@bitkyc08/opencodex 2.80.0 → 2.82.0

package/src/providers/quota/vendor-probes-oauth.ts

@@ -2,7 +2,9 @@ import { markAnthropicFamilyEnumeration } from "./anthropic-family-headers";
 import { effectiveCodexAuthAccountId, fetchMainAccountInfoSnapshot, listCodexAuthAccountsSnapshot } from "../../codex/auth-api";
 import { MAIN_CODEX_ACCOUNT_ID } from "../../codex/main-account";
 import { getValidAccessToken } from "../../oauth";
-import { captureOAuthAccountSelection, getAccountCredential, getAccountSet } from "../../oauth/store";
+import { loadConfig } from "../../config";
+import { configuredAnthropicInstance, type AnthropicInstanceId } from "../anthropic-instance";
+import { captureOAuthAccountSelection, credentialGeneration, getAccountCredential, getAccountSet } from "../../oauth/store";
 import { hydrateKiroAccountState, persistKiroAccountState } from "../kiro-account-state-disk";
 import { kiroProbeCurrent, kiroProbeIdentity } from "./kiro-account-probe";
 import { fetchMuseKeyQuotaSnapshot } from "../muse-key-quota";
@@ -33,6 +35,7 @@ import {
 } from "./report-cache";
 import {
   accountCacheKey,
+  captureProviderAccountQuotaEpoch,
   accountQuotaCache,
   hydrateAccountQuotaCache,
   mayCommitAccountQuotaKey,
@@ -40,7 +43,7 @@ import {
 } from "./account-cache";
 import type { OcxConfig, OcxProviderConfig } from "../../types";
 import type { ProviderQuota, ProviderQuotaWindow } from "../quota-types";
-import { AnthropicQuotaProbeOwnershipError, assertAnthropicQuotaSendAllowed, probeAnthropicQuotaWithRecovery } from "./anthropic-cooldown-recovery";
+import { AnthropicQuotaProbeOwnershipError, anthropicCooldownRecoveryFor } from "./anthropic-cooldown-recovery";
 
 const XAI_BILLING_URL = "https://cli-chat-proxy.grok.com/v1/billing";
 const XAI_CREDITS_URL = `${XAI_BILLING_URL}?format=credits`;
@@ -336,39 +339,68 @@ async function readAnthropicUsageQuota(accessToken: string): Promise<ProviderQuo
 export async function fetchAnthropicUsageQuota(
   accessToken: string,
   requireFreshDispatch = false,
+): Promise<ProviderQuota | null> {
+  return fetchAnthropicUsageQuotaForInstance("anthropic", accessToken, requireFreshDispatch);
+}
+
+export async function fetchAnthropicUsageQuotaForInstance(
+  instance: AnthropicInstanceId,
+  accessToken: string,
+  requireFreshDispatch = false,
 ): Promise<ProviderQuota | null> {
   // Recovery evidence must be requested after the claimed cooldown. Joining an older request
   // can return after the 429 while still describing provider state from before that refusal.
-  const joinable = requireFreshDispatch ? undefined : anthropicUsageInflight.get(accessToken);
+  const credentialIdentity = getAccountSet(instance)?.accounts.filter(row => row.credential.access === accessToken)
+    .map(row => [row.id, row.loginId, row.addedAt, credentialGeneration(row.credential)]);
+  const key = `${instance}\0${captureProviderAccountQuotaEpoch(instance)}\0${JSON.stringify(credentialIdentity)}\0${accessToken}`;
+  const joinable = requireFreshDispatch ? undefined : anthropicUsageInflight.get(key);
   if (joinable) return joinable;
 
   const probe = readAnthropicUsageQuota(accessToken).finally(() => {
-    if (anthropicUsageInflight.get(accessToken) === probe) anthropicUsageInflight.delete(accessToken);
+    if (anthropicUsageInflight.get(key) === probe) anthropicUsageInflight.delete(key);
   });
-  anthropicUsageInflight.set(accessToken, probe);
+  anthropicUsageInflight.set(key, probe);
   return probe;
 }
 
-export async function fetchAnthropicQuota(provider: string): Promise<ProviderQuotaReport | null> {
+/** `config` is the caller's live object; currency re-reads it instead of reloading the file. */
+export async function fetchAnthropicQuota(provider: string, config: OcxConfig = loadConfig()): Promise<ProviderQuotaReport | null> {
+  const instance = configuredAnthropicInstance(config, provider);
+  const target = config.providers[provider];
+  if (!instance || target?.disabled || target && target.authMode !== "oauth") return null;
+  const targetIdentity = JSON.stringify(target);
+  const targetCurrent = () => configuredAnthropicInstance(config, provider) === instance
+    && JSON.stringify(config.providers[provider]) === targetIdentity;
+  const recovery = anthropicCooldownRecoveryFor(instance);
   // Capture the account we intend to probe before awaiting — a mid-flight active
   // switch must not seed the wrong account's cache with this response.
-  const selection = captureOAuthAccountSelection("anthropic");
+  const selection = captureOAuthAccountSelection(instance);
   const probedAccountId = selection?.accountId;
-  const probedAccountKey = probedAccountId ? accountCacheKey("anthropic", probedAccountId) : null;
+  const initialRow = getAccountSet(instance)?.accounts.find(row => row.id === probedAccountId);
+  const epoch = captureProviderAccountQuotaEpoch(instance);
+  const incarnation = probedAccountId ? recovery.reserveAnthropicAccountIncarnation(probedAccountId) : undefined;
+  const probedAccountKey = probedAccountId ? accountCacheKey(instance, probedAccountId) : null;
   const writerGeneration = captureConfigGeneration();
   let accessToken: string;
   try {
-    accessToken = await getValidAccessToken("anthropic");
+    accessToken = await getValidAccessToken(instance);
   } catch {
     return null;
   }
   if (!probedAccountId || !probedAccountKey) return null;
+  const currentRow = getAccountSet(instance)?.accounts.find(row => row.id === probedAccountId);
+  if (!initialRow || !currentRow || initialRow.loginId !== currentRow.loginId || initialRow.addedAt !== currentRow.addedAt
+    || epoch !== captureProviderAccountQuotaEpoch(instance) || recovery.anthropicAccountIncarnation(probedAccountId) !== incarnation) return null;
   let quota: ProviderQuota | null;
   let anthropicCurrent: (() => boolean) | undefined;
   try {
-    const result = await probeAnthropicQuotaWithRecovery(probedAccountId, accessToken,
-      fresh => { assertAnthropicQuotaSendAllowed(probedAccountId, accessToken); return fetchAnthropicUsageQuota(accessToken, fresh); },
-      () => mayCommitAccountQuotaKey(probedAccountKey, writerGeneration));
+    const result = await recovery.probeAnthropicQuotaWithRecovery(probedAccountId, accessToken,
+      fresh => {
+        if (!targetCurrent()) throw new AnthropicQuotaProbeOwnershipError("quota target changed");
+        recovery.assertAnthropicQuotaSendAllowed(probedAccountId, accessToken);
+        return fetchAnthropicUsageQuotaForInstance(instance, accessToken, fresh);
+      },
+      () => targetCurrent() && mayCommitAccountQuotaKey(probedAccountKey, writerGeneration));
     if (result && !result.isCurrent()) return null;
     quota = result?.quota ?? null;
     anthropicCurrent = result?.isCurrent;
@@ -380,14 +412,14 @@ export async function fetchAnthropicQuota(provider: string): Promise<ProviderQuo
   // Share the active-account probe with the per-account cache so Providers-page
   // loads do not double-hit Anthropic's rate-limited usage endpoint.
   if (probedAccountId && probedAccountKey) {
-    const stillOwnsToken = getAccountCredential("anthropic", probedAccountId)?.access === accessToken;
+    const stillOwnsToken = getAccountCredential(instance, probedAccountId)?.access === accessToken;
     if (stillOwnsToken && anthropicCurrent?.() && mayCommitAccountQuotaKey(probedAccountKey, writerGeneration)) {
       accountQuotaCache.set(probedAccountKey, { ts: Date.now(), quota, isCurrent: anthropicCurrent });
     }
   }
   const quotaReport = report(provider, "anthropic:oauth-usage", quota);
   if (quotaReport && anthropicCurrent) {
-    accountReportCurrent.set(quotaReport, () => anthropicCurrent() && getAccountSet("anthropic")?.activeAccountId === probedAccountId);
+    accountReportCurrent.set(quotaReport, () => anthropicCurrent() && getAccountSet(instance)?.activeAccountId === probedAccountId);
   }
   return quotaReport;
 }

package/src/providers/quota.ts

@@ -1,4 +1,6 @@
 import { listCodexAuthAccountsSnapshot } from "../codex/auth-api";
+import { isAnthropicInstanceId, configuredAnthropicInstance } from "./anthropic-instance";
+import { fetchAnthropicAccountQuota } from "./quota/anthropic-account-quota";
 import { resolveEnvValue } from "../config";
 import { getAccountCredential, getAccountSet } from "../oauth/store";
 import { apiKeyPoolEntryId } from "./api-keys";
@@ -18,6 +20,7 @@ import {
   accountReportCurrent,
   AUTHORITATIVE_EMPTY_QUOTA,
   bumpProviderQuotaInvalidationEpoch,
+  captureProviderReportEpochs, providerReportEpochChanged,
   cacheKeyWithAggregationState,
   getProviderQuotaReportCache,
   hasCodexPoolProvider,
@@ -56,7 +59,6 @@ import {
 } from "./quota/account-cache";
 import {
   fetchAnthropicQuota,
-  fetchAnthropicUsageQuota,
   fetchChatGptForwardQuota,
   fetchCursorQuota,
   fetchKiroQuota,
@@ -68,11 +70,10 @@ import { fetchCommandCodeQuota, fetchKimiQuota, keyQuotaReaderForProvider } from
 import { antigravityQuotaDiagnosticIdentity, fetchAntigravityQuota, probeAntigravityUsageQuota } from "./quota/antigravity";
 import { persistKiroAccountState } from "./kiro-account-state-disk";
 import { kiroProbeCurrent, kiroProbeIdentity } from "./quota/kiro-account-probe";
-import { AnthropicQuotaProbeOwnershipError, anthropicCooldownFlightKey, assertAnthropicQuotaSendAllowed, probeAnthropicQuotaWithRecovery } from "./quota/anthropic-cooldown-recovery";
 export type { ProviderQuota, ProviderQuotaCreditsUsd, ProviderQuotaWindow } from "./quota-types";
 export { QUOTA_RESPONSE_MAX_BYTES } from "./quota-wire";
 export {
-  clearProviderQuotaCache,
+  clearProviderQuotaCache, clearProviderQuotaCacheFor,
   publishKeyReportForTests,
   readProviderQuotaJsonForTests,
   setProviderQuotaBeforePublishForTests,
@@ -86,7 +87,7 @@ export {
   parseAnthropicRateLimitHeaders,
   providerOAuthAccountQuotaMode,
   readPassiveProviderAccountQuotas,
-  recordAnthropicAccountQuotaFromHeaders,
+  recordAnthropicAccountQuotaFromHeaders, recordAnthropicAccountQuotaFromHeadersForInstance,
   recordPassiveAccountQuota,
   reconcileProviderAccountQuotaRows,
   resetProviderQuotaReconcileStateForTests,
@@ -96,7 +97,7 @@ export {
   type ProviderAccountQuota,
 } from "./quota/account-cache";
 export { fetchAntigravityUsageQuota, isCanonicalAntigravityQuotaUrl, setAntigravityAccountQuotaTransportForTests } from "./quota/antigravity";
-export { parseOllamaCloudQuota, parseZaiQuotaLimits, providerApiKeyQuotaMode } from "./quota/vendor-probes-key";
+export { parseOllamaCloudBalance, parseOllamaCloudQuota, parseZaiQuotaLimits, providerApiKeyQuotaMode } from "./quota/vendor-probes-key";
 export { parseXaiCreditsResponse } from "./quota/vendor-probes-oauth";
 export async function fetchProviderApiKeyQuotas(config: OcxConfig, name: string, forceRefresh = false): Promise<ProviderApiKeyQuota[]> {
   const provider = config.providers[name];
@@ -121,7 +122,7 @@ async function maybeFetchProviderQuota(
       return fetchChatGptForwardQuota(config, name, provider, forceRefresh, prefetchedCodexSnapshot);
     }
     if (provider.authMode === "oauth" && explicitAccountReader(name)) return await fetchExplicitCurrentQuota(name, provider, config);
-    if (provider.authMode === "oauth" && name === "anthropic") return fetchAnthropicQuota(name);
+    if (provider.authMode === "oauth" && configuredAnthropicInstance(config, name)) return fetchAnthropicQuota(name, config);
     if (provider.authMode === "oauth" && name === "google-antigravity") return await fetchAntigravityQuota(name);
     if (provider.authMode === "oauth" && name === "kiro") return fetchKiroQuota(name);
     // meta-muse: a device-logged-in account can be probed at the key endpoint; an
@@ -236,6 +237,7 @@ export async function fetchProviderQuotaReports(config: OcxConfig, forceRefresh
   const keyCandidate = cacheKeyWithAggregationState(config, prefetchedCodexSnapshot);
   const key = typeof keyCandidate === "string" ? keyCandidate : await keyCandidate;
   const writerGeneration = captureConfigGeneration();
+  const providerEpochs = captureProviderReportEpochs();
   const now = Date.now();
   // The cache fast path must not extend a preserved last-good row past its 30-minute bound:
   // a row preserved at age 29:59 plus a full 5-minute TTL would otherwise serve until ~35min.
@@ -312,6 +314,8 @@ export async function fetchProviderQuotaReports(config: OcxConfig, forceRefresh
       byProvider.delete(provider);
       generationMismatchedProviders.delete(provider);
     }
+    // A provider-scoped clear during this probe retires only that provider's row.
+    for (const provider of [...byProvider.keys()]) if (providerReportEpochChanged(providerEpochs, provider)) byProvider.delete(provider);
 
     const response = { generatedAt: Date.now(), reports: [...byProvider.values()] };
     // Commit only when this probe still holds authority (no clear/force superseded it).
@@ -415,27 +419,27 @@ async function fetchAccountQuota(
   accountId: string,
   forceRefresh: boolean,
   providerConfig?: OcxProviderConfig,
+  liveConfig?: OcxConfig,
 ): Promise<AccountQuotaCacheEntry> {
   if (accountQuotaProbeSkip(provider, accountId)) return accountQuotaProbeSkip(provider, accountId)!;
+  if (isAnthropicInstanceId(provider)) return fetchAnthropicAccountQuota(provider, accountId, forceRefresh, liveConfig);
   if (explicitAccountReader(provider)) return fetchExplicitAccountQuota(provider, accountId, forceRefresh, providerConfig);
-  if (provider === "anthropic" || provider === "kiro") hydrateAccountQuotaCache();
+  if (provider === "kiro") hydrateAccountQuotaCache();
   const key = accountCacheKey(provider, accountId);
   const writerGeneration = captureConfigGeneration();
   const kiroIdentity = provider === "kiro" ? kiroProbeIdentity(accountId) : undefined;
   const cachedCandidate = accountQuotaCache.get(key);
-  const cached = (provider !== "kiro" || cachedCandidate?.identity === kiroIdentity)
-    && (provider !== "anthropic" || cachedCandidate?.isCurrent?.() !== false) ? cachedCandidate : undefined;
+  const cached = provider !== "kiro" || cachedCandidate?.identity === kiroIdentity ? cachedCandidate : undefined;
   if (!forceRefresh && cached && Date.now() - cached.ts < ACCOUNT_QUOTA_TTL_MS) {
     if (provider === "google-antigravity" && cached.quotaFailure && cached.quotaFailureIsCurrent?.() !== true) return { ...cached, quotaFailure: undefined };
-    return provider === "anthropic" ? { ...cached, quota: normalizeAnthropicQuota(cached.quota, Date.now()) } : cached;
+    return cached;
   }
-  const flightKey = provider === "anthropic" ? anthropicCooldownFlightKey(key, accountId) : key;
-  const flightCurrent = () => provider !== "anthropic" || anthropicCooldownFlightKey(key, accountId) === flightKey;
+  const flightKey = key;
   const joinable = accountQuotaInflight.get(flightKey);
   if (joinable) {
     const joined = await joinable;
     const joinedCurrent = joined.isCurrent?.();
-    if (joinedCurrent === false || (!flightCurrent() && joinedCurrent !== true)) return { ts: Date.now(), quota: null, unavailable: true };
+    if (joinedCurrent === false) return { ts: Date.now(), quota: null, unavailable: true };
     return provider !== "kiro" || joined.identity === kiroIdentity
       ? joined : fetchAccountQuota(provider, accountId, true, providerConfig);
   }
@@ -449,14 +453,10 @@ async function fetchAccountQuota(
     };
     const diagnosticFields = () => quotaFailure && quotaFailureIsCurrent() ? { quotaFailure, quotaFailureIsCurrent } : {};
     const unavailable = (): AccountQuotaCacheEntry => {
-      if (!flightCurrent()) return { ts: Date.now(), quota: null, unavailable: true };
-      const previous = accountQuotaCache.get(key);
-      const retained = provider === "anthropic" && previous?.isCurrent?.() === false ? undefined : previous;
       const entry: AccountQuotaCacheEntry = {
         ts: Date.now(),
-        quota: provider === "anthropic" ? normalizeAnthropicQuota(retained?.quota, Date.now()) : cached?.quota ?? null,
+        quota: cached?.quota ?? null,
         unavailable: true,
-        ...(provider === "anthropic" && retained?.isCurrent ? { isCurrent: retained.isCurrent } : {}),
         ...(provider === "kiro" ? { identity: kiroIdentity } : {}),
         ...diagnosticFields(),
       };
@@ -470,14 +470,12 @@ async function fetchAccountQuota(
     try {
       if (provider === "google-antigravity") diagnosticIdentity = antigravityQuotaDiagnosticIdentity(accountId);
       let quota: ProviderQuota | null;
-      let anthropicCurrent: (() => boolean) | undefined;
       let kiroSnapshot: KiroUsageSnapshot | null = null;
       if (provider === "kiro") {
         kiroSnapshot = await fetchKiroUsageSnapshot(await kiroUsageContextForAccount(accountId));
         quota = kiroSnapshot?.quota ?? null;
       } else {
         const token = await getTokenForAccountQuotaProbe(provider, accountId);
-        if (!flightCurrent()) throw new AnthropicQuotaProbeOwnershipError("anthropic quota flight is stale");
         if (provider === "google-antigravity") {
           // Per-account Gem/Cla windows (#1082). The project id is part of the stored
           // credential; without it the probe cannot be made, and that is "unavailable",
@@ -488,22 +486,14 @@ async function fetchAccountQuota(
           const result = await probeAntigravityUsageQuota(token, credential.projectId);
           quota = result.kind === "available" ? result.quota : null;
           if (result.kind === "unavailable") quotaFailure = result.failure;
-        } else if (provider === "anthropic") {
-          const result = await probeAnthropicQuotaWithRecovery(accountId, token,
-            fresh => { assertAnthropicQuotaSendAllowed(accountId, token); return fetchAnthropicUsageQuota(token, fresh); },
-            () => mayCommitAccountQuotaKey(key, writerGeneration));
-          if (result && !result.isCurrent()) throw new AnthropicQuotaProbeOwnershipError("anthropic quota probe lost publication ownership");
-          quota = result?.quota ?? null;
-          anthropicCurrent = result?.isCurrent;
         } else {
           return { ts: Date.now(), quota: null, unavailable: true };
         }
       }
       if (!quota) return unavailable();
       const entry: AccountQuotaCacheEntry = {
-        ts: Date.now(), quota: provider === "anthropic" ? normalizeAnthropicQuota(quota, Date.now()) : quota,
+        ts: Date.now(), quota,
         ...(provider === "kiro" ? { identity: kiroIdentity } : {}),
-        ...(anthropicCurrent ? { isCurrent: anthropicCurrent } : {}),
       };
       if (mayCommitAccountQuotaKey(key, writerGeneration)
         && (provider !== "kiro" || kiroProbeCurrent(accountId, kiroIdentity))) {
@@ -513,7 +503,6 @@ async function fetchAccountQuota(
       }
       return entry;
     } catch (error) {
-      if (provider === "anthropic" && error instanceof AnthropicQuotaProbeOwnershipError) return { ts: Date.now(), quota: null, unavailable: true };
       if (provider === "google-antigravity") quotaFailure = "account_unavailable";
       return unavailable();
     }
@@ -531,20 +520,21 @@ export async function fetchProviderAccountQuotas(
   provider: string,
   forceRefresh = false,
   providerConfig?: OcxProviderConfig,
+  liveConfig?: OcxConfig,
 ): Promise<ProviderAccountQuota[]> {
   if (!supportsPerAccountQuota(provider)) return [];
   const set = getAccountSet(provider);
   if (!set) return [];
   return mapQuotaRoster(set.accounts, async account => {
-    const entry = await fetchAccountQuota(provider, account.id, forceRefresh, providerConfig);
+    const entry = await fetchAccountQuota(provider, account.id, forceRefresh, providerConfig, liveConfig);
     const result: ProviderAccountQuota = {
       accountId: account.id,
-      quota: provider === "anthropic" ? normalizeAnthropicQuota(entry.quota, Date.now()) : entry.quota,
+      quota: isAnthropicInstanceId(provider) ? normalizeAnthropicQuota(entry.quota, Date.now()) : entry.quota,
       ...(entry.unavailable ? { unavailable: true as const } : {}),
       ...(entry.unavailable && entry.quotaFailure && entry.quotaFailureIsCurrent?.() === true ? { quotaFailure: entry.quotaFailure } : {}),
     };
     if (entry.quotaFailureIsCurrent) Object.defineProperty(result, "quotaFailureIsCurrent", { value: entry.quotaFailureIsCurrent });
-    if (provider === "anthropic" && entry.isCurrent) Object.defineProperty(result, "isCurrent", { value: entry.isCurrent });
+    if (isAnthropicInstanceId(provider) && entry.isCurrent) Object.defineProperty(result, "isCurrent", { value: entry.isCurrent });
     if (!explicitAccountReader(provider)) return result;
     const identity = entry.identity;
     Object.defineProperty(result, "isCurrent", { value: () => {

package/src/providers/registry/entries-core.ts

@@ -14,6 +14,7 @@ import { cursorFastCapableBases } from "../../adapters/cursor/catalog";
 import { COMMAND_CODE_MODEL_REASONING_EFFORTS } from "../command-code-efforts";
 import { isCanonicalOpenRouterTarget } from "../openrouter-routing";
 import type { ProviderRegistryEntry } from "./types";
+import type { AnthropicInstanceId } from "../anthropic-instance-id";
 import { ANTHROPIC_FAST_MODE_BETA } from "../anthropic-fast";
 import {
   ANTHROPIC_MODELS,
@@ -109,6 +110,37 @@ const ANTHROPIC_FAST_MODELS: Readonly<Record<string, boolean>> = Object.freeze({
 const ANTHROPIC_FAST_TIER_DESCRIPTION =
   "Claude fast mode: faster output at 2x price; needs usage credits (subscription) or fast-mode access (API)";
 
+/** Each instance owns its entire seed, including nested model lists and Fast wire maps. */
+function anthropicOAuthEntry(id: AnthropicInstanceId, label: string): ProviderRegistryEntry {
+  return structuredClone<ProviderRegistryEntry>({
+    id,
+    label,
+    adapter: "anthropic",
+    baseUrl: "https://api.anthropic.com",
+    authKind: "oauth",
+    allowBaseUrlOverride: true,
+    featured: true,
+    oauthId: id,
+    oauthFamily: "anthropic",
+    jawcodeBundle: "anthropic",
+    note: id === "anthropic" ? "Log in with your Claude account"
+      : "Independent Claude account pool — log in with a separate Claude account",
+    models: [...ANTHROPIC_MODELS],
+    modelContextWindows: { ...ANTHROPIC_MODEL_CONTEXT_WINDOWS },
+    modelInputModalities: { ...ANTHROPIC_MODEL_INPUT_MODALITIES },
+    modelReasoningEfforts: { ...ANTHROPIC_MODEL_REASONING_EFFORTS },
+    // Codex omits max_output_tokens; the fallback 8192 truncates long answers.
+    defaultMaxOutputTokens: ANTHROPIC_DEFAULT_MAX_OUTPUT_TOKENS,
+    modelMaxOutputTokens: { ...ANTHROPIC_MODEL_MAX_OUTPUT_TOKENS },
+    defaultModel: "claude-sonnet-5",
+    // Subscription /fast remains opt-in: it draws usage credits at 2x price.
+    fastWire: ANTHROPIC_FAST_WIRE,
+    modelSupportsServiceTier: { ...ANTHROPIC_FAST_MODELS },
+    fastTierDescription: ANTHROPIC_FAST_TIER_DESCRIPTION,
+    fastOptIn: true,
+  });
+}
+
 export const PROVIDER_REGISTRY_CORE: readonly ProviderRegistryEntry[] = [
   {
     id: "openai",
@@ -209,7 +241,7 @@ export const PROVIDER_REGISTRY_CORE: readonly ProviderRegistryEntry[] = [
     // (it is the current catalog, so its default ordering wins), then the ids
     // only the old devin entry carried. Degraded-mode seed only either way —
     // `liveModels` discovers the account's real roster.
-    models: ["swe-2", "swe-1-7", "gpt-5-6-sol", "gpt-6-astra", "gpt-6-1-sol", "gpt-6-sol", "gpt-6-luna", "claude-opus-5-5", "claude-opus-5", "claude-fable-5-1", "claude-sonnet-5-5", "claude-sonnet-5", "glm-5-3", "kimi-k3", "gemini-3-8-flash", "grok-4-6", "grok-4-7", "swe-1-7-lightning", "gpt-5-6-luna", "gpt-5-6-terra", "claude-opus-4-8", "glm-5-2", "kimi-k2-7", "grok-4-5"],
+    models: ["swe-2", "swe-1-7", "gpt-5-6-sol", "gpt-6-astra", "gpt-6-1-sol", "gpt-6-sol", "gpt-6-luna", "claude-opus-5-5", "claude-opus-5", "claude-fable-5-1", "claude-sonnet-5-5", "claude-haiku-5-5", "claude-sonnet-5", "glm-5-3", "kimi-k3", "gemini-3-8-flash", "grok-4-6", "grok-4-7", "swe-1-7-lightning", "gpt-5-6-luna", "gpt-5-6-terra", "claude-opus-4-8", "glm-5-2", "kimi-k2-7", "grok-4-5"],
     liveModels: true,
     defaultModel: "swe-2",
     modelContextWindows: DEVIN_MODEL_CONTEXT_WINDOWS,
@@ -490,35 +522,8 @@ export const PROVIDER_REGISTRY_CORE: readonly ProviderRegistryEntry[] = [
     modelReasoningEfforts: ORCAROUTER_MODEL_REASONING_EFFORTS,
     note: "Connect your OrcaRouter account with OAuth 2.0 + PKCE; the issued API key is stored in OpenCodex's existing credential store.",
   },
-  {
-    id: "anthropic",
-    label: "Anthropic Claude",
-    adapter: "anthropic",
-    baseUrl: "https://api.anthropic.com",
-    authKind: "oauth",
-    allowBaseUrlOverride: true,
-    featured: true,
-    oauthId: "anthropic",
-    jawcodeBundle: "anthropic",
-    note: "Log in with your Claude account",
-    models: [...ANTHROPIC_MODELS],
-    modelContextWindows: { ...ANTHROPIC_MODEL_CONTEXT_WINDOWS },
-    modelInputModalities: { ...ANTHROPIC_MODEL_INPUT_MODALITIES },
-    modelReasoningEfforts: { ...ANTHROPIC_MODEL_REASONING_EFFORTS },
-    // Codex omits max_output_tokens; without a provider budget the Anthropic adapter
-    // falls back to 8192, which truncates long answers with stop_reason=max_tokens.
-    defaultMaxOutputTokens: ANTHROPIC_DEFAULT_MAX_OUTPUT_TOKENS,
-    modelMaxOutputTokens: { ...ANTHROPIC_MODEL_MAX_OUTPUT_TOKENS },
-    defaultModel: "claude-sonnet-5",
-    // Claude fast mode on the subscription lane (Claude Code `/fast`): the OAuth route accepts
-    // `speed` and gates it on account entitlement (usage credits / org enablement), probed live
-    // 2026-09-23 (devlog/_plan/260923_anthropic_fast_speed/020_probe-evidence.md).
-    // Off until the operator opts in: fast mode draws usage credits at 2x price.
-    fastWire: ANTHROPIC_FAST_WIRE,
-    modelSupportsServiceTier: { ...ANTHROPIC_FAST_MODELS },
-    fastTierDescription: ANTHROPIC_FAST_TIER_DESCRIPTION,
-    fastOptIn: true,
-  },
+  anthropicOAuthEntry("anthropic", "Anthropic Claude"),
+  anthropicOAuthEntry("anthropic2", "Anthropic · Pool 2"),
   {
     id: "anthropic-apikey",
     label: "Anthropic (API key)",

package/src/providers/registry/model-ids.ts

@@ -129,6 +129,7 @@ export const REGISTRY_FIELD_MODEL_ID_ROLES = {
   thinkingBudgetModels: NONE,
   escapeBuiltinToolNames: NONE,
   oauthId: NONE,
+  oauthFamily: NONE,
   virtualModels: RECORD_KEYS,
   modelMaxInputTokens: RECORD_KEYS,
   jawcodeBundle: NONE,

package/src/providers/registry/model-seeds.ts

@@ -12,8 +12,10 @@ import type { ProviderModelDiscoverySpec } from "./types";
 // 260929 Claude Sonnet 5.5 (`claude-sonnet-5-5`, released 2026-09-28): 1M context / 128K output /
 // adaptive thinking / effort low..max with a high default, same price as Sonnet 5, per the Sonnet 5.5
 // overview, migration guide, effort and pricing pages (platform.claude.com).
-export const ANTHROPIC_MODELS = ["claude-fable-5-1", "claude-fable-5", "claude-sonnet-5-5", "claude-sonnet-5", "claude-opus-5-5", "claude-opus-5", "claude-opus-4-8", "claude-opus-4-7", "claude-opus-4-6", "claude-sonnet-4-6", "claude-haiku-4-5"];
-export const ANTHROPIC_MODEL_CONTEXT_WINDOWS: Record<string, number> = { "claude-fable-5-1": 1_000_000, "claude-sonnet-5-5": 1_000_000, "claude-sonnet-5": 1_000_000, "claude-fable-5": 1_000_000, "claude-opus-5-5": 1_000_000, "claude-opus-5": 1_000_000, "claude-opus-4-8": 1_000_000, "claude-opus-4-7": 1_000_000, "claude-opus-4-6": 1_000_000, "claude-sonnet-4-6": 1_000_000, "claude-haiku-4-5": 200_000 };
+// 261008 Claude Haiku 5.5: 1M / 128K, adaptive thinking, effort low..max (default medium),
+// per platform.claude.com Haiku 5.5 overview, migration guide and pricing page.
+export const ANTHROPIC_MODELS = ["claude-fable-5-1", "claude-fable-5", "claude-sonnet-5-5", "claude-sonnet-5", "claude-opus-5-5", "claude-opus-5", "claude-opus-4-8", "claude-opus-4-7", "claude-opus-4-6", "claude-sonnet-4-6", "claude-haiku-5-5", "claude-haiku-4-5"];
+export const ANTHROPIC_MODEL_CONTEXT_WINDOWS: Record<string, number> = { "claude-fable-5-1": 1_000_000, "claude-sonnet-5-5": 1_000_000, "claude-sonnet-5": 1_000_000, "claude-fable-5": 1_000_000, "claude-opus-5-5": 1_000_000, "claude-opus-5": 1_000_000, "claude-opus-4-8": 1_000_000, "claude-opus-4-7": 1_000_000, "claude-opus-4-6": 1_000_000, "claude-sonnet-4-6": 1_000_000, "claude-haiku-5-5": 1_000_000, "claude-haiku-4-5": 200_000 };
 // All seeded Claude models support vision: https://platform.claude.com/docs/en/models/overview
 export const ANTHROPIC_MODEL_INPUT_MODALITIES: Record<string, string[]> = Object.fromEntries(
   ANTHROPIC_MODELS.map(id => [id, ["text", "image"]]),
@@ -40,6 +42,7 @@ export const ANTHROPIC_DEFAULT_MAX_OUTPUT_TOKENS = 64_000;
  * headroom arithmetic wrong.
  */
 export const ANTHROPIC_MODEL_MAX_OUTPUT_TOKENS: Record<string, number> = {
+  "claude-haiku-5-5": 128_000,
   "claude-fable-5-1": 128_000,
   "claude-fable-5": 128_000,
   "claude-sonnet-5-5": 128_000,
@@ -70,8 +73,8 @@ export const ANTHROPIC_MODEL_MAX_OUTPUT_TOKENS: Record<string, number> = {
  * do what it says:
  * - `minimal`: `adaptiveEffort` rewrites it to `low` (the adaptive wire 400s on it), so
  *   it is not a distinct setting.
- * - `none`: only sonnet >= 5 accepts an explicit thinking disable
- *   (`EXPLICIT_THINKING_DISABLE_FAMILY_MINIMUMS`); Fable rejects one outright.
+ * - `none`: thinking-off support differs by family (`anthropic-model-contract.ts`);
+ *   Haiku 5.5 accepts it without effort, while Fable rejects one outright.
  * - `ultra`: not an Anthropic concept, and it is degraded to `max` at the request
  *   boundary anyway (src/responses/parser.ts).
  */

package/src/providers/registry/types.ts

@@ -361,6 +361,8 @@ export interface ProviderRegistryEntry {
   thinkingBudgetModels?: string[];
   escapeBuiltinToolNames?: boolean;
   oauthId?: string;
+  /** OAuth implementation family; instance identity remains the exact id/oauthId. */
+  oauthFamily?: "anthropic";
   virtualModels?: Record<string, { wireModelId: string; reasoningMode: "pro" }>;
   modelMaxInputTokens?: Record<string, number>;
   jawcodeBundle?: string;
@@ -373,6 +375,7 @@ export interface ProviderRegistryEntry {
 
 export type ProviderConfigSeed = Pick<
   OcxProviderConfig,
+  "anthropicOAuthInstance" |
   "adapter" | "baseUrl" | "apiKeyTransport" | "responsesPath" | "chatCompletionsPath" | "authMode" | "keyOptional" | "freeTier" | "modelSuffixBracketStrip" | "defaultModel" | "models"
   | "liveModels" | "contextWindow" | "modelContextWindows" | "modelInputModalities"
   | "modelDisplayNames"

package/src/providers/registry.ts

@@ -7,7 +7,7 @@ import type {
 } from "./registry/types";
 import { PROVIDER_REGISTRY_CORE } from "./registry/entries-core";
 import { PROVIDER_REGISTRY_EXTENDED } from "./registry/entries-extended";
-
+import { anthropicInstanceRowShapeMatches } from "./anthropic-instance-id";
 export type {
   ProviderAuthKind,
   MetadataModelIdNormalize,
@@ -102,10 +102,11 @@ export function normalizedProviderEndpoint(value: string): string {
  */
 export function providerMatchesRegistryTransport(
   id: string,
-  provider: Pick<OcxProviderConfig, "baseUrl" | "adapter"> & Partial<Pick<OcxProviderConfig, "authMode">>,
+  provider: Pick<OcxProviderConfig, "baseUrl" | "adapter"> & Partial<Pick<OcxProviderConfig, "authMode" | "anthropicOAuthInstance">>,
 ): boolean {
   const entry = getProviderRegistryEntry(id);
   if (!entry) return false;
+  if (id === "anthropic2") return entry.authKind === "oauth" && entry.oauthId === id && entry.oauthFamily === "anthropic" && anthropicInstanceRowShapeMatches(id, provider);
   if (entry.authKind !== "key" || entry.preserveCustomDestination !== true) return true;
   // The opt-in is intentionally limited to fixed key destinations. Fail closed if a future
   // registry edit combines it with an override/template despite the registry parity tests.
@@ -115,7 +116,6 @@ export function providerMatchesRegistryTransport(
   if (provider.authMode !== undefined && provider.authMode !== "key") return false;
   return normalizedProviderEndpoint(provider.baseUrl) === normalizedProviderEndpoint(entry.baseUrl);
 }
-
 /**
  * Resolve the registry entry a configured provider actually points at, by TRANSPORT
  * rather than by name.

package/src/responses/reasoning-envelope.ts

@@ -36,6 +36,32 @@ export interface ReasoningEnvelope {
    * same way a signature does.
    */
   krc?: string;
+  /**
+   * A Responses provider's own `encrypted_content` for one reasoning item, minted while serving
+   * `model` (the client-facing model the Claude route was asked for). The Claude route has no
+   * other channel to hand a provider its reasoning back: the body is `store: false` and Claude
+   * Code replays only the thinking block. `src/claude/inbound.ts` restores it only for a request
+   * naming the same model, so a model switch cannot carry it to a provider that cannot decrypt it.
+   */
+  nat?: NativeReasoning;
+}
+
+export interface NativeReasoning {
+  /** The provider's opaque `encrypted_content`, verbatim. */
+  enc: string;
+  /** Client-facing model the item was produced for. */
+  model: string;
+  /** Route-bound HMAC for this exact ciphertext. */
+  tag: string;
+  /** The provider's reasoning item id, when it sent one. */
+  id?: string;
+}
+
+function decodeNativeReasoning(value: unknown): NativeReasoning | undefined {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return undefined;
+  const { enc, model, id, tag } = value as { enc?: unknown; model?: unknown; id?: unknown; tag?: unknown };
+  if (typeof enc !== "string" || enc.length === 0 || typeof model !== "string" || model.length === 0 || typeof tag !== "string" || tag.length === 0) return undefined;
+  return typeof id === "string" && id.length > 0 ? { enc, model, tag, id } : { enc, model, tag };
 }
 
 export function encodeReasoningEnvelope(envelope: ReasoningEnvelope, budget?: TranslatorBudget): string {
@@ -116,7 +142,9 @@ export function decodeReasoningEnvelope(encryptedContent: string, budget?: Trans
       if (hasTxt) envelope.txt = txt;
       const krc = (parsed as { krc?: unknown }).krc;
       if (typeof krc === "string" && krc.length > 0) envelope.krc = krc;
-      return envelope.sig || envelope.red || hasTxt || envelope.krc ? envelope : null;
+      const nat = decodeNativeReasoning((parsed as { nat?: unknown }).nat);
+      if (nat) envelope.nat = nat;
+      return envelope.sig || envelope.red || hasTxt || envelope.krc || envelope.nat ? envelope : null;
     } catch {
       return null;
     } finally {

package/src/responses/reasoning-replay-cache.ts

@@ -19,7 +19,8 @@
  * long-lived proxy cannot grow without limit.
  */
 
-import { createHash, createHmac, randomBytes } from "node:crypto";
+import { createHash, createHmac, randomBytes, timingSafeEqual } from "node:crypto";
+import { thoughtSignatureReplaySalt } from "./thought-signature-replay";
 import type {
   OcxProviderConfig,
   OcxReasoningReplayIdentity,
@@ -27,6 +28,21 @@ import type {
 } from "../types";
 
 const MAX_ENTRIES = 64;
+export interface NativeReasoningOwner { destination: string; credential: string }
+
+/** Bind exact ciphertext to the durable route that accepted it. */
+export function nativeReasoningTag(owner: NativeReasoningOwner | undefined, blob: string): string | undefined {
+  const salt = thoughtSignatureReplaySalt();
+  if (!owner || !salt || salt.length < 16 || blob.length === 0) return undefined;
+  return createHmac("sha256", salt).update("native-reasoning\0")
+    .update(JSON.stringify([owner.destination, owner.credential, createHash("sha256").update(blob).digest("hex")]))
+    .digest("hex");
+}
+
+export function nativeReasoningTagMatches(expected: string | undefined, presented: string | undefined): boolean {
+  if (!expected || !presented || !/^[a-f0-9]{64}$/.test(expected) || !/^[a-f0-9]{64}$/.test(presented)) return false;
+  return timingSafeEqual(Buffer.from(expected, "hex"), Buffer.from(presented, "hex"));
+}
 const MAX_TOTAL_BYTES = 256 * 1024;
 const TTL_MS = 60 * 60 * 1000;
 const OPAQUE_BLOB_REJECTION_TTL_MS = 5 * 60 * 1000;