@bitkyc08/opencodex 2.88.0 → 2.90.0

package/src/oauth/store.ts

@@ -19,6 +19,8 @@
  *   distinct one. Kimi extracts JWT `user_id`/`sub` as accountId; Cursor extracts JWT `sub` —
  *   both append distinct identified accounts under multiauth.
  */
+import { notifyAuthStoreLoaded } from "../lib/decision-quota-sink";
+import { accountPauseDetailsSchema } from "../config/schema/account-auto-pause";
 import { normalizeOAuthPlan, mergeOAuthPlan } from "./plan";
 import { normalizeAnthropicIdentity, matchesAnthropicImport, mergeAnthropicIdentity } from "./anthropic-identity";
 import { findKiroAccountForLogin, withRetainedKiroUser } from "./kiro-account-identity";
@@ -354,17 +356,23 @@ export function credentialGeneration(cred: OAuthCredentials): string {
   return createHash("sha256").update(JSON.stringify([cred.refresh, cred.access, cred.expires])).digest("hex");
 }
 
+/** Load and normalize the OAuth auth store with hardened permissions, and hand the result to the opt-in decision-quota slot (a no-op unless JEV quota signals are active). */
 function loadAuthStoreInternal(): { store: AuthStore; hadLegacy: boolean } {
   const path = getAuthStorePath();
   hardenConfigDir();
   hardenExistingSecret(path);
-  if (!existsSync(path)) return { store: {}, hadLegacy: false };
+  if (!existsSync(path)) { notifyAuthStoreLoaded({}); return { store: {}, hadLegacy: false }; }
+  let result: { store: AuthStore; hadLegacy: boolean };
   try {
-    return normalizeAuthStore(JSON.parse(readFileSync(path, "utf-8")));
+    result = normalizeAuthStore(JSON.parse(readFileSync(path, "utf-8")));
   } catch {
     backupInvalidConfig(path);
+    notifyAuthStoreLoaded({});
     return { store: {}, hadLegacy: false };
   }
+  // Outside the parse try: roster publication is advisory and must never route a loaded store into the invalid-config backup path.
+  notifyAuthStoreLoaded(result.store);
+  return result;
 }
 
 export function loadAuthStore(): AuthStore {
@@ -403,6 +411,7 @@ export function peekAuthStore(): AuthStore {
   return snapshot.kind === "ready" ? snapshot.store : {};
 }
 
+/** Atomically write the auth store with owner-only permissions, then hand it to the opt-in decision-quota slot. */
 function persist(store: AuthStore): void {
   const dir = getConfigDir();
   assertNotRealHomeUnderTest(dir);
@@ -413,6 +422,7 @@ function persist(store: AuthStore): void {
   }
   hardenConfigDir();
   atomicWriteFile(getAuthStorePath(), JSON.stringify(store, null, 2) + "\n");
+  notifyAuthStoreLoaded(store);
 }
 
 export class OAuthFileLockError extends Error { readonly code = "OAUTH_FILE_LOCK_UNAVAILABLE"; constructor(message: string, options?: { cause?: unknown }) { super(message, options); this.name = "OAuthFileLockError"; } }
@@ -638,7 +648,12 @@ function normalizeAccount(value: unknown): ProviderAccount | null {
   if (candidate.refreshAttentionGeneration === credentialGeneration(credential)) {
     account.refreshAttentionGeneration = candidate.refreshAttentionGeneration;
   }
-  if (candidate.paused === true) account.paused = true;
+  if (candidate.paused === true) {
+    account.paused = true;
+    const details = accountPauseDetailsSchema.safeParse(candidate.pauseDetails);
+    if (details.success) account.pauseDetails = details.data;
+  }
+  if (typeof candidate.pauseRevision === "string") account.pauseRevision = candidate.pauseRevision;
   const threshold = parseAnthropicAccountThreshold(candidate.autoSwitchThresholdOverride);
   if (threshold !== null) account.autoSwitchThresholdOverride = threshold;
   if (candidate.needsReauth === true && candidate.needsReauthReason === "verify_account") {
@@ -801,7 +816,7 @@ function serializeMutation<T>(work: () => Promise<T>, retainedValues: readonly u
   drainOAuthMutations();
   return result;
 }
-export function mutateStore<T>(fn:(store:AuthStore)=>T|Promise<T>, retainedValues: readonly unknown[] = [], options?: { waitMs?: number; assertBeforePersist?: () => void; scrubLegacyBackup?: (result: T) => readonly string[]; finalizeResult?: (result: T, store: AuthStore) => void; afterPersist?: (result: T) => void }):Promise<T>{return serializeMutation(async()=>{const guard=await createOAuthFileLock({path:getAuthStoreLockPath(),staleAfterMs:30000}).acquire();try{
+export function mutateStore<T>(fn:(store:AuthStore)=>T|Promise<T>, retainedValues: readonly unknown[] = [], options?: { waitMs?: number; assertBeforePersist?: () => void; scrubLegacyBackup?: (result: T) => readonly string[]; finalizeResult?: (result: T, store: AuthStore) => void; afterPersist?: (result: T) => void; withConfigLock?: boolean }):Promise<T>{return serializeMutation(async()=>{const guard=await createOAuthFileLock({path:getAuthStoreLockPath(),staleAfterMs:30000}).acquire();try{
     const { store, hadLegacy } = loadAuthStoreInternal();
     if (hadLegacy) backupLegacyOnce();
     const selections = new Map(Object.entries(store).map(([provider, set]) => [provider, {
@@ -814,7 +829,7 @@ export function mutateStore<T>(fn:(store:AuthStore)=>T|Promise<T>, retainedValue
     // Only providers whose credentials this mutation actually removed leave the downgrade
     // backup; a no-op removal names none. The result decides, so it is read here.
     const scrubbedProviders = options?.scrubLegacyBackup?.(result) ?? [];
-    options?.assertBeforePersist?.();
+    if (!options?.withConfigLock) options?.assertBeforePersist?.();
     const changedProviders: string[] = [];
     for (const provider of new Set([...selections.keys(), ...Object.keys(store)])) {
       const before = selections.get(provider);
@@ -837,7 +852,8 @@ export function mutateStore<T>(fn:(store:AuthStore)=>T|Promise<T>, retainedValue
     // Receipt-producing mutations need the revision assigned by the bookkeeping above, not the
     // provisional value visible inside their callback. Finalization cannot await or mutate disk.
     options?.finalizeResult?.(result, store);
-    persist(store);
+    const publish = () => { if (options?.withConfigLock) options.assertBeforePersist?.(); persist(store); };
+    if (options?.withConfigLock) withConfigMutationLockSync(publish); else publish();
     if (scrubbedProviders.length > 0) scrubLegacyBackup(scrubbedProviders);
     // A committed observer may establish ordering before the generic selection
     // publication, but its failure can never turn a durable write into a reported failure.
@@ -1388,17 +1404,23 @@ export async function setAccountPaused(
   provider: string,
   accountId: string,
   paused: boolean,
+  automatic?: { generation: string; pauseRevision?: string; details: import("../types/account-auto-pause").AccountPauseDetails; isCurrent?: () => boolean; assertPolicyBeforePersist?: () => void },
 ): Promise<SetAccountPausedResult> {
   const result = await mutateStore(store => {
     const set = store[provider];
     const account = set?.accounts.find(candidate => candidate.id === accountId);
     if (!set || !account) return { status: "not-found" } as const;
-    if ((account.paused === true) === paused) {
+    if (automatic && (automatic.isCurrent?.() === false || credentialGeneration(account.credential) !== automatic.generation
+      || account.pauseRevision !== automatic.pauseRevision)) return { status: "not-found" } as const;
+    if (paused && account.paused === true) {
       return { status: "unchanged", activeAccountId: set.activeAccountId, activeAccountChanged: false } as const;
     }
 
     if (paused) account.paused = true;
     else delete account.paused;
+    account.pauseRevision = randomUUID();
+    if (automatic) account.pauseDetails = automatic.details;
+    else delete account.pauseDetails;
     // Pause is part of selection eligibility even when the operator changes a non-active
     // account. Bump the provider selection revision so observers receive the existing
     // post-persistence roster invalidation and stale automatic proposals cannot commit.
@@ -1432,7 +1454,10 @@ export async function setAccountPaused(
       activeAccountId: set.activeAccountId,
       activeAccountChanged,
     } as const;
-  }, [provider, accountId, paused]);
+  }, [provider, accountId, paused], { withConfigLock: !!automatic, assertBeforePersist: () => {
+    automatic?.assertPolicyBeforePersist?.();
+    if (automatic?.isCurrent?.() === false) throw new Error("Account auto-pause policy changed before persistence");
+  } });
   if (result.status === "updated") publishOAuthAccountPauseChange(provider);
   return result;
 }
@@ -1485,6 +1510,8 @@ export async function replaceProviderAccountSet(
         ...(account.needsReauth ? { needsReauth: true } : {}),
         ...(account.refreshAttentionGeneration ? { refreshAttentionGeneration: account.refreshAttentionGeneration } : {}),
         ...(account.paused ? { paused: true } : {}),
+        ...(account.pauseDetails ? { pauseDetails: account.pauseDetails } : {}),
+        ...(account.pauseRevision ? { pauseRevision: account.pauseRevision } : {}),
         ...(account.autoSwitchThresholdOverride !== undefined ? { autoSwitchThresholdOverride: account.autoSwitchThresholdOverride } : {}),
         ...(account.needsReauthReason === "verify_account" ? { needsReauthReason: account.needsReauthReason } : {}),
         ...(account.addedAt !== undefined ? { addedAt: account.addedAt } : {}),

package/src/oauth/types.ts

@@ -96,6 +96,8 @@ export interface ProviderAccount {
   refreshAttentionGeneration?: string;
   /** Operator exclusion from generic OAuth account selection until explicitly resumed. */
   paused?: boolean;
+  pauseDetails?: import("../types/account-auto-pause").AccountPauseDetails;
+  pauseRevision?: string;
   /** Anthropic-only usage-switch override; absent inherits its pool default, zero disables it. */
   autoSwitchThresholdOverride?: number;
   /**

package/src/plugins/upstream-hooks.ts

@@ -31,13 +31,20 @@ interface Registration {
 }
 
 const registrations: Registration[] = [];
+// Changes on every registration and removal, so an observer can tell that no rewriter could
+// have touched a send between two points even when the slot is empty at both.
+let registrationEpoch = 0;
 
 export function registerUpstreamRewriter(name: string, rewrite: UpstreamRewriter): () => void {
   const registration: Registration = { name, rewrite, disabled: false };
   registrations.push(registration);
+  registrationEpoch += 1;
   return () => {
     const index = registrations.indexOf(registration);
-    if (index >= 0) registrations.splice(index, 1);
+    if (index >= 0) {
+      registrations.splice(index, 1);
+      registrationEpoch += 1;
+    }
   };
 }
 
@@ -45,6 +52,11 @@ export function hasUpstreamRewriters(): boolean {
   return registrations.length > 0;
 }
 
+/** Monotonic registration epoch; equal values bracket a window with no registration change. */
+export function upstreamRewriterEpoch(): number {
+  return registrationEpoch;
+}
+
 /**
  * Run every active rewriter over one send. Returns the input untouched (same objects) when
  * no rewriter is registered, so the common path allocates nothing.
@@ -116,4 +128,5 @@ export function rewriteWebSocketDial(
 
 export function resetUpstreamRewritersForTests(): void {
   registrations.length = 0;
+  registrationEpoch += 1;
 }

package/src/providers/api-key-pause.ts

@@ -0,0 +1,32 @@
+import { accountAutoPauseFenceMatchesDisk, type AccountAutoPauseFence } from "../config/account-auto-pause-revisions";
+import { randomUUID } from "node:crypto";
+import type { OcxConfig } from "../types";
+import type { ProviderApiKeySelection } from "../types/provider";
+import type { AccountPauseDetails } from "../types/account-auto-pause";
+import { apiKeyPoolEntryId } from "./api-keys";
+import { resolveProviderApiKey } from "./api-key-resolve";
+import { commitProviderApiKeySelection } from "./api-key-selection";
+
+export function setProviderApiKeyPaused(config: OcxConfig, name: string, id: string, paused: boolean,
+  automatic?: { fence: AccountAutoPauseFence; selection: ProviderApiKeySelection; pauseRevision?: string; resolvedKey?: string; details: AccountPauseDetails }): boolean {
+  const result = commitProviderApiKeySelection(config, name, provider => {
+    if (automatic && !accountAutoPauseFenceMatchesDisk(name, automatic.fence)) return { changed: false, value: false };
+    const pool = provider.apiKeyPool?.length ? provider.apiKeyPool
+      : provider.apiKey ? [{ id: apiKeyPoolEntryId(provider.apiKey), key: provider.apiKey }] : [];
+    const entry = pool.find(e => e.id === id);
+    if (!entry || automatic && (entry.disabled || entry.key !== automatic.selection.reference || entry.pauseRevision !== automatic.pauseRevision
+      || provider.accountAutoPause?.enabled !== true || resolveProviderApiKey(entry.key) !== automatic.resolvedKey)) return { changed: false, value: false };
+    provider.apiKeyPool = pool;
+    entry.disabled = paused;
+    entry.pauseRevision = randomUUID();
+    if (automatic) entry.pauseDetails = automatic.details;
+    else delete entry.pauseDetails;
+    if (paused && provider.apiKey === entry.key) {
+      const next = provider.apiKeyPool?.find(e => !e.disabled);
+      if (next) provider.apiKey = next.key;
+      else delete provider.apiKey;
+    } else if (!paused && !provider.apiKey) provider.apiKey = entry.key;
+    return { changed: true, selectionChanged: true, value: true };
+  }, automatic?.selection);
+  return result.status === "committed" && result.value;
+}

package/src/providers/api-key-resolve.ts

@@ -16,6 +16,7 @@
  * Policy: a reference that cannot be resolved fails closed (no key) and is warned once per
  * account; nothing ever rewrites plaintext into config or its backups.
  */
+import { invalidateDecisionKeyQuotas, observeDecisionKeyCredential } from "../lib/decision-quota-sink";
 import { resolveEnvValue } from "../config/proxy-env";
 import { loadKeyringBinding } from "../lib/keyring-native";
 import { isGcpCredentialMaterial } from "../lib/gcp-credential-input";
@@ -52,6 +53,7 @@ export function providerKeyResolutionGeneration(): number {
 /** Test seam: swap the OS entry for an in-memory one and drop caches. */
 export function setProviderKeychainEntryFactoryForTests(factory: ProviderKeychainEntryFactory | null): void {
   entryFactory = factory ?? defaultEntryFactory;
+  invalidateDecisionKeyQuotas();
   resolvedCache.clear();
   resolutionGeneration++;
   warnedAccounts.clear();
@@ -59,6 +61,7 @@ export function setProviderKeychainEntryFactoryForTests(factory: ProviderKeychai
 
 /** Write-path seam: a store/restore mutated secrets, so cached reads and warnings are stale. */
 export function invalidateResolvedProviderKeyCache(): void {
+  invalidateDecisionKeyQuotas();
   resolvedCache.clear();
   resolutionGeneration++;
   warnedAccounts.clear();
@@ -114,15 +117,18 @@ function readKeychain(account: string, quiet = false): string | undefined {
  */
 export function resolveProviderApiKey(value: string | undefined): string | undefined {
   if (!value) return undefined;
-  if (isKeychainReference(value)) return readKeychain(keychainAccount(value));
-  return resolveEnvValue(value);
+  const resolved = isKeychainReference(value) ? readKeychain(keychainAccount(value)) : resolveEnvValue(value);
+  observeDecisionKeyCredential(value, resolved);
+  return resolved;
 }
 
 /** The same resolution without the unreadable-reference warning, for observe-only callers. */
 export function resolveProviderApiKeyQuietly(value: string | undefined): string | undefined {
   if (!value) return undefined;
-  if (isKeychainReference(value)) return readKeychain(keychainAccount(value), true);
-  return resolveEnvValue(value);
+  const resolved = isKeychainReference(value) ? readKeychain(keychainAccount(value), true) : resolveEnvValue(value);
+  // A quiet read still sees a replaced secret; advisory key evidence published under the old one must not outlive it.
+  observeDecisionKeyCredential(value, resolved);
+  return resolved;
 }
 
 export type ProviderKeyStoreKind = "keychain" | "env" | "file" | "none";

package/src/providers/api-key-selection.ts

@@ -13,6 +13,9 @@ import { captureProviderApiKeySelection } from "./api-key-selection-capture";
 export { captureProviderApiKeySelection } from "./api-key-selection-capture";
 
 function matchesSelection(provider: OcxProviderConfig, expected: ProviderApiKeySelection): boolean {
+  if (expected.distributed) return provider.apiKeySelectionRevision === expected.revision
+    && provider.requestPacing?.enabled === true && provider.requestPacing.keySelection === "round-robin"
+    && !!provider.apiKeyPool?.some(entry => !entry.disabled && entry.id === expected.entryId && entry.key === expected.reference);
   const current = captureProviderApiKeySelection(provider);
   return current.entryId === expected.entryId && current.reference === expected.reference
     && current.revision === expected.revision;
@@ -24,10 +27,12 @@ function currentKeyProvider(config: OcxConfig, name: string, selection?: Provide
   let row = configured;
   if (selection?.distributed) {
     const entry = configured.apiKeyPool?.find(key => key.id === selection.entryId && key.key === selection.reference);
-    if (!entry || (!allowCooling && isKeyInCooldown(name, entry.id)) || configured.apiKeySelectionRevision !== selection.revision
+    if (!entry || entry.disabled || (!allowCooling && isKeyInCooldown(name, entry.id)) || configured.apiKeySelectionRevision !== selection.revision
       || !configured.requestPacing?.enabled || configured.requestPacing.keySelection !== "round-robin") return null;
     row = { ...configured, apiKey: entry.key, _apiKeyAttempt: selection };
   }
+  if (row.apiKeyPool?.some(entry => entry.disabled && entry.key === row.apiKey)
+    || row.apiKeyPool?.length && row.apiKeyPool.every(entry => entry.disabled)) return null;
   const current = routedProviderConfig(name, { ...row, _apiKeyAttempt: selection?.distributed ? selection : undefined });
   if (current.authMode === "oauth" || current.authMode === "forward") return null;
   if (current.authMode === "key" && !current.keyOptional && !current.apiKey?.trim()) return null;

package/src/providers/api-keys.ts

@@ -21,6 +21,8 @@ export interface ProviderApiKeyInfo extends AccountQuotaFields {
   /** First/last 4 chars only; env references (`${VAR}`) are shown verbatim (not secrets). */
   masked: string;
   active: boolean;
+  disabled?: boolean;
+  pauseDetails?: import("../types/account-auto-pause").AccountPauseDetails;
   addedAt?: number;
 }
 
@@ -217,7 +219,7 @@ export function listProviderApiKeys(config: OcxConfig, name: string): { activeId
   const pool = provider.apiKeyPool?.length
     ? provider.apiKeyPool
     : provider.apiKey ? [{ id: apiKeyPoolEntryId(provider.apiKey), key: provider.apiKey }] : [];
-  const activeId = (pool.find(entry => entry.key === provider.apiKey) ?? pool[0])?.id ?? null;
+  const activeId = pool.find(entry => entry.key === provider.apiKey)?.id ?? null;
   return {
     activeId,
     keys: pool.map(entry => ({
@@ -225,6 +227,8 @@ export function listProviderApiKeys(config: OcxConfig, name: string): { activeId
       ...(entry.label ? { label: entry.label } : {}),
       masked: maskApiKey(entry.key),
       active: entry.id === activeId,
+      ...(entry.disabled ? { disabled: true } : {}),
+      ...(entry.pauseDetails ? { pauseDetails: entry.pauseDetails } : {}),
       ...(entry.addedAt !== undefined ? { addedAt: entry.addedAt } : {}),
     })),
   };
@@ -300,7 +304,7 @@ export function addProviderApiKey(config: OcxConfig, name: string, key: string,
     } else {
       pool.push({ id, key: trimmed, ...(label?.trim() ? { label: label.trim() } : {}), addedAt: Date.now() });
     }
-    fresh.apiKey = trimmed;
+    if (!existing?.disabled) fresh.apiKey = trimmed;
     return { changed: true, selectionChanged: true, value: id };
   });
   if (committed.status !== "committed") return { error: "provider selection unavailable" };
@@ -313,7 +317,7 @@ export function setActiveProviderApiKey(config: OcxConfig, name: string, id: str
     const entry = provider.apiKeyPool?.find(e => e.id === id)
       ?? (!provider.apiKeyPool?.length && provider.apiKey && apiKeyPoolEntryId(provider.apiKey) === id
         ? { id, key: provider.apiKey } : undefined);
-    if (!entry) return { changed: false, value: false };
+    if (!entry || entry.disabled) return { changed: false, value: false };
     ensurePool(provider);
     provider.apiKey = entry.key;
     return { changed: true, selectionChanged: true, value: true };
@@ -344,7 +348,7 @@ export function removeProviderApiKey(config: OcxConfig, name: string, id: string
     removed = entry.key;
     provider.apiKeyPool = pool.filter(e => e.id !== id);
     if (provider.apiKey === entry.key) {
-      const next = provider.apiKeyPool[0];
+      const next = provider.apiKeyPool.find(candidate => !candidate.disabled);
       if (next) provider.apiKey = next.key;
       else delete provider.apiKey;
     }

package/src/providers/claude-cli-usage.ts

@@ -1,7 +1,11 @@
 import { markAnthropicFamilyEnumeration } from "./quota/anthropic-family-headers";
+import { rawAnthropicUsageWindows } from "./quota/anthropic-decision-windows";
+import { bindRawDecisionWindows } from "./quota-decision-publication";
+import { decisionQuotaSinkActive } from "../lib/decision-quota-sink";
 import { CLAUDE_CLI_USER_AGENT } from "./claude-cli-identity";
 import { asRecord, normalizePercent, normalizeResetAt, readQuotaJson, REQUEST_TIMEOUT_MS } from "./quota-wire";
-import type { ProviderQuota, ProviderQuotaWindow } from "./quota-types";
+import type { ProviderQuota, ProviderQuotaWindow, QuotaFailureCode } from "./quota-types";
+import { httpQuotaFailure } from "./quota/failure-codes";
 const hasQuotaRows = (q: ProviderQuota) => q.fiveHourPercent !== undefined || q.weeklyPercent !== undefined || Boolean(q.customWindows?.length);
 
 function parseClaudeBucket(value: unknown): { percent?: number; resetAt?: number } | null {
@@ -41,7 +45,18 @@ function parseClaudeLimit(value: unknown): ProviderQuotaWindow | null {
   return { label, scope: "model", percent, ...(resetAt !== undefined ? { resetAt } : {}) };
 }
 
+/** Read the Anthropic OAuth usage endpoint for an access token and return the parsed quota, or null on a non-OK or malformed response. */
 export async function readAnthropicUsageQuota(accessToken: string): Promise<ProviderQuota | null> {
+  return (await probeAnthropicUsageQuota(accessToken)).quota;
+}
+
+/** A usage read plus, when it yields no quota, the closed reason why. A thrown fetch still throws. */
+export interface AnthropicUsageProbe {
+  quota: ProviderQuota | null;
+  failure?: QuotaFailureCode;
+}
+
+export async function probeAnthropicUsageQuota(accessToken: string): Promise<AnthropicUsageProbe> {
   const response = await fetch("https://api.anthropic.com/api/oauth/usage", {
     headers: {
       Accept: "application/json, text/plain, */*",
@@ -52,9 +67,12 @@ export async function readAnthropicUsageQuota(accessToken: string): Promise<Prov
     },
     signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
   });
-  if (!response.ok) return null;
+  if (!response.ok) {
+    try { await response.body?.cancel(); } catch { /* Best-effort release; the status is the diagnosis. */ }
+    return { quota: null, failure: httpQuotaFailure(response.status) };
+  }
   const body = asRecord(await readQuotaJson(response));
-  if (!body) return null;
+  if (!body) return { quota: null, failure: "response_unusable" };
   const fiveHour = parseClaudeBucket(body.five_hour);
   const sevenDay = parseClaudeBucket(body.seven_day);
   const fable = parseClaudeBucket(body.seven_day_fable);
@@ -87,10 +105,12 @@ export async function readAnthropicUsageQuota(accessToken: string): Promise<Prov
     ...(customWindows.length > 0 ? { customWindows } : {}),
     updatedAt: Date.now(),
   };
+  if (decisionQuotaSinkActive()) bindRawDecisionWindows(quota, rawAnthropicUsageWindows(body, quota.updatedAt));
   // Empty / schema-changed payloads must not cache as "success with no bars".
-  return hasQuotaRows(quota) ? markAnthropicFamilyEnumeration(quota, Array.isArray(body.limits) && body.limits.every(raw => {
+  if (!hasQuotaRows(quota)) return { quota: null, failure: "response_unusable" };
+  return { quota: markAnthropicFamilyEnumeration(quota, Array.isArray(body.limits) && body.limits.every(raw => {
     const kind = asRecord(raw)?.kind;
     return kind === "session" || kind === "weekly_all" || kind === "weekly_scoped" && parseClaudeLimit(raw) !== null;
-  })) : null;
+  })) };
 }
 

package/src/providers/initial-model-selection.ts

@@ -3,7 +3,7 @@ import { randomUUID } from "node:crypto";
 import { getProviderRegistryEntry, providerMatchesRegistryTransport } from "./registry";
 import { routedSlug, slugEquivalenceKey } from "./slug-codec";
 import { comboDisabledModelSelectors } from "../combos/types";
-import { providerUsesKeyAuthOverride, resolveProviderApiKey } from "./key-store";
+import { providerUsesKeyAuthOverride } from "./key-store";
 
 export const INITIAL_MODEL_SELECTION_THRESHOLD = 20;
 type Selection = NonNullable<OcxProviderConfig["initialModelSelection"]>;
@@ -31,7 +31,7 @@ function loginConnection(name: string, provider: OcxProviderConfig): boolean {
   if (entry && providerMatchesRegistryTransport(name, provider)) {
     if (entry.authKind === "forward") return true;
     if (entry.authKind === "oauth") {
-      return !providerUsesKeyAuthOverride(entry, provider, resolveProviderApiKey(provider.apiKey));
+      return !providerUsesKeyAuthOverride(entry, provider);
     }
   }
   return provider.authMode === "oauth" || provider.authMode === "forward";

package/src/providers/key-failover.ts

@@ -12,6 +12,7 @@ import { isKeyInCooldown, getKeyCooldownUntil, setKeyCooldown } from "./api-key-
 export { clearKeyCooldowns, getKeyCooldownUntil, sweepExpiredApiKeyCooldowns } from "./api-key-cooldowns";
 import { commitProviderApiKeySelection, providerApiKeySelectionIsCurrent } from "./api-key-selection";
 import { RequestPacingQueueOverloadError } from "./request-pacing";
+import { isCanonicalMistralChat } from "./mistral-transport";
 import type { ProviderApiKeySelection } from "../types/provider";
 import { routedProviderConfig } from "./routed-config";
 import { getProviderRegistryEntry } from "./registry";
@@ -493,9 +494,9 @@ export function selectProactiveApiKey(
 
   const activeEntry = pool.find(entry => entry.key === provider.apiKey);
   // A healthy committed key wins, whether the operator chose it or a previous rotation did.
-  if (activeEntry && !isKeyInCooldown(providerName, activeEntry.id, now)) return null;
+  if (activeEntry && !activeEntry.disabled && !isKeyInCooldown(providerName, activeEntry.id, now)) return null;
 
-  const eligible = pool.filter(entry => !isKeyInCooldown(providerName, entry.id, now));
+  const eligible = pool.filter(entry => !entry.disabled && !isKeyInCooldown(providerName, entry.id, now));
   if (eligible.length === 0) return null;
 
   let chosen = eligible[0]!;
@@ -504,7 +505,7 @@ export function selectProactiveApiKey(
     const lastIndex = lastId ? pool.findIndex(entry => entry.id === lastId) : -1;
     for (let offset = 1; offset <= pool.length; offset += 1) {
       const candidate = pool[(lastIndex + offset) % pool.length]!;
-      if (isKeyInCooldown(providerName, candidate.id, now)) continue;
+      if (candidate.disabled || isKeyInCooldown(providerName, candidate.id, now)) continue;
       chosen = candidate;
       break;
     }
@@ -518,11 +519,11 @@ export function selectProactiveApiKey(
   const outcome = commitProviderApiKeySelection<string | null>(config, providerName, freshProvider => {
     const freshPool = freshProvider.apiKeyPool ?? [];
     const target = freshPool.find(entry => entry.id === chosen.id);
-    if (!target) return { changed: false, value: null };
+    if (!target || target.disabled) return { changed: false, value: null };
     if (freshProvider.apiKey === target.key) return { changed: false, value: null };
     const freshActive = freshPool.find(entry => entry.key === freshProvider.apiKey);
     // Re-check under the lock: a concurrent manual selection may have landed a healthy key.
-    if (freshActive && !isKeyInCooldown(providerName, freshActive.id, now)) {
+    if (freshActive && !freshActive.disabled && !isKeyInCooldown(providerName, freshActive.id, now)) {
       return { changed: false, value: null };
     }
     freshProvider.apiKey = target.key;
@@ -564,7 +565,7 @@ export function selectProactiveApiKeyTransport(
 
 const dispatchKeyCursor = new Map<string, string>();
 function allocateDistributedKey(providerName: string, provider: OcxProviderConfig, now: number): OcxProviderConfig {
-  const pool = (provider.apiKeyPool ?? []).filter((entry, index, all) => all.findIndex(other => other.key === entry.key) === index);
+  const pool = (provider.apiKeyPool ?? []).filter(entry => !entry.disabled).filter((entry, index, all) => all.findIndex(other => other.key === entry.key) === index);
   const previous = dispatchKeyCursor.get(providerName);
   const start = pool.findIndex(entry => entry.id === previous);
   for (let offset = 1; offset <= pool.length; offset++) {
@@ -575,7 +576,7 @@ function allocateDistributedKey(providerName: string, provider: OcxProviderConfi
       entryId: entry.id, reference: entry.key, revision: provider.apiKeySelectionRevision, distributed: true,
     } };
   }
-  const next = Math.min(...pool.map(entry => getKeyCooldownUntil(providerName, entry.id, now) ?? now + 1000));
+  const next = pool.length ? Math.min(...pool.map(entry => getKeyCooldownUntil(providerName, entry.id, now) ?? now + 1000)) : now + 1000;
   throw new RequestPacingQueueOverloadError(providerName, "keys_exhausted", Math.max(1, Math.ceil((next - now) / 1000)));
 }
 
@@ -585,7 +586,7 @@ function allocateDistributedKey(providerName: string, provider: OcxProviderConfi
  * (subscription traffic such as Muse Spark) falls back to a patient same-key policy so a
  * burst 429 waits and replays instead of surfacing to the client and aborting a long
  * session; key-auth Command Code at its canonical endpoints gets the same fallback (#5180), and
- * every other provider without the knob keeps today's fail-fast behavior.
+ * canonical Mistral Chat uses a slower fallback; other destinations stay fail-fast.
  * OAuth/forward/local credentials are never replayed on the same token. The returned
  * policy is fully defaulted so callers never re-check fields.
  */
@@ -609,8 +610,15 @@ export function rateLimitRetryPolicyFor(
       respectRetryAfter: policy.respectRetryAfter ?? DEFAULT_RATE_LIMIT_RETRY.respectRetryAfter,
     };
   }
-  // No explicit knob: patient fallback for OpenCode Go and canonical Command Code only.
+  // No explicit knob: destination-specific fallbacks, never OAuth or local credentials.
   if (provider.authMode !== undefined && provider.authMode !== "key") return null;
+  // Mistral's token-throughput and temporary capacity refusals both use HTTP 429.
+  // Keep relays and other wire adapters opt-in, and reuse the existing send budget.
+  if (typeof provider.baseUrl === "string" && typeof provider.adapter === "string" && isCanonicalMistralChat({
+    adapter: provider.adapter, authMode: provider.authMode, baseUrl: provider.baseUrl,
+  })) {
+    return { ...DEFAULT_RATE_LIMIT_RETRY, attempts: 6, intervalMs: 10_000 };
+  }
   if (isOpenCodeGoDestination(provider)) return { ...OPENCODE_GO_RATE_LIMIT_RETRY };
   // Command Code's Provider API rate-limits long muse-spark turns the same way (#5180): a single
   // key cannot fail over, and the Codex client does not retry a 429, so the turn aborts. The key
@@ -711,7 +719,7 @@ export function recordDistributedKeyFailure(
   const provider = config.providers[providerName];
   if (!selection?.distributed || !provider || provider.authMode === "oauth" || provider.authMode === "forward") return false;
   const failed = provider.apiKeyPool?.find(entry => entry.id === selection.entryId && entry.key === selection.reference);
-  if (!failed || provider.apiKeySelectionRevision !== selection.revision) return false;
+  if (!failed || failed.disabled || provider.apiKeySelectionRevision !== selection.revision) return false;
   const delay = status === "billing" ? ANTHROPIC_BILLING_COOLDOWN_MS : status === 401 ? MAX_COOLDOWN_MS : quotaResetAt !== undefined
     ? Math.max(1, quotaResetAt - now) : parseRetryAfterMs(retryAfter, now) ?? DEFAULT_COOLDOWN_MS;
   for (const entry of provider.apiKeyPool ?? []) if (entry.key === failed.key) {
@@ -739,7 +747,7 @@ function rotateKeyAfterFailure(
   if (attemptedSelection?.distributed) {
     if (acceptsFreshProvider && !acceptsFreshProvider(provider)) return null;
     if (!recordDistributedKeyFailure(config, providerName, attemptedSelection, failureStatus, now, retryAfterHeader, quotaResetAt)) return null;
-    if (!(provider.apiKeyPool ?? []).some(entry => !isKeyInCooldown(providerName, entry.id, now))) return null;
+    if (!(provider.apiKeyPool ?? []).some(entry => !entry.disabled && !isKeyInCooldown(providerName, entry.id, now))) return null;
     return allocateDistributedKey(providerName, provider, now);
   }
 
@@ -764,7 +772,7 @@ function rotateKeyAfterFailure(
 
     if (freshProvider.apiKey !== failedKey) {
       const activeEntry = pool.find(entry => entry.key === freshProvider.apiKey);
-      if (activeEntry && !isKeyInCooldown(providerName, activeEntry.id, now)) {
+      if (activeEntry && !activeEntry.disabled && !isKeyInCooldown(providerName, activeEntry.id, now)) {
         return {
           changed: false,
           value: { failedId: failedEntry?.id },
@@ -776,7 +784,7 @@ function rotateKeyAfterFailure(
     const candidateCount = failedEntry ? pool.length - 1 : pool.length;
     for (let offset = 1; offset <= candidateCount; offset += 1) {
       const candidate = pool[(currentIndex + offset) % pool.length]!;
-      if (isKeyInCooldown(providerName, candidate.id, now)) continue;
+      if (candidate.disabled || isKeyInCooldown(providerName, candidate.id, now)) continue;
       freshProvider.apiKey = candidate.key;
       return {
         changed: true,

package/src/providers/key-store.ts

@@ -32,14 +32,19 @@ export type {
   ProviderKeyStoreKind,
 } from "./api-key-resolve";
 
-/** Shared with routing: a key-mode override is effective only while its key resolves. */
+/**
+ * Shared with routing: a key-mode override is operator intent, not a credential probe.
+ * The configured authMode alone decides the lane; a key that cannot be resolved right now
+ * (paused last key, missing env var, disabled pool) fails closed at the transport and must
+ * never implicitly reclassify the provider to the registry's OAuth lane, where a stored
+ * OAuth account would be billed instead of the operator's key.
+ */
 export function providerUsesKeyAuthOverride(
   entry: Pick<ProviderRegistryEntry, "authKind" | "allowKeyAuthOverride">,
   provider: Pick<OcxProviderConfig, "authMode">,
-  resolvedKey: string | undefined,
 ): boolean {
   return entry.authKind === "oauth" && entry.allowKeyAuthOverride === true
-    && provider.authMode === "key" && typeof resolvedKey === "string" && resolvedKey.trim().length > 0;
+    && provider.authMode === "key";
 }
 
 /**