cartethyia 2.7.4 → 2.7.6

package/src/providers/integrations/zcode-start-plan/quota.ts

@@ -0,0 +1,152 @@
+import { asCoercedNumber, asRecord, asTrimmedString } from "../../../shared/coerce";
+import type { FetchLike, ProviderQuotaResult, ProviderQuotaWindow } from "../../quota/quota-contracts";
+
+const BALANCE_URL = "https://zcode.z.ai/api/v1/zcode-plan/billing/balance?app_version=3.16.3";
+const DEVICE_MID = "9f1b0d4e-3c2a-4e7b-9f1d-6a2c8b5e0d31";
+const APP_VERSION = "3.16.3";
+
+function instant(value: unknown): string | null {
+  const seconds = asCoercedNumber(value);
+  if (seconds === undefined || seconds <= 0) return null;
+  const date = new Date(seconds * 1000);
+  return Number.isFinite(date.getTime()) ? date.toISOString() : null;
+}
+
+function boundary(values: readonly unknown[], latest: boolean): string | null {
+  const instants = values.map(instant).filter((value): value is string => value !== null);
+  if (instants.length === 0) return null;
+  return instants.reduce((a, b) => (latest ? a > b : a < b) ? a : b);
+}
+
+// The upstream capabilities, not the display name, declare which models a grant serves.
+function modelIds(value: unknown): readonly string[] {
+  if (!Array.isArray(value)) return [];
+  return [...new Set(value.flatMap((entry: unknown) => {
+    const capability = asTrimmedString(entry);
+    if (capability === undefined || (capability.includes(":") && !capability.startsWith("model:"))) return [];
+    const model = capability.replace(/^model:/, "").trim().toLowerCase();
+    return model ? [model] : [];
+  }))];
+}
+
+function periodLabel(period: string | undefined): string {
+  if (period === "daily_night") return "nightly";
+  if (period === "one_time") return "one-time";
+  return period ?? "grant";
+}
+
+function grantLabel(name: string): string {
+  return /^(?:zcode\s+)?start plan$/i.test(name) ? "Start" : name;
+}
+
+function percent(value: number | null, limit: number | null): number | null {
+  return value !== null && limit !== null && limit > 0
+    ? Math.min(100, Math.max(0, value / limit * 100))
+    : null;
+}
+
+function samePlan(bucket: Record<string, unknown>, plan: Record<string, unknown>): boolean {
+  const userPlan = asTrimmedString(bucket["user_plan_id"]);
+  const owner = asTrimmedString(plan["user_plan_id"]);
+  if (userPlan !== undefined && owner !== undefined) return userPlan === owner;
+  const id = asTrimmedString(bucket["plan_id"]);
+  return id !== undefined && id === asTrimmedString(plan["plan_id"]);
+}
+
+/** Billing shape verified against opencode-zcode-auth 0.1.42; see the provider guide. */
+export async function fetchZcodeStartPlanQuota(
+  credential: string,
+  fetcher: FetchLike,
+): Promise<ProviderQuotaResult> {
+  const source = "zcode-start";
+  try {
+    const response = await fetcher(BALANCE_URL, {
+      headers: {
+        authorization: `Bearer ${credential}`,
+        accept: "application/json",
+        "x-device-mid": DEVICE_MID,
+        "x-zcode-app-version": APP_VERSION,
+        "x-client-language": "en-US",
+      },
+      signal: AbortSignal.timeout(15_000),
+    });
+    if (!response.ok) return { source, plan: null, windows: [], error: `plan billing answered ${response.status}` };
+    const payload = asRecord(await response.json());
+    const code = payload?.["code"];
+    if (!payload || payload["success"] === false ||
+      (code !== undefined && ![0, 200, "0", "200"].includes(code as string | number))) {
+      return { source, plan: null, windows: [], error: "plan billing rejected request" };
+    }
+    const data = asRecord(payload["data"]);
+    if (!data || !Array.isArray(data["balances"]) || !Array.isArray(data["plans"])) {
+      return { source, plan: null, windows: [], error: "plan billing returned an unreadable balance" };
+    }
+    const plans = data["plans"].flatMap((value: unknown) => {
+      const plan = asRecord(value);
+      return plan ? [plan] : [];
+    });
+    const windows: ProviderQuotaWindow[] = [];
+    const names = new Set<string>();
+    const represented = new Set<Record<string, unknown>>();
+    for (const raw of data["balances"]) {
+      const bucket = asRecord(raw);
+      if (!bucket) continue;
+      const owner = plans.find((plan) => samePlan(bucket, plan));
+      if (owner) represented.add(owner);
+      const name = asTrimmedString(owner?.["name"]) ?? "Start Plan";
+      names.add(name);
+      const entitlement = (Array.isArray(owner?.["entitlements"]) ? owner["entitlements"] : [])
+        .map(asRecord).find((entry) => entry?.["entitlement_id"] === bucket["entitlement_id"]);
+      const period = asTrimmedString(entitlement?.["period"]);
+      const limit = asCoercedNumber(bucket["total_units"]) ?? null;
+      const reportedUsed = asCoercedNumber(bucket["used_units"]);
+      const reportedRemaining = asCoercedNumber(bucket["remaining_units"]);
+      const used = reportedUsed ?? (limit !== null && reportedRemaining !== undefined ? Math.max(0, limit - reportedRemaining) : null);
+      const remaining = reportedRemaining ?? (limit !== null && used !== null ? Math.max(0, limit - used) : null);
+      const models = modelIds(bucket["capabilities"] ?? entitlement?.["capabilities"]);
+      const expired = asTrimmedString(owner?.["status"])?.toLowerCase() === "expired";
+      windows.push({
+        kind: period ?? "grant",
+        label: `${asTrimmedString(bucket["show_name"]) ?? (models.join(", ") || "GLM")} · ${grantLabel(name)} · ${periodLabel(period)}`,
+        accounting: "independent",
+        modelIds: models,
+        startsAt: boundary([owner?.["starts_at"], bucket["period_start"]], true),
+        resetsAt: boundary([bucket["expires_at"], bucket["period_end"], owner?.["ends_at"]], false),
+        usedPercent: expired ? 100 : percent(used, limit),
+        remainingPercent: expired ? 0 : percent(remaining, limit),
+        used,
+        limit,
+        remaining,
+        recurring: !expired && (period === "daily" || period === "daily_night"),
+      });
+    }
+    // The balance may list a future plan before it has materialized any buckets.
+    for (const plan of plans) {
+      const startsAt = instant(plan["starts_at"]);
+      if (represented.has(plan) || !startsAt || Date.parse(startsAt) <= Date.now() || plan["status"] === "expired") continue;
+      const name = asTrimmedString(plan["name"]) ?? "Start Plan";
+      names.add(name);
+      const entitlements = Array.isArray(plan["entitlements"]) ? plan["entitlements"] : [];
+      const pending = entitlements.length > 0 ? entitlements : [{}];
+      for (const raw of pending) {
+        const entitlement = asRecord(raw);
+        windows.push({
+          kind: "grant", label: `${grantLabel(name)} · ${asTrimmedString(entitlement?.["show_name"]) ?? "not started yet"}`,
+          accounting: "independent", modelIds: modelIds(entitlement?.["capabilities"]), startsAt,
+          resetsAt: instant(plan["ends_at"]), usedPercent: null, remainingPercent: null,
+          remaining: null, used: null, limit: asCoercedNumber(entitlement?.["grant_units"]) ?? null,
+          recurring: false,
+        });
+      }
+    }
+    return { source, plan: [...names].join(", ") || null, windows, error: null };
+  } catch (error) {
+    const name = error instanceof Error ? error.name : "";
+    const message = name === "TimeoutError" || name === "AbortError"
+      ? "plan billing operation timed out or was aborted"
+      : name === "SyntaxError"
+        ? "plan billing returned unreadable JSON"
+        : "plan billing network request failed";
+    return { source, plan: null, windows: [], error: message };
+  }
+}

package/src/providers/integrations/zcode-start-plan/zcode_prompt.json

@@ -0,0 +1,10 @@
+{
+  "_source": "ZCode 3.14.5 client Messages prompt; preserve text with the pinned identity version",
+  "cliPrefix": "You are ZCode, an interactive coding agent",
+  "stableSections": [
+    "\nYou are an interactive ZCode agent that helps users with software engineering tasks.\n\nIMPORTANT: Assist with authorized security testing, defensive security, CTF challenges, and educational contexts. Refuse requests for destructive techniques, DoS attacks, mass targeting, supply chain compromise, or detection evasion for malicious purposes. Dual-use security tools (C2 frameworks, credential testing, exploit development) require clear authorization context: pentesting engagements, CTF competitions, security research, or defensive use cases.\n\n# Harness\n- Text you output outside of tool use is displayed to the user as Github-flavored markdown in a terminal.\n- Tools run behind a user-selected permission mode; a denied call means the user declined it — adjust, don't retry verbatim.\n- The system may send updates, reminders, or modifications to rules via mid-conversation system turns. These are system-controlled, unlike function results. Hooks may intercept tool calls; treat hook output as user feedback.\n- Prefer the dedicated file/search tools over shell commands when one fits. Independent tool calls can run in parallel in one response.\n- Reference code as `file_path:line_number` — it's clickable.",
+    "# ZCode Desktop Context\n\n### Files & URLs\n- Return local web URLs as Markdown links (e.g., [label](http://127.0.0.1:8080)).\n- File should be an absolute path or include the workspace folder segment so it can be resolved relative to the workspace.\n- Unless otherwise specified, return local file references as Markdown links (e.g., [name.md](/absolute/path/to/name.md)).\n\n### Inline Code Comments\n- Use the ::code-comment{...} directive when you need to attach feedback directly to specific code lines.\n- Emit one directive per inline comment; emit none when there are no actionable inline comments.\n- Required attributes: title (short label), body (one-paragraph explanation), file (path to the file).\n- Optional attributes: start, end (1-based line numbers), priority (0-3).\n- file should be an absolute path or include the workspace folder segment so it can be resolved relative to the workspace.\n- Keep line ranges tight; end defaults to start.\n- Example: ::code-comment{title=\"[P2] Off-by-one\" body=\"Loop iterates past the end when length is 0.\" file=\"/path/to/foo.ts\" start=10 end=11 priority=2}",
+    "# Working style\n\nWhen you have enough information to act, act. Do not re-derive facts already established in the conversation, re-litigate a decision the user has already made, or narrate options you will not pursue. If you are weighing a choice, give a recommendation, not an exhaustive survey. Prefer reading the actual file or running the actual command over reasoning about what it probably contains. When a signal pattern-matches to a known failure, check that the evidence actually supports that specific diagnosis before acting on it."
+  ],
+  "environmentTemplate": "# Environment\nYou have been invoked in the following environment:\n - Primary working directory: {cwd}\n - Platform: {platform}\n - Shell: {shell}\n - You are powered by the model named {provider}/{model}."
+}

package/src/providers/operations/account-error-classification.ts

@@ -57,6 +57,26 @@ const UNCLASSIFIED_COOLDOWN_MS = resolveAccountUnclassifiedCooldownMs;
  * which let the account re-enter rotation inside the window.
  */
 const GROK_QUOTA_COOLDOWN_MS = 24 * 60 * 60 * 1000;
+/**
+ * Trae answers `4013 "AI service is not available in the current region now."`
+ * when the upstream does not serve the account's region. A day because the
+ * verdict is durable: it reproduces on every request until the region opens,
+ * and the account must not be re-dialled every thirty seconds for the whole
+ * window.
+ */
+const TRAE_REGION_COOLDOWN_MS = 24 * 60 * 60 * 1000;
+/**
+ * Trae's free-tier quota (`4008` / "exceeded the quota") resets daily, so its
+ * exhaustion is a full-day model backoff — never the generic 1h fallback,
+ * which let the account re-enter rotation inside the window.
+ */
+const TRAE_QUOTA_COOLDOWN_MS = 24 * 60 * 60 * 1000;
+/**
+ * Qoder's quota verdicts (`110` billing-daily-count, the upstream-499 close)
+ * are per-model: one model's spend cap does not drain another. A day matches
+ * the daily billing window the provider names.
+ */
+const QODER_QUOTA_COOLDOWN_MS = 24 * 60 * 60 * 1000;
 /**
  * The buddy family's policy/channel block (`11140`, `11128`) is a *base* backoff,
  * not a flat penalty — see {@link resolveAccountPolicyBlockCooldownMs}. It used
@@ -438,6 +458,26 @@ function banWording(lower: string): boolean {
   );
 }
 
+/**
+ * Whether GitHub Copilot stated the account lacks a license — a ban-shaped
+ * verdict on the account, not a refreshable auth rejection.
+ *
+ * Observed live (2026-11-03): the health log showed
+ * `unauthorized: not licensed to use Copilot` and `forbidden` on
+ * `gpt-6-luna`. Copilot answers 401 for a bad credential and 403 for a
+ * license/entitlement refusal, so `forbidden`/`unauthorized` on this surface
+ * is the same verdict. No amount of waiting or refreshing changes it — the
+ * subscription cannot serve this credential.
+ */
+function copilotNotLicensed(lower: string): boolean {
+  return (
+    lower.includes("not licensed") ||
+    lower.includes("forbidden") ||
+    lower.includes("unauthorized") ||
+    lower.includes("license")
+  );
+}
+
 /**
  * Bounded to a day, matching `MAX_COOLDOWN_MS` in the failure policy: a stated
  * window longer than that is a monthly or plan-level limit, and parking an
@@ -586,20 +626,10 @@ interface AccountErrorSignals {
   readonly staticToken: boolean;
   readonly credentialKind: string | undefined;
   /** Buddy-family provider: the only family with provider-specific codes below. */
-  readonly buddy: boolean;
-  /**
-   * The upstream named a restriction on this account, not a refusal of the
-   * request. Only the `11140` shape carries `displayMsg` about the account
-   * being restricted, so the policy arm can tell a ban from a bad request
-   * instead of treating both as one cooldown.
-   */
   readonly buddyBanned: boolean;
   readonly priceRefusal: boolean;
-  readonly deploymentInfraError: boolean;
   readonly quotaSignal: boolean;
   readonly policyRejection: boolean;
-  readonly requestScoped: boolean;
-  readonly channelRejection: boolean;
   readonly hostedToolFailure: boolean;
   readonly modelEntitlementFailure: boolean;
   readonly queuedUpstream: boolean;
@@ -793,7 +823,20 @@ export function classifyAccountError(
   const modelBlockHits = Math.max(1, Math.floor(options?.modelBlockHits ?? 1));
   const staticToken = options?.staticToken === true;
   const credentialKind = options?.credentialKind;
-  const buddy = BUDDY_PROVIDER_IDS.has(options?.providerId?.toLowerCase() ?? "");
+
+  // Start Plan is a separate provider: its named trial refusal rests only that model.
+  const providerId = options?.providerId ?? (error instanceof GatewayError ? error.details.providerId : undefined);
+  const refusedModel = statusCode === 400
+    ? /no active limited quota for ([\w.-]+)/i.exec(message)?.[1]
+    : statusCode === 429
+      ? /limited quota(?: for)? ([\w.-]+)(?: is)? exhausted/i.exec(message)?.[1]
+      : undefined;
+  if (providerId === "zcode-start" && modelId !== undefined && refusedModel !== undefined &&
+    refusedModel.toLowerCase().replace(/-trial$/, "") === modelId.toLowerCase().replace(/-trial$/, "")) {
+    const cooldownMs = statedCooldownMs ?? DEFAULT_QUOTA_COOLDOWN_MS();
+    return result("model_unreachable", "cooldown", cooldownMs, new Date(Date.now() + cooldownMs),
+      reason("Start Plan trial unavailable for this model"), origin === "upstream");
+  }
 
   // A price refusal is a verdict on the *request*, not on the account. inferhub
   // answers 402 with `no provider's ask matches your max-per-mtok bid`: the
@@ -869,6 +912,7 @@ export function classifyAccountError(
       // keeps serving its other models.
       providerCode === "112" ||
       providerCode === "110" ||
+      providerCode === "116" ||
       providerCode === "insufficient_quota" ||
       providerCode === "quota_exceeded" ||
       providerCode === "subscription:free-usage-exhausted" ||
@@ -1067,7 +1111,8 @@ export function classifyAccountError(
   // for all other models. Disabling the whole account breaks healthy models.
   const modelEntitlementFailure =
     statusCode === 403 &&
-    (lower.includes("not have a valid license") ||
+    ((providerId === "commandcode" && lower.includes("model_not_in_plan")) ||
+      lower.includes("not have a valid license") ||
       lower.includes("valid license of this product") ||
       lower.includes("model not supported") ||
       lower.includes("not entitled to") ||
@@ -1131,14 +1176,10 @@ export function classifyAccountError(
     modelBlockHits,
     staticToken,
     credentialKind,
-    buddy,
     buddyBanned,
     priceRefusal,
-    deploymentInfraError,
     quotaSignal,
     policyRejection,
-    requestScoped,
-    channelRejection,
     hostedToolFailure,
     modelEntitlementFailure,
     queuedUpstream,
@@ -1225,101 +1266,6 @@ const ACCOUNT_ERROR_RULES: readonly AccountErrorRule[] = [
         false,
       ),
   },
-  {
-    name: "deployment-infrastructure",
-    match: (s) => s.deploymentInfraError,
-    decide: (s) =>
-      s.result(
-        "server_error",
-        "cooldown",
-        60_000,
-        null,
-        `Proxy deployment error: ${s.message.slice(0, 160)}`,
-        false,
-      ),
-  },
-  {
-    name: "model-frequency-window",
-    match: (s) => s.lower.includes("frequency limit") && s.lower.includes("switch to the other models"),
-    decide: (s) => {
-      const cooldownMs = s.statedCooldownMs ?? DEFAULT_QUOTA_COOLDOWN_MS();
-      return s.result(
-        "rate_limit_transient",
-        "cooldown",
-        cooldownMs,
-        new Date(Date.now() + cooldownMs),
-        s.reason("Provider frequency limit for this model"),
-        // Provider-scoped evidence still has to reach the writer: a stream frame
-        // carries no credential detail, so `canMutate` is false and without this
-        // the pair would be retried for the whole window it was closed for.
-        s.origin === "upstream" && s.scope === "provider",
-      );
-    },
-  },
-  {
-    name: "content-policy-block",
-    match: (s) => s.policyRejection && s.buddy,
-    decide: (s) => {
-      // A ban is a verdict on the credential, and cooldown cannot answer it:
-      // the account is refused, not throttled. Disabling is the fix, and
-      // disabling *immediately* is a feature — a client's retry budget is spent
-      // in seconds, so a banned account that merely cooled stayed in the plan
-      // and burned sibling accounts that were still healthy before the window
-      // expired.
-      //
-      // The two shapes are told apart by the body, not the code alone: `11140`
-      // names a restriction on the account, `11-128` refuses the request.
-      if (s.buddyBanned) {
-        return s.result(
-          "policy_blocked_banned",
-          "disabled",
-          0,
-          null,
-          s.reason("Account banned by upstream"),
-          // A ban is evidence about the credential even at provider scope, for
-          // the same reason a named revocation is: the message is the evidence.
-          // Without this a stream frame's missing credential detail would leave
-          // a banned account serving.
-          true,
-        );
-      }
-      // Not a ban: the upstream refused this request. The account is fine, so
-      // the only correct move is to stop retrying it verbatim. Cooling the
-      // account here was the bug that made one malformed request look like a
-      // dead credential.
-      return s.result(
-        "policy_blocked_invalid_request",
-        "cooldown",
-        0,
-        null,
-        s.reason("Upstream refused this request"),
-        // Never mutates: a malformed body fails identically on every account,
-        // so cooling would burn a healthy credential on the gateway's own fault.
-        false,
-      );
-    },
-  },
-  {
-    name: "request-scoped-rejection",
-    match: (s) => s.requestScoped && s.buddy,
-    decide: (s) =>
-      s.result("unknown", "cooldown", 0, null, s.reason("Request-scoped upstream rejection"), false),
-  },
-  {
-    name: "channel-rejection",
-    match: (s) => s.channelRejection && s.buddy,
-    decide: (s) => {
-      const channelBlockMs = resolveAccountPolicyBlockCooldownMs();
-      return s.result(
-        "policy_blocked",
-        "cooldown",
-        channelBlockMs,
-        new Date(Date.now() + channelBlockMs),
-        s.reason("Provider channel rejection"),
-        s.origin === "upstream",
-      );
-    },
-  },
   {
     name: "validation-required",
     match: (s) => s.validationRequired,
@@ -1337,6 +1283,33 @@ const ACCOUNT_ERROR_RULES: readonly AccountErrorRule[] = [
         true,
       ),
   },
+  {
+    // GitHub Copilot answers a license/entitlement refusal with 403 and
+    // "not licensed to use Copilot" / "forbidden" / "unauthorized". That is a
+    // verdict on the account: the subscription cannot serve this credential,
+    // and no amount of waiting or refreshing changes it. Cooldown cycling
+    // (auth_invalidated + 5m backoff) kept a dead account in rotation where a
+    // client's retry budget burned sibling accounts — the same failure the
+    // buddy ban exists to prevent. Disable immediately. Must run before
+    // `credential-rejected`, which would claim the bare 403 as a refreshable
+    // auth rejection.
+    name: "github-copilot-not-licensed",
+    match: (s) =>
+      s.origin === "upstream" &&
+      s.providerId === "github" &&
+      copilotNotLicensed(s.lower),
+    decide: (s) =>
+      s.result(
+        "policy_blocked_banned",
+        "disabled",
+        0,
+        null,
+        s.reason("GitHub Copilot account not licensed"),
+        // A license refusal is evidence about the account even at provider
+        // scope, for the same reason a named revocation or a buddy ban is.
+        true,
+      ),
+  },
   {
     name: "credential-rejected",
     match: (s) =>
@@ -1468,9 +1441,84 @@ const ACCOUNT_ERROR_RULES: readonly AccountErrorRule[] = [
       );
     },
   },
+  {
+    // Trae answers `4013 "AI service is not available in the current region
+    // now."` when the upstream does not serve the account's region. That is a
+    // durable verdict on the account, not a transient transport fault: it
+    // reproduces on every request until the region opens, so it must cool hard
+    // for a day rather than be re-dialled every thirty seconds. Must run
+    // before `transport-fault`, which would read the 502 as a short
+    // `server_error`.
+    name: "trae-region-unavailable",
+    match: (s) =>
+      (s.providerId === "trae" || s.providerId === "traecn") &&
+      (s.providerCode === "4013" || s.lower.includes("not available in the current region")),
+    decide: (s) => {
+      const cooldownMs = TRAE_REGION_COOLDOWN_MS;
+      return s.result(
+        "quota_exhausted",
+        "cooldown",
+        cooldownMs,
+        new Date(Date.now() + cooldownMs),
+        s.reason("Trae service unavailable in the current region"),
+        // Account-scoped provider evidence still has to reach the writer: a
+        // stream frame carries no credential detail, so `canMutate` is false
+        // and without this the account stays in rotation to reproduce the
+        // refusal for the whole window the region is closed for.
+        true,
+      );
+    },
+  },
+  {
+    // Trae's free-tier quota (`4008` / "exceeded the quota") resets daily.
+    // Treating it like the generic quota cooldown (1h account-wide fallback)
+    // let the account re-enter rotation inside the window and reproduce the
+    // refusal every few minutes — the "cooldown not holding" report. The
+    // verdict is a full-day backoff on *any* model (the account's quota is
+    // spent, so every model on it shares the wall). Scoped to the model so
+    // the account is not disabled wholesale; the 1-day window means a model
+    // stays parked for the day instead of flapping. Must run before
+    // `quota-exhausted`, which would apply the generic shorter fallback.
+    name: "trae-quota-exhausted",
+    match: (s) =>
+      (s.providerId === "trae" || s.providerId === "traecn") &&
+      (s.providerCode === "4008" || s.lower.includes("have exceeded the quota")),
+    decide: (s) => {
+      const cooldownMs = s.statedCooldownMs ?? TRAE_QUOTA_COOLDOWN_MS;
+      return s.result(
+        "model_unreachable",
+        "cooldown",
+        cooldownMs,
+        new Date(Date.now() + cooldownMs),
+        s.reason("Trae quota exhausted for this model"),
+        s.origin === "upstream" && s.modelId !== undefined,
+      );
+    },
+  },
+  {
+    // Qoder's quota verdicts — `110` "Billing daily count exceeded" and the
+    // upstream-499 exhausted-quota close — are per-model: one model's spend
+    // cap does not drain another. Scoping them to the model keeps the account
+    // serving its other models. Must run before `quota-exhausted`, which
+    // parks the whole account.
+    name: "qoder-model-quota",
+    match: (s) =>
+      (s.providerId === "qoder" || s.providerId === "qodercn") && s.quotaSignal,
+    decide: (s) => {
+      const cooldownMs = s.statedCooldownMs ?? QODER_QUOTA_COOLDOWN_MS;
+      return s.result(
+        "model_unreachable",
+        "cooldown",
+        cooldownMs,
+        new Date(Date.now() + cooldownMs),
+        s.reason("Qoder quota exhausted for this model"),
+        s.origin === "upstream" && s.modelId !== undefined,
+      );
+    },
+  },
   {
     name: "quota-exhausted",
-    match: (s) => s.quotaSignal,
+    match: (s) => s.origin === "upstream" && s.quotaSignal,
     decide: (s) => {
       // xAI Grok Build's free tier resets on a rolling window. Use a duration
       // stated by the provider when present; otherwise park for the conservative
@@ -1478,11 +1526,21 @@ const ACCOUNT_ERROR_RULES: readonly AccountErrorRule[] = [
       const grokFreeTier =
         s.providerCode === "subscription:free-usage-exhausted" ||
         s.providerCode.startsWith("subscription:") ||
+        // A 402 spend/entitlement wall (`personal-team-blocked:spending-limit`,
+        // "out of credits") is the same verdict: the account cannot serve until
+        // the operator tops up or upgrades. The default 1h fallback re-dialled
+        // it every hour inside a window that will not clear on its own.
+        s.providerCode.includes("spending") ||
+        s.providerCode.includes("credits") ||
         s.lower.includes("free-usage") ||
         s.lower.includes("free usage") ||
         s.lower.includes("included free usage") ||
         s.lower.includes("rolling 24-hour") ||
-        s.lower.includes("rolling 24 hour");
+        s.lower.includes("rolling 24 hour") ||
+        s.lower.includes("spending limit") ||
+        s.lower.includes("out of credits") ||
+        s.lower.includes("run out of credits") ||
+        s.lower.includes("need a grok subscription");
       const buddyCreditsExhausted =
         s.providerCode === "14018" || s.lower.includes("credits exhausted");
       const cooldownMs = grokFreeTier
@@ -1514,6 +1572,7 @@ const ACCOUNT_ERROR_RULES: readonly AccountErrorRule[] = [
     // moves to the next account and the flagged one returns almost at once.
     name: "inception-per-minute-limit",
     match: (s) =>
+      s.origin === "upstream" &&
       s.providerId === "inception" &&
       (s.statusCode === 429 ||
         s.providerCode === "rate_limit_reached" ||
@@ -1538,15 +1597,16 @@ const ACCOUNT_ERROR_RULES: readonly AccountErrorRule[] = [
   {
     name: "rate-limit",
     match: (s) =>
-      s.statusCode === 429 ||
-      s.providerCode === "rate_limit_exceeded" ||
-      s.lower.includes("rate_limit") ||
-      s.lower.includes("rate limit") ||
-      s.lower.includes("too many requests") ||
-      s.lower.includes("requests per minute") ||
-      s.lower.includes("tokens per minute") ||
-      s.lower.includes("tpm limit") ||
-      s.lower.includes("rpm limit"),
+      s.origin === "upstream" &&
+      (s.statusCode === 429 ||
+        s.providerCode === "rate_limit_exceeded" ||
+        s.lower.includes("rate_limit") ||
+        s.lower.includes("rate limit") ||
+        s.lower.includes("too many requests") ||
+        s.lower.includes("requests per minute") ||
+        s.lower.includes("tokens per minute") ||
+        s.lower.includes("tpm limit") ||
+        s.lower.includes("rpm limit")),
     decide: (s) => {
       const cooldownMs = s.statedCooldownMs ?? DEFAULT_RATE_LIMIT_COOLDOWN_MS();
       // Same per-account reasoning as quota above: the failing account (or
@@ -1565,13 +1625,14 @@ const ACCOUNT_ERROR_RULES: readonly AccountErrorRule[] = [
   {
     name: "model-capacity",
     match: (s) =>
-      s.statusCode === 503 ||
-      s.statusCode === 529 ||
-      s.providerCode === "model_capacity" ||
-      s.queuedUpstream ||
-      s.lower.includes("model overloaded") ||
-      s.lower.includes("capacity exceeded") ||
-      s.lower.includes("temporarily unavailable"),
+      s.origin === "upstream" &&
+      (s.statusCode === 503 ||
+        s.statusCode === 529 ||
+        s.providerCode === "model_capacity" ||
+        s.queuedUpstream ||
+        s.lower.includes("model overloaded") ||
+        s.lower.includes("capacity exceeded") ||
+        s.lower.includes("temporarily unavailable")),
     decide: (s) => {
       const cooldownMs = s.statedCooldownMs ?? MODEL_CAPACITY_COOLDOWN_MS();
       const modelScopedMutation = s.origin === "upstream" && s.modelId !== undefined;
@@ -1631,20 +1692,24 @@ const ACCOUNT_ERROR_RULES: readonly AccountErrorRule[] = [
     // verdict, not a transport fault. It must run before `transport-fault`,
     // which otherwise reads the status as a 5xx-class outage and cools the
     // account for the shorter transient window — or leaves it unmutated.
+    //
+    // The verdict is per-model, like Qoder's other quota signs: one model's
+    // spend cap does not drain another, so it cools the pair, never the whole
+    // account.
     name: "qoder-499-quota",
     match: (s) =>
       (s.providerId === "qoder" || s.providerId === "qodercn") &&
       s.statusCode === 499 &&
       s.origin === "upstream",
     decide: (s) => {
-      const cooldownMs = s.statedCooldownMs ?? DEFAULT_QUOTA_COOLDOWN_MS();
+      const cooldownMs = s.statedCooldownMs ?? QODER_QUOTA_COOLDOWN_MS;
       return s.result(
-        "quota_exhausted",
+        "model_unreachable",
         "cooldown",
         cooldownMs,
         new Date(Date.now() + cooldownMs),
-        s.reason("Qoder quota exhausted (upstream 499)"),
-        s.origin === "upstream",
+        s.reason("Qoder quota exhausted for this model (upstream 499)"),
+        s.origin === "upstream" && s.modelId !== undefined,
       );
     },
   },