@bitkyc08/opencodex 2.76.0 → 2.78.0-preview.20261005

package/src/lib/package-tree-integrity.ts

@@ -1,6 +1,7 @@
 import { readFileSync, statSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
+import { isRealBunBinary } from "./bun-binary-validator.mjs";
 import { isStandaloneBinary } from "./standalone";
 
 export interface PackageTreeObservation {
@@ -56,6 +57,14 @@ export interface PackageTreeIntegrityOptions {
   schedule?: (callback: () => void, delayMs: number) => (() => void) | void;
   /** Test seam for `installedVersion()`; production reads the package manifest. */
   readInstalledVersion?: () => string | undefined;
+  /**
+   * Whether the runtime a restart would spawn is complete. An in-place npm install writes
+   * package.json and extracts the `bun` package's small placeholder before its postinstall
+   * swaps the real binary in, and the replacement spawns `process.execPath`, that same path.
+   * While this answers false the replacement is treated like an unreadable tree: no restart,
+   * then a fresh full debounce once the runtime is ready.
+   */
+  runtimeReady?: () => boolean;
 }
 
 export type ObservePackageTree = () => PackageTreeObservation | null;
@@ -142,6 +151,12 @@ export function sameObservation(left: PackageTreeObservation, right: PackageTree
  */
 const PACKAGE_TREE_RECHECK_MS = 1_000;
 
+/**
+ * Fences a live process whose package manifest was replaced, and once the replacement is readable,
+ * stable for the debounce interval and any configured `runtimeReady` check passes, hands it to
+ * `onReplaced`. If the callback throws, the guard rechecks the tree and may call it again after
+ * another debounce interval while the replacement persists.
+ */
 export function createPackageTreeIntegrityGuard(
   observe: ObservePackageTree = observePackageManifest,
   now: () => number = Date.now,
@@ -154,6 +169,8 @@ export function createPackageTreeIntegrityGuard(
   let timerScheduled = false;
   let cancelScheduled: (() => void) | null = null;
   let waitingForReadableTree = false;
+  /** Logged once per wait, so a postinstall that never runs is visible rather than silent. */
+  let waitingForRuntime = false;
   let replacementCandidate: PackageTreeObservation | null = null;
   /** The replacement identity that survived a full stability interval (see installedVersion). */
   let settledReplacement: PackageTreeObservation | null = null;
@@ -192,9 +209,24 @@ export function createPackageTreeIntegrityGuard(
       if (sameObservation(boot, current)) {
         resetRestartTimer();
         waitingForReadableTree = false;
+        waitingForRuntime = false;
         replacementCandidate = null;
         return;
       }
+      if (options.runtimeReady && !options.runtimeReady()) {
+        if (!waitingForRuntime) {
+          waitingForRuntime = true;
+          console.warn("Package tree replaced; waiting for its Bun runtime to finish installing before restarting");
+        }
+        // A replacement settled before a failed admission is no longer restart-ready: withdraw
+        // it so installedVersion() stays silent until the fresh debounce settles it again.
+        settledReplacement = null;
+        resetRestartTimer();
+        waitingForReadableTree = true;
+        armRestartTimer(PACKAGE_TREE_RECHECK_MS);
+        return;
+      }
+      waitingForRuntime = false;
       if (waitingForReadableTree) {
         waitingForReadableTree = false;
         replacementCandidate = current;
@@ -239,6 +271,7 @@ export function createPackageTreeIntegrityGuard(
   return {
     installedVersion: () => {
       if (settledReplacement === null) return undefined;
+      if (options.runtimeReady && !options.runtimeReady()) return undefined;
       const current = observe();
       if (current === null || !sameObservation(settledReplacement, current)) return undefined;
       return readInstalledVersion();
@@ -271,6 +304,7 @@ export function createPackageTreeIntegrityGuard(
       lastOkAt = at;
       resetRestartTimer();
       waitingForReadableTree = false;
+      waitingForRuntime = false;
       replacementCandidate = null;
       return { ok: true };
     },
@@ -292,5 +326,12 @@ export function createRuntimePackageTreeIntegrityGuard(
     if (installer === "source" || isStandaloneBinary()) {
       return { status: () => ({ ok: true }), dispose: () => {} };
     }
-    return createPackageTreeIntegrityGuard(observe, now, options);
+    // The restart replacement spawns process.execPath, the bundled Bun in an npm install. Read it
+    // now: Linux Bun resolves it lazily, and after npm swaps the package directory a first read
+    // reports the retired binary as "(deleted)"; reading it once pins the boot path.
+    const runtimePath = process.execPath;
+    return createPackageTreeIntegrityGuard(observe, now, {
+      ...options,
+      runtimeReady: options.runtimeReady ?? (() => isRealBunBinary(runtimePath)),
+    });
   }

package/src/lib/provider-client-headers.ts

@@ -0,0 +1,62 @@
+const HEADER_NAME_PATTERN = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+const BLOCKED_FORWARDED_CLIENT_HEADERS = new Set([
+  "authorization",
+  "chatgpt-account-id",
+  "connection",
+  "content-length",
+  "content-type",
+  "cookie",
+  "expect",
+  "host",
+  "keep-alive",
+  "proxy-authorization",
+  "proxy-connection",
+  "set-cookie",
+  "te",
+  "trailer",
+  "transfer-encoding",
+  "upgrade",
+  "x-amz-security-token",
+  "x-api-key",
+  "api-key",
+  "x-goog-api-key",
+  "x-oai-attestation",
+]);
+
+const ALLOWED_FORWARDED_CLIENT_HEADERS = new Set([
+  "originator", "x-client-request-id", "x-codex-app-version", "user-agent",
+]);
+const MAX_FORWARDED_CLIENT_HEADERS = 64;
+
+/** Normalize one opt-in caller header while refusing credential and transport-owned fields. */
+export function normalizeForwardedClientHeaderName(value: unknown): string | null {
+  if (typeof value !== "string") return null;
+  const name = value.trim().toLowerCase();
+  if (!name || !HEADER_NAME_PATTERN.test(name) || !ALLOWED_FORWARDED_CLIENT_HEADERS.has(name)) return null;
+  return name;
+}
+
+/** Validate provider.forwardClientHeaders without ever admitting credential-bearing headers. */
+export function providerForwardClientHeadersConfigError(value: unknown): string | null {
+  if (value === undefined) return null;
+  if (!Array.isArray(value)) return "forwardClientHeaders must be an array of header names";
+  if (value.length > MAX_FORWARDED_CLIENT_HEADERS) {
+    return `forwardClientHeaders must contain at most ${MAX_FORWARDED_CLIENT_HEADERS} names`;
+  }
+  const seen = new Set<string>();
+  for (const raw of value) {
+    if (typeof raw !== "string" || !raw.trim() || !HEADER_NAME_PATTERN.test(raw.trim())) {
+      return "forwardClientHeaders must use valid HTTP header names";
+    }
+    const name = raw.trim().toLowerCase();
+    if (BLOCKED_FORWARDED_CLIENT_HEADERS.has(name)) {
+      return `forwardClientHeaders must not include credential or transport-owned header "${raw.trim()}"`;
+    }
+    if (!ALLOWED_FORWARDED_CLIENT_HEADERS.has(name)) {
+      return "forwardClientHeaders must use the supported client metadata allowlist";
+    }
+    if (seen.has(name)) return `forwardClientHeaders must not repeat header "${raw.trim()}"`;
+    seen.add(name);
+  }
+  return null;
+}

package/src/lib/proxy-env.ts

@@ -96,6 +96,9 @@ export function outboundProxyConfigured(
   return OUTBOUND_PROXY_ENV_KEYS.some(key => proxyEnvPresent(key, env));
 }
 
+// Captured before config/proxy-env applies runtime changes; Bun retains startup proxy env.
+export const startupOutboundProxyConfigured = outboundProxyConfigured();
+
 /**
  * The value when `raw` is a proxy URL Bun fetch can actually use, else null.
  * Bun rejects unparseable values and non-http(s) schemes (UnsupportedProxyProtocol),

package/src/lib/test-home-guard.ts

@@ -150,7 +150,8 @@ export function assertNotRealCodexHomeUnderTest(dir: string): void {
   if (canonicalize(dir) !== PROTECTED_CODEX_HOME) return;
   throw new Error(
     `refusing to write the real Codex home (${PROTECTED_CODEX_HOME}) from a test process. `
-    + "Point CODEX_HOME at a temp directory for this test before writing native auth.json.",
+    + "Point CODEX_HOME at a temp directory for this test before writing Codex files "
+    + "(auth.json, the catalog, models_cache.json, the journal or config.toml).",
   );
 }
 

package/src/oauth/anthropic-account-refusal.ts

@@ -9,13 +9,13 @@ import type { OcxConfig } from "../types";
 import type { AnthropicRouteDecision } from "./anthropic-model-routes";
 import { recordAnthropicAccountRefusal, rotateAnthropicAccountOnRefusal, hasAnthropicFailoverQuorum, isAnthropicAccountPoolEnabled, pickAlternateAnthropicAccount } from "./anthropic-routing";
 
-const responseCredentials = new WeakMap<Response, Pick<OAuthAccessSnapshot, "accountId" | "generation">>();
+const responseCredentials = new WeakMap<Response, Pick<OAuthAccessSnapshot, "accountId" | "generation"> & { providerAccountUuid?: string; checkProviderUuid: boolean }>();
 const retryStates = new WeakMap<object, { firstAccountId: string; sameAccount: boolean; detour: boolean }>();
 const verdicts = new WeakMap<Response, Promise<boolean>>();
 
 /** Called only when the outgoing headers prove ownership of the selected stored bearer. */
-export function bindAnthropicRefusalCredential(response: Response, snapshot: OAuthAccessSnapshot): void {
-  responseCredentials.set(response, { accountId: snapshot.accountId, generation: snapshot.generation });
+export function bindAnthropicRefusalCredential(response: Response, snapshot: OAuthAccessSnapshot, providerAccountUuid?: string): void {
+  responseCredentials.set(response, { accountId: snapshot.accountId, generation: snapshot.generation, providerAccountUuid, checkProviderUuid: arguments.length >= 3 });
 }
 
 async function isAccountRefusal(response: Response, signal?: AbortSignal): Promise<boolean> {
@@ -55,6 +55,10 @@ export async function rotateAnthropicAccountOnResponse(
     requestKey?: object;
     allow429Recovery?: boolean;
     allowAccountRefusal?: boolean;
+    /** Applies to alternate ranking only; the shared same-account throttle remains allowed. */
+    excludedAccountIds?: ReadonlySet<string>;
+    /** Native dispatch re-reads operator policy after asynchronous classification/waits. */
+    currentDecision?: () => AnthropicRouteDecision | null;
   },
 ): Promise<string | null> {
   if (options.signal?.aborted || isNonReplayableResponse(response)) return null;
@@ -62,11 +66,13 @@ export async function rotateAnthropicAccountOnResponse(
     const sent = responseCredentials.get(response);
     const current = sent && getAccountCredentialWithStatus("anthropic", sent.accountId);
     if (!sent || sent.accountId !== options.accountId || !current || current.needsReauth
-      || credentialGeneration(current.credential) !== sent.generation) return null;
+      || credentialGeneration(current.credential) !== sent.generation
+      || sent.checkProviderUuid && current.credential.accountId !== sent.providerAccountUuid) return null;
+    options.currentDecision?.();
     const kind = classifyAnthropic429(response.headers);
     if (kind === "family-quota") {
       if (anthropicModelFamily(options.model) !== "Fable" || !options.canRetry || options.allow429Recovery === false) return null;
-      return pickAlternateAnthropicAccount(options.config, sent.accountId, Date.now(), options.decision ?? null, options.model);
+      return pickAlternateAnthropicAccount(options.config, sent.accountId, Date.now(), (options.currentDecision ? options.currentDecision() : options.decision ?? null), options.model, options.excludedAccountIds);
     }
     if (kind !== "shared-quota") {
       if (!isAnthropicAccountPoolEnabled(options.config) && !hasAnthropicFailoverQuorum() && !current.paused) return null;
@@ -87,16 +93,19 @@ export async function rotateAnthropicAccountOnResponse(
         const live = getAccountCredentialWithStatus("anthropic", sent.accountId);
         if (!live || live.paused || live.needsReauth || options.signal?.aborted
           || credentialGeneration(live.credential) !== sent.generation
+          || sent.checkProviderUuid && live.credential.accountId !== sent.providerAccountUuid
           || anthropicRatePauseUntil(sent.accountId, Math.max(Date.now(), retryAt))) return null;
+        options.currentDecision?.();
         return sent.accountId;
       }
       if (kind === "transient-rate" && !state.detour) {
         state.detour = true;
-        return pickAlternateAnthropicAccount(options.config, sent.accountId, Date.now(), options.decision ?? null, options.model);
+        return pickAlternateAnthropicAccount(options.config, sent.accountId, Date.now(), (options.currentDecision ? options.currentDecision() : options.decision ?? null), options.model, options.excludedAccountIds);
       }
       return null;
     }
     if (options.allow429Recovery === false) {
+      options.currentDecision?.();
       recordAnthropicAccountRefusal(options.config, options.accountId, 429, response.headers.get("retry-after"), Date.now(), response.headers);
       return null;
     }
@@ -112,8 +121,10 @@ export async function rotateAnthropicAccountOnResponse(
     if (!await verdict || options.signal?.aborted) return null;
     // A late refusal must not cool a new credential stored while its body was being read.
     const current = getAccountCredentialWithStatus("anthropic", sent.accountId);
-    if (!current || current.paused || current.needsReauth || credentialGeneration(current.credential) !== sent.generation) return null;
+    if (!current || current.paused || current.needsReauth || credentialGeneration(current.credential) !== sent.generation
+      || sent.checkProviderUuid && current.credential.accountId !== sent.providerAccountUuid) return null;
   }
+  const decision = options.currentDecision ? options.currentDecision() : options.decision;
   const status = response.status === 429 ? 429 : 403;
   if (!options.canRetry) {
     recordAnthropicAccountRefusal(options.config, options.accountId, status,
@@ -121,5 +132,5 @@ export async function rotateAnthropicAccountOnResponse(
     return null;
   }
   return rotateAnthropicAccountOnRefusal(options.config, options.accountId, status,
-    response.headers.get("retry-after"), options.sessionKey, Date.now(), response.headers, options.decision, options.model);
+    response.headers.get("retry-after"), options.sessionKey, Date.now(), response.headers, decision, options.model, options.excludedAccountIds);
 }

package/src/oauth/anthropic-continuity.ts

@@ -0,0 +1,65 @@
+import { detectClaudeCodeToken, hasClaudeCredentialContinuity } from "./local-token-detect";
+import { normalizeAnthropicIdentity, resolveAnthropicAccountIdentity, type AnthropicIdentityResolver } from "./anthropic-identity";
+import { credentialGeneration, type AuthStore } from "./store";
+import { REFRESH_SKEW_MS } from "./refresh-policy";
+import type { OAuthCredentials, ProviderAccountSet } from "./types";
+
+export type ClaudeCredentialObservation =
+  | { kind: "absent" }
+  | { kind: "unresolved" | "different"; diskGeneration: string }
+  | { kind: "adopt"; credential: OAuthCredentials; diskGeneration: string };
+
+export async function newerClaudeCredential(
+  stored: OAuthCredentials, now: number, signal?: AbortSignal,
+  resolveIdentity: AnthropicIdentityResolver = resolveAnthropicAccountIdentity,
+): Promise<ClaudeCredentialObservation> {
+  if (stored.source !== "local-cli") return { kind: "absent" };
+  const disk = detectClaudeCodeToken();
+  if (!disk || !Number.isFinite(disk.expires) || disk.expires <= now + REFRESH_SKEW_MS
+    || credentialGeneration(disk) === credentialGeneration(stored)) return { kind: "absent" };
+  const diskGeneration = credentialGeneration(disk);
+  const before = normalizeAnthropicIdentity(stored.anthropicIdentity, stored.access);
+  if (hasClaudeCredentialContinuity(stored, disk)) {
+    return { kind: "adopt", diskGeneration: credentialGeneration(disk), credential: {
+      ...stored, ...disk, anthropicIdentity: disk.access === stored.access ? before : undefined,
+    } };
+  }
+  // Independent observations share a deadline through the caller signal; neither extends the other.
+  const [oldProof, newProof] = await Promise.all([
+    before ?? resolveIdentity(stored.access, signal), resolveIdentity(disk.access, signal),
+  ]);
+  const oldIdentity = normalizeAnthropicIdentity(oldProof, stored.access);
+  const newIdentity = normalizeAnthropicIdentity(newProof, disk.access);
+  if (!oldIdentity || !newIdentity) return { kind: "unresolved", diskGeneration };
+  if (oldIdentity.accountUuid !== newIdentity.accountUuid) return { kind: "different", diskGeneration };
+  return { kind: "adopt", diskGeneration: credentialGeneration(disk), credential: {
+    ...stored, ...disk, accountId: newIdentity.accountUuid, anthropicIdentity: newIdentity,
+  } };
+}
+
+/** Capture primitives before network awaits; check them again inside the serialized writer. */
+export function captureAnthropicCredentialOwner(set: ProviderAccountSet, accountId: string) {
+  const row = set.accounts.find(account => account.id === accountId)!;
+  const loginId = row.loginId;
+  const generation = credentialGeneration(row.credential);
+  const metadata = identityMetadata(row.credential);
+  const needsReauth = row.needsReauth;
+  const selection = { id: set.activeAccountId, revision: set.selectionRevision };
+  return (store: AuthStore, diskGeneration?: string, allowPaused = false): boolean => {
+    const current = store["anthropic"];
+    const account = current?.accounts.find(candidate => candidate.id === accountId);
+    if (!account || (!allowPaused && account.paused) || account.loginId !== loginId
+      || account.needsReauth !== needsReauth || credentialGeneration(account.credential) !== generation
+      || identityMetadata(account.credential) !== metadata) return false;
+    if (diskGeneration !== undefined) {
+      if (current?.activeAccountId !== selection.id || current?.selectionRevision !== selection.revision) return false;
+      const disk = detectClaudeCodeToken();
+      if (!disk || disk.expires <= Date.now() + REFRESH_SKEW_MS || credentialGeneration(disk) !== diskGeneration) return false;
+    }
+    return true;
+  };
+}
+
+function identityMetadata(credential: OAuthCredentials): string {
+  return JSON.stringify([credential.source, credential.accountId, credential.email, credential.anthropicIdentity]);
+}

package/src/oauth/anthropic-identity.ts

@@ -0,0 +1,75 @@
+/** Private account proof from an authenticated Anthropic response, bound to its exact bearer. */
+import { hasClaudeCredentialContinuity } from "./local-token-detect";
+import { createHash } from "node:crypto";
+import { readBoundedResponseBody } from "../lib/bounded-body";
+import { CLAUDE_CLI_USER_AGENT } from "../providers/claude-cli-identity";
+import type { OAuthCredentials } from "./types";
+
+const PROFILE_URL = "https://api.anthropic.com/api/oauth/profile";
+const PROFILE_TIMEOUT_MS = 10_000;
+const PROFILE_MAX_BYTES = 65_536;
+export type AnthropicIdentity = NonNullable<OAuthCredentials["anthropicIdentity"]>;
+export type AnthropicIdentityResolver = (access: string, signal?: AbortSignal) => Promise<AnthropicIdentity | undefined>;
+
+export function bindAnthropicIdentity(access: string, accountUuid: unknown): AnthropicIdentity | undefined {
+  if (!access || typeof accountUuid !== "string" || !accountUuid.length || accountUuid.length > 128
+    || accountUuid !== accountUuid.trim() || /[\x00-\x1f\x7f]/.test(accountUuid)) return undefined;
+  return { v: 1, accountUuid, bearerSha256: createHash("sha256").update(access).digest("hex") };
+}
+
+export function normalizeAnthropicIdentity(value: unknown, access: string): AnthropicIdentity | undefined {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return undefined;
+  const proof = value as Partial<AnthropicIdentity>;
+  const bound = bindAnthropicIdentity(access, proof.accountUuid);
+  return proof.v === 1 && bound && proof.bearerSha256 === bound.bearerSha256 ? bound : undefined;
+}
+
+/** Fixed destination, no redirects, bounded body and deadline; failures never include response data. */
+export const resolveAnthropicAccountIdentity: AnthropicIdentityResolver = async (access, signal) => {
+  if (!access || signal?.aborted) return undefined;
+  const deadline = AbortSignal.timeout(PROFILE_TIMEOUT_MS);
+  const combined = signal ? AbortSignal.any([signal, deadline]) : deadline;
+  try {
+    const response = await fetch(PROFILE_URL, {
+      method: "GET", redirect: "error", signal: combined,
+      headers: { Authorization: `Bearer ${access}`, Accept: "application/json",
+        "anthropic-beta": "oauth-2025-04-20",
+        "Cache-Control": "no-cache", "User-Agent": CLAUDE_CLI_USER_AGENT },
+    });
+    if (!response.ok || response.redirected) {
+      void response.body?.cancel().catch(() => {});
+      return undefined;
+    }
+    const body = await readBoundedResponseBody(response, {
+      signal: combined, maxBytes: PROFILE_MAX_BYTES, fatalUtf8: true,
+      totalTimeoutMs: PROFILE_TIMEOUT_MS, inactivityTimeoutMs: PROFILE_TIMEOUT_MS,
+    });
+    if (body.truncated || body.oversized || body.timedOut || combined.aborted) return undefined;
+    const data: unknown = JSON.parse(body.text);
+    if (!data || typeof data !== "object" || !("account" in data)) return undefined;
+    const account = data.account;
+    return account && typeof account === "object" && "uuid" in account
+      ? bindAnthropicIdentity(access, account.uuid) : undefined;
+  } catch {
+    // Unavailable identity is an explicit unresolved result, never an ownership guess.
+    return undefined;
+  }
+};
+
+/** A changed access bearer cannot inherit the previous bearer's proof. */
+export function mergeAnthropicIdentity(fresh: OAuthCredentials, previous: OAuthCredentials): Pick<OAuthCredentials, "anthropicIdentity"> {
+  const before = normalizeAnthropicIdentity(previous.anthropicIdentity, previous.access);
+  const after = normalizeAnthropicIdentity(fresh.anthropicIdentity, fresh.access);
+  if (before && after && before.accountUuid !== after.accountUuid) {
+    throw new Error("Anthropic credential identity changed; explicit account login required");
+  }
+  return { anthropicIdentity: after ?? (fresh.access === previous.access ? before : undefined) };
+}
+
+/** Explicit imports enrich only a proven slot; labels and paths never establish ownership. */
+export function matchesAnthropicImport(stored: OAuthCredentials, imported: OAuthCredentials): boolean {
+  const before = normalizeAnthropicIdentity(stored.anthropicIdentity, stored.access);
+  const after = normalizeAnthropicIdentity(imported.anthropicIdentity, imported.access);
+  if (before && after) return before.accountUuid === after.accountUuid;
+  return hasClaudeCredentialContinuity(stored, imported);
+}

package/src/oauth/anthropic-routing.ts

@@ -18,6 +18,7 @@ import { anthropicFamilyRejected, anthropicFamilyRetryAt, anthropicModelExhauste
  * Token refresh failures retain the existing store needsReauth policy.
  */
 import { anthropicRatePauseUntil, clearAnthropicRatePauses, classifyAnthropic429, anthropicRetryAfterMs, pauseAnthropicRateAdmission } from "./anthropic-rate-limit-policy";
+import { REFRESH_SKEW_MS } from "./refresh-policy";
 import { createHash } from "node:crypto";
 import { captureOAuthAccountSelection, commitOAuthAccountSelection, credentialGeneration, getAccountSet, getAccountCredential, getAccountCredentialWithStatus } from "./store";
 import type { OAuthAccessSnapshot } from "./index";
@@ -110,6 +111,9 @@ type OAuthAccountSelection = NonNullable<ReturnType<typeof captureOAuthAccountSe
 // Undefined means this runtime has not admitted a selection yet; null means consumed.
 // The startup baseline comes from the authoritative store, never a second persisted pin.
 let manualPreference: OAuthAccountSelection | null | undefined;
+let manualSelectionGeneration = 0;
+/** Automatic pointer moves preserve affinity; manual selection revokes older bindings. */
+export function captureAnthropicManualSelectionGeneration(): number { return manualSelectionGeneration; }
 
 function normalizeAffinityComponent(value: string | null | undefined): string {
   const normalized = value?.trim() ?? "";
@@ -284,6 +288,7 @@ export function clearAnthropicAccountPoolState(): void {
   clearAnthropicCooldownGenerations();
   sessionAffinity.clear();
   manualPreference = undefined;
+  manualSelectionGeneration++;
   quorumCache = null;
 }
 
@@ -353,7 +358,6 @@ function usageScore(config: OcxConfig, accountId: string, model?: string): numbe
   }
 }
 
-const TOKEN_SKEW_MS = 60_000;
 
 /** Background `local-cli` slots with expired access are not pool-eligible (identity adoption risk). */
 function isPoolCredentialUsable(accountId: string, now: number): boolean {
@@ -361,7 +365,7 @@ function isPoolCredentialUsable(accountId: string, now: number): boolean {
   if (!cred) return false;
   if (cred.source !== "local-cli") return true;
   if (canRefreshAnthropicPoolAccount(accountId)) return true;
-  return cred.expires > now + TOKEN_SKEW_MS;
+  return cred.expires > now + REFRESH_SKEW_MS;
 }
 
 export function getEligibleAnthropicAccounts(now = Date.now(), model?: string): string[] {
@@ -508,9 +512,9 @@ function compareScoredAccounts(a: ScoredAccount, b: ScoredAccount): number {
   return a.score - b.score || a.fiveHourTieBreak - b.fiveHourTieBreak;
 }
 
-function pickLowestUsage(config: OcxConfig, excludeId: string | undefined, now: number, decision: AnthropicRouteDecision | null = null, model?: string): string | null {
+function pickLowestUsage(config: OcxConfig, excludeId: string | undefined, now: number, decision: AnthropicRouteDecision | null = null, model?: string, excludedAccountIds?: ReadonlySet<string>): string | null {
   const window = anthropicQuotaWindow(anthropicAccountPoolConfig(config));
-  const unfiltered = routeCandidates(getEligibleAnthropicAccounts(now, model), decision).filter(id => id !== excludeId);
+  const unfiltered = routeCandidates(getEligibleAnthropicAccounts(now, model), decision).filter(id => id !== excludeId && !excludedAccountIds?.has(id));
   const available = window === "weekly" ? unfiltered.filter(id => !exhausted5h(id)
     || isAnthropicAccountPoolEnabled(config) && anthropicAccountAutoSwitchThreshold(config, id) === 0) : unfiltered;
   const modelAvailable = model ? available.filter(id => !anthropicModelExhausted(id, model)) : available;
@@ -589,16 +593,17 @@ export function pickAlternateAnthropicAccount(
   now: number,
   decision: AnthropicRouteDecision | null,
   model?: string,
+  excludedAccountIds?: ReadonlySet<string>,
 ): string | null {
   const strategy = anthropicPoolStrategy(config);
-  const eligible = routeCandidates(getEligibleAnthropicAccounts(now, model), decision).filter(id => id !== excludeId);
+  const eligible = routeCandidates(getEligibleAnthropicAccounts(now, model), decision).filter(id => id !== excludeId && !excludedAccountIds?.has(id));
   if (strategy === "round-robin") {
     return peekRoundRobinAccount(POOL_KEY_ANTHROPIC, eligible, stickyLimitForPool(config));
   }
   if (strategy === "fill-first") {
     return pickNextFillFirstAnthropicAccount(config, excludeId, eligible, decision, model);
   }
-  return pickLowestUsage(config, excludeId, now, decision, model);
+  return pickLowestUsage(config, excludeId, now, decision, model, excludedAccountIds);
 }
 
 function pruneExpiredAffinity(now: number): void {
@@ -918,6 +923,7 @@ export function rotateAnthropicAccountOnRefusal(
   rateLimitHeaders?: AnthropicRateLimitHeaders | null,
   decision: AnthropicRouteDecision | null = null,
   model?: string,
+  excludedAccountIds?: ReadonlySet<string>,
 ): string | null {
   if (!recordAnthropicAccountRefusal(config, failedAccountId, status, retryAfterHeader, now, rateLimitHeaders)) return null;
 
@@ -926,8 +932,8 @@ export function rotateAnthropicAccountOnRefusal(
   // because those dormant values remain in config. The quota picker is the neutral
   // recovery policy already used by the default strategy.
   const next = isAnthropicAccountPoolEnabled(config)
-    ? pickAlternateAnthropicAccount(config, failedAccountId, now, decision, model)
-    : pickLowestUsage(config, failedAccountId, now, null, model);
+    ? pickAlternateAnthropicAccount(config, failedAccountId, now, decision, model, excludedAccountIds)
+    : pickLowestUsage(config, failedAccountId, now, null, model, excludedAccountIds);
   if (!next) {
     console.warn(`[anthropic-pool] ${decision ? `route:#${decision.position} ` : ""}no eligible replacement; returning ${status}`);
     return null;
@@ -1070,6 +1076,7 @@ export function commitAnthropicSelectionRouting(
  */
 export function resetAnthropicRoutingForManualSelection(accountId: string): void {
   sessionAffinity.clear();
+  manualSelectionGeneration++;
   manualPreference = captureOAuthAccountSelection(PROVIDER);
   seedPoolRotationAccount(POOL_KEY_ANTHROPIC, accountId);
   // A manual account selection is an operator statement about the roster; do not answer the
@@ -1093,7 +1100,7 @@ export async function getAnthropicPoolAccessToken(accountId: string): Promise<st
     const { OAuthLoginRequiredError } = await import("./index");
     throw new OAuthLoginRequiredError(PROVIDER);
   }
-  if (stored.expires > Date.now() + TOKEN_SKEW_MS) return stored.access;
+  if (stored.expires > Date.now() + REFRESH_SKEW_MS) return stored.access;
   if (!canRefreshAnthropicPoolAccount(accountId)) {
     throw new Error("background local-cli token expired; refuse CLI-adopting refresh for pool");
   }
@@ -1172,12 +1179,10 @@ export function anthropicSessionKeyFromParts(input: {
   /** When true, prompt_cache_key is a shared Desktop cohort — ignore it for affinity. */
   promptCacheKeyIsSharedCohort?: boolean;
 }): string | null {
-  const preferred = (
-    input.clientThreadId
-    ?? input.sessionIdHeader
-    ?? input.threadIdHeader
-    ?? ""
-  ).trim();
+  const preferred = input.clientThreadId?.trim()
+    || input.sessionIdHeader?.trim()
+    || input.threadIdHeader?.trim()
+    || "";
   if (preferred) {
     return preferred.length <= 128 ? preferred : createHash("sha256").update(preferred).digest("hex");
   }

package/src/oauth/anthropic.ts

@@ -1,7 +1,9 @@
 /** Anthropic OAuth flow (Claude Pro/Max). Ported from jawcode oauth/anthropic.ts. */
 import { OAuthCallbackFlow } from "./callback-server";
+import { bindAnthropicIdentity, resolveAnthropicAccountIdentity } from "./anthropic-identity";
 import { generatePKCE } from "./pkce";
 import type { LocalTokenImportMode, OAuthController, OAuthCredentials } from "./types";
+import { outboundProxyConfigured, startupOutboundProxyConfigured } from "../lib/proxy-env";
 
 const CLIENT_ID = atob("OWQxYzI1MGEtZTYxYi00NGQ5LTg4ZWQtNTk0NGQxOTYyZjVl");
 const AUTHORIZE_URL = "https://claude.ai/oauth/authorize";
@@ -39,6 +41,7 @@ export class AnthropicTokenError extends Error {
     message: string,
     readonly httpStatus: number | undefined,
     readonly oauthError: string | undefined,
+    readonly requestNotSent = false,
   ) {
     super(message);
     this.name = "AnthropicTokenError";
@@ -46,12 +49,35 @@ export class AnthropicTokenError extends Error {
 }
 
 async function postJson(url: string, body: Record<string, string | number>): Promise<string> {
-  const response = await fetch(url, {
+  const direct = !startupOutboundProxyConfigured && !outboundProxyConfigured();
+  const init: RequestInit & { protocol: "http1.1" } = {
     method: "POST",
     headers: { "Content-Type": "application/json", Accept: "application/json" },
     body: JSON.stringify(body),
     signal: AbortSignal.timeout(30_000),
-  });
+    // Pinned Bun 1.4.0: one HTTP/1.1 attempt, no keep-alive reuse or redirect following.
+    // Only without an outbound proxy can token-host DNS failure prove no request was sent.
+    redirect: "manual",
+    keepalive: false,
+    protocol: "http1.1",
+  };
+  let response: Response;
+  try {
+    response = await fetch(url, init);
+  } catch (error) {
+    if (direct && typeof error === "object" && error !== null
+      && "code" in error && error.code === "ENOTFOUND"
+      && "syscall" in error && error.syscall === "getaddrinfo"
+      && "hostname" in error && error.hostname === new URL(url).hostname) {
+      throw new AnthropicTokenError("Anthropic OAuth DNS lookup failed before connection", undefined, undefined, true);
+    }
+    throw error;
+  }
+  if (response.status >= 300 && response.status < 400) {
+    // A redirect can follow a completed POST and token rotation; it is not a rejection.
+    await response.body?.cancel().catch(() => {});
+    throw new AnthropicTokenError(`Anthropic OAuth redirect HTTP ${response.status}: outcome unknown`, undefined, undefined);
+  }
   const responseBody = await response.text();
   if (!response.ok) {
     let oauthError: string | undefined;
@@ -96,6 +122,7 @@ function credsFrom(data: AnthropicTokenResponse, refreshFallback?: string): OAut
     refresh: data.refresh_token || refreshFallback || "",
     access: data.access_token,
     expires,
+    anthropicIdentity: bindAnthropicIdentity(data.access_token, accountUuid),
     accountId: typeof accountUuid === "string" && accountUuid.length > 0 ? accountUuid : undefined,
     email: typeof email === "string" && email.length > 0 ? email : undefined,
   };
@@ -159,7 +186,11 @@ export async function loginAnthropic(
     const local = detectClaudeCodeToken();
     if (local) {
       ctrl.onProgress?.("Found Claude Code token, importing automatically");
-      if (local.expires >= Date.now() + 60_000) return local;
+      if (local.expires >= Date.now() + 60_000) {
+        const identity = await resolveAnthropicAccountIdentity(local.access, ctrl.signal);
+        ctrl.signal?.throwIfAborted();
+        return { ...local, ...(identity ? { accountId: identity.accountUuid, anthropicIdentity: identity } : {}) };
+      }
       try {
         return { ...(await refreshAnthropicToken(local.refresh)), source: "local-cli" };
       } catch (error) {

package/src/oauth/generic-account-failover.ts

@@ -734,3 +734,24 @@ export function clearGenericFailoverHealth(providerName?: string): void {
     if (key.startsWith(`${providerName}\u0000`)) health.delete(key);
   }
 }
+
+/**
+ * Retire one account's superseded auth evidence after an explicit (re-)login. An
+ * auth cooldown recorded against the old grant must not hold out the fresh
+ * credential, so it leaves with the login rather than lingering until its
+ * deadline. Rate, quota, and suspension evidence is preserved: a re-login says
+ * nothing about those verdicts, and dropping them would make a throttled account
+ * eligible early. Entries bound to the still-current generation stay as well.
+ */
+export function clearGenericFailoverHealthForAccount(providerName: string, accountId: string): void {
+  const live = getAccountSet(providerName)?.accounts.find(row => row.id === accountId);
+  const current = live ? credentialGeneration(live.credential) : undefined;
+  const bare = `${providerName}\u0000${accountId}`;
+  for (const key of [...health.keys()]) {
+    if (key !== bare && !key.startsWith(`${bare}\u0000`)) continue;
+    const entry = health.get(key);
+    if (!entry || entry.cooldownSource !== "auth") continue;
+    if (current !== undefined && entry.identity === current) continue;
+    health.delete(key);
+  }
+}