@bitkyc08/opencodex 2.76.0 → 2.78.0-preview.20261005

package/src/oauth/health.ts

@@ -14,6 +14,22 @@ import { loadAuthStore, peekAuthStore, peekOAuthRefreshIntent, readOAuthRefreshI
 import type { ProviderAccount } from "./types";
 
 export type OAuthAccountHealth =
+  | { status: "healthy" }
+  | { status: "cooldown"; until: string; reason: "rate_limit" | "quota" }
+  | { status: "reauth_required"; reason: OAuthReauthReason }
+  | { status: "warning"; reason: "refresh_conflict" | "metadata_mismatch" | "stale_credentials" | "validation_pending" };
+
+/** Why an OAuth account needs reauthentication. `verify_account` is distinct from a dead
+ * credential: the grant is alive but the provider blocks the account until a human
+ * verifies it, so a plain re-login without that verification will not help. */
+export type OAuthReauthReason = "unauthorized" | "forbidden" | "refresh_failed" | "verify_account";
+
+/**
+ * Codex-pool health: the same shape minus the provider-verification cause, which only
+ * the generic OAuth quarantine produces. Narrowing the return keeps Codex DTOs on
+ * `CodexAccountReauthReason` without a lossy re-narrow at every consumer.
+ */
+export type CodexPoolAccountHealth =
   | { status: "healthy" }
   | { status: "cooldown"; until: string; reason: "rate_limit" | "quota" }
   | { status: "reauth_required"; reason: "unauthorized" | "forbidden" | "refresh_failed" }
@@ -24,6 +40,7 @@ export type OAuthHealthLabel =
   | "Rate limited"
   | "Quota limited"
   | "Reauthentication required"
+  | "Verification required"
   | "Refresh failed"
   | "Metadata mismatch"
   | "Credential conflict"
@@ -60,7 +77,7 @@ type OAuthWarningReason = "refresh_conflict" | "metadata_mismatch" | "stale_cred
 
 export function projectOAuthAccountHealth(input: {
   needsReauth?: boolean;
-  reauthReason?: "unauthorized" | "forbidden" | "refresh_failed";
+  reauthReason?: OAuthReauthReason;
   cooldownUntilMs?: number;
   cooldownReason?: "rate_limit" | "quota";
   warningReason?: OAuthWarningReason;
@@ -96,6 +113,9 @@ function actionFor(provider: string, health: OAuthAccountHealth): string | undef
   }
   if (health.status === "reauth_required") {
     if (provider === "codex") return CODEX_REAUTH_ACTION;
+    if (health.reason === "verify_account") {
+      return `verify the account with the provider in a browser, then run \`ocx login ${provider}\``;
+    }
     return `run \`ocx login ${provider}\``;
   }
   if (health.status === "cooldown") {
@@ -115,7 +135,9 @@ export function oauthHealthLabel(health: OAuthAccountHealth): OAuthHealthLabel {
     case "cooldown":
       return health.reason === "rate_limit" ? "Rate limited" : "Quota limited";
     case "reauth_required":
-      return health.reason === "refresh_failed" ? "Refresh failed" : "Reauthentication required";
+      if (health.reason === "refresh_failed") return "Refresh failed";
+      if (health.reason === "verify_account") return "Verification required";
+      return "Reauthentication required";
     case "warning":
       switch (health.reason) {
         case "validation_pending":
@@ -190,7 +212,9 @@ export function projectStoredOAuthAccountHealth(
     : null;
   return projectOAuthAccountHealth({
     needsReauth: account.needsReauth === true,
-    reauthReason: account.needsReauth === true ? "refresh_failed" : undefined,
+    reauthReason: account.needsReauth === true
+      ? (account.needsReauthReason ?? "refresh_failed")
+      : undefined,
     cooldownUntilMs: anthropicSnap?.cooldownUntil,
     // Same mapping as the Codex pool's `cooldownReasonFromSource`: only a Retry-After is
     // request-rate throttling. A reset-derived cooldown means a usage window is spent, which
@@ -206,7 +230,7 @@ export function projectCodexAccountHealth(input: {
   needsReauth: boolean;
   reauthReason?: "unauthorized" | "forbidden" | "refresh_failed";
   now?: number;
-}): OAuthAccountHealth {
+}): CodexPoolAccountHealth {
   // One read serves every verdict below. Each lookup re-reads and re-hardens the whole store
   // file, and the main account lives in the native Codex auth file rather than the pool store,
   // so a lookup for it could only ever miss.
@@ -250,13 +274,16 @@ export function projectCodexAccountHealth(input: {
   }
   const now = input.now ?? Date.now();
   const snap = getCodexAccountHealthSnapshot(input.accountId, now);
+  // Safe narrowing: every reason above is Codex-scoped (`verify_account` only enters
+  // through the generic OAuth quarantine path), so the shared projector cannot
+  // produce it here despite the wider return type.
   return projectOAuthAccountHealth({
     needsReauth,
     reauthReason: needsReauth ? (input.reauthReason ?? storedFailureReason ?? "refresh_failed") : undefined,
     cooldownUntilMs: snap?.cooldownUntil,
     cooldownReason: cooldownReasonFromSource(snap?.cooldownSource),
     now,
-  });
+  }) as CodexPoolAccountHealth;
 }
 
 /**

package/src/oauth/index.ts

@@ -52,7 +52,7 @@ import { apiKeyPoolEntryId, sanitizeApiKeyValue } from "../providers/api-keys";
 import { effectiveGoogleMode, getProviderRegistryEntry, mergeRegistryStaticHeaders, providerMatchesRegistryTransport } from "../providers/registry";
 import { providerModelsUrl, resolveProviderModelDiscoveryUrl } from "../providers/model-discovery";
 import { resolveProviderTransport } from "../providers/xai-transport";
-import { detectClaudeCodeToken, detectGrokCliToken, hasComparableGrokIdentity, isSameGrokIdentity, shouldAdoptGrokGeneration } from "./local-token-detect";
+import { detectGrokCliToken, hasComparableGrokIdentity, isSameGrokIdentity, shouldAdoptGrokGeneration } from "./local-token-detect";
 import { logOAuthEvent } from "./log";
 import { captureConfigGeneration, sweepExpiredOnWrite } from "../lib/state-store-sweeper";
 import { clearManualCodeSlot, ensureManualCodeSlot, kiroLoginSettling, loginAbort, loginState, waitForManualLoginCode, type OAuthLoginHint } from "./login-flow-state";
@@ -82,7 +82,9 @@ export {
 export { OAUTH_REFRESH_LOCK_WAIT_MS, peekAuthStore, peekOAuthRefreshIntent } from "./store";
 import { codexAccountNamespaceProviderCollisionError } from "../codex/account-namespace-match";
 
-const REFRESH_SKEW_MS = 60_000;
+import { REFRESH_SKEW_MS } from "./refresh-policy";
+import { newerClaudeCredential, captureAnthropicCredentialOwner } from "./anthropic-continuity";
+import { mergeAnthropicIdentity, type AnthropicIdentityResolver } from "./anthropic-identity";
 export interface OAuthAccessSnapshot {
   provider: string;
   accountId: string;
@@ -169,7 +171,7 @@ export function seedOAuthTokenRefreshFlightsForTests(rows: Array<{ key: string;
 const XAI_PERMANENT_FAILURE_TTL_MS=30_000;
 const permanentRefreshFailures=new Map<string,number>();
 interface XaiRefreshDeps { intentLock?:ReturnType<typeof createOAuthRefreshIntentLock>; now?:()=>number; afterPrePersistRead?:()=>void|Promise<void>; signal?: AbortSignal }
-interface AnthropicRefreshDeps { intentLock?:ReturnType<typeof createOAuthRefreshIntentLock>; now?:()=>number; afterPrePersistRead?:()=>void|Promise<void>; signal?: AbortSignal; flight?: OAuthRefreshFlightEvidence; replacedStaleFlight?: OAuthRefreshFlightEvidence }
+interface AnthropicRefreshDeps { resolveIdentity?: AnthropicIdentityResolver; intentLock?:ReturnType<typeof createOAuthRefreshIntentLock>; now?:()=>number; afterPrePersistRead?:()=>void|Promise<void>; signal?: AbortSignal; flight?: OAuthRefreshFlightEvidence; replacedStaleFlight?: OAuthRefreshFlightEvidence }
 interface GenericRefreshDeps { intentLock?:ReturnType<typeof createOAuthRefreshIntentLock>; afterPrePersistRead?:()=>void|Promise<void>; signal?: AbortSignal }
 function verdictKey(p:string,a:string,c:OAuthCredentials){return `${p}\0${a}\0${credentialGeneration(c)}`;}
 function cached(p:string,a:string,c:OAuthCredentials,now:()=>number){const k=verdictKey(p,a,c),u=permanentRefreshFailures.get(k);if(u===undefined)return false;if(u<=now()){permanentRefreshFailures.delete(k);return false;}return true;}
@@ -866,6 +868,7 @@ function authoritative(stored:OAuthCredentials,active:boolean,now:()=>number):OA
 function merged(fresh: OAuthCredentials, previous: OAuthCredentials): OAuthCredentials {
   return {
     ...fresh,
+    ...mergeAnthropicIdentity(fresh, previous),
     // Shared: a refresh function returns "local-cli" only when the credential it hands back
     // still is the local CLI's (Devin re-reading the CLI file, Meta Muse echoing its durable
     // CLI key). Relabelling that "oauth" would stop the next forced refresh from re-reading it.
@@ -880,12 +883,6 @@ function merged(fresh: OAuthCredentials, previous: OAuthCredentials): OAuthCrede
 }
 export async function refreshXaiAccountWithLock(provider:string,accountId:string,def:OAuthProviderDef,callerCredential:OAuthCredentials,deps:XaiRefreshDeps={}):Promise<string>{const writerGeneration=captureConfigGeneration();const now=deps.now??Date.now;const guard=await(deps.intentLock??createOAuthRefreshIntentLock(provider,accountId)).acquire();try{const row=getAccountCredentialWithStatus(provider,accountId);if(!row)throw new OAuthLoginRequiredError(provider);if(row.paused)throw new OAuthAccountPausedError();const stored=row.credential;const active=getAccountSet(provider)?.activeAccountId===accountId,candidate=authoritative(stored,active,now);if(credentialGeneration(candidate)!==credentialGeneration(callerCredential)&&candidate.expires>now()+REFRESH_SKEW_MS){if(credentialGeneration(candidate)!==credentialGeneration(stored)){const o=await mergeAccountCredential(provider,accountId,candidate,{expectedGeneration:credentialGeneration(stored),afterPrePersistRead:deps.afterPrePersistRead});if(o.superseded){if(o.stored.expires>now()+REFRESH_SKEW_MS)return o.stored.access;throw new OAuthLoginRequiredError(provider);}}return candidate.access;}if(cached(provider,accountId,candidate,now))throw new OAuthLoginRequiredError(provider);const generation=credentialGeneration(candidate);try{const fresh=merged(await def.refresh(candidate.refresh,deps.signal),candidate);const o=await mergeAccountCredential(provider,accountId,fresh,{expectedGeneration:generation,afterPrePersistRead:deps.afterPrePersistRead});if(o.superseded){if(o.stored.expires>now()+REFRESH_SKEW_MS)return o.stored.access;throw new OAuthLoginRequiredError(provider);}permanentRefreshFailures.delete(verdictKey(provider,accountId,candidate));if(candidate.source==="local-cli")console.warn(XAI_LOCAL_CLI_DETACH_WARNING);return fresh.access;}catch(error){if(error instanceof OAuthMutationBusyError){permanentRefreshFailures.delete(verdictKey(provider,accountId,candidate));throw error;}if(!terminal(error))throw error;const failedAt=now();permanentRefreshFailures.set(verdictKey(provider,accountId,candidate),failedAt+XAI_PERMANENT_FAILURE_TTL_MS);sweepExpiredOnWrite(failedAt);await markAccountNeedsReauthIfGeneration(provider,accountId,generation,writerGeneration);throw new OAuthLoginRequiredError(provider);}}finally{guard.release();}}
 
-function newerClaudeCredential(stored: OAuthCredentials, now: number): OAuthCredentials | undefined {
-  if (stored.source !== "local-cli") return undefined;
-  const disk = detectClaudeCodeToken();
-  if (!disk || disk.expires <= now + REFRESH_SKEW_MS) return undefined;
-  return credentialGeneration(disk) !== credentialGeneration(stored) ? disk : undefined;
-}
 
 /**
  * Preserve an already-rotated Nous refresh token (RT-B) after a terminal refresh
@@ -939,33 +936,42 @@ export async function refreshAnthropicAccountWithLock(
   const now = deps.now ?? Date.now;
   const guard = await (deps.intentLock ?? createOAuthRefreshIntentLock(provider, accountId)).acquire();
   try {
-    const row = getAccountCredentialWithStatus(provider, accountId);
-    if (!row) throw new OAuthLoginRequiredError(provider);
-    if (row.paused) throw new OAuthAccountPausedError();
-    const stored = row.credential;
-    const account = getAccountSet(provider)?.accounts.find(candidate => candidate.id === accountId);
+    const accountSet = getAccountSet(provider);
+    const account = accountSet?.accounts.find(candidate => candidate.id === accountId);
+    if (!accountSet || !account) throw new OAuthLoginRequiredError(provider);
+    if (account.paused) throw new OAuthAccountPausedError();
+    const stored = account.credential;
+    const owns = captureAnthropicCredentialOwner(accountSet, accountId);
     const generation = credentialGeneration(stored);
     let pendingIntent = readOAuthRefreshIntent(provider, accountId);
-    const disk = newerClaudeCredential(stored, now());
-    if (disk) {
-      const outcome = await mergeAccountCredential(provider, accountId, disk, {
-        expectedGeneration: credentialGeneration(stored),
+    const observed = await newerClaudeCredential(stored, now(), deps.signal, deps.resolveIdentity);
+    const assertOwner = (store: AuthStore, checkDisk = true) => {
+      if (observed.kind !== "absent" && deps.signal?.aborted) throw new OAuthTokenRefreshStaleError();
+      if (!owns(store, checkDisk && observed.kind !== "absent" ? observed.diskGeneration : undefined)) {
+        if (store[provider]?.accounts.find(a => a.id === accountId)?.paused) throw new OAuthAccountPausedError();
+        throw new OAuthTokenRefreshStaleError();
+      }
+    };
+    assertOwner({ [provider]: getAccountSet(provider)! }, observed.kind !== "adopt");
+    if (observed.kind === "adopt") {
+      const outcome = await mergeAccountCredential(provider, accountId, observed.credential, {
+        expectedGeneration: generation,
         afterPrePersistRead: deps.afterPrePersistRead,
+        assertOwnership: assertOwner,
       });
-      if (outcome.superseded) {
-        // The disk credential is already durable here, so cleanup is secondary: an unlink
-        // failure must not mask a committed credential by throwing over the return below.
-        if (pendingIntent) clearAnthropicRefreshIntentBestEffort(provider, accountId, pendingIntent);
-        if (outcome.stored.expires > now() + REFRESH_SKEW_MS) return outcome.stored.access;
-        throw new OAuthLoginRequiredError(provider);
-      }
+      // A superseding write did not adopt our candidate. Its pending intent remains owned by it.
+      if (outcome.superseded) throw new OAuthTokenRefreshStaleError();
       if (pendingIntent) clearAnthropicRefreshIntentBestEffort(provider, accountId, pendingIntent);
-      return disk.access;
+      return observed.credential.access;
     }
+    // Unknown rotation may have consumed this refresh token. Refuse without replay or changing health.
+    if (observed.kind === "unresolved") throw new OAuthLoginRequiredError(provider);
     if (pendingIntent?.cleanupPending && pendingIntent.generation === generation) {
       resumeAnthropicRefreshIntentCleanup(provider, accountId, pendingIntent);
       pendingIntent = undefined;
     }
+    if (observed.kind === "different"
+      && (pendingIntent?.uncertain || pendingIntent?.generation === generation)) throw new OAuthLoginRequiredError(provider);
     if (!pendingIntent?.uncertain && pendingIntent?.generation === generation) {
       if (pendingIntent.staleOwner) throw new OAuthTokenRefreshStaleError();
       if (deps.replacedStaleFlight && pendingIntent.flightId === deps.replacedStaleFlight.flightId) {
@@ -1007,6 +1013,7 @@ export async function refreshAnthropicAccountWithLock(
       const outcome = await mergeAccountCredential(provider, accountId, fresh, {
         expectedGeneration: generation,
         afterPrePersistRead: deps.afterPrePersistRead,
+        assertOwnership: store => { if (!owns(store, undefined, true)) throw new OAuthTokenRefreshStaleError(); },
       });
       if (outcome.superseded) {
         if (attemptIntent) clearAnthropicRefreshIntentBestEffort(provider, accountId, attemptIntent);
@@ -1025,18 +1032,16 @@ export async function refreshAnthropicAccountWithLock(
         // OAuthLoginRequiredError. One 503 locked the account out of refresh until manual
         // re-auth even after upstream recovered.
         //
-        // Only clear the intent when the server DEFINITIVELY answered and rejected the
-        // request. The adapter attaches an HTTP status only to that explicit non-success
-        // response. A timeout, a dropped connection, or an unreadable/unparseable body
-        // carries no status: the server may already have
-        // rotated the token, and replaying it could trip refresh-token-reuse revocation.
-        // Those outcomes keep the intent so the guard still refuses a blind replay.
-        if ((!refreshMayHaveReachedProvider || definitivelyAnswered(error)) && attemptIntent) {
+        // Clear only for proven pre-dispatch failure or an explicit HTTP rejection.
+        // Other transport/body failures may follow rotation and keep the replay guard.
+        const requestNotSent = !refreshMayHaveReachedProvider
+          || (error instanceof AnthropicTokenError && error.requestNotSent);
+        if ((requestNotSent || definitivelyAnswered(error)) && attemptIntent) {
           await clearAnthropicRefreshIntentForKnownFailure(
             provider,
             accountId,
             attemptIntent,
-            refreshMayHaveReachedProvider ? "definitive-rejection" : "pre-dispatch",
+            requestNotSent ? "pre-dispatch" : "definitive-rejection",
             error,
           );
         }
@@ -1717,7 +1722,7 @@ export async function runLogin(
       });
     } else {
       const saveOptions = {
-        preserveIdentityless: opts?.forceLogin === true,
+        preserveIdentityless: opts?.forceLogin === true || (provider === "anthropic" && cred.source === "local-cli"),
         assertBeforePersist: deps.assertCurrentOwner,
       };
       if (shouldRollbackKiroAccounts && !deps.saveCredential) {
@@ -1799,6 +1804,7 @@ export interface OAuthAccountSummary {
   email?: string;
   active: boolean;
   needsReauth?: boolean;
+  needsReauthReason?: "verify_account";
   expiresAt?: number;
   /**
    * Subscription tier, mirroring the field the OpenAI/Codex provider reports, so a consumer
@@ -1835,6 +1841,7 @@ export function getLoginStatus(provider: string, maskEmails = true): { loggedIn:
     email: projectEmail(a.credential.email, maskEmails) ?? undefined,
     active: a.id === set.activeAccountId,
     ...(a.needsReauth ? { needsReauth: true } : {}),
+    ...(a.needsReauth && a.needsReauthReason === "verify_account" ? { needsReauthReason: a.needsReauthReason } : {}),
     expiresAt: a.credential.expires,
     // Explicitly null rather than omitted — see OAuthAccountSummary.plan. No OAuth provider
     // exposes a subscription tier today, so there is nothing truthful to put here; deriving one

package/src/oauth/local-token-detect.ts

@@ -128,3 +128,10 @@ export function detectClaudeCodeToken(): OAuthCredentials | null {
   if (!raw) return null;
   return parseClaudeOauthPayload(raw);
 }
+
+/** Shared-token continuity for opaque Claude tokens; fully rotated pairs need authenticated account proof. */
+export function hasClaudeCredentialContinuity(stored: OAuthCredentials, disk: OAuthCredentials): boolean {
+  const sameToken = (left: string, right: string): boolean =>
+    typeof left === "string" && left.trim().length > 0 && left === right;
+  return sameToken(stored.refresh, disk.refresh) || sameToken(stored.access, disk.access);
+}

package/src/oauth/pool-settings-capability.ts

@@ -50,7 +50,7 @@ export function parseGenericStickyLimit(value: unknown): number | null {
 
 /** Fields the unified pool-settings contract can carry, per kind. */
 export const POOL_SETTINGS_FIELDS = [
-  "enabled", "strategy", "stickyLimit", "autoSwitchThreshold", "quotaWindow", "maxConcurrentPerAccount", "routes",
+  "enabled", "strategy", "stickyLimit", "autoSwitchThreshold", "quotaWindow", "maxConcurrentPerAccount", "routes", "nativeMessages",
 ] as const;
 export type PoolSettingsField = typeof POOL_SETTINGS_FIELDS[number];
 
@@ -84,8 +84,12 @@ export interface PoolSettingsDto {
   quotaWindow: string | null;
   maxConcurrentPerAccount: number | null;
   routes: AnthropicModelRoute[] | null;
+  /** Anthropic preference, default true; null for unsupported pool kinds. */
+  nativeMessages: boolean | null;
   /** Present only when stored Anthropic routes fail validation on read. */
   routesError?: string;
+  /** Saved state confirmed despite a post-publication failure. */
+  warning?: "config_bookkeeping_failed";
 }
 
 
@@ -134,7 +138,7 @@ export function genericPoolSettingsDto(
 /** Which fields each kind actually honours. Declared, never silently omitted. */
 const SUPPORTED_BY_KIND: Record<PoolSettingsKind, PoolSettingsField[]> = {
   codex: ["strategy", "stickyLimit", "autoSwitchThreshold"],
-  anthropic: ["enabled", "strategy", "stickyLimit", "autoSwitchThreshold", "quotaWindow", "routes"],
+  anthropic: ["enabled", "strategy", "stickyLimit", "autoSwitchThreshold", "quotaWindow", "routes", "nativeMessages"],
   generic: ["enabled", "strategy", "stickyLimit", "autoSwitchThreshold"],
 };
 
@@ -165,6 +169,7 @@ export function unifiedPoolSettingsDto(
       quotaWindow: null,
       maxConcurrentPerAccount: null,
       routes: null,
+      nativeMessages: null,
     };
   }
   if (kind === "anthropic") {
@@ -174,6 +179,7 @@ export function unifiedPoolSettingsDto(
       ...base,
       enabled,
       enabledEffective: enabled === true,
+      nativeMessages: !Object.hasOwn(pool, "nativeMessages") || pool.nativeMessages === true,
       strategy: parseGenericPoolStrategy(pool.strategy) ?? "quota",
       stickyLimit: parseGenericStickyLimit(pool.stickyLimit) ?? 1,
       autoSwitchThreshold: parseGenericAutoSwitchThreshold(pool.autoSwitchThreshold) ?? 80,
@@ -198,5 +204,6 @@ export function unifiedPoolSettingsDto(
     quotaWindow: null,
     maxConcurrentPerAccount: provider === "kiro" ? parseKiroAccountCap(failover.maxConcurrentPerAccount) : null,
     routes: null,
+    nativeMessages: null,
   };
 }

package/src/oauth/refresh-policy.ts

@@ -0,0 +1,2 @@
+/** Refresh early enough to avoid dispatching a bearer that expires in flight. */
+export const REFRESH_SKEW_MS = 60_000;

package/src/oauth/store.ts

@@ -19,6 +19,7 @@
  *   distinct one. Kimi extracts JWT `user_id`/`sub` as accountId; Cursor extracts JWT `sub` —
  *   both append distinct identified accounts under multiauth.
  */
+import { normalizeAnthropicIdentity, matchesAnthropicImport, mergeAnthropicIdentity } from "./anthropic-identity";
 import { createHash, randomUUID } from "node:crypto";
 import { chmodSync, closeSync, constants as fsConstants, copyFileSync, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
@@ -34,6 +35,7 @@ import {
 } from "../lib/state-store-sweeper";
 import { validateCopilotApiBaseUrl } from "./github-copilot";
 import { validateDevinApiBaseUrl } from "./devin/api-base";
+import { REFRESH_SKEW_MS } from "./refresh-policy";
 import { parseAnthropicAccountThreshold } from "./anthropic-account-threshold";
 import type { OAuthAccountSelection, OAuthCredentialSource, OAuthCredentials, ProviderAccount, ProviderAccountSet } from "./types";
 
@@ -531,6 +533,8 @@ function normalizeCredential(cred: unknown): OAuthCredentials | null {
   };
   if (typeof candidate.email === "string" && candidate.email.length > 0) normalized.email = candidate.email;
   if (typeof candidate.accountId === "string" && candidate.accountId.length > 0) normalized.accountId = candidate.accountId;
+  const identity = normalizeAnthropicIdentity(candidate.anthropicIdentity, candidate.access);
+  if (identity) normalized.anthropicIdentity = identity;
   if (isCredentialSource(candidate.source)) normalized.source = candidate.source;
   if (typeof candidate.projectId === "string" && candidate.projectId.length > 0) normalized.projectId = candidate.projectId;
   if (typeof candidate.apiBaseUrl === "string" && candidate.apiBaseUrl.length > 0) {
@@ -629,6 +633,9 @@ function normalizeAccount(value: unknown): ProviderAccount | null {
   if (candidate.paused === true) account.paused = true;
   const threshold = parseAnthropicAccountThreshold(candidate.autoSwitchThresholdOverride);
   if (threshold !== null) account.autoSwitchThresholdOverride = threshold;
+  if (candidate.needsReauth === true && candidate.needsReauthReason === "verify_account") {
+    account.needsReauthReason = "verify_account";
+  }
   if (typeof candidate.addedAt === "number") account.addedAt = candidate.addedAt;
   if (typeof candidate.loginId === "string"
     && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(candidate.loginId)) {
@@ -862,9 +869,10 @@ export async function saveCredentialWithReceipt(
 ): Promise<OAuthCredentialWriteReceipt | null> {
   const safe = normalizeCredential(cred);
   if (!safe) return null;
-  return await mutateStore(store => {
+  const receipt = await mutateStore(store => {
     const set = store[provider];
     const previousActiveAccountId = set?.activeAccountId;
+    const previousSelectionRevision = set?.selectionRevision;
     const previousAccounts = new Map(
       set?.accounts.map(account => [account.id, structuredClone(account)]) ?? [],
     );
@@ -876,11 +884,27 @@ export async function saveCredentialWithReceipt(
       const id = newAccountId(safe);
       store[provider] = { activeAccountId: id, accounts: [{ id, credential: safe, addedAt: Date.now() }] };
       accountId = id;
+    } else if (provider === "anthropic" && safe.source === "local-cli") {
+      const existing = set.accounts.find(a => matchesAnthropicImport(a.credential, safe));
+      if (existing) {
+        existing.credential = { ...safe, ...mergeAnthropicIdentity(safe, existing.credential),
+          accountId: safe.accountId ?? existing.credential.accountId, email: safe.email ?? existing.credential.email };
+        set.selectionRevision = previousSelectionRevision;
+        delete existing.needsReauth;
+        delete existing.needsReauthReason;
+        accountId = existing.id;
+      } else {
+        const id = distinctAccountId(safe, set.accounts);
+        set.accounts.push({ id, credential: safe, addedAt: Date.now() });
+        set.activeAccountId = id;
+        accountId = id;
+      }
     } else if (identity) {
       const existing = set.accounts.find(a => (a.credential.accountId ?? a.credential.email) === identity);
       if (existing) {
         existing.credential = safe;
         delete existing.needsReauth;
+        delete existing.needsReauthReason;
         if (existing.paused !== true) set.activeAccountId = existing.id;
         accountId = existing.id;
       } else {
@@ -892,6 +916,7 @@ export async function saveCredentialWithReceipt(
         if (!opts.preserveIdentityless && active && active.credential.accountId === undefined && active.credential.email === undefined) {
           active.credential = safe;
           delete active.needsReauth;
+          delete active.needsReauthReason;
           accountId = active.id;
         } else {
           const id = distinctAccountId(safe, set.accounts);
@@ -911,6 +936,7 @@ export async function saveCredentialWithReceipt(
       if (active) {
         active.credential = safe;
         delete active.needsReauth;
+        delete active.needsReauthReason;
         accountId = active.id;
       } else {
         const id = distinctAccountId(safe, set.accounts);
@@ -944,6 +970,18 @@ export async function saveCredentialWithReceipt(
       receipt.selectionRevision = store[provider]?.selectionRevision;
     },
   });
+  // An explicit login retires that account's failover evidence: a cooldown recorded
+  // against the old grant must not hold out the fresh credential. Dynamic import
+  // keeps the store free of a static edge into the failover module, which reads the
+  // store itself.
+  try {
+    const { clearGenericFailoverHealthForAccount } = await import("./generic-account-failover");
+    clearGenericFailoverHealthForAccount(provider, receipt.accountId);
+  } catch {
+    // The credential write has already committed. A cleanup failure must not
+    // surface as a failed login, or the Kiro path rolls the new grant back.
+  }
+  return receipt;
 }
 
 /** Ordinary callers do not acquire rollback authority merely by saving a credential. */
@@ -1047,6 +1085,7 @@ export async function upsertCredentialByIdentity(
     if (existing && set) {
       existing.credential = safe;
       delete existing.needsReauth;
+      delete existing.needsReauthReason;
       set.activeAccountId ??= existing.id;
       return "updated";
     }
@@ -1149,6 +1188,7 @@ export async function saveAccountCredential(
     account.credential = safe;
     if (opts.rotateLoginId) account.loginId = randomUUID();
     delete account.needsReauth;
+    delete account.needsReauthReason;
     // A pause that found no usable fallback leaves the active id on a paused row. Once this
     // reauthentication makes an unpaused account usable, hand the selection to it.
     const active = set.accounts.find(a => a.id === set.activeAccountId);
@@ -1288,7 +1328,9 @@ export async function setAccountPaused(
     if (paused && set.activeAccountId === accountId) {
       const start = set.accounts.findIndex(candidate => candidate.id === accountId);
       const ring = [...set.accounts.slice(start + 1), ...set.accounts.slice(0, start)];
-      const fallback = ring.find(candidate => candidate.paused !== true && candidate.needsReauth !== true);
+      const fallback = ring.find(candidate => candidate.paused !== true && candidate.needsReauth !== true
+        && !(provider === "anthropic" && candidate.credential.source === "local-cli"
+          && candidate.credential.expires <= Date.now() + REFRESH_SKEW_MS));
       if (fallback) {
         set.activeAccountId = fallback.id;
         set.selectionRevision = randomUUID();
@@ -1363,6 +1405,7 @@ export async function replaceProviderAccountSet(
         ...(account.needsReauth ? { needsReauth: true } : {}),
         ...(account.paused ? { paused: true } : {}),
         ...(account.autoSwitchThresholdOverride !== undefined ? { autoSwitchThresholdOverride: account.autoSwitchThresholdOverride } : {}),
+        ...(account.needsReauthReason === "verify_account" ? { needsReauthReason: account.needsReauthReason } : {}),
         ...(account.addedAt !== undefined ? { addedAt: account.addedAt } : {}),
         ...(account.loginId ? { loginId: account.loginId } : {}),
       })),
@@ -1408,18 +1451,24 @@ export async function markAccountNeedsReauth(
   provider: string,
   accountId: string,
   needsReauth: boolean,
+  reason?: "verify_account",
   writerGeneration = captureConfigGeneration(),
 ): Promise<void> {
   if (writerGeneration < lastReconciledGeneration && !liveOAuthAccountKeys.has(oauthAccountKey(provider, accountId))) return;
   await mutateStore(store => {
     const account = store[provider]?.accounts.find(a => a.id === accountId);
     if (!account) return;
-    if (needsReauth) account.needsReauth = true;
-    else delete account.needsReauth;
+    if (needsReauth) {
+      account.needsReauth = true;
+      if (reason === "verify_account") account.needsReauthReason = reason;
+    } else {
+      delete account.needsReauth;
+      delete account.needsReauthReason;
+    }
   }, [provider, accountId]);
 }
 
-export async function mergeAccountCredential(provider:string,accountId:string,credential:OAuthCredentials,opts:{expectedGeneration?:string;afterPrePersistRead?:()=>void|Promise<void>;assertOwnership?: (store: AuthStore) => void}={}):Promise<{superseded:false}|{superseded:true;stored:OAuthCredentials}>{const safe=normalizeCredential(credential);if(!safe)throw new Error("Refusing to persist invalid OAuth credential");return await mutateStore(async store=>{await opts.afterPrePersistRead?.();const account=store[provider]?.accounts.find(x=>x.id===accountId);if(!account)throw new Error(`OAuth account disappeared before persist: ${provider}`);if(opts.expectedGeneration!==undefined&&credentialGeneration(account.credential)!==opts.expectedGeneration)return{superseded:true,stored:account.credential};opts.assertOwnership?.(store);account.credential=safe;delete account.needsReauth;return{superseded:false};},[provider,accountId,safe,opts.expectedGeneration]);}
+export async function mergeAccountCredential(provider:string,accountId:string,credential:OAuthCredentials,opts:{expectedGeneration?:string;afterPrePersistRead?:()=>void|Promise<void>;assertOwnership?: (store: AuthStore) => void}={}):Promise<{superseded:false}|{superseded:true;stored:OAuthCredentials}>{const safe=normalizeCredential(credential);if(!safe)throw new Error("Refusing to persist invalid OAuth credential");return await mutateStore(async store=>{await opts.afterPrePersistRead?.();const account=store[provider]?.accounts.find(x=>x.id===accountId);if(!account)throw new Error(`OAuth account disappeared before persist: ${provider}`);if(opts.expectedGeneration!==undefined&&credentialGeneration(account.credential)!==opts.expectedGeneration)return{superseded:true,stored:account.credential};opts.assertOwnership?.(store);account.credential=safe;if(account.needsReauthReason!=="verify_account"){delete account.needsReauth;delete account.needsReauthReason;}return{superseded:false};},[provider,accountId,safe,opts.expectedGeneration]);}
 // A late refresh failure must not change an operator-paused account's health. Check under
 // the mutation lock, not before awaiting it, so a concurrent pause cannot be overwritten.
-export async function markAccountNeedsReauthIfGeneration(provider:string,accountId:string,generation:string,writerGeneration=captureConfigGeneration()):Promise<boolean>{const key=oauthAccountKey(provider,accountId);if(writerGeneration<lastReconciledGeneration&&!liveOAuthAccountKeys.has(key))return false;return await mutateStore(store=>{const account=store[provider]?.accounts.find(x=>x.id===accountId);if(!account?.credential||account.paused||credentialGeneration(account.credential)!==generation)return false;if(writerGeneration<lastReconciledGeneration&&!liveOAuthAccountKeys.has(key))return false;account.needsReauth=true;return true;},[provider,accountId,generation]);}
+export async function markAccountNeedsReauthIfGeneration(provider:string,accountId:string,generation:string,writerGeneration=captureConfigGeneration(),reason?:"verify_account"):Promise<boolean>{const key=oauthAccountKey(provider,accountId);if(writerGeneration<lastReconciledGeneration&&!liveOAuthAccountKeys.has(key))return false;return await mutateStore(store=>{const account=store[provider]?.accounts.find(x=>x.id===accountId);if(!account?.credential||account.paused||credentialGeneration(account.credential)!==generation)return false;if(writerGeneration<lastReconciledGeneration&&!liveOAuthAccountKeys.has(key))return false;account.needsReauth=true;if(reason==="verify_account")account.needsReauthReason=reason;return true;},[provider,accountId,generation]);}

package/src/oauth/types.ts

@@ -62,6 +62,8 @@ export type OAuthCredentials = {
   email?: string;
   accountId?: string;
   source?: OAuthCredentialSource;
+  /** Private authenticated account proof; never projected into account summaries. */
+  anthropicIdentity?: { v: 1; accountUuid: string; bearerSha256: string };
   /** Google Antigravity (Cloud Code Assist) discovered project id; injected into the CCA envelope. */
   projectId?: string;
   /**
@@ -92,6 +94,13 @@ export interface ProviderAccount {
   paused?: boolean;
   /** Anthropic-only usage-switch override; absent inherits its pool default, zero disables it. */
   autoSwitchThresholdOverride?: number;
+  /**
+   * Why the account needs reauthentication. `verify_account` means the grant is
+   * alive but the provider blocks the account until the human verifies it
+   * (Antigravity 403 PERMISSION_DENIED) — a plain re-login without that
+   * verification will not help. Absent means an ordinary credential failure.
+   */
+  needsReauthReason?: "verify_account";
   addedAt?: number;
 }
 

package/src/protocols/encoders/messages.ts

@@ -386,7 +386,8 @@ function createAnthropicMessageWriter(
         return;
       }
       const message = typeof error.message === "string" ? error.message : "upstream request failed";
-      fail(anthropicFailedStatus(error, message), message, true);
+      fail(anthropicFailedStatus(error, message), message, true,
+        error.code === "context_length_exceeded" ? error.code : undefined);
     },
     overflow() {
       fail(413, "upstream translation buffer exceeded the safe limit", false, "translation_buffer_limit");
@@ -413,7 +414,7 @@ export function encodeAnthropicMessageSse(
 /**
  * Fold an encoded Messages stream into the non-streaming client response, with the status
  * mapping the Messages ingress applied to its collected message: a translator overflow is 413,
- * a stream that ended in an error frame is 502, anything else unexpected a 502 api_error.
+ * a classified context rejection is 400; other error frames/unexpected failures stay 502.
  */
 export async function collectAnthropicMessageResponse(
   stream: ReadableStream<Uint8Array>,
@@ -444,7 +445,7 @@ export async function collectAnthropicMessageResponse(
     );
   }
   return new Response(JSON.stringify(message), {
-    status: isError ? 502 : 200,
+    status: isError ? (translatedError?.code === "context_length_exceeded" ? 400 : 502) : 200,
     headers: { "Content-Type": "application/json" },
   });
 }

package/src/protocols/plan-snapshot.ts

@@ -138,7 +138,7 @@ function candidateFor(
     const reason = rows.effortRow ? "effort-row" : nativeChatDeclineReason(settled, chatBodyForFeatures(features), config);
     nativeEligible = reason === undefined;
     if (reason) declineReasons = [reason];
-  } else if (inbound === "messages" && resolveProtocolSettings(config).rollout.managedMessagesNative) {
+  } else if (inbound === "messages" && resolveProtocolSettings(config, settled.providerName).rollout.managedMessagesNative) {
     // The runtime rule itself. With the switch off nothing is judged, so the default preview
     // is exactly what it was before the managed native lane existed.
     // Pinned effort is judged from config and the route; blocked-skill elision and the web-search

package/src/protocols/settings.ts

@@ -71,19 +71,29 @@ export interface ProtocolSettings {
 }
 
 /** Resolve protocol policy with conservative defaults for every absent or malformed field. */
-export function resolveProtocolSettings(config: Pick<OcxConfig, "protocols">): Readonly<ProtocolSettings> {
+export function resolveProtocolSettings(config: Pick<OcxConfig, "protocols" | "anthropicAccountPool">, providerName?: string): Readonly<ProtocolSettings> {
   const raw: unknown = config.protocols;
   const protocols = isRec(raw) ? raw : {};
   const rollout = isRec(protocols.rollout) ? protocols.rollout : {};
   const on = (key: keyof ProtocolRolloutSettings): boolean => rollout[key] === true;
-  const managedMessagesNative = on("managedMessagesNative");
+  // A present malformed container cannot become an absent/default-on policy.
+  const validContainers = (raw === undefined || isRec(raw))
+    && (!Object.hasOwn(protocols, "rollout") || isRec(protocols.rollout));
+  const rawPool: unknown = config.anthropicAccountPool;
+  const pool = isRec(rawPool) ? rawPool : {};
+  const pooled = providerName === "anthropic" && pool.enabled === true;
+  const poolPreference = !Object.hasOwn(pool, "nativeMessages") || pool.nativeMessages === true;
+  const nativeOn = (key: "managedMessagesNative" | "managedMessagesNativeOAuth") => validContainers
+    && (!pooled || poolPreference)
+    && (Object.hasOwn(rollout, key) ? rollout[key] === true : pooled);
+  const managedMessagesNative = nativeOn("managedMessagesNative");
   return Object.freeze({
     unrepresentable: protocols.unrepresentable === "reject" ? "reject" : "legacy",
     rollout: Object.freeze({
       nativeChatCombos: on("nativeChatCombos"),
       managedMessagesNative,
       // OAuth extension is meaningless without the key-auth path it extends.
-      managedMessagesNativeOAuth: managedMessagesNative && on("managedMessagesNativeOAuth"),
+      managedMessagesNativeOAuth: managedMessagesNative && nativeOn("managedMessagesNativeOAuth"),
       directEncoders: on("directEncoders"),
       shadowPlan: on("shadowPlan"),
     }),
@@ -95,16 +105,30 @@ export function resolveProtocolSettings(config: Pick<OcxConfig, "protocols">): R
  * dashboard can tell a preview computed under an older policy from a current one. Not a
  * security boundary; FNV-1a over a canonical JSON projection.
  */
-export function protocolPolicyRevision(config: Pick<OcxConfig, "apiSurfaces" | "claudeCode" | "protocols">): string {
+export function protocolPolicyRevision(config: Pick<OcxConfig, "apiSurfaces" | "claudeCode" | "protocols" | "anthropicAccountPool">): string {
   const surfaces = resolveApiSurfaceSettings(config);
   const settings = resolveProtocolSettings(config);
+  const anthropicSettings = resolveProtocolSettings(config, "anthropic");
+  const state = (record: unknown, key: string) => !isRec(record) || !Object.hasOwn(record, key)
+    ? "absent" : record[key] === true ? "true" : record[key] === false ? "false" : "invalid";
+  const container = (value: unknown) => value === undefined ? "absent" : isRec(value) ? "object" : "invalid";
+  const rawProtocols: unknown = config.protocols;
+  const rawRollout = isRec(rawProtocols) ? rawProtocols.rollout : undefined;
   const canonical = JSON.stringify({
     messages: [surfaces.messages.enabled, surfaces.messages.source],
     unrepresentable: settings.unrepresentable,
+    nativeInputs: [
+      container(rawProtocols), container(rawRollout),
+      state(rawRollout, "managedMessagesNative"), state(rawRollout, "managedMessagesNativeOAuth"),
+      container(config.anthropicAccountPool), state(config.anthropicAccountPool, "enabled"),
+      state(config.anthropicAccountPool, "nativeMessages"),
+    ],
     rollout: [
       settings.rollout.nativeChatCombos,
       settings.rollout.managedMessagesNative,
       settings.rollout.managedMessagesNativeOAuth,
+      anthropicSettings.rollout.managedMessagesNative,
+      anthropicSettings.rollout.managedMessagesNativeOAuth,
       settings.rollout.directEncoders,
       settings.rollout.shadowPlan,
     ],