@bitkyc08/opencodex 2.80.0 → 2.81.0

package/src/server/gui-static.ts

@@ -20,12 +20,46 @@ const MIME_TYPES: Record<string, string> = {
  */
 const HASHED_ASSET_PATTERN = /-[a-zA-Z0-9_-]{8,}\.[a-zA-Z0-9]+$/;
 
-export function findGuiDist(): string | null {
+/** `productName` in desktop/src-tauri/tauri.conf.json; Linux packages install resources under `lib/<productName>`. */
+export const DESKTOP_PRODUCT_NAME = "OpenCodex";
+
+/**
+ * Where a compiled `ocx` looks for `gui/dist`, given the directory holding the executable.
+ *
+ * Beside the binary covers a release archive and the Windows desktop install. The desktop shell
+ * ships `ocx` as a sidecar and its resources where Tauri's `resource_dir` puts them: `../Resources`
+ * inside a macOS app bundle, `../lib/<productName>` for a Linux package (`/usr/bin`, `/usr/local/bin`,
+ * an AppImage's `usr/bin`). The shell passes that directory as OPENCODEX_GUI_DIST only to the sidecar
+ * it starts itself; `ocx ensure` from the Codex shim and the login service start the same binary
+ * without the variable, so they find the dashboard here.
+ */
+export function standaloneGuiDistCandidates(executableDir: string, platform: NodeJS.Platform = process.platform): string[] {
+  const candidates = [join(executableDir, "gui", "dist")];
+  if (platform === "darwin") candidates.push(join(executableDir, "..", "Resources", "gui", "dist"));
+  if (platform === "linux") candidates.push(join(executableDir, "..", "lib", DESKTOP_PRODUCT_NAME, "gui", "dist"));
+  return candidates;
+}
+
+/** Overrides for tests; production callers pass nothing and get this process's own layout. */
+export interface GuiDistLookup {
+  /** Directory holding a compiled `ocx`, or null when running from source. */
+  standaloneDir?: string | null;
+  platform?: NodeJS.Platform;
+  /** Directory of this module; a source checkout's `gui/dist` is resolved from it. */
+  moduleDir?: string;
+}
+
+/** Lookup only: checks for `index.html` and never creates, copies or builds anything. */
+export function findGuiDist(lookup: GuiDistLookup = {}): string | null {
+  const standaloneDir = lookup.standaloneDir === undefined
+    ? (isStandaloneBinary() ? standaloneRoot() : null)
+    : lookup.standaloneDir;
+  const moduleDir = lookup.moduleDir ?? import.meta.dir;
   const candidates = [
     process.env.OPENCODEX_GUI_DIST,
-    ...(isStandaloneBinary() ? [join(standaloneRoot(), "gui", "dist")] : []),
-    join(import.meta.dir, "..", "..", "gui", "dist"),
-    join(import.meta.dir, "..", "..", "..", "gui", "dist"),
+    ...(standaloneDir === null ? [] : standaloneGuiDistCandidates(standaloneDir, lookup.platform)),
+    join(moduleDir, "..", "..", "gui", "dist"),
+    join(moduleDir, "..", "..", "..", "gui", "dist"),
   ].filter((candidate): candidate is string => Boolean(candidate));
   for (const c of candidates) {
     if (existsSync(join(c, "index.html"))) return c;

package/src/server/index/spend-ledger-lifecycle.ts

@@ -6,6 +6,7 @@ import {
 import {
   configureSharedSpendLedger,
   spendPolicyFromConfig,
+  waitForSharedSpendReporterDrain,
 } from "../../lib/spend-reservation-ledger";
 import { warnIfSyncedStateDirectory } from "../../lib/synced-state-location";
 
@@ -26,7 +27,7 @@ export function waitForFailedStartRollback(error: unknown): Promise<void> {
 }
 
 export interface SpendLedgerServerLifecycle {
-  configure(spend: OcxSpendConfig | undefined): void;
+  configure(spend: OcxSpendConfig | undefined, poolAliases?: unknown, providerIds?: readonly string[]): void;
   track<T extends { stop(closeActiveConnections?: boolean): void | Promise<void> }>(server: T): T;
   release(): void;
   releaseAfterFailedStart(): Promise<void>;
@@ -49,13 +50,18 @@ export function acquireSpendLedgerServerLifecycle(configDir: string): SpendLedge
     owner.release();
   };
   return {
-    configure(spend): void {
-      configureSharedSpendLedger(spendPolicyFromConfig(spend));
+    configure(spend, poolAliases, providerIds): void {
+      configureSharedSpendLedger(spendPolicyFromConfig(spend, poolAliases, providerIds));
     },
     track<T extends { stop(closeActiveConnections?: boolean): void | Promise<void> }>(server: T): T {
       // Capture the raw stop before startServer replaces the public method with full teardown.
       const stop = server.stop.bind(server);
-      failedStartStops.push(() => stop(true));
+      const drainedStop = async (closeActiveConnections?: boolean): Promise<void> => {
+        await stop(closeActiveConnections);
+        await waitForSharedSpendReporterDrain();
+      };
+      Object.defineProperty(server, "stop", { configurable: true, value: drainedStop });
+      failedStartStops.push(() => drainedStop(true));
       return server;
     },
     release,

package/src/server/index.ts

@@ -302,7 +302,7 @@ function startServerWithSpendLedgerOwner(port: number | undefined, deps: StartSe
   configureAppOwnedMemoryBudget(resolveAppOwnedMemoryBudgetBytes(config.appOwnedMemoryBudgetMb));
   enforceAppOwnedMemoryBudget();
   // Observe-only mode still journals physical sends, so every server owns before configuring.
-  spendLedgerLifecycle.configure(config.spend);
+  spendLedgerLifecycle.configure(config.spend, config.spendPoolAliases, Object.keys(config.providers));
   // After ownership: a second server on the same home is refused above, so the process running
   // this line is the only one appending to usage.jsonl and the only one that may compact it.
   setUsageLedgerRetention(config.usageLedgerMaxBytes);
@@ -505,7 +505,9 @@ function startServerWithSpendLedgerOwner(port: number | undefined, deps: StartSe
     const lease = tryAdmitTurn(sessionLaneIdFromRequest(req.headers));
     if (!lease) return serverBusyResponse(req, "active turns", policy);
     // Root, lane, and the refusal that follows from them, all live in ./workflow-refusal.
-    const workflow = admitHttpWorkflowTurn(req.headers);
+    let workflow: ReturnType<typeof admitHttpWorkflowTurn>;
+    try { workflow = admitHttpWorkflowTurn(req.headers); }
+    catch (error) { lease.release(); throw error; }
     if (workflow && !workflow.admitted) {
       lease.release();
       // withCors, because without Access-Control-Allow-Origin the exposed refusal header is

package/src/server/inference/context.ts

@@ -34,7 +34,7 @@ export function createInferenceSendBudget(
 export function expandInferenceOAuthSendBudget(budget: TransientSendBudget | undefined, accounts: number): void {
   if (!budget) return;
   const policy = ingressPolicies.get(budget);
-  if (!policy || budget.used !== 0) return;
+  if (!policy || budget.used !== 0 || ("physicalStarted" in budget && Number(budget.physicalStarted) > 0)) return;
   ingressPolicies.delete(budget);
   if (accounts < 2 || !Number.isSafeInteger(accounts)) return;
   const sends = Math.min(accounts, GENERIC_OAUTH_MAX_ACCOUNTS_PER_REQUEST) * TRANSIENT_RETRY_MAX_ATTEMPTS;

package/src/server/lifecycle.ts

@@ -479,7 +479,7 @@ export async function drainAndShutdown(
   beginBackgroundShellShutdown();
   try {
     while (admittedTurns.size > 0 && Date.now() < deadline) {
-      await Bun.sleep(100);
+      await Bun.sleep(Math.min(100, Math.max(0, deadline - Date.now())));
     }
     if (admittedTurns.size > 0) {
       console.warn(`⚠️  Aborting ${admittedTurns.size} in-flight turn(s) after ${timeoutMs}ms deadline`);

package/src/server/management/agent-settings-routes.ts

@@ -8,6 +8,8 @@ import { catalogModelSlug, filterCatalogVisibleModels, invalidateCodexModelsCach
 import { mergeModelPinnedEfforts, modelPinnedEffortsConfigError } from "../../config/provider-validation";
 import { MULTI_AGENT_SURFACE_ADVISORY_VERSION, multiAgentSurfaceAdvisory, resolveMultiAgentMode } from "../../config/multi-agent-surface";
 import { captureConfigTopLevelRollback, parsedConfigRebaseDeletionKeys, projectConfigRebaseProvenance } from "../../config/rebase-provenance";
+import { anthropicSidecarPatchError } from "../../config/schema/anthropic-account-pool";
+import { isAnthropicInstanceId, type AnthropicInstanceId } from "../../providers/anthropic-instance-id";
 import {
   adoptPersistedClaudeCode,
   DEFAULT_SUBAGENT_MODELS,
@@ -71,9 +73,13 @@ import {
   webSearchCandidateRows,
   webSearchModelIsRejected,
   webSearchModelRejection,
+  sidecarAnthropicPoolOptions,
+  sidecarSettingsAfterPatch,
+  sidecarOptionsAuth,
   type WebSearchBackend,
 } from "./web-search-sidecar-options";
 import { drainAndShutdown } from "../lifecycle";
+import { inheritedAnthropicInstance } from "../../sidecar/auth";
 import { filterRequestLogs, getRequestLogEntries, type RequestLogEntry } from "../request-log";
 import { estimateComboCost, estimateRequestCost, normalizeCostTokens, tokensPerSecond } from "../../usage/cost";
 import type { PersistedUsageAttempt } from "../../usage/log";
@@ -1368,6 +1374,12 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
     );
     const webSearchOverride = config.claudeCode?.webSearchSidecar;
     const visionOverride = config.claudeCode?.visionSidecar;
+    const helperParent = config.claudeCode?.model?.includes("/") ? config.claudeCode.model.split("/")[0] : undefined;
+    const helperVision = { ...config.visionSidecar, ...visionOverride };
+    // Same pool the runtime picks (vision/plan.ts preferredVisionBackend): explicit, else inherited
+    // from the Claude model's instance, so a usable inherited Pool 2 reports the Anthropic backend.
+    const helperVisionInstance = helperVision.anthropicInstance ?? inheritedAnthropicInstance(config, helperParent);
+    const helperVisionBackend = helperVision.backend ?? (sidecarOptionsAuth(config, helperVisionInstance).isAnthropicAuth ? "anthropic" : "openai");
     const { firstPartyDesired, readFirstPartyProxyStatus } = await import("../../claude/first-party-settings");
     const { observeClaudeDesktopMode } = await import("../../claude/desktop-first-party");
     const { claudeInterceptEnabled, getClaudeInterceptState } = await import("../../claude/intercept/runtime");
@@ -1411,11 +1423,15 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
       autoCompactWindow: config.claudeCode?.autoCompactWindow ?? null,
       blockedSkills: config.claudeCode?.blockedSkills ?? null,
       injectAgents: config.claudeCode?.injectAgents !== false,
+      sidecarPools: {
+        webSearchSidecar: sidecarAnthropicPoolOptions(config, { ...config.webSearchSidecar, ...webSearchOverride }, helperParent),
+        visionSidecar: sidecarAnthropicPoolOptions(config, { ...helperVision, backend: helperVisionBackend }, helperParent),
+      },
       ...(webSearchOverride && Object.keys(webSearchOverride).length > 0
-        ? { webSearchSidecar: { backend: webSearchOverride.backend, model: webSearchOverride.model } }
+        ? { webSearchSidecar: { backend: webSearchOverride.backend, model: webSearchOverride.model, ...(webSearchOverride.anthropicInstance ? { anthropicInstance: webSearchOverride.anthropicInstance } : {}) } }
         : {}),
       ...(visionOverride && Object.keys(visionOverride).length > 0
-        ? { visionSidecar: { backend: visionOverride.backend, model: visionOverride.model } }
+        ? { visionSidecar: { backend: visionOverride.backend, model: visionOverride.model, ...(visionOverride.anthropicInstance ? { anthropicInstance: visionOverride.anthropicInstance } : {}) } }
         : {}),
       fastMode: config.fastMode,
       forceAvailable: [...visibleNativeSlugs(config), ...filterCatalogVisibleModels(models, config).map(catalogModelSlug)],
@@ -1563,6 +1579,8 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
           ...(residual ? ["settings_residual"] : []),
         ] });
     }
+    const instanceError = anthropicSidecarPatchError(config, body, true);
+    if (instanceError) return jsonResponse({ error: instanceError }, 400);
     for (const field of ["webSearchSidecar", "visionSidecar"] as const) {
       const section = body[field];
       if (section === undefined || section === null) continue;
@@ -1587,7 +1605,9 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
       // gates cannot drift.
       if (field === "visionSidecar" && typeof section.model === "string" && section.model !== "") {
         const requested = section.model;
-        const candidates = await visionCandidateRows(config);
+        const candidates = await visionCandidateRows({ ...config, visionSidecar: {
+          ...config.visionSidecar, ...sidecarSettingsAfterPatch(config.claudeCode?.visionSidecar, section),
+        } });
         const hint = section.backend === "anthropic" || section.backend === "openai"
           || section.backend === "routed"
           ? section.backend
@@ -1610,7 +1630,7 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
       // module as /api/sidecar-settings — a gate on one route and a stale copy on
       // the other is no gate at all.
       if (field === "webSearchSidecar"
-        && (section.model !== undefined || section.backend !== undefined)) {
+        && (section.model !== undefined || section.backend !== undefined || section.anthropicInstance !== undefined)) {
         const stored = config.claudeCode?.webSearchSidecar;
         // Validate against the SUBMITTED backend across the whole union, not
         // just openai/anthropic (#2457). allowedBackends above already refused
@@ -1629,7 +1649,9 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
           : typeof section.model === "string"
             ? section.model
             : stored?.model ?? config.webSearchSidecar?.model;
-        const candidates = await webSearchCandidateRows(config);
+        const candidates = await webSearchCandidateRows({ ...config, webSearchSidecar: {
+          ...config.webSearchSidecar, ...sidecarSettingsAfterPatch(config.claudeCode?.webSearchSidecar, section),
+        } });
         if (effectiveModel && webSearchModelIsRejected(effectiveBackend, effectiveModel, candidates)) {
           return jsonResponse(webSearchModelRejection(
             "webSearchSidecar.model",
@@ -1650,8 +1672,10 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
       }
       // The per-field validation above guarantees vision only ever carries the two-member
       // union; the cast is the loop's shared-shape compromise, not a wider write path.
-      const requested = section as { backend?: "openai" | "anthropic" | "xai" | "gemini" | "exa" | null; model?: string };
+      const requested = section as { backend?: "openai" | "anthropic" | "xai" | "gemini" | "exa" | null; model?: string; anthropicInstance?: AnthropicInstanceId | null };
       const override = { ...next[field] } as NonNullable<OcxClaudeCodeConfig[typeof field]>;
+      if (requested.anthropicInstance === null) delete override.anthropicInstance;
+      else if (isAnthropicInstanceId(requested.anthropicInstance)) override.anthropicInstance = requested.anthropicInstance;
       if (requested.backend === null) delete override.backend;
       else if (requested.backend !== undefined) override.backend = requested.backend as never;
       if (requested.model === "") delete override.model;

package/src/server/management/anthropic-account-threshold.ts

@@ -1,7 +1,8 @@
+import { isAnthropicOAuthInstance, configuredAnthropicInstance } from "../../providers/anthropic-instance";
 import type { OcxConfig } from "../../types";
-import { effectiveAnthropicAccountThreshold, parseAnthropicAccountThreshold } from "../../oauth/anthropic-account-threshold";
+import { effectiveAnthropicAccountThresholdForInstance, parseAnthropicAccountThreshold } from "../../oauth/anthropic-account-threshold";
 import { OAUTH_PROVIDERS } from "../../oauth";
-import { setAnthropicAccountThreshold } from "../../oauth/store";
+import { setAnthropicAccountThresholdForInstance } from "../../oauth/store";
 import { jsonResponse } from "../auth-cors";
 import { readManagementJsonBodyOr } from "./body";
 
@@ -10,18 +11,20 @@ export async function handleAnthropicAccountThreshold(req: Request, config: OcxC
   const body = await readManagementJsonBodyOr(req, {});
   if (!body || typeof body !== "object" || Array.isArray(body)) return jsonResponse({ error: "body must be an object" }, 400);
   const fields = body as Record<string, unknown>;
-  const definition = OAUTH_PROVIDERS.anthropic;
-  const effectiveProvider = config.providers.anthropic
+  const provider = fields.provider;
+  if (typeof provider !== "string" || !isAnthropicOAuthInstance(provider)) return jsonResponse({ error: "account threshold requires Anthropic OAuth" }, 400);
+  const definition = OAUTH_PROVIDERS[provider];
+  const effectiveProvider = config.providers[provider]
     ?? definition?.resolveProviderConfig?.(config) ?? definition?.providerConfig;
-  if (fields.provider !== "anthropic" || effectiveProvider?.authMode !== "oauth") {
+  if (effectiveProvider?.authMode !== "oauth" || (provider === "anthropic2" && !configuredAnthropicInstance(config, provider))) {
     return jsonResponse({ error: "account threshold requires Anthropic OAuth" }, 400);
   }
   if (typeof fields.accountId !== "string" || !fields.accountId.trim()) return jsonResponse({ error: "missing accountId" }, 400);
   const threshold = parseAnthropicAccountThreshold(fields.threshold);
   if (fields.threshold !== null && threshold === null) return jsonResponse({ error: "threshold must be an integer 0-100 or null" }, 400);
-  if (!await setAnthropicAccountThreshold(fields.accountId, threshold)) return jsonResponse({ error: "account not found" }, 404);
-  return jsonResponse({ ok: true, provider: "anthropic", accountId: fields.accountId,
+  if (!await setAnthropicAccountThresholdForInstance(provider, fields.accountId, threshold)) return jsonResponse({ error: "account not found" }, 404);
+  return jsonResponse({ ok: true, provider, accountId: fields.accountId,
     autoSwitchThresholdOverride: threshold,
-    effectiveAutoSwitchThreshold: effectiveAnthropicAccountThreshold(config, { autoSwitchThresholdOverride: threshold ?? undefined }),
-    autoSwitchThreshold: effectiveAnthropicAccountThreshold(config) });
+    effectiveAutoSwitchThreshold: effectiveAnthropicAccountThresholdForInstance(provider, config, { autoSwitchThresholdOverride: threshold ?? undefined }),
+    autoSwitchThreshold: effectiveAnthropicAccountThresholdForInstance(provider, config) });
 }

package/src/server/management/anthropic-pool-settings.ts

@@ -0,0 +1,72 @@
+import type { OcxConfig } from "../../types";
+import type { AnthropicAccountPoolConfig } from "../../types/anthropic-account-pool";
+import { configuredAnthropicInstance, type AnthropicInstanceId } from "../../providers/anthropic-instance";
+import { rawAnthropicAccountPool, resolveAnthropicAccountPoolConfig } from "../../oauth/anthropic-pool-config";
+import { readConfigFileSnapshot, validateConfigCandidate } from "../../config/diagnostics";
+import { ConfigWritePublishedError } from "../../config/persist-unlocked";
+import { mutatePersistedConfig } from "../../config";
+import { reconcileLiveStateStores } from "../../lib/state-store-registrations";
+import { jsonResponse } from "../auth-cors";
+
+/** Required instance; never synthesizes a deleted B provider row. */
+export function writeAnthropicPoolSettings(config: OcxConfig, instance: AnthropicInstanceId, value: AnthropicAccountPoolConfig): void {
+  if (instance === "anthropic") config.anthropicAccountPool = value;
+  else {
+    const row = config.providers[instance];
+    if (!configuredAnthropicInstance(config, instance)) throw new Error("Anthropic pool instance is no longer configured");
+    row!.anthropicAccountPool = value;
+  }
+}
+
+/**
+ * Both Anthropic writers share publication-aware recovery from the atomic mutation owner.
+ * Recovery covers only the durable write. Once the file holds the new value, a stale live row
+ * or a failed reconcile is reported as saved with the fixed bookkeeping warning, never a 500.
+ */
+export function persistAnthropicPoolPatch(
+  config: OcxConfig,
+  instance: AnthropicInstanceId,
+  patch: (target: OcxConfig) => { changed: boolean; value: NonNullable<OcxConfig["anthropicAccountPool"]> },
+): { status: "saved"; warning?: "config_bookkeeping_failed" } | { status: "failed"; response: Response } {
+  const before = readConfigFileSnapshot();
+  const unknown = () => ({ status: "failed" as const, response: jsonResponse({
+    error: "Pool settings save state is unknown; reload settings before editing again",
+    code: "config_save_state_unknown",
+  }, 409) });
+  const publish = (value: AnthropicAccountPoolConfig, warned: boolean): { status: "saved"; warning?: "config_bookkeeping_failed" } => {
+    let warning = warned;
+    try { writeAnthropicPoolSettings(config, instance, value); } catch { warning = true; }
+    try { reconcileLiveStateStores(); } catch { warning = true; }
+    return warning ? { status: "saved", warning: "config_bookkeeping_failed" } : { status: "saved" };
+  };
+  let durable: AnthropicAccountPoolConfig | undefined;
+  try {
+    const saved = mutatePersistedConfig(target => {
+      if (instance === "anthropic2" && !configuredAnthropicInstance(target, instance)) {
+        throw new Error("Anthropic pool instance is no longer configured");
+      }
+      return patch(target);
+    });
+    if (saved.status === "unavailable") return unknown();
+    durable = saved.value;
+  } catch (error) {
+    const persisted = readConfigFileSnapshot();
+    if (persisted.diagnostics.source !== "file" || persisted.raw === undefined) return unknown();
+    // File reads may salvage hand edits; recovery success requires a strict, authoritative document.
+    let validated: ReturnType<typeof validateConfigCandidate>;
+    try { validated = validateConfigCandidate(JSON.parse(persisted.raw.replace(/^\uFEFF/, ""))); }
+    catch { return unknown(); }
+    if (!validated.ok) return unknown();
+    const current = validated.config;
+    if (instance === "anthropic2" && !configuredAnthropicInstance(current, instance)) return unknown();
+    let expected: AnthropicAccountPoolConfig;
+    try { expected = patch(structuredClone(current)).value; } catch { return unknown(); }
+    const matches = JSON.stringify(rawAnthropicAccountPool(current, instance)) === JSON.stringify(expected);
+    // A failed live write or reconcile must not turn confirmed publication back into a rollback.
+    if (matches) return publish(resolveAnthropicAccountPoolConfig(current, instance), true);
+    if (error instanceof ConfigWritePublishedError || persisted.raw !== before.raw) return unknown();
+    return { status: "failed", response: jsonResponse({ error: "Pool settings could not be saved" }, 500) };
+  }
+  if (durable === undefined) return unknown();
+  return publish(durable, false);
+}

package/src/server/management/anthropic-reset-grant-routes.ts

@@ -14,7 +14,11 @@
 import { jsonResponse } from "../auth-cors";
 import type { ManagementContext } from "./context";
 import { getValidAccessSnapshotForAccount } from "../../oauth";
-import { captureOAuthAccountSelection, listAccounts } from "../../oauth/store";
+import { configuredAnthropicInstance, isAnthropicInstanceId, type AnthropicInstanceId } from "../../providers/anthropic-instance";
+import { captureAnthropicPhysicalSendOwnership, anthropicPhysicalSendOwnershipIsCurrent } from "../../oauth/anthropic-send-ownership";
+import { anthropicCooldownRecoveryFor } from "../../providers/quota/anthropic-cooldown-recovery";
+import { captureProviderAccountQuotaEpoch } from "../../providers/quota/account-cache";
+import { captureOAuthAccountSelection, getAccountSet, getAccountCredentialWithStatus, listAccounts } from "../../oauth/store";
 import {
   ANTHROPIC_RESET_GRANT_ID_RE,
   AnthropicResetGrantError,
@@ -28,19 +32,20 @@ import {
   AnthropicResetLedgerError,
   anthropicOrgDigest,
   anthropicResetOperationExists,
+  anthropicResetJournalPathForInstance,
   beginAnthropicResetOperation,
   pendingAnthropicResetOperation,
   releaseAnthropicResetLease,
   settleAnthropicResetOperation,
 } from "../../providers/anthropic-reset-grant-ledger";
 
-const PROVIDER = "anthropic";
 const UUID_V4_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 
 const MESSAGES = {
   method_not_allowed: "Method not allowed",
   session_required: "Spending a reset requires a dashboard session.",
   invalid_json: "Request body must be JSON.",
+  invalid_provider: "No matching builtin Anthropic OAuth provider.",
   invalid_grant_id: "grantId is missing or malformed.",
   invalid_operation_id: "operationId must be a UUIDv4.",
   no_account: "No matching Anthropic OAuth account.",
@@ -60,6 +65,9 @@ const MESSAGES = {
 type ErrorCode = keyof typeof MESSAGES;
 
 export interface AnthropicResetGrantRouteDeps {
+  provider?: AnthropicInstanceId;
+  isCurrent?: () => boolean;
+  forProvider?: (provider: AnthropicInstanceId) => AnthropicResetGrantRouteDeps;
   fetchFn?: typeof globalThis.fetch;
   journalPath?: string;
   now?: () => number;
@@ -68,25 +76,64 @@ export interface AnthropicResetGrantRouteDeps {
   accessTokenFor: (accountId: string) => Promise<string>;
 }
 
-const defaultDeps: AnthropicResetGrantRouteDeps = {
-  listAccountIds: () => listAccounts(PROVIDER).map(account => account.id),
-  activeAccountId: () => captureOAuthAccountSelection(PROVIDER)?.accountId ?? null,
-  accessTokenFor: async accountId =>
-    (await getValidAccessSnapshotForAccount(PROVIDER, accountId, { requireUsableAccount: true })).accessToken,
-};
+function defaultDepsFor(ctx: ManagementContext, provider: AnthropicInstanceId): AnthropicResetGrantRouteDeps | null {
+  // One source: the live management config. A keeps its legacy reach without a providers row;
+  // B requires its configured builtin row. A fresh file load here would refuse on any drift.
+  const live = ctx.config;
+  const target = live.providers?.[provider];
+  if (target?.disabled || target && target.authMode !== "oauth" || configuredAnthropicInstance(live, provider) !== provider) return null;
+  const identity = JSON.stringify(target ?? null);
+  let owner: ReturnType<typeof captureAnthropicPhysicalSendOwnership> = null;
+  const targetCurrent = () => configuredAnthropicInstance(live, provider) === provider
+    && JSON.stringify(live.providers?.[provider] ?? null) === identity;
+  return {
+    // Only the journal path: the ledger's numeric `now` option is not the deps clock function.
+    provider, journalPath: anthropicResetJournalPathForInstance(provider),
+    listAccountIds: () => listAccounts(provider).map(account => account.id),
+    activeAccountId: () => captureOAuthAccountSelection(provider)?.accountId ?? null,
+    isCurrent: () => {
+      if (!targetCurrent() || !owner || !anthropicPhysicalSendOwnershipIsCurrent(owner)) return false;
+      const row = getAccountCredentialWithStatus(provider, owner.accountId);
+      return !!row && !row.paused && !row.needsReauth;
+    },
+    accessTokenFor: async accountId => {
+      const initial = getAccountSet(provider)?.accounts.find(row => row.id === accountId);
+      const recovery = anthropicCooldownRecoveryFor(provider);
+      const incarnation = recovery.reserveAnthropicAccountIncarnation(accountId);
+      const epoch = captureProviderAccountQuotaEpoch(provider);
+      const snapshot = await getValidAccessSnapshotForAccount(provider, accountId, { requireUsableAccount: true });
+      const current = getAccountSet(provider)?.accounts.find(row => row.id === accountId);
+      if (!initial || !current || initial.loginId !== current.loginId || initial.addedAt !== current.addedAt
+        || recovery.anthropicAccountIncarnation(accountId) !== incarnation || captureProviderAccountQuotaEpoch(provider) !== epoch) throw new Error("reset account replaced");
+      owner = captureAnthropicPhysicalSendOwnership(snapshot);
+      if (!targetCurrent() || !owner) throw new Error("reset owner changed");
+      return snapshot.accessToken;
+    },
+  };
+}
+
+function selectDeps(ctx: ManagementContext, requested: unknown, deps?: AnthropicResetGrantRouteDeps): AnthropicResetGrantRouteDeps | null {
+  const provider = requested === undefined || requested === null ? "anthropic" : requested;
+  if (!isAnthropicInstanceId(provider)) return null;
+  const selected = deps?.forProvider?.(provider) ?? deps;
+  // Legacy injected dependencies are A-only; B must explicitly bind its own journal.
+  if (selected) return (selected.provider ?? "anthropic") === provider
+    ? { journalPath: anthropicResetJournalPathForInstance(provider), ...selected, provider } : null;
+  return defaultDepsFor(ctx, provider);
+}
 
 function fail(ctx: ManagementContext, status: number, code: ErrorCode, extra: Record<string, unknown> = {}): Response {
   return jsonResponse({ error: { code, message: MESSAGES[code], ...extra } }, status, ctx.req, ctx.config);
 }
 
-function ledgerFailure(ctx: ManagementContext, error: unknown): Response {
-  if (error instanceof AnthropicResetLedgerError && error.code === "busy") return fail(ctx, 503, "ledger_busy");
-  return fail(ctx, 503, "ledger_unavailable");
+function ledgerFailure(ctx: ManagementContext, error: unknown, extra: Record<string, unknown> = {}): Response {
+  if (error instanceof AnthropicResetLedgerError && error.code === "busy") return fail(ctx, 503, "ledger_busy", extra);
+  return fail(ctx, 503, "ledger_unavailable", extra);
 }
 
-function readFailure(ctx: ManagementContext, error: unknown): Response {
-  if (error instanceof AnthropicResetGrantError && error.code === "auth") return fail(ctx, 401, "auth_failed");
-  return fail(ctx, 502, "upstream_unavailable");
+function readFailure(ctx: ManagementContext, error: unknown, extra: Record<string, unknown> = {}): Response {
+  if (error instanceof AnthropicResetGrantError && error.code === "auth") return fail(ctx, 401, "auth_failed", extra);
+  return fail(ctx, 502, "upstream_unavailable", extra);
 }
 
 function resolveAccountId(deps: AnthropicResetGrantRouteDeps, requested: unknown): string | null {
@@ -107,16 +154,19 @@ async function tokenFor(deps: AnthropicResetGrantRouteDeps, accountId: string):
 }
 
 async function handleRead(ctx: ManagementContext, deps: AnthropicResetGrantRouteDeps): Promise<Response> {
+  const receipt = { provider: deps.provider };
   const accountId = resolveAccountId(deps, ctx.url.searchParams.get("accountId") ?? undefined);
-  if (!accountId) return fail(ctx, 400, "no_account");
+  if (!accountId) return fail(ctx, 400, "no_account", receipt);
   const accessToken = await tokenFor(deps, accountId);
-  if (!accessToken) return fail(ctx, 401, "auth_failed");
+  if (!accessToken) return fail(ctx, 401, "auth_failed", receipt);
+  if (deps.isCurrent?.() === false) return fail(ctx, 401, "auth_failed", receipt);
   let status;
   try {
     status = await fetchAnthropicResetGrantStatus({ accessToken, fetchFn: deps.fetchFn });
   } catch (error) {
-    return readFailure(ctx, error);
+    return readFailure(ctx, error, receipt);
   }
+  if (deps.isCurrent?.() === false) return fail(ctx, 401, "auth_failed", receipt);
   let pendingOperation = null;
   let journalAvailable = true;
   try {
@@ -124,10 +174,10 @@ async function handleRead(ctx: ManagementContext, deps: AnthropicResetGrantRoute
   } catch {
     journalAvailable = false;
   }
-  return jsonResponse({ accountId, ...status, pendingOperation, journalAvailable }, 200, ctx.req, ctx.config);
+  return jsonResponse({ provider: deps.provider, accountId, ...status, pendingOperation, journalAvailable }, 200, ctx.req, ctx.config);
 }
 
-async function handleConsume(ctx: ManagementContext, deps: AnthropicResetGrantRouteDeps): Promise<Response> {
+async function handleConsume(ctx: ManagementContext, injected?: AnthropicResetGrantRouteDeps): Promise<Response> {
   if (ctx.principal !== "gui-session") return fail(ctx, 403, "session_required");
   let body: Record<string, unknown>;
   try {
@@ -137,21 +187,27 @@ async function handleConsume(ctx: ManagementContext, deps: AnthropicResetGrantRo
   } catch {
     return fail(ctx, 400, "invalid_json");
   }
+  const deps = selectDeps(ctx, body.provider, injected);
+  if (!deps) return fail(ctx, 400, "invalid_provider");
+  const provider = deps.provider;
+  const operationReceipt = { provider };
+  const scopedFail = (status: number, code: ErrorCode, extra: Record<string, unknown> = {}) => fail(ctx, status, code, { ...operationReceipt, ...extra });
   const { grantId, operationId } = body;
-  if (typeof grantId !== "string" || !ANTHROPIC_RESET_GRANT_ID_RE.test(grantId)) return fail(ctx, 400, "invalid_grant_id");
-  if (typeof operationId !== "string" || !UUID_V4_RE.test(operationId)) return fail(ctx, 400, "invalid_operation_id");
-  if (typeof body.accountId !== "string") return fail(ctx, 400, "no_account");
+  if (typeof grantId !== "string" || !ANTHROPIC_RESET_GRANT_ID_RE.test(grantId)) return scopedFail(400, "invalid_grant_id");
+  if (typeof operationId !== "string" || !UUID_V4_RE.test(operationId)) return scopedFail(400, "invalid_operation_id");
+  if (typeof body.accountId !== "string") return scopedFail(400, "no_account");
   const accountId = resolveAccountId(deps, body.accountId);
-  if (!accountId) return fail(ctx, 400, "no_account");
+  if (!accountId) return scopedFail(400, "no_account");
 
   const accessToken = await tokenFor(deps, accountId);
-  if (!accessToken) return fail(ctx, 401, "auth_failed");
+  if (!accessToken || deps.isCurrent?.() === false) return scopedFail(401, "auth_failed");
   let organizationUuid: string;
   try {
     organizationUuid = await fetchAnthropicOrganizationUuid({ accessToken, fetchFn: deps.fetchFn });
   } catch (error) {
-    return readFailure(ctx, error);
+    return readFailure(ctx, error, operationReceipt);
   }
+  if (deps.isCurrent?.() === false) return scopedFail(401, "auth_failed");
   const ledger = { journalPath: deps.journalPath, now: deps.now?.() };
 
   // A new operation must pass the spend gate on a fresh read. A same-id retry of
@@ -161,39 +217,40 @@ async function handleConsume(ctx: ManagementContext, deps: AnthropicResetGrantRo
   try {
     known = anthropicResetOperationExists(operationId, ledger);
   } catch (error) {
-    return ledgerFailure(ctx, error);
+    return ledgerFailure(ctx, error, operationReceipt);
   }
   if (!known) {
     let status;
     try {
       status = await fetchAnthropicResetGrantStatus({ accessToken, fetchFn: deps.fetchFn });
     } catch (error) {
-      return readFailure(ctx, error);
+      return readFailure(ctx, error, operationReceipt);
     }
     const blocker = anthropicResetGrantBlocker(status, grantId);
-    if (blocker) return fail(ctx, 409, "grant_not_usable", { reason: blocker });
+    if (blocker) return scopedFail(409, "grant_not_usable", { reason: blocker });
   }
 
   let begin;
+  if (deps.isCurrent?.() === false) return scopedFail(401, "auth_failed");
   try {
     begin = beginAnthropicResetOperation(
       { operationId, accountId, grantId, orgDigest: anthropicOrgDigest(organizationUuid) },
       { journalPath: deps.journalPath, now: deps.now?.() },
     );
   } catch (error) {
-    return ledgerFailure(ctx, error);
+    return ledgerFailure(ctx, error, operationReceipt);
   }
   switch (begin.kind) {
     case "replay":
       return jsonResponse(
-        { code: begin.code, replayed: true, resetsLeft: begin.resetsLeft, accountId, grantId, operationId },
+        { provider, code: begin.code, replayed: true, resetsLeft: begin.resetsLeft, accountId, grantId, operationId },
         200, ctx.req, ctx.config,
       );
-    case "identity-mismatch": return fail(ctx, 409, "operation_identity_mismatch");
-    case "in-flight": return fail(ctx, 409, "in_flight");
-    case "expired": return fail(ctx, 409, "unknown_outcome_expired");
-    case "unresolved-prior": return fail(ctx, 409, "unresolved_prior_operation", { pendingOperationId: begin.operationId });
-    case "capacity": return fail(ctx, 503, "ledger_capacity");
+    case "identity-mismatch": return scopedFail(409, "operation_identity_mismatch");
+    case "in-flight": return scopedFail(409, "in_flight");
+    case "expired": return scopedFail(409, "unknown_outcome_expired");
+    case "unresolved-prior": return scopedFail(409, "unresolved_prior_operation", { pendingOperationId: begin.operationId });
+    case "capacity": return scopedFail(503, "ledger_capacity");
     case "execute": break;
   }
 
@@ -206,7 +263,7 @@ async function handleConsume(ctx: ManagementContext, deps: AnthropicResetGrantRo
     try {
       releaseAnthropicResetLease(operationId, { journalPath: deps.journalPath, now: deps.now?.() });
     } catch { /* the lease expires on its own */ }
-    return fail(ctx, 502, "unknown_outcome", { operationId, grantId });
+    return scopedFail(502, "unknown_outcome", { operationId, grantId, accountId });
   }
   let settled;
   try {
@@ -216,13 +273,14 @@ async function handleConsume(ctx: ManagementContext, deps: AnthropicResetGrantRo
     );
   } catch {
     // Fail closed: the caller must not read this as a durable result.
-    return fail(ctx, 500, "journal_write_failed", { operationId, grantId });
+    return scopedFail(500, "journal_write_failed", { operationId, grantId, accountId });
   }
   // Report what the journal holds. An overlapping same-id attempt may have
   // settled first; its answer is the canonical one.
   const replayed = settled.code !== answer.code || settled.resetsLeft !== answer.resetsLeft;
   return jsonResponse(
     {
+      provider,
       code: settled.code,
       replayed,
       resetsLeft: settled.resetsLeft,
@@ -237,12 +295,13 @@ async function handleConsume(ctx: ManagementContext, deps: AnthropicResetGrantRo
 
 export async function handleAnthropicResetGrantRoutes(
   ctx: ManagementContext,
-  deps: AnthropicResetGrantRouteDeps = defaultDeps,
+  deps?: AnthropicResetGrantRouteDeps,
 ): Promise<Response | null> {
   const { pathname } = ctx.url;
   if (pathname === "/api/anthropic/reset-grants") {
     if (ctx.req.method !== "GET") return fail(ctx, 405, "method_not_allowed");
-    return handleRead(ctx, deps);
+    const selected = selectDeps(ctx, ctx.url.searchParams.get("provider"), deps);
+    return selected ? handleRead(ctx, selected) : fail(ctx, 400, "invalid_provider");
   }
   if (pathname === "/api/anthropic/reset-grants/consume") {
     if (ctx.req.method !== "POST") return fail(ctx, 405, "method_not_allowed");