@bitkyc08/opencodex 2.88.0 → 2.89.0

package/src/providers/api-keys.ts

@@ -21,6 +21,8 @@ export interface ProviderApiKeyInfo extends AccountQuotaFields {
   /** First/last 4 chars only; env references (`${VAR}`) are shown verbatim (not secrets). */
   masked: string;
   active: boolean;
+  disabled?: boolean;
+  pauseDetails?: import("../types/account-auto-pause").AccountPauseDetails;
   addedAt?: number;
 }
 
@@ -217,7 +219,7 @@ export function listProviderApiKeys(config: OcxConfig, name: string): { activeId
   const pool = provider.apiKeyPool?.length
     ? provider.apiKeyPool
     : provider.apiKey ? [{ id: apiKeyPoolEntryId(provider.apiKey), key: provider.apiKey }] : [];
-  const activeId = (pool.find(entry => entry.key === provider.apiKey) ?? pool[0])?.id ?? null;
+  const activeId = pool.find(entry => entry.key === provider.apiKey)?.id ?? null;
   return {
     activeId,
     keys: pool.map(entry => ({
@@ -225,6 +227,8 @@ export function listProviderApiKeys(config: OcxConfig, name: string): { activeId
       ...(entry.label ? { label: entry.label } : {}),
       masked: maskApiKey(entry.key),
       active: entry.id === activeId,
+      ...(entry.disabled ? { disabled: true } : {}),
+      ...(entry.pauseDetails ? { pauseDetails: entry.pauseDetails } : {}),
       ...(entry.addedAt !== undefined ? { addedAt: entry.addedAt } : {}),
     })),
   };
@@ -300,7 +304,7 @@ export function addProviderApiKey(config: OcxConfig, name: string, key: string,
     } else {
       pool.push({ id, key: trimmed, ...(label?.trim() ? { label: label.trim() } : {}), addedAt: Date.now() });
     }
-    fresh.apiKey = trimmed;
+    if (!existing?.disabled) fresh.apiKey = trimmed;
     return { changed: true, selectionChanged: true, value: id };
   });
   if (committed.status !== "committed") return { error: "provider selection unavailable" };
@@ -313,7 +317,7 @@ export function setActiveProviderApiKey(config: OcxConfig, name: string, id: str
     const entry = provider.apiKeyPool?.find(e => e.id === id)
       ?? (!provider.apiKeyPool?.length && provider.apiKey && apiKeyPoolEntryId(provider.apiKey) === id
         ? { id, key: provider.apiKey } : undefined);
-    if (!entry) return { changed: false, value: false };
+    if (!entry || entry.disabled) return { changed: false, value: false };
     ensurePool(provider);
     provider.apiKey = entry.key;
     return { changed: true, selectionChanged: true, value: true };
@@ -344,7 +348,7 @@ export function removeProviderApiKey(config: OcxConfig, name: string, id: string
     removed = entry.key;
     provider.apiKeyPool = pool.filter(e => e.id !== id);
     if (provider.apiKey === entry.key) {
-      const next = provider.apiKeyPool[0];
+      const next = provider.apiKeyPool.find(candidate => !candidate.disabled);
       if (next) provider.apiKey = next.key;
       else delete provider.apiKey;
     }

package/src/providers/claude-cli-usage.ts

@@ -1,4 +1,7 @@
 import { markAnthropicFamilyEnumeration } from "./quota/anthropic-family-headers";
+import { rawAnthropicUsageWindows } from "./quota/anthropic-decision-windows";
+import { bindRawDecisionWindows } from "./quota-decision-publication";
+import { decisionQuotaSinkActive } from "../lib/decision-quota-sink";
 import { CLAUDE_CLI_USER_AGENT } from "./claude-cli-identity";
 import { asRecord, normalizePercent, normalizeResetAt, readQuotaJson, REQUEST_TIMEOUT_MS } from "./quota-wire";
 import type { ProviderQuota, ProviderQuotaWindow } from "./quota-types";
@@ -41,6 +44,7 @@ function parseClaudeLimit(value: unknown): ProviderQuotaWindow | null {
   return { label, scope: "model", percent, ...(resetAt !== undefined ? { resetAt } : {}) };
 }
 
+/** Read the Anthropic OAuth usage endpoint for an access token and return the parsed quota, or null on a non-OK or malformed response. */
 export async function readAnthropicUsageQuota(accessToken: string): Promise<ProviderQuota | null> {
   const response = await fetch("https://api.anthropic.com/api/oauth/usage", {
     headers: {
@@ -87,6 +91,7 @@ export async function readAnthropicUsageQuota(accessToken: string): Promise<Prov
     ...(customWindows.length > 0 ? { customWindows } : {}),
     updatedAt: Date.now(),
   };
+  if (decisionQuotaSinkActive()) bindRawDecisionWindows(quota, rawAnthropicUsageWindows(body, quota.updatedAt));
   // Empty / schema-changed payloads must not cache as "success with no bars".
   return hasQuotaRows(quota) ? markAnthropicFamilyEnumeration(quota, Array.isArray(body.limits) && body.limits.every(raw => {
     const kind = asRecord(raw)?.kind;

package/src/providers/key-failover.ts

@@ -493,9 +493,9 @@ export function selectProactiveApiKey(
 
   const activeEntry = pool.find(entry => entry.key === provider.apiKey);
   // A healthy committed key wins, whether the operator chose it or a previous rotation did.
-  if (activeEntry && !isKeyInCooldown(providerName, activeEntry.id, now)) return null;
+  if (activeEntry && !activeEntry.disabled && !isKeyInCooldown(providerName, activeEntry.id, now)) return null;
 
-  const eligible = pool.filter(entry => !isKeyInCooldown(providerName, entry.id, now));
+  const eligible = pool.filter(entry => !entry.disabled && !isKeyInCooldown(providerName, entry.id, now));
   if (eligible.length === 0) return null;
 
   let chosen = eligible[0]!;
@@ -504,7 +504,7 @@ export function selectProactiveApiKey(
     const lastIndex = lastId ? pool.findIndex(entry => entry.id === lastId) : -1;
     for (let offset = 1; offset <= pool.length; offset += 1) {
       const candidate = pool[(lastIndex + offset) % pool.length]!;
-      if (isKeyInCooldown(providerName, candidate.id, now)) continue;
+      if (candidate.disabled || isKeyInCooldown(providerName, candidate.id, now)) continue;
       chosen = candidate;
       break;
     }
@@ -518,11 +518,11 @@ export function selectProactiveApiKey(
   const outcome = commitProviderApiKeySelection<string | null>(config, providerName, freshProvider => {
     const freshPool = freshProvider.apiKeyPool ?? [];
     const target = freshPool.find(entry => entry.id === chosen.id);
-    if (!target) return { changed: false, value: null };
+    if (!target || target.disabled) return { changed: false, value: null };
     if (freshProvider.apiKey === target.key) return { changed: false, value: null };
     const freshActive = freshPool.find(entry => entry.key === freshProvider.apiKey);
     // Re-check under the lock: a concurrent manual selection may have landed a healthy key.
-    if (freshActive && !isKeyInCooldown(providerName, freshActive.id, now)) {
+    if (freshActive && !freshActive.disabled && !isKeyInCooldown(providerName, freshActive.id, now)) {
       return { changed: false, value: null };
     }
     freshProvider.apiKey = target.key;
@@ -564,7 +564,7 @@ export function selectProactiveApiKeyTransport(
 
 const dispatchKeyCursor = new Map<string, string>();
 function allocateDistributedKey(providerName: string, provider: OcxProviderConfig, now: number): OcxProviderConfig {
-  const pool = (provider.apiKeyPool ?? []).filter((entry, index, all) => all.findIndex(other => other.key === entry.key) === index);
+  const pool = (provider.apiKeyPool ?? []).filter(entry => !entry.disabled).filter((entry, index, all) => all.findIndex(other => other.key === entry.key) === index);
   const previous = dispatchKeyCursor.get(providerName);
   const start = pool.findIndex(entry => entry.id === previous);
   for (let offset = 1; offset <= pool.length; offset++) {
@@ -575,7 +575,7 @@ function allocateDistributedKey(providerName: string, provider: OcxProviderConfi
       entryId: entry.id, reference: entry.key, revision: provider.apiKeySelectionRevision, distributed: true,
     } };
   }
-  const next = Math.min(...pool.map(entry => getKeyCooldownUntil(providerName, entry.id, now) ?? now + 1000));
+  const next = pool.length ? Math.min(...pool.map(entry => getKeyCooldownUntil(providerName, entry.id, now) ?? now + 1000)) : now + 1000;
   throw new RequestPacingQueueOverloadError(providerName, "keys_exhausted", Math.max(1, Math.ceil((next - now) / 1000)));
 }
 
@@ -711,7 +711,7 @@ export function recordDistributedKeyFailure(
   const provider = config.providers[providerName];
   if (!selection?.distributed || !provider || provider.authMode === "oauth" || provider.authMode === "forward") return false;
   const failed = provider.apiKeyPool?.find(entry => entry.id === selection.entryId && entry.key === selection.reference);
-  if (!failed || provider.apiKeySelectionRevision !== selection.revision) return false;
+  if (!failed || failed.disabled || provider.apiKeySelectionRevision !== selection.revision) return false;
   const delay = status === "billing" ? ANTHROPIC_BILLING_COOLDOWN_MS : status === 401 ? MAX_COOLDOWN_MS : quotaResetAt !== undefined
     ? Math.max(1, quotaResetAt - now) : parseRetryAfterMs(retryAfter, now) ?? DEFAULT_COOLDOWN_MS;
   for (const entry of provider.apiKeyPool ?? []) if (entry.key === failed.key) {
@@ -739,7 +739,7 @@ function rotateKeyAfterFailure(
   if (attemptedSelection?.distributed) {
     if (acceptsFreshProvider && !acceptsFreshProvider(provider)) return null;
     if (!recordDistributedKeyFailure(config, providerName, attemptedSelection, failureStatus, now, retryAfterHeader, quotaResetAt)) return null;
-    if (!(provider.apiKeyPool ?? []).some(entry => !isKeyInCooldown(providerName, entry.id, now))) return null;
+    if (!(provider.apiKeyPool ?? []).some(entry => !entry.disabled && !isKeyInCooldown(providerName, entry.id, now))) return null;
     return allocateDistributedKey(providerName, provider, now);
   }
 
@@ -764,7 +764,7 @@ function rotateKeyAfterFailure(
 
     if (freshProvider.apiKey !== failedKey) {
       const activeEntry = pool.find(entry => entry.key === freshProvider.apiKey);
-      if (activeEntry && !isKeyInCooldown(providerName, activeEntry.id, now)) {
+      if (activeEntry && !activeEntry.disabled && !isKeyInCooldown(providerName, activeEntry.id, now)) {
         return {
           changed: false,
           value: { failedId: failedEntry?.id },
@@ -776,7 +776,7 @@ function rotateKeyAfterFailure(
     const candidateCount = failedEntry ? pool.length - 1 : pool.length;
     for (let offset = 1; offset <= candidateCount; offset += 1) {
       const candidate = pool[(currentIndex + offset) % pool.length]!;
-      if (isKeyInCooldown(providerName, candidate.id, now)) continue;
+      if (candidate.disabled || isKeyInCooldown(providerName, candidate.id, now)) continue;
       freshProvider.apiKey = candidate.key;
       return {
         changed: true,

package/src/providers/model-rename-fields.ts

@@ -51,6 +51,7 @@ export const PROVIDER_MODEL_RENAME_ROLES = {
   apiKeyTransport: "none",
   apiKeyPool: "none",
   apiKeyPoolStrategy: "none",
+  accountAutoPause: "none",
   apiKeySelectionRevision: "none",
   _apiKeyAttempt: "none",
   defaultModel: "scalar",

package/src/providers/opencode-zen-rate-limit.ts

@@ -1,22 +1,16 @@
 /**
  * OpenCode Zen short-window rate-limit guidance (#1145 / OCX-56).
  *
- * OpenCode's keyed and keyless Zen chat endpoints share `https://opencode.ai/zen/v1`.
+ * OpenCode's keyed Zen chat endpoint uses `https://opencode.ai/zen/v1`.
  * Free-model traffic can hit a short-window burst ceiling around 15–20 RPM
  * (community-measured). Zen often answers with opaque `429 Rate limit exceeded`
  * bodies and may omit `Retry-After` / `X-RateLimit-*`; when those headers are
- * present they still take precedence. Distinct from the keyless desktop
- * ~200 requests / 5h quota documented on `opencode-free`.
- *
- * The same module also owns the keyless free-tier admission explanation (#4121):
- * Zen rejects a request that carries no `x-opencode-session` header with
- * `MissingSessionID` / "OpenCode's free tier can only be used in OpenCode".
- * opencodex does not synthesize that header — see {@link enrichOpenCodeZenFreeTierMessage}.
+ * present they still take precedence.
  */
 import { validateClientRetryAfterHeader } from "../lib/retry-after";
 import { registryEntryForProviderDestination } from "./registry";
 
-const OPENCODE_ZEN_PROVIDER_IDS = new Set(["opencode-zen", "opencode-free"]);
+const OPENCODE_ZEN_PROVIDER_IDS = new Set(["opencode-zen"]);
 
 /** Observed free-model burst ceiling on Zen (not an official OpenCode figure). */
 export const OPENCODE_ZEN_OBSERVED_RPM_HINT = "roughly 15-20 requests per minute";
@@ -49,7 +43,7 @@ export function isOpenCodeZenRateLimitProvider(opts: {
 
 /**
  * Same-key `retryOn429` only applies on key-authenticated HTTP paths — not
- * keyless `opencode-free` traffic and not custom `runTurn` transports.
+ * keyless traffic and not custom `runTurn` transports.
  */
 export function supportsOpenCodeZenRetryOn429Guidance(opts: {
   authMode?: string;
@@ -112,73 +106,13 @@ export function enrichOpenCodeZenRateLimitMessage(
 }
 
 /**
- * Zen's keyless free tier admits only OpenCode's own client. A request without an
- * `x-opencode-session` header is refused with error type `MissingSessionID` and the
- * message "OpenCode's free tier can only be used in OpenCode" (#4121).
- *
- * Presence of the header is the whole gate — any value clears it — so opencodex could
- * pass by minting one. It does not. Fabricating a session identifier and a versioned
- * `opencode/<version>` User-Agent is a claim to *be* the OpenCode client, and no upstream
- * contract authorizes a third-party agent to make it; an HTTP 200 obtained that way is a
- * bypassed admission check, not permission. Until OpenCode publishes a third-party
- * integration path for this exact keyless tier, the supported route is the keyed
- * `opencode-zen` provider.
- *
- * Two markers are matched because the two request surfaces expose different parts of the
- * upstream envelope: the Responses path forwards the bounded raw body (which carries the
- * `MissingSessionID` type), while the native Chat path forwards only the parsed message.
- */
-const OPENCODE_ZEN_FREE_TIER_LOCK_IN = /MissingSessionID|free tier can only be used in OpenCode/i;
-
-/** Idempotence marker — the appended guidance must not stack across enrichment layers. */
-const FREE_TIER_ENRICHMENT_MARKER = "does not send a fabricated OpenCode session header";
-
-/** True when an upstream error body is Zen's keyless free-tier admission refusal. */
-export function isOpenCodeZenFreeTierLockIn(message: string, upstreamErrorType?: string | null): boolean {
-  if (upstreamErrorType && OPENCODE_ZEN_FREE_TIER_LOCK_IN.test(upstreamErrorType)) return true;
-  return OPENCODE_ZEN_FREE_TIER_LOCK_IN.test(message);
-}
-
-/**
- * Replace a raw `MissingSessionID` passthrough with an explanation of the upstream
- * restriction and the supported alternative. No-op for every other provider and every
- * other error, and idempotent so layered enrichment cannot append it twice.
- */
-export function enrichOpenCodeZenFreeTierMessage(
-  message: string,
-  opts: {
-    providerName?: string;
-    baseUrl?: string;
-    adapter?: string;
-    /** Upstream `error.type`, when the caller parsed one out of the envelope. */
-    upstreamErrorType?: string | null;
-  },
-): string {
-  if (message.includes(FREE_TIER_ENRICHMENT_MARKER)) return message;
-  if (!isOpenCodeZenFreeTierLockIn(message, opts.upstreamErrorType)) return message;
-  if (!isOpenCodeZenRateLimitProvider(opts)) return message;
-  return (
-    `${message}`
-    + " OpenCode Zen's keyless free tier admits only OpenCode's own client: it refuses any"
-    + " request that arrives without an x-opencode-session header."
-    + ` opencodex ${FREE_TIER_ENRICHMENT_MARKER}, because presenting itself as the OpenCode`
-    + " client is a claim no upstream contract supports."
-    + " Use the keyed opencode-zen provider with an OpenCode Zen API key"
-    + " (https://opencode.ai/auth), or route this model through another provider."
-    + " Upstream terms: https://opencode.ai/docs/zen/."
-  );
-}
-
-/**
- * Single entry point for Zen upstream-error guidance on Responses and native Messages: short-window
- * rate limits first, then the keyless free-tier admission refusal. Each layer is a no-op
- * outside its own case, so the composition is safe for every other upstream failure.
+ * Zen upstream-error guidance on Responses and native Messages.
  */
 export function enrichOpenCodeZenUpstreamMessage(
   message: string,
   opts: Parameters<typeof enrichOpenCodeZenRateLimitMessage>[1] & { upstreamErrorType?: string | null },
 ): string {
-  return enrichOpenCodeZenFreeTierMessage(enrichOpenCodeZenRateLimitMessage(message, opts), opts);
+  return enrichOpenCodeZenRateLimitMessage(message, opts);
 }
 
 /** The effective HTTP endpoint, never the configured row name, identifies Console. */

package/src/providers/quota/account-cache.ts

@@ -1,3 +1,6 @@
+import { rawAnthropicHeaderWindows } from "./anthropic-decision-windows";
+import { clearDecisionAccountQuotas, decisionQuotaSinkActive } from "../../lib/decision-quota-sink";
+import { bindRawDecisionWindows, publishAnthropicDecisionQuota } from "../quota-decision-publication";
 import { parseAnthropicFamilyHeaders, mergeAnthropicFamilyWindows } from "./anthropic-family-headers";
 import { anthropicModelQuotaFor, ANTHROPIC_PASSIVE_FAMILY_MAX_AGE_MS } from "../../oauth/anthropic-model-quota";
 import { createHash } from "node:crypto";
@@ -289,6 +292,7 @@ export function recordAnthropicAccountQuotaFromHeadersForInstance(
   writerGeneration: number,
   status?: number,
   model?: string,
+  decisionCredentialGeneration?: string,
 ): void {
   if (!accountId) return;
   const key = accountCacheKey(instance, accountId);
@@ -318,14 +322,20 @@ export function recordAnthropicAccountQuotaFromHeadersForInstance(
       ...(observed.customWindows ? { customWindows: mergeAnthropicFamilyWindows(previous?.quota?.customWindows, observed.customWindows) } : {}),
     }, observed.updatedAt),
   });
+  // Advisory evidence is published for the primary pool only; Pool 2 stays unknown to decisions.
+  if (instance === "anthropic" && generation && generation === decisionCredentialGeneration && decisionQuotaSinkActive()) {
+    bindRawDecisionWindows(observed, rawAnthropicHeaderWindows(headers, observed.updatedAt));
+    publishAnthropicDecisionQuota(accountId, generation, observed, true);
+  }
   persistAccountQuotaCache();
 }
 
 /** Legacy recorder: config/roster generation is numeric and distinct from bearer ownership. */
 export function recordAnthropicAccountQuotaFromHeaders(
   accountId: string, headers: Headers, writerGeneration: number, status?: number, model?: string,
+  decisionCredentialGeneration?: string,
 ): void {
-  recordAnthropicAccountQuotaFromHeadersForInstance("anthropic", accountId, headers, writerGeneration, status, model);
+  recordAnthropicAccountQuotaFromHeadersForInstance("anthropic", accountId, headers, writerGeneration, status, model, decisionCredentialGeneration);
 }
 
 /**
@@ -446,6 +456,7 @@ export function resetProviderQuotaReconcileStateForTests(): void {
 
 /** Drop cached per-account rows (all, or just one provider's). */
 export function clearAccountQuotaCache(provider?: string): void {
+  clearDecisionAccountQuotas(provider);
   // Anthropic readers use provider-owned epochs; B cannot revoke an A flight.
   if (provider !== "anthropic2") explicitAccountEpoch += 1;
   if (!provider) {
@@ -475,6 +486,9 @@ export function clearAccountQuotaCache(provider?: string): void {
 
 /** Drop one account's cached bars and any joined probe so a reset is not ranked from the old window. */
 export function forgetCachedProviderAccountQuota(provider: string, accountId: string): void {
+  // Advisory decision evidence of the same account is a copy of the dropped bars; it must not
+  // keep ranking the account from the pre-reset window while the reread is pending or fails.
+  clearDecisionAccountQuotas(provider, accountId);
   hydrateAccountQuotaCache();
   const key = accountCacheKey(provider, accountId);
   accountQuotaCache.delete(key);

package/src/providers/quota/anthropic-account-quota.ts

@@ -64,6 +64,7 @@ export async function fetchAnthropicAccountQuota(
   // and a thrown read (network failure) both record the unavailable row over the retained
   // in-flight observations, as the pre-instance A path did, so joined callers and later cached
   // reads agree and windows that expired during the shared probe are normalized away.
+  /** Cache the settled probe result for an account and publish its decision evidence only while the flight is still current for its credential and generation. */
   const publish = (result: AnthropicQuotaRecoveryResult | null): AccountQuotaCacheEntry => {
     const previous = accountQuotaCache.get(key);
     const retained = previous?.isCurrent?.() === false ? undefined : previous;
@@ -72,7 +73,7 @@ export async function fetchAnthropicAccountQuota(
       ts: Date.now(), quota: normalizeAnthropicQuota(result?.quota ?? retained?.quota, Date.now()),
       ...(!result ? { unavailable: true as const } : {}), isCurrent,
     };
-    if (isCurrent() && mayCommitAccountQuotaKey(key, writerGeneration)) { accountQuotaCache.set(key, entry); sweepExpiredOnWrite(entry.ts); }
+    if (isCurrent() && mayCommitAccountQuotaKey(key, writerGeneration)) { accountQuotaCache.set(key, entry); result?.publishDecisionQuota(); sweepExpiredOnWrite(entry.ts); }
     return entry;
   };
   const probe = (async (): Promise<AccountQuotaCacheEntry> => {

package/src/providers/quota/anthropic-cooldown-recovery.ts

@@ -1,3 +1,5 @@
+import { boundDecisionWindows } from "../quota-decision-publication";
+import { decisionQuotaSinkActive, publishDecisionAccountQuota } from "../../lib/decision-quota-sink";
 import { mergeAnthropicFamilyWindows, hasAnthropicFamilyEnumeration } from "./anthropic-family-headers";
 import { getCachedProviderAccountQuota, captureProviderAccountQuotaEpoch } from "./account-cache";
 import { anthropicModelQuotaFor } from "../../oauth/anthropic-model-quota";
@@ -10,6 +12,7 @@ export class AnthropicQuotaProbeOwnershipError extends Error {}
 
 export type AnthropicCooldownRecoveryProbe = Readonly<{
   instance: AnthropicInstanceId;
+  generation: string;
   requiresFreshDispatch: boolean;
   isCurrentCredential(): boolean;
   isCurrentFamily(): boolean;
@@ -20,10 +23,13 @@ export type AnthropicCooldownRecoveryProbe = Readonly<{
 export type AnthropicQuotaRecoveryResult = Readonly<{
   instance: AnthropicInstanceId;
   quota: ProviderQuota;
+  /** Publishes secret-free advisory evidence for the primary pool only; a no-op for Pool 2. */
+  publishDecisionQuota(): void;
   /** Must be checked synchronously at each publication boundary. */
   isCurrent(): boolean;
 }>;
 
+/** Create the cooldown-recovery probe owner for one Anthropic instance; its results are credential- and generation-bound before they may publish. */
 function createAnthropicCooldownRecovery(instance: AnthropicInstanceId) {
   const familyGeneration = (accountId: string) => anthropicModelQuotaFor(instance).anthropicFamilyQuotaGeneration(accountId);
 
@@ -129,6 +135,7 @@ function createAnthropicCooldownRecovery(instance: AnthropicInstanceId) {
     };
     return {
       instance,
+      generation,
       requiresFreshDispatch: claim !== null,
       isCurrentCredential,
       isCurrentFamily: () => familyGeneration(accountId) === capturedFamilyGeneration,
@@ -165,6 +172,7 @@ function createAnthropicCooldownRecovery(instance: AnthropicInstanceId) {
     }
     // Clearing the claimed cooldown intentionally advances the fence. Adopt that exact new
     // generation; any later observation/429 then invalidates publication before a cache write.
+    const rawQuota = quota;
     const ownsFamily = probe.isCurrentFamily();
     const authoritative = ownsFamily && hasAnthropicFamilyEnumeration(quota);
     if (ownsFamily) anthropicModelQuotaFor(instance).observeAnthropicFamilyQuota(accountId, quota.customWindows ?? [], quota.updatedAt, authoritative);
@@ -177,14 +185,24 @@ function createAnthropicCooldownRecovery(instance: AnthropicInstanceId) {
     }
     const publicationGeneration = anthropicCooldownGeneration(accountId);
     const publicationFamilyGeneration = familyGeneration(accountId);
+    /** True while the probed credential, cooldown generation and family generation are unchanged and publication is still permitted. */
+    const isCurrent = () => probe.isCurrentCredential()
+      && anthropicCooldownGeneration(accountId) === publicationGeneration
+      && familyGeneration(accountId) === publicationFamilyGeneration
+      && mayPublish();
     afterSettlementForTests?.();
     return {
       instance,
       quota,
-      isCurrent: () => probe.isCurrentCredential()
-        && anthropicCooldownGeneration(accountId) === publicationGeneration
-        && familyGeneration(accountId) === publicationFamilyGeneration
-        && mayPublish(),
+      isCurrent,
+      publishDecisionQuota: () => {
+        // Activation first: ownership validation reads the auth store and must not run for signals-off installs.
+        if (instance !== "anthropic" || !decisionQuotaSinkActive() || !isCurrent()) return;
+        // An unbound probe result was parsed while inactive: unknown, never display fallback.
+        const windows = boundDecisionWindows(rawQuota);
+        if (windows) publishDecisionAccountQuota("anthropic", accountId, probe.generation,
+          windows.filter(row => ownsFamily || ["5h", "weekly", "monthly"].includes(row.window)), !authoritative);
+      },
     };
   }
 

package/src/providers/quota/anthropic-decision-windows.ts

@@ -0,0 +1,47 @@
+/** Raw advisory projection; compatibility display clamping/rounding remains unchanged. */
+import type { DecisionQuotaWindow } from "../quota-decision-snapshot";
+import { normalizeResetAt, toFiniteNumber } from "../quota-wire";
+/** Return a plain object value, or undefined for non-objects and arrays. */
+const record = (value: unknown): Record<string, unknown> | undefined =>
+  value && typeof value === "object" && !Array.isArray(value) ? value as Record<string, unknown> : undefined;
+/** Normalize a reset value; an explicit invalid reset becomes NaN so it cannot read as an undated valid measurement. */
+function reset(value: unknown): number | undefined {
+  // Explicit invalid reset must not become an apparently undated valid measurement.
+  return value === undefined || value === null ? undefined : normalizeResetAt(value) ?? NaN;
+}
+/** Extract raw decision windows (5h, weekly and per-model families) from an Anthropic usage body, keeping invalid resets distinct from display parsing. */
+export function rawAnthropicUsageWindows(body: Record<string, unknown>, observedAt: number): DecisionQuotaWindow[] {
+  const rows: DecisionQuotaWindow[] = [];
+  /** Append one window when its percentage is a finite number, carrying its normalized reset. */
+  const add = (window: DecisionQuotaWindow["window"], raw: unknown, percentField: string) => {
+    const row = record(raw);
+    const percent = toFiniteNumber(row?.[percentField]);
+    if (percent === undefined) return;
+    const resetAt = reset(row?.resets_at);
+    rows.push({ window, percent, observedAt, ...(resetAt !== undefined ? { resetAt } : {}) });
+  };
+  for (const [window, field] of [["5h", "five_hour"], ["weekly", "seven_day"], ["fable", "seven_day_fable"], ["opus", "seven_day_opus"], ["sonnet", "seven_day_sonnet"]] as const) add(window, body[field], "utilization");
+  for (const limit of Array.isArray(body.limits) ? body.limits : []) {
+    const row = record(limit);
+    if (row?.kind !== "weekly_scoped") continue;
+    const display = record(record(row.scope)?.model)?.display_name;
+    if (typeof display !== "string") continue;
+    const label = display.replace(/[\u0000-\u001f\u007f-\u009f]/gu, "").toLowerCase();
+    const family = (["fable", "opus", "sonnet"] as const).find(family => label.includes(family));
+    if (family) add(family, row, "percent");
+  }
+  return rows;
+}
+/** Extract decision windows from Anthropic unified rate-limit response headers, converting utilization fractions to percentages. */
+export function rawAnthropicHeaderWindows(headers: Headers, observedAt: number): DecisionQuotaWindow[] {
+  const rows: DecisionQuotaWindow[] = [];
+  for (const [window, wire] of [["5h", "5h"], ["weekly", "7d"], ["fable", "7d_oi"]] as const) {
+    const fraction = toFiniteNumber(headers.get(`anthropic-ratelimit-unified-${wire}-utilization`));
+    if (fraction === undefined || fraction < 0 || fraction > 1) continue;
+    const rawReset = headers.get(`anthropic-ratelimit-unified-${wire}-reset`);
+    const seconds = toFiniteNumber(rawReset);
+    const resetAt = rawReset === null ? undefined : seconds !== undefined && seconds > 0 ? seconds * 1000 : NaN;
+    rows.push({ window, percent: fraction * 100, observedAt, ...(resetAt !== undefined ? { resetAt } : {}) });
+  }
+  return rows;
+}

package/src/providers/quota/antigravity.ts

@@ -45,8 +45,31 @@ function quotaInfoEntries(modelInfo: Record<string, unknown>): Record<string, un
   return entries;
 }
 
+/**
+ * Gemini 4 Argon has its own quota pool. Its names also contain "gemini", so every family
+ * decision below checks Argon first; otherwise Argon readings fill or replace the Gem family.
+ */
+const ARGON_TOKEN = /(?:^|[^a-z0-9])argon(?:[^a-z0-9]|$)/i;
+const GEMINI_TOKEN = /(?:^|[^a-z0-9])gemini(?:[^a-z0-9]|$)/i;
+const CLAUDE_FAMILY_TOKEN = /(?:^|[^a-z0-9])(?:claude|3p|gpt|opus|sonnet)(?:[^a-z0-9]|$)/i;
+/** Canonical model of the Argon summary pool; tagging keeps the window out of routing. */
+const ARGON_POOL_MODEL_ID = "gemini-4-argon";
+
+type AntigravitySummaryFamily = "argon" | "gem" | "cla";
+
+/** A bucket's own id and name decide its family when they name one; the group decides otherwise. */
+function antigravitySummaryBucketFamily(bucket: Record<string, unknown>): AntigravitySummaryFamily | undefined {
+  const identity = `${typeof bucket.bucketId === "string" ? bucket.bucketId : ""} ${typeof bucket.displayName === "string" ? bucket.displayName : ""}`;
+  if (ARGON_TOKEN.test(identity)) return "argon";
+  if (GEMINI_TOKEN.test(identity)) return "gem";
+  if (CLAUDE_FAMILY_TOKEN.test(identity)) return "cla";
+  return undefined;
+}
+
 function classifyAntigravityFamily(modelId: string, modelInfo: Record<string, unknown>, quotaInfo: Record<string, unknown>): "Gem" | "Cla" | null {
   const displayName = typeof modelInfo.displayName === "string" ? modelInfo.displayName : "";
+  // Argon models keep their exact model rows but never seed the shared Gem family bar.
+  if (ARGON_TOKEN.test(`${modelId} ${displayName}`)) return null;
   const tier = typeof quotaInfo.tier === "string" ? quotaInfo.tier : "";
   const haystack = `${modelId} ${displayName} ${tier}`.toLowerCase();
   if (haystack.includes("gemini")) return "Gem";
@@ -128,9 +151,13 @@ function parseAntigravityQuotaSummary(body: Record<string, unknown> | null): Pro
   for (const rawGroup of groups) {
     const group = asRecord(rawGroup);
     if (!group) continue;
-    const groupName = `${typeof group.displayName === "string" ? group.displayName : ""} ${typeof group.description === "string" ? group.description : ""}`.toLowerCase();
-    const isGemini = groupName.includes("gemini");
-    const isClaude = groupName.includes("claude") || groupName.includes("3p") || groupName.includes("gpt");
+    const groupDisplayName = typeof group.displayName === "string" ? group.displayName : "";
+    const groupName = `${groupDisplayName} ${typeof group.description === "string" ? group.description : ""}`.toLowerCase();
+    // A description that merely mentions Argon must not move a whole Gemini group.
+    const groupFamily: AntigravitySummaryFamily | undefined = ARGON_TOKEN.test(groupDisplayName) ? "argon"
+      : groupName.includes("gemini") ? "gem"
+        : groupName.includes("claude") || groupName.includes("3p") || groupName.includes("gpt") ? "cla"
+          : undefined;
 
     const buckets = Array.isArray(group.buckets) ? (group.buckets as unknown[]) : [];
     for (const rawBucket of buckets) {
@@ -143,13 +170,19 @@ function parseAntigravityQuotaSummary(body: Record<string, unknown> | null): Pro
 
       const isWeekly = windowStr.includes("week");
       const is5h = windowStr.includes("5h") || windowStr.includes("five");
+      const family = antigravitySummaryBucketFamily(bucket) ?? groupFamily;
 
-      if (isGemini) {
+      if (family === "argon") {
+        const label = is5h ? "Argon" : isWeekly ? "Argon (Weekly)" : "";
+        if (label && !customWindowsMap.has(label)) {
+          customWindowsMap.set(label, { label, modelId: ARGON_POOL_MODEL_ID, percent, ...(resetAt !== undefined ? { resetAt } : {}) });
+        }
+      } else if (family === "gem") {
         const label = is5h ? "Gem" : isWeekly ? "Gem (Weekly)" : "";
         if (label && !customWindowsMap.has(label)) {
           customWindowsMap.set(label, { label, percent, ...(resetAt !== undefined ? { resetAt } : {}) });
         }
-      } else if (isClaude) {
+      } else if (family === "cla") {
         const label = is5h ? "Cla" : isWeekly ? "Cla (Weekly)" : "";
         if (label && !customWindowsMap.has(label)) {
           customWindowsMap.set(label, { label, percent, ...(resetAt !== undefined ? { resetAt } : {}) });
@@ -164,7 +197,7 @@ function parseAntigravityQuotaSummary(body: Record<string, unknown> | null): Pro
     }
   }
 
-  const PREFERRED_ORDER = ["Gem", "Gem (Weekly)", "Cla", "Cla (Weekly)"];
+  const PREFERRED_ORDER = ["Gem", "Gem (Weekly)", "Cla", "Cla (Weekly)", "Argon", "Argon (Weekly)"];
   const customWindows = Array.from(customWindowsMap.values()).sort((a, b) => {
     const ia = PREFERRED_ORDER.indexOf(a.label);
     const ib = PREFERRED_ORDER.indexOf(b.label);

package/src/providers/quota/report-cache.ts

@@ -1,3 +1,5 @@
+import { decisionQuotaSinkActive, invalidateDecisionKeyQuotas, publishDecisionKeyQuota } from "../../lib/decision-quota-sink";
+import { providerDecisionWindows } from "../quota-decision-publication";
 import { createHash } from "node:crypto";
 import { effectiveCodexAuthAccountId, listCodexAuthAccountsSnapshot } from "../../codex/auth-api";
 import { withoutRetiredCodexQuota, type StoredAccountQuota } from "../../codex/quota";
@@ -345,6 +347,18 @@ export function isProviderQuotaReportCurrent(value: ProviderQuotaReport): boolea
     && (accountReportCurrent.get(value)?.() ?? true);
 }
 
+/** Called only by an accepted collector/cache publication, never the JEV read path. */
+export function publishCollectedDecisionQuota(reports: ProviderQuotaReport[], config: OcxConfig): void {
+  if (!decisionQuotaSinkActive()) return;
+  invalidateDecisionKeyQuotas();
+  for (const report of reports) {
+    const provider = config.providers[report.provider];
+    const evidence = routingEvidence.get(report);
+    if (provider && evidence && evidence.binding === providerQuotaRoutingBinding(report.provider, provider))
+      publishDecisionKeyQuota(report.provider, provider, providerDecisionWindows(evidence.quota));
+  }
+}
+
 /**
  * The reports this process already holds for the configured providers, for a passive read (#6959):
  * no probe, token refresh, account snapshot or publication into routing evidence. The Home's own

package/src/providers/quota/vendor-probes-oauth.ts

@@ -300,7 +300,7 @@ export async function fetchAnthropicQuota(provider: string, config: OcxConfig =
   if (!initialRow || !currentRow || initialRow.loginId !== currentRow.loginId || initialRow.addedAt !== currentRow.addedAt
     || epoch !== captureProviderAccountQuotaEpoch(instance) || recovery.anthropicAccountIncarnation(probedAccountId) !== incarnation) return null;
   let quota: ProviderQuota | null;
-  let anthropicCurrent: (() => boolean) | undefined;
+  let anthropicCurrent: (() => boolean) | undefined; let anthropicPublish: (() => void) | undefined;
   try {
     const result = await recovery.probeAnthropicQuotaWithRecovery(probedAccountId, accessToken,
       fresh => {
@@ -311,7 +311,7 @@ export async function fetchAnthropicQuota(provider: string, config: OcxConfig =
       () => targetCurrent() && mayCommitAccountQuotaKey(probedAccountKey, writerGeneration));
     if (result && !result.isCurrent()) return null;
     quota = result?.quota ?? null;
-    anthropicCurrent = result?.isCurrent;
+    anthropicCurrent = result?.isCurrent; anthropicPublish = result?.publishDecisionQuota;
   } catch (error) {
     if (error instanceof AnthropicQuotaProbeOwnershipError) return null;
     throw error;
@@ -322,7 +322,7 @@ export async function fetchAnthropicQuota(provider: string, config: OcxConfig =
   if (probedAccountId && probedAccountKey) {
     const stillOwnsToken = getAccountCredential(instance, probedAccountId)?.access === accessToken;
     if (stillOwnsToken && anthropicCurrent?.() && mayCommitAccountQuotaKey(probedAccountKey, writerGeneration)) {
-      accountQuotaCache.set(probedAccountKey, { ts: Date.now(), quota, isCurrent: anthropicCurrent });
+      accountQuotaCache.set(probedAccountKey, { ts: Date.now(), quota, isCurrent: anthropicCurrent }); anthropicPublish?.();
     }
   }
   const quotaReport = report(provider, "anthropic:oauth-usage", quota);