@bitkyc08/opencodex 2.86.0 → 2.87.0

package/src/lib/gcp-credential-input.ts

@@ -0,0 +1,12 @@
+/** Structured JSON is never literal key material; malformed GCP text is also refused. */
+export function isGcpCredentialMaterial(value: string): boolean {
+  const credentialField = /\b(?:service_account|authorized_user|external_account|private_key|refresh_token|client_secret)\b|-----BEGIN [A-Z ]*PRIVATE KEY-----/;
+  if (/[\[\{"']/.test(value) && credentialField.test(value)) return true;
+  // Reject structured carriers outright rather than recursively guessing their credential shape.
+  // This includes quoted/array/object wrappers with arbitrarily escaped or nested JSON inside.
+  try {
+    const parsed: unknown = JSON.parse(value);
+    return typeof parsed === "string" || (parsed !== null && typeof parsed === "object");
+  }
+  catch { return false; }
+}

package/src/lib/lab-live-route-production.ts

@@ -72,6 +72,11 @@ export async function buildLabProviderAuthHeaders(
       && configuredAnthropicInstance(config, routeContext.providerId) !== routeContext.providerId) {
       throw new TransportError("auth_blocked", "anthropic instance unavailable");
     }
+    // The DSH account token is sent only by its own adapter to its pinned endpoint; the generic
+    // probe transport would use another endpoint and auth scheme.
+    if (routeContext.providerId === "dsh-account") {
+      throw new TransportError("auth_blocked", "dsh-account probes are not supported");
+    }
     try {
       const snapshot = await getValidAccessTokenSnapshot(routeContext.providerId);
       headers.Authorization = `Bearer ${snapshot.accessToken}`;

package/src/lib/opaque-proxy-tunnel.ts

@@ -0,0 +1,217 @@
+/**
+ * Single-route opaque proxy tunnel. The desktop upstream dialer retains its
+ * own fixed-target TLS contract.
+ * Shares OpenCodex's MIT SOCKS handshake; the caller owns all post-establishment
+ * cancellation and socket cleanup. Never replay or implicitly retry directly.
+ */
+import net, { type Socket } from 'node:net';
+import tls from 'node:tls';
+import { socks5Handshake, socks5Credentials, Socks5HandshakeError } from './socks5-handshake';
+
+interface RouteEndpoint { host: string; port: number }
+type RouteCredentials = { username?: undefined; password?: undefined } | { username: string; password: string };
+type PlainProxy = { kind?: 'http'; proxyCa?: never };
+type SecureProxy = { kind: 'https'; proxyCa?: string };
+type SocksProxy = { kind: 'socks5' | 'socks5h'; proxyCa?: never };
+export type OpaqueProxyRoute = RouteEndpoint & RouteCredentials & (PlainProxy | SecureProxy | SocksProxy);
+export interface OpaqueTunnelOptions {
+  signal?: AbortSignal;
+  timeoutMs?: number;
+  maxHeaderBytes?: number;
+}
+interface AttemptOptions {
+  signal?: AbortSignal;
+  timeoutMs: number;
+  maxHeaderBytes: number;
+}
+export class TunnelError extends Error {
+  override readonly name = 'TunnelError';
+  readonly code: string;
+  readonly status?: number;
+  constructor(code: string, message: string, { status }: { status?: number } = {}) {
+    super(message); this.code = code; this.status = status;
+  }
+}
+const aborted = () => new TunnelError('ABORTED', 'Tunnel establishment cancelled');
+
+function validateAuthority(authority: string): string {
+  if (typeof authority !== 'string' || !/^(?:\[[0-9a-fA-F:]+\]|[a-zA-Z0-9._-]+):[0-9]+$/.test(authority)) {
+    throw new TunnelError('TARGET', 'An explicit host:port authority is required');
+  }
+  const port = Number(authority.slice(authority.lastIndexOf(':') + 1));
+  if (!Number.isInteger(port) || port < 1 || port > 65535) throw new TunnelError('TARGET', 'Invalid target port');
+  return authority;
+}
+
+function validateOptions(p: OpaqueProxyRoute, timeoutMs: number, maxHeaderBytes: number): void {
+  if (!p || Array.isArray(p) || typeof p.host !== 'string' || !p.host || /[\s/@]/.test(p.host)
+    || !Number.isInteger(p.port) || p.port < 1 || p.port > 65535
+    || !['http', 'https', 'socks5', 'socks5h'].includes(p.kind ?? 'http')) throw new TunnelError('CONFIG', 'Invalid proxy route');
+  if ((p.username === undefined) !== (p.password === undefined)
+    || (p.username !== undefined && (typeof p.username !== 'string' || typeof p.password !== 'string'
+      || (!p.kind?.startsWith('socks') && p.username.includes(':')) || Buffer.byteLength(p.username + p.password) > 4096))) throw new TunnelError('CONFIG', 'Invalid proxy credentials');
+  if ((p.kind ?? 'http').startsWith('socks') && p.username !== undefined
+    && (Buffer.byteLength(p.username) > 255 || Buffer.byteLength(p.password) > 255)) throw new TunnelError('CONFIG', 'SOCKS credentials must each fit in 255 UTF-8 bytes');
+  if (p.proxyCa !== undefined && p.kind !== 'https') throw new TunnelError('CONFIG', 'Proxy TLS settings require HTTPS proxy');
+  if (p.proxyCa !== undefined && typeof p.proxyCa !== 'string') throw new TunnelError('CONFIG', 'Invalid proxy CA');
+  if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 30000
+    || !Number.isSafeInteger(maxHeaderBytes) || maxHeaderBytes < 64 || maxHeaderBytes > 65536) {
+    throw new TunnelError('CONFIG', 'Invalid deadline or header limit');
+  }
+}
+
+function connectOne(authority: string, proxy: OpaqueProxyRoute, { signal, timeoutMs, maxHeaderBytes }: AttemptOptions): Promise<Socket> {
+  if (proxy.kind === 'socks5' || proxy.kind === 'socks5h') return connectSocks(authority, proxy, { signal, timeoutMs, maxHeaderBytes });
+  return new Promise<Socket>((resolve, reject) => {
+    if (signal?.aborted) return reject(aborted());
+    const secure = proxy.kind === 'https';
+    const identity = proxy.host;
+    const tlsOptions: tls.ConnectionOptions & { allowHalfOpen: boolean } = {
+      host: proxy.host, port: proxy.port, allowHalfOpen: true,
+      servername: net.isIP(identity) ? undefined : identity, ca: proxy.proxyCa,
+      checkServerIdentity: (_name, cert) => tls.checkServerIdentity(identity, cert),
+      rejectUnauthorized: true, ALPNProtocols: ['http/1.1'],
+    };
+    const socket = secure
+      ? tls.connect(tlsOptions)
+      : net.createConnection({ host: proxy.host, port: proxy.port, allowHalfOpen: true });
+    // Keep a defensive observer across the promise-to-owner handoff. Errors still
+    // settle the establishment promise or are handled by the relay after handoff.
+    socket.on('error', () => {});
+    let pending: Buffer = Buffer.alloc(0); let settled = false, tlsReady = !secure;
+    const connectedEvent = secure ? 'secureConnect' : 'connect';
+    const cleanup = () => {
+      clearTimeout(timer); signal?.removeEventListener('abort', onAbort);
+      socket.removeListener(connectedEvent, onConnect); socket.removeListener('data', onData);
+      socket.removeListener('error', onError); socket.removeListener('end', onEnd); socket.removeListener('close', onClose);
+    };
+    const fail = (error: Error) => {
+      if (settled) return; settled = true; cleanup(); socket.destroy(); reject(error);
+    };
+    const onAbort = () => fail(aborted());
+    const establishmentFailure = (code: string, message: string) => fail(new TunnelError(code, message));
+    const onError = () => {
+      if (secure && !tlsReady) {
+        fail(new TunnelError('PROXY_TLS', 'HTTPS proxy establishment failed'));
+      } else establishmentFailure('TRANSPORT', 'HTTP proxy connection failed');
+    };
+    const onEnd = () => establishmentFailure('EARLY_CLOSE', 'HTTP proxy closed before establishing the tunnel');
+    const onClose = onEnd;
+    const onConnect = () => {
+      tlsReady = true;
+      const auth = proxy.username === undefined ? '' : `Proxy-Authorization: Basic ${Buffer.from(`${proxy.username}:${proxy.password}`).toString('base64')}\r\n`;
+      socket.write(`CONNECT ${authority} HTTP/1.1\r\nHost: ${authority}\r\n${auth}\r\n`);
+    };
+    const onData = (chunk: Buffer) => {
+      pending = Buffer.concat([pending, chunk]);
+      const lineEnd = pending.indexOf('\r\n');
+      if (lineEnd >= 0) {
+        const firstLine = pending.subarray(0, lineEnd).toString('latin1');
+        const firstStatus = /^HTTP\/1\.[01] ([0-9]{3})(?: [\t\x20-\x7e\x80-\xff]*)?$/.exec(firstLine);
+        if (!firstStatus) return fail(new TunnelError('PROTOCOL', 'Invalid HTTP proxy status line'));
+        const status = Number(firstStatus[1]);
+        if (status < 200 || status >= 300) return fail(new TunnelError('REFUSED', 'HTTP proxy refused CONNECT', { status }));
+      }
+      const end = pending.indexOf('\r\n\r\n');
+      if (end < 0) {
+        if (pending.length > maxHeaderBytes) fail(new TunnelError('PROTOCOL', 'HTTP proxy response headers exceed limit'));
+        return;
+      }
+      if (end + 4 > maxHeaderBytes) return fail(new TunnelError('PROTOCOL', 'HTTP proxy response headers exceed limit'));
+      const lines = pending.subarray(0, end).toString('latin1').split('\r\n');
+      const statusLine = lines[0];
+      const match = /^HTTP\/1\.[01] ([0-9]{3})(?: [^\r\n]*)?$/.exec(statusLine);
+      if (!match) return fail(new TunnelError('PROTOCOL', 'Invalid HTTP proxy status line'));
+      const status = Number(match[1]);
+      if (lines.slice(1).some(line => !/^[!#$%&'*+.^_`|~0-9A-Za-z-]+:[\t\x20-\x7e\x80-\xff]*$/.test(line))) {
+        return fail(new TunnelError('PROTOCOL', 'Invalid HTTP proxy response header'));
+      }
+      if (status < 200 || status >= 300) return fail(new TunnelError('REFUSED', 'HTTP proxy refused CONNECT', { status }));
+      settled = true; socket.pause(); cleanup();
+      const head = pending.subarray(end + 4);
+      if (head.length) socket.unshift(head);
+      resolve(socket);
+    };
+    const timer = setTimeout(() => establishmentFailure('TIMEOUT', 'HTTP proxy establishment deadline exceeded'), timeoutMs);
+    socket.once(connectedEvent, onConnect); socket.on('data', onData);
+    socket.once('error', onError); socket.once('end', onEnd); socket.once('close', onClose);
+    signal?.addEventListener('abort', onAbort, { once: true });
+    if (signal?.aborted) onAbort();
+  });
+}
+
+// The bounded socket reader owns setup cancellation and preserves queued bytes.
+// Framing uses the existing
+// MIT socks5-handshake module; neither shared framing nor its DNS policy changes.
+async function connectSocks(authority: string, proxy: OpaqueProxyRoute, { signal, timeoutMs }: AttemptOptions): Promise<Socket> {
+  if (signal?.aborted) throw aborted();
+  const socket = net.createConnection({ host: proxy.host, port: proxy.port, allowHalfOpen: true });
+  socket.on('error', () => {});
+  let buffer: Buffer = Buffer.alloc(0), failure: Error | undefined;
+  let waiting: { length: number; resolve: () => void; reject: (error: Error) => void } | undefined;
+  const fail = (error: Error) => { if (failure) return; failure = error; const current = waiting; waiting = undefined; current?.reject(error); socket.destroy(); };
+  const transportError = (code: string, message: string) => fail(new TunnelError(code, message));
+  const onData = (chunk: Buffer) => {
+    // Consume at most the bytes needed by a bounded handshake read, then pause.
+    // A valid CONNECT reply can share a packet with arbitrary early target data;
+    // that remainder is not a malformed/oversized handshake and must survive.
+    socket.pause();
+    buffer = Buffer.concat([buffer, chunk]);
+    if (waiting && buffer.length >= waiting.length) { const current = waiting; waiting = undefined; current.resolve(); }
+    else if (waiting) socket.resume();
+  };
+  const onError = () => transportError('TRANSPORT', 'SOCKS proxy connection failed');
+  const onClose = () => transportError('EARLY_CLOSE', 'SOCKS proxy closed before tunnel establishment');
+  const onAbort = () => fail(aborted());
+  const timer = setTimeout(() => transportError('TIMEOUT', 'SOCKS establishment deadline exceeded'), timeoutMs);
+  socket.on('data', onData); socket.once('error', onError); socket.once('end', onClose); socket.once('close', onClose);
+  socket.pause();
+  signal?.addEventListener('abort', onAbort, { once: true }); if (signal?.aborted) onAbort();
+  const reader = {
+    write(bytes: Uint8Array): void { if (failure) throw failure; socket.write(bytes); },
+    async readExact(length: number): Promise<Buffer> {
+      if (failure) throw failure;
+      if (!Number.isSafeInteger(length) || length < 0 || length > 1024) throw new TunnelError('PROTOCOL', 'Invalid handshake read size');
+      if (buffer.length < length) await new Promise<void>((resolve, reject) => {
+        if (waiting) { reject(new TunnelError('PROTOCOL', 'Concurrent handshake read')); return; }
+        waiting = { length, resolve, reject };
+        socket.resume();
+      });
+      if (failure) throw failure;
+      const result = buffer.subarray(0, length); buffer = buffer.subarray(length); return result;
+    },
+  };
+  try {
+    const credentialsUrl = new URL('socks5://fixture.invalid');
+    if (proxy.username !== undefined) { credentialsUrl.username = encodeURIComponent(proxy.username); credentialsUrl.password = encodeURIComponent(proxy.password); }
+    const colon = authority.lastIndexOf(':');
+    const target = { host: authority.slice(0, colon).replace(/^\[|\]$/g, ''), port: Number(authority.slice(colon + 1)) };
+    await socks5Handshake(reader, target, socks5Credentials(credentialsUrl), signal);
+    if (failure) throw failure;
+    if (signal?.aborted || socket.destroyed) throw aborted();
+    socket.pause(); if (buffer.length) socket.unshift(buffer); buffer = Buffer.alloc(0);
+    return socket;
+  } catch (error) {
+    socket.destroy();
+    if (error instanceof Socks5HandshakeError) throw new TunnelError('SOCKS_REFUSED', 'SOCKS authentication, policy, or protocol refusal');
+    throw error;
+  } finally {
+    clearTimeout(timer); signal?.removeEventListener('abort', onAbort);
+    socket.removeListener('data', onData); socket.removeListener('error', onError);
+    socket.removeListener('end', onClose); socket.removeListener('close', onClose);
+  }
+}
+
+/** Establish only. There is no application data, implicit DIRECT, or replay here.
+ * HTTP/HTTPS CONNECT and SOCKS5/SOCKS5h yield an opaque raw target tunnel.
+ */
+export async function dialTunnel(authority: string, proxy: OpaqueProxyRoute, options: OpaqueTunnelOptions = {}): Promise<Socket> {
+  const { signal, timeoutMs = 10000, maxHeaderBytes = 65536 } = options;
+  validateAuthority(authority);
+  validateOptions(proxy, timeoutMs, maxHeaderBytes);
+  if (signal?.aborted) throw aborted();
+  // Snapshot the selected route. No alternate proxy or direct fallback exists.
+  const socket = await connectOne(authority, { ...proxy }, { signal, timeoutMs, maxHeaderBytes });
+  if (signal?.aborted || socket.destroyed) { socket.destroy(); throw aborted(); }
+  return socket;
+}

package/src/lib/redact.ts

@@ -7,7 +7,7 @@ export const REDACTED_SECRET = "[REDACTED]";
  * credentials over an unsafe channel (e.g. plaintext non-loopback HTTP) rather than
  * re-deriving a narrower local list.
  */
-export const SENSITIVE_KEY_PATTERN = /^(?:authorization|proxy-authorization|cookie|set-cookie|set-cookie2|api[-_]?key|x-api-key|x-goog-api-key|x-amz-security-token|copilot[-_]?session[-_]?token|session[-_]?token|access[-_]?token|refresh[-_]?token|id[-_]?token|token|secret|client[-_]?secret|password|profile[-_]?arn|exa[-_]?api[-_]?key)$/i;
+export const SENSITIVE_KEY_PATTERN = /^(?:authorization|proxy-authorization|cookie|set-cookie|set-cookie2|api[-_]?key|x-api-key|x-goog-api-key|x-amz-security-token|x-dsh-auth-token|copilot[-_]?session[-_]?token|session[-_]?token|access[-_]?token|refresh[-_]?token|id[-_]?token|token|secret|client[-_]?secret|password|profile[-_]?arn|exa[-_]?api[-_]?key)$/i;
 
 /**
  * Colon-labelled credential headers echoed back inside an error body
@@ -40,7 +40,7 @@ export const SENSITIVE_KEY_PATTERN = /^(?:authorization|proxy-authorization|cook
 // Every letter position also accepts \u0001, the placeholder the fold emits for
 // an unresolved HTML named reference: `authorⅈzation` is the label with one
 // character we cannot name, and that is still the label.
-const CREDENTIAL_HEADER_LABEL_RAW = "copilot[_-]?session[_-]?token|session[_-]?token|sessionToken|x-api-key|x-goog-api-key|x-amz-security-token|api[_-]?key|apiKey|exa[_-]?api[_-]?key|exaApiKey|access[_-]?token|accessToken|refresh[_-]?token|refreshToken|id[_-]?token|client[_-]?secret|clientSecret|authorization|proxy-authorization|cookie|set-cookie|password|secret|token";
+const CREDENTIAL_HEADER_LABEL_RAW = "copilot[_-]?session[_-]?token|session[_-]?token|sessionToken|x-api-key|x-goog-api-key|x-amz-security-token|x-dsh-auth-token|api[_-]?key|apiKey|exa[_-]?api[_-]?key|exaApiKey|access[_-]?token|accessToken|refresh[_-]?token|refreshToken|id[_-]?token|client[_-]?secret|clientSecret|authorization|proxy-authorization|cookie|set-cookie|password|secret|token";
 
 const CREDENTIAL_HEADER_LABEL = CREDENTIAL_HEADER_LABEL_RAW
   .replace(/(?<![\[\\])([A-Za-z])(?![\]\-])/g, "[$1\u0001]");

package/src/oauth/account-quota-rank.ts

@@ -96,7 +96,7 @@ function headroomOf(provider: string, accountId: string, requestedModelId?: stri
   const family = classifyModelFamilyForQuota(provider, requestedModelId);
   if (family) {
     const percents = (quota.customWindows ?? [])
-      .filter(window => windowMatchesFamily(window.label, family))
+      .filter(window => window.modelId === undefined && windowMatchesFamily(window.label, family))
       .map(window => window.percent)
       .filter((value): value is number => typeof value === "number");
     if (percents.length === 0) return null;
@@ -106,7 +106,7 @@ function headroomOf(provider: string, accountId: string, requestedModelId?: stri
     quota.fiveHourPercent,
     quota.weeklyPercent,
     quota.monthlyPercent,
-    ...(quota.customWindows ?? []).map(window => window.percent),
+    ...(quota.customWindows ?? []).filter(window => window.modelId === undefined).map(window => window.percent),
   ].filter((value): value is number => typeof value === "number");
   if (percents.length === 0) return null;
   return 100 - Math.max(...percents);
@@ -140,6 +140,73 @@ export function isAccountQuotaExhausted(
   return headroom !== null && headroom <= 0;
 }
 
+/**
+ * Earliest future reset timestamp (in ms) for the relevant quota window, or null if unknown.
+ * Prefers weekly reset when multiple windows exist so expiring allowance is consumed first.
+ */
+export function accountResetTimestamp(
+  provider: string,
+  accountId: string,
+  requestedModelId?: string | null,
+  now = Date.now(),
+): number | null {
+  const quota = getCachedProviderAccountQuota(provider, accountId);
+  if (!quota) return null;
+  const family = classifyModelFamilyForQuota(provider, requestedModelId);
+  const windows = (quota.customWindows ?? []).filter(w => !family || windowMatchesFamily(w.label, family));
+  const weekly = windows.find(w => /week/i.test(w.label));
+  let rawReset = weekly?.resetAt ?? quota.weeklyResetAt;
+  if (rawReset === undefined && provider !== "google-antigravity" && provider !== "anthropic") {
+    // Providers without a weekly cadence: prefer an explicitly 5h-labeled window before
+    // falling back to first-window order.
+    const fiveHour = windows.find(w => /5h|five/i.test(w.label)) ?? windows[0];
+    rawReset = fiveHour?.resetAt ?? quota.fiveHourResetAt;
+  } else if (rawReset === undefined) {
+    rawReset = windows[0]?.resetAt ?? quota.fiveHourResetAt;
+  }
+  if (typeof rawReset !== "number" || !Number.isFinite(rawReset)) return null;
+  const ms = rawReset < 1e11 ? rawReset * 1000 : rawReset;
+  return ms > now ? ms : null;
+}
+
+/**
+ * Rank candidates by soonest reset timestamp first among healthy accounts.
+ * Accounts whose quota will reset earliest get priority so allowances do not expire unused.
+ *
+ * When a passive provider has incomplete quota evidence (some ring members with no
+ * cached record), reset timestamps are unreliable: an unknown account converts to
+ * Infinity and always loses to a known near-exhausted one. Fall back to headroom
+ * order instead of inventing a reset ordering.
+ */
+export function rankAccountsByResetFirst(
+  provider: string,
+  ring: readonly string[],
+  requestedModelId?: string | null,
+  now = Date.now(),
+  accounts?: ReadonlyMap<string, ProviderAccount>,
+): string[] {
+  if (ring.length < 2) return [...ring];
+  const ranked = rankAccountsByHeadroom(provider, ring, requestedModelId, accounts);
+  const healthy = ranked.filter(id => !isAccountQuotaExhausted(provider, id, requestedModelId, accounts?.get(id)));
+  if (healthy.length < 2) return ranked;
+  if (
+    hasPassiveAccountQuota(provider)
+    && !ring.every(id => headroomOf(provider, id, requestedModelId, accounts?.get(id)) !== null)
+  ) return ranked;
+
+  const withReset = healthy.map((id, index) => ({
+    id,
+    resetAt: accountResetTimestamp(provider, id, requestedModelId, now) ?? Number.POSITIVE_INFINITY,
+    headroom: headroomOf(provider, id, requestedModelId, accounts?.get(id)) ?? 0,
+    index,
+  }));
+
+  withReset.sort((a, b) => (a.resetAt - b.resetAt) || (b.headroom - a.headroom) || (a.index - b.index));
+  const sortedHealthy = withReset.map(r => r.id);
+  const exhausted = ranked.filter(id => isAccountQuotaExhausted(provider, id, requestedModelId, accounts?.get(id)));
+  return [...sortedHealthy, ...exhausted];
+}
+
 /**
  * Order candidates best-first.
  *

package/src/oauth/anthropic-account-refusal.ts

@@ -31,6 +31,22 @@ export function bindAnthropicRefusalCredentialForSend(response: Response, owner:
   responseCredentials.set(response, Object.freeze({ ...owner, providerAccountUuid, checkProviderUuid: arguments.length >= 3 }));
 }
 
+/** Preserve the original send proof across internal error normalization, without renewing it. */
+export function carryAnthropicRefusalCredential(source: Response, target: Response): void {
+  const sent = responseCredentials.get(source);
+  if (sent) responseCredentials.set(target, sent);
+}
+
+/** Recheck after body consumption: a late refusal cannot acquire a replacement login's authority. */
+export function anthropicRefusalCredentialIsCurrent(response: Response, instance: AnthropicInstanceId, accountId: string): boolean {
+  const sent = responseCredentials.get(response);
+  if (!sent || sent.provider !== instance || sent.accountId !== accountId
+    || !anthropicPhysicalSendOwnershipIsCurrent(sent)) return false;
+  const row = getAccountCredentialWithStatus(instance, accountId);
+  return !!row && !row.paused && !row.needsReauth
+    && (!sent.checkProviderUuid || row.credential.accountId === sent.providerAccountUuid);
+}
+
 async function isRevokedOAuthToken(response: Response, signal?: AbortSignal): Promise<boolean> {
   if (response.status !== 401) return false;
   try {
@@ -59,9 +75,11 @@ async function isAccountRefusal(response: Response, signal?: AbortSignal): Promi
     // Whole-message patterns: request-policy/model/resource refusals and quoted diagnostics
     // must not acquire account authority merely by containing entitlement keywords.
     if ("code" in error && error.code != null
-      && (typeof error.code !== "string" || !["subscription_required", "insufficient_quota", "permission_denied"].includes(error.code))) return false;
+      && (typeof error.code !== "string" || !["subscription_required", "insufficient_quota", "permission_denied", "oauth_org_not_allowed"].includes(error.code))) return false;
+    // The organization disabled subscription access: an account-scoped verdict, cooled like its siblings.
+    if (error.type === "oauth_org_not_allowed" || ("code" in error && error.code === "oauth_org_not_allowed")) return true;
     const message = error.message.trim();
-    if (error.type === "permission_error" && /^(?:Your account does not have access to Claude Code|Your (?:Claude )?subscription (?:has expired|is (?:expired|inactive))|Your account does not have an active subscription)[.!]?$/i.test(message)) return true;
+    if (error.type === "permission_error" && /^(?:Your account does not have access to Claude Code|Your (?:Claude )?subscription (?:has expired|is (?:expired|inactive))|Your account does not have an active subscription|(?:Your|This) organization has disabled Claude subscription access for Claude Code(?:\. Use an Anthropic API key instead, or ask your admin to enable access)?)[.!]?$/i.test(message)) return true;
     return (error.type === "billing_error" || error.type === "permission_error")
       && /^Your credit balance is too low to access the Anthropic API\.(?: Please go to Plans & Billing to upgrade or purchase credits\.)?$/i.test(message);
   } catch {

package/src/oauth/anthropic-oauth-definitions.ts

@@ -1,7 +1,7 @@
 import { ConfigMutationLockError } from "../config";
 import { deriveOAuthDefaultModel, deriveOAuthProviderConfig } from "../providers/derive";
 import type { AnthropicInstanceId } from "../providers/anthropic-instance-id";
-import { loginAnthropic, refreshAnthropicToken } from "./anthropic";
+import { ANTHROPIC_CODE_REDIRECT_URI, loginAnthropic, refreshAnthropicToken } from "./anthropic";
 import type { OAuthProviderDef } from "./index";
 import {
   clearOAuthRefreshIntent, clearOAuthRefreshIntentIfMatch, markOAuthRefreshIntentCleanupPending,
@@ -16,8 +16,10 @@ export function anthropicOAuthDefinition(instance: AnthropicInstanceId): OAuthPr
   return {
     login: (ctrl, opts) => loginAnthropic(ctrl, {
       instance, importLocal: instance === "anthropic2" || opts?.forceLogin ? "off" : "fallback",
+      codeMode: opts?.codeMode === true,
     }),
     refresh: refreshAnthropicToken,
+    codeRedirectUri: ANTHROPIC_CODE_REDIRECT_URI,
     providerConfig,
     defaultModel,
     // Subscription OAuth must never generate unattended traffic by default.

package/src/oauth/anthropic-routing.ts

@@ -19,7 +19,6 @@ import { clearAllAnthropicFamilyQuota, anthropicModelQuotaFor, anthropicModelPer
  */
 import { clearAllAnthropicRatePauses, anthropicRatePolicyFor, classifyAnthropic429, anthropicRetryAfterMs } from "./anthropic-rate-limit-policy";
 import { REFRESH_SKEW_MS } from "./refresh-policy";
-import { createHash } from "node:crypto";
 import { captureOAuthAccountSelection, commitOAuthAccountSelection, credentialGeneration, getAccountSet, getAccountCredential, getAccountCredentialWithStatus } from "./store";
 import type { OAuthAccessSnapshot } from "./index";
 import { getCachedProviderAccountQuota } from "../providers/quota";
@@ -273,26 +272,7 @@ export function formatAnthropicProviderForLog(
   return `${providerName}-${formatAnthropicAccountOrdinal(accountId)}`;
 }
 
-export function anthropicSessionKeyFromParts(input: {
-  sessionIdHeader?: string | null;
-  threadIdHeader?: string | null;
-  promptCacheKey?: string | null;
-  clientThreadId?: string | null;
-  /** When true, prompt_cache_key is a shared Desktop cohort — ignore it for affinity. */
-  promptCacheKeyIsSharedCohort?: boolean;
-}): string | null {
-  const preferred = input.clientThreadId?.trim()
-    || input.sessionIdHeader?.trim()
-    || input.threadIdHeader?.trim()
-    || "";
-  if (preferred) {
-    return preferred.length <= 128 ? preferred : createHash("sha256").update(preferred).digest("hex");
-  }
-  if (input.promptCacheKeyIsSharedCohort) return null;
-  const cacheKey = input.promptCacheKey?.trim() ?? "";
-  if (!cacheKey) return null;
-  return cacheKey.length <= 128 ? cacheKey : createHash("sha256").update(cacheKey).digest("hex");
-}
+export { oauthSessionKeyFromParts as anthropicSessionKeyFromParts } from "./session-affinity-key";
 
 
 export type AnthropicCooldownRecoveryClaim = Readonly<{

package/src/oauth/anthropic.ts

@@ -15,6 +15,16 @@ const CALLBACK_PATH = "/callback";
 /** Profile enrichment budget on token refresh; login paths keep the resolver's own deadline. */
 const REFRESH_PROFILE_TIMEOUT_MS = 2_000;
 const SCOPES = "org:create_api_key user:profile user:inference";
+/**
+ * Provider-hosted code-display redirect: Anthropic renders `code#state` for the user to copy
+ * instead of redirecting to a local port. This is what makes login possible from a container or
+ * a hosted gateway, where no browser can reach this process. Same OAuth client as the callback
+ * flow — only the redirect differs, so it must be the redirect_uri used for BOTH the authorize
+ * request and the token exchange.
+ */
+export const ANTHROPIC_CODE_REDIRECT_URI = "https://platform.claude.com/oauth/code/callback";
+/** A displayed code is copied by hand across devices; the 300s callback wait is too short. */
+const CODE_MODE_TIMEOUT_MS = 10 * 60_000;
 
 // ── OAuth-request requirements applied by the anthropic adapter when authMode==="oauth" ──
 export const ANTHROPIC_OAUTH_BETA = "claude-code-20250219,oauth-2025-04-20";
@@ -142,10 +152,27 @@ async function withAccountProfile(credential: OAuthCredentials, signal?: AbortSi
 }
 
 export class AnthropicOAuthFlow extends OAuthCallbackFlow {
+  /**
+   * PKCE verifier for THIS flow. One `AnthropicOAuthFlow` is constructed per login and
+   * `generateAuthUrl` runs once on it, so the verifier is already flow-scoped: a second
+   * concurrent login builds a second instance and cannot reach this field.
+   */
   #verifier = "";
+  #codeMode: boolean;
 
-  constructor(ctrl: OAuthController) {
-    super(ctrl, CALLBACK_PORT, CALLBACK_PATH);
+  constructor(ctrl: OAuthController, opts?: { codeMode?: boolean }) {
+    if (opts?.codeMode) {
+      super(ctrl, {
+        preferredPort: CALLBACK_PORT,
+        callbackPath: CALLBACK_PATH,
+        redirectUri: ANTHROPIC_CODE_REDIRECT_URI,
+        skipCallbackServer: true,
+        timeoutMs: CODE_MODE_TIMEOUT_MS,
+      });
+    } else {
+      super(ctrl, CALLBACK_PORT, CALLBACK_PATH);
+    }
+    this.#codeMode = opts?.codeMode === true;
   }
 
   async generateAuthUrl(state: string, redirectUri: string): Promise<{ url: string; instructions?: string }> {
@@ -163,8 +190,9 @@ export class AnthropicOAuthFlow extends OAuthCallbackFlow {
     });
     return {
       url: `${AUTHORIZE_URL}?${authParams.toString()}`,
-      instructions:
-        "Complete Claude login in your browser. If the browser cannot reach this machine, paste the final redirect URL or authorization code when prompted.",
+      instructions: this.#codeMode
+        ? "Open this URL in any browser, approve access, then paste the code Anthropic displays (it looks like code#state)."
+        : "Complete Claude login in your browser. If the browser cannot reach this machine, paste the final redirect URL or authorization code when prompted.",
     };
   }
 
@@ -191,9 +219,12 @@ export class AnthropicOAuthFlow extends OAuthCallbackFlow {
 
 export async function loginAnthropic(
   ctrl: OAuthController,
-  opts?: { importLocal?: LocalTokenImportMode; instance?: AnthropicInstanceId },
+  opts?: { importLocal?: LocalTokenImportMode; instance?: AnthropicInstanceId; codeMode?: boolean },
 ): Promise<OAuthCredentials> {
-  const importLocal = opts?.importLocal ?? "off";
+  // A code-mode caller asked for a URL to show and a box to paste into. Importing a local
+  // Claude Code token instead would complete WITHOUT ever firing onAuth, so the caller would
+  // get no URL at all — a different outcome than the one its contract promises.
+  const importLocal = opts?.codeMode ? "off" : opts?.importLocal ?? "off";
   if (opts?.instance === "anthropic2" && importLocal !== "off") throw new AnthropicLocalCliImportError();
   if (importLocal !== "off") {
     const { detectClaudeCodeToken } = await import("./local-token-detect");
@@ -221,7 +252,7 @@ export async function loginAnthropic(
       );
     }
   }
-  return new AnthropicOAuthFlow(ctrl).login();
+  return new AnthropicOAuthFlow(ctrl, { codeMode: opts?.codeMode === true }).login();
 }
 
 export async function refreshAnthropicToken(refreshToken: string): Promise<OAuthCredentials> {

package/src/oauth/callback-server.ts

@@ -66,6 +66,15 @@ export interface OAuthCallbackFlowOptions {
   callbackBindHostname?: string;
   /** Exact redirect URI advertised to the provider; disables port fallback. */
   redirectUri?: string;
+  /**
+   * Code-display mode: the provider renders the authorization code for the user to paste, so
+   * this process never receives a redirect and must NOT open a listener. Requires `redirectUri`
+   * (the provider-hosted code page) and an `onManualCodeInput` channel — without one the flow
+   * would wait for a callback that can never arrive.
+   */
+  skipCallbackServer?: boolean;
+  /** Overrides the 300s wait for the code; code-display pastes are hand-typed and slower. */
+  timeoutMs?: number;
 }
 
 type BunServer = ReturnType<typeof Bun.serve>;
@@ -77,6 +86,8 @@ export abstract class OAuthCallbackFlow {
   callbackHostname: string;
   callbackBindHostname: string;
   redirectUri?: string;
+  skipCallbackServer: boolean;
+  timeoutMs: number;
   #callbackResolve?: (result: CallbackResult) => void;
   #callbackReject?: (error: string) => void;
 
@@ -86,6 +97,8 @@ export abstract class OAuthCallbackFlow {
     callbackPath: string = CALLBACK_PATH,
   ) {
     this.ctrl = ctrl;
+    this.skipCallbackServer = false;
+    this.timeoutMs = DEFAULT_TIMEOUT;
     if (typeof preferredPortOrOptions === "number") {
       this.preferredPort = preferredPortOrOptions;
       this.callbackPath = callbackPath;
@@ -98,6 +111,11 @@ export abstract class OAuthCallbackFlow {
     this.callbackHostname = preferredPortOrOptions.callbackHostname ?? DEFAULT_HOSTNAME;
     this.callbackBindHostname = preferredPortOrOptions.callbackBindHostname ?? DEFAULT_BIND_HOSTNAME;
     this.redirectUri = preferredPortOrOptions.redirectUri;
+    this.skipCallbackServer = preferredPortOrOptions.skipCallbackServer === true;
+    this.timeoutMs = preferredPortOrOptions.timeoutMs ?? DEFAULT_TIMEOUT;
+    if (this.skipCallbackServer && !this.redirectUri) {
+      throw new Error("skipCallbackServer requires an explicit redirectUri");
+    }
   }
 
   /** Build provider-specific authorization URL. */
@@ -132,6 +150,14 @@ export abstract class OAuthCallbackFlow {
   }
 
   async #startCallbackServer(expectedState: string): Promise<{ servers: BunServer[]; redirectUri: string }> {
+    if (this.skipCallbackServer) {
+      // The paste channel is the ONLY way this flow can complete. Fail loudly here rather than
+      // hanging until the timeout on a controller that can never deliver a code.
+      if (!this.ctrl.onManualCodeInput) {
+        throw new Error("Code-display login requires a manual code input channel");
+      }
+      return { servers: [], redirectUri: this.redirectUri! };
+    }
     try {
       const servers = this.#createServers(this.preferredPort, expectedState);
       if (this.redirectUri) {
@@ -226,7 +252,7 @@ export abstract class OAuthCallbackFlow {
   }
 
   #waitForCallback(expectedState: string): Promise<CallbackResult> {
-    const timeoutSignal = AbortSignal.timeout(DEFAULT_TIMEOUT);
+    const timeoutSignal = AbortSignal.timeout(this.timeoutMs);
     const signal = this.ctrl.signal ? AbortSignal.any([this.ctrl.signal, timeoutSignal]) : timeoutSignal;
 
     const callbackPromise = new Promise<CallbackResult>((resolve, reject) => {

package/src/oauth/chatgpt-device.ts

@@ -1,5 +1,5 @@
 import type { OAuthController, OAuthCredentials } from "./types";
-import { CHATGPT_CLIENT_ID, CHATGPT_TOKEN_URL, credsFromToken } from "./chatgpt";
+import { CHATGPT_CLIENT_ID, CHATGPT_TOKEN_URL, credsFromToken } from "./chatgpt-shared";
 
 /**
  * OpenAI deviceauth (device-code) grant for the ChatGPT/Codex provider.