@cortexkit/pi-anthropic-auth 1.15.1 → 1.17.0

package/README.md

@@ -42,7 +42,7 @@ Pi state is stored separately from OpenCode at:
 
 Override the path with `PI_ANTHROPIC_AUTH_FILE`. The package also respects `PI_AGENT_DIR` when deriving the default sidecar path.
 
-The sidecar uses the same JSON shape as the OpenCode package, including `routing`, `claudeCache`, `cacheKeep`, `claudeFast`, `dump`, `relay`, and fallback `accounts` blocks.
+The sidecar uses the same JSON shape as the OpenCode package, including `routing`, `claudeCache`, `cacheKeep`, `claudeFast`, `dump`, `relay`, and fallback `accounts` blocks. Runtime OAuth/quota state is stored in `anthropic-auth-state.json`; sticky session assignments are stored separately in `anthropic-auth-routing-state.json` with SHA-256-hashed session IDs.
 
 ## Commands
 
@@ -55,6 +55,7 @@ The sidecar uses the same JSON shape as the OpenCode package, including `routing
 /claude-cache mode hybrid
 
 /claude-cachekeep
+/claude-cachekeep always
 /claude-cachekeep 09-23
 /claude-cachekeep off
 
@@ -69,11 +70,13 @@ The sidecar uses the same JSON shape as the OpenCode package, including `routing
 /claude-routing
 /claude-routing main-first
 /claude-routing fallback-first
+/claude-routing sticky-balanced
+/claude-routing reset
 
 /claude-quota
 ```
 
-`/claude-quota` reports sidecar OAuth fallback quota state from `~/.pi/agent/anthropic-auth.json`. `/claude-routing fallback-first` prefers usable OAuth fallback accounts before the main account; `/claude-routing main-first` restores the default. API-key routes use the same sidecar shape as OpenCode and are sent directly to their configured Anthropic-compatible base URL, such as Kie's `https://api.kie.ai/claude`, but Pi only uses them after the main OAuth model response reports HTTP 429 or a streaming rate-limit error and a live quota check confirms 0% remaining. `/claude-cachekeep HH-HH` keeps recently used hybrid-mode session caches warm during the configured local time window by sending `max_tokens: 0` pre-warm requests about five minutes before the 1-hour TTL expires. `/claude-fast on` adds Anthropic `speed: "fast"` plus the `fast-mode-2026-02-01` beta header for supported Opus models (`claude-opus-4-6`, `claude-opus-4-7`, and `claude-opus-4-8`).
+`/claude-quota` reports sidecar OAuth fallback quota state from `~/.pi/agent/anthropic-auth.json`. `/claude-routing fallback-first` prefers usable OAuth fallback accounts before the main account; `/claude-routing main-first` restores the default. `/claude-routing sticky-balanced` assigns each Pi session to an OAuth account according to current 5-hour, 7-day, and matching model-scoped quota headroom, then persists that assignment across transient failures and process restarts. `/claude-routing reset` clears the current Pi session's assignment. Direct Opus sessions prefer usable accounts whose Fable quota is exhausted. API-key routes use the same sidecar shape as OpenCode and are sent directly to their configured Anthropic-compatible base URL, such as Kie's `https://api.kie.ai/claude`, but Pi only uses them after the main OAuth model response reports HTTP 429 or a streaming rate-limit error and a live quota check confirms 0% remaining. `/claude-cachekeep always` keeps active hybrid caches warm while Pi remains open; `/claude-cachekeep HH-HH` limits prewarms to a local time window. Both send `max_tokens: 0` pre-warm requests about five minutes before the 1-hour TTL expires. Running `/claude-cachekeep` without arguments lists live tracked sessions across Pi processes through a temporary lease registry that stores only session IDs and cache timing. `/claude-fast on` adds Anthropic `speed: "fast"` plus the `fast-mode-2026-02-01` beta header for supported Opus models (`claude-opus-4-6`, `claude-opus-4-7`, and `claude-opus-4-8`).
 
 ## Relay
 

package/dist/commands.js

@@ -1,5 +1,6 @@
-import { buildClaudeQuotaSummary, buildFallbackQuotaSummaries, CLAUDE_ACCOUNT_COMMAND_NAME, CLAUDE_CACHE_KEEP_COMMAND_NAME, CLAUDE_ROUTING_COMMAND_NAME, createEmptyStorage, executeAccountCommand, executeCache1hCommand, executeCacheKeepCommand, executeDumpCommand, executeFastModeCommand, executeLoggingCommand, executeRoutingCommand, getCache1hPersistentMode, getCacheKeepWindow, getPersistedLogLevel, getRoutingMode, isCache1hPersistentlyEnabled, isCacheKeepHybridActive, isCacheKeepPersistentlyEnabled, isDumpPersistentlyEnabled, isFastModePersistentlyEnabled, loadAccounts, parseCache1hCommandAction, parseCacheKeepCommandAction, parseDumpCommandAction, parseFastModeCommandAction, parseLoggingCommandAction, parseRoutingCommandAction, removeAccountPersistent, reorderAccountsPersistent, setAccountEnabledPersistent, setCache1hPersistentEnabled, setCache1hPersistentMode, setCacheKeepPersistentEnabled, setCacheKeepPersistentWindow, setCacheKeepSubagentsEnabled, setDumpEnabled, setDumpPersistentEnabled, setFastModePersistentEnabled, setLogLevelPersistent, setRoutingMode, } from '@cortexkit/anthropic-auth-core';
+import { buildClaudeQuotaSummary, buildFallbackQuotaSummaries, CLAUDE_ACCOUNT_COMMAND_NAME, CLAUDE_CACHE_KEEP_COMMAND_NAME, CLAUDE_ROUTING_COMMAND_NAME, createEmptyStorage, executeAccountCommand, executeCache1hCommand, executeCacheKeepCommand, executeDumpCommand, executeFastModeCommand, executeLoggingCommand, executeRoutingCommand, getCache1hPersistentMode, getCacheKeepWindow, getPersistedLogLevel, getRoutingMode, isCache1hPersistentlyEnabled, isCacheKeepAlways, isCacheKeepHybridActive, isCacheKeepPersistentlyEnabled, isDumpPersistentlyEnabled, isFastModePersistentlyEnabled, loadAccounts, parseCache1hCommandAction, parseCacheKeepCommandAction, parseDumpCommandAction, parseFastModeCommandAction, parseLoggingCommandAction, parseRoutingCommandAction, removeAccountPersistent, reorderAccountsPersistent, setAccountEnabledPersistent, setCache1hPersistentEnabled, setCache1hPersistentMode, setCacheKeepPersistentAlways, setCacheKeepPersistentEnabled, setCacheKeepPersistentWindow, setCacheKeepSubagentsEnabled, setDumpEnabled, setDumpPersistentEnabled, setFastModePersistentEnabled, setLogLevelPersistent, setRoutingMode, } from '@cortexkit/anthropic-auth-core';
 import { getPiAccountStoragePath } from "./paths.js";
+import { clearPiStickyRoutingSession, getPiTrackedCacheKeepSessions, } from "./stream.js";
 function notify(ctx, message, kind = 'info') {
     ctx.ui.notify(message, kind);
 }
@@ -35,7 +36,7 @@ export function registerCommands(pi) {
         },
     });
     pi.registerCommand(CLAUDE_CACHE_KEEP_COMMAND_NAME, {
-        description: 'Keep hybrid Claude cache warm during a local time window',
+        description: 'Keep hybrid Claude cache warm always or during a local time window',
         handler: async (args, ctx) => {
             const path = getPiAccountStoragePath();
             let storage = await loadAccounts(path);
@@ -43,17 +44,28 @@ export function registerCommands(pi) {
             if (action.type === 'window') {
                 storage = await setCacheKeepPersistentWindow(action.startHour, action.endHour, path);
             }
+            else if (action.type === 'always') {
+                storage = await setCacheKeepPersistentAlways(path);
+            }
             else if (action.type === 'disable') {
                 storage = await setCacheKeepPersistentEnabled(false, path);
             }
             else if (action.type === 'subagents') {
                 storage = await setCacheKeepSubagentsEnabled(action.enabled, path);
             }
+            const trackedSessionDetails = await getPiTrackedCacheKeepSessions();
+            const nextPrewarmAt = trackedSessionDetails.length
+                ? Math.min(...trackedSessionDetails.map((session) => session.nextPrewarmAt))
+                : undefined;
             notify(ctx, executeCacheKeepCommand({
                 argumentsText: args ?? '',
                 enabled: isCacheKeepPersistentlyEnabled(storage),
+                always: isCacheKeepAlways(storage),
                 window: getCacheKeepWindow(storage),
                 hybridActive: isCacheKeepHybridActive(storage),
+                trackedSessions: trackedSessionDetails.length,
+                trackedSessionDetails,
+                nextPrewarmAt,
             }), action.type === 'usage' ? 'warning' : 'info');
         },
     });
@@ -116,6 +128,9 @@ export function registerCommands(pi) {
             if (action.type === 'mode') {
                 storage = await setRoutingMode(action.mode, path);
             }
+            else if (action.type === 'reset') {
+                await clearPiStickyRoutingSession(path, ctx.sessionManager.getSessionId());
+            }
             notify(ctx, executeRoutingCommand({
                 argumentsText: args ?? '',
                 mode: getRoutingMode(storage),

package/dist/stream.d.ts

@@ -1,5 +1,7 @@
 import { type ApiKeyAccount } from '@cortexkit/anthropic-auth-core';
 import { type Api, type AssistantMessageEventStream, type Context, type Model, type SimpleStreamOptions } from '@earendil-works/pi-ai';
+export declare function clearPiStickyRoutingSession(storagePath: string, sessionId: string): Promise<void>;
+export declare function getPiTrackedCacheKeepSessions(): Promise<import("@cortexkit/anthropic-auth-core").CacheKeepTrackedSession[]>;
 type AnthropicEvent = {
     type?: string;
     index?: number;

package/dist/stream.js

@@ -1,12 +1,68 @@
-import { applyClaudeCodeHeaders, CACHE_KEEP_EXTENDED_TTL_BETA, CacheKeepManager, dumpDirectRequest, FAST_MODE_BETA, FallbackAccountManager, getCache1hPersistentMode, getRelayConfig, getRoutingMode, isApiKeyAccount, isCache1hPersistentlyEnabled, isCacheKeepHybridActive, isDumpPersistentlyEnabled, isFastModePersistentlyEnabled, isOAuthAccount, isValidApiBaseURL, loadAccounts, mergeAnthropicBetas, QuotaManager, quotaSnapshotModelScopeIsExhausted, resolveClaudeCodeIdentity, sendViaRelay, setDumpEnabled, shouldFallbackStatus, } from '@cortexkit/anthropic-auth-core';
+import { applyClaudeCodeHeaders, CACHE_KEEP_EXTENDED_TTL_BETA, CacheKeepManager, CacheKeepSessionRegistry, decideStickyQuotaFailure, dumpDirectRequest, FAST_MODE_BETA, FallbackAccountManager, getCache1hPersistentMode, getDefaultCacheKeepRegistryDirectory, getRelayConfig, getRoutingMode, getStickyRoutingStatePath, isApiKeyAccount, isCache1hPersistentlyEnabled, isCacheKeepHybridActive, isDumpPersistentlyEnabled, isFastModePersistentlyEnabled, isKillswitchEnabled, isOAuthAccount, isPermanentRefreshError, isValidApiBaseURL, killswitchPassesPolicy, loadAccounts, mergeAnthropicBetas, QuotaManager, quotaSnapshotModelScopeIsExhausted, quotaSnapshotPassesModelScope, quotaSnapshotPassesPolicy, resolveClaudeCodeIdentity, STICKY_ROUTING_MAIN_ACCOUNT_ID, StickySessionRouter, sendViaRelay, setDumpEnabled, shouldFallbackStatus, stickyQuotaSnapshotIsFresh, stickyRetryAfterWithJitter, stickyRouteFamilyForModel, } from '@cortexkit/anthropic-auth-core';
 import { calculateCost, createAssistantMessageEventStream, } from '@earendil-works/pi-ai';
 import { buildAnthropicRequest, fromClaudeCodeToolName } from "./convert.js";
 import { getPiAccountStoragePath } from "./paths.js";
 function errorText(error) {
     return error instanceof Error ? error.message : String(error);
 }
+let cacheKeepRegistry;
+let cacheKeepRegistryDirectory;
+const stickyRouters = new Map();
+const quotaManagers = new Map();
+const fallbackManagers = new Map();
+const PI_SERVICE_CACHE_LIMIT = 16;
+function setBoundedService(map, key, value) {
+    map.delete(key);
+    map.set(key, value);
+    while (map.size > PI_SERVICE_CACHE_LIMIT) {
+        const oldest = map.keys().next().value;
+        if (oldest === undefined)
+            break;
+        map.delete(oldest);
+    }
+}
+function getPiRoutingServices(storagePath, storage) {
+    let quotaManager = quotaManagers.get(storagePath);
+    let fallbackManager = fallbackManagers.get(storagePath);
+    if (!quotaManager || !fallbackManager) {
+        quotaManager = new QuotaManager({ storage });
+        fallbackManager = new FallbackAccountManager({
+            configPath: storagePath,
+            quotaManager,
+        });
+        setBoundedService(quotaManagers, storagePath, quotaManager);
+        setBoundedService(fallbackManagers, storagePath, fallbackManager);
+    }
+    else {
+        quotaManager.updateStorage(storage);
+    }
+    return { quotaManager, fallbackManager };
+}
+function getPiStickyRouter(storagePath) {
+    const path = process.env.PI_ANTHROPIC_AUTH_ROUTING_STATE_FILE ||
+        getStickyRoutingStatePath(storagePath);
+    let router = stickyRouters.get(path);
+    if (!router) {
+        router = new StickySessionRouter({ path });
+        setBoundedService(stickyRouters, path, router);
+    }
+    return router;
+}
+export async function clearPiStickyRoutingSession(storagePath, sessionId) {
+    await getPiStickyRouter(storagePath).clear(sessionId);
+}
+function getPiCacheKeepRegistry() {
+    const directory = process.env.PI_ANTHROPIC_AUTH_CACHEKEEP_REGISTRY_DIR ||
+        getDefaultCacheKeepRegistryDirectory('pi');
+    if (!cacheKeepRegistry || cacheKeepRegistryDirectory !== directory) {
+        cacheKeepRegistry = new CacheKeepSessionRegistry({ directory });
+        cacheKeepRegistryDirectory = directory;
+    }
+    return cacheKeepRegistry;
+}
 const cacheKeepManager = new CacheKeepManager({
     loadStorage: () => loadAccounts(getPiAccountStoragePath()),
+    onTrackedSessionsChanged: (sessions) => getPiCacheKeepRegistry().publish(sessions),
     prepareHeaders: async (headers, target) => {
         const authorization = headers.get('authorization') ?? '';
         const match = /^Bearer\s+(.+)$/i.exec(authorization);
@@ -31,6 +87,9 @@ const cacheKeepManager = new CacheKeepManager({
         return headers;
     },
 });
+export async function getPiTrackedCacheKeepSessions() {
+    return getPiCacheKeepRegistry().list(cacheKeepManager.trackedSessions());
+}
 function mapStopReason(reason) {
     switch (reason) {
         case 'end_turn':
@@ -178,13 +237,15 @@ async function sendAnthropicRequest(options) {
         bodyText,
         storage,
         cacheMode: isCacheKeepHybridActive(storage) ? 'hybrid' : 'disabled',
+        oauthAccountId: options.oauthAccountId,
     });
     const directFetch = async () => {
         try {
             const response = await fetch(input, init);
             await dumpDirectRequest({
                 affinity: relayAffinity,
-                route: options.apiAccount ? `api:${options.apiAccount.id}` : 'oauth',
+                route: options.route ??
+                    (options.apiAccount ? `api:${options.apiAccount.id}` : 'oauth'),
                 status: response.status,
                 bodyText,
                 url: input.toString(),
@@ -196,7 +257,8 @@ async function sendAnthropicRequest(options) {
         catch (error) {
             await dumpDirectRequest({
                 affinity: relayAffinity,
-                route: options.apiAccount ? `api:${options.apiAccount.id}` : 'oauth',
+                route: options.route ??
+                    (options.apiAccount ? `api:${options.apiAccount.id}` : 'oauth'),
                 error: errorText(error),
                 bodyText,
                 url: input.toString(),
@@ -245,11 +307,93 @@ async function firstStreamingError(response) {
     return response;
 }
 async function executeWithFallback(options) {
-    const manager = new FallbackAccountManager({
-        configPath: options.storagePath,
-    });
     const storage = await loadAccounts(options.storagePath);
-    const quotaManager = new QuotaManager({ storage });
+    const { quotaManager, fallbackManager: manager } = getPiRoutingServices(options.storagePath, storage);
+    quotaManager.seedMainFromStorage(storage, options.primaryAccessToken);
+    quotaManager.seedFallbacksFromAccounts((storage?.accounts ?? []).filter(isOAuthAccount));
+    async function buildStickyRoutes(modelId) {
+        const mainEntry = quotaManager.getMain(options.primaryAccessToken);
+        let mainQuota = mainEntry?.quota;
+        if (!stickyQuotaSnapshotIsFresh(mainEntry?.quota, storage, Date.now(), modelId)) {
+            try {
+                mainQuota = await quotaManager.refreshMain(options.primaryAccessToken);
+            }
+            catch { }
+        }
+        const usableFallbacks = await manager.getUsableFallbackAccounts(storage, {
+            modelId,
+        });
+        const usableById = new Map(usableFallbacks.map((account) => [account.id, account]));
+        const allRoutes = [];
+        if (!isPermanentRefreshError(storage?.refresh?.mainLastRefreshError)) {
+            allRoutes.push({
+                id: STICKY_ROUTING_MAIN_ACCOUNT_ID,
+                access: options.primaryAccessToken,
+                quota: mainQuota,
+                order: 0,
+            });
+        }
+        for (const [index, configured] of (storage?.accounts ?? []).entries()) {
+            if (configured.enabled === false || !isOAuthAccount(configured))
+                continue;
+            const account = usableById.get(configured.id) ?? configured;
+            if (!account.access || isPermanentRefreshError(account.lastRefreshError))
+                continue;
+            let accountQuota = quotaManager.getFallback(account.id, account.access)?.quota ??
+                account.quota;
+            if (!stickyQuotaSnapshotIsFresh(accountQuota, storage, Date.now(), modelId)) {
+                try {
+                    accountQuota = await quotaManager.refreshFallback(account.id, account.access);
+                }
+                catch { }
+            }
+            allRoutes.push({
+                id: account.id,
+                access: account.access,
+                quota: accountQuota,
+                order: index + 1,
+                account,
+            });
+        }
+        const retainAccountIds = new Set(allRoutes.flatMap((route) => {
+            const refreshError = route.id === STICKY_ROUTING_MAIN_ACCOUNT_ID
+                ? storage?.refresh?.mainLastRefreshError
+                : route.account?.lastRefreshError;
+            if (isPermanentRefreshError(refreshError))
+                return [];
+            if (stickyQuotaSnapshotIsFresh(route.quota, storage, Date.now(), modelId) &&
+                decideStickyQuotaFailure({ quota: route.quota, modelId }).action ===
+                    'migrate') {
+                return [];
+            }
+            if (isKillswitchEnabled(storage) &&
+                !killswitchPassesPolicy(route.quota, storage, route.id === STICKY_ROUTING_MAIN_ACCOUNT_ID ? undefined : route.id, modelId)) {
+                return [];
+            }
+            return [route.id];
+        }));
+        const usableIds = new Set(usableFallbacks.map((account) => account.id));
+        const candidates = allRoutes.flatMap((route) => {
+            if (!route.quota)
+                return [];
+            const accountId = route.id === STICKY_ROUTING_MAIN_ACCOUNT_ID ? undefined : route.id;
+            const passes = quotaSnapshotPassesPolicy(route.quota, storage) &&
+                quotaSnapshotPassesModelScope(route.quota, modelId) &&
+                (!isKillswitchEnabled(storage) ||
+                    killswitchPassesPolicy(route.quota, storage, accountId, modelId)) &&
+                (route.id === STICKY_ROUTING_MAIN_ACCOUNT_ID || usableIds.has(route.id));
+            return passes
+                ? [
+                    {
+                        accountId: route.id,
+                        quota: route.quota,
+                        order: route.order,
+                    },
+                ]
+                : [];
+        });
+        return { allRoutes, candidates, retainAccountIds };
+    }
     async function primaryQuotaRefreshConfirmsExhausted() {
         try {
             const quota = await quotaManager.refreshMain(options.primaryAccessToken);
@@ -282,7 +426,7 @@ async function executeWithFallback(options) {
     function primaryFreshModelScopeExhausted() {
         const entry = quotaManager.getMain(options.primaryAccessToken);
         return Boolean(entry &&
-            entry.refreshAfter > Date.now() &&
+            !quotaManager.isMainStale(options.model.id) &&
             quotaSnapshotModelScopeIsExhausted(entry.quota, options.model.id));
     }
     async function tryFallbackAccounts(routeOptions = {}) {
@@ -298,7 +442,7 @@ async function executeWithFallback(options) {
             if (!account)
                 continue;
             if (isOAuthAccount(account)) {
-                if (!account.access)
+                if (routeOptions.apiOnly === true || !account.access)
                     continue;
                 response = await sendAnthropicRequest({
                     ...options,
@@ -330,7 +474,191 @@ async function executeWithFallback(options) {
         }
         return null;
     }
-    const fallbackFirst = getRoutingMode(storage) === 'fallback-first';
+    const routingMode = getRoutingMode(storage);
+    if (routingMode === 'sticky-balanced' && options.streamOptions?.sessionId) {
+        const sessionId = options.streamOptions.sessionId;
+        const router = getPiStickyRouter(options.storagePath);
+        const initialInputBytes = Math.max(1, Buffer.byteLength(JSON.stringify(options.context)));
+        let routes = await buildStickyRoutes(options.model.id);
+        const incompleteQuotaPool = routes.allRoutes.length === 0 ||
+            routes.allRoutes.some((candidate) => !candidate.quota ||
+                !stickyQuotaSnapshotIsFresh(candidate.quota, storage, Date.now(), options.model.id));
+        let resolution = await router.resolve({
+            sessionId,
+            family: stickyRouteFamilyForModel(options.model.id),
+            modelId: options.model.id,
+            candidates: routes.candidates,
+            retainAccountIds: routes.retainAccountIds,
+            storage,
+            inputBytes: initialInputBytes,
+        });
+        if (!resolution && incompleteQuotaPool) {
+            const error = new Error('Sticky-balanced routing is waiting for current OAuth quota snapshots');
+            Object.assign(error, {
+                code: 'ECONNRESET',
+                syscall: 'sticky-routing',
+            });
+            throw error;
+        }
+        let route = routes.allRoutes.find((candidate) => candidate.id === resolution?.accountId);
+        if (resolution && route) {
+            const sendRoute = (selected) => sendAnthropicRequest({
+                ...options,
+                accessToken: selected.access,
+                oauthAccountId: selected.id,
+                route: `sticky:${selected.id}`,
+            });
+            const completeRoute = async (selected, response, markUsed = true) => {
+                if (markUsed && selected.account)
+                    await manager.markUsed(selected.account);
+                return response;
+            };
+            const proactiveQuotaDecision = stickyQuotaSnapshotIsFresh(route.quota, storage, Date.now(), options.model.id)
+                ? decideStickyQuotaFailure({
+                    quota: route.quota,
+                    modelId: options.model.id,
+                })
+                : undefined;
+            if (proactiveQuotaDecision?.action === 'hold') {
+                return completeRoute(route, new Response(JSON.stringify({
+                    type: 'error',
+                    error: {
+                        type: 'rate_limit_error',
+                        message: 'Sticky OAuth account five-hour quota resets shortly; retaining session affinity.',
+                    },
+                }), {
+                    status: 429,
+                    headers: {
+                        'content-type': 'application/json',
+                        'retry-after': String(stickyRetryAfterWithJitter(sessionId, proactiveQuotaDecision.retryAfterSeconds)),
+                    },
+                }), false);
+            }
+            let response = await sendRoute(route);
+            let preflight = await firstStreamingError(response);
+            if (preflight instanceof Response && preflight.ok) {
+                return completeRoute(route, preflight);
+            }
+            let permanentAuthFailure = preflight instanceof Response &&
+                preflight.status === 401 &&
+                route.id === STICKY_ROUTING_MAIN_ACCOUNT_ID;
+            if (preflight instanceof Response &&
+                preflight.status === 401 &&
+                route.account &&
+                storage) {
+                const authRouteId = route.id;
+                try {
+                    const refreshed = await manager.refreshAccount(route.account, storage, {
+                        force: true,
+                    });
+                    if (refreshed.access) {
+                        route = { ...route, access: refreshed.access, account: refreshed };
+                    }
+                    await preflight.body?.cancel().catch(() => { });
+                    response = await sendRoute(route);
+                    preflight = await firstStreamingError(response);
+                    if (preflight instanceof Response && preflight.ok) {
+                        return completeRoute(route, preflight);
+                    }
+                    permanentAuthFailure =
+                        preflight instanceof Response && preflight.status === 401;
+                }
+                catch (error) {
+                    const latest = await loadAccounts(options.storagePath);
+                    const refreshError = latest?.accounts.find((account) => account.id === authRouteId && isOAuthAccount(account))?.lastRefreshError;
+                    if (!isPermanentRefreshError(refreshError))
+                        throw error;
+                    permanentAuthFailure = true;
+                }
+            }
+            let migrate = (preflight instanceof Response && preflight.status === 403) ||
+                permanentAuthFailure;
+            if (primaryResponseAllowsApiFallback(preflight)) {
+                let quota;
+                try {
+                    quota =
+                        route.id === STICKY_ROUTING_MAIN_ACCOUNT_ID
+                            ? await quotaManager.refreshMain(route.access)
+                            : await quotaManager.refreshFallback(route.id, route.access);
+                }
+                catch {
+                    // Retain affinity when the quota probe itself is unavailable.
+                    quota = undefined;
+                }
+                const decision = decideStickyQuotaFailure({
+                    quota,
+                    modelId: options.model.id,
+                });
+                if (decision.action === 'hold') {
+                    const headers = new Headers(preflight instanceof Response
+                        ? preflight.headers
+                        : response.headers);
+                    headers.set('retry-after', String(stickyRetryAfterWithJitter(sessionId, decision.retryAfterSeconds)));
+                    if (preflight instanceof Response) {
+                        return completeRoute(route, new Response(preflight.body, {
+                            status: preflight.status,
+                            statusText: preflight.statusText,
+                            headers,
+                        }));
+                    }
+                    await response.body?.cancel().catch(() => { });
+                    headers.set('content-type', 'application/json');
+                    return completeRoute(route, new Response(JSON.stringify({
+                        type: 'error',
+                        error: {
+                            type: 'rate_limit_error',
+                            message: 'Sticky OAuth account five-hour quota resets shortly; retaining session affinity.',
+                        },
+                    }), { status: 429, headers }));
+                }
+                migrate = decision.action === 'migrate';
+            }
+            if (migrate) {
+                const failedRouteId = route.id;
+                routes = await buildStickyRoutes(options.model.id);
+                if (routes.candidates.some((candidate) => candidate.accountId !== failedRouteId)) {
+                    if (preflight instanceof Response) {
+                        await preflight.body?.cancel().catch(() => { });
+                    }
+                    else {
+                        await response.body?.cancel().catch(() => { });
+                    }
+                    resolution = await router.resolve({
+                        sessionId,
+                        family: stickyRouteFamilyForModel(options.model.id),
+                        modelId: options.model.id,
+                        candidates: routes.candidates,
+                        retainAccountIds: routes.retainAccountIds,
+                        storage,
+                        inputBytes: initialInputBytes,
+                        excludeAccountIds: new Set([failedRouteId]),
+                    });
+                    const migrated = routes.allRoutes.find((candidate) => candidate.id === resolution?.accountId);
+                    if (resolution && migrated) {
+                        route = migrated;
+                        return completeRoute(route, await sendRoute(route));
+                    }
+                }
+                if (primaryResponseAllowsApiFallback(preflight) &&
+                    (await primaryQuotaRefreshConfirmsExhausted())) {
+                    if (preflight instanceof Response) {
+                        await preflight.body?.cancel().catch(() => { });
+                    }
+                    else {
+                        await response.body?.cancel().catch(() => { });
+                    }
+                    const apiFallback = await tryFallbackAccounts({
+                        includeApiRoutes: true,
+                        apiOnly: true,
+                    });
+                    if (apiFallback)
+                        return apiFallback;
+                }
+            }
+            return completeRoute(route, preflight instanceof Response ? preflight : response);
+        }
+    }
+    const fallbackFirst = routingMode === 'fallback-first';
     if (fallbackFirst) {
         const fallback = await tryFallbackAccounts();
         if (fallback)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cortexkit/pi-anthropic-auth",
-  "version": "1.15.1",
+  "version": "1.17.0",
   "type": "module",
   "repository": {
     "type": "git",
@@ -36,7 +36,7 @@
     "prepublishOnly": "bun run build"
   },
   "dependencies": {
-    "@cortexkit/anthropic-auth-core": "1.15.1"
+    "@cortexkit/anthropic-auth-core": "1.17.0"
   },
   "peerDependencies": {
     "@earendil-works/pi-ai": "*",