@bitkyc08/opencodex 2.77.0 → 2.78.0

package/src/integrations/target.ts

@@ -36,6 +36,12 @@ export interface IntegrationTarget {
   readonly format: ConfigFormat;
   /** The contribution shape that file's reader understands. */
   readonly buildContribution: BuildContribution;
+  /**
+   * The one YAML leaf patched in place in that file, or null when the writer
+   * re-renders the document. A client's config file and its store have
+   * different shapes, so this belongs to the target rather than the client.
+   */
+  readonly sourcePreservingYaml: { readonly path: readonly string[] } | null;
   /**
    * Set when a write to the file above would not reach the client.
    *
@@ -60,10 +66,20 @@ export interface IneffectiveWrite {
    * with the store itself as the target: a client that bumps its schema after
    * we wrote the store leaves our block there, removable, and the file no
    * longer one we may merge into.
+   *
+   * `missing-store` — the store does not exist, but the client already manages it
+   * (DSH: a Desktop profile manifest is present). DSH renames `settings.yaml` to
+   * `settings.yaml.imported` and imports it on startup, so a config-file write would
+   * orphan our ownership record. `remedy` says how to bring the store back, and
+   * `emptyDocument` is what to create it with.
    */
-  readonly why: "owned-config-file" | "unestablished-schema";
+  readonly why: IneffectiveWriteReason;
+  readonly remedy?: string;
+  readonly emptyDocument?: string;
 }
 
+export type IneffectiveWriteReason = "owned-config-file" | "unestablished-schema" | "missing-store";
+
 function configFileTarget(
   clientId: IntegrationClientId,
   configPath: string,
@@ -74,6 +90,7 @@ function configFileTarget(
     configPath,
     format: exportSpec.format,
     buildContribution: exportSpec.buildContribution,
+    sourcePreservingYaml: INTEGRATION_CLIENTS[clientId].sourcePreservingYaml ?? null,
     ineffective,
   };
 }
@@ -87,6 +104,7 @@ function storeTarget(
     configPath,
     format: declared.format,
     buildContribution: declared.buildContribution,
+    sourcePreservingYaml: declared.sourcePreservingYaml ?? null,
     ineffective,
   };
 }
@@ -141,7 +159,12 @@ export function resolveIntegrationTarget(args: {
   if (!declared) return configFileTarget(clientId, configPath, null);
   const storePath = declared.path(args.env, args.home);
   const kind = io.statKind(storePath);
-  if (kind === "missing") return configFileTarget(clientId, configPath, null);
+  if (kind === "missing") {
+    const missing = declared.missingStore;
+    return missing?.readsStore(storePath, path => io.statKind(path)) === true
+      ? configFileTarget(clientId, configPath, { store: storePath, why: "missing-store", remedy: missing.remedy, emptyDocument: missing.emptyDocument })
+      : configFileTarget(clientId, configPath, null);
+  }
   // Only proven absence permits a legacy write. Unreadable or non-file stores
   // cannot establish what the client reads; preserve the recorded removal target.
   if (kind !== "file") {

package/src/integrations/writer.ts

@@ -33,7 +33,7 @@ import {
   refreshablePathsOf,
   semanticProtectedContributionFingerprint,
 } from "./ownership-policy";
-import { AmbiguousSelectorError, createdContainerPaths, mergeContribution, removeFragments } from "./merge";
+import { AmbiguousSelectorError, createdContainerPaths, mergeContribution, parseSegment, removeFragments } from "./merge";
 import {
   INTEGRATION_CLIENTS,
   assertDroidPathsUnambiguous,
@@ -48,7 +48,7 @@ import type { IntegrationState } from "./state";
 import { serializeDocument, UnserializableValueError } from "./serialize";
 import { ClientPathError } from "../clients/config-export";
 import { matchesOperationResult, newOpId, type JournalEntry } from "./journal";
-import { observeIntegration, type IntegrationWriteInput, type RefusalReason } from "./mutation-plan";
+import { observeIntegration, restoreStoreDirectoryRefusal, type IntegrationWriteInput, type RefusalReason } from "./mutation-plan";
 import { createIntegrationStateStore, type IntegrationStateStore } from "./store";
 import {
   patchYamlFragmentSource,
@@ -300,6 +300,8 @@ function applyOrRefreshIntegration(
     return refuse(clientId, "superseded_store", classified.state,
       target.ineffective.why === "owned-config-file"
         ? `${clientId} now reads its providers from ${readsFrom}, and opencodex still has a block in ${configPath}, which it no longer reads. Disable the ${clientId} integration to remove that block, then enable it again to write ${readsFrom}.`
+        : target.ineffective.why === "missing-store"
+          ? `${clientId} reads its providers from ${readsFrom}, which does not exist. ${clientId} renames ${configPath} away and imports it on its next start, so opencodex will not write there. ${target.ineffective.remedy ?? fallback}`
         : readsFrom === configPath
           ? `opencodex does not recognise the schema of ${readsFrom}, the file ${clientId} reads its providers from, so it will not merge into it. ${fallback}`
           : `${clientId} now reads its providers from ${readsFrom}, whose schema opencodex does not recognise, so writing ${configPath} would change nothing it loads. ${fallback}`);
@@ -383,8 +385,15 @@ function applyOrRefreshIntegration(
   let created: string[];
   let text: string;
   try {
+    // The source patcher updates this selected row in place. Keep it in the
+    // semantic merge too, even when we originally created it, and retain that
+    // provenance so disable can still remove the row when it becomes empty.
+    const sourceRoot = target.sourcePreservingYaml?.path[0];
+    const retainedRow = sourceRoot && parseSegment(sourceRoot).kind === "select" ? sourceRoot : null;
+    const priorCreated = record?.createdContainers ?? [];
+    const prunable = new Set(priorCreated.filter(path => path !== retainedRow));
     const base = classified.state === "stale" && record
-      ? removeFragments(parsed, record.fragmentPaths, new Set(record.createdContainers ?? [])).doc
+      ? removeFragments(parsed, record.fragmentPaths, prunable).doc
       : classified.state === "conflict" && record
         /*
          * A forced overwrite of a `foreign-edit` conflict drops what the previous
@@ -399,26 +408,27 @@ function applyOrRefreshIntegration(
          * them, so a later disable removes our leaves and leaves their structure
          * standing.
          */
-        ? removeFragments(parsed, record.fragmentPaths, new Set(record.createdContainers ?? [])).doc
+        ? removeFragments(parsed, record.fragmentPaths, prunable).doc
         : parsed;
     // Computed against the document as it stands BEFORE the merge: afterwards
     // every container exists and "did we create this?" is unanswerable.
     created = createdContainerPaths(base, contribution);
+    if (retainedRow && priorCreated.includes(retainedRow)) created = [...new Set([retainedRow, ...created])];
     const nextDocument = mergeContribution(base, contribution);
     if (clientId === "cline") preserveClineSelection(parsed, nextDocument);
-    if (spec.sourcePreservingYaml && before !== null) {
-      const value = sourcePreservingFragmentValue(contribution, spec.sourcePreservingYaml.path);
+    if (target.sourcePreservingYaml && before !== null) {
+      const value = sourcePreservingFragmentValue(contribution, target.sourcePreservingYaml.path);
       const patched = value === undefined
         ? null
         : patchYamlFragmentSource(
             before,
-            spec.sourcePreservingYaml.path,
+            target.sourcePreservingYaml.path,
             { kind: "upsert", value },
             nextDocument,
           );
       if (patched === null) {
         return refuse(clientId, "unsafe", "unsafe",
-          yamlRefusalReason(before, spec.sourcePreservingYaml.path, configPath, "it was left alone"));
+          yamlRefusalReason(before, target.sourcePreservingYaml.path, configPath, "it was left alone"));
       }
       text = patched;
     } else {
@@ -565,12 +575,12 @@ export function disableIntegration(input: IntegrationWriteInput): WriteOutcome {
    * comment makes its ancestor user-owned without protecting our leaf.
    */
   const recordedCreated = record!.createdContainers ?? [];
-  const prunableCreated = spec.sourcePreservingYaml && before !== null
-    ? sourcePrunableYamlContainers(before, spec.sourcePreservingYaml.path, recordedCreated)
+  const prunableCreated = target.sourcePreservingYaml && before !== null
+    ? sourcePrunableYamlContainers(before, target.sourcePreservingYaml.path, recordedCreated)
     : recordedCreated;
   if (prunableCreated === null) {
     return refuse(clientId, "unsafe", "unsafe",
-      yamlRefusalReason(before ?? "", spec.sourcePreservingYaml!.path, configPath, "nothing was removed"));
+      yamlRefusalReason(before ?? "", target.sourcePreservingYaml!.path, configPath, "nothing was removed"));
   }
   let doc: unknown;
   let removed: boolean;
@@ -586,14 +596,14 @@ export function disableIntegration(input: IntegrationWriteInput): WriteOutcome {
   }
   let text: string;
   try {
-    if (spec.sourcePreservingYaml && before !== null) {
-      const patched = patchYamlFragmentSource(before, spec.sourcePreservingYaml.path, {
+    if (target.sourcePreservingYaml && before !== null) {
+      const patched = patchYamlFragmentSource(before, target.sourcePreservingYaml.path, {
         kind: "remove",
         createdContainers: prunableCreated,
       }, doc);
       if (patched === null) {
         return refuse(clientId, "unsafe", "unsafe",
-          yamlRefusalReason(before, spec.sourcePreservingYaml.path, configPath, "nothing was removed"));
+          yamlRefusalReason(before, target.sourcePreservingYaml.path, configPath, "nothing was removed"));
       }
       text = patched;
     } else {
@@ -651,6 +661,10 @@ export function restoreIntegration(input: IntegrationRestoreInput): WriteOutcome
     return refuse(clientId, "conflict", "conflict",
       `that operation was recorded for ${configPath}, which this client no longer writes; it now resolves to ${resolvedPath}`);
   }
+  const directoryRefusal = restoreStoreDirectoryRefusal(input, configPath, io);
+  if (directoryRefusal !== null) {
+    return refuse(clientId, "unsafe", "unsafe", directoryRefusal);
+  }
   /*
    * Preview refuses this in observeRestore. Refusing here too is what keeps an
    * undo of an older candidate from replacing the record a newer candidate owns.
@@ -862,6 +876,57 @@ function tryFreezeIntegrationInput(input: IntegrationWriteInput):
   }
 }
 
+/**
+ * The store lock to hold beside the config file's, or null.
+ *
+ * Only for a store whose directory exists: a lock is never what creates a
+ * client's profile. A store path that cannot be resolved names nothing to lock;
+ * target resolution reports it on its own.
+ */
+function storeLockFile(frozen: FrozenIntegrationInput): string | null {
+  const declared = INTEGRATION_CLIENTS[frozen.clientId].currentStore;
+  if (!declared?.lockFile) return null;
+  let storePath: string;
+  try {
+    storePath = declared.path(frozen.env, frozen.home);
+  } catch (error) {
+    if (error instanceof ClientPathError) return null;
+    throw error;
+  }
+  return frozen.io.statKind(dirname(storePath)) === "dir" ? declared.lockFile(storePath) : null;
+}
+
+/**
+ * Hold the config file's sibling lock, then the store's. Every operation takes
+ * them in that order, so two of ours cannot deadlock, and the client's own
+ * writer only ever holds one of them.
+ */
+function withClientLocks(
+  frozen: FrozenIntegrationInput,
+  suffix: ".lock",
+  operation: () => WriteOutcome,
+  options?: CoordinatedIntegrationOptions,
+): Promise<WriteOutcome> {
+  const run = async (heldStoreLock: string | null): Promise<WriteOutcome> => {
+    const refused = await options?.revalidate?.(frozen);
+    if (refused) return refused;
+    // A profile can appear while revalidation awaits. Acquire its lock and
+    // repeat the validation before observing or mutating its document.
+    const required = storeLockFile(frozen);
+    if (required !== null && required !== heldStoreLock) {
+      return withIntegrationWriterLock(required, () => run(required), options?.lockSeams, ".lock");
+    }
+    // No await between the last store probe and the synchronous transaction.
+    return operation();
+  };
+  return withIntegrationWriterLock(frozen.resolvedPaths.configPath, () => {
+    // Decide only after the outer lock has actually been acquired.
+    const storeLock = storeLockFile(frozen);
+    return storeLock === null ? run(null)
+      : withIntegrationWriterLock(storeLock, () => run(storeLock), options?.lockSeams, ".lock");
+  }, options?.lockSeams, suffix);
+}
+
 async function coordinatedWrite(
   input: IntegrationWriteInput,
   operation: (frozen: IntegrationWriteInput) => WriteOutcome,
@@ -879,16 +944,14 @@ async function coordinatedWrite(
   // An absent client home is not created merely to acquire a sibling lock.
   if (frozen.io.statKind(frozen.resolvedPaths.detectDir) !== "dir") {
     const refused = await options?.revalidate?.(frozen);
-    return refused ?? operation(frozen);
+    if (refused) return refused;
+    if (frozen.io.statKind(frozen.resolvedPaths.detectDir) !== "dir") return operation(frozen);
   }
-  return withIntegrationWriterLock(
-    frozen.resolvedPaths.configPath,
-    async () => {
-      const refused = await options?.revalidate?.(frozen);
-      return refused ?? operation(frozen);
-    },
-    options?.lockSeams,
+  return withClientLocks(
+    frozen,
     spec.writerLock.suffix,
+    () => operation(frozen),
+    options,
   );
 }
 
@@ -941,15 +1004,10 @@ export async function restoreIntegrationCoordinated(
       `${frozen.resolvedPaths.detectDir} is missing; restore will not create the client home`,
     );
   }
-  return withIntegrationWriterLock(
-    frozen.resolvedPaths.configPath,
-    async () => {
-      // An undo is bound like any other confirmation, and this is the only place where that check
-      // happens with the lock held and before the snapshot, the write and the journal row.
-      const refused = await options?.revalidate?.(frozen);
-      return refused ?? run();
-    },
-    options?.lockSeams,
+  return withClientLocks(
+    frozen,
     spec.writerLock.suffix,
+    run,
+    options,
   );
 }

package/src/lib/package-tree-integrity.ts

@@ -1,6 +1,7 @@
 import { readFileSync, statSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
+import { isRealBunBinary } from "./bun-binary-validator.mjs";
 import { isStandaloneBinary } from "./standalone";
 
 export interface PackageTreeObservation {
@@ -56,6 +57,14 @@ export interface PackageTreeIntegrityOptions {
   schedule?: (callback: () => void, delayMs: number) => (() => void) | void;
   /** Test seam for `installedVersion()`; production reads the package manifest. */
   readInstalledVersion?: () => string | undefined;
+  /**
+   * Whether the runtime a restart would spawn is complete. An in-place npm install writes
+   * package.json and extracts the `bun` package's small placeholder before its postinstall
+   * swaps the real binary in, and the replacement spawns `process.execPath`, that same path.
+   * While this answers false the replacement is treated like an unreadable tree: no restart,
+   * then a fresh full debounce once the runtime is ready.
+   */
+  runtimeReady?: () => boolean;
 }
 
 export type ObservePackageTree = () => PackageTreeObservation | null;
@@ -142,6 +151,12 @@ export function sameObservation(left: PackageTreeObservation, right: PackageTree
  */
 const PACKAGE_TREE_RECHECK_MS = 1_000;
 
+/**
+ * Fences a live process whose package manifest was replaced, and once the replacement is readable,
+ * stable for the debounce interval and any configured `runtimeReady` check passes, hands it to
+ * `onReplaced`. If the callback throws, the guard rechecks the tree and may call it again after
+ * another debounce interval while the replacement persists.
+ */
 export function createPackageTreeIntegrityGuard(
   observe: ObservePackageTree = observePackageManifest,
   now: () => number = Date.now,
@@ -154,6 +169,8 @@ export function createPackageTreeIntegrityGuard(
   let timerScheduled = false;
   let cancelScheduled: (() => void) | null = null;
   let waitingForReadableTree = false;
+  /** Logged once per wait, so a postinstall that never runs is visible rather than silent. */
+  let waitingForRuntime = false;
   let replacementCandidate: PackageTreeObservation | null = null;
   /** The replacement identity that survived a full stability interval (see installedVersion). */
   let settledReplacement: PackageTreeObservation | null = null;
@@ -192,9 +209,24 @@ export function createPackageTreeIntegrityGuard(
       if (sameObservation(boot, current)) {
         resetRestartTimer();
         waitingForReadableTree = false;
+        waitingForRuntime = false;
         replacementCandidate = null;
         return;
       }
+      if (options.runtimeReady && !options.runtimeReady()) {
+        if (!waitingForRuntime) {
+          waitingForRuntime = true;
+          console.warn("Package tree replaced; waiting for its Bun runtime to finish installing before restarting");
+        }
+        // A replacement settled before a failed admission is no longer restart-ready: withdraw
+        // it so installedVersion() stays silent until the fresh debounce settles it again.
+        settledReplacement = null;
+        resetRestartTimer();
+        waitingForReadableTree = true;
+        armRestartTimer(PACKAGE_TREE_RECHECK_MS);
+        return;
+      }
+      waitingForRuntime = false;
       if (waitingForReadableTree) {
         waitingForReadableTree = false;
         replacementCandidate = current;
@@ -239,6 +271,7 @@ export function createPackageTreeIntegrityGuard(
   return {
     installedVersion: () => {
       if (settledReplacement === null) return undefined;
+      if (options.runtimeReady && !options.runtimeReady()) return undefined;
       const current = observe();
       if (current === null || !sameObservation(settledReplacement, current)) return undefined;
       return readInstalledVersion();
@@ -271,6 +304,7 @@ export function createPackageTreeIntegrityGuard(
       lastOkAt = at;
       resetRestartTimer();
       waitingForReadableTree = false;
+      waitingForRuntime = false;
       replacementCandidate = null;
       return { ok: true };
     },
@@ -292,5 +326,12 @@ export function createRuntimePackageTreeIntegrityGuard(
     if (installer === "source" || isStandaloneBinary()) {
       return { status: () => ({ ok: true }), dispose: () => {} };
     }
-    return createPackageTreeIntegrityGuard(observe, now, options);
+    // The restart replacement spawns process.execPath, the bundled Bun in an npm install. Read it
+    // now: Linux Bun resolves it lazily, and after npm swaps the package directory a first read
+    // reports the retired binary as "(deleted)"; reading it once pins the boot path.
+    const runtimePath = process.execPath;
+    return createPackageTreeIntegrityGuard(observe, now, {
+      ...options,
+      runtimeReady: options.runtimeReady ?? (() => isRealBunBinary(runtimePath)),
+    });
   }

package/src/lib/proxy-env.ts

@@ -96,6 +96,9 @@ export function outboundProxyConfigured(
   return OUTBOUND_PROXY_ENV_KEYS.some(key => proxyEnvPresent(key, env));
 }
 
+// Captured before config/proxy-env applies runtime changes; Bun retains startup proxy env.
+export const startupOutboundProxyConfigured = outboundProxyConfigured();
+
 /**
  * The value when `raw` is a proxy URL Bun fetch can actually use, else null.
  * Bun rejects unparseable values and non-http(s) schemes (UnsupportedProxyProtocol),

package/src/lib/test-home-guard.ts

@@ -150,7 +150,8 @@ export function assertNotRealCodexHomeUnderTest(dir: string): void {
   if (canonicalize(dir) !== PROTECTED_CODEX_HOME) return;
   throw new Error(
     `refusing to write the real Codex home (${PROTECTED_CODEX_HOME}) from a test process. `
-    + "Point CODEX_HOME at a temp directory for this test before writing native auth.json.",
+    + "Point CODEX_HOME at a temp directory for this test before writing Codex files "
+    + "(auth.json, the catalog, models_cache.json, the journal or config.toml).",
   );
 }
 

package/src/oauth/anthropic-account-refusal.ts

@@ -9,13 +9,13 @@ import type { OcxConfig } from "../types";
 import type { AnthropicRouteDecision } from "./anthropic-model-routes";
 import { recordAnthropicAccountRefusal, rotateAnthropicAccountOnRefusal, hasAnthropicFailoverQuorum, isAnthropicAccountPoolEnabled, pickAlternateAnthropicAccount } from "./anthropic-routing";
 
-const responseCredentials = new WeakMap<Response, Pick<OAuthAccessSnapshot, "accountId" | "generation">>();
+const responseCredentials = new WeakMap<Response, Pick<OAuthAccessSnapshot, "accountId" | "generation"> & { providerAccountUuid?: string; checkProviderUuid: boolean }>();
 const retryStates = new WeakMap<object, { firstAccountId: string; sameAccount: boolean; detour: boolean }>();
 const verdicts = new WeakMap<Response, Promise<boolean>>();
 
 /** Called only when the outgoing headers prove ownership of the selected stored bearer. */
-export function bindAnthropicRefusalCredential(response: Response, snapshot: OAuthAccessSnapshot): void {
-  responseCredentials.set(response, { accountId: snapshot.accountId, generation: snapshot.generation });
+export function bindAnthropicRefusalCredential(response: Response, snapshot: OAuthAccessSnapshot, providerAccountUuid?: string): void {
+  responseCredentials.set(response, { accountId: snapshot.accountId, generation: snapshot.generation, providerAccountUuid, checkProviderUuid: arguments.length >= 3 });
 }
 
 async function isAccountRefusal(response: Response, signal?: AbortSignal): Promise<boolean> {
@@ -55,6 +55,10 @@ export async function rotateAnthropicAccountOnResponse(
     requestKey?: object;
     allow429Recovery?: boolean;
     allowAccountRefusal?: boolean;
+    /** Applies to alternate ranking only; the shared same-account throttle remains allowed. */
+    excludedAccountIds?: ReadonlySet<string>;
+    /** Native dispatch re-reads operator policy after asynchronous classification/waits. */
+    currentDecision?: () => AnthropicRouteDecision | null;
   },
 ): Promise<string | null> {
   if (options.signal?.aborted || isNonReplayableResponse(response)) return null;
@@ -62,11 +66,13 @@ export async function rotateAnthropicAccountOnResponse(
     const sent = responseCredentials.get(response);
     const current = sent && getAccountCredentialWithStatus("anthropic", sent.accountId);
     if (!sent || sent.accountId !== options.accountId || !current || current.needsReauth
-      || credentialGeneration(current.credential) !== sent.generation) return null;
+      || credentialGeneration(current.credential) !== sent.generation
+      || sent.checkProviderUuid && current.credential.accountId !== sent.providerAccountUuid) return null;
+    options.currentDecision?.();
     const kind = classifyAnthropic429(response.headers);
     if (kind === "family-quota") {
       if (anthropicModelFamily(options.model) !== "Fable" || !options.canRetry || options.allow429Recovery === false) return null;
-      return pickAlternateAnthropicAccount(options.config, sent.accountId, Date.now(), options.decision ?? null, options.model);
+      return pickAlternateAnthropicAccount(options.config, sent.accountId, Date.now(), (options.currentDecision ? options.currentDecision() : options.decision ?? null), options.model, options.excludedAccountIds);
     }
     if (kind !== "shared-quota") {
       if (!isAnthropicAccountPoolEnabled(options.config) && !hasAnthropicFailoverQuorum() && !current.paused) return null;
@@ -87,16 +93,19 @@ export async function rotateAnthropicAccountOnResponse(
         const live = getAccountCredentialWithStatus("anthropic", sent.accountId);
         if (!live || live.paused || live.needsReauth || options.signal?.aborted
           || credentialGeneration(live.credential) !== sent.generation
+          || sent.checkProviderUuid && live.credential.accountId !== sent.providerAccountUuid
           || anthropicRatePauseUntil(sent.accountId, Math.max(Date.now(), retryAt))) return null;
+        options.currentDecision?.();
         return sent.accountId;
       }
       if (kind === "transient-rate" && !state.detour) {
         state.detour = true;
-        return pickAlternateAnthropicAccount(options.config, sent.accountId, Date.now(), options.decision ?? null, options.model);
+        return pickAlternateAnthropicAccount(options.config, sent.accountId, Date.now(), (options.currentDecision ? options.currentDecision() : options.decision ?? null), options.model, options.excludedAccountIds);
       }
       return null;
     }
     if (options.allow429Recovery === false) {
+      options.currentDecision?.();
       recordAnthropicAccountRefusal(options.config, options.accountId, 429, response.headers.get("retry-after"), Date.now(), response.headers);
       return null;
     }
@@ -112,8 +121,10 @@ export async function rotateAnthropicAccountOnResponse(
     if (!await verdict || options.signal?.aborted) return null;
     // A late refusal must not cool a new credential stored while its body was being read.
     const current = getAccountCredentialWithStatus("anthropic", sent.accountId);
-    if (!current || current.paused || current.needsReauth || credentialGeneration(current.credential) !== sent.generation) return null;
+    if (!current || current.paused || current.needsReauth || credentialGeneration(current.credential) !== sent.generation
+      || sent.checkProviderUuid && current.credential.accountId !== sent.providerAccountUuid) return null;
   }
+  const decision = options.currentDecision ? options.currentDecision() : options.decision;
   const status = response.status === 429 ? 429 : 403;
   if (!options.canRetry) {
     recordAnthropicAccountRefusal(options.config, options.accountId, status,
@@ -121,5 +132,5 @@ export async function rotateAnthropicAccountOnResponse(
     return null;
   }
   return rotateAnthropicAccountOnRefusal(options.config, options.accountId, status,
-    response.headers.get("retry-after"), options.sessionKey, Date.now(), response.headers, options.decision, options.model);
+    response.headers.get("retry-after"), options.sessionKey, Date.now(), response.headers, decision, options.model, options.excludedAccountIds);
 }

package/src/oauth/anthropic-routing.ts

@@ -111,6 +111,9 @@ type OAuthAccountSelection = NonNullable<ReturnType<typeof captureOAuthAccountSe
 // Undefined means this runtime has not admitted a selection yet; null means consumed.
 // The startup baseline comes from the authoritative store, never a second persisted pin.
 let manualPreference: OAuthAccountSelection | null | undefined;
+let manualSelectionGeneration = 0;
+/** Automatic pointer moves preserve affinity; manual selection revokes older bindings. */
+export function captureAnthropicManualSelectionGeneration(): number { return manualSelectionGeneration; }
 
 function normalizeAffinityComponent(value: string | null | undefined): string {
   const normalized = value?.trim() ?? "";
@@ -285,6 +288,7 @@ export function clearAnthropicAccountPoolState(): void {
   clearAnthropicCooldownGenerations();
   sessionAffinity.clear();
   manualPreference = undefined;
+  manualSelectionGeneration++;
   quorumCache = null;
 }
 
@@ -508,9 +512,9 @@ function compareScoredAccounts(a: ScoredAccount, b: ScoredAccount): number {
   return a.score - b.score || a.fiveHourTieBreak - b.fiveHourTieBreak;
 }
 
-function pickLowestUsage(config: OcxConfig, excludeId: string | undefined, now: number, decision: AnthropicRouteDecision | null = null, model?: string): string | null {
+function pickLowestUsage(config: OcxConfig, excludeId: string | undefined, now: number, decision: AnthropicRouteDecision | null = null, model?: string, excludedAccountIds?: ReadonlySet<string>): string | null {
   const window = anthropicQuotaWindow(anthropicAccountPoolConfig(config));
-  const unfiltered = routeCandidates(getEligibleAnthropicAccounts(now, model), decision).filter(id => id !== excludeId);
+  const unfiltered = routeCandidates(getEligibleAnthropicAccounts(now, model), decision).filter(id => id !== excludeId && !excludedAccountIds?.has(id));
   const available = window === "weekly" ? unfiltered.filter(id => !exhausted5h(id)
     || isAnthropicAccountPoolEnabled(config) && anthropicAccountAutoSwitchThreshold(config, id) === 0) : unfiltered;
   const modelAvailable = model ? available.filter(id => !anthropicModelExhausted(id, model)) : available;
@@ -589,16 +593,17 @@ export function pickAlternateAnthropicAccount(
   now: number,
   decision: AnthropicRouteDecision | null,
   model?: string,
+  excludedAccountIds?: ReadonlySet<string>,
 ): string | null {
   const strategy = anthropicPoolStrategy(config);
-  const eligible = routeCandidates(getEligibleAnthropicAccounts(now, model), decision).filter(id => id !== excludeId);
+  const eligible = routeCandidates(getEligibleAnthropicAccounts(now, model), decision).filter(id => id !== excludeId && !excludedAccountIds?.has(id));
   if (strategy === "round-robin") {
     return peekRoundRobinAccount(POOL_KEY_ANTHROPIC, eligible, stickyLimitForPool(config));
   }
   if (strategy === "fill-first") {
     return pickNextFillFirstAnthropicAccount(config, excludeId, eligible, decision, model);
   }
-  return pickLowestUsage(config, excludeId, now, decision, model);
+  return pickLowestUsage(config, excludeId, now, decision, model, excludedAccountIds);
 }
 
 function pruneExpiredAffinity(now: number): void {
@@ -918,6 +923,7 @@ export function rotateAnthropicAccountOnRefusal(
   rateLimitHeaders?: AnthropicRateLimitHeaders | null,
   decision: AnthropicRouteDecision | null = null,
   model?: string,
+  excludedAccountIds?: ReadonlySet<string>,
 ): string | null {
   if (!recordAnthropicAccountRefusal(config, failedAccountId, status, retryAfterHeader, now, rateLimitHeaders)) return null;
 
@@ -926,8 +932,8 @@ export function rotateAnthropicAccountOnRefusal(
   // because those dormant values remain in config. The quota picker is the neutral
   // recovery policy already used by the default strategy.
   const next = isAnthropicAccountPoolEnabled(config)
-    ? pickAlternateAnthropicAccount(config, failedAccountId, now, decision, model)
-    : pickLowestUsage(config, failedAccountId, now, null, model);
+    ? pickAlternateAnthropicAccount(config, failedAccountId, now, decision, model, excludedAccountIds)
+    : pickLowestUsage(config, failedAccountId, now, null, model, excludedAccountIds);
   if (!next) {
     console.warn(`[anthropic-pool] ${decision ? `route:#${decision.position} ` : ""}no eligible replacement; returning ${status}`);
     return null;
@@ -1070,6 +1076,7 @@ export function commitAnthropicSelectionRouting(
  */
 export function resetAnthropicRoutingForManualSelection(accountId: string): void {
   sessionAffinity.clear();
+  manualSelectionGeneration++;
   manualPreference = captureOAuthAccountSelection(PROVIDER);
   seedPoolRotationAccount(POOL_KEY_ANTHROPIC, accountId);
   // A manual account selection is an operator statement about the roster; do not answer the
@@ -1172,12 +1179,10 @@ export function anthropicSessionKeyFromParts(input: {
   /** When true, prompt_cache_key is a shared Desktop cohort — ignore it for affinity. */
   promptCacheKeyIsSharedCohort?: boolean;
 }): string | null {
-  const preferred = (
-    input.clientThreadId
-    ?? input.sessionIdHeader
-    ?? input.threadIdHeader
-    ?? ""
-  ).trim();
+  const preferred = input.clientThreadId?.trim()
+    || input.sessionIdHeader?.trim()
+    || input.threadIdHeader?.trim()
+    || "";
   if (preferred) {
     return preferred.length <= 128 ? preferred : createHash("sha256").update(preferred).digest("hex");
   }

package/src/oauth/anthropic.ts

@@ -3,6 +3,7 @@ import { OAuthCallbackFlow } from "./callback-server";
 import { bindAnthropicIdentity, resolveAnthropicAccountIdentity } from "./anthropic-identity";
 import { generatePKCE } from "./pkce";
 import type { LocalTokenImportMode, OAuthController, OAuthCredentials } from "./types";
+import { outboundProxyConfigured, startupOutboundProxyConfigured } from "../lib/proxy-env";
 
 const CLIENT_ID = atob("OWQxYzI1MGEtZTYxYi00NGQ5LTg4ZWQtNTk0NGQxOTYyZjVl");
 const AUTHORIZE_URL = "https://claude.ai/oauth/authorize";
@@ -40,6 +41,7 @@ export class AnthropicTokenError extends Error {
     message: string,
     readonly httpStatus: number | undefined,
     readonly oauthError: string | undefined,
+    readonly requestNotSent = false,
   ) {
     super(message);
     this.name = "AnthropicTokenError";
@@ -47,12 +49,35 @@ export class AnthropicTokenError extends Error {
 }
 
 async function postJson(url: string, body: Record<string, string | number>): Promise<string> {
-  const response = await fetch(url, {
+  const direct = !startupOutboundProxyConfigured && !outboundProxyConfigured();
+  const init: RequestInit & { protocol: "http1.1" } = {
     method: "POST",
     headers: { "Content-Type": "application/json", Accept: "application/json" },
     body: JSON.stringify(body),
     signal: AbortSignal.timeout(30_000),
-  });
+    // Pinned Bun 1.4.0: one HTTP/1.1 attempt, no keep-alive reuse or redirect following.
+    // Only without an outbound proxy can token-host DNS failure prove no request was sent.
+    redirect: "manual",
+    keepalive: false,
+    protocol: "http1.1",
+  };
+  let response: Response;
+  try {
+    response = await fetch(url, init);
+  } catch (error) {
+    if (direct && typeof error === "object" && error !== null
+      && "code" in error && error.code === "ENOTFOUND"
+      && "syscall" in error && error.syscall === "getaddrinfo"
+      && "hostname" in error && error.hostname === new URL(url).hostname) {
+      throw new AnthropicTokenError("Anthropic OAuth DNS lookup failed before connection", undefined, undefined, true);
+    }
+    throw error;
+  }
+  if (response.status >= 300 && response.status < 400) {
+    // A redirect can follow a completed POST and token rotation; it is not a rejection.
+    await response.body?.cancel().catch(() => {});
+    throw new AnthropicTokenError(`Anthropic OAuth redirect HTTP ${response.status}: outcome unknown`, undefined, undefined);
+  }
   const responseBody = await response.text();
   if (!response.ok) {
     let oauthError: string | undefined;