@jameslovespancakes/pi-plus 1.0.21 → 1.0.23

package/src/domains/claude-remote/index.ts

@@ -2,7 +2,7 @@ import { basename } from "node:path";
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { ClaudeRemoteBridge, type BridgeOptions } from "../../core/claude-remote/bridge.ts";
 import { mirrorMessage } from "../../core/claude-remote/protocol.ts";
-import { env, setEnv } from "../../core/env.ts";
+import { env } from "../../core/env.ts";
 import { createTokenSource } from "./auth.ts";
 import { remoteControlPicker } from "./picker.ts";
 
@@ -30,6 +30,7 @@ export function registerClaudeRemote(pi: ExtensionAPI, deps: RemoteDependencies
   let enabled = false;
   let current: ExtensionContext | undefined;
   let generation = 0;
+  let sessionEpoch = 0;
   // Counts rather than a TTL: follow-ups can wait longer than 30 seconds.
   const echoes: string[] = [];
 
@@ -48,6 +49,7 @@ export function registerClaudeRemote(pi: ExtensionAPI, deps: RemoteDependencies
   }
 
   function stop(): void {
+    enabled = false;
     ++generation;
     active?.stop();
     active = undefined;
@@ -55,12 +57,18 @@ export function registerClaudeRemote(pi: ExtensionAPI, deps: RemoteDependencies
     setConnectionStatus("off");
   }
 
+  function endSession(): void {
+    ++sessionEpoch;
+    stop();
+  }
+
   function start(ctx: ExtensionContext): void {
     if (active) {
       notify(ctx, `Claude Remote: ${status}. Open https://claude.ai/code`);
       return;
     }
     current = ctx;
+    enabled = true;
     const gen = ++generation;
     const title = `pi: ${pi.getSessionName() || basename(ctx.cwd) || "session"}`.slice(0, 100);
     setConnectionStatus("connecting");
@@ -115,14 +123,8 @@ export function registerClaudeRemote(pi: ExtensionAPI, deps: RemoteDependencies
   }
 
   function setEnabled(next: boolean, ctx: ExtensionContext): boolean {
-    enabled = next;
-    const saved = setEnv("PI_CLAUDE_REMOTE", next ? "1" : "0");
     if (next) start(ctx);
     else stop();
-    if (!saved) notify(ctx, "Could not save preference; changed this session only.", true);
-    else if ((env("PI_CLAUDE_REMOTE") === "1") !== next) {
-      notify(ctx, "PI_CLAUDE_REMOTE overrides this preference after reload.", true);
-    }
     return enabled;
   }
 
@@ -132,28 +134,33 @@ export function registerClaudeRemote(pi: ExtensionAPI, deps: RemoteDependencies
       .filter((value) => value.startsWith(prefix)).map((value) => ({ value, label: value })),
     handler: async (args, ctx) => {
       const action = args.trim().toLowerCase();
+      const session = sessionEpoch;
       if (!action && ctx.mode === "tui") {
         await ctx.ui.custom((_tui, theme, _keys, done) => remoteControlPicker(
-          theme, enabled, (next) => setEnabled(next, ctx), () => done(undefined),
+          theme, () => session === sessionEpoch && enabled,
+          (next) => session === sessionEpoch && setEnabled(next, ctx), () => done(undefined),
         ));
       } else if (action === "on" || action === "off") {
         if (action === "on" && ctx.hasUI && !enabled && !await ctx.ui.confirm("Enable Remote Control?",
-          "Share sessions with Anthropic and control pi from the Claude app. Auto-starts in interactive sessions.")) return;
+          "Share this session with Anthropic and control it from the Claude app. New sessions and reloads start Off.")) return;
+        if (session !== sessionEpoch) return;
         setEnabled(action === "on", ctx);
       } else notify(ctx, "Usage: /claude-remote [on|off]", true);
     },
   });
 
+  // Stop before pi changes the active session, including cancelled switches.
+  pi.on("session_before_switch", () => { endSession(); });
+  pi.on("session_before_fork", () => { endSession(); });
   pi.on("session_start", (_event, ctx) => {
-    stop();
+    endSession();
     current = ctx;
     setConnectionStatus("off");
-    enabled = env("PI_CLAUDE_REMOTE") === "1";
-    // Never spawn remote mirrors for workflow/SDK/print subagents by default.
-    if (ctx.mode === "tui" && enabled) start(ctx);
+    // Intentionally ignore legacy PI_CLAUDE_REMOTE preferences. Every session,
+    // including resumes, forks, reloads and workflow children, starts Off.
   });
   pi.on("session_shutdown", (_event, ctx) => {
-    stop();
+    endSession();
     if (ctx.hasUI) ctx.ui.setStatus("claude-remote", undefined);
     current = undefined;
   });

package/src/domains/claude-remote/picker.ts

@@ -5,11 +5,11 @@ import { frameSettings, settingsTheme } from "../../ui/settings-picker.ts";
 /** Same dot, colors and in-place SettingsList toggle as /provider. */
 export function remoteControlPicker(
   theme: any,
-  initial: boolean,
+  readEnabled: () => boolean,
   toggle: (enabled: boolean) => boolean,
   done: () => void,
 ): Component {
-  let enabled = initial;
+  let enabled = readEnabled();
   const color = (value: boolean, text: string) => hasTruecolor()
     ? levelColor(value ? 100 : 0)(text) : theme.fg(value ? "success" : "error", text);
   const label = () => `${color(enabled, "●")} Remote Control`;
@@ -19,13 +19,22 @@ export function remoteControlPicker(
     values: [color(true, "On"), color(false, "Off")],
   };
   const list = new SettingsList([item], 1, settingsTheme(theme), () => {
-    enabled = toggle(!enabled);
+    enabled = toggle(!readEnabled());
     item.label = label();
     list.updateValue(item.id, value());
   }, done, { enableSearch: false });
   const frame = frameSettings(theme, list, "Remote Control");
   return {
     ...frame,
+    render(width: number) {
+      const next = readEnabled();
+      if (next !== enabled) {
+        enabled = next;
+        item.label = label();
+        list.updateValue(item.id, value());
+      }
+      return frame.render(width);
+    },
     invalidate() {
       item.values = [color(true, "On"), color(false, "Off")];
       item.label = label();

package/src/domains/models/policy-gate.ts

@@ -1,15 +1,7 @@
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
-import {
-  approve,
-  checkModel,
-  gatedProviders,
-  isApproved,
-  loadPolicy,
-  providerState,
-  revoke,
-  toggleProvider,
-} from "../../core/policy/policy.ts";
-import { openProviderPicker, STATE_TEXT, type ProviderRow, type StateKey } from "./provider-picker.ts";
+import { gatedProviders, loadPolicy, ProviderPolicy } from "../../core/policy/policy.ts";
+import { withOpenRouterZdr } from "../../core/policy/openrouter.ts";
+import { openProviderPicker, providerStateText, type ProviderRow } from "./provider-picker.ts";
 
 /**
  * Enforces the approval policy at the provider boundary, so it also covers
@@ -20,7 +12,11 @@ class ModelPolicyError extends Error {
   code = "MODEL_POLICY_BLOCKED";
 }
 
-async function providerRows(ctx: any): Promise<ProviderRow[]> {
+// A workflow child inherits the host's live guard, not a second unapproved gate.
+const POLICY_GUARD = Symbol.for("pi-plus.provider-policy");
+
+/** Configured providers plus policy gates, re-read after authentication changes. */
+async function providerRows(ctx: any, policy: ProviderPolicy): Promise<ProviderRow[]> {
   const ids = new Set<string>();
   try {
     for (const model of await ctx.modelRegistry.getAvailable()) ids.add(model.provider);
@@ -47,16 +43,11 @@ async function providerRows(ctx: any): Promise<ProviderRow[]> {
       id: provider,
       provider,
       display,
-      state: providerState(provider) as ProviderRow["state"],
+      state: policy.providerState(provider),
     };
   });
 }
 
-/**
- * Every provider the user actually has credentials for, plus any the policy
- * gates. Derived at call time so a newly authenticated provider shows up
- * without touching config.
- */
 /**
  * Providers are free to decorate their own name. The CortexKit package calls
  * itself "Anthropic (CortexKit OAuth)". The implementation detail is noise in a
@@ -68,57 +59,59 @@ function cleanName(name: string): string {
 
 
 export function registerPolicyGate(pi: ExtensionAPI): void {
+  const policy = new ProviderPolicy();
   let wrapped = false;
 
   const wrapProviders = (ctx: any) => {
     if (wrapped) return;
-    for (const providerId of gatedProviders()) {
+    // OpenRouter must be wrapped even when config auto-approves it: the picker
+    // can still select ZDR (or Off) without changing the installed catalogue.
+    for (const providerId of new Set([...gatedProviders(), "openrouter"])) {
       const provider = ctx.modelRegistry.getProvider(providerId);
-      if (!provider) continue;
+      if (!provider || ctx.modelRegistry.getRegisteredNativeProvider?.(providerId)?.[POLICY_GUARD]) continue;
 
       const guard = (model: any) => {
-        const decision = checkModel(providerId, model?.id ?? "unknown");
+        const decision = policy.checkModel(providerId, model?.id ?? "unknown");
         if (!decision.allowed) throw new ModelPolicyError(decision.message);
       };
 
-      const originalStream = provider.stream?.bind(provider);
-      const originalStreamSimple = provider.streamSimple?.bind(provider);
-
-      pi.registerProvider({
+      const wrapStream = (stream: any) => (model: any, context: any, options: any) => {
+        guard(model);
+        if (providerId === "openrouter" && policy.openRouterZdrRequired()) {
+          const request = withOpenRouterZdr(model, options);
+          return stream.call(provider, request.model, context, request.options);
+        }
+        return stream.call(provider, model, context, options);
+      };
+      const guarded = {
         ...provider,
-        ...(originalStream && {
-          stream: (model: any, ...rest: any[]) => {
-            guard(model);
-            return originalStream(model, ...rest);
-          },
-        }),
-        ...(originalStreamSimple && {
-          streamSimple: (model: any, ...rest: any[]) => {
-            guard(model);
-            return originalStreamSimple(model, ...rest);
-          },
-        }),
-      });
+        [POLICY_GUARD]: true,
+        ...(provider.stream && { stream: wrapStream(provider.stream) }),
+        ...(provider.streamSimple && { streamSimple: wrapStream(provider.streamSimple) }),
+      };
+      pi.registerProvider(guarded);
     }
     wrapped = true;
   };
 
   pi.on("session_start", async (_event, ctx) => {
+    policy.reset();
     loadPolicy();
     wrapProviders(ctx);
   });
+  pi.on("session_shutdown", () => { policy.reset(); });
 
   pi.registerCommand("provider", {
-    description: "Toggle which providers may be used (approve | remove <name>)",
+    description: "Toggle providers (approve | remove <name>; zdr openrouter for ZDR-only routing)",
     getArgumentCompletions: (prefix) => {
       const [action, name = ""] = prefix.split(/\s+/);
       if (!prefix.includes(" ")) {
-        return ["approve", "remove"]
+        return ["approve", "zdr", "remove"]
           .filter((option) => option.startsWith(action))
           .map((option) => ({ value: option, label: option }));
       }
-      if (action !== "approve" && action !== "remove") return [];
-      return gatedProviders()
+      if (action !== "approve" && action !== "remove" && action !== "zdr") return [];
+      return (action === "zdr" ? ["openrouter"] : [...new Set([...gatedProviders(), "openrouter"])])
         .filter((provider) => provider.startsWith(name))
         .map((provider) => ({ value: `${action} ${provider}`, label: provider }));
     },
@@ -126,43 +119,48 @@ export function registerPolicyGate(pi: ExtensionAPI): void {
       const [action, ...rest] = args.trim().split(/\s+/).filter(Boolean);
       const name = rest.join(" ");
 
-      if (action === "approve" || action === "remove") {
+      if (action === "approve" || action === "remove" || action === "zdr") {
         if (!name) {
           ctx.ui.notify(`Usage: /provider ${action} <provider>`, "warning");
           return;
         }
-        if (!gatedProviders().includes(name)) {
+        if (action === "zdr" && name !== "openrouter") {
+          ctx.ui.notify("ZDR mode is supported only for OpenRouter. Use: /provider zdr openrouter", "warning");
+          return;
+        }
+        if (name !== "openrouter" && !gatedProviders().includes(name)) {
           ctx.ui.notify(
             `“${name}” is not a gated provider. Gated: ${gatedProviders().join(", ") || "none"}`,
             "warning",
           );
           return;
         }
-        if (action === "approve") approve(name);
-        else revoke(name);
-        ctx.ui.notify(`${name} is now ${isApproved(name) ? "approved" : "blocked"}.`, "info");
+        if (action === "zdr") policy.approveOpenRouterZdr();
+        else if (action === "approve") policy.approve(name);
+        else policy.revoke(name);
+        ctx.ui.notify(`${name} is now ${providerStateText(name, policy.providerState(name))}.`, "info");
         return;
       }
 
       if (action) {
-        ctx.ui.notify(`Unknown action “${action}”. Use: /provider [approve|remove <name>]`, "warning");
+        ctx.ui.notify(`Unknown action “${action}”. Use: /provider [approve|remove <name>] or /provider zdr openrouter`, "warning");
         return;
       }
 
-      const rows = await providerRows(ctx);
+      const rows = await providerRows(ctx, policy);
 
       // Headless: plain text, no cursor to draw.
       if (!ctx.hasUI) {
         ctx.ui.notify(
-          rows.map((row) => `${row.state === "auto" || row.state === "approved" ? "[on] " : "[off]"} ${row.display}: ${STATE_TEXT[row.state]}`).join("\n"),
+          rows.map((row) => `${row.state === "blocked" || row.state === "denied" ? "[off]" : "[on] "} ${row.display}: ${providerStateText(row.provider, row.state)}`).join("\n"),
           "info",
         );
         return;
       }
 
       await openProviderPicker(ctx, {
-        rows: () => providerRows(ctx),
-        toggle: (provider) => toggleProvider(provider) as StateKey,
+        rows: () => providerRows(ctx, policy),
+        toggle: (provider) => policy.toggleProvider(provider),
       });
     },
   });

package/src/domains/models/provider-picker.ts

@@ -22,12 +22,22 @@ export const STATE_TEXT = {
   approved: "Approved",
   blocked: "Needs Approval",
   denied: "Denied",
+  zdr: "On (ZDR)",
 } as const;
 
 export type StateKey = keyof typeof STATE_TEXT;
 
-/** The two values SettingsList cycles between for a binary toggle. */
-export const TOGGLE_VALUES = [STATE_TEXT.auto, STATE_TEXT.blocked];
+export function providerToggleStates(provider: string): StateKey[] {
+  return provider === "openrouter" ? ["blocked", "approved", "zdr"] : ["auto", "blocked"];
+}
+
+export function providerStateText(provider: string, state: StateKey): string {
+  if (provider === "openrouter") {
+    if (state === "auto" || state === "approved") return "On";
+    if (state === "blocked") return "Off";
+  }
+  return STATE_TEXT[state];
+}
 
 export interface ProviderRow {
   /** Stable id used by SettingsList and by the toggle handler. */
@@ -52,6 +62,7 @@ const STATE_LEVEL: Record<StateKey, number> = {
   approved: 100,
   blocked: 45,
   denied: 0,
+  zdr: 100,
 };
 
 /** Fallback for terminals without truecolor. */
@@ -60,6 +71,7 @@ const STATE_THEME_COLOUR: Record<StateKey, string> = {
   approved: "success",
   blocked: "warning",
   denied: "error",
+  zdr: "success",
 };
 
 /**
@@ -120,13 +132,12 @@ export async function openProviderPicker(ctx: any, deps: PickerDeps): Promise<vo
     // `values` carries the COLOURED strings, not plain text. SettingsList shows
     // whichever it cycles to immediately, so pre-colouring them means the new
     // text arrives already in the right colour rather than flashing uncoloured.
-    const colouredToggle = [colourState(theme, "auto"), colourState(theme, "blocked")];
-
+    const valueFor = (row: ProviderRow, state = row.state) => colourState(theme, state, providerStateText(row.provider, state));
     const items = rows.map((row) => ({
       id: row.id,
       label: labelFor(theme, row),
-      values: [...colouredToggle],
-      currentValue: colourState(theme, row.state),
+      values: providerToggleStates(row.provider).map((state) => valueFor(row, state)),
+      currentValue: valueFor(row),
     }));
 
     // Synchronous throughout: label, dot and value all change in one render.
@@ -137,7 +148,7 @@ export async function openProviderPicker(ctx: any, deps: PickerDeps): Promise<vo
 
       if (row.state === "denied") {
         // Undo the value SettingsList optimistically cycled to.
-        list?.updateValue(id, colourState(theme, row.state));
+        list?.updateValue(id, valueFor(row));
         ctx.ui.notify(`${row.display} is denied in policy. Edit pi-plus.json to change that.`, "warning");
         return;
       }
@@ -145,7 +156,7 @@ export async function openProviderPicker(ctx: any, deps: PickerDeps): Promise<vo
       const next = deps.toggle(row.provider);
       row.state = next;
       item.label = labelFor(theme, row);
-      list?.updateValue(id, colourState(theme, next));
+      list?.updateValue(id, valueFor(row));
       list?.invalidate?.();
     };
 

package/src/domains/setup/index.ts

@@ -94,7 +94,7 @@ async function inspect(ctx: any): Promise<Feature[]> {
     name: "Providers",
     ready: config.policy.requireApproval.length > 0,
     detail: `${config.policy.requireApproval.length} gated pattern(s), ${config.policy.autoApprove.length} auto-approved`,
-    commands: ["/provider", "/provider list", "/provider approve <name>"],
+    commands: ["/provider", "/provider approve <name>", "/provider zdr openrouter"],
     open: "/provider",
   });
 
@@ -131,12 +131,11 @@ async function inspect(ctx: any): Promise<Feature[]> {
     open: "/remote setup",
   });
 
-  /* Claude app remote control (preference only; never connect from the hub). */
-  const claudeRemote = env("PI_CLAUDE_REMOTE") === "1";
+  /* No persisted auto-start preference: connection is opted into per session. */
   features.push({
     name: "Claude Remote",
-    ready: claudeRemote,
-    detail: claudeRemote ? "auto-start enabled for interactive sessions" : "opt-in Claude app mirror; requires Anthropic OAuth",
+    ready: false,
+    detail: "session-only Claude app mirror; defaults Off; requires Anthropic OAuth",
     commands: ["/claude-remote", "/claude-remote on", "/claude-remote off"],
     setup: "/claude-remote",
     open: "/claude-remote",

package/src/domains/subscriptions/provider.ts

@@ -12,13 +12,13 @@ import { catalogIsStale, refreshAnthropicCatalog } from "../../core/anthropic/ca
 import { ANTHROPIC_MODELS, buildAnthropicModels, type ModelSpec } from "../../core/anthropic/models.ts";
 import {
   ACCESS_REFRESH_INTERVAL_MS,
-  applyQuotaHeaders,
-  refreshAllQuota,
+  refreshDueAccessTokens,
 } from "../../core/anthropic/quota.ts";
 import {
   MAIN_ACCOUNT_ID, familyForModel, selectAccount, type Candidate,
 } from "../../core/anthropic/routing.ts";
 import { getRoutingMode, loadAccounts, saveAccount } from "../../core/anthropic/store.ts";
+import { cachedClaudeQuota, observeClaudeQuota } from "../../core/anthropic/usage-cache.ts";
 import { refreshAbortSignal } from "../../core/accounts/routing.ts";
 
 /**
@@ -40,14 +40,8 @@ function isAnthropicMessagesPayload(payload: any): boolean {
 /** The catalogue currently registered; replaced when discovery finds a new model. */
 let registeredModels: ModelSpec[] = ANTHROPIC_MODELS;
 
-let lastSelected: { id: string; at: number } | undefined;
 const accountLastUsed = new Map<string, number>();
 
-/** Which account served the most recent request, for the UI. */
-export function lastRoutedAccount(): { id: string; at: number } | undefined {
-  return lastSelected;
-}
-
 /** Routes to a pooled account, falling back to pi's primary credential. */
 export function routeAccessToken(primary: string, modelId?: string, _sessionId?: string): string {
   const storage = loadAccounts();
@@ -71,7 +65,8 @@ export function routeAccessToken(primary: string, modelId?: string, _sessionId?:
     {
       id: MAIN_ACCOUNT_ID,
       access: primary,
-      quota: storage.main?.quota as any,
+      quota: cachedClaudeQuota({ access: primary, identity: primaryIdentity,
+        quota: storage.accounts.find((account) => primaryIdentity && account.identity === primaryIdentity)?.quota }),
       order: 0,
       lastUsed: accountLastUsed.get(MAIN_ACCOUNT_ID) ?? Number(storage.main?.lastUsed ?? 0),
     },
@@ -81,7 +76,7 @@ export function routeAccessToken(primary: string, modelId?: string, _sessionId?:
     ...sidecars.map((a, index) => ({
         id: a.id,
         access: a.access,
-        quota: a.quota,
+        quota: cachedClaudeQuota({ access: a.access!, id: a.id, identity: a.identity, quota: a.quota }),
         order: index + 1,
         lastUsed: accountLastUsed.get(a.id) ?? a.lastUsed ?? 0,
         account: a,
@@ -99,7 +94,6 @@ export function routeAccessToken(primary: string, modelId?: string, _sessionId?:
   }
 
   const now = Date.now();
-  lastSelected = { id: picked.candidate.id, at: now };
   accountLastUsed.set(picked.candidate.id, now);
   if (picked.candidate.account) {
     // Minute precision avoids a credential write on every request.
@@ -215,16 +209,19 @@ export function registerAnthropicProvider(pi: ExtensionAPI): void {
     return JSON.parse(signed);
   });
 
-  /** Updates the routed account from response quota headers. */
-  pi.on("after_provider_response", (event: any) => {
-    const routed = lastRoutedAccount();
-    // The primary account lives in pi's auth store.
-    if (!routed || routed.id === MAIN_ACCOUNT_ID) return;
-    try {
-      applyQuotaHeaders(routed.id, event?.headers);
-    } catch {
-      // Never let bookkeeping disturb a response.
-    }
+  // Capture the credential actually sent by this session, not global routing state.
+  let requestAccess: string | undefined;
+  pi.on("before_provider_headers", (event) => {
+    const authorization = Object.entries(event.headers).find(([key]) => key.toLowerCase() === "authorization")?.[1];
+    requestAccess = typeof authorization === "string" && /^Bearer sk-ant-oat/i.test(authorization)
+      ? authorization.slice(7) : undefined;
+  });
+  pi.on("after_provider_response", (event) => {
+    const access = requestAccess;
+    requestAccess = undefined;
+    if (!access) return;
+    try { observeClaudeQuota(access, event.headers); }
+    catch { /* Telemetry must never disturb inference. */ }
   });
 
   /**
@@ -236,7 +233,7 @@ export function registerAnthropicProvider(pi: ExtensionAPI): void {
   const startRefreshLoop = () => {
     if (refreshTimer) return;
     refreshTimer = setInterval(
-      () => void refreshAllQuota().catch(() => {}),
+      () => void refreshDueAccessTokens().catch(() => {}),
       ACCESS_REFRESH_INTERVAL_MS + Math.floor(Math.random() * 30_000),
     );
     refreshTimer.unref?.();
@@ -244,12 +241,12 @@ export function registerAnthropicProvider(pi: ExtensionAPI): void {
 
   pi.on("input", async () => {
     startRefreshLoop();
-    void refreshAllQuota().catch(() => {});
+    void refreshDueAccessTokens().catch(() => {});
   });
 
   pi.on("session_start", async (_event: any, ctx: any) => {
     startRefreshLoop();
-    void refreshAllQuota().catch(() => {});
+    void refreshDueAccessTokens().catch(() => {});
     // Off the request path and TTL-gated, so this is one call a day at most.
     void discoverModels(pi, ctx).catch(() => {});
   });

package/src/domains/subscriptions/providers/gemini.ts

@@ -93,11 +93,7 @@ export const GEMINI_SPEC: PooledOAuthProviderSpec<typeof GEMINI_API> = {
     const email = credentialEmail(credential);
     return email ? `email:${email.toLowerCase()}` : undefined;
   },
-  describeAccount: (account) => {
-    const email = credentialEmail(account);
-    const name = account.label || account.id.slice(0, 8);
-    return email ? `${name} (${email})` : name;
-  },
+  describeAccount: (account) => account.label || account.id.slice(0, 8),
   accessTokenOf: (apiKey) => {
     try {
       return decodeApiKey(apiKey).token;

package/src/domains/workflows/runtime/agent-session-providers.ts

@@ -6,6 +6,7 @@ type HostProviderRegistry = Pick<
   | "getApiKeyForProvider"
   | "getProviderAuthStatus"
   | "getRegisteredProviderConfig"
+  | "getRegisteredNativeProvider"
   | "getRegisteredProviderIds"
   | "isUsingOAuth"
 >;
@@ -27,10 +28,14 @@ export async function synchronizeWorkflowModelRuntime(input: {
   }
 
   for (const providerId of hostProviderIds) {
+    const native = host.getRegisteredNativeProvider(providerId);
     const config = host.getRegisteredProviderConfig(providerId);
-    if (!config) continue;
+    if (!native && !config) continue;
     child.unregisterProvider(providerId);
-    child.registerProvider(providerId, config);
+    // Native registrations carry live auth/policy/stream wrappers. Copying only
+    // legacy config silently drops those guards in workflow child sessions.
+    if (native) child.registerNativeProvider(native);
+    else child.registerProvider(providerId, config!);
   }
 
   const selectedProvider = selectedModel?.provider;

package/src/services/usage-service.ts

@@ -119,7 +119,8 @@ export async function refreshUsage(ctx: any, force = false): Promise<void> {
   inFlight = (async () => {
     try {
       const result = await fetchAll(ctx, sourceOptions);
-      const rateLimited = result.errors.some((error) => error.includes("429"));
+      // Claude owns a persistent per-account cooldown; it must not stall other providers.
+      const rateLimited = result.errors.some((error) => !error.startsWith("Claude ") && error.includes("429"));
       recordUsageDrops(result.rows);
 
       // Per-account merge: accounts that failed this cycle keep their last