@bitkyc08/opencodex 2.80.0 → 2.81.0

package/src/oauth/anthropic-send-ownership.ts

@@ -0,0 +1,41 @@
+/** Ownership captured before a physical send, independent of subsequent cooldown observations. */
+import type { OAuthAccessSnapshot } from "./index";
+import { credentialGeneration, getAccountSet } from "./store";
+import { isAnthropicInstanceId, type AnthropicInstanceId } from "../providers/anthropic-instance-id";
+import { anthropicCooldownRecoveryFor } from "../providers/quota/anthropic-cooldown-recovery";
+import { captureProviderAccountQuotaEpoch } from "../providers/quota/account-cache";
+
+export type AnthropicPhysicalSendOwnership = Readonly<{
+  provider: AnthropicInstanceId;
+  accountId: string;
+  accessToken: string;
+  generation: string;
+  accountIncarnation: number;
+  loginId?: string;
+  addedAt?: number;
+  quotaEpoch: number;
+}>;
+
+/** Namespace API: config/target admission remains with the config-aware physical caller. */
+export function captureAnthropicPhysicalSendOwnership(snapshot: OAuthAccessSnapshot): AnthropicPhysicalSendOwnership | null {
+  if (!isAnthropicInstanceId(snapshot.provider)) return null;
+  const row = getAccountSet(snapshot.provider)?.accounts.find(account => account.id === snapshot.accountId);
+  if (!row || row.paused || row.needsReauth || row.credential.access !== snapshot.accessToken
+    || credentialGeneration(row.credential) !== snapshot.generation) return null;
+  return Object.freeze({
+    provider: snapshot.provider, accountId: snapshot.accountId,
+    accessToken: snapshot.accessToken, generation: snapshot.generation,
+    accountIncarnation: anthropicCooldownRecoveryFor(snapshot.provider).reserveAnthropicAccountIncarnation(snapshot.accountId),
+    loginId: row.loginId, addedAt: row.addedAt,
+    quotaEpoch: captureProviderAccountQuotaEpoch(snapshot.provider),
+  });
+}
+
+/** Pure ownership read: never adopt or reserve the replacement account's current incarnation. */
+export function anthropicPhysicalSendOwnershipIsCurrent(owner: AnthropicPhysicalSendOwnership): boolean {
+  const row = getAccountSet(owner.provider)?.accounts.find(account => account.id === owner.accountId);
+  return !!row && row.loginId === owner.loginId && row.addedAt === owner.addedAt
+    && row.credential.access === owner.accessToken && credentialGeneration(row.credential) === owner.generation
+    && anthropicCooldownRecoveryFor(owner.provider).anthropicAccountIncarnation(owner.accountId) === owner.accountIncarnation
+    && captureProviderAccountQuotaEpoch(owner.provider) === owner.quotaEpoch;
+}

package/src/oauth/anthropic.ts

@@ -4,6 +4,8 @@ import { bindAnthropicIdentity, resolveAnthropicAccountIdentity } from "./anthro
 import { generatePKCE } from "./pkce";
 import type { LocalTokenImportMode, OAuthController, OAuthCredentials } from "./types";
 import { outboundProxyConfigured, startupOutboundProxyConfigured } from "../lib/proxy-env";
+import type { AnthropicInstanceId } from "../providers/anthropic-instance-id";
+import { AnthropicLocalCliImportError } from "./store-anthropic-instance";
 
 const CLIENT_ID = atob("OWQxYzI1MGEtZTYxYi00NGQ5LTg4ZWQtNTk0NGQxOTYyZjVl");
 const AUTHORIZE_URL = "https://claude.ai/oauth/authorize";
@@ -178,9 +180,10 @@ export class AnthropicOAuthFlow extends OAuthCallbackFlow {
 
 export async function loginAnthropic(
   ctrl: OAuthController,
-  opts?: { importLocal?: LocalTokenImportMode },
+  opts?: { importLocal?: LocalTokenImportMode; instance?: AnthropicInstanceId },
 ): Promise<OAuthCredentials> {
   const importLocal = opts?.importLocal ?? "off";
+  if (opts?.instance === "anthropic2" && importLocal !== "off") throw new AnthropicLocalCliImportError();
   if (importLocal !== "off") {
     const { detectClaudeCodeToken } = await import("./local-token-detect");
     const local = detectClaudeCodeToken();

package/src/oauth/generic-account-failover.ts

@@ -1,3 +1,4 @@
+import { isBuiltinAnthropicInstanceRow } from "../providers/anthropic-instance";
 /**
  * Generic OAuth multi-account 429 failover (#2568).
  *
@@ -157,7 +158,8 @@ export function kiroAutoSelection(
 
 /** True when this provider participates in generic rotation at all. */
 export function isGenericFailoverProvider(providerName: string, provider: OcxProviderConfig): boolean {
-  return provider.authMode === "oauth" && !EXCLUDED_PROVIDERS.has(providerName);
+  return provider.authMode === "oauth" && !EXCLUDED_PROVIDERS.has(providerName)
+    && !isBuiltinAnthropicInstanceRow(providerName, provider);
 }
 
 /**

package/src/oauth/health.ts

@@ -1,7 +1,8 @@
+import { isAnthropicInstanceId } from "../providers/anthropic-instance-id";
 import type { MainAccountHardLockStatus } from "../codex/main-account-hard-lock";
 import type { MainAccountExternalUsageWarning } from "../codex/main-account-external-usage";
 import { getCodexAccountHealthSnapshot, type CodexCooldownSource } from "../codex/routing";
-import { getAnthropicAccountHealthSnapshot } from "./anthropic-routing";
+import { anthropicRoutingFor } from "./anthropic-routing";
 import { isAccountNeedsReauth } from "../codex/account-runtime-state";
 import { getCodexAccountCredential, listCodexAccountIds, readCodexAccountRecord } from "../codex/account-store";
 import { MAIN_CODEX_ACCOUNT_ID } from "../codex/main-account";
@@ -10,7 +11,7 @@ import { LOCAL_MANAGEMENT_READ_PATHS } from "../lib/local-management-capability"
 import { maskAccountId } from "../lib/privacy";
 import { findLiveProxy } from "../server/proxy-liveness";
 import { fetchBoundLocalManagementRead } from "../server/local-management-read-client";
-import { loadAuthStore, peekAuthStore, peekOAuthRefreshIntent, readOAuthRefreshIntent } from "./store";
+import { accountNeedsReauthForStatus, loadAuthStore, peekAuthStore, peekOAuthRefreshIntent, readOAuthRefreshIntent } from "./store";
 import type { ProviderAccount } from "./types";
 
 export type OAuthAccountHealth =
@@ -207,12 +208,13 @@ export function projectStoredOAuthAccountHealth(
   now = Date.now(),
   opts: { observeOnly?: boolean } = {},
 ): OAuthAccountHealth {
-  const anthropicSnap = provider === "anthropic"
-    ? getAnthropicAccountHealthSnapshot(account.id, now)
+  const anthropicSnap = isAnthropicInstanceId(provider)
+    ? anthropicRoutingFor(provider).getAnthropicAccountHealthSnapshot(account.id, now)
     : null;
+  const needsReauth = accountNeedsReauthForStatus(provider, account, now);
   return projectOAuthAccountHealth({
-    needsReauth: account.needsReauth === true,
-    reauthReason: account.needsReauth === true
+    needsReauth,
+    reauthReason: needsReauth
       ? (account.needsReauthReason ?? "refresh_failed")
       : undefined,
     cooldownUntilMs: anthropicSnap?.cooldownUntil,

package/src/oauth/index.ts

@@ -1,7 +1,7 @@
 import type { KiroOAuthMetadata, OAuthController, OAuthCredentials } from "./types";
 import { initializeProviderModelSelection } from "../providers/initial-model-selection";
 import type { OcxConfig, OcxProviderConfig, RefreshPolicy } from "../types";
-import { ConfigMutationLockError, loadConfig, mutatePersistedConfig, saveConfig } from "../config";
+import { getDefaultConfig, initializePersistedConfigIfMissing, loadConfig, mutatePersistedConfig, observeInitialConfigState, saveConfig } from "../config";
 import { resolveProviderApiKey } from "../providers/key-store";
 import { projectEmail } from "../lib/privacy";
 import { KiroTokenRefreshError, environmentKiroRoutingMetadata, loginKiro, refreshKiroToken, settleKiroLoginTransaction } from "./kiro";
@@ -9,15 +9,13 @@ import {
   OAuthMutationBusyError,
   OAuthRefreshIntentIOError,
   clearOAuthRefreshIntent,
-  clearOAuthRefreshIntentIfMatch,
   createOAuthRefreshIntentLock,
   credentialGeneration,
   getAccountCredential,
   getAccountCredentialWithStatus,
   getAccountSet,
   getCredential,
-  markAccountNeedsReauthIfGeneration,
-  markOAuthRefreshIntentCleanupPending,
+  markAccountNeedsReauthIfGeneration, accountNeedsReauthForStatus, markAccountRefreshAttentionIfGeneration,
   markOAuthRefreshIntentStaleOwner,
   mergeAccountCredential,
   normalizeAuthStoreBuffer,
@@ -29,11 +27,15 @@ import {
   writeOAuthRefreshIntent,
   type OAuthCredentialWriteReceipt,
   type OAuthRefreshIntent,
-  type OAuthRefreshIntentCleanupPending,
   type AuthStore,
 } from "./store";
 import { loginXai, refreshXaiToken, XAI_LOCAL_CLI_DETACH_WARNING, XaiTokenRequestError } from "./xai";
-import { ANTHROPIC_OAUTH_BETA, AnthropicTokenError, loginAnthropic, refreshAnthropicToken } from "./anthropic";
+import { ANTHROPIC_OAUTH_BETA, AnthropicTokenError } from "./anthropic";
+import { isAnthropicOAuthInstance, anthropicInstanceRowShapeMatches } from "../providers/anthropic-instance";
+import { captureModelsOAuthTarget, guardModelsOAuthRequest, mayResolveModelsOAuth } from "./model-discovery-auth";
+import { anthropicOAuthDefinition, assertAnthropicInstanceLoginConfig, AnthropicInstanceCollisionError,
+  clearAnthropicRefreshIntentBestEffort, clearAnthropicRefreshIntentForKnownFailure,
+  resumeAnthropicRefreshIntentCleanup, clearObservedAnthropicRefreshIntent } from "./anthropic-oauth-definitions";
 import { loginKimi, refreshKimiToken } from "./kimi";
 import { loginNous, NousTokenError, refreshNousToken, clearNousRefreshIntent, RefreshIntentIOError } from "./nous";
 import { loginChatGPT, refreshChatGPTToken, type ChatGPTLoginFlow } from "./chatgpt";
@@ -83,8 +85,9 @@ export { OAUTH_REFRESH_LOCK_WAIT_MS, peekAuthStore, peekOAuthRefreshIntent } fro
 import { codexAccountNamespaceProviderCollisionError } from "../codex/account-namespace-match";
 
 import { REFRESH_SKEW_MS } from "./refresh-policy";
-import { newerClaudeCredential, captureAnthropicCredentialOwner } from "./anthropic-continuity";
+import { newerClaudeCredentialForInstance, captureAnthropicCredentialOwnerForInstance } from "./anthropic-continuity";
 import { mergeAnthropicIdentity, type AnthropicIdentityResolver } from "./anthropic-identity";
+import { AnthropicCrossInstanceDuplicateError, AnthropicLocalCliImportError, assertAnthropicCredentialSource } from "./store-anthropic-instance";
 export interface OAuthAccessSnapshot {
   provider: string;
   accountId: string;
@@ -195,7 +198,7 @@ export interface LoginFlowLifecycle {
   onSettled?: () => void | Promise<void>;
 }
 
-interface OAuthProviderDef {
+export interface OAuthProviderDef {
   login(ctrl: OAuthController, opts?: LoginOpts, providerConfig?: OcxProviderConfig): Promise<OAuthCredentials>;
   refresh(
     refreshToken: string,
@@ -266,15 +269,8 @@ export const OAUTH_PROVIDERS: Record<string, OAuthProviderDef> = {
     providerConfig: oauthConfig("xai"),
     defaultModel: oauthDefaultModel("xai"),
   },
-  anthropic: {
-    login: (ctrl, opts) => loginAnthropic(ctrl, { importLocal: opts?.forceLogin ? "off" : "fallback" }),
-    refresh: refreshAnthropicToken,
-    providerConfig: oauthConfig("anthropic"),
-    defaultModel: oauthDefaultModel("anthropic"),
-    // Anthropic actively server-side-blocks subscription OAuth outside its own clients (Feb 2026).
-    // Never generate background refresh traffic for it — grade 20, highest ToS risk.
-    defaultRefreshPolicy: "disabled",
-  },
+  anthropic: anthropicOAuthDefinition("anthropic"),
+  anthropic2: anthropicOAuthDefinition("anthropic2"),
   kimi: {
     login: (ctrl) => loginKimi(ctrl),
     refresh: refreshKimiToken,
@@ -446,8 +442,10 @@ export class OAuthAccountPausedError extends Error {
 }
 
 export class OAuthProviderPublicationError extends Error {
-  constructor() {
-    super("OAuth credential was saved, but the provider entry was not written. Resolve the account namespace collision, then retry login.");
+  constructor(provider?: string, credentialWritten = true) {
+    super(provider !== "anthropic2" ? "OAuth credential was saved, but the provider entry was not written. Resolve the account namespace collision, then retry login."
+      : credentialWritten ? "Anthropic Pool 2 credential was saved as an orphan auth row, but the provider entry was not written. Repair the persisted config or resolve the provider/account namespace collision, then retry login."
+      : "Anthropic Pool 2 login did not start because the config file is missing or could not be written; no credential was saved. Repair the persisted config, then retry login.");
     this.name = "OAuthProviderPublicationError";
   }
 }
@@ -490,6 +488,9 @@ export function publicOAuthAuthenticationErrorMessage(error: unknown): string {
     || error instanceof OAuthReauthIdentityUnverifiedError
     || error instanceof OAuthTokenRefreshBusyError
     || error instanceof OAuthTokenRefreshStaleError
+    || error instanceof AnthropicInstanceCollisionError
+    || error instanceof AnthropicCrossInstanceDuplicateError
+    || error instanceof AnthropicLocalCliImportError
   ) return error.message;
   return "OAuth authentication failed. Check the OpenCodex account status and retry.";
 }
@@ -739,131 +740,6 @@ function definitivelyAnswered(error: unknown): boolean {
   return false;
 }
 
-/**
- * Intent cleanup is secondary to the refresh outcome it protects.
- *
- * Once a credential is already durable, cleanup remains secondary and best-effort. A known
- * failed attempt takes the stricter path below: its retry-safe marker must become durable before
- * the original provider error can be returned.
- */
-function clearAnthropicRefreshIntentBestEffort(
-  provider: string,
-  accountId: string,
-  expected: OAuthRefreshIntent,
-): boolean {
-  try {
-    return expected.attemptId
-      ? clearOAuthRefreshIntentIfMatch(provider, accountId, expected)
-      : clearOAuthRefreshIntent(provider, accountId, expected.generation);
-  } catch {
-    console.warn(
-      "[opencodex] Anthropic refresh intent cleanup failed; preserving the durable replay guard.",
-    );
-    return false;
-  }
-}
-
-const ANTHROPIC_INTENT_MARK_RETRY_DELAYS_MS = [10, 25, 50] as const;
-
-function isConfigMutationLockContention(error: unknown): boolean {
-  if (!(error instanceof ConfigMutationLockError)) return false;
-  const cause = error.cause;
-  const code = cause && typeof cause === "object" && "code" in cause
-    ? String((cause as { code?: unknown }).code)
-    : "";
-  return code === "SQLITE_BUSY" || code === "SQLITE_LOCKED";
-}
-
-async function clearAnthropicRefreshIntentForKnownFailure(
-  provider: string,
-  accountId: string,
-  expected: OAuthRefreshIntent,
-  cleanupPending: OAuthRefreshIntentCleanupPending,
-  refreshError: unknown,
-): Promise<boolean> {
-  let marked: OAuthRefreshIntent | undefined;
-  for (let attempt = 0; attempt <= ANTHROPIC_INTENT_MARK_RETRY_DELAYS_MS.length; attempt += 1) {
-    try {
-      marked = markOAuthRefreshIntentCleanupPending(
-        provider,
-        accountId,
-        expected,
-        cleanupPending,
-      );
-      break;
-    } catch (cause) {
-      const retryDelay = ANTHROPIC_INTENT_MARK_RETRY_DELAYS_MS[attempt];
-      if (!isConfigMutationLockContention(cause) || retryDelay === undefined) {
-        throw new OAuthRefreshIntentIOError(
-          "mark-cleanup-pending",
-          cause,
-          refreshError,
-        );
-      }
-      // The provider has definitively answered, so caller cancellation no longer changes the
-      // settlement obligation. Yield briefly while retaining the per-account refresh lock, then
-      // rerun the existing compare-and-swap marker against current disk state.
-      await Bun.sleep(retryDelay);
-    }
-  }
-  if (!marked) {
-    throw new OAuthRefreshIntentIOError(
-      "mark-cleanup-pending",
-      new Error("Anthropic refresh intent changed before safe cleanup"),
-      refreshError,
-    );
-  }
-
-  let cleared: boolean;
-  try {
-    cleared = clearOAuthRefreshIntentIfMatch(provider, accountId, marked);
-  } catch {
-    console.warn(
-      "[opencodex] Anthropic refresh intent cleanup failed; retry-safe cleanup remains pending.",
-    );
-    return false;
-  }
-  if (!cleared) {
-    throw new OAuthRefreshIntentIOError(
-      "clear-cleanup-pending",
-      new Error("Anthropic refresh intent changed during safe cleanup"),
-      refreshError,
-    );
-  }
-  return true;
-}
-
-function resumeAnthropicRefreshIntentCleanup(
-  provider: string,
-  accountId: string,
-  pendingIntent: OAuthRefreshIntent,
-): void {
-  let cleared: boolean;
-  try {
-    cleared = clearOAuthRefreshIntentIfMatch(provider, accountId, pendingIntent);
-  } catch (cause) {
-    throw new OAuthRefreshIntentIOError(
-      "resume-cleanup",
-      cause,
-    );
-  }
-  if (!cleared) {
-    throw new OAuthRefreshIntentIOError(
-      "resume-cleanup",
-      new Error("Pending Anthropic refresh intent changed before cleanup"),
-    );
-  }
-}
-
-function clearObservedAnthropicRefreshIntent(
-  provider: string,
-  accountId: string,
-  pendingIntent: OAuthRefreshIntent,
-): boolean {
-  return pendingIntent.attemptId
-    ? clearOAuthRefreshIntentIfMatch(provider, accountId, pendingIntent)
-    : clearOAuthRefreshIntent(provider, accountId, pendingIntent.generation);
-}
 function authoritative(stored:OAuthCredentials,active:boolean,now:()=>number):OAuthCredentials{if(stored.source!=="local-cli")return stored;const disk=detectGrokCliToken();if(!disk)return stored;const allowed=isSameGrokIdentity(stored,disk)||(active&&!hasComparableGrokIdentity(stored,disk));return allowed&&shouldAdoptGrokGeneration(stored,disk,now(),REFRESH_SKEW_MS)?disk:stored;}
 function merged(fresh: OAuthCredentials, previous: OAuthCredentials): OAuthCredentials {
   return {
@@ -932,6 +808,7 @@ export async function refreshAnthropicAccountWithLock(
   callerCredential: OAuthCredentials,
   deps: AnthropicRefreshDeps = {},
 ): Promise<string> {
+  if (!isAnthropicOAuthInstance(provider)) throw new UnsupportedOAuthProviderError(provider);
   const writerGeneration = captureConfigGeneration();
   const now = deps.now ?? Date.now;
   const guard = await (deps.intentLock ?? createOAuthRefreshIntentLock(provider, accountId)).acquire();
@@ -941,10 +818,10 @@ export async function refreshAnthropicAccountWithLock(
     if (!accountSet || !account) throw new OAuthLoginRequiredError(provider);
     if (account.paused) throw new OAuthAccountPausedError();
     const stored = account.credential;
-    const owns = captureAnthropicCredentialOwner(accountSet, accountId);
+    const owns = captureAnthropicCredentialOwnerForInstance(provider, accountSet, accountId);
     const generation = credentialGeneration(stored);
     let pendingIntent = readOAuthRefreshIntent(provider, accountId);
-    const observed = await newerClaudeCredential(stored, now(), deps.signal, deps.resolveIdentity);
+    const observed = await newerClaudeCredentialForInstance(provider, stored, now(), deps.signal, deps.resolveIdentity);
     const assertOwner = (store: AuthStore, checkDisk = true) => {
       if (observed.kind !== "absent" && deps.signal?.aborted) throw new OAuthTokenRefreshStaleError();
       if (!owns(store, checkDisk && observed.kind !== "absent" ? observed.diskGeneration : undefined)) {
@@ -1116,6 +993,10 @@ export async function refreshGenericAccountWithLock(
       return fresh.access;
     } catch (error) {
       if (error instanceof OAuthMutationBusyError) throw error;
+      if (provider === "kiro" && error instanceof KiroTokenRefreshError && error.refreshAttention) {
+        await markAccountRefreshAttentionIfGeneration(provider, accountId, generation, writerGeneration);
+        throw error;
+      }
       if (!terminal(error)) throw error;
       // Nous-specific failure-atomicity: a terminal refresh error that carries
       // an already-issued rotated refresh token (e.g. the access JWT lacked the
@@ -1177,20 +1058,22 @@ async function refreshAndPersistAccessToken(
   replacedStaleFlight?: OAuthRefreshFlightEvidence,
 ): Promise<string> {
   if (provider === "xai") return refreshXaiAccountWithLock(provider, accountId, def, cred, { signal });
-  if (provider === "anthropic") return refreshAnthropicAccountWithLock(provider, accountId, def, cred, { signal, flight, replacedStaleFlight });
+  if (isAnthropicOAuthInstance(provider)) return refreshAnthropicAccountWithLock(provider, accountId, def, cred, { signal, flight, replacedStaleFlight });
   return refreshGenericAccountWithLock(provider, accountId, def, cred, { signal });
 }
 
-/**
- * Shared bearer-token resolver for /models listing — used by BOTH server.ts:fetchAllModels and
- * codex-catalog.ts:fetchProviderModels so OAuth providers' models are listed once logged in.
- * Returns undefined for forward-mode or oauth-not-logged-in (caller skips).
- */
+/** Resolve discovery credentials only for the caller-owned configured OAuth row. */
+export async function getModelsOAuthAccessSnapshot(name: string, prov: OcxProviderConfig | undefined): Promise<OAuthAccessSnapshot> {
+  if (!mayResolveModelsOAuth(name, prov)) throw new OAuthLoginRequiredError(name);
+  return getValidAccessTokenSnapshot(name);
+}
+
+/** Shared /models auth resolver; custom key rows keep their own key, including omitted authMode. */
 export async function resolveModelsAuthToken(name: string, prov: OcxProviderConfig): Promise<string | undefined> {
   if (prov.authMode === "forward") return undefined;
   if (prov.authMode === "oauth") {
     try {
-      return await getValidAccessToken(name);
+      return (await getModelsOAuthAccessSnapshot(name, prov)).accessToken;
     } catch {
       return undefined;
     }
@@ -1235,6 +1118,8 @@ export function buildModelsRequest(
   providerName = "",
   observedAuth?: ModelsRequestObservedAuth,
 ): { method?: "POST"; url: string; headers: Record<string, string> } {
+  const authorizedTarget = captureModelsOAuthTarget(providerName, prov);
+  if (prov.authMode === "oauth" && !mayResolveModelsOAuth(providerName, prov)) apiKey = undefined;
   const transportSeed = modelDiscoveryTransportSeed(providerName, prov);
   const copilotApiBaseUrl = observedAuth === undefined
     ? (providerName === "github-copilot" ? getOAuthCredentialApiBaseUrl(providerName) : undefined)
@@ -1261,16 +1146,18 @@ export function buildModelsRequest(
     effectiveProvider.baseUrl,
     defaultUrl,
   );
+  const guarded = <T extends { url: string; headers: Record<string, string> }>(request: T): T =>
+    guardModelsOAuthRequest(providerName, prov, request, authorizedTarget);
   if (effectiveGoogleMode(providerName, effectiveProvider) === "cloud-code-assist") {
     headers.Accept = "application/json";
     headers["Content-Type"] = "application/json";
     headers["User-Agent"] = ANTIGRAVITY_REQUEST_UA;
     if (apiKey) headers.Authorization = `Bearer ${apiKey}`;
-    return {
-      method: "POST",
+    return guarded({
+      method: "POST" as const,
       url: discoveryUrl(`${effectiveProvider.baseUrl.replace(/\/+$/, "")}/v1internal:fetchAvailableModels`),
       headers,
-    };
+    });
   }
   if (effectiveGoogleMode(providerName, effectiveProvider) === "ai-studio") {
     // Generative Language API: API key goes in x-goog-api-key (never Authorization: Bearer),
@@ -1278,7 +1165,7 @@ export function buildModelsRequest(
     // enough to list everything without a pageToken loop. Vertex/antigravity keep the
     // generic branch (they fall back to their static model lists).
     if (apiKey) headers["x-goog-api-key"] = apiKey;
-    return { url: discoveryUrl(`${effectiveProvider.baseUrl}/v1beta/models?pageSize=1000`), headers };
+    return guarded({ url: discoveryUrl(`${effectiveProvider.baseUrl}/v1beta/models?pageSize=1000`), headers });
   }
   if (effectiveProvider.adapter === "anthropic") {
     const base = effectiveProvider.baseUrl.replace(/\/v1\/?$/, "");
@@ -1290,10 +1177,10 @@ export function buildModelsRequest(
       if (effectiveProvider.apiKeyTransport === "bearer") headers["Authorization"] = `Bearer ${apiKey}`;
       else headers["x-api-key"] = apiKey;
     }
-    return { url: discoveryUrl(`${base}/v1/models?limit=1000`), headers };
+    return guarded({ url: discoveryUrl(`${base}/v1/models?limit=1000`), headers });
   }
   if (apiKey) headers["Authorization"] = `Bearer ${apiKey}`;
-  return { url: discoveryUrl(providerModelsUrl(effectiveProvider.baseUrl)), headers };
+  return guarded({ url: discoveryUrl(providerModelsUrl(effectiveProvider.baseUrl)), headers });
 }
 
 /**
@@ -1452,6 +1339,7 @@ function projectOAuthProviderReconciliation(config: OcxConfig): OAuthReconcilePr
   const touchedAntigravityVersion = projected.googleAntigravityStaticCatalogVersion !== beforeAntigravityVersion;
 
   for (const [name, prov] of Object.entries(projected.providers)) {
+    if (name === "anthropic2" && !anthropicInstanceRowShapeMatches(name, prov)) continue;
     const beforeProvider = JSON.stringify(prov);
     const def = OAUTH_PROVIDERS[name];
     if (name === "command-code" && isLegacyCommandCodeStaticCatalog(prov)) {
@@ -1588,6 +1476,7 @@ const OAUTH_LOGIN_OWNED_PROVIDER_FIELDS = [
 
 /** Add/refresh only an OAuth provider's login-owned config fields (does not persist). */
 export function upsertOAuthProvider(config: OcxConfig, provider: string): void {
+  assertAnthropicInstanceLoginConfig(config, provider);
   if (provider === "chatgpt") return;
   const def = OAUTH_PROVIDERS[provider];
   if (!def) return;
@@ -1656,6 +1545,7 @@ interface RunLoginDeps {
   saveAccountCredential?: typeof saveAccountCredential;
   loadConfig?: typeof loadConfig;
   saveConfig?: typeof saveConfig;
+  mutatePersistedConfig?: typeof mutatePersistedConfig;
   settleKiroLoginTransaction?: typeof settleKiroLoginTransaction;
   rollbackCredentialWrite?: typeof rollbackCredentialWriteIfMatch;
   assertCurrentOwner?: () => void;
@@ -1672,14 +1562,28 @@ export async function runLogin(
   if (!def) throw new UnsupportedOAuthProviderError(provider);
   const loadLatestConfig = deps.loadConfig ?? loadConfig;
   const saveLatestConfig = deps.saveConfig ?? saveConfig;
-  const preflightConfig = provider !== "chatgpt" ? loadLatestConfig() : undefined;
+  const initialBConfigState = provider === "anthropic2" ? observeInitialConfigState() : undefined;
+  let preflightConfig = provider !== "chatgpt" ? loadLatestConfig() : undefined;
+  if (provider === "anthropic2" && preflightConfig && initialBConfigState === "missing") {
+    // Explicit first-login onboarding may create the ordinary defaults, without a B row.
+    // The create-only owner never replaces a concurrent file. Reload its winner before login;
+    // once the browser starts, later deletion remains a publication refusal, not recreation.
+    if (initializePersistedConfigIfMissing(getDefaultConfig()) === "invalid") {
+      throw new OAuthProviderPublicationError(provider, false);
+    }
+    preflightConfig = loadLatestConfig();
+  }
   if (preflightConfig) {
+    assertAnthropicInstanceLoginConfig(preflightConfig, provider);
     const namespaceCollision = codexAccountNamespaceProviderCollisionError(
       preflightConfig.codexAccountNamespaces,
       provider,
     );
     if (namespaceCollision) throw new Error(namespaceCollision);
   }
+  if (provider === "anthropic2" && observeInitialConfigState() !== "exists") {
+    throw new OAuthProviderPublicationError(provider, false);
+  }
   // loginKiro keys its pending CLI-session transaction by object identity. Keep this exact object
   // for settlement even when source normalization below creates a derived credential object.
   const shouldRollbackKiroAccounts = provider === "kiro" && opts?.forceLogin === true;
@@ -1693,6 +1597,7 @@ export async function runLogin(
   }
   const rawCred = await def.login(ctrl, opts, loginProviderConfig);
   const cred: OAuthCredentials = rawCred.source ? rawCred : { ...rawCred, source: "oauth" };
+  if (isAnthropicOAuthInstance(provider)) assertAnthropicCredentialSource(provider, cred);
   const settleKiroTransaction = deps.settleKiroLoginTransaction ?? settleKiroLoginTransaction;
   try {
     deps.assertCurrentOwner?.();
@@ -1738,16 +1643,28 @@ export async function runLogin(
     if (provider !== "chatgpt") {
       // Re-run against post-credential state so same-provider API-key additions, removals,
       // and active-key switches survive. A late namespace claim wins over provider creation.
-      const latestConfig = loadLatestConfig();
-      const lateCollision = codexAccountNamespaceProviderCollisionError(
-        latestConfig.codexAccountNamespaces,
-        provider,
-      );
-      if (lateCollision) {
-        throw new OAuthProviderPublicationError();
+      if (provider === "anthropic2") {
+        const publication = (deps.mutatePersistedConfig ?? mutatePersistedConfig)(latestConfig => {
+          assertAnthropicInstanceLoginConfig(latestConfig, provider, true);
+          if (codexAccountNamespaceProviderCollisionError(latestConfig.codexAccountNamespaces, provider)) {
+            throw new OAuthProviderPublicationError(provider);
+          }
+          upsertOAuthProvider(latestConfig, provider);
+          return { changed: true, value: undefined };
+        });
+        if (publication.status === "unavailable") throw new OAuthProviderPublicationError(provider);
+      } else {
+        const latestConfig = loadLatestConfig();
+        const lateCollision = codexAccountNamespaceProviderCollisionError(
+          latestConfig.codexAccountNamespaces,
+          provider,
+        );
+        if (lateCollision) {
+          throw new OAuthProviderPublicationError();
+        }
+        upsertOAuthProvider(latestConfig, provider);
+        saveLatestConfig(latestConfig);
       }
-      upsertOAuthProvider(latestConfig, provider);
-      saveLatestConfig(latestConfig);
     }
   } catch (error) {
     const errors: unknown[] = [error];
@@ -1840,7 +1757,7 @@ export function getLoginStatus(provider: string, maskEmails = true): { loggedIn:
     ...(a.alias ? { alias: a.alias } : {}),
     email: projectEmail(a.credential.email, maskEmails) ?? undefined,
     active: a.id === set.activeAccountId,
-    ...(a.needsReauth ? { needsReauth: true } : {}),
+    ...(accountNeedsReauthForStatus(provider, a) ? { needsReauth: true } : {}),
     ...(a.needsReauth && a.needsReauthReason === "verify_account" ? { needsReauthReason: a.needsReauthReason } : {}),
     expiresAt: a.credential.expires,
     // Explicitly null rather than omitted — see OAuthAccountSummary.plan. No OAuth provider
@@ -1852,11 +1769,11 @@ export function getLoginStatus(provider: string, maskEmails = true): { loggedIn:
 
   // A stored credential counts as "logged in" when it exists and is not marked for
   // re-authentication. An expired access token with a valid refresh token is still
-  // logged in: request resolution refreshes expired/near-expiry credentials lazily.
+  // logged in unless refresh-attention evidence applies; refresh eligibility stays internal.
   // Invalid/unknown local-import expiries are handled at parse/adoption time
   // (local-token-detect.ts), never by over-reporting login state here.
-  const activeNeedsReauth = set?.accounts
-    .find(a => a.id === set.activeAccountId)?.needsReauth === true;
+  const activeAccount = set?.accounts.find(a => a.id === set.activeAccountId);
+  const activeNeedsReauth = activeAccount && accountNeedsReauthForStatus(provider, activeAccount);
   return {
     loggedIn: !!cred && !activeNeedsReauth,
     email: projectEmail(cred?.email, maskEmails) ?? undefined,

package/src/oauth/kiro.ts

@@ -60,6 +60,7 @@ export class KiroTokenRefreshError extends Error {
   constructor(
     readonly httpStatus: number,
     readonly oauthError?: string,
+    readonly refreshAttention = false,
   ) {
     super(`Kiro token refresh failed: ${httpStatus}${oauthError ? ` (${oauthError})` : ""}`);
     this.name = "KiroTokenRefreshError";
@@ -530,17 +531,21 @@ export function resolveKiroRequestProfile(
     : { profileArn: undefined, builderIdFallback: false };
 }
 
-async function kiroTokenRefreshError(response: Response): Promise<KiroTokenRefreshError> {
+async function kiroTokenRefreshError(response: Response, awsSsoRefresh = false): Promise<KiroTokenRefreshError> {
   let oauthError: string | undefined;
+  let refreshAttention = false;
   try {
     const payload = await response.json() as { error?: unknown };
+    // This input-error code is attention evidence only for our AWS SSO refresh request,
+    // never a terminal grant verdict. Do not surface arbitrary upstream descriptions.
+    refreshAttention = awsSsoRefresh && response.status === 400 && payload.error === "invalid_request";
     if (typeof payload.error === "string" && KIRO_TERMINAL_REFRESH_ERRORS.has(payload.error)) {
       oauthError = payload.error;
     }
   } catch {
     // Error bodies are untrusted and intentionally excluded from the surfaced message.
   }
-  return new KiroTokenRefreshError(response.status, oauthError);
+  return new KiroTokenRefreshError(response.status, oauthError, refreshAttention);
 }
 
 async function readTokenResponse(res: Response, oldRefresh: string): Promise<OAuthCredentials> {
@@ -608,7 +613,7 @@ async function refreshAwsSsoOidcToken(
     signal: kiroRefreshSignal(signal),
   });
   const res = await run(refresh);
-  if (!res.ok) throw await kiroTokenRefreshError(res);
+  if (!res.ok) throw await kiroTokenRefreshError(res, true);
   return readTokenResponse(res, refresh);
 }
 
@@ -668,11 +673,19 @@ export async function refreshKiroToken(
     const local = matchingRotatedKiroCliCredential(refresh, credential);
     if (!local) throw error;
     const retryMetadata = metadataForRotatedKiroCliCredential(credential, local);
-    const fresh = await refreshAwsSsoOidcToken(local.refresh, signal, {
-      ...credential,
-      refresh: local.refresh,
-      kiro: retryMetadata,
-    });
-    return { ...fresh, kiro: retryMetadata };
+    try {
+      const fresh = await refreshAwsSsoOidcToken(local.refresh, signal, {
+        ...credential,
+        refresh: local.refresh,
+        kiro: retryMetadata,
+      });
+      return { ...fresh, kiro: retryMetadata };
+    } catch (recoveryError) {
+      // A failed CLI fallback may use the desktop endpoint. Retain the original AWS SSO
+      // attention evidence on another input rejection; transient recovery stays retryable.
+      if (error.refreshAttention && recoveryError instanceof KiroTokenRefreshError
+        && recoveryError.httpStatus === 400 && recoveryError.oauthError === undefined) throw error;
+      throw recoveryError;
+    }
   }
 }