@bitkyc08/opencodex 2.89.0 → 2.90.0

package/src/oauth/kiro.ts

@@ -205,11 +205,54 @@ function profileArnFromWhoami(parsed: Record<string, unknown>): string | undefin
       : undefined);
 }
 
+/**
+ * `kiro-cli whoami --format json` prints its identity as one JSON object, but once an IAM Identity
+ * Center profile is selected kiro-cli 2.32 follows that object with a human-readable `Profile:`
+ * block on stdout. Parsing the whole stream then failed, which silently dropped the user email that
+ * tells organization users apart (#6641). Only the leading top-level object is identity evidence;
+ * it must start the output and end its line, so text on later lines is ignored while a second
+ * value on the same line makes the identity unreadable.
+ */
+function parseWhoamiObject(stdout: string): Record<string, unknown> | undefined {
+  const start = stdout.search(/\S/);
+  if (start < 0 || stdout[start] !== "{") return undefined;
+  let depth = 0;
+  let inString = false;
+  let escaped = false;
+  for (let index = start; index < stdout.length; index++) {
+    const char = stdout[index];
+    if (inString) {
+      if (escaped) escaped = false;
+      else if (char === "\\") escaped = true;
+      else if (char === "\"") inString = false;
+      continue;
+    }
+    if (char === "\"") inString = true;
+    else if (char === "{" || char === "[") depth++;
+    else if (char === "}" || char === "]") {
+      depth--;
+      if (depth > 0) continue;
+      if (!/^[ \t]*(?:\r?\n|$)/.test(stdout.slice(index + 1))) return undefined;
+      const parsed: unknown = JSON.parse(stdout.slice(start, index + 1));
+      return parsed && typeof parsed === "object" && !Array.isArray(parsed)
+        ? parsed as Record<string, unknown>
+        : undefined;
+    }
+  }
+  return undefined;
+}
+
+/**
+ * Same-session identity reported by `kiro-cli whoami --format json`: the lower-cased user email
+ * and a structurally valid profile ARN. Any failure (non-zero exit, unreadable output, a thrown
+ * runner) yields an empty identity, so a login falls back to the SQLite import instead of failing.
+ */
 async function readKiroCliIdentity(runner: KiroCliRunner, signal?: AbortSignal): Promise<{ email?: string; profileArn?: string }> {
   try {
     const result = await runner(["whoami", "--format", "json"], signal);
     if (result.exitCode !== 0) return {};
-    const parsed = JSON.parse(result.stdout) as Record<string, unknown>;
+    const parsed = parseWhoamiObject(result.stdout);
+    if (!parsed) return {};
     const email = typeof parsed.email === "string" ? parsed.email.trim().toLowerCase() : "";
     const profileArn = profileArnFromWhoami(parsed);
     return {

package/src/oauth/login-flow-state.ts

@@ -297,14 +297,23 @@ export function clearLoginState(provider: string): void {
 /**
  * Cancel one login. `flowId` names it exactly; without one the provider's newest in-flight flow
  * is cancelled, which is every single-flow caller (GUI, CLI) unchanged. A flow id belonging to a
- * different provider is refused rather than cancelled.
+ * different provider is refused rather than cancelled. Only the public OAuth cancellation
+ * endpoint opts into failed-outcome dismissal; callers using this boolean as proof of an
+ * aborted controller (Codex flow ownership) retain their original contract.
  */
-export function cancelLoginFlow(provider: string, flowId?: string): boolean {
+export function cancelLoginFlow(provider: string, flowId?: string, options?: { dismissSettledFailure?: boolean }): boolean {
   const flowKey = flowId ?? latestLoginFlowKey(provider);
   if (flowKey === undefined) return false;
   const active = loginAbort.get(flowKey);
   const existing = loginState.get(flowKey);
   if ((active?.provider ?? loginFlowProvider(flowKey)) !== provider) return false;
+  if (options?.dismissSettledFailure && !active && existing?.done && existing.error) {
+    // A failed add-account attempt does not invalidate a previously signed-in account. Let
+    // its owner dismiss the stale UI outcome without erasing credentials or another flow.
+    clearManualCodeSlot(flowKey);
+    dropLoginFlow(flowKey);
+    return true;
+  }
   if (!active && (!existing || existing.done)) return false;
   abandonLoginFlow(flowKey, { error: "Login cancelled", errorCode: "no_pending_login" });
   return true;

package/src/providers/claude-cli-usage.ts

@@ -4,7 +4,8 @@ import { bindRawDecisionWindows } from "./quota-decision-publication";
 import { decisionQuotaSinkActive } from "../lib/decision-quota-sink";
 import { CLAUDE_CLI_USER_AGENT } from "./claude-cli-identity";
 import { asRecord, normalizePercent, normalizeResetAt, readQuotaJson, REQUEST_TIMEOUT_MS } from "./quota-wire";
-import type { ProviderQuota, ProviderQuotaWindow } from "./quota-types";
+import type { ProviderQuota, ProviderQuotaWindow, QuotaFailureCode } from "./quota-types";
+import { httpQuotaFailure } from "./quota/failure-codes";
 const hasQuotaRows = (q: ProviderQuota) => q.fiveHourPercent !== undefined || q.weeklyPercent !== undefined || Boolean(q.customWindows?.length);
 
 function parseClaudeBucket(value: unknown): { percent?: number; resetAt?: number } | null {
@@ -46,6 +47,16 @@ function parseClaudeLimit(value: unknown): ProviderQuotaWindow | null {
 
 /** Read the Anthropic OAuth usage endpoint for an access token and return the parsed quota, or null on a non-OK or malformed response. */
 export async function readAnthropicUsageQuota(accessToken: string): Promise<ProviderQuota | null> {
+  return (await probeAnthropicUsageQuota(accessToken)).quota;
+}
+
+/** A usage read plus, when it yields no quota, the closed reason why. A thrown fetch still throws. */
+export interface AnthropicUsageProbe {
+  quota: ProviderQuota | null;
+  failure?: QuotaFailureCode;
+}
+
+export async function probeAnthropicUsageQuota(accessToken: string): Promise<AnthropicUsageProbe> {
   const response = await fetch("https://api.anthropic.com/api/oauth/usage", {
     headers: {
       Accept: "application/json, text/plain, */*",
@@ -56,9 +67,12 @@ export async function readAnthropicUsageQuota(accessToken: string): Promise<Prov
     },
     signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
   });
-  if (!response.ok) return null;
+  if (!response.ok) {
+    try { await response.body?.cancel(); } catch { /* Best-effort release; the status is the diagnosis. */ }
+    return { quota: null, failure: httpQuotaFailure(response.status) };
+  }
   const body = asRecord(await readQuotaJson(response));
-  if (!body) return null;
+  if (!body) return { quota: null, failure: "response_unusable" };
   const fiveHour = parseClaudeBucket(body.five_hour);
   const sevenDay = parseClaudeBucket(body.seven_day);
   const fable = parseClaudeBucket(body.seven_day_fable);
@@ -93,9 +107,10 @@ export async function readAnthropicUsageQuota(accessToken: string): Promise<Prov
   };
   if (decisionQuotaSinkActive()) bindRawDecisionWindows(quota, rawAnthropicUsageWindows(body, quota.updatedAt));
   // Empty / schema-changed payloads must not cache as "success with no bars".
-  return hasQuotaRows(quota) ? markAnthropicFamilyEnumeration(quota, Array.isArray(body.limits) && body.limits.every(raw => {
+  if (!hasQuotaRows(quota)) return { quota: null, failure: "response_unusable" };
+  return { quota: markAnthropicFamilyEnumeration(quota, Array.isArray(body.limits) && body.limits.every(raw => {
     const kind = asRecord(raw)?.kind;
     return kind === "session" || kind === "weekly_all" || kind === "weekly_scoped" && parseClaudeLimit(raw) !== null;
-  })) : null;
+  })) };
 }
 

package/src/providers/initial-model-selection.ts

@@ -3,7 +3,7 @@ import { randomUUID } from "node:crypto";
 import { getProviderRegistryEntry, providerMatchesRegistryTransport } from "./registry";
 import { routedSlug, slugEquivalenceKey } from "./slug-codec";
 import { comboDisabledModelSelectors } from "../combos/types";
-import { providerUsesKeyAuthOverride, resolveProviderApiKey } from "./key-store";
+import { providerUsesKeyAuthOverride } from "./key-store";
 
 export const INITIAL_MODEL_SELECTION_THRESHOLD = 20;
 type Selection = NonNullable<OcxProviderConfig["initialModelSelection"]>;
@@ -31,7 +31,7 @@ function loginConnection(name: string, provider: OcxProviderConfig): boolean {
   if (entry && providerMatchesRegistryTransport(name, provider)) {
     if (entry.authKind === "forward") return true;
     if (entry.authKind === "oauth") {
-      return !providerUsesKeyAuthOverride(entry, provider, resolveProviderApiKey(provider.apiKey));
+      return !providerUsesKeyAuthOverride(entry, provider);
     }
   }
   return provider.authMode === "oauth" || provider.authMode === "forward";

package/src/providers/key-failover.ts

@@ -12,6 +12,7 @@ import { isKeyInCooldown, getKeyCooldownUntil, setKeyCooldown } from "./api-key-
 export { clearKeyCooldowns, getKeyCooldownUntil, sweepExpiredApiKeyCooldowns } from "./api-key-cooldowns";
 import { commitProviderApiKeySelection, providerApiKeySelectionIsCurrent } from "./api-key-selection";
 import { RequestPacingQueueOverloadError } from "./request-pacing";
+import { isCanonicalMistralChat } from "./mistral-transport";
 import type { ProviderApiKeySelection } from "../types/provider";
 import { routedProviderConfig } from "./routed-config";
 import { getProviderRegistryEntry } from "./registry";
@@ -585,7 +586,7 @@ function allocateDistributedKey(providerName: string, provider: OcxProviderConfi
  * (subscription traffic such as Muse Spark) falls back to a patient same-key policy so a
  * burst 429 waits and replays instead of surfacing to the client and aborting a long
  * session; key-auth Command Code at its canonical endpoints gets the same fallback (#5180), and
- * every other provider without the knob keeps today's fail-fast behavior.
+ * canonical Mistral Chat uses a slower fallback; other destinations stay fail-fast.
  * OAuth/forward/local credentials are never replayed on the same token. The returned
  * policy is fully defaulted so callers never re-check fields.
  */
@@ -609,8 +610,15 @@ export function rateLimitRetryPolicyFor(
       respectRetryAfter: policy.respectRetryAfter ?? DEFAULT_RATE_LIMIT_RETRY.respectRetryAfter,
     };
   }
-  // No explicit knob: patient fallback for OpenCode Go and canonical Command Code only.
+  // No explicit knob: destination-specific fallbacks, never OAuth or local credentials.
   if (provider.authMode !== undefined && provider.authMode !== "key") return null;
+  // Mistral's token-throughput and temporary capacity refusals both use HTTP 429.
+  // Keep relays and other wire adapters opt-in, and reuse the existing send budget.
+  if (typeof provider.baseUrl === "string" && typeof provider.adapter === "string" && isCanonicalMistralChat({
+    adapter: provider.adapter, authMode: provider.authMode, baseUrl: provider.baseUrl,
+  })) {
+    return { ...DEFAULT_RATE_LIMIT_RETRY, attempts: 6, intervalMs: 10_000 };
+  }
   if (isOpenCodeGoDestination(provider)) return { ...OPENCODE_GO_RATE_LIMIT_RETRY };
   // Command Code's Provider API rate-limits long muse-spark turns the same way (#5180): a single
   // key cannot fail over, and the Codex client does not retry a 429, so the turn aborts. The key

package/src/providers/key-store.ts

@@ -32,14 +32,19 @@ export type {
   ProviderKeyStoreKind,
 } from "./api-key-resolve";
 
-/** Shared with routing: a key-mode override is effective only while its key resolves. */
+/**
+ * Shared with routing: a key-mode override is operator intent, not a credential probe.
+ * The configured authMode alone decides the lane; a key that cannot be resolved right now
+ * (paused last key, missing env var, disabled pool) fails closed at the transport and must
+ * never implicitly reclassify the provider to the registry's OAuth lane, where a stored
+ * OAuth account would be billed instead of the operator's key.
+ */
 export function providerUsesKeyAuthOverride(
   entry: Pick<ProviderRegistryEntry, "authKind" | "allowKeyAuthOverride">,
   provider: Pick<OcxProviderConfig, "authMode">,
-  resolvedKey: string | undefined,
 ): boolean {
   return entry.authKind === "oauth" && entry.allowKeyAuthOverride === true
-    && provider.authMode === "key" && typeof resolvedKey === "string" && resolvedKey.trim().length > 0;
+    && provider.authMode === "key";
 }
 
 /**

package/src/providers/mistral-transport.ts

@@ -0,0 +1,207 @@
+import { createHash } from "node:crypto";
+import type { OcxProviderConfig } from "../types";
+import { isEgressTransparentExecutor, markEgressTransparentExecutor } from "../lib/provider-egress";
+import { configuredOutboundFetch } from "../lib/proxy-env";
+import { waitOutsideProviderHeaderDeadline } from "../lib/provider-admission-wait";
+import { markSameTargetRetryHold, sleepWithAbort } from "../lib/upstream-retry";
+import { RequestPacingQueueOverloadError } from "./request-pacing";
+import type { OcxProviderTransport } from "./xai-transport";
+
+const MAX_IDENTITIES = 128;
+const DEFAULT_MAX_WAIT_MS = 60_000; // Existing retry wait budget, not an inferred rate window.
+const MINUTE_MS = 60 * 1000; // Unit named by the observed headers, never an account quota.
+type RecoveryState = { generation: number; probe?: { done: Promise<void>; finish(): void } };
+
+/** Match the supported key-auth Chat destination, including one optional trailing slash. */
+export function isCanonicalMistralChat(
+  provider: Pick<OcxProviderConfig, "adapter" | "authMode" | "baseUrl">,
+): boolean {
+  if (provider.adapter !== "openai-chat" || (provider.authMode !== undefined && provider.authMode !== "key")) return false;
+  try {
+    const url = new URL(provider.baseUrl);
+    return url.origin === "https://api.mistral.ai" && /^\/v1\/?$/.test(url.pathname)
+      && !url.username && !url.password && !url.search && !url.hash;
+  } catch { return false; }
+}
+
+/** Read a nonnegative integer counter; reject missing or malformed values. */
+function count(headers: Headers, name: string): number | undefined {
+  const raw = headers.get(name)?.trim();
+  if (!raw || !/^\d+$/.test(raw)) return undefined;
+  const value = Number(raw);
+  return Number.isSafeInteger(value) ? value : undefined;
+}
+
+/** Read the server delay as seconds or an HTTP date; ignore invalid hints. */
+function retryDelay(headers: Headers, now: number): number | undefined {
+  const raw = headers.get("retry-after")?.trim();
+  if (!raw) return undefined;
+  const value = /^\d+(?:\.\d+)?$/.test(raw) ? Number(raw) * 1000 : Date.parse(raw) - now;
+  return Number.isFinite(value) ? Math.max(0, value) : undefined;
+}
+
+/** Classify measured refusal evidence only; never predict a future cache hit or token charge. */
+export function mistralMinuteRefusal(headers: Headers): "temporary" | "charge-above-allowance" | "unknown" {
+  const month = count(headers, "x-ratelimit-limit-tokens-month");
+  if (month !== undefined && count(headers, "x-ratelimit-remaining-tokens-month") === 0) return "unknown";
+  const limit = count(headers, "x-ratelimit-limit-tokens-minute");
+  const remaining = count(headers, "x-ratelimit-remaining-tokens-minute");
+  const cost = count(headers, "x-ratelimit-tokens-query-cost");
+  if (limit !== undefined && limit > 0 && cost !== undefined && cost > limit) return "charge-above-allowance";
+  if (limit !== undefined && limit > 0 && remaining !== undefined && remaining <= limit
+    && (remaining === 0 || (cost !== undefined && cost > remaining))) return "temporary";
+  const requests = count(headers, "x-ratelimit-limit-req-minute");
+  if (requests !== undefined && requests > 0 && count(headers, "x-ratelimit-remaining-req-minute") === 0) return "temporary";
+  return "unknown";
+}
+
+/** Process-local observations, never a fixed account/plan quota or a persisted credential. */
+export class MistralBudgetPacer {
+  private readonly deadlines = new Map<string, number>();
+  private readonly recoveries = new Map<string, RecoveryState>();
+  /** Latest live deadline evicted at capacity; unknown identities wait it out instead of sending early. */
+  private evictedUntil = 0;
+  private waiting = 0;
+
+  constructor(
+    private readonly now: () => number = Date.now,
+    private readonly sleep: (ms: number, signal?: AbortSignal) => Promise<void> = sleepWithAbort,
+  ) {}
+
+  /** Record server delays and confirmed minute pressure for this credential and model. */
+  observe(identity: string, headers: Headers, status = 200): void {
+    const tokens = count(headers, "x-ratelimit-remaining-tokens-minute");
+    const requests = count(headers, "x-ratelimit-remaining-req-minute");
+    // Healthy remaining counters never predict the next request's cache/charge.
+    if (status !== 429 && tokens !== 0 && requests !== 0) return;
+    // With no explicit time, activate a conservative minute hold only AFTER a
+    // refusal establishes pressure. Healthy responses never predict the next cost.
+    const delay = retryDelay(headers, this.now())
+      ?? (status === 429 && mistralMinuteRefusal(headers) === "temporary" ? MINUTE_MS : undefined);
+    if (delay === undefined || delay === 0) return;
+    for (const [key, deadline] of this.deadlines) {
+      if (deadline <= this.now()) this.deadlines.delete(key);
+    }
+    if (!this.deadlines.has(identity) && this.deadlines.size >= MAX_IDENTITIES) {
+      const [evicted, until] = this.deadlines.entries().next().value!;
+      this.evictedUntil = Math.max(this.evictedUntil, until);
+      this.deadlines.delete(evicted);
+    }
+    this.deadlines.set(identity, Math.max(this.deadlines.get(identity) ?? 0, this.now() + delay));
+    if (status === 429) {
+      if (!this.recoveries.has(identity) && this.recoveries.size >= MAX_IDENTITIES) {
+        const idle = [...this.recoveries].find(([, state]) => !state.probe);
+        if (!idle) return;
+        this.recoveries.delete(idle[0]);
+      }
+      const state = this.recoveries.get(identity) ?? { generation: 0 };
+      state.generation++;
+      this.recoveries.set(identity, state);
+    }
+  }
+
+  /** Wait within the admission budget and return a release callback for one recovery probe. */
+  async acquire(identity: string, signal?: AbortSignal, maxWaitMs = DEFAULT_MAX_WAIT_MS): Promise<(success?: boolean) => void> {
+    signal?.throwIfAborted();
+    if (this.waiting >= MAX_IDENTITIES) throw new RequestPacingQueueOverloadError("mistral", "queue_full", 60);
+    this.waiting++;
+    const deadline = this.now() + maxWaitMs;
+    try {
+      for (;;) {
+        signal?.throwIfAborted();
+        // An evicted identity may have re-entered with a shorter delay; the evicted one still binds.
+        const live = this.evictedUntil > this.now() ? this.evictedUntil : undefined;
+        const own = this.deadlines.get(identity);
+        const readyAt = own === undefined ? live : live === undefined ? own : Math.max(own, live);
+        if (readyAt !== undefined && readyAt > deadline) {
+          const delay = readyAt - this.now();
+          throw new RequestPacingQueueOverloadError("mistral", "queue_expired", Math.ceil(delay / 1000));
+        }
+        if (readyAt !== undefined && readyAt > this.now()) {
+          await this.sleep(readyAt - this.now(), signal);
+          continue;
+        }
+        const state = this.recoveries.get(identity);
+        if (!state) { this.deadlines.delete(identity); return () => {}; }
+        if (state.probe) {
+          const remaining = deadline - this.now();
+          if (remaining <= 0) throw new RequestPacingQueueOverloadError("mistral", "queue_expired", 1);
+          const local = new AbortController();
+          try {
+            await Promise.race([state.probe.done, this.sleep(remaining, AbortSignal.any([local.signal, ...(signal ? [signal] : [])]))]);
+          } finally { local.abort(); }
+          continue;
+        }
+        let finish!: () => void;
+        const probe = { done: new Promise<void>(resolve => { finish = resolve; }), finish: () => finish() };
+        state.probe = probe;
+        const generation = state.generation;
+        let released = false;
+        return success => {
+          if (released) return;
+          released = true;
+          if (state.probe === probe) delete state.probe;
+          // Only this probe can settle recovery; an older concurrent success must
+          // not erase a more recent refusal or the server's minimum wait.
+          if (success && state.generation === generation) {
+            if (this.recoveries.get(identity) === state) this.recoveries.delete(identity);
+            if ((this.deadlines.get(identity) ?? 0) <= this.now()) this.deadlines.delete(identity);
+          }
+          probe.finish();
+        };
+      }
+    } finally { this.waiting--; }
+  }
+}
+
+const pacer = new MistralBudgetPacer();
+const wrapped = new WeakSet<typeof globalThis.fetch>();
+
+/** Wrap canonical Mistral Chat sends with bounded admission and server-delay protection. */
+export function resolveMistralTransport(
+  provider: OcxProviderTransport,
+  budgetPacer = pacer,
+): OcxProviderTransport {
+  if (!isCanonicalMistralChat(provider) || (provider.fetch && wrapped.has(provider.fetch))) return provider;
+  const baseFetch = provider.fetch
+    ?? markEgressTransparentExecutor(((input, init) => configuredOutboundFetch(input, init)) as typeof globalThis.fetch);
+  const attemptFetch = (async (input, init) => {
+    const url = new URL(input instanceof Request ? input.url : String(input));
+    if (url.origin !== "https://api.mistral.ai" || url.pathname !== "/v1/chat/completions"
+      || url.search || url.hash || init?.method?.toUpperCase() !== "POST" || typeof init.body !== "string") {
+      return baseFetch(input, init);
+    }
+    // The Chat adapter serializes model first. Read only that bounded prefix rather
+    // than parsing/copying a potentially million-token conversation a second time.
+    const encodedModel = /^\s*\{\s*"model"\s*:\s*("(?:[^"\\]|\\.)*")\s*[,}]/.exec(init.body.slice(0, 4096))?.[1];
+    let model: unknown;
+    try { model = encodedModel === undefined ? undefined : JSON.parse(encodedModel); } catch { return baseFetch(input, init); }
+    const authorization = new Headers(init.headers).get("authorization");
+    if (!authorization || typeof model !== "string" || !model || model.length > 256) return baseFetch(input, init);
+    // Bind to the actual send credential, including after pool rotation; keep no raw key.
+    const identity = createHash("sha256").update(JSON.stringify([authorization, model])).digest("hex");
+    const pacing = provider.requestPacing?.enabled !== false && provider.retryOn429?.respectRetryAfter !== false;
+    const release = pacing ? await waitOutsideProviderHeaderDeadline(init,
+      signal => budgetPacer.acquire(identity, signal, provider.retryOn429?.maxIntervalMs)) : undefined;
+    let response: Response;
+    try {
+      init.signal?.throwIfAborted();
+      response = await baseFetch(input, init);
+      if (pacing) budgetPacer.observe(identity, response.headers, response.status);
+    } catch (error) { release?.(); throw error; }
+    release?.(response.ok);
+    const retry = provider.retryOn429;
+    if (response.status === 429 && retry?.respectRetryAfter !== false) {
+      const delay = retryDelay(response.headers, Date.now());
+      if (delay !== undefined && delay > (retry?.maxIntervalMs ?? DEFAULT_MAX_WAIT_MS)) {
+        // The shared retry helper caps waits. Stop same-key replays sooner than Mistral permits;
+        // another credential may still serve, and the original status/body/Retry-After reach the caller.
+        markSameTargetRetryHold(response);
+      }
+    }
+    return response;
+  }) as typeof globalThis.fetch;
+  if (isEgressTransparentExecutor(baseFetch)) markEgressTransparentExecutor(attemptFetch);
+  wrapped.add(attemptFetch);
+  return { ...provider, fetch: attemptFetch };
+}

package/src/providers/openai-sidecar.ts

@@ -12,6 +12,7 @@ import {
   type CodexAuthPolicyConfig,
 } from "../codex/auth-context";
 import { recordCodexUpstreamOutcome, type CodexUpstreamOutcome } from "../codex/routing";
+import { codexFailureWindowOutcomeMeta } from "../codex/routing/failure-window";
 import { inspectChatGptDomainClaim } from "../oauth/chatgpt";
 import { ForwardAdmissionCredentialError, validateForwardAdmissionCredential, type DataPlaneAdmission } from "../server/auth-cors";
 import type { CodexAccountMode, OcxConfig, OcxProviderConfig } from "../types";
@@ -205,6 +206,7 @@ export async function resolveFirstUsableOpenAiSidecar(
         releaseCodexAuthContextProbeLease(authContext);
         throw new CodexPoolAuthenticationError("Selected Codex account is unavailable");
       }
+      const windowMeta = codexFailureWindowOutcomeMeta(authContext);
       return {
         ...candidate,
         authContext,
@@ -220,6 +222,7 @@ export async function resolveFirstUsableOpenAiSidecar(
             probeLeaseId: authContext.probeLeaseId,
             probeQuotaScope: authContext.probeQuotaScope,
             writerGeneration: authContext.writerGeneration,
+            ...windowMeta,
             // 401/403 here is evidence about this exact stored credential; without the generation a
             // replacement inherits the quarantine (#2892 gap 4).
             ...(authContext.kind === "pool" ? { credentialGeneration: authContext.generation } : {}),
@@ -256,6 +259,7 @@ export async function resolveFirstUsableOpenAiSidecar(
       releaseCodexAuthContextProbeLease(authContext);
       continue;
     }
+    const windowMeta = codexFailureWindowOutcomeMeta(authContext);
     return {
       ...candidate,
       authContext,
@@ -271,6 +275,7 @@ export async function resolveFirstUsableOpenAiSidecar(
               threadId: authContext.affinityKey,
               probeLeaseId: authContext.probeLeaseId,
               writerGeneration: authContext.writerGeneration,
+              ...windowMeta,
               // Same fence as the exact-account recorder above (#2892 gap 4).
               ...(authContext.kind === "pool" ? { credentialGeneration: authContext.generation } : {}),
             },

package/src/providers/quota/anthropic-account-quota.ts

@@ -4,7 +4,9 @@ import { getAccountSet } from "../../oauth/store";
 import { captureConfigGeneration, sweepExpiredOnWrite } from "../../lib/state-store-sweeper";
 import { configuredAnthropicInstance, type AnthropicInstanceId } from "../anthropic-instance";
 import { ACCOUNT_QUOTA_TTL_MS } from "../quota-wire";
-import { fetchAnthropicUsageQuotaForInstance } from "./vendor-probes-oauth";
+import { fetchAnthropicUsageProbeForInstance } from "./vendor-probes-oauth";
+import { thrownQuotaFailure } from "./failure-codes";
+import type { QuotaFailureCode } from "../quota-types";
 import { AnthropicQuotaProbeOwnershipError, anthropicCooldownRecoveryFor, type AnthropicQuotaRecoveryResult } from "./anthropic-cooldown-recovery";
 import {
   accountCacheKey, accountQuotaCache, accountQuotaInflight, captureProviderAccountQuotaEpoch,
@@ -49,7 +51,10 @@ export async function fetchAnthropicAccountQuota(
   }
   let token: string;
   try { token = await getTokenForAccountQuotaProbe(instance, accountId); }
-  catch { return unavailable(); }
+  catch {
+    // Missing, signed-out or unrefreshable credential: a reauthentication matter, never a quota fact.
+    return { ...unavailable(), quotaFailure: "account_unavailable", quotaFailureIsCurrent: ownerCurrent };
+  }
   if (!ownerCurrent()) return unavailable();
   const flightKey = recovery.anthropicCredentialQuotaFlightKey(key, accountId);
   const flightCurrent = () => ownerCurrent()
@@ -65,30 +70,37 @@ export async function fetchAnthropicAccountQuota(
   // in-flight observations, as the pre-instance A path did, so joined callers and later cached
   // reads agree and windows that expired during the shared probe are normalized away.
   /** Cache the settled probe result for an account and publish its decision evidence only while the flight is still current for its credential and generation. */
-  const publish = (result: AnthropicQuotaRecoveryResult | null): AccountQuotaCacheEntry => {
+  const publish = (result: AnthropicQuotaRecoveryResult | null, failure?: QuotaFailureCode): AccountQuotaCacheEntry => {
     const previous = accountQuotaCache.get(key);
     const retained = previous?.isCurrent?.() === false ? undefined : previous;
     const isCurrent = result?.isCurrent ?? flightCurrent;
     const entry: AccountQuotaCacheEntry = {
       ts: Date.now(), quota: normalizeAnthropicQuota(result?.quota ?? retained?.quota, Date.now()),
       ...(!result ? { unavailable: true as const } : {}), isCurrent,
+      ...(!result && failure ? { quotaFailure: failure, quotaFailureIsCurrent: isCurrent } : {}),
     };
     if (isCurrent() && mayCommitAccountQuotaKey(key, writerGeneration)) { accountQuotaCache.set(key, entry); result?.publishDecisionQuota(); sweepExpiredOnWrite(entry.ts); }
     return entry;
   };
   const probe = (async (): Promise<AccountQuotaCacheEntry> => {
+    // The closed reason of the last usage read in this flight: an HTTP status class, an unusable
+    // body, or a thrown dispatch. Ownership and cooldown refusals never set it.
+    let failure: QuotaFailureCode | undefined;
     try {
       const result = await recovery.probeAnthropicQuotaWithRecovery(accountId, token, fresh => {
         if (!flightCurrent()) throw new AnthropicQuotaProbeOwnershipError("quota flight changed");
         recovery.assertAnthropicQuotaSendAllowed(accountId, token);
-        return fetchAnthropicUsageQuotaForInstance(instance, token, fresh || freshDispatch);
+        return fetchAnthropicUsageProbeForInstance(instance, token, fresh || freshDispatch).then(
+          read => { failure = read.failure; return read.quota; },
+          error => { failure = thrownQuotaFailure(error); throw error; },
+        );
       }, () => ownerCurrent() && mayCommitAccountQuotaKey(key, writerGeneration));
       if (result && !result.isCurrent()) return unavailable();
       if (!result && !flightCurrent()) return unavailable();
-      return publish(result);
+      return publish(result, failure);
     } catch (error) {
       if (error instanceof AnthropicQuotaProbeOwnershipError || !flightCurrent()) return unavailable();
-      return publish(null);
+      return publish(null, failure);
     }
   })().finally(() => { if (accountQuotaInflight.get(flightKey) === probe) accountQuotaInflight.delete(flightKey); });
   accountQuotaInflight.set(flightKey, probe);

package/src/providers/quota/antigravity.ts

@@ -306,13 +306,16 @@ function antigravityUnavailableFailure(
   return fallbackFailure;
 }
 
-export async function probeAntigravityUsageQuota(accessToken: string, projectId: string): Promise<AntigravityQuotaProbeResult> {
+export async function probeAntigravityUsageQuota(accessToken: string, projectId: string, signal?: AbortSignal): Promise<AntigravityQuotaProbeResult> {
+  // An optional caller signal (account import) cancels every request of this probe, including the
+  // 403 retry and the models fallback, alongside the per-request deadline.
+  const requestSignal = () => signal ? AbortSignal.any([signal, AbortSignal.timeout(REQUEST_TIMEOUT_MS)]) : AbortSignal.timeout(REQUEST_TIMEOUT_MS);
   const fetchQuota = (url: string, userAgent = antigravityUserAgent()) => providerOutboundPost("google-antigravity", { baseUrl: ANTIGRAVITY_ACCOUNT_QUOTA_BASE }, url, {
     headers: {
       Accept: "application/json", "Content-Type": "application/json",
       "User-Agent": userAgent, Authorization: `Bearer ${accessToken}`,
     },
-    body: JSON.stringify({ project: projectId }), signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+    body: JSON.stringify({ project: projectId }), signal: requestSignal(),
   }, antigravityOutboundDependencies);
   let summaryFailure: QuotaFailureCode | undefined;
   try {
@@ -332,6 +335,7 @@ export async function probeAntigravityUsageQuota(accessToken: string, projectId:
     // Existing behavior: summary transport/parse failure may recover through the models probe.
     summaryFailure = quotaTransportFailure(error);
   }
+  if (signal?.aborted) return unavailableAntigravityQuota(summaryFailure ?? "transport_error");
   try {
     const response = await fetchQuota(ANTIGRAVITY_QUOTA_MODELS_URL);
     if (await providerRedirectError(response, ANTIGRAVITY_QUOTA_MODELS_URL)) {

package/src/providers/quota/failure-codes.ts

@@ -0,0 +1,18 @@
+import type { QuotaFailureCode } from "../quota-types";
+
+/**
+ * Closed quota-probe diagnoses derived from an HTTP status class or a thrown dispatch. They carry
+ * no upstream text, URL, header or credential: only one of `QUOTA_FAILURE_CODES`.
+ */
+export function httpQuotaFailure(status: number): QuotaFailureCode {
+  if (status >= 300 && status < 400) return "redirect_blocked";
+  if (status === 401 || status === 403) return "access_denied";
+  if (status === 429) return "rate_limited";
+  return "upstream_error";
+}
+
+/** A thrown fetch: the request deadline is a timeout, anything else a transport failure. */
+export function thrownQuotaFailure(error: unknown): QuotaFailureCode {
+  const name = error && typeof error === "object" ? (error as { name?: unknown }).name : undefined;
+  return name === "TimeoutError" ? "timeout" : "transport_error";
+}

package/src/providers/quota/vendor-probes-oauth.ts

@@ -8,7 +8,7 @@ import { captureOAuthAccountSelection, credentialGeneration, getAccountCredentia
 import { hydrateKiroAccountState, persistKiroAccountState } from "../kiro-account-state-disk";
 import { kiroProbeCurrent, kiroProbeIdentity } from "./kiro-account-probe";
 import { fetchMuseKeyQuotaSnapshot } from "../muse-key-quota";
-import { readAnthropicUsageQuota } from "../claude-cli-usage";
+import { probeAnthropicUsageQuota, type AnthropicUsageProbe } from "../claude-cli-usage";
 import { XAI_GROK_CLIENT_VERSION, XAI_GROK_COMPATIBILITY } from "../xai-transport";
 import {
   commitKiroAccountUsageState,
@@ -227,7 +227,7 @@ export async function fetchXaiQuota(provider: string, context: { accessToken: st
   }
 }
 
-const anthropicUsageInflight = new Map<string, Promise<ProviderQuota | null>>();
+const anthropicUsageInflight = new Map<string, Promise<AnthropicUsageProbe>>();
 
 /**
  * Anthropic per-credential usage.
@@ -256,6 +256,15 @@ export async function fetchAnthropicUsageQuotaForInstance(
   accessToken: string,
   requireFreshDispatch = false,
 ): Promise<ProviderQuota | null> {
+  return (await fetchAnthropicUsageProbeForInstance(instance, accessToken, requireFreshDispatch)).quota;
+}
+
+/** The same shared flight as `fetchAnthropicUsageQuotaForInstance`, keeping the closed failure reason. */
+export async function fetchAnthropicUsageProbeForInstance(
+  instance: AnthropicInstanceId,
+  accessToken: string,
+  requireFreshDispatch = false,
+): Promise<AnthropicUsageProbe> {
   // Recovery evidence must be requested after the claimed cooldown. Joining an older request
   // can return after the 429 while still describing provider state from before that refusal.
   const credentialIdentity = getAccountSet(instance)?.accounts.filter(row => row.credential.access === accessToken)
@@ -264,7 +273,7 @@ export async function fetchAnthropicUsageQuotaForInstance(
   const joinable = requireFreshDispatch ? undefined : anthropicUsageInflight.get(key);
   if (joinable) return joinable;
 
-  const probe = readAnthropicUsageQuota(accessToken).finally(() => {
+  const probe = probeAnthropicUsageQuota(accessToken).finally(() => {
     if (anthropicUsageInflight.get(key) === probe) anthropicUsageInflight.delete(key);
   });
   anthropicUsageInflight.set(key, probe);

package/src/providers/quota-routing-cache.ts

@@ -29,7 +29,7 @@ export function providerQuotaRoutingBinding(
   // A key probe must not constrain that later account selection.
   const entry = getProviderRegistryEntry(name);
   if (entry && (entry.authKind === "oauth" || entry.authKind === "forward")
-    && !providerUsesKeyAuthOverride(entry, provider, credential)) return null;
+    && !providerUsesKeyAuthOverride(entry, provider)) return null;
   // Static auth headers can replace or combine with the probed API-key header.
   // Its semantics belong to the adapter, so it is not provider-wide quota evidence.
   if (Object.keys(provider.headers ?? {}).some(header =>