@bitkyc08/opencodex 2.10.0 → 2.10.1

package/src/oauth/index.ts

@@ -4,7 +4,7 @@ import type { OcxConfig, OcxProviderConfig, RefreshPolicy } from "../types";
 import { loadConfig, resolveEnvValue, saveConfig } from "../config";
 import { maskEmail } from "../lib/privacy";
 import { KiroTokenRefreshError, environmentKiroRoutingMetadata, loginKiro, refreshKiroToken, settleKiroLoginTransaction } from "./kiro";
-import { getAccountCredential, getAccountSet, removeAccount, saveAccountCredential, saveCredential, setActiveAccount, getCredential, credentialGeneration, createOAuthRefreshIntentLock, mergeAccountCredential, markAccountNeedsReauthIfGeneration, readOAuthRefreshIntent, writeOAuthRefreshIntent, markOAuthRefreshIntentStaleOwner, clearOAuthRefreshIntent, OAuthMutationBusyError } from "./store";
+import { getAccountCredential, getAccountSet, removeAccount, saveAccountCredential, saveCredential, setActiveAccount, getCredential, credentialGeneration, createOAuthRefreshIntentLock, mergeAccountCredential, markAccountNeedsReauthIfGeneration, readOAuthRefreshIntent, writeOAuthRefreshIntent, markOAuthRefreshIntentStaleOwner, clearOAuthRefreshIntent, normalizeAuthStoreBuffer, OAuthMutationBusyError } from "./store";
 import { loginXai, refreshXaiToken, XAI_LOCAL_CLI_DETACH_WARNING, XaiTokenRequestError } from "./xai";
 import { ANTHROPIC_OAUTH_BETA, AnthropicTokenError, loginAnthropic, refreshAnthropicToken } from "./anthropic";
 import { loginKimi, refreshKimiToken } from "./kimi";
@@ -56,6 +56,20 @@ export interface OAuthAccessSnapshot {
   kiro?: Pick<KiroOAuthMetadata, "profileArn" | "apiRegion" | "ssoRegion">;
 }
 
+export interface ObservedOAuthAccessSnapshot extends OAuthAccessSnapshot {
+  /** Allowlisted provider API origin consumed by GitHub Copilot model discovery. */
+  apiBaseUrl?: string;
+}
+
+export type OAuthActiveTokenObservation =
+  | { readonly kind: "available"; readonly snapshot: ObservedOAuthAccessSnapshot }
+  | { readonly kind: "missing" }
+  | { readonly kind: "malformed" }
+  | { readonly kind: "needs-reauth" }
+  | { readonly kind: "expired" }
+  | { readonly kind: "near-expiry" }
+  | { readonly kind: "unsupported" };
+
 const MAX_OAUTH_TOKEN_REFRESH_FLIGHTS = 32;
 const OAUTH_TOKEN_REFRESH_FLIGHT_STALE_MS = 120_000;
 interface OAuthRefreshFlightEvidence { flightId: string; dispatched: boolean }
@@ -278,6 +292,38 @@ function accessSnapshot(provider: string, accountId: string, cred: OAuthCredenti
   };
 }
 
+/**
+ * Observe the active OAuth token from an auth-store buffer supplied by its filesystem owner.
+ * Missing, malformed, reauth-required, and expiring credentials are typed no-token outcomes;
+ * this path never refreshes, locks, hardens, backs up, or persists credentials.
+ */
+export function observeActiveOAuthAccessToken(
+  provider: string,
+  authStoreBuffer: Uint8Array | null,
+  now = Date.now(),
+): OAuthActiveTokenObservation {
+  const authStore = normalizeAuthStoreBuffer(authStoreBuffer);
+  if (authStore.kind === "absent") return { kind: "missing" };
+  if (authStore.kind === "malformed") return { kind: "malformed" };
+  if (!isOAuthProvider(provider)) return { kind: "unsupported" };
+
+  const accountSet = authStore.store[provider];
+  const account = accountSet?.accounts.find(candidate => candidate.id === accountSet.activeAccountId);
+  if (!account) return { kind: "missing" };
+  if (account.needsReauth) return { kind: "needs-reauth" };
+  if (account.credential.expires <= now) return { kind: "expired" };
+  if (account.credential.expires <= now + REFRESH_SKEW_MS) return { kind: "near-expiry" };
+
+  const apiBaseUrl = validateCopilotApiBaseUrl(account.credential.apiBaseUrl);
+  return {
+    kind: "available",
+    snapshot: {
+      ...accessSnapshot(provider, account.id, account.credential),
+      ...(apiBaseUrl ? { apiBaseUrl } : {}),
+    },
+  };
+}
+
 async function resolveAccessSnapshotForAccount(
   provider: string,
   accountId: string,
@@ -583,13 +629,25 @@ function modelDiscoveryTransportSeed(providerName: string, prov: OcxProviderConf
  * Everyone else uses the OpenAI-style `/models` + Bearer with a `{ data: [{ id, owned_by? }] }`
  * response.
  */
-export function buildModelsRequest(prov: OcxProviderConfig, apiKey: string | undefined, providerName = ""): { url: string; headers: Record<string, string> } {
+export interface ModelsRequestObservedAuth {
+  readonly oauthApiBaseUrl?: string;
+}
+
+export function buildModelsRequest(
+  prov: OcxProviderConfig,
+  apiKey: string | undefined,
+  providerName = "",
+  observedAuth?: ModelsRequestObservedAuth,
+): { url: string; headers: Record<string, string> } {
   const transportSeed = modelDiscoveryTransportSeed(providerName, prov);
+  const copilotApiBaseUrl = observedAuth === undefined
+    ? (providerName === "github-copilot" ? getOAuthCredentialApiBaseUrl(providerName) : undefined)
+    : observedAuth.oauthApiBaseUrl;
   const effectiveProvider = resolveProviderTransport(
     providerName,
     transportSeed,
     undefined,
-    providerName === "github-copilot" ? getOAuthCredentialApiBaseUrl(providerName) : undefined,
+    copilotApiBaseUrl,
   );
   const headers: Record<string, string> = { ...(effectiveProvider.headers ?? {}) };
   const discoveryUrl = (defaultUrl: string): string => resolveProviderModelDiscoveryUrl(

package/src/oauth/key-providers.ts

@@ -52,6 +52,10 @@ export async function validateApiKey(
   key: string,
 ): Promise<boolean | "unknown"> {
   try {
+    // A public model catalog cannot prove that the supplied key is valid. Returning unknown keeps
+    // the best-effort login flow available without persisting a false-positive validation result.
+    if (provider.apiKeyValidation === "unknown") return "unknown";
+
     if (provider.adapter === "anthropic") {
       const base = provider.baseUrl.replace(/\/v1\/?$/, "");
       const res = await fetch(`${base}/v1/messages`, {

package/src/oauth/kiro.ts

@@ -172,13 +172,37 @@ async function defaultKiroCliRunner(args: string[], signal?: AbortSignal): Promi
   }
 }
 
-async function readKiroCliIdentity(runner: KiroCliRunner, signal?: AbortSignal): Promise<{ email?: string }> {
+/** Kiro profile ARN structure: arn:<partition>:codewhisperer:<region>:<account>:profile/<id> */
+const KIRO_PROFILE_ARN_PATTERN = /^arn:[a-z0-9-]+:codewhisperer:[a-z0-9-]+:\d{12}:profile\/[A-Za-z0-9-]+$/;
+const KIRO_PROFILE_ARN_MAX_LENGTH = 256;
+
+function parseKiroProfileArn(value: unknown): string | undefined {
+  if (typeof value !== "string") return undefined;
+  const trimmed = value.trim();
+  if (trimmed.length === 0 || trimmed.length > KIRO_PROFILE_ARN_MAX_LENGTH) return undefined;
+  return KIRO_PROFILE_ARN_PATTERN.test(trimmed) ? trimmed : undefined;
+}
+
+function profileArnFromWhoami(parsed: Record<string, unknown>): string | undefined {
+  // Only narrowly-named documented-ish shapes; never invent an ARN (#993).
+  return parseKiroProfileArn(parsed.profileArn)
+    ?? parseKiroProfileArn(parsed.profile_arn)
+    ?? (parsed.profile && typeof parsed.profile === "object" && !Array.isArray(parsed.profile)
+      ? parseKiroProfileArn((parsed.profile as Record<string, unknown>).arn)
+      : undefined);
+}
+
+async function readKiroCliIdentity(runner: KiroCliRunner, signal?: AbortSignal): Promise<{ email?: string; profileArn?: string }> {
   try {
     const result = await runner(["whoami", "--format", "json"], signal);
     if (result.exitCode !== 0) return {};
-    const parsed = JSON.parse(result.stdout) as { email?: unknown };
+    const parsed = JSON.parse(result.stdout) as Record<string, unknown>;
     const email = typeof parsed.email === "string" ? parsed.email.trim().toLowerCase() : "";
-    return email && email.length <= 320 ? { email } : {};
+    const profileArn = profileArnFromWhoami(parsed);
+    return {
+      ...(email && email.length <= 320 ? { email } : {}),
+      ...(profileArn ? { profileArn } : {}),
+    };
   } catch {
     return {};
   }
@@ -251,14 +275,34 @@ async function oauthCredentialFromImported(
   runner: KiroCliRunner,
   signal?: AbortSignal,
 ): Promise<OAuthCredentials> {
-  const identity = imported.source === "sqlite" ? await readKiroCliIdentity(runner, signal) : {};
-  const metadata = metadataFromImported(imported);
+  let identity: { email?: string; profileArn?: string } = {};
+  if (imported.source === "sqlite") {
+    identity = await readKiroCliIdentity(runner, signal);
+    // Session-switch race (#993 review): another process may have switched the
+    // active Kiro CLI session between the SQLite read and whoami. Accept
+    // whoami's identity only when the session token STILL matches the import —
+    // refresh token, or access token when refresh is absent.
+    if (identity.profileArn !== undefined) {
+      const current = readKiroCliSqliteCredential();
+      const importedKey = imported.refresh || imported.access;
+      const currentKey = current ? current.refresh || current.access : "";
+      if (!current || currentKey !== importedKey) identity = {};
+    }
+  }
+  // Builder ID imports often lack a profileArn in SQLite; whoami against the
+  // SAME active CLI session can supply it (#993). Imported stays authoritative.
+  const resolvedProfileArn = imported.profileArn ?? identity.profileArn;
+  const metadata: KiroOAuthMetadata | undefined = (() => {
+    const base = metadataFromImported(imported) ?? {};
+    if (resolvedProfileArn && !base.profileArn) base.profileArn = resolvedProfileArn;
+    return Object.keys(base).length > 0 ? base : undefined;
+  })();
   return {
     access: imported.access,
     refresh: imported.refresh,
     expires: imported.expires,
     source: imported.source === "json" ? "credential-file" : "local-cli",
-    ...(imported.profileArn ? { accountId: imported.profileArn } : {}),
+    ...(resolvedProfileArn ? { accountId: resolvedProfileArn } : {}),
     ...(identity.email ? { email: identity.email } : {}),
     ...(metadata ? { kiro: metadata } : {}),
   };

package/src/oauth/store.ts

@@ -29,7 +29,14 @@ import {
 import { validateCopilotApiBaseUrl } from "./github-copilot";
 import type { OAuthCredentialSource, OAuthCredentials, ProviderAccount, ProviderAccountSet } from "./types";
 
-type AuthStore = Record<string, ProviderAccountSet>;
+export type AuthStore = Record<string, ProviderAccountSet>;
+
+export type AuthStoreBufferSnapshot =
+  | { readonly kind: "ready"; readonly store: AuthStore }
+  | { readonly kind: "absent" }
+  | { readonly kind: "malformed" };
+
+const authStoreDecoder = new TextDecoder("utf-8", { fatal: true });
 let lastReconciledGeneration = 0;
 let liveOAuthAccountKeys = new Set<string>();
 
@@ -142,6 +149,27 @@ export function loadAuthStore(): AuthStore {
   return loadAuthStoreInternal().store;
 }
 
+/**
+ * Pure normalization for auth-store bytes already read by another owner.
+ * This function performs no filesystem consultation, hardening, backup, or persistence.
+ */
+export function normalizeAuthStoreBuffer(buffer: Uint8Array | null): AuthStoreBufferSnapshot {
+  if (buffer === null) return { kind: "absent" };
+  try {
+    const parsed: unknown = JSON.parse(authStoreDecoder.decode(buffer));
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      return { kind: "malformed" };
+    }
+    const { store } = normalizeAuthStore(parsed);
+    if (Object.keys(parsed).length > 0 && Object.keys(store).length === 0) {
+      return { kind: "malformed" };
+    }
+    return { kind: "ready", store };
+  } catch {
+    return { kind: "malformed" };
+  }
+}
+
 /**
  * Observe-only auth store read for diagnostics (`ocx doctor` / status).
  * Does not chmod paths or backup invalid JSON — corrupt files are treated as empty.
@@ -149,11 +177,8 @@ export function loadAuthStore(): AuthStore {
 export function peekAuthStore(): AuthStore {
   const path = getAuthStorePath();
   if (!existsSync(path)) return {};
-  try {
-    return normalizeAuthStore(JSON.parse(readFileSync(path, "utf-8"))).store;
-  } catch {
-    return {};
-  }
+  const snapshot = normalizeAuthStoreBuffer(readFileSync(path));
+  return snapshot.kind === "ready" ? snapshot.store : {};
 }
 
 function persist(store: AuthStore): void {

package/src/oauth/token-guardian.ts

@@ -30,6 +30,7 @@ import { getMainAccountToken, MAIN_CODEX_ACCOUNT_ID } from "../codex/main-accoun
 import { isCanonicalOpenAiForwardProvider, OPENAI_CODEX_PROVIDER_ID } from "../providers/openai-tiers";
 import { providerCodexAccountMode } from "../providers/registry";
 import { captureConfigGeneration, type GenerationContext } from "../lib/state-store-sweeper";
+import { tryAcquireNativeMainProfileClaim } from "../codex/native-main-admission";
 
 export interface TokenGuardianHandle {
   stop(): void;
@@ -175,11 +176,14 @@ export async function guardianSweep(nowMs: number = Date.now()): Promise<Guardia
   ) {
     const mode = providerCodexAccountMode(OPENAI_CODEX_PROVIDER_ID, openai) ?? "pool";
     if (opts.codexWarmupEnabled) {
-      const mainToken = getMainAccountToken();
       const key = `codex:${MAIN_CODEX_ACCOUNT_ID}`;
-      if (mainToken && !inBackoff(key, nowMs)) {
+      if (!inBackoff(key, nowMs)) {
         tasks.push(async () => {
+          const nativeMainLease = tryAcquireNativeMainProfileClaim();
+          if (!nativeMainLease) return;
           try {
+            const mainToken = getMainAccountToken();
+            if (!mainToken) return;
             await warmCodexAccount({
               accessToken: mainToken.accessToken,
               chatgptAccountId: mainToken.chatgptAccountId,
@@ -190,9 +194,11 @@ export async function guardianSweep(nowMs: number = Date.now()): Promise<Guardia
           } catch (err) {
             recordFailure(key, nowMs, opts.backoffBaseSeconds, opts.backoffMaxSeconds, false, writerGeneration);
             result.failed.push(key);
+          } finally {
+            nativeMainLease.release();
           }
         });
-      } else if (mainToken) {
+      } else {
         result.skippedBackoff.push(key);
       }
     }

package/src/providers/codex-capacity.ts

@@ -0,0 +1,288 @@
+export const CODEX_CONFIGURED_CAPACITY_WEIGHTS = {
+  plus: 1,
+  business: 1,
+  prolite: 5,
+  pro: 20,
+} as const;
+
+/** Match the provider-report last-good freshness bound. */
+export const CODEX_CAPACITY_MAX_QUOTA_AGE_MS = 30 * 60_000;
+
+export type CodexCapacityQuota = {
+  fiveHourPercent?: number;
+  fiveHourResetAt?: number;
+  weeklyPercent?: number;
+  weeklyResetAt?: number;
+  monthlyPercent?: number;
+  monthlyResetAt?: number;
+  customWindows?: Array<{ label: string; percent: number; resetAt?: number }>;
+  updatedAt: number;
+};
+
+export interface CodexCapacityAccount {
+  isMain: boolean;
+  active?: boolean;
+  plan?: string | null;
+  paused: boolean;
+  needsReauth?: boolean;
+  quota: CodexCapacityQuota | null;
+}
+
+export interface CodexCapacityWindowAggregation {
+  usedPercent: number;
+  includedAccounts: number;
+  excludedAccounts: number;
+  incomplete: boolean;
+  /** Internal calculation evidence; stripped from the management API response. */
+  totalWeight?: number;
+  /** Internal calculation evidence; stripped from the management API response. */
+  consumedWeight?: number;
+  /** Internal calculation evidence; stripped from the management API response. */
+  remainingWeight?: number;
+  updatedAt: number;
+  nextRecoveryAt?: number;
+  nextRecoveryPercent?: number;
+}
+
+export interface CodexCapacityAggregation {
+  kind: "capacity-weighted-v1";
+  scope: "routable-known";
+  includedAccounts: number;
+  excludedAccounts: number;
+  unknownPlanAccounts: number;
+  missingQuotaAccounts: number;
+  pausedAccounts: number;
+  reauthAccounts: number;
+  staleQuotaAccounts: number;
+  partialWindowAccounts: number;
+  incomplete: boolean;
+  presentation?: "aggregate" | "effective-account-fallback" | "coverage-only";
+  fiveHour?: CodexCapacityWindowAggregation;
+  weekly?: CodexCapacityWindowAggregation;
+  monthly?: CodexCapacityWindowAggregation;
+  customWindows?: Array<CodexCapacityWindowAggregation & { label: string }>;
+  currentAccount?: {
+    isMain: boolean;
+    plan?: string | null;
+    quota: CodexCapacityQuota | null;
+  };
+}
+
+export interface CodexCapacityResult {
+  quota: CodexCapacityQuota | null;
+  aggregation: CodexCapacityAggregation | null;
+  currentAccount?: CodexCapacityAggregation["currentAccount"];
+}
+
+type MutableWindow = {
+  totalWeight: number;
+  consumedWeight: number;
+  includedAccounts: number;
+  recoveries: Map<number, number>;
+  oldestUpdatedAt: number;
+};
+
+function configuredWeight(plan: string | null | undefined): number | undefined {
+  const normalized = plan?.trim().toLowerCase();
+  return normalized && Object.hasOwn(CODEX_CONFIGURED_CAPACITY_WEIGHTS, normalized)
+    ? CODEX_CONFIGURED_CAPACITY_WEIGHTS[normalized as keyof typeof CODEX_CONFIGURED_CAPACITY_WEIGHTS]
+    : undefined;
+}
+
+function normalizedPercent(value: unknown): number | undefined {
+  return typeof value === "number" && Number.isFinite(value)
+    ? Math.max(0, Math.min(100, value))
+    : undefined;
+}
+
+function futureResetMs(value: unknown, now: number): number | undefined {
+  if (typeof value !== "number" || !Number.isFinite(value)) return undefined;
+  const milliseconds = value > 10_000_000_000 ? value : value * 1000;
+  return milliseconds > now ? milliseconds : undefined;
+}
+
+function hasKnownQuotaWindow(quota: CodexCapacityQuota | null): quota is CodexCapacityQuota {
+  if (!quota) return false;
+  return normalizedPercent(quota.fiveHourPercent) !== undefined
+    || normalizedPercent(quota.weeklyPercent) !== undefined
+    || normalizedPercent(quota.monthlyPercent) !== undefined
+    || !!quota.customWindows?.some(window => normalizedPercent(window.percent) !== undefined);
+}
+
+function currentQuotaForDisplay(account: CodexCapacityAccount, now: number): CodexCapacityQuota | null {
+  const quota = account.quota;
+  const fresh = !!quota
+    && Number.isFinite(quota.updatedAt)
+    && now - quota.updatedAt <= CODEX_CAPACITY_MAX_QUOTA_AGE_MS;
+  return !account.paused && !account.needsReauth && fresh && hasKnownQuotaWindow(quota) ? quota : null;
+}
+
+function addWindow(
+  windows: Map<string, MutableWindow>,
+  key: string,
+  weight: number,
+  percent: number,
+  resetAt: number | undefined,
+  updatedAt: number,
+): void {
+  const window = windows.get(key) ?? {
+    totalWeight: 0,
+    consumedWeight: 0,
+    includedAccounts: 0,
+    recoveries: new Map<number, number>(),
+    oldestUpdatedAt: updatedAt,
+  };
+  const consumed = weight * percent / 100;
+  window.totalWeight += weight;
+  window.consumedWeight += consumed;
+  window.includedAccounts += 1;
+  window.oldestUpdatedAt = Math.min(window.oldestUpdatedAt, updatedAt);
+  if (resetAt !== undefined && consumed > 0) {
+    window.recoveries.set(resetAt, (window.recoveries.get(resetAt) ?? 0) + consumed);
+  }
+  windows.set(key, window);
+}
+
+function finalizeWindow(window: MutableWindow, totalAccounts: number): CodexCapacityWindowAggregation {
+  const nextRecoveryAt = [...window.recoveries.keys()].sort((a, b) => a - b)[0];
+  const recovered = nextRecoveryAt === undefined ? undefined : window.recoveries.get(nextRecoveryAt);
+  return {
+    usedPercent: window.consumedWeight / window.totalWeight * 100,
+    includedAccounts: window.includedAccounts,
+    excludedAccounts: totalAccounts - window.includedAccounts,
+    incomplete: window.includedAccounts < totalAccounts,
+    totalWeight: window.totalWeight,
+    consumedWeight: window.consumedWeight,
+    remainingWeight: window.totalWeight - window.consumedWeight,
+    updatedAt: window.oldestUpdatedAt,
+    ...(nextRecoveryAt !== undefined ? { nextRecoveryAt } : {}),
+    ...(recovered !== undefined ? { nextRecoveryPercent: recovered / window.totalWeight * 100 } : {}),
+  };
+}
+
+/** Display-only configured-weight estimate. It never participates in account selection or routing. */
+export function aggregateCodexPoolCapacity(
+  accounts: readonly CodexCapacityAccount[],
+  now = Date.now(),
+): CodexCapacityResult {
+  const current = accounts.find(account => account.active)
+    ?? accounts.find(account => account.isMain)
+    ?? accounts[0];
+  const currentAccount = current ? {
+    isMain: current.isMain,
+    ...(current.plan !== undefined ? { plan: current.plan } : {}),
+    quota: currentQuotaForDisplay(current, now),
+  } : undefined;
+  const windows = new Map<string, MutableWindow>();
+  const included = new Set<CodexCapacityAccount>();
+  const contributions = new Map<CodexCapacityAccount, Set<string>>();
+  let unknownPlanAccounts = 0;
+  let missingQuotaAccounts = 0;
+  let pausedAccounts = 0;
+  let reauthAccounts = 0;
+  let staleQuotaAccounts = 0;
+
+  for (const account of accounts) {
+    const weight = configuredWeight(account.plan);
+    if (weight === undefined) unknownPlanAccounts += 1;
+    if (account.paused) pausedAccounts += 1;
+    if (account.needsReauth) reauthAccounts += 1;
+    const quota = account.quota;
+    const quotaFresh = !!quota
+      && Number.isFinite(quota.updatedAt)
+      && now - quota.updatedAt <= CODEX_CAPACITY_MAX_QUOTA_AGE_MS;
+    if (quota && !quotaFresh) staleQuotaAccounts += 1;
+    const standard = quota ? [
+      ["fiveHour", quota.fiveHourPercent, quota.fiveHourResetAt],
+      ["weekly", quota.weeklyPercent, quota.weeklyResetAt],
+      ["monthly", quota.monthlyPercent, quota.monthlyResetAt],
+    ] as const : [];
+    const custom = quota?.customWindows ?? [];
+    const hasQuota = hasKnownQuotaWindow(quota);
+    if (!hasQuota) missingQuotaAccounts += 1;
+    if (account.paused || account.needsReauth || weight === undefined || !quota || !hasQuota || !quotaFresh) continue;
+
+    let contributed = false;
+    const contributionKeys = new Set<string>();
+    for (const [key, rawPercent, rawReset] of standard) {
+      const percent = normalizedPercent(rawPercent);
+      if (percent === undefined) continue;
+      addWindow(windows, key, weight, percent, futureResetMs(rawReset, now), quota.updatedAt);
+      contributionKeys.add(key);
+      contributed = true;
+    }
+    for (const customWindow of custom) {
+      const percent = normalizedPercent(customWindow.percent);
+      if (percent === undefined) continue;
+      addWindow(windows, `custom:${customWindow.label}`, weight, percent, futureResetMs(customWindow.resetAt, now), quota.updatedAt);
+      contributionKeys.add(`custom:${customWindow.label}`);
+      contributed = true;
+    }
+    if (contributed) {
+      included.add(account);
+      contributions.set(account, contributionKeys);
+    }
+  }
+
+  if (windows.size === 0) {
+    if (accounts.length === 0) return { quota: null, aggregation: null, ...(currentAccount ? { currentAccount } : {}) };
+    const aggregation: CodexCapacityAggregation = {
+      kind: "capacity-weighted-v1",
+      scope: "routable-known",
+      includedAccounts: 0,
+      excludedAccounts: accounts.length,
+      unknownPlanAccounts,
+      missingQuotaAccounts,
+      pausedAccounts,
+      reauthAccounts,
+      staleQuotaAccounts,
+      partialWindowAccounts: 0,
+      incomplete: true,
+      ...(currentAccount ? { currentAccount } : {}),
+    };
+    return { quota: null, aggregation, ...(currentAccount ? { currentAccount } : {}) };
+  }
+  const fiveHour = windows.get("fiveHour") ? finalizeWindow(windows.get("fiveHour")!, accounts.length) : undefined;
+  const weekly = windows.get("weekly") ? finalizeWindow(windows.get("weekly")!, accounts.length) : undefined;
+  const monthly = windows.get("monthly") ? finalizeWindow(windows.get("monthly")!, accounts.length) : undefined;
+  const customWindows = [...windows.entries()].flatMap(([key, window]) => key.startsWith("custom:")
+    ? [{ label: key.slice("custom:".length), ...finalizeWindow(window, accounts.length) }]
+    : []);
+  const quota: CodexCapacityQuota = {
+    ...(fiveHour ? { fiveHourPercent: fiveHour.usedPercent } : {}),
+    ...(weekly ? { weeklyPercent: weekly.usedPercent } : {}),
+    ...(monthly ? { monthlyPercent: monthly.usedPercent } : {}),
+    ...(customWindows.length > 0 ? {
+      customWindows: customWindows.map(window => ({ label: window.label, percent: window.usedPercent })),
+    } : {}),
+    updatedAt: Math.min(
+      ...[fiveHour, weekly, monthly, ...customWindows]
+        .flatMap(window => window ? [window.updatedAt] : []),
+    ),
+  };
+  const visibleWindowKeys = [...windows.keys()];
+  const partialWindowAccounts = accounts.filter(account => {
+    const keys = contributions.get(account);
+    return !!keys && visibleWindowKeys.some(key => !keys.has(key));
+  }).length;
+  const excludedAccounts = accounts.length - included.size;
+  const aggregation: CodexCapacityAggregation = {
+    kind: "capacity-weighted-v1",
+    scope: "routable-known",
+    includedAccounts: included.size,
+    excludedAccounts,
+    unknownPlanAccounts,
+    missingQuotaAccounts,
+    pausedAccounts,
+    reauthAccounts,
+    staleQuotaAccounts,
+    partialWindowAccounts,
+    incomplete: excludedAccounts > 0 || partialWindowAccounts > 0,
+    ...(fiveHour ? { fiveHour } : {}),
+    ...(weekly ? { weekly } : {}),
+    ...(monthly ? { monthly } : {}),
+    ...(customWindows.length > 0 ? { customWindows } : {}),
+    ...(currentAccount ? { currentAccount } : {}),
+  };
+  return { quota, aggregation, ...(currentAccount ? { currentAccount } : {}) };
+}

package/src/providers/derive.ts

@@ -6,6 +6,7 @@ export interface DerivedKeyLoginProvider {
   baseUrl: string;
   responsesPath?: string;
   adapter: string;
+  apiKeyValidation?: "unknown";
   apiKeyTransport?: OcxProviderConfig["apiKeyTransport"];
   dashboardUrl: string;
   models?: string[];
@@ -22,6 +23,7 @@ export interface DerivedKeyLoginProvider {
   modelDefaultReasoningEfforts?: Record<string, string>;
   reasoningEffortMap?: Record<string, string>;
   modelReasoningEffortMap?: Record<string, Record<string, string>>;
+  reasoningWireFormat?: OcxProviderConfig["reasoningWireFormat"];
   noVisionModels?: string[];
   noReasoningModels?: string[];
   noTemperatureModels?: string[];
@@ -102,13 +104,20 @@ function cloneNestedRecord(input: Record<string, Record<string, string>>): Recor
   return Object.fromEntries(Object.entries(input).map(([key, value]) => [key, { ...value }]));
 }
 
+/**
+ * Build the provider config a registry entry contributes when a preset is materialized.
+ * The registry auth kind is preserved verbatim (including `"local"`) so fail-closed gates
+ * keep distinguishing local runtimes from API-key providers after the seed round-trip.
+ */
 export function providerConfigSeed(entry: ProviderRegistryEntry): OcxProviderConfig {
   return {
     adapter: entry.adapter,
     baseUrl: entry.baseUrl,
     ...(entry.apiKeyTransport !== undefined ? { apiKeyTransport: entry.apiKeyTransport } : {}),
     ...(entry.responsesPath ? { responsesPath: entry.responsesPath } : {}),
-    authMode: entry.authKind === "local" ? undefined : entry.authKind,
+    // Preserve the registry auth kind verbatim (including "local") so fail-closed gates that
+    // distinguish local runtimes from API-key providers keep working after the seed round-trip.
+    authMode: entry.authKind,
     ...(entry.codexAccountMode ? { codexAccountMode: entry.codexAccountMode } : {}),
     ...(entry.keyOptional !== undefined ? { keyOptional: entry.keyOptional } : {}),
     ...(entry.freeTier !== undefined ? { freeTier: entry.freeTier } : {}),
@@ -128,6 +137,7 @@ export function providerConfigSeed(entry: ProviderRegistryEntry): OcxProviderCon
     ...(entry.modelDefaultReasoningEfforts ? { modelDefaultReasoningEfforts: { ...entry.modelDefaultReasoningEfforts } } : {}),
     ...(entry.reasoningEffortMap ? { reasoningEffortMap: { ...entry.reasoningEffortMap } } : {}),
     ...(entry.modelReasoningEffortMap ? { modelReasoningEffortMap: cloneNestedRecord(entry.modelReasoningEffortMap) } : {}),
+    ...(entry.reasoningWireFormat ? { reasoningWireFormat: entry.reasoningWireFormat } : {}),
     ...(entry.noVisionModels ? { noVisionModels: [...entry.noVisionModels] } : {}),
     ...(entry.noReasoningModels ? { noReasoningModels: [...entry.noReasoningModels] } : {}),
     ...(entry.noTemperatureModels ? { noTemperatureModels: [...entry.noTemperatureModels] } : {}),
@@ -159,6 +169,7 @@ export function deriveKeyLoginMap(): Record<string, DerivedKeyLoginProvider> {
       baseUrl: entry.baseUrl,
       ...(entry.responsesPath ? { responsesPath: entry.responsesPath } : {}),
       adapter: entry.adapter,
+      ...(entry.apiKeyValidation !== undefined ? { apiKeyValidation: entry.apiKeyValidation } : {}),
       ...(entry.apiKeyTransport !== undefined ? { apiKeyTransport: entry.apiKeyTransport } : {}),
       dashboardUrl: entry.dashboardUrl,
       ...(entry.models ? { models: [...entry.models] } : {}),
@@ -175,6 +186,7 @@ export function deriveKeyLoginMap(): Record<string, DerivedKeyLoginProvider> {
       ...(entry.modelDefaultReasoningEfforts ? { modelDefaultReasoningEfforts: { ...entry.modelDefaultReasoningEfforts } } : {}),
       ...(entry.reasoningEffortMap ? { reasoningEffortMap: { ...entry.reasoningEffortMap } } : {}),
       ...(entry.modelReasoningEffortMap ? { modelReasoningEffortMap: cloneNestedRecord(entry.modelReasoningEffortMap) } : {}),
+      ...(entry.reasoningWireFormat ? { reasoningWireFormat: entry.reasoningWireFormat } : {}),
       ...(entry.noVisionModels ? { noVisionModels: [...entry.noVisionModels] } : {}),
       ...(entry.noReasoningModels ? { noReasoningModels: [...entry.noReasoningModels] } : {}),
       ...(entry.noTemperatureModels ? { noTemperatureModels: [...entry.noTemperatureModels] } : {}),
@@ -248,6 +260,7 @@ export function enrichProviderFromRegistry(name: string, prov: OcxProviderConfig
   if (!prov.modelDefaultReasoningEfforts && seed.modelDefaultReasoningEfforts) prov.modelDefaultReasoningEfforts = { ...seed.modelDefaultReasoningEfforts };
   if (!prov.reasoningEffortMap && seed.reasoningEffortMap) prov.reasoningEffortMap = { ...seed.reasoningEffortMap };
   if (!prov.modelReasoningEffortMap && seed.modelReasoningEffortMap) prov.modelReasoningEffortMap = cloneNestedRecord(seed.modelReasoningEffortMap);
+  if (prov.reasoningWireFormat === undefined && seed.reasoningWireFormat !== undefined) prov.reasoningWireFormat = seed.reasoningWireFormat;
   if (!prov.noVisionModels && seed.noVisionModels) prov.noVisionModels = [...seed.noVisionModels];
   if (!prov.noReasoningModels && seed.noReasoningModels) prov.noReasoningModels = [...seed.noReasoningModels];
   if (!prov.noTemperatureModels && seed.noTemperatureModels) prov.noTemperatureModels = [...seed.noTemperatureModels];
@@ -259,6 +272,25 @@ export function enrichProviderFromRegistry(name: string, prov: OcxProviderConfig
   // learned this route still gets backfilled.
   if (prov.responsesPath === undefined && seed.responsesPath !== undefined) prov.responsesPath = seed.responsesPath;
   if (prov.statelessResponses === undefined && seed.statelessResponses !== undefined) prov.statelessResponses = seed.statelessResponses;
+  // Registry-only metadata (never seeded into saved config): backfill straight from
+  // the entry so an explicit user value stays distinguishable from the default.
+  if (prov.supportsServiceTier === undefined && entry.supportsServiceTier !== undefined) prov.supportsServiceTier = entry.supportsServiceTier;
+  if (prov.preserveResponsesReasoningContent === undefined && entry.preserveResponsesReasoningContent !== undefined) prov.preserveResponsesReasoningContent = entry.preserveResponsesReasoningContent;
+  // Registry-only repair policy (#938): fill only when the runtime provider has
+  // no explicit policy, and deep-clone so saved/user values never alias the
+  // registry constant.
+  if (prov.responsesItemIdRepair === undefined && entry.responsesItemIdRepair) {
+    prov.responsesItemIdRepair = {
+      ...(entry.responsesItemIdRepair.message ? { message: [...entry.responsesItemIdRepair.message] } : {}),
+      ...(entry.responsesItemIdRepair.reasoning ? { reasoning: [...entry.responsesItemIdRepair.reasoning] } : {}),
+      ...(entry.responsesItemIdRepair.repairMissingTerminalIds !== undefined
+        ? { repairMissingTerminalIds: entry.responsesItemIdRepair.repairMissingTerminalIds }
+        : {}),
+      ...(entry.responsesItemIdRepair.repairInvalidIds !== undefined
+        ? { repairInvalidIds: entry.responsesItemIdRepair.repairInvalidIds }
+        : {}),
+    };
+  }
   if (!prov.autoToolChoiceOnlyModels && seed.autoToolChoiceOnlyModels) prov.autoToolChoiceOnlyModels = [...seed.autoToolChoiceOnlyModels];
   if (!prov.preserveReasoningContentModels && seed.preserveReasoningContentModels) prov.preserveReasoningContentModels = [...seed.preserveReasoningContentModels];
   if (!prov.reasoningSplitModels && seed.reasoningSplitModels) prov.reasoningSplitModels = [...seed.reasoningSplitModels];