@bitkyc08/opencodex 2.79.0 → 2.81.0

package/src/messaging/rpc.ts

@@ -0,0 +1,196 @@
+import { MessageBudget } from "./budget";
+import { localSocket, type LocalSocket } from "./socket";
+import { isRecord, isThreadId, LocalMessagingError, type LocalMetadataClient, type LocalThread } from "./types";
+
+type Method = "initialize" | "thread/loaded/list" | "thread/read" | "thread/queue/add";
+interface QueueResult {
+  status: "not_sent" | "queued" | "unknown";
+  error?: { code: string; message: string };
+}
+/** Only a validated server rejection can establish non-submission after a write. */
+class QueueRejection extends LocalMessagingError {}
+interface Pending {
+  resolve(value: unknown): void;
+  reject(error: Error): void;
+  timer: ReturnType<typeof setTimeout>;
+  method: Method;
+}
+
+/** Metadata discovery plus one text-only queue method; no lifecycle/turn/permission mutation. */
+export class LocalMessageRpc implements LocalMetadataClient {
+  private nextId = 0;
+  private readonly pending = new Map<number, Pending>();
+  private closed = false;
+  private readonly abort: () => void;
+
+  /** Bind connection failure and operation cancellation to all pending requests. */
+  private constructor(private readonly socket: LocalSocket, private readonly budget: MessageBudget,
+    private readonly rpcTimeoutMs: number) {
+    this.abort = () => this.close(budget.signal.reason);
+    socket.onmessage = event => this.receive(event.data);
+    socket.onerror = socket.onclose = () => this.close();
+    budget.signal.addEventListener("abort", this.abort, { once: true });
+    if (budget.signal.aborted) this.abort();
+  }
+
+  /** Connect and initialize an existing local daemon within budget; never start or repair one. */
+  static async connect(url: string, budget: MessageBudget, rpcTimeoutMs = 10_000): Promise<LocalMessageRpc> {
+    budget.throwIfEnded();
+    if (!Number.isInteger(rpcTimeoutMs) || rpcTimeoutMs <= 0 || rpcTimeoutMs > 10_000) {
+      throw new LocalMessagingError("invalid_budget", "RPC timeout must be between 1 and 10000 milliseconds.");
+    }
+    const socket = localSocket(url);
+    try {
+      await new Promise<void>((resolve, reject) => {
+        const cleanup = () => {
+          clearTimeout(timer);
+          budget.signal.removeEventListener("abort", abort);
+          socket.onopen = socket.onerror = socket.onclose = null;
+        };
+        const abort = () => { cleanup(); reject(budget.signal.reason); };
+        const timer = setTimeout(() => {
+          cleanup(); reject(new LocalMessagingError("daemon_unavailable", "Local Codex connection timed out; no daemon was started."));
+        }, budget.remainingMs(rpcTimeoutMs));
+        budget.signal.addEventListener("abort", abort, { once: true });
+        socket.onopen = () => { cleanup(); resolve(); };
+        socket.onerror = socket.onclose = () => {
+          cleanup(); reject(new LocalMessagingError("daemon_unavailable", "Cannot connect to the existing local Codex daemon."));
+        };
+        if (budget.signal.aborted) abort();
+      });
+    } catch (error) { socket.terminate(); throw error; }
+    const rpc = new LocalMessageRpc(socket, budget, rpcTimeoutMs);
+    try {
+      const result = await rpc.request("initialize", {
+        clientInfo: { name: "opencodex_message", version: "1.0.0" },
+        capabilities: { experimentalApi: true },
+      });
+      if (!isRecord(result)) throw rpc.invalidMetadata();
+      budget.throwIfEnded();
+      socket.send(JSON.stringify({ method: "initialized", params: {} }));
+      return rpc;
+    } catch (error) { rpc.close(); throw error; }
+  }
+
+  /** Read up to 50 loaded UUIDs, rejecting malformed IDs and unbounded pagination cursors. */
+  async loadedPage(cursor?: string): Promise<{ data: string[]; nextCursor: string | null }> {
+    const raw = await this.request("thread/loaded/list", { limit: 50, ...(cursor ? { cursor } : {}) });
+    if (!isRecord(raw) || !Array.isArray(raw.data) || raw.data.length > 50 || !raw.data.every(isThreadId)
+      || (raw.nextCursor !== undefined && raw.nextCursor !== null
+        && (typeof raw.nextCursor !== "string" || !raw.nextCursor || raw.nextCursor.length > 4096))) {
+      throw this.invalidMetadata();
+    }
+    return { data: raw.data, nextCursor: typeof raw.nextCursor === "string" ? raw.nextCursor : null };
+  }
+
+  /** Validate one exact thread and project ID/name/status only, without requesting turns. */
+  async readThread(id: string): Promise<LocalThread> {
+    if (!isThreadId(id)) throw new LocalMessagingError("invalid_selector", "A valid Codex thread ID is required.");
+    const raw = await this.request("thread/read", { threadId: id, includeTurns: false });
+    const thread = isRecord(raw) ? raw.thread : null;
+    if (!isRecord(thread) || thread.id !== id || (thread.name !== undefined && thread.name !== null
+      && (typeof thread.name !== "string" || thread.name.length > 4096)) || !isRecord(thread.status)
+      || !["idle", "active", "systemError", "notLoaded"].includes(String(thread.status.type))) {
+      throw this.invalidMetadata();
+    }
+    return { id, name: typeof thread.name === "string" ? thread.name : null, status: thread.status.type as LocalThread["status"] };
+  }
+
+  /** Submit once on this connection; after an accepted write only a correlated reply is definitive. */
+  async queueMessage(threadId: string, text: string, messageId: string): Promise<QueueResult> {
+    let written = false;
+    try {
+      if (!isThreadId(threadId) || !isThreadId(messageId) || !text || text.includes("\0")
+        || Buffer.byteLength(text) > 32 * 1024) {
+        throw new LocalMessagingError("invalid_message", "A bounded text message and UUID correlation are required.");
+      }
+      const raw = await this.request("thread/queue/add", {
+        threadId, input: [{ type: "text", text }], clientUserMessageId: messageId,
+      }, () => { written = true; });
+      const queued = isRecord(raw) ? raw.queuedSubmission : null;
+      if (!isRecord(queued) || typeof queued.id !== "string" || !queued.id || queued.id.length > 4096
+        || queued.clientUserMessageId !== messageId || !Array.isArray(queued.input) || queued.input.length !== 1
+        || !isRecord(queued.input[0]) || queued.input[0].type !== "text" || queued.input[0].text !== text
+        || (queued.input[0].text_elements !== undefined
+          && (!Array.isArray(queued.input[0].text_elements) || queued.input[0].text_elements.length !== 0))) {
+        throw this.invalidMetadata();
+      }
+      return { status: "queued" };
+    } catch (error) {
+      if (error instanceof QueueRejection || !written) {
+        return { status: "not_sent", error: error instanceof LocalMessagingError
+          ? { code: error.code, message: error.message }
+          : { code: "messaging_failed", message: "Local queue submission could not be started." } };
+      }
+      return { status: "unknown", error: { code: "submission_unknown",
+        message: "Local queue submission may have occurred. Do not replay; recipient processing is unknown." } };
+    }
+  }
+
+  /** Idempotently reject pending work, remove handlers and terminate only this connection. */
+  close(error: Error = new LocalMessagingError("daemon_unavailable", "Local Codex connection closed.")): void {
+    if (this.closed) return;
+    this.closed = true;
+    this.budget.signal.removeEventListener("abort", this.abort);
+    this.socket.onopen = this.socket.onmessage = this.socket.onerror = this.socket.onclose = null;
+    for (const pending of this.pending.values()) { clearTimeout(pending.timer); pending.reject(error); }
+    this.pending.clear();
+    this.socket.terminate();
+  }
+
+  /** Fail closed on malformed metadata without including the daemon's response in the error. */
+  private invalidMetadata(): LocalMessagingError {
+    const error = new LocalMessagingError("invalid_metadata", "Codex returned invalid local session metadata.");
+    this.close(error);
+    return error;
+  }
+
+  /** Issue one whitelisted RPC with bounded concurrency and timeout; record accepted writes. */
+  private request(method: Method, params: Record<string, unknown>, onWritten?: () => void): Promise<unknown> {
+    this.budget.throwIfEnded();
+    if (this.closed || this.socket.readyState !== 1) throw new LocalMessagingError("daemon_unavailable", "Local Codex connection is closed.");
+    if (this.pending.size >= 4) throw new LocalMessagingError("rpc_limit", "Local Codex metadata concurrency limit exceeded.");
+    const id = ++this.nextId;
+    return new Promise((resolve, reject) => {
+      const timer = setTimeout(() => this.close(new LocalMessagingError("rpc_timeout", "Local Codex request timed out.")),
+        this.budget.remainingMs(this.rpcTimeoutMs));
+      this.pending.set(id, { resolve, reject, timer, method });
+      try { this.socket.send(JSON.stringify({ id, method, params })); onWritten?.(); } catch { this.close(); }
+    });
+  }
+
+  /** Settle matching bounded RPC frames; ignore notifications and sanitize remote errors. */
+  private receive(data: unknown): void {
+    try {
+      if (typeof data !== "string" || Buffer.byteLength(data) > 1024 * 1024) throw new Error();
+      const raw: unknown = JSON.parse(data);
+      if (!isRecord(raw)) throw new Error();
+      if (typeof raw.method === "string" && raw.id === undefined) return;
+      if (typeof raw.id !== "number" || !Number.isSafeInteger(raw.id)
+        || Object.hasOwn(raw, "result") === Object.hasOwn(raw, "error")) throw new Error();
+      const pending = this.pending.get(raw.id);
+      if (!pending) {
+        // During a one-shot submission an uncorrelated response cannot acknowledge our write.
+        if ([...this.pending.values()].some(request => request.method === "thread/queue/add")) throw new Error();
+        return;
+      }
+      let rejection: LocalMessagingError | undefined;
+      if (Object.hasOwn(raw, "error")) {
+        const error = raw.error;
+        if (!isRecord(error) || !Number.isSafeInteger(error.code) || typeof error.message !== "string") throw new Error();
+        if (pending.method === "thread/queue/add") {
+          const unsupported = error.code === -32601 || (error.code === -32600
+            && (error.message === "thread/queue/add requires experimentalApi capability"
+              || error.message.startsWith("Invalid request: unknown variant `thread/queue/add`")));
+          rejection = unsupported
+            ? new QueueRejection("unsupported_queue", "Your Codex daemon does not support local queueing (experimental thread/queue/add).")
+            : new QueueRejection("queue_rejected", "Codex rejected the local queue submission.");
+        } else rejection = new LocalMessagingError("rpc_rejected", "Codex rejected the local metadata request.");
+      }
+      this.pending.delete(raw.id);
+      clearTimeout(pending.timer);
+      if (rejection) pending.reject(rejection);
+      else pending.resolve(raw.result);
+    } catch { this.close(new LocalMessagingError("invalid_metadata", "Codex returned an invalid or oversized RPC frame.")); }
+  }
+}

package/src/messaging/send.ts

@@ -0,0 +1,58 @@
+import { MessageBudget } from "./budget";
+import { discoverLoaded, resolveLoaded } from "./discovery";
+import { messageEnvelope, validateMessage, type MessageOptions } from "./envelope";
+import { LocalMessageRpc } from "./rpc";
+import { localDaemonEndpoint } from "./socket";
+import { isThreadId, LocalMessagingError, type LocalThread } from "./types";
+
+export interface MessageReceipt {
+  schema: "ocx-message/1";
+  messageId: string;
+  kind: MessageOptions["kind"];
+  inReplyTo: string | null;
+  status: "not_sent" | "queued" | "unknown";
+  sender: { threadId: string; name: string | null; identitySource: "CODEX_THREAD_ID" } | null;
+  target: { threadId: string; name: string | null } | null;
+  error?: { code: string; message: string };
+}
+
+/** Expose caller-safe messaging errors without serializing arbitrary daemon output. */
+export function messageFailure(error: unknown) {
+  return error instanceof LocalMessagingError ? { code: error.code, message: error.message }
+    : { code: "messaging_failed", message: "Local messaging failed; private daemon output is not included." };
+}
+
+/** Return a complete loaded-session snapshot and close the command-owned RPC connection. */
+export async function localSessions(home: string, budget: MessageBudget): Promise<LocalThread[]> {
+  const rpc = await LocalMessageRpc.connect(localDaemonEndpoint(home).url, budget);
+  try { return await discoverLoaded(rpc, budget); } finally { rpc.close(); }
+}
+
+/** Revalidate and submit once on the discovery connection; never reconnect, resume or replay. */
+export async function sendLocalMessage(options: MessageOptions & { thread?: string; name?: string; body: string },
+  context: { home: string; senderId?: string }, budget: MessageBudget): Promise<MessageReceipt> {
+  const receipt: MessageReceipt = { schema: "ocx-message/1", messageId: crypto.randomUUID(), kind: options.kind,
+    inReplyTo: options.inReplyTo ?? null, status: "not_sent", sender: null, target: null };
+  let rpc: LocalMessageRpc | undefined;
+  try {
+    validateMessage(options, options.body);
+    if (context.senderId !== undefined && !isThreadId(context.senderId)) {
+      throw new LocalMessagingError("invalid_sender", "CODEX_THREAD_ID is not a UUID; sender identity cannot be inferred.");
+    }
+    const endpoint = localDaemonEndpoint(context.home);
+    rpc = await LocalMessageRpc.connect(endpoint.url, budget);
+    const threads = await discoverLoaded(rpc, budget);
+    const target = resolveLoaded(threads, options);
+    receipt.target = { threadId: target.id, name: target.name };
+    const sender = context.senderId ? resolveLoaded(threads, { thread: context.senderId }) : null;
+    receipt.sender = sender ? { threadId: sender.id, name: sender.name, identitySource: "CODEX_THREAD_ID" } : null;
+    const envelope = messageEnvelope(receipt.messageId, options, options.body, sender);
+    // Recheck the exact resolved ID, never re-resolve a name or reconnect by path.
+    const fresh = await rpc.readThread(target.id);
+    if (fresh.status === "notLoaded") throw new LocalMessagingError("target_not_loaded", "The destination unloaded before submission.");
+    budget.throwIfEnded();
+    Object.assign(receipt, await rpc.queueMessage(target.id, envelope.text, receipt.messageId));
+  } catch (error) { receipt.error = messageFailure(error); }
+  finally { rpc?.close(); }
+  return receipt;
+}

package/src/messaging/socket.ts

@@ -0,0 +1,72 @@
+import { lstatSync, readlinkSync, realpathSync } from "node:fs";
+import { basename, dirname, isAbsolute, join, resolve } from "node:path";
+import { LocalMessagingError } from "./types";
+
+export interface LocalSocket extends WebSocket { terminate(): void }
+interface SocketStat {
+  uid: number;
+  mode: number;
+  isSocket(): boolean;
+  isDirectory(): boolean;
+}
+export interface SocketFilesystem {
+  realpath(path: string): string;
+  lstat(path: string): SocketStat;
+}
+/** Bun on macOS cannot realpath a socket inode; resolve its parent and terminal symlinks. */
+function socketRealpath(path: string): string {
+  for (let links = 0; links < 40; links++) {
+    const parent = realpathSync(dirname(path));
+    const candidate = join(parent, basename(path));
+    if (!lstatSync(candidate).isSymbolicLink()) return candidate;
+    path = resolve(parent, readlinkSync(candidate));
+  }
+  throw new Error("Too many socket symlinks");
+}
+const filesystem: SocketFilesystem = { realpath: socketRealpath, lstat: lstatSync };
+
+/** Explicit home only: resolving or starting the user's daemon is not transport work. */
+export function localDaemonEndpoint(codexHome: string, platform = process.platform) {
+  const path = join(codexHome, "app-server-control", "app-server-control.sock");
+  if (!["linux", "darwin"].includes(platform) || !isAbsolute(codexHome)
+    || Buffer.byteLength(path) > 103 || /[:?#%\\\x00-\x1f]/.test(path)) {
+    throw new LocalMessagingError("unsupported_socket", "This local Codex control socket cannot be addressed on this platform.");
+  }
+  return { url: `ws+unix://${path}:/` };
+}
+
+/** StrictModes on the resolved endpoint and every ancestor; symlinked homes are permitted. */
+export function trustedSocketPath(path: string, fs: SocketFilesystem = filesystem,
+  uid = process.getuid?.()): string {
+  try {
+    if (uid === undefined) throw new Error();
+    const real = fs.realpath(path);
+    if (!isAbsolute(real)) throw new Error();
+    const socket = fs.lstat(real);
+    if (!socket.isSocket() || socket.uid !== uid) throw new Error();
+    for (let dir = dirname(real); ; dir = dirname(dir)) {
+      const stat = fs.lstat(dir);
+      if (!stat.isDirectory() || (stat.uid !== uid && stat.uid !== 0)
+        || ((stat.mode & 0o022) !== 0 && !(stat.uid === 0 && (stat.mode & 0o1000) !== 0))) throw new Error();
+      if (dir === "/") break;
+    }
+    return real;
+  } catch {
+    throw new LocalMessagingError("untrusted_socket", "The local Codex control socket or its parent directories are not trusted.");
+  }
+}
+
+/** Validate trust before opening the resolved Unix endpoint; never accept network transports. */
+export function localSocket(url: string): LocalSocket {
+  if (!["linux", "darwin"].includes(process.platform)
+    || !/^ws\+unix:\/\/\/[^:?#%\\\x00-\x1f]+:\/$/.test(url) || Buffer.byteLength(url.slice(10, -2)) > 103) {
+    throw new LocalMessagingError("unsupported_socket", "Messaging accepts only the local Unix control socket.");
+  }
+  const path = trustedSocketPath(url.slice(10, -2));
+  // A short alias does not bypass the actual Unix address budget or URL grammar.
+  if (Buffer.byteLength(path) > 103 || /[:?#%\\\x00-\x1f]/.test(path)) {
+    throw new LocalMessagingError("unsupported_socket", "Messaging accepts only the local Unix control socket.");
+  }
+  const Constructor = WebSocket as unknown as { new(url: string): LocalSocket };
+  return new Constructor(`ws+unix://${path}:/`);
+}

package/src/messaging/types.ts

@@ -0,0 +1,29 @@
+/** Typed failure whose message is safe for CLI receipts, never raw daemon or helper output. */
+export class LocalMessagingError extends Error {
+  /** Attach a stable failure code to caller-authored, sanitized explanatory text. */
+  constructor(readonly code: string, message: string) {
+    super(message);
+    this.name = "LocalMessagingError";
+  }
+}
+
+/** Narrow an untrusted RPC value to a non-null, non-array object before field validation. */
+export function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+/** Accept UUID-shaped thread/correlation IDs, not names or command fragments. */
+export function isThreadId(value: unknown): value is string {
+  return typeof value === "string" && /^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i.test(value);
+}
+
+export interface LocalThread {
+  id: string;
+  name: string | null;
+  status: "idle" | "active" | "systemError" | "notLoaded";
+}
+
+export interface LocalMetadataClient {
+  loadedPage(cursor?: string): Promise<{ data: string[]; nextCursor: string | null }>;
+  readThread(id: string): Promise<LocalThread>;
+}

package/src/oauth/anthropic-account-refusal.ts

@@ -1,21 +1,34 @@
 import { anthropicModelFamily } from "./anthropic-model-quota";
 /** Narrow pre-output account recovery, fenced to the bearer that physically sent the turn. */
 import { readBoundedResponseBody } from "../lib/bounded-body";
-import { classifyAnthropic429, anthropicRetryAfterMs, pauseAnthropicRateAdmission, anthropicRatePauseUntil, ANTHROPIC_SHORT_RETRY_MS, ANTHROPIC_MAX_INLINE_THROTTLE_MS } from "./anthropic-rate-limit-policy";
+import { classifyAnthropic429, anthropicRetryAfterMs, anthropicRatePolicyFor, ANTHROPIC_SHORT_RETRY_MS, ANTHROPIC_MAX_INLINE_THROTTLE_MS } from "./anthropic-rate-limit-policy";
 import { isNonReplayableResponse, sleepWithAbort } from "../lib/upstream-retry";
 import { credentialGeneration, getAccountCredentialWithStatus } from "./store";
 import type { OAuthAccessSnapshot } from "./index";
 import type { OcxConfig } from "../types";
 import type { AnthropicRouteDecision } from "./anthropic-model-routes";
-import { recordAnthropicAccountRefusal, rotateAnthropicAccountOnRefusal, hasAnthropicFailoverQuorum, isAnthropicAccountPoolEnabled, pickAlternateAnthropicAccount } from "./anthropic-routing";
+import { anthropicRoutingFor } from "./anthropic-routing";
+import { configuredAnthropicInstance } from "../providers/anthropic-instance";
+import type { AnthropicInstanceId } from "../providers/anthropic-instance-id";
+import { captureAnthropicPhysicalSendOwnership, anthropicPhysicalSendOwnershipIsCurrent,
+  type AnthropicPhysicalSendOwnership } from "./anthropic-send-ownership";
 
-const responseCredentials = new WeakMap<Response, Pick<OAuthAccessSnapshot, "accountId" | "generation"> & { providerAccountUuid?: string; checkProviderUuid: boolean }>();
-const retryStates = new WeakMap<object, { firstAccountId: string; sameAccount: boolean; detour: boolean }>();
+const responseCredentials = new WeakMap<Response, AnthropicPhysicalSendOwnership & { providerAccountUuid?: string; checkProviderUuid: boolean }>();
+type RetryState = { firstAccountId: string; sameAccount: boolean; detour: boolean };
+const retryStatesByInstance = new Map<AnthropicInstanceId, WeakMap<object, RetryState>>();
 const verdicts = new WeakMap<Response, Promise<boolean>>();
 
-/** Called only when the outgoing headers prove ownership of the selected stored bearer. */
+/** Legacy compatibility only; physical callers must capture ownership before fetch and use ForSend. */
 export function bindAnthropicRefusalCredential(response: Response, snapshot: OAuthAccessSnapshot, providerAccountUuid?: string): void {
-  responseCredentials.set(response, { accountId: snapshot.accountId, generation: snapshot.generation, providerAccountUuid, checkProviderUuid: arguments.length >= 3 });
+  const owner = captureAnthropicPhysicalSendOwnership(snapshot);
+  if (!owner) { responseCredentials.delete(response); return; }
+  if (arguments.length >= 3) bindAnthropicRefusalCredentialForSend(response, owner, providerAccountUuid);
+  else bindAnthropicRefusalCredentialForSend(response, owner);
+}
+
+/** Retain the pre-send owner even when stale; binding a returned response cannot renew its authority. */
+export function bindAnthropicRefusalCredentialForSend(response: Response, owner: AnthropicPhysicalSendOwnership, providerAccountUuid?: string): void {
+  responseCredentials.set(response, Object.freeze({ ...owner, providerAccountUuid, checkProviderUuid: arguments.length >= 3 }));
 }
 
 async function isAccountRefusal(response: Response, signal?: AbortSignal): Promise<boolean> {
@@ -41,7 +54,8 @@ async function isAccountRefusal(response: Response, signal?: AbortSignal): Promi
   }
 }
 
-export async function rotateAnthropicAccountOnResponse(
+export async function rotateAnthropicAccountOnResponseForInstance(
+  instance: AnthropicInstanceId,
   response: Response,
   options: {
     config: OcxConfig;
@@ -61,13 +75,25 @@ export async function rotateAnthropicAccountOnResponse(
     currentDecision?: () => AnthropicRouteDecision | null;
   },
 ): Promise<string | null> {
-  if (options.signal?.aborted || isNonReplayableResponse(response)) return null;
+  if (options.signal?.aborted || isNonReplayableResponse(response)
+    || configuredAnthropicInstance(options.config, instance) !== instance) return null;
+  const sent = responseCredentials.get(response);
+  if (!sent || sent.provider !== instance || sent.accountId !== options.accountId) return null;
+  const routing = anthropicRoutingFor(instance);
+  const { pauseAnthropicRateAdmission, anthropicRatePauseUntil } = anthropicRatePolicyFor(instance);
+  const { recordAnthropicAccountRefusal, rotateAnthropicAccountOnRefusal,
+    hasAnthropicFailoverQuorum, isAnthropicAccountPoolEnabled, pickAlternateAnthropicAccount } = routing;
+  const ownedCurrent = () => {
+    if (configuredAnthropicInstance(options.config, instance) !== instance
+      || !anthropicPhysicalSendOwnershipIsCurrent(sent)) return undefined;
+    const row = getAccountCredentialWithStatus(instance, sent.accountId);
+    return row && !row.needsReauth && row.credential.access === sent.accessToken
+      && credentialGeneration(row.credential) === sent.generation
+      && (!sent.checkProviderUuid || row.credential.accountId === sent.providerAccountUuid) ? row : undefined;
+  };
   if (response.status === 429) {
-    const sent = responseCredentials.get(response);
-    const current = sent && getAccountCredentialWithStatus("anthropic", sent.accountId);
-    if (!sent || sent.accountId !== options.accountId || !current || current.needsReauth
-      || credentialGeneration(current.credential) !== sent.generation
-      || sent.checkProviderUuid && current.credential.accountId !== sent.providerAccountUuid) return null;
+    const current = ownedCurrent();
+    if (!current) return null;
     options.currentDecision?.();
     const kind = classifyAnthropic429(response.headers);
     if (kind === "family-quota") {
@@ -80,6 +106,8 @@ export async function rotateAnthropicAccountOnResponse(
       const delay = anthropicRetryAfterMs(response.headers.get("retry-after"), now) ?? ANTHROPIC_SHORT_RETRY_MS;
       if (kind === "transient-rate") pauseAnthropicRateAdmission(sent.accountId, now + delay);
       if (!options.canRetry || options.allow429Recovery === false || !options.requestKey) return null;
+      let retryStates = retryStatesByInstance.get(instance);
+      if (!retryStates) { retryStates = new WeakMap(); retryStatesByInstance.set(instance, retryStates); }
       let state = retryStates.get(options.requestKey);
       if (!state) { state = { firstAccountId: sent.accountId, sameAccount: false, detour: false }; retryStates.set(options.requestKey, state); }
       // A concurrent committed selection may have moved the same-account proposal.
@@ -90,7 +118,7 @@ export async function rotateAnthropicAccountOnResponse(
         // Millisecond rounding can wake just before this deadline; later extensions still bind.
         const retryAt = now + wait;
         try { await sleepWithAbort(wait, options.signal); } catch { return null; }
-        const live = getAccountCredentialWithStatus("anthropic", sent.accountId);
+        const live = ownedCurrent();
         if (!live || live.paused || live.needsReauth || options.signal?.aborted
           || credentialGeneration(live.credential) !== sent.generation
           || sent.checkProviderUuid && live.credential.accountId !== sent.providerAccountUuid
@@ -111,8 +139,6 @@ export async function rotateAnthropicAccountOnResponse(
     }
   } else {
     if (response.status !== 403 || options.allowAccountRefusal === false) return null;
-    const sent = responseCredentials.get(response);
-    if (!sent || sent.accountId !== options.accountId) return null;
     let verdict = verdicts.get(response);
     if (!verdict) {
       verdict = isAccountRefusal(response, options.signal);
@@ -120,7 +146,7 @@ export async function rotateAnthropicAccountOnResponse(
     }
     if (!await verdict || options.signal?.aborted) return null;
     // A late refusal must not cool a new credential stored while its body was being read.
-    const current = getAccountCredentialWithStatus("anthropic", sent.accountId);
+    const current = ownedCurrent();
     if (!current || current.paused || current.needsReauth || credentialGeneration(current.credential) !== sent.generation
       || sent.checkProviderUuid && current.credential.accountId !== sent.providerAccountUuid) return null;
   }
@@ -134,3 +160,11 @@ export async function rotateAnthropicAccountOnResponse(
   return rotateAnthropicAccountOnRefusal(options.config, options.accountId, status,
     response.headers.get("retry-after"), options.sessionKey, Date.now(), response.headers, decision, options.model, options.excludedAccountIds);
 }
+
+/** Compatibility entrypoint: legacy consumers always recover inside the primary pool. */
+export function rotateAnthropicAccountOnResponse(
+  response: Response,
+  options: Parameters<typeof rotateAnthropicAccountOnResponseForInstance>[2],
+): Promise<string | null> {
+  return rotateAnthropicAccountOnResponseForInstance("anthropic", response, options);
+}

package/src/oauth/anthropic-account-threshold.ts

@@ -1,3 +1,5 @@
+import type { AnthropicInstanceId } from "../providers/anthropic-instance-id";
+import { resolveAnthropicAccountPoolConfig } from "./anthropic-pool-config";
 import type { OcxConfig } from "../types";
 import type { ProviderAccount } from "./types";
 
@@ -7,7 +9,11 @@ export function parseAnthropicAccountThreshold(value: unknown): number | null {
 }
 
 /** Missing or malformed legacy metadata inherits; concrete zero must survive nullish fallback. */
-export function effectiveAnthropicAccountThreshold(config: OcxConfig, account?: Pick<ProviderAccount, "autoSwitchThresholdOverride">): number {
+export function effectiveAnthropicAccountThresholdForInstance(instance: AnthropicInstanceId, config: OcxConfig, account?: Pick<ProviderAccount, "autoSwitchThresholdOverride">): number {
   return parseAnthropicAccountThreshold(account?.autoSwitchThresholdOverride)
-    ?? parseAnthropicAccountThreshold(config.anthropicAccountPool?.autoSwitchThreshold) ?? 80;
+    ?? parseAnthropicAccountThreshold(resolveAnthropicAccountPoolConfig(config, instance).autoSwitchThreshold) ?? 80;
+}
+
+export function effectiveAnthropicAccountThreshold(config: OcxConfig, account?: Pick<ProviderAccount, "autoSwitchThresholdOverride">): number {
+  return effectiveAnthropicAccountThresholdForInstance("anthropic", config, account);
 }

package/src/oauth/anthropic-continuity.ts

@@ -3,6 +3,7 @@ import { normalizeAnthropicIdentity, resolveAnthropicAccountIdentity, type Anthr
 import { credentialGeneration, type AuthStore } from "./store";
 import { REFRESH_SKEW_MS } from "./refresh-policy";
 import type { OAuthCredentials, ProviderAccountSet } from "./types";
+import type { AnthropicInstanceId } from "../providers/anthropic-instance-id";
 
 export type ClaudeCredentialObservation =
   | { kind: "absent" }
@@ -13,6 +14,14 @@ export async function newerClaudeCredential(
   stored: OAuthCredentials, now: number, signal?: AbortSignal,
   resolveIdentity: AnthropicIdentityResolver = resolveAnthropicAccountIdentity,
 ): Promise<ClaudeCredentialObservation> {
+  return newerClaudeCredentialForInstance("anthropic", stored, now, signal, resolveIdentity);
+}
+
+export async function newerClaudeCredentialForInstance(
+  instance: AnthropicInstanceId, stored: OAuthCredentials, now: number, signal?: AbortSignal,
+  resolveIdentity: AnthropicIdentityResolver = resolveAnthropicAccountIdentity,
+): Promise<ClaudeCredentialObservation> {
+  if (instance === "anthropic2") return { kind: "absent" };
   if (stored.source !== "local-cli") return { kind: "absent" };
   const disk = detectClaudeCodeToken();
   if (!disk || !Number.isFinite(disk.expires) || disk.expires <= now + REFRESH_SKEW_MS
@@ -39,6 +48,10 @@ export async function newerClaudeCredential(
 
 /** Capture primitives before network awaits; check them again inside the serialized writer. */
 export function captureAnthropicCredentialOwner(set: ProviderAccountSet, accountId: string) {
+  return captureAnthropicCredentialOwnerForInstance("anthropic", set, accountId);
+}
+
+export function captureAnthropicCredentialOwnerForInstance(instance: AnthropicInstanceId, set: ProviderAccountSet, accountId: string) {
   const row = set.accounts.find(account => account.id === accountId)!;
   const loginId = row.loginId;
   const generation = credentialGeneration(row.credential);
@@ -46,12 +59,13 @@ export function captureAnthropicCredentialOwner(set: ProviderAccountSet, account
   const needsReauth = row.needsReauth;
   const selection = { id: set.activeAccountId, revision: set.selectionRevision };
   return (store: AuthStore, diskGeneration?: string, allowPaused = false): boolean => {
-    const current = store["anthropic"];
+    const current = store[instance];
     const account = current?.accounts.find(candidate => candidate.id === accountId);
     if (!account || (!allowPaused && account.paused) || account.loginId !== loginId
       || account.needsReauth !== needsReauth || credentialGeneration(account.credential) !== generation
       || identityMetadata(account.credential) !== metadata) return false;
     if (diskGeneration !== undefined) {
+      if (instance === "anthropic2") return false;
       if (current?.activeAccountId !== selection.id || current?.selectionRevision !== selection.revision) return false;
       const disk = detectClaudeCodeToken();
       if (!disk || disk.expires <= Date.now() + REFRESH_SKEW_MS || credentialGeneration(disk) !== diskGeneration) return false;