@bitkyc08/opencodex 2.82.0 → 2.84.0

package/src/providers/anthropic-reset-admission.ts

@@ -0,0 +1,62 @@
+/**
+ * Put one Anthropic account back into the pool after a settled reset grant.
+ *
+ * A fresh usage read lifts a 429 quota cooldown whose rejected windows read
+ * open, whatever its deadline source (#6989), but a grant should not have to
+ * wait for one: the grant itself lifts admission, as far as its evidence goes:
+ *
+ * - `claimedAt` is when the operation was first journaled, before its first
+ *   claim was sent. A refusal recorded at or after it may already describe the
+ *   post-reset account (another request can be refused while the claim is in
+ *   flight), so it stays.
+ * - `cleared` is the window list the canonical settlement reported. The
+ *   cooldown is lifted only when those windows cover every window its refusal
+ *   named; an empty or partial list leaves it in place.
+ *
+ * Whatever the routing outcome (other than a newer refusal), the cached bars
+ * are dropped and usage is reread with its own request: joining a read that
+ * started before the grant could republish the pre-reset bars, and a fresh
+ * reading is what lets usage recovery release a cooldown the cleared
+ * list did not cover. The reread is best-effort; the grant is already spent.
+ *
+ * Model-family exclusions are not cleared here. Only that reread may release
+ * one, and only when its payload proves the family is no longer rejected.
+ */
+import { anthropicRoutingFor, type AnthropicQuotaWindow } from "../oauth/anthropic-routing";
+import type { AnthropicInstanceId } from "./anthropic-instance";
+import { fetchAnthropicAccountQuota } from "./quota/anthropic-account-quota";
+import { forgetCachedProviderAccountQuota } from "./quota/account-cache";
+import { anthropicCooldownRecoveryFor } from "./quota/anthropic-cooldown-recovery";
+
+export interface AnthropicResetAdmissionEvidence {
+  /** Journal time of the operation's first record, written before the first claim was sent. */
+  claimedAt: number;
+  /** Windows the canonical settlement reported cleared (reset-grant window names). */
+  cleared: readonly string[];
+}
+
+const QUOTA_WINDOW_FOR_RESET_WINDOW: Readonly<Record<string, AnthropicQuotaWindow>> = {
+  five_hour: "five-hour",
+  seven_day: "weekly",
+};
+
+export async function admitAnthropicAccountAfterReset(
+  instance: AnthropicInstanceId,
+  accountId: string,
+  evidence: AnthropicResetAdmissionEvidence,
+): Promise<void> {
+  const cleared = new Set<AnthropicQuotaWindow>();
+  for (const window of evidence.cleared) {
+    const quotaWindow = QUOTA_WINDOW_FOR_RESET_WINDOW[window];
+    if (quotaWindow) cleared.add(quotaWindow);
+  }
+  const outcome = anthropicRoutingFor(instance).clearAnthropicAccountCooldownForReset(accountId, evidence.claimedAt, cleared);
+  if (outcome === "newer") return;
+  // Move any usage read that started before the grant onto a stale generation
+  // before dropping the cached row, so it cannot republish the pre-reset bars.
+  // "cleared" and "uncovered" already advanced the generation in routing (an
+  // uncovered entry moved with it, so the reread below can still recover it).
+  if (outcome === "absent") anthropicCooldownRecoveryFor(instance).noteAnthropicCooldownMutation(accountId);
+  forgetCachedProviderAccountQuota(instance, accountId);
+  await fetchAnthropicAccountQuota(instance, accountId, true, undefined, true);
+}

package/src/providers/anthropic-reset-grant-ledger.ts

@@ -7,7 +7,7 @@
  * ten minutes (`b5o = 600000`) and mints a new one afterwards; this journal keeps
  * the same window.
  *
- * Rules (devlog/_plan/260923_claude_reset_grants/010_plan.md, "Ledger contract"):
+ * Rules (devlog/_fin/260923_claude_reset_grants/010_plan.md, "Ledger contract"):
  * - Every read-modify-write runs synchronously inside a cross-process
  *   `BEGIN IMMEDIATE` lock on a sibling SQLite file; nothing awaits inside it,
  *   and the upstream claim always runs after the open record is on disk.
@@ -44,6 +44,8 @@ interface OperationRecord {
   status: "open" | "settled";
   code?: string;
   resetsLeft?: number | null;
+  /** Windows the settled claim reported cleared; absent on records written before this field. */
+  cleared?: string[];
   attempts: number;
   leaseUntil: number;
   createdAt: number;
@@ -64,7 +66,7 @@ export interface AnthropicResetOperationIdentity {
 
 export type AnthropicResetBegin =
   | { kind: "execute"; attempt: number }
-  | { kind: "replay"; code: string; resetsLeft: number | null; settledAt: number }
+  | { kind: "replay"; code: string; resetsLeft: number | null; settledAt: number; claimedAt: number; cleared: string[] }
   | { kind: "identity-mismatch" }
   | { kind: "in-flight" }
   | { kind: "expired" }
@@ -102,7 +104,9 @@ function isRecordShape(value: unknown): value is OperationRecord {
   return typeof record.accountId === "string" && typeof record.grantId === "string"
     && typeof record.orgDigest === "string" && (record.status === "open" || record.status === "settled")
     && typeof record.attempts === "number" && typeof record.leaseUntil === "number"
-    && typeof record.createdAt === "number" && typeof record.updatedAt === "number";
+    && typeof record.createdAt === "number" && typeof record.updatedAt === "number"
+    && (record.cleared === undefined
+      || Array.isArray(record.cleared) && record.cleared.every(window => typeof window === "string"));
 }
 
 /** Missing file → empty journal. Present but unreadable → throws; never an empty fallback. */
@@ -197,7 +201,10 @@ export function beginAnthropicResetOperation(
         return { kind: "identity-mismatch" };
       }
       if (existing.status === "settled") {
-        return { kind: "replay", code: existing.code ?? "unavailable", resetsLeft: existing.resetsLeft ?? null, settledAt: existing.updatedAt };
+        return {
+          kind: "replay", code: existing.code ?? "unavailable", resetsLeft: existing.resetsLeft ?? null,
+          settledAt: existing.updatedAt, claimedAt: existing.createdAt, cleared: existing.cleared ?? [],
+        };
       }
       if (existing.leaseUntil > now) return { kind: "in-flight" };
       if (now - existing.createdAt >= ANTHROPIC_RESET_RETRY_WINDOW_MS) return { kind: "expired" };
@@ -232,6 +239,12 @@ export function beginAnthropicResetOperation(
 export interface AnthropicResetSettlement {
   code: string;
   resetsLeft: number | null;
+  /** When the canonical (first) settlement was journaled, not when this caller arrived. */
+  settledAt: number;
+  /** When the operation was first journaled, before its first claim was sent. */
+  claimedAt: number;
+  /** Windows the canonical settlement reported cleared. */
+  cleared: string[];
 }
 
 /**
@@ -241,7 +254,7 @@ export interface AnthropicResetSettlement {
  * throws, because an answer with no journal entry cannot be reported as durable.
  */
 export function settleAnthropicResetOperation(
-  settlement: { operationId: string; code: string; resetsLeft: number | null },
+  settlement: { operationId: string; code: string; resetsLeft: number | null; cleared?: readonly string[] },
   options: AnthropicResetLedgerOptions = {},
 ): AnthropicResetSettlement {
   const now = options.now ?? Date.now();
@@ -250,14 +263,23 @@ export function settleAnthropicResetOperation(
     const journal = readJournal(filePath);
     const existing = journal.operations[settlement.operationId];
     if (!existing) throw new AnthropicResetLedgerError("unavailable");
-    if (existing.status === "settled") return { code: existing.code ?? "unavailable", resetsLeft: existing.resetsLeft ?? null };
+    if (existing.status === "settled") {
+      return {
+        code: existing.code ?? "unavailable", resetsLeft: existing.resetsLeft ?? null,
+        settledAt: existing.updatedAt, claimedAt: existing.createdAt, cleared: existing.cleared ?? [],
+      };
+    }
     existing.status = "settled";
     existing.code = settlement.code;
     existing.resetsLeft = settlement.resetsLeft;
+    existing.cleared = [...(settlement.cleared ?? [])];
     existing.leaseUntil = 0;
     existing.updatedAt = now;
     writeJournal(filePath, journal, now);
-    return { code: settlement.code, resetsLeft: settlement.resetsLeft };
+    return {
+      code: settlement.code, resetsLeft: settlement.resetsLeft, settledAt: now,
+      claimedAt: existing.createdAt, cleared: [...existing.cleared],
+    };
   });
 }
 

package/src/providers/api-key-resolve.ts

@@ -39,17 +39,25 @@ function defaultEntryFactory(service: string, account: string): ProviderKeychain
 let entryFactory: ProviderKeychainEntryFactory = defaultEntryFactory;
 const resolvedCache = new Map<string, string>();
 const warnedAccounts = new Set<string>();
+let resolutionGeneration = 0;
+
+/** Advances whenever cached secrets may have changed, so derived snapshots can rebuild. */
+export function providerKeyResolutionGeneration(): number {
+  return resolutionGeneration;
+}
 
 /** Test seam: swap the OS entry for an in-memory one and drop caches. */
 export function setProviderKeychainEntryFactoryForTests(factory: ProviderKeychainEntryFactory | null): void {
   entryFactory = factory ?? defaultEntryFactory;
   resolvedCache.clear();
+  resolutionGeneration++;
   warnedAccounts.clear();
 }
 
 /** Write-path seam: a store/restore mutated secrets, so cached reads and warnings are stale. */
 export function invalidateResolvedProviderKeyCache(): void {
   resolvedCache.clear();
+  resolutionGeneration++;
   warnedAccounts.clear();
 }
 
@@ -76,7 +84,7 @@ export function providerKeychainEntry(account: string): ProviderKeychainEntry {
   return entryFactory(PROVIDER_KEYCHAIN_SERVICE, account);
 }
 
-function readKeychain(account: string): string | undefined {
+function readKeychain(account: string, quiet = false): string | undefined {
   const cached = resolvedCache.get(account);
   if (cached !== undefined) return cached;
   try {
@@ -88,7 +96,7 @@ function readKeychain(account: string): string | undefined {
   } catch {
     // fall through to the single warning below
   }
-  if (!warnedAccounts.has(account)) {
+  if (!quiet && !warnedAccounts.has(account)) {
     warnedAccounts.add(account);
     console.warn(`[opencodex] provider key reference keychain:${account} could not be read from the OS keychain; requests for this provider have no credential until the keychain is available (no plaintext fallback)`);
   }
@@ -105,6 +113,13 @@ export function resolveProviderApiKey(value: string | undefined): string | undef
   return resolveEnvValue(value);
 }
 
+/** The same resolution without the unreadable-reference warning, for observe-only callers. */
+export function resolveProviderApiKeyQuietly(value: string | undefined): string | undefined {
+  if (!value) return undefined;
+  if (isKeychainReference(value)) return readKeychain(keychainAccount(value), true);
+  return resolveEnvValue(value);
+}
+
 export type ProviderKeyStoreKind = "keychain" | "env" | "file" | "none";
 
 export function providerKeyStoreKind(provider: Pick<OcxProviderConfig, "apiKey"> | undefined): ProviderKeyStoreKind {

package/src/providers/devin-cli-authmode-migration.ts

@@ -4,7 +4,7 @@
  * `devin-cli` used to be a local provider whose adapter spawned `devin acp`;
  * it later became an account provider on the shared `devin` adapter, and the
  * registry id itself has since merged into `devin` outright
- * (devlog/_plan/260913_devin_provider_merge).
+ * (devlog/_fin/260913_devin_provider_merge).
  *
  * Only the adapter repair still lives here. The `authMode` half — rewriting
  * `"local"` to `"oauth"` on the registry-id row — moved into

package/src/providers/devin-provider-merge-migration.ts

@@ -1,6 +1,6 @@
 /**
  * Merge the retired `devin-cli` provider id into `devin` at startup
- * (devlog/_plan/260913_devin_provider_merge).
+ * (devlog/_fin/260913_devin_provider_merge).
  *
  * The two registry entries were the same adapter, api-server, and credential
  * shape — only the login path differed — so `devin-cli` was removed from the

package/src/providers/github-copilot-auto.ts

@@ -0,0 +1,169 @@
+import { createHash } from "node:crypto";
+import type { OcxParsedRequest, OcxProviderConfig } from "../types";
+import { readBoundedResponseBody } from "../lib/bounded-body";
+import { ProviderOutboundSendCancelledError, providerOutboundGet, providerOutboundPost } from "../lib/provider-outbound";
+import { githubCopilotHttpError, resolveCopilotApiBaseUrl } from "../oauth/github-copilot";
+import { resolveGithubCopilotTransport } from "./github-copilot-transport";
+import { waitForProviderRequestSlot, releaseProviderRequestSlot } from "./request-pacing";
+
+export interface CopilotModel {
+  id: string;
+  model_picker_enabled?: boolean;
+  supported_endpoints?: string[];
+  [key: string]: unknown;
+}
+const catalogs = new Map<string, { expires: number; models: CopilotModel[] }>();
+const MAX_MODELS = 512;
+const MAX_RESPONSE_BYTES = 1_048_576;
+export class CopilotAutoHttpError extends Error {
+  /** Preserve only the upstream status and bounded retry delay; never retain response bodies. */
+  constructor(readonly status: number, readonly retryAfter?: string) {
+    super(githubCopilotHttpError("Auto negotiation", status).message);
+  }
+}
+/** Reject array/scalar payloads before interpreting negotiation objects. */
+function record(value: unknown): Record<string, unknown> | undefined {
+  return value !== null && typeof value === "object" && !Array.isArray(value)
+    ? value as Record<string, unknown> : undefined;
+}
+/** Accept a bounded, homogeneous list so malformed pools cannot grant routing eligibility. */
+function strings(value: unknown): string[] {
+  return Array.isArray(value) && value.length <= MAX_MODELS
+    && value.every(/** Require every pool entry to be a bounded nonempty string before it can authorize model selection. */
+      v => typeof v === "string" && v.length > 0 && v.length <= 256)
+    ? value as string[] : [];
+}
+/** Isolate discovery caches by endpoint and credential without storing plaintext cache keys. */
+function authority(provider: OcxProviderConfig): string {
+  return createHash("sha256").update(JSON.stringify([provider.baseUrl, provider.apiKey])).digest("hex");
+}
+/** Make one paced, origin-fenced negotiation send with bounded decoding and secret-safe errors. */
+async function requestJson(provider: OcxProviderConfig, path: string, signal?: AbortSignal, body?: unknown,
+  sessionToken?: string, beforeSend?: () => boolean, concurrency = true): Promise<Record<string, unknown>> {
+  const boundedSignal = signal ? AbortSignal.any([signal, AbortSignal.timeout(8_000)]) : AbortSignal.timeout(8_000);
+  boundedSignal.throwIfAborted();
+  const headers = new Headers(provider.headers);
+  headers.set("Authorization", `Bearer ${provider.apiKey}`);
+  headers.set("X-GitHub-Api-Version", "2026-08-01");
+  headers.set("Content-Type", "application/json");
+  headers.delete("Copilot-Session-Token");
+  if (sessionToken) headers.set("Copilot-Session-Token", sessionToken);
+  const url = `${provider.baseUrl}${path}`;
+  // Queued-dispatch rebuilding can already own a provider concurrency lease; that
+  // caller opts out of taking a second lease while retaining interval pacing.
+  const slot = await waitForProviderRequestSlot("github-copilot", provider, "auto", boundedSignal, { concurrency });
+  try {
+    const init = { headers, signal: boundedSignal };
+    const response = body === undefined
+      ? await providerOutboundGet("github-copilot", provider, url, init, { beforeSend })
+      : await providerOutboundPost("github-copilot", provider, url, { ...init, body: JSON.stringify(body) }, { beforeSend });
+    // Status-only failures: session endpoints can echo secret material in their bodies.
+    if (!response.ok) {
+      void response.body?.cancel().catch(/** Ignore cleanup failures after discarding a refusal body that may contain reflected credentials. */
+        () => undefined);
+      const retry = response.headers.get("retry-after");
+      throw new CopilotAutoHttpError(response.status, retry && /^\d{1,4}$/.test(retry)
+        ? String(Math.max(1, Math.min(3600, Number(retry)))) : undefined);
+    }
+    const bounded = await readBoundedResponseBody(response, { maxBytes: MAX_RESPONSE_BYTES,
+      signal: boundedSignal, totalTimeoutMs: 8_000, fatalUtf8: true });
+    if (bounded.truncated) throw new Error("GitHub Copilot Auto negotiation returned an incomplete response");
+    let value: unknown;
+    try { value = JSON.parse(bounded.text); } catch { /* never include raw bodies */ }
+    const payload = record(value);
+    if (!payload) throw new Error("GitHub Copilot Auto negotiation returned invalid JSON");
+    return payload;
+  } catch (error) {
+    if (error instanceof CopilotAutoHttpError || error instanceof ProviderOutboundSendCancelledError) throw error;
+    // Transport/decoder exception messages may contain reflected header values.
+    throw new Error(boundedSignal.aborted ? "GitHub Copilot Auto negotiation cancelled"
+      : "GitHub Copilot Auto negotiation transport failed");
+  } finally { releaseProviderRequestSlot(slot); }
+}
+
+/** Detect Auto-only permission only when every row explicitly denies named selection. */
+export function copilotRequiresAuto(_provider: OcxProviderConfig, models: CopilotModel[]): boolean {
+  return models.length > 0 && models.every(/** Missing or malformed metadata cannot establish an account-wide picker denial. */
+    model => model.model_picker_enabled === false);
+}
+/** Retain legacy rows with unknown permissions; only an explicit denial removes a named picker row. */
+export function copilotPickerModels(provider: OcxProviderConfig, models: CopilotModel[]): CopilotModel[] {
+  if (copilotRequiresAuto(provider, models)) return [{ id: "auto" }];
+  return models.filter(/** Preserve named selection unless the provider explicitly marks the row unavailable. */
+    model => model.model_picker_enabled !== false);
+}
+/** Read the credential-bound catalog; callers may disable caching or reuse an existing lease. */
+export async function fetchCopilotAutoModels(provider: OcxProviderConfig, signal?: AbortSignal,
+  beforeSend?: () => boolean, cacheTtlMs = 60_000, concurrency = true): Promise<CopilotModel[]> {
+  const key = authority(provider);
+  const cached = catalogs.get(key);
+  if (cacheTtlMs > 0 && cached && cached.expires > Date.now()) return cached.models;
+  const payload = await requestJson(provider, "/models", signal, undefined, undefined, beforeSend, concurrency);
+  if (!Array.isArray(payload.data) || payload.data.length > MAX_MODELS)
+    throw new Error("GitHub Copilot model discovery returned an invalid catalog");
+  const models = payload.data.flatMap(/** Discard malformed catalog rows while retaining metadata for bounded model identifiers. */
+    value => {
+    const row = record(value);
+    if (!row || typeof row.id !== "string" || !row.id || row.id.length > 256) return [];
+    return [{ ...row, id: row.id } as CopilotModel];
+  });
+  if (cacheTtlMs > 0) {
+    if (!catalogs.has(key) && catalogs.size >= 32) catalogs.delete(catalogs.keys().next().value!);
+    catalogs.set(key, { expires: Date.now() + Math.min(cacheTtlMs, 60_000), models });
+  }
+  return models;
+}
+/** Reset discovery state between isolated account/permission regression cases. */
+export function clearCopilotAutoModelsForTests(): void { catalogs.clear(); }
+
+/** Resolve before adapter construction: the server can choose either wire on every turn. */
+export async function resolveCopilotAuto(provider: OcxProviderConfig, requestedModel: string,
+  parsed: OcxParsedRequest, signal?: AbortSignal, beforeSend?: () => boolean, concurrency = true): Promise<{
+    provider: OcxProviderConfig; modelId: string; auto: boolean; expiresAt?: number;
+  }> {
+  const transport = resolveGithubCopilotTransport(provider, provider.authMode === "oauth"
+    ? resolveCopilotApiBaseUrl(provider.baseUrl) : undefined);
+  // Never inherit a session token from a previous account or persist it in config.
+  const cleanHeaders = new Headers(transport.headers);
+  cleanHeaders.delete("Copilot-Session-Token");
+  transport.headers = Object.fromEntries(cleanHeaders);
+  let models: CopilotModel[];
+  try { models = await fetchCopilotAutoModels(transport, signal, beforeSend, 60_000, concurrency); }
+  catch (error) {
+    if (signal?.aborted || error instanceof ProviderOutboundSendCancelledError) throw error;
+    // Permission discovery is additive for legacy paid configurations. A temporary
+    // discovery outage must not turn a previously usable named route into a refusal.
+    return { provider: transport, modelId: requestedModel, auto: false };
+  }
+  if (!copilotRequiresAuto(provider, models))
+    return { provider: transport, modelId: requestedModel, auto: false };
+  const session = await requestJson(transport, "/models/session", signal,
+    { auto_mode: { model_hints: ["auto"] } }, undefined, beforeSend, concurrency);
+  const pool = strings(session.available_models);
+  if (typeof session.session_token !== "string" || !session.session_token || session.session_token.length > 32_768 || !/^[\x21-\x7e]+$/.test(session.session_token) || !pool.length)
+    throw new Error("GitHub Copilot Auto session omitted its routing credentials");
+  if (session.expires_at !== undefined && (typeof session.expires_at !== "number" || !Number.isFinite(session.expires_at)))
+    throw new Error("GitHub Copilot Auto session returned an invalid expiry");
+  const expiresAt = typeof session.expires_at === "number" && Number.isFinite(session.expires_at)
+    ? session.expires_at * 1000 : Date.now() + 60_000;
+  if (!Number.isFinite(expiresAt) || expiresAt <= Date.now() + 1000) throw new Error("GitHub Copilot Auto session is already expired");
+  const lastUser = [...parsed.context.messages].reverse().find(/** Find the newest user turn as the intent-routing source instead of replaying earlier conversation text. */
+    message => message.role === "user");
+  const prompt = lastUser?.role === "user"
+    ? typeof lastUser.content === "string" ? lastUser.content : lastUser.content.flatMap(/** Extract text parts for intent negotiation without forwarding image or other multimodal payloads. */
+      part => part.type === "text" ? [part.text] : []).join("\n")
+    : "";
+  const intent = await requestJson(transport, "/models/session/intent", signal,
+    { prompt: prompt.slice(0, 32_768), available_models: pool }, session.session_token, beforeSend, concurrency);
+  const modelId = strings(intent.candidate_models).find(/** Choose the first server-ranked candidate that belongs to this credential-bound session pool. */
+    candidate => pool.includes(candidate));
+  if (!modelId) throw new Error("GitHub Copilot Auto intent returned no eligible model");
+  const endpoints = strings(models.find(/** Read endpoint capabilities for the selected model before choosing its inference adapter. */
+    model => model.id === modelId)?.supported_endpoints);
+  const adapter = endpoints.includes("/responses") ? "openai-responses"
+    : endpoints.includes("/chat/completions") ? "openai-chat" : undefined;
+  if (!adapter) throw new Error("GitHub Copilot Auto selected a model with no supported inference endpoint");
+  return { auto: true, modelId, expiresAt: Math.min(expiresAt, Date.now() + 60_000), provider: { ...transport, adapter,
+    ...(adapter === "openai-responses" ? { responsesPath: "/responses" } : { chatCompletionsPath: "/chat/completions" }),
+    headers: { ...transport.headers, "X-GitHub-Api-Version": "2026-08-01", "Copilot-Session-Token": session.session_token } } };
+}

package/src/providers/key-failover.ts

@@ -8,7 +8,7 @@
  *
  * Modelled after src/codex/routing.ts cooldown logic but scoped to plain API-key pools.
  */
-import { commitProviderApiKeySelection } from "./api-key-selection";
+import { commitProviderApiKeySelection, providerApiKeySelectionIsCurrent } from "./api-key-selection";
 import type { ProviderApiKeySelection } from "../types/provider";
 import { routedProviderConfig } from "../router";
 import { getProviderRegistryEntry } from "./registry";
@@ -30,6 +30,16 @@ interface KeyCooldown {
 
 const DEFAULT_COOLDOWN_MS = 60_000;
 const MAX_COOLDOWN_MS = 10 * 60_000; // cap at 10 min for api-key rotation
+/**
+ * Anthropic credit-balance refusal (#6958). An empty prepaid balance is account state, not a
+ * rate signal: it clears only when someone buys credits or auto-reload fires, so the
+ * ten-minute credential cap would hand a dead key back to rotation six times an hour. One hour
+ * keeps it out of replacement and proactive selection while a funded sibling exists, and still
+ * notices a top-up without a restart. When every key is held, requests keep using the active
+ * key and return Anthropic's original refusal. The hold is in memory; dashboard key management
+ * clears it.
+ */
+export const ANTHROPIC_BILLING_COOLDOWN_MS = 60 * 60_000;
 
 /**
  * Cap for a cooldown the upstream itself dated, as opposed to one we inferred.
@@ -688,12 +698,13 @@ export function rateLimitRetryDelayMs(
 function rotateKeyAfterFailure(
   config: OcxConfig,
   providerName: string,
-  failureStatus: 401 | 429,
+  failureStatus: 401 | 429 | "billing",
   retryAfterHeader: string | null | undefined,
   now = Date.now(),
   attemptedKey?: string,
   attemptedSelection?: ProviderApiKeySelection,
   quotaResetAt?: number,
+  acceptsFreshProvider?: (provider: OcxProviderConfig) => boolean,
 ): OcxProviderConfig | null {
   const provider = config.providers[providerName];
   if (!provider) return null;
@@ -704,6 +715,11 @@ function rotateKeyAfterFailure(
     | { failedId?: string; candidateId?: string }
     | { exhaustedCount: number; failedId?: string };
   const outcome = commitProviderApiKeySelection<Rotation | null>(config, providerName, freshProvider => {
+    // Run on every persisted transaction attempt, including a freshness rebase.
+    if (acceptsFreshProvider) {
+      try { if (!acceptsFreshProvider(freshProvider)) return { changed: false, value: null }; }
+      catch { return { changed: false, value: null }; }
+    }
     const pool = freshProvider.apiKeyPool;
     if (!pool || pool.length < 2) return { changed: false, value: null };
 
@@ -741,6 +757,8 @@ function rotateKeyAfterFailure(
   }, attemptedSelection);
   if (outcome.status === "unavailable") return null;
   if (outcome.status === "superseded") {
+    // Billing authority is bound to the sent selection; a newer manual choice grants no replay.
+    if (acceptsFreshProvider) return null;
     // A newer manual selection (including A→B→A) owns subsequent dispatch. Reusing the
     // same failed key here would loop forever; preserve its original failure instead.
     return outcome.provider.apiKey !== failedKey ? structuredClone(outcome.provider) : null;
@@ -750,7 +768,9 @@ function rotateKeyAfterFailure(
     // A 401 is a verdict about the credential itself, not a timing signal: the key is rejected
     // until an operator replaces it, and upstreams send no Retry-After for it. Hold it for the
     // full cap instead of the 429 default so a dead key is not re-tried once a minute.
-    const cooldownMs = failureStatus === 401
+    const cooldownMs = failureStatus === "billing"
+      ? ANTHROPIC_BILLING_COOLDOWN_MS
+      : failureStatus === 401
       ? MAX_COOLDOWN_MS
       // A reset instant the upstream dated outranks both the header and the
       // default: it is the only one of the three that knows when the quota
@@ -762,7 +782,7 @@ function rotateKeyAfterFailure(
     sweepExpiredOnWrite(now);
   }
   if ("exhaustedCount" in outcome.value) {
-    console.warn(`[key-failover] ${providerName}: all ${outcome.value.exhaustedCount} keys in cooldown after ${failureStatus}; returning the upstream status to the client`);
+    console.warn(`[key-failover] ${providerName}: all ${outcome.value.exhaustedCount} keys in cooldown after ${failureLabel(failureStatus)}; returning the upstream status to the client`);
     return null;
   }
 
@@ -771,12 +791,16 @@ function rotateKeyAfterFailure(
   if (outcome.value.candidateId) {
     console.warn(
       // Log ids only — labels are user-supplied free text and could carry secret material.
-      `[key-failover] ${providerName}: ${failureStatus} on key ${outcome.value.failedId ?? "?"}; rotating to key ${outcome.value.candidateId}`,
+      `[key-failover] ${providerName}: ${failureLabel(failureStatus)} on key ${outcome.value.failedId ?? "?"}; rotating to key ${outcome.value.candidateId}`,
     );
   }
   return structuredClone(committed);
 }
 
+function failureLabel(failureStatus: 401 | 429 | "billing"): string {
+  return failureStatus === "billing" ? "credit-balance refusal" : String(failureStatus);
+}
+
 export function rotateKeyOn429(
   config: OcxConfig,
   providerName: string,
@@ -865,6 +889,29 @@ export function rotateProviderTransportOn401(
   return applyRotatedTransport(providerName, routedProvider, rotated, options.promptCacheKey);
 }
 
+/** Exact Anthropic billing refusal: cool the key for ANTHROPIC_BILLING_COOLDOWN_MS. */
+export function rotateProviderTransportOnAnthropicBilling(
+  config: OcxConfig,
+  providerName: string,
+  routedProvider: OcxProviderTransport,
+  options: Omit<RotateProviderTransportOptions, "retryAfter"> = {},
+): OcxProviderTransport | null {
+  if (routedProvider.adapter !== "anthropic"
+    || (routedProvider.authMode !== undefined && routedProvider.authMode !== "key")
+    || !hasKeyPoolFailover(routedProvider)) return null;
+  const headerShape = (provider: OcxProviderConfig) => JSON.stringify(Object.entries(provider.headers ?? {}).sort(([a], [b]) => a.localeCompare(b)));
+  const sentHeaders = headerShape(routedProvider);
+  const acceptsFreshProvider = (fresh: OcxProviderConfig): boolean => fresh.adapter === routedProvider.adapter
+    && (fresh.authMode === undefined || fresh.authMode === "key") && hasKeyPoolFailover(fresh)
+    && (fresh.apiKeyTransport ?? "x-api-key") === (routedProvider.apiKeyTransport ?? "x-api-key")
+    && headerShape(fresh) === sentHeaders
+    && providerApiKeySelectionIsCurrent({ ...config, providers: { ...config.providers, [providerName]: fresh } },
+      providerName, routedProvider);
+  const rotated = rotateKeyAfterFailure(config, providerName, "billing", null, options.now,
+    options.attemptedKey, options.attemptedSelection ?? routedProvider._apiKeyAttempt, undefined, acceptsFreshProvider);
+  return rotated ? applyRotatedTransport(providerName, routedProvider, rotated, options.promptCacheKey) : null;
+}
+
 function applyRotatedTransport(
   providerName: string,
   routedProvider: OcxProviderTransport,

package/src/providers/model-presets.ts

@@ -12,7 +12,7 @@
  * The preset is a SEED, not a lock. Materialization evaluates these rules against the provider's
  * current catalog and stores CONCRETE ids in `selectedModels`, so the visibility hot path
  * (`filterCatalogVisibleModels`) never learns about patterns and an older binary still sees a
- * plain allowlist. Design: devlog/_plan/260824_model_ux_aliases_and_defaults/030_default_preset.md
+ * plain allowlist. Design: devlog/_fin/260824_model_ux_aliases_and_defaults/030_default_preset.md
  */
 
 import type { OcxProviderConfig } from "../types";

package/src/providers/model-rename-startup.ts

@@ -3,6 +3,7 @@ import { projectModelRenames } from "./model-rename-migration";
 import { projectStaleContextWindows } from "./stale-context-window-migration";
 import { projectStaleModelRosters } from "./stale-model-roster-migration";
 import { projectStaleVisionClassifications } from "./stale-vision-classification-migration";
+import { projectStaleNoVisionSeeds } from "./stale-no-vision-seed-migration";
 import { projectDevinCliAuthMode } from "./devin-cli-authmode-migration";
 import type { OcxConfig } from "../types";
 
@@ -17,12 +18,13 @@ export function projectStartupConfigRepairs(config: OcxConfig): ReturnType<typeo
   const renames = projectModelRenames(config);
   const windows = projectStaleContextWindows(renames.config);
   const vision = projectStaleVisionClassifications(windows.config);
-  const rosters = projectStaleModelRosters(vision.config);
+  const noVision = projectStaleNoVisionSeeds(vision.config);
+  const rosters = projectStaleModelRosters(noVision.config);
   const devinCli = projectDevinCliAuthMode(rosters.config);
   return {
     config: devinCli.config,
-    changed: renames.changed || windows.changed || vision.changed || rosters.changed || devinCli.changed,
-    warnings: [...renames.warnings, ...windows.warnings, ...vision.warnings, ...rosters.warnings, ...devinCli.warnings],
+    changed: renames.changed || windows.changed || vision.changed || noVision.changed || rosters.changed || devinCli.changed,
+    warnings: [...renames.warnings, ...windows.warnings, ...vision.warnings, ...noVision.warnings, ...rosters.warnings, ...devinCli.warnings],
   };
 }
 

package/src/providers/muse-subscription-usage.ts

@@ -99,7 +99,7 @@ export function museUsageWindowsToQuota(usage: unknown): ProviderQuota | null {
  *
  * Kept as a thin adapter over the shared mapper: the frame nests the same two windows
  * under `subscription`, the muse-code/key response nests them under `subs_usage`
- * (devlog/_plan/260912_muse_device_oauth/001 C). Two parsers would drift, and the
+ * (devlog/_fin/260912_muse_device_oauth/001 C). Two parsers would drift, and the
  * five-hour-window discrimination above is the part that must not.
  */
 export function parseMuseSubscriptionUsage(payload: unknown): ProviderQuota | null {

package/src/providers/quota/account-cache.ts

@@ -473,6 +473,17 @@ export function clearAccountQuotaCache(provider?: string): void {
   persistAccountQuotaCache();
 }
 
+/** Drop one account's cached bars and any joined probe so a reset is not ranked from the old window. */
+export function forgetCachedProviderAccountQuota(provider: string, accountId: string): void {
+  hydrateAccountQuotaCache();
+  const key = accountCacheKey(provider, accountId);
+  accountQuotaCache.delete(key);
+  for (const flight of [...accountQuotaInflight.keys()]) {
+    if (flight === key || flight.startsWith(key + "\u0000")) accountQuotaInflight.delete(flight);
+  }
+  persistAccountQuotaCache();
+}
+
 /**
  * Resolve a bearer for quota probing without silently adopting a newer global
  * Claude CLI credential into a background multiauth slot.

package/src/providers/quota/anthropic-account-quota.ts

@@ -20,6 +20,8 @@ import {
  */
 export async function fetchAnthropicAccountQuota(
   instance: AnthropicInstanceId, accountId: string, force: boolean, config: OcxConfig = loadConfig(),
+  /** Never join an older account or vendor flight; a reset reread needs post-grant evidence. */
+  freshDispatch = false,
 ): Promise<AccountQuotaCacheEntry> {
   const unavailable = (): AccountQuotaCacheEntry => ({ ts: Date.now(), quota: null, unavailable: true });
   const target = config.providers[instance];
@@ -52,7 +54,7 @@ export async function fetchAnthropicAccountQuota(
   const flightKey = recovery.anthropicCredentialQuotaFlightKey(key, accountId);
   const flightCurrent = () => ownerCurrent()
     && recovery.anthropicCredentialQuotaFlightKey(key, accountId) === flightKey;
-  const joinable = accountQuotaInflight.get(flightKey);
+  const joinable = freshDispatch ? undefined : accountQuotaInflight.get(flightKey);
   if (joinable) {
     const joined = await joinable;
     return ownerCurrent() && (joined.isCurrent?.() ?? flightCurrent()) ? joined : unavailable();
@@ -78,7 +80,7 @@ export async function fetchAnthropicAccountQuota(
       const result = await recovery.probeAnthropicQuotaWithRecovery(accountId, token, fresh => {
         if (!flightCurrent()) throw new AnthropicQuotaProbeOwnershipError("quota flight changed");
         recovery.assertAnthropicQuotaSendAllowed(accountId, token);
-        return fetchAnthropicUsageQuotaForInstance(instance, token, fresh);
+        return fetchAnthropicUsageQuotaForInstance(instance, token, fresh || freshDispatch);
       }, () => ownerCurrent() && mayCommitAccountQuotaKey(key, writerGeneration));
       if (result && !result.isCurrent()) return unavailable();
       if (!result && !flightCurrent()) return unavailable();

package/src/providers/quota/report-cache.ts

@@ -344,3 +344,17 @@ export function isProviderQuotaReportCurrent(value: ProviderQuotaReport): boolea
   return (generation === undefined || isMainAccountIdentityGenerationLive(generation))
     && (accountReportCurrent.get(value)?.() ?? true);
 }
+
+/**
+ * The reports this process already holds for the configured providers, for a passive read (#6959):
+ * no probe, token refresh, account snapshot or publication into routing evidence. The Home's own
+ * dashboard and traffic keep the cache current.
+ */
+export function heldProviderQuotaReports(configuredProviders: readonly string[]): ProviderQuotaResponse {
+  const held = getProviderQuotaReportCache()?.response;
+  const configured = new Set(configuredProviders);
+  return {
+    generatedAt: held?.generatedAt ?? Date.now(),
+    reports: (held?.reports ?? []).filter(item => configured.has(item.provider) && isProviderQuotaReportCurrent(item)),
+  };
+}