@bitkyc08/opencodex 2.79.0 → 2.81.0

package/src/server/management/system-restart.ts

@@ -1,8 +1,8 @@
 /**
  * Dashboard memory-card drain-and-restart (#563).
  *
- * Longer than POST /api/stop's short drain: waits up to 60s for active turns,
- * then respawns. Never runs restoreNativeCodex / stripGrokConfig — this is a
+ * Waits up to 60s for active turns unless a manual API caller explicitly opts
+ * into a shorter grace, with the existing 60s cleanup watchdog, then respawns. Never runs restoreNativeCodex / stripGrokConfig — this is a
  * recycle to reclaim RSS, not a teardown.
  *
  * Respawn policy (matches real supervisor configs in src/service.ts):
@@ -37,6 +37,7 @@
  *   Checked before the service rule: that app, not a service manager, is the parent.
  */
 import {
+  abortAndReleaseAllTurns,
   acquireTemporaryDrain,
   beginShutdownDrain,
   drainAndShutdown,
@@ -64,8 +65,11 @@ import { spawnReplacementStart } from "../restart-replacement";
 export { MEMORY_DRAIN_RESTART_MS, REPLACEMENT_READY_TIMEOUT_MS } from "../../lib/system-restart-contract";
 export { waitForReplacementReady, type ReplacementReadinessIo } from "../restart-replacement";
 export const DEADLINE_LISTENER_STOP_TIMEOUT_MS = 5_000;
+const RESTART_RESPONSE_FLUSH_DELAY_MS = 200;
 
 export interface SystemRestartIo {
+  /** Cancel and release admitted turns without stopping the listener or process. */
+  abortActiveTurns?: () => void;
   acquireTemporaryDrain?: () => { release(): void } | null;
   drainAndShutdown?: typeof drainAndShutdown;
   /** True when a background service can actually respawn this process after exit(1). */
@@ -92,6 +96,11 @@ export interface SystemRestartIo {
   now?: () => number;
 }
 
+export interface SystemRestartOptions {
+  /** Explicit API opt-in; omission preserves the existing 60s drain. */
+  drainGraceMs?: number;
+}
+
 export interface SystemRestartAdmission {
   /** Only the caller that created this pending restart receives its veto. */
   onAccepted?: (veto: () => void) => void;
@@ -100,8 +109,9 @@ export interface SystemRestartAdmission {
 }
 
 let restartIo: SystemRestartIo = {};
-/** Prevents double-scheduling in the 200ms window before drainAndShutdown sets draining. */
+/** Prevents double-scheduling during the 200ms response-flush window. */
 let restartAccepted = false;
+let acceptedDrainGraceMs = MEMORY_DRAIN_RESTART_MS;
 
 type RestartDrainOutcome = "completed" | "failed" | "rejected" | "deadline";
 type BoundedSettlementOutcome = "completed" | "rejected" | "deadline";
@@ -173,6 +183,7 @@ export function noteExplicitShutdownRequested(): void {
 export function setSystemRestartIoForTests(io: SystemRestartIo = {}): void {
   restartIo = io;
   restartAccepted = false;
+  acceptedDrainGraceMs = MEMORY_DRAIN_RESTART_MS;
   explicitShutdownRequested = false;
 }
 
@@ -324,10 +335,10 @@ async function completeDeadlineRestartHandoff(
 
 /**
  * Accept a drain-and-restart request. Returns immediately; the drain +
- * respawn runs on a short timer so the HTTP response can flush first.
+ * respawn waits 200ms for the HTTP response to flush; shorter grace cuts turns separately.
  * Idempotent while already draining: returns the accepted shape again.
  */
-export function acceptSystemRestart(io: SystemRestartIo = restartIo, admission: SystemRestartAdmission = {}): {
+export function acceptSystemRestart(io: SystemRestartIo = restartIo, admission: SystemRestartAdmission = {}, options: SystemRestartOptions = {}): {
   accepted: true;
   alreadyDraining: boolean;
   activeTurnCount: number;
@@ -337,16 +348,22 @@ export function acceptSystemRestart(io: SystemRestartIo = restartIo, admission:
     ?? io.isDraining
     ?? isShutdownDraining;
   const alreadyDraining = restartAccepted || shutdownActive();
+  const drainGraceMs = alreadyDraining
+    ? (restartAccepted ? acceptedDrainGraceMs : MEMORY_DRAIN_RESTART_MS)
+    : (options.drainGraceMs ?? MEMORY_DRAIN_RESTART_MS);
   const activeTurnCount = (io.getActiveTurnCount ?? getActiveTurnCount)();
   const schedule = io.schedule ?? ((fn, ms) => { setTimeout(() => { void fn(); }, ms); });
 
   if (!alreadyDraining) {
     restartAccepted = true;
+    acceptedDrainGraceMs = drainGraceMs;
     const automatic = Boolean(admission.onAccepted);
     const temporaryDrain = automatic
       ? (io.acquireTemporaryDrain ?? (() => acquireTemporaryDrain("automatic-restart")))()
       : null;
+    let cancelEarlyCut: (() => void) | undefined;
     const releasePending = () => {
+      cancelEarlyCut?.();
       temporaryDrain?.release();
       restartAccepted = false;
     };
@@ -363,13 +380,27 @@ export function acceptSystemRestart(io: SystemRestartIo = restartIo, admission:
       releasePending();
     });
     const now = io.now ?? Date.now;
-    const restartDeadlineMs = now() + MEMORY_DRAIN_RESTART_MS;
+    const acceptedAtMs = now();
+    const restartDeadlineMs = acceptedAtMs + MEMORY_DRAIN_RESTART_MS;
+    const drainDeadlineMs = acceptedAtMs + drainGraceMs;
+    const scheduleDeadline = io.scheduleDeadline ?? ((fn, ms) => {
+      const timer = setTimeout(fn, ms);
+      return () => clearTimeout(timer);
+    });
     // Reject new data-plane traffic immediately (503), before the 200ms response-flush delay.
     if (!automatic) {
       if (io.beginShutdownDrain) io.beginShutdownDrain();
       else if (io.setDraining) io.setDraining(true);
       else beginShutdownDrain();
     }
+    // A shorter grace cuts admitted turns at acceptance + grace, but listener stop
+    // and process exit must still wait for the full response-flush window.
+    if (!vetoed && drainGraceMs < RESTART_RESPONSE_FLUSH_DELAY_MS) {
+      cancelEarlyCut = scheduleDeadline(() => {
+        if (vetoed) return;
+        (io.abortActiveTurns ?? (() => abortAndReleaseAllTurns(new Error("server shutdown"))))();
+      }, drainGraceMs);
+    }
     schedule(async () => {
       if (vetoed) return;
       pending = false;
@@ -390,12 +421,11 @@ export function acceptSystemRestart(io: SystemRestartIo = restartIo, admission:
       // closes the listener and makes both the server ref and runtime metadata stale.
       const restartPort = (io.listenPort ?? resolveListenPort)();
       const drain = io.drainAndShutdown ?? drainAndShutdown;
-      const remainingMs = Math.max(0, restartDeadlineMs - now());
-      const drainPromise = Promise.resolve().then(() => drain(undefined, remainingMs));
-      const scheduleDeadline = io.scheduleDeadline ?? ((fn, ms) => {
-        const timer = setTimeout(fn, ms);
-        return () => clearTimeout(timer);
-      });
+      // Bound active/scoped-drain waiting independently of cleanup and readiness.
+      // A cut turn may already have executed upstream; never replay it automatically.
+      const drainPromise = Promise.resolve().then(
+        () => drain(undefined, Math.max(0, drainDeadlineMs - now())),
+      );
       const drainOutcome = await waitForRestartDrain(drainPromise, restartDeadlineMs, now, scheduleDeadline);
       if (!canHandoff()) return;
       const exitProcess = io.exitProcess ?? ((code: number) => { process.exit(code); });
@@ -451,13 +481,13 @@ export function acceptSystemRestart(io: SystemRestartIo = restartIo, admission:
       }
       (io.markRecycling ?? markRecyclingForExit)();
       exitProcess(drainOutcome === "failed" || drainOutcome === "rejected" ? 1 : 0);
-    }, 200);
+    }, RESTART_RESPONSE_FLUSH_DELAY_MS);
   }
 
   return {
     accepted: true,
     alreadyDraining,
     activeTurnCount,
-    drainTimeoutMs: MEMORY_DRAIN_RESTART_MS,
+    drainTimeoutMs: drainGraceMs,
   };
 }

package/src/server/management/system-routes.ts

@@ -30,6 +30,7 @@ import { inspectResponseSpillStorage, responseStateMetrics, type ResponseSpillDi
 import { appOwnedBytesSnapshot } from "../../lib/app-owned-memory";
 import { readWindowsReplaceRetryCounters } from "../../lib/windows-atomic-replace";
 import {
+  MEMORY_DRAIN_RESTART_MS,
   SYSTEM_RESTART_EXPECTED_PID_HEADER,
   parseExpectedSystemRestartPid,
 } from "../../lib/system-restart-contract";
@@ -46,6 +47,7 @@ import type {
 } from "../../codex/app-server-restart-service";
 import type { ManagementContext } from "./context";
 import { acceptSystemRestart } from "./system-restart";
+import { readOptionalManagementJsonBody, rethrowManagementBodyTooLarge } from "./body";
 
 const ENDPOINT_SAMPLE_LIMIT = 60;
 // The spill report reads the snapshot and walks the spill directory synchronously,
@@ -179,8 +181,28 @@ export async function handleSystemRoutes(ctx: ManagementContext): Promise<Respon
       }, 409, req, config);
     }
 
-    // Longer informed drain than /api/stop; does not tear down Codex/Grok injection.
-    const result = acceptSystemRestart();
+    let body: unknown;
+    try { body = await readOptionalManagementJsonBody(req); }
+    catch (error) {
+      rethrowManagementBodyTooLarge(error);
+      return jsonResponse({ success: false, error: "Invalid restart JSON body." }, 400, req, config);
+    }
+    if (!body || typeof body !== "object" || Array.isArray(body)) {
+      return jsonResponse({ success: false, error: "Invalid restart JSON body." }, 400, req, config);
+    }
+    const drainGraceMs = (body as Record<string, unknown>).drainGraceMs;
+    if (drainGraceMs !== undefined && (
+      typeof drainGraceMs !== "number" || !Number.isSafeInteger(drainGraceMs)
+      || drainGraceMs < 1 || drainGraceMs > MEMORY_DRAIN_RESTART_MS
+    )) {
+      return jsonResponse({ success: false, error: "drainGraceMs must be an integer from 1 to 60000." }, 400, req, config);
+    }
+    // The process capability signs the restart target, not this new body option.
+    if (drainGraceMs !== undefined && ctx.principal === "system-restart-capability") {
+      return jsonResponse({ success: false, error: "Short grace requires management authentication." }, 403, req, config);
+    }
+    // Omission retains the informed 60s drain; only an explicit API request shortens it.
+    const result = acceptSystemRestart(undefined, {}, { drainGraceMs });
     return jsonResponse({
       success: true,
       message: result.alreadyDraining

package/src/server/management/vision-sidecar-options.ts

@@ -8,7 +8,7 @@
  * the same as no gate at all.
  */
 import type { OcxConfig } from "../../types";
-import { findAnthropicVisionProvider, type AnthropicVisionProvider } from "../../vision";
+import { type AnthropicVisionProvider } from "../../vision";
 import { VISION_BACKENDS } from "../../vision/backends";
 import {
   modelAcceptsImageInput,
@@ -18,7 +18,7 @@ import {
   type VisionSidecarBackend,
 } from "../../vision/eligibility";
 import { pickerVisibleSidecarCandidates } from "../../sidecar/candidates";
-import { resolveSidecarAuth } from "../../sidecar/auth";
+import { sidecarOptionsAuth } from "./web-search-sidecar-options";
 
 /**
  * Backends whose executor could actually run (#2188 roadmap 170): openai
@@ -38,7 +38,7 @@ export function enabledVisionBackends(
   config: OcxConfig,
   anthropicSidecar: AnthropicVisionProvider | undefined,
 ): VisionSidecarBackend[] {
-  const auth = resolveSidecarAuth(config);
+  const auth = sidecarOptionsAuth(config, config.visionSidecar?.anthropicInstance);
   // Preserve the caller's resolution for the anthropic side: the descriptor
   // reads the shared auth module, but a caller that already resolved "no
   // executor" must not see anthropic options it cannot dispatch. The filter
@@ -52,7 +52,7 @@ export function enabledVisionBackends(
   // the UNIVERSAL sides: when neither resolves, both are offered so the picker
   // stays populated (permissive-unknown rule; test 6 pins it).
   if (!active.includes("openai") && !active.includes("anthropic")) {
-    return ["openai", "anthropic", ...active];
+    return ["openai", ...(config.visionSidecar?.anthropicInstance ? [] : ["anthropic" as const]), ...active];
   }
   return active;
 }
@@ -67,7 +67,7 @@ export function enabledVisionBackends(
  * pre-filtering here would deaden the gate (review F1: reject → allow flip).
  */
 export async function visionCandidateRows(config: OcxConfig): Promise<VisionCandidateModel[]> {
-  const auth = resolveSidecarAuth(config);
+  const auth = sidecarOptionsAuth(config, config.visionSidecar?.anthropicInstance);
   const all = await pickerVisibleSidecarCandidates(config, auth);
   return all.map(candidate => ({
     provider: candidate.provider,
@@ -158,10 +158,13 @@ export function visionDescriberRejection(
   config: OcxConfig,
   candidates: readonly VisionCandidateModel[],
 ): { error: string; allowed: string[] } {
+  const auth = sidecarOptionsAuth(config, config.visionSidecar?.anthropicInstance);
+  const anthropic = auth.anthropicProviderName && auth.anthropicProvider
+    ? { providerName: auth.anthropicProviderName, provider: auth.anthropicProvider, config } : undefined;
   return {
     error: `${field} "${requested}" cannot describe images: it has no image input support, or it is a model the vision sidecar describes FOR.`,
     // The rejection path is not hot, so it resolves the executor itself rather than
     // making every 400 caller thread one through.
-    allowed: visionModelOptionsFrom(config, candidates, findAnthropicVisionProvider(config)).map(option => option.value),
+    allowed: visionModelOptionsFrom(config, candidates, anthropic).map(option => option.value),
   };
 }

package/src/server/management/web-search-sidecar-options.ts

@@ -14,7 +14,9 @@
  * id outside (candidates ∪ auth slots) can never run and is refused.
  */
 import type { OcxConfig } from "../../types";
-import { AUTH_SLOT_MODELS, resolveSidecarAuth } from "../../sidecar/auth";
+import { AUTH_SLOT_MODELS, resolveSidecarAuth, resolveAnthropicSidecarAuth, resolveAnthropicHelperInstance, AnthropicHelperUnavailableError, type SidecarAuthState } from "../../sidecar/auth";
+import { ANTHROPIC_INSTANCE_IDS, isAnthropicInstanceId, type AnthropicInstanceId } from "../../providers/anthropic-instance-id";
+import { configuredAnthropicInstance } from "../../providers/anthropic-instance";
 import { pickerVisibleSidecarCandidates, type SidecarCandidate } from "../../sidecar/candidates";
 import { WEB_SEARCH_BACKENDS, webSearchSidecarCandidates } from "../../web-search/backends";
 import type { WebSearchBackendId } from "../../web-search/index";
@@ -24,6 +26,53 @@ import type { WebSearchBackendId } from "../../web-search/index";
 // simply never produce rows.
 export type WebSearchBackend = WebSearchBackendId;
 
+export function sidecarAnthropicPoolOptions(config: OcxConfig,
+  settings: { backend?: string; anthropicInstance?: AnthropicInstanceId }, parentProviderName?: string): {
+    backend?: string; parent?: AnthropicInstanceId; selected?: AnthropicInstanceId;
+    resolved?: AnthropicInstanceId; mixed: boolean; available: AnthropicInstanceId[];
+    code?: "anthropic_helper_unavailable";
+  } {
+  const parent = configuredAnthropicInstance(config, parentProviderName);
+  const available = ANTHROPIC_INSTANCE_IDS.filter(instance => resolveAnthropicSidecarAuth(config, instance) !== undefined);
+  const base = { ...(settings.backend ? { backend: settings.backend } : {}), ...(parent ? { parent } : {}), ...(settings.anthropicInstance ? { selected: settings.anthropicInstance } : {}),
+    mixed: !!parent && !!settings.anthropicInstance && parent !== settings.anthropicInstance, available };
+  if (settings.backend !== "anthropic") return base;
+  try {
+    const resolved = resolveAnthropicHelperInstance(config, { backendFamily: "anthropic",
+      anthropicInstance: settings.anthropicInstance, parentProviderName });
+    const legacy = resolved === undefined ? resolveSidecarAuth(config).anthropicProviderName : resolved;
+    return { ...base, ...(isAnthropicInstanceId(legacy) ? { resolved: legacy } : {}) };
+  } catch (error) {
+    if (!(error instanceof AnthropicHelperUnavailableError)) throw error;
+    return { ...base, code: error.code };
+  }
+}
+
+/** An unavailable explicit pool removes its executor; it never resumes legacy discovery. */
+export function sidecarOptionsAuth(config: OcxConfig, instance?: AnthropicInstanceId): SidecarAuthState {
+  try { return resolveSidecarAuth(config, instance); }
+  catch (error) {
+    if (!(error instanceof AnthropicHelperUnavailableError)) throw error;
+    // Preserve other backend defaults while removing all Anthropic executor authority.
+    const otherBackends = { ...config, providers: Object.fromEntries(Object.entries(config.providers)
+      .filter(([, provider]) => provider.adapter !== "anthropic")) };
+    return { isCodexAuth: resolveSidecarAuth(otherBackends).isCodexAuth, isAnthropicAuth: false };
+  }
+}
+
+/** Apply only the helper identity fields to a typed, isolated validation snapshot. */
+export function sidecarSettingsAfterPatch<T extends { backend?: string; model?: string; anthropicInstance?: AnthropicInstanceId }>(
+  stored: T | undefined, patch: Record<string, unknown>,
+): T {
+  const next = { ...stored } as T;
+  for (const key of ["backend", "model", "anthropicInstance"] as const) {
+    const value = patch[key];
+    if (value === null || (key === "model" && value === "")) delete next[key];
+    else if (value !== undefined) Object.assign(next, { [key]: value });
+  }
+  return next;
+}
+
 export interface WebSearchCandidateRow extends SidecarCandidate {
   /** Executor backend that admitted this exact candidate row. */
   backend: WebSearchBackend;
@@ -41,7 +90,7 @@ export interface WebSearchModelOption {
 
 /** The candidate rows the web-search executors can actually run right now. */
 export async function webSearchCandidateRows(config: OcxConfig): Promise<WebSearchCandidateRow[]> {
-  const auth = resolveSidecarAuth(config);
+  const auth = sidecarOptionsAuth(config, config.webSearchSidecar?.anthropicInstance);
   const all = await pickerVisibleSidecarCandidates(config, auth);
   return webSearchSidecarCandidates(config, auth, all).flatMap(candidate => {
    const descriptor = WEB_SEARCH_BACKENDS.find(entry =>

package/src/server/management-auth.ts

@@ -279,6 +279,8 @@ export interface ManagementSessionControl {
   isCurrent(req: Request, config: OcxConfig): boolean;
   /** Prove that the current browser session came from the operator-mediated pairing flow. */
   isPaired(req: Request, config: OcxConfig): boolean;
+  /** Revalidate independent session authority before disclosing stored data keys. */
+  canRevealDataKeys?(req: Request, config: OcxConfig): boolean;
 }
 
 export function createManagementSessionControl(state: ManagementAuthState): ManagementSessionControl {
@@ -307,6 +309,10 @@ export function createManagementSessionControl(state: ManagementAuthState): Mana
     isPaired(req: Request, config: OcxConfig): boolean {
       return currentSession(req, config)?.issuance === "pairing";
     },
+    canRevealDataKeys(req: Request, config: OcxConfig): boolean {
+      const issuance = currentSession(req, config)?.issuance;
+      return issuance === "pairing" || issuance === "tailscale-identity";
+    },
     revokeCurrent(req: Request): boolean {
       if (!state.available) return false;
       const credential = requestManagementCredential(req);

package/src/server/messages-native-eligibility.ts

@@ -13,6 +13,7 @@ import { credentialDomainFor } from "../protocols/opaque-state";
 import { resolveProtocolSettings } from "../protocols/settings";
 import type { RouteResult } from "../router";
 import type { OcxConfig } from "../types";
+import { configuredAnthropicInstance } from "../providers/anthropic-instance";
 import { requiresVisionPreprocessing } from "../vision";
 import { resolvePinnedEffort } from "./effort-policy";
 
@@ -94,7 +95,7 @@ function bridgeOnlyPolicyApplies(
 /**
  * The credential rule. A proxy-managed key is native since PF-08. An Anthropic OAuth account
  * is native only with `managedMessagesNativeOAuth` on (itself effective only with
- * `managedMessagesNative`), only for the `anthropic` provider the OAuth store serves, and only
+ * `managedMessagesNative`), only for a configured Anthropic OAuth instance, and only
  * to `api.anthropic.com`. Pool selection and recovery are resolved at native dispatch. `forward`
  * belongs to the caller.
  */
@@ -107,7 +108,7 @@ function credentialDeclineReason(
   if (provider.authMode === undefined || provider.authMode === "key") return undefined;
   if (provider.authMode !== "oauth") return "auth-mode-not-native";
   if (!resolveProtocolSettings(config, route.providerName).rollout.managedMessagesNativeOAuth) return "auth-mode-not-native";
-  if (route.providerName !== "anthropic") return "auth-mode-not-native";
+  if (!configuredAnthropicInstance(config, route.providerName)) return "auth-mode-not-native";
   if (!credentialDomainFor(provider)?.firstPartyAnthropic) return "auth-mode-not-native";
   return undefined;
 }

package/src/server/messages-native-oauth.ts

@@ -19,17 +19,11 @@
  * No token, account id or body content is logged or returned in an error message.
  */
 import type { OAuthAccessSnapshot } from "../oauth";
-import {
-  commitAnthropicSelectionRouting,
-  captureAnthropicManualSelectionGeneration,
-  getAnthropicPoolAccessSnapshot,
-  getAnthropicAccountHealthSnapshot,
-  resolveAnthropicDispatchAccountId,
-  resolveAnthropicAccountForSession,
-  getEligibleAnthropicAccounts,
-  isAnthropicAccountPoolEnabled,
-} from "../oauth/anthropic-routing";
-import { resolveAnthropicModelRoute, routeCandidates, type AnthropicRouteDecision } from "../oauth/anthropic-model-routes";
+import { anthropicRoutingFor } from "../oauth/anthropic-routing";
+import { resolveAnthropicModelRouteForInstance, routeCandidates, type AnthropicRouteDecision } from "../oauth/anthropic-model-routes";
+import { configuredAnthropicInstance, type AnthropicInstanceId } from "../providers/anthropic-instance";
+import { resolveAnthropicMessagesUrl } from "../adapters/anthropic";
+import { routedProviderConfig } from "../router";
 import {
   captureOAuthAccountSelection,
   commitOAuthAccountSelection,
@@ -40,7 +34,6 @@ import type { TranslatorBudget } from "../lib/translator-budget";
 import type { OcxConfig } from "../types";
 import { relaySseWithPayloadRewrite } from "./sse-payload-rewrite";
 
-const PROVIDER = "anthropic";
 const MAX_SELECTION_ATTEMPTS = 3;
 
 type Selection = NonNullable<ReturnType<typeof captureOAuthAccountSelection>>;
@@ -52,6 +45,9 @@ function isRec(value: unknown): value is Rec {
 
 /** The committed selection and the credential snapshot one native request is served with. */
 export interface NativeOAuthBinding {
+  readonly instance: AnthropicInstanceId;
+  /** Config-authorized physical destination, captured before any credential await. */
+  readonly routeTarget: string;
   readonly selection: Selection;
   readonly snapshot: OAuthAccessSnapshot;
   /** Anthropic account UUID from the same stored generation, distinct from snapshot.accountId. */
@@ -74,17 +70,43 @@ export class NativeOAuthSelectionChangedError extends Error {
 /** Invalid operator route configuration remains a request refusal, not an auth failure. */
 export class NativeOAuthModelRouteError extends Error {}
 
-function currentRoute(config: OcxConfig, model?: string): AnthropicRouteDecision | null {
-  const resolved = model ? resolveAnthropicModelRoute(config, model) : { decision: null };
+/**
+ * Current configured ownership and target; a revoked B never resolves orphan credentials.
+ *
+ * Adapter, auth mode and destination are read from the routed provider, the same normalization the
+ * settled route used to compute its target. Routing canonicalizes the primary row's adapter and auth
+ * mode from the registry, so a raw-field comparison would refuse an existing Pool 1 row the route
+ * already accepted. B's own raw-row shape is still enforced through `configuredAnthropicInstance`.
+ */
+function nativeOAuthRouteTarget(instance: AnthropicInstanceId, config: OcxConfig): string {
+  const provider = config.providers[instance];
+  if (configuredAnthropicInstance(config, instance) !== instance || !provider || provider.disabled === true) {
+    throw new NativeOAuthSelectionChangedError();
+  }
+  let routed: ReturnType<typeof routedProviderConfig>;
+  try {
+    routed = routedProviderConfig(instance, provider);
+  } catch {
+    // A destination the router now refuses is a moved route, not a different failure class.
+    throw new NativeOAuthSelectionChangedError();
+  }
+  if (routed.authMode !== "oauth" || routed.adapter !== "anthropic") throw new NativeOAuthSelectionChangedError();
+  return resolveAnthropicMessagesUrl(routed);
+}
+
+function currentRoute(instance: AnthropicInstanceId, config: OcxConfig, model?: string): AnthropicRouteDecision | null {
+  const resolved = model ? resolveAnthropicModelRouteForInstance(instance, config, model) : { decision: null };
   if (resolved.error) throw new NativeOAuthModelRouteError(`Invalid Anthropic model routes: ${resolved.error}`);
   return resolved.decision ? { ...resolved.decision, accounts: [...resolved.decision.accounts] } : null;
 }
 
-function routeIsCurrent(config: OcxConfig, model: string | undefined, decision: AnthropicRouteDecision | null): boolean {
-  return JSON.stringify(currentRoute(config, model)) === JSON.stringify(decision);
+function routeIsCurrent(instance: AnthropicInstanceId, config: OcxConfig, model: string | undefined, decision: AnthropicRouteDecision | null): boolean {
+  return JSON.stringify(currentRoute(instance, config, model)) === JSON.stringify(decision);
 }
 
 export interface NativeOAuthBindingOptions {
+  /** Settled route destination; retries may never authorize a replacement destination. */
+  routeTarget?: string;
   sessionKey?: string | null;
   model?: string;
   /** An account proposed by the shared pre-output refusal recovery policy. */
@@ -94,21 +116,34 @@ export interface NativeOAuthBindingOptions {
   expectedRecoveryRouteDecision?: AnthropicRouteDecision | null;
 }
 
+/** Compatibility entrypoint: the original instance only. */
+export function resolveNativeOAuthBinding(config: OcxConfig, options: NativeOAuthBindingOptions = {}): Promise<NativeOAuthBinding> {
+  return resolveNativeOAuthBindingForInstance("anthropic", config, options);
+}
+
 /** Resolve the shared pool selector and commit its exact credential generation for dispatch. */
-export async function resolveNativeOAuthBinding(
+export async function resolveNativeOAuthBindingForInstance(
+  instance: AnthropicInstanceId,
   config: OcxConfig,
   options: NativeOAuthBindingOptions = {},
 ): Promise<NativeOAuthBinding> {
+  const routeTarget = options.routeTarget ?? nativeOAuthRouteTarget(instance, config);
+  const routing = anthropicRoutingFor(instance);
+  const assertOwner = () => {
+    if (nativeOAuthRouteTarget(instance, config) !== routeTarget) throw new NativeOAuthSelectionChangedError();
+  };
   const sessionKey = options.sessionKey ?? null;
   const model = options.model;
   for (let attempt = 0; attempt < MAX_SELECTION_ATTEMPTS; attempt++) {
-    const routeDecision = currentRoute(config, model);
-    const manualSelectionGeneration = captureAnthropicManualSelectionGeneration();
-    const selection = captureOAuthAccountSelection(PROVIDER);
+    assertOwner();
+    const routeDecision = currentRoute(instance, config, model);
+    const manualSelectionGeneration = routing.captureAnthropicManualSelectionGeneration();
+    const selection = captureOAuthAccountSelection(instance);
     // Always ask admission first so pause/login/cooldown retains its typed local refusal.
-    const admittedId = await resolveAnthropicDispatchAccountId(config, sessionKey, routeDecision, model);
-    if (!routeIsCurrent(config, model, routeDecision)) continue;
-    const proposed = resolveAnthropicAccountForSession(sessionKey, config, Date.now(), routeDecision, model);
+    const admittedId = await routing.resolveAnthropicDispatchAccountId(config, sessionKey, routeDecision, model);
+    assertOwner();
+    if (!routeIsCurrent(instance, config, model, routeDecision)) continue;
+    const proposed = routing.resolveAnthropicAccountForSession(sessionKey, config, Date.now(), routeDecision, model);
     // A lost selection commit discards a recovery proposal: a newer manual/policy choice wins.
     const recoverySelectionMatches = !!options.expectedRecoverySelection
       && selection?.accountId === options.expectedRecoverySelection.accountId
@@ -118,27 +153,30 @@ export async function resolveNativeOAuthBinding(
     const accountId = attempt === 0 && options.candidateAccountId && recoverySelectionMatches && recoveryRouteMatches
       ? options.candidateAccountId : admittedId;
     if (!selection) continue;
-    if (!routeCandidates(getEligibleAnthropicAccounts(Date.now(), model), routeDecision).includes(accountId)) {
+    if (!routeCandidates(routing.getEligibleAnthropicAccounts(Date.now(), model), routeDecision).includes(accountId)) {
       throw new NativeOAuthSelectionChangedError();
     }
-    const candidate = await getAnthropicPoolAccessSnapshot(accountId);
-    if (!routeIsCurrent(config, model, routeDecision)) continue;
-    const committed = await commitOAuthAccountSelection(PROVIDER, candidate.accountId, {
+    const candidate = await routing.getAnthropicPoolAccessSnapshot(accountId);
+    assertOwner();
+    if (candidate.provider !== instance) throw new NativeOAuthSelectionChangedError();
+    if (!routeIsCurrent(instance, config, model, routeDecision)) continue;
+    const committed = await commitOAuthAccountSelection(instance, candidate.accountId, {
       expectedSelection: selection,
       expectedCredentialGeneration: candidate.generation,
       requireUsableAccount: true,
     });
+    assertOwner();
     if (committed) {
-      if (!routeIsCurrent(config, model, routeDecision)
-        || manualSelectionGeneration !== captureAnthropicManualSelectionGeneration()) continue;
-      if (!commitAnthropicSelectionRouting(candidate.accountId, selection, committed, {
+      if (!routeIsCurrent(instance, config, model, routeDecision)
+        || manualSelectionGeneration !== routing.captureAnthropicManualSelectionGeneration()) continue;
+      if (!routing.commitAnthropicSelectionRouting(candidate.accountId, selection, committed, {
         config, sessionKey, model, routeDecision,
         reason: accountId === proposed.accountId ? proposed.reason : undefined,
         expectedCredentialGeneration: candidate.generation,
       })) continue;
-      const row = getAccountCredentialWithStatus(PROVIDER, candidate.accountId);
-      if (!row || credentialGeneration(row.credential) !== candidate.generation) continue;
-      const binding = { selection: committed, snapshot: candidate, providerAccountUuid: row.credential.accountId, routeDecision, sessionKey, model, config, manualSelectionGeneration };
+      const row = getAccountCredentialWithStatus(instance, candidate.accountId);
+      if (!row || row.credential.access !== candidate.accessToken || credentialGeneration(row.credential) !== candidate.generation) continue;
+      const binding: NativeOAuthBinding = { instance, routeTarget, selection: committed, snapshot: candidate, providerAccountUuid: row.credential.accountId, routeDecision, sessionKey, model, config, manualSelectionGeneration };
       if (nativeOAuthBindingIsCurrent(binding)) return binding;
     }
   }
@@ -150,12 +188,18 @@ export async function resolveNativeOAuthBinding(
  * selection, plus the same usable credential generation. Checked before every physical send.
  */
 export function nativeOAuthBindingIsCurrent(binding: NativeOAuthBinding): boolean {
-  if (binding.manualSelectionGeneration !== captureAnthropicManualSelectionGeneration()
-    || !routeIsCurrent(binding.config, binding.model, binding.routeDecision)) return false;
-  const selected = captureOAuthAccountSelection(PROVIDER);
-  const row = getAccountCredentialWithStatus(PROVIDER, binding.snapshot.accountId);
-  const sessionRoute = isAnthropicAccountPoolEnabled(binding.config) && binding.sessionKey
-    ? resolveAnthropicAccountForSession(binding.sessionKey, binding.config, Date.now(), binding.routeDecision, binding.model) : null;
+  const { instance } = binding;
+  const routing = anthropicRoutingFor(instance);
+  try {
+    if (nativeOAuthRouteTarget(instance, binding.config) !== binding.routeTarget) return false;
+  } catch { return false; }
+  if (binding.snapshot.provider !== instance) return false;
+  if (binding.manualSelectionGeneration !== routing.captureAnthropicManualSelectionGeneration()
+    || !routeIsCurrent(instance, binding.config, binding.model, binding.routeDecision)) return false;
+  const selected = captureOAuthAccountSelection(instance);
+  const row = getAccountCredentialWithStatus(instance, binding.snapshot.accountId);
+  const sessionRoute = routing.isAnthropicAccountPoolEnabled(binding.config) && binding.sessionKey
+    ? routing.resolveAnthropicAccountForSession(binding.sessionKey, binding.config, Date.now(), binding.routeDecision, binding.model) : null;
   // Another conversation may move the automatic active pointer without revoking this
   // session's affinity. Manual selection clears affinity and precedes it in the selector.
   const selectionCurrent = sessionRoute?.reason === "affinity"
@@ -163,8 +207,9 @@ export function nativeOAuthBindingIsCurrent(binding: NativeOAuthBinding): boolea
     || (selected?.accountId === binding.selection.accountId && selected?.revision === binding.selection.revision);
   return selectionCurrent
     && !!row && !row.paused && !row.needsReauth && row.credential.expires > Date.now()
-    && !getAnthropicAccountHealthSnapshot(binding.snapshot.accountId)
-    && routeCandidates(getEligibleAnthropicAccounts(Date.now(), binding.model), binding.routeDecision).includes(binding.snapshot.accountId)
+    && !routing.getAnthropicAccountHealthSnapshot(binding.snapshot.accountId)
+    && routeCandidates(routing.getEligibleAnthropicAccounts(Date.now(), binding.model), binding.routeDecision).includes(binding.snapshot.accountId)
+    && row.credential.access === binding.snapshot.accessToken
     && credentialGeneration(row.credential) === binding.snapshot.generation
     && row.credential.accountId === binding.providerAccountUuid;
 }

package/src/server/messages-native-scope.ts

@@ -36,7 +36,10 @@ export function nativeMessagesToolScopeDenial(
         const definition = tool.definition;
         if (typeof definition.name !== "string") { anonymous.push(definition); continue; }
         // A temporary replacement keeps the declaration it shadows in scope as well.
-        definitions.set(definition.name, permanent ? [definition] : [...definitions.get(definition.name) ?? [], definition]);
+        // These arrays belong to this check, not to the caller's declarations.
+        const declarations = permanent ? [] : definitions.get(definition.name) ?? [];
+        declarations.push(definition);
+        definitions.set(definition.name, declarations);
         withdrawn.delete(definition.name);
       } else if (tool.type === "tool_reference" && typeof tool.name === "string") {
         if (block.type === "tool_removal" && permanent) withdrawn.add(tool.name);

package/src/server/messages-native-selector.ts

@@ -0,0 +1,39 @@
+/** Pure caller-forward exclusion shared by Messages ingress and protocol preview. */
+import { resolveInboundModel } from "../claude/inbound-model-options";
+import { routeConcreteModel } from "../router";
+import { configuredAnthropicInstance } from "../providers/anthropic-instance";
+import { hasOwnProvider } from "../config/provider-name";
+import type { OcxConfig } from "../types";
+
+export function messagesSelectorTargetsSecondaryInstance(
+  config: OcxConfig,
+  model: string,
+  cc: OcxConfig["claudeCode"] = config.claudeCode,
+): boolean {
+  const selector = resolveInboundModel(model, cc);
+  const slash = selector.indexOf("/");
+  if (slash <= 0) return false;
+  const qualifier = selector.slice(0, slash);
+  // An orphan or unmarked B selector must also never forward a caller's credential.
+  if (qualifier === "anthropic2") return true;
+  // Provider keys are case-sensitive and outrank aliases, including when disabled.
+  if (hasOwnProvider(config.providers, qualifier)) return false;
+  try {
+    // Concrete resolution handles configured provider aliases without picking a combo/account.
+    return routeConcreteModel(config, selector).providerName === "anthropic2";
+  } catch {
+    return config.providers.anthropic2?.alias?.trim().toLowerCase() === qualifier.toLowerCase();
+  }
+}
+
+/** A missing B row must not fall through the router's generic default-provider path. */
+export function messagesSecondaryInstanceUnavailable(
+  config: OcxConfig,
+  model: string,
+  cc: OcxConfig["claudeCode"] = config.claudeCode,
+): boolean {
+  if (!messagesSelectorTargetsSecondaryInstance(config, model, cc)) return false;
+  const provider = config.providers.anthropic2;
+  return !provider || provider.disabled === true
+    || provider.authMode === "oauth" && configuredAnthropicInstance(config, "anthropic2") !== "anthropic2";
+}