@bitkyc08/opencodex 2.90.0 → 2.92.0

package/src/providers/stale-model-roster-migration.ts

@@ -10,13 +10,18 @@
  * This rewrites one thing: a saved `models` list that is still byte-for-byte the roster
  * this file names as `from`, on a provider that still carries the registry adapter, and
  * only while the registry currently seeds `to`. A list the user changed does not match and
- * is left alone. For each added id it also fills a per-model context window and default
- * effort, but only inside a container the row already has: enrichment fills those records
- * all-or-nothing, so creating one here would hide the rest of the registry seed.
+ * is left alone. For each added id it also fills a per-model context window, output limit
+ * and default effort, but only inside a container the row already has: enrichment fills
+ * those records all-or-nothing, so creating one here would hide the rest of the registry seed.
  * Same shape and restraint as `stale-context-window-migration`.
  */
-import { PROVIDER_REGISTRY } from "./registry";
+import { ALIBABA_INTL_TOKEN_PLAN_BASE_URL } from "./base-url-choices";
+import { PROVIDER_REGISTRY, normalizedProviderEndpoint } from "./registry";
 import {
+  ALIBABA_TOKEN_PLAN_MODELS,
+  ALIBABA_INTL_TOKEN_PLAN_MODELS,
+  ALIBABA_TOKEN_PLAN_CONTEXT_WINDOWS,
+  ALIBABA_TOKEN_PLAN_MAX_OUTPUT_TOKENS,
   MINIMAX_M31_DEFAULT_REASONING_EFFORT,
   MINIMAX_M31_FLASH_PREVIEW,
   MINIMAX_MODELS,
@@ -33,7 +38,18 @@ export interface StaleModelRoster {
   to: readonly string[];
   /** Per-model seed values for the added ids, written only into containers that exist. */
   contextWindows?: Readonly<Record<string, number>>;
+  /**
+   * Custom catalog rows read the saved map directly, so an added id missing from a
+   * partial map would publish without the registry output limit.
+   */
+  maxOutputTokens?: Readonly<Record<string, number>>;
   defaultReasoningEfforts?: Readonly<Record<string, string>>;
+  /**
+   * For a provider whose saved URL may point elsewhere (pay-as-you-go or Custom), the
+   * destinations whose roster `to` describes. A row on any other URL keeps its list; a row
+   * with no saved URL uses the registry default and is refreshed.
+   */
+  destinationBaseUrls?: readonly string[];
 }
 
 export interface StaleModelRosterProjection {
@@ -42,17 +58,45 @@ export interface StaleModelRosterProjection {
   warnings: string[];
 }
 
+const ALIBABA_TOKEN_PLAN_MODELS_BEFORE_1017 = [
+  "qwen3.8-max", "qwen3.8-flash", "qwen3.7-max", "qwen3.7-plus", "qwen3.6-flash",
+  "deepseek-v4-pro", "deepseek-v4-flash-0731", "deepseek-v4.1-flash", "glm-5.2", "glm-5.3",
+];
+const ALIBABA_INTL_TOKEN_PLAN_MODELS_BEFORE_1017 = [
+  "qwen3.8-max", "qwen3.8-flash", "qwen3.7-max", "qwen3.7-plus", "qwen3.6-plus", "qwen3.6-flash",
+  "deepseek-v4-pro", "deepseek-v4-pro-0813", "deepseek-v4-flash", "deepseek-v4-flash-0731", "deepseek-v4.1-flash", "deepseek-v3.2",
+  "kimi-k2.7-code", "kimi-k2.6", "kimi-k2.5",
+  "glm-5.2", "glm-5.3", "glm-5.1", "glm-5",
+  "MiniMax-M2.5",
+];
+
 /**
  * MiniMax-M3.1-Flash-Preview (2026-09-30). MiniMax's /v1/models roster does not list the
  * preview, so live discovery cannot add it; the catalog keeps it only when it is configured.
  */
-export const STALE_MODEL_ROSTERS: readonly StaleModelRoster[] = ["minimax", "minimax-cn"].map(provider => ({
-  provider,
-  from: MINIMAX_MODELS_BEFORE_M31,
-  to: MINIMAX_MODELS,
-  contextWindows: { [MINIMAX_M31_FLASH_PREVIEW]: MINIMAX_MODEL_CONTEXT_WINDOWS[MINIMAX_M31_FLASH_PREVIEW]! },
-  defaultReasoningEfforts: { [MINIMAX_M31_FLASH_PREVIEW]: MINIMAX_M31_DEFAULT_REASONING_EFFORT },
-}));
+export const STALE_MODEL_ROSTERS: readonly StaleModelRoster[] = [
+  ...["minimax", "minimax-cn"].map(provider => ({
+    provider,
+    from: MINIMAX_MODELS_BEFORE_M31,
+    to: MINIMAX_MODELS,
+    contextWindows: { [MINIMAX_M31_FLASH_PREVIEW]: MINIMAX_MODEL_CONTEXT_WINDOWS[MINIMAX_M31_FLASH_PREVIEW]! },
+    defaultReasoningEfforts: { [MINIMAX_M31_FLASH_PREVIEW]: MINIMAX_M31_DEFAULT_REASONING_EFFORT },
+  })),
+  ...[
+    { provider: "alibaba-token-plan", from: ALIBABA_TOKEN_PLAN_MODELS_BEFORE_1017, to: ALIBABA_TOKEN_PLAN_MODELS },
+    // International honors pay-as-you-go and Custom URLs, which may still serve the retired ids.
+    // Beijing needs no guard: the router pins it to the registry Token Plan host.
+    {
+      provider: "alibaba-token-plan-intl", from: ALIBABA_INTL_TOKEN_PLAN_MODELS_BEFORE_1017, to: ALIBABA_INTL_TOKEN_PLAN_MODELS,
+      destinationBaseUrls: [ALIBABA_INTL_TOKEN_PLAN_BASE_URL],
+    },
+  ].map(entry => ({
+    ...entry,
+    contextWindows: ALIBABA_TOKEN_PLAN_CONTEXT_WINDOWS,
+    maxOutputTokens: ALIBABA_TOKEN_PLAN_MAX_OUTPUT_TOKENS,
+    defaultReasoningEfforts: { "deepseek-v4.1-flash-1017": "high" },
+  })),
+];
 
 function sameList(value: unknown, expected: readonly string[]): boolean {
   return Array.isArray(value)
@@ -65,12 +109,24 @@ function registrySeeds(provider: string, adapter: unknown, roster: readonly stri
   return entry !== undefined && entry.adapter === adapter && sameList(entry.models, roster);
 }
 
-function fillExisting<T>(container: Record<string, T> | undefined, values: Readonly<Record<string, T>> | undefined, ids: readonly string[]): void {
-  if (!container || !values) return;
+function servesRoster(baseUrl: unknown, destinations: readonly string[] | undefined): boolean {
+  if (!destinations || baseUrl === undefined || baseUrl === "") return true;
+  if (typeof baseUrl !== "string") return false;
+  const saved = normalizedProviderEndpoint(baseUrl);
+  return destinations.some(url => normalizedProviderEndpoint(url) === saved);
+}
+
+function fillExisting<T>(container: Record<string, T> | undefined, values: Readonly<Record<string, T>> | undefined, ids: readonly string[]): boolean {
+  if (!container || !values) return false;
+  let filled = false;
   for (const id of ids) {
     const value = values[id];
-    if (value !== undefined && !Object.prototype.hasOwnProperty.call(container, id)) container[id] = value;
+    if (value !== undefined && !Object.prototype.hasOwnProperty.call(container, id)) {
+      container[id] = value;
+      filled = true;
+    }
   }
+  return filled;
 }
 
 /** Pure projection. The caller decides whether to persist. */
@@ -85,10 +141,22 @@ export function projectStaleModelRosters(
     const prov = config.providers?.[entry.provider];
     if (!prov) continue;
     if (!registrySeeds(entry.provider, prov.adapter, entry.to)) continue;
-    if (!sameList(prov.models, entry.from)) continue;
+    if (!servesRoster(prov.baseUrl, entry.destinationBaseUrls)) continue;
     const added = entry.to.filter(id => !entry.from.includes(id));
+    if (sameList(prov.models, entry.to)) {
+      // A row refreshed before output limits joined the refresh still has a partial map.
+      // Only that record is revisited: the earlier pass already filled windows and efforts,
+      // so refilling them could restore a key the operator has since removed.
+      if (fillExisting(prov.modelMaxOutputTokens, entry.maxOutputTokens, added)) {
+        changed = true;
+        warnings.push(`filled output limits for ${added.join(", ")} on the saved "${entry.provider}" row.`);
+      }
+      continue;
+    }
+    if (!sameList(prov.models, entry.from)) continue;
     prov.models = [...entry.to];
     fillExisting(prov.modelContextWindows, entry.contextWindows, added);
+    fillExisting(prov.modelMaxOutputTokens, entry.maxOutputTokens, added);
     fillExisting(prov.modelDefaultReasoningEfforts, entry.defaultReasoningEfforts, added);
     changed = true;
     warnings.push(

package/src/providers/workbuddy-credit-balance.ts

@@ -0,0 +1,81 @@
+export interface WorkBuddyCreditAmount {
+  total: number;
+  used: number;
+  remaining: number;
+  frozen: number;
+}
+
+export const WORKBUDDY_CREDIT_KINDS = ["plan_base", "plan_bonus", "addon", "benefit", "other"] as const;
+export type WorkBuddyCreditKind = typeof WORKBUDDY_CREDIT_KINDS[number];
+
+/** Display-only credits; they are neither USD nor provider-wide model eligibility. */
+export interface WorkBuddyCreditBalance extends WorkBuddyCreditAmount {
+  groups: Array<WorkBuddyCreditAmount & { kind: WorkBuddyCreditKind }>;
+  expiring?: { amount: number; at: number };
+}
+
+export function workBuddyRecord(value: unknown): Record<string, unknown> {
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value as Record<string, unknown> : {};
+}
+
+export function workBuddyCapacity(value: unknown): number | undefined {
+  if (typeof value !== "number" && !(typeof value === "string" && /^\d+(?:\.\d+)?$/.test(value))) return undefined;
+  const number = Number(value);
+  return Number.isFinite(number) && number >= 0 && number <= Number.MAX_SAFE_INTEGER ? number : undefined;
+}
+
+function amount(value: unknown): WorkBuddyCreditAmount | undefined {
+  const row = workBuddyRecord(value);
+  const total = workBuddyCapacity(row.total), used = workBuddyCapacity(row.used);
+  const remaining = workBuddyCapacity(row.remaining), frozen = workBuddyCapacity(row.frozen);
+  if (total === undefined || used === undefined || remaining === undefined || frozen === undefined) return undefined;
+  return { total, used, remaining, frozen };
+}
+
+/** Narrow wire/cache input before rendering, without admitting account or package identifiers. */
+export function normalizeWorkBuddyCredits(value: unknown): WorkBuddyCreditBalance | undefined {
+  const row = workBuddyRecord(value), balance = amount(value);
+  if (!balance || !Array.isArray(row.groups) || row.groups.length > WORKBUDDY_CREDIT_KINDS.length) return undefined;
+  const groups: WorkBuddyCreditBalance["groups"] = [];
+  const seen = new Set<string>();
+  for (const raw of row.groups) {
+    const group = workBuddyRecord(raw), quantities = amount(group);
+    const kind = WORKBUDDY_CREDIT_KINDS.find(kind => kind === group.kind);
+    if (!quantities || !kind || seen.has(kind)) return undefined;
+    seen.add(kind); groups.push({ kind, ...quantities });
+  }
+  const expiring = workBuddyRecord(row.expiring), quantity = workBuddyCapacity(expiring.amount);
+  const at = typeof expiring.at === "number" && expiring.at > 0 && Number.isFinite(new Date(expiring.at).getTime()) ? expiring.at : undefined;
+  return { ...balance, groups, ...(quantity !== undefined && quantity > 0 && at !== undefined ? { expiring: { amount: quantity, at } } : {}) };
+}
+
+function packageAmount(row: Record<string, unknown>): WorkBuddyCreditAmount | undefined {
+  const total = workBuddyCapacity(row.CycleTotalCapacity), used = workBuddyCapacity(row.CycleUsedCapacity);
+  const frozen = row.CycleFrozenCapacity === undefined ? 0 : workBuddyCapacity(row.CycleFrozenCapacity);
+  if (total === undefined || used === undefined || frozen === undefined) return undefined;
+  const remaining = row.CycleRemainCapacity === undefined ? Math.max(0, total - used - frozen) : workBuddyCapacity(row.CycleRemainCapacity);
+  return remaining === undefined ? undefined : { total, used, remaining, frozen };
+}
+
+export function parseWorkBuddyCredits(value: unknown): WorkBuddyCreditBalance | undefined {
+  const summary = workBuddyRecord(value);
+  if (!Array.isArray(summary.Packages) || summary.Packages.length > 512) return undefined;
+  const balance: WorkBuddyCreditBalance = { total: 0, used: 0, remaining: 0, frozen: 0, groups: [] };
+  for (const raw of summary.Packages) {
+    const quantities = packageAmount(workBuddyRecord(raw));
+    if (!quantities) return undefined;
+    for (const key of ["total", "used", "remaining", "frozen"] as const) balance[key] += quantities[key];
+  }
+  // CreditGroups is a breakdown of Packages, not another balance to add to it.
+  if (Array.isArray(summary.CreditGroups) && summary.CreditGroups.length <= 16) {
+    for (const raw of summary.CreditGroups) {
+      const row = workBuddyRecord(raw), quantities = packageAmount(row);
+      if (!quantities) continue;
+      const kind = WORKBUDDY_CREDIT_KINDS.find(kind => kind === row.Kind) ?? "other";
+      const existing = balance.groups.find(group => group.kind === kind);
+      if (existing) for (const key of ["total", "used", "remaining", "frozen"] as const) existing[key] += quantities[key];
+      else balance.groups.push({ kind, ...quantities });
+    }
+  }
+  return normalizeWorkBuddyCredits(balance);
+}

package/src/providers/workbuddy-models.ts

@@ -0,0 +1,37 @@
+import { isValidModelDiscoveryModelId } from "./model-discovery-limits";
+import type { ProviderModelItemsResult, ProviderModelsApiItem } from "./model-discovery";
+
+function record(value: unknown): Record<string, unknown> {
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value as Record<string, unknown> : {};
+}
+
+/** The product catalog contains non-chat models too; only the CLI agent's roster is routable. */
+export function extractWorkBuddyModels(value: unknown, limit: number): ProviderModelItemsResult {
+  const envelope = record(value), data = record(envelope.data);
+  if ((envelope.code !== 0 && envelope.code !== "0") || !Array.isArray(data.agents) || !Array.isArray(data.models)) return { ok: false, reason: "invalid_shape" };
+  if (data.models.length > limit || data.agents.length > limit) return { ok: false, reason: "too_many_models" };
+  const agent = data.agents.map(record).find(a => a.name === "cli");
+  if (!Array.isArray(agent?.models)) return { ok: false, reason: "invalid_shape" };
+  if (agent.models.length > limit) return { ok: false, reason: "too_many_models" };
+  const definitions = new Map(data.models.map(raw => { const row = record(raw); return [row.id, row] as const; }));
+  const items: ProviderModelsApiItem[] = [], seen = new Set<string>();
+  for (const id of agent.models) {
+    if (!isValidModelDiscoveryModelId(id)) return { ok: false, reason: "invalid_shape" };
+    if (seen.has(id)) continue;
+    seen.add(id);
+    const row = definitions.get(id) ?? {}, reasoning = record(row.reasoning);
+    const rawEfforts = Array.isArray(reasoning.supportedEfforts) ? reasoning.supportedEfforts
+      : row.supportsReasoning === true ? ["low", "high", "max"] : [];
+    const efforts = rawEfforts.filter(e => typeof e === "string" && ["low", "medium", "high", "xhigh", "max"].includes(e));
+    if (efforts.length && row.onlyReasoning !== true && reasoning.canDisableThinking !== false) efforts.unshift("none");
+    const positive = (v: unknown) => typeof v === "number" && Number.isSafeInteger(v) && v > 0 ? v : undefined;
+    items.push({
+      id, ...(typeof row.name === "string" && row.name.length <= 256 ? { name: row.name } : {}),
+      context_length: positive(row.maxInputTokens), max_input_tokens: positive(row.maxInputTokens),
+      max_output_tokens: positive(row.maxOutputTokens), reasoning_efforts: efforts,
+      // WorkBuddy AI filters images from GLM requests despite advertising supportsImages.
+      input_modalities: row.supportsImages === true && !id.startsWith("glm-") ? ["text", "image"] : ["text"],
+    });
+  }
+  return { ok: true, items, rawCount: agent.models.length };
+}

package/src/providers/workbuddy.ts

@@ -0,0 +1,60 @@
+import type { WorkBuddyOAuthMetadata } from "../oauth/types";
+import { createHash } from "node:crypto";
+
+export const WORKBUDDY_ORIGIN = "https://www.workbuddy.ai";
+export const WORKBUDDY_BASE_URL = `${WORKBUDDY_ORIGIN}/v2`;
+export const WORKBUDDY_CONFIG_URL = `${WORKBUDDY_ORIGIN}/v3/config`;
+export const WORKBUDDY_USER_AGENT = "WorkBuddy/5.5.6";
+
+export function workBuddyCatalogIdentity(access: string, metadata: WorkBuddyOAuthMetadata | undefined): string {
+  return createHash("sha256").update(JSON.stringify([access, metadata])).digest("hex");
+}
+
+export function workBuddyHeaderValue(value: unknown, max = 1024): value is string {
+  return typeof value === "string" && value.length > 0 && value.length <= max && /^[\x21-\x7e]+$/.test(value);
+}
+
+export function normalizeWorkBuddyMetadata(value: unknown): WorkBuddyOAuthMetadata | undefined {
+  if (!value || typeof value !== "object") return undefined;
+  const v = value as Partial<WorkBuddyOAuthMetadata>;
+  if (!workBuddyHeaderValue(v.uid) || !workBuddyHeaderValue(v.domain)) return undefined;
+  if (v.enterpriseId !== undefined && !workBuddyHeaderValue(v.enterpriseId)) return undefined;
+  return {
+    uid: v.uid, domain: v.domain,
+    ...(v.enterpriseId ? { enterpriseId: v.enterpriseId } : {}),
+    ...(typeof v.refreshExpiresAt === "number" && Number.isFinite(v.refreshExpiresAt) && v.refreshExpiresAt > 0
+      ? { refreshExpiresAt: v.refreshExpiresAt } : {}),
+  };
+}
+
+export function assertWorkBuddyDestination(baseUrl: string): void {
+  const u = new URL(baseUrl);
+  if (u.origin !== WORKBUDDY_ORIGIN || u.username || u.password || u.search || u.hash
+    || !["", "/v2", "/v2/chat/completions"].includes(u.pathname.replace(/\/+$/, ""))) {
+    throw new Error("WorkBuddy AI credentials require https://www.workbuddy.ai/v2");
+  }
+}
+
+export function workBuddyHeaders(access: string | undefined, metadata?: WorkBuddyOAuthMetadata): Record<string, string> {
+  const headers: Record<string, string> = {
+    "User-Agent": WORKBUDDY_USER_AGENT,
+    "X-Product": "SaaS", "X-IDE-Type": "WorkBuddy", "X-IDE-Name": "WorkBuddy",
+    "X-IDE-Version": "5.5.6", "X-Requested-With": "XMLHttpRequest",
+    "X-Agent-Intent": "craft", "X-Agent-Purpose": "conversation", "X-Agent-Type": "main",
+  };
+  if (access) {
+    if (!workBuddyHeaderValue(access, 32768)) throw new Error("Invalid WorkBuddy AI access token");
+    headers.Authorization = `Bearer ${access}`;
+  }
+  if (metadata) {
+    const valid = normalizeWorkBuddyMetadata(metadata);
+    if (!valid) throw new Error("WorkBuddy AI account identity unavailable; sign in again");
+    headers["X-User-Id"] = valid.uid;
+    headers["X-Domain"] = valid.domain;
+    if (valid.enterpriseId) {
+      headers["X-Enterprise-Id"] = valid.enterpriseId;
+      headers["X-Tenant-Id"] = valid.enterpriseId;
+    }
+  }
+  return headers;
+}

package/src/quota-pool/assemble.ts

@@ -0,0 +1,326 @@
+/**
+ * Assemble `ocx.quota-pool/1` (`GET /api/quota-pool`) from what this Home already holds.
+ *
+ * Strictly passive. Every source below is a cache another path filled; this module starts no
+ * probe, token refresh, quota refresh or upstream call and writes nothing. The whole assembly runs
+ * inside `runPassiveRead`, so even the shared readers it calls (the Codex account list, the OAuth
+ * store) take their passive branch: no WHAM probe, no native-main claim, no file hardening or
+ * malformed-store backup. Sources:
+ *
+ * - Codex pool accounts: the passive `listCodexAuthAccountsSnapshot` (stored `StoredAccountQuota`
+ *   per account plus the cached main-account reading);
+ * - provider-level reports: `heldProviderQuotaReports`, the reports the Home last published
+ *   (for the Codex pool provider this is OpenCodex's own pool aggregate, reported as `pooled`);
+ * - per-account OAuth quota (Anthropic instances, Kiro, Antigravity, xAI, Cursor, Kimi, Command
+ *   Code, Devin, DSH, Meta): the last-good per-account cache;
+ * - Claude CLI: the usage-admission snapshot (5-hour, weekly and family windows, plus a parsed
+ *   CLI limit refusal).
+ *
+ * An unknown window is omitted, never emitted as 0%. A window whose reset has passed is unknown
+ * again and is omitted too. Optional fields are left out instead of set to null.
+ */
+import type { OcxConfig, OcxProviderConfig } from "../types";
+import type { ProviderQuota, ProviderQuotaWindow } from "../providers/quota-types";
+import type { StoredAccountQuota } from "../codex/quota-types";
+import { isTerminalShortWindow, resetAtToMs } from "../codex/quota-types";
+import { runPassiveRead } from "../lib/passive-read";
+import { packageVersion } from "../lib/package-version";
+import { listCodexAuthAccountsSnapshot } from "../codex/auth-api";
+import { latestCodexQuotaObservationSource } from "../codex/quota";
+import { ACCOUNT_LOG_LABEL_RE, oauthAccountLogLabel } from "../codex/account-label";
+import { OPENAI_CODEX_PROVIDER_ID } from "../providers/openai-tiers-destination";
+import { hasCodexPoolProvider, heldProviderQuotaReports, type ProviderQuotaReport } from "../providers/quota/report-cache";
+import {
+  accountCacheKey,
+  accountQuotaCache,
+  getCachedProviderAccountQuota,
+  hasPassiveAccountQuota,
+  supportsPerAccountQuota,
+} from "../providers/quota/account-cache";
+import { parseQuotaFailureCode } from "../providers/quota-types";
+import { getAccountSet } from "../oauth/store";
+import { peekClaudeUsageObservation } from "../adapters/claude-cli/usage-admission";
+import {
+  QUOTA_POOL_SCHEMA,
+  type QuotaPool,
+  type QuotaPoolAccount,
+  type QuotaPoolAccountState,
+  type QuotaPoolProvider,
+  type QuotaPoolRole,
+  type QuotaPoolSource,
+  type QuotaPoolWindow,
+} from "./contract";
+import { quotaPoolAccountRef, readQuotaPoolIdentity, type QuotaPoolIdentity } from "./identity";
+
+const VERSION = packageVersion("0.0.0");
+const SHORT_BURST_MAX_SECONDS = 6 * 3600;
+const SHORT_DAILY_MAX_SECONDS = 36 * 3600;
+
+export interface QuotaPoolDeps {
+  now?: () => number;
+  /** Test seam for the Claude CLI admission file. */
+  claudeUsageStatePath?: string;
+}
+
+export type QuotaPoolResult = { ok: true; pool: QuotaPool } | { ok: false; error: "quota_pool_identity_unavailable" };
+
+const finite = (value: unknown): value is number => typeof value === "number" && Number.isFinite(value);
+
+function iso(ms: number): string | undefined {
+  if (!finite(ms) || ms <= 0) return undefined;
+  const date = new Date(ms);
+  return Number.isFinite(date.getTime()) ? date.toISOString() : undefined;
+}
+
+/** A used percent inside the contract's 0..100, or undefined when there is no reading. */
+function percent(value: unknown): number | undefined {
+  if (!finite(value) || value < 0) return undefined;
+  return Math.min(100, value);
+}
+
+type WindowDraft = Omit<QuotaPoolWindow, "observedAt" | "source"> & { resetMs?: number };
+
+/**
+ * Finish a window, or drop it when it carries nothing (no percent, no counters) or its reset has
+ * already passed: an elapsed window is unknown now, not empty.
+ */
+function finish(draft: WindowDraft, source: QuotaPoolSource, observedMs: number, now: number): QuotaPoolWindow | null {
+  const observedAt = iso(observedMs);
+  if (!observedAt) return null;
+  const { resetMs, ...rest } = draft;
+  if (resetMs !== undefined && resetMs <= now) return null;
+  if (rest.usedPercent === undefined && rest.used === undefined && rest.limit === undefined && rest.exhausted === undefined) return null;
+  const resetsAt = resetMs !== undefined ? iso(resetMs) : undefined;
+  const exhausted = rest.exhausted ?? (rest.usedPercent !== undefined ? rest.usedPercent >= 100 : undefined);
+  const window: QuotaPoolWindow = { ...rest, source, observedAt };
+  if (resetsAt) window.resetsAt = resetsAt;
+  if (exhausted !== undefined) window.exhausted = exhausted;
+  return window;
+}
+
+function resetMs(value: unknown): number | undefined {
+  return finite(value) && value > 0 ? resetAtToMs(value) : undefined;
+}
+
+function shortKind(seconds: number | undefined): Pick<QuotaPoolWindow, "id" | "kind" | "label"> {
+  if (seconds === undefined || seconds <= SHORT_BURST_MAX_SECONDS) return { id: "5h", kind: "burst_5h", label: "5-hour" };
+  if (seconds <= SHORT_DAILY_MAX_SECONDS) return { id: "daily", kind: "daily", label: "Daily" };
+  return { id: "short", kind: "custom", label: "Short window" };
+}
+
+/** Codex `StoredAccountQuota`, mapped as the header and WHAM parsers stored it. */
+export function codexQuotaWindows(quota: StoredAccountQuota, source: QuotaPoolSource, now: number): QuotaPoolWindow[] {
+  const out: QuotaPoolWindow[] = [];
+  const push = (window: QuotaPoolWindow | null) => { if (window) out.push(window); };
+  const shortPercent = percent(quota.shortPercent);
+  const shortSeconds = finite(quota.shortWindowSeconds) && quota.shortWindowSeconds > 0 ? quota.shortWindowSeconds : undefined;
+  if (shortPercent !== undefined) {
+    push(finish({
+      ...shortKind(shortSeconds),
+      usedPercent: shortPercent,
+      ...(shortSeconds !== undefined ? { windowSeconds: shortSeconds } : {}),
+      resetMs: resetMs(quota.shortResetAt),
+      exhausted: isTerminalShortWindow(quota, now),
+    }, source, quota.shortObservedAt ?? quota.updatedAt, now));
+  }
+  const weekly = percent(quota.weeklyPercent);
+  if (weekly !== undefined) {
+    push(finish({ id: "weekly", kind: "weekly", label: "Weekly", usedPercent: weekly, resetMs: resetMs(quota.weeklyResetAt) }, source, quota.updatedAt, now));
+  }
+  const monthly = percent(quota.monthlyPercent);
+  if (monthly !== undefined) {
+    push(finish({ id: "monthly", kind: "monthly", label: "Monthly", usedPercent: monthly, resetMs: resetMs(quota.monthlyResetAt) }, source, quota.updatedAt, now));
+  }
+  for (const custom of quota.customWindows ?? []) {
+    const used = percent(custom?.percent);
+    if (typeof custom?.label !== "string" || !custom.label.trim() || used === undefined) continue;
+    push(finish({ id: `custom:${custom.label}`, kind: "custom", label: custom.label, usedPercent: used, resetMs: resetMs(custom.resetAt) }, source, quota.updatedAt, now));
+  }
+  return out;
+}
+
+function customWindow(window: ProviderQuotaWindow, source: QuotaPoolSource, updatedAt: number, now: number): QuotaPoolWindow | null {
+  if (typeof window?.label !== "string" || !window.label.trim()) return null;
+  // An exact-model row (Antigravity diagnostics, CCA fallback) restates the pool its family
+  // window already reports and carries no proven scope; reporting it unscoped would let it gate
+  // every model.
+  if (window.modelId !== undefined && window.scope !== "model") return null;
+  const scoped = window.scope === "model";
+  const passive = finite(window.passiveObservedAt);
+  return finish({
+    id: scoped ? `family:${window.label.toLowerCase()}` : `custom:${window.label}`,
+    kind: "custom",
+    label: window.label,
+    ...(percent(window.percent) !== undefined ? { usedPercent: percent(window.percent) } : {}),
+    ...(scoped ? { scopeModel: window.label } : {}),
+    ...(window.rejected === true ? { exhausted: true } : {}),
+    resetMs: resetMs(window.resetAt),
+  }, passive ? "header" : source, passive ? window.passiveObservedAt! : updatedAt, now);
+}
+
+/** A `ProviderQuota` (provider report or per-account cache row). */
+export function providerQuotaWindows(quota: ProviderQuota, source: QuotaPoolSource, now: number): QuotaPoolWindow[] {
+  const out: QuotaPoolWindow[] = [];
+  const push = (window: QuotaPoolWindow | null) => { if (window) out.push(window); };
+  const at = quota.updatedAt;
+  const fixed = [
+    ["5h", "burst_5h", "5-hour", quota.fiveHourPercent, quota.fiveHourResetAt],
+    ["weekly", "weekly", "Weekly", quota.weeklyPercent, quota.weeklyResetAt],
+    ["monthly", "monthly", "Monthly", quota.monthlyPercent, quota.monthlyResetAt],
+  ] as const;
+  for (const [id, kind, label, value, reset] of fixed) {
+    const used = percent(value);
+    if (used === undefined) continue;
+    push(finish({ id, kind, label, usedPercent: used, resetMs: resetMs(reset) }, source, at, now));
+  }
+  const kiroUsed = finite(quota.kiroCreditsUsed) && quota.kiroCreditsUsed >= 0 ? quota.kiroCreditsUsed : undefined;
+  const kiroLimit = finite(quota.kiroCreditsLimit) && quota.kiroCreditsLimit > 0 ? quota.kiroCreditsLimit : undefined;
+  if (kiroUsed !== undefined || kiroLimit !== undefined) {
+    push(finish({
+      id: "credits:kiro", kind: "credits", label: "Kiro credits", unit: "credits",
+      ...(kiroUsed !== undefined ? { used: kiroUsed } : {}),
+      ...(kiroLimit !== undefined ? { limit: kiroLimit } : {}),
+      ...(kiroUsed !== undefined && kiroLimit !== undefined ? { usedPercent: percent((kiroUsed / kiroLimit) * 100) } : {}),
+    }, source, at, now));
+  }
+  const usd = quota.creditsUsd;
+  if (usd && finite(usd.used) && usd.used >= 0) {
+    const unlimited = usd.unlimited === true;
+    push(finish({
+      id: "credits:usd", kind: "credits", label: "USD credits", unit: "usd", used: usd.used,
+      ...(!unlimited && finite(usd.limit) && usd.limit > 0 ? { limit: usd.limit } : {}),
+      ...(!unlimited && percent(usd.percent) !== undefined ? { usedPercent: percent(usd.percent) } : {}),
+      ...(unlimited ? { exhausted: false } : finite(usd.remaining) ? { exhausted: usd.remaining <= 0 } : {}),
+    }, source, at, now));
+  }
+  for (const custom of quota.customWindows ?? []) push(customWindow(custom, source, at, now));
+  return out;
+}
+
+function accountState(input: { reauth: boolean; paused: boolean; windows: readonly QuotaPoolWindow[] }): QuotaPoolAccountState {
+  if (input.reauth) return "reauth";
+  if (input.paused) return "paused";
+  // A model-scoped window never gates the account as a whole.
+  if (input.windows.some(window => window.exhausted === true && window.scopeModel === undefined)) return "exhausted";
+  return input.windows.length === 0 ? "unknown" : "available";
+}
+
+function nextResetAt(windows: readonly QuotaPoolWindow[]): string | undefined {
+  const resets = windows.filter(window => window.scopeModel === undefined && window.resetsAt).map(window => window.resetsAt!).sort();
+  return resets[0];
+}
+
+function reportSource(report: ProviderQuotaReport): QuotaPoolSource {
+  if (report.aggregation) return "estimated";
+  return report.observed === true ? "header" : "measured";
+}
+
+function codexAccounts(identity: QuotaPoolIdentity, accounts: Awaited<ReturnType<typeof listCodexAuthAccountsSnapshot>>["accounts"], now: number): QuotaPoolAccount[] {
+  const provider = OPENAI_CODEX_PROVIDER_ID;
+  return accounts.map(dto => {
+    const source: QuotaPoolSource = latestCodexQuotaObservationSource(dto.id) === "response-header" ? "header" : "measured";
+    const windows = dto.quota ? codexQuotaWindows(dto.quota as StoredAccountQuota, source, now) : [];
+    const account: QuotaPoolAccount = {
+      provider,
+      accountRef: quotaPoolAccountRef(identity, provider, dto.id),
+      // needsReauth only: a passive read leaves hasCredential false when it did not check, and an
+      // account without a credential already carries needsReauth.
+      state: accountState({ reauth: dto.needsReauth === true, paused: dto.paused, windows }),
+      windows,
+    };
+    if (typeof dto.logLabel === "string" && ACCOUNT_LOG_LABEL_RE.test(dto.logLabel)) account.label = dto.logLabel;
+    if (typeof dto.plan === "string" && dto.plan.trim()) account.plan = dto.plan.trim();
+    return account;
+  });
+}
+
+function oauthAccounts(identity: QuotaPoolIdentity, provider: string, now: number): QuotaPoolAccount[] {
+  const set = getAccountSet(provider);
+  if (!set) return [];
+  return set.accounts.map(row => {
+    const quota = getCachedProviderAccountQuota(provider, row.id);
+    const entry = accountQuotaCache.get(accountCacheKey(provider, row.id));
+    const windows = quota ? providerQuotaWindows(quota, "measured", now) : [];
+    const account: QuotaPoolAccount = {
+      provider,
+      accountRef: quotaPoolAccountRef(identity, provider, row.id),
+      label: oauthAccountLogLabel(row.id, provider),
+      state: accountState({ reauth: row.needsReauth === true, paused: row.paused === true, windows }),
+      windows,
+    };
+    const failure = entry?.quotaFailure && entry.quotaFailureIsCurrent?.() === true ? parseQuotaFailureCode(entry.quotaFailure) : undefined;
+    if (failure) account.failure = failure;
+    return account;
+  });
+}
+
+function claudeCliAccounts(identity: QuotaPoolIdentity, provider: string, deps: QuotaPoolDeps, now: number): QuotaPoolAccount[] {
+  const observation = peekClaudeUsageObservation(deps.claudeUsageStatePath ? { statePath: deps.claudeUsageStatePath } : {});
+  if (!observation) return [];
+  const windows = observation.quota ? providerQuotaWindows(observation.quota, "measured", now) : [];
+  if (finite(observation.refusalUntil) && observation.refusalUntil > now) {
+    const refusal = finish({ id: "refusal", kind: "custom", label: "Claude CLI limit", exhausted: true, resetMs: observation.refusalUntil },
+      "estimated", observation.checkedAt, now);
+    if (refusal) windows.push(refusal);
+  }
+  return [{
+    provider,
+    accountRef: quotaPoolAccountRef(identity, provider, `claude-cli:${observation.identity}`),
+    state: accountState({ reauth: false, paused: false, windows }),
+    windows,
+  }];
+}
+
+function role(config: OcxConfig): QuotaPoolRole {
+  return config.runtimeRole === "hub" || config.runtimeRole === "client" ? config.runtimeRole : "standalone";
+}
+
+function enabled(provider: OcxProviderConfig | undefined): provider is OcxProviderConfig {
+  return !!provider && provider.disabled !== true;
+}
+
+async function assemble(config: OcxConfig, identity: QuotaPoolIdentity, deps: QuotaPoolDeps): Promise<QuotaPool> {
+  const now = (deps.now ?? Date.now)();
+  const names = Object.keys(config.providers).filter(name => enabled(config.providers[name])).sort();
+  const reports = new Map(heldProviderQuotaReports(names).reports.map(report => [report.provider, report]));
+  const codexPool = hasCodexPoolProvider(config);
+  const codex = codexPool ? (await listCodexAuthAccountsSnapshot(config)).accounts : [];
+  const providers: QuotaPoolProvider[] = [];
+  for (const name of names) {
+    const provider = config.providers[name]!;
+    let accounts: QuotaPoolAccount[] = [];
+    let tracked = false;
+    if (codexPool && name === OPENAI_CODEX_PROVIDER_ID) {
+      tracked = true;
+      accounts = codexAccounts(identity, codex, now);
+    } else if (provider.adapter === "claude-cli") {
+      tracked = true;
+      accounts = claudeCliAccounts(identity, name, deps, now);
+    } else if (supportsPerAccountQuota(name) || hasPassiveAccountQuota(name)) {
+      tracked = true;
+      accounts = oauthAccounts(identity, name, now);
+    }
+    const report = reports.get(name);
+    const pooledWindows = report ? providerQuotaWindows(report.quota, reportSource(report), now) : [];
+    if (!tracked && !report) continue;
+    const pooled: QuotaPoolProvider["pooled"] = { windows: pooledWindows };
+    const next = nextResetAt(pooledWindows);
+    if (next) pooled.nextResetAt = next;
+    providers.push({ provider: name, accounts, pooled });
+  }
+  return {
+    schema: QUOTA_POOL_SCHEMA,
+    producer: { version: VERSION, role: role(config), homeId: identity.homeId },
+    generatedAt: iso(now) ?? new Date().toISOString(),
+    providers,
+  };
+}
+
+/** The quota pool, or an identity error. Always a passive read, whoever asks. */
+export function readQuotaPool(config: OcxConfig, deps: QuotaPoolDeps = {}): Promise<QuotaPoolResult> {
+  return runPassiveRead(async () => {
+    const identity = readQuotaPoolIdentity();
+    if (!identity) return { ok: false, error: "quota_pool_identity_unavailable" } as const;
+    return { ok: true, pool: await assemble(config, identity, deps) } as const;
+  });
+}