@iislee/opencodex 2.11.0 → 2.35.0

package/src/oauth/index.ts

@@ -1,19 +1,24 @@
 import type { KiroOAuthMetadata, OAuthController, OAuthCredentials } from "./types";
 import { parseCallbackInput } from "./callback-server";
 import type { OcxConfig, OcxProviderConfig, RefreshPolicy } from "../types";
+import { maskEmail } from "../lib/privacy";
 import { loadConfig, resolveEnvValue, saveConfig } from "../config";
 import { KiroTokenRefreshError, environmentKiroRoutingMetadata, loginKiro, refreshKiroToken, settleKiroLoginTransaction } from "./kiro";
-import { getAccountCredential, getAccountSet, removeAccount, saveAccountCredential, saveCredential, setActiveAccount, getCredential, credentialGeneration, createOAuthRefreshIntentLock, mergeAccountCredential, markAccountNeedsReauthIfGeneration, readOAuthRefreshIntent, writeOAuthRefreshIntent, markOAuthRefreshIntentStaleOwner, clearOAuthRefreshIntent, OAuthMutationBusyError } from "./store";
+import { getAccountCredential, getAccountSet, removeAccount, saveAccountCredential, saveCredential, setActiveAccount, getCredential, credentialGeneration, createOAuthRefreshIntentLock, mergeAccountCredential, markAccountNeedsReauthIfGeneration, readOAuthRefreshIntent, writeOAuthRefreshIntent, markOAuthRefreshIntentStaleOwner, clearOAuthRefreshIntent, normalizeAuthStoreBuffer, OAuthMutationBusyError } from "./store";
 import { loginXai, refreshXaiToken, XAI_LOCAL_CLI_DETACH_WARNING, XaiTokenRequestError } from "./xai";
 import { ANTHROPIC_OAUTH_BETA, AnthropicTokenError, loginAnthropic, refreshAnthropicToken } from "./anthropic";
 import { loginKimi, refreshKimiToken } from "./kimi";
+import { loginNous, NousTokenError, refreshNousToken, clearNousRefreshIntent, RefreshIntentIOError } from "./nous";
 import { loginChatGPT, refreshChatGPTToken } from "./chatgpt";
 import { loginAntigravity, refreshAntigravityToken } from "./google-antigravity";
 import { loginCursor, refreshCursorToken } from "./cursor";
 import { loginGithubCopilot, refreshGithubCopilotToken, validateCopilotApiBaseUrl } from "./github-copilot";
+import { loginCommandCode, refreshCommandCodeToken } from "./command-code";
+import { loginCline, refreshClineToken } from "./cline";
+import { ANTIGRAVITY_REQUEST_UA } from "../adapters/google-antigravity-wire";
 import { deriveOAuthDefaultModel, deriveOAuthProviderConfig } from "../providers/derive";
 import { apiKeyPoolEntryId, sanitizeApiKeyValue } from "../providers/api-keys";
-import { effectiveGoogleMode, getProviderRegistryEntry, providerMatchesRegistryTransport } from "../providers/registry";
+import { effectiveGoogleMode, getProviderRegistryEntry, mergeRegistryStaticHeaders, providerMatchesRegistryTransport } from "../providers/registry";
 import { resolveProviderModelDiscoveryUrl } from "../providers/model-discovery";
 import { resolveProviderTransport } from "../providers/xai-transport";
 import { detectClaudeCodeToken, detectGrokCliToken, hasComparableGrokIdentity, isSameGrokIdentity, shouldAdoptGrokGeneration } from "./local-token-detect";
@@ -51,10 +56,35 @@ export interface OAuthAccessSnapshot {
   accountId: string;
   generation: string;
   accessToken: string;
+  /** Cloud Code Assist project selected during Antigravity login. */
+  projectId?: string;
   /** Safe request-routing subset; refresh-only Kiro client secrets never leave the credential store. */
-  kiro?: Pick<KiroOAuthMetadata, "profileArn" | "apiRegion" | "ssoRegion">;
+  kiro?: Pick<KiroOAuthMetadata, "profileArn" | "apiRegion" | "ssoRegion" | "authType">;
+  /**
+   * Allowlisted GitHub Copilot API origin belonging to THIS account.
+   *
+   * Copilot pins its bearer to an account-scoped regional host, and the initial route already
+   * pairs the two (`core.ts` resolves transport with `getOAuthCredentialApiBaseUrl`). Account
+   * failover must carry the pairing across the rotation; without it, account B's token is sent to
+   * account A's origin (#2568d).
+   */
+  apiBaseUrl?: string;
 }
 
+export interface ObservedOAuthAccessSnapshot extends OAuthAccessSnapshot {
+  /** Retained for callers that predate `apiBaseUrl` moving onto the base snapshot. */
+  apiBaseUrl?: string;
+}
+
+export type OAuthActiveTokenObservation =
+  | { readonly kind: "available"; readonly snapshot: ObservedOAuthAccessSnapshot }
+  | { readonly kind: "missing" }
+  | { readonly kind: "malformed" }
+  | { readonly kind: "needs-reauth" }
+  | { readonly kind: "expired" }
+  | { readonly kind: "near-expiry" }
+  | { readonly kind: "unsupported" };
+
 const MAX_OAUTH_TOKEN_REFRESH_FLIGHTS = 32;
 const OAUTH_TOKEN_REFRESH_FLIGHT_STALE_MS = 120_000;
 interface OAuthRefreshFlightEvidence { flightId: string; dispatched: boolean }
@@ -145,6 +175,14 @@ function oauthDefaultModel(id: string): string {
 }
 
 export const OAUTH_PROVIDERS: Record<string, OAuthProviderDef> = {
+  "command-code": {
+    // Add-account/reauth must not reimport the current local CLI credential.
+    login: (ctrl, opts) => loginCommandCode(ctrl, { importLocal: opts?.forceLogin ? "off" : "fallback" }),
+    refresh: refreshCommandCodeToken,
+    providerConfig: oauthConfig("command-code"),
+    defaultModel: oauthDefaultModel("command-code"),
+    defaultRefreshPolicy: "disabled",
+  },
   xai: {
     // forceLogin skips the local grok-cli import so a SECOND account can be chosen in the browser.
     login: (ctrl, opts) => loginXai(ctrl, { importLocal: opts?.forceLogin ? "off" : "fallback" }),
@@ -167,6 +205,22 @@ export const OAUTH_PROVIDERS: Record<string, OAuthProviderDef> = {
     providerConfig: oauthConfig("kimi"),
     defaultModel: oauthDefaultModel("kimi"),
   },
+  nous: {
+    // Nous Portal device-grant login (RFC 8628) against portal.nousresearch.com.
+    // The access token is the per-request inference JWT (scope inference:invoke).
+    // Refresh tokens are single-use and rotated server-side on every refresh:
+    // keep background refresh lazy-only (the default) so concurrent refreshes
+    // cannot trip the Portal's token-reuse revocation.
+    login: (ctrl) => loginNous(ctrl),
+    refresh: (rt, signal) => refreshNousToken(rt, signal),
+    providerConfig: oauthConfig("nous"),
+    defaultModel: oauthDefaultModel("nous"),
+    // Single-use rotating refresh tokens must never be background-refreshed
+    // proactively: concurrent refreshes would trip the Portal's reuse
+    // revocation. Anchor the lazy-only default explicitly so it cannot be
+    // silently overridden to proactive.
+    defaultRefreshPolicy: "lazy-only",
+  },
   kiro: {
     login: (ctrl, opts) => loginKiro(ctrl, { forceLogin: opts?.forceLogin }),
     refresh: (rt, signal, credential) => refreshKiroToken(rt, signal, credential),
@@ -180,7 +234,7 @@ export const OAUTH_PROVIDERS: Record<string, OAuthProviderDef> = {
     defaultModel: oauthDefaultModel("google-antigravity"),
   },
   cursor: {
-    login: (ctrl) => loginCursor(ctrl),
+    login: (ctrl, opts) => loginCursor(ctrl, undefined, { forceLogin: opts?.forceLogin }),
     refresh: refreshCursorToken,
     providerConfig: oauthConfig("cursor"),
     defaultModel: oauthDefaultModel("cursor"),
@@ -193,6 +247,12 @@ export const OAUTH_PROVIDERS: Record<string, OAuthProviderDef> = {
     // Unofficial Copilot bridge — keep proactive traffic lazy-only (no background guardian spam).
     defaultRefreshPolicy: "lazy-only",
   },
+  cline: {
+    login: (ctrl, opts) => loginCline(ctrl, { importLocal: opts?.forceLogin ? "off" : "fallback", forceLogin: opts?.forceLogin }),
+    refresh: refreshClineToken,
+    providerConfig: oauthConfig("cline"),
+    defaultModel: oauthDefaultModel("cline"),
+  },
   chatgpt: {
     login: loginChatGPT,
     refresh: (rt) => refreshChatGPTToken(rt),
@@ -248,35 +308,138 @@ export class UnsupportedOAuthProviderError extends Error {
 }
 
 export class OAuthLoginRequiredError extends Error {
+  readonly provider: string;
+
   constructor(provider: string) {
     super(`Not logged in to ${provider}. Run: ocx login ${provider}`);
     this.name = "OAuthLoginRequiredError";
+    this.provider = provider;
+  }
+}
+
+export class OAuthProviderPublicationError extends Error {
+  constructor() {
+    super("OAuth credential was saved, but the provider entry was not written. Resolve the account namespace collision, then retry login.");
+    this.name = "OAuthProviderPublicationError";
+  }
+}
+
+export class OAuthReauthIdentityMismatchError extends Error {
+  constructor() {
+    super("Signed-in account does not match the selected account. Sign in with the same account.");
+    this.name = "OAuthReauthIdentityMismatchError";
+  }
+}
+
+export class OAuthReauthIdentityUnverifiedError extends Error {
+  constructor() {
+    super("Could not verify signed-in account identity for reauth.");
+    this.name = "OAuthReauthIdentityUnverifiedError";
   }
 }
 
+class OAuthLoginSupersededError extends Error {
+  constructor() {
+    super("OAuth login was superseded before credential persistence");
+    this.name = "OAuthLoginSupersededError";
+  }
+}
+
+/** Project arbitrary OAuth failures onto the small, stable public error vocabulary. */
+export function publicOAuthAuthenticationErrorMessage(error: unknown): string {
+  if (error instanceof OAuthMutationBusyError) {
+    return error.message === "OAuth mutation queue wait timed out"
+      ? "OAuth mutation queue wait timed out"
+      : "OAuth mutation queue is busy";
+  }
+  if (
+    (error instanceof OAuthLoginRequiredError && isOAuthProvider(error.provider))
+    || error instanceof OAuthProviderPublicationError
+    // Reauth identity outcomes carry fixed, account-free remediation text. Dropping them to the
+    // generic message hides WHICH failure the user must fix (sign in with the selected account).
+    || error instanceof OAuthReauthIdentityMismatchError
+    || error instanceof OAuthReauthIdentityUnverifiedError
+    || error instanceof OAuthTokenRefreshBusyError
+    || error instanceof OAuthTokenRefreshStaleError
+  ) return error.message;
+  return "OAuth authentication failed. Check the OpenCodex account status and retry.";
+}
+
 function accessSnapshot(provider: string, accountId: string, cred: OAuthCredentials): OAuthAccessSnapshot {
+  // Derived, not read back: a stored `authType` is trusted when present, but a credential imported
+  // before the field existed still routes correctly because the client pair implies SSO OIDC.
+  const kiroAuthType = cred.kiro?.authType
+    ?? (cred.kiro?.clientId && cred.kiro?.clientSecret ? "aws_sso_oidc" as const : undefined);
   const storedKiroRouting = {
     ...(cred.kiro?.profileArn ? { profileArn: cred.kiro.profileArn } : {}),
     ...(cred.kiro?.apiRegion ? { apiRegion: cred.kiro.apiRegion } : {}),
     ...(cred.kiro?.ssoRegion ? { ssoRegion: cred.kiro.ssoRegion } : {}),
   };
+  // `authType` is a property OF the account, not routing the environment can substitute for, so it
+  // is merged after the environment fallback decision rather than counting as stored routing.
+  // Folding it into `storedKiroRouting` would make a client-pair-only credential look non-empty
+  // and silently disable `environmentKiroRoutingMetadata()` for it.
+  const kiroAuthTypeRouting = kiroAuthType ? { authType: kiroAuthType } : {};
+  // Validated here, not at the call site: an unvalidated origin from a legacy or crafted
+  // credential must never travel with a bearer, and dropping it makes the transport fall back to
+  // the canonical host rather than to whatever the previous account was using.
+  const copilotApiBaseUrl = provider === "github-copilot"
+    ? validateCopilotApiBaseUrl(cred.apiBaseUrl)
+    : undefined;
   return {
     provider,
     accountId,
     generation: credentialGeneration(cred),
     accessToken: cred.access,
+    ...(cred.projectId ? { projectId: cred.projectId } : {}),
+    ...(copilotApiBaseUrl ? { apiBaseUrl: copilotApiBaseUrl } : {}),
     // Stored account metadata remains authoritative. Metadata-less legacy/environment credentials
     // may use explicit environment routing, but never borrow the currently signed-in local CLI account.
     ...(provider === "kiro"
       ? {
-          kiro: Object.keys(storedKiroRouting).length > 0
-            ? storedKiroRouting
-            : environmentKiroRoutingMetadata() ?? {},
+          kiro: {
+            ...(Object.keys(storedKiroRouting).length > 0
+              ? storedKiroRouting
+              : environmentKiroRoutingMetadata() ?? {}),
+            ...kiroAuthTypeRouting,
+          },
         }
       : {}),
   };
 }
 
+/**
+ * Observe the active OAuth token from an auth-store buffer supplied by its filesystem owner.
+ * Missing, malformed, reauth-required, and expiring credentials are typed no-token outcomes;
+ * this path never refreshes, locks, hardens, backs up, or persists credentials.
+ */
+export function observeActiveOAuthAccessToken(
+  provider: string,
+  authStoreBuffer: Uint8Array | null,
+  now = Date.now(),
+): OAuthActiveTokenObservation {
+  const authStore = normalizeAuthStoreBuffer(authStoreBuffer);
+  if (authStore.kind === "absent") return { kind: "missing" };
+  if (authStore.kind === "malformed") return { kind: "malformed" };
+  if (!isOAuthProvider(provider)) return { kind: "unsupported" };
+
+  const accountSet = authStore.store[provider];
+  const account = accountSet?.accounts.find(candidate => candidate.id === accountSet.activeAccountId);
+  if (!account) return { kind: "missing" };
+  if (account.needsReauth) return { kind: "needs-reauth" };
+  if (account.credential.expires <= now) return { kind: "expired" };
+  if (account.credential.expires <= now + REFRESH_SKEW_MS) return { kind: "near-expiry" };
+
+  const apiBaseUrl = validateCopilotApiBaseUrl(account.credential.apiBaseUrl);
+  return {
+    kind: "available",
+    snapshot: {
+      ...accessSnapshot(provider, account.id, account.credential),
+      ...(apiBaseUrl ? { apiBaseUrl } : {}),
+    },
+  };
+}
+
 async function resolveAccessSnapshotForAccount(
   provider: string,
   accountId: string,
@@ -339,7 +502,7 @@ export async function getValidAccessTokenSnapshot(provider: string): Promise<OAu
 }
 
 /** Providers whose upstream-401 replay path may force a snapshot refresh. */
-const FORCE_REFRESH_PROVIDERS = new Set(["xai", "github-copilot", "kiro"]);
+const FORCE_REFRESH_PROVIDERS = new Set(["xai", "github-copilot", "kiro", "cline"]);
 
 export async function forceRefreshOAuthAccessSnapshot(
   rejected: OAuthAccessSnapshot,
@@ -362,6 +525,22 @@ export async function getValidAccessTokenForAccount(provider: string, accountId:
   return (await resolveAccessSnapshotForAccount(provider, accountId)).accessToken;
 }
 
+/**
+ * Account-scoped resolver returning the FULL snapshot, not just the bearer.
+ *
+ * A rotator that swaps only the token silently mixes credential generations: Antigravity pairs
+ * an account-matched `projectId` with its token (see the pairing comment in
+ * server/responses/core.ts), Kiro carries routing metadata, and Copilot's observed snapshot
+ * carries an account-specific API origin. Reading those back from "whichever account is active"
+ * after a rotation is exactly the mixing this returns in one piece to prevent (#2568).
+ */
+export async function getValidAccessSnapshotForAccount(
+  provider: string,
+  accountId: string,
+): Promise<OAuthAccessSnapshot> {
+  return resolveAccessSnapshotForAccount(provider, accountId);
+}
+
 /** Terminal refresh failures (revoked/rotated-away grants) — retrying cannot succeed. */
 function isTerminalRefreshError(err: unknown): boolean {
   const msg = (err instanceof Error ? err.message : String(err)).toLowerCase();
@@ -376,6 +555,11 @@ function terminal(error:unknown):boolean{
   if(error instanceof XaiTokenRequestError)return ["invalid_grant","refresh_token_reused","revoked_token"].includes(error.oauthError??"");
   if(error instanceof AnthropicTokenError)return (error.httpStatus===400||error.httpStatus===401)&&["invalid_grant","refresh_token_reused","revoked","revoked_token","refresh_token_revoked"].includes(error.oauthError??"");
   if(error instanceof KiroTokenRefreshError)return (error.httpStatus===400||error.httpStatus===401)&&error.oauthError!==undefined;
+  if(error instanceof NousTokenError)return error.terminal===true||["invalid_grant","refresh_token_reused","revoked","revoked_token","expired_token"].includes(error.oauthError??"");
+  // Local durable-write/read/cleanup failures are operational, not credential
+  // death: the provider credential was never rejected or consumed. Never mark
+  // the account needsReauth for broken local persistence infrastructure.
+  if (error instanceof RefreshIntentIOError) return false;
   return isTerminalRefreshError(error);
 }
 function authoritative(stored:OAuthCredentials,active:boolean,now:()=>number):OAuthCredentials{if(stored.source!=="local-cli")return stored;const disk=detectGrokCliToken();if(!disk)return stored;const allowed=isSameGrokIdentity(stored,disk)||(active&&!hasComparableGrokIdentity(stored,disk));return allowed&&shouldAdoptGrokGeneration(stored,disk,now(),REFRESH_SKEW_MS)?disk:stored;}
@@ -399,6 +583,47 @@ function newerClaudeCredential(stored: OAuthCredentials, now: number): OAuthCred
   return credentialGeneration(disk) !== credentialGeneration(stored) ? disk : undefined;
 }
 
+/**
+ * Preserve an already-rotated Nous refresh token (RT-B) after a terminal refresh
+ * error (e.g. the returned access JWT lacked `inference:invoke`). The unusable
+ * access token is NOT persisted as valid: the recovery credential carries an
+ * empty access placeholder with a past expiry so it can never be routed, and the
+ * account is marked needsReauth by the caller. Generation-safe: a concurrent
+ * newer write wins and is never overwritten.
+ */
+async function preserveNousRotatedRefresh(
+  provider: string,
+  accountId: string,
+  rotatedRefresh: string,
+  expectedGeneration: string,
+  previous: OAuthCredentials,
+): Promise<{ kind: "persisted"; generation: string } | { kind: "superseded" } | { kind: "failed" }> {
+  try {
+    const recovery: OAuthCredentials = {
+      refresh: rotatedRefresh,
+      // Never persist the unusable access token: an empty placeholder with a
+      // past expiry can never be observed as a valid credential.
+      access: "",
+      expires: 0,
+      ...(previous.accountId ? { accountId: previous.accountId } : {}),
+      ...(previous.email ? { email: previous.email } : {}),
+      ...(previous.source ? { source: previous.source } : {}),
+    };
+    const outcome = await mergeAccountCredential(provider, accountId, recovery, { expectedGeneration });
+    if (outcome.superseded) return { kind: "superseded" };
+    // Return the exact generation this write produced, so the caller never
+    // re-reads the store (a concurrent writer could otherwise supply a different
+    // credential generation and be marked needsReauth by mistake).
+    return { kind: "persisted", generation: credentialGeneration(recovery) };
+  } catch (error) {
+    // A store-mutation busy outcome is transient and retryable; surface it
+    // unchanged so the caller can retry rather than treating it as a permanent
+    // RT-B persistence failure.
+    if (error instanceof OAuthMutationBusyError) throw error;
+    return { kind: "failed" };
+  }
+}
+
 export async function refreshAnthropicAccountWithLock(
   provider: string,
   accountId: string,
@@ -512,10 +737,69 @@ export async function refreshGenericAccountWithLock(
         throw new OAuthLoginRequiredError(provider);
       }
       logOAuthEvent("OAuth credentials rotated and persisted", { provider, accountId });
+      // Best-effort bookkeeping cleanup: the rotated credential is already
+      // durably persisted. A failure to unlink the old-token intent file
+      // (EACCES/EPERM/EBUSY/EROFS) must not turn a committed rotation into a
+      // failed refresh. The stale intent keys the OLD token, which is no longer
+      // stored, so leaving it behind blocks nothing and is safe. It must also
+      // never route through the generic refresh error path (no needsReauth).
+      if (provider === "nous") {
+        try {
+          clearNousRefreshIntent(stored.refresh);
+        } catch (cleanupErr) {
+          logOAuthEvent("OAuth refresh intent cleanup failed (non-fatal)", {
+            provider,
+            accountId,
+            cause: cleanupErr instanceof Error ? cleanupErr.message : String(cleanupErr),
+          });
+        }
+      }
       return fresh.access;
     } catch (error) {
       if (error instanceof OAuthMutationBusyError) throw error;
       if (!terminal(error)) throw error;
+      // Nous-specific failure-atomicity: a terminal refresh error that carries
+      // an already-issued rotated refresh token (e.g. the access JWT lacked the
+      // required `inference:invoke` scope) means the server consumed RT-A and
+      // issued RT-B. RT-B must be preserved generation-safely BEFORE forcing
+      // reauthentication; discarding it would lose the only usable refresh
+      // material and force a full re-auth for no reason.
+      if (provider === "nous" && error instanceof NousTokenError) {
+        const rotated = error.getRotatedRefresh();
+        if (rotated !== undefined && rotated !== stored.refresh) {
+          const outcome = await preserveNousRotatedRefresh(
+            provider,
+            accountId,
+            rotated,
+            generation,
+            stored,
+          );
+          if (outcome.kind === "persisted") {
+            // RT-A's intent is cleared only after RT-B is durably persisted;
+            // cleanup itself stays best-effort (a stale RT-A intent keys a token
+            // that is no longer stored).
+            try {
+              clearNousRefreshIntent(stored.refresh);
+            } catch (cleanupErr) {
+              logOAuthEvent("OAuth refresh intent cleanup failed (non-fatal)", {
+                provider,
+                accountId,
+                cause: cleanupErr instanceof Error ? cleanupErr.message : String(cleanupErr),
+              });
+            }
+            // Mark exactly the generation this write produced — never a
+            // credential written by a concurrent login between the merge and
+            // this step.
+            await markAccountNeedsReauthIfGeneration(provider, accountId, outcome.generation, writerGeneration);
+          } else {
+            // RT-B persistence failed or a newer generation superseded it:
+            // never clear RT-A's intent (RT-A was consumed), and mark the old
+            // generation needsReauth (a no-op if a newer generation won).
+            await markAccountNeedsReauthIfGeneration(provider, accountId, generation, writerGeneration);
+          }
+          throw new OAuthLoginRequiredError(provider);
+        }
+      }
       await markAccountNeedsReauthIfGeneration(provider, accountId, generation, writerGeneration);
       throw new OAuthLoginRequiredError(provider);
     }
@@ -572,31 +856,63 @@ function modelDiscoveryTransportSeed(providerName: string, prov: OcxProviderConf
 }
 
 /**
- * Provider-correct `GET /models` request (URL + headers), so both model-listing paths fetch the
+ * Provider-correct model-discovery request (URL + headers), so both model-listing paths fetch the
  * LIVE catalog correctly per adapter. Anthropic is the special case: its endpoint is `/v1/models`
  * (not `/models`), it needs `anthropic-version`, and it authenticates with `x-api-key` by default
  * (or `Authorization: Bearer` when `apiKeyTransport = "bearer"`), plus the OAuth beta for oauth
  * mode — not a bare Bearer. Google (ai-studio mode)
  * is the other special case: `x-goog-api-key` + `/v1beta/models`, returning `{ models: [...] }`.
  * The catalog authority gate intentionally degrades that non-OpenAI shape to stale/static data.
- * Everyone else uses the OpenAI-style `/models` + Bearer with a `{ data: [{ id, owned_by? }] }`
- * response.
+ * Antigravity uses its CCA `:fetchAvailableModels` RPC; everyone else uses the OpenAI-style
+ * `/models` + Bearer with a `{ data: [{ id, owned_by? }] }` response.
  */
-export function buildModelsRequest(prov: OcxProviderConfig, apiKey: string | undefined, providerName = ""): { url: string; headers: Record<string, string> } {
+export interface ModelsRequestObservedAuth {
+  readonly oauthApiBaseUrl?: string;
+}
+
+export function buildModelsRequest(
+  prov: OcxProviderConfig,
+  apiKey: string | undefined,
+  providerName = "",
+  observedAuth?: ModelsRequestObservedAuth,
+): { method?: "POST"; url: string; headers: Record<string, string> } {
   const transportSeed = modelDiscoveryTransportSeed(providerName, prov);
+  const copilotApiBaseUrl = observedAuth === undefined
+    ? (providerName === "github-copilot" ? getOAuthCredentialApiBaseUrl(providerName) : undefined)
+    : observedAuth.oauthApiBaseUrl;
   const effectiveProvider = resolveProviderTransport(
     providerName,
     transportSeed,
     undefined,
-    providerName === "github-copilot" ? getOAuthCredentialApiBaseUrl(providerName) : undefined,
+    copilotApiBaseUrl,
   );
-  const headers: Record<string, string> = { ...(effectiveProvider.headers ?? {}) };
+  // Model discovery is an upstream request like any other, so it carries the same registry
+  // static headers the inference path does. Without this a provider is identified correctly
+  // when it answers a completion but anonymously when it lists its own models, which is the
+  // kind of split fingerprint an upstream rate limiter reads as two different clients.
+  const registryStaticHeaders = providerMatchesRegistryTransport(providerName, effectiveProvider)
+    ? getProviderRegistryEntry(providerName)?.staticHeaders
+    : undefined;
+  const headers: Record<string, string> = {
+    ...(mergeRegistryStaticHeaders(registryStaticHeaders, effectiveProvider.headers) ?? {}),
+  };
   const discoveryUrl = (defaultUrl: string): string => resolveProviderModelDiscoveryUrl(
     providerName,
     prov,
     effectiveProvider.baseUrl,
     defaultUrl,
   );
+  if (effectiveGoogleMode(providerName, effectiveProvider) === "cloud-code-assist") {
+    headers.Accept = "application/json";
+    headers["Content-Type"] = "application/json";
+    headers["User-Agent"] = ANTIGRAVITY_REQUEST_UA;
+    if (apiKey) headers.Authorization = `Bearer ${apiKey}`;
+    return {
+      method: "POST",
+      url: discoveryUrl(`${effectiveProvider.baseUrl.replace(/\/+$/, "")}/v1internal:fetchAvailableModels`),
+      headers,
+    };
+  }
   if (effectiveGoogleMode(providerName, effectiveProvider) === "ai-studio") {
     // Generative Language API: API key goes in x-goog-api-key (never Authorization: Bearer),
     // models live under /v1beta (v1 misses preview models), and pageSize maxes at 1000 —
@@ -630,9 +946,7 @@ export function buildModelsRequest(prov: OcxProviderConfig, apiKey: string | und
  *
  * Only touches providers that are registry-managed AND still `authMode: "oauth"`. Preset fields
  * are refreshed, while the registry's `liveModels` default is normally filled only when no value
- * is stored. Antigravity has one versioned exception below because its old GUI-generated `true`
- * cannot be distinguished from a hand-written pre-migration `true`. Persists + returns true when
- * anything changed.
+ * is stored. Persists + returns true when anything changed.
  */
 function cloneProviderField(value: unknown): unknown {
   if (Array.isArray(value)) return [...value];
@@ -659,31 +973,62 @@ const OAUTH_RECONCILE_FIELDS: (keyof OcxProviderConfig)[] = [
   "autoToolChoiceOnlyModels",
   "preserveReasoningContentModels",
 ];
+// `requiresReasoningPlaceholderModels` is deliberately NOT reconciled here: no
+// OAuth preset seeds it, so the delete-when-preset-undefined branch would wipe
+// an explicit user opt-out (`[]`) on every startup. Registry seeds still reach
+// existing rows through enrichProviderFromRegistry, which is fill-only and
+// preserves explicit saved values.
 
 const GOOGLE_ANTIGRAVITY_PROVIDER = "google-antigravity";
-const GOOGLE_ANTIGRAVITY_STATIC_CATALOG_VERSION = 1 as const;
+const GOOGLE_ANTIGRAVITY_LIVE_DISCOVERY_VERSION = 2 as const;
+
+/** Only migrate the three-model experimental seed; an operator's later `liveModels: false` wins. */
+function isLegacyCommandCodeStaticCatalog(provider: OcxProviderConfig): boolean {
+  return provider.liveModels === false
+    && provider.defaultModel === "deepseek-v4-flash"
+    && JSON.stringify(provider.models) === JSON.stringify(["deepseek-v4-flash", "kimi-k3", "glm-5.2"]);
+}
+
+function isLegacyAntigravityStaticCatalog(provider: OcxProviderConfig): boolean {
+  // A fingerprint of the shape version 1 actually shipped, NOT of the current registry.
+  // These literals must stay frozen as the model list moves on: matching them is how we
+  // know the row is the untouched v1 seed rather than a user's own selection.
+  return provider.liveModels === false
+    && provider.adapter === "google"
+    && provider.baseUrl === "https://daily-cloudcode-pa.googleapis.com"
+    && provider.authMode === "oauth"
+    && provider.googleMode === "cloud-code-assist"
+    && provider.defaultModel === "gemini-3.6-flash"
+    && JSON.stringify(provider.models) === JSON.stringify([
+      "gemini-3.6-flash",
+      "gemini-3.1-pro",
+      "gemini-3.1-flash-image",
+      "claude-sonnet-4-6",
+      "claude-opus-4-6-thinking",
+      "gpt-oss-120b-medium",
+    ]);
+}
+
+/** Promote only the versioned canonical static seed; unmarked `liveModels: false` remains user intent. */
+function migrateLegacyAntigravityStaticCatalog(config: OcxConfig): boolean {
+  if (config.googleAntigravityStaticCatalogVersion !== 1) return false;
+  const provider = config.providers[GOOGLE_ANTIGRAVITY_PROVIDER];
+  if (provider && isLegacyAntigravityStaticCatalog(provider)) provider.liveModels = true;
+  config.googleAntigravityStaticCatalogVersion = GOOGLE_ANTIGRAVITY_LIVE_DISCOVERY_VERSION;
+  return true;
+}
 
 export function reconcileOAuthProviders(config: OcxConfig): boolean {
-  let changed = false;
-  const migrateAntigravityStaticCatalog =
-    config.googleAntigravityStaticCatalogVersion !== GOOGLE_ANTIGRAVITY_STATIC_CATALOG_VERSION;
+  let changed = migrateLegacyAntigravityStaticCatalog(config);
   for (const [name, prov] of Object.entries(config.providers)) {
     const def = OAUTH_PROVIDERS[name];
-    // Normalize the canonical row before the OAuth-only reconciliation guard. The old GUI and a
-    // manual edit both persist the same bare `true`, with no source metadata, so every ambiguous
-    // pre-marker value is reset once. A deliberate live-discovery choice can be re-enabled after
-    // the marker and is then preserved. Do this before the guard so omitted/non-OAuth authMode
-    // rows do not get stamped without actually receiving the new static default.
-    if (name === GOOGLE_ANTIGRAVITY_PROVIDER && migrateAntigravityStaticCatalog && prov.liveModels !== false) {
-      prov.liveModels = false;
+    if (name === "command-code" && isLegacyCommandCodeStaticCatalog(prov)) {
+      // The former experimental preset was the exact three-model seed above. It was not a user
+      // choice to disable discovery, so promote only that shape to the account live catalog.
+      prov.liveModels = true;
       changed = true;
     }
-    // During the one-time Antigravity static-catalog migration, also refresh preset catalog
-    // fields when authMode is omitted or non-oauth. Otherwise liveModels flips to static while
-    // a stale models[] remains the published catalog forever.
-    const migrateAntigravityCatalogFields =
-      name === GOOGLE_ANTIGRAVITY_PROVIDER && migrateAntigravityStaticCatalog;
-    if (!def || (prov.authMode !== "oauth" && !migrateAntigravityCatalogFields)) continue;
+    if (!def || prov.authMode !== "oauth") continue;
     const preset = def.providerConfig;
     for (const field of OAUTH_RECONCILE_FIELDS) {
       if (JSON.stringify(prov[field]) === JSON.stringify(preset[field])) continue;
@@ -694,23 +1039,19 @@ export function reconcileOAuthProviders(config: OcxConfig): boolean {
       }
       changed = true;
     }
-    // Before this marker existed, the GUI materialized an omitted `liveModels` as `true` on any
-    // settings save. Since persisted values have no provenance, the pre-guard normalization above
-    // intentionally resets all pre-marker `true` values once. Later choices are version-bounded.
     if (prov.liveModels === undefined && preset.liveModels !== undefined) {
       prov.liveModels = preset.liveModels;
       changed = true;
     }
     // Heal a defaultModel that no longer exists in the refreshed list (e.g. a deprecated snapshot).
-    if (prov.defaultModel && preset.defaultModel && !(prov.models ?? []).includes(prov.defaultModel)) {
+    // Skip providers without a static preset `models` list: for live-discovery providers
+    // (e.g. command-code OAuth) the account-scoped catalog is not enumerable here, so any
+    // persisted defaultModel is a user selection and must not be overwritten by the seed.
+    if (prov.defaultModel && preset.defaultModel && preset.models && preset.models.length > 0 && !(prov.models ?? []).includes(prov.defaultModel)) {
       prov.defaultModel = preset.defaultModel;
       changed = true;
     }
   }
-  if (migrateAntigravityStaticCatalog) {
-    config.googleAntigravityStaticCatalogVersion = GOOGLE_ANTIGRAVITY_STATIC_CATALOG_VERSION;
-    changed = true;
-  }
   if (changed) saveConfig(config);
   return changed;
 }
@@ -767,19 +1108,36 @@ export function upsertOAuthProvider(config: OcxConfig, provider: string): void {
   if (provider === "chatgpt") return;
   const def = OAUTH_PROVIDERS[provider];
   if (!def) return;
+  if (provider === GOOGLE_ANTIGRAVITY_PROVIDER) migrateLegacyAntigravityStaticCatalog(config);
   const namespaceCollision = codexAccountNamespaceProviderCollisionError(config.codexAccountNamespaces, provider);
   if (namespaceCollision) throw new Error(namespaceCollision);
   const existing = config.providers[provider];
   const next: OcxProviderConfig = { ...def.providerConfig };
-  // `liveModels` is a user-facing provider toggle. A registry default seeds new rows, but an
-  // explicit post-migration choice must survive re-login and the latest-config upsert. Old GUI
-  // saves and manual edits left identical pre-marker `true` values, so that ambiguous state is
-  // reset once; users who deliberately forced discovery can re-enable it after migration.
-  const preserveExistingLiveModels = provider !== GOOGLE_ANTIGRAVITY_PROVIDER
-    || config.googleAntigravityStaticCatalogVersion === GOOGLE_ANTIGRAVITY_STATIC_CATALOG_VERSION;
-  if (preserveExistingLiveModels && typeof existing?.liveModels === "boolean") {
+  // `liveModels` is a user-facing provider toggle. Preserve either explicit setting across login;
+  // Antigravity's CCA discovery now uses its real RPC, so legacy `true` remains a valid choice.
+  if (typeof existing?.liveModels === "boolean" && !isLegacyCommandCodeStaticCatalog(existing)) {
     next.liveModels = existing.liveModels;
   }
+  // The Command Code protocol-version pin is an operator compatibility control. A re-login,
+  // add-account, or reauth rebuilds the row from the preset, which has no version; carry the
+  // existing pin so authentication changes do not silently revert the documented control.
+  if (existing?.commandCodeVersion !== undefined) {
+    next.commandCodeVersion = existing.commandCodeVersion;
+  }
+  // User-configured price overlays are operator data, not preset state; a
+  // re-login, add-account, or reauth must not silently drop them from the
+  // Logs/Usage estimates.
+  if (existing?.modelCosts !== undefined) {
+    next.modelCosts = existing.modelCosts;
+  }
+  // The per-provider account-failover opt-out is operator intent about SPENDING, and the login
+  // path is exactly where losing it does damage: adding a second account both rebuilds this row
+  // from the preset and creates the 2-account quorum that turns presence-driven rotation on
+  // (#2568d). Dropping the opt-out here would enable the thing the operator switched off, at the
+  // moment they were doing something unrelated.
+  if (existing?.oauthAccountFailover !== undefined) {
+    next.oauthAccountFailover = existing.oauthAccountFailover;
+  }
   if (existing && getProviderRegistryEntry(provider)?.allowKeyAuthOverride === true) {
     // Shared sanitizeApiKeyValue trim / no-CRLF checks from api-key pool writes.
     let storedApiKey = sanitizeApiKeyValue(existing.apiKey);
@@ -803,9 +1161,6 @@ export function upsertOAuthProvider(config: OcxConfig, provider: string): void {
     }
   }
   config.providers[provider] = next;
-  if (provider === GOOGLE_ANTIGRAVITY_PROVIDER) {
-    config.googleAntigravityStaticCatalogVersion = GOOGLE_ANTIGRAVITY_STATIC_CATALOG_VERSION;
-  }
 }
 
 interface RunLoginDeps {
@@ -816,6 +1171,7 @@ interface RunLoginDeps {
   settleKiroLoginTransaction?: typeof settleKiroLoginTransaction;
   removeAccount?: typeof removeAccount;
   setActiveAccount?: typeof setActiveAccount;
+  assertCurrentOwner?: () => void;
 }
 
 /** Roll back only accounts created by this forced login, preserving concurrent refreshes of others. */
@@ -865,6 +1221,7 @@ export async function runLogin(
   const cred: OAuthCredentials = rawCred.source ? rawCred : { ...rawCred, source: "oauth" };
   const settleKiroTransaction = deps.settleKiroLoginTransaction ?? settleKiroLoginTransaction;
   try {
+    deps.assertCurrentOwner?.();
     // Validate the provider row before credential persistence. A namespace claimed during the
     // credential write is handled again below before the latest row is re-upserted.
     if (provider !== "chatgpt") {
@@ -875,7 +1232,7 @@ export async function runLogin(
       const existing = getAccountCredential(provider, opts.reauthAccountId);
       if (!existing) throw new Error(`Unknown account for reauth: ${opts.reauthAccountId}`);
       if (!existing.accountId && !existing.email) {
-        throw new Error("Could not verify signed-in account identity for reauth.");
+        throw new OAuthReauthIdentityUnverifiedError();
       }
       const identityMatches = existing.accountId && cred.accountId
         ? existing.accountId === cred.accountId
@@ -883,12 +1240,15 @@ export async function runLogin(
           ? existing.email.toLowerCase() === cred.email.toLowerCase()
           : false;
       if (!identityMatches) {
-        throw new Error("Signed-in account does not match the selected account. Sign in with the same account.");
+        throw new OAuthReauthIdentityMismatchError();
       }
-      await (deps.saveAccountCredential ?? saveAccountCredential)(provider, opts.reauthAccountId, cred);
+      await (deps.saveAccountCredential ?? saveAccountCredential)(provider, opts.reauthAccountId, cred, {
+        assertBeforePersist: deps.assertCurrentOwner,
+      });
     } else {
       await (deps.saveCredential ?? saveCredential)(provider, cred, {
-        preserveIdentityless: provider === "kiro" && opts?.forceLogin === true,
+        preserveIdentityless: opts?.forceLogin === true,
+        assertBeforePersist: deps.assertCurrentOwner,
       });
     }
     if (provider !== "chatgpt") {
@@ -900,10 +1260,7 @@ export async function runLogin(
         provider,
       );
       if (lateCollision) {
-        throw new Error(
-          `${lateCollision}. The credential for "${provider}" was saved, but the provider entry was not written. `
-          + "Rename the account selector, then re-run the login.",
-        );
+        throw new OAuthProviderPublicationError();
       }
       upsertOAuthProvider(latestConfig, provider);
       saveLatestConfig(latestConfig);
@@ -933,11 +1290,15 @@ export async function runLogin(
   settleKiroTransaction(rawCred, true);
   if (provider !== "chatgpt") {
     try {
+      const { clearModelCache } = await import("../codex/model-cache");
+      const { clearGatherRoutedModelsInflight } = await import("../codex/catalog");
+      clearModelCache(provider);
+      clearGatherRoutedModelsInflight();
       const { clearAccountQuotaCache, clearProviderQuotaCache } = await import("../providers/quota");
       clearProviderQuotaCache();
       clearAccountQuotaCache(provider);
     } catch {
-      // Quota module may be unavailable in tightly scoped unit tests.
+      // Optional state modules may be unavailable in tightly scoped unit tests.
     }
   }
   return cred;
@@ -954,6 +1315,7 @@ export async function runLogin(
  */
 const loginState = new Map<string, { error?: string; done: boolean }>();
 const loginAbort = new Map<string, AbortController>();
+const kiroLoginSettling = new Set<string>();
 
 /** Pending paste for a login in progress: either a waiter or a stashed early submission. */
 interface ManualCodeSlot {
@@ -1036,7 +1398,11 @@ export function submitManualLoginCode(provider: string, input: string): { ok: tr
   // protected. Early posts (flow not yet waiting, no expectedState) are stashed and
   // re-validated by the callback loop.
   const parsed = parseCallbackInput(trimmed);
-  if (!parsed.code) return { ok: false, error: "no authorization code found in input" };
+  // Command Code's manual fallback accepts a pasted JSON callback payload
+  // (`{ apiKey, state, ... }`) which has no `code` param. Let it through the
+  // shared gate so the provider-specific parser can validate it.
+  const isCommandCodeJson = provider === "command-code" && trimmed.startsWith("{") && !parsed.code;
+  if (!parsed.code && !isCommandCodeJson) return { ok: false, error: "no authorization code found in input" };
   if (parsed.kind !== "raw" && slot.expectedState !== undefined) {
     if (parsed.state === undefined) return { ok: false, error: "redirect URL is missing the state parameter" };
     if (parsed.state !== slot.expectedState) return { ok: false, error: "state mismatch — paste the redirect URL from THIS login attempt" };
@@ -1058,19 +1424,27 @@ export function getLoginStatus(provider: string): { loggedIn: boolean; email?: s
   const cred = getCredential(provider);
   const st = loginState.get(provider);
   const set = getAccountSet(provider);
-  // Full email on purpose: local dashboard/CLI account management needs to distinguish
-  // multiauth slots (masked local-parts collide). Tokens stay out of this surface.
+  // Masked emails on purpose: status DTOs are shared with GUI/CLI surfaces that
+  // must not leak full local-parts. Tokens stay out of this surface entirely.
   const accounts: OAuthAccountSummary[] | undefined = set?.accounts.map(a => ({
     id: a.id,
     ...(a.alias ? { alias: a.alias } : {}),
-    email: a.credential.email ?? undefined,
+    email: maskEmail(a.credential.email) ?? undefined,
     active: a.id === set.activeAccountId,
     ...(a.needsReauth ? { needsReauth: true } : {}),
     expiresAt: a.credential.expires,
   }));
+
+  // A stored credential counts as "logged in" when it exists and is not marked for
+  // re-authentication. An expired access token with a valid refresh token is still
+  // logged in: request resolution refreshes expired/near-expiry credentials lazily.
+  // Invalid/unknown local-import expiries are handled at parse/adoption time
+  // (local-token-detect.ts), never by over-reporting login state here.
+  const activeNeedsReauth = set?.accounts
+    .find(a => a.id === set.activeAccountId)?.needsReauth === true;
   return {
-    loggedIn: !!cred,
-    email: cred?.email ?? undefined,
+    loggedIn: !!cred && !activeNeedsReauth,
+    email: maskEmail(cred?.email) ?? undefined,
     source: cred?.source,
     error: st?.error,
     done: st?.done ?? false,
@@ -1112,13 +1486,14 @@ export async function startLoginFlow(
   const def = OAUTH_PROVIDERS[provider];
   if (!def) throw new UnsupportedOAuthProviderError(provider);
   const existing = loginState.get(provider);
-  if (existing && !existing.done) {
+  if ((existing && !existing.done) || (provider === "kiro" && kiroLoginSettling.has(provider))) {
     throw new Error(`A login for ${provider} is already in progress`);
   }
   clearManualCodeSlot(provider);
   loginState.set(provider, { done: false });
   const abort = new AbortController();
   loginAbort.set(provider, abort);
+  if (provider === "kiro") kiroLoginSettling.add(provider);
   return new Promise((resolve, reject) => {
     let urlResolved = false;
     const ctrl: OAuthController = {
@@ -1131,7 +1506,16 @@ export async function startLoginFlow(
       onManualCodeInput: (expectedState?: string) => waitForManualLoginCode(provider, abort.signal, expectedState),
       signal: abort.signal,
     };
+    const abandonIfNotOwner = (error?: unknown): boolean => {
+      if (loginAbort.get(provider) === abort) return false;
+      if (!urlResolved) reject(error ?? new Error("OAuth login was superseded"));
+      return true;
+    };
     const settle = async (error?: unknown): Promise<void> => {
+      // Cancellation deletes this controller and records its own terminal result. A late provider
+      // rejection (or an older flow settling after a replacement starts) must not overwrite that
+      // state or delete the replacement flow's controller/manual-code slot.
+      if (abandonIfNotOwner(error)) return;
       let finalError = error;
       try {
         await lifecycle?.onSettled?.();
@@ -1140,6 +1524,7 @@ export async function startLoginFlow(
         // runtime config. For an already-failed login, keep the original recovery error.
         if (finalError === undefined) finalError = settleError;
       }
+      if (abandonIfNotOwner(finalError)) return;
       if (finalError === undefined) {
         loginAbort.delete(provider);
         clearManualCodeSlot(provider);
@@ -1153,22 +1538,28 @@ export async function startLoginFlow(
       const e = finalError;
       loginAbort.delete(provider);
       clearManualCodeSlot(provider);
-      const msg = e instanceof Error ? e.message : String(e);
+      const msg = publicOAuthAuthenticationErrorMessage(e);
       loginState.set(provider, { done: true, error: msg });
       if (!urlResolved) reject(e);
     };
     // Background: runLogin persists the credential + provider entry to disk. The lifecycle hook
     // lets a long-lived server config adopt that settled state before clients observe done=true.
-    void runLogin(provider, ctrl, opts).then(
+    const assertCurrentOwner = (): void => {
+      if (loginAbort.get(provider) !== abort) throw new OAuthLoginSupersededError();
+    };
+    void runLogin(provider, ctrl, opts, { assertCurrentOwner }).then(
       () => settle(),
       (e: unknown) => settle(e),
     ).catch((e: unknown) => {
       // settle catches lifecycle failures, so this is only a defensive promise-boundary guard.
+      if (abandonIfNotOwner(e)) return;
       loginAbort.delete(provider);
       clearManualCodeSlot(provider);
-      const msg = e instanceof Error ? e.message : String(e);
+      const msg = publicOAuthAuthenticationErrorMessage(e);
       loginState.set(provider, { done: true, error: msg });
       if (!urlResolved) reject(e);
+    }).finally(() => {
+      if (provider === "kiro") kiroLoginSettling.delete(provider);
     });
   });
 }