@bitkyc08/opencodex 2.10.1 → 2.10.2

package/src/oauth/command-code.ts

@@ -0,0 +1,239 @@
+import type { OAuthController, OAuthCredentials } from "./types";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { isAddrInUse } from "../server/ports";
+import { parseCallbackInput } from "./callback-server";
+
+const COMMAND_CODE_STUDIO_URL = "https://commandcode.ai";
+const COMMAND_CODE_CALLBACK_PORT = 5959;
+const LOGIN_TIMEOUT_MS = 120_000;
+const CALLBACK_PATH = "/callback";
+
+interface CommandCodeCallback {
+  apiKey: string;
+  state: string;
+  userId: string;
+  userName: string;
+  keyName: string;
+}
+
+interface CommandCodeLocalAuth {
+  apiKey?: unknown;
+  userId?: unknown;
+}
+
+export interface CommandCodeLoginOptions {
+  /** Add-account and reauthentication flows must select a fresh browser identity. */
+  importLocal?: "fallback" | "off";
+}
+
+export function shouldImportLocalCommandCodeAuth(options: CommandCodeLoginOptions = {}): boolean {
+  return options.importLocal !== "off";
+}
+
+async function importLocalCommandCodeAuth(signal?: AbortSignal): Promise<OAuthCredentials | undefined> {
+  if (signal?.aborted) {
+    throw signal.reason ?? new DOMException("Command Code login aborted", "AbortError");
+  }
+  let parsed: CommandCodeLocalAuth;
+  try {
+    parsed = JSON.parse(await Bun.file(join(homedir(), ".commandcode", "auth.json")).text()) as CommandCodeLocalAuth;
+  } catch {
+    return undefined;
+  }
+  if (typeof parsed.apiKey !== "string" || parsed.apiKey.length === 0) return undefined;
+  let accountId: string | undefined;
+  try {
+    const response = await fetch("https://api.commandcode.ai/alpha/whoami", {
+      headers: { Authorization: `Bearer ${parsed.apiKey}`, Accept: "application/json" },
+      signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(10_000)]) : AbortSignal.timeout(10_000),
+    });
+    if (!response.ok) return undefined;
+    // Carry the validated whoami identity so an imported credential keeps multi-account
+    // semantics even when the local auth.json omits userId.
+    const body = (await response.json()) as { user?: { id?: unknown } };
+    if (typeof body.user?.id === "string" && body.user.id.length > 0) accountId = body.user.id;
+  } catch (error) {
+    if (signal?.aborted) throw signal.reason ?? new DOMException("Command Code login aborted", "AbortError");
+    return undefined;
+  }
+  if (!accountId && typeof parsed.userId === "string" && parsed.userId.length > 0) accountId = parsed.userId;
+  return {
+    access: parsed.apiKey,
+    refresh: parsed.apiKey,
+    expires: Number.MAX_SAFE_INTEGER,
+    ...(accountId ? { accountId } : {}),
+    source: "local-cli",
+  };
+}
+
+function randomState(): string {
+  const bytes = new Uint8Array(32);
+  crypto.getRandomValues(bytes);
+  return Buffer.from(bytes).toString("base64url");
+}
+
+export function parseCommandCodeCallback(value: unknown, expectedState: string): CommandCodeCallback {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("Command Code callback must be an object");
+  }
+  const body = value as Record<string, unknown>;
+  if (body.state !== expectedState) throw new Error("Command Code OAuth state mismatch");
+  for (const field of ["apiKey", "userId", "userName", "keyName"] as const) {
+    if (typeof body[field] !== "string" || body[field].length === 0) {
+      throw new Error(`Command Code callback missing ${field}`);
+    }
+  }
+  return body as unknown as CommandCodeCallback;
+}
+
+function createCallbackServer(state: string): {
+  servers: Array<ReturnType<typeof Bun.serve>>;
+  callback: Promise<CommandCodeCallback>;
+} {
+  let resolve!: (value: CommandCodeCallback) => void;
+  const callback = new Promise<CommandCodeCallback>((res) => { resolve = res; });
+  const fetch = async (request: Request): Promise<Response> => {
+    const url = new URL(request.url);
+    const origin = request.headers.get("origin");
+    const headers = new Headers({
+      "Content-Type": "application/json",
+      "Access-Control-Allow-Origin": origin === COMMAND_CODE_STUDIO_URL ? origin : COMMAND_CODE_STUDIO_URL,
+      "Access-Control-Allow-Methods": "POST, OPTIONS",
+      "Access-Control-Allow-Headers": "Content-Type",
+    });
+    if (request.method === "OPTIONS") return new Response(null, { status: 204, headers });
+    if (url.pathname !== CALLBACK_PATH) return Response.json({ success: false, error: "Not found" }, { status: 404, headers });
+    if (request.method !== "POST") return Response.json({ success: false, error: "Method not allowed" }, { status: 405, headers });
+    try {
+      const body = await request.json();
+      const parsed = parseCommandCodeCallback(body, state);
+      queueMicrotask(() => resolve(parsed));
+      return Response.json({ success: true }, { headers });
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      return Response.json({ success: false, error: message }, { status: 400, headers });
+    }
+  };
+  const create = (port: number): Array<ReturnType<typeof Bun.serve>> => {
+    // The advertised callback host is `127.0.0.1`; on Windows `localhost` commonly resolves to `::1`
+    // first, so also bind the IPv6 loopback best-effort (mirrors the shared OAuthCallbackFlow).
+    const servers = [Bun.serve({ hostname: "127.0.0.1", port, fetch })];
+    try {
+      servers.push(Bun.serve({ hostname: "::1", port: servers[0].port, fetch }));
+    } catch (error) {
+      if (isAddrInUse(error)) {
+        for (const server of servers) server.stop(true);
+        throw error;
+      }
+      // IPv6 unsupported (EAFNOSUPPORT etc.) degrades to the IPv4-only listener.
+    }
+    return servers;
+  };
+  try {
+    return { servers: create(COMMAND_CODE_CALLBACK_PORT), callback };
+  } catch {
+    return { servers: create(0), callback };
+  }
+}
+
+/** Validate a raw pasted Command Code API key and return the validated identity. */
+async function validatePastedApiKey(apiKey: string): Promise<{ userId: string; userName: string } | undefined> {
+  try {
+    const response = await fetch("https://api.commandcode.ai/alpha/whoami", {
+      headers: { Authorization: `Bearer ${apiKey}`, Accept: "application/json" },
+      signal: AbortSignal.timeout(10_000),
+    });
+    if (!response.ok) return undefined;
+    const body = (await response.json()) as { user?: { id?: unknown; userName?: unknown } };
+    const userId = body.user?.id;
+    const userName = body.user?.userName;
+    if (typeof userId !== "string" || typeof userName !== "string") return undefined;
+    if (!userId.trim() || !userName.trim()) return undefined;
+    return { userId, userName };
+  } catch {
+    return undefined;
+  }
+}
+
+/** Manual-paste fallback: a raw API key, or a pasted callback JSON/URL that carries `apiKey`. */
+function parsePastedCommandCodeInput(input: string, expectedState: string): CommandCodeCallback | undefined {
+  const trimmed = input.trim();
+  if (!trimmed) return undefined;
+  if (trimmed.startsWith("{")) {
+    try {
+      return parseCommandCodeCallback(JSON.parse(trimmed) as unknown, expectedState);
+    } catch {
+      return undefined;
+    }
+  }
+  const parsed = parseCallbackInput(trimmed);
+  const apiKey = parsed.code?.trim();
+  if (!apiKey) return undefined;
+  // A URL/query-shaped paste is an authorization response and must carry a matching state,
+  // mirroring the shared OAuth callback flow; a stale or attacker-supplied URL from another
+  // session must not be accepted. Raw in-session keys are exempt (no state to compare).
+  if (parsed.kind !== "raw" && parsed.state !== expectedState) return undefined;
+  return { apiKey, state: expectedState, userId: "", userName: "", keyName: "manual" };
+}
+
+export async function loginCommandCode(ctrl: OAuthController, options: CommandCodeLoginOptions = {}): Promise<OAuthCredentials> {
+  if (ctrl.signal?.aborted) {
+    throw ctrl.signal.reason ?? new DOMException("Command Code login aborted", "AbortError");
+  }
+  if (shouldImportLocalCommandCodeAuth(options)) {
+    const local = await importLocalCommandCodeAuth(ctrl.signal);
+    if (local) {
+      ctrl.onProgress?.("Imported existing Command Code CLI authentication.");
+      return local;
+    }
+  }
+  const state = randomState();
+  let servers: Array<ReturnType<typeof Bun.serve>> = [];
+  let timeoutId: ReturnType<typeof setTimeout> | undefined;
+  try {
+    const created = createCallbackServer(state);
+    servers = created.servers;
+    const callbackUrl = `http://127.0.0.1:${servers[0].port}${CALLBACK_PATH}`;
+    const authUrl = `${COMMAND_CODE_STUDIO_URL}/studio/auth/cli?callback=${encodeURIComponent(callbackUrl)}&state=${encodeURIComponent(state)}`;
+    ctrl.onAuth?.({ url: authUrl, instructions: "Sign in with Command Code in the browser." });
+    ctrl.onProgress?.("Waiting for Command Code authentication...");
+    const timeout = new Promise<never>((_, reject) => {
+      timeoutId = setTimeout(() => reject(new Error("Command Code OAuth callback timed out")), LOGIN_TIMEOUT_MS);
+      ctrl.signal?.addEventListener("abort", () => { if (timeoutId) clearTimeout(timeoutId); reject(ctrl.signal?.reason); }, { once: true });
+    });
+    const manual = ctrl.onManualCodeInput
+      ? (async (): Promise<CommandCodeCallback> => {
+          while (true) {
+            // The loop keeps waiting until a valid paste arrives; invalid pastes re-prompt.
+            // Yield between iterations so an abort signal can interrupt a fast re-prompt loop.
+            if (ctrl.signal?.aborted) throw ctrl.signal.reason ?? new DOMException("Command Code login aborted", "AbortError");
+            const input = await ctrl.onManualCodeInput?.(state);
+            if (input === undefined) continue;
+            const pasted = parsePastedCommandCodeInput(input, state);
+            if (!pasted) continue;
+            const identity = await validatePastedApiKey(pasted.apiKey);
+            if (identity) return { ...pasted, ...identity };
+            await new Promise(resolve => setTimeout(resolve, 0));
+          }
+        })()
+      : undefined;
+    const result = await Promise.race([created.callback, timeout, ...(manual ? [manual] : [])]);
+    if (result === undefined) throw new Error("Command Code OAuth callback cancelled");
+    return {
+      access: result.apiKey,
+      refresh: result.apiKey,
+      expires: Number.MAX_SAFE_INTEGER,
+      accountId: result.userId,
+      source: "oauth",
+    };
+  } finally {
+    if (timeoutId) clearTimeout(timeoutId);
+    for (const server of servers) server.stop(true);
+  }
+}
+
+export async function refreshCommandCodeToken(apiKey: string): Promise<OAuthCredentials> {
+  if (!apiKey) throw new Error("Command Code API key missing; run ocx login command-code");
+  return { access: apiKey, refresh: apiKey, expires: Number.MAX_SAFE_INTEGER, source: "oauth" };
+}

package/src/oauth/health.ts

@@ -4,6 +4,13 @@ import { isAccountNeedsReauth } from "../codex/account-runtime-state";
 import { getCodexAccountCredential, listCodexAccountIds } from "../codex/account-store";
 import { MAIN_CODEX_ACCOUNT_ID } from "../codex/main-account";
 import { configuredAdminToken } from "../lib/admin-secrets";
+import { readRuntimePort } from "../config";
+import {
+  LOCAL_ATTESTATION_CHALLENGE_HEADER,
+  LOCAL_ATTESTATION_PROOF_HEADER,
+  createLocalAttestationChallenge,
+  verifyLocalAttestationProof,
+} from "../lib/local-management-attestation";
 import { maskAccountId } from "../lib/privacy";
 import { findLiveProxy, probeHostname } from "../server/proxy-liveness";
 import { loadAuthStore, peekAuthStore, peekOAuthRefreshIntent, readOAuthRefreshIntent } from "./store";
@@ -328,6 +335,7 @@ type LiveProxyCodexHealthResult = {
 async function fetchCodexHealthFromLiveProxy(
   fetchImpl: typeof fetch = fetch,
   findLiveProxyImpl: typeof findLiveProxy = findLiveProxy,
+  readRuntimePortImpl: typeof readRuntimePort = readRuntimePort,
 ): Promise<LiveProxyCodexHealthResult> {
   const live = await findLiveProxyImpl();
   if (!live) return { source: "unavailable", entries: null };
@@ -335,8 +343,39 @@ async function fetchCodexHealthFromLiveProxy(
   // interchangeable with the admin credential even on loopback.
   const token = configuredAdminToken();
   const headers: Record<string, string> = {};
-  if (token) headers.Authorization = `Bearer ${token}`;
   try {
+    if (token) {
+      // Public /healthz identity is intentionally forgeable enough for liveness, not
+      // strong enough to receive a bearer. Prove the listener knows the per-process
+      // secret stored in the protected runtime record before attaching the admin token.
+      if (live.source !== "runtime" || live.pid === null) {
+        return { source: "management-api-unavailable", entries: null };
+      }
+      const attestedPid = live.pid;
+      const runtime = readRuntimePortImpl(attestedPid);
+      if (!runtime?.attestationSecret || runtime.port !== live.port) {
+        return { source: "management-api-unavailable", entries: null };
+      }
+      const challenge = createLocalAttestationChallenge();
+      const proofResponse = await fetchImpl(
+        `http://${probeHostname(live.hostname)}:${live.port}/healthz`,
+        {
+          headers: { [LOCAL_ATTESTATION_CHALLENGE_HEADER]: challenge },
+          signal: AbortSignal.timeout(4000),
+        },
+      );
+      const proof = proofResponse.headers.get(LOCAL_ATTESTATION_PROOF_HEADER);
+      if (!proofResponse.ok || !verifyLocalAttestationProof(
+        runtime.attestationSecret,
+        challenge,
+        attestedPid,
+        live.port,
+        proof,
+      )) {
+        return { source: "management-api-unavailable", entries: null };
+      }
+      headers.Authorization = `Bearer ${token}`;
+    }
     const res = await fetchImpl(
       `http://${probeHostname(live.hostname)}:${live.port}/api/codex-auth/accounts`,
       { headers, signal: AbortSignal.timeout(4000) },
@@ -387,10 +426,15 @@ export async function collectOAuthHealthEntriesForCli(
   deps: {
     fetchImpl?: typeof fetch;
     findLiveProxyImpl?: typeof findLiveProxy;
+    readRuntimePortImpl?: typeof readRuntimePort;
   } = {},
 ): Promise<OAuthCliHealthReport> {
   const entries = collectOAuthHealthEntries(now, { observeOnly: true, includeLocalCodex: false });
-  const remote = await fetchCodexHealthFromLiveProxy(deps.fetchImpl, deps.findLiveProxyImpl);
+  const remote = await fetchCodexHealthFromLiveProxy(
+    deps.fetchImpl,
+    deps.findLiveProxyImpl,
+    deps.readRuntimePortImpl,
+  );
   if (remote.entries) {
     for (const entry of remote.entries) entries.push(entry);
     return { entries, codexHealthSource: "management-api" };

package/src/oauth/index.ts

@@ -12,6 +12,7 @@ import { loginChatGPT, refreshChatGPTToken } from "./chatgpt";
 import { loginAntigravity, refreshAntigravityToken } from "./google-antigravity";
 import { loginCursor, refreshCursorToken } from "./cursor";
 import { loginGithubCopilot, refreshGithubCopilotToken, validateCopilotApiBaseUrl } from "./github-copilot";
+import { loginCommandCode, refreshCommandCodeToken } from "./command-code";
 import { deriveOAuthDefaultModel, deriveOAuthProviderConfig } from "../providers/derive";
 import { apiKeyPoolEntryId, sanitizeApiKeyValue } from "../providers/api-keys";
 import { effectiveGoogleMode, getProviderRegistryEntry, providerMatchesRegistryTransport } from "../providers/registry";
@@ -160,6 +161,14 @@ function oauthDefaultModel(id: string): string {
 }
 
 export const OAUTH_PROVIDERS: Record<string, OAuthProviderDef> = {
+  "command-code": {
+    // Add-account/reauth must not reimport the current local CLI credential.
+    login: (ctrl, opts) => loginCommandCode(ctrl, { importLocal: opts?.forceLogin ? "off" : "fallback" }),
+    refresh: refreshCommandCodeToken,
+    providerConfig: oauthConfig("command-code"),
+    defaultModel: oauthDefaultModel("command-code"),
+    defaultRefreshPolicy: "disabled",
+  },
   xai: {
     // forceLogin skips the local grok-cli import so a SECOND account can be chosen in the browser.
     login: (ctrl, opts) => loginXai(ctrl, { importLocal: opts?.forceLogin ? "off" : "fallback" }),
@@ -722,12 +731,25 @@ const OAUTH_RECONCILE_FIELDS: (keyof OcxProviderConfig)[] = [
 const GOOGLE_ANTIGRAVITY_PROVIDER = "google-antigravity";
 const GOOGLE_ANTIGRAVITY_STATIC_CATALOG_VERSION = 1 as const;
 
+/** Only migrate the three-model experimental seed; an operator's later `liveModels: false` wins. */
+function isLegacyCommandCodeStaticCatalog(provider: OcxProviderConfig): boolean {
+  return provider.liveModels === false
+    && provider.defaultModel === "deepseek-v4-flash"
+    && JSON.stringify(provider.models) === JSON.stringify(["deepseek-v4-flash", "kimi-k3", "glm-5.2"]);
+}
+
 export function reconcileOAuthProviders(config: OcxConfig): boolean {
   let changed = false;
   const migrateAntigravityStaticCatalog =
     config.googleAntigravityStaticCatalogVersion !== GOOGLE_ANTIGRAVITY_STATIC_CATALOG_VERSION;
   for (const [name, prov] of Object.entries(config.providers)) {
     const def = OAUTH_PROVIDERS[name];
+    if (name === "command-code" && isLegacyCommandCodeStaticCatalog(prov)) {
+      // The former experimental preset was the exact three-model seed above. It was not a user
+      // choice to disable discovery, so promote only that shape to the account live catalog.
+      prov.liveModels = true;
+      changed = true;
+    }
     // Normalize the canonical row before the OAuth-only reconciliation guard. The old GUI and a
     // manual edit both persist the same bare `true`, with no source metadata, so every ambiguous
     // pre-marker value is reset once. A deliberate live-discovery choice can be re-enabled after
@@ -761,7 +783,10 @@ export function reconcileOAuthProviders(config: OcxConfig): boolean {
       changed = true;
     }
     // Heal a defaultModel that no longer exists in the refreshed list (e.g. a deprecated snapshot).
-    if (prov.defaultModel && preset.defaultModel && !(prov.models ?? []).includes(prov.defaultModel)) {
+    // Skip providers without a static preset `models` list: for live-discovery providers
+    // (e.g. command-code OAuth) the account-scoped catalog is not enumerable here, so any
+    // persisted defaultModel is a user selection and must not be overwritten by the seed.
+    if (prov.defaultModel && preset.defaultModel && preset.models && preset.models.length > 0 && !(prov.models ?? []).includes(prov.defaultModel)) {
       prov.defaultModel = preset.defaultModel;
       changed = true;
     }
@@ -836,9 +861,15 @@ export function upsertOAuthProvider(config: OcxConfig, provider: string): void {
   // reset once; users who deliberately forced discovery can re-enable it after migration.
   const preserveExistingLiveModels = provider !== GOOGLE_ANTIGRAVITY_PROVIDER
     || config.googleAntigravityStaticCatalogVersion === GOOGLE_ANTIGRAVITY_STATIC_CATALOG_VERSION;
-  if (preserveExistingLiveModels && typeof existing?.liveModels === "boolean") {
+  if (preserveExistingLiveModels && typeof existing?.liveModels === "boolean" && !isLegacyCommandCodeStaticCatalog(existing)) {
     next.liveModels = existing.liveModels;
   }
+  // The Command Code protocol-version pin is an operator compatibility control. A re-login,
+  // add-account, or reauth rebuilds the row from the preset, which has no version; carry the
+  // existing pin so authentication changes do not silently revert the documented control.
+  if (existing?.commandCodeVersion !== undefined) {
+    next.commandCodeVersion = existing.commandCodeVersion;
+  }
   if (existing && getProviderRegistryEntry(provider)?.allowKeyAuthOverride === true) {
     // Shared sanitizeApiKeyValue trim / no-CRLF checks from api-key pool writes.
     let storedApiKey = sanitizeApiKeyValue(existing.apiKey);
@@ -1095,7 +1126,11 @@ export function submitManualLoginCode(provider: string, input: string): { ok: tr
   // protected. Early posts (flow not yet waiting, no expectedState) are stashed and
   // re-validated by the callback loop.
   const parsed = parseCallbackInput(trimmed);
-  if (!parsed.code) return { ok: false, error: "no authorization code found in input" };
+  // Command Code's manual fallback accepts a pasted JSON callback payload
+  // (`{ apiKey, state, ... }`) which has no `code` param. Let it through the
+  // shared gate so the provider-specific parser can validate it.
+  const isCommandCodeJson = provider === "command-code" && trimmed.startsWith("{") && !parsed.code;
+  if (!parsed.code && !isCommandCodeJson) return { ok: false, error: "no authorization code found in input" };
   if (parsed.kind !== "raw" && slot.expectedState !== undefined) {
     if (parsed.state === undefined) return { ok: false, error: "redirect URL is missing the state parameter" };
     if (parsed.state !== slot.expectedState) return { ok: false, error: "state mismatch — paste the redirect URL from THIS login attempt" };

package/src/providers/command-code-efforts.ts

@@ -0,0 +1,85 @@
+import { readBoundedResponseBody } from "../lib/bounded-body";
+
+const COMMAND_CODE_MODEL_EFFORTS = {
+  "deepseek/deepseek-v4-pro": {
+    efforts: ["high", "max"],
+    profileUrl: "https://commandcode.ai/models/deepseek-v4-pro",
+  },
+  "deepseek/deepseek-v4-flash": {
+    efforts: ["high", "max"],
+    profileUrl: "https://commandcode.ai/models/deepseek-v4-flash",
+  },
+  "zai-org/glm-5.2": {
+    efforts: ["high", "max"],
+    profileUrl: "https://commandcode.ai/models/glm-5-2",
+  },
+} as const;
+
+/**
+ * Official Command Code model-profile facts, not a model catalog. Models remain
+ * account-scoped and come exclusively from the authenticated /provider/v1/models endpoint.
+ */
+export const COMMAND_CODE_MODEL_REASONING_EFFORTS: Record<string, string[]> = Object.fromEntries(
+  Object.entries(COMMAND_CODE_MODEL_EFFORTS).map(([id, row]) => [id, [...row.efforts]]),
+);
+
+const refreshedEfforts = new Map<string, string[]>();
+
+function keyFor(modelId: string): string {
+  return modelId.trim().toLowerCase();
+}
+
+export function commandCodeReasoningEfforts(modelId: string): readonly string[] | undefined {
+  const key = keyFor(modelId);
+  return refreshedEfforts.get(key) ?? COMMAND_CODE_MODEL_REASONING_EFFORTS[key];
+}
+
+function parsedProfileEfforts(page: string): string[] | undefined {
+  const match = page.match(/Reasoning efforts\s+([^.;]+?)\s+are supported;\s*([^.]*)/i);
+  if (!match) return undefined;
+  const listed = match[1]!.toLowerCase().match(/\b(?:low|medium|high|xhigh|max)\b/g) ?? [];
+  const mapped = match[2]!.toLowerCase().match(/\b(?:low|medium|high|xhigh|max)\s+maps to\s+(?:low|medium|high|xhigh|max)\b/g) ?? [];
+  const normalized = new Set(listed);
+  for (const mapping of mapped) {
+    const [, source, target] = mapping.match(/(low|medium|high|xhigh|max)\s+maps to\s+(low|medium|high|xhigh|max)/) ?? [];
+    if (source && target) {
+      normalized.delete(source);
+      normalized.add(target);
+    }
+  }
+  return normalized.size > 0 ? [...normalized] : [];
+}
+
+/**
+ * Refresh one stale effort record only after the upstream rejects an effort request.
+ * A failed or unparseable public profile deliberately leaves the known table unchanged.
+ */
+export async function refreshCommandCodeReasoningEfforts(
+  modelId: string,
+  fetchFn: typeof globalThis.fetch = globalThis.fetch,
+): Promise<readonly string[] | undefined> {
+  const key = keyFor(modelId);
+  const profile = COMMAND_CODE_MODEL_EFFORTS[key as keyof typeof COMMAND_CODE_MODEL_EFFORTS];
+  if (!profile) return undefined;
+  try {
+    const response = await fetchFn(profile.profileUrl, {
+      headers: { Accept: "text/html" },
+      signal: AbortSignal.timeout(10_000),
+    });
+    if (!response.ok) return undefined;
+    // Bound the profile page before parsing: a large or malformed page must not
+    // allocate unbounded memory on the request path.
+    const observed = await readBoundedResponseBody(response, { maxBytes: 256 * 1024 });
+    if (!observed.displaySafe) return undefined;
+    const efforts = parsedProfileEfforts(observed.text);
+    if (efforts === undefined) return undefined;
+    refreshedEfforts.set(key, efforts);
+    return efforts;
+  } catch {
+    return undefined;
+  }
+}
+
+export function resetCommandCodeReasoningEffortsForTest(): void {
+  refreshedEfforts.clear();
+}

package/src/providers/google-vertex-location.ts

@@ -0,0 +1,14 @@
+/**
+ * Vertex regional hosts are formed as `<location>-aiplatform.googleapis.com`.
+ * Restricting the location to one lowercase DNS label keeps user configuration
+ * from changing the request authority while remaining forward-compatible with
+ * new Google regions and multi-regions.
+ */
+const GOOGLE_VERTEX_LOCATION_LABEL = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+
+export function googleVertexLocationConfigError(location: unknown): string | null {
+  if (typeof location !== "string" || !GOOGLE_VERTEX_LOCATION_LABEL.test(location)) {
+    return "Vertex AI location must be a single lowercase Google Cloud location label (for example, us-central1 or global)";
+  }
+  return null;
+}