@bitkyc08/opencodex 2.79.0 → 2.81.0

package/src/providers/anthropic-instance.ts

@@ -0,0 +1,48 @@
+/**
+ * Registry- and config-aware Anthropic instance checks. See `./anthropic-instance-id.ts` for the IDs and
+ * the pure row-shape rule; this module adds the registry declaration and the configured-row lookup.
+ *
+ * Instance membership is never inferred from `adapter === "anthropic"` (the API-key provider and
+ * Anthropic-compatible gateways share that adapter) or from a name prefix.
+ */
+import type { OcxConfig, OcxProviderConfig } from "../types";
+import { getProviderRegistryEntry } from "./registry";
+import { anthropicInstanceRowShapeMatches, isAnthropicInstanceId, type AnthropicInstanceId } from "./anthropic-instance-id";
+
+export * from "./anthropic-instance-id";
+
+/** Exact registry check: one of the two IDs, declared as an Anthropic-family OAuth entry with its own OAuth ID. */
+export function isAnthropicOAuthInstance(id: string | undefined): id is AnthropicInstanceId {
+  if (!isAnthropicInstanceId(id)) return false;
+  const entry = getProviderRegistryEntry(id);
+  return entry !== undefined
+    && entry.authKind === "oauth"
+    && entry.oauthId === id
+    && entry.oauthFamily === "anthropic";
+}
+
+export function isBuiltinAnthropicInstanceRow(
+  name: string,
+  row?: Partial<Pick<OcxProviderConfig, "adapter" | "authMode" | "baseUrl" | "anthropicOAuthInstance">>,
+): boolean {
+  return isAnthropicOAuthInstance(name) && anthropicInstanceRowShapeMatches(name, row);
+}
+
+/**
+ * The instance a configured provider name runs as, or undefined.
+ *
+ * For `anthropic` this is a compatibility identity result: it returns the instance whenever the name is
+ * `anthropic`, and callers keep every auth-mode, enabled-provider and eligibility check they already
+ * apply. For `anthropic2` the row must exist, must not be disabled and must pass the builtin row-shape
+ * rule, so an orphan `anthropic2` auth row or a custom provider of that name never activates the pool.
+ */
+export function configuredAnthropicInstance(
+  config: Pick<OcxConfig, "providers">,
+  name: string | undefined,
+): AnthropicInstanceId | undefined {
+  if (!isAnthropicOAuthInstance(name)) return undefined;
+  if (name === "anthropic") return "anthropic";
+  const row = config.providers?.[name];
+  if (!row || row.disabled === true) return undefined;
+  return anthropicInstanceRowShapeMatches(name, row) ? name : undefined;
+}

package/src/providers/anthropic-reset-grant-ledger.ts

@@ -21,6 +21,7 @@ import { existsSync, mkdirSync, readFileSync, writeSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { atomicWriteFileStreamed } from "../config/atomic-write";
 import { getConfigDir } from "../config/paths";
+import type { AnthropicInstanceId } from "./anthropic-instance-id";
 
 export const ANTHROPIC_RESET_LEASE_MS = 90_000;
 export const ANTHROPIC_RESET_RETRY_WINDOW_MS = 600_000;
@@ -83,7 +84,16 @@ export function anthropicOrgDigest(organizationUuid: string): string {
 }
 
 export function anthropicResetJournalPath(customDir?: string): string {
-  return join(customDir ?? getConfigDir(), "anthropic-reset-grant-ledger.json");
+  return anthropicResetJournalPathForInstance("anthropic", customDir);
+}
+
+export function anthropicResetJournalPathForInstance(instance: AnthropicInstanceId, customDir?: string): string {
+  return join(customDir ?? getConfigDir(), `${instance}-reset-grant-ledger.json`);
+}
+
+/** Namespace is in the path; A's version-1 journal bytes and record schema stay unchanged. */
+export function anthropicResetLedgerOptionsForInstance(instance: AnthropicInstanceId, customDir?: string): AnthropicResetLedgerOptions {
+  return { journalPath: anthropicResetJournalPathForInstance(instance, customDir) };
 }
 
 function isRecordShape(value: unknown): value is OperationRecord {

package/src/providers/derive.ts

@@ -245,6 +245,8 @@ export function providerConfigSeed(entry: ProviderRegistryEntry): OcxProviderCon
     // Preserve the registry auth kind verbatim (including "local") so fail-closed gates that
     // distinguish local runtimes from API-key providers keep working after the seed round-trip.
     authMode: entry.authKind,
+    ...(entry.id === "anthropic2" && entry.authKind === "oauth" && entry.oauthFamily === "anthropic"
+      ? { anthropicOAuthInstance: "anthropic2" as const } : {}),
     ...(entry.codexAccountMode ? { codexAccountMode: entry.codexAccountMode } : {}),
     ...(entry.keyOptional !== undefined ? { keyOptional: entry.keyOptional } : {}),
     ...(entry.freeTier !== undefined ? { freeTier: entry.freeTier } : {}),

package/src/providers/kiro-models.ts

@@ -25,6 +25,8 @@ export const KIRO_MODELS = [
   "claude-sonnet-4.6",
   "claude-sonnet-4.5",
   "claude-sonnet-4.0",
+  // 261008 preemptive: Haiku 5.5; calls fail upstream until Kiro ships it.
+  "claude-haiku-5.5",
   "claude-haiku-4.5",
   "deepseek-3.2",
   "minimax-m2.5",
@@ -55,6 +57,7 @@ export const KIRO_MODEL_CONTEXT_WINDOWS: Record<string, number> = {
   "claude-sonnet-4.6": 1_000_000,
   "claude-sonnet-4.5": 200_000,
   "claude-sonnet-4.0": 200_000,
+  "claude-haiku-5.5": 1_000_000,
   "claude-haiku-4.5": 200_000,
   "deepseek-3.2": 128_000,
   "minimax-m2.5": 200_000,

package/src/providers/label.ts

@@ -89,6 +89,6 @@ export function stampOAuthAccountLabel(
   if (!accountId) return;
   if (provider.authMode !== "oauth") return;
   const base = baseProviderLabel(providerName);
-  if (base === "openai" || base === "anthropic") return;
+  if (base === "openai" || (base === "anthropic" || base === "anthropic2")) return;
   logCtx.accountLogLabel = oauthAccountLogLabel(accountId, base);
 }

package/src/providers/model-rename-fields.ts

@@ -78,6 +78,8 @@ export const PROVIDER_MODEL_RENAME_ROLES = {
   modelVercelGatewayRouting: "record",
   authMode: "none",
   oauthAccountFailover: "none",
+  anthropicAccountPool: "none",
+  anthropicOAuthInstance: "none",
   keyOptional: "none",
   freeTier: "none",
   note: "none",

package/src/providers/quota/account-cache.ts

@@ -1,8 +1,9 @@
 import { parseAnthropicFamilyHeaders, mergeAnthropicFamilyWindows } from "./anthropic-family-headers";
-import { observeAnthropicFamilyQuota, clearAnthropicRequestedFamilyQuota, ANTHROPIC_PASSIVE_FAMILY_MAX_AGE_MS } from "../../oauth/anthropic-model-quota";
+import { anthropicModelQuotaFor, ANTHROPIC_PASSIVE_FAMILY_MAX_AGE_MS } from "../../oauth/anthropic-model-quota";
 import { createHash } from "node:crypto";
 import { getValidAccessTokenForAccount } from "../../oauth";
 import { credentialGeneration, getAccountCredential, getAccountCredentialWithStatus, getAccountSet } from "../../oauth/store";
+import { isAnthropicInstanceId, type AnthropicInstanceId } from "../anthropic-instance-id";
 import type { GenerationContext } from "../../lib/state-store-sweeper";
 import { ACCOUNT_QUOTA_TTL_MS, toFiniteNumber } from "../quota-wire";
 import { clearKiroAccountUsageState, hydrateKiroUsageVerdict, kiroPersistableVerdicts, reconcileKiroAccountUsageState } from "../kiro-usage";
@@ -96,8 +97,19 @@ export function normalizeAnthropicQuota(quota: ProviderQuota | null | undefined,
   return hasQuotaRows(result) ? result : null;
 }
 
+function isAnthropicAccountCacheKey(key: string): boolean {
+  const separator = key.indexOf("\0");
+  return separator > 0 && isAnthropicInstanceId(key.slice(0, separator));
+}
+
 export const accountQuotaCache = new Map<string, AccountQuotaCacheEntry>();
 export let explicitAccountEpoch = 0;
+let allAccountQuotaEpoch = 0;
+const providerAccountQuotaEpochs = new Map<string, number>();
+/** Instance-owned cache clears do not revoke an unrelated account's probe. */
+export function captureProviderAccountQuotaEpoch(provider: string): number {
+  return allAccountQuotaEpoch + (providerAccountQuotaEpochs.get(provider) ?? 0);
+}
 
 /**
  * Seed the cache from the last run, once.
@@ -127,7 +139,7 @@ export function hydrateAccountQuotaCache(): void {
     }
     // Disk stores observation time, not the Anthropic usage probe's clock.
     if (!accountQuotaCache.has(key)) {
-      const anthropic = key.startsWith("anthropic\u0000");
+      const anthropic = isAnthropicAccountCacheKey(key);
       accountQuotaCache.set(key, {
         ts: anthropic ? 0 : quota.updatedAt,
         quota: anthropic ? normalizeAnthropicQuota(quota, now)
@@ -148,7 +160,7 @@ export function persistAccountQuotaCache(): void {
     const liveKiro = new Map<string, ProviderAccount>(getAccountSet("kiro")?.accounts.map(account =>
       [accountCacheKey("kiro", account.id), account]) ?? []);
     for (const [key, entry] of accountQuotaCache) {
-      const quota = key.startsWith("anthropic\u0000") ? normalizeAnthropicQuota(entry.quota, now) : entry.quota;
+      const quota = isAnthropicAccountCacheKey(key) ? normalizeAnthropicQuota(entry.quota, now) : entry.quota;
       if (quota && key.startsWith("kiro\0")) {
         const account = liveKiro.get(key);
         if (account && entry.identity === kiroEvidenceIdentity(account))
@@ -182,7 +194,7 @@ export interface ProviderAccountQuota {
 
 /** Providers whose per-account quota can be probed. Extend as other OAuth APIs are covered. */
 export function supportsPerAccountQuota(provider: string): boolean {
-  return provider === "anthropic" || provider === "kiro" || provider === "google-antigravity"
+  return isAnthropicInstanceId(provider) || provider === "kiro" || provider === "google-antigravity"
     || explicitAccountReader(provider);
 }
 
@@ -209,12 +221,12 @@ export function getCachedProviderAccountQuota(provider: string, accountId: strin
     const account = getAccountSet("kiro")?.accounts.find(row => row.id === accountId);
     if (!account || entry?.identity !== kiroEvidenceIdentity(account)) return null;
   }
-  if (provider === "anthropic" && entry?.anthropicCredentialGeneration) {
+  if (isAnthropicInstanceId(provider) && entry?.anthropicCredentialGeneration) {
     const credential = getAccountCredential(provider, accountId);
     if (!credential || credentialGeneration(credential) !== entry.anthropicCredentialGeneration) return null;
   }
   if (entry?.isCurrent && !entry.isCurrent()) return null;
-  return provider === "anthropic" ? normalizeAnthropicQuota(entry?.quota, Date.now()) : entry?.quota ?? null;
+  return isAnthropicInstanceId(provider) ? normalizeAnthropicQuota(entry?.quota, Date.now()) : entry?.quota ?? null;
 }
 
 /** Test-only: seed or clear the per-account quota cache without probing upstream. */
@@ -270,7 +282,8 @@ function normalizeUtilizationFraction(value: string | null): number | undefined
  * erasing model-specific windows. The caller owns credential attribution; this guard
  * prevents a retired account key from being revived by an older config generation.
  */
-export function recordAnthropicAccountQuotaFromHeaders(
+export function recordAnthropicAccountQuotaFromHeadersForInstance(
+  instance: AnthropicInstanceId,
   accountId: string,
   headers: Headers,
   writerGeneration: number,
@@ -278,7 +291,8 @@ export function recordAnthropicAccountQuotaFromHeaders(
   model?: string,
 ): void {
   if (!accountId) return;
-  const key = accountCacheKey("anthropic", accountId);
+  const key = accountCacheKey(instance, accountId);
+  const { observeAnthropicFamilyQuota, clearAnthropicRequestedFamilyQuota } = anthropicModelQuotaFor(instance);
   if (!mayCommitAccountQuotaKey(key, writerGeneration)) return;
   if (status !== undefined && status >= 200 && status < 300) clearAnthropicRequestedFamilyQuota(accountId, model);
   const observed = parseAnthropicRateLimitHeaders(headers, status);
@@ -289,7 +303,7 @@ export function recordAnthropicAccountQuotaFromHeaders(
   // every other provider's saved row.
   hydrateAccountQuotaCache();
   const candidate = accountQuotaCache.get(key);
-  const credential = getAccountCredential("anthropic", accountId);
+  const credential = getAccountCredential(instance, accountId);
   const generation = credential && credentialGeneration(credential);
   const previous = candidate?.isCurrent?.() === false
     || candidate?.anthropicCredentialGeneration && candidate.anthropicCredentialGeneration !== generation ? undefined : candidate;
@@ -307,6 +321,13 @@ export function recordAnthropicAccountQuotaFromHeaders(
   persistAccountQuotaCache();
 }
 
+/** Legacy recorder: config/roster generation is numeric and distinct from bearer ownership. */
+export function recordAnthropicAccountQuotaFromHeaders(
+  accountId: string, headers: Headers, writerGeneration: number, status?: number, model?: string,
+): void {
+  recordAnthropicAccountQuotaFromHeadersForInstance("anthropic", accountId, headers, writerGeneration, status, model);
+}
+
 /**
  * Providers whose per-account quota is OBSERVED in-band, never probed.
  *
@@ -380,7 +401,7 @@ export function sweepExpiredProviderAccountQuotaRows(now = Date.now()): number {
   let removed = 0;
   for (const [key, entry] of accountQuotaCache) {
     // Anthropic observations extend retention, never the usage probe's eligibility clock.
-    const retainedAt = key.startsWith("anthropic\u0000")
+    const retainedAt = isAnthropicAccountCacheKey(key)
       ? Math.max(entry.ts, entry.quota?.updatedAt ?? 0)
       : entry.ts;
     if (retainedAt + ACCOUNT_QUOTA_TTL_MS > now) continue;
@@ -425,8 +446,10 @@ export function resetProviderQuotaReconcileStateForTests(): void {
 
 /** Drop cached per-account rows (all, or just one provider's). */
 export function clearAccountQuotaCache(provider?: string): void {
-  explicitAccountEpoch += 1;
+  // Anthropic readers use provider-owned epochs; B cannot revoke an A flight.
+  if (provider !== "anthropic2") explicitAccountEpoch += 1;
   if (!provider) {
+    allAccountQuotaEpoch += 1;
     accountQuotaCache.clear();
     accountQuotaInflight.clear();
     clearKiroAccountUsageState();
@@ -436,6 +459,7 @@ export function clearAccountQuotaCache(provider?: string): void {
     cancelPendingAccountQuotaPersist();
     return;
   }
+  providerAccountQuotaEpochs.set(provider, (providerAccountQuotaEpochs.get(provider) ?? 0) + 1);
   hydrateAccountQuotaCache();
   const prefix = `${provider}\u0000`;
   for (const key of [...accountQuotaCache.keys()]) {
@@ -464,7 +488,9 @@ export async function getTokenForAccountQuotaProbe(provider: string, accountId:
   const row = getAccountCredentialWithStatus(provider, accountId);
   if (!row) throw new Error("account credential missing");
   // An operator-paused account is excluded from every automatic upstream use, quota reads included.
+  // Anthropic instances also skip a needs-reauth row; other providers keep their probe behavior.
   if (row.paused) throw new Error("account is paused; quota probe skipped");
+  if (row.needsReauth && isAnthropicInstanceId(provider)) throw new Error("account needs sign-in; quota probe skipped");
   const stored = row.credential;
   if (stored.expires > Date.now() + ACCOUNT_TOKEN_SKEW_MS) return stored.access;
   const activeId = getAccountSet(provider)?.activeAccountId;

package/src/providers/quota/anthropic-account-quota.ts

@@ -0,0 +1,93 @@
+import { loadConfig } from "../../config";
+import type { OcxConfig } from "../../types";
+import { getAccountSet } from "../../oauth/store";
+import { captureConfigGeneration, sweepExpiredOnWrite } from "../../lib/state-store-sweeper";
+import { configuredAnthropicInstance, type AnthropicInstanceId } from "../anthropic-instance";
+import { ACCOUNT_QUOTA_TTL_MS } from "../quota-wire";
+import { fetchAnthropicUsageQuotaForInstance } from "./vendor-probes-oauth";
+import { AnthropicQuotaProbeOwnershipError, anthropicCooldownRecoveryFor, type AnthropicQuotaRecoveryResult } from "./anthropic-cooldown-recovery";
+import {
+  accountCacheKey, accountQuotaCache, accountQuotaInflight, captureProviderAccountQuotaEpoch,
+  getTokenForAccountQuotaProbe, hydrateAccountQuotaCache, mayCommitAccountQuotaKey,
+  normalizeAnthropicQuota, type AccountQuotaCacheEntry,
+} from "./account-cache";
+
+/**
+ * Resolve renewal first: a flight always belongs to the credential actually dispatched.
+ * `config` is the caller's live object. Currency re-reads that one object, never a fresh file
+ * load, so memory/disk drift cannot refuse every probe; commit authority stays with the
+ * captured writer generation.
+ */
+export async function fetchAnthropicAccountQuota(
+  instance: AnthropicInstanceId, accountId: string, force: boolean, config: OcxConfig = loadConfig(),
+): Promise<AccountQuotaCacheEntry> {
+  const unavailable = (): AccountQuotaCacheEntry => ({ ts: Date.now(), quota: null, unavailable: true });
+  const target = config.providers[instance];
+  if (target?.disabled || target && target.authMode !== "oauth" || configuredAnthropicInstance(config, instance) !== instance) return unavailable();
+  const targetIdentity = JSON.stringify(target);
+  const epoch = captureProviderAccountQuotaEpoch(instance);
+  const initialRow = getAccountSet(instance)?.accounts.find(row => row.id === accountId);
+  if (!initialRow) return unavailable();
+  const recovery = anthropicCooldownRecoveryFor(instance);
+  const incarnation = recovery.reserveAnthropicAccountIncarnation(accountId);
+  const ownerCurrent = () => {
+    const row = getAccountSet(instance)?.accounts.find(row => row.id === accountId);
+    return epoch === captureProviderAccountQuotaEpoch(instance)
+      && configuredAnthropicInstance(config, instance) === instance
+      && JSON.stringify(config.providers[instance]) === targetIdentity
+      && recovery.anthropicAccountIncarnation(accountId) === incarnation
+      && !!row && row.loginId === initialRow.loginId && row.addedAt === initialRow.addedAt;
+  };
+  hydrateAccountQuotaCache();
+  const key = accountCacheKey(instance, accountId);
+  const candidate = accountQuotaCache.get(key);
+  const cached = candidate?.isCurrent?.() === false ? undefined : candidate;
+  if (!force && cached && Date.now() - cached.ts < ACCOUNT_QUOTA_TTL_MS) {
+    return { ...cached, quota: normalizeAnthropicQuota(cached.quota, Date.now()) };
+  }
+  let token: string;
+  try { token = await getTokenForAccountQuotaProbe(instance, accountId); }
+  catch { return unavailable(); }
+  if (!ownerCurrent()) return unavailable();
+  const flightKey = recovery.anthropicCredentialQuotaFlightKey(key, accountId);
+  const flightCurrent = () => ownerCurrent()
+    && recovery.anthropicCredentialQuotaFlightKey(key, accountId) === flightKey;
+  const joinable = accountQuotaInflight.get(flightKey);
+  if (joinable) {
+    const joined = await joinable;
+    return ownerCurrent() && (joined.isCurrent?.() ?? flightCurrent()) ? joined : unavailable();
+  }
+  const writerGeneration = captureConfigGeneration();
+  // One publication path for a result and for a failed dispatch. A null result (HTTP refusal)
+  // and a thrown read (network failure) both record the unavailable row over the retained
+  // in-flight observations, as the pre-instance A path did, so joined callers and later cached
+  // reads agree and windows that expired during the shared probe are normalized away.
+  const publish = (result: AnthropicQuotaRecoveryResult | null): AccountQuotaCacheEntry => {
+    const previous = accountQuotaCache.get(key);
+    const retained = previous?.isCurrent?.() === false ? undefined : previous;
+    const isCurrent = result?.isCurrent ?? flightCurrent;
+    const entry: AccountQuotaCacheEntry = {
+      ts: Date.now(), quota: normalizeAnthropicQuota(result?.quota ?? retained?.quota, Date.now()),
+      ...(!result ? { unavailable: true as const } : {}), isCurrent,
+    };
+    if (isCurrent() && mayCommitAccountQuotaKey(key, writerGeneration)) { accountQuotaCache.set(key, entry); sweepExpiredOnWrite(entry.ts); }
+    return entry;
+  };
+  const probe = (async (): Promise<AccountQuotaCacheEntry> => {
+    try {
+      const result = await recovery.probeAnthropicQuotaWithRecovery(accountId, token, fresh => {
+        if (!flightCurrent()) throw new AnthropicQuotaProbeOwnershipError("quota flight changed");
+        recovery.assertAnthropicQuotaSendAllowed(accountId, token);
+        return fetchAnthropicUsageQuotaForInstance(instance, token, fresh);
+      }, () => ownerCurrent() && mayCommitAccountQuotaKey(key, writerGeneration));
+      if (result && !result.isCurrent()) return unavailable();
+      if (!result && !flightCurrent()) return unavailable();
+      return publish(result);
+    } catch (error) {
+      if (error instanceof AnthropicQuotaProbeOwnershipError || !flightCurrent()) return unavailable();
+      return publish(null);
+    }
+  })().finally(() => { if (accountQuotaInflight.get(flightKey) === probe) accountQuotaInflight.delete(flightKey); });
+  accountQuotaInflight.set(flightKey, probe);
+  return probe;
+}