@bitkyc08/opencodex 2.80.0 → 2.82.0

package/src/claude/outbound.ts

@@ -20,7 +20,7 @@ import {
   type TranslatorBudget,
 } from "../lib/translator-budget";
 import { sseFieldOffset, sseFieldValue } from "../lib/sse-decoder";
-import { decodeReasoningEnvelope, encodeReasoningEnvelope } from "../responses/reasoning-envelope";
+import { decodeReasoningEnvelope, encodeReasoningEnvelope, OCX_REASONING_PREFIX } from "../responses/reasoning-envelope";
 
 type Rec = Record<string, unknown>;
 
@@ -70,8 +70,67 @@ export function anthropicErrorType(status: number): string {
   }
 }
 
+/**
+ * Claude Code compacts reactively only when an oversized-prompt refusal is worded the way the
+ * Anthropic API words it: it looks for `prompt is too long` (or `input is too long for requested
+ * model`) in the message and reads `prompt is too long: <actual> tokens > <limit> maximum` for the
+ * gap (2.1.288 binary). Routed providers word the same refusal differently, so a
+ * context_length_exceeded envelope is rewritten into that form. Counts are carried over only when
+ * the upstream states both of them; otherwise the original text is prefixed and no number is
+ * guessed. Without this the client ends the turn on a fatal error instead of compacting
+ * (devlog/_plan/261009_claude_1m_default/010).
+ */
+const CLAUDE_PROMPT_TOO_LONG_RE = /prompt is too long|input is too long for requested model/i;
+const STATED_CONTEXT_COUNTS_RE = /maximum context length is (\d+) tokens[\s\S]*?(?:resulted in|you requested) (\d+) tokens/i;
+
+export function claudePromptTooLongMessage(message: string): string {
+  if (CLAUDE_PROMPT_TOO_LONG_RE.test(message)) return message;
+  const counts = STATED_CONTEXT_COUNTS_RE.exec(message);
+  if (counts) return `prompt is too long: ${counts[2]} tokens > ${counts[1]} maximum`;
+  return `prompt is too long: ${message}`;
+}
+
+/** Provider wordings of an oversized-input refusal, for lanes that relay a provider's own error text. */
+const CONTEXT_OVERFLOW_TEXT_RE = /prompt is too long|input is too long|context window|context length|maximum context|too many tokens|model token limit/i;
+
+export function isContextOverflowText(message: string): boolean {
+  return CONTEXT_OVERFLOW_TEXT_RE.test(message);
+}
+
+/**
+ * SSE payload rewrite for the native Messages lane: an `error` event that refuses an oversized
+ * input gets the Anthropic wording; every other payload passes through byte-identical. The type
+ * gate keeps a rate limit that happens to mention the context window untouched.
+ */
+export function claudeOverflowSsePayload(payload: string): string {
+  if (!payload.includes("\"error\"")) return payload;
+  let parsed: unknown;
+  try { parsed = JSON.parse(payload); } catch { return payload; }
+  if (!isRec(parsed) || parsed.type !== "error" || !isRec(parsed.error)) return payload;
+  const error = parsed.error;
+  const message = typeof error.message === "string" ? error.message : "";
+  const sized = error.type === "invalid_request_error" || error.type === "request_too_large";
+  if (!sized || isThroughputLimitText(message)) return payload;
+  if (!(error.code === "context_length_exceeded" || isContextOverflowText(message))) return payload;
+  const next = claudePromptTooLongMessage(message);
+  return next === message ? payload : JSON.stringify({ ...parsed, error: { ...error, message: next } });
+}
+
+/**
+ * A throughput limit that the shared classifier files under context_length_exceeded (its "too many
+ * tokens" match also catches "too many tokens per minute"). Worded as an overflow it would make
+ * Claude Code compact a conversation that only needs to wait, so it keeps its own text.
+ */
+const THROUGHPUT_LIMIT_TEXT_RE = /\bper (?:second|minute|hour|day)\b|\brate limit|\bquota\b|\btpm\b/i;
+
+export function isThroughputLimitText(message: string): boolean {
+  return THROUGHPUT_LIMIT_TEXT_RE.test(message);
+}
+
 export function anthropicErrorBody(status: number, message: string, type?: string, code?: string): Rec {
-  return { type: "error", error: { type: type ?? anthropicErrorType(status), message, ...(code ? { code } : {}) } };
+  const overflow = code === "context_length_exceeded" && !isThroughputLimitText(message);
+  const text = overflow ? claudePromptTooLongMessage(message) : message;
+  return { type: "error", error: { type: type ?? anthropicErrorType(status), message: text, ...(code ? { code } : {}) } };
 }
 
 export function anthropicErrorResponse(status: number, message: string, type?: string, code?: string): Response {
@@ -280,6 +339,13 @@ interface OpenBlock {
   thinkingBuf?: string;
   thinkingBufBytes?: number;
   reasoningSig?: string;
+  /** The provider's own encrypted reasoning for this item; signed into the block on close. */
+  reasoningNative?: { enc: string; id?: string };
+}
+
+/** A provider-minted (not ocxr1) `encrypted_content`, or `""`. */
+function nativeEncryptedReasoning(encrypted: string): string {
+  return encrypted.length > 0 && !encrypted.startsWith(OCX_REASONING_PREFIX) ? encrypted : "";
 }
 
 /** Streaming: Responses SSE bytes -> Anthropic Messages SSE bytes. */
@@ -294,6 +360,7 @@ export function responsesSseToAnthropicSse(
      * upstream sent no confirmed usage before the first frame. See `messageSnapshot` (#4857).
      */
     inputTokenFloor?: number;
+    nativeReasoningTagFor?: (blob: string) => string | undefined;
   },
 ): ReadableStream<Uint8Array> {
   const translatorBudget = opts.translatorBudget;
@@ -382,6 +449,13 @@ export function responsesSseToAnthropicSse(
           open.webSearchArgsEmitted = true;
         }
         if (open.kind === "thinking") {
+          const native = open.reasoningNative;
+          const tag = native && opts.nativeReasoningTagFor?.(native.enc);
+          if (!open.thinkingBuf && !open.reasoningSig && !tag) {
+            releaseThinkingBuffer(open);
+            open = null;
+            return;
+          }
           // Delay the index and all thinking frames until closure so a matching
           // done envelope can put its redacted blocks first. The existing buffer
           // remains charged through signature emission, including queued frames.
@@ -396,7 +470,10 @@ export function responsesSseToAnthropicSse(
               delta: { type: "thinking_delta", thinking: open.thinkingBuf },
             });
           }
-          const signature = open.reasoningSig ?? encodeReasoningEnvelope({ txt: open.thinkingBuf ?? "" }, translatorBudget);
+          const signature = open.reasoningSig ?? encodeReasoningEnvelope({
+            txt: open.thinkingBuf ?? "",
+            ...(tag ? { nat: { ...native, model, tag } } : {}),
+          }, translatorBudget);
           emit("content_block_delta", {
             type: "content_block_delta", index: open.index,
             delta: { type: "signature_delta", signature },
@@ -684,11 +761,15 @@ export function responsesSseToAnthropicSse(
                 emit("content_block_start", { type: "content_block_start", index: idx, content_block: { type: "redacted_thinking", data } });
                 emit("content_block_stop", { type: "content_block_stop", index: idx });
               }
-              if (env?.sig && open?.kind !== "thinking") {
+              // A provider's own blob is the only copy of its reasoning the client can hold, so
+              // it gets a thinking block even when no summary text arrived.
+              const native = nativeEncryptedReasoning(encrypted);
+              if ((env?.sig || native) && open?.kind !== "thinking") {
                 ensureBlock("thinking");
               }
               if (open?.kind === "thinking") {
                 if (env?.sig) open.reasoningSig = env.sig;
+                if (native) open.reasoningNative = typeof item.id === "string" && item.id.length > 0 ? { enc: native, id: item.id } : { enc: native };
                 closeOpenBlock();
               }
             }
@@ -881,7 +962,7 @@ export function responsesSseToAnthropicSse(
 }
 
 /** Non-streaming: /v1/responses JSON -> Anthropic message JSON. */
-export function responsesJsonToAnthropicMessage(json: unknown, model: string, translatorBudget?: TranslatorBudget): Rec {
+export function responsesJsonToAnthropicMessage(json: unknown, model: string, translatorBudget?: TranslatorBudget, nativeReasoningTagFor?: (blob: string) => string | undefined): Rec {
   const body = isRec(json) ? json : {};
   const output = Array.isArray(body.output) ? body.output : [];
   const content: Rec[] = [];
@@ -917,10 +998,14 @@ export function responsesJsonToAnthropicMessage(json: unknown, model: string, tr
         // Legacy combined envelopes place redacted blocks before the signed block,
         // matching the Anthropic adapter. New bridge output uses separate items.
         for (const data of env?.red ?? []) content.push({ type: "redacted_thinking", data });
-        // env.txt may be locally hidden text. Do not expose it here or manufacture
-        // a new signed continuity carrier; hidden-summary replay remains limited.
-        if (parts.length > 0 || env?.sig) {
-          content.push({ type: "thinking", thinking: parts.join("\n\n"), signature: env?.sig ?? encodeReasoningEnvelope({ txt: parts.join("\n\n") }, translatorBudget) });
+        // env.txt may be locally hidden text. Do not expose it here. A provider's own blob is
+        // carried in the envelope so the next request can hand it back (see inbound.ts).
+        const native = nativeEncryptedReasoning(encrypted);
+        const tag = native && nativeReasoningTagFor?.(native);
+        if (parts.length > 0 || env?.sig || tag) {
+          const text = parts.join("\n\n");
+          const nat = tag ? { enc: native, model, tag, ...(typeof raw.id === "string" && raw.id.length > 0 ? { id: raw.id } : {}) } : undefined;
+          content.push({ type: "thinking", thinking: text, signature: env?.sig ?? encodeReasoningEnvelope({ txt: text, ...(nat ? { nat } : {}) }, translatorBudget) });
         }
         break;
       }

package/src/claude/subagent-model.ts

@@ -1,6 +1,7 @@
 import type { OcxConfig } from "../types";
 import { claudeCodeAlias, claudeCodeNativeAlias, resolveAlias } from "./alias";
-import { AUTO_CONTEXT_OFF, shouldMarkOneMillion, stripOneMillionMarker, withOneMillionMarker } from "./context-windows";
+import { AUTO_CONTEXT_OFF, shouldMarkOneMillion, stripOneMillionMarker, UNPAIRED_AUTO_CONTEXT, withOneMillionMarker, type AutoContextMode } from "./context-windows";
+import { isAnthropicClaudeRoute } from "./long-context";
 import { hasOwnProvider } from "../config";
 import { knownModelIdsForProvider } from "../router";
 import { decodeRoutedModelIdOrThrow } from "../providers/slug-codec";
@@ -14,20 +15,43 @@ export { SAFE_AGENT_MODEL_ID } from "../config/subagent-models";
 
 /**
  * Generated subagent defs cannot rely on the parent's auto-context compaction
- * pairing, so their [1m] marker follows the AUTHORITATIVE window only: mark when
- * the effective window (exact selector, then the canonical [1m] form, then bare)
- * is genuinely >= 1M; strip an inherited unsafe marker back to the bare selector;
- * with no window information, keep the selector as it was. Genuine routed [1m]
- * ids are preserved through the canonical-exact lookup. (#854)
+ * pairing, so their [1m] marker follows the unpaired long-context rule
+ * (long-context.ts): mark when the effective window (exact selector, then the
+ * canonical [1m] form, then bare) is >= 1M or can host the default compact window,
+ * whose overflow Claude Code compacts on as `prompt is too long`; strip an inherited
+ * marker the window cannot carry; with no window information, keep the selector as it
+ * was. Genuine routed [1m] ids are preserved through the canonical-exact lookup.
+ * (#854; devlog/_plan/261009_claude_1m_default/020)
  */
-export function withSubagentContextMarker(selector: string, windows: Record<string, number>): string {
+/**
+ * The marking mode a subagent selector gets: real Anthropic models (a bare `claude-*` passthrough
+ * id, or a Claude row on either Anthropic pool) need a genuine 1M; everything else follows the
+ * unpaired long-context rule. Connected launches read windows from the published catalog, which
+ * does not drop capped Anthropic rows, so this cannot rely on the window map alone.
+ */
+function subagentSelectorMode(bare: string): AutoContextMode {
+  const route = resolveAlias(bare) ?? resolveDesktop3pAlias(bare) ?? bare;
+  const slash = route.indexOf("/");
+  const anthropic = slash < 0
+    ? route.startsWith("claude-")
+    : isAnthropicClaudeRoute(route.slice(0, slash), route.slice(slash + 1));
+  return anthropic ? AUTO_CONTEXT_OFF : UNPAIRED_AUTO_CONTEXT;
+}
+
+/**
+ * `accounting200k` (claudeCode.contextAccounting "200k") stops automatic marking only: an unmarked
+ * selector stays bare, while an explicit [1m] still follows its selector's safety rule.
+ */
+export function withSubagentContextMarker(selector: string, windows: Record<string, number>, accounting200k = false): string {
   const bare = stripOneMillionMarker(selector);
   const wasMarked = selector !== bare;
   const canonicalExact = wasMarked ? `${bare}[1m]` : selector;
   const authoritativeWindow = windows[selector] ?? windows[canonicalExact] ?? windows[bare];
   if (typeof authoritativeWindow === "number" && authoritativeWindow > 0) {
-    return shouldMarkOneMillion(authoritativeWindow, AUTO_CONTEXT_OFF)
-      ? (withOneMillionMarker(selector, windows) ?? selector)
+    if (accounting200k && !wasMarked) return bare;
+    const mode = subagentSelectorMode(bare);
+    return shouldMarkOneMillion(authoritativeWindow, mode)
+      ? (withOneMillionMarker(selector, windows, mode) ?? selector)
       : bare;
   }
   return wasMarked ? selector : bare;
@@ -56,6 +80,11 @@ function selectorIdentity(selector: string): string {
   return fullSelectorIdentity(stripOneMillionMarker(selector));
 }
 
+/** Whether the config opted into 200k accounting (shared by roster, self and force markers). */
+export function accountsAt200k(config: OcxConfig): boolean {
+  return config.claudeCode?.contextAccounting === "200k";
+}
+
 /** Resolve only currently exposed entries; retained roster rows are not exposure proof. */
 export function resolveSubagentForceModel(config: OcxConfig, windows: Record<string, number>, available: SubagentForceExposure): string | null {
   const entry = config.claudeCode?.subagentModelForce;
@@ -77,8 +106,8 @@ export function resolveSubagentForceModel(config: OcxConfig, windows: Record<str
     const window = windows[parts.alias] ?? windows[`${bare}[1m]`] ?? windows[bare];
     // Identity admission must not let an appended context promise ride on an
     // ordinary exposed model. Exact catalog ids such as kimi/k3[1m] remain literal.
-    if (requestedMarker && !exactMarkedExposure && !(typeof window === "number" && Number.isFinite(window) && window >= 1_000_000)) return null;
-    const marked = exactMarkedExposure ? parts.alias : withSubagentContextMarker(parts.alias, windows);
+    if (requestedMarker && !exactMarkedExposure && !(typeof window === "number" && Number.isFinite(window) && shouldMarkOneMillion(window, subagentSelectorMode(bare)))) return null;
+    const marked = exactMarkedExposure ? parts.alias : withSubagentContextMarker(parts.alias, windows, accountsAt200k(config));
     // Bare Anthropic names are indistinguishable from the old CLI's fallback.
     // Encode only the force selector; handlers restore native identity before
     // their existing credential/model-map checks. Roster generation is unchanged.

package/src/cli/account-anthropic-threshold.ts

@@ -1,7 +1,13 @@
+import type { AnthropicInstanceId } from "../providers/anthropic-instance-id";
 import { apiError, apiJson, proxyUnreachable, resolveBaseUrl, type AccountDeps } from "./account-api";
 
+/** A 200 that names another pool is refused locally; there is no upstream status to forward. */
+export function anthropicProviderIdentityError(json: Record<string, unknown>, provider: AnthropicInstanceId, label: string): number | undefined {
+  return json.provider === provider ? undefined : apiError({}, `invalid ${label} identity`, 400);
+}
+
 /** A separate account selector prevents accidentally changing the whole Anthropic pool. */
-export async function cmdAnthropicAccountThreshold(args: string[], action: string, wantsJson: boolean, deps: AccountDeps): Promise<number> {
+export async function cmdAnthropicAccountThreshold(args: string[], action: string, wantsJson: boolean, deps: AccountDeps, provider: AnthropicInstanceId = "anthropic"): Promise<number> {
   const selector = args.indexOf("--account");
   const accountId = selector >= 0 ? args[selector + 1] : undefined;
   if (selector >= 0) args.splice(selector, 2);
@@ -15,8 +21,8 @@ export async function cmdAnthropicAccountThreshold(args: string[], action: strin
   const base = await resolveBaseUrl(deps);
   if (!base) return proxyUnreachable();
   const response = action === "status"
-    ? await apiJson(deps, base, "GET", "/api/oauth/accounts?provider=anthropic")
-    : await apiJson(deps, base, "PUT", "/api/oauth/accounts/auto-switch", { provider: "anthropic", accountId, threshold });
+    ? await apiJson(deps, base, "GET", `/api/oauth/accounts?provider=${provider}`)
+    : await apiJson(deps, base, "PUT", "/api/oauth/accounts/auto-switch", { provider, accountId, threshold });
   if (response.status === 0) return proxyUnreachable(response.transportError);
   if (response.status !== 200) return apiError(response.json, "failed to update account threshold", response.status);
   if (!response.json || typeof response.json !== "object" || Array.isArray(response.json)) return apiError({}, "invalid account threshold response", 400);
@@ -28,7 +34,10 @@ export async function cmdAnthropicAccountThreshold(args: string[], action: strin
   const validPercent = (value: unknown) => typeof value === "number" && Number.isInteger(value) && value >= 0 && value <= 100;
   if ((result.autoSwitchThresholdOverride !== null && !validPercent(result.autoSwitchThresholdOverride))
     || !validPercent(result.effectiveAutoSwitchThreshold)) return apiError({}, "invalid account threshold response", 400);
-  const payload = { provider: "anthropic", accountId, autoSwitchThresholdOverride: result.autoSwitchThresholdOverride,
+  const responseProvider = action === "status" ? response.json.provider : result.provider;
+  if ((provider === "anthropic2" || responseProvider !== undefined) && responseProvider !== provider) return apiError({}, "invalid account threshold identity", 400);
+  if (action !== "status" && (provider === "anthropic2" || result.accountId !== undefined) && result.accountId !== accountId) return apiError({}, "invalid account threshold identity", 400);
+  const payload = { provider, accountId, autoSwitchThresholdOverride: result.autoSwitchThresholdOverride,
     effectiveAutoSwitchThreshold: result.effectiveAutoSwitchThreshold };
   if (wantsJson) console.log(JSON.stringify(payload, null, 2));
   else console.log(`auto-switch: ${payload.autoSwitchThresholdOverride === null ? "inherited" : "custom"} (${payload.effectiveAutoSwitchThreshold === 0 ? "usage-based switching disabled" : `${payload.effectiveAutoSwitchThreshold}%`})`);
@@ -36,6 +45,6 @@ export async function cmdAnthropicAccountThreshold(args: string[], action: strin
 }
 
 function invalid(): number {
-  console.error("Usage: ocx account auto-switch anthropic <status|inherit|on|off|threshold <0-100>> --account <id> [--json]");
+  console.error("Usage: ocx account auto-switch <anthropic|anthropic2> <status|inherit|on|off|threshold <0-100>> --account <id> [--json]");
   return 2;
 }

package/src/cli/account-api.ts

@@ -1,3 +1,4 @@
+import { configuredAnthropicInstance, isAnthropicOAuthInstance } from "../providers/anthropic-instance";
 import { parseQuotaFailureCode, type QuotaFailureCode, type ProviderQuota, type AccountQuotaMode } from "../providers/quota-types";
 /**
  * Data-access layer for `ocx account` (issue #180) — live-proxy HTTP client and
@@ -110,6 +111,7 @@ export function classifyAccount(config: OcxConfig, name: string): ClassifyResult
   if (provider && !provider.authMode && (provider.apiKey || (provider.apiKeyPool?.length ?? 0) > 0)) {
     return { type: "api-key" };
   }
+  if (name === "anthropic2" && !configuredAnthropicInstance(config, name)) return { error: "Anthropic pool instance is not configured" };
   if (isPublicOAuthProvider(name)) return { type: "oauth" };
   if (provider) return { type: "api-key" };
   return { error: `unknown provider "${name}"` };
@@ -408,7 +410,7 @@ async function fetchOAuthRows(
     needsReauth: a.needsReauth,
     ...projectAccountHealth(a, name, a.id),
     ...(a.paused === true ? { paused: true } : {}),
-    ...(name === "anthropic" && Object.hasOwn(a, "autoSwitchThresholdOverride") ? { autoSwitchThresholdOverride: a.autoSwitchThresholdOverride } : {}),
+    ...(isAnthropicOAuthInstance(name) && Object.hasOwn(a, "autoSwitchThresholdOverride") ? { autoSwitchThresholdOverride: a.autoSwitchThresholdOverride } : {}),
     ...(a.needsReauthReason === "verify_account" ? { needsReauthReason: a.needsReauthReason } : {}),
     ...(name === "kiro" && typeof a.autoSelectable === "boolean"
       ? { autoSelectable: a.autoSelectable } : {}),

package/src/cli/account-extended.ts

@@ -1,5 +1,6 @@
+import { isAnthropicOAuthInstance } from "../providers/anthropic-instance";
 import { loadConfig } from "../config";
-import { cmdAnthropicAccountThreshold } from "./account-anthropic-threshold";
+import { anthropicProviderIdentityError, cmdAnthropicAccountThreshold } from "./account-anthropic-threshold";
 import { isReservedCodexAccountWord, reportCodexAccountTargetError, resolveCodexAccountTarget } from "./account-target";
 import { hasPassiveAccountQuota } from "../providers/quota";
 import { closeSync, openSync, readSync, readFileSync, statSync } from "node:fs";
@@ -41,7 +42,7 @@ const AUTO_NOTE = "auto (no pin — lowest-usage account is selected per request
 const EXTENDED_USAGE = `Usage:
   ocx account refresh <provider> [--json]
   ocx account auto-switch <provider> <on|off|status|threshold <0-100>> [--json]
-  ocx account auto-switch anthropic <on|off|status|inherit|threshold <0-100>> --account <id> [--json]
+  ocx account auto-switch <anthropic|anthropic2> <on|off|status|inherit|threshold <0-100>> --account <id> [--json]
   ocx account alias <provider> <id|alias|main> <display-name|-> [--json]
   ocx account priority <provider> <id|alias|main> [<-100..100|first|earlier|normal|later|last|reset>] [--json]
   ocx account pause <provider> <id|alias|main> [--json]
@@ -49,7 +50,7 @@ const EXTENDED_USAGE = `Usage:
   ocx account pause-exhausted <provider> [--json]
   ocx account strategy <provider> [<quota|round-robin|fill-first|least-loaded|reset-first>] [--json]
   ocx account sticky <provider> [<1-100>] [--json]
-  ocx account routes anthropic [--file <json-file>|--clear] [--json]
+  ocx account routes <anthropic|anthropic2> [--file <json-file>|--clear] [--json]
   ocx account remove <provider> <id|alias|main> --yes [--json]
   ocx account clear-cooldown <provider> <id|alias|main> [--json]
   ocx account add-key <provider> [--label <label>] [--json]
@@ -360,8 +361,8 @@ export async function cmdAutoSwitch(args: string[], deps: AccountDeps): Promise<
   const classified = configAndType(deps, name);
   // Anthropic keeps its threshold on its own pool contract; generic OAuth providers (#695)
   // and the Codex pool are accepted here.
-  if (!("error" in classified) && classified.type === "oauth" && name === "anthropic") return cmdAnthropicAccountThreshold(args, action, wantsJson, deps);
-  if ("error" in classified || classified.type === "api-key" || name === "anthropic") {
+  if (!("error" in classified) && classified.type === "oauth" && isAnthropicOAuthInstance(name)) return cmdAnthropicAccountThreshold(args, action, wantsJson, deps, name);
+  if ("error" in classified || classified.type === "api-key" || isAnthropicOAuthInstance(name)) {
     return usage("Error: auto-switch only applies to the openai Codex account pool or a generic OAuth provider pool");
   }
   const genericPool = classified.type === "oauth";
@@ -638,7 +639,7 @@ export async function cmdClearCooldown(args: string[], deps: AccountDeps): Promi
   if (!name || !requestedId || args.length) return usage();
   const classified = configAndType(deps, name);
   if ("error" in classified) return usage(`Error: ${classified.error}`);
-  if (classified.type !== "codex" && !(classified.type === "oauth" && name === "anthropic")) {
+  if (classified.type !== "codex" && !(classified.type === "oauth" && isAnthropicOAuthInstance(name))) {
     return usage(`Error: ${name} has no operator-clearable account cooldown`);
   }
   const baseUrl = await resolveBaseUrl(deps);
@@ -1108,7 +1109,8 @@ export async function cmdRoutes(args: string[], deps: AccountDeps): Promise<numb
   const wantsJson = flag(args, "--json");
   const file = flagValue(args, "--file");
   const clear = flag(args, "--clear");
-  if (args.shift() !== "anthropic" || args.length || (file.found && (!file.value || clear))) return usage();
+  const provider = args.shift();
+  if (!isAnthropicOAuthInstance(provider) || args.length || (file.found && (!file.value || clear))) return usage();
   const baseUrl = await resolveBaseUrl(deps);
   if (!baseUrl) return proxyUnreachable();
   let routes: unknown;
@@ -1123,10 +1125,12 @@ export async function cmdRoutes(args: string[], deps: AccountDeps): Promise<numb
   }
   const writing = file.found || clear;
   const response = await apiJson(deps, baseUrl, writing ? "PUT" : "GET",
-    writing ? "/api/pool/settings" : "/api/pool/settings?provider=anthropic",
-    writing ? { provider: "anthropic", routes: clear ? null : routes } : undefined);
+    writing ? "/api/pool/settings" : `/api/pool/settings?provider=${provider}`,
+    writing ? { provider, routes: clear ? null : routes } : undefined);
   if (response.status === 0) return proxyUnreachable(response.transportError);
   if (response.status !== 200) return apiError(response.json, "failed to manage Anthropic routes", response.status);
+  const identityError = anthropicProviderIdentityError(response.json, provider, "Anthropic routes");
+  if (identityError !== undefined) return identityError;
   if (wantsJson) console.log(JSON.stringify(response.json, null, 2));
   else console.log(JSON.stringify(response.json.routes ?? [], null, 2));
   return 0;

package/src/cli/account-policy-dto.ts

@@ -51,7 +51,7 @@ const grant = z.object({ id: grantId, label: text, resetsTotal: z.number().int()
   percentUsed: z.object({ five_hour: threshold.optional(), seven_day: threshold.optional(),
     seven_day_overage_included: threshold.optional() }),
 }).refine(value => value.resetsLeft <= value.resetsTotal);
-export const grantsSchema = z.object({ accountId: text.min(1), eligible: z.boolean(),
+export const grantsSchema = z.object({ provider: z.enum(["anthropic", "anthropic2"]).optional(), accountId: text.min(1), eligible: z.boolean(),
   ineligibleReason: z.enum(["config_off", "tier", "seat", "mobile", "surface", "cli_version", "no_grant", "tenure", "other_experiment", "unavailable", "unknown"]).nullable(),
   atLimit: z.boolean(), grants: z.array(grant).refine(values => new Set(values.map(value => value.id)).size === values.length), nextGrantId: grantId.nullable(), weeklyResetsAt: date, cooldownUntil: date,
   pendingOperation: z.object({ operationId: z.string().uuid(), grantId, createdAt: z.number().finite(),

package/src/cli/account-policy.ts

@@ -1,3 +1,4 @@
+import { isAnthropicInstanceId } from "../providers/anthropic-instance-id";
 import { MAIN_CODEX_ACCOUNT_ID } from "../codex/account-id";
 import { isValidProviderName } from "../config/provider-name";
 import { resolveCodexAccountTargetFromRows } from "./account-target";
@@ -13,7 +14,7 @@ const USAGE = "Usage: ocx account pool <provider> [--enabled on|off] [--threshol
   + "       ocx account auto-switch openai <status|on|off|inherit|threshold N> --account ID [--json]\n"
   + "       ocx account credits openai <ID on|off|--all on|off> [--json]\n"
   + "       ocx account quota-activation openai ID --window <fiveHour|weekly> <on|off> [--json]\n"
-  + "       ocx account anthropic-reset-grants [ID] [--json]";
+  + "       ocx account anthropic-reset-grants [ID] [--provider anthropic|anthropic2] [--json]";
 const READ_ERRORS = { no_account: "No matching Anthropic OAuth account.", auth_failed: "Sign in to this Anthropic account again.",
   upstream_unavailable: "Anthropic did not return the reset-grant status.", ledger_unavailable: "The reset journal is unavailable.",
   ledger_busy: "The reset journal is busy. No grant was consumed." };
@@ -67,14 +68,14 @@ async function pool(args: string[], json: boolean, deps: RuntimeApiDeps): Promis
     patch.strategy = strategy;
   }
   if (window !== undefined) {
-    if (provider !== "anthropic" || !["five-hour", "weekly", "max-utilization"].includes(window)) usage();
+    if (!isAnthropicInstanceId(provider) || !["five-hour", "weekly", "max-utilization"].includes(window)) usage();
     patch.quotaWindow = window;
   }
   done(args);
   const pinned = { ...deps, baseUrl: await runtimeBaseUrl(deps) };
   const before = parseDto(poolSchema, await request(`/api/pool/settings?provider=${encodeURIComponent(provider)}`, pinned));
   requireEqual(before.provider, provider);
-  requireEqual(before.kind, provider === "openai" ? "codex" : provider === "anthropic" ? "anthropic" : "generic");
+  requireEqual(before.kind, provider === "openai" ? "codex" : isAnthropicInstanceId(provider) ? "anthropic" : "generic");
   if (Object.keys(patch).some(key => !(before.supported as string[]).includes(key))
     || (before.kind === "codex" && enabled !== undefined)) throw new CliUsageError("The selected pool does not support a requested field.");
   if (!Object.keys(patch).length) return output(before, json);
@@ -157,10 +158,18 @@ export async function handleAccountPolicyCommand(sub: Subcommand, args: string[]
     if (rest.includes("--json")) usage();
     if (sub === "pool") return pool(rest, json, deps);
     if (sub !== "anthropic-reset-grants") return codex(sub, rest, json, deps);
+    const selectedProvider = option(rest, "--provider");
+    const provider = selectedProvider ?? "anthropic";
+    if (!isAnthropicInstanceId(provider)) usage();
     const id = rest.length ? selector(rest.shift()) : undefined;
     done(rest);
     const pinned = { ...deps, baseUrl: await runtimeBaseUrl(deps) };
-    const result = parseDto(grantsSchema, await request(`/api/anthropic/reset-grants${id ? `?accountId=${encodeURIComponent(id)}` : ""}`, pinned));
+    // Omission preserves legacy A request syntax; explicit calls verify the echoed instance.
+    const query = new URLSearchParams();
+    if (id) query.set("accountId", id);
+    if (selectedProvider !== undefined) query.set("provider", provider);
+    const result = parseDto(grantsSchema, await request(`/api/anthropic/reset-grants${query.size ? `?${query}` : ""}`, pinned));
+    if (selectedProvider !== undefined || result.provider !== undefined) requireEqual(result.provider, provider);
     if (id) requireEqual(result.accountId, id);
     return output(result, json, "Reset-grant status read; no grant was consumed.");
   }, READ_ERRORS);

package/src/cli/account.ts

@@ -52,7 +52,7 @@ const ACCOUNT_USAGE = `Usage:
   ocx account clear <provider> [--json]
   ocx account refresh <provider> [--json]
   ocx account auto-switch <provider> <on|off|status|threshold <0-100>> [--json]
-  ocx account auto-switch anthropic <on|off|status|inherit|threshold <0-100>> --account <id> [--json]
+  ocx account auto-switch <anthropic|anthropic2> <on|off|status|inherit|threshold <0-100>> --account <id> [--json]
   ocx account alias <provider> <account-or-key-id|alias> <display-name|-> [--json]
   ocx account priority <provider> <account-id|alias|main> [<-100..100|first|earlier|normal|later|last|reset>] [--json]
   ocx account pause <provider> <account-id|alias|main> [--json]
@@ -60,7 +60,7 @@ const ACCOUNT_USAGE = `Usage:
   ocx account pause-exhausted <provider> [--json]
   ocx account strategy <provider> [<quota|round-robin|fill-first|least-loaded|reset-first>] [--json]
   ocx account sticky <provider> [<1-100>] [--json]
-  ocx account routes anthropic [--file <json-file>|--clear] [--json]
+  ocx account routes <anthropic|anthropic2> [--file <json-file>|--clear] [--json]
   ocx account remove <provider> <account-or-key-id|alias|main> --yes [--json]
   ocx account clear-cooldown <provider> <account-id|alias|main> [--json]
   ocx account add-key <provider> [--label <label>] [--json]
@@ -70,7 +70,7 @@ const ACCOUNT_USAGE = `Usage:
   ocx account pool <provider> [--enabled on|off] [--threshold N] [--strategy NAME] [--sticky N] [--quota-window W] [--json]
   ocx account credits openai <ID on|off|--all on|off> [--json]
   ocx account quota-activation openai ID --window fiveHour|weekly <on|off> [--json]
-  ocx account anthropic-reset-grants [ID] [--json]
+  ocx account anthropic-reset-grants [ID] [--provider anthropic|anthropic2] [--json]
   ocx account code <provider> [--flow <flow-id>] [--json]   (reads the code from stdin)
   ocx account cancel <provider> [--flow <flow-id>] [--json] (--flow required for codex)
   ocx account reset-credits <account-id|main> [--consume --yes] [--json]

package/src/cli/agent.ts

@@ -30,7 +30,7 @@ const USAGE = `Usage:
   ocx agent subagents <status|set|clear> [model,model...] [--json]
   ocx agent subagents force <model|-> [--json]
   ocx agent fallback <status|set|clear> [model,model...] [--poll-ms <5000-600000>] [--json]
-  ocx agent roles [status|set <role> <model>|suggest [--model <id>] [--apply]] [--json]
+  ocx agent roles [status|set <role> <model> [--effort <level>]|suggest [--model <id>] [--apply]] [--json]
   ocx agent sidecar <status|web|vision> [--list] [--model <id|->]
       [--backend web:<openai|anthropic|xai|gemini|exa|-> vision:<openai|anthropic|routed|->]
       [--reasoning <level>] [--max-descriptions <n> (vision)] [--enabled <on|off>]
@@ -311,7 +311,7 @@ async function sidecar(argv: string[], deps: RuntimeApiDeps): Promise<void> {
 interface CodexAgentRolesStatus {
   lazycodex?: { detected?: boolean };
   omoJsonc?: { state?: string } | null;
-  roles?: Array<{ role: string; model: string | null; omoJsoncModel: string | null }>;
+  roles?: Array<{ role: string; model: string | null; effort?: string | null; omoJsoncModel: string | null }>;
 }
 
 interface CodexRoleProposal {
@@ -393,7 +393,7 @@ async function roles(argv: string[], deps: RuntimeApiDeps): Promise<void> {
     const rows = result.roles ?? [];
     printData(result, wantsJson, [
       "omo (Codex / LazyCodex): detected",
-      ...(rows.length === 0 ? ["No Codex agent roles found."] : rows.map(row => `${row.role}: ${row.model ?? "(no model pin)"}`)),
+      ...(rows.length === 0 ? ["No Codex agent roles found."] : rows.map(row => `${row.role}: ${row.model ?? "(no model pin)"}${row.effort ? ` (${row.effort})` : ""}`)),
       `omo.jsonc: ${result.omoJsonc?.state ?? "unknown"}`,
     ]);
     return;
@@ -403,18 +403,22 @@ async function roles(argv: string[], deps: RuntimeApiDeps): Promise<void> {
     return;
   }
   if (action !== "set") throw new CliUsageError(`unknown roles action ${action}`, USAGE);
+  const effort = takeOption(args, "--effort");
+  // An empty value is a supplied flag, not an absent one: dropping it would change the model and
+  // silently ignore the effort the operator asked for.
+  if (effort !== undefined && effort.trim() === "") throw new CliUsageError("--effort needs a reasoning level", USAGE);
   const role = args.shift();
   const model = args.shift();
   if (!role || !model) throw new CliUsageError("a role and a model are required", USAGE);
   rejectArgs(args, USAGE);
   const result = await runtimeRequest<{ toml?: { status?: string }; omoJsonc?: { status?: string } }>(
     `/api/codex-agent-roles/${encodeURIComponent(role)}`,
-    { method: "PUT", body: JSON.stringify({ model }) },
+    { method: "PUT", body: JSON.stringify(effort !== undefined ? { model, effort } : { model }) },
     deps,
   );
   const omo = result.omoJsonc?.status;
   printData(result, wantsJson, [
-    `${role}: ${model} (role TOML ${result.toml?.status ?? "unknown"})`,
+    `${role}: ${model}${effort ? ` (${effort})` : ""} (role TOML ${result.toml?.status ?? "unknown"})`,
     omo === "skipped_comments"
       ? "omo.jsonc: not written, because it contains comments that a rewrite would lose."
       : `omo.jsonc: ${omo ?? "unknown"}`,

package/src/cli/aside-profile-recovery.ts

@@ -0,0 +1,33 @@
+/**
+ * Recovery guidance for Aside profiles whose sync preference is off while their managed block is stale (#6757).
+ *
+ * Sync refreshes only profiles whose preference is on, and an OFF preference is the operator's decision, so an
+ * "off (stale)" profile needs an explicit, reviewed enable. This module renders text only: it issues no request,
+ * reads no state and never changes a preference. Sync cannot name real profile IDs without a status read that may
+ * run integration maintenance, so its empty result points at status, which already holds the rows.
+ */
+export const ASIDE_SYNC_EMPTY_LINES: readonly string[] = [
+  "No eligible Aside profiles to synchronize. Sync refreshes only profiles whose sync preference is on.",
+  "List profiles with: ocx integration client status --client aside",
+  "For a profile shown as off (stale), review: ocx integration client preview --client aside --operation apply --profile <N>",
+  "Then, if the preview permits the change and you accept it: ocx integration client enable --client aside --profile <N>",
+];
+
+function recoveryProfileId(row: unknown): number | null {
+  if (!row || typeof row !== "object") return null;
+  const { profileId, enabled, state } = row as Record<string, unknown>;
+  // Only an explicit OFF beside a stale block qualifies. Conflict and unsafe blocks need inspection, not an enable.
+  if (enabled !== false || state !== "stale") return null;
+  return typeof profileId === "number" && Number.isSafeInteger(profileId) && profileId >= 0 && !Object.is(profileId, -0)
+    ? profileId : null;
+}
+
+/** Per-profile preview-then-enable commands for status rows that are off with a stale managed block. */
+export function asideProfileRecoveryLines(rows: readonly unknown[]): string[] {
+  const ids = [...new Set(rows.map(recoveryProfileId).filter((id): id is number => id !== null))];
+  return ids.flatMap(id => [
+    `Aside profile ${id} is off (stale). To reconnect it, review: ocx integration client preview --client aside --operation apply --profile ${id}`,
+    `Then, if the preview permits the change and you accept it: ocx integration client enable --client aside --profile ${id}`,
+  ]);
+}
+

package/src/cli/capabilities-accounts.ts

@@ -184,10 +184,10 @@ export const ACCOUNT_CAPABILITIES: readonly Capability[] = [
   },
   {
     command: ["account","anthropic-reset-grants"],
-    usage: "ocx account anthropic-reset-grants [account-id] [--json]",
+    usage: "ocx account anthropic-reset-grants [account-id] [--provider anthropic|anthropic2] [--json]",
     summary: "Read Anthropic reset-grant eligibility and pending status without consuming a grant.",
     routes: [{"method":"GET","path":"/api/anthropic/reset-grants"}],
-    flags: [{"name":"--json","value":"boolean","summary":"Emit the validated task result as one JSON document."}],
+    flags: [{ name: "--provider", value: "string", summary: "Anthropic OAuth instance: anthropic or anthropic2; omission keeps the legacy Anthropic pool." }, {"name":"--json","value":"boolean","summary":"Emit the validated task result as one JSON document."}],
     mutates: false,
     json: "envelope",
     details: ["Optional identity is the exact Anthropic account ID. Omission delegates active/fallback account choice to the server, not the Codex alias resolver.","This GET can refresh access/status information upstream. Empty grants, unavailable status, pending operation and unavailable journal remain distinct. Consume remains a GUI-session-only human handoff; no session acquisition or retry is performed."],

package/src/cli/capabilities-agents-routing.ts

@@ -1,6 +1,30 @@
 import type { Capability } from "./capability-types";
 
 export const AGENT_ROUTING_CAPABILITIES: readonly Capability[] = [
+  {
+    command: ["message", "sessions"],
+    summary: "Discover already-loaded local Codex sessions without reading conversation history.",
+    routes: [], flags: [{ name: "--json", value: "boolean", summary: "Emit a versioned local session directory." }],
+    mutates: false, json: "envelope",
+    bannerLines: ["ocx message <sub>           Loaded local Codex sessions and queued peer messages (sessions|send)"],
+    details: ["Linux/macOS Unix socket only. Uses effective CODEX_HOME; starts no daemon and returns no partial directory."],
+  },
+  {
+    command: ["message", "send"],
+    summary: "Submit one correlated peer message to an exact loaded local Codex destination.",
+    routes: [], mutates: true, json: "envelope",
+    flags: [
+      { name: "--thread", value: "string", summary: "Exact loaded UUID; choose this or --name." },
+      { name: "--name", value: "string", summary: "Unique exact loaded name; choose this or --thread." },
+      { name: "--stdin", value: "boolean", required: true, summary: "Read at most 16 KiB of UTF-8 message text." },
+      { name: "--kind", value: "string", summary: "request (default), response or notification." },
+      { name: "--in-reply-to", value: "string", summary: "Request message UUID; required only for a response." },
+      { name: "--json", value: "boolean", summary: "Emit a receipt with not_sent, queued or unknown status." },
+    ],
+    details: ["Requires daemon support for experimental thread/queue/add. Sender context comes from CODEX_THREAD_ID, not an authentication claim.",
+      "queued means submitted, not processed. unknown must not be replayed; no automatic retry, daemon start or thread resume.",
+      "Exit 0: queued; 1: not sent; 3: unknown; 64: invalid usage. No remote/Claude transport or skill installation."],
+  },
   {
     command: ["agent", "status"],
     usage: "ocx agent status [--json]",