@juspay/neurolink 10.12.0 → 10.12.2

package/dist/lib/processors/archive/ArchiveProcessor.js

@@ -162,6 +162,17 @@ const SINGLE_STREAM_TOOLS = {
     xz: "xz",
     zst: "zstd",
 };
+/**
+ * Whether a zlib rejection is the output bound firing rather than bad input.
+ *
+ * `maxOutputLength` aborts an inflate the moment its output would pass the cap,
+ * which is the whole point — but it surfaces as a plain `RangeError`, and a
+ * bomb reported as "failed to decompress" reads as a corrupt upload and invites
+ * the user to send it again. It will fail identically every time.
+ *
+ * Keyed on `code`, not the message: the message embeds a byte count.
+ */
+const isDecompressionBoundExceeded = (error) => error?.code === "ERR_BUFFER_TOO_LARGE";
 /** File extensions recognized as archive formats */
 const SUPPORTED_ARCHIVE_EXTENSIONS = [".zip", ".tar", ".gz", ".tgz", ".bz2", ".tbz2", ".jar", ".xz", ".txz", ".zst", ".tzst"];
 // =============================================================================
@@ -761,19 +772,16 @@ export class ArchiveProcessor extends BaseFileProcessor {
             const zlib = await import("zlib");
             const { promisify } = await import("util");
             const gunzip = promisify(zlib.gunzip);
-            const decompressed = await gunzip(buffer);
+            // Bounded at the decoder, matching the zstd path. Checking the length
+            // afterwards only reports a bomb once it has already been paid for: 40KB
+            // of gzip inflates to 40MB, and the allocation is the damage, not the
+            // number. `maxOutputLength` abandons the inflate at the cap instead, so
+            // the ceiling on memory is the limit rather than whatever the attacker
+            // chose. The overflow is classified in the catch below.
+            const decompressed = await gunzip(buffer, {
+                maxOutputLength: ARCHIVE_SECURITY.MAX_DECOMPRESSED_SIZE,
+            });
             const tarBuffer = Buffer.from(decompressed);
-            // Security: check decompressed size
-            if (tarBuffer.length > ARCHIVE_SECURITY.MAX_DECOMPRESSED_SIZE) {
-                return {
-                    success: false,
-                    entries: [],
-                    securityWarnings: [],
-                    error: this.createError(FileErrorCode.SECURITY_VALIDATION_FAILED, {
-                        reason: `Decompressed TAR size (${this.formatSizeMB(tarBuffer.length)} MB) exceeds limit (${this.formatSizeMB(ARCHIVE_SECURITY.MAX_DECOMPRESSED_SIZE)} MB)`,
-                    }),
-                };
-            }
             // Security: check compression ratio
             if (buffer.length > 0) {
                 const ratio = tarBuffer.length / buffer.length;
@@ -793,6 +801,16 @@ export class ArchiveProcessor extends BaseFileProcessor {
             return await this.parseTarStream(tarStream, tarBuffer);
         }
         catch (error) {
+            if (isDecompressionBoundExceeded(error)) {
+                return {
+                    success: false,
+                    entries: [],
+                    securityWarnings: [],
+                    error: this.createError(FileErrorCode.SECURITY_VALIDATION_FAILED, {
+                        reason: `Decompressed TAR size exceeds limit (${this.formatSizeMB(ARCHIVE_SECURITY.MAX_DECOMPRESSED_SIZE)} MB)`,
+                    }),
+                };
+            }
             // Check if the error is one we already created (security validation)
             if (error &&
                 typeof error === "object" &&
@@ -976,18 +994,11 @@ export class ArchiveProcessor extends BaseFileProcessor {
             const zlib = await import("zlib");
             const { promisify } = await import("util");
             const gunzip = promisify(zlib.gunzip);
-            const decompressed = await gunzip(buffer);
-            // Security: check decompressed size
-            if (decompressed.length > ARCHIVE_SECURITY.MAX_DECOMPRESSED_SIZE) {
-                return {
-                    success: false,
-                    entries: [],
-                    securityWarnings: [],
-                    error: this.createError(FileErrorCode.SECURITY_VALIDATION_FAILED, {
-                        reason: `Decompressed size (${this.formatSizeMB(decompressed.length)} MB) exceeds limit (${this.formatSizeMB(ARCHIVE_SECURITY.MAX_DECOMPRESSED_SIZE)} MB)`,
-                    }),
-                };
-            }
+            // Bounded at the decoder — see the matching call in extractTarGzEntries.
+            // The overflow is classified in the catch below.
+            const decompressed = await gunzip(buffer, {
+                maxOutputLength: ARCHIVE_SECURITY.MAX_DECOMPRESSED_SIZE,
+            });
             // Security: compression ratio
             if (buffer.length > 0) {
                 const ratio = decompressed.length / buffer.length;
@@ -1031,6 +1042,16 @@ export class ArchiveProcessor extends BaseFileProcessor {
             return { success: true, entries, securityWarnings, contents };
         }
         catch (error) {
+            if (isDecompressionBoundExceeded(error)) {
+                return {
+                    success: false,
+                    entries: [],
+                    securityWarnings: [],
+                    error: this.createError(FileErrorCode.SECURITY_VALIDATION_FAILED, {
+                        reason: `Decompressed size exceeds limit (${this.formatSizeMB(ARCHIVE_SECURITY.MAX_DECOMPRESSED_SIZE)} MB)`,
+                    }),
+                };
+            }
             return {
                 success: false,
                 entries: [],

package/dist/lib/proxy/accountQuota.d.ts

@@ -14,12 +14,13 @@ import type { AccountQuota } from "../types/index.js";
 export declare function getUnifiedRateLimitStatus(headers: Headers | Record<string, string>): string | undefined;
 /**
  * Whether Anthropic explicitly permits a request to use overage after a
- * subscription window is exhausted. Fresh responses require all three
- * provider signals. Older persisted snapshots predate the raw fallback and
- * upgrade-path fields, but retain a positive fallback percentage together with
- * an allowed overage status, which is the equivalent provider state.
+ * subscription window is exhausted. An active overage signal is authoritative;
+ * otherwise fresh responses require explicit fallback and upgrade-path signals.
+ * Older persisted snapshots predate those raw fields, but retain a positive
+ * fallback percentage together with an allowed overage status, which is the
+ * equivalent provider state.
  */
-export declare function isQuotaOverageAvailable(quota: Pick<AccountQuota, "fallbackPercentage" | "fallbackStatus" | "overageStatus" | "upgradePaths"> | null | undefined): boolean;
+export declare function isQuotaOverageAvailable(quota: Pick<AccountQuota, "fallbackPercentage" | "fallbackStatus" | "overageStatus" | "overageInUse" | "upgradePaths"> | null | undefined): boolean;
 /**
  * Parse Anthropic rate-limit / quota headers into an `AccountQuota`.
  * Returns `null` when key headers are absent.

package/dist/lib/proxy/accountQuota.js

@@ -41,15 +41,19 @@ export function getUnifiedRateLimitStatus(headers) {
 }
 /**
  * Whether Anthropic explicitly permits a request to use overage after a
- * subscription window is exhausted. Fresh responses require all three
- * provider signals. Older persisted snapshots predate the raw fallback and
- * upgrade-path fields, but retain a positive fallback percentage together with
- * an allowed overage status, which is the equivalent provider state.
+ * subscription window is exhausted. An active overage signal is authoritative;
+ * otherwise fresh responses require explicit fallback and upgrade-path signals.
+ * Older persisted snapshots predate those raw fields, but retain a positive
+ * fallback percentage together with an allowed overage status, which is the
+ * equivalent provider state.
  */
 export function isQuotaOverageAvailable(quota) {
     if (quota?.overageStatus?.trim().toLowerCase() !== "allowed") {
         return false;
     }
+    if (quota.overageInUse === true) {
+        return true;
+    }
     const explicitFallback = quota.fallbackStatus?.trim().toLowerCase();
     const hasExplicitOveragePath = (quota.upgradePaths ?? "")
         .split(",")
@@ -93,6 +97,8 @@ export function parseQuotaHeaders(headers) {
         fallbackStatus: getHeader(headers, `${P}unified-fallback`) ?? "unknown",
         upgradePaths: getHeader(headers, `${P}unified-upgrade-paths`),
         overageStatus: getHeader(headers, `${P}unified-overage-status`) ?? "unknown",
+        overageInUse: getHeader(headers, `${P}unified-overage-in-use`)?.trim().toLowerCase() ===
+            "true",
         lastUpdated: Date.now(),
         source: "headers",
     };

package/dist/lib/proxy/proxyAnalysis.js

@@ -101,6 +101,9 @@ function routingCandidateValue(value) {
         optionalNullableStringFields.some((field) => field in candidate &&
             candidate[field] !== undefined &&
             !isNullableString(candidate[field])) ||
+        ("quotaStale" in candidate &&
+            candidate.quotaStale !== undefined &&
+            typeof candidate.quotaStale !== "boolean") ||
         ("overageEligible" in candidate &&
             candidate.overageEligible !== undefined &&
             typeof candidate.overageEligible !== "boolean") ||
@@ -118,6 +121,7 @@ function routingCandidateValue(value) {
         usable: candidate.usable,
         saturated: candidate.saturated,
         quotaObserved: candidate.quotaObserved,
+        quotaStale: candidate.quotaStale === true,
         quotaLastUpdated: candidate.quotaLastUpdated,
         quotaAgeMs: candidate.quotaAgeMs,
         coolingActive: candidate.coolingActive,

package/dist/lib/server/routes/claudeProxyRoutes.d.ts

@@ -70,8 +70,9 @@ declare function reconcileCooldownFromQuota(state: RuntimeAccountState, quota: A
  * proxy restart: all accounts tie, selection falls back to token-store
  * enumeration order, and the first account served becomes self-reinforcing
  * (it alone has data) — starving the others regardless of their resets.
- * Never overwrites fresher in-memory quota; stale disk snapshots degrade
- * gracefully because past reset timestamps are ignored by resetEpochToMs.
+ * Never overwrites fresher in-memory quota. Persisted quota cannot create or
+ * clear a cooldown: only an existing cooldown or fresh upstream response
+ * headers can change admission state.
  */
 declare function seedRuntimeQuotasFromDisk(accounts: ProxyPassthroughAccount[]): Promise<void>;
 /**

package/dist/lib/server/routes/claudeProxyRoutes.js

@@ -110,6 +110,9 @@ function fetchAnthropicUpstream(url, init) {
     });
 }
 const accountRuntimeState = new Map();
+/** Persisted quota is advisory after a restart. Older snapshots cannot reject
+ * an account or create a new cooldown because the provider may have reset it. */
+const QUOTA_SNAPSHOT_FRESHNESS_MS = 15 * 60 * 1000;
 /** Shared across requests so a concurrent burst gets at most two retries for
  *  the account/window, rather than every request starting its own retry chain. */
 const transientRateLimitRetryBudgets = new Map();
@@ -603,8 +606,9 @@ function reconcileCooldownFromQuota(state, quota, now) {
  * proxy restart: all accounts tie, selection falls back to token-store
  * enumeration order, and the first account served becomes self-reinforcing
  * (it alone has data) — starving the others regardless of their resets.
- * Never overwrites fresher in-memory quota; stale disk snapshots degrade
- * gracefully because past reset timestamps are ignored by resetEpochToMs.
+ * Never overwrites fresher in-memory quota. Persisted quota cannot create or
+ * clear a cooldown: only an existing cooldown or fresh upstream response
+ * headers can change admission state.
  */
 async function seedRuntimeQuotasFromDisk(accounts) {
     try {
@@ -625,15 +629,6 @@ async function seedRuntimeQuotasFromDisk(accounts) {
                 state.coolingUntil = persistedCooldown.coolingUntil;
                 state.coolingReason = persistedCooldown.reason;
             }
-            if (state.quota) {
-                const cooldownUpdate = reconcileCooldownFromQuota(state, state.quota, now);
-                if (cooldownUpdate?.kind === "cooled") {
-                    await saveAccountCooldown(account.key, cooldownUpdate.coolingUntil, cooldownUpdate.coolingReason);
-                }
-                else if (cooldownUpdate?.kind === "cleared") {
-                    await clearAccountCooldown(account.key, cooldownUpdate.coolingUntil);
-                }
-            }
         }
     }
     catch {
@@ -802,47 +797,59 @@ function getSessionResetToleranceMs() {
 function accountSortMetrics(accountKey, now, sessionSoftLimit, sessionResetToleranceMs) {
     const st = accountRuntimeState.get(accountKey);
     const q = st?.quota;
+    const quotaLastUpdated = q && Number.isFinite(q.lastUpdated) ? q.lastUpdated : null;
+    const quotaAgeMs = quotaLastUpdated === null ? null : Math.max(0, now - quotaLastUpdated);
+    const quotaStale = quotaAgeMs !== null && quotaAgeMs > QUOTA_SNAPSHOT_FRESHNESS_MS;
+    const routingQuota = quotaStale ? undefined : q;
     const coolingActive = !!st?.coolingUntil && now < st.coolingUntil;
     // resetEpochToMs returns undefined for absent OR passed resets, so a
     // ticking window is exactly "reset !== undefined".
-    const weeklyReset = resetEpochToMs(q?.weeklyResetAt, now);
-    const sessionReset = resetEpochToMs(q?.sessionResetAt, now);
+    const weeklyReset = resetEpochToMs(routingQuota?.weeklyResetAt, now);
+    const sessionReset = resetEpochToMs(routingQuota?.sessionResetAt, now);
     const sessionTicking = sessionReset !== undefined;
     const weeklyTicking = weeklyReset !== undefined;
-    const sessionUsed = q ? (sessionTicking ? (q.sessionUsed ?? 0) : 0) : null;
-    const weeklyUsed = q ? (weeklyTicking ? (q.weeklyUsed ?? null) : 0) : null;
-    const sessionStatus = q
+    const sessionUsed = routingQuota
         ? sessionTicking
-            ? (q.sessionStatus ?? "unknown")
+            ? (routingQuota.sessionUsed ?? 0)
+            : 0
+        : null;
+    const weeklyUsed = routingQuota
+        ? weeklyTicking
+            ? (routingQuota.weeklyUsed ?? null)
+            : 0
+        : null;
+    const sessionStatus = routingQuota
+        ? sessionTicking
+            ? (routingQuota.sessionStatus ?? "unknown")
             : "allowed"
         : null;
-    const weeklyStatus = q
+    const weeklyStatus = routingQuota
         ? weeklyTicking
-            ? (q.weeklyStatus ?? "unknown")
+            ? (routingQuota.weeklyStatus ?? "unknown")
             : "allowed"
         : null;
-    const overageEligible = isQuotaOverageAvailable(q);
+    const overageEligible = isQuotaOverageAvailable(routingQuota);
     const saturated = sessionStatus === "throttled" ||
         (sessionTicking && (sessionUsed ?? 0) >= sessionSoftLimit);
-    const quotaLastUpdated = q && Number.isFinite(q.lastUpdated) ? q.lastUpdated : null;
     return {
         usable: !coolingActive &&
             weeklyStatus !== "rejected" &&
             (sessionStatus !== "rejected" || overageEligible) &&
-            (q?.unifiedStatus?.trim().toLowerCase() !== "rejected" ||
+            (routingQuota?.unifiedStatus?.trim().toLowerCase() !== "rejected" ||
                 overageEligible),
-        saturated,
-        hasQuota: !!q,
+        saturated: !quotaStale && saturated,
+        hasQuota: !!routingQuota,
+        quotaStale,
         quotaLastUpdated,
-        quotaAgeMs: quotaLastUpdated === null ? null : Math.max(0, now - quotaLastUpdated),
+        quotaAgeMs,
         coolingActive,
         coolingReason: st?.coolingReason ?? null,
         coolingUntil: st?.coolingUntil ?? 0,
-        unifiedStatus: q?.unifiedStatus ?? null,
-        fallbackStatus: q?.fallbackStatus ?? null,
-        upgradePaths: q?.upgradePaths ?? null,
+        unifiedStatus: routingQuota?.unifiedStatus ?? null,
+        fallbackStatus: routingQuota?.fallbackStatus ?? null,
+        upgradePaths: routingQuota?.upgradePaths ?? null,
         overageEligible,
-        overageStatus: q?.overageStatus ?? null,
+        overageStatus: routingQuota?.overageStatus ?? null,
         sessionStatus,
         sessionUsed,
         sessionResetBucket: sessionTicking
@@ -960,6 +967,7 @@ function buildRoutingDecision(args) {
             usable: metrics.usable,
             saturated: metrics.saturated,
             quotaObserved: metrics.hasQuota,
+            quotaStale: metrics.quotaStale,
             quotaLastUpdated: metrics.quotaLastUpdated,
             quotaAgeMs: metrics.quotaAgeMs,
             coolingActive: metrics.coolingActive,

package/dist/lib/types/proxy.d.ts

@@ -439,6 +439,7 @@ export type ProxyAccountRoutingCandidate = {
     usable: boolean;
     saturated: boolean;
     quotaObserved: boolean;
+    quotaStale: boolean;
     quotaLastUpdated: number | null;
     quotaAgeMs: number | null;
     coolingActive: boolean;
@@ -477,6 +478,7 @@ export type ProxyAccountSortMetrics = {
     usable: boolean;
     saturated: boolean;
     hasQuota: boolean;
+    quotaStale: boolean;
     quotaLastUpdated: number | null;
     quotaAgeMs: number | null;
     coolingActive: boolean;
@@ -941,6 +943,8 @@ export type AccountQuota = {
     upgradePaths?: string;
     /** "allowed" | "rejected" */
     overageStatus: string;
+    /** Whether Anthropic reports that paid overage is actively serving traffic. */
+    overageInUse?: boolean;
     /** Epoch ms when we last captured this data */
     lastUpdated: number;
     /** Dynamic per-plan limit buckets from the usage API `limits[]` array

package/dist/processors/archive/ArchiveProcessor.js

@@ -162,6 +162,17 @@ const SINGLE_STREAM_TOOLS = {
     xz: "xz",
     zst: "zstd",
 };
+/**
+ * Whether a zlib rejection is the output bound firing rather than bad input.
+ *
+ * `maxOutputLength` aborts an inflate the moment its output would pass the cap,
+ * which is the whole point — but it surfaces as a plain `RangeError`, and a
+ * bomb reported as "failed to decompress" reads as a corrupt upload and invites
+ * the user to send it again. It will fail identically every time.
+ *
+ * Keyed on `code`, not the message: the message embeds a byte count.
+ */
+const isDecompressionBoundExceeded = (error) => error?.code === "ERR_BUFFER_TOO_LARGE";
 /** File extensions recognized as archive formats */
 const SUPPORTED_ARCHIVE_EXTENSIONS = [".zip", ".tar", ".gz", ".tgz", ".bz2", ".tbz2", ".jar", ".xz", ".txz", ".zst", ".tzst"];
 // =============================================================================
@@ -761,19 +772,16 @@ export class ArchiveProcessor extends BaseFileProcessor {
             const zlib = await import("zlib");
             const { promisify } = await import("util");
             const gunzip = promisify(zlib.gunzip);
-            const decompressed = await gunzip(buffer);
+            // Bounded at the decoder, matching the zstd path. Checking the length
+            // afterwards only reports a bomb once it has already been paid for: 40KB
+            // of gzip inflates to 40MB, and the allocation is the damage, not the
+            // number. `maxOutputLength` abandons the inflate at the cap instead, so
+            // the ceiling on memory is the limit rather than whatever the attacker
+            // chose. The overflow is classified in the catch below.
+            const decompressed = await gunzip(buffer, {
+                maxOutputLength: ARCHIVE_SECURITY.MAX_DECOMPRESSED_SIZE,
+            });
             const tarBuffer = Buffer.from(decompressed);
-            // Security: check decompressed size
-            if (tarBuffer.length > ARCHIVE_SECURITY.MAX_DECOMPRESSED_SIZE) {
-                return {
-                    success: false,
-                    entries: [],
-                    securityWarnings: [],
-                    error: this.createError(FileErrorCode.SECURITY_VALIDATION_FAILED, {
-                        reason: `Decompressed TAR size (${this.formatSizeMB(tarBuffer.length)} MB) exceeds limit (${this.formatSizeMB(ARCHIVE_SECURITY.MAX_DECOMPRESSED_SIZE)} MB)`,
-                    }),
-                };
-            }
             // Security: check compression ratio
             if (buffer.length > 0) {
                 const ratio = tarBuffer.length / buffer.length;
@@ -793,6 +801,16 @@ export class ArchiveProcessor extends BaseFileProcessor {
             return await this.parseTarStream(tarStream, tarBuffer);
         }
         catch (error) {
+            if (isDecompressionBoundExceeded(error)) {
+                return {
+                    success: false,
+                    entries: [],
+                    securityWarnings: [],
+                    error: this.createError(FileErrorCode.SECURITY_VALIDATION_FAILED, {
+                        reason: `Decompressed TAR size exceeds limit (${this.formatSizeMB(ARCHIVE_SECURITY.MAX_DECOMPRESSED_SIZE)} MB)`,
+                    }),
+                };
+            }
             // Check if the error is one we already created (security validation)
             if (error &&
                 typeof error === "object" &&
@@ -976,18 +994,11 @@ export class ArchiveProcessor extends BaseFileProcessor {
             const zlib = await import("zlib");
             const { promisify } = await import("util");
             const gunzip = promisify(zlib.gunzip);
-            const decompressed = await gunzip(buffer);
-            // Security: check decompressed size
-            if (decompressed.length > ARCHIVE_SECURITY.MAX_DECOMPRESSED_SIZE) {
-                return {
-                    success: false,
-                    entries: [],
-                    securityWarnings: [],
-                    error: this.createError(FileErrorCode.SECURITY_VALIDATION_FAILED, {
-                        reason: `Decompressed size (${this.formatSizeMB(decompressed.length)} MB) exceeds limit (${this.formatSizeMB(ARCHIVE_SECURITY.MAX_DECOMPRESSED_SIZE)} MB)`,
-                    }),
-                };
-            }
+            // Bounded at the decoder — see the matching call in extractTarGzEntries.
+            // The overflow is classified in the catch below.
+            const decompressed = await gunzip(buffer, {
+                maxOutputLength: ARCHIVE_SECURITY.MAX_DECOMPRESSED_SIZE,
+            });
             // Security: compression ratio
             if (buffer.length > 0) {
                 const ratio = decompressed.length / buffer.length;
@@ -1031,6 +1042,16 @@ export class ArchiveProcessor extends BaseFileProcessor {
             return { success: true, entries, securityWarnings, contents };
         }
         catch (error) {
+            if (isDecompressionBoundExceeded(error)) {
+                return {
+                    success: false,
+                    entries: [],
+                    securityWarnings: [],
+                    error: this.createError(FileErrorCode.SECURITY_VALIDATION_FAILED, {
+                        reason: `Decompressed size exceeds limit (${this.formatSizeMB(ARCHIVE_SECURITY.MAX_DECOMPRESSED_SIZE)} MB)`,
+                    }),
+                };
+            }
             return {
                 success: false,
                 entries: [],

package/dist/proxy/accountQuota.d.ts

@@ -14,12 +14,13 @@ import type { AccountQuota } from "../types/index.js";
 export declare function getUnifiedRateLimitStatus(headers: Headers | Record<string, string>): string | undefined;
 /**
  * Whether Anthropic explicitly permits a request to use overage after a
- * subscription window is exhausted. Fresh responses require all three
- * provider signals. Older persisted snapshots predate the raw fallback and
- * upgrade-path fields, but retain a positive fallback percentage together with
- * an allowed overage status, which is the equivalent provider state.
+ * subscription window is exhausted. An active overage signal is authoritative;
+ * otherwise fresh responses require explicit fallback and upgrade-path signals.
+ * Older persisted snapshots predate those raw fields, but retain a positive
+ * fallback percentage together with an allowed overage status, which is the
+ * equivalent provider state.
  */
-export declare function isQuotaOverageAvailable(quota: Pick<AccountQuota, "fallbackPercentage" | "fallbackStatus" | "overageStatus" | "upgradePaths"> | null | undefined): boolean;
+export declare function isQuotaOverageAvailable(quota: Pick<AccountQuota, "fallbackPercentage" | "fallbackStatus" | "overageStatus" | "overageInUse" | "upgradePaths"> | null | undefined): boolean;
 /**
  * Parse Anthropic rate-limit / quota headers into an `AccountQuota`.
  * Returns `null` when key headers are absent.

package/dist/proxy/accountQuota.js

@@ -41,15 +41,19 @@ export function getUnifiedRateLimitStatus(headers) {
 }
 /**
  * Whether Anthropic explicitly permits a request to use overage after a
- * subscription window is exhausted. Fresh responses require all three
- * provider signals. Older persisted snapshots predate the raw fallback and
- * upgrade-path fields, but retain a positive fallback percentage together with
- * an allowed overage status, which is the equivalent provider state.
+ * subscription window is exhausted. An active overage signal is authoritative;
+ * otherwise fresh responses require explicit fallback and upgrade-path signals.
+ * Older persisted snapshots predate those raw fields, but retain a positive
+ * fallback percentage together with an allowed overage status, which is the
+ * equivalent provider state.
  */
 export function isQuotaOverageAvailable(quota) {
     if (quota?.overageStatus?.trim().toLowerCase() !== "allowed") {
         return false;
     }
+    if (quota.overageInUse === true) {
+        return true;
+    }
     const explicitFallback = quota.fallbackStatus?.trim().toLowerCase();
     const hasExplicitOveragePath = (quota.upgradePaths ?? "")
         .split(",")
@@ -93,6 +97,8 @@ export function parseQuotaHeaders(headers) {
         fallbackStatus: getHeader(headers, `${P}unified-fallback`) ?? "unknown",
         upgradePaths: getHeader(headers, `${P}unified-upgrade-paths`),
         overageStatus: getHeader(headers, `${P}unified-overage-status`) ?? "unknown",
+        overageInUse: getHeader(headers, `${P}unified-overage-in-use`)?.trim().toLowerCase() ===
+            "true",
         lastUpdated: Date.now(),
         source: "headers",
     };

package/dist/proxy/proxyAnalysis.js

@@ -101,6 +101,9 @@ function routingCandidateValue(value) {
         optionalNullableStringFields.some((field) => field in candidate &&
             candidate[field] !== undefined &&
             !isNullableString(candidate[field])) ||
+        ("quotaStale" in candidate &&
+            candidate.quotaStale !== undefined &&
+            typeof candidate.quotaStale !== "boolean") ||
         ("overageEligible" in candidate &&
             candidate.overageEligible !== undefined &&
             typeof candidate.overageEligible !== "boolean") ||
@@ -118,6 +121,7 @@ function routingCandidateValue(value) {
         usable: candidate.usable,
         saturated: candidate.saturated,
         quotaObserved: candidate.quotaObserved,
+        quotaStale: candidate.quotaStale === true,
         quotaLastUpdated: candidate.quotaLastUpdated,
         quotaAgeMs: candidate.quotaAgeMs,
         coolingActive: candidate.coolingActive,

package/dist/server/routes/claudeProxyRoutes.d.ts

@@ -70,8 +70,9 @@ declare function reconcileCooldownFromQuota(state: RuntimeAccountState, quota: A
  * proxy restart: all accounts tie, selection falls back to token-store
  * enumeration order, and the first account served becomes self-reinforcing
  * (it alone has data) — starving the others regardless of their resets.
- * Never overwrites fresher in-memory quota; stale disk snapshots degrade
- * gracefully because past reset timestamps are ignored by resetEpochToMs.
+ * Never overwrites fresher in-memory quota. Persisted quota cannot create or
+ * clear a cooldown: only an existing cooldown or fresh upstream response
+ * headers can change admission state.
  */
 declare function seedRuntimeQuotasFromDisk(accounts: ProxyPassthroughAccount[]): Promise<void>;
 /**