@bitkyc08/opencodex 2.80.0 → 2.82.0

package/src/oauth/pool-kernel.ts

@@ -1,3 +1,4 @@
+import { isAnthropicInstanceId, type AnthropicInstanceId } from "../providers/anthropic-instance-id";
 import type { OcxAccountPoolRotationStrategy } from "../types";
 import type { GenerationContext } from "../lib/state-store-sweeper";
 
@@ -277,7 +278,7 @@ export function clearPoolRotationState(poolKey?: string): void {
 
 export function reconcilePoolRotationState(context: GenerationContext): number {
   if (context.generation <= lastReconciledGeneration) return 0;
-  const anthropicIds = new Set<string>();
+  const anthropicIds = new Map<AnthropicInstanceId, Set<string>>();
   // Live account ids per generic OAuth provider, built from the same
   // `provider\0id` roster the Anthropic pass already walks. Without this the
   // `generic:*` entries fall through as unknown and are never swept, so a removed
@@ -288,8 +289,10 @@ export function reconcilePoolRotationState(context: GenerationContext): number {
     if (separator <= 0) continue;
     const provider = key.slice(0, separator);
     const accountId = key.slice(separator + 1);
-    if (provider === "anthropic") {
-      anthropicIds.add(accountId);
+    if (isAnthropicInstanceId(provider)) {
+      let ids = anthropicIds.get(provider);
+      if (!ids) { ids = new Set(); anthropicIds.set(provider, ids); }
+      ids.add(accountId);
       continue;
     }
     let bucket = genericIds.get(provider);
@@ -301,8 +304,8 @@ export function reconcilePoolRotationState(context: GenerationContext): number {
   }
   let removed = 0;
   for (const [poolKey, state] of selectionState) {
-    const valid = poolKey === POOL_KEY_ANTHROPIC
-      ? anthropicIds
+    const valid = isAnthropicInstanceId(poolKey)
+      ? anthropicIds.get(poolKey) ?? new Set<string>()
       : poolKey === POOL_KEY_CODEX || poolKey.startsWith(`${POOL_KEY_CODEX}:`)
         ? context.codexAccountIds
         : poolKey.startsWith("generic:")
@@ -328,3 +331,6 @@ export function reconcilePoolRotationState(context: GenerationContext): number {
   lastReconciledGeneration = context.generation;
   return removed;
 }
+
+/** Separate cursor and weights for each Anthropic OAuth instance. */
+export function anthropicPoolKey(instance: AnthropicInstanceId): string { return instance; }

package/src/oauth/pool-settings-capability.ts

@@ -1,3 +1,5 @@
+import { isBuiltinAnthropicInstanceRow, isAnthropicInstanceId } from "../providers/anthropic-instance";
+import { resolveAnthropicAccountPoolConfig } from "./anthropic-pool-config";
 import { isGenericFailoverProvider } from "./generic-account-failover";
 import { parseAccountPoolStickyLimit, parseAccountPoolStrategy, parseCodexAccountPoolStrategy } from "./pool-kernel";
 import type { OcxConfig, OcxProviderConfig } from "../types";
@@ -25,8 +27,8 @@ export type GenericPoolStrategy = typeof GENERIC_POOL_STRATEGIES[number];
 
 export function poolSettingsCapability(name: string, provider: OcxProviderConfig | undefined): PoolSettingsKind | null {
   if (name === "openai") return "codex";
-  if (name === "anthropic") return "anthropic";
-  if (!provider) return null;
+  if (name === "anthropic" || (provider?.disabled !== true && isBuiltinAnthropicInstanceRow(name, provider))) return "anthropic";
+  if (name === "anthropic2" || !provider) return null;
   return isGenericFailoverProvider(name, provider) ? "generic" : null;
 }
 
@@ -173,7 +175,7 @@ export function unifiedPoolSettingsDto(
     };
   }
   if (kind === "anthropic") {
-    const pool = config.anthropicAccountPool ?? {};
+    const pool = isAnthropicInstanceId(provider) ? resolveAnthropicAccountPoolConfig(config, provider) : {};
     const enabled = typeof pool.enabled === "boolean" ? pool.enabled : null;
     return {
       ...base,

package/src/oauth/store-anthropic-instance.ts

@@ -0,0 +1,87 @@
+import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { getConfigPath } from "../config/paths";
+import { anthropicInstanceRowShapeMatches, type AnthropicInstanceId, type AnthropicInstanceRow } from "../providers/anthropic-instance-id";
+import type { OcxConfig } from "../types";
+import { normalizeAnthropicIdentity } from "./anthropic-identity";
+import type { AuthStore } from "./store";
+import type { OAuthCredentials } from "./types";
+
+export class AnthropicCrossInstanceDuplicateError extends Error {
+  readonly code = "ANTHROPIC_CROSS_INSTANCE_DUPLICATE";
+  constructor() {
+    super("This Anthropic credential is already registered in the other pool; use a different account or remove the existing registration first.");
+    this.name = "AnthropicCrossInstanceDuplicateError";
+  }
+}
+
+export class AnthropicLocalCliImportError extends Error {
+  readonly code = "ANTHROPIC_LOCAL_CLI_IMPORT_FORBIDDEN";
+  constructor() {
+    super("Anthropic Pool 2 supports browser OAuth only; local Claude Code credentials cannot be imported or adopted.");
+    this.name = "AnthropicLocalCliImportError";
+  }
+}
+
+export class AnthropicInstanceCollisionError extends Error {
+  readonly code = "ANTHROPIC_INSTANCE_COLLISION";
+  constructor(credentialWritten = false) {
+    super("anthropic2 is already configured as a custom provider; rename the custom provider before logging in to Pool 2."
+      + (credentialWritten ? " The saved Pool 2 credential remains an orphan auth row; remove it or rename the custom provider before retrying." : ""));
+    this.name = "AnthropicInstanceCollisionError";
+  }
+}
+
+export function assertAnthropicInstanceLoginConfig(config: Pick<OcxConfig, "providers">, provider: string, credentialWritten = false): void {
+  if (provider !== "anthropic2") return;
+  const row = config.providers.anthropic2;
+  if (Object.hasOwn(config.providers, provider) && !anthropicInstanceRowShapeMatches(provider, row)) {
+    throw new AnthropicInstanceCollisionError(credentialWritten);
+  }
+  // A malformed custom row (for example, missing baseUrl) can disappear behind loadConfig's
+  // fallback. Raw presence still owns this namespace; onboarding must not overwrite its bytes.
+  let raw: string;
+  try { raw = readFileSync(getConfigPath(), "utf8"); }
+  catch (error) {
+    if (error && typeof error === "object" && "code" in error && error.code === "ENOENT") return;
+    throw new Error("Cannot verify Anthropic Pool 2 ownership in the existing config file.");
+  }
+  let parsed: unknown;
+  try { parsed = JSON.parse(raw.replace(/^\uFEFF/, "")); }
+  catch { throw new Error("Cannot verify Anthropic Pool 2 ownership in the existing config file."); }
+  const providers = parsed && typeof parsed === "object" && "providers" in parsed ? parsed.providers : undefined;
+  if (providers && typeof providers === "object" && Object.hasOwn(providers, provider)) {
+    const persisted = (providers as Record<string, unknown>)[provider];
+    if (!persisted || typeof persisted !== "object" || Array.isArray(persisted)
+      || !anthropicInstanceRowShapeMatches(provider, persisted as AnthropicInstanceRow)) {
+      throw new AnthropicInstanceCollisionError(credentialWritten);
+    }
+  }
+}
+
+export function assertAnthropicCredentialSource(instance: AnthropicInstanceId, credential: OAuthCredentials): void {
+  if (instance === "anthropic2" && credential.source === "local-cli") throw new AnthropicLocalCliImportError();
+}
+
+function tokenFingerprint(token: string): string | undefined {
+  return token.length > 0 ? createHash("sha256").update(token).digest("hex") : undefined;
+}
+
+/** Registration only, called under the auth-store writer lock before any row changes. */
+export function assertNoCrossAnthropicRegistration(store: AuthStore, instance: AnthropicInstanceId, credential: OAuthCredentials): void {
+  assertAnthropicCredentialSource(instance, credential);
+  const other = instance === "anthropic" ? "anthropic2" : "anthropic";
+  const tokens = new Set([tokenFingerprint(credential.access), tokenFingerprint(credential.refresh)]
+    .filter((fingerprint): fingerprint is string => fingerprint !== undefined));
+  const identity = normalizeAnthropicIdentity(credential.anthropicIdentity, credential.access);
+  // Paused, needs-reauth and orphan rows retain ownership; labels are never proof.
+  for (const row of store[other]?.accounts ?? []) {
+    const access = tokenFingerprint(row.credential.access);
+    const refresh = tokenFingerprint(row.credential.refresh);
+    const existingIdentity = normalizeAnthropicIdentity(row.credential.anthropicIdentity, row.credential.access);
+    if ((access !== undefined && tokens.has(access)) || (refresh !== undefined && tokens.has(refresh))
+      || (identity && existingIdentity && identity.accountUuid === existingIdentity.accountUuid)) {
+      throw new AnthropicCrossInstanceDuplicateError();
+    }
+  }
+}

package/src/oauth/store.ts

@@ -20,10 +20,12 @@
  *   both append distinct identified accounts under multiauth.
  */
 import { normalizeAnthropicIdentity, matchesAnthropicImport, mergeAnthropicIdentity } from "./anthropic-identity";
+import { isAnthropicInstanceId, type AnthropicInstanceId } from "../providers/anthropic-instance-id";
+import { assertNoCrossAnthropicRegistration, assertAnthropicCredentialSource, assertAnthropicInstanceLoginConfig } from "./store-anthropic-instance";
 import { createHash, randomUUID } from "node:crypto";
 import { chmodSync, closeSync, constants as fsConstants, copyFileSync, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
-import { getConfigDir, atomicWriteFile, backupInvalidConfig, hardenConfigDir, hardenExistingSecret, withConfigMutationLockSync } from "../config";
+import { getConfigDir, atomicWriteFile, backupInvalidConfig, hardenConfigDir, hardenExistingSecret, withConfigMutationLockSync, loadConfig } from "../config";
 import { atomicWriteFileNoFollowUnclaimed } from "../config/atomic-write";
 import { assertNotRealHomeUnderTest } from "../lib/test-home-guard";
 import { recordOwnedConfigPath } from "../lib/config-ownership";
@@ -630,6 +632,9 @@ function normalizeAccount(value: unknown): ProviderAccount | null {
   const account: ProviderAccount = { id: candidate.id, credential };
   if (typeof candidate.alias === "string" && candidate.alias.trim()) account.alias = candidate.alias.trim();
   if (candidate.needsReauth === true) account.needsReauth = true;
+  if (candidate.refreshAttentionGeneration === credentialGeneration(credential)) {
+    account.refreshAttentionGeneration = candidate.refreshAttentionGeneration;
+  }
   if (candidate.paused === true) account.paused = true;
   const threshold = parseAnthropicAccountThreshold(candidate.autoSwitchThresholdOverride);
   if (threshold !== null) account.autoSwitchThresholdOverride = threshold;
@@ -862,14 +867,26 @@ export interface OAuthCredentialWriteReceipt {
   previousAccount: ProviderAccount | undefined;
 }
 
+/** Recheck B immediately before persist, including writes queued behind another mutation. */
+function registrationPersistGuard(provider: string, assertBeforePersist?: () => void): (() => void) | undefined {
+  if (provider !== "anthropic2") return assertBeforePersist;
+  return () => {
+    assertBeforePersist?.();
+    assertAnthropicInstanceLoginConfig(loadConfig(), provider);
+  };
+}
+
 export async function saveCredentialWithReceipt(
   provider: string,
   cred: OAuthCredentials,
   opts: { preserveIdentityless?: boolean; assertBeforePersist?: () => void } = {},
 ): Promise<OAuthCredentialWriteReceipt | null> {
+  if (isAnthropicInstanceId(provider)) assertAnthropicCredentialSource(provider, cred);
   const safe = normalizeCredential(cred);
   if (!safe) return null;
   const receipt = await mutateStore(store => {
+    if (provider === "anthropic2") assertAnthropicInstanceLoginConfig(loadConfig(), provider);
+    if (isAnthropicInstanceId(provider)) assertNoCrossAnthropicRegistration(store, provider, safe);
     const set = store[provider];
     const previousActiveAccountId = set?.activeAccountId;
     const previousSelectionRevision = set?.selectionRevision;
@@ -892,6 +909,7 @@ export async function saveCredentialWithReceipt(
         set.selectionRevision = previousSelectionRevision;
         delete existing.needsReauth;
         delete existing.needsReauthReason;
+        delete existing.refreshAttentionGeneration;
         accountId = existing.id;
       } else {
         const id = distinctAccountId(safe, set.accounts);
@@ -905,6 +923,7 @@ export async function saveCredentialWithReceipt(
         existing.credential = safe;
         delete existing.needsReauth;
         delete existing.needsReauthReason;
+        delete existing.refreshAttentionGeneration;
         if (existing.paused !== true) set.activeAccountId = existing.id;
         accountId = existing.id;
       } else {
@@ -917,6 +936,7 @@ export async function saveCredentialWithReceipt(
           active.credential = safe;
           delete active.needsReauth;
           delete active.needsReauthReason;
+          delete active.refreshAttentionGeneration;
           accountId = active.id;
         } else {
           const id = distinctAccountId(safe, set.accounts);
@@ -937,6 +957,7 @@ export async function saveCredentialWithReceipt(
         active.credential = safe;
         delete active.needsReauth;
         delete active.needsReauthReason;
+        delete active.refreshAttentionGeneration;
         accountId = active.id;
       } else {
         const id = distinctAccountId(safe, set.accounts);
@@ -965,7 +986,7 @@ export async function saveCredentialWithReceipt(
       previousAccount: previousAccounts.get(accountId),
     };
   }, [provider, safe], {
-    assertBeforePersist: opts.assertBeforePersist,
+    assertBeforePersist: registrationPersistGuard(provider, opts.assertBeforePersist),
     finalizeResult: (receipt, store) => {
       receipt.selectionRevision = store[provider]?.selectionRevision;
     },
@@ -1064,11 +1085,14 @@ export async function upsertCredentialByIdentity(
   provider: string,
   cred: OAuthCredentials,
 ): Promise<"inserted" | "updated"> {
+  if (isAnthropicInstanceId(provider)) assertAnthropicCredentialSource(provider, cred);
   const safe = normalizeCredential(cred);
   if (!safe || (!safe.accountId && !safe.email)) {
     throw new Error("Refusing to persist OAuth credential without verified identity");
   }
   return await mutateStore(store => {
+    if (provider === "anthropic2") assertAnthropicInstanceLoginConfig(loadConfig(), provider);
+    if (isAnthropicInstanceId(provider)) assertNoCrossAnthropicRegistration(store, provider, safe);
     const set = store[provider];
     const matchesEmailOnly = (account: ProviderAccount): boolean => {
       if (account.credential.accountId) return false;
@@ -1086,6 +1110,7 @@ export async function upsertCredentialByIdentity(
       existing.credential = safe;
       delete existing.needsReauth;
       delete existing.needsReauthReason;
+      delete existing.refreshAttentionGeneration;
       set.activeAccountId ??= existing.id;
       return "updated";
     }
@@ -1098,7 +1123,7 @@ export async function upsertCredentialByIdentity(
       store[provider] = { activeAccountId: id, accounts: [account] };
     }
     return "inserted";
-  }, [provider, safe]);
+  }, [provider, safe], { assertBeforePersist: registrationPersistGuard(provider) });
 }
 
 /**
@@ -1172,16 +1197,19 @@ export function getAccountCredentialWithStatus(
   };
 }
 
-/** Persist a refreshed credential for a SPECIFIC account without touching activeAccountId. */
+/** Persist an explicit login/reauth credential for one account; runtime rotations use mergeAccountCredential. */
 export async function saveAccountCredential(
   provider: string,
   accountId: string,
   cred: OAuthCredentials,
   opts: { assertBeforePersist?: () => void; rotateLoginId?: boolean } = {},
 ): Promise<void> {
+  if (isAnthropicInstanceId(provider)) assertAnthropicCredentialSource(provider, cred);
   const safe = normalizeCredential(cred);
   if (!safe) return;
   await mutateStore(store => {
+    if (provider === "anthropic2") assertAnthropicInstanceLoginConfig(loadConfig(), provider);
+    if (isAnthropicInstanceId(provider)) assertNoCrossAnthropicRegistration(store, provider, safe);
     const set = store[provider];
     const account = set?.accounts.find(a => a.id === accountId);
     if (!set || !account) return;
@@ -1189,6 +1217,7 @@ export async function saveAccountCredential(
     if (opts.rotateLoginId) account.loginId = randomUUID();
     delete account.needsReauth;
     delete account.needsReauthReason;
+    delete account.refreshAttentionGeneration;
     // A pause that found no usable fallback leaves the active id on a paused row. Once this
     // reauthentication makes an unpaused account usable, hand the selection to it.
     const active = set.accounts.find(a => a.id === set.activeAccountId);
@@ -1196,7 +1225,7 @@ export async function saveAccountCredential(
       set.activeAccountId = account.id;
       set.selectionRevision = randomUUID();
     }
-  }, [provider, accountId, safe], { assertBeforePersist: opts.assertBeforePersist });
+  }, [provider, accountId, safe], { assertBeforePersist: registrationPersistGuard(provider, opts.assertBeforePersist) });
 }
 
 function accountSelection(set: ProviderAccountSet): OAuthAccountSelection {
@@ -1275,13 +1304,20 @@ export async function setAnthropicAccountThreshold(
   accountId: string,
   threshold: number | null,
   options: { assertBeforePersist?: () => void } = {},
+): Promise<boolean> {
+  return setAnthropicAccountThresholdForInstance("anthropic", accountId, threshold, options);
+}
+
+export async function setAnthropicAccountThresholdForInstance(
+  instance: AnthropicInstanceId, accountId: string, threshold: number | null,
+  options: { assertBeforePersist?: () => void } = {},
 ): Promise<boolean> {
   const normalizedThreshold = threshold === null ? null : parseAnthropicAccountThreshold(threshold);
   if (threshold !== null && normalizedThreshold === null) {
     throw new Error("threshold must be an integer 0-100 or null");
   }
   const result = await mutateStore(store => {
-    const set = store.anthropic;
+    const set = store[instance];
     const account = set?.accounts.find(row => row.id === accountId);
     if (!set || !account) return { status: "not-found" as const };
     if ((account.autoSwitchThresholdOverride ?? null) === normalizedThreshold) return { status: "unchanged" as const };
@@ -1290,12 +1326,12 @@ export async function setAnthropicAccountThreshold(
     else account.autoSwitchThresholdOverride = normalizedThreshold;
     set.selectionRevision = randomUUID();
     return { status: "updated" as const, before, after: accountSelection(set) };
-  }, [accountId, normalizedThreshold], { assertBeforePersist: options.assertBeforePersist, afterPersist: result => {
+  }, [instance, accountId, normalizedThreshold], { assertBeforePersist: options.assertBeforePersist, afterPersist: result => {
     if (result.status !== "updated") return;
     // Publish the policy-owned transition before the generic selection event. This
     // preserves an exact previous-revision manual intent without opening an ABA gap.
     publishOAuthAccountRoutingPolicyChange(Object.freeze({
-      provider: "anthropic",
+      provider: instance,
       before: Object.freeze(result.before),
       after: Object.freeze(result.after),
     }));
@@ -1403,6 +1439,7 @@ export async function replaceProviderAccountSet(
         credential: { ...account.credential, ...(account.credential.kiro ? { kiro: { ...account.credential.kiro } } : {}) },
         ...(account.alias ? { alias: account.alias } : {}),
         ...(account.needsReauth ? { needsReauth: true } : {}),
+        ...(account.refreshAttentionGeneration ? { refreshAttentionGeneration: account.refreshAttentionGeneration } : {}),
         ...(account.paused ? { paused: true } : {}),
         ...(account.autoSwitchThresholdOverride !== undefined ? { autoSwitchThresholdOverride: account.autoSwitchThresholdOverride } : {}),
         ...(account.needsReauthReason === "verify_account" ? { needsReauthReason: account.needsReauthReason } : {}),
@@ -1468,7 +1505,28 @@ export async function markAccountNeedsReauth(
   }, [provider, accountId]);
 }
 
-export async function mergeAccountCredential(provider:string,accountId:string,credential:OAuthCredentials,opts:{expectedGeneration?:string;afterPrePersistRead?:()=>void|Promise<void>;assertOwnership?: (store: AuthStore) => void}={}):Promise<{superseded:false}|{superseded:true;stored:OAuthCredentials}>{const safe=normalizeCredential(credential);if(!safe)throw new Error("Refusing to persist invalid OAuth credential");return await mutateStore(async store=>{await opts.afterPrePersistRead?.();const account=store[provider]?.accounts.find(x=>x.id===accountId);if(!account)throw new Error(`OAuth account disappeared before persist: ${provider}`);if(opts.expectedGeneration!==undefined&&credentialGeneration(account.credential)!==opts.expectedGeneration)return{superseded:true,stored:account.credential};opts.assertOwnership?.(store);account.credential=safe;if(account.needsReauthReason!=="verify_account"){delete account.needsReauth;delete account.needsReauthReason;}return{superseded:false};},[provider,accountId,safe,opts.expectedGeneration]);}
+export async function mergeAccountCredential(provider:string,accountId:string,credential:OAuthCredentials,opts:{expectedGeneration?:string;afterPrePersistRead?:()=>void|Promise<void>;assertOwnership?: (store: AuthStore) => void}={}):Promise<{superseded:false}|{superseded:true;stored:OAuthCredentials}>{const safe=normalizeCredential(credential);if(!safe)throw new Error("Refusing to persist invalid OAuth credential");if(isAnthropicInstanceId(provider))assertAnthropicCredentialSource(provider,safe);return await mutateStore(async store=>{await opts.afterPrePersistRead?.();const account=store[provider]?.accounts.find(x=>x.id===accountId);if(!account)throw new Error(`OAuth account disappeared before persist: ${provider}`);if(opts.expectedGeneration!==undefined&&credentialGeneration(account.credential)!==opts.expectedGeneration)return{superseded:true,stored:account.credential};opts.assertOwnership?.(store);account.credential=safe;delete account.refreshAttentionGeneration;if(account.needsReauthReason!=="verify_account"){delete account.needsReauth;delete account.needsReauthReason;}return{superseded:false};},[provider,accountId,safe,opts.expectedGeneration]);}
 // A late refresh failure must not change an operator-paused account's health. Check under
 // the mutation lock, not before awaiting it, so a concurrent pause cannot be overwritten.
-export async function markAccountNeedsReauthIfGeneration(provider:string,accountId:string,generation:string,writerGeneration=captureConfigGeneration(),reason?:"verify_account"):Promise<boolean>{const key=oauthAccountKey(provider,accountId);if(writerGeneration<lastReconciledGeneration&&!liveOAuthAccountKeys.has(key))return false;return await mutateStore(store=>{const account=store[provider]?.accounts.find(x=>x.id===accountId);if(!account?.credential||account.paused||credentialGeneration(account.credential)!==generation)return false;if(writerGeneration<lastReconciledGeneration&&!liveOAuthAccountKeys.has(key))return false;account.needsReauth=true;if(reason==="verify_account")account.needsReauthReason=reason;return true;},[provider,accountId,generation]);}
+export async function markAccountNeedsReauthIfGeneration(provider:string,accountId:string,generation:string,writerGeneration=captureConfigGeneration(),reason?:"verify_account",isCurrent?:(store:AuthStore)=>boolean):Promise<boolean>{const key=oauthAccountKey(provider,accountId);if(writerGeneration<lastReconciledGeneration&&!liveOAuthAccountKeys.has(key))return false;return await mutateStore(store=>{const account=store[provider]?.accounts.find(x=>x.id===accountId);if(!account?.credential||account.paused||credentialGeneration(account.credential)!==generation)return false;if(writerGeneration<lastReconciledGeneration&&!liveOAuthAccountKeys.has(key))return false;if(isCurrent&&!isCurrent(store))return false;account.needsReauth=true;if(reason==="verify_account")account.needsReauthReason=reason;return true;},[provider,accountId,generation]);}
+
+/** Attention is projected only; refresh selection continues to use the stored terminal flag. */
+export function accountNeedsReauthForStatus(provider: string, account: ProviderAccount, now = Date.now()): boolean {
+  return account.needsReauth === true || (provider === "kiro" && account.credential.expires <= now
+    && account.refreshAttentionGeneration === credentialGeneration(account.credential));
+}
+
+/** Record refresh evidence under the same generation/config/pause fences as terminal health. */
+export async function markAccountRefreshAttentionIfGeneration(
+  provider: string, accountId: string, generation: string, writerGeneration = captureConfigGeneration(),
+): Promise<boolean> {
+  if (provider !== "kiro") return false;
+  const key = oauthAccountKey(provider, accountId);
+  return await mutateStore(store => {
+    const account = store[provider]?.accounts.find(a => a.id === accountId);
+    if (!account || account.paused || credentialGeneration(account.credential) !== generation) return false;
+    if (writerGeneration < lastReconciledGeneration && !liveOAuthAccountKeys.has(key)) return false;
+    account.refreshAttentionGeneration = generation;
+    return true;
+  }, [provider, accountId, generation]);
+}

package/src/oauth/token-guardian.ts

@@ -29,6 +29,7 @@ import { codexWarmupFailureReason, warmCodexAccount } from "../codex/warmup";
 import { getMainAccountToken, MAIN_CODEX_ACCOUNT_ID } from "../codex/main-account";
 import { isCanonicalOpenAiForwardProvider, OPENAI_CODEX_PROVIDER_ID } from "../providers/openai-tiers";
 import { providerCodexAccountMode } from "../providers/registry";
+import { configuredAnthropicInstance } from "../providers/anthropic-instance";
 import { captureConfigGeneration, type GenerationContext } from "../lib/state-store-sweeper";
 import { tryAcquireNativeMainProfileClaim } from "../codex/native-main-admission";
 
@@ -144,6 +145,7 @@ export async function guardianSweep(nowMs: number = Date.now()): Promise<Guardia
   // skipping accounts already marked needsReauth (terminal; only a re-login fixes them) or
   // paused by the operator (manual exclusion from all automatic account use).
   for (const provider of listOAuthProviders()) {
+    if (provider === "anthropic2" && configuredAnthropicInstance(config, provider) === undefined) continue;
     if (resolveRefreshPolicy(provider, config) !== "proactive") continue;
     for (const account of listAccounts(provider)) {
       if (account.needsReauth || account.paused) continue;

package/src/oauth/types.ts

@@ -90,6 +90,8 @@ export interface ProviderAccount {
   credential: OAuthCredentials;
   /** Terminal refresh failure (invalid_grant / reused / revoked) — re-login required. */
   needsReauth?: boolean;
+  /** Kiro SSO refresh input-error evidence; status-only attention after this generation expires. */
+  refreshAttentionGeneration?: string;
   /** Operator exclusion from generic OAuth account selection until explicitly resumed. */
   paused?: boolean;
   /** Anthropic-only usage-switch override; absent inherits its pool default, zero disables it. */

package/src/protocols/plan-snapshot.ts

@@ -23,6 +23,7 @@ import { getRoutingProfile, POLICY_NAMESPACE, resolvePolicyProfileId } from "../
 import { resolveWireProtocolOverride } from "../server/adapter-resolve";
 import { nativeChatDeclineReason } from "../server/chat-native-eligibility";
 import { nativeMessagesDeclineReason } from "../server/messages-native-eligibility";
+import { messagesSelectorTargetsSecondaryInstance, messagesSecondaryInstanceUnavailable } from "../server/messages-native-selector";
 import { parseSyntheticRowId } from "../server/fast-row";
 import type { OcxConfig } from "../types";
 import { inboundWireForProtocol, type Protocol, type ProtocolReasonCode } from "./contract";
@@ -161,6 +162,7 @@ function messagesPassthroughPossible(config: OcxConfig, model: string): boolean
   if (config.claudeCode?.nativePassthrough === false) return false;
   if (!/^(claude|anthropic)/i.test(model)) return false;
   try {
+    if (messagesSelectorTargetsSecondaryInstance(config, model)) return false;
     return resolveInboundModel(model, config.claudeCode) === model;
   } catch {
     return false;
@@ -204,6 +206,9 @@ export function buildProtocolPlanSnapshot(
     // A synthetic row needs the proxy-owned adapter, so it never takes the passthrough.
     if (!syntheticRow && messagesPassthroughPossible(config, request.model)) reasonCodes.push("caller-credential-required");
     try {
+      if (messagesSecondaryInstanceUnavailable(config, routeKey)) {
+        return { ...base, routeKind: "unknown", candidates: [], reasonCodes: [...reasonCodes, "unknown-model"] };
+      }
       routeKey = resolveInboundModel(routeKey, config.claudeCode);
     } catch {
       return { ...base, routeKind: "unknown", candidates: [], reasonCodes };

package/src/protocols/settings.ts

@@ -3,9 +3,11 @@
  *
  * Nothing else reads those keys directly: endpoint admission, `count_tokens`, the endpoint
  * metadata DTO and the dashboard all resolve through here, so they cannot disagree about
- * whether an API is open. Type-only config import keeps this module free of runtime edges.
+ * whether an API is open. Instance admission reads only config and registry metadata;
+ * this module never reads credentials or selects an account.
  */
 import type { OcxConfig } from "../types";
+import { configuredAnthropicInstance } from "../providers/anthropic-instance";
 import type { Protocol } from "./contract";
 
 export type ApiSurfaceSource =
@@ -70,8 +72,10 @@ export interface ProtocolSettings {
   rollout: Readonly<ProtocolRolloutSettings>;
 }
 
+type ProtocolConfig = Pick<OcxConfig, "protocols" | "anthropicAccountPool"> & Partial<Pick<OcxConfig, "providers">>;
+
 /** Resolve protocol policy with conservative defaults for every absent or malformed field. */
-export function resolveProtocolSettings(config: Pick<OcxConfig, "protocols" | "anthropicAccountPool">, providerName?: string): Readonly<ProtocolSettings> {
+export function resolveProtocolSettings(config: ProtocolConfig, providerName?: string): Readonly<ProtocolSettings> {
   const raw: unknown = config.protocols;
   const protocols = isRec(raw) ? raw : {};
   const rollout = isRec(protocols.rollout) ? protocols.rollout : {};
@@ -79,9 +83,11 @@ export function resolveProtocolSettings(config: Pick<OcxConfig, "protocols" | "a
   // A present malformed container cannot become an absent/default-on policy.
   const validContainers = (raw === undefined || isRec(raw))
     && (!Object.hasOwn(protocols, "rollout") || isRec(protocols.rollout));
-  const rawPool: unknown = config.anthropicAccountPool;
+  const instance = configuredAnthropicInstance({ providers: config.providers ?? {} }, providerName);
+  const rawPool: unknown = instance === "anthropic2"
+    ? config.providers?.anthropic2?.anthropicAccountPool : instance === "anthropic" ? config.anthropicAccountPool : undefined;
   const pool = isRec(rawPool) ? rawPool : {};
-  const pooled = providerName === "anthropic" && pool.enabled === true;
+  const pooled = instance !== undefined && pool.enabled === true;
   const poolPreference = !Object.hasOwn(pool, "nativeMessages") || pool.nativeMessages === true;
   const nativeOn = (key: "managedMessagesNative" | "managedMessagesNativeOAuth") => validContainers
     && (!pooled || poolPreference)
@@ -105,15 +111,17 @@ export function resolveProtocolSettings(config: Pick<OcxConfig, "protocols" | "a
  * dashboard can tell a preview computed under an older policy from a current one. Not a
  * security boundary; FNV-1a over a canonical JSON projection.
  */
-export function protocolPolicyRevision(config: Pick<OcxConfig, "apiSurfaces" | "claudeCode" | "protocols" | "anthropicAccountPool">): string {
+export function protocolPolicyRevision(config: ProtocolConfig & Pick<OcxConfig, "apiSurfaces" | "claudeCode">): string {
   const surfaces = resolveApiSurfaceSettings(config);
   const settings = resolveProtocolSettings(config);
   const anthropicSettings = resolveProtocolSettings(config, "anthropic");
+  const secondarySettings = resolveProtocolSettings(config, "anthropic2");
   const state = (record: unknown, key: string) => !isRec(record) || !Object.hasOwn(record, key)
     ? "absent" : record[key] === true ? "true" : record[key] === false ? "false" : "invalid";
   const container = (value: unknown) => value === undefined ? "absent" : isRec(value) ? "object" : "invalid";
   const rawProtocols: unknown = config.protocols;
   const rawRollout = isRec(rawProtocols) ? rawProtocols.rollout : undefined;
+  const secondary = config.providers?.anthropic2;
   const canonical = JSON.stringify({
     messages: [surfaces.messages.enabled, surfaces.messages.source],
     unrepresentable: settings.unrepresentable,
@@ -122,6 +130,11 @@ export function protocolPolicyRevision(config: Pick<OcxConfig, "apiSurfaces" | "
       state(rawRollout, "managedMessagesNative"), state(rawRollout, "managedMessagesNativeOAuth"),
       container(config.anthropicAccountPool), state(config.anthropicAccountPool, "enabled"),
       state(config.anthropicAccountPool, "nativeMessages"),
+      container(secondary), state(secondary, "disabled"),
+      !!secondary && Object.hasOwn(secondary, "anthropicOAuthInstance"), secondary?.anthropicOAuthInstance ?? "absent",
+      secondary?.adapter ?? "absent", secondary?.authMode ?? "absent", secondary?.baseUrl ?? "absent",
+      container(secondary?.anthropicAccountPool), state(secondary?.anthropicAccountPool, "enabled"),
+      state(secondary?.anthropicAccountPool, "nativeMessages"),
     ],
     rollout: [
       settings.rollout.nativeChatCombos,
@@ -129,6 +142,8 @@ export function protocolPolicyRevision(config: Pick<OcxConfig, "apiSurfaces" | "
       settings.rollout.managedMessagesNativeOAuth,
       anthropicSettings.rollout.managedMessagesNative,
       anthropicSettings.rollout.managedMessagesNativeOAuth,
+      secondarySettings.rollout.managedMessagesNative,
+      secondarySettings.rollout.managedMessagesNativeOAuth,
       settings.rollout.directEncoders,
       settings.rollout.shadowPlan,
     ],

package/src/providers/anthropic-instance-id.ts

@@ -0,0 +1,47 @@
+/**
+ * Identity of the two builtin Anthropic OAuth account-pool instances.
+ *
+ * This module has no imports on purpose: the provider registry and config types depend on it, and
+ * `./anthropic-instance.ts` (which reads the registry) builds on top of it. Keep it that way, or the
+ * registry and its lookup helper import each other.
+ *
+ * `anthropic` is the original pool. `anthropic2` is a second, independent pool that runs the same
+ * Anthropic implementation with its own credentials, pool settings and runtime state. Exactly these two
+ * IDs exist; a prefix such as `anthropic3` is never an instance.
+ */
+export const ANTHROPIC_INSTANCE_IDS = ["anthropic", "anthropic2"] as const;
+export type AnthropicInstanceId = typeof ANTHROPIC_INSTANCE_IDS[number];
+
+/** The canonical pool. Bare `claude-*` inference, Claude Code caller-forward and CLI import stay here. */
+export const ANTHROPIC_PRIMARY_INSTANCE: AnthropicInstanceId = "anthropic";
+/** The second, independent pool ("Anthropic · Pool 2"). Browser OAuth only. */
+export const ANTHROPIC_POOL2_INSTANCE: AnthropicInstanceId = "anthropic2";
+
+export type AnthropicInstanceRow = {
+  adapter?: string;
+  authMode?: string;
+  baseUrl?: string;
+  anthropicOAuthInstance?: unknown;
+};
+
+export function isAnthropicInstanceId(value: unknown): value is AnthropicInstanceId {
+  return value === "anthropic" || value === "anthropic2";
+}
+
+/**
+ * Whether a configured provider row may be treated as the builtin instance of that name.
+ *
+ * `anthropic` keeps its historical meaning: the row named `anthropic` is the instance. A row named
+ * `anthropic2` may predate the builtin as a user's custom provider, so it is the builtin only when it is
+ * explicitly marked as an Anthropic OAuth instance. Transport endpoints never establish ownership.
+ * Anything else keeps its custom meaning and is never pinned, enriched or routed as the builtin pool.
+ */
+export function anthropicInstanceRowShapeMatches(
+  name: string,
+  row: AnthropicInstanceRow | undefined,
+): boolean {
+  if (name === "anthropic") return true;
+  if (name !== "anthropic2" || !row) return false;
+  return Object.hasOwn(row, "anthropicOAuthInstance") && row.anthropicOAuthInstance === "anthropic2"
+    && row.adapter === "anthropic" && row.authMode === "oauth";
+}

package/src/providers/anthropic-instance.ts

@@ -0,0 +1,48 @@
+/**
+ * Registry- and config-aware Anthropic instance checks. See `./anthropic-instance-id.ts` for the IDs and
+ * the pure row-shape rule; this module adds the registry declaration and the configured-row lookup.
+ *
+ * Instance membership is never inferred from `adapter === "anthropic"` (the API-key provider and
+ * Anthropic-compatible gateways share that adapter) or from a name prefix.
+ */
+import type { OcxConfig, OcxProviderConfig } from "../types";
+import { getProviderRegistryEntry } from "./registry";
+import { anthropicInstanceRowShapeMatches, isAnthropicInstanceId, type AnthropicInstanceId } from "./anthropic-instance-id";
+
+export * from "./anthropic-instance-id";
+
+/** Exact registry check: one of the two IDs, declared as an Anthropic-family OAuth entry with its own OAuth ID. */
+export function isAnthropicOAuthInstance(id: string | undefined): id is AnthropicInstanceId {
+  if (!isAnthropicInstanceId(id)) return false;
+  const entry = getProviderRegistryEntry(id);
+  return entry !== undefined
+    && entry.authKind === "oauth"
+    && entry.oauthId === id
+    && entry.oauthFamily === "anthropic";
+}
+
+export function isBuiltinAnthropicInstanceRow(
+  name: string,
+  row?: Partial<Pick<OcxProviderConfig, "adapter" | "authMode" | "baseUrl" | "anthropicOAuthInstance">>,
+): boolean {
+  return isAnthropicOAuthInstance(name) && anthropicInstanceRowShapeMatches(name, row);
+}
+
+/**
+ * The instance a configured provider name runs as, or undefined.
+ *
+ * For `anthropic` this is a compatibility identity result: it returns the instance whenever the name is
+ * `anthropic`, and callers keep every auth-mode, enabled-provider and eligibility check they already
+ * apply. For `anthropic2` the row must exist, must not be disabled and must pass the builtin row-shape
+ * rule, so an orphan `anthropic2` auth row or a custom provider of that name never activates the pool.
+ */
+export function configuredAnthropicInstance(
+  config: Pick<OcxConfig, "providers">,
+  name: string | undefined,
+): AnthropicInstanceId | undefined {
+  if (!isAnthropicOAuthInstance(name)) return undefined;
+  if (name === "anthropic") return "anthropic";
+  const row = config.providers?.[name];
+  if (!row || row.disabled === true) return undefined;
+  return anthropicInstanceRowShapeMatches(name, row) ? name : undefined;
+}