@bitkyc08/opencodex 2.83.0 → 2.86.0

package/src/oauth/anthropic-routing.ts

@@ -72,10 +72,25 @@ export type { AnthropicAccountPoolConfig } from "../types/anthropic-account-pool
 
 /** Local admission refusal across async dispatch; never treat it as provider reachability evidence. */
 export class AnthropicAccountCooldownError extends Error {
-  constructor(readonly retryAfterSeconds: number | null, readonly routePosition?: number) {
-    super(routePosition === undefined
-      ? "All Anthropic OAuth accounts are temporarily rate-limited"
-      : "Anthropic OAuth accounts for this model route are temporarily rate-limited");
+  /** The retryable wording, kept unchanged for combo children: combo failover classifies by prose too. */
+  readonly retryableMessage: string;
+  constructor(
+    readonly retryAfterSeconds: number | null,
+    readonly routePosition?: number,
+    /**
+     * Set only when no account the route can use is admissible and every held one is out on
+     * spent quota (#6991). `resetsAt` is the earliest upstream window reset among them (epoch
+     * ms), or null when any held account's reset is unknown. Null overall means at least one hold
+     * is a transient throttle or an entitlement refusal, which a client retry may outlast.
+     */
+    readonly usageLimit: { readonly resetsAt: number | null } | null = null,
+  ) {
+    const scope = routePosition === undefined ? "All Anthropic OAuth accounts" : "Anthropic OAuth accounts for this model route";
+    const retryable = `${scope} are temporarily rate-limited`;
+    super(usageLimit === null ? retryable
+      : usageLimit.resetsAt === null ? `${scope} have reached their usage limit`
+        : `${scope} have reached their usage limit; the first one resets at ${new Date(usageLimit.resetsAt).toISOString()}`);
+    this.retryableMessage = retryable;
     this.name = "AnthropicAccountCooldownError";
   }
 }
@@ -89,7 +104,7 @@ export class AnthropicAccountCooldownError extends Error {
  * `retry-after` would report a drained five-hour window as request-rate throttling.
  */
 type AnthropicCooldownSource = "retry-after" | "reset-derived" | "default";
-type AnthropicQuotaWindow = "five-hour" | "weekly";
+export type AnthropicQuotaWindow = "five-hour" | "weekly";
 
 interface AccountHealth {
   cooldownUntil: number;
@@ -98,6 +113,24 @@ interface AccountHealth {
   rejectedQuotaWindows?: AnthropicQuotaWindow[];
   /** Monotonic fence so an older quota probe cannot erase a newer refusal. */
   cooldownGeneration: number;
+  /** When the refusal was recorded; a reset settled earlier must not lift it. */
+  recordedAt: number;
+  /** 429 (shared quota) or 403 (entitlement); only a quota refusal can be lifted by a reset grant. */
+  refusalStatus: 429 | 403;
+  /** Windows a 429 reported as rejected, whatever set the deadline; empty when it named none. */
+  refusedQuotaWindows: AnthropicQuotaWindow[];
+  /**
+   * When the rejected windows reopen according to upstream's reset headers, kept even when
+   * Retry-After set the deadline. A usage-limit answer reports this, never an admission deadline.
+   */
+  quotaResetAt?: number;
+}
+
+/** See `anthropicAccountHold`: the latest hold on one account and its known window reset. */
+interface AnthropicAccountHold {
+  until: number;
+  quota: boolean;
+  resetAt?: number;
 }
 
 interface AffinityEntry {
@@ -127,6 +160,14 @@ function parseRetryAfterMs(value: string | null | undefined, now: number): numbe
   return delayUntil(Date.parse(text), now);
 }
 
+/** Windows whose unified status a refusal reported as rejected, independent of any reset header. */
+function rejectedQuotaWindowsIn(headers: AnthropicRateLimitHeaders | null | undefined): AnthropicQuotaWindow[] {
+  if (!headers) return [];
+  return ([["5h", "five-hour"], ["7d", "weekly"]] as const)
+    .filter(([window]) => headers.get(`anthropic-ratelimit-unified-${window}-status`)?.trim() === "rejected")
+    .map(([, quotaWindow]) => quotaWindow);
+}
+
 function parseRateLimitReset(
   headers: AnthropicRateLimitHeaders | null | undefined,
   now: number,
@@ -152,6 +193,32 @@ function parseRateLimitReset(
   return { delayMs: latest - now, rejectedQuotaWindows };
 }
 
+/**
+ * When every window a refusal reported as rejected reopens, per upstream's reset headers; undefined
+ * unless each rejected window carries a usable reset. Unlike `parseRateLimitReset`, which picks the
+ * best available admission deadline, this is reported to the client as the usage-limit reset, so a
+ * weekly window with no reset cannot hide behind a five-hour one that has one.
+ */
+function rejectedWindowsResetAt(headers: AnthropicRateLimitHeaders | null | undefined, now: number): number | undefined {
+  if (!headers) return undefined;
+  const usableReset = (header: string): number | undefined => {
+    const resetAt = Number(headers.get(header)?.trim()) * 1000;
+    return Number.isFinite(resetAt) && delayUntil(resetAt, now) !== undefined ? resetAt : undefined;
+  };
+  const rejected = rejectedQuotaWindowsIn(headers);
+  if (!rejected.length) {
+    return headers.get("anthropic-ratelimit-unified-status")?.trim() === "rejected"
+      ? usableReset("anthropic-ratelimit-unified-reset") : undefined;
+  }
+  let latest = 0;
+  for (const window of rejected) {
+    const resetAt = usableReset(`anthropic-ratelimit-unified-${window === "five-hour" ? "5h" : "7d"}-reset`);
+    if (resetAt === undefined) return undefined;
+    latest = Math.max(latest, resetAt);
+  }
+  return latest;
+}
+
 interface ScoredAccount {
   accountId: string;
   hasKnownUsage: boolean;
@@ -286,6 +353,7 @@ type RoutingFacadeSymbol =
   | "settleAnthropicCooldownRecovery"
   | "getAnthropicAccountHealthSnapshot"
   | "clearAnthropicAccountCooldown"
+  | "clearAnthropicAccountCooldownForReset"
   | "sweepExpiredAnthropicRoutingHealth"
   | "clearAnthropicAccountPoolState"
   | "anthropicSessionAffinitySizeForTests"
@@ -293,6 +361,8 @@ type RoutingFacadeSymbol =
   | "hasAnthropicFailoverQuorum"
   | "forgetAnthropicFailoverQuorum"
   | "getAnthropicPoolRetryAfterSeconds"
+  | "anthropicPoolCooldownError"
+  | "anthropicPoolUsageLimitAfterRefusal"
   | "pickAlternateAnthropicAccount"
   | "resolveAnthropicAccountForSession"
   | "resolveAnthropicDispatchAccountId"
@@ -315,7 +385,7 @@ const handlers = new Map<AnthropicInstanceId, RoutingHandlers>();
 function createAnthropicRouting(instance: AnthropicInstanceId): AnthropicRouting {
   const PROVIDER = instance;
   const poolKey = anthropicPoolKey(instance);
-  const { anthropicFamilyRejected, anthropicFamilyRetryAt, anthropicModelExhausted, clearAnthropicFamilyQuota } = anthropicModelQuotaFor(instance);
+  const { anthropicFamilyRejected, anthropicFamilyRetryAt, anthropicFamilyHoldState, anthropicModelExhausted, clearAnthropicFamilyQuota } = anthropicModelQuotaFor(instance);
   const { anthropicRatePauseUntil, clearAnthropicRatePauses, pauseAnthropicRateAdmission } = anthropicRatePolicyFor(instance);
   const { anthropicCooldownGeneration, clearAnthropicCooldownGenerations, noteAnthropicCooldownMutation } = anthropicCooldownRecoveryFor(instance);
   // Request-owned config authorizes selection/commit. Namespace-only credential and roster
@@ -356,7 +426,26 @@ function createAnthropicRouting(instance: AnthropicInstanceId): AnthropicRouting
 
 
   /**
-   * Capture the exact reset-derived refusal a fresh usage probe is allowed to recover.
+   * The windows a fresh usage read must show open before it may lift this cooldown, or null when
+   * no usage read can lift it.
+   *
+   * Only a 429 is quota evidence: `recordAnthropicAccountRefusal` keeps a 429 only after
+   * classifying it as shared quota, and a 403 is an entitlement refusal that usage cannot answer.
+   * The deadline source does not matter (#6989). Anthropic sends Retry-After on a spent window as
+   * well, set to that window's reset, so a `retry-after` cooldown that named rejected windows
+   * carries exactly the evidence a `reset-derived` one does; the read decides, not the header.
+   * A refusal that named no window can only be the aggregate unified status. It stays claimable
+   * when reset-derived, as before, but no usage reading covers it, so it is always retained.
+   */
+  function recoverableQuotaWindows(entry: AccountHealth): readonly AnthropicQuotaWindow[] | null {
+    if (entry.refusalStatus !== 429) return null;
+    if (entry.rejectedQuotaWindows?.length) return entry.rejectedQuotaWindows;
+    if (entry.refusedQuotaWindows.length) return entry.refusedQuotaWindows;
+    return entry.cooldownSource === "reset-derived" ? [] : null;
+  }
+
+  /**
+   * Capture the exact quota refusal a fresh usage probe is allowed to recover.
    *
    * The generation fence matters because the usage request is asynchronous: a newer 429 may
    * arrive while it is in flight, and an older answer must never erase that newer refusal.
@@ -366,13 +455,14 @@ function createAnthropicRouting(instance: AnthropicInstanceId): AnthropicRouting
     now = Date.now(),
   ): AnthropicCooldownRecoveryClaim | null {
     const entry = upstreamHealth.get(accountId);
-    if (!entry || entry.cooldownUntil <= now || entry.cooldownSource !== "reset-derived") return null;
+    if (!entry || entry.cooldownUntil <= now || recoverableQuotaWindows(entry) === null) return null;
     return { instance, accountId, cooldownGeneration: entry.cooldownGeneration, claimedAt: now };
   }
 
   /**
-   * Clear only the claimed reset-derived cooldown when a fresh, complete usage result proves
-   * headroom in every window that upstream previously reported as rejected.
+   * Clear only the claimed quota cooldown when a fresh, complete usage result proves headroom in
+   * every window that upstream previously reported as rejected. A result read before the claim
+   * (`updatedAt < claimedAt`) is stale and settles nothing.
    */
   function settleAnthropicCooldownRecovery(
     claim: AnthropicCooldownRecoveryClaim,
@@ -380,12 +470,12 @@ function createAnthropicRouting(instance: AnthropicInstanceId): AnthropicRouting
   ): AnthropicCooldownRecoverySettlement {
     if (claim.instance !== instance) return "superseded";
     const entry = upstreamHealth.get(claim.accountId);
-    if (!entry || entry.cooldownSource !== "reset-derived"
+    const windows = entry ? recoverableQuotaWindows(entry) : null;
+    if (!entry || windows === null
       || entry.cooldownGeneration !== claim.cooldownGeneration
       || anthropicCooldownGeneration(claim.accountId) !== claim.cooldownGeneration
       || !Number.isFinite(quota.updatedAt) || quota.updatedAt < claim.claimedAt) return "superseded";
-    const windows = entry.rejectedQuotaWindows;
-    if (!windows?.length) return "retained";
+    if (!windows.length) return "retained";
     const recovered = windows.every(window => {
       const percent = window === "five-hour" ? quota.fiveHourPercent : quota.weeklyPercent;
       return typeof percent === "number" && Number.isFinite(percent) && percent >= 0 && percent < 100;
@@ -416,6 +506,34 @@ function createAnthropicRouting(instance: AnthropicInstanceId): AnthropicRouting
     return cleared;
   }
 
+  /**
+   * Lift a quota cooldown for a reset grant. `claimedAt` is when the claim was first journaled,
+   * before it was sent: a refusal recorded at or after it may already describe the post-reset
+   * account (a tie within one clock tick cannot be ordered, so it stays too). The windows the
+   * grant confirmed cleared must cover every window the refusal named; a refusal that named none
+   * needs both windows cleared, and an entitlement (403) refusal is never lifted by a reset.
+   */
+  function clearAnthropicAccountCooldownForReset(
+    accountId: string,
+    claimedAt: number,
+    clearedWindows: ReadonlySet<AnthropicQuotaWindow>,
+  ): "cleared" | "absent" | "newer" | "uncovered" {
+    const entry = upstreamHealth.get(accountId);
+    if (!entry) return "absent";
+    if (entry.recordedAt >= claimedAt) return "newer";
+    const named = entry.rejectedQuotaWindows?.length ? entry.rejectedQuotaWindows : entry.refusedQuotaWindows;
+    const required: readonly AnthropicQuotaWindow[] = named.length ? named : ["five-hour", "weekly"];
+    if (entry.refusalStatus !== 429 || !required.every(window => clearedWindows.has(window))) {
+      // Kept, but reads that started before the grant are now stale. Move the entry to the same
+      // new generation so a fresh usage read can still recover a 429 quota cooldown.
+      entry.cooldownGeneration = noteAnthropicCooldownMutation(accountId);
+      return "uncovered";
+    }
+    upstreamHealth.delete(accountId);
+    noteAnthropicCooldownMutation(accountId);
+    return "cleared";
+  }
+
   function sweepExpiredAnthropicRoutingHealth(now = Date.now()): number {
     let removed = 0;
     for (const [accountId, health] of upstreamHealth) {
@@ -603,23 +721,90 @@ function createAnthropicRouting(instance: AnthropicInstanceId): AnthropicRouting
 
   /** Earliest remaining cooldown among cooled Anthropic accounts, for client Retry-After. */
   function getAnthropicPoolRetryAfterSeconds(now = Date.now(), decision: AnthropicRouteDecision | null = null, model?: string): number | null {
+    return anthropicPoolCooldownError(now, decision, model).retryAfterSeconds;
+  }
+
+  /**
+   * What keeps one account out of admission, and whether that is spent quota (#6991).
+   *
+   * Every hold must lift before the account can serve, so the latest one decides. A 429 health
+   * entry is quota by construction (only a shared-quota classification records one), whatever its
+   * deadline source; a 403 entry is an entitlement refusal; an admission pause is a transient
+   * throttle; a family exclusion is a spent family window unless a revalidation send is already
+   * in flight. A tie goes to the transient hold, because then a retry at that instant may succeed.
+   *
+   * The reported reset is computed apart from that admission order: the account's usage reopens
+   * when the last of its quota holds' upstream windows resets, and it is unknown when any of them
+   * lacks a known reset. Admission deadlines are not resets: they may be Retry-After, the
+   * sixty-second default or the thirty-minute family evidence lifetime.
+   */
+  function anthropicAccountHold(accountId: string, now: number, model?: string): AnthropicAccountHold | null {
+    const latest = { until: 0, quota: false };
+    let quotaResetAt = 0;
+    let quotaResetKnown = true;
+    const consider = (until: number | undefined, quota: boolean, reset?: number) => {
+      if (until === undefined || until <= now) return;
+      if (quota) {
+        if (reset === undefined || reset <= now) quotaResetKnown = false;
+        else quotaResetAt = Math.max(quotaResetAt, reset);
+      }
+      if (until < latest.until || (until === latest.until && quota)) return;
+      latest.until = until;
+      latest.quota = quota;
+    };
+    const entry = getAnthropicAccountHealthSnapshot(accountId, now) ? upstreamHealth.get(accountId) : undefined;
+    consider(entry?.cooldownUntil, entry?.refusalStatus === 429, entry?.quotaResetAt);
+    consider(anthropicRatePauseUntil(accountId, now), false);
+    const family = anthropicFamilyHoldState(accountId, model);
+    consider(anthropicFamilyRetryAt(accountId, model, now), family?.revalidating === false, family?.resetAt);
+    if (latest.until === 0) return null;
+    return { until: latest.until, quota: latest.quota,
+      ...(latest.quota && quotaResetKnown && quotaResetAt > 0 ? { resetAt: quotaResetAt } : {}) };
+  }
+
+  /**
+   * The local refusal for a pool (or model route) with no admissible account. Retry-After is the
+   * earliest hold among accounts the route can use once they recover. The refusal is a usage limit
+   * only when no account the route can use is admissible and every held one is out on spent quota;
+   * then a client retry before that instant cannot succeed, and Codex should stop and show the
+   * reset instead of retrying. The reset is the earliest known window reset, and is omitted when
+   * any held account's reset is unknown, since that account could reopen first.
+   */
+  function anthropicPoolCooldownError(now = Date.now(), decision: AnthropicRouteDecision | null = null, model?: string): AnthropicAccountCooldownError {
     const set = getAccountSet(PROVIDER);
-    if (!set) return null;
+    if (!set) return new AnthropicAccountCooldownError(null, decision?.position);
     // Once an explicit fallback route has no eligible declared account, selection may use
     // the ordinary pool. Its earliest usable cooldown must determine the advertised wait.
     const fallbackExpanded = decision?.fallback === true
       && !getEligibleAnthropicAccounts(now, model).some(id => decision.accounts.includes(id));
     let earliest: number | null = null;
+    let allQuota = true;
+    let earliestReset: number | null = null;
+    let resetsKnown = true;
     for (const account of set.accounts) {
       if (account.paused === true || account.needsReauth === true || !isPoolCredentialUsable(account.id, now)) continue;
       if (decision && !fallbackExpanded && !decision.accounts.includes(account.id)) continue;
-      const snap = getAnthropicAccountHealthSnapshot(account.id, now);
-      const until = Math.max(snap?.cooldownUntil ?? 0, anthropicRatePauseUntil(account.id, now) ?? 0, anthropicFamilyRetryAt(account.id, model, now) ?? 0);
-      if (until <= now) continue;
-      if (earliest === null || until < earliest) earliest = until;
+      const hold = anthropicAccountHold(account.id, now, model);
+      if (!hold) continue;
+      if (!hold.quota) allQuota = false;
+      else if (hold.resetAt === undefined) resetsKnown = false;
+      else if (earliestReset === null || hold.resetAt < earliestReset) earliestReset = hold.resetAt;
+      if (earliest === null || hold.until < earliest) earliest = hold.until;
     }
-    if (earliest === null || earliest <= now) return null;
-    return Math.max(1, Math.ceil((earliest - now) / 1000));
+    if (earliest === null) return new AnthropicAccountCooldownError(null, decision?.position);
+    const exhausted = allQuota && routeCandidates(getEligibleAnthropicAccounts(now, model), decision).length === 0;
+    return new AnthropicAccountCooldownError(Math.max(1, Math.ceil((earliest - now) / 1000)), decision?.position,
+      exhausted ? { resetsAt: resetsKnown ? earliestReset : null } : null);
+  }
+
+  /**
+   * After an upstream refusal found no replacement: the usage-limit refusal when the pool is
+   * exhausted as defined above, else null. A refusal that left an admissible sibling (a send
+   * budget ran out, a request-scoped 429) or a sibling on a transient hold is not exhaustion.
+   */
+  function anthropicPoolUsageLimitAfterRefusal(now = Date.now(), decision: AnthropicRouteDecision | null = null, model?: string): AnthropicAccountCooldownError | null {
+    const refusal = anthropicPoolCooldownError(now, decision, model);
+    return refusal.usageLimit === null ? null : refusal;
   }
 
   function pickLowestUsage(config: OcxConfig, excludeId: string | undefined, now: number, decision: AnthropicRouteDecision | null = null, model?: string, excludedAccountIds?: ReadonlySet<string>): string | null {
@@ -950,7 +1135,7 @@ function createAnthropicRouting(instance: AnthropicInstanceId): AnthropicRouting
     const now = Date.now();
     const selection = resolveAnthropicAccountForSession(sessionKey, config, now, decision, model);
     if (selection.reason === "all-cooled") {
-      throw new AnthropicAccountCooldownError(getAnthropicPoolRetryAfterSeconds(now, decision, model), decision?.position);
+      throw anthropicPoolCooldownError(now, decision, model);
     }
     if (selection.reason === "paused" || !selection.accountId || !getEligibleAnthropicAccounts(now, model).includes(selection.accountId)) {
       const { OAuthAccountPausedError, OAuthLoginRequiredError } = await import("./index");
@@ -1084,6 +1269,7 @@ function createAnthropicRouting(instance: AnthropicInstanceId): AnthropicRouting
     // account is back in the rotation a minute later.
     const parsedRetry = parseRetryAfterMs(retryAfterHeader, now);
     const resetDerived = status === 429 && parsedRetry === undefined ? parseRateLimitReset(rateLimitHeaders, now) : undefined;
+    const quotaResetAt = status === 429 ? rejectedWindowsResetAt(rateLimitHeaders, now) : undefined;
     const cooldownMs = parsedRetry ?? resetDerived?.delayMs ?? (status === 403 ? ACCOUNT_REFUSAL_COOLDOWN_MS : DEFAULT_COOLDOWN_MS);
     const cooldownGeneration = noteAnthropicCooldownMutation(failedAccountId);
     upstreamHealth.set(failedAccountId, {
@@ -1093,6 +1279,10 @@ function createAnthropicRouting(instance: AnthropicInstanceId): AnthropicRouting
         : resetDerived !== undefined ? "reset-derived" : "default",
       ...(resetDerived ? { rejectedQuotaWindows: resetDerived.rejectedQuotaWindows } : {}),
       cooldownGeneration,
+      recordedAt: now,
+      refusalStatus: status,
+      refusedQuotaWindows: status === 429 ? rejectedQuotaWindowsIn(rateLimitHeaders) : [],
+      ...(quotaResetAt !== undefined ? { quotaResetAt } : {}),
     });
     sweepExpiredOnWrite(now);
     clearAnthropicSessionAffinityForAccount(failedAccountId);
@@ -1272,9 +1462,10 @@ function createAnthropicRouting(instance: AnthropicInstanceId): AnthropicRouting
     instance, captureAnthropicManualSelectionGeneration, anthropicAccountPoolConfig,
     isAnthropicAccountPoolEnabled, anthropicAutoSwitchThreshold, anthropicAccountAutoSwitchThreshold,
     captureAnthropicCooldownRecovery, settleAnthropicCooldownRecovery, getAnthropicAccountHealthSnapshot,
-    clearAnthropicAccountCooldown, sweepExpiredAnthropicRoutingHealth, clearAnthropicAccountPoolState,
+    clearAnthropicAccountCooldown, clearAnthropicAccountCooldownForReset, sweepExpiredAnthropicRoutingHealth, clearAnthropicAccountPoolState,
     anthropicSessionAffinitySizeForTests, getEligibleAnthropicAccounts, hasAnthropicFailoverQuorum,
-    forgetAnthropicFailoverQuorum, getAnthropicPoolRetryAfterSeconds, pickAlternateAnthropicAccount,
+    forgetAnthropicFailoverQuorum, getAnthropicPoolRetryAfterSeconds, anthropicPoolCooldownError,
+    anthropicPoolUsageLimitAfterRefusal, pickAlternateAnthropicAccount,
     resolveAnthropicAccountForSession, resolveAnthropicDispatchAccountId, bindAnthropicSessionAffinity,
     clearAnthropicSessionAffinityForAccount, rotateAnthropicAccountOn429, rotateAnthropicAccountOnRefusal,
     recordAnthropicAccount429, recordAnthropicAccountRefusal, promoteAnthropicActiveAccount,
@@ -1352,6 +1543,14 @@ export function clearAnthropicAccountCooldown(accountId: string): boolean {
   return anthropicRoutingFor("anthropic").clearAnthropicAccountCooldown(accountId);
 }
 
+export function clearAnthropicAccountCooldownForReset(
+  accountId: string,
+  claimedAt: number,
+  clearedWindows: ReadonlySet<AnthropicQuotaWindow>,
+): "cleared" | "absent" | "newer" | "uncovered" {
+  return anthropicRoutingFor("anthropic").clearAnthropicAccountCooldownForReset(accountId, claimedAt, clearedWindows);
+}
+
 export function sweepExpiredAnthropicRoutingHealth(now = Date.now()): number {
   return anthropicRoutingFor("anthropic").sweepExpiredAnthropicRoutingHealth(now);
 }
@@ -1380,6 +1579,14 @@ export function getAnthropicPoolRetryAfterSeconds(now = Date.now(), decision: An
   return anthropicRoutingFor("anthropic").getAnthropicPoolRetryAfterSeconds(now, decision, model);
 }
 
+export function anthropicPoolCooldownError(now = Date.now(), decision: AnthropicRouteDecision | null = null, model?: string): AnthropicAccountCooldownError {
+  return anthropicRoutingFor("anthropic").anthropicPoolCooldownError(now, decision, model);
+}
+
+export function anthropicPoolUsageLimitAfterRefusal(now = Date.now(), decision: AnthropicRouteDecision | null = null, model?: string): AnthropicAccountCooldownError | null {
+  return anthropicRoutingFor("anthropic").anthropicPoolUsageLimitAfterRefusal(now, decision, model);
+}
+
 export function pickAlternateAnthropicAccount(
   config: OcxConfig,
   excludeId: string,

package/src/oauth/anthropic.ts

@@ -1,6 +1,6 @@
 /** Anthropic OAuth flow (Claude Pro/Max). Ported from jawcode oauth/anthropic.ts. */
 import { OAuthCallbackFlow } from "./callback-server";
-import { bindAnthropicIdentity, resolveAnthropicAccountIdentity } from "./anthropic-identity";
+import { bindAnthropicIdentity, normalizeAnthropicIdentity, resolveAnthropicAccountIdentity } from "./anthropic-identity";
 import { generatePKCE } from "./pkce";
 import type { LocalTokenImportMode, OAuthController, OAuthCredentials } from "./types";
 import { outboundProxyConfigured, startupOutboundProxyConfigured } from "../lib/proxy-env";
@@ -12,6 +12,8 @@ const AUTHORIZE_URL = "https://claude.ai/oauth/authorize";
 const TOKEN_URL = "https://api.anthropic.com/v1/oauth/token";
 const CALLBACK_PORT = 54545;
 const CALLBACK_PATH = "/callback";
+/** Profile enrichment budget on token refresh; login paths keep the resolver's own deadline. */
+const REFRESH_PROFILE_TIMEOUT_MS = 2_000;
 const SCOPES = "org:create_api_key user:profile user:inference";
 
 // ── OAuth-request requirements applied by the anthropic adapter when authMode==="oauth" ──
@@ -130,6 +132,15 @@ function credsFrom(data: AnthropicTokenResponse, refreshFallback?: string): OAut
   };
 }
 
+async function withAccountProfile(credential: OAuthCredentials, signal?: AbortSignal): Promise<OAuthCredentials> {
+  const profile = await resolveAnthropicAccountIdentity(credential.access, signal);
+  if (!profile) return credential;
+  // Token-response identity remains authoritative here; enrichment changes display metadata only.
+  const identity = normalizeAnthropicIdentity(credential.anthropicIdentity, credential.access);
+  if (identity && identity.accountUuid !== profile.accountUuid) return credential;
+  return { ...credential, plan: profile.plan ?? null };
+}
+
 export class AnthropicOAuthFlow extends OAuthCallbackFlow {
   #verifier = "";
 
@@ -174,7 +185,7 @@ export class AnthropicOAuthFlow extends OAuthCallbackFlow {
       redirect_uri: redirectUri,
       code_verifier: this.#verifier,
     });
-    return credsFrom(parseTokenResponse(responseBody));
+    return withAccountProfile(credsFrom(parseTokenResponse(responseBody)), this.ctrl.signal);
   }
 }
 
@@ -192,7 +203,8 @@ export async function loginAnthropic(
       if (local.expires >= Date.now() + 60_000) {
         const identity = await resolveAnthropicAccountIdentity(local.access, ctrl.signal);
         ctrl.signal?.throwIfAborted();
-        return { ...local, ...(identity ? { accountId: identity.accountUuid, anthropicIdentity: identity } : {}) };
+        return { ...local, ...(identity ? { accountId: identity.accountUuid,
+          anthropicIdentity: normalizeAnthropicIdentity(identity, local.access), plan: identity.plan ?? null } : {}) };
       }
       try {
         return { ...(await refreshAnthropicToken(local.refresh)), source: "local-cli" };
@@ -218,5 +230,7 @@ export async function refreshAnthropicToken(refreshToken: string): Promise<OAuth
     client_id: CLIENT_ID,
     refresh_token: refreshToken,
   });
-  return credsFrom(parseTokenResponse(responseBody), refreshToken);
+  // Refresh can sit on a request path, so the profile enrichment gets a short deadline. A
+  // missed read leaves plan unobserved and the stored label survives through mergeOAuthPlan.
+  return withAccountProfile(credsFrom(parseTokenResponse(responseBody), refreshToken), AbortSignal.timeout(REFRESH_PROFILE_TIMEOUT_MS));
 }

package/src/oauth/generic-account-failover.ts

@@ -41,6 +41,7 @@ import type { KiroRefusalKind } from "../adapters/kiro-refusal";
 import { kiroAccountEvidence } from "../providers/kiro-usage";
 import { kiroEvidenceIdentity } from "../providers/kiro-account-state-disk";
 import { kiroAccountSupportsModel } from "../providers/kiro-model-catalog";
+import { antigravityAccountSupportsModel } from "../providers/antigravity-account-roster";
 import { ACCOUNT_QUOTA_TTL_MS } from "../providers/quota-wire";
 import { sweepExpiredOnWrite } from "../lib/state-store-sweeper";
 import { subscribeOAuthAccountPauseChanges } from "../lib/account-selection-events";
@@ -248,11 +249,31 @@ export function eligibleFailoverAccounts(providerName: string, now = Date.now(),
   return eligibleIdsIn(getAccountSet(providerName), providerName, now, family);
 }
 
-/** Model evidence only ranks accounts already eligible and below any configured cap. */
+/** Whether an account's own model listing includes `model`; undefined when unknown. */
+function accountListsModel(providerName: string, accountId: string, model: string): boolean | undefined {
+  if (providerName === "kiro") return kiroAccountSupportsModel(accountId, model);
+  if (providerName === "google-antigravity") return antigravityAccountSupportsModel(providerName, accountId, model);
+  return undefined;
+}
+
+/**
+ * Model evidence only ranks accounts already eligible and below any configured cap.
+ *
+ * Kiro and Antigravity both gate models per account. For Antigravity (Claude 4.6 vs 5.5, Argon)
+ * an account whose discovered roster lists the model wins; an account whose roster omits it is
+ * skipped while any other remains; an account with no roster yet is unknown and stays usable.
+ */
 export function preferKiroModelSupport(
   providerName: string, ids: string[], model?: string | null, config?: OcxConfig,
 ): string[] {
-  if (providerName !== "kiro" || !model) return ids;
+  if (!model) return ids;
+  if (providerName === "google-antigravity") {
+    const positive = ids.filter(id => accountListsModel(providerName, id, model) === true);
+    if (positive.length) return positive;
+    const notListedAgainst = ids.filter(id => accountListsModel(providerName, id, model) !== false);
+    return notListedAgainst.length ? notListedAgainst : ids;
+  }
+  if (providerName !== "kiro") return ids;
   const cap = config?.providers?.kiro?.oauthAccountFailover?.maxConcurrentPerAccount;
   const withRoom = typeof cap === "number" && Number.isInteger(cap) && cap >= 1 && cap <= 100
     ? ids.filter(id => accountInFlight("kiro", id) < cap) : ids;
@@ -631,10 +652,13 @@ export function preferredInitialAccount(
   const modelEligible = preferKiroModelSupport(providerName,
     eligibleFailoverAccounts(providerName, now, classifyModelFamilyForQuota(providerName, requestedModelId)),
     requestedModelId, config);
-  const activeLacks = providerName === "kiro" && !!active && !!requestedModelId
-    && kiroAccountSupportsModel(active, requestedModelId) === false;
+  const activeLacks = (providerName === "kiro" || providerName === "google-antigravity")
+    && !!active && !!requestedModelId
+    && accountListsModel(providerName, active, requestedModelId) === false;
   const listingSibling = activeLacks
-    ? modelEligible.find(id => id !== active && kiroModelListingHasRoom(config, id, requestedModelId!))
+    ? modelEligible.find(id => id !== active && (providerName === "kiro"
+      ? kiroModelListingHasRoom(config, id, requestedModelId!)
+      : accountListsModel(providerName, id, requestedModelId!) === true))
     : undefined;
   if (listingSibling) return listingSibling;
 

package/src/oauth/google-antigravity.ts

@@ -11,6 +11,7 @@
  */
 import { OAuthCallbackFlow, type OAuthCallbackFlowOptions } from "./callback-server";
 import { generatePKCE } from "./pkce";
+import { normalizeOAuthPlan } from "./plan";
 import type { OAuthController, OAuthCredentials } from "./types";
 import { antigravityUserAgent, ANTIGRAVITY_IDE_VERSION } from "../adapters/client-fingerprint";
 
@@ -94,7 +95,7 @@ function extractProjectId(data: Record<string, unknown> | undefined): string | u
   return undefined;
 }
 
-async function loadCodeAssistProject(accessToken: string, signal?: AbortSignal): Promise<string | undefined> {
+async function loadCodeAssistProject(accessToken: string, signal?: AbortSignal): Promise<{ projectId?: string; plan: string | null } | undefined> {
   const response = await fetch(`${PROD_API}/${API_VERSION}:loadCodeAssist`, {
     method: "POST",
     headers: { Authorization: `Bearer ${accessToken}`, Accept: "*/*", "Content-Type": "application/json", "User-Agent": antigravityUserAgent() },
@@ -102,7 +103,12 @@ async function loadCodeAssistProject(accessToken: string, signal?: AbortSignal):
     signal: requestSignal(signal),
   });
   if (!response.ok) return undefined;
-  return extractProjectId((await response.json().catch(() => undefined)) as Record<string, unknown> | undefined);
+  const data: unknown = await response.json().catch(() => undefined);
+  if (!data || typeof data !== "object" || Array.isArray(data)) return undefined;
+  const payload = data as Record<string, unknown>;
+  const tier = (value: unknown) => value && typeof value === "object" && "id" in value
+    ? normalizeOAuthPlan(value.id) : undefined;
+  return { projectId: extractProjectId(payload), plan: tier(payload.paidTier) ?? tier(payload.currentTier) ?? null };
 }
 
 async function onboardProject(accessToken: string, signal?: AbortSignal): Promise<string | undefined> {
@@ -138,7 +144,18 @@ async function onboardProject(accessToken: string, signal?: AbortSignal): Promis
 
 /** Discover the CCA project for an access token (loadCodeAssist → onboardUser fallback). */
 export async function discoverAntigravityProject(accessToken: string, signal?: AbortSignal): Promise<string | undefined> {
-  return (await loadCodeAssistProject(accessToken, signal)) ?? (await onboardProject(accessToken, signal));
+  return (await discoverAntigravityAccount(accessToken, signal)).projectId;
+}
+
+async function discoverAntigravityAccount(accessToken: string, signal?: AbortSignal): Promise<{ projectId?: string; plan?: string | null }> {
+  const account = await loadCodeAssistProject(accessToken, signal);
+  // Once loadCodeAssist answered, an onboarding failure must not discard its tier observation;
+  // a missing project still fails login, and cancellation still propagates.
+  const projectId = account?.projectId ?? await (account
+    ? onboardProject(accessToken, signal).catch(error => { if (signal?.aborted) throw error; return undefined; })
+    : onboardProject(accessToken, signal));
+  // An unanswered loadCodeAssist observed nothing; only a parsed body may clear a stored label.
+  return { projectId, ...(account ? { plan: account.plan } : {}) };
 }
 
 function credentialsFromPayload(payload: GoogleTokenPayload, refreshFallback = ""): OAuthCredentials {
@@ -207,13 +224,13 @@ class AntigravityOAuthFlow extends OAuthCallbackFlow {
     }, this.ctrl.signal);
     const creds = credentialsFromPayload(payload);
     this.ctrl.onProgress?.("Discovering Cloud Code Assist project");
-    const projectId = await discoverAntigravityProject(creds.access, this.ctrl.signal);
+    const { projectId, plan } = await discoverAntigravityAccount(creds.access, this.ctrl.signal);
     if (!projectId) {
       // Fail the login rather than persisting a credential that every request would reject for a
       // missing CCA project — otherwise status shows "logged in" while all calls fail closed.
       throw new Error("Antigravity login could not discover a Cloud Code Assist project for this account. Ensure the account has Antigravity/Cloud Code Assist access and try again.");
     }
-    return { ...creds, projectId };
+    return { ...creds, projectId, plan };
   }
 }
 
@@ -231,8 +248,8 @@ export async function refreshAntigravityToken(refreshToken: string, signal?: Abo
   }, signal);
   const creds = credentialsFromPayload(payload, refreshToken);
   // Re-discover the project on refresh so a newly-onboarded account fills in projectId.
-  const projectId = await discoverAntigravityProject(creds.access, signal).catch(() => undefined);
-  return projectId ? { ...creds, projectId } : creds;
+  const account = await discoverAntigravityAccount(creds.access, signal).catch(() => undefined);
+  return account ? { ...creds, ...account } : creds;
 }
 
 /**