@bitkyc08/opencodex 2.80.0 → 2.81.0

package/src/server/management/config-routes.ts

@@ -4,6 +4,8 @@ import { getMainAccountExternalUsageWarning } from "../../codex/main-account-ext
 import { getObservedMainQuotaIdentityKey } from "../../codex/main-account-cache";
 import { compactionRoutingSchema, memoryModelsSchema } from "../../config/schema/leaf-validators";
 import { compactionRecoverySchema } from "../../config/schema/compaction-recovery";
+import { anthropicSidecarPatchError } from "../../config/schema/anthropic-account-pool";
+import { isAnthropicInstanceId } from "../../providers/anthropic-instance-id";
 import { captureConfigTopLevelRollback } from "../../config/rebase-provenance";
 import type { IntegrationClientId } from "../../integrations/registry";
 import { randomUUID } from "node:crypto";
@@ -85,7 +87,6 @@ import { getProviderRegistryEntry } from "../../providers/registry";
 import { VISION_REASONING_EFFORTS, isVisionReasoningEffort } from "../../reasoning-effort";
 import { normalizeVisionReasoningForModel } from "../../vision/reasoning";
 import {
-  findAnthropicVisionProvider,
   isValidVisionTimeoutMs,
   MAX_VISION_TIMEOUT_MS,
   MIN_VISION_TIMEOUT_MS,
@@ -105,6 +106,7 @@ import {
   webSearchModelIsRejected,
   webSearchModelOptionsFrom,
   webSearchModelRejection,
+  sidecarAnthropicPoolOptions, sidecarOptionsAuth, sidecarSettingsAfterPatch,
 } from "./web-search-sidecar-options";
 import { validateXaiSearchOptions } from "../../web-search/xai-executor";
 import { getDebugLogEntries } from "../../lib/debug-log-buffer";
@@ -150,7 +152,9 @@ async function sidecarVisionResponseSettings(config: OcxConfig): Promise<{
   const vs = config.visionSidecar ?? {};
   // Match the runtime's one selected Anthropic executor for both backend fallback
   // and catalog reachability; resolving it once prevents the two projections drifting.
-  const anthropicSidecar = findAnthropicVisionProvider(config);
+  const auth = sidecarOptionsAuth(config, vs.anthropicInstance);
+  const anthropicSidecar = auth.isAnthropicAuth && auth.anthropicProviderName && auth.anthropicProvider
+    ? { providerName: auth.anthropicProviderName, provider: auth.anthropicProvider, config } : undefined;
   // The routed backend reports its own namespaced model verbatim: it is the
   // dispatched value, and collapsing it through the legacy resolver would
   // display a describer the runtime is not using (roadmap 190).
@@ -276,7 +280,7 @@ export async function syncEnabledClientIntegrations(
     },
     config,
     port,
-  }, ["mcode", "pi", "aside", "raycast", "omo", "cline", "droid", "opencode", "kilo"]));
+  }, ["mcode", "pi", "aside", "raycast", "omo", "cline", "commandcode", "droid", "opencode", "kilo"]));
 
   return out;
 }
@@ -290,6 +294,8 @@ function publicVisionSidecarSettings(
     enabled: vs.enabled !== false,
     model: vision.model,
     backend: vs.backend,
+    ...(vs.anthropicInstance ? { anthropicInstance: vs.anthropicInstance } : {}),
+    anthropicPool: sidecarAnthropicPoolOptions(config, { ...vs, backend: vs.backend ?? (vision.models.find(row => row.value === vision.model)?.backend) }),
     reasoning: vision.reasoning,
     maxDescriptionsPerTurn: resolveMaxDescriptionsPerTurn(vs.maxDescriptionsPerTurn),
     timeoutMs: resolveVisionTimeoutMs(vs.timeoutMs),
@@ -882,6 +888,8 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
         enabled: ws.enabled !== false,
         model: ws.model ?? "gpt-5.6-luna",
         backend: ws.backend,
+        ...(ws.anthropicInstance ? { anthropicInstance: ws.anthropicInstance } : {}),
+        anthropicPool: sidecarAnthropicPoolOptions(config, ws),
         streamRoutedModelOutput: ws.streamRoutedModelOutput === true,
         ...(ws.xSearch ? { xSearch: ws.xSearch } : {}),
       },
@@ -902,10 +910,11 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
     if (raw.webSearch !== undefined && !isPlainRecord(raw.webSearch)) return jsonResponse({ error: "webSearch must be an object" }, 400);
     if (raw.vision !== undefined && !isPlainRecord(raw.vision)) return jsonResponse({ error: "vision must be an object" }, 400);
     const body = raw as {
-      webSearch?: { enabled?: unknown; model?: unknown; backend?: unknown; reasoning?: unknown; streamRoutedModelOutput?: unknown; exaApiKey?: unknown; xSearch?: unknown };
+      webSearch?: { enabled?: unknown; model?: unknown; backend?: unknown; anthropicInstance?: unknown; reasoning?: unknown; streamRoutedModelOutput?: unknown; exaApiKey?: unknown; xSearch?: unknown };
       vision?: {
         model?: unknown;
         backend?: unknown;
+        anthropicInstance?: unknown;
         reasoning?: unknown;
         maxDescriptionsPerTurn?: unknown;
         enabled?: unknown;
@@ -913,6 +922,11 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       };
     };
     const WEB_SEARCH_BACKENDS_UNION = ["openai", "anthropic", "xai", "gemini", "exa"] as const;
+    const instanceError = anthropicSidecarPatchError(config, {
+      ...(body.webSearch ? { webSearchSidecar: body.webSearch } : {}),
+      ...(body.vision ? { visionSidecar: body.vision } : {}),
+    });
+    if (instanceError) return jsonResponse({ error: instanceError }, 400);
     if (body.webSearch && body.webSearch.backend !== undefined && body.webSearch.backend !== null
       && !WEB_SEARCH_BACKENDS_UNION.includes(body.webSearch.backend as never)) {
       return jsonResponse({ error: "webSearch.backend must be openai, anthropic, xai, gemini, exa, or null" }, 400);
@@ -956,7 +970,7 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
     // rejection body, so a 400 cannot cost two provider fetches.
     if (body.vision && typeof body.vision.model === "string" && body.vision.model !== "") {
       const requested = body.vision.model;
-      const candidates = await visionCandidateRows(config);
+      const candidates = await visionCandidateRows({ ...config, visionSidecar: sidecarSettingsAfterPatch(config.visionSidecar, body.vision) });
       const hint = body.vision.backend === "anthropic" || body.vision.backend === "openai"
         || body.vision.backend === "routed"
         ? body.vision.backend
@@ -994,7 +1008,7 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
     // only case that owes a config.toml rewrite.
     const webSearchEnabledBefore = config.webSearchSidecar?.enabled !== false;
     if (body.webSearch) {
-      const pairTouched = body.webSearch.model !== undefined || body.webSearch.backend !== undefined;
+      const pairTouched = body.webSearch.model !== undefined || body.webSearch.backend !== undefined || body.webSearch.anthropicInstance !== undefined;
       // Validate against the backend the caller SUBMITTED, across the whole
       // union — not just openai/anthropic (#2457). The union check above has
       // already refused unknown literals, so a surviving string is a member;
@@ -1013,12 +1027,14 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
         ? body.webSearch.model || undefined
         : config.webSearchSidecar?.model;
       if (pairTouched && effectiveModel) {
-        const candidates = await webSearchCandidateRows(config);
+        const candidates = await webSearchCandidateRows({ ...config, webSearchSidecar: sidecarSettingsAfterPatch(config.webSearchSidecar, body.webSearch) });
         if (webSearchModelIsRejected(effectiveBackend, effectiveModel, candidates)) {
           return jsonResponse(webSearchModelRejection("webSearch.model", effectiveBackend, effectiveModel, candidates), 400);
         }
       }
       const webSearchCandidate = { ...config.webSearchSidecar };
+      if (body.webSearch.anthropicInstance === null) delete webSearchCandidate.anthropicInstance;
+      else if (isAnthropicInstanceId(body.webSearch.anthropicInstance)) webSearchCandidate.anthropicInstance = body.webSearch.anthropicInstance;
       if (typeof body.webSearch.model === "string") {
         if (body.webSearch.model === "") delete webSearchCandidate.model;
         else webSearchCandidate.model = body.webSearch.model;
@@ -1098,6 +1114,8 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
     }
     if (body.vision) {
       config.visionSidecar = { ...config.visionSidecar };
+      if (body.vision.anthropicInstance === null) delete config.visionSidecar.anthropicInstance;
+      else if (isAnthropicInstanceId(body.vision.anthropicInstance)) config.visionSidecar.anthropicInstance = body.vision.anthropicInstance;
       if (typeof body.vision.model === "string") {
         if (body.vision.model === "") delete config.visionSidecar.model;
         else config.visionSidecar.model = body.vision.model;
@@ -1143,6 +1161,8 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
         enabled: ws.enabled !== false,
         model: ws.model ?? "gpt-5.6-luna",
         backend: ws.backend,
+        ...(ws.anthropicInstance ? { anthropicInstance: ws.anthropicInstance } : {}),
+        anthropicPool: sidecarAnthropicPoolOptions(config, ws),
         streamRoutedModelOutput: ws.streamRoutedModelOutput === true,
         ...(ws.xSearch ? { xSearch: ws.xSearch } : {}),
       },

package/src/server/management/decision-routes.ts

@@ -1,4 +1,5 @@
 import { jsonResponse } from "../auth-cors";
+import { jevDecisionEndpointUrl } from "../../combos/jev-decision-contract";
 import type { ManagementContext } from "./context";
 import { readManagementJsonBody, rethrowManagementBodyTooLarge } from "./body";
 import { isPlainRecord } from "./shared";
@@ -29,7 +30,7 @@ function decisionServiceIssue(
   provider: DecisionRow,
   isSystemOneEndpoint: (url: string) => boolean,
 ): { url: string; model: string; issue?: "disabled" | "endpoint" | "model" } {
-  const url = typeof provider.baseUrl === "string" ? provider.baseUrl.trim().replace(/\/+$/, "") : "";
+  const url = typeof provider.baseUrl === "string" ? jevDecisionEndpointUrl(provider.baseUrl) : "";
   const model = provider.defaultModel?.trim() || provider.models?.[0]?.trim() || "";
   const issue = provider.disabled === true
     ? "disabled"

package/src/server/management/integration-routes.ts

@@ -318,6 +318,25 @@ function invalidClientResponse(ctx: ManagementContext): Response {
   }, 400, ctx.req, ctx.config);
 }
 
+/** Bind an explicitly scoped restore before profile delegation or mutation. */
+function restoreClientScopeResponse(ctx: ManagementContext, opId: string, expectedClientId: unknown, pathClientId?: IntegrationClientId): Response | null {
+  if (pathClientId !== undefined) {
+    if (expectedClientId !== undefined && (typeof expectedClientId !== "string" || !isIntegrationClientId(expectedClientId))) return invalidClientResponse(ctx);
+    if (expectedClientId !== undefined && expectedClientId !== pathClientId) return jsonResponse({ error: "restore identity does not match the client path", code: "integration_client_mismatch" }, 409, ctx.req, ctx.config);
+    expectedClientId = pathClientId;
+  }
+  if (expectedClientId === undefined) return null;
+  if (typeof expectedClientId !== "string" || !isIntegrationClientId(expectedClientId)) return invalidClientResponse(ctx);
+  try {
+    const operation = integrationStore().findOperation(opId);
+    if (!operation) return jsonResponse({ error: "integration operation not found", code: "integration_operation_not_found", opId }, 404, ctx.req, ctx.config);
+    if (operation.clientId !== expectedClientId) return jsonResponse({ error: "integration operation belongs to a different client", code: "integration_client_mismatch" }, 409, ctx.req, ctx.config);
+    return null;
+  } catch (error) {
+    return internalErrorResponse(error, ctx);
+  }
+}
+
 function isStringRecord(value: unknown): value is Record<string, string> {
   return value !== null && typeof value === "object" && !Array.isArray(value)
     && Object.values(value).every(item => typeof item === "string");
@@ -775,7 +794,7 @@ export async function handleIntegrationRoutes(ctx: ManagementContext): Promise<R
     }
   }
 
-  if (url.pathname === "/api/client-integrations/restore/preview") {
+  if (url.pathname === "/api/client-integrations/restore/preview" || url.pathname === "/api/client-integrations/commandcode/restore/preview") {
     if (req.method !== "POST") return null;
     const parsed = await readJsonBody(ctx);
     if (parsed instanceof Response) return parsed;
@@ -786,6 +805,8 @@ export async function handleIntegrationRoutes(ctx: ManagementContext): Promise<R
       return jsonResponse({ error: "confirmDrift must be a boolean", code: "invalid_confirm_drift" }, 400, req, ctx.config);
     }
     const opId = parsed.opId.trim();
+    const scopeResponse = restoreClientScopeResponse(ctx, opId, parsed.expectedClientId, url.pathname === "/api/client-integrations/commandcode/restore/preview" ? "commandcode" : undefined);
+    if (scopeResponse) return scopeResponse;
     try {
       const store = integrationStore();
       const operation = store.findOperation(opId);
@@ -819,7 +840,7 @@ export async function handleIntegrationRoutes(ctx: ManagementContext): Promise<R
     }
   }
 
-  if (url.pathname === "/api/client-integrations/restore") {
+  if (url.pathname === "/api/client-integrations/restore" || url.pathname === "/api/client-integrations/commandcode/restore") {
     if (req.method !== "POST") return null;
     const parsed = await readJsonBody(ctx);
     if (parsed instanceof Response) return parsed;
@@ -837,6 +858,8 @@ export async function handleIntegrationRoutes(ctx: ManagementContext): Promise<R
     }
 
     const opId = parsed.opId.trim();
+    const scopeResponse = restoreClientScopeResponse(ctx, opId, parsed.expectedClientId, url.pathname === "/api/client-integrations/commandcode/restore" ? "commandcode" : undefined);
+    if (scopeResponse) return scopeResponse;
     const confirmDrift = parsed.confirmDrift ?? false;
     const restoreBinding = planBindingOf(parsed);
     if (restoreBinding === "half") return halfBoundResponse(ctx);

package/src/server/management/oauth-account-routes.ts

@@ -1,7 +1,8 @@
-import { readConfigFileSnapshot, validateConfigCandidate } from "../../config/diagnostics";
-import { ConfigWritePublishedError } from "../../config/persist-unlocked";
+import { isAnthropicOAuthInstance, configuredAnthropicInstance, type AnthropicInstanceId } from "../../providers/anthropic-instance";
+import { resolveAnthropicAccountPoolConfig } from "../../oauth/anthropic-pool-config";
+import { persistAnthropicPoolPatch, writeAnthropicPoolSettings } from "./anthropic-pool-settings";
 import { parseAnthropicModelRoutes, readAnthropicModelRoutes } from "../../oauth/anthropic-model-routes";
-import { effectiveAnthropicAccountThreshold } from "../../oauth/anthropic-account-threshold";
+import { effectiveAnthropicAccountThresholdForInstance } from "../../oauth/anthropic-account-threshold";
 import { handleAnthropicAccountThreshold } from "./anthropic-account-threshold";
 import { randomBytes, randomUUID } from "node:crypto";
 import { readFileSync } from "node:fs";
@@ -18,7 +19,6 @@ import {
   readConfigDiagnostics,
   reconcileLiveConfigFromDisk,
   saveConfigPreservingClaudeCode,
-  mutatePersistedConfig,
 } from "../../config";
 import {
   clearLoginState,
@@ -39,7 +39,7 @@ import { enrichProviderFromCatalog, listKeyLoginProviders } from "../../oauth/ke
 import { deriveProviderPresets } from "../../providers/derive";
 import { providerCodexAccountMode } from "../../providers/registry";
 import { routedSlug, slugEquals } from "../../providers/slug-codec";
-import { clearAccountQuotaCache, clearProviderQuotaCache, fetchProviderAccountQuotas, fetchProviderApiKeyQuotas, fetchProviderQuotaReports, providerOAuthAccountQuotaMode, providerApiKeyQuotaMode, readPassiveProviderAccountQuotas } from "../../providers/quota";
+import { clearAccountQuotaCache, clearProviderQuotaCache, clearProviderQuotaCacheFor, fetchProviderAccountQuotas, fetchProviderApiKeyQuotas, fetchProviderQuotaReports, providerOAuthAccountQuotaMode, providerApiKeyQuotaMode, readPassiveProviderAccountQuotas } from "../../providers/quota";
 import { isCanonicalOpenAiForwardProvider } from "../../providers/openai-tiers";
 import { clearThreadAccountMap } from "../../codex/routing";
 import {
@@ -101,6 +101,21 @@ function isDevinCloudDirectProvider(provider: string): boolean {
   return provider === "devin" || provider === "devin-cli";
 }
 
+/**
+ * Quota invalidation after an account mutation. A B mutation retires only B's provider-level
+ * report, routing row and per-account rows; A's cache, epochs and in-flight probes survive.
+ * Other providers keep the global clear; `accountRows` also drops that provider's account rows.
+ */
+function clearQuotaCachesAfterAccountMutation(provider: string, accountRows: boolean): void {
+  if (provider === "anthropic2") {
+    clearProviderQuotaCacheFor(provider);
+    clearAccountQuotaCache(provider);
+    return;
+  }
+  clearProviderQuotaCache();
+  if (accountRows) clearAccountQuotaCache(provider);
+}
+
 async function clearDevinCloudDirectCaches(): Promise<void> {
   const { clearCachedUserJwt, clearCachedCatalog } = await import("../../adapters/devin/cloud-direct");
   clearCachedUserJwt();
@@ -208,49 +223,12 @@ function metaMuseConsentRequired(provider: string, principal: ManagementContext[
 
 function genericOAuthProviderConfig(provider: string, config: ManagementContext["config"]) {
   const configured = config.providers[provider];
+  if (provider === "anthropic2" && !configuredAnthropicInstance(config, provider)) return undefined;
   if (configured) return configured;
   const definition = OAUTH_PROVIDERS[provider];
   return definition?.resolveProviderConfig?.(config) ?? definition?.providerConfig;
 }
 
-/** Both Anthropic writers share publication-aware recovery from the atomic mutation owner. */
-function persistAnthropicPoolPatch(
-  config: OcxConfig,
-  patch: (target: OcxConfig) => { changed: boolean; value: NonNullable<OcxConfig["anthropicAccountPool"]> },
-): { status: "saved"; warning?: "config_bookkeeping_failed" } | { status: "failed"; response: Response } {
-  const before = readConfigFileSnapshot();
-  const unknown = () => ({ status: "failed" as const, response: jsonResponse({
-    error: "Pool settings save state is unknown; reload settings before editing again",
-    code: "config_save_state_unknown",
-  }, 409) });
-  try {
-    const saved = mutatePersistedConfig(patch);
-    if (saved.status === "unavailable") return unknown();
-    config.anthropicAccountPool = saved.value;
-    reconcileLiveStateStores();
-    return { status: "saved" };
-  } catch (error) {
-    const persisted = readConfigFileSnapshot();
-    if (persisted.diagnostics.source !== "file" || persisted.raw === undefined) return unknown();
-    // File reads may salvage hand edits; recovery success requires a strict, authoritative document.
-    let validated: ReturnType<typeof validateConfigCandidate>;
-    try { validated = validateConfigCandidate(JSON.parse(persisted.raw.replace(/^\uFEFF/, ""))); }
-    catch { return unknown(); }
-    if (!validated.ok) return unknown();
-    const current = validated.config;
-    const expected = patch(structuredClone(current)).value;
-    const matches = JSON.stringify(current.anthropicAccountPool) === JSON.stringify(expected);
-    if (matches) {
-      config.anthropicAccountPool = current.anthropicAccountPool;
-      // A failed reconcile must not turn confirmed publication back into a rollback.
-      try { reconcileLiveStateStores(); } catch { /* Fixed warning covers bookkeeping failure. */ }
-      return { status: "saved", warning: "config_bookkeeping_failed" };
-    }
-    if (error instanceof ConfigWritePublishedError || persisted.raw !== before.raw) return unknown();
-    return { status: "failed", response: jsonResponse({ error: "Pool settings could not be saved" }, 500) };
-  }
-}
-
 export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<Response | null> {
   const { req, url, config, deps, principal, syncClaudeAgentDefsBestEffort } = ctx;
 
@@ -422,9 +400,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     clearModelCache(provider);
     clearGatherRoutedModelsInflight();
     // Drop cached/last-good quota rows tied to the removed credential.
-    const { clearProviderQuotaCache, clearAccountQuotaCache } = await import("../../providers/quota");
-    clearProviderQuotaCache();
-    clearAccountQuotaCache(provider);
+    clearQuotaCachesAfterAccountMutation(provider, true);
     // The cached user_jwt's payload contains the api_key, and the catalog is
     // keyed by that key. Without this they outlive the credential in process
     // memory until the JWT's own ~24 minute expiry. `devin-cli` is a deprecated
@@ -445,7 +421,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     const { isGenericFailoverProvider, kiroAutoSelection } = await import("../../oauth/generic-account-failover");
     const effectiveProvider = genericOAuthProviderConfig(provider, config);
     const supportsPause = effectiveProvider !== undefined
-      && (provider === "anthropic" && effectiveProvider.authMode === "oauth"
+      && (isAnthropicOAuthInstance(provider) && effectiveProvider.authMode === "oauth"
         || isGenericFailoverProvider(provider, effectiveProvider));
     const {
       oauthAccountHealthFields,
@@ -456,7 +432,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
       const set = getAccountSet(provider);
       const current = getLoginStatus(provider, emailMaskingEnabled(config));
       return {
-        activeAccountId: current.activeAccountId ?? null,
+        ...(provider === "anthropic2" ? { provider } : {}), activeAccountId: current.activeAccountId ?? null,
         accounts: (current.accounts ?? []).map(summary => {
           const full = set?.accounts.find(account => account.id === summary.id);
           const health = full
@@ -467,9 +443,9 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
             });
           return { ...summary, ...oauthAccountHealthFields(provider, summary.id, health), quotaMode,
             ...(supportsPause ? { paused: full?.paused === true } : {}),
-            ...(provider === "anthropic" && supportsPause ? { autoSwitchThresholdOverride: full?.autoSwitchThresholdOverride ?? null,
-              effectiveAutoSwitchThreshold: effectiveAnthropicAccountThreshold(config, full),
-              autoSwitchThreshold: effectiveAnthropicAccountThreshold(config) } : {}),
+            ...(isAnthropicOAuthInstance(provider) && supportsPause ? { autoSwitchThresholdOverride: full?.autoSwitchThresholdOverride ?? null,
+              effectiveAutoSwitchThreshold: effectiveAnthropicAccountThresholdForInstance(provider as AnthropicInstanceId, config, full),
+              autoSwitchThreshold: effectiveAnthropicAccountThresholdForInstance(provider as AnthropicInstanceId, config) } : {}),
             ...(provider === "kiro" && full ? kiroAutoSelection(full) : {}) };
         }),
       };
@@ -489,11 +465,11 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     // from the post-probe store so the response is not stale.
     const rows = passiveQuota
       ? readPassiveProviderAccountQuotas(provider)
-      : await fetchProviderAccountQuotas(provider, forceRefresh, quotaProvider);
+      : await fetchProviderAccountQuotas(provider, forceRefresh, quotaProvider, config);
     const byId = new Map(rows.map(row => [row.accountId, row]));
     const projected = projectAccounts();
     return jsonResponse({
-      activeAccountId: projected.activeAccountId,
+      ...(provider === "anthropic2" ? { provider } : {}), activeAccountId: projected.activeAccountId,
       accounts: projected.accounts.map(account => {
         const row = byId.get(account.id);
         if (!row) return account;
@@ -514,6 +490,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     const body = await readManagementJsonBodyOr(req, {}) as { provider?: string; accountId?: string };
     const provider = (body.provider ?? "").trim().toLowerCase();
     if (!isPublicOAuthProvider(provider)) return jsonResponse({ error: "unknown oauth provider" }, 400);
+    if (provider === "anthropic2" && !configuredAnthropicInstance(config, provider)) return jsonResponse({ error: "Anthropic pool instance is not configured" }, 409);
     if (!body.accountId) return jsonResponse({ error: "missing accountId" }, 400);
     const { getAccountCredentialWithStatus, setActiveAccount } = await import("../../oauth/store");
     const current = getAccountCredentialWithStatus(provider, body.accountId);
@@ -532,16 +509,15 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     // side carries resetCodexRoutingForManualSelection for.
     const { genericPoolKey, seedPoolRotationAccount } = await import("../../oauth/pool-kernel");
     seedPoolRotationAccount(genericPoolKey(provider), body.accountId);
-    if (provider === "anthropic") {
-      const { resetAnthropicRoutingForManualSelection } = await import("../../oauth/anthropic-routing");
-      resetAnthropicRoutingForManualSelection(body.accountId);
+    if (isAnthropicOAuthInstance(provider)) {
+      const { anthropicRoutingFor } = await import("../../oauth/anthropic-routing");
+      anthropicRoutingFor(provider).resetAnthropicRoutingForManualSelection(body.accountId);
     }
     const { clearModelCache } = await import("../../codex/model-cache");
     const { clearGatherRoutedModelsInflight } = await import("../../codex/catalog");
     clearModelCache(provider);
     clearGatherRoutedModelsInflight();
-    const { clearProviderQuotaCache } = await import("../../providers/quota");
-    clearProviderQuotaCache();
+    clearQuotaCachesAfterAccountMutation(provider, false);
     return jsonResponse({ ok: true, provider, activeAccountId: body.accountId });
   }
 
@@ -558,7 +534,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
 
     const { isGenericFailoverProvider } = await import("../../oauth/generic-account-failover");
     const effectiveProvider = genericOAuthProviderConfig(provider, config);
-    if (!effectiveProvider || !(provider === "anthropic" && effectiveProvider.authMode === "oauth"
+    if (!effectiveProvider || !(isAnthropicOAuthInstance(provider) && effectiveProvider.authMode === "oauth"
       || isGenericFailoverProvider(provider, effectiveProvider))) {
       return jsonResponse({ error: "account pause is not supported for this OAuth provider" }, 400);
     }
@@ -568,9 +544,9 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     if (result.status === "not-found") return jsonResponse({ error: "account not found" }, 404);
 
     if (result.activeAccountChanged) {
-      if (provider === "anthropic") {
-        const { resetAnthropicRoutingForManualSelection } = await import("../../oauth/anthropic-routing");
-        resetAnthropicRoutingForManualSelection(result.activeAccountId);
+      if (isAnthropicOAuthInstance(provider)) {
+        const { anthropicRoutingFor } = await import("../../oauth/anthropic-routing");
+        anthropicRoutingFor(provider).resetAnthropicRoutingForManualSelection(result.activeAccountId);
       } else {
         const { genericPoolKey, seedPoolRotationAccount } = await import("../../oauth/pool-kernel");
         seedPoolRotationAccount(genericPoolKey(provider), result.activeAccountId);
@@ -579,8 +555,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
       const { clearGatherRoutedModelsInflight } = await import("../../codex/catalog");
       clearModelCache(provider);
       clearGatherRoutedModelsInflight();
-      const { clearProviderQuotaCache } = await import("../../providers/quota");
-      clearProviderQuotaCache();
+      clearQuotaCachesAfterAccountMutation(provider, false);
     }
 
     return jsonResponse({
@@ -671,7 +646,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
         if (autoSwitchThreshold !== undefined) config.autoSwitchThreshold = autoSwitchThreshold;
       } else if (kind === "anthropic") {
         const patchPool = (target: OcxConfig) => {
-          const pool = { ...(target.anthropicAccountPool ?? {}) };
+          const pool = { ...resolveAnthropicAccountPoolConfig(target, provider as AnthropicInstanceId) };
           if (fields.nativeMessages !== undefined) pool.nativeMessages = fields.nativeMessages as boolean;
           if (fields.enabled !== undefined) pool.enabled = fields.enabled as boolean;
           if (strategy !== undefined) pool.strategy = strategy as never;
@@ -682,10 +657,10 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
             if (fields.routes === null) delete pool.routes;
             else if (parsedRoutes?.ok) pool.routes = parsedRoutes.routes;
           }
-          target.anthropicAccountPool = pool;
+          writeAnthropicPoolSettings(target, provider as AnthropicInstanceId, pool);
           return { changed: true, value: pool };
         };
-        const saved = persistAnthropicPoolPatch(config, patchPool);
+        const saved = persistAnthropicPoolPatch(config, provider as AnthropicInstanceId, patchPool);
         if (saved.status === "failed") return saved.response;
         return jsonResponse({ ...unifiedPoolSettingsDto(config, provider, kind), ...(saved.warning ? { warning: saved.warning } : {}) });
       } else {
@@ -710,7 +685,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
   // Opt-in Anthropic OAuth account pool (#294): enable/threshold/strategy + clear cooldown.
   if (url.pathname === "/api/oauth/accounts/pool" && req.method === "GET") {
     const provider = (url.searchParams.get("provider") ?? "").trim().toLowerCase();
-    if (provider !== "anthropic") {
+    if (!isAnthropicOAuthInstance(provider)) {
       // Generic OAuth pool-settings contract (#695 slice 1): persisted per provider. `strategy`
       // and `autoSwitchThreshold` stay inert until the selector consumes them; `enabled` already
       // governs the pre-dispatch account preference. Codex keeps /api/codex-auth; api-key
@@ -722,7 +697,8 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
       }
       return jsonResponse(genericPoolSettingsDto(provider, prov, config.pool?.kernel === true));
     }
-    const pool = config.anthropicAccountPool ?? {};
+    if (provider === "anthropic2" && !configuredAnthropicInstance(config, provider)) return jsonResponse({ error: "Anthropic pool instance is not configured" }, 409);
+    const pool = resolveAnthropicAccountPoolConfig(config, provider);
     return jsonResponse({
       provider,
       enabled: pool.enabled === true,
@@ -753,10 +729,10 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     };
     const provider = typeof body.provider === "string" ? body.provider.trim().toLowerCase() : "";
     if (Object.hasOwn(body, "nativeMessages")) {
-      if (provider !== "anthropic") return jsonResponse({ error: "nativeMessages is only part of the anthropic pool contract" }, 400);
+      if (!isAnthropicOAuthInstance(provider)) return jsonResponse({ error: "nativeMessages is only part of the anthropic pool contract" }, 400);
       if (typeof body.nativeMessages !== "boolean") return jsonResponse({ error: "nativeMessages must be a boolean" }, 400);
     }
-    if (provider !== "anthropic") {
+    if (!isAnthropicOAuthInstance(provider)) {
       const {
         poolSettingsCapability, genericPoolSettingsDto, parseGenericPoolStrategy, parseGenericAutoSwitchThreshold,
         parseGenericStickyLimit, parseKiroAccountCap,
@@ -810,12 +786,13 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
       saveConfigPreservingClaudeCode(config);
       return jsonResponse({ ok: true, ...genericPoolSettingsDto(provider, prov, config.pool?.kernel === true) });
     }
-    let enabled = config.anthropicAccountPool?.enabled === true;
+    if (provider === "anthropic2" && !configuredAnthropicInstance(config, provider)) return jsonResponse({ error: "Anthropic pool instance is not configured" }, 409);
+    let enabled = resolveAnthropicAccountPoolConfig(config, provider)?.enabled === true;
     if (body.enabled !== undefined) {
       if (typeof body.enabled !== "boolean") return jsonResponse({ error: "enabled must be a boolean" }, 400);
       enabled = body.enabled;
     }
-    let threshold = config.anthropicAccountPool?.autoSwitchThreshold ?? 80;
+    let threshold = resolveAnthropicAccountPoolConfig(config, provider)?.autoSwitchThreshold ?? 80;
     if (body.autoSwitchThreshold !== undefined) {
       if (
         typeof body.autoSwitchThreshold !== "number"
@@ -827,7 +804,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
       }
       threshold = body.autoSwitchThreshold;
     }
-    let strategy = config.anthropicAccountPool?.strategy;
+    let strategy = resolveAnthropicAccountPoolConfig(config, provider)?.strategy;
     if (body.strategy !== undefined) {
       const parsed = parseAccountPoolStrategy(body.strategy);
       if (parsed === null) {
@@ -835,7 +812,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
       }
       strategy = parsed;
     }
-    let stickyLimit = config.anthropicAccountPool?.stickyLimit;
+    let stickyLimit = resolveAnthropicAccountPoolConfig(config, provider)?.stickyLimit;
     if (body.stickyLimit !== undefined) {
       const parsed = parseAccountPoolStickyLimit(body.stickyLimit);
       if (parsed === null) {
@@ -843,7 +820,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
       }
       stickyLimit = parsed;
     }
-    let quotaWindow = config.anthropicAccountPool?.quotaWindow;
+    let quotaWindow = resolveAnthropicAccountPoolConfig(config, provider)?.quotaWindow;
     if (body.quotaWindow !== undefined) {
       const parsed = parseAccountPoolQuotaWindow(body.quotaWindow);
       if (parsed === null) {
@@ -855,7 +832,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
       ? parseAnthropicModelRoutes(body.routes) : null;
     if (parsedLegacyRoutes && !parsedLegacyRoutes.ok) return jsonResponse({ error: parsedLegacyRoutes.error }, 400);
     const legacyPatch = (target: OcxConfig) => {
-      const pool = { ...(target.anthropicAccountPool ?? {}) };
+      const pool = { ...resolveAnthropicAccountPoolConfig(target, provider as AnthropicInstanceId) };
       if (body.enabled !== undefined) pool.enabled = enabled;
       else if (pool.enabled === undefined) pool.enabled = false;
       if (body.nativeMessages !== undefined) pool.nativeMessages = body.nativeMessages as boolean;
@@ -868,21 +845,21 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
         if (body.routes === null) delete pool.routes;
         else if (parsedLegacyRoutes?.ok) pool.routes = parsedLegacyRoutes.routes;
       }
-      target.anthropicAccountPool = pool;
+      writeAnthropicPoolSettings(target, provider as AnthropicInstanceId, pool);
       return { changed: true, value: pool };
     };
-    const saved = persistAnthropicPoolPatch(config, legacyPatch);
+    const saved = persistAnthropicPoolPatch(config, provider as AnthropicInstanceId, legacyPatch);
     if (saved.status === "failed") return saved.response;
     return jsonResponse({
       ok: true,
       provider,
-      enabled: config.anthropicAccountPool?.enabled === true,
-      autoSwitchThreshold: config.anthropicAccountPool?.autoSwitchThreshold ?? 80,
-      strategy: normalizeAccountPoolStrategy(config.anthropicAccountPool?.strategy),
-      stickyLimit: normalizeAccountPoolStickyLimit(config.anthropicAccountPool?.stickyLimit),
-      quotaWindow: normalizeAccountPoolQuotaWindow(config.anthropicAccountPool?.quotaWindow),
-      routes: config.anthropicAccountPool?.routes ?? null,
-      nativeMessages: !Object.hasOwn(config.anthropicAccountPool ?? {}, "nativeMessages") || config.anthropicAccountPool?.nativeMessages === true,
+      enabled: resolveAnthropicAccountPoolConfig(config, provider)?.enabled === true,
+      autoSwitchThreshold: resolveAnthropicAccountPoolConfig(config, provider)?.autoSwitchThreshold ?? 80,
+      strategy: normalizeAccountPoolStrategy(resolveAnthropicAccountPoolConfig(config, provider)?.strategy),
+      stickyLimit: normalizeAccountPoolStickyLimit(resolveAnthropicAccountPoolConfig(config, provider)?.stickyLimit),
+      quotaWindow: normalizeAccountPoolQuotaWindow(resolveAnthropicAccountPoolConfig(config, provider)?.quotaWindow),
+      routes: resolveAnthropicAccountPoolConfig(config, provider)?.routes ?? null,
+      nativeMessages: !Object.hasOwn(resolveAnthropicAccountPoolConfig(config, provider), "nativeMessages") || resolveAnthropicAccountPoolConfig(config, provider)?.nativeMessages === true,
       ...(saved.warning ? { warning: saved.warning } : {}),
       experimental: true,
     });
@@ -891,10 +868,11 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     const body = await readManagementJsonBodyOr(req, {}) as { provider?: unknown; accountId?: unknown };
     const provider = typeof body.provider === "string" ? body.provider.trim().toLowerCase() : "";
     const accountId = typeof body.accountId === "string" ? body.accountId.trim() : "";
-    if (provider !== "anthropic") return jsonResponse({ error: "clear-cooldown is only supported for anthropic" }, 400);
+    if (!isAnthropicOAuthInstance(provider)) return jsonResponse({ error: "clear-cooldown is only supported for anthropic" }, 400);
+    if (provider === "anthropic2" && !configuredAnthropicInstance(config, provider)) return jsonResponse({ error: "Anthropic pool instance is not configured" }, 409);
     if (!accountId) return jsonResponse({ error: "missing accountId" }, 400);
-    const { clearAnthropicAccountCooldown } = await import("../../oauth/anthropic-routing");
-    const cleared = clearAnthropicAccountCooldown(accountId);
+    const { anthropicRoutingFor } = await import("../../oauth/anthropic-routing");
+    const cleared = anthropicRoutingFor(provider).clearAnthropicAccountCooldown(accountId);
     return jsonResponse({ ok: true, cleared });
   }
 
@@ -936,8 +914,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
         const { clearGatherRoutedModelsInflight } = await import("../../codex/catalog");
         clearModelCache(provider);
         clearGatherRoutedModelsInflight();
-        clearProviderQuotaCache();
-        clearAccountQuotaCache(provider);
+        clearQuotaCachesAfterAccountMutation(provider, true);
       }
       if (!imported.ok) return jsonResponse({ code: imported.code }, imported.status);
       return jsonResponse(imported.result);
@@ -969,19 +946,17 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     const { removeAccount, getAccountSet } = await import("../../oauth/store");
     if (!(await removeAccount(provider, id))) return jsonResponse({ error: "account not found" }, 404);
     reconcileLiveStateStores();
-    if (provider === "anthropic") {
-      const { clearAnthropicAccountCooldown, clearAnthropicSessionAffinityForAccount } = await import("../../oauth/anthropic-routing");
-      clearAnthropicAccountCooldown(id);
-      clearAnthropicSessionAffinityForAccount(id);
+    if (isAnthropicOAuthInstance(provider)) {
+      const { anthropicRoutingFor } = await import("../../oauth/anthropic-routing");
+      anthropicRoutingFor(provider).clearAnthropicAccountCooldown(id);
+      anthropicRoutingFor(provider).clearAnthropicSessionAffinityForAccount(id);
     }
     if (!getAccountSet(provider)) clearLoginState(provider);
     const { clearModelCache } = await import("../../codex/model-cache");
     const { clearGatherRoutedModelsInflight } = await import("../../codex/catalog");
     clearModelCache(provider);
     clearGatherRoutedModelsInflight();
-    const { clearProviderQuotaCache, clearAccountQuotaCache } = await import("../../providers/quota");
-    clearProviderQuotaCache();
-    clearAccountQuotaCache(provider);
+    clearQuotaCachesAfterAccountMutation(provider, true);
     // Same reasoning as logout. Removing the last account for a provider used to
     // leave the JWT and catalog in memory, because only the logout route cleared
     // them.
@@ -1168,7 +1143,13 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     if (principal !== "gui-session") {
       return jsonResponse({ error: "dashboard session required" }, 403, req, config);
     }
+    // Local page bootstrap is sufficient for the dashboard, not stored-secret disclosure.
+    const authorized = () => ctx.sessionControl?.canRevealDataKeys?.(req, config) === true;
+    const denied = () => jsonResponse({ error: "operator-authorized dashboard session required" }, 403, req, config);
+    if (!authorized()) return denied();
     const body = await readJsonBody(req);
+    // Body reception can outlive the session or its revocation; do not trust cached admission.
+    if (!authorized()) return denied();
     if (!body || Object.keys(body).length !== 1 || typeof body.id !== "string" || !body.id) {
       return jsonResponse({ error: "invalid body" }, 400, req, config);
     }