@bitkyc08/opencodex 2.86.0 → 2.88.0

package/src/lib/errors.ts

@@ -650,10 +650,22 @@ export function adapterFailureFromMessage(message: string): { httpStatus: number
   return { httpStatus, error };
 }
 
+/** A declared client refusal: retrying the identical request cannot change the verdict. */
+const CLIENT_ERROR_STATUS: Record<string, 400 | 401 | 403 | 404> = {
+  invalid_request_error: 400,
+  authentication_error: 401,
+  permission_error: 403,
+  not_found_error: 404,
+};
+
 /** Narrow structured classes carried through a synthesized bare-error terminal. */
 export function recognizedUpstreamError(error: { type?: unknown; code?: unknown }):
-  { type: string; code: string; httpStatus: 429 | 503 } | undefined {
+  { type: string; code: string; httpStatus: 400 | 401 | 403 | 404 | 429 | 503 } | undefined {
   const code = typeof error.code === "string" ? error.code : undefined;
+  const clientClass = code ?? (typeof error.type === "string" ? error.type : undefined);
+  if (clientClass !== undefined && Object.hasOwn(CLIENT_ERROR_STATUS, clientClass)) {
+    return { type: clientClass, code: clientClass, httpStatus: CLIENT_ERROR_STATUS[clientClass] };
+  }
   // An explicit unknown code must not gain a recognized class from its type or copy.
   if (code !== undefined && !["rate_limit_exceeded", "rate_limit_error", "server_is_overloaded", "overloaded_error"].includes(code)) return undefined;
   if (code === "rate_limit_exceeded" || code === "rate_limit_error"
@@ -680,8 +692,13 @@ export function httpStatusFromTerminalError(error: {
   if (isCyberPolicyCode(error.code) || (error.message ? isCyberPolicyMessage(error.message) : false)) {
     return 400;
   }
+  const message = error.message ?? "";
   const recognized = recognizedUpstreamError(error);
-  if (recognized) return recognized.httpStatus;
+  // Client-closed messages often arrive as invalid_request_error after classifyError, so a
+  // recognized 400 yields to the client-closed check below; every other class keeps its order.
+  if (recognized && !(recognized.httpStatus === 400 && message && isClientClosedMessage(message))) {
+    return recognized.httpStatus;
+  }
   if (error.type === "rate_limit_error" || error.code === "rate_limit_exceeded") return 429;
   if (error.type === "authentication_error" || error.code === "invalid_api_key") return 401;
   if (
@@ -693,7 +710,6 @@ export function httpStatusFromTerminalError(error: {
   if (error.type === "server_error" && error.code === "server_is_overloaded") return 503;
   // Client-closed messages often arrive as invalid_request_error after classifyError; check message
   // before treating every invalid_request_error as HTTP 400.
-  const message = error.message ?? "";
   if (message && isClientClosedMessage(message)) return 499;
   if (error.type === "invalid_request_error") return 400;
   if (error.type === "proxy_error") return 500;

package/src/lib/gcp-adc.ts

@@ -2,6 +2,10 @@
  * Application Default Credentials (ADC) resolution for Vertex AI.
  *
  * Direct WebCrypto + REST implementation (no `google-auth-library`). Sources, in priority order:
+ *   0. A `gcp-sa:<account>` reference (the provider's active key resolving to one) → the Service
+ *      Account / authorized_user JSON stored in the OS credential store under that account
+ *      (`keychain:<account>` secret, written by the key-store save path when the user pastes a
+ *      credential JSON directly into the API-key slot). See resolveGcpCredentialMarker.
  *   1. `GOOGLE_APPLICATION_CREDENTIALS` env → file with `type: "service_account"` (RS256 JWT
  *      exchange) or `type: "authorized_user"` (refresh-token exchange).
  *   2. gcloud user ADC (`CLOUDSDK_CONFIG`, else `%APPDATA%\gcloud` on Windows, else
@@ -18,6 +22,8 @@ import { Buffer } from "node:buffer";
 import * as os from "node:os";
 import * as path from "node:path";
 import { readFileSync, existsSync, statSync } from "node:fs";
+import { GCP_CREDENTIAL_MARKER_PREFIX, providerKeychainEntry } from "../providers/api-key-resolve";
+export { isGcpCredentialMaterial } from "./gcp-credential-input";
 import {
   captureConfigGeneration,
   sweepExpiredOnWrite,
@@ -36,6 +42,50 @@ const TOKEN_TIMEOUT_MS = 15_000;
 const TOKEN_ATTEMPTS = 3;
 const TOKEN_RETRY_BASE_MS = 300;
 
+/**
+ * Reference prefix stored in `provider.apiKey` (and `apiKeyPool` entries) when the user pastes a
+ * GCP credential JSON directly into an API-key slot. The secret JSON lives in the OS credential
+ * store under the same service the `keychain:` references use; only the marker is persisted to
+ * `config.json`. The leaf reference prefix also identifies already-stored material for migration.
+ */
+export { GCP_CREDENTIAL_MARKER_PREFIX } from "../providers/api-key-resolve";
+
+/** Extract a marker account; malformed explicit markers never opt into host ADC. */
+export function gcpCredentialMarkerAccount(value: string | undefined): string | undefined {
+  if (typeof value !== "string" || !value.startsWith(GCP_CREDENTIAL_MARKER_PREFIX)) return undefined;
+  const account = value.slice(GCP_CREDENTIAL_MARKER_PREFIX.length);
+  if (!account.trim()) throw new Error("GCP credential marker requires a non-empty account");
+  return account;
+}
+
+/**
+ * Whether a pasted API-key value is in fact a GCP credential JSON. Used by the save path to
+ * divert JSON material out of the literal-key flow before it reaches `config.json`. Deliberately
+ * strict: only a `type` field with a known ADC credential type counts, so a user's literal API
+ * key that happens to start with `{` is never eaten.
+ */
+export function parseGcpCredentialJson(value: string): AdcFileCredentials | undefined {
+  const trimmed = (value ?? "").trim();
+  if (!trimmed.startsWith("{") || !trimmed.endsWith("}")) return undefined;
+  try {
+    const parsed = JSON.parse(trimmed) as Record<string, unknown>;
+    if (parsed?.type === "service_account") {
+      if (typeof parsed.client_email !== "string" || !parsed.client_email.trim()) return undefined;
+      if (typeof parsed.private_key !== "string" || !parsed.private_key.trim()) return undefined;
+      return parsed as unknown as AdcFileCredentials;
+    }
+    if (parsed?.type === "authorized_user") {
+      if (typeof parsed.client_id !== "string" || !parsed.client_id.trim()) return undefined;
+      if (typeof parsed.client_secret !== "string" || !parsed.client_secret.trim()) return undefined;
+      if (typeof parsed.refresh_token !== "string" || !parsed.refresh_token.trim()) return undefined;
+      return parsed as unknown as AdcFileCredentials;
+    }
+    return undefined;
+  } catch {
+    return undefined;
+  }
+}
+
 interface CachedToken {
   token: string;
   expiresAtMs: number;
@@ -81,7 +131,10 @@ export function sweepExpiredGcpAdcTokens(now = Date.now()): number {
 
 export function reconcileGcpAdcTokens(context: GenerationContext): number {
   if (context.generation <= lastReconciledGeneration) return 0;
-  const currentSource = currentAdcSourceKey();
+  // The periodic sweep registration has no request context, so no marker is active here: markers
+  // travel per-request via getVertexAccessToken(options.markerAccount), and a marker-token cache
+  // entry whose account no longer resolves is simply pruned by this sweep when it expires.
+  const currentSource = currentAdcSourceKey(undefined);
   let removed = 0;
   for (const source of tokenCache.keys()) {
     if (source === currentSource) continue;
@@ -131,7 +184,29 @@ function readJsonFile<T>(filePath: string): T | undefined {
   return JSON.parse(readFileSync(filePath, "utf8")) as T;
 }
 
-function loadAdcCredentials(): { source: string; creds: AdcFileCredentials } | undefined {
+/**
+ * Read the credential JSON for a `gcp-sa:<account>` marker from the OS credential store. Uses the
+ * same service name and the same injectable entry factory as the `keychain:` API-key references
+ * (api-key-resolve.providerKeychainEntry), so one probe surface and one test seam cover both.
+ * Mirrors `readKeychain`'s fail-closed policy: an unreadable entry yields no credential (the
+ * caller surfaces the failure instead of silently falling through to the next ADC source).
+ */
+function readMarkerCredential(account: string): AdcFileCredentials | undefined {
+  try {
+    const raw = providerKeychainEntry(account).getPassword();
+    if (typeof raw !== "string" || !raw.trim()) return undefined;
+    return parseGcpCredentialJson(raw);
+  } catch {
+    return undefined;
+  }
+}
+
+function loadAdcCredentials(markerAccount: string | undefined): { source: string; creds: AdcFileCredentials } | undefined {
+  if (markerAccount) {
+    const creds = readMarkerCredential(markerAccount);
+    if (!creds) throw new Error("GCP credential marker is set but its credential could not be read from the OS credential store");
+    return { source: `marker:${markerAccount}`, creds };
+  }
   const gacPath = process.env.GOOGLE_APPLICATION_CREDENTIALS;
   if (gacPath) {
     const creds = readJsonFile<AdcFileCredentials>(gacPath);
@@ -148,9 +223,10 @@ function loadAdcCredentials(): { source: string; creds: AdcFileCredentials } | u
  * The cache key for the source the NEXT resolve would use, computed cheaply (no network). Lets the
  * cache return a token only when it still matches the active credential source, so an in-process
  * change to GOOGLE_APPLICATION_CREDENTIALS (or the user ADC file) does not keep serving a stale
- * token from a different source. Falls back to "metadata" when no file/env ADC is present.
+ * token from a different source. Falls back to "metadata" when no marker/file/env ADC is present.
  */
-function currentAdcSourceKey(): string {
+function currentAdcSourceKey(markerAccount: string | undefined): string {
+  if (markerAccount) return `marker:${markerAccount}`;
   const gacPath = process.env.GOOGLE_APPLICATION_CREDENTIALS;
   if (gacPath) return fileSourceTag("gac", gacPath);
   const userPath = userAdcPath();
@@ -279,8 +355,8 @@ async function fetchMetadataToken(signal: AbortSignal | undefined, fetchImpl: Fe
   }
 }
 
-async function resolveAccessTokenUncached(signal: AbortSignal | undefined, fetchImpl: FetchImpl): Promise<{ source: string; token: TokenResponse }> {
-  const adc = loadAdcCredentials();
+async function resolveAccessTokenUncached(markerAccount: string | undefined, signal: AbortSignal | undefined, fetchImpl: FetchImpl): Promise<{ source: string; token: TokenResponse }> {
+  const adc = loadAdcCredentials(markerAccount);
   if (adc) {
     const token = adc.creds.type === "service_account"
       ? await exchangeJwtForToken(adc.creds, signal, fetchImpl)
@@ -295,14 +371,25 @@ async function resolveAccessTokenUncached(signal: AbortSignal | undefined, fetch
 }
 
 /** Returns a Bearer access token for the `Authorization` header on Vertex AI calls (cached + refreshed). */
-export async function getVertexAccessToken(options?: { signal?: AbortSignal; fetch?: FetchImpl }): Promise<string> {
+export async function getVertexAccessToken(options?: { signal?: AbortSignal; fetch?: FetchImpl; markerAccount?: string }): Promise<string> {
+  // The marker travels as an argument, never as process-global state: a module-level "active
+  // marker" written by the router would race across concurrent requests for different providers
+  // and could resolve one provider's Vertex call with another provider's service account. The
+  // adapter passes `gcpCredentialMarkerAccount(provider.apiKey)` per request instead.
+  const markerAccount = options?.markerAccount;
   const fetchImpl = options?.fetch ?? globalThis.fetch.bind(globalThis);
   const skew = getRefreshSkewMs();
   const now = Date.now();
 
   // Only serve a cached token that matches the source the next resolve would actually use; prune
   // expired or now-stale (different-source) entries so a credential-source change is honored.
-  const expectedSource = currentAdcSourceKey();
+  const expectedSource = currentAdcSourceKey(markerAccount);
+  // A cached bearer token is usable only while the explicitly selected store entry remains
+  // readable. Removal or a locked store must fail closed before the cache can return it.
+  if (markerAccount && !readMarkerCredential(markerAccount)) {
+    tokenCache.delete(expectedSource);
+    throw new Error("GCP credential marker is set but its credential could not be read from the OS credential store");
+  }
   const writerGeneration = captureConfigGeneration();
   for (const [source, cached] of tokenCache) {
     if (source === expectedSource && cached.expiresAtMs - skew > now) return cached.token;
@@ -317,7 +404,7 @@ export async function getVertexAccessToken(options?: { signal?: AbortSignal; fet
 
   const promise = (async () => {
     try {
-      const { source, token } = await resolveAccessTokenUncached(options?.signal, fetchImpl);
+      const { source, token } = await resolveAccessTokenUncached(markerAccount, options?.signal, fetchImpl);
       const expiresAtMs = Date.now() + Math.max(0, token.expires_in * 1000);
       if (writerGeneration >= lastReconciledGeneration || liveSources.has(source)) {
         tokenCache.set(source, { token: token.access_token, expiresAtMs });

package/src/lib/gcp-credential-input.ts

@@ -0,0 +1,12 @@
+/** Structured JSON is never literal key material; malformed GCP text is also refused. */
+export function isGcpCredentialMaterial(value: string): boolean {
+  const credentialField = /\b(?:service_account|authorized_user|external_account|private_key|refresh_token|client_secret)\b|-----BEGIN [A-Z ]*PRIVATE KEY-----/;
+  if (/[\[\{"']/.test(value) && credentialField.test(value)) return true;
+  // Reject structured carriers outright rather than recursively guessing their credential shape.
+  // This includes quoted/array/object wrappers with arbitrarily escaped or nested JSON inside.
+  try {
+    const parsed: unknown = JSON.parse(value);
+    return typeof parsed === "string" || (parsed !== null && typeof parsed === "object");
+  }
+  catch { return false; }
+}

package/src/lib/lab-live-route-production.ts

@@ -72,6 +72,11 @@ export async function buildLabProviderAuthHeaders(
       && configuredAnthropicInstance(config, routeContext.providerId) !== routeContext.providerId) {
       throw new TransportError("auth_blocked", "anthropic instance unavailable");
     }
+    // The DSH account token is sent only by its own adapter to its pinned endpoint; the generic
+    // probe transport would use another endpoint and auth scheme.
+    if (routeContext.providerId === "dsh-account") {
+      throw new TransportError("auth_blocked", "dsh-account probes are not supported");
+    }
     try {
       const snapshot = await getValidAccessTokenSnapshot(routeContext.providerId);
       headers.Authorization = `Bearer ${snapshot.accessToken}`;

package/src/lib/opaque-proxy-tunnel.ts

@@ -0,0 +1,217 @@
+/**
+ * Single-route opaque proxy tunnel. The desktop upstream dialer retains its
+ * own fixed-target TLS contract.
+ * Shares OpenCodex's MIT SOCKS handshake; the caller owns all post-establishment
+ * cancellation and socket cleanup. Never replay or implicitly retry directly.
+ */
+import net, { type Socket } from 'node:net';
+import tls from 'node:tls';
+import { socks5Handshake, socks5Credentials, Socks5HandshakeError } from './socks5-handshake';
+
+interface RouteEndpoint { host: string; port: number }
+type RouteCredentials = { username?: undefined; password?: undefined } | { username: string; password: string };
+type PlainProxy = { kind?: 'http'; proxyCa?: never };
+type SecureProxy = { kind: 'https'; proxyCa?: string };
+type SocksProxy = { kind: 'socks5' | 'socks5h'; proxyCa?: never };
+export type OpaqueProxyRoute = RouteEndpoint & RouteCredentials & (PlainProxy | SecureProxy | SocksProxy);
+export interface OpaqueTunnelOptions {
+  signal?: AbortSignal;
+  timeoutMs?: number;
+  maxHeaderBytes?: number;
+}
+interface AttemptOptions {
+  signal?: AbortSignal;
+  timeoutMs: number;
+  maxHeaderBytes: number;
+}
+export class TunnelError extends Error {
+  override readonly name = 'TunnelError';
+  readonly code: string;
+  readonly status?: number;
+  constructor(code: string, message: string, { status }: { status?: number } = {}) {
+    super(message); this.code = code; this.status = status;
+  }
+}
+const aborted = () => new TunnelError('ABORTED', 'Tunnel establishment cancelled');
+
+function validateAuthority(authority: string): string {
+  if (typeof authority !== 'string' || !/^(?:\[[0-9a-fA-F:]+\]|[a-zA-Z0-9._-]+):[0-9]+$/.test(authority)) {
+    throw new TunnelError('TARGET', 'An explicit host:port authority is required');
+  }
+  const port = Number(authority.slice(authority.lastIndexOf(':') + 1));
+  if (!Number.isInteger(port) || port < 1 || port > 65535) throw new TunnelError('TARGET', 'Invalid target port');
+  return authority;
+}
+
+function validateOptions(p: OpaqueProxyRoute, timeoutMs: number, maxHeaderBytes: number): void {
+  if (!p || Array.isArray(p) || typeof p.host !== 'string' || !p.host || /[\s/@]/.test(p.host)
+    || !Number.isInteger(p.port) || p.port < 1 || p.port > 65535
+    || !['http', 'https', 'socks5', 'socks5h'].includes(p.kind ?? 'http')) throw new TunnelError('CONFIG', 'Invalid proxy route');
+  if ((p.username === undefined) !== (p.password === undefined)
+    || (p.username !== undefined && (typeof p.username !== 'string' || typeof p.password !== 'string'
+      || (!p.kind?.startsWith('socks') && p.username.includes(':')) || Buffer.byteLength(p.username + p.password) > 4096))) throw new TunnelError('CONFIG', 'Invalid proxy credentials');
+  if ((p.kind ?? 'http').startsWith('socks') && p.username !== undefined
+    && (Buffer.byteLength(p.username) > 255 || Buffer.byteLength(p.password) > 255)) throw new TunnelError('CONFIG', 'SOCKS credentials must each fit in 255 UTF-8 bytes');
+  if (p.proxyCa !== undefined && p.kind !== 'https') throw new TunnelError('CONFIG', 'Proxy TLS settings require HTTPS proxy');
+  if (p.proxyCa !== undefined && typeof p.proxyCa !== 'string') throw new TunnelError('CONFIG', 'Invalid proxy CA');
+  if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 30000
+    || !Number.isSafeInteger(maxHeaderBytes) || maxHeaderBytes < 64 || maxHeaderBytes > 65536) {
+    throw new TunnelError('CONFIG', 'Invalid deadline or header limit');
+  }
+}
+
+function connectOne(authority: string, proxy: OpaqueProxyRoute, { signal, timeoutMs, maxHeaderBytes }: AttemptOptions): Promise<Socket> {
+  if (proxy.kind === 'socks5' || proxy.kind === 'socks5h') return connectSocks(authority, proxy, { signal, timeoutMs, maxHeaderBytes });
+  return new Promise<Socket>((resolve, reject) => {
+    if (signal?.aborted) return reject(aborted());
+    const secure = proxy.kind === 'https';
+    const identity = proxy.host;
+    const tlsOptions: tls.ConnectionOptions & { allowHalfOpen: boolean } = {
+      host: proxy.host, port: proxy.port, allowHalfOpen: true,
+      servername: net.isIP(identity) ? undefined : identity, ca: proxy.proxyCa,
+      checkServerIdentity: (_name, cert) => tls.checkServerIdentity(identity, cert),
+      rejectUnauthorized: true, ALPNProtocols: ['http/1.1'],
+    };
+    const socket = secure
+      ? tls.connect(tlsOptions)
+      : net.createConnection({ host: proxy.host, port: proxy.port, allowHalfOpen: true });
+    // Keep a defensive observer across the promise-to-owner handoff. Errors still
+    // settle the establishment promise or are handled by the relay after handoff.
+    socket.on('error', () => {});
+    let pending: Buffer = Buffer.alloc(0); let settled = false, tlsReady = !secure;
+    const connectedEvent = secure ? 'secureConnect' : 'connect';
+    const cleanup = () => {
+      clearTimeout(timer); signal?.removeEventListener('abort', onAbort);
+      socket.removeListener(connectedEvent, onConnect); socket.removeListener('data', onData);
+      socket.removeListener('error', onError); socket.removeListener('end', onEnd); socket.removeListener('close', onClose);
+    };
+    const fail = (error: Error) => {
+      if (settled) return; settled = true; cleanup(); socket.destroy(); reject(error);
+    };
+    const onAbort = () => fail(aborted());
+    const establishmentFailure = (code: string, message: string) => fail(new TunnelError(code, message));
+    const onError = () => {
+      if (secure && !tlsReady) {
+        fail(new TunnelError('PROXY_TLS', 'HTTPS proxy establishment failed'));
+      } else establishmentFailure('TRANSPORT', 'HTTP proxy connection failed');
+    };
+    const onEnd = () => establishmentFailure('EARLY_CLOSE', 'HTTP proxy closed before establishing the tunnel');
+    const onClose = onEnd;
+    const onConnect = () => {
+      tlsReady = true;
+      const auth = proxy.username === undefined ? '' : `Proxy-Authorization: Basic ${Buffer.from(`${proxy.username}:${proxy.password}`).toString('base64')}\r\n`;
+      socket.write(`CONNECT ${authority} HTTP/1.1\r\nHost: ${authority}\r\n${auth}\r\n`);
+    };
+    const onData = (chunk: Buffer) => {
+      pending = Buffer.concat([pending, chunk]);
+      const lineEnd = pending.indexOf('\r\n');
+      if (lineEnd >= 0) {
+        const firstLine = pending.subarray(0, lineEnd).toString('latin1');
+        const firstStatus = /^HTTP\/1\.[01] ([0-9]{3})(?: [\t\x20-\x7e\x80-\xff]*)?$/.exec(firstLine);
+        if (!firstStatus) return fail(new TunnelError('PROTOCOL', 'Invalid HTTP proxy status line'));
+        const status = Number(firstStatus[1]);
+        if (status < 200 || status >= 300) return fail(new TunnelError('REFUSED', 'HTTP proxy refused CONNECT', { status }));
+      }
+      const end = pending.indexOf('\r\n\r\n');
+      if (end < 0) {
+        if (pending.length > maxHeaderBytes) fail(new TunnelError('PROTOCOL', 'HTTP proxy response headers exceed limit'));
+        return;
+      }
+      if (end + 4 > maxHeaderBytes) return fail(new TunnelError('PROTOCOL', 'HTTP proxy response headers exceed limit'));
+      const lines = pending.subarray(0, end).toString('latin1').split('\r\n');
+      const statusLine = lines[0];
+      const match = /^HTTP\/1\.[01] ([0-9]{3})(?: [^\r\n]*)?$/.exec(statusLine);
+      if (!match) return fail(new TunnelError('PROTOCOL', 'Invalid HTTP proxy status line'));
+      const status = Number(match[1]);
+      if (lines.slice(1).some(line => !/^[!#$%&'*+.^_`|~0-9A-Za-z-]+:[\t\x20-\x7e\x80-\xff]*$/.test(line))) {
+        return fail(new TunnelError('PROTOCOL', 'Invalid HTTP proxy response header'));
+      }
+      if (status < 200 || status >= 300) return fail(new TunnelError('REFUSED', 'HTTP proxy refused CONNECT', { status }));
+      settled = true; socket.pause(); cleanup();
+      const head = pending.subarray(end + 4);
+      if (head.length) socket.unshift(head);
+      resolve(socket);
+    };
+    const timer = setTimeout(() => establishmentFailure('TIMEOUT', 'HTTP proxy establishment deadline exceeded'), timeoutMs);
+    socket.once(connectedEvent, onConnect); socket.on('data', onData);
+    socket.once('error', onError); socket.once('end', onEnd); socket.once('close', onClose);
+    signal?.addEventListener('abort', onAbort, { once: true });
+    if (signal?.aborted) onAbort();
+  });
+}
+
+// The bounded socket reader owns setup cancellation and preserves queued bytes.
+// Framing uses the existing
+// MIT socks5-handshake module; neither shared framing nor its DNS policy changes.
+async function connectSocks(authority: string, proxy: OpaqueProxyRoute, { signal, timeoutMs }: AttemptOptions): Promise<Socket> {
+  if (signal?.aborted) throw aborted();
+  const socket = net.createConnection({ host: proxy.host, port: proxy.port, allowHalfOpen: true });
+  socket.on('error', () => {});
+  let buffer: Buffer = Buffer.alloc(0), failure: Error | undefined;
+  let waiting: { length: number; resolve: () => void; reject: (error: Error) => void } | undefined;
+  const fail = (error: Error) => { if (failure) return; failure = error; const current = waiting; waiting = undefined; current?.reject(error); socket.destroy(); };
+  const transportError = (code: string, message: string) => fail(new TunnelError(code, message));
+  const onData = (chunk: Buffer) => {
+    // Consume at most the bytes needed by a bounded handshake read, then pause.
+    // A valid CONNECT reply can share a packet with arbitrary early target data;
+    // that remainder is not a malformed/oversized handshake and must survive.
+    socket.pause();
+    buffer = Buffer.concat([buffer, chunk]);
+    if (waiting && buffer.length >= waiting.length) { const current = waiting; waiting = undefined; current.resolve(); }
+    else if (waiting) socket.resume();
+  };
+  const onError = () => transportError('TRANSPORT', 'SOCKS proxy connection failed');
+  const onClose = () => transportError('EARLY_CLOSE', 'SOCKS proxy closed before tunnel establishment');
+  const onAbort = () => fail(aborted());
+  const timer = setTimeout(() => transportError('TIMEOUT', 'SOCKS establishment deadline exceeded'), timeoutMs);
+  socket.on('data', onData); socket.once('error', onError); socket.once('end', onClose); socket.once('close', onClose);
+  socket.pause();
+  signal?.addEventListener('abort', onAbort, { once: true }); if (signal?.aborted) onAbort();
+  const reader = {
+    write(bytes: Uint8Array): void { if (failure) throw failure; socket.write(bytes); },
+    async readExact(length: number): Promise<Buffer> {
+      if (failure) throw failure;
+      if (!Number.isSafeInteger(length) || length < 0 || length > 1024) throw new TunnelError('PROTOCOL', 'Invalid handshake read size');
+      if (buffer.length < length) await new Promise<void>((resolve, reject) => {
+        if (waiting) { reject(new TunnelError('PROTOCOL', 'Concurrent handshake read')); return; }
+        waiting = { length, resolve, reject };
+        socket.resume();
+      });
+      if (failure) throw failure;
+      const result = buffer.subarray(0, length); buffer = buffer.subarray(length); return result;
+    },
+  };
+  try {
+    const credentialsUrl = new URL('socks5://fixture.invalid');
+    if (proxy.username !== undefined) { credentialsUrl.username = encodeURIComponent(proxy.username); credentialsUrl.password = encodeURIComponent(proxy.password); }
+    const colon = authority.lastIndexOf(':');
+    const target = { host: authority.slice(0, colon).replace(/^\[|\]$/g, ''), port: Number(authority.slice(colon + 1)) };
+    await socks5Handshake(reader, target, socks5Credentials(credentialsUrl), signal);
+    if (failure) throw failure;
+    if (signal?.aborted || socket.destroyed) throw aborted();
+    socket.pause(); if (buffer.length) socket.unshift(buffer); buffer = Buffer.alloc(0);
+    return socket;
+  } catch (error) {
+    socket.destroy();
+    if (error instanceof Socks5HandshakeError) throw new TunnelError('SOCKS_REFUSED', 'SOCKS authentication, policy, or protocol refusal');
+    throw error;
+  } finally {
+    clearTimeout(timer); signal?.removeEventListener('abort', onAbort);
+    socket.removeListener('data', onData); socket.removeListener('error', onError);
+    socket.removeListener('end', onClose); socket.removeListener('close', onClose);
+  }
+}
+
+/** Establish only. There is no application data, implicit DIRECT, or replay here.
+ * HTTP/HTTPS CONNECT and SOCKS5/SOCKS5h yield an opaque raw target tunnel.
+ */
+export async function dialTunnel(authority: string, proxy: OpaqueProxyRoute, options: OpaqueTunnelOptions = {}): Promise<Socket> {
+  const { signal, timeoutMs = 10000, maxHeaderBytes = 65536 } = options;
+  validateAuthority(authority);
+  validateOptions(proxy, timeoutMs, maxHeaderBytes);
+  if (signal?.aborted) throw aborted();
+  // Snapshot the selected route. No alternate proxy or direct fallback exists.
+  const socket = await connectOne(authority, { ...proxy }, { signal, timeoutMs, maxHeaderBytes });
+  if (signal?.aborted || socket.destroyed) { socket.destroy(); throw aborted(); }
+  return socket;
+}

package/src/lib/redact.ts

@@ -7,7 +7,7 @@ export const REDACTED_SECRET = "[REDACTED]";
  * credentials over an unsafe channel (e.g. plaintext non-loopback HTTP) rather than
  * re-deriving a narrower local list.
  */
-export const SENSITIVE_KEY_PATTERN = /^(?:authorization|proxy-authorization|cookie|set-cookie|set-cookie2|api[-_]?key|x-api-key|x-goog-api-key|x-amz-security-token|copilot[-_]?session[-_]?token|session[-_]?token|access[-_]?token|refresh[-_]?token|id[-_]?token|token|secret|client[-_]?secret|password|profile[-_]?arn|exa[-_]?api[-_]?key)$/i;
+export const SENSITIVE_KEY_PATTERN = /^(?:authorization|proxy-authorization|cookie|set-cookie|set-cookie2|api[-_]?key|x-api-key|x-goog-api-key|x-amz-security-token|x-dsh-auth-token|copilot[-_]?session[-_]?token|session[-_]?token|access[-_]?token|refresh[-_]?token|id[-_]?token|token|secret|client[-_]?secret|password|profile[-_]?arn|exa[-_]?api[-_]?key)$/i;
 
 /**
  * Colon-labelled credential headers echoed back inside an error body
@@ -40,7 +40,7 @@ export const SENSITIVE_KEY_PATTERN = /^(?:authorization|proxy-authorization|cook
 // Every letter position also accepts \u0001, the placeholder the fold emits for
 // an unresolved HTML named reference: `authorⅈzation` is the label with one
 // character we cannot name, and that is still the label.
-const CREDENTIAL_HEADER_LABEL_RAW = "copilot[_-]?session[_-]?token|session[_-]?token|sessionToken|x-api-key|x-goog-api-key|x-amz-security-token|api[_-]?key|apiKey|exa[_-]?api[_-]?key|exaApiKey|access[_-]?token|accessToken|refresh[_-]?token|refreshToken|id[_-]?token|client[_-]?secret|clientSecret|authorization|proxy-authorization|cookie|set-cookie|password|secret|token";
+const CREDENTIAL_HEADER_LABEL_RAW = "copilot[_-]?session[_-]?token|session[_-]?token|sessionToken|x-api-key|x-goog-api-key|x-amz-security-token|x-dsh-auth-token|api[_-]?key|apiKey|exa[_-]?api[_-]?key|exaApiKey|access[_-]?token|accessToken|refresh[_-]?token|refreshToken|id[_-]?token|client[_-]?secret|clientSecret|authorization|proxy-authorization|cookie|set-cookie|password|secret|token";
 
 const CREDENTIAL_HEADER_LABEL = CREDENTIAL_HEADER_LABEL_RAW
   .replace(/(?<![\[\\])([A-Za-z])(?![\]\-])/g, "[$1\u0001]");

package/src/lib/request-failure-model.ts

@@ -223,6 +223,8 @@ const RECOVERY_KIND_CAUSE = {
   "rate-limit-429": "rate-limit",
   "anthropic-oauth-429": "rate-limit",
   "oauth-account-429": "rate-limit",
+  // A 402 is the account's quota, not a transient limit; only another account can serve it.
+  "oauth-account-402": "quota-exhausted",
   "image-413": "payload-too-large",
   // The gateway rejects a body it accepts seconds later and the replay is byte-identical, so
   // nothing about the payload was wrong; the origin declined to take it at that moment.

package/src/oauth/account-quota-rank.ts

@@ -96,7 +96,7 @@ function headroomOf(provider: string, accountId: string, requestedModelId?: stri
   const family = classifyModelFamilyForQuota(provider, requestedModelId);
   if (family) {
     const percents = (quota.customWindows ?? [])
-      .filter(window => windowMatchesFamily(window.label, family))
+      .filter(window => window.modelId === undefined && windowMatchesFamily(window.label, family))
       .map(window => window.percent)
       .filter((value): value is number => typeof value === "number");
     if (percents.length === 0) return null;
@@ -106,7 +106,7 @@ function headroomOf(provider: string, accountId: string, requestedModelId?: stri
     quota.fiveHourPercent,
     quota.weeklyPercent,
     quota.monthlyPercent,
-    ...(quota.customWindows ?? []).map(window => window.percent),
+    ...(quota.customWindows ?? []).filter(window => window.modelId === undefined).map(window => window.percent),
   ].filter((value): value is number => typeof value === "number");
   if (percents.length === 0) return null;
   return 100 - Math.max(...percents);
@@ -140,6 +140,73 @@ export function isAccountQuotaExhausted(
   return headroom !== null && headroom <= 0;
 }
 
+/**
+ * Earliest future reset timestamp (in ms) for the relevant quota window, or null if unknown.
+ * Prefers weekly reset when multiple windows exist so expiring allowance is consumed first.
+ */
+export function accountResetTimestamp(
+  provider: string,
+  accountId: string,
+  requestedModelId?: string | null,
+  now = Date.now(),
+): number | null {
+  const quota = getCachedProviderAccountQuota(provider, accountId);
+  if (!quota) return null;
+  const family = classifyModelFamilyForQuota(provider, requestedModelId);
+  const windows = (quota.customWindows ?? []).filter(w => !family || windowMatchesFamily(w.label, family));
+  const weekly = windows.find(w => /week/i.test(w.label));
+  let rawReset = weekly?.resetAt ?? quota.weeklyResetAt;
+  if (rawReset === undefined && provider !== "google-antigravity" && provider !== "anthropic") {
+    // Providers without a weekly cadence: prefer an explicitly 5h-labeled window before
+    // falling back to first-window order.
+    const fiveHour = windows.find(w => /5h|five/i.test(w.label)) ?? windows[0];
+    rawReset = fiveHour?.resetAt ?? quota.fiveHourResetAt;
+  } else if (rawReset === undefined) {
+    rawReset = windows[0]?.resetAt ?? quota.fiveHourResetAt;
+  }
+  if (typeof rawReset !== "number" || !Number.isFinite(rawReset)) return null;
+  const ms = rawReset < 1e11 ? rawReset * 1000 : rawReset;
+  return ms > now ? ms : null;
+}
+
+/**
+ * Rank candidates by soonest reset timestamp first among healthy accounts.
+ * Accounts whose quota will reset earliest get priority so allowances do not expire unused.
+ *
+ * When a passive provider has incomplete quota evidence (some ring members with no
+ * cached record), reset timestamps are unreliable: an unknown account converts to
+ * Infinity and always loses to a known near-exhausted one. Fall back to headroom
+ * order instead of inventing a reset ordering.
+ */
+export function rankAccountsByResetFirst(
+  provider: string,
+  ring: readonly string[],
+  requestedModelId?: string | null,
+  now = Date.now(),
+  accounts?: ReadonlyMap<string, ProviderAccount>,
+): string[] {
+  if (ring.length < 2) return [...ring];
+  const ranked = rankAccountsByHeadroom(provider, ring, requestedModelId, accounts);
+  const healthy = ranked.filter(id => !isAccountQuotaExhausted(provider, id, requestedModelId, accounts?.get(id)));
+  if (healthy.length < 2) return ranked;
+  if (
+    hasPassiveAccountQuota(provider)
+    && !ring.every(id => headroomOf(provider, id, requestedModelId, accounts?.get(id)) !== null)
+  ) return ranked;
+
+  const withReset = healthy.map((id, index) => ({
+    id,
+    resetAt: accountResetTimestamp(provider, id, requestedModelId, now) ?? Number.POSITIVE_INFINITY,
+    headroom: headroomOf(provider, id, requestedModelId, accounts?.get(id)) ?? 0,
+    index,
+  }));
+
+  withReset.sort((a, b) => (a.resetAt - b.resetAt) || (b.headroom - a.headroom) || (a.index - b.index));
+  const sortedHealthy = withReset.map(r => r.id);
+  const exhausted = ranked.filter(id => isAccountQuotaExhausted(provider, id, requestedModelId, accounts?.get(id)));
+  return [...sortedHealthy, ...exhausted];
+}
+
 /**
  * Order candidates best-first.
  *

package/src/oauth/anthropic-account-refusal.ts

@@ -31,6 +31,22 @@ export function bindAnthropicRefusalCredentialForSend(response: Response, owner:
   responseCredentials.set(response, Object.freeze({ ...owner, providerAccountUuid, checkProviderUuid: arguments.length >= 3 }));
 }
 
+/** Preserve the original send proof across internal error normalization, without renewing it. */
+export function carryAnthropicRefusalCredential(source: Response, target: Response): void {
+  const sent = responseCredentials.get(source);
+  if (sent) responseCredentials.set(target, sent);
+}
+
+/** Recheck after body consumption: a late refusal cannot acquire a replacement login's authority. */
+export function anthropicRefusalCredentialIsCurrent(response: Response, instance: AnthropicInstanceId, accountId: string): boolean {
+  const sent = responseCredentials.get(response);
+  if (!sent || sent.provider !== instance || sent.accountId !== accountId
+    || !anthropicPhysicalSendOwnershipIsCurrent(sent)) return false;
+  const row = getAccountCredentialWithStatus(instance, accountId);
+  return !!row && !row.paused && !row.needsReauth
+    && (!sent.checkProviderUuid || row.credential.accountId === sent.providerAccountUuid);
+}
+
 async function isRevokedOAuthToken(response: Response, signal?: AbortSignal): Promise<boolean> {
   if (response.status !== 401) return false;
   try {
@@ -59,9 +75,11 @@ async function isAccountRefusal(response: Response, signal?: AbortSignal): Promi
     // Whole-message patterns: request-policy/model/resource refusals and quoted diagnostics
     // must not acquire account authority merely by containing entitlement keywords.
     if ("code" in error && error.code != null
-      && (typeof error.code !== "string" || !["subscription_required", "insufficient_quota", "permission_denied"].includes(error.code))) return false;
+      && (typeof error.code !== "string" || !["subscription_required", "insufficient_quota", "permission_denied", "oauth_org_not_allowed"].includes(error.code))) return false;
+    // The organization disabled subscription access: an account-scoped verdict, cooled like its siblings.
+    if (error.type === "oauth_org_not_allowed" || ("code" in error && error.code === "oauth_org_not_allowed")) return true;
     const message = error.message.trim();
-    if (error.type === "permission_error" && /^(?:Your account does not have access to Claude Code|Your (?:Claude )?subscription (?:has expired|is (?:expired|inactive))|Your account does not have an active subscription)[.!]?$/i.test(message)) return true;
+    if (error.type === "permission_error" && /^(?:Your account does not have access to Claude Code|Your (?:Claude )?subscription (?:has expired|is (?:expired|inactive))|Your account does not have an active subscription|(?:Your|This) organization has disabled Claude subscription access for Claude Code(?:\. Use an Anthropic API key instead, or ask your admin to enable access)?)[.!]?$/i.test(message)) return true;
     return (error.type === "billing_error" || error.type === "permission_error")
       && /^Your credit balance is too low to access the Anthropic API\.(?: Please go to Plans & Billing to upgrade or purchase credits\.)?$/i.test(message);
   } catch {

package/src/oauth/anthropic-oauth-definitions.ts

@@ -1,7 +1,7 @@
 import { ConfigMutationLockError } from "../config";
 import { deriveOAuthDefaultModel, deriveOAuthProviderConfig } from "../providers/derive";
 import type { AnthropicInstanceId } from "../providers/anthropic-instance-id";
-import { loginAnthropic, refreshAnthropicToken } from "./anthropic";
+import { ANTHROPIC_CODE_REDIRECT_URI, loginAnthropic, refreshAnthropicToken } from "./anthropic";
 import type { OAuthProviderDef } from "./index";
 import {
   clearOAuthRefreshIntent, clearOAuthRefreshIntentIfMatch, markOAuthRefreshIntentCleanupPending,
@@ -16,8 +16,10 @@ export function anthropicOAuthDefinition(instance: AnthropicInstanceId): OAuthPr
   return {
     login: (ctrl, opts) => loginAnthropic(ctrl, {
       instance, importLocal: instance === "anthropic2" || opts?.forceLogin ? "off" : "fallback",
+      codeMode: opts?.codeMode === true,
     }),
     refresh: refreshAnthropicToken,
+    codeRedirectUri: ANTHROPIC_CODE_REDIRECT_URI,
     providerConfig,
     defaultModel,
     // Subscription OAuth must never generate unattended traffic by default.