@bitkyc08/opencodex 2.79.0 → 2.81.0

package/src/providers/quota.ts

@@ -1,4 +1,6 @@
 import { listCodexAuthAccountsSnapshot } from "../codex/auth-api";
+import { isAnthropicInstanceId, configuredAnthropicInstance } from "./anthropic-instance";
+import { fetchAnthropicAccountQuota } from "./quota/anthropic-account-quota";
 import { resolveEnvValue } from "../config";
 import { getAccountCredential, getAccountSet } from "../oauth/store";
 import { apiKeyPoolEntryId } from "./api-keys";
@@ -18,6 +20,7 @@ import {
   accountReportCurrent,
   AUTHORITATIVE_EMPTY_QUOTA,
   bumpProviderQuotaInvalidationEpoch,
+  captureProviderReportEpochs, providerReportEpochChanged,
   cacheKeyWithAggregationState,
   getProviderQuotaReportCache,
   hasCodexPoolProvider,
@@ -56,7 +59,6 @@ import {
 } from "./quota/account-cache";
 import {
   fetchAnthropicQuota,
-  fetchAnthropicUsageQuota,
   fetchChatGptForwardQuota,
   fetchCursorQuota,
   fetchKiroQuota,
@@ -68,11 +70,10 @@ import { fetchCommandCodeQuota, fetchKimiQuota, keyQuotaReaderForProvider } from
 import { antigravityQuotaDiagnosticIdentity, fetchAntigravityQuota, probeAntigravityUsageQuota } from "./quota/antigravity";
 import { persistKiroAccountState } from "./kiro-account-state-disk";
 import { kiroProbeCurrent, kiroProbeIdentity } from "./quota/kiro-account-probe";
-import { AnthropicQuotaProbeOwnershipError, anthropicCooldownFlightKey, assertAnthropicQuotaSendAllowed, probeAnthropicQuotaWithRecovery } from "./quota/anthropic-cooldown-recovery";
 export type { ProviderQuota, ProviderQuotaCreditsUsd, ProviderQuotaWindow } from "./quota-types";
 export { QUOTA_RESPONSE_MAX_BYTES } from "./quota-wire";
 export {
-  clearProviderQuotaCache,
+  clearProviderQuotaCache, clearProviderQuotaCacheFor,
   publishKeyReportForTests,
   readProviderQuotaJsonForTests,
   setProviderQuotaBeforePublishForTests,
@@ -86,7 +87,7 @@ export {
   parseAnthropicRateLimitHeaders,
   providerOAuthAccountQuotaMode,
   readPassiveProviderAccountQuotas,
-  recordAnthropicAccountQuotaFromHeaders,
+  recordAnthropicAccountQuotaFromHeaders, recordAnthropicAccountQuotaFromHeadersForInstance,
   recordPassiveAccountQuota,
   reconcileProviderAccountQuotaRows,
   resetProviderQuotaReconcileStateForTests,
@@ -121,7 +122,7 @@ async function maybeFetchProviderQuota(
       return fetchChatGptForwardQuota(config, name, provider, forceRefresh, prefetchedCodexSnapshot);
     }
     if (provider.authMode === "oauth" && explicitAccountReader(name)) return await fetchExplicitCurrentQuota(name, provider, config);
-    if (provider.authMode === "oauth" && name === "anthropic") return fetchAnthropicQuota(name);
+    if (provider.authMode === "oauth" && configuredAnthropicInstance(config, name)) return fetchAnthropicQuota(name, config);
     if (provider.authMode === "oauth" && name === "google-antigravity") return await fetchAntigravityQuota(name);
     if (provider.authMode === "oauth" && name === "kiro") return fetchKiroQuota(name);
     // meta-muse: a device-logged-in account can be probed at the key endpoint; an
@@ -236,6 +237,7 @@ export async function fetchProviderQuotaReports(config: OcxConfig, forceRefresh
   const keyCandidate = cacheKeyWithAggregationState(config, prefetchedCodexSnapshot);
   const key = typeof keyCandidate === "string" ? keyCandidate : await keyCandidate;
   const writerGeneration = captureConfigGeneration();
+  const providerEpochs = captureProviderReportEpochs();
   const now = Date.now();
   // The cache fast path must not extend a preserved last-good row past its 30-minute bound:
   // a row preserved at age 29:59 plus a full 5-minute TTL would otherwise serve until ~35min.
@@ -312,6 +314,8 @@ export async function fetchProviderQuotaReports(config: OcxConfig, forceRefresh
       byProvider.delete(provider);
       generationMismatchedProviders.delete(provider);
     }
+    // A provider-scoped clear during this probe retires only that provider's row.
+    for (const provider of [...byProvider.keys()]) if (providerReportEpochChanged(providerEpochs, provider)) byProvider.delete(provider);
 
     const response = { generatedAt: Date.now(), reports: [...byProvider.values()] };
     // Commit only when this probe still holds authority (no clear/force superseded it).
@@ -415,27 +419,27 @@ async function fetchAccountQuota(
   accountId: string,
   forceRefresh: boolean,
   providerConfig?: OcxProviderConfig,
+  liveConfig?: OcxConfig,
 ): Promise<AccountQuotaCacheEntry> {
   if (accountQuotaProbeSkip(provider, accountId)) return accountQuotaProbeSkip(provider, accountId)!;
+  if (isAnthropicInstanceId(provider)) return fetchAnthropicAccountQuota(provider, accountId, forceRefresh, liveConfig);
   if (explicitAccountReader(provider)) return fetchExplicitAccountQuota(provider, accountId, forceRefresh, providerConfig);
-  if (provider === "anthropic" || provider === "kiro") hydrateAccountQuotaCache();
+  if (provider === "kiro") hydrateAccountQuotaCache();
   const key = accountCacheKey(provider, accountId);
   const writerGeneration = captureConfigGeneration();
   const kiroIdentity = provider === "kiro" ? kiroProbeIdentity(accountId) : undefined;
   const cachedCandidate = accountQuotaCache.get(key);
-  const cached = (provider !== "kiro" || cachedCandidate?.identity === kiroIdentity)
-    && (provider !== "anthropic" || cachedCandidate?.isCurrent?.() !== false) ? cachedCandidate : undefined;
+  const cached = provider !== "kiro" || cachedCandidate?.identity === kiroIdentity ? cachedCandidate : undefined;
   if (!forceRefresh && cached && Date.now() - cached.ts < ACCOUNT_QUOTA_TTL_MS) {
     if (provider === "google-antigravity" && cached.quotaFailure && cached.quotaFailureIsCurrent?.() !== true) return { ...cached, quotaFailure: undefined };
-    return provider === "anthropic" ? { ...cached, quota: normalizeAnthropicQuota(cached.quota, Date.now()) } : cached;
+    return cached;
   }
-  const flightKey = provider === "anthropic" ? anthropicCooldownFlightKey(key, accountId) : key;
-  const flightCurrent = () => provider !== "anthropic" || anthropicCooldownFlightKey(key, accountId) === flightKey;
+  const flightKey = key;
   const joinable = accountQuotaInflight.get(flightKey);
   if (joinable) {
     const joined = await joinable;
     const joinedCurrent = joined.isCurrent?.();
-    if (joinedCurrent === false || (!flightCurrent() && joinedCurrent !== true)) return { ts: Date.now(), quota: null, unavailable: true };
+    if (joinedCurrent === false) return { ts: Date.now(), quota: null, unavailable: true };
     return provider !== "kiro" || joined.identity === kiroIdentity
       ? joined : fetchAccountQuota(provider, accountId, true, providerConfig);
   }
@@ -449,14 +453,10 @@ async function fetchAccountQuota(
     };
     const diagnosticFields = () => quotaFailure && quotaFailureIsCurrent() ? { quotaFailure, quotaFailureIsCurrent } : {};
     const unavailable = (): AccountQuotaCacheEntry => {
-      if (!flightCurrent()) return { ts: Date.now(), quota: null, unavailable: true };
-      const previous = accountQuotaCache.get(key);
-      const retained = provider === "anthropic" && previous?.isCurrent?.() === false ? undefined : previous;
       const entry: AccountQuotaCacheEntry = {
         ts: Date.now(),
-        quota: provider === "anthropic" ? normalizeAnthropicQuota(retained?.quota, Date.now()) : cached?.quota ?? null,
+        quota: cached?.quota ?? null,
         unavailable: true,
-        ...(provider === "anthropic" && retained?.isCurrent ? { isCurrent: retained.isCurrent } : {}),
         ...(provider === "kiro" ? { identity: kiroIdentity } : {}),
         ...diagnosticFields(),
       };
@@ -470,14 +470,12 @@ async function fetchAccountQuota(
     try {
       if (provider === "google-antigravity") diagnosticIdentity = antigravityQuotaDiagnosticIdentity(accountId);
       let quota: ProviderQuota | null;
-      let anthropicCurrent: (() => boolean) | undefined;
       let kiroSnapshot: KiroUsageSnapshot | null = null;
       if (provider === "kiro") {
         kiroSnapshot = await fetchKiroUsageSnapshot(await kiroUsageContextForAccount(accountId));
         quota = kiroSnapshot?.quota ?? null;
       } else {
         const token = await getTokenForAccountQuotaProbe(provider, accountId);
-        if (!flightCurrent()) throw new AnthropicQuotaProbeOwnershipError("anthropic quota flight is stale");
         if (provider === "google-antigravity") {
           // Per-account Gem/Cla windows (#1082). The project id is part of the stored
           // credential; without it the probe cannot be made, and that is "unavailable",
@@ -488,22 +486,14 @@ async function fetchAccountQuota(
           const result = await probeAntigravityUsageQuota(token, credential.projectId);
           quota = result.kind === "available" ? result.quota : null;
           if (result.kind === "unavailable") quotaFailure = result.failure;
-        } else if (provider === "anthropic") {
-          const result = await probeAnthropicQuotaWithRecovery(accountId, token,
-            fresh => { assertAnthropicQuotaSendAllowed(accountId, token); return fetchAnthropicUsageQuota(token, fresh); },
-            () => mayCommitAccountQuotaKey(key, writerGeneration));
-          if (result && !result.isCurrent()) throw new AnthropicQuotaProbeOwnershipError("anthropic quota probe lost publication ownership");
-          quota = result?.quota ?? null;
-          anthropicCurrent = result?.isCurrent;
         } else {
           return { ts: Date.now(), quota: null, unavailable: true };
         }
       }
       if (!quota) return unavailable();
       const entry: AccountQuotaCacheEntry = {
-        ts: Date.now(), quota: provider === "anthropic" ? normalizeAnthropicQuota(quota, Date.now()) : quota,
+        ts: Date.now(), quota,
         ...(provider === "kiro" ? { identity: kiroIdentity } : {}),
-        ...(anthropicCurrent ? { isCurrent: anthropicCurrent } : {}),
       };
       if (mayCommitAccountQuotaKey(key, writerGeneration)
         && (provider !== "kiro" || kiroProbeCurrent(accountId, kiroIdentity))) {
@@ -513,7 +503,6 @@ async function fetchAccountQuota(
       }
       return entry;
     } catch (error) {
-      if (provider === "anthropic" && error instanceof AnthropicQuotaProbeOwnershipError) return { ts: Date.now(), quota: null, unavailable: true };
       if (provider === "google-antigravity") quotaFailure = "account_unavailable";
       return unavailable();
     }
@@ -531,20 +520,21 @@ export async function fetchProviderAccountQuotas(
   provider: string,
   forceRefresh = false,
   providerConfig?: OcxProviderConfig,
+  liveConfig?: OcxConfig,
 ): Promise<ProviderAccountQuota[]> {
   if (!supportsPerAccountQuota(provider)) return [];
   const set = getAccountSet(provider);
   if (!set) return [];
   return mapQuotaRoster(set.accounts, async account => {
-    const entry = await fetchAccountQuota(provider, account.id, forceRefresh, providerConfig);
+    const entry = await fetchAccountQuota(provider, account.id, forceRefresh, providerConfig, liveConfig);
     const result: ProviderAccountQuota = {
       accountId: account.id,
-      quota: provider === "anthropic" ? normalizeAnthropicQuota(entry.quota, Date.now()) : entry.quota,
+      quota: isAnthropicInstanceId(provider) ? normalizeAnthropicQuota(entry.quota, Date.now()) : entry.quota,
       ...(entry.unavailable ? { unavailable: true as const } : {}),
       ...(entry.unavailable && entry.quotaFailure && entry.quotaFailureIsCurrent?.() === true ? { quotaFailure: entry.quotaFailure } : {}),
     };
     if (entry.quotaFailureIsCurrent) Object.defineProperty(result, "quotaFailureIsCurrent", { value: entry.quotaFailureIsCurrent });
-    if (provider === "anthropic" && entry.isCurrent) Object.defineProperty(result, "isCurrent", { value: entry.isCurrent });
+    if (isAnthropicInstanceId(provider) && entry.isCurrent) Object.defineProperty(result, "isCurrent", { value: entry.isCurrent });
     if (!explicitAccountReader(provider)) return result;
     const identity = entry.identity;
     Object.defineProperty(result, "isCurrent", { value: () => {

package/src/providers/registry/entries-core.ts

@@ -14,6 +14,7 @@ import { cursorFastCapableBases } from "../../adapters/cursor/catalog";
 import { COMMAND_CODE_MODEL_REASONING_EFFORTS } from "../command-code-efforts";
 import { isCanonicalOpenRouterTarget } from "../openrouter-routing";
 import type { ProviderRegistryEntry } from "./types";
+import type { AnthropicInstanceId } from "../anthropic-instance-id";
 import { ANTHROPIC_FAST_MODE_BETA } from "../anthropic-fast";
 import {
   ANTHROPIC_MODELS,
@@ -109,6 +110,37 @@ const ANTHROPIC_FAST_MODELS: Readonly<Record<string, boolean>> = Object.freeze({
 const ANTHROPIC_FAST_TIER_DESCRIPTION =
   "Claude fast mode: faster output at 2x price; needs usage credits (subscription) or fast-mode access (API)";
 
+/** Each instance owns its entire seed, including nested model lists and Fast wire maps. */
+function anthropicOAuthEntry(id: AnthropicInstanceId, label: string): ProviderRegistryEntry {
+  return structuredClone<ProviderRegistryEntry>({
+    id,
+    label,
+    adapter: "anthropic",
+    baseUrl: "https://api.anthropic.com",
+    authKind: "oauth",
+    allowBaseUrlOverride: true,
+    featured: true,
+    oauthId: id,
+    oauthFamily: "anthropic",
+    jawcodeBundle: "anthropic",
+    note: id === "anthropic" ? "Log in with your Claude account"
+      : "Independent Claude account pool — log in with a separate Claude account",
+    models: [...ANTHROPIC_MODELS],
+    modelContextWindows: { ...ANTHROPIC_MODEL_CONTEXT_WINDOWS },
+    modelInputModalities: { ...ANTHROPIC_MODEL_INPUT_MODALITIES },
+    modelReasoningEfforts: { ...ANTHROPIC_MODEL_REASONING_EFFORTS },
+    // Codex omits max_output_tokens; the fallback 8192 truncates long answers.
+    defaultMaxOutputTokens: ANTHROPIC_DEFAULT_MAX_OUTPUT_TOKENS,
+    modelMaxOutputTokens: { ...ANTHROPIC_MODEL_MAX_OUTPUT_TOKENS },
+    defaultModel: "claude-sonnet-5",
+    // Subscription /fast remains opt-in: it draws usage credits at 2x price.
+    fastWire: ANTHROPIC_FAST_WIRE,
+    modelSupportsServiceTier: { ...ANTHROPIC_FAST_MODELS },
+    fastTierDescription: ANTHROPIC_FAST_TIER_DESCRIPTION,
+    fastOptIn: true,
+  });
+}
+
 export const PROVIDER_REGISTRY_CORE: readonly ProviderRegistryEntry[] = [
   {
     id: "openai",
@@ -209,7 +241,7 @@ export const PROVIDER_REGISTRY_CORE: readonly ProviderRegistryEntry[] = [
     // (it is the current catalog, so its default ordering wins), then the ids
     // only the old devin entry carried. Degraded-mode seed only either way —
     // `liveModels` discovers the account's real roster.
-    models: ["swe-2", "swe-1-7", "gpt-5-6-sol", "gpt-6-astra", "gpt-6-1-sol", "gpt-6-sol", "gpt-6-luna", "claude-opus-5-5", "claude-opus-5", "claude-fable-5-1", "claude-sonnet-5-5", "claude-sonnet-5", "glm-5-3", "kimi-k3", "gemini-3-8-flash", "grok-4-6", "grok-4-7", "swe-1-7-lightning", "gpt-5-6-luna", "gpt-5-6-terra", "claude-opus-4-8", "glm-5-2", "kimi-k2-7", "grok-4-5"],
+    models: ["swe-2", "swe-1-7", "gpt-5-6-sol", "gpt-6-astra", "gpt-6-1-sol", "gpt-6-sol", "gpt-6-luna", "claude-opus-5-5", "claude-opus-5", "claude-fable-5-1", "claude-sonnet-5-5", "claude-haiku-5-5", "claude-sonnet-5", "glm-5-3", "kimi-k3", "gemini-3-8-flash", "grok-4-6", "grok-4-7", "swe-1-7-lightning", "gpt-5-6-luna", "gpt-5-6-terra", "claude-opus-4-8", "glm-5-2", "kimi-k2-7", "grok-4-5"],
     liveModels: true,
     defaultModel: "swe-2",
     modelContextWindows: DEVIN_MODEL_CONTEXT_WINDOWS,
@@ -490,35 +522,8 @@ export const PROVIDER_REGISTRY_CORE: readonly ProviderRegistryEntry[] = [
     modelReasoningEfforts: ORCAROUTER_MODEL_REASONING_EFFORTS,
     note: "Connect your OrcaRouter account with OAuth 2.0 + PKCE; the issued API key is stored in OpenCodex's existing credential store.",
   },
-  {
-    id: "anthropic",
-    label: "Anthropic Claude",
-    adapter: "anthropic",
-    baseUrl: "https://api.anthropic.com",
-    authKind: "oauth",
-    allowBaseUrlOverride: true,
-    featured: true,
-    oauthId: "anthropic",
-    jawcodeBundle: "anthropic",
-    note: "Log in with your Claude account",
-    models: [...ANTHROPIC_MODELS],
-    modelContextWindows: { ...ANTHROPIC_MODEL_CONTEXT_WINDOWS },
-    modelInputModalities: { ...ANTHROPIC_MODEL_INPUT_MODALITIES },
-    modelReasoningEfforts: { ...ANTHROPIC_MODEL_REASONING_EFFORTS },
-    // Codex omits max_output_tokens; without a provider budget the Anthropic adapter
-    // falls back to 8192, which truncates long answers with stop_reason=max_tokens.
-    defaultMaxOutputTokens: ANTHROPIC_DEFAULT_MAX_OUTPUT_TOKENS,
-    modelMaxOutputTokens: { ...ANTHROPIC_MODEL_MAX_OUTPUT_TOKENS },
-    defaultModel: "claude-sonnet-5",
-    // Claude fast mode on the subscription lane (Claude Code `/fast`): the OAuth route accepts
-    // `speed` and gates it on account entitlement (usage credits / org enablement), probed live
-    // 2026-09-23 (devlog/_plan/260923_anthropic_fast_speed/020_probe-evidence.md).
-    // Off until the operator opts in: fast mode draws usage credits at 2x price.
-    fastWire: ANTHROPIC_FAST_WIRE,
-    modelSupportsServiceTier: { ...ANTHROPIC_FAST_MODELS },
-    fastTierDescription: ANTHROPIC_FAST_TIER_DESCRIPTION,
-    fastOptIn: true,
-  },
+  anthropicOAuthEntry("anthropic", "Anthropic Claude"),
+  anthropicOAuthEntry("anthropic2", "Anthropic · Pool 2"),
   {
     id: "anthropic-apikey",
     label: "Anthropic (API key)",

package/src/providers/registry/model-ids.ts

@@ -129,6 +129,7 @@ export const REGISTRY_FIELD_MODEL_ID_ROLES = {
   thinkingBudgetModels: NONE,
   escapeBuiltinToolNames: NONE,
   oauthId: NONE,
+  oauthFamily: NONE,
   virtualModels: RECORD_KEYS,
   modelMaxInputTokens: RECORD_KEYS,
   jawcodeBundle: NONE,

package/src/providers/registry/model-seeds.ts

@@ -12,8 +12,10 @@ import type { ProviderModelDiscoverySpec } from "./types";
 // 260929 Claude Sonnet 5.5 (`claude-sonnet-5-5`, released 2026-09-28): 1M context / 128K output /
 // adaptive thinking / effort low..max with a high default, same price as Sonnet 5, per the Sonnet 5.5
 // overview, migration guide, effort and pricing pages (platform.claude.com).
-export const ANTHROPIC_MODELS = ["claude-fable-5-1", "claude-fable-5", "claude-sonnet-5-5", "claude-sonnet-5", "claude-opus-5-5", "claude-opus-5", "claude-opus-4-8", "claude-opus-4-7", "claude-opus-4-6", "claude-sonnet-4-6", "claude-haiku-4-5"];
-export const ANTHROPIC_MODEL_CONTEXT_WINDOWS: Record<string, number> = { "claude-fable-5-1": 1_000_000, "claude-sonnet-5-5": 1_000_000, "claude-sonnet-5": 1_000_000, "claude-fable-5": 1_000_000, "claude-opus-5-5": 1_000_000, "claude-opus-5": 1_000_000, "claude-opus-4-8": 1_000_000, "claude-opus-4-7": 1_000_000, "claude-opus-4-6": 1_000_000, "claude-sonnet-4-6": 1_000_000, "claude-haiku-4-5": 200_000 };
+// 261008 Claude Haiku 5.5: 1M / 128K, adaptive thinking, effort low..max (default medium),
+// per platform.claude.com Haiku 5.5 overview, migration guide and pricing page.
+export const ANTHROPIC_MODELS = ["claude-fable-5-1", "claude-fable-5", "claude-sonnet-5-5", "claude-sonnet-5", "claude-opus-5-5", "claude-opus-5", "claude-opus-4-8", "claude-opus-4-7", "claude-opus-4-6", "claude-sonnet-4-6", "claude-haiku-5-5", "claude-haiku-4-5"];
+export const ANTHROPIC_MODEL_CONTEXT_WINDOWS: Record<string, number> = { "claude-fable-5-1": 1_000_000, "claude-sonnet-5-5": 1_000_000, "claude-sonnet-5": 1_000_000, "claude-fable-5": 1_000_000, "claude-opus-5-5": 1_000_000, "claude-opus-5": 1_000_000, "claude-opus-4-8": 1_000_000, "claude-opus-4-7": 1_000_000, "claude-opus-4-6": 1_000_000, "claude-sonnet-4-6": 1_000_000, "claude-haiku-5-5": 1_000_000, "claude-haiku-4-5": 200_000 };
 // All seeded Claude models support vision: https://platform.claude.com/docs/en/models/overview
 export const ANTHROPIC_MODEL_INPUT_MODALITIES: Record<string, string[]> = Object.fromEntries(
   ANTHROPIC_MODELS.map(id => [id, ["text", "image"]]),
@@ -40,6 +42,7 @@ export const ANTHROPIC_DEFAULT_MAX_OUTPUT_TOKENS = 64_000;
  * headroom arithmetic wrong.
  */
 export const ANTHROPIC_MODEL_MAX_OUTPUT_TOKENS: Record<string, number> = {
+  "claude-haiku-5-5": 128_000,
   "claude-fable-5-1": 128_000,
   "claude-fable-5": 128_000,
   "claude-sonnet-5-5": 128_000,
@@ -70,8 +73,8 @@ export const ANTHROPIC_MODEL_MAX_OUTPUT_TOKENS: Record<string, number> = {
  * do what it says:
  * - `minimal`: `adaptiveEffort` rewrites it to `low` (the adaptive wire 400s on it), so
  *   it is not a distinct setting.
- * - `none`: only sonnet >= 5 accepts an explicit thinking disable
- *   (`EXPLICIT_THINKING_DISABLE_FAMILY_MINIMUMS`); Fable rejects one outright.
+ * - `none`: thinking-off support differs by family (`anthropic-model-contract.ts`);
+ *   Haiku 5.5 accepts it without effort, while Fable rejects one outright.
  * - `ultra`: not an Anthropic concept, and it is degraded to `max` at the request
  *   boundary anyway (src/responses/parser.ts).
  */

package/src/providers/registry/types.ts

@@ -361,6 +361,8 @@ export interface ProviderRegistryEntry {
   thinkingBudgetModels?: string[];
   escapeBuiltinToolNames?: boolean;
   oauthId?: string;
+  /** OAuth implementation family; instance identity remains the exact id/oauthId. */
+  oauthFamily?: "anthropic";
   virtualModels?: Record<string, { wireModelId: string; reasoningMode: "pro" }>;
   modelMaxInputTokens?: Record<string, number>;
   jawcodeBundle?: string;
@@ -373,6 +375,7 @@ export interface ProviderRegistryEntry {
 
 export type ProviderConfigSeed = Pick<
   OcxProviderConfig,
+  "anthropicOAuthInstance" |
   "adapter" | "baseUrl" | "apiKeyTransport" | "responsesPath" | "chatCompletionsPath" | "authMode" | "keyOptional" | "freeTier" | "modelSuffixBracketStrip" | "defaultModel" | "models"
   | "liveModels" | "contextWindow" | "modelContextWindows" | "modelInputModalities"
   | "modelDisplayNames"

package/src/providers/registry.ts

@@ -7,7 +7,7 @@ import type {
 } from "./registry/types";
 import { PROVIDER_REGISTRY_CORE } from "./registry/entries-core";
 import { PROVIDER_REGISTRY_EXTENDED } from "./registry/entries-extended";
-
+import { anthropicInstanceRowShapeMatches } from "./anthropic-instance-id";
 export type {
   ProviderAuthKind,
   MetadataModelIdNormalize,
@@ -102,10 +102,11 @@ export function normalizedProviderEndpoint(value: string): string {
  */
 export function providerMatchesRegistryTransport(
   id: string,
-  provider: Pick<OcxProviderConfig, "baseUrl" | "adapter"> & Partial<Pick<OcxProviderConfig, "authMode">>,
+  provider: Pick<OcxProviderConfig, "baseUrl" | "adapter"> & Partial<Pick<OcxProviderConfig, "authMode" | "anthropicOAuthInstance">>,
 ): boolean {
   const entry = getProviderRegistryEntry(id);
   if (!entry) return false;
+  if (id === "anthropic2") return entry.authKind === "oauth" && entry.oauthId === id && entry.oauthFamily === "anthropic" && anthropicInstanceRowShapeMatches(id, provider);
   if (entry.authKind !== "key" || entry.preserveCustomDestination !== true) return true;
   // The opt-in is intentionally limited to fixed key destinations. Fail closed if a future
   // registry edit combines it with an override/template despite the registry parity tests.
@@ -115,7 +116,6 @@ export function providerMatchesRegistryTransport(
   if (provider.authMode !== undefined && provider.authMode !== "key") return false;
   return normalizedProviderEndpoint(provider.baseUrl) === normalizedProviderEndpoint(entry.baseUrl);
 }
-
 /**
  * Resolve the registry entry a configured provider actually points at, by TRANSPORT
  * rather than by name.

package/src/responses/spill-store.ts

@@ -72,6 +72,7 @@ export interface ResponseSpillPayload {
    */
   providerOutputStart?: number;
   providers?: OcxProviderContinuationState;
+  unforcedStoreFalse?: boolean;
 }
 
 export interface ResponseSpillRef {
@@ -496,6 +497,7 @@ function serializedSpill(
     items: state.items,
     ...(state.providerOutputStart !== undefined ? { providerOutputStart: state.providerOutputStart } : {}),
     ...(state.providers ? { providers: state.providers } : {}),
+    ...(state.unforcedStoreFalse ? { unforcedStoreFalse: state.unforcedStoreFalse } : {}),
   };
   const serialized = JSON.stringify(payload);
   if (serialized === undefined) throw new Error("Response spill serialization failed");
@@ -549,12 +551,14 @@ function validPayload(value: unknown, responseId: string): value is ResponseSpil
   if (!value || typeof value !== "object" || Array.isArray(value)) return false;
   const payload = value as Record<string, unknown>;
   const keys = Object.keys(payload);
-  if (keys.some(key => !["version", "responseId", "createdAt", "clientThreadId", "items", "providerOutputStart", "providers"].includes(key))) return false;
+  if (keys.some(key => !["version", "responseId", "createdAt", "clientThreadId", "items", "providerOutputStart", "providers", "unforcedStoreFalse"].includes(key))) return false;
   if (payload.version !== 1 || payload.responseId !== responseId) return false;
   if (typeof payload.createdAt !== "number" || !Number.isFinite(payload.createdAt)) return false;
   if (payload.clientThreadId !== undefined
     && (typeof payload.clientThreadId !== "string" || payload.clientThreadId.trim().length === 0)) return false;
+  if (payload.unforcedStoreFalse !== undefined && typeof payload.unforcedStoreFalse !== "boolean") return false;
   if (!Array.isArray(payload.items)) return false;
+  if (payload.unforcedStoreFalse === true && payload.providerOutputStart === undefined) return false;
   // A malformed boundary must degrade to "never skip", never to a bad index: reject the
   // payload outright so materialization treats it as corrupt rather than trusting it.
   if (payload.providerOutputStart !== undefined) {

package/src/responses/state/metrics.ts

@@ -0,0 +1,87 @@
+import type { StoredResponseState } from "../state";
+import type { ResponseSpillWriteStatus, ResponseSpillWriteFailureCode, ResponseSpillWriteFailureOrigin } from "./spill-failure";
+
+export interface ResponseStateMetrics {
+  count: number;
+  residentCount: number;
+  spillStubCount: number;
+  tombstoneCount: number;
+  totalBytes: number;
+  spillPayloadBytes: number;
+  largestBytes: number;
+  oldestAgeMs: number;
+  spillWrites: number;
+  spillWriteFailures: number;
+  spillWriteStatus: ResponseSpillWriteStatus;
+  spillWriteConsecutiveFailures: number;
+  spillLastWriteFailureCode: ResponseSpillWriteFailureCode | null;
+  spillLastWriteFailureOrigin: ResponseSpillWriteFailureOrigin | null;
+  spillAclRetryReturnedTimeouts: number;
+  spillAclTimeoutMemoRefusals: number;
+  spillLastWriteFailureAt: number | null;
+  spillLastWriteSuccessAt: number | null;
+  spillReadFailures: number;
+  replayScopeMismatchDrops: number;
+}
+
+export function computeResponseStateMetrics(params: {
+  states: Iterable<StoredResponseState>;
+  stateCount: number;
+  now: number;
+  totalBytes: number;
+  spillWrites: number;
+  spillWriteFailures: number;
+  spillWriteConsecutiveFailures: number;
+  spillLastFailureCode: ResponseSpillWriteFailureCode | null;
+  spillLastFailureOrigin: ResponseSpillWriteFailureOrigin | null;
+  spillLastSuccessAt: number | null;
+  spillAclRetryReturnedTimeouts: number;
+  spillAclTimeoutMemoRefusals: number;
+  spillLastFailureAt: number | null;
+  spillReadFailures: number;
+  replayScopeMismatchDrops: number;
+}): ResponseStateMetrics {
+  let largestBytes = 0;
+  let oldestCreatedAt = params.now;
+  let residentCount = 0;
+  let spillStubCount = 0;
+  let tombstoneCount = 0;
+  let spillPayloadBytes = 0;
+  for (const state of params.states) {
+    const bytes = state.sizeBytes;
+    if (bytes > largestBytes) largestBytes = bytes;
+    if (state.createdAt < oldestCreatedAt) oldestCreatedAt = state.createdAt;
+    if (state.kind === "resident") {
+      residentCount += 1;
+    } else if (state.kind === "spill") {
+      spillStubCount += 1;
+      spillPayloadBytes += state.spill.payloadBytes;
+    } else tombstoneCount += 1;
+  }
+  return {
+    count: params.stateCount,
+    residentCount,
+    spillStubCount,
+    tombstoneCount,
+    totalBytes: params.totalBytes,
+    spillPayloadBytes,
+    largestBytes,
+    oldestAgeMs: params.stateCount > 0 ? params.now - oldestCreatedAt : 0,
+    spillWrites: params.spillWrites,
+    spillWriteFailures: params.spillWriteFailures,
+    spillWriteStatus: params.spillWriteConsecutiveFailures > 0
+      ? "degraded"
+      : params.spillLastSuccessAt !== null
+        ? "healthy"
+        : "initial",
+    spillWriteConsecutiveFailures: params.spillWriteConsecutiveFailures,
+    spillLastWriteFailureCode: params.spillLastFailureCode,
+    spillLastWriteFailureOrigin: params.spillLastFailureOrigin,
+    spillAclRetryReturnedTimeouts: params.spillAclRetryReturnedTimeouts,
+    spillAclTimeoutMemoRefusals: params.spillAclTimeoutMemoRefusals,
+    spillLastWriteFailureAt: params.spillLastFailureAt,
+    spillLastWriteSuccessAt: params.spillLastSuccessAt,
+    spillReadFailures: params.spillReadFailures,
+    replayScopeMismatchDrops: params.replayScopeMismatchDrops,
+  };
+}

package/src/responses/state/snapshot-codec.ts

@@ -24,6 +24,7 @@ interface LegacySnapshotState {
   providers?: OcxProviderContinuationState;
   conversationId?: unknown;
   cursorCheckpointUsable?: unknown;
+  unforcedStoreFalse?: unknown;
 }
 
 function isSpillRef(value: unknown): value is ResponseSpillRef {
@@ -51,6 +52,9 @@ export function loadSnapshotEntry(id: string, value: unknown, store: SnapshotLoa
       ? raw as number
       : undefined;
   };
+  // Restricted retention requires proven provider output; legacy unrestricted rows stay readable.
+  if (rec.unforcedStoreFalse === true
+    && anchorFor(rec.kind === "spill" ? Number.MAX_SAFE_INTEGER : Array.isArray(rec.items) ? rec.items.length : 0) === undefined) return;
   if (rec.kind === "spill") {
     if (!isSpillRef(rec.spill)) return;
     const base: Omit<SpilledResponseState, "sizeBytes"> = {
@@ -61,6 +65,7 @@ export function loadSnapshotEntry(id: string, value: unknown, store: SnapshotLoa
       // here; the spill payload validator re-checks it against the real array.
       ...(anchorFor(Number.MAX_SAFE_INTEGER) !== undefined ? { providerOutputStart: anchorFor(Number.MAX_SAFE_INTEGER) } : {}),
       ...(rec.providers ? { providers: rec.providers } : {}),
+      ...(rec.unforcedStoreFalse === true ? { unforcedStoreFalse: true } : {}),
       spill: rec.spill,
     };
     store.replaceMapEntry(id, { ...base, sizeBytes: store.stubSize(id, base) });
@@ -88,6 +93,7 @@ export function loadSnapshotEntry(id: string, value: unknown, store: SnapshotLoa
     items: rec.items,
     ...(anchorFor(rec.items.length) !== undefined ? { providerOutputStart: anchorFor(rec.items.length) } : {}),
     ...(providers ? { providers } : {}),
+    ...(rec.unforcedStoreFalse === true ? { unforcedStoreFalse: true } : {}),
   });
   if (!resident) {
     store.replaceMapEntry(id, store.tombstone(id, rec.createdAt));

package/src/responses/state/spill-queue.ts

@@ -191,6 +191,7 @@ function spillPayloadForResident(candidate: ResidentResponseState): Parameters<t
     items: candidate.items,
     ...(candidate.providerOutputStart !== undefined ? { providerOutputStart: candidate.providerOutputStart } : {}),
     ...(candidate.providers ? { providers: candidate.providers } : {}),
+    ...(candidate.unforcedStoreFalse ? { unforcedStoreFalse: candidate.unforcedStoreFalse } : {}),
   };
 }
 

package/src/responses/state/unforced-store-false.ts

@@ -0,0 +1,55 @@
+/**
+ * Closed provenance and replay gating for unforced store:false client tool call responses.
+ *
+ * An unforced store:false response is cached exclusively to allow the client to send a matching
+ * function/custom tool output continuation on the next turn. Normal replay, text continuation, or
+ * mismatched output without a matching pending call fails replay and requires the client to
+ * supply the full conversation.
+ */
+
+export function hasPendingClientToolCall(output: readonly unknown[]): boolean {
+  return output.some(item =>
+    !!item && typeof item === "object" && clientToolOutputType((item as { type?: unknown }).type) !== undefined,
+  );
+}
+
+export function allowsUnforcedStoreFalseReplay(
+  stored: readonly unknown[],
+  providerOutputStart: number | undefined,
+  clientInput: readonly unknown[],
+  carried: number,
+): boolean {
+  if (typeof providerOutputStart !== "number" || !Number.isSafeInteger(providerOutputStart)
+    || providerOutputStart < 0 || providerOutputStart > stored.length) return false;
+  const anchor = providerOutputStart;
+  const pendingCallIds = new Map<string, string>();
+  for (const item of stored.slice(anchor)) {
+    if (item && typeof item === "object") {
+      const outputType = clientToolOutputType((item as { type?: unknown }).type);
+      const callId = (item as { call_id?: unknown }).call_id;
+      if (outputType && typeof callId === "string" && callId) pendingCallIds.set(callId, outputType);
+    }
+  }
+  for (let i = 0; i < carried; i++) {
+    const item = clientInput[i];
+    if (item && typeof item === "object") {
+      const callId = (item as { call_id?: unknown }).call_id;
+      if (typeof callId === "string" && pendingCallIds.get(callId) === (item as { type?: unknown }).type) pendingCallIds.delete(callId);
+    }
+  }
+  return clientInput.slice(carried).some(item => {
+    if (item && typeof item === "object") {
+      const callId = (item as { call_id?: unknown }).call_id;
+      return typeof callId === "string" && pendingCallIds.has(callId)
+        && pendingCallIds.get(callId) === (item as { type?: unknown }).type;
+    }
+    return false;
+  });
+}
+
+/** Closed call/output pairs supported by the client-owned continuation path. */
+function clientToolOutputType(type: unknown): string | undefined {
+  if (type === "function_call") return "function_call_output";
+  if (type === "custom_tool_call") return "custom_tool_call_output";
+  return undefined;
+}