@bitkyc08/opencodex 2.79.0 → 2.81.0

package/src/server/management/oauth-account-routes.ts

@@ -1,7 +1,8 @@
-import { readConfigFileSnapshot, validateConfigCandidate } from "../../config/diagnostics";
-import { ConfigWritePublishedError } from "../../config/persist-unlocked";
+import { isAnthropicOAuthInstance, configuredAnthropicInstance, type AnthropicInstanceId } from "../../providers/anthropic-instance";
+import { resolveAnthropicAccountPoolConfig } from "../../oauth/anthropic-pool-config";
+import { persistAnthropicPoolPatch, writeAnthropicPoolSettings } from "./anthropic-pool-settings";
 import { parseAnthropicModelRoutes, readAnthropicModelRoutes } from "../../oauth/anthropic-model-routes";
-import { effectiveAnthropicAccountThreshold } from "../../oauth/anthropic-account-threshold";
+import { effectiveAnthropicAccountThresholdForInstance } from "../../oauth/anthropic-account-threshold";
 import { handleAnthropicAccountThreshold } from "./anthropic-account-threshold";
 import { randomBytes, randomUUID } from "node:crypto";
 import { readFileSync } from "node:fs";
@@ -18,7 +19,6 @@ import {
   readConfigDiagnostics,
   reconcileLiveConfigFromDisk,
   saveConfigPreservingClaudeCode,
-  mutatePersistedConfig,
 } from "../../config";
 import {
   clearLoginState,
@@ -39,7 +39,7 @@ import { enrichProviderFromCatalog, listKeyLoginProviders } from "../../oauth/ke
 import { deriveProviderPresets } from "../../providers/derive";
 import { providerCodexAccountMode } from "../../providers/registry";
 import { routedSlug, slugEquals } from "../../providers/slug-codec";
-import { clearAccountQuotaCache, clearProviderQuotaCache, fetchProviderAccountQuotas, fetchProviderApiKeyQuotas, fetchProviderQuotaReports, providerOAuthAccountQuotaMode, providerApiKeyQuotaMode, readPassiveProviderAccountQuotas } from "../../providers/quota";
+import { clearAccountQuotaCache, clearProviderQuotaCache, clearProviderQuotaCacheFor, fetchProviderAccountQuotas, fetchProviderApiKeyQuotas, fetchProviderQuotaReports, providerOAuthAccountQuotaMode, providerApiKeyQuotaMode, readPassiveProviderAccountQuotas } from "../../providers/quota";
 import { isCanonicalOpenAiForwardProvider } from "../../providers/openai-tiers";
 import { clearThreadAccountMap } from "../../codex/routing";
 import {
@@ -101,6 +101,21 @@ function isDevinCloudDirectProvider(provider: string): boolean {
   return provider === "devin" || provider === "devin-cli";
 }
 
+/**
+ * Quota invalidation after an account mutation. A B mutation retires only B's provider-level
+ * report, routing row and per-account rows; A's cache, epochs and in-flight probes survive.
+ * Other providers keep the global clear; `accountRows` also drops that provider's account rows.
+ */
+function clearQuotaCachesAfterAccountMutation(provider: string, accountRows: boolean): void {
+  if (provider === "anthropic2") {
+    clearProviderQuotaCacheFor(provider);
+    clearAccountQuotaCache(provider);
+    return;
+  }
+  clearProviderQuotaCache();
+  if (accountRows) clearAccountQuotaCache(provider);
+}
+
 async function clearDevinCloudDirectCaches(): Promise<void> {
   const { clearCachedUserJwt, clearCachedCatalog } = await import("../../adapters/devin/cloud-direct");
   clearCachedUserJwt();
@@ -208,49 +223,12 @@ function metaMuseConsentRequired(provider: string, principal: ManagementContext[
 
 function genericOAuthProviderConfig(provider: string, config: ManagementContext["config"]) {
   const configured = config.providers[provider];
+  if (provider === "anthropic2" && !configuredAnthropicInstance(config, provider)) return undefined;
   if (configured) return configured;
   const definition = OAUTH_PROVIDERS[provider];
   return definition?.resolveProviderConfig?.(config) ?? definition?.providerConfig;
 }
 
-/** Both Anthropic writers share publication-aware recovery from the atomic mutation owner. */
-function persistAnthropicPoolPatch(
-  config: OcxConfig,
-  patch: (target: OcxConfig) => { changed: boolean; value: NonNullable<OcxConfig["anthropicAccountPool"]> },
-): { status: "saved"; warning?: "config_bookkeeping_failed" } | { status: "failed"; response: Response } {
-  const before = readConfigFileSnapshot();
-  const unknown = () => ({ status: "failed" as const, response: jsonResponse({
-    error: "Pool settings save state is unknown; reload settings before editing again",
-    code: "config_save_state_unknown",
-  }, 409) });
-  try {
-    const saved = mutatePersistedConfig(patch);
-    if (saved.status === "unavailable") return unknown();
-    config.anthropicAccountPool = saved.value;
-    reconcileLiveStateStores();
-    return { status: "saved" };
-  } catch (error) {
-    const persisted = readConfigFileSnapshot();
-    if (persisted.diagnostics.source !== "file" || persisted.raw === undefined) return unknown();
-    // File reads may salvage hand edits; recovery success requires a strict, authoritative document.
-    let validated: ReturnType<typeof validateConfigCandidate>;
-    try { validated = validateConfigCandidate(JSON.parse(persisted.raw.replace(/^\uFEFF/, ""))); }
-    catch { return unknown(); }
-    if (!validated.ok) return unknown();
-    const current = validated.config;
-    const expected = patch(structuredClone(current)).value;
-    const matches = JSON.stringify(current.anthropicAccountPool) === JSON.stringify(expected);
-    if (matches) {
-      config.anthropicAccountPool = current.anthropicAccountPool;
-      // A failed reconcile must not turn confirmed publication back into a rollback.
-      try { reconcileLiveStateStores(); } catch { /* Fixed warning covers bookkeeping failure. */ }
-      return { status: "saved", warning: "config_bookkeeping_failed" };
-    }
-    if (error instanceof ConfigWritePublishedError || persisted.raw !== before.raw) return unknown();
-    return { status: "failed", response: jsonResponse({ error: "Pool settings could not be saved" }, 500) };
-  }
-}
-
 export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<Response | null> {
   const { req, url, config, deps, principal, syncClaudeAgentDefsBestEffort } = ctx;
 
@@ -422,9 +400,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     clearModelCache(provider);
     clearGatherRoutedModelsInflight();
     // Drop cached/last-good quota rows tied to the removed credential.
-    const { clearProviderQuotaCache, clearAccountQuotaCache } = await import("../../providers/quota");
-    clearProviderQuotaCache();
-    clearAccountQuotaCache(provider);
+    clearQuotaCachesAfterAccountMutation(provider, true);
     // The cached user_jwt's payload contains the api_key, and the catalog is
     // keyed by that key. Without this they outlive the credential in process
     // memory until the JWT's own ~24 minute expiry. `devin-cli` is a deprecated
@@ -445,7 +421,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     const { isGenericFailoverProvider, kiroAutoSelection } = await import("../../oauth/generic-account-failover");
     const effectiveProvider = genericOAuthProviderConfig(provider, config);
     const supportsPause = effectiveProvider !== undefined
-      && (provider === "anthropic" && effectiveProvider.authMode === "oauth"
+      && (isAnthropicOAuthInstance(provider) && effectiveProvider.authMode === "oauth"
         || isGenericFailoverProvider(provider, effectiveProvider));
     const {
       oauthAccountHealthFields,
@@ -456,7 +432,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
       const set = getAccountSet(provider);
       const current = getLoginStatus(provider, emailMaskingEnabled(config));
       return {
-        activeAccountId: current.activeAccountId ?? null,
+        ...(provider === "anthropic2" ? { provider } : {}), activeAccountId: current.activeAccountId ?? null,
         accounts: (current.accounts ?? []).map(summary => {
           const full = set?.accounts.find(account => account.id === summary.id);
           const health = full
@@ -467,9 +443,9 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
             });
           return { ...summary, ...oauthAccountHealthFields(provider, summary.id, health), quotaMode,
             ...(supportsPause ? { paused: full?.paused === true } : {}),
-            ...(provider === "anthropic" && supportsPause ? { autoSwitchThresholdOverride: full?.autoSwitchThresholdOverride ?? null,
-              effectiveAutoSwitchThreshold: effectiveAnthropicAccountThreshold(config, full),
-              autoSwitchThreshold: effectiveAnthropicAccountThreshold(config) } : {}),
+            ...(isAnthropicOAuthInstance(provider) && supportsPause ? { autoSwitchThresholdOverride: full?.autoSwitchThresholdOverride ?? null,
+              effectiveAutoSwitchThreshold: effectiveAnthropicAccountThresholdForInstance(provider as AnthropicInstanceId, config, full),
+              autoSwitchThreshold: effectiveAnthropicAccountThresholdForInstance(provider as AnthropicInstanceId, config) } : {}),
             ...(provider === "kiro" && full ? kiroAutoSelection(full) : {}) };
         }),
       };
@@ -489,11 +465,11 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     // from the post-probe store so the response is not stale.
     const rows = passiveQuota
       ? readPassiveProviderAccountQuotas(provider)
-      : await fetchProviderAccountQuotas(provider, forceRefresh, quotaProvider);
+      : await fetchProviderAccountQuotas(provider, forceRefresh, quotaProvider, config);
     const byId = new Map(rows.map(row => [row.accountId, row]));
     const projected = projectAccounts();
     return jsonResponse({
-      activeAccountId: projected.activeAccountId,
+      ...(provider === "anthropic2" ? { provider } : {}), activeAccountId: projected.activeAccountId,
       accounts: projected.accounts.map(account => {
         const row = byId.get(account.id);
         if (!row) return account;
@@ -514,6 +490,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     const body = await readManagementJsonBodyOr(req, {}) as { provider?: string; accountId?: string };
     const provider = (body.provider ?? "").trim().toLowerCase();
     if (!isPublicOAuthProvider(provider)) return jsonResponse({ error: "unknown oauth provider" }, 400);
+    if (provider === "anthropic2" && !configuredAnthropicInstance(config, provider)) return jsonResponse({ error: "Anthropic pool instance is not configured" }, 409);
     if (!body.accountId) return jsonResponse({ error: "missing accountId" }, 400);
     const { getAccountCredentialWithStatus, setActiveAccount } = await import("../../oauth/store");
     const current = getAccountCredentialWithStatus(provider, body.accountId);
@@ -532,16 +509,15 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     // side carries resetCodexRoutingForManualSelection for.
     const { genericPoolKey, seedPoolRotationAccount } = await import("../../oauth/pool-kernel");
     seedPoolRotationAccount(genericPoolKey(provider), body.accountId);
-    if (provider === "anthropic") {
-      const { resetAnthropicRoutingForManualSelection } = await import("../../oauth/anthropic-routing");
-      resetAnthropicRoutingForManualSelection(body.accountId);
+    if (isAnthropicOAuthInstance(provider)) {
+      const { anthropicRoutingFor } = await import("../../oauth/anthropic-routing");
+      anthropicRoutingFor(provider).resetAnthropicRoutingForManualSelection(body.accountId);
     }
     const { clearModelCache } = await import("../../codex/model-cache");
     const { clearGatherRoutedModelsInflight } = await import("../../codex/catalog");
     clearModelCache(provider);
     clearGatherRoutedModelsInflight();
-    const { clearProviderQuotaCache } = await import("../../providers/quota");
-    clearProviderQuotaCache();
+    clearQuotaCachesAfterAccountMutation(provider, false);
     return jsonResponse({ ok: true, provider, activeAccountId: body.accountId });
   }
 
@@ -558,7 +534,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
 
     const { isGenericFailoverProvider } = await import("../../oauth/generic-account-failover");
     const effectiveProvider = genericOAuthProviderConfig(provider, config);
-    if (!effectiveProvider || !(provider === "anthropic" && effectiveProvider.authMode === "oauth"
+    if (!effectiveProvider || !(isAnthropicOAuthInstance(provider) && effectiveProvider.authMode === "oauth"
       || isGenericFailoverProvider(provider, effectiveProvider))) {
       return jsonResponse({ error: "account pause is not supported for this OAuth provider" }, 400);
     }
@@ -568,9 +544,9 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     if (result.status === "not-found") return jsonResponse({ error: "account not found" }, 404);
 
     if (result.activeAccountChanged) {
-      if (provider === "anthropic") {
-        const { resetAnthropicRoutingForManualSelection } = await import("../../oauth/anthropic-routing");
-        resetAnthropicRoutingForManualSelection(result.activeAccountId);
+      if (isAnthropicOAuthInstance(provider)) {
+        const { anthropicRoutingFor } = await import("../../oauth/anthropic-routing");
+        anthropicRoutingFor(provider).resetAnthropicRoutingForManualSelection(result.activeAccountId);
       } else {
         const { genericPoolKey, seedPoolRotationAccount } = await import("../../oauth/pool-kernel");
         seedPoolRotationAccount(genericPoolKey(provider), result.activeAccountId);
@@ -579,8 +555,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
       const { clearGatherRoutedModelsInflight } = await import("../../codex/catalog");
       clearModelCache(provider);
       clearGatherRoutedModelsInflight();
-      const { clearProviderQuotaCache } = await import("../../providers/quota");
-      clearProviderQuotaCache();
+      clearQuotaCachesAfterAccountMutation(provider, false);
     }
 
     return jsonResponse({
@@ -671,7 +646,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
         if (autoSwitchThreshold !== undefined) config.autoSwitchThreshold = autoSwitchThreshold;
       } else if (kind === "anthropic") {
         const patchPool = (target: OcxConfig) => {
-          const pool = { ...(target.anthropicAccountPool ?? {}) };
+          const pool = { ...resolveAnthropicAccountPoolConfig(target, provider as AnthropicInstanceId) };
           if (fields.nativeMessages !== undefined) pool.nativeMessages = fields.nativeMessages as boolean;
           if (fields.enabled !== undefined) pool.enabled = fields.enabled as boolean;
           if (strategy !== undefined) pool.strategy = strategy as never;
@@ -682,10 +657,10 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
             if (fields.routes === null) delete pool.routes;
             else if (parsedRoutes?.ok) pool.routes = parsedRoutes.routes;
           }
-          target.anthropicAccountPool = pool;
+          writeAnthropicPoolSettings(target, provider as AnthropicInstanceId, pool);
           return { changed: true, value: pool };
         };
-        const saved = persistAnthropicPoolPatch(config, patchPool);
+        const saved = persistAnthropicPoolPatch(config, provider as AnthropicInstanceId, patchPool);
         if (saved.status === "failed") return saved.response;
         return jsonResponse({ ...unifiedPoolSettingsDto(config, provider, kind), ...(saved.warning ? { warning: saved.warning } : {}) });
       } else {
@@ -710,7 +685,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
   // Opt-in Anthropic OAuth account pool (#294): enable/threshold/strategy + clear cooldown.
   if (url.pathname === "/api/oauth/accounts/pool" && req.method === "GET") {
     const provider = (url.searchParams.get("provider") ?? "").trim().toLowerCase();
-    if (provider !== "anthropic") {
+    if (!isAnthropicOAuthInstance(provider)) {
       // Generic OAuth pool-settings contract (#695 slice 1): persisted per provider. `strategy`
       // and `autoSwitchThreshold` stay inert until the selector consumes them; `enabled` already
       // governs the pre-dispatch account preference. Codex keeps /api/codex-auth; api-key
@@ -722,7 +697,8 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
       }
       return jsonResponse(genericPoolSettingsDto(provider, prov, config.pool?.kernel === true));
     }
-    const pool = config.anthropicAccountPool ?? {};
+    if (provider === "anthropic2" && !configuredAnthropicInstance(config, provider)) return jsonResponse({ error: "Anthropic pool instance is not configured" }, 409);
+    const pool = resolveAnthropicAccountPoolConfig(config, provider);
     return jsonResponse({
       provider,
       enabled: pool.enabled === true,
@@ -753,10 +729,10 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     };
     const provider = typeof body.provider === "string" ? body.provider.trim().toLowerCase() : "";
     if (Object.hasOwn(body, "nativeMessages")) {
-      if (provider !== "anthropic") return jsonResponse({ error: "nativeMessages is only part of the anthropic pool contract" }, 400);
+      if (!isAnthropicOAuthInstance(provider)) return jsonResponse({ error: "nativeMessages is only part of the anthropic pool contract" }, 400);
       if (typeof body.nativeMessages !== "boolean") return jsonResponse({ error: "nativeMessages must be a boolean" }, 400);
     }
-    if (provider !== "anthropic") {
+    if (!isAnthropicOAuthInstance(provider)) {
       const {
         poolSettingsCapability, genericPoolSettingsDto, parseGenericPoolStrategy, parseGenericAutoSwitchThreshold,
         parseGenericStickyLimit, parseKiroAccountCap,
@@ -810,12 +786,13 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
       saveConfigPreservingClaudeCode(config);
       return jsonResponse({ ok: true, ...genericPoolSettingsDto(provider, prov, config.pool?.kernel === true) });
     }
-    let enabled = config.anthropicAccountPool?.enabled === true;
+    if (provider === "anthropic2" && !configuredAnthropicInstance(config, provider)) return jsonResponse({ error: "Anthropic pool instance is not configured" }, 409);
+    let enabled = resolveAnthropicAccountPoolConfig(config, provider)?.enabled === true;
     if (body.enabled !== undefined) {
       if (typeof body.enabled !== "boolean") return jsonResponse({ error: "enabled must be a boolean" }, 400);
       enabled = body.enabled;
     }
-    let threshold = config.anthropicAccountPool?.autoSwitchThreshold ?? 80;
+    let threshold = resolveAnthropicAccountPoolConfig(config, provider)?.autoSwitchThreshold ?? 80;
     if (body.autoSwitchThreshold !== undefined) {
       if (
         typeof body.autoSwitchThreshold !== "number"
@@ -827,7 +804,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
       }
       threshold = body.autoSwitchThreshold;
     }
-    let strategy = config.anthropicAccountPool?.strategy;
+    let strategy = resolveAnthropicAccountPoolConfig(config, provider)?.strategy;
     if (body.strategy !== undefined) {
       const parsed = parseAccountPoolStrategy(body.strategy);
       if (parsed === null) {
@@ -835,7 +812,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
       }
       strategy = parsed;
     }
-    let stickyLimit = config.anthropicAccountPool?.stickyLimit;
+    let stickyLimit = resolveAnthropicAccountPoolConfig(config, provider)?.stickyLimit;
     if (body.stickyLimit !== undefined) {
       const parsed = parseAccountPoolStickyLimit(body.stickyLimit);
       if (parsed === null) {
@@ -843,7 +820,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
       }
       stickyLimit = parsed;
     }
-    let quotaWindow = config.anthropicAccountPool?.quotaWindow;
+    let quotaWindow = resolveAnthropicAccountPoolConfig(config, provider)?.quotaWindow;
     if (body.quotaWindow !== undefined) {
       const parsed = parseAccountPoolQuotaWindow(body.quotaWindow);
       if (parsed === null) {
@@ -855,7 +832,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
       ? parseAnthropicModelRoutes(body.routes) : null;
     if (parsedLegacyRoutes && !parsedLegacyRoutes.ok) return jsonResponse({ error: parsedLegacyRoutes.error }, 400);
     const legacyPatch = (target: OcxConfig) => {
-      const pool = { ...(target.anthropicAccountPool ?? {}) };
+      const pool = { ...resolveAnthropicAccountPoolConfig(target, provider as AnthropicInstanceId) };
       if (body.enabled !== undefined) pool.enabled = enabled;
       else if (pool.enabled === undefined) pool.enabled = false;
       if (body.nativeMessages !== undefined) pool.nativeMessages = body.nativeMessages as boolean;
@@ -868,21 +845,21 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
         if (body.routes === null) delete pool.routes;
         else if (parsedLegacyRoutes?.ok) pool.routes = parsedLegacyRoutes.routes;
       }
-      target.anthropicAccountPool = pool;
+      writeAnthropicPoolSettings(target, provider as AnthropicInstanceId, pool);
       return { changed: true, value: pool };
     };
-    const saved = persistAnthropicPoolPatch(config, legacyPatch);
+    const saved = persistAnthropicPoolPatch(config, provider as AnthropicInstanceId, legacyPatch);
     if (saved.status === "failed") return saved.response;
     return jsonResponse({
       ok: true,
       provider,
-      enabled: config.anthropicAccountPool?.enabled === true,
-      autoSwitchThreshold: config.anthropicAccountPool?.autoSwitchThreshold ?? 80,
-      strategy: normalizeAccountPoolStrategy(config.anthropicAccountPool?.strategy),
-      stickyLimit: normalizeAccountPoolStickyLimit(config.anthropicAccountPool?.stickyLimit),
-      quotaWindow: normalizeAccountPoolQuotaWindow(config.anthropicAccountPool?.quotaWindow),
-      routes: config.anthropicAccountPool?.routes ?? null,
-      nativeMessages: !Object.hasOwn(config.anthropicAccountPool ?? {}, "nativeMessages") || config.anthropicAccountPool?.nativeMessages === true,
+      enabled: resolveAnthropicAccountPoolConfig(config, provider)?.enabled === true,
+      autoSwitchThreshold: resolveAnthropicAccountPoolConfig(config, provider)?.autoSwitchThreshold ?? 80,
+      strategy: normalizeAccountPoolStrategy(resolveAnthropicAccountPoolConfig(config, provider)?.strategy),
+      stickyLimit: normalizeAccountPoolStickyLimit(resolveAnthropicAccountPoolConfig(config, provider)?.stickyLimit),
+      quotaWindow: normalizeAccountPoolQuotaWindow(resolveAnthropicAccountPoolConfig(config, provider)?.quotaWindow),
+      routes: resolveAnthropicAccountPoolConfig(config, provider)?.routes ?? null,
+      nativeMessages: !Object.hasOwn(resolveAnthropicAccountPoolConfig(config, provider), "nativeMessages") || resolveAnthropicAccountPoolConfig(config, provider)?.nativeMessages === true,
       ...(saved.warning ? { warning: saved.warning } : {}),
       experimental: true,
     });
@@ -891,10 +868,11 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     const body = await readManagementJsonBodyOr(req, {}) as { provider?: unknown; accountId?: unknown };
     const provider = typeof body.provider === "string" ? body.provider.trim().toLowerCase() : "";
     const accountId = typeof body.accountId === "string" ? body.accountId.trim() : "";
-    if (provider !== "anthropic") return jsonResponse({ error: "clear-cooldown is only supported for anthropic" }, 400);
+    if (!isAnthropicOAuthInstance(provider)) return jsonResponse({ error: "clear-cooldown is only supported for anthropic" }, 400);
+    if (provider === "anthropic2" && !configuredAnthropicInstance(config, provider)) return jsonResponse({ error: "Anthropic pool instance is not configured" }, 409);
     if (!accountId) return jsonResponse({ error: "missing accountId" }, 400);
-    const { clearAnthropicAccountCooldown } = await import("../../oauth/anthropic-routing");
-    const cleared = clearAnthropicAccountCooldown(accountId);
+    const { anthropicRoutingFor } = await import("../../oauth/anthropic-routing");
+    const cleared = anthropicRoutingFor(provider).clearAnthropicAccountCooldown(accountId);
     return jsonResponse({ ok: true, cleared });
   }
 
@@ -936,8 +914,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
         const { clearGatherRoutedModelsInflight } = await import("../../codex/catalog");
         clearModelCache(provider);
         clearGatherRoutedModelsInflight();
-        clearProviderQuotaCache();
-        clearAccountQuotaCache(provider);
+        clearQuotaCachesAfterAccountMutation(provider, true);
       }
       if (!imported.ok) return jsonResponse({ code: imported.code }, imported.status);
       return jsonResponse(imported.result);
@@ -969,19 +946,17 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     const { removeAccount, getAccountSet } = await import("../../oauth/store");
     if (!(await removeAccount(provider, id))) return jsonResponse({ error: "account not found" }, 404);
     reconcileLiveStateStores();
-    if (provider === "anthropic") {
-      const { clearAnthropicAccountCooldown, clearAnthropicSessionAffinityForAccount } = await import("../../oauth/anthropic-routing");
-      clearAnthropicAccountCooldown(id);
-      clearAnthropicSessionAffinityForAccount(id);
+    if (isAnthropicOAuthInstance(provider)) {
+      const { anthropicRoutingFor } = await import("../../oauth/anthropic-routing");
+      anthropicRoutingFor(provider).clearAnthropicAccountCooldown(id);
+      anthropicRoutingFor(provider).clearAnthropicSessionAffinityForAccount(id);
     }
     if (!getAccountSet(provider)) clearLoginState(provider);
     const { clearModelCache } = await import("../../codex/model-cache");
     const { clearGatherRoutedModelsInflight } = await import("../../codex/catalog");
     clearModelCache(provider);
     clearGatherRoutedModelsInflight();
-    const { clearProviderQuotaCache, clearAccountQuotaCache } = await import("../../providers/quota");
-    clearProviderQuotaCache();
-    clearAccountQuotaCache(provider);
+    clearQuotaCachesAfterAccountMutation(provider, true);
     // Same reasoning as logout. Removing the last account for a provider used to
     // leave the JWT and catalog in memory, because only the logout route cleared
     // them.
@@ -1168,7 +1143,13 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     if (principal !== "gui-session") {
       return jsonResponse({ error: "dashboard session required" }, 403, req, config);
     }
+    // Local page bootstrap is sufficient for the dashboard, not stored-secret disclosure.
+    const authorized = () => ctx.sessionControl?.canRevealDataKeys?.(req, config) === true;
+    const denied = () => jsonResponse({ error: "operator-authorized dashboard session required" }, 403, req, config);
+    if (!authorized()) return denied();
     const body = await readJsonBody(req);
+    // Body reception can outlive the session or its revocation; do not trust cached admission.
+    if (!authorized()) return denied();
     if (!body || Object.keys(body).length !== 1 || typeof body.id !== "string" || !body.id) {
       return jsonResponse({ error: "invalid body" }, 400, req, config);
     }

package/src/server/management/provider-instance-ownership.ts

@@ -0,0 +1,44 @@
+import { isDeepStrictEqual } from "node:util";
+import type { OcxProviderConfig } from "../../types";
+import type { ProviderEditorProviderDTO } from "../auth-cors";
+import { anthropicInstanceRowShapeMatches } from "../../providers/anthropic-instance-id";
+import { assertAnthropicInstanceLoginConfig } from "../../oauth/store-anthropic-instance";
+
+/** Preset publication may create B, but may never take over an existing custom row. */
+export function anthropicInstancePublicationError(name: string, next: OcxProviderConfig, existing: OcxProviderConfig | undefined): string | undefined {
+  if (name === "anthropic2" && anthropicInstanceRowShapeMatches(name, next)) {
+    try { assertAnthropicInstanceLoginConfig({ providers: existing ? { [name]: existing } : {} }, name); }
+    catch { return "cannot add Pool 2 over an existing custom provider or unreadable configuration; resolve it first"; }
+  }
+  return undefined;
+}
+
+/** Full form edits omit provenance; preserve only an already owned compatible row. */
+export function preserveAnthropicInstanceMarker(name: string, next: OcxProviderConfig, existing: OcxProviderConfig | undefined): void {
+  if (name !== "anthropic2" || Object.hasOwn(next, "anthropicOAuthInstance")) return;
+  if (anthropicInstanceRowShapeMatches(name, existing) && next.adapter === "anthropic" && next.authMode === "oauth") {
+    next.anthropicOAuthInstance = "anthropic2";
+  }
+}
+
+export function mergeProviderEditorRow(
+  persisted: OcxProviderConfig | undefined,
+  baseline: ProviderEditorProviderDTO | undefined,
+  next: ProviderEditorProviderDTO,
+): OcxProviderConfig {
+  const merged = structuredClone(persisted ?? {}) as Record<string, unknown>;
+  const fields = new Set([...Object.keys(baseline ?? {}), ...Object.keys(next)]);
+  for (const field of fields) {
+    const baselineHasField = baseline !== undefined && Object.hasOwn(baseline, field);
+    const nextHasField = Object.hasOwn(next, field);
+    if (
+      baselineHasField === nextHasField
+      && (!baselineHasField || isDeepStrictEqual(baseline[field], next[field]))
+    ) {
+      continue;
+    }
+    if (nextHasField) merged[field] = structuredClone(next[field]);
+    else delete merged[field];
+  }
+  return merged as unknown as OcxProviderConfig;
+}

package/src/server/management/provider-routes.ts

@@ -40,6 +40,7 @@ import { commitProviderPatch } from "./provider-patch-transaction";
 import { captureConfigTopLevelRollback } from "../../config/rebase-provenance";
 import { canonicalAutoReviewModelKey, mergeModelPinnedEfforts, modelPinnedEffortsConfigError, pinnedReasoningEffortConfigError } from "../../config/provider-validation";
 import { replaceProviderAccountSet } from "../../oauth/store";
+import { captureModelsOAuthTarget, mayResolveModelsOAuth, modelsOAuthTargetMatches } from "../../oauth/model-discovery-auth";
 import { providerDestinationResolvedError } from "../../lib/destination-policy";
 import { reconcileLiveStateStores } from "../../lib/state-store-registrations";
 import { ProviderOutboundPolicyError, providerOutboundGet, providerOutboundPost, providerRedirectError } from "../../lib/provider-outbound";
@@ -115,7 +116,6 @@ import {
   publicProviderBaseUrl,
   safeConfigDTO,
   type ProviderEditorConfigDTO,
-  type ProviderEditorProviderDTO,
 } from "../auth-cors";
 import { providerCatalogCapabilityConfigError } from "./provider-capability-config";
 import { providerEmptyToolOutputConfigError } from "../../config/provider-validation";
@@ -138,6 +138,7 @@ import { isPlainRecord, parseDebugLogQuery, tokPerSecondResult, unavailableCostR
 import type { MetricUnavailableReason, TokPerSecondResult, CostEstimateReason, CostResult, MetricSource } from "./shared";
 import type { ManagementContext } from "./context";
 import { readManagementJsonBody, rethrowManagementBodyTooLarge } from "./body";
+import { anthropicInstancePublicationError, mergeProviderEditorRow, preserveAnthropicInstanceMarker } from "./provider-instance-ownership";
 import { providerTlsProfileDiagnostic } from "../../lib/provider-tls-profile";
 
 type ProviderPatchApplication =
@@ -213,28 +214,6 @@ type ProviderEditorCandidateResult =
 
 type ProviderEditorMutationValue = ProviderEditorCandidateResult;
 
-function mergeProviderEditorRow(
-  persisted: OcxProviderConfig | undefined,
-  baseline: ProviderEditorProviderDTO | undefined,
-  next: ProviderEditorProviderDTO,
-): OcxProviderConfig {
-  const merged = structuredClone(persisted ?? {}) as Record<string, unknown>;
-  const fields = new Set([...Object.keys(baseline ?? {}), ...Object.keys(next)]);
-  for (const field of fields) {
-    const baselineHasField = baseline !== undefined && Object.hasOwn(baseline, field);
-    const nextHasField = Object.hasOwn(next, field);
-    if (
-      baselineHasField === nextHasField
-      && (!baselineHasField || isDeepStrictEqual(baseline[field], next[field]))
-    ) {
-      continue;
-    }
-    if (nextHasField) merged[field] = structuredClone(next[field]);
-    else delete merged[field];
-  }
-  return merged as unknown as OcxProviderConfig;
-}
-
 /** Build and validate a complete candidate without mutating the caller's snapshot. */
 function providerEditorCandidate(
   persisted: OcxConfig,
@@ -273,6 +252,8 @@ function providerEditorCandidate(
     const namespaceCollision = codexAccountNamespaceProviderCollisionError(candidate.codexAccountNamespaces, name);
     if (namespaceCollision) return { ok: false, status: 409, error: namespaceCollision, code: "provider_namespace_conflict" };
     const merged = mergeProviderEditorRow(persisted.providers[name], baseline.providers[name], publicProvider);
+    const markerCollision = anthropicInstancePublicationError(name, merged, persisted.providers[name]);
+    if (markerCollision) return { ok: false, status: 409, error: markerCollision, code: "anthropic_instance_collision" };
     const transportCandidate = providerTransportValidationCandidate(merged as unknown as Record<string, unknown>);
     // The editor merges onto the persisted row, so stored operator overlays (selectedModels,
     // disabled, …) ride along in the candidate. They are owned by their own write boundaries;
@@ -1172,6 +1153,9 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
     const aliasOwnershipError = providerAliasOverlayOwnershipError(body.provider, existing);
     if (aliasOwnershipError) return jsonResponse({ error: aliasOwnershipError }, 400);
     const transportCandidate = providerTransportValidationCandidate(body.provider);
+    preserveAnthropicInstanceMarker(name, transportCandidate as unknown as OcxProviderConfig, existing);
+    const markerCollision = anthropicInstancePublicationError(name, transportCandidate as unknown as OcxProviderConfig, existing);
+    if (markerCollision) return jsonResponse({ error: markerCollision }, 409);
     const pinError = applyProviderPinFields(transportCandidate as unknown as OcxProviderConfig, body.provider, existing);
     if (pinError) return jsonResponse({ error: pinError }, 400);
     const providerError = providerManagementConfigError(name, transportCandidate)
@@ -1328,6 +1312,9 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
     // DNS validation above awaits. Re-read the live row so a dedicated alias write that
     // completed during that wait remains authoritative instead of being overwritten by the
     // older ownership snapshot used to admit this POST.
+    const lateMarkerCollision = anthropicInstancePublicationError(name, prov, config.providers[name]);
+    if (lateMarkerCollision) return jsonResponse({ error: lateMarkerCollision }, 409);
+    preserveAnthropicInstanceMarker(name, prov, config.providers[name]);
     restorePersistedAliasOverlays(prov, config.providers[name]);
     const capabilities = Object.hasOwn(body.provider, "modelCapabilities")
       ? mergeModelCapabilities(undefined, prov.modelCapabilities)
@@ -1371,6 +1358,8 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
     const rollback = pinsOwned ? captureConfigTopLevelRollback(config, ["defaultProvider", "modelDiscovery", "disabledModels"]) : undefined;
     let validationError: string | undefined;
     withConfigMutationLockSync(() => {
+      validationError = anthropicInstancePublicationError(name, candidate, config.providers[name]);
+      if (validationError) return;
       const liveTiers = config.providers[name]?.modelContextTiers;
       if (submittedModelContextTiers && liveTiers) candidate.modelContextTiers = Object.assign(Object.create(null), liveTiers, candidate.modelContextTiers ?? {});
       else if (!submittedModelContextTiers && liveTiers) candidate.modelContextTiers = { ...liveTiers };
@@ -1621,7 +1610,8 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
     if (!name || !isValidProviderName(name) || !hasOwnProvider(config.providers, name)) {
       return jsonResponse({ error: "unknown provider" }, 404);
     }
-    const prov = config.providers[name]!;
+    const prov = { ...config.providers[name]! };
+    const authorizedTarget = captureModelsOAuthTarget(name, prov);
     if (prov.disabled) {
       return jsonResponse({ ok: false, error: "Provider is disabled", latencyMs: 0 });
     }
@@ -1646,10 +1636,10 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
       // credential resolution/network access for providers such as Antigravity.
       return jsonResponse({ applicable: false, reason: "static_catalog", latencyMs: 0 });
     }
-    const { buildModelsRequest, getValidAccessTokenSnapshot, resolveModelsAuthToken } = await import("../../oauth");
+    const { buildModelsRequest, getModelsOAuthAccessSnapshot, resolveModelsAuthToken } = await import("../../oauth");
     const antigravity = effectiveGoogleMode(name, prov) === "cloud-code-assist";
-    const snapshot = prov.authMode === "oauth"
-      ? await getValidAccessTokenSnapshot(name).catch(() => undefined)
+    const snapshot = prov.authMode === "oauth" && mayResolveModelsOAuth(name, config.providers[name])
+      ? await getModelsOAuthAccessSnapshot(name, prov).catch(() => undefined)
       : undefined;
     const apiKey = prov.authMode === "oauth" ? snapshot?.accessToken : await resolveModelsAuthToken(name, prov);
     if (prov.authMode === "oauth" && !apiKey) {
@@ -1735,7 +1725,10 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
       // Same canonical-URL TUN transparency as catalog discovery: the registry's
       // own fixed discovery URL survives purely-benchmark (Clash/Surge/Mihomo
       // fake-IP) DNS without proxy env.
-      const outboundDependencies = { isCanonicalUrl: isRegistryModelDiscoveryUrl };
+      const outboundDependencies = { isCanonicalUrl: isRegistryModelDiscoveryUrl,
+        beforeSend: () => prov.authMode !== "oauth" || (mayResolveModelsOAuth(name, config.providers[name])
+          && modelsOAuthTargetMatches(name, config.providers[name], authorizedTarget)
+          && (name !== "anthropic2" || new URL(modelsUrl).href === authorizedTarget)) };
       const res = method === "POST"
         ? await providerOutboundPost(name, prov, modelsUrl, {
           headers,

package/src/server/management/route-registry.ts

@@ -231,6 +231,8 @@ export const MANAGEMENT_ROUTES: readonly ManagementRoute[] = [
   { method: "POST", path: "/api/client-integrations/restore", module: "server/management/integration-routes", mutates: true },
   { method: "POST", path: "/api/client-integrations/preview", module: "server/management/integration-routes", mutates: false },
   { method: "POST", path: "/api/client-integrations/restore/preview", module: "server/management/integration-routes", mutates: false },
+  { method: "POST", path: "/api/client-integrations/commandcode/restore", module: "server/management/integration-routes", mutates: true },
+  { method: "POST", path: "/api/client-integrations/commandcode/restore/preview", module: "server/management/integration-routes", mutates: false },
   // server/management/lab-automation-routes
   { method: "GET", path: "/api/lab/automation", module: "server/management/lab-automation-routes", mutates: false, exempt: { reason: "local-transport", why: "ocx lab reads the same rows from the local SQLite projection; src/cli/lab.ts imports ../lab/query directly and never fetches /api/lab." } },
   { method: "GET", path: "/api/lab/automation/runs", module: "server/management/lab-automation-routes", mutates: false, exempt: { reason: "local-transport", why: "ocx lab reads the same rows from the local SQLite projection; src/cli/lab.ts imports ../lab/query directly and never fetches /api/lab." } },
@@ -324,7 +326,7 @@ export const MANAGEMENT_ROUTES: readonly ManagementRoute[] = [
   { method: "PATCH", path: "/api/keys", module: "server/management/oauth-account-routes", mutates: true },
   { method: "PATCH", path: "/api/oauth/accounts/pool", module: "server/management/oauth-account-routes", mutates: true },
   { method: "POST", path: "/api/keys", module: "server/management/oauth-account-routes", mutates: true },
-  { method: "POST", path: "/api/keys/reveal", module: "server/management/oauth-account-routes", mutates: false, exempt: { reason: "session-only", why: "Revealing a data key requires the gui-session principal; the admin token is refused." } },
+  { method: "POST", path: "/api/keys/reveal", module: "server/management/oauth-account-routes", mutates: false, exempt: { reason: "session-only", why: "Stored-key reads require a current pairing or trusted Tailscale-identity session; automatic loopback sessions and admin tokens are refused." } },
   { method: "POST", path: "/api/keys/rotate", module: "server/management/oauth-account-routes", mutates: true },
   { method: "POST", path: "/api/keys/rotate/commit", module: "server/management/oauth-account-routes", mutates: true },
   { method: "POST", path: "/api/oauth/accounts/clear-cooldown", module: "server/management/oauth-account-routes", mutates: true },

package/src/server/management/routing-profile-routes.ts

@@ -63,7 +63,7 @@ function parseEvidence(raw: unknown): { evidence: PolicyRequestEvidence; ok: boo
   return { evidence, ok: true };
 }
 
-function parseCandidateEvidence(raw: unknown): PolicyCandidateEvidence[] | null {
+function parseCandidateEvidence(raw: unknown, config: OcxConfig): PolicyCandidateEvidence[] | null {
   if (!Array.isArray(raw)) return null;
   const out: PolicyCandidateEvidence[] = [];
   for (const item of raw) {
@@ -87,10 +87,10 @@ function parseCandidateEvidence(raw: unknown): PolicyCandidateEvidence[] | null
       // caller does not supply an explicit quota object, so a dry-run following
       // the documented shape reports the same cached account quota as routing.
       ...(item.quota === undefined && typeof item.codexAccountId === "string"
-        ? { quota: quotaEvidenceForCandidate({ provider, model, codexAccountId: item.codexAccountId }) }
+        ? { quota: quotaEvidenceForCandidate({ provider, model, codexAccountId: item.codexAccountId }, config) }
         : {}),
       ...(item.quota === undefined && typeof item.accountRef === "string" && typeof item.codexAccountId !== "string"
-        ? { quota: quotaEvidenceForCandidate({ provider, model, accountRef: item.accountRef }) }
+        ? { quota: quotaEvidenceForCandidate({ provider, model, accountRef: item.accountRef }, config) }
         : {}),
     });
   }
@@ -392,7 +392,7 @@ export async function handleRoutingProfileRoutes(ctx: ManagementContext): Promis
     if (labActivationRequired(config, getConfigDir())) activateLab(config, getConfigDir());
     const candidateEvidence = body.candidates === undefined
       ? assembleCandidateEvidence(config, resolvedProfile, now)
-      : parseCandidateEvidence(body.candidates);
+      : parseCandidateEvidence(body.candidates, config);
     if (candidateEvidence === null) {
       return jsonResponse({ error: { code: "invalid_candidates", message: "candidates must be an array of evidence objects" } }, 400, req, config);
     }