@bitkyc08/opencodex 2.80.0 → 2.82.0

package/src/oauth/index.ts

@@ -1,7 +1,7 @@
 import type { KiroOAuthMetadata, OAuthController, OAuthCredentials } from "./types";
 import { initializeProviderModelSelection } from "../providers/initial-model-selection";
 import type { OcxConfig, OcxProviderConfig, RefreshPolicy } from "../types";
-import { ConfigMutationLockError, loadConfig, mutatePersistedConfig, saveConfig } from "../config";
+import { getDefaultConfig, initializePersistedConfigIfMissing, loadConfig, mutatePersistedConfig, observeInitialConfigState, saveConfig } from "../config";
 import { resolveProviderApiKey } from "../providers/key-store";
 import { projectEmail } from "../lib/privacy";
 import { KiroTokenRefreshError, environmentKiroRoutingMetadata, loginKiro, refreshKiroToken, settleKiroLoginTransaction } from "./kiro";
@@ -9,15 +9,13 @@ import {
   OAuthMutationBusyError,
   OAuthRefreshIntentIOError,
   clearOAuthRefreshIntent,
-  clearOAuthRefreshIntentIfMatch,
   createOAuthRefreshIntentLock,
   credentialGeneration,
   getAccountCredential,
   getAccountCredentialWithStatus,
   getAccountSet,
   getCredential,
-  markAccountNeedsReauthIfGeneration,
-  markOAuthRefreshIntentCleanupPending,
+  markAccountNeedsReauthIfGeneration, accountNeedsReauthForStatus, markAccountRefreshAttentionIfGeneration,
   markOAuthRefreshIntentStaleOwner,
   mergeAccountCredential,
   normalizeAuthStoreBuffer,
@@ -29,14 +27,18 @@ import {
   writeOAuthRefreshIntent,
   type OAuthCredentialWriteReceipt,
   type OAuthRefreshIntent,
-  type OAuthRefreshIntentCleanupPending,
   type AuthStore,
 } from "./store";
 import { loginXai, refreshXaiToken, XAI_LOCAL_CLI_DETACH_WARNING, XaiTokenRequestError } from "./xai";
-import { ANTHROPIC_OAUTH_BETA, AnthropicTokenError, loginAnthropic, refreshAnthropicToken } from "./anthropic";
+import { ANTHROPIC_OAUTH_BETA, AnthropicTokenError } from "./anthropic";
+import { isAnthropicOAuthInstance, anthropicInstanceRowShapeMatches } from "../providers/anthropic-instance";
+import { captureModelsOAuthTarget, guardModelsOAuthRequest, mayResolveModelsOAuth } from "./model-discovery-auth";
+import { anthropicOAuthDefinition, assertAnthropicInstanceLoginConfig, AnthropicInstanceCollisionError,
+  clearAnthropicRefreshIntentBestEffort, clearAnthropicRefreshIntentForKnownFailure,
+  resumeAnthropicRefreshIntentCleanup, clearObservedAnthropicRefreshIntent } from "./anthropic-oauth-definitions";
 import { loginKimi, refreshKimiToken } from "./kimi";
 import { loginNous, NousTokenError, refreshNousToken, clearNousRefreshIntent, RefreshIntentIOError } from "./nous";
-import { loginChatGPT, refreshChatGPTToken, type ChatGPTLoginFlow } from "./chatgpt";
+import { ChatGptTokenRequestError, ChatGptTokenError, loginChatGPT, refreshChatGPTToken, type ChatGPTLoginFlow } from "./chatgpt";
 import { loginAntigravity, refreshAntigravityToken } from "./google-antigravity";
 import { loginCursor, refreshCursorToken } from "./cursor";
 import { loginZed, refreshZedToken } from "./zed";
@@ -83,8 +85,9 @@ export { OAUTH_REFRESH_LOCK_WAIT_MS, peekAuthStore, peekOAuthRefreshIntent } fro
 import { codexAccountNamespaceProviderCollisionError } from "../codex/account-namespace-match";
 
 import { REFRESH_SKEW_MS } from "./refresh-policy";
-import { newerClaudeCredential, captureAnthropicCredentialOwner } from "./anthropic-continuity";
+import { newerClaudeCredentialForInstance, captureAnthropicCredentialOwnerForInstance } from "./anthropic-continuity";
 import { mergeAnthropicIdentity, type AnthropicIdentityResolver } from "./anthropic-identity";
+import { AnthropicCrossInstanceDuplicateError, AnthropicLocalCliImportError, assertAnthropicCredentialSource } from "./store-anthropic-instance";
 export interface OAuthAccessSnapshot {
   provider: string;
   accountId: string;
@@ -195,7 +198,7 @@ export interface LoginFlowLifecycle {
   onSettled?: () => void | Promise<void>;
 }
 
-interface OAuthProviderDef {
+export interface OAuthProviderDef {
   login(ctrl: OAuthController, opts?: LoginOpts, providerConfig?: OcxProviderConfig): Promise<OAuthCredentials>;
   refresh(
     refreshToken: string,
@@ -266,15 +269,8 @@ export const OAUTH_PROVIDERS: Record<string, OAuthProviderDef> = {
     providerConfig: oauthConfig("xai"),
     defaultModel: oauthDefaultModel("xai"),
   },
-  anthropic: {
-    login: (ctrl, opts) => loginAnthropic(ctrl, { importLocal: opts?.forceLogin ? "off" : "fallback" }),
-    refresh: refreshAnthropicToken,
-    providerConfig: oauthConfig("anthropic"),
-    defaultModel: oauthDefaultModel("anthropic"),
-    // Anthropic actively server-side-blocks subscription OAuth outside its own clients (Feb 2026).
-    // Never generate background refresh traffic for it — grade 20, highest ToS risk.
-    defaultRefreshPolicy: "disabled",
-  },
+  anthropic: anthropicOAuthDefinition("anthropic"),
+  anthropic2: anthropicOAuthDefinition("anthropic2"),
   kimi: {
     login: (ctrl) => loginKimi(ctrl),
     refresh: refreshKimiToken,
@@ -354,7 +350,7 @@ export const OAUTH_PROVIDERS: Record<string, OAuthProviderDef> = {
   },
   chatgpt: {
     login: (ctrl, opts) => loginChatGPT(ctrl, { forceLogin: opts?.forceLogin, flow: opts?.flow }),
-    refresh: (rt) => refreshChatGPTToken(rt),
+    refresh: (rt, signal) => refreshChatGPTToken(rt, { signal }),
     providerConfig: { adapter: "openai-responses", baseUrl: "https://chatgpt.com/backend-api/codex", authMode: "forward" as const },
     defaultModel: "gpt-5.6-luna",
   },
@@ -446,8 +442,10 @@ export class OAuthAccountPausedError extends Error {
 }
 
 export class OAuthProviderPublicationError extends Error {
-  constructor() {
-    super("OAuth credential was saved, but the provider entry was not written. Resolve the account namespace collision, then retry login.");
+  constructor(provider?: string, credentialWritten = true) {
+    super(provider !== "anthropic2" ? "OAuth credential was saved, but the provider entry was not written. Resolve the account namespace collision, then retry login."
+      : credentialWritten ? "Anthropic Pool 2 credential was saved as an orphan auth row, but the provider entry was not written. Repair the persisted config or resolve the provider/account namespace collision, then retry login."
+      : "Anthropic Pool 2 login did not start because the config file is missing or could not be written; no credential was saved. Repair the persisted config, then retry login.");
     this.name = "OAuthProviderPublicationError";
   }
 }
@@ -490,6 +488,9 @@ export function publicOAuthAuthenticationErrorMessage(error: unknown): string {
     || error instanceof OAuthReauthIdentityUnverifiedError
     || error instanceof OAuthTokenRefreshBusyError
     || error instanceof OAuthTokenRefreshStaleError
+    || error instanceof AnthropicInstanceCollisionError
+    || error instanceof AnthropicCrossInstanceDuplicateError
+    || error instanceof AnthropicLocalCliImportError
   ) return error.message;
   return "OAuth authentication failed. Check the OpenCodex account status and retry.";
 }
@@ -711,10 +712,14 @@ function isTerminalRefreshError(err: unknown): boolean {
     || msg.includes("expired_token");
 }
 function terminal(error:unknown):boolean{
+  if (error instanceof ChatGptTokenRequestError) return false;
   if(error instanceof XaiTokenRequestError)return ["invalid_grant","refresh_token_reused","revoked_token"].includes(error.oauthError??"");
   if(error instanceof AnthropicTokenError)return (error.httpStatus===400||error.httpStatus===401)&&["invalid_grant","refresh_token_reused","revoked","revoked_token","refresh_token_revoked"].includes(error.oauthError??"");
   if(error instanceof KiroTokenRefreshError)return (error.httpStatus===400||error.httpStatus===401)&&error.oauthError!==undefined;
   if(error instanceof NousTokenError)return error.terminal===true||["invalid_grant","refresh_token_reused","revoked","revoked_token","expired_token"].includes(error.oauthError??"");
+  // ChatGPT carries the pool classifier's verdict on the error itself: revoked and
+  // expired grants are terminal; unknown/transient failures stay retryable.
+  if(error instanceof ChatGptTokenError)return error.terminal;
   // Local durable-write/read/cleanup failures are operational, not credential
   // death: the provider credential was never rejected or consumed. Never mark
   // the account needsReauth for broken local persistence infrastructure.
@@ -739,131 +744,6 @@ function definitivelyAnswered(error: unknown): boolean {
   return false;
 }
 
-/**
- * Intent cleanup is secondary to the refresh outcome it protects.
- *
- * Once a credential is already durable, cleanup remains secondary and best-effort. A known
- * failed attempt takes the stricter path below: its retry-safe marker must become durable before
- * the original provider error can be returned.
- */
-function clearAnthropicRefreshIntentBestEffort(
-  provider: string,
-  accountId: string,
-  expected: OAuthRefreshIntent,
-): boolean {
-  try {
-    return expected.attemptId
-      ? clearOAuthRefreshIntentIfMatch(provider, accountId, expected)
-      : clearOAuthRefreshIntent(provider, accountId, expected.generation);
-  } catch {
-    console.warn(
-      "[opencodex] Anthropic refresh intent cleanup failed; preserving the durable replay guard.",
-    );
-    return false;
-  }
-}
-
-const ANTHROPIC_INTENT_MARK_RETRY_DELAYS_MS = [10, 25, 50] as const;
-
-function isConfigMutationLockContention(error: unknown): boolean {
-  if (!(error instanceof ConfigMutationLockError)) return false;
-  const cause = error.cause;
-  const code = cause && typeof cause === "object" && "code" in cause
-    ? String((cause as { code?: unknown }).code)
-    : "";
-  return code === "SQLITE_BUSY" || code === "SQLITE_LOCKED";
-}
-
-async function clearAnthropicRefreshIntentForKnownFailure(
-  provider: string,
-  accountId: string,
-  expected: OAuthRefreshIntent,
-  cleanupPending: OAuthRefreshIntentCleanupPending,
-  refreshError: unknown,
-): Promise<boolean> {
-  let marked: OAuthRefreshIntent | undefined;
-  for (let attempt = 0; attempt <= ANTHROPIC_INTENT_MARK_RETRY_DELAYS_MS.length; attempt += 1) {
-    try {
-      marked = markOAuthRefreshIntentCleanupPending(
-        provider,
-        accountId,
-        expected,
-        cleanupPending,
-      );
-      break;
-    } catch (cause) {
-      const retryDelay = ANTHROPIC_INTENT_MARK_RETRY_DELAYS_MS[attempt];
-      if (!isConfigMutationLockContention(cause) || retryDelay === undefined) {
-        throw new OAuthRefreshIntentIOError(
-          "mark-cleanup-pending",
-          cause,
-          refreshError,
-        );
-      }
-      // The provider has definitively answered, so caller cancellation no longer changes the
-      // settlement obligation. Yield briefly while retaining the per-account refresh lock, then
-      // rerun the existing compare-and-swap marker against current disk state.
-      await Bun.sleep(retryDelay);
-    }
-  }
-  if (!marked) {
-    throw new OAuthRefreshIntentIOError(
-      "mark-cleanup-pending",
-      new Error("Anthropic refresh intent changed before safe cleanup"),
-      refreshError,
-    );
-  }
-
-  let cleared: boolean;
-  try {
-    cleared = clearOAuthRefreshIntentIfMatch(provider, accountId, marked);
-  } catch {
-    console.warn(
-      "[opencodex] Anthropic refresh intent cleanup failed; retry-safe cleanup remains pending.",
-    );
-    return false;
-  }
-  if (!cleared) {
-    throw new OAuthRefreshIntentIOError(
-      "clear-cleanup-pending",
-      new Error("Anthropic refresh intent changed during safe cleanup"),
-      refreshError,
-    );
-  }
-  return true;
-}
-
-function resumeAnthropicRefreshIntentCleanup(
-  provider: string,
-  accountId: string,
-  pendingIntent: OAuthRefreshIntent,
-): void {
-  let cleared: boolean;
-  try {
-    cleared = clearOAuthRefreshIntentIfMatch(provider, accountId, pendingIntent);
-  } catch (cause) {
-    throw new OAuthRefreshIntentIOError(
-      "resume-cleanup",
-      cause,
-    );
-  }
-  if (!cleared) {
-    throw new OAuthRefreshIntentIOError(
-      "resume-cleanup",
-      new Error("Pending Anthropic refresh intent changed before cleanup"),
-    );
-  }
-}
-
-function clearObservedAnthropicRefreshIntent(
-  provider: string,
-  accountId: string,
-  pendingIntent: OAuthRefreshIntent,
-): boolean {
-  return pendingIntent.attemptId
-    ? clearOAuthRefreshIntentIfMatch(provider, accountId, pendingIntent)
-    : clearOAuthRefreshIntent(provider, accountId, pendingIntent.generation);
-}
 function authoritative(stored:OAuthCredentials,active:boolean,now:()=>number):OAuthCredentials{if(stored.source!=="local-cli")return stored;const disk=detectGrokCliToken();if(!disk)return stored;const allowed=isSameGrokIdentity(stored,disk)||(active&&!hasComparableGrokIdentity(stored,disk));return allowed&&shouldAdoptGrokGeneration(stored,disk,now(),REFRESH_SKEW_MS)?disk:stored;}
 function merged(fresh: OAuthCredentials, previous: OAuthCredentials): OAuthCredentials {
   return {
@@ -932,6 +812,7 @@ export async function refreshAnthropicAccountWithLock(
   callerCredential: OAuthCredentials,
   deps: AnthropicRefreshDeps = {},
 ): Promise<string> {
+  if (!isAnthropicOAuthInstance(provider)) throw new UnsupportedOAuthProviderError(provider);
   const writerGeneration = captureConfigGeneration();
   const now = deps.now ?? Date.now;
   const guard = await (deps.intentLock ?? createOAuthRefreshIntentLock(provider, accountId)).acquire();
@@ -941,10 +822,10 @@ export async function refreshAnthropicAccountWithLock(
     if (!accountSet || !account) throw new OAuthLoginRequiredError(provider);
     if (account.paused) throw new OAuthAccountPausedError();
     const stored = account.credential;
-    const owns = captureAnthropicCredentialOwner(accountSet, accountId);
+    const owns = captureAnthropicCredentialOwnerForInstance(provider, accountSet, accountId);
     const generation = credentialGeneration(stored);
     let pendingIntent = readOAuthRefreshIntent(provider, accountId);
-    const observed = await newerClaudeCredential(stored, now(), deps.signal, deps.resolveIdentity);
+    const observed = await newerClaudeCredentialForInstance(provider, stored, now(), deps.signal, deps.resolveIdentity);
     const assertOwner = (store: AuthStore, checkDisk = true) => {
       if (observed.kind !== "absent" && deps.signal?.aborted) throw new OAuthTokenRefreshStaleError();
       if (!owns(store, checkDisk && observed.kind !== "absent" ? observed.diskGeneration : undefined)) {
@@ -1116,6 +997,10 @@ export async function refreshGenericAccountWithLock(
       return fresh.access;
     } catch (error) {
       if (error instanceof OAuthMutationBusyError) throw error;
+      if (provider === "kiro" && error instanceof KiroTokenRefreshError && error.refreshAttention) {
+        await markAccountRefreshAttentionIfGeneration(provider, accountId, generation, writerGeneration);
+        throw error;
+      }
       if (!terminal(error)) throw error;
       // Nous-specific failure-atomicity: a terminal refresh error that carries
       // an already-issued rotated refresh token (e.g. the access JWT lacked the
@@ -1177,20 +1062,22 @@ async function refreshAndPersistAccessToken(
   replacedStaleFlight?: OAuthRefreshFlightEvidence,
 ): Promise<string> {
   if (provider === "xai") return refreshXaiAccountWithLock(provider, accountId, def, cred, { signal });
-  if (provider === "anthropic") return refreshAnthropicAccountWithLock(provider, accountId, def, cred, { signal, flight, replacedStaleFlight });
+  if (isAnthropicOAuthInstance(provider)) return refreshAnthropicAccountWithLock(provider, accountId, def, cred, { signal, flight, replacedStaleFlight });
   return refreshGenericAccountWithLock(provider, accountId, def, cred, { signal });
 }
 
-/**
- * Shared bearer-token resolver for /models listing — used by BOTH server.ts:fetchAllModels and
- * codex-catalog.ts:fetchProviderModels so OAuth providers' models are listed once logged in.
- * Returns undefined for forward-mode or oauth-not-logged-in (caller skips).
- */
+/** Resolve discovery credentials only for the caller-owned configured OAuth row. */
+export async function getModelsOAuthAccessSnapshot(name: string, prov: OcxProviderConfig | undefined): Promise<OAuthAccessSnapshot> {
+  if (!mayResolveModelsOAuth(name, prov)) throw new OAuthLoginRequiredError(name);
+  return getValidAccessTokenSnapshot(name);
+}
+
+/** Shared /models auth resolver; custom key rows keep their own key, including omitted authMode. */
 export async function resolveModelsAuthToken(name: string, prov: OcxProviderConfig): Promise<string | undefined> {
   if (prov.authMode === "forward") return undefined;
   if (prov.authMode === "oauth") {
     try {
-      return await getValidAccessToken(name);
+      return (await getModelsOAuthAccessSnapshot(name, prov)).accessToken;
     } catch {
       return undefined;
     }
@@ -1235,6 +1122,8 @@ export function buildModelsRequest(
   providerName = "",
   observedAuth?: ModelsRequestObservedAuth,
 ): { method?: "POST"; url: string; headers: Record<string, string> } {
+  const authorizedTarget = captureModelsOAuthTarget(providerName, prov);
+  if (prov.authMode === "oauth" && !mayResolveModelsOAuth(providerName, prov)) apiKey = undefined;
   const transportSeed = modelDiscoveryTransportSeed(providerName, prov);
   const copilotApiBaseUrl = observedAuth === undefined
     ? (providerName === "github-copilot" ? getOAuthCredentialApiBaseUrl(providerName) : undefined)
@@ -1261,16 +1150,18 @@ export function buildModelsRequest(
     effectiveProvider.baseUrl,
     defaultUrl,
   );
+  const guarded = <T extends { url: string; headers: Record<string, string> }>(request: T): T =>
+    guardModelsOAuthRequest(providerName, prov, request, authorizedTarget);
   if (effectiveGoogleMode(providerName, effectiveProvider) === "cloud-code-assist") {
     headers.Accept = "application/json";
     headers["Content-Type"] = "application/json";
     headers["User-Agent"] = ANTIGRAVITY_REQUEST_UA;
     if (apiKey) headers.Authorization = `Bearer ${apiKey}`;
-    return {
-      method: "POST",
+    return guarded({
+      method: "POST" as const,
       url: discoveryUrl(`${effectiveProvider.baseUrl.replace(/\/+$/, "")}/v1internal:fetchAvailableModels`),
       headers,
-    };
+    });
   }
   if (effectiveGoogleMode(providerName, effectiveProvider) === "ai-studio") {
     // Generative Language API: API key goes in x-goog-api-key (never Authorization: Bearer),
@@ -1278,7 +1169,7 @@ export function buildModelsRequest(
     // enough to list everything without a pageToken loop. Vertex/antigravity keep the
     // generic branch (they fall back to their static model lists).
     if (apiKey) headers["x-goog-api-key"] = apiKey;
-    return { url: discoveryUrl(`${effectiveProvider.baseUrl}/v1beta/models?pageSize=1000`), headers };
+    return guarded({ url: discoveryUrl(`${effectiveProvider.baseUrl}/v1beta/models?pageSize=1000`), headers });
   }
   if (effectiveProvider.adapter === "anthropic") {
     const base = effectiveProvider.baseUrl.replace(/\/v1\/?$/, "");
@@ -1290,10 +1181,10 @@ export function buildModelsRequest(
       if (effectiveProvider.apiKeyTransport === "bearer") headers["Authorization"] = `Bearer ${apiKey}`;
       else headers["x-api-key"] = apiKey;
     }
-    return { url: discoveryUrl(`${base}/v1/models?limit=1000`), headers };
+    return guarded({ url: discoveryUrl(`${base}/v1/models?limit=1000`), headers });
   }
   if (apiKey) headers["Authorization"] = `Bearer ${apiKey}`;
-  return { url: discoveryUrl(providerModelsUrl(effectiveProvider.baseUrl)), headers };
+  return guarded({ url: discoveryUrl(providerModelsUrl(effectiveProvider.baseUrl)), headers });
 }
 
 /**
@@ -1452,6 +1343,7 @@ function projectOAuthProviderReconciliation(config: OcxConfig): OAuthReconcilePr
   const touchedAntigravityVersion = projected.googleAntigravityStaticCatalogVersion !== beforeAntigravityVersion;
 
   for (const [name, prov] of Object.entries(projected.providers)) {
+    if (name === "anthropic2" && !anthropicInstanceRowShapeMatches(name, prov)) continue;
     const beforeProvider = JSON.stringify(prov);
     const def = OAUTH_PROVIDERS[name];
     if (name === "command-code" && isLegacyCommandCodeStaticCatalog(prov)) {
@@ -1588,6 +1480,7 @@ const OAUTH_LOGIN_OWNED_PROVIDER_FIELDS = [
 
 /** Add/refresh only an OAuth provider's login-owned config fields (does not persist). */
 export function upsertOAuthProvider(config: OcxConfig, provider: string): void {
+  assertAnthropicInstanceLoginConfig(config, provider);
   if (provider === "chatgpt") return;
   const def = OAUTH_PROVIDERS[provider];
   if (!def) return;
@@ -1656,6 +1549,7 @@ interface RunLoginDeps {
   saveAccountCredential?: typeof saveAccountCredential;
   loadConfig?: typeof loadConfig;
   saveConfig?: typeof saveConfig;
+  mutatePersistedConfig?: typeof mutatePersistedConfig;
   settleKiroLoginTransaction?: typeof settleKiroLoginTransaction;
   rollbackCredentialWrite?: typeof rollbackCredentialWriteIfMatch;
   assertCurrentOwner?: () => void;
@@ -1672,14 +1566,28 @@ export async function runLogin(
   if (!def) throw new UnsupportedOAuthProviderError(provider);
   const loadLatestConfig = deps.loadConfig ?? loadConfig;
   const saveLatestConfig = deps.saveConfig ?? saveConfig;
-  const preflightConfig = provider !== "chatgpt" ? loadLatestConfig() : undefined;
+  const initialBConfigState = provider === "anthropic2" ? observeInitialConfigState() : undefined;
+  let preflightConfig = provider !== "chatgpt" ? loadLatestConfig() : undefined;
+  if (provider === "anthropic2" && preflightConfig && initialBConfigState === "missing") {
+    // Explicit first-login onboarding may create the ordinary defaults, without a B row.
+    // The create-only owner never replaces a concurrent file. Reload its winner before login;
+    // once the browser starts, later deletion remains a publication refusal, not recreation.
+    if (initializePersistedConfigIfMissing(getDefaultConfig()) === "invalid") {
+      throw new OAuthProviderPublicationError(provider, false);
+    }
+    preflightConfig = loadLatestConfig();
+  }
   if (preflightConfig) {
+    assertAnthropicInstanceLoginConfig(preflightConfig, provider);
     const namespaceCollision = codexAccountNamespaceProviderCollisionError(
       preflightConfig.codexAccountNamespaces,
       provider,
     );
     if (namespaceCollision) throw new Error(namespaceCollision);
   }
+  if (provider === "anthropic2" && observeInitialConfigState() !== "exists") {
+    throw new OAuthProviderPublicationError(provider, false);
+  }
   // loginKiro keys its pending CLI-session transaction by object identity. Keep this exact object
   // for settlement even when source normalization below creates a derived credential object.
   const shouldRollbackKiroAccounts = provider === "kiro" && opts?.forceLogin === true;
@@ -1693,6 +1601,7 @@ export async function runLogin(
   }
   const rawCred = await def.login(ctrl, opts, loginProviderConfig);
   const cred: OAuthCredentials = rawCred.source ? rawCred : { ...rawCred, source: "oauth" };
+  if (isAnthropicOAuthInstance(provider)) assertAnthropicCredentialSource(provider, cred);
   const settleKiroTransaction = deps.settleKiroLoginTransaction ?? settleKiroLoginTransaction;
   try {
     deps.assertCurrentOwner?.();
@@ -1738,16 +1647,28 @@ export async function runLogin(
     if (provider !== "chatgpt") {
       // Re-run against post-credential state so same-provider API-key additions, removals,
       // and active-key switches survive. A late namespace claim wins over provider creation.
-      const latestConfig = loadLatestConfig();
-      const lateCollision = codexAccountNamespaceProviderCollisionError(
-        latestConfig.codexAccountNamespaces,
-        provider,
-      );
-      if (lateCollision) {
-        throw new OAuthProviderPublicationError();
+      if (provider === "anthropic2") {
+        const publication = (deps.mutatePersistedConfig ?? mutatePersistedConfig)(latestConfig => {
+          assertAnthropicInstanceLoginConfig(latestConfig, provider, true);
+          if (codexAccountNamespaceProviderCollisionError(latestConfig.codexAccountNamespaces, provider)) {
+            throw new OAuthProviderPublicationError(provider);
+          }
+          upsertOAuthProvider(latestConfig, provider);
+          return { changed: true, value: undefined };
+        });
+        if (publication.status === "unavailable") throw new OAuthProviderPublicationError(provider);
+      } else {
+        const latestConfig = loadLatestConfig();
+        const lateCollision = codexAccountNamespaceProviderCollisionError(
+          latestConfig.codexAccountNamespaces,
+          provider,
+        );
+        if (lateCollision) {
+          throw new OAuthProviderPublicationError();
+        }
+        upsertOAuthProvider(latestConfig, provider);
+        saveLatestConfig(latestConfig);
       }
-      upsertOAuthProvider(latestConfig, provider);
-      saveLatestConfig(latestConfig);
     }
   } catch (error) {
     const errors: unknown[] = [error];
@@ -1840,7 +1761,7 @@ export function getLoginStatus(provider: string, maskEmails = true): { loggedIn:
     ...(a.alias ? { alias: a.alias } : {}),
     email: projectEmail(a.credential.email, maskEmails) ?? undefined,
     active: a.id === set.activeAccountId,
-    ...(a.needsReauth ? { needsReauth: true } : {}),
+    ...(accountNeedsReauthForStatus(provider, a) ? { needsReauth: true } : {}),
     ...(a.needsReauth && a.needsReauthReason === "verify_account" ? { needsReauthReason: a.needsReauthReason } : {}),
     expiresAt: a.credential.expires,
     // Explicitly null rather than omitted — see OAuthAccountSummary.plan. No OAuth provider
@@ -1852,11 +1773,11 @@ export function getLoginStatus(provider: string, maskEmails = true): { loggedIn:
 
   // A stored credential counts as "logged in" when it exists and is not marked for
   // re-authentication. An expired access token with a valid refresh token is still
-  // logged in: request resolution refreshes expired/near-expiry credentials lazily.
+  // logged in unless refresh-attention evidence applies; refresh eligibility stays internal.
   // Invalid/unknown local-import expiries are handled at parse/adoption time
   // (local-token-detect.ts), never by over-reporting login state here.
-  const activeNeedsReauth = set?.accounts
-    .find(a => a.id === set.activeAccountId)?.needsReauth === true;
+  const activeAccount = set?.accounts.find(a => a.id === set.activeAccountId);
+  const activeNeedsReauth = activeAccount && accountNeedsReauthForStatus(provider, activeAccount);
   return {
     loggedIn: !!cred && !activeNeedsReauth,
     email: projectEmail(cred?.email, maskEmails) ?? undefined,

package/src/oauth/kiro.ts

@@ -60,6 +60,7 @@ export class KiroTokenRefreshError extends Error {
   constructor(
     readonly httpStatus: number,
     readonly oauthError?: string,
+    readonly refreshAttention = false,
   ) {
     super(`Kiro token refresh failed: ${httpStatus}${oauthError ? ` (${oauthError})` : ""}`);
     this.name = "KiroTokenRefreshError";
@@ -530,17 +531,21 @@ export function resolveKiroRequestProfile(
     : { profileArn: undefined, builderIdFallback: false };
 }
 
-async function kiroTokenRefreshError(response: Response): Promise<KiroTokenRefreshError> {
+async function kiroTokenRefreshError(response: Response, awsSsoRefresh = false): Promise<KiroTokenRefreshError> {
   let oauthError: string | undefined;
+  let refreshAttention = false;
   try {
     const payload = await response.json() as { error?: unknown };
+    // This input-error code is attention evidence only for our AWS SSO refresh request,
+    // never a terminal grant verdict. Do not surface arbitrary upstream descriptions.
+    refreshAttention = awsSsoRefresh && response.status === 400 && payload.error === "invalid_request";
     if (typeof payload.error === "string" && KIRO_TERMINAL_REFRESH_ERRORS.has(payload.error)) {
       oauthError = payload.error;
     }
   } catch {
     // Error bodies are untrusted and intentionally excluded from the surfaced message.
   }
-  return new KiroTokenRefreshError(response.status, oauthError);
+  return new KiroTokenRefreshError(response.status, oauthError, refreshAttention);
 }
 
 async function readTokenResponse(res: Response, oldRefresh: string): Promise<OAuthCredentials> {
@@ -608,7 +613,7 @@ async function refreshAwsSsoOidcToken(
     signal: kiroRefreshSignal(signal),
   });
   const res = await run(refresh);
-  if (!res.ok) throw await kiroTokenRefreshError(res);
+  if (!res.ok) throw await kiroTokenRefreshError(res, true);
   return readTokenResponse(res, refresh);
 }
 
@@ -668,11 +673,19 @@ export async function refreshKiroToken(
     const local = matchingRotatedKiroCliCredential(refresh, credential);
     if (!local) throw error;
     const retryMetadata = metadataForRotatedKiroCliCredential(credential, local);
-    const fresh = await refreshAwsSsoOidcToken(local.refresh, signal, {
-      ...credential,
-      refresh: local.refresh,
-      kiro: retryMetadata,
-    });
-    return { ...fresh, kiro: retryMetadata };
+    try {
+      const fresh = await refreshAwsSsoOidcToken(local.refresh, signal, {
+        ...credential,
+        refresh: local.refresh,
+        kiro: retryMetadata,
+      });
+      return { ...fresh, kiro: retryMetadata };
+    } catch (recoveryError) {
+      // A failed CLI fallback may use the desktop endpoint. Retain the original AWS SSO
+      // attention evidence on another input rejection; transient recovery stays retryable.
+      if (error.refreshAttention && recoveryError instanceof KiroTokenRefreshError
+        && recoveryError.httpStatus === 400 && recoveryError.oauthError === undefined) throw error;
+      throw recoveryError;
+    }
   }
 }

package/src/oauth/login-cli.ts

@@ -14,6 +14,7 @@ import { KEY_LOGIN_PROVIDERS, isKeyLoginProvider, validateApiKey, type KeyLoginP
 import type { OcxConfig, OcxProviderConfig } from "../types";
 import { configuredAdminToken } from "../lib/admin-secrets";
 import { codexAccountNamespaceProviderCollisionError } from "../codex/account-namespace-match";
+import { assertAnthropicInstanceLoginConfig } from "./store-anthropic-instance";
 
 /**
  * Seams a test drives in place of a browser, a terminal and a real provider. Production passes
@@ -136,6 +137,7 @@ export async function handleLogin(provider?: string, deps: LoginCliDeps = {}): P
 }
 
 export async function handleOAuthLogin(name: string, deps: LoginCliDeps = {}): Promise<void> {
+  if (name === "anthropic2") assertAnthropicInstanceLoginConfig(loadConfig(), name);
   const login = deps.runLogin ?? runLogin;
   const launch = deps.openUrl ?? openUrl;
   const browser = createBrowserLaunchReport(deps.warn);

package/src/oauth/model-discovery-auth.ts

@@ -0,0 +1,43 @@
+import type { OcxProviderConfig } from "../types";
+import { isBuiltinAnthropicInstanceRow } from "../providers/anthropic-instance";
+import { resolveProviderModelDiscoveryUrl } from "../providers/model-discovery";
+import { resolveProviderTransport } from "../providers/xai-transport";
+
+/** Discovery owns its configured row (a frozen capture for catalog gathers), not live config. */
+export function mayResolveModelsOAuth(name: string, provider: OcxProviderConfig | undefined): boolean {
+  return name !== "anthropic2" || (provider !== undefined && provider.disabled !== true
+    && isBuiltinAnthropicInstanceRow(name, provider));
+}
+
+/** Derive authority from configured transport/discovery policy, never from the outgoing request. */
+export function captureModelsOAuthTarget(name: string, provider: OcxProviderConfig | undefined): string | undefined {
+  if (name !== "anthropic2" || !mayResolveModelsOAuth(name, provider) || !provider) return undefined;
+  try {
+    const effective = resolveProviderTransport(name, provider);
+    const base = effective.baseUrl.replace(/\/v1\/?$/, "");
+    const target = new URL(resolveProviderModelDiscoveryUrl(name, provider, effective.baseUrl, `${base}/v1/models?limit=1000`));
+    return !target.username && !target.password && !target.hash ? target.href : undefined;
+  } catch { return undefined; }
+}
+
+export function modelsOAuthTargetMatches(name: string, provider: OcxProviderConfig | undefined, target: string | undefined): boolean {
+  return name !== "anthropic2" || (target !== undefined && captureModelsOAuthTarget(name, provider) === target);
+}
+
+/** A supplied snapshot cannot authorize sending Pool 2's bearer to a custom destination. */
+export function guardModelsOAuthRequest<T extends { url: string; headers: Record<string, string> }>(
+  name: string,
+  provider: OcxProviderConfig,
+  request: T,
+  authorizedTarget = captureModelsOAuthTarget(name, provider),
+): T {
+  if (name !== "anthropic2" || provider.authMode !== "oauth") return request;
+  try {
+    const destination = new URL(request.url);
+    if (mayResolveModelsOAuth(name, provider) && authorizedTarget !== undefined
+      && authorizedTarget === captureModelsOAuthTarget(name, provider) && destination.href === authorizedTarget
+      && !destination.username && !destination.password && !destination.hash) return request;
+  } catch { /* Malformed destinations carry no credential authority. */ }
+  return { ...request, headers: Object.fromEntries(Object.entries(request.headers)
+    .filter(([header]) => header.toLowerCase() !== "authorization")) };
+}