@oh-my-pi/pi-ai 18.4.4 → 18.4.6

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@oh-my-pi/pi-ai",
-	"version": "18.4.4",
+	"version": "18.4.6",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"keywords": [
 		"ai",
@@ -155,11 +155,11 @@
 		"fmt": "oxfmt --no-error-on-unmatched-pattern 'src/**/*.{ts,tsx}' '{test,bench,examples,scripts}/**/*.ts' '*.ts'"
 	},
 	"dependencies": {
-		"@oh-my-pi/omptype": "18.4.4",
-		"@oh-my-pi/pi-catalog": "18.4.4",
-		"@oh-my-pi/pi-natives": "18.4.4",
-		"@oh-my-pi/pi-utils": "18.4.4",
-		"@oh-my-pi/pi-wire": "18.4.4"
+		"@oh-my-pi/omptype": "18.4.6",
+		"@oh-my-pi/pi-catalog": "18.4.6",
+		"@oh-my-pi/pi-natives": "18.4.6",
+		"@oh-my-pi/pi-utils": "18.4.6",
+		"@oh-my-pi/pi-wire": "18.4.6"
 	},
 	"devDependencies": {
 		"@types/bun": "^1.3.14"

package/src/api-registry.ts

@@ -29,6 +29,7 @@ const BUILTIN_API_IDS = [
 	"google-vertex",
 	"ollama-chat",
 	"cursor-agent",
+	"factory-droid-agent",
 	"gitlab-duo-agent",
 	"devin-agent",
 	"apple-foundation-models",

package/src/auth/cascade.ts

@@ -8,7 +8,15 @@ import { getEnvApiKey, getEnvApiKeyName } from "../stream";
 import type { SessionAffinity } from "./affinity";
 import type { CredentialPool } from "./pool";
 import type { CredentialSelector } from "./select";
-import type { AuthApiKeyOptions, AuthCredential, AuthSource, AuthSourceOptions, KeysApi, LimitsApi } from "./types";
+import type {
+	AuthApiKeyOptions,
+	AuthCredential,
+	AuthSource,
+	AuthSourceOptions,
+	KeysApi,
+	LimitsApi,
+	OAuthRequestIdentity,
+} from "./types";
 
 /**
  * Default config value resolver that checks env vars and treats as literal.
@@ -23,6 +31,7 @@ async function defaultConfigValueResolver(config: string): Promise<string | unde
 export class KeyOverrides {
 	#runtimeOverrides: Map<string, string> = new Map();
 	#configOverrides: Map<string, string> = new Map();
+	#configFallbacks: Map<string, string> = new Map();
 	#configValueResolver: (config: string) => Promise<string | undefined>;
 
 	constructor(resolver?: (config: string) => Promise<string | undefined>) {
@@ -41,6 +50,11 @@ export class KeyOverrides {
 		return this.#configOverrides.get(provider);
 	}
 
+	/** Config value consulted only after stored OAuth/login credentials. */
+	fallbackKey(provider: string): string | undefined {
+		return this.#configFallbacks.get(provider);
+	}
+
 	/** Resolve a config value (env var name, "!command", literal) to the secret. */
 	resolve(config: string): Promise<string | undefined> {
 		return this.#configValueResolver(config);
@@ -70,16 +84,28 @@ export class KeyOverrides {
 	 *
 	 * Lower priority than {@link KeyOverrides.setRuntime} so a CLI `--api-key`
 	 * still wins for the duration of a single invocation.
+	 *
+	 * `fallback: true` instead ranks the value below stored OAuth and `/login`
+	 * credentials (at the env-var tier). Providers that own a `/login` flow use
+	 * this so their default key reference (e.g. an unset env-var name, which
+	 * resolves to its literal text) cannot shadow the key the user logged in with.
 	 */
-	setConfig(provider: string, apiKeyConfig: string): void {
-		this.#configOverrides.set(provider, apiKeyConfig);
+	setConfig(provider: string, apiKeyConfig: string, options?: { fallback?: boolean }): void {
+		if (options?.fallback) {
+			this.#configOverrides.delete(provider);
+			this.#configFallbacks.set(provider, apiKeyConfig);
+		} else {
+			this.#configFallbacks.delete(provider);
+			this.#configOverrides.set(provider, apiKeyConfig);
+		}
 	}
 
 	/**
-	 * Remove a single config-sourced API key override.
+	 * Remove a single config-sourced API key (override or fallback).
 	 */
 	removeConfig(provider: string): void {
 		this.#configOverrides.delete(provider);
+		this.#configFallbacks.delete(provider);
 	}
 
 	/**
@@ -88,6 +114,7 @@ export class KeyOverrides {
 	 */
 	clearConfig(): void {
 		this.#configOverrides.clear();
+		this.#configFallbacks.clear();
 	}
 
 	/**
@@ -169,7 +196,7 @@ export class KeyCascade implements KeysApi {
 	/**
 	 * Classify where a provider's auth comes from, following the same precedence
 	 * as {@link KeyCascade.get}: runtime override → config override →
-	 * stored OAuth → login-stored api_key → env var → stored api_key.
+	 * stored OAuth → login-stored api_key → config fallback → env var → stored api_key.
 	 * Returns undefined when no auth is configured.
 	 *
 	 * Compact, structured counterpart to {@link KeyCascade.describe}; `env`
@@ -184,6 +211,7 @@ export class KeyCascade implements KeysApi {
 		if (bearing.some(credential => credential.type === "api_key" && credential.source === "login")) {
 			return { kind: "api_key", concrete: true };
 		}
+		if (this.#deps.overrides.fallbackKey(provider) !== undefined) return { kind: "config", concrete: true };
 		if (
 			(env === "dedicated" && this.#hasDedicatedEnvAuth(provider)) ||
 			(env === "aliases" && (this.#hasDedicatedEnvAuth(provider) || Boolean(getEnvApiKey(provider))))
@@ -256,6 +284,9 @@ export class KeyCascade implements KeysApi {
 			return this.#deps.overrides.resolve(loginApiKeySelection.credential.key);
 		}
 
+		const fallbackKey = this.#deps.overrides.fallbackKey(provider);
+		if (fallbackKey !== undefined) return this.#deps.overrides.resolve(fallbackKey);
+
 		const envKey = getEnvApiKey(provider);
 		if (envKey) return envKey;
 
@@ -273,10 +304,12 @@ export class KeyCascade implements KeysApi {
 		options?: AuthApiKeyOptions,
 	): Promise<ResolvedApiKey | undefined> {
 		let credentialId: number | undefined;
-		const apiKey = await this.get(provider, sessionId, options, id => {
+		let oauthIdentity: OAuthRequestIdentity | undefined;
+		const apiKey = await this.get(provider, sessionId, options, (id, identity) => {
 			credentialId = id;
+			oauthIdentity = identity;
 		});
-		return apiKey === undefined ? undefined : { apiKey, credentialId };
+		return apiKey === undefined ? undefined : { apiKey, credentialId, ...(oauthIdentity ? { oauthIdentity } : {}) };
 	}
 
 	/**
@@ -288,7 +321,7 @@ export class KeyCascade implements KeysApi {
 		provider: string,
 		sessionId?: string,
 		options?: AuthApiKeyOptions,
-		onCredentialId?: (id: number) => void,
+		onCredentialId?: (id: number, identity?: OAuthRequestIdentity) => void,
 	): Promise<string | undefined> {
 		// Runtime override takes highest priority
 		const runtimeKey = this.#deps.overrides.runtimeKey(provider);
@@ -310,7 +343,10 @@ export class KeyCascade implements KeysApi {
 		// then a stored static api_key (which may be a stale broker-migrated copy) as a last resort.
 		const oauthResolved = await this.#deps.selector.resolveOAuth(provider, sessionId, options);
 		if (oauthResolved) {
-			if (oauthResolved.credentialId !== undefined) onCredentialId?.(oauthResolved.credentialId);
+			if (onCredentialId && oauthResolved.credentialId !== undefined) {
+				const { orgId, region, inferenceRegion } = oauthResolved.credential;
+				onCredentialId(oauthResolved.credentialId, { orgId, region, inferenceRegion });
+			}
 			return oauthResolved.apiKey;
 		}
 		const loginApiKeySelection = await this.#deps.selector.selectApiKey(
@@ -334,6 +370,9 @@ export class KeyCascade implements KeysApi {
 		// suppresses account_uuid for this session.
 		if (sessionId) this.#deps.affinity.forget(provider, sessionId);
 
+		const fallbackKey = this.#deps.overrides.fallbackKey(provider);
+		if (fallbackKey !== undefined) return this.#deps.overrides.resolve(fallbackKey);
+
 		const envKey = getEnvApiKey(provider);
 		if (envKey) return envKey;
 		const apiKeySelection = await this.#deps.selector.selectApiKey(
@@ -458,6 +497,7 @@ export class KeyCascade implements KeysApi {
 				!this.isKeylessFallback(provider, credential),
 		);
 		if (loginApiKeySource) return loginApiKeySource;
+		if (this.#deps.overrides.fallbackKey(provider) !== undefined) return "provider config (fallback)";
 		if (getEnvApiKey(provider)) return `env (over ${baseLabel})`;
 		const apiKeySource = describeStored(
 			"api_key",
@@ -475,8 +515,8 @@ export class KeyCascade implements KeysApi {
 		this.#deps.overrides.removeRuntime(provider);
 	}
 
-	setConfig(provider: string, apiKeyConfig: string): void {
-		this.#deps.overrides.setConfig(provider, apiKeyConfig);
+	setConfig(provider: string, apiKeyConfig: string, options?: { fallback?: boolean }): void {
+		this.#deps.overrides.setConfig(provider, apiKeyConfig, options);
 	}
 
 	removeConfig(provider: string): void {

package/src/auth/health.ts

@@ -76,6 +76,9 @@ export class CredentialHealth implements HealthApi {
 			email: credential.email,
 			enterpriseUrl: credential.enterpriseUrl,
 			apiEndpoint: credential.apiEndpoint,
+			orgId: credential.orgId,
+			region: credential.region,
+			inferenceRegion: credential.inferenceRegion,
 		};
 	}
 

package/src/auth/oauth.ts

@@ -151,6 +151,8 @@ export class OAuthAccounts implements OAuthApi {
 			apiEndpoint: credential.apiEndpoint,
 			orgId: credential.orgId,
 			orgName: credential.orgName,
+			region: credential.region,
+			inferenceRegion: credential.inferenceRegion,
 		};
 	}
 
@@ -206,6 +208,8 @@ export class OAuthAccounts implements OAuthApi {
 				enterpriseUrl: credential.enterpriseUrl,
 				orgId: credential.orgId,
 				orgName: credential.orgName,
+				region: credential.region,
+				inferenceRegion: credential.inferenceRegion,
 			};
 		} catch (error) {
 			return {

package/src/auth/rank.ts

@@ -20,6 +20,11 @@ export type UsageCandidate<T extends AuthCredential> = {
 	inReserve?: boolean;
 	/** True only when reserve ranking had a usable remaining-fraction measurement. */
 	reserveMeasured?: boolean;
+	/**
+	 * Present after ranking: the account's renewable allowance for this request is
+	 * spent, so if it still serves it draws on paid overage such as Codex credits.
+	 */
+	allowanceSpent?: boolean;
 };
 
 /** OAuth credential eligible for usage ranking. */
@@ -39,6 +44,7 @@ export type UsageRankedCandidate<T extends AuthCredential> = UsageCandidate<T> &
 	reserveMeasured?: boolean;
 	accountPriority: number;
 	hasPriorityBoost: boolean;
+	allowanceSpent: boolean;
 	usageMeasured: boolean;
 	planPriority: number;
 	secondaryUsed: number;
@@ -90,6 +96,9 @@ function compareUsageRankedCandidatePriority(
 	if (planGated && left.planPriority !== right.planPriority) {
 		return left.planPriority - right.planPriority;
 	}
+	// Paid overage (Codex credits) never renews, so an account serving past its
+	// allowance yields to any sibling whose renewable allowance is left (#13889).
+	if (left.allowanceSpent !== right.allowanceSpent) return left.allowanceSpent ? 1 : -1;
 	if (left.inReserve !== right.inReserve) return left.inReserve ? 1 : -1;
 	if (left.hasPriorityBoost !== right.hasPriorityBoost) return left.hasPriorityBoost ? -1 : 1;
 	// Short-window guard: candidates whose primary (e.g. 5h) window is
@@ -130,7 +139,7 @@ function compareUsageRankedCandidates(
 	return priority !== 0 ? priority : left.orderPos - right.orderPos;
 }
 
-/** Sort ranked candidates by blocks, plan, reserve, boost, hot window, usage and drain. */
+/** Sort ranked candidates by blocks, plan, spent allowance, reserve, boost, hot window, usage and drain. */
 export function orderUsageRankedCandidates<T extends AuthCredential>(
 	candidates: UsageRankedCandidate<T>[],
 	planGated: boolean,
@@ -142,5 +151,6 @@ export function orderUsageRankedCandidates<T extends AuthCredential>(
 		usageChecked: candidate.usageChecked,
 		inReserve: candidate.inReserve,
 		reserveMeasured: candidate.reserveMeasured,
+		allowanceSpent: candidate.allowanceSpent,
 	}));
 }

package/src/auth/refresh.ts

@@ -44,6 +44,32 @@ const OAUTH_REFRESH_LEASE_RENEW_MS = 5_000;
 const OAUTH_REFRESH_OPERATION_TIMEOUT_MS = 10_000;
 const DEFAULT_OAUTH_REFRESH_TIMEOUT_MS = 10_000;
 
+type OrganizationScope = Pick<
+	OAuthCredentials,
+	"orgId" | "region" | "inferenceRegion" | "activeOrganizationId" | "orgName"
+>;
+
+/**
+ * Organization-scoped identity after a refresh: refreshed values win; stored
+ * org/residency/inference scope carries over only while the organization is
+ * unchanged. The WorkOS selection always falls back to the stored one.
+ */
+export function mergeRefreshedOrganizationScope(
+	current: OrganizationScope,
+	refreshed: OrganizationScope,
+): OrganizationScope {
+	const sameOrg =
+		(refreshed.orgId === undefined || refreshed.orgId === current.orgId) &&
+		(refreshed.activeOrganizationId === undefined || refreshed.activeOrganizationId === current.activeOrganizationId);
+	return {
+		orgId: refreshed.orgId ?? (sameOrg ? current.orgId : undefined),
+		region: refreshed.region ?? (sameOrg ? current.region : undefined),
+		inferenceRegion: refreshed.inferenceRegion ?? (sameOrg ? current.inferenceRegion : undefined),
+		activeOrganizationId: refreshed.activeOrganizationId ?? current.activeOrganizationId,
+		orgName: refreshed.orgName ?? (sameOrg ? current.orgName : undefined),
+	};
+}
+
 /** Merge provider refresh bytes with the stored OAuth row, preserving subtype metadata for every refresh path. */
 export function mergeRefreshedCredential<T extends OAuthCredential>(current: T, refreshed: OAuthCredentials): T {
 	return {
@@ -56,8 +82,7 @@ export function mergeRefreshedCredential<T extends OAuthCredential>(current: T,
 		projectId: refreshed.projectId ?? current.projectId,
 		enterpriseUrl: refreshed.enterpriseUrl ?? current.enterpriseUrl,
 		apiEndpoint: refreshed.apiEndpoint ?? current.apiEndpoint,
-		orgId: refreshed.orgId ?? current.orgId,
-		orgName: refreshed.orgName ?? current.orgName,
+		...mergeRefreshedOrganizationScope(current, refreshed),
 		authorizedAt: refreshed.authorizedAt ?? current.authorizedAt,
 	};
 }

package/src/auth/select.ts

@@ -267,6 +267,7 @@ export class CredentialSelector {
 				blockedUntil,
 				inReserve: false,
 				accountPriority: 0,
+				allowanceSpent: remainingUsageFraction(strategy, usage, args.rankingContext, nowMs) === 0,
 				usageMeasured,
 				hasPriorityBoost: strategy.hasPriorityBoost?.(primary, primaryUncapped, args.rankingContext) ?? false,
 				planPriority: 0,
@@ -469,6 +470,7 @@ export class CredentialSelector {
 					reserveFraction !== undefined && remainingFraction !== undefined && remainingFraction <= reserveFraction,
 				reserveMeasured: reserveFraction !== undefined && remainingFraction !== undefined,
 				accountPriority: policy?.priority === undefined || !Number.isFinite(policy.priority) ? 0 : policy.priority,
+				allowanceSpent: remainingFraction === 0,
 				usageMeasured,
 				hasPriorityBoost: strategy?.hasPriorityBoost?.(primary, primaryUncapped, args.rankingContext) ?? false,
 				planPriority: planPriority(args.planGate, usage),
@@ -573,12 +575,27 @@ export class CredentialSelector {
 			sessionPreferredCanRefreshOrUse &&
 			!this.#deps.blocks.isBlocked(provider, providerKey, sessionPreferredIndex, blockScopes);
 		const sessionPinIsExplicit = sessionCredential?.type === "oauth" && sessionCredential.explicit === true;
+		const rankDespitePin =
+			!sessionPreferredIsAvailable ||
+			!sessionPreferredIsWarm ||
+			hasPlanRequirement ||
+			(policyReserveEnabled && !sessionPinIsExplicit);
+		// A warm automatic pin whose allowance is spent keeps serving on paid overage
+		// (Codex credits) and is never blocked, so check it and rank when spent: a
+		// sibling with renewable allowance left must take over (#13889). tryOAuth
+		// reads this same report for the pin, so it is handed on below.
+		const sessionPreferredUsage =
+			checkUsage && !rankDespitePin && !sessionPinIsExplicit && sessionPreferredCredential
+				? await this.#deps.usage.report(provider, sessionPreferredCredential, {
+						...options,
+						timeoutMs: this.#deps.usage.requestTimeoutMs,
+					})
+				: undefined;
 		const shouldRank =
 			checkUsage &&
-			(!sessionPreferredIsAvailable ||
-				!sessionPreferredIsWarm ||
-				hasPlanRequirement ||
-				(policyReserveEnabled && !sessionPinIsExplicit));
+			(rankDespitePin ||
+				(sessionPreferredUsage !== undefined &&
+					remainingUsageFraction(strategy, sessionPreferredUsage, rankingContext, Date.now()) === 0));
 		// When ranking, seed the pinned credential first in the evaluation order so it wins genuine
 		// ties (the ranked comparator falls back to `orderPos`) without overriding a strictly-better
 		// sibling — this respects the residual value of a same-account shared static prefix that other
@@ -621,11 +638,11 @@ export class CredentialSelector {
 			: policyOrder
 					.map(idx => credentials[idx])
 					.filter((selection): selection is { credential: OAuthCredential; index: number } => Boolean(selection))
-					.map(selection => ({
-						selection,
-						usage: null,
-						usageChecked: false,
-					}));
+					.map(selection =>
+						selection.index === sessionPreferredIndex && sessionPreferredUsage !== undefined
+							? { selection, usage: sessionPreferredUsage, usageChecked: true }
+							: { selection, usage: null, usageChecked: false },
+					);
 		const preflightFailures = new Set<OAuthCandidate>();
 
 		const sessionPreferredCandidate = candidates.findIndex(
@@ -634,23 +651,34 @@ export class CredentialSelector {
 				candidate.selection.index === sessionPreferredIndex,
 		);
 		const preferredCandidate = sessionPreferredCandidate === -1 ? undefined : candidates[sessionPreferredCandidate];
-		const reserveWouldEvictAutomaticPin = (excludePreflightFailures: boolean): boolean =>
+		// A warm automatic pin normally wins. Two policies may evict it, each only
+		// while a sibling is confirmed better: reserve (sibling measured outside
+		// reserve) and spent allowance (unblocked sibling with allowance left).
+		const automaticPinWouldBeEvicted = (excludePreflightFailures: boolean): boolean =>
 			!sessionPinIsExplicit &&
-			preferredCandidate?.inReserve === true &&
-			candidates.some(
-				candidate =>
-					candidate !== preferredCandidate &&
-					(!excludePreflightFailures || !preflightFailures.has(candidate)) &&
+			preferredCandidate !== undefined &&
+			candidates.some(candidate => {
+				if (candidate === preferredCandidate) return false;
+				if (excludePreflightFailures && preflightFailures.has(candidate)) return false;
+				if (
+					preferredCandidate.inReserve === true &&
 					candidate.reserveMeasured === true &&
-					candidate.inReserve === false,
-			);
-		const reserveWouldEvictBeforePreflight = reserveWouldEvictAutomaticPin(false);
-		// A warm automatic pin normally wins. Reserve is the one policy allowed
-		// to evict it, and only while a sibling is confirmed outside reserve.
+					candidate.inReserve === false
+				) {
+					return true;
+				}
+				return (
+					preferredCandidate.allowanceSpent === true &&
+					candidate.usage !== null &&
+					candidate.allowanceSpent === false &&
+					!this.#deps.blocks.isBlocked(provider, providerKey, candidate.selection.index, blockScopes)
+				);
+			});
+		const pinEvictedBeforePreflight = automaticPinWouldBeEvicted(false);
 		if (
 			!hasPlanRequirement &&
 			sessionPreferredCandidate > 0 &&
-			(!shouldRank || sessionPinIsExplicit || (sessionPreferredIsWarm && !reserveWouldEvictBeforePreflight))
+			(!shouldRank || sessionPinIsExplicit || (sessionPreferredIsWarm && !pinEvictedBeforePreflight))
 		) {
 			const [preferred] = candidates.splice(sessionPreferredCandidate, 1);
 			candidates.unshift(preferred);
@@ -774,14 +802,14 @@ export class CredentialSelector {
 			}),
 		);
 
-		const reserveWouldEvictAfterPreflight = reserveWouldEvictAutomaticPin(true);
+		const pinEvictedAfterPreflight = automaticPinWouldBeEvicted(true);
 		if (
 			!hasPlanRequirement &&
 			preferredCandidate !== undefined &&
 			!preflightFailures.has(preferredCandidate) &&
 			sessionPreferredIsWarm &&
 			!sessionPinIsExplicit &&
-			!reserveWouldEvictAfterPreflight
+			!pinEvictedAfterPreflight
 		) {
 			const preferredIndex = candidates.indexOf(preferredCandidate);
 			if (preferredIndex > 0) {
@@ -803,7 +831,7 @@ export class CredentialSelector {
 		// unenforced and the pin is not known-ineligible) so an active session never
 		// silently migrates accounts mid-conversation; blocked, exhausted, or
 		// known-ineligible pins still fall through to the ranked sibling.
-		if (hasPlanRequirement && sessionPreferredCandidate > 0 && !reserveWouldEvictAfterPreflight) {
+		if (hasPlanRequirement && sessionPreferredCandidate > 0 && !pinEvictedAfterPreflight) {
 			const preferred = candidates[sessionPreferredCandidate]!;
 			const planEligibility = planGate?.(preferred.usage);
 			if (planEligibility === true || (!enforcePlanRequirement && planEligibility !== false)) {

package/src/auth/types.ts

@@ -214,6 +214,9 @@ export type CompletionProbeCredential =
 			email?: string;
 			enterpriseUrl?: string;
 			apiEndpoint?: string;
+			orgId?: string;
+			region?: string;
+			inferenceRegion?: "global" | "eu" | "us";
 	  };
 
 /**
@@ -486,6 +489,13 @@ export type AuthApiKeyOptions = {
 	refreshReason?: OAuthRefreshReason;
 };
 
+/** Non-secret identity bound to the OAuth credential selected for one request attempt. */
+export interface OAuthRequestIdentity {
+	orgId?: string;
+	region?: string;
+	inferenceRegion?: "global" | "eu" | "us";
+}
+
 /**
  * Refreshed OAuth access plus identity metadata returned by
  * {@link AuthStorage.oauth.access}. Callers that authenticate via a bearer
@@ -505,6 +515,8 @@ export interface OAuthAccess {
 	/** Organization/workspace the credential is scoped to (Anthropic/ChatGPT multi-subscription). */
 	orgId?: string;
 	orgName?: string;
+	region?: string;
+	inferenceRegion?: "global" | "eu" | "us";
 }
 
 /**
@@ -933,10 +945,14 @@ export interface KeysApi {
 	 *
 	 * Lower priority than {@link setRuntimeApiKey} so a CLI `--api-key`
 	 * still wins for the duration of a single invocation.
+	 *
+	 * `fallback: true` ranks the value below stored OAuth and `/login`
+	 * credentials instead, so a provider's default key reference cannot shadow
+	 * a key the user logged in with.
 	 */
-	setConfig(provider: string, apiKeyConfig: string): void;
+	setConfig(provider: string, apiKeyConfig: string, options?: { fallback?: boolean }): void;
 	/**
-	 * Remove a single config-sourced API key override.
+	 * Remove a single config-sourced API key (override or fallback).
 	 */
 	removeConfig(provider: string): void;
 	/**

package/src/auth/usage-cache.ts

@@ -65,6 +65,9 @@ export function buildUsageCredential(credential: AuthCredential): UsageCredentia
 		orgName: credential.orgName,
 		enterpriseUrl: credential.enterpriseUrl,
 		apiEndpoint: credential.apiEndpoint,
+		region: credential.region,
+		inferenceRegion: credential.inferenceRegion,
+		activeOrganizationId: credential.activeOrganizationId,
 	};
 }
 
@@ -81,6 +84,9 @@ export function usageCacheIdentity(credential: UsageCredential): string {
 	if (projectId) parts.push(`project:${projectId}`);
 	const enterpriseUrl = credential.enterpriseUrl?.trim().toLowerCase();
 	if (enterpriseUrl) parts.push(`enterprise:${enterpriseUrl}`);
+	if (credential.region) parts.push(`region:${credential.region}`);
+	if (credential.inferenceRegion) parts.push(`inference:${credential.inferenceRegion}`);
+	if (credential.activeOrganizationId) parts.push(`selected-org:${credential.activeOrganizationId}`);
 	// Only fall back to a secret-derived key when a stable account identifier is
 	// unavailable. Including the token hash when accountId/email/orgId are present
 	// causes cache misses on every OAuth refresh — usage data is per-account (or

package/src/auth/usage.ts

@@ -34,7 +34,7 @@ import {
 import type { UsageCache, UsageRequestDescriptor } from "./usage-cache";
 import type { CredentialPool } from "./pool";
 import type { RankingStrategyResolver } from "../usage/registry";
-import { OAUTH_REFRESH_SKEW_MS } from "./refresh";
+import { mergeRefreshedOrganizationScope, OAUTH_REFRESH_SKEW_MS } from "./refresh";
 import type { OAuthRefresher } from "./refresh";
 import { USAGE_REPORT_TTL_MS } from "./sqlite-credential-store";
 import type { AuthCredentialStore } from "./store";
@@ -64,6 +64,9 @@ export function buildRefreshableOauthCredential(credential: UsageCredential): OA
 		orgName: credential.orgName,
 		enterpriseUrl: credential.enterpriseUrl,
 		apiEndpoint: credential.apiEndpoint,
+		region: credential.region,
+		inferenceRegion: credential.inferenceRegion,
+		activeOrganizationId: credential.activeOrganizationId,
 	};
 }
 
@@ -82,8 +85,7 @@ export function mergeRefreshedUsageCredential(
 		email: refreshed.email ?? credential.email,
 		enterpriseUrl: refreshed.enterpriseUrl ?? credential.enterpriseUrl,
 		apiEndpoint: refreshed.apiEndpoint ?? credential.apiEndpoint,
-		orgId: refreshed.orgId ?? credential.orgId,
-		orgName: refreshed.orgName ?? credential.orgName,
+		...mergeRefreshedOrganizationScope(credential, refreshed),
 	};
 }
 
@@ -189,8 +191,11 @@ export class UsageService implements UsageApi {
 			email: next.email ?? entry.credential.email,
 			enterpriseUrl: next.enterpriseUrl ?? entry.credential.enterpriseUrl,
 			apiEndpoint: next.apiEndpoint ?? entry.credential.apiEndpoint,
-			orgId: next.orgId ?? entry.credential.orgId,
-			orgName: next.orgName ?? entry.credential.orgName,
+			orgId: next.orgId,
+			orgName: next.orgName,
+			region: next.region,
+			inferenceRegion: next.inferenceRegion,
+			activeOrganizationId: next.activeOrganizationId,
 		});
 	}