throw new OAuthLoginRequiredError(provider);const generation=credentialGeneration(candidate);try{const fresh=merged(await def.refresh(candidate.refresh,deps.signal),candidate);const o=await mergeAccountCredential(provider,accountId,fresh,{expectedGeneration:generation,afterPrePersistRead:deps.afterPrePersistRead});if(o.superseded){if(o.stored.expires>now()+REFRESH_SKEW_MS)return o.stored.access;throw new OAuthLoginRequiredError(provider);}permanentRefreshFailures.delete(verdictKey(provider,accountId,candidate));if(candidate.source==="local-cli")console.warn(XAI_LOCAL_CLI_DETACH_WARNING);return fresh.access;}catch(error){if(error instanceof OAuthMutationBusyError){permanentRefreshFailures.delete(verdictKey(provider,accountId,candidate));throw error;}if(!terminal(error))throw error;const failedAt=now();permanentRefreshFailures.set(verdictKey(provider,accountId,candidate),failedAt+XAI_PERMANENT_FAILURE_TTL_MS);sweepExpiredOnWrite(failedAt);await markAccountNeedsReauthIfGeneration(provider,accountId,generation,writerGeneration);throw new OAuthLoginRequiredError(provider);}}finally{guard.release();}}
 
-function newerClaudeCredential(stored: OAuthCredentials, now: number): OAuthCredentials | undefined {
-  if (stored.source !== "local-cli") return undefined;
-  const disk = detectClaudeCodeToken();
-  if (!disk || disk.expires <= now + REFRESH_SKEW_MS) return undefined;
-  return credentialGeneration(disk) !== credentialGeneration(stored) ? disk : undefined;
-}
 
 /**
  * Preserve an already-rotated Nous refresh token (RT-B) after a terminal refresh
@@ -939,33 +936,42 @@ export async function refreshAnthropicAccountWithLock(
   const now = deps.now ?? Date.now;
   const guard = await (deps.intentLock ?? createOAuthRefreshIntentLock(provider, accountId)).acquire();
   try {
-    const row = getAccountCredentialWithStatus(provider, accountId);
-    if (!row) throw new OAuthLoginRequiredError(provider);
-    if (row.paused) throw new OAuthAccountPausedError();
-    const stored = row.credential;
-    const account = getAccountSet(provider)?.accounts.find(candidate => candidate.id === accountId);
+    const accountSet = getAccountSet(provider);
+    const account = accountSet?.accounts.find(candidate => candidate.id === accountId);
+    if (!accountSet || !account) throw new OAuthLoginRequiredError(provider);
+    if (account.paused) throw new OAuthAccountPausedError();
+    const stored = account.credential;
+    const owns = captureAnthropicCredentialOwner(accountSet, accountId);
     const generation = credentialGeneration(stored);
     let pendingIntent = readOAuthRefreshIntent(provider, accountId);
-    const disk = newerClaudeCredential(stored, now());
-    if (disk) {
-      const outcome = await mergeAccountCredential(provider, accountId, disk, {
-        expectedGeneration: credentialGeneration(stored),
+    const observed = await newerClaudeCredential(stored, now(), deps.signal, deps.resolveIdentity);
+    const assertOwner = (store: AuthStore, checkDisk = true) => {
+      if (observed.kind !== "absent" && deps.signal?.aborted) throw new OAuthTokenRefreshStaleError();
+      if (!owns(store, checkDisk && observed.kind !== "absent" ? observed.diskGeneration : undefined)) {
+        if (store[provider]?.accounts.find(a => a.id === accountId)?.paused) throw new OAuthAccountPausedError();
+        throw new OAuthTokenRefreshStaleError();
+      }
+    };
+    assertOwner({ [provider]: getAccountSet(provider)! }, observed.kind !== "adopt");
+    if (observed.kind === "adopt") {
+      const outcome = await mergeAccountCredential(provider, accountId, observed.credential, {
+        expectedGeneration: generation,
         afterPrePersistRead: deps.afterPrePersistRead,
+        assertOwnership: assertOwner,
       });
-      if (outcome.superseded) {
-        // The disk credential is already durable here, so cleanup is secondary: an unlink
-        // failure must not mask a committed credential by throwing over the return below.
-        if (pendingIntent) clearAnthropicRefreshIntentBestEffort(provider, accountId, pendingIntent);
-        if (outcome.stored.expires > now() + REFRESH_SKEW_MS) return outcome.stored.access;
-        throw new OAuthLoginRequiredError(provider);
-      }
+      // A superseding write did not adopt our candidate. Its pending intent remains owned by it.
+      if (outcome.superseded) throw new OAuthTokenRefreshStaleError();
       if (pendingIntent) clearAnthropicRefreshIntentBestEffort(provider, accountId, pendingIntent);
-      return disk.access;
+      return observed.credential.access;
     }
+    // Unknown rotation may have consumed this refresh token. Refuse without replay or changing health.
+    if (observed.kind === "unresolved") throw new OAuthLoginRequiredError(provider);
     if (pendingIntent?.cleanupPending && pendingIntent.generation === generation) {
       resumeAnthropicRefreshIntentCleanup(provider, accountId, pendingIntent);
       pendingIntent = undefined;
     }
+    if (observed.kind === "different"
+      && (pendingIntent?.uncertain || pendingIntent?.generation === generation)) throw new OAuthLoginRequiredError(provider);
     if (!pendingIntent?.uncertain && pendingIntent?.generation === generation) {
       if (pendingIntent.staleOwner) throw new OAuthTokenRefreshStaleError();
       if (deps.replacedStaleFlight && pendingIntent.flightId === deps.replacedStaleFlight.flightId) {
@@ -1007,6 +1013,7 @@ export async function refreshAnthropicAccountWithLock(
       const outcome = await mergeAccountCredential(provider, accountId, fresh, {
         expectedGeneration: generation,
         afterPrePersistRead: deps.afterPrePersistRead,
+        assertOwnership: store => { if (!owns(store, undefined, true)) throw new OAuthTokenRefreshStaleError(); },
       });
       if (outcome.superseded) {
         if (attemptIntent) clearAnthropicRefreshIntentBestEffort(provider, accountId, attemptIntent);
@@ -1717,7 +1724,7 @@ export async function runLogin(
       });
     } else {
       const saveOptions = {
-        preserveIdentityless: opts?.forceLogin === true,
+        preserveIdentityless: opts?.forceLogin === true || (provider === "anthropic" && cred.source === "local-cli"),
         assertBeforePersist: deps.assertCurrentOwner,
       };
       if (shouldRollbackKiroAccounts && !deps.saveCredential) {
@@ -1799,6 +1806,7 @@ export interface OAuthAccountSummary {
   email?: string;
   active: boolean;
   needsReauth?: boolean;
+  needsReauthReason?: "verify_account";
   expiresAt?: number;
   /**
    * Subscription tier, mirroring the field the OpenAI/Codex provider reports, so a consumer
@@ -1835,6 +1843,7 @@ export function getLoginStatus(provider: string, maskEmails = true): { loggedIn:
     email: projectEmail(a.credential.email, maskEmails) ?? undefined,
     active: a.id === set.activeAccountId,
     ...(a.needsReauth ? { needsReauth: true } : {}),
+    ...(a.needsReauth && a.needsReauthReason === "verify_account" ? { needsReauthReason: a.needsReauthReason } : {}),
     expiresAt: a.credential.expires,
     // Explicitly null rather than omitted — see OAuthAccountSummary.plan. No OAuth provider
     // exposes a subscription tier today, so there is nothing truthful to put here; deriving one

package/src/oauth/local-token-detect.ts

@@ -128,3 +128,10 @@ export function detectClaudeCodeToken(): OAuthCredentials | null {
   if (!raw) return null;
   return parseClaudeOauthPayload(raw);
 }
+
+/** Shared-token continuity for opaque Claude tokens; fully rotated pairs need authenticated account proof. */
+export function hasClaudeCredentialContinuity(stored: OAuthCredentials, disk: OAuthCredentials): boolean {
+  const sameToken = (left: string, right: string): boolean =>
+    typeof left === "string" && left.trim().length > 0 && left === right;
+  return sameToken(stored.refresh, disk.refresh) || sameToken(stored.access, disk.access);
+}

package/src/oauth/refresh-policy.ts

@@ -0,0 +1,2 @@
+/** Refresh early enough to avoid dispatching a bearer that expires in flight. */
+export const REFRESH_SKEW_MS = 60_000;

package/src/oauth/store.ts

@@ -19,6 +19,7 @@
  *   distinct one. Kimi extracts JWT `user_id`/`sub` as accountId; Cursor extracts JWT `sub` —
  *   both append distinct identified accounts under multiauth.
  */
+import { normalizeAnthropicIdentity, matchesAnthropicImport, mergeAnthropicIdentity } from "./anthropic-identity";
 import { createHash, randomUUID } from "node:crypto";
 import { chmodSync, closeSync, constants as fsConstants, copyFileSync, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
@@ -34,6 +35,7 @@ import {
 } from "../lib/state-store-sweeper";
 import { validateCopilotApiBaseUrl } from "./github-copilot";
 import { validateDevinApiBaseUrl } from "./devin/api-base";
+import { REFRESH_SKEW_MS } from "./refresh-policy";
 import { parseAnthropicAccountThreshold } from "./anthropic-account-threshold";
 import type { OAuthAccountSelection, OAuthCredentialSource, OAuthCredentials, ProviderAccount, ProviderAccountSet } from "./types";
 
@@ -531,6 +533,8 @@ function normalizeCredential(cred: unknown): OAuthCredentials | null {
   };
   if (typeof candidate.email === "string" && candidate.email.length > 0) normalized.email = candidate.email;
   if (typeof candidate.accountId === "string" && candidate.accountId.length > 0) normalized.accountId = candidate.accountId;
+  const identity = normalizeAnthropicIdentity(candidate.anthropicIdentity, candidate.access);
+  if (identity) normalized.anthropicIdentity = identity;
   if (isCredentialSource(candidate.source)) normalized.source = candidate.source;
   if (typeof candidate.projectId === "string" && candidate.projectId.length > 0) normalized.projectId = candidate.projectId;
   if (typeof candidate.apiBaseUrl === "string" && candidate.apiBaseUrl.length > 0) {
@@ -629,6 +633,9 @@ function normalizeAccount(value: unknown): ProviderAccount | null {
   if (candidate.paused === true) account.paused = true;
   const threshold = parseAnthropicAccountThreshold(candidate.autoSwitchThresholdOverride);
   if (threshold !== null) account.autoSwitchThresholdOverride = threshold;
+  if (candidate.needsReauth === true && candidate.needsReauthReason === "verify_account") {
+    account.needsReauthReason = "verify_account";
+  }
   if (typeof candidate.addedAt === "number") account.addedAt = candidate.addedAt;
   if (typeof candidate.loginId === "string"
     && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(candidate.loginId)) {
@@ -862,9 +869,10 @@ export async function saveCredentialWithReceipt(
 ): Promise<OAuthCredentialWriteReceipt | null> {
   const safe = normalizeCredential(cred);
   if (!safe) return null;
-  return await mutateStore(store => {
+  const receipt = await mutateStore(store => {
     const set = store[provider];
     const previousActiveAccountId = set?.activeAccountId;
+    const previousSelectionRevision = set?.selectionRevision;
     const previousAccounts = new Map(
       set?.accounts.map(account => [account.id, structuredClone(account)]) ?? [],
     );
@@ -876,11 +884,27 @@ export async function saveCredentialWithReceipt(
       const id = newAccountId(safe);
       store[provider] = { activeAccountId: id, accounts: [{ id, credential: safe, addedAt: Date.now() }] };
       accountId = id;
+    } else if (provider === "anthropic" && safe.source === "local-cli") {
+      const existing = set.accounts.find(a => matchesAnthropicImport(a.credential, safe));
+      if (existing) {
+        existing.credential = { ...safe, ...mergeAnthropicIdentity(safe, existing.credential),
+          accountId: safe.accountId ?? existing.credential.accountId, email: safe.email ?? existing.credential.email };
+        set.selectionRevision = previousSelectionRevision;
+        delete existing.needsReauth;
+        delete existing.needsReauthReason;
+        accountId = existing.id;
+      } else {
+        const id = distinctAccountId(safe, set.accounts);
+        set.accounts.push({ id, credential: safe, addedAt: Date.now() });
+        set.activeAccountId = id;
+        accountId = id;
+      }
     } else if (identity) {
       const existing = set.accounts.find(a => (a.credential.accountId ?? a.credential.email) === identity);
       if (existing) {
         existing.credential = safe;
         delete existing.needsReauth;
+        delete existing.needsReauthReason;
         if (existing.paused !== true) set.activeAccountId = existing.id;
         accountId = existing.id;
       } else {
@@ -892,6 +916,7 @@ export async function saveCredentialWithReceipt(
         if (!opts.preserveIdentityless && active && active.credential.accountId === undefined && active.credential.email === undefined) {
           active.credential = safe;
           delete active.needsReauth;
+          delete active.needsReauthReason;
           accountId = active.id;
         } else {
           const id = distinctAccountId(safe, set.accounts);
@@ -911,6 +936,7 @@ export async function saveCredentialWithReceipt(
       if (active) {
         active.credential = safe;
         delete active.needsReauth;
+        delete active.needsReauthReason;
         accountId = active.id;
       } else {
         const id = distinctAccountId(safe, set.accounts);
@@ -944,6 +970,18 @@ export async function saveCredentialWithReceipt(
       receipt.selectionRevision = store[provider]?.selectionRevision;
     },
   });
+  // An explicit login retires that account's failover evidence: a cooldown recorded
+  // against the old grant must not hold out the fresh credential. Dynamic import
+  // keeps the store free of a static edge into the failover module, which reads the
+  // store itself.
+  try {
+    const { clearGenericFailoverHealthForAccount } = await import("./generic-account-failover");
+    clearGenericFailoverHealthForAccount(provider, receipt.accountId);
+  } catch {
+    // The credential write has already committed. A cleanup failure must not
+    // surface as a failed login, or the Kiro path rolls the new grant back.
+  }
+  return receipt;
 }
 
 /** Ordinary callers do not acquire rollback authority merely by saving a credential. */
@@ -1047,6 +1085,7 @@ export async function upsertCredentialByIdentity(
     if (existing && set) {
       existing.credential = safe;
       delete existing.needsReauth;
+      delete existing.needsReauthReason;
       set.activeAccountId ??= existing.id;
       return "updated";
     }
@@ -1149,6 +1188,7 @@ export async function saveAccountCredential(
     account.credential = safe;
     if (opts.rotateLoginId) account.loginId = randomUUID();
     delete account.needsReauth;
+    delete account.needsReauthReason;
     // A pause that found no usable fallback leaves the active id on a paused row. Once this
     // reauthentication makes an unpaused account usable, hand the selection to it.
     const active = set.accounts.find(a => a.id === set.activeAccountId);
@@ -1288,7 +1328,9 @@ export async function setAccountPaused(
     if (paused && set.activeAccountId === accountId) {
       const start = set.accounts.findIndex(candidate => candidate.id === accountId);
       const ring = [...set.accounts.slice(start + 1), ...set.accounts.slice(0, start)];
-      const fallback = ring.find(candidate => candidate.paused !== true && candidate.needsReauth !== true);
+      const fallback = ring.find(candidate => candidate.paused !== true && candidate.needsReauth !== true
+        && !(provider === "anthropic" && candidate.credential.source === "local-cli"
+          && candidate.credential.expires <= Date.now() + REFRESH_SKEW_MS));
       if (fallback) {
         set.activeAccountId = fallback.id;
         set.selectionRevision = randomUUID();
@@ -1363,6 +1405,7 @@ export async function replaceProviderAccountSet(
         ...(account.needsReauth ? { needsReauth: true } : {}),
         ...(account.paused ? { paused: true } : {}),
         ...(account.autoSwitchThresholdOverride !== undefined ? { autoSwitchThresholdOverride: account.autoSwitchThresholdOverride } : {}),
+        ...(account.needsReauthReason === "verify_account" ? { needsReauthReason: account.needsReauthReason } : {}),
         ...(account.addedAt !== undefined ? { addedAt: account.addedAt } : {}),
         ...(account.loginId ? { loginId: account.loginId } : {}),
       })),
@@ -1408,18 +1451,24 @@ export async function markAccountNeedsReauth(
   provider: string,
   accountId: string,
   needsReauth: boolean,
+  reason?: "verify_account",
   writerGeneration = captureConfigGeneration(),
 ): Promise<void> {
   if (writerGeneration < lastReconciledGeneration && !liveOAuthAccountKeys.has(oauthAccountKey(provider, accountId))) return;
   await mutateStore(store => {
     const account = store[provider]?.accounts.find(a => a.id === accountId);
     if (!account) return;
-    if (needsReauth) account.needsReauth = true;
-    else delete account.needsReauth;
+    if (needsReauth) {
+      account.needsReauth = true;
+      if (reason === "verify_account") account.needsReauthReason = reason;
+    } else {
+      delete account.needsReauth;
+      delete account.needsReauthReason;
+    }
   }, [provider, accountId]);
 }
 
-export async function mergeAccountCredential(provider:string,accountId:string,credential:OAuthCredentials,opts:{expectedGeneration?:string;afterPrePersistRead?:()=>void|Promise<void>;assertOwnership?: (store: AuthStore) => void}={}):Promise<{superseded:false}|{superseded:true;stored:OAuthCredentials}>{const safe=normalizeCredential(credential);if(!safe)throw new Error("Refusing to persist invalid OAuth credential");return await mutateStore(async store=>{await opts.afterPrePersistRead?.();const account=store[provider]?.accounts.find(x=>x.id===accountId);if(!account)throw new Error(`OAuth account disappeared before persist: ${provider}`);if(opts.expectedGeneration!==undefined&&credentialGeneration(account.credential)!==opts.expectedGeneration)return{superseded:true,stored:account.credential};opts.assertOwnership?.(store);account.credential=safe;delete account.needsReauth;return{superseded:false};},[provider,accountId,safe,opts.expectedGeneration]);}
+export async function mergeAccountCredential(provider:string,accountId:string,credential:OAuthCredentials,opts:{expectedGeneration?:string;afterPrePersistRead?:()=>void|Promise<void>;assertOwnership?: (store: AuthStore) => void}={}):Promise<{superseded:false}|{superseded:true;stored:OAuthCredentials}>{const safe=normalizeCredential(credential);if(!safe)throw new Error("Refusing to persist invalid OAuth credential");return await mutateStore(async store=>{await opts.afterPrePersistRead?.();const account=store[provider]?.accounts.find(x=>x.id===accountId);if(!account)throw new Error(`OAuth account disappeared before persist: ${provider}`);if(opts.expectedGeneration!==undefined&&credentialGeneration(account.credential)!==opts.expectedGeneration)return{superseded:true,stored:account.credential};opts.assertOwnership?.(store);account.credential=safe;if(account.needsReauthReason!=="verify_account"){delete account.needsReauth;delete account.needsReauthReason;}return{superseded:false};},[provider,accountId,safe,opts.expectedGeneration]);}
 // A late refresh failure must not change an operator-paused account's health. Check under
 // the mutation lock, not before awaiting it, so a concurrent pause cannot be overwritten.
-export async function markAccountNeedsReauthIfGeneration(provider:string,accountId:string,generation:string,writerGeneration=captureConfigGeneration()):Promise<boolean>{const key=oauthAccountKey(provider,accountId);if(writerGeneration<lastReconciledGeneration&&!liveOAuthAccountKeys.has(key))return false;return await mutateStore(store=>{const account=store[provider]?.accounts.find(x=>x.id===accountId);if(!account?.credential||account.paused||credentialGeneration(account.credential)!==generation)return false;if(writerGeneration<lastReconciledGeneration&&!liveOAuthAccountKeys.has(key))return false;account.needsReauth=true;return true;},[provider,accountId,generation]);}
+export async function markAccountNeedsReauthIfGeneration(provider:string,accountId:string,generation:string,writerGeneration=captureConfigGeneration(),reason?:"verify_account"):Promise<boolean>{const key=oauthAccountKey(provider,accountId);if(writerGeneration<lastReconciledGeneration&&!liveOAuthAccountKeys.has(key))return false;return await mutateStore(store=>{const account=store[provider]?.accounts.find(x=>x.id===accountId);if(!account?.credential||account.paused||credentialGeneration(account.credential)!==generation)return false;if(writerGeneration<lastReconciledGeneration&&!liveOAuthAccountKeys.has(key))return false;account.needsReauth=true;if(reason==="verify_account")account.needsReauthReason=reason;return true;},[provider,accountId,generation]);}

package/src/oauth/types.ts

@@ -62,6 +62,8 @@ export type OAuthCredentials = {
   email?: string;
   accountId?: string;
   source?: OAuthCredentialSource;
+  /** Private authenticated account proof; never projected into account summaries. */
+  anthropicIdentity?: { v: 1; accountUuid: string; bearerSha256: string };
   /** Google Antigravity (Cloud Code Assist) discovered project id; injected into the CCA envelope. */
   projectId?: string;
   /**
@@ -92,6 +94,13 @@ export interface ProviderAccount {
   paused?: boolean;
   /** Anthropic-only usage-switch override; absent inherits its pool default, zero disables it. */
   autoSwitchThresholdOverride?: number;
+  /**
+   * Why the account needs reauthentication. `verify_account` means the grant is
+   * alive but the provider blocks the account until the human verifies it
+   * (Antigravity 403 PERMISSION_DENIED) — a plain re-login without that
+   * verification will not help. Absent means an ordinary credential failure.
+   */
+  needsReauthReason?: "verify_account";
   addedAt?: number;
 }
 

package/src/protocols/encoders/messages.ts

@@ -386,7 +386,8 @@ function createAnthropicMessageWriter(
         return;
       }
       const message = typeof error.message === "string" ? error.message : "upstream request failed";
-      fail(anthropicFailedStatus(error, message), message, true);
+      fail(anthropicFailedStatus(error, message), message, true,
+        error.code === "context_length_exceeded" ? error.code : undefined);
     },
     overflow() {
       fail(413, "upstream translation buffer exceeded the safe limit", false, "translation_buffer_limit");
@@ -413,7 +414,7 @@ export function encodeAnthropicMessageSse(
 /**
  * Fold an encoded Messages stream into the non-streaming client response, with the status
  * mapping the Messages ingress applied to its collected message: a translator overflow is 413,
- * a stream that ended in an error frame is 502, anything else unexpected a 502 api_error.
+ * a classified context rejection is 400; other error frames/unexpected failures stay 502.
  */
 export async function collectAnthropicMessageResponse(
   stream: ReadableStream<Uint8Array>,
@@ -444,7 +445,7 @@ export async function collectAnthropicMessageResponse(
     );
   }
   return new Response(JSON.stringify(message), {
-    status: isError ? 502 : 200,
+    status: isError ? (translatedError?.code === "context_length_exceeded" ? 400 : 502) : 200,
     headers: { "Content-Type": "application/json" },
   });
 }

package/src/providers/antigravity-effort-families.ts

@@ -0,0 +1,75 @@
+import type { OcxConfig } from "../types";
+import { routedSlug, slugEquals, slugEquivalenceKey } from "./slug-codec";
+
+/** Discovery evidence only; independent of the parser and the catalog cache. */
+export interface AntigravityEffortFamilyRow {
+  id: string;
+  provider: string;
+  custom?: boolean;
+  catalogKind?: string;
+  antigravityEffortWireModelIds?: Partial<Record<"low" | "medium" | "high", string>>;
+}
+
+const FAMILY_EFFORTS = ["low", "medium", "high"] as const;
+
+export function antigravityEffortFamilyIds(row: AntigravityEffortFamilyRow): string[] | undefined {
+  if (row.custom || row.catalogKind === "custom-model-v1" || !row.antigravityEffortWireModelIds) return undefined;
+  const ids = FAMILY_EFFORTS.map(effort => `${row.id}-${effort}`);
+  return FAMILY_EFFORTS.every((effort, index) => row.antigravityEffortWireModelIds![effort] === ids[index])
+    ? ids : undefined;
+}
+
+/** Retained wire targets stay routable internally; only the public list collapses. */
+export function collapseAntigravityPublicModels<T extends AntigravityEffortFamilyRow>(rows: T[]): T[] {
+  const hidden = new Map<string, Set<string>>();
+  for (const row of rows) {
+    const ids = antigravityEffortFamilyIds(row);
+    if (!ids) continue;
+    const providerIds = hidden.get(row.provider) ?? new Set<string>();
+    for (const id of ids) providerIds.add(id);
+    hidden.set(row.provider, providerIds);
+  }
+  return rows.filter(row => row.custom || row.catalogKind === "custom-model-v1"
+    || antigravityEffortFamilyIds(row) !== undefined || !hidden.get(row.provider)?.has(row.id));
+}
+
+/** Project stored native/encoded selections without rewriting the user's allowlist. */
+export function projectAntigravitySelectedModels(
+  provider: string,
+  selected: readonly string[],
+  rows: readonly AntigravityEffortFamilyRow[],
+): string[] {
+  const projected = [...selected];
+  const keys = new Set(selected.map(id => slugEquivalenceKey(routedSlug(provider, id))));
+  const bases = new Set(rows.filter(row => row.provider === provider && antigravityEffortFamilyIds(row)).map(row => row.id));
+  for (const row of rows) {
+    if (row.provider !== provider) continue;
+    const ids = antigravityEffortFamilyIds(row);
+    const baseKey = slugEquivalenceKey(routedSlug(provider, row.id));
+    if (!ids || keys.has(baseKey) || projected.includes(row.id)
+      || !ids.some(id => !bases.has(id) && keys.has(slugEquivalenceKey(routedSlug(provider, id))))) continue;
+    projected.push(row.id);
+  }
+  return projected;
+}
+
+/** Inherit once, before the baseline has ever recorded the public base identity. */
+export function antigravityFamilyDisabled(
+  config: Pick<OcxConfig, "providers" | "disabledModels" | "modelDiscovery">,
+  row: AntigravityEffortFamilyRow,
+  rows: readonly AntigravityEffortFamilyRow[] = [],
+): boolean {
+  const ids = antigravityEffortFamilyIds(row);
+  if (!ids) return false;
+  const disabled = config.disabledModels ?? [];
+  if (disabled.some(slug => slugEquals(slug, row.provider, row.id))) return true;
+  const baseline = config.modelDiscovery?.knownModels?.[row.provider];
+  if (!baseline) return false;
+  const known = new Set([...baseline.ids, ...baseline.removed]);
+  if (known.has(row.id)) return false;
+  const bases = new Set(rows.filter(candidate => candidate.provider === row.provider
+    && antigravityEffortFamilyIds(candidate)).map(candidate => candidate.id));
+  const priorTiers = ids.filter(id => known.has(id) && !bases.has(id));
+  return priorTiers.length > 0
+    && priorTiers.every(id => disabled.some(slug => slugEquals(slug, row.provider, id)));
+}