@bitkyc08/opencodex 2.86.0 → 2.88.0

package/src/providers/gcp-credential-cleanup.ts

@@ -0,0 +1,59 @@
+import { mutatePersistedConfig, readConfigAdmissionSnapshot, withConfigMutationLockSync } from "../config";
+import { GCP_CREDENTIAL_MARKER_PREFIX, gcpCredentialMarkerAccount } from "../lib/gcp-adc";
+import type { OcxConfig, OcxProviderConfig } from "../types";
+import { isKeychainReference, keychainAccount, providerKeychainEntry } from "./api-key-resolve";
+
+/** Snapshot credential references before removing a key or provider. */
+export function providerGcpCredentialMarkers(provider: OcxProviderConfig): string[] {
+  return [...new Set([provider.apiKey, ...(provider.apiKeyPool ?? []).map(entry => entry.key)]
+    .filter((key): key is string => typeof key === "string" && key.startsWith(GCP_CREDENTIAL_MARKER_PREFIX)))];
+}
+
+/** Capture both the caller's row and the valid durable row before a provider mutation. */
+export function snapshotProviderGcpCredentialMarkers(name: string, provider: OcxProviderConfig | undefined): string[] {
+  const durable = readConfigAdmissionSnapshot();
+  const durableProvider = durable.kind === "read" && durable.diagnostics.source === "file"
+    && durable.diagnostics.error === null ? durable.diagnostics.config.providers[name] : undefined;
+  return [provider, durableProvider].flatMap(row => row ? providerGcpCredentialMarkers(row) : []);
+}
+
+/** Capture deletion candidates and save under the same lock; cleanup follows a successful save. */
+export function commitProviderGcpCredentialRemoval<T>(config: OcxConfig, name: string, saveRemoval: () => T): T {
+  let markers: string[] = [];
+  const result = withConfigMutationLockSync(() => {
+    markers = snapshotProviderGcpCredentialMarkers(name, config.providers[name]);
+    return saveRemoval();
+  });
+  cleanupRemovedGcpCredentials(markers);
+  return result;
+}
+
+function cleanupGcpCredentialAccount(key: string | undefined): string | undefined {
+  if (key?.startsWith(GCP_CREDENTIAL_MARKER_PREFIX) && !key.slice(GCP_CREDENTIAL_MARKER_PREFIX.length).trim()) return undefined;
+  return gcpCredentialMarkerAccount(key);
+}
+
+/** After a successful config commit, remove only credentials no persisted provider references. */
+export function cleanupRemovedGcpCredentials(markers: readonly string[]): void {
+  if (!markers.length) return;
+  try {
+    // Re-read under the config mutation lock: another provider may share a marker, or a newer
+    // commit may have reintroduced it. Never decide deletion from the caller's stale snapshot.
+    const outcome = mutatePersistedConfig(fresh => {
+      const retained = new Set(Object.values(fresh.providers).flatMap(provider =>
+        [provider.apiKey, ...(provider.apiKeyPool ?? []).map(entry => entry.key)]
+          .flatMap(key => {
+            const account = isKeychainReference(key) ? keychainAccount(key) : cleanupGcpCredentialAccount(key);
+            return account === undefined ? [] : [account];
+          })));
+      for (const marker of new Set(markers)) {
+        const account = cleanupGcpCredentialAccount(marker);
+        if (account && !retained.has(account)) providerKeychainEntry(account).deletePassword();
+      }
+      return { changed: false, value: true };
+    });
+    if (outcome.status === "unavailable") throw new Error("configuration unavailable");
+  } catch {
+    console.warn("GCP credential cleanup incomplete; inspect the OS credential store. Configuration removal remains committed.");
+  }
+}

package/src/providers/key-failover.ts

@@ -8,9 +8,12 @@
  *
  * Modelled after src/codex/routing.ts cooldown logic but scoped to plain API-key pools.
  */
+import { isKeyInCooldown, getKeyCooldownUntil, setKeyCooldown } from "./api-key-cooldowns";
+export { clearKeyCooldowns, getKeyCooldownUntil, sweepExpiredApiKeyCooldowns } from "./api-key-cooldowns";
 import { commitProviderApiKeySelection, providerApiKeySelectionIsCurrent } from "./api-key-selection";
+import { RequestPacingQueueOverloadError } from "./request-pacing";
 import type { ProviderApiKeySelection } from "../types/provider";
-import { routedProviderConfig } from "../router";
+import { routedProviderConfig } from "./routed-config";
 import { getProviderRegistryEntry } from "./registry";
 import { isCanonicalCommandCodeBaseUrl, normalizedBaseUrl } from "./quota/vendor-probes-key";
 import type { OcxConfig, OcxProviderConfig, RateLimitRetryPolicy, ResetReplayPolicy, TransientRetryPolicy } from "../types";
@@ -24,10 +27,6 @@ import { cachedApiKeyQuota } from "./quota-key-accounts";
 
 // ---- cooldown state (in-memory, same as codex/routing.ts) ----
 
-interface KeyCooldown {
-  cooldownUntil: number;
-}
-
 const DEFAULT_COOLDOWN_MS = 60_000;
 const MAX_COOLDOWN_MS = 10 * 60_000; // cap at 10 min for api-key rotation
 /**
@@ -347,11 +346,6 @@ const DEFAULT_RESET_REPLAY = {
 } as const satisfies Required<ResetReplayPolicy>;
 
 /** Map<`${providerName}\0${keyId}`, KeyCooldown> */
-const keyCooldowns = new Map<string, KeyCooldown>();
-
-function cooldownKey(providerName: string, keyId: string): string {
-  return `${providerName}\0${keyId}`;
-}
 
 /**
  * Parse an upstream `Retry-After` header: numeric seconds (including `0`) or an HTTP-date.
@@ -379,16 +373,6 @@ function parseRetryAfterMs(value: string | null | undefined, now = Date.now()):
  * True while the given key is inside its 429 cooldown window (lazily evicting the entry once the
  * window expires). Used to skip keys that the upstream just rate-limited during failover.
  */
-function isKeyInCooldown(providerName: string, keyId: string, now = Date.now()): boolean {
-  const entry = keyCooldowns.get(cooldownKey(providerName, keyId));
-  if (!entry) return false;
-  if (entry.cooldownUntil <= now) {
-    keyCooldowns.delete(cooldownKey(providerName, keyId));
-    return false;
-  }
-  return true;
-}
-
 // ---- public API ----
 
 /**
@@ -418,9 +402,11 @@ const keyRotationCursor = new Map<string, string>();
 export function forgetApiKeyRotationCursor(providerName?: string): void {
   if (!providerName) {
     keyRotationCursor.clear();
+    dispatchKeyCursor.clear();
     return;
   }
   keyRotationCursor.delete(providerName);
+  dispatchKeyCursor.delete(providerName);
 }
 
 /** The pool entry shape is inline on OcxProviderConfig; name it once rather than re-spelling it. */
@@ -566,11 +552,33 @@ export function selectProactiveApiKeyTransport(
   promptCacheKey?: string,
   now = Date.now(),
 ): OcxProviderTransport | null {
+  const configured = config.providers[providerName];
+  if (configured?.requestPacing?.enabled && configured.requestPacing.keySelection === "round-robin"
+    && hasKeyPoolFailover(configured)) {
+    return applyRotatedTransport(providerName, routedProvider, allocateDistributedKey(providerName, configured, now), promptCacheKey);
+  }
   const committed = selectProactiveApiKey(config, providerName, now);
   if (!committed) return null;
   return applyRotatedTransport(providerName, routedProvider, committed, promptCacheKey);
 }
 
+const dispatchKeyCursor = new Map<string, string>();
+function allocateDistributedKey(providerName: string, provider: OcxProviderConfig, now: number): OcxProviderConfig {
+  const pool = (provider.apiKeyPool ?? []).filter((entry, index, all) => all.findIndex(other => other.key === entry.key) === index);
+  const previous = dispatchKeyCursor.get(providerName);
+  const start = pool.findIndex(entry => entry.id === previous);
+  for (let offset = 1; offset <= pool.length; offset++) {
+    const entry = pool[(start + offset) % pool.length]!;
+    if (isKeyInCooldown(providerName, entry.id, now)) continue;
+    dispatchKeyCursor.set(providerName, entry.id);
+    return { ...provider, apiKey: entry.key, _apiKeyAttempt: {
+      entryId: entry.id, reference: entry.key, revision: provider.apiKeySelectionRevision, distributed: true,
+    } };
+  }
+  const next = Math.min(...pool.map(entry => getKeyCooldownUntil(providerName, entry.id, now) ?? now + 1000));
+  throw new RequestPacingQueueOverloadError(providerName, "keys_exhausted", Math.max(1, Math.ceil((next - now) / 1000)));
+}
+
 /**
  * Normalize a provider's `retryOn429` policy. An explicit object always wins (including
  * `enabled: false` to opt out). When the knob is absent, the OpenCode Go destination
@@ -695,6 +703,24 @@ export function rateLimitRetryDelayMs(
  * rebuilds from this committed row, reapplies registry metadata, and retains only explicit
  * runtime transport state (`fetch` and generated OpenCode session affinity).
  */
+/** Record a request-local key failure without selecting or sending a replacement. */
+export function recordDistributedKeyFailure(
+  config: OcxConfig, providerName: string, selection: ProviderApiKeySelection | undefined,
+  status: 401 | 429 | "billing", now = Date.now(), retryAfter?: string | null, quotaResetAt?: number,
+): boolean {
+  const provider = config.providers[providerName];
+  if (!selection?.distributed || !provider || provider.authMode === "oauth" || provider.authMode === "forward") return false;
+  const failed = provider.apiKeyPool?.find(entry => entry.id === selection.entryId && entry.key === selection.reference);
+  if (!failed || provider.apiKeySelectionRevision !== selection.revision) return false;
+  const delay = status === "billing" ? ANTHROPIC_BILLING_COOLDOWN_MS : status === 401 ? MAX_COOLDOWN_MS : quotaResetAt !== undefined
+    ? Math.max(1, quotaResetAt - now) : parseRetryAfterMs(retryAfter, now) ?? DEFAULT_COOLDOWN_MS;
+  for (const entry of provider.apiKeyPool ?? []) if (entry.key === failed.key) {
+    setKeyCooldown(providerName, entry.id, now + delay);
+  }
+  sweepExpiredOnWrite(now);
+  return true;
+}
+
 function rotateKeyAfterFailure(
   config: OcxConfig,
   providerName: string,
@@ -710,6 +736,13 @@ function rotateKeyAfterFailure(
   if (!provider) return null;
   if (provider.authMode === "oauth" || provider.authMode === "forward") return null;
 
+  if (attemptedSelection?.distributed) {
+    if (acceptsFreshProvider && !acceptsFreshProvider(provider)) return null;
+    if (!recordDistributedKeyFailure(config, providerName, attemptedSelection, failureStatus, now, retryAfterHeader, quotaResetAt)) return null;
+    if (!(provider.apiKeyPool ?? []).some(entry => !isKeyInCooldown(providerName, entry.id, now))) return null;
+    return allocateDistributedKey(providerName, provider, now);
+  }
+
   const failedKey = attemptedSelection?.reference ?? attemptedKey ?? provider.apiKey;
   type Rotation =
     | { failedId?: string; candidateId?: string }
@@ -778,7 +811,7 @@ function rotateKeyAfterFailure(
       : quotaResetAt !== undefined
         ? Math.max(quotaResetAt - now, 1)
         : parseRetryAfterMs(retryAfterHeader, now) ?? DEFAULT_COOLDOWN_MS;
-    keyCooldowns.set(cooldownKey(providerName, outcome.value.failedId), { cooldownUntil: now + cooldownMs });
+    setKeyCooldown(providerName, outcome.value.failedId, now + cooldownMs);
     sweepExpiredOnWrite(now);
   }
   if ("exhaustedCount" in outcome.value) {
@@ -831,16 +864,6 @@ export function rotateKeyOn401(
   return rotateKeyAfterFailure(config, providerName, 401, null, now, attemptedKey, attemptedSelection);
 }
 
-export function sweepExpiredApiKeyCooldowns(now = Date.now()): number {
-  let removed = 0;
-  for (const [key, cooldown] of keyCooldowns) {
-    if (cooldown.cooldownUntil > now) continue;
-    keyCooldowns.delete(key);
-    removed += 1;
-  }
-  return removed;
-}
-
 interface RotateProviderTransportOptions {
   retryAfter?: string | null;
   /** Epoch ms from `parseQuotaResetAt`, when the upstream dated the reset in its body. */
@@ -934,22 +957,3 @@ function applyRotatedTransport(
   };
   return resolveProviderTransport(providerName, retryProvider, promptCacheKey);
 }
-
-/** Clear cooldown state for a provider (e.g. after manual key management). */
-export function clearKeyCooldowns(providerName?: string): void {
-  if (!providerName) {
-    keyCooldowns.clear();
-    return;
-  }
-  const prefix = `${providerName}\0`;
-  for (const key of keyCooldowns.keys()) {
-    if (key.startsWith(prefix)) keyCooldowns.delete(key);
-  }
-}
-
-/** Visible-for-testing: get the cooldown-until timestamp for a key. */
-export function getKeyCooldownUntil(providerName: string, keyId: string, now = Date.now()): number | null {
-  const entry = keyCooldowns.get(cooldownKey(providerName, keyId));
-  if (!entry) return null;
-  return entry.cooldownUntil > now ? entry.cooldownUntil : null;
-}

package/src/providers/key-store.ts

@@ -1,8 +1,10 @@
 import { resolveEnvValue, saveConfigPreservingClaudeCode } from "../config";
 import type { OcxConfig, OcxProviderConfig } from "../types";
 import type { ProviderRegistryEntry } from "./registry";
+import { isGcpCredentialMaterial } from "../lib/gcp-adc";
 import {
   KEYCHAIN_REFERENCE_PREFIX,
+  GCP_CREDENTIAL_MARKER_PREFIX,
   invalidateResolvedProviderKeyCache,
   isKeychainReference,
   keychainAccount,
@@ -79,7 +81,7 @@ export function storeProviderKeyInKeychain(config: OcxConfig, name: string): { o
   const pool = provider.apiKeyPool ?? [];
   try {
     for (const entry of pool) {
-      if (isKeychainReference(entry.key)) continue;
+      if (entry.key.startsWith(GCP_CREDENTIAL_MARKER_PREFIX) || isKeychainReference(entry.key)) continue;
       const secret = resolveEnvValue(entry.key);
       if (!secret) continue; // unresolved env reference stays as-is
       const account = `${name}/${entry.id}`;
@@ -87,7 +89,7 @@ export function storeProviderKeyInKeychain(config: OcxConfig, name: string): { o
       written.push(account);
       planned.push(() => { entry.key = `${KEYCHAIN_REFERENCE_PREFIX}${account}`; });
     }
-    if (provider.apiKey && !isKeychainReference(provider.apiKey)) {
+    if (provider.apiKey && !provider.apiKey.startsWith(GCP_CREDENTIAL_MARKER_PREFIX) && !isKeychainReference(provider.apiKey)) {
       const active = pool.find(e => e.key === provider.apiKey || (isKeychainReference(e.key) && false));
       const secret = resolveEnvValue(provider.apiKey);
       if (secret) {
@@ -138,6 +140,9 @@ export function restoreProviderKeyFromKeychain(config: OcxConfig, name: string):
     let value: string | null = null;
     try { value = providerKeychainEntry(account).getPassword(); } catch { value = null; }
     if (!value) return { ok: false, error: `OS keychain has no readable secret for ${ref}; config left unchanged`, status: 503 };
+    if (isGcpCredentialMaterial(value)) {
+      return { ok: false, error: "GCP credentials must remain in the OS store; use a gcp-sa reference. Config left unchanged", status: 400 };
+    }
     resolved.set(account, value);
   }
   for (const entry of pool) {

package/src/providers/model-rename-fields.ts

@@ -32,9 +32,12 @@ export const PROVIDER_MODEL_RENAME_ROLES = {
   preserveResponsesReasoningContent: "none",
   preserveResponsesInputItemIds: "none",
   preserveResponsesMessageMetadata: "none",
+  projectResponsesLiteHostedSearchHistory: "none",
   modelReasoningEffortsAuthoritative: "none",
   dropResponsesReasoningItems: "none",
   decodesNativeCompactionBlobs: "none",
+  supportsNativeCompactionTrigger: "none",
+  supportsNativeCompactEndpoint: "none",
   allowEncryptedV2AgentTasks: "none",
   allowPrivateNetwork: "none",
   proxy: "none",

package/src/providers/model-rename-migration.ts

@@ -292,8 +292,8 @@ function publishes(container: unknown, id: string): boolean {
  *
  * Under those two conditions the rewrite is worse than a no-op, because it never converges.
  * `startServer` runs this migration and then `reconcileOAuthProviders`, and
- * `applyOAuthPresetCatalog` copies the preset’s record over the saved one whenever the two
- * differ. The deletion is undone inside the same boot, the config is written twice, and the user
+ * `applyOAuthPresetCatalog` fills missing preset keys into the saved metadata maps.
+ * The deletion is undone inside the same boot, the config is written twice, and the user
  * is told about a rename that never sticks on every single start. Issue #5066 is exactly that:
  * `ANTIGRAVITY_MODEL_CONTEXT_WINDOWS` derives a window for every compatibility alias, so
  * `modelContextWindows` holds a key for all nine retired Flash ids beside the live ones — the

package/src/providers/openai-tiers-destination.ts

@@ -67,19 +67,28 @@ function isOfficialOpenAiResponsesDestination(provider: OcxProviderConfig): bool
 /**
  * Whether this provider can serve `POST /responses/compact`. The canonical ChatGPT
  * backend can, and so can the official OpenAI API — but an arbitrary gateway that
- * merely speaks the Responses wire cannot, and calling it there fails compaction
- * with an unhelpful error instead of falling back to a routed summary (#422).
+ * merely speaks the Responses wire cannot without an explicit capability opt-in (#422).
+ * This is a protocol claim, not OpenAI identity or permission to forward caller credentials.
  */
 export function supportsNativeResponsesCompactEndpoint(
   providerName: string,
   provider: OcxProviderConfig,
 ): boolean {
   if (isCanonicalOpenAiForwardProvider(provider)) return true;
+  // Generic OAuth selection/refresh belongs to the routed Responses path, not this direct transport.
+  if (provider.adapter === "openai-responses" && provider.supportsNativeCompactEndpoint === true
+    && provider.authMode !== "oauth") return true;
   return providerName === OPENAI_API_PROVIDER_ID
     && provider.adapter === "openai-responses"
     && normalizedBaseUrl(provider.baseUrl) === OPENAI_API_BASE_URL;
 }
 
+/** Native v2 is independent of the v1 endpoint and ciphertext replay capabilities. */
+export function supportsNativeResponsesCompactionTrigger(provider: OcxProviderConfig): boolean {
+  return isCanonicalOpenAiForwardProvider(provider)
+    || (provider.adapter === "openai-responses" && provider.supportsNativeCompactionTrigger === true);
+}
+
 /**
  * Whether this destination is an OpenAI-operated Responses backend — the canonical ChatGPT Codex
  * surface or the official OpenAI API.

package/src/providers/openai-tiers.ts

@@ -1,9 +1,9 @@
 import type { CodexAccountMode, OcxConfig, OcxProviderConfig, ProviderCostOverlay } from "../types";
 import { OPENAI_PROVIDER_TIER_VERSION } from "../types";
 import { openaiResponsesUrl } from "../adapters/openai-responses-url";
-import { MAX_COST4_RATE } from "../usage/expected-prices";
+import { COST4_RATE_KEYS, validCost4 } from "../usage/user-cost-validation";
 import { OPENAI_CODEX_PROVIDER_ID, LEGACY_OPENAI_MULTI_PROVIDER_ID, LEGACY_CHATGPT_PROVIDER_ID, CODEX_FORWARD_BASE_URL, isCanonicalOpenAiForwardProvider } from "./openai-tiers-destination";
-export { OPENAI_CODEX_PROVIDER_ID, LEGACY_OPENAI_MULTI_PROVIDER_ID, OPENAI_API_PROVIDER_ID, LEGACY_CHATGPT_PROVIDER_ID, CODEX_FORWARD_BASE_URL, isCanonicalOpenAiForwardProvider, supportsNativeResponsesCompactEndpoint, isOpenAiOperatedResponsesDestination, destinationDecodesNativeCompactionBlob } from "./openai-tiers-destination";
+export { OPENAI_CODEX_PROVIDER_ID, LEGACY_OPENAI_MULTI_PROVIDER_ID, OPENAI_API_PROVIDER_ID, LEGACY_CHATGPT_PROVIDER_ID, CODEX_FORWARD_BASE_URL, isCanonicalOpenAiForwardProvider, supportsNativeResponsesCompactEndpoint, supportsNativeResponsesCompactionTrigger, isOpenAiOperatedResponsesDestination, destinationDecodesNativeCompactionBlob } from "./openai-tiers-destination";
 
 const LEGACY_OPENAI_MULTI_PREFIX = `${LEGACY_OPENAI_MULTI_PROVIDER_ID}/`;
 
@@ -54,19 +54,12 @@ function managedLegacyMultiOverlay(
   };
 }
 
-/** Shape check for a legacy overlay: a plain record of complete non-negative finite Cost4 rows. */
+/** Use the shared rate/policy contract while rejecting unknown legacy row fields. */
 function validLegacyOverlayCosts(value: unknown): boolean {
   if (!value || typeof value !== "object" || Array.isArray(value)) return false;
-  const fields = ["input", "output", "cacheRead", "cacheWrite"] as const;
+  const allowed = new Set<string>([...COST4_RATE_KEYS, "promptLengthPricing"]);
   return Object.values(value as Record<string, unknown>).every(entry => {
-    if (!entry || typeof entry !== "object" || Array.isArray(entry)) return false;
-    const rates = entry as Record<string, unknown>;
-    return Object.keys(rates).length === fields.length
-      && fields.every(key => Object.hasOwn(rates, key)
-        && typeof rates[key] === "number"
-        && Number.isFinite(rates[key])
-        && (rates[key] as number) >= 0
-        && (rates[key] as number) <= MAX_COST4_RATE);
+    return validCost4(entry) && Object.keys(entry).every(key => allowed.has(key));
   });
 }
 

package/src/providers/opencode-go-transport.ts

@@ -1,6 +1,7 @@
 import { createHash } from "node:crypto";
 import type { OcxProviderConfig } from "../types";
 import { registryEntryForProviderDestination } from "./registry";
+import { isOpenCodeGoGeminiDestination } from "../types/opencode-go";
 
 export const OPENCODE_GO_SESSION_HEADER = "x-opencode-session";
 
@@ -44,7 +45,8 @@ export function resolveOpenCodeGoTransport<T extends OcxProviderConfig>(
     Pick<OcxProviderConfig, "baseUrl" | "adapter">
     & Partial<Pick<OcxProviderConfig, "authMode">>,
 ): T {
-  if (registryEntryForProviderDestination(destinationProvider)?.id !== "opencode-go") return provider;
+  if (registryEntryForProviderDestination(destinationProvider)?.id !== "opencode-go"
+    && !(provider.adapter === "google" && isOpenCodeGoGeminiDestination(provider))) return provider;
   if (!sessionLane) return provider;
   if (hasHeaderCaseInsensitive(provider.headers, OPENCODE_GO_SESSION_HEADER)) return provider;
 

package/src/providers/opencode-zen-rate-limit.ts

@@ -70,6 +70,9 @@ export function enrichOpenCodeZenRateLimitMessage(
   message: string,
   opts: {
     status: number;
+    /** Parsed upstream error type, when available. */
+    upstreamErrorType?: string | null;
+    upstreamErrorCode?: string | null;
     providerName?: string;
     baseUrl?: string;
     adapter?: string;
@@ -84,7 +87,9 @@ export function enrichOpenCodeZenRateLimitMessage(
 ): string {
   if (opts.status !== 429) return message;
   if (!isOpenCodeZenRateLimitProvider(opts)) return message;
-  if (!/rate\s*limit/i.test(message)) return message;
+  const errorText = `${opts.upstreamErrorType ?? ""} ${opts.upstreamErrorCode ?? ""} ${message}`.replace(/[_-]/g, " ");
+  if (/\b(?:quota|billing)\b|\busage\s+limit\b|\binsufficient\s+(?:credits?|balance|funds)\b|\b(?:credits?|balance)\s+(?:exhausted|depleted)\b/i.test(errorText)) return message;
+  if (opts.upstreamErrorType !== "rate_limit_error" && !/rate\s*limit/i.test(message)) return message;
   if (message.includes(ENRICHMENT_MARKER)) return message;
 
   const upstreamRetry = validateClientRetryAfterHeader(
@@ -165,7 +170,7 @@ export function enrichOpenCodeZenFreeTierMessage(
 }
 
 /**
- * Single entry point for Zen upstream-error guidance on the Responses wire: short-window
+ * Single entry point for Zen upstream-error guidance on Responses and native Messages: short-window
  * rate limits first, then the keyless free-tier admission refusal. Each layer is a no-op
  * outside its own case, so the composition is safe for every other upstream failure.
  */

package/src/providers/quota/account-cache.ts

@@ -200,7 +200,7 @@ export function supportsPerAccountQuota(provider: string): boolean {
 
 export function explicitAccountReader(provider: string): boolean {
   return provider === "xai" || provider === "cursor" || provider === "kimi" || provider === "command-code"
-    || provider === "devin";
+    || provider === "devin" || provider === "dsh-account";
 }
 
 export function providerOAuthAccountQuotaMode(provider: string): AccountQuotaMode {
@@ -499,9 +499,9 @@ export async function getTokenForAccountQuotaProbe(provider: string, accountId:
   const row = getAccountCredentialWithStatus(provider, accountId);
   if (!row) throw new Error("account credential missing");
   // An operator-paused account is excluded from every automatic upstream use, quota reads included.
-  // Anthropic instances also skip a needs-reauth row; other providers keep their probe behavior.
+  // Anthropic instances and DSH (whose grant never refreshes) also skip a needs-reauth row.
   if (row.paused) throw new Error("account is paused; quota probe skipped");
-  if (row.needsReauth && isAnthropicInstanceId(provider)) throw new Error("account needs sign-in; quota probe skipped");
+  if (row.needsReauth && (isAnthropicInstanceId(provider) || provider === "dsh-account")) throw new Error("account needs sign-in; quota probe skipped");
   const stored = row.credential;
   if (stored.expires > Date.now() + ACCOUNT_TOKEN_SKEW_MS) return stored.access;
   const activeId = getAccountSet(provider)?.activeAccountId;
@@ -519,7 +519,8 @@ export async function getTokenForAccountQuotaProbe(provider: string, accountId:
 export function accountQuotaProbeSkip(provider: string, accountId: string): AccountQuotaCacheEntry | undefined {
   if (!supportsPerAccountQuota(provider)) return { ts: Date.now(), quota: null, unavailable: true };
   if (getAccountCredentialWithStatus(provider, accountId)?.paused !== true) return undefined;
-  return accountQuotaCache.get(accountCacheKey(provider, accountId)) ?? { ts: Date.now(), quota: null, unavailable: true };
+  const cached = accountQuotaCache.get(accountCacheKey(provider, accountId));
+  return cached && cached.isCurrent?.() !== false ? cached : { ts: Date.now(), quota: null, unavailable: true };
 }
 
 export function explicitQuotaConfig(provider: string, configured?: OcxProviderConfig): OcxProviderConfig | undefined {
@@ -552,5 +553,5 @@ export function explicitQuotaDestination(provider: string, config: OcxProviderCo
   if (provider === "command-code") return isCanonicalCommandCodeBaseUrl(config.baseUrl);
   // These readers use fixed canonical billing origins, never config.baseUrl. Devin reads
   // the credential's own allowlisted api-server host instead (fetchDevinQuota revalidates it).
-  return provider === "xai" || provider === "cursor" || provider === "devin";
+  return provider === "xai" || provider === "cursor" || provider === "devin" || provider === "dsh-account";
 }

package/src/providers/quota/account-row.ts

@@ -0,0 +1,34 @@
+import { getAccountCredential } from "../../oauth/store";
+import type { OcxProviderConfig } from "../../types";
+import { isAnthropicInstanceId } from "../anthropic-instance-id";
+import {
+  explicitAccountReader, explicitQuotaIdentity, normalizeAnthropicQuota,
+  type AccountQuotaCacheEntry, type ProviderAccountQuota,
+} from "./account-cache";
+
+/** Preserve private ownership fences until management's final publication check. */
+export function projectAccountQuotaRow(
+  provider: string,
+  accountId: string,
+  entry: AccountQuotaCacheEntry,
+  providerConfig?: OcxProviderConfig,
+): ProviderAccountQuota {
+  const result: ProviderAccountQuota = {
+    accountId,
+    quota: isAnthropicInstanceId(provider) ? normalizeAnthropicQuota(entry.quota, Date.now()) : entry.quota,
+    ...(entry.unavailable ? { unavailable: true as const } : {}),
+    ...(entry.unavailable && entry.quotaFailure && entry.quotaFailureIsCurrent?.() === true ? { quotaFailure: entry.quotaFailure } : {}),
+  };
+  if (entry.quotaFailureIsCurrent) Object.defineProperty(result, "quotaFailureIsCurrent", { value: entry.quotaFailureIsCurrent });
+  if (explicitAccountReader(provider)) {
+    const identity = entry.identity;
+    Object.defineProperty(result, "isCurrent", { value: () => {
+      if (entry.isCurrent) return entry.isCurrent();
+      const credential = getAccountCredential(provider, accountId);
+      return !!credential && (!identity || explicitQuotaIdentity(provider, accountId, providerConfig) === identity);
+    } });
+  } else if (entry.isCurrent) {
+    Object.defineProperty(result, "isCurrent", { value: entry.isCurrent });
+  }
+  return result;
+}

package/src/providers/quota/antigravity.ts

@@ -71,19 +71,40 @@ function antigravityWindowsFromModels(body: Record<string, unknown> | null): Pro
   if (!models) return [];
 
   const windows = new Map<string, ProviderQuotaWindow>();
+  const modelWindows: ProviderQuotaWindow[] = [];
+  const labels = new Set(["Gem", "Cla"]);
   for (const [modelId, rawModelInfo] of Object.entries(models)) {
     const modelInfo = asRecord(rawModelInfo);
     if (!modelInfo) continue;
     for (const quotaInfo of quotaInfoEntries(modelInfo)) {
       const label = classifyAntigravityFamily(modelId, modelInfo, quotaInfo);
-      if (!label || windows.has(label)) continue;
       const percent = antigravityUsedPercent(quotaInfo);
       if (percent === undefined) continue;
-      windows.set(label, {
-        label,
-        percent,
-        ...(normalizeResetAt(quotaInfo.resetTime) !== undefined ? { resetAt: normalizeResetAt(quotaInfo.resetTime) } : {}),
-      });
+      const resetAt = normalizeResetAt(quotaInfo.resetTime);
+      if (label && !windows.has(label)) {
+        windows.set(label, { label, percent, ...(resetAt !== undefined ? { resetAt } : {}) });
+      }
+      // Keep model measurements as display/diagnostic evidence. They are deliberately
+      // separate from the family summaries above; routing must not infer eligibility
+      // from one model's counter or from a missing row.
+      if (modelId.trim() && modelId.length <= 128 && modelWindows.length < 256) {
+        const tier = typeof quotaInfo.tier === "string" && quotaInfo.tier.length <= 64
+          ? quotaInfo.tier.trim().slice(0, Math.max(0, 125 - modelId.length))
+          : "";
+        const baseLabel = `${modelId}${tier ? ` · ${tier}` : ""}`;
+        let modelLabel = baseLabel;
+        for (let ordinal = 2; labels.has(modelLabel); ordinal += 1) {
+          const suffix = ` #${ordinal}`;
+          modelLabel = `${baseLabel.slice(0, 128 - suffix.length)}${suffix}`;
+        }
+        labels.add(modelLabel);
+        modelWindows.push({
+          label: modelLabel,
+          modelId,
+          percent,
+          ...(resetAt !== undefined ? { resetAt } : {}),
+        });
+      }
     }
   }
 
@@ -91,7 +112,7 @@ function antigravityWindowsFromModels(body: Record<string, unknown> | null): Pro
     const window = windows.get(label);
     return window ? [window] : [];
   });
-  return customWindows;
+  return [...customWindows, ...modelWindows];
 }
 
 /**

package/src/providers/quota/dsh-account.ts

@@ -0,0 +1,70 @@
+import { DSH_PLATFORM_ORIGIN } from "../../oauth/dsh";
+import { asRecord, QUOTA_JSON_READ_FAILURE, readQuotaJson, REQUEST_TIMEOUT_MS } from "../quota-wire";
+import { AUTHORITATIVE_EMPTY_QUOTA, TERMINAL_QUOTA_FAILURE, type ProviderQuotaProbeResult } from "./report-cache";
+import { credentialGeneration, markAccountNeedsReauthIfGeneration } from "../../oauth/store";
+import type { OAuthCredentials } from "../../oauth/types";
+
+/** The stored account whose token is probed; a rejection retires exactly this credential generation. */
+export interface DshQuotaProbeOwner {
+  accountId: string;
+  credential: OAuthCredentials;
+}
+
+export async function fetchDshAccountQuota(
+  provider: string,
+  accessToken: string,
+  owner?: DshQuotaProbeOwner,
+): Promise<ProviderQuotaProbeResult> {
+  if (!accessToken || !accessToken.trim()) return null;
+
+  try {
+    const response = await fetch(`${DSH_PLATFORM_ORIGIN}/api/v0/users/get_user_summary`, {
+      method: "GET",
+      headers: {
+        "x-dsh-auth-token": accessToken.trim(),
+        "Accept": "application/json",
+      },
+      redirect: "manual",
+      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+    });
+
+    if (response.status === 401) {
+      // A DSH grant never refreshes, so the platform rejecting it retires this credential the same
+      // way an inference 401 does. Generation-checked: a re-import that landed meanwhile stays usable.
+      if (owner) {
+        await markAccountNeedsReauthIfGeneration(provider, owner.accountId, credentialGeneration(owner.credential))
+          .catch(() => false);
+      }
+      return TERMINAL_QUOTA_FAILURE;
+    }
+    if (!response.ok) {
+      return null;
+    }
+
+    const bodyRaw = await readQuotaJson(response);
+    if (bodyRaw === QUOTA_JSON_READ_FAILURE) {
+      return null;
+    }
+
+    const body = asRecord(bodyRaw);
+    if (!body || body.code !== 0) {
+      return null;
+    }
+
+    const data = asRecord(body.data);
+    if (data?.biz_code !== 0) return null;
+    const bizData = asRecord(data.biz_data);
+    const summary = asRecord(bizData?.user_summary) ?? bizData;
+    if (!summary) return null;
+
+    // DeepSeek platform reports monetary wallet amounts (normal_wallets, bonus_wallets, total_costs)
+    // without capacity or percentage-based rate-limit windows.
+    // Fabricating a synthetic percent: 0 custom window would falsely mark an empty wallet (¥0.00)
+    // as "0% used" (healthy quota) and pollute quota exhaustion / account ranking.
+    // Instead, return AUTHORITATIVE_EMPTY_QUOTA to confirm the credential is active while leaving
+    // quota routing evidence unknown.
+    return AUTHORITATIVE_EMPTY_QUOTA;
+  } catch {
+    return null;
+  }
+}