@bitkyc08/opencodex 2.8.0 → 2.9.0

package/src/oauth/anthropic-routing.ts

@@ -28,12 +28,15 @@ import {
   seedPoolRotationAccount,
 } from "../codex/pool-rotation";
 import type { OcxAccountPoolRotationStrategy, OcxConfig } from "../types";
+import { sweepExpiredOnWrite } from "../lib/state-store-sweeper";
+import { retainedUtf8Bytes } from "../lib/admission";
 
 const PROVIDER = "anthropic";
 const DEFAULT_COOLDOWN_MS = 60_000;
 const MAX_COOLDOWN_MS = 15 * 60_000;
 const AFFINITY_IDLE_TTL_MS = 24 * 60 * 60_000;
 const MAX_AFFINITY_ENTRIES = 2_000;
+const MAX_AFFINITY_COMPONENT_BYTES = 512;
 const UNKNOWN_USAGE_SCORE = 100;
 const DEFAULT_AUTO_SWITCH_THRESHOLD = 80;
 /** Cap same-request 429 rotations so short Retry-After cannot infinite-loop. */
@@ -62,6 +65,11 @@ interface AffinityEntry {
 const upstreamHealth = new Map<string, AccountHealth>();
 const sessionAffinity = new Map<string, AffinityEntry>();
 
+function normalizeAffinityComponent(value: string | null | undefined): string {
+  const normalized = value?.trim() ?? "";
+  return normalized && retainedUtf8Bytes(normalized) <= MAX_AFFINITY_COMPONENT_BYTES ? normalized : "";
+}
+
 export function anthropicAccountPoolConfig(config: OcxConfig): AnthropicAccountPoolConfig {
   const raw = config.anthropicAccountPool;
   if (!raw || typeof raw !== "object") return {};
@@ -110,12 +118,26 @@ export function clearAnthropicAccountCooldown(accountId: string): boolean {
   return upstreamHealth.delete(accountId);
 }
 
+export function sweepExpiredAnthropicRoutingHealth(now = Date.now()): number {
+  let removed = 0;
+  for (const [accountId, health] of upstreamHealth) {
+    if (health.cooldownUntil > now) continue;
+    upstreamHealth.delete(accountId);
+    removed += 1;
+  }
+  return removed;
+}
+
 /** Test / logout helper. */
 export function clearAnthropicAccountPoolState(): void {
   upstreamHealth.clear();
   sessionAffinity.clear();
 }
 
+export function anthropicSessionAffinitySizeForTests(): number {
+  return sessionAffinity.size;
+}
+
 function isCooled(accountId: string, now: number): boolean {
   return getAnthropicAccountHealthSnapshot(accountId, now) !== null;
 }
@@ -344,7 +366,7 @@ export function resolveAnthropicAccountForSession(
     return { accountId: set.activeAccountId, reason: "pool-disabled" };
   }
 
-  const key = sessionKey?.trim() || "";
+  const key = normalizeAffinityComponent(sessionKey);
   if (key) {
     const affined = sessionAffinity.get(key);
     if (affined && now - affined.lastUsedAt <= AFFINITY_IDLE_TTL_MS) {
@@ -374,7 +396,7 @@ export function resolveAnthropicAccountForSession(
   if (strategyPick) {
     // Do not promote active here — token validation may still fail. Callers
     // (responses/core) promote after getAnthropicPoolAccessToken succeeds.
-    if (key) {
+    if (key && normalizeAffinityComponent(strategyPick.accountId)) {
       sessionAffinity.set(key, { accountId: strategyPick.accountId, lastUsedAt: now });
       pruneExpiredAffinity(now);
     }
@@ -420,7 +442,7 @@ export function resolveAnthropicAccountForSession(
     return { accountId: null, reason: anyCooled ? "all-cooled" : "none" };
   }
 
-  if (key) {
+  if (key && normalizeAffinityComponent(accountId)) {
     sessionAffinity.set(key, { accountId, lastUsedAt: now });
     pruneExpiredAffinity(now);
   }
@@ -432,8 +454,8 @@ export function bindAnthropicSessionAffinity(
   accountId: string,
   now = Date.now(),
 ): void {
-  const key = sessionKey?.trim();
-  if (!key) return;
+  const key = normalizeAffinityComponent(sessionKey);
+  if (!key || !normalizeAffinityComponent(accountId)) return;
   sessionAffinity.set(key, { accountId, lastUsedAt: now });
   pruneExpiredAffinity(now);
 }
@@ -464,6 +486,7 @@ export function rotateAnthropicAccountOn429(
     cooldownUntil: now + cooldownMs,
     cooldownSource: parsedRetry ? "retry-after" : "default",
   });
+  sweepExpiredOnWrite(now);
   clearAnthropicSessionAffinityForAccount(failedAccountId);
   notePoolRotationFailure(POOL_KEY_ANTHROPIC, failedAccountId);
 
@@ -473,8 +496,9 @@ export function rotateAnthropicAccountOn429(
     return null;
   }
 
-  if (sessionKey?.trim()) {
-    sessionAffinity.set(sessionKey.trim(), { accountId: next, lastUsedAt: now });
+  const affinityKey = normalizeAffinityComponent(sessionKey);
+  if (affinityKey && normalizeAffinityComponent(next)) {
+    sessionAffinity.set(affinityKey, { accountId: next, lastUsedAt: now });
     pruneExpiredAffinity(now);
   }
   console.warn(

package/src/oauth/google-antigravity.ts

@@ -32,7 +32,8 @@ const SCOPES = [
 ];
 const CALLBACK_PORT = 51121;
 const CALLBACK_PATH = "/callback";
-const REFRESH_SKEW_MS = 50 * 60 * 1000; // refresh proactively ~50min before nominal 1h expiry
+// Keep provider-side margins small: the shared OAuth freshness gate applies an additional minute.
+const REFRESH_SKEW_MS = 5 * 60 * 1000;
 const REQUEST_TIMEOUT_MS = 30_000;
 const ONBOARD_ATTEMPTS = 5;
 const ONBOARD_POLL_MS = 2_000;

package/src/oauth/health.ts

@@ -3,8 +3,8 @@ import { getAnthropicAccountHealthSnapshot } from "./anthropic-routing";
 import { isAccountNeedsReauth } from "../codex/account-runtime-state";
 import { getCodexAccountCredential, listCodexAccountIds } from "../codex/account-store";
 import { MAIN_CODEX_ACCOUNT_ID } from "../codex/main-account";
+import { configuredAdminToken } from "../lib/admin-secrets";
 import { maskAccountId } from "../lib/privacy";
-import { loadServiceTokenFromFile } from "../lib/service-secrets";
 import { findLiveProxy, probeHostname } from "../server/proxy-liveness";
 import { loadAuthStore, peekAuthStore, peekOAuthRefreshIntent, readOAuthRefreshIntent } from "./store";
 import type { ProviderAccount } from "./types";
@@ -320,13 +320,20 @@ function coerceRemoteAccountHealth(
   return projectOAuthAccountHealth({ needsReauth: account.needsReauth === true });
 }
 
+type LiveProxyCodexHealthResult = {
+  source: CodexHealthSource;
+  entries: OAuthHealthEntry[] | null;
+};
+
 async function fetchCodexHealthFromLiveProxy(
   fetchImpl: typeof fetch = fetch,
   findLiveProxyImpl: typeof findLiveProxy = findLiveProxy,
-): Promise<OAuthHealthEntry[] | null> {
+): Promise<LiveProxyCodexHealthResult> {
   const live = await findLiveProxyImpl();
-  if (!live) return null;
-  const token = process.env.OPENCODEX_API_AUTH_TOKEN ?? loadServiceTokenFromFile(process.env);
+  if (!live) return { source: "unavailable", entries: null };
+  // This is a management-plane endpoint. A data-plane service token is intentionally not
+  // interchangeable with the admin credential even on loopback.
+  const token = configuredAdminToken();
   const headers: Record<string, string> = {};
   if (token) headers.Authorization = `Bearer ${token}`;
   try {
@@ -334,22 +341,29 @@ async function fetchCodexHealthFromLiveProxy(
       `http://${probeHostname(live.hostname)}:${live.port}/api/codex-auth/accounts`,
       { headers, signal: AbortSignal.timeout(4000) },
     );
-    if (!res.ok) return null;
+    if (res.status === 401 || res.status === 403) {
+      return { source: "management-auth-failed", entries: null };
+    }
+    if (!res.ok) return { source: "management-api-unavailable", entries: null };
     const json = await res.json() as { accounts?: ProxyCodexAccountHealth[] };
-    if (!Array.isArray(json.accounts)) return null;
+    if (!Array.isArray(json.accounts)) return { source: "management-api-unavailable", entries: null };
     const entries: OAuthHealthEntry[] = [];
     for (const account of json.accounts) {
       if (!account?.id || typeof account.id !== "string") continue;
       pushEntry(entries, "codex", account.id, coerceRemoteAccountHealth(account));
     }
-    return entries;
+    return { source: "management-api", entries };
   } catch {
-    return null;
+    return { source: "management-api-unavailable", entries: null };
   }
 }
 
 /** How CLI/doctor obtained Codex cooldown/reauth (proxy memory only lives in the proxy). */
-export type CodexHealthSource = "management-api" | "unavailable";
+export type CodexHealthSource =
+  | "management-api"
+  | "unavailable"
+  | "management-auth-failed"
+  | "management-api-unavailable";
 
 export type OAuthCliHealthReport = {
   entries: OAuthHealthEntry[];
@@ -359,6 +373,10 @@ export type OAuthCliHealthReport = {
 /** Shown by `ocx status` / `ocx doctor` when the proxy management API is unreachable. */
 export const CODEX_HEALTH_UNAVAILABLE_NOTE =
   "Codex health: unavailable (proxy not running; live cooldown/reauth requires the management API)";
+export const CODEX_HEALTH_AUTH_FAILED_NOTE =
+  "Codex health: unavailable (proxy running; management authentication failed)";
+export const CODEX_HEALTH_MANAGEMENT_API_UNAVAILABLE_NOTE =
+  "Codex health: unavailable (proxy running; management API did not return account health)";
 
 /**
  * CLI/doctor collector: observe-only OAuth store reads, and Codex health only from the
@@ -373,9 +391,9 @@ export async function collectOAuthHealthEntriesForCli(
 ): Promise<OAuthCliHealthReport> {
   const entries = collectOAuthHealthEntries(now, { observeOnly: true, includeLocalCodex: false });
   const remote = await fetchCodexHealthFromLiveProxy(deps.fetchImpl, deps.findLiveProxyImpl);
-  if (remote) {
-    for (const entry of remote) entries.push(entry);
+  if (remote.entries) {
+    for (const entry of remote.entries) entries.push(entry);
     return { entries, codexHealthSource: "management-api" };
   }
-  return { entries, codexHealthSource: "unavailable" };
+  return { entries, codexHealthSource: remote.source };
 }

package/src/oauth/index.ts

@@ -4,7 +4,7 @@ import type { OcxConfig, OcxProviderConfig, RefreshPolicy } from "../types";
 import { loadConfig, resolveEnvValue, saveConfig } from "../config";
 import { maskEmail } from "../lib/privacy";
 import { KiroTokenRefreshError, environmentKiroRoutingMetadata, loginKiro, refreshKiroToken, settleKiroLoginTransaction } from "./kiro";
-import { getAccountCredential, getAccountSet, removeAccount, saveAccountCredential, saveCredential, setActiveAccount, getCredential, credentialGeneration, createOAuthRefreshIntentLock, mergeAccountCredential, markAccountNeedsReauthIfGeneration, readOAuthRefreshIntent, writeOAuthRefreshIntent, clearOAuthRefreshIntent } from "./store";
+import { getAccountCredential, getAccountSet, removeAccount, saveAccountCredential, saveCredential, setActiveAccount, getCredential, credentialGeneration, createOAuthRefreshIntentLock, mergeAccountCredential, markAccountNeedsReauthIfGeneration, readOAuthRefreshIntent, writeOAuthRefreshIntent, markOAuthRefreshIntentStaleOwner, clearOAuthRefreshIntent, OAuthMutationBusyError } from "./store";
 import { loginXai, refreshXaiToken, XAI_LOCAL_CLI_DETACH_WARNING, XaiTokenRequestError } from "./xai";
 import { ANTHROPIC_OAUTH_BETA, AnthropicTokenError, loginAnthropic, refreshAnthropicToken } from "./anthropic";
 import { loginKimi, refreshKimiToken } from "./kimi";
@@ -19,7 +19,12 @@ import { resolveProviderModelDiscoveryUrl } from "../providers/model-discovery";
 import { resolveProviderTransport } from "../providers/xai-transport";
 import { detectClaudeCodeToken, detectGrokCliToken, hasComparableGrokIdentity, isSameGrokIdentity, shouldAdoptGrokGeneration } from "./local-token-detect";
 import { logOAuthEvent } from "./log";
+import { captureConfigGeneration, sweepExpiredOnWrite, type GenerationContext } from "../lib/state-store-sweeper";
+import { retainedUtf8Bytes } from "../lib/admission";
+import { randomUUID } from "node:crypto";
 export {
+  CODEX_HEALTH_AUTH_FAILED_NOTE,
+  CODEX_HEALTH_MANAGEMENT_API_UNAVAILABLE_NOTE,
   CODEX_HEALTH_UNAVAILABLE_NOTE,
   MASKED_ACCOUNT_FALLBACK,
   collectOAuthHealthEntries,
@@ -51,14 +56,57 @@ export interface OAuthAccessSnapshot {
   kiro?: Pick<KiroOAuthMetadata, "profileArn" | "apiRegion" | "ssoRegion">;
 }
 
-const tokenRefreshes = new Map<string, Promise<OAuthAccessSnapshot>>();
+const MAX_OAUTH_TOKEN_REFRESH_FLIGHTS = 32;
+const OAUTH_TOKEN_REFRESH_FLIGHT_STALE_MS = 120_000;
+interface OAuthRefreshFlightEvidence { flightId: string; dispatched: boolean }
+interface OAuthTokenRefreshFlight extends OAuthRefreshFlightEvidence { promise: Promise<OAuthAccessSnapshot>; startedAt: number; abort: AbortController }
+const tokenRefreshes = new Map<string, OAuthTokenRefreshFlight>();
+export class OAuthTokenRefreshBusyError extends Error {
+  readonly code = "OAUTH_TOKEN_REFRESH_BUSY";
+  readonly retryable = true;
+  constructor() { super("OAuth token refresh capacity reached"); this.name = "OAuthTokenRefreshBusyError"; }
+}
+export class OAuthTokenRefreshStaleError extends Error {
+  readonly code = "OAUTH_TOKEN_REFRESH_STALE";
+  readonly retryable = true;
+  constructor() { super("OAuth token refresh owner became stale"); this.name = "OAuthTokenRefreshStaleError"; }
+}
+
+/** Focused owner-identity tests only. Synthetic owners retain no account data. */
+export function seedOAuthTokenRefreshFlightsForTests(rows: Array<{ key: string; startedAt?: number; flightId?: string; dispatched?: boolean }>): {
+  promises: Promise<OAuthAccessSnapshot>[];
+  cleanup: () => void;
+} {
+  const inserted: OAuthTokenRefreshFlight[] = [];
+  const promises = rows.map(({ key, startedAt, flightId, dispatched }) => {
+    const abort = new AbortController();
+    const promise = new Promise<OAuthAccessSnapshot>((_resolve, reject) => {
+      abort.signal.addEventListener("abort", () => reject(abort.signal.reason), { once: true });
+    });
+    const flight = { promise, startedAt: startedAt ?? Date.now(), abort, flightId: flightId ?? randomUUID(), dispatched: dispatched ?? false };
+    tokenRefreshes.set(key, flight);
+    inserted.push(flight);
+    return promise;
+  });
+  return {
+    promises,
+    cleanup() {
+      for (const [key, flight] of tokenRefreshes) {
+        if (!inserted.includes(flight)) continue;
+        tokenRefreshes.delete(key);
+        flight.abort.abort(new Error("test cleanup"));
+      }
+    },
+  };
+}
 const XAI_PERMANENT_FAILURE_TTL_MS=30_000;
 const permanentRefreshFailures=new Map<string,number>();
-interface XaiRefreshDeps { intentLock?:ReturnType<typeof createOAuthRefreshIntentLock>; now?:()=>number; afterPrePersistRead?:()=>void|Promise<void> }
-interface AnthropicRefreshDeps { intentLock?:ReturnType<typeof createOAuthRefreshIntentLock>; now?:()=>number; afterPrePersistRead?:()=>void|Promise<void> }
-interface GenericRefreshDeps { intentLock?:ReturnType<typeof createOAuthRefreshIntentLock>; afterPrePersistRead?:()=>void|Promise<void> }
+interface XaiRefreshDeps { intentLock?:ReturnType<typeof createOAuthRefreshIntentLock>; now?:()=>number; afterPrePersistRead?:()=>void|Promise<void>; signal?: AbortSignal }
+interface AnthropicRefreshDeps { intentLock?:ReturnType<typeof createOAuthRefreshIntentLock>; now?:()=>number; afterPrePersistRead?:()=>void|Promise<void>; signal?: AbortSignal; flight?: OAuthRefreshFlightEvidence; replacedStaleFlight?: OAuthRefreshFlightEvidence }
+interface GenericRefreshDeps { intentLock?:ReturnType<typeof createOAuthRefreshIntentLock>; afterPrePersistRead?:()=>void|Promise<void>; signal?: AbortSignal }
 function verdictKey(p:string,a:string,c:OAuthCredentials){return `${p}\0${a}\0${credentialGeneration(c)}`;}
 function cached(p:string,a:string,c:OAuthCredentials,now:()=>number){const k=verdictKey(p,a,c),u=permanentRefreshFailures.get(k);if(u===undefined)return false;if(u<=now()){permanentRefreshFailures.delete(k);return false;}return true;}
+export function sweepExpiredXaiPermanentFailureVerdicts(now=Date.now()):number{let removed=0;for(const[key,until]of permanentRefreshFailures){if(until>now)continue;permanentRefreshFailures.delete(key);removed+=1;}return removed;}
 
 export interface LoginOpts { forceLogin?: boolean; /** When set, persist into this account slot and require matching identity. */ reauthAccountId?: string }
 
@@ -244,24 +292,44 @@ async function resolveAccessSnapshotForAccount(
   if (rejectedGeneration === undefined && cred.expires > Date.now() + REFRESH_SKEW_MS) return current;
 
   const key = `${provider}\u0000${accountId}`;
-  const existing = tokenRefreshes.get(key);
-  if (existing) {
+  let existing = tokenRefreshes.get(key);
+  let replacedStaleFlight: OAuthRefreshFlightEvidence | undefined;
+  if (existing && Date.now() - existing.startedAt <= OAUTH_TOKEN_REFRESH_FLIGHT_STALE_MS) {
     logOAuthEvent("OAuth refresh joined existing operation", { provider, accountId });
-    return existing;
+    return existing.promise;
+  }
+  if (existing) {
+    replacedStaleFlight = { flightId: existing.flightId, dispatched: existing.dispatched };
+    existing.abort.abort(new OAuthTokenRefreshStaleError());
+    if (tokenRefreshes.get(key) === existing) tokenRefreshes.delete(key);
+    existing = undefined;
   }
+  if (tokenRefreshes.size >= MAX_OAUTH_TOKEN_REFRESH_FLIGHTS) throw new OAuthTokenRefreshBusyError();
 
+  const abort = new AbortController();
+  const flight: OAuthTokenRefreshFlight = {
+    promise: undefined as unknown as Promise<OAuthAccessSnapshot>,
+    startedAt: Date.now(),
+    abort,
+    flightId: randomUUID(),
+    dispatched: false,
+  };
   const refresh = (async (): Promise<OAuthAccessSnapshot> => {
-    const accessToken = await refreshAndPersistAccessToken(provider, accountId, def, cred);
+    const accessToken = await refreshAndPersistAccessToken(provider, accountId, def, cred, abort.signal, flight, replacedStaleFlight);
     const persisted = getAccountCredential(provider, accountId);
     if (!persisted) throw new OAuthLoginRequiredError(provider);
     if (persisted.access !== accessToken) {
       throw new Error(`OAuth refresh persisted an unexpected access token for ${provider}`);
     }
     return accessSnapshot(provider, accountId, persisted);
-  })().finally(() => {
-    if (tokenRefreshes.get(key) === refresh) tokenRefreshes.delete(key);
+  })().catch(error => {
+    if (abort.signal.reason instanceof OAuthTokenRefreshStaleError) throw abort.signal.reason;
+    throw error;
+  }).finally(() => {
+    if (tokenRefreshes.get(key) === flight) tokenRefreshes.delete(key);
   });
-  tokenRefreshes.set(key, refresh);
+  flight.promise = refresh;
+  tokenRefreshes.set(key, flight);
   return refresh;
 }
 
@@ -323,7 +391,7 @@ function merged(fresh: OAuthCredentials, previous: OAuthCredentials): OAuthCrede
     ...(fresh.kiro === undefined && previous.kiro ? { kiro: previous.kiro } : {}),
   };
 }
-export async function refreshXaiAccountWithLock(provider:string,accountId:string,def:OAuthProviderDef,callerCredential:OAuthCredentials,deps:XaiRefreshDeps={}):Promise<string>{const now=deps.now??Date.now;const guard=await(deps.intentLock??createOAuthRefreshIntentLock(provider,accountId)).acquire();try{const stored=getAccountCredential(provider,accountId);if(!stored)throw new OAuthLoginRequiredError(provider);const active=getAccountSet(provider)?.activeAccountId===accountId,candidate=authoritative(stored,active,now);if(credentialGeneration(candidate)!==credentialGeneration(callerCredential)&&candidate.expires>now()+REFRESH_SKEW_MS){if(credentialGeneration(candidate)!==credentialGeneration(stored)){const o=await mergeAccountCredential(provider,accountId,candidate,{expectedGeneration:credentialGeneration(stored),afterPrePersistRead:deps.afterPrePersistRead});if(o.superseded){if(o.stored.expires>now()+REFRESH_SKEW_MS)return o.stored.access;throw new OAuthLoginRequiredError(provider);}}return candidate.access;}if(cached(provider,accountId,candidate,now))throw new OAuthLoginRequiredError(provider);const generation=credentialGeneration(candidate);try{const fresh=merged(await def.refresh(candidate.refresh),candidate);const o=await mergeAccountCredential(provider,accountId,fresh,{expectedGeneration:generation,afterPrePersistRead:deps.afterPrePersistRead});if(o.superseded){if(o.stored.expires>now()+REFRESH_SKEW_MS)return o.stored.access;throw new OAuthLoginRequiredError(provider);}permanentRefreshFailures.delete(verdictKey(provider,accountId,candidate));if(candidate.source==="local-cli")console.warn(XAI_LOCAL_CLI_DETACH_WARNING);return fresh.access;}catch(error){if(!terminal(error))throw error;permanentRefreshFailures.set(verdictKey(provider,accountId,candidate),now()+XAI_PERMANENT_FAILURE_TTL_MS);await markAccountNeedsReauthIfGeneration(provider,accountId,generation);throw new OAuthLoginRequiredError(provider);}}finally{guard.release();}}
+export async function refreshXaiAccountWithLock(provider:string,accountId:string,def:OAuthProviderDef,callerCredential:OAuthCredentials,deps:XaiRefreshDeps={}):Promise<string>{const writerGeneration=captureConfigGeneration();const now=deps.now??Date.now;const guard=await(deps.intentLock??createOAuthRefreshIntentLock(provider,accountId)).acquire();try{const stored=getAccountCredential(provider,accountId);if(!stored)throw new OAuthLoginRequiredError(provider);const active=getAccountSet(provider)?.activeAccountId===accountId,candidate=authoritative(stored,active,now);if(credentialGeneration(candidate)!==credentialGeneration(callerCredential)&&candidate.expires>now()+REFRESH_SKEW_MS){if(credentialGeneration(candidate)!==credentialGeneration(stored)){const o=await mergeAccountCredential(provider,accountId,candidate,{expectedGeneration:credentialGeneration(stored),afterPrePersistRead:deps.afterPrePersistRead});if(o.superseded){if(o.stored.expires>now()+REFRESH_SKEW_MS)return o.stored.access;throw new OAuthLoginRequiredError(provider);}}return candidate.access;}if(cached(provider,accountId,candidate,now))throw new OAuthLoginRequiredError(provider);const generation=credentialGeneration(candidate);try{const fresh=merged(await def.refresh(candidate.refresh,deps.signal),candidate);const o=await mergeAccountCredential(provider,accountId,fresh,{expectedGeneration:generation,afterPrePersistRead:deps.afterPrePersistRead});if(o.superseded){if(o.stored.expires>now()+REFRESH_SKEW_MS)return o.stored.access;throw new OAuthLoginRequiredError(provider);}permanentRefreshFailures.delete(verdictKey(provider,accountId,candidate));if(candidate.source==="local-cli")console.warn(XAI_LOCAL_CLI_DETACH_WARNING);return fresh.access;}catch(error){if(error instanceof OAuthMutationBusyError){permanentRefreshFailures.delete(verdictKey(provider,accountId,candidate));throw error;}if(!terminal(error))throw error;const failedAt=now();permanentRefreshFailures.set(verdictKey(provider,accountId,candidate),failedAt+XAI_PERMANENT_FAILURE_TTL_MS);sweepExpiredOnWrite(failedAt);await markAccountNeedsReauthIfGeneration(provider,accountId,generation,writerGeneration);throw new OAuthLoginRequiredError(provider);}}finally{guard.release();}}
 
 function newerClaudeCredential(stored: OAuthCredentials, now: number): OAuthCredentials | undefined {
   if (stored.source !== "local-cli") return undefined;
@@ -339,6 +407,7 @@ export async function refreshAnthropicAccountWithLock(
   callerCredential: OAuthCredentials,
   deps: AnthropicRefreshDeps = {},
 ): Promise<string> {
+  const writerGeneration = captureConfigGeneration();
   const now = deps.now ?? Date.now;
   const guard = await (deps.intentLock ?? createOAuthRefreshIntentLock(provider, accountId)).acquire();
   try {
@@ -346,7 +415,7 @@ export async function refreshAnthropicAccountWithLock(
     if (!stored) throw new OAuthLoginRequiredError(provider);
     const account = getAccountSet(provider)?.accounts.find(candidate => candidate.id === accountId);
     const generation = credentialGeneration(stored);
-    const pendingIntent = readOAuthRefreshIntent(provider, accountId);
+    let pendingIntent = readOAuthRefreshIntent(provider, accountId);
     const disk = newerClaudeCredential(stored, now());
     if (disk) {
       const outcome = await mergeAccountCredential(provider, accountId, disk, {
@@ -361,8 +430,19 @@ export async function refreshAnthropicAccountWithLock(
       if (pendingIntent) clearOAuthRefreshIntent(provider, accountId, pendingIntent.generation);
       return disk.access;
     }
+    if (!pendingIntent?.uncertain && pendingIntent?.generation === generation) {
+      if (pendingIntent.staleOwner) throw new OAuthTokenRefreshStaleError();
+      if (deps.replacedStaleFlight && pendingIntent.flightId === deps.replacedStaleFlight.flightId) {
+        if (deps.replacedStaleFlight.dispatched) {
+          markOAuthRefreshIntentStaleOwner(provider, accountId, generation, deps.replacedStaleFlight.flightId);
+          throw new OAuthTokenRefreshStaleError();
+        }
+        clearOAuthRefreshIntent(provider, accountId, generation);
+        pendingIntent = undefined;
+      }
+    }
     if (pendingIntent?.uncertain || pendingIntent?.generation === generation) {
-      await markAccountNeedsReauthIfGeneration(provider, accountId, generation);
+      await markAccountNeedsReauthIfGeneration(provider, accountId, generation, writerGeneration);
       throw new OAuthLoginRequiredError(provider);
     }
     if (pendingIntent) clearOAuthRefreshIntent(provider, accountId, pendingIntent.generation);
@@ -374,8 +454,10 @@ export async function refreshAnthropicAccountWithLock(
     }
 
     try {
-      writeOAuthRefreshIntent(provider, accountId, generation, now());
-      const fresh = merged(await def.refresh(stored.refresh), stored);
+      writeOAuthRefreshIntent(provider, accountId, generation, now(), deps.flight?.flightId);
+      if (deps.signal?.aborted) throw deps.signal.reason;
+      if (deps.flight) deps.flight.dispatched = true;
+      const fresh = merged(await def.refresh(stored.refresh, deps.signal), stored);
       const outcome = await mergeAccountCredential(provider, accountId, fresh, {
         expectedGeneration: generation,
         afterPrePersistRead: deps.afterPrePersistRead,
@@ -388,8 +470,9 @@ export async function refreshAnthropicAccountWithLock(
       clearOAuthRefreshIntent(provider, accountId, generation);
       return fresh.access;
     } catch (error) {
+      if (error instanceof OAuthMutationBusyError) throw error;
       if (!terminal(error)) throw error;
-      await markAccountNeedsReauthIfGeneration(provider, accountId, generation);
+      await markAccountNeedsReauthIfGeneration(provider, accountId, generation, writerGeneration);
       clearOAuthRefreshIntent(provider, accountId, generation);
       throw new OAuthLoginRequiredError(provider);
     }
@@ -405,6 +488,7 @@ export async function refreshGenericAccountWithLock(
   callerCredential: OAuthCredentials,
   deps: GenericRefreshDeps = {},
 ): Promise<string> {
+  const writerGeneration = captureConfigGeneration();
   logOAuthEvent("OAuth refresh started", { provider, accountId });
   const guard = await (deps.intentLock ?? createOAuthRefreshIntentLock(provider, accountId)).acquire();
   try {
@@ -419,7 +503,7 @@ export async function refreshGenericAccountWithLock(
     }
     const generation = credentialGeneration(stored);
     try {
-      const fresh = merged(await def.refresh(stored.refresh, undefined, stored), stored);
+      const fresh = merged(await def.refresh(stored.refresh, deps.signal, stored), stored);
       const outcome = await mergeAccountCredential(provider, accountId, fresh, {
         expectedGeneration: generation,
         afterPrePersistRead: deps.afterPrePersistRead,
@@ -431,8 +515,9 @@ export async function refreshGenericAccountWithLock(
       logOAuthEvent("OAuth credentials rotated and persisted", { provider, accountId });
       return fresh.access;
     } catch (error) {
+      if (error instanceof OAuthMutationBusyError) throw error;
       if (!terminal(error)) throw error;
-      await markAccountNeedsReauthIfGeneration(provider, accountId, generation);
+      await markAccountNeedsReauthIfGeneration(provider, accountId, generation, writerGeneration);
       throw new OAuthLoginRequiredError(provider);
     }
   } finally {
@@ -445,10 +530,13 @@ async function refreshAndPersistAccessToken(
   accountId: string,
   def: OAuthProviderDef,
   cred: OAuthCredentials,
+  signal?: AbortSignal,
+  flight?: OAuthRefreshFlightEvidence,
+  replacedStaleFlight?: OAuthRefreshFlightEvidence,
 ): Promise<string> {
-  if (provider === "xai") return refreshXaiAccountWithLock(provider, accountId, def, cred);
-  if (provider === "anthropic") return refreshAnthropicAccountWithLock(provider, accountId, def, cred);
-  return refreshGenericAccountWithLock(provider, accountId, def, cred);
+  if (provider === "xai") return refreshXaiAccountWithLock(provider, accountId, def, cred, { signal });
+  if (provider === "anthropic") return refreshAnthropicAccountWithLock(provider, accountId, def, cred, { signal, flight, replacedStaleFlight });
+  return refreshGenericAccountWithLock(provider, accountId, def, cred, { signal });
 }
 
 /**
@@ -831,6 +919,21 @@ interface ManualCodeSlot {
   expectedState?: string;
 }
 const loginManual = new Map<string, ManualCodeSlot>();
+const OAUTH_PENDING_CODE_MAX_BYTES = 4 * 1024;
+let lastOAuthFlowReconciledGeneration = 0;
+
+export function reconcileOAuthFlowState(context: GenerationContext): number {
+  if (context.generation <= lastOAuthFlowReconciledGeneration) return 0;
+  let removed = 0;
+  for (const [provider, state] of loginState) {
+    if (context.providerNames.has(provider) || !state.done || loginAbort.has(provider)) continue;
+    if (loginState.delete(provider)) removed += 1;
+    if (loginManual.delete(provider)) removed += 1;
+    if (loginAbort.delete(provider)) removed += 1;
+  }
+  lastOAuthFlowReconciledGeneration = context.generation;
+  return removed;
+}
 
 function clearManualCodeSlot(provider: string): void {
   loginManual.delete(provider);
@@ -879,6 +982,7 @@ function waitForManualLoginCode(provider: string, signal: AbortSignal, expectedS
 export function submitManualLoginCode(provider: string, input: string): { ok: true } | { ok: false; error: string } {
   const trimmed = input.trim();
   if (!trimmed) return { ok: false, error: "empty code" };
+  if (retainedUtf8Bytes(trimmed) > OAUTH_PENDING_CODE_MAX_BYTES) return { ok: false, error: "code too large" };
   const st = loginState.get(provider);
   if (!st || st.done) return { ok: false, error: "no login in progress" };
   const slot = ensureManualCodeSlot(provider);

package/src/oauth/kiro-credentials.ts

@@ -1,5 +1,5 @@
 import { randomUUID } from "node:crypto";
-import { chmodSync, closeSync, existsSync, fsyncSync, linkSync, openSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { chmodSync, closeSync, existsSync, fsyncSync, linkSync, openSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { isAbsolute, join, posix, win32 } from "node:path";
 import { Database } from "bun:sqlite";
@@ -169,6 +169,77 @@ export function resolveKiroCliNativeSessionEntries(
   return [{ location: "kiro-cli-linux-data", path: posix.join(home, ".local", "share", "kiro-cli", "data.sqlite3") }];
 }
 
+/**
+ * Resolve the absolute kiro-cli executable for spawn/login helpers.
+ *
+ * Pure + parameterized like `resolveKiroCliNativeSessionEntries` so Windows install layouts can be
+ * covered from any host. PATH remains the first choice; only when bare `kiro-cli` is missing do we
+ * fall back to the platform-native install directories next to the session database.
+ *
+ * Windows: official MSI installs to `C:\Program Files\Kiro-Cli\kiro-cli.exe`, while some local
+ * installs keep the binary next to `%LOCALAPPDATA%\Kiro-Cli\data.sqlite3`.
+ * macOS/Linux: prefer PATH, then the usual user-local bin directories.
+ */
+export function resolveKiroCliExecutable(
+  inputs: KiroCliNativeInputs & {
+    pathEntries?: string[];
+    exists?: (path: string) => boolean;
+    isFile?: (path: string) => boolean;
+  },
+): string {
+  const exists = inputs.exists ?? existsSync;
+  // A directory named `kiro-cli` on PATH satisfies existsSync and would then be handed to
+  // spawn(), which fails with EACCES at login instead of falling through to the next candidate.
+  // When a caller injects `exists` it owns the whole filesystem view, so the real stat would
+  // reject every synthetic path; such callers inject `isFile` too when they care about it.
+  const isFile = inputs.isFile ?? (inputs.exists ? () => true : ((path: string) => {
+    try {
+      return statSync(path).isFile();
+    } catch {
+      return false;
+    }
+  }));
+  const pathEntries = inputs.pathEntries
+    ?? (inputs.env.PATH ?? inputs.env.Path ?? "").split(inputs.platform === "win32" ? ";" : ":")
+      .map(entry => entry.trim())
+      .filter(Boolean);
+
+  const pathCandidates = inputs.platform === "win32"
+    ? pathEntries.flatMap(entry => [
+        win32.join(entry, "kiro-cli.exe"),
+        win32.join(entry, "kiro-cli"),
+      ])
+    : pathEntries.map(entry => posix.join(entry, "kiro-cli"));
+
+  const installCandidates: string[] = [];
+  if (inputs.platform === "win32") {
+    const localBase = inputs.env.LOCALAPPDATA?.trim()
+      || (inputs.env.USERPROFILE?.trim() ? win32.join(inputs.env.USERPROFILE.trim(), "AppData", "Local") : "")
+      || win32.join(inputs.home, "AppData", "Local");
+    const programFiles = inputs.env["ProgramFiles"]?.trim() || "C:\\Program Files";
+    installCandidates.push(
+      win32.join(localBase, "Kiro-Cli", "kiro-cli.exe"),
+      win32.join(programFiles, "Kiro-Cli", "kiro-cli.exe"),
+    );
+  } else if (inputs.platform === "darwin") {
+    installCandidates.push(
+      posix.join(inputs.home, ".local", "bin", "kiro-cli"),
+      "/usr/local/bin/kiro-cli",
+      "/opt/homebrew/bin/kiro-cli",
+    );
+  } else {
+    installCandidates.push(
+      posix.join(inputs.home, ".local", "bin", "kiro-cli"),
+      "/usr/local/bin/kiro-cli",
+    );
+  }
+
+  for (const candidate of [...pathCandidates, ...installCandidates]) {
+    if (exists(candidate) && isFile(candidate)) return candidate;
+  }
+  return inputs.platform === "win32" ? "kiro-cli.exe" : "kiro-cli";
+}
+
 function nativeKiroCliSessionEntries(): Array<{ location: KiroCliNativeLocation; path: string }> {
   // Only the stores that `kiro-cli logout` / `kiro-cli login` themselves mutate. Import fallbacks
   // (Amazon Q / SSO cache) and KIROCLI_DB_PATH selectors must not be snapshotted for rollback.

package/src/oauth/kiro.ts

@@ -18,6 +18,7 @@ import {
   persistKiroCliSessionRecovery,
   readImportedKiroCredential,
   readKiroCliSqliteCredential,
+  resolveKiroCliExecutable,
   restoreKiroCliSession,
   restoreStaleKiroCliSessionRecovery,
   requireKiroRegion,
@@ -25,11 +26,14 @@ import {
   type KiroCliSessionSnapshot,
   type KiroImportDiagnostic,
 } from "./kiro-credentials";
+import { homedir } from "node:os";
 import { getAccountSet, saveAccountCredential } from "./store";
 
 const DEFAULT_REGION = "us-east-1";
 const REFRESH_URL = "https://prod.{region}.auth.desktop.kiro.dev/refreshToken";
 const OIDC_URL = "https://oidc.{region}.amazonaws.com/token";
+const KIRO_CLI_UNIX_INSTALL_COMMAND = "curl -fsSL https://cli.kiro.dev/install | bash";
+const KIRO_CLI_WINDOWS_INSTALL_COMMAND = "irm 'https://cli.kiro.dev/install.ps1' | iex";
 const KIRO_TERMINAL_REFRESH_ERRORS = new Set([
   "invalid_grant",
   "refresh_token_reused",
@@ -68,13 +72,28 @@ export interface KiroLoginOptions {
   cliRunner?: KiroCliRunner;
 }
 
+export function kiroCliInstallGuidance(platform = process.platform): string {
+  return platform === "win32"
+    ? `install the Kiro CLI in PowerShell (\`${KIRO_CLI_WINDOWS_INSTALL_COMMAND}\`)`
+    : `install the Kiro CLI (\`${KIRO_CLI_UNIX_INSTALL_COMMAND}\`)`;
+}
+
 const pendingKiroLoginTransactions = new WeakMap<OAuthCredentials, KiroCliSessionSnapshot>();
 /** Forced logins that started with no native CLI DB must logout on persistence failure. */
 const pendingKiroEmptyPriorSessions = new WeakSet<OAuthCredentials>();
 
+
+function resolveRuntimeKiroCliExecutable(): string {
+  return resolveKiroCliExecutable({
+    env: process.env,
+    platform: process.platform,
+    home: process.platform === "win32" ? homedir() : (process.env.HOME || homedir()),
+  });
+}
+
 function logoutKiroCliBestEffort(): void {
   try {
-    Bun.spawnSync(["kiro-cli", "logout"], {
+    Bun.spawnSync([resolveRuntimeKiroCliExecutable(), "logout"], {
       stdin: "ignore",
       stdout: "ignore",
       stderr: "ignore",
@@ -128,7 +147,7 @@ async function defaultKiroCliRunner(args: string[], signal?: AbortSignal): Promi
   throwIfKiroLoginCancelled(signal);
   let child: ReturnType<typeof Bun.spawn>;
   try {
-    child = Bun.spawn(["kiro-cli", ...args], {
+    child = Bun.spawn([resolveRuntimeKiroCliExecutable(), ...args], {
       stdin: "ignore",
       stdout: "pipe",
       stderr: "ignore",
@@ -346,7 +365,7 @@ export async function loginKiro(ctrl: OAuthController, options: KiroLoginOptions
       url: "",
       instructions:
         "No kiro-cli token found. Paste a Kiro access token below (starts with 'aoa'). " +
-        "Otherwise install the Kiro CLI (`curl -fsSL https://cli.kiro.dev/install | bash`), " +
+        `Otherwise ${kiroCliInstallGuidance()}, ` +
         "run `kiro-cli login`, and retry — or set KIRO_ACCESS_TOKEN.",
     });
     ctrl.onProgress?.("No kiro-cli token found. Paste a Kiro access token (starts with 'aoa'), or install the Kiro CLI and run `kiro-cli login` first.");
@@ -364,7 +383,7 @@ export async function loginKiro(ctrl: OAuthController, options: KiroLoginOptions
   }
 
   throw new Error(
-    "Kiro: no token found. Install the Kiro CLI (`curl -fsSL https://cli.kiro.dev/install | bash`) " +
+    `Kiro: no token found. ${kiroCliInstallGuidance()} ` +
       "and run `kiro-cli login` to import its session, or set KIRO_ACCESS_TOKEN. " +
       "Browser login is not supported for Kiro.",
   );