@bitkyc08/opencodex 2.89.0 → 2.91.0

package/src/providers/key-failover.ts

@@ -12,6 +12,7 @@ import { isKeyInCooldown, getKeyCooldownUntil, setKeyCooldown } from "./api-key-
 export { clearKeyCooldowns, getKeyCooldownUntil, sweepExpiredApiKeyCooldowns } from "./api-key-cooldowns";
 import { commitProviderApiKeySelection, providerApiKeySelectionIsCurrent } from "./api-key-selection";
 import { RequestPacingQueueOverloadError } from "./request-pacing";
+import { isCanonicalMistralChat } from "./mistral-transport";
 import type { ProviderApiKeySelection } from "../types/provider";
 import { routedProviderConfig } from "./routed-config";
 import { getProviderRegistryEntry } from "./registry";
@@ -585,7 +586,7 @@ function allocateDistributedKey(providerName: string, provider: OcxProviderConfi
  * (subscription traffic such as Muse Spark) falls back to a patient same-key policy so a
  * burst 429 waits and replays instead of surfacing to the client and aborting a long
  * session; key-auth Command Code at its canonical endpoints gets the same fallback (#5180), and
- * every other provider without the knob keeps today's fail-fast behavior.
+ * canonical Mistral Chat uses a slower fallback; other destinations stay fail-fast.
  * OAuth/forward/local credentials are never replayed on the same token. The returned
  * policy is fully defaulted so callers never re-check fields.
  */
@@ -609,8 +610,15 @@ export function rateLimitRetryPolicyFor(
       respectRetryAfter: policy.respectRetryAfter ?? DEFAULT_RATE_LIMIT_RETRY.respectRetryAfter,
     };
   }
-  // No explicit knob: patient fallback for OpenCode Go and canonical Command Code only.
+  // No explicit knob: destination-specific fallbacks, never OAuth or local credentials.
   if (provider.authMode !== undefined && provider.authMode !== "key") return null;
+  // Mistral's token-throughput and temporary capacity refusals both use HTTP 429.
+  // Keep relays and other wire adapters opt-in, and reuse the existing send budget.
+  if (typeof provider.baseUrl === "string" && typeof provider.adapter === "string" && isCanonicalMistralChat({
+    adapter: provider.adapter, authMode: provider.authMode, baseUrl: provider.baseUrl,
+  })) {
+    return { ...DEFAULT_RATE_LIMIT_RETRY, attempts: 6, intervalMs: 10_000 };
+  }
   if (isOpenCodeGoDestination(provider)) return { ...OPENCODE_GO_RATE_LIMIT_RETRY };
   // Command Code's Provider API rate-limits long muse-spark turns the same way (#5180): a single
   // key cannot fail over, and the Codex client does not retry a 429, so the turn aborts. The key

package/src/providers/key-store.ts

@@ -32,14 +32,19 @@ export type {
   ProviderKeyStoreKind,
 } from "./api-key-resolve";
 
-/** Shared with routing: a key-mode override is effective only while its key resolves. */
+/**
+ * Shared with routing: a key-mode override is operator intent, not a credential probe.
+ * The configured authMode alone decides the lane; a key that cannot be resolved right now
+ * (paused last key, missing env var, disabled pool) fails closed at the transport and must
+ * never implicitly reclassify the provider to the registry's OAuth lane, where a stored
+ * OAuth account would be billed instead of the operator's key.
+ */
 export function providerUsesKeyAuthOverride(
   entry: Pick<ProviderRegistryEntry, "authKind" | "allowKeyAuthOverride">,
   provider: Pick<OcxProviderConfig, "authMode">,
-  resolvedKey: string | undefined,
 ): boolean {
   return entry.authKind === "oauth" && entry.allowKeyAuthOverride === true
-    && provider.authMode === "key" && typeof resolvedKey === "string" && resolvedKey.trim().length > 0;
+    && provider.authMode === "key";
 }
 
 /**

package/src/providers/mistral-transport.ts

@@ -0,0 +1,240 @@
+import { createHash } from "node:crypto";
+import type { OcxProviderConfig } from "../types";
+import { isEgressTransparentExecutor, markEgressTransparentExecutor } from "../lib/provider-egress";
+import { configuredOutboundFetch } from "../lib/proxy-env";
+import { waitOutsideProviderHeaderDeadline } from "../lib/provider-admission-wait";
+import { markSameTargetRetryHold, sleepWithAbort } from "../lib/upstream-retry";
+import { RequestPacingQueueOverloadError } from "./request-pacing";
+import type { OcxProviderTransport } from "./xai-transport";
+
+const MAX_IDENTITIES = 128;
+/** Queued waiters per credential+model identity; one hot identity never refuses another. */
+const MAX_WAITERS_PER_IDENTITY = 128;
+/**
+ * Process-wide waiter bound. Model strings come from clients, so identities are not bounded by
+ * configuration; this keeps memory and pending requests finite. It is a multiple of the
+ * per-identity cap, so no single identity can fill it alone.
+ */
+const MAX_WAITERS_TOTAL = 4 * MAX_WAITERS_PER_IDENTITY;
+const DEFAULT_MAX_WAIT_MS = 60_000; // Existing retry wait budget, not an inferred rate window.
+const MINUTE_MS = 60 * 1000; // Unit named by the observed headers, never an account quota.
+type RecoveryState = { generation: number; probe?: { done: Promise<void>; finish(): void } };
+
+/** Match the supported key-auth Chat destination, including one optional trailing slash. */
+export function isCanonicalMistralChat(
+  provider: Pick<OcxProviderConfig, "adapter" | "authMode" | "baseUrl">,
+): boolean {
+  if (provider.adapter !== "openai-chat" || (provider.authMode !== undefined && provider.authMode !== "key")) return false;
+  try {
+    const url = new URL(provider.baseUrl);
+    return url.origin === "https://api.mistral.ai" && /^\/v1\/?$/.test(url.pathname)
+      && !url.username && !url.password && !url.search && !url.hash;
+  } catch { return false; }
+}
+
+/** Read a nonnegative integer counter; reject missing or malformed values. */
+function count(headers: Headers, name: string): number | undefined {
+  const raw = headers.get(name)?.trim();
+  if (!raw || !/^\d+$/.test(raw)) return undefined;
+  const value = Number(raw);
+  return Number.isSafeInteger(value) ? value : undefined;
+}
+
+/** Read the server delay as seconds or an HTTP date; ignore invalid hints. */
+function retryDelay(headers: Headers, now: number): number | undefined {
+  const raw = headers.get("retry-after")?.trim();
+  if (!raw) return undefined;
+  const value = /^\d+(?:\.\d+)?$/.test(raw) ? Number(raw) * 1000 : Date.parse(raw) - now;
+  return Number.isFinite(value) ? Math.max(0, value) : undefined;
+}
+
+/** Classify measured refusal evidence only; never predict a future cache hit or token charge. */
+export function mistralMinuteRefusal(headers: Headers): "temporary" | "charge-above-allowance" | "unknown" {
+  const month = count(headers, "x-ratelimit-limit-tokens-month");
+  if (month !== undefined && count(headers, "x-ratelimit-remaining-tokens-month") === 0) return "unknown";
+  const limit = count(headers, "x-ratelimit-limit-tokens-minute");
+  const remaining = count(headers, "x-ratelimit-remaining-tokens-minute");
+  const cost = count(headers, "x-ratelimit-tokens-query-cost");
+  if (limit !== undefined && limit > 0 && cost !== undefined && cost > limit) return "charge-above-allowance";
+  if (limit !== undefined && limit > 0 && remaining !== undefined && remaining <= limit
+    && (remaining === 0 || (cost !== undefined && cost > remaining))) return "temporary";
+  const requests = count(headers, "x-ratelimit-limit-req-minute");
+  if (requests !== undefined && requests > 0 && count(headers, "x-ratelimit-remaining-req-minute") === 0) return "temporary";
+  return "unknown";
+}
+
+/** Process-local observations, never a fixed account/plan quota or a persisted credential. */
+export class MistralBudgetPacer {
+  private readonly deadlines = new Map<string, number>();
+  private readonly recoveries = new Map<string, RecoveryState>();
+  /** Latest live deadline evicted at capacity; unknown identities wait it out instead of sending early. */
+  private evictedUntil = 0;
+  /**
+   * Parked waiters keyed by identity. A request counts only once it is about to wait, so a held
+   * credential or model fills only its own queue and a request that can send now is never answered
+   * queue_full (HTTP 429). The map holds identities with live waiters only; the total is capped by
+   * MAX_WAITERS_TOTAL.
+   */
+  private readonly waiting = new Map<string, number>();
+  private waitingTotal = 0;
+
+  constructor(
+    private readonly now: () => number = Date.now,
+    private readonly sleep: (ms: number, signal?: AbortSignal) => Promise<void> = sleepWithAbort,
+  ) {}
+
+  /** Record server delays and confirmed minute pressure for this credential and model. */
+  observe(identity: string, headers: Headers, status = 200): void {
+    const tokens = count(headers, "x-ratelimit-remaining-tokens-minute");
+    const requests = count(headers, "x-ratelimit-remaining-req-minute");
+    // Healthy remaining counters never predict the next request's cache/charge.
+    if (status !== 429 && tokens !== 0 && requests !== 0) return;
+    // With no explicit time, activate a conservative minute hold only AFTER a
+    // refusal establishes pressure. Healthy responses never predict the next cost.
+    const delay = retryDelay(headers, this.now())
+      ?? (status === 429 && mistralMinuteRefusal(headers) === "temporary" ? MINUTE_MS : undefined);
+    if (delay === undefined || delay === 0) return;
+    for (const [key, deadline] of this.deadlines) {
+      if (deadline <= this.now()) this.deadlines.delete(key);
+    }
+    if (!this.deadlines.has(identity) && this.deadlines.size >= MAX_IDENTITIES) {
+      const [evicted, until] = this.deadlines.entries().next().value!;
+      this.evictedUntil = Math.max(this.evictedUntil, until);
+      this.deadlines.delete(evicted);
+    }
+    this.deadlines.set(identity, Math.max(this.deadlines.get(identity) ?? 0, this.now() + delay));
+    if (status === 429) {
+      if (!this.recoveries.has(identity) && this.recoveries.size >= MAX_IDENTITIES) {
+        const idle = [...this.recoveries].find(([, state]) => !state.probe);
+        if (!idle) return;
+        this.recoveries.delete(idle[0]);
+      }
+      const state = this.recoveries.get(identity) ?? { generation: 0 };
+      state.generation++;
+      this.recoveries.set(identity, state);
+    }
+  }
+
+  /** Wait within the admission budget and return a release callback for one recovery probe. */
+  async acquire(identity: string, signal?: AbortSignal, maxWaitMs = DEFAULT_MAX_WAIT_MS): Promise<(success?: boolean) => void> {
+    signal?.throwIfAborted();
+    const deadline = this.now() + maxWaitMs;
+    let parked = false;
+    const park = (): void => {
+      if (parked) return;
+      const queued = this.waiting.get(identity) ?? 0;
+      if (queued >= MAX_WAITERS_PER_IDENTITY || this.waitingTotal >= MAX_WAITERS_TOTAL) {
+        throw new RequestPacingQueueOverloadError("mistral", "queue_full", 60);
+      }
+      this.waiting.set(identity, queued + 1);
+      this.waitingTotal++;
+      parked = true;
+    };
+    try {
+      for (;;) {
+        signal?.throwIfAborted();
+        // An evicted identity may have re-entered with a shorter delay; the evicted one still binds.
+        const live = this.evictedUntil > this.now() ? this.evictedUntil : undefined;
+        const own = this.deadlines.get(identity);
+        const readyAt = own === undefined ? live : live === undefined ? own : Math.max(own, live);
+        if (readyAt !== undefined && readyAt > deadline) {
+          const delay = readyAt - this.now();
+          throw new RequestPacingQueueOverloadError("mistral", "queue_expired", Math.ceil(delay / 1000));
+        }
+        if (readyAt !== undefined && readyAt > this.now()) {
+          park();
+          await this.sleep(readyAt - this.now(), signal);
+          continue;
+        }
+        const state = this.recoveries.get(identity);
+        if (!state) { this.deadlines.delete(identity); return () => {}; }
+        if (state.probe) {
+          const remaining = deadline - this.now();
+          if (remaining <= 0) throw new RequestPacingQueueOverloadError("mistral", "queue_expired", 1);
+          park();
+          const local = new AbortController();
+          try {
+            await Promise.race([state.probe.done, this.sleep(remaining, AbortSignal.any([local.signal, ...(signal ? [signal] : [])]))]);
+          } finally { local.abort(); }
+          continue;
+        }
+        let finish!: () => void;
+        const probe = { done: new Promise<void>(resolve => { finish = resolve; }), finish: () => finish() };
+        state.probe = probe;
+        const generation = state.generation;
+        let released = false;
+        return success => {
+          if (released) return;
+          released = true;
+          if (state.probe === probe) delete state.probe;
+          // Only this probe can settle recovery; an older concurrent success must
+          // not erase a more recent refusal or the server's minimum wait.
+          if (success && state.generation === generation) {
+            if (this.recoveries.get(identity) === state) this.recoveries.delete(identity);
+            if ((this.deadlines.get(identity) ?? 0) <= this.now()) this.deadlines.delete(identity);
+          }
+          probe.finish();
+        };
+      }
+    } finally {
+      if (parked) {
+        this.waitingTotal--;
+        const left = (this.waiting.get(identity) ?? 1) - 1;
+        if (left > 0) this.waiting.set(identity, left);
+        else this.waiting.delete(identity);
+      }
+    }
+  }
+}
+
+const pacer = new MistralBudgetPacer();
+const wrapped = new WeakSet<typeof globalThis.fetch>();
+
+/** Wrap canonical Mistral Chat sends with bounded admission and server-delay protection. */
+export function resolveMistralTransport(
+  provider: OcxProviderTransport,
+  budgetPacer = pacer,
+): OcxProviderTransport {
+  if (!isCanonicalMistralChat(provider) || (provider.fetch && wrapped.has(provider.fetch))) return provider;
+  const baseFetch = provider.fetch
+    ?? markEgressTransparentExecutor(((input, init) => configuredOutboundFetch(input, init)) as typeof globalThis.fetch);
+  const attemptFetch = (async (input, init) => {
+    const url = new URL(input instanceof Request ? input.url : String(input));
+    if (url.origin !== "https://api.mistral.ai" || url.pathname !== "/v1/chat/completions"
+      || url.search || url.hash || init?.method?.toUpperCase() !== "POST" || typeof init.body !== "string") {
+      return baseFetch(input, init);
+    }
+    // The Chat adapter serializes model first. Read only that bounded prefix rather
+    // than parsing/copying a potentially million-token conversation a second time.
+    const encodedModel = /^\s*\{\s*"model"\s*:\s*("(?:[^"\\]|\\.)*")\s*[,}]/.exec(init.body.slice(0, 4096))?.[1];
+    let model: unknown;
+    try { model = encodedModel === undefined ? undefined : JSON.parse(encodedModel); } catch { return baseFetch(input, init); }
+    const authorization = new Headers(init.headers).get("authorization");
+    if (!authorization || typeof model !== "string" || !model || model.length > 256) return baseFetch(input, init);
+    // Bind to the actual send credential, including after pool rotation; keep no raw key.
+    const identity = createHash("sha256").update(JSON.stringify([authorization, model])).digest("hex");
+    const pacing = provider.requestPacing?.enabled !== false && provider.retryOn429?.respectRetryAfter !== false;
+    const release = pacing ? await waitOutsideProviderHeaderDeadline(init,
+      signal => budgetPacer.acquire(identity, signal, provider.retryOn429?.maxIntervalMs)) : undefined;
+    let response: Response;
+    try {
+      init.signal?.throwIfAborted();
+      response = await baseFetch(input, init);
+      if (pacing) budgetPacer.observe(identity, response.headers, response.status);
+    } catch (error) { release?.(); throw error; }
+    release?.(response.ok);
+    const retry = provider.retryOn429;
+    if (response.status === 429 && retry?.respectRetryAfter !== false) {
+      const delay = retryDelay(response.headers, Date.now());
+      if (delay !== undefined && delay > (retry?.maxIntervalMs ?? DEFAULT_MAX_WAIT_MS)) {
+        // The shared retry helper caps waits. Stop same-key replays sooner than Mistral permits;
+        // another credential may still serve, and the original status/body/Retry-After reach the caller.
+        markSameTargetRetryHold(response);
+      }
+    }
+    return response;
+  }) as typeof globalThis.fetch;
+  if (isEgressTransparentExecutor(baseFetch)) markEgressTransparentExecutor(attemptFetch);
+  wrapped.add(attemptFetch);
+  return { ...provider, fetch: attemptFetch };
+}

package/src/providers/openai-sidecar.ts

@@ -12,6 +12,7 @@ import {
   type CodexAuthPolicyConfig,
 } from "../codex/auth-context";
 import { recordCodexUpstreamOutcome, type CodexUpstreamOutcome } from "../codex/routing";
+import { codexFailureWindowOutcomeMeta } from "../codex/routing/failure-window";
 import { inspectChatGptDomainClaim } from "../oauth/chatgpt";
 import { ForwardAdmissionCredentialError, validateForwardAdmissionCredential, type DataPlaneAdmission } from "../server/auth-cors";
 import type { CodexAccountMode, OcxConfig, OcxProviderConfig } from "../types";
@@ -205,6 +206,7 @@ export async function resolveFirstUsableOpenAiSidecar(
         releaseCodexAuthContextProbeLease(authContext);
         throw new CodexPoolAuthenticationError("Selected Codex account is unavailable");
       }
+      const windowMeta = codexFailureWindowOutcomeMeta(authContext);
       return {
         ...candidate,
         authContext,
@@ -220,6 +222,7 @@ export async function resolveFirstUsableOpenAiSidecar(
             probeLeaseId: authContext.probeLeaseId,
             probeQuotaScope: authContext.probeQuotaScope,
             writerGeneration: authContext.writerGeneration,
+            ...windowMeta,
             // 401/403 here is evidence about this exact stored credential; without the generation a
             // replacement inherits the quarantine (#2892 gap 4).
             ...(authContext.kind === "pool" ? { credentialGeneration: authContext.generation } : {}),
@@ -256,6 +259,7 @@ export async function resolveFirstUsableOpenAiSidecar(
       releaseCodexAuthContextProbeLease(authContext);
       continue;
     }
+    const windowMeta = codexFailureWindowOutcomeMeta(authContext);
     return {
       ...candidate,
       authContext,
@@ -271,6 +275,7 @@ export async function resolveFirstUsableOpenAiSidecar(
               threadId: authContext.affinityKey,
               probeLeaseId: authContext.probeLeaseId,
               writerGeneration: authContext.writerGeneration,
+              ...windowMeta,
               // Same fence as the exact-account recorder above (#2892 gap 4).
               ...(authContext.kind === "pool" ? { credentialGeneration: authContext.generation } : {}),
             },

package/src/providers/quota/anthropic-account-quota.ts

@@ -4,7 +4,9 @@ import { getAccountSet } from "../../oauth/store";
 import { captureConfigGeneration, sweepExpiredOnWrite } from "../../lib/state-store-sweeper";
 import { configuredAnthropicInstance, type AnthropicInstanceId } from "../anthropic-instance";
 import { ACCOUNT_QUOTA_TTL_MS } from "../quota-wire";
-import { fetchAnthropicUsageQuotaForInstance } from "./vendor-probes-oauth";
+import { fetchAnthropicUsageProbeForInstance } from "./vendor-probes-oauth";
+import { thrownQuotaFailure } from "./failure-codes";
+import type { QuotaFailureCode } from "../quota-types";
 import { AnthropicQuotaProbeOwnershipError, anthropicCooldownRecoveryFor, type AnthropicQuotaRecoveryResult } from "./anthropic-cooldown-recovery";
 import {
   accountCacheKey, accountQuotaCache, accountQuotaInflight, captureProviderAccountQuotaEpoch,
@@ -49,7 +51,10 @@ export async function fetchAnthropicAccountQuota(
   }
   let token: string;
   try { token = await getTokenForAccountQuotaProbe(instance, accountId); }
-  catch { return unavailable(); }
+  catch {
+    // Missing, signed-out or unrefreshable credential: a reauthentication matter, never a quota fact.
+    return { ...unavailable(), quotaFailure: "account_unavailable", quotaFailureIsCurrent: ownerCurrent };
+  }
   if (!ownerCurrent()) return unavailable();
   const flightKey = recovery.anthropicCredentialQuotaFlightKey(key, accountId);
   const flightCurrent = () => ownerCurrent()
@@ -65,30 +70,37 @@ export async function fetchAnthropicAccountQuota(
   // in-flight observations, as the pre-instance A path did, so joined callers and later cached
   // reads agree and windows that expired during the shared probe are normalized away.
   /** Cache the settled probe result for an account and publish its decision evidence only while the flight is still current for its credential and generation. */
-  const publish = (result: AnthropicQuotaRecoveryResult | null): AccountQuotaCacheEntry => {
+  const publish = (result: AnthropicQuotaRecoveryResult | null, failure?: QuotaFailureCode): AccountQuotaCacheEntry => {
     const previous = accountQuotaCache.get(key);
     const retained = previous?.isCurrent?.() === false ? undefined : previous;
     const isCurrent = result?.isCurrent ?? flightCurrent;
     const entry: AccountQuotaCacheEntry = {
       ts: Date.now(), quota: normalizeAnthropicQuota(result?.quota ?? retained?.quota, Date.now()),
       ...(!result ? { unavailable: true as const } : {}), isCurrent,
+      ...(!result && failure ? { quotaFailure: failure, quotaFailureIsCurrent: isCurrent } : {}),
     };
     if (isCurrent() && mayCommitAccountQuotaKey(key, writerGeneration)) { accountQuotaCache.set(key, entry); result?.publishDecisionQuota(); sweepExpiredOnWrite(entry.ts); }
     return entry;
   };
   const probe = (async (): Promise<AccountQuotaCacheEntry> => {
+    // The closed reason of the last usage read in this flight: an HTTP status class, an unusable
+    // body, or a thrown dispatch. Ownership and cooldown refusals never set it.
+    let failure: QuotaFailureCode | undefined;
     try {
       const result = await recovery.probeAnthropicQuotaWithRecovery(accountId, token, fresh => {
         if (!flightCurrent()) throw new AnthropicQuotaProbeOwnershipError("quota flight changed");
         recovery.assertAnthropicQuotaSendAllowed(accountId, token);
-        return fetchAnthropicUsageQuotaForInstance(instance, token, fresh || freshDispatch);
+        return fetchAnthropicUsageProbeForInstance(instance, token, fresh || freshDispatch).then(
+          read => { failure = read.failure; return read.quota; },
+          error => { failure = thrownQuotaFailure(error); throw error; },
+        );
       }, () => ownerCurrent() && mayCommitAccountQuotaKey(key, writerGeneration));
       if (result && !result.isCurrent()) return unavailable();
       if (!result && !flightCurrent()) return unavailable();
-      return publish(result);
+      return publish(result, failure);
     } catch (error) {
       if (error instanceof AnthropicQuotaProbeOwnershipError || !flightCurrent()) return unavailable();
-      return publish(null);
+      return publish(null, failure);
     }
   })().finally(() => { if (accountQuotaInflight.get(flightKey) === probe) accountQuotaInflight.delete(flightKey); });
   accountQuotaInflight.set(flightKey, probe);

package/src/providers/quota/antigravity.ts

@@ -8,6 +8,7 @@ import { asRecord, normalizePercent, normalizeResetAt, readQuotaJson, REQUEST_TI
 import { report, type ProviderQuotaReport } from "./report-cache";
 import { quotaCredentialIdentity } from "./account-cache";
 import type { ProviderQuota, ProviderQuotaWindow, QuotaFailureCode } from "../quota-types";
+import { httpQuotaFailure } from "./failure-codes";
 
 export function antigravityQuotaDiagnosticIdentity(accountId: string, credential = getAccountCredential("google-antigravity", accountId)): string | undefined {
   return credential ? quotaCredentialIdentity("google-antigravity", accountId, credential, {
@@ -275,13 +276,6 @@ function quotaTransportFailure(error: unknown): QuotaFailureCode {
   return "transport_error";
 }
 
-function quotaHttpFailure(status: number): QuotaFailureCode {
-  if (status >= 300 && status < 400) return "redirect_blocked";
-  if (status === 401 || status === 403) return "access_denied";
-  if (status === 429) return "rate_limited";
-  return "upstream_error";
-}
-
 function unavailableAntigravityQuota(failure: QuotaFailureCode): AntigravityQuotaProbeResult {
   return { kind: "unavailable", failure, legacy: { kind: "null" } };
 }
@@ -306,13 +300,16 @@ function antigravityUnavailableFailure(
   return fallbackFailure;
 }
 
-export async function probeAntigravityUsageQuota(accessToken: string, projectId: string): Promise<AntigravityQuotaProbeResult> {
+export async function probeAntigravityUsageQuota(accessToken: string, projectId: string, signal?: AbortSignal): Promise<AntigravityQuotaProbeResult> {
+  // An optional caller signal (account import) cancels every request of this probe, including the
+  // 403 retry and the models fallback, alongside the per-request deadline.
+  const requestSignal = () => signal ? AbortSignal.any([signal, AbortSignal.timeout(REQUEST_TIMEOUT_MS)]) : AbortSignal.timeout(REQUEST_TIMEOUT_MS);
   const fetchQuota = (url: string, userAgent = antigravityUserAgent()) => providerOutboundPost("google-antigravity", { baseUrl: ANTIGRAVITY_ACCOUNT_QUOTA_BASE }, url, {
     headers: {
       Accept: "application/json", "Content-Type": "application/json",
       "User-Agent": userAgent, Authorization: `Bearer ${accessToken}`,
     },
-    body: JSON.stringify({ project: projectId }), signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+    body: JSON.stringify({ project: projectId }), signal: requestSignal(),
   }, antigravityOutboundDependencies);
   let summaryFailure: QuotaFailureCode | undefined;
   try {
@@ -332,13 +329,14 @@ export async function probeAntigravityUsageQuota(accessToken: string, projectId:
     // Existing behavior: summary transport/parse failure may recover through the models probe.
     summaryFailure = quotaTransportFailure(error);
   }
+  if (signal?.aborted) return unavailableAntigravityQuota(summaryFailure ?? "transport_error");
   try {
     const response = await fetchQuota(ANTIGRAVITY_QUOTA_MODELS_URL);
     if (await providerRedirectError(response, ANTIGRAVITY_QUOTA_MODELS_URL)) {
       return unavailableAntigravityQuota(antigravityUnavailableFailure(summaryFailure, "redirect_blocked"));
     }
     if (!response.ok) {
-      return unavailableAntigravityQuota(antigravityUnavailableFailure(summaryFailure, quotaHttpFailure(response.status)));
+      return unavailableAntigravityQuota(antigravityUnavailableFailure(summaryFailure, httpQuotaFailure(response.status)));
     }
     const customWindows = antigravityWindowsFromModels(asRecord(await readQuotaJson(response)));
     if (!customWindows.length) {

package/src/providers/quota/failure-codes.ts

@@ -0,0 +1,18 @@
+import type { QuotaFailureCode } from "../quota-types";
+
+/**
+ * Closed quota-probe diagnoses derived from an HTTP status class or a thrown dispatch. They carry
+ * no upstream text, URL, header or credential: only one of `QUOTA_FAILURE_CODES`.
+ */
+export function httpQuotaFailure(status: number): QuotaFailureCode {
+  if (status >= 300 && status < 400) return "redirect_blocked";
+  if (status === 401 || status === 403) return "access_denied";
+  if (status === 429) return "rate_limited";
+  return "upstream_error";
+}
+
+/** A thrown fetch: the request deadline is a timeout, anything else a transport failure. */
+export function thrownQuotaFailure(error: unknown): QuotaFailureCode {
+  const name = error && typeof error === "object" ? (error as { name?: unknown }).name : undefined;
+  return name === "TimeoutError" ? "timeout" : "transport_error";
+}

package/src/providers/quota/vendor-probes-oauth.ts

@@ -8,7 +8,7 @@ import { captureOAuthAccountSelection, credentialGeneration, getAccountCredentia
 import { hydrateKiroAccountState, persistKiroAccountState } from "../kiro-account-state-disk";
 import { kiroProbeCurrent, kiroProbeIdentity } from "./kiro-account-probe";
 import { fetchMuseKeyQuotaSnapshot } from "../muse-key-quota";
-import { readAnthropicUsageQuota } from "../claude-cli-usage";
+import { probeAnthropicUsageQuota, type AnthropicUsageProbe } from "../claude-cli-usage";
 import { XAI_GROK_CLIENT_VERSION, XAI_GROK_COMPATIBILITY } from "../xai-transport";
 import {
   commitKiroAccountUsageState,
@@ -227,7 +227,7 @@ export async function fetchXaiQuota(provider: string, context: { accessToken: st
   }
 }
 
-const anthropicUsageInflight = new Map<string, Promise<ProviderQuota | null>>();
+const anthropicUsageInflight = new Map<string, Promise<AnthropicUsageProbe>>();
 
 /**
  * Anthropic per-credential usage.
@@ -256,6 +256,15 @@ export async function fetchAnthropicUsageQuotaForInstance(
   accessToken: string,
   requireFreshDispatch = false,
 ): Promise<ProviderQuota | null> {
+  return (await fetchAnthropicUsageProbeForInstance(instance, accessToken, requireFreshDispatch)).quota;
+}
+
+/** The same shared flight as `fetchAnthropicUsageQuotaForInstance`, keeping the closed failure reason. */
+export async function fetchAnthropicUsageProbeForInstance(
+  instance: AnthropicInstanceId,
+  accessToken: string,
+  requireFreshDispatch = false,
+): Promise<AnthropicUsageProbe> {
   // Recovery evidence must be requested after the claimed cooldown. Joining an older request
   // can return after the 429 while still describing provider state from before that refusal.
   const credentialIdentity = getAccountSet(instance)?.accounts.filter(row => row.credential.access === accessToken)
@@ -264,7 +273,7 @@ export async function fetchAnthropicUsageQuotaForInstance(
   const joinable = requireFreshDispatch ? undefined : anthropicUsageInflight.get(key);
   if (joinable) return joinable;
 
-  const probe = readAnthropicUsageQuota(accessToken).finally(() => {
+  const probe = probeAnthropicUsageQuota(accessToken).finally(() => {
     if (anthropicUsageInflight.get(key) === probe) anthropicUsageInflight.delete(key);
   });
   anthropicUsageInflight.set(key, probe);

package/src/providers/quota-routing-cache.ts

@@ -29,7 +29,7 @@ export function providerQuotaRoutingBinding(
   // A key probe must not constrain that later account selection.
   const entry = getProviderRegistryEntry(name);
   if (entry && (entry.authKind === "oauth" || entry.authKind === "forward")
-    && !providerUsesKeyAuthOverride(entry, provider, credential)) return null;
+    && !providerUsesKeyAuthOverride(entry, provider)) return null;
   // Static auth headers can replace or combine with the probed API-key header.
   // Its semantics belong to the adapter, so it is not provider-wide quota evidence.
   if (Object.keys(provider.headers ?? {}).some(header =>

package/src/providers/quota.ts

@@ -1,6 +1,7 @@
 import { listCodexAuthAccountsSnapshot } from "../codex/auth-api";
 import { isAnthropicInstanceId, configuredAnthropicInstance } from "./anthropic-instance";
 import { fetchAnthropicAccountQuota } from "./quota/anthropic-account-quota";
+import { thrownQuotaFailure } from "./quota/failure-codes";
 import { resolveEnvValue } from "../config";
 import { getAccountCredential, getAccountSet } from "../oauth/store";
 import { apiKeyPoolEntryId } from "./api-keys";
@@ -515,7 +516,10 @@ async function fetchAccountQuota(
       }
       return entry;
     } catch (error) {
-      if (provider === "google-antigravity") quotaFailure = "account_unavailable";
+      // The probe itself reports HTTP and transport failures as results; what throws here is the
+      // credential side (missing/paused account, failed refresh, no project). A refresh that hit
+      // its deadline is a timeout to retry, not an account the operator must re-sign.
+      if (provider === "google-antigravity") quotaFailure = thrownQuotaFailure(error) === "timeout" ? "timeout" : "account_unavailable";
       return unavailable();
     }
   })().finally(() => {

package/src/providers/registry/entries-extended.ts

@@ -1020,7 +1020,12 @@ export const PROVIDER_REGISTRY_EXTENDED: readonly ProviderRegistryEntry[] = [
     },
   },
   // FREEZE 2026-07-10: codestral-latest is unconfirmed behind auth. Evidence: devlog/_plan/260710_provider_hardening/003_research_aggregators.md.
-  { id: "mistral", label: "Mistral", baseUrl: "https://api.mistral.ai/v1", adapter: "openai-chat", authKind: "key", dashboardUrl: "https://console.mistral.ai/api-keys", defaultModel: "codestral-latest" },
+  {
+    id: "mistral", label: "Mistral", baseUrl: "https://api.mistral.ai/v1", adapter: "openai-chat", authKind: "key",
+    dashboardUrl: "https://console.mistral.ai/api-keys", defaultModel: "codestral-latest", promptCacheKey: true,
+    // Native text-only input enrolls this model in the existing vision sidecar.
+    modelInputModalities: { "zai-glm-5-3": ["text"] },
+  },
   {
     id: "minimax", label: "MiniMax — Coding Plan", baseUrl: "https://api.minimax.io/v1", adapter: "openai-chat", authKind: "key",
     dashboardUrl: "https://platform.minimax.io", defaultModel: "MiniMax-M3", models: MINIMAX_MODELS,

package/src/providers/routed-config.ts

@@ -134,7 +134,7 @@ export function routedProviderConfig(providerName: string, provider: OcxProvider
   const repairLegacyMimoFreeAuth = providerName === "mimo-free"
     && staticModelCatalog
     && (provider.authMode === undefined || provider.authMode === "local");
-  const explicitKeyOverride = providerUsesKeyAuthOverride(registryEntry, provider, resolvedApiKey);
+  const explicitKeyOverride = providerUsesKeyAuthOverride(registryEntry, provider);
   const canonicalAuthMode = explicitKeyOverride
     ? "key"
     : repairLegacyMimoFreeAuth

package/src/providers/xai-transport.ts

@@ -3,6 +3,7 @@ import type { OcxProviderConfig } from "../types";
 import { isEgressTransparentExecutor, markEgressTransparentExecutor } from "../lib/provider-egress";
 import { configuredOutboundFetch } from "../lib/proxy-env";
 import { resolveGithubCopilotTransport } from "./github-copilot-transport";
+import { resolveMistralTransport } from "./mistral-transport";
 
 export const XAI_GROK_CLI_BASE_URL = "https://cli-chat-proxy.grok.com/v1";
 
@@ -121,7 +122,7 @@ export function resolveProviderTransport(
   if (providerName === "github-copilot") {
     return resolveGithubCopilotTransport(provider, apiBaseUrl);
   }
-  if (providerName !== "xai") return provider;
+  if (providerName !== "xai") return resolveMistralTransport(provider);
 
   const cacheKey = promptCacheKey?.trim();
   const affinity = cacheKey ? deriveXaiConvId(cacheKey) : undefined;