fix(oauth): preserve account identity when pausing Anthropic credentials

docs-site/src/content/docs/ko/reference/cli/providers-accounts.md

@@ -258,6 +258,12 @@ Codex pool selection applies to the next request after clearing existing affinit
 
 ### `ocx account pause|resume anthropic <id|alias> [--json]`
 
+Anthropic의 자동 대체 계정 선택은 기존 계정 순서를 유지하며, 일시 정지되었거나 재인증이 필요한 계정과 60초 이내에 만료되는 Claude Code 가져오기를 건너뜁니다. 출처가 기록되지 않은 레거시 계정도 선택할 수 있지만, 자체 저장 자격 증명과 일반적인 저장 토큰 갱신만 사용하며 CLI 디스크 자격 증명을 가져오지 않습니다. 60초 넘게 남은 유효한 Claude Code 계정은 선택할 수 있습니다. 이후 CLI 자격 증명을 자동으로 다시 가져올 때는 비어 있지 않은 access 또는 refresh 토큰 중 하나가 저장된 값과 같아야 하며, 기존 계정 ID와 이메일을 보존합니다. 두 토큰이 모두 바뀌면 자격 증명의 연속성을 확인할 수 없으므로 저장된 토큰의 갱신 또는 기존 재인증 경로를 사용합니다. 완전히 교체된 Claude Code 토큰을 가져오려면 명시적으로 로그인하세요.
+
+허용된 대체 계정이 없으면 사용 가능한 활성 계정이 선택될 때까지 할당량 조회와 실시간 모델 검색이 대기합니다.
+`ocx account use anthropic <account-id-or-alias>`로 일시 정지되지 않은 기존 레거시 계정을 명시적으로 선택할 수 있습니다.
+원래 자격 증명의 출처가 기록되지 않았더라도 해당 계정의 유효한 자격 증명과 일반적인 저장 토큰 갱신을 계속 사용할 수 있습니다.
+
 CLI 명령은 Anthropic OAuth 계정을 id 또는 유일한 alias로 일시 정지하거나 재개합니다. alias는 정확히 일치하는 값을 먼저 찾고, 없으면 대소문자를 구분하지 않고 찾습니다. 대시보드와 같은 `PUT /api/oauth/accounts/pause`에 `{ provider: "anthropic", accountId, paused }`를 보냅니다. 계정에 저장되는 `paused` 상태는 `GET /api/oauth/accounts`에도 표시됩니다. 사전 계정 전환 풀이 꺼져 있어도 정지된 계정은 선택, 세션 바인딩, 429 대체 후보에서 제외됩니다. 모든 계정이 정지되면 하나를 재개할 때까지 요청은 403을 반환합니다. 이미 전송한 요청은 유지하며 자격 증명과 건강 상태를 지우지 않습니다. 재시작·재로그인 후에도 정지는 유지되고, 계정을 삭제하면 함께 제거됩니다. 계정별 전환 임계값은 이 기능에 포함되지 않습니다.
 
 ### `ocx account clear <provider> [--json]`

docs-site/src/content/docs/reference/cli/providers-accounts.md

@@ -486,6 +486,20 @@ Anthropic pause applies even when proactive pooling is disabled, including sessi
 and does not interrupt a turn already sent. Removing the account removes its pause state.
 Per-account Anthropic auto-switch thresholds are not part of this control.
 
+Anthropic's automatic pause fallback keeps account order, skips paused accounts and accounts
+requiring reauthentication, and excludes Claude Code imports expiring within 60 seconds.
+Legacy accounts without a recorded source remain eligible using only their own stored credentials
+and normal stored-token refresh; they never adopt CLI-disk credentials. A still-valid Claude Code import with more time remaining
+can be selected. Later automatic re-adoption requires an unchanged, nonempty access or refresh
+token; the stored account ID and email are preserved. If Claude Code replaces both tokens,
+OpenCodex cannot establish credential continuity and uses its stored-token refresh or existing
+reauthentication path instead. Use explicit login to import a completely replaced Claude Code pair.
+
+If no permitted fallback remains, quota and live model discovery wait for a usable active account.
+You can explicitly select an existing unpaused legacy account with
+`ocx account use anthropic <account-id-or-alias>`; its own valid credential and normal stored-token
+refresh remain available even when its original credential source was not recorded.
+
 ```bash
 ocx account pause google-antigravity <account-id-or-alias>
 ocx account resume google-antigravity <account-id-or-alias>

src/oauth/anthropic-routing.ts

@@ -16,6 +16,7 @@
  * Token refresh failures retain the existing store needsReauth policy.
  */
 import { createHash } from "node:crypto";
+import { REFRESH_SKEW_MS } from "./refresh-policy";
 import { captureOAuthAccountSelection, commitOAuthAccountSelection, credentialGeneration, getAccountSet, getAccountCredential, getAccountCredentialWithStatus } from "./store";
 import type { OAuthAccessSnapshot } from "./index";
 import { getCachedProviderAccountQuota } from "../providers/quota";
@@ -337,15 +338,13 @@ function usageScore(config: OcxConfig, accountId: string): number {
   }
 }
 
-const TOKEN_SKEW_MS = 60_000;
-
 /** Background `local-cli` slots with expired access are not pool-eligible (identity adoption risk). */
 function isPoolCredentialUsable(accountId: string, now: number): boolean {
   const cred = getAccountCredential(PROVIDER, accountId);
   if (!cred) return false;
   if (cred.source !== "local-cli") return true;
   if (canRefreshAnthropicPoolAccount(accountId)) return true;
-  return cred.expires > now + TOKEN_SKEW_MS;
+  return cred.expires > now + REFRESH_SKEW_MS;
 }
 
 export function getEligibleAnthropicAccounts(now = Date.now()): string[] {
@@ -1056,7 +1055,7 @@ export async function getAnthropicPoolAccessToken(accountId: string): Promise<st
     const { OAuthLoginRequiredError } = await import("./index");
     throw new OAuthLoginRequiredError(PROVIDER);
   }
-  if (stored.expires > Date.now() + TOKEN_SKEW_MS) return stored.access;
+  if (stored.expires > Date.now() + REFRESH_SKEW_MS) return stored.access;
   if (!canRefreshAnthropicPoolAccount(accountId)) {
     throw new Error("background local-cli token expired; refuse CLI-adopting refresh for pool");
   }

src/oauth/index.ts

@@ -51,7 +51,7 @@ import { apiKeyPoolEntryId, sanitizeApiKeyValue } from "../providers/api-keys";
 import { effectiveGoogleMode, getProviderRegistryEntry, mergeRegistryStaticHeaders, providerMatchesRegistryTransport } from "../providers/registry";
 import { providerModelsUrl, resolveProviderModelDiscoveryUrl } from "../providers/model-discovery";
 import { resolveProviderTransport } from "../providers/xai-transport";
-import { detectClaudeCodeToken, detectGrokCliToken, hasComparableGrokIdentity, isSameGrokIdentity, shouldAdoptGrokGeneration } from "./local-token-detect";
+import { detectClaudeCodeToken, detectGrokCliToken, hasClaudeCredentialContinuity, hasComparableGrokIdentity, isSameGrokIdentity, shouldAdoptGrokGeneration } from "./local-token-detect";
 import { logOAuthEvent } from "./log";
 import { captureConfigGeneration, sweepExpiredOnWrite } from "../lib/state-store-sweeper";
 import { clearManualCodeSlot, ensureManualCodeSlot, kiroLoginSettling, loginAbort, loginState, waitForManualLoginCode, type OAuthLoginHint } from "./login-flow-state";
@@ -80,8 +80,8 @@ export {
 } from "./health";
 export { OAUTH_REFRESH_LOCK_WAIT_MS, peekAuthStore, peekOAuthRefreshIntent } from "./store";
 import { codexAccountNamespaceProviderCollisionError } from "../codex/account-namespace-match";
+import { REFRESH_SKEW_MS } from "./refresh-policy";
 
-const REFRESH_SKEW_MS = 60_000;
 export interface OAuthAccessSnapshot {
   provider: string;
   accountId: string;
@@ -869,8 +869,8 @@ export async function refreshXaiAccountWithLock(provider:string,accountId:string
 function newerClaudeCredential(stored: OAuthCredentials, now: number): OAuthCredentials | undefined {
   if (stored.source !== "local-cli") return undefined;
   const disk = detectClaudeCodeToken();
-  if (!disk || disk.expires <= now + REFRESH_SKEW_MS) return undefined;
-  return credentialGeneration(disk) !== credentialGeneration(stored) ? disk : undefined;
+  if (!disk || disk.expires <= now + REFRESH_SKEW_MS || !hasClaudeCredentialContinuity(stored, disk)) return undefined;
+  return credentialGeneration(disk) !== credentialGeneration(stored) ? merged(disk, stored) : undefined;
 }
 
 /**

src/oauth/local-token-detect.ts

@@ -128,3 +128,10 @@ export function detectClaudeCodeToken(): OAuthCredentials | null {
   if (!raw) return null;
   return parseClaudeOauthPayload(raw);
 }
+
+/** Opaque Claude tokens carry no account identity; adoption needs a shared credential token. */
+export function hasClaudeCredentialContinuity(stored: OAuthCredentials, disk: OAuthCredentials): boolean {
+  const sameToken = (left: string, right: string): boolean =>
+    typeof left === "string" && left.trim().length > 0 && left === right;
+  return sameToken(stored.refresh, disk.refresh) || sameToken(stored.access, disk.access);
+}

src/oauth/refresh-policy.ts

@@ -0,0 +1,2 @@
+/** Refresh early enough to avoid dispatching a bearer that expires in flight. */
+export const REFRESH_SKEW_MS = 60_000;

src/oauth/store.ts

@@ -34,6 +34,7 @@ import {
 } from "../lib/state-store-sweeper";
 import { validateCopilotApiBaseUrl } from "./github-copilot";
 import { validateDevinApiBaseUrl } from "./devin/api-base";
+import { REFRESH_SKEW_MS } from "./refresh-policy";
 import { parseAnthropicAccountThreshold } from "./anthropic-account-threshold";
 import type { OAuthAccountSelection, OAuthCredentialSource, OAuthCredentials, ProviderAccount, ProviderAccountSet } from "./types";
 
@@ -1288,7 +1289,9 @@ export async function setAccountPaused(
     if (paused && set.activeAccountId === accountId) {
       const start = set.accounts.findIndex(candidate => candidate.id === accountId);
       const ring = [...set.accounts.slice(start + 1), ...set.accounts.slice(0, start)];
-      const fallback = ring.find(candidate => candidate.paused !== true && candidate.needsReauth !== true);
+      const fallback = ring.find(candidate => candidate.paused !== true && candidate.needsReauth !== true
+        && !(provider === "anthropic" && candidate.credential.source === "local-cli"
+          && candidate.credential.expires <= Date.now() + REFRESH_SKEW_MS));
       if (fallback) {
         set.activeAccountId = fallback.id;
         set.selectionRevision = randomUUID();

structure/providers/anthropic-account-pool.md

@@ -7,6 +7,19 @@ OAuth, not a second list in provider config. `setAccountPaused` serializes pause
 with credential and selection writes, advances the selection revision, and only publishes
 invalidation after persistence. Removing an account removes its pause; reauthentication
 preserves it. The store moves active selection to an unpaused, non-reauth row if available.
+For Anthropic, automatic fallback preserves ring order, including source-less legacy rows,
+and skips background local-CLI rows expiring within 60 seconds, including still-valid credentials.
+`src/oauth/refresh-policy.ts` shares that skew between pause fallback, routing and token refresh.
+`src/oauth/index.ts` permits Claude Code re-adoption only when a nonempty access or refresh token
+matches the stored credential, preserving its account ID/email. `src/oauth/local-token-detect.ts`
+supplies this credential-continuity check; a shared path, active selection or matching metadata
+does not prove continuity. Fully replaced opaque token pairs are not adopted, even if they may
+belong to the same account. Stored-token refresh and explicit login remain available through the
+existing refresh-intent/reauth rules, so promotion cannot authorize another account's CLI pair.
+A legacy row selected by pause fallback or explicitly can use its own valid bearer for quota/model
+discovery and refresh its stored token normally. Missing or invalid provenance normalizes to no
+source, which never permits CLI-disk adoption. With no permitted fallback, active-account probes
+stay closed until a usable account is selected or resumed.
 Pause does not clear cooldowns, quota, or credentials and does not cancel an already-sent turn.
 
 `src/oauth/anthropic-routing.ts` excludes paused rows from quota, round-robin, fill-first,
@@ -27,6 +40,7 @@ pause/prior-429 recovery uses `only-eligible`, and logs name the committed accou
 > Decision record: [ADR-6013](../decisions/ADR-6013-anthropic-account-pause.md)
 
 Regression coverage: `tests/adapters/anthropic/anthropic-account-pause.test.ts`,
+`tests/oauth/local-token-detect.test.ts`, `tests/oauth/oauth-refresh.test.ts`,
 `tests/adapters/anthropic/anthropic-model-routes.test.ts`, `tests/oauth/oauth-accounts-api.test.ts`,
 `tests/cli/cli-account-pool-verbs.test.ts`, and `gui/tests/provider-quota-refresh-controls.test.tsx`.