[terence71-glitch]

Problem

Provider-limits / usage sync resolves the selected connection proxy before fetching usage for OAuth connections. However, if that proxied usage fetch fails with a network/proxy error, the code currently retries the same usage fetch without any proxy:

result = await fetchUsageWithContext(null);

That direct retry is unsafe for account-isolated setups. If a connection has an explicit account/key proxy configured, provider-limits traffic is account-bound traffic and should not silently fall back to the OmniRoute host IP when the account proxy is unavailable.

This was first identified through Claude/Anthropic hardening, where risky endpoints include:

• https://api.anthropic.com/api/oauth/usage
• https://api.anthropic.com/api/claude_cli/bootstrap
• legacy usage fallback endpoints under https://api.anthropic.com/v1/...

But the isolation rule is broader than Claude:

An explicit account/key proxy means traffic for that OAuth connection should either use that account proxy or fail closed.

Solution

Add a narrow fail-closed policy in src/lib/usage/providerLimits.ts for OAuth connections whose resolved proxy is account-scoped:

function isAccountScopedProxyResolution(proxyInfo: unknown): boolean {
  if (!isRecord(proxyInfo)) return false;
  if (!proxyInfo.proxy) return false;
  return proxyInfo.level === "key" || proxyInfo.level === "account";
}

function shouldFailClosedForProviderLimitsProxy(
  connection: ProviderConnectionLike,
  proxyInfo: unknown
): boolean {
  return connection.authType === "oauth" && isAccountScopedProxyResolution(proxyInfo);
}

When this policy applies:

• thrown proxy/network failures are re-thrown instead of retried directly
• usage responses that contain proxy/network failure messages are converted into a 503 failure instead of retried directly

This keeps the change scoped to explicit account isolation:

OAuth + key/account proxy + proxy works   -> usage sync works through proxy
OAuth + key/account proxy + proxy fails   -> fail closed; no direct retry
OAuth + provider/global proxy + failure   -> preserve existing direct retry behavior
No account/key proxy                      -> preserve existing behavior

Tests

Added tests/unit/provider-limits-proxy-fail-closed.test.ts.

Coverage:

1. Claude provider limits fail closed when an account proxy is unreachable

   • creates a Claude OAuth connection
   • assigns an unreachable key/account proxy
   • calls fetchAndPersistProviderLimits()
   • verifies the call rejects
   • verifies no direct Anthropic usage fetch is attempted

2. non-Claude OAuth provider limits fail closed when an account proxy is unreachable

   • creates a GitHub OAuth connection
   • assigns an unreachable key/account proxy
   • calls fetchAndPersistProviderLimits()
   • verifies the call rejects
   • verifies no direct usage fetch is attempted

3. Claude provider limits preserve direct retry for non-account proxy failures

   • creates a Claude OAuth connection
   • assigns an unreachable provider-level proxy
   • calls fetchAndPersistProviderLimits()
   • verifies the existing direct retry path still succeeds

Targeted test command:

node --import tsx/esm --test tests/unit/provider-limits-proxy-fail-closed.test.ts

Result:

tests 3
pass 3
fail 0

Typecheck command:

npm run typecheck:core

Result:

passed
```or manual validation that reviewers should know about.

[gemini-code-assist]

Code Review

This pull request introduces a fail-closed mechanism for provider limits when using account-scoped proxies with OAuth connections. Specifically, it adds helper functions to detect account-scoped proxy resolutions and prevent falling back to direct retries without a proxy if a proxy-related network failure occurs. Additionally, comprehensive unit tests have been added under tests/unit/ to verify this behavior for both Claude and non-Claude OAuth providers, while ensuring that non-account proxy failures still preserve the existing direct retry behavior. No review comments were provided, and the changes look solid and conform to the repository style guides.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.