@bitkyc08/opencodex 2.17.0 → 2.18.2

package/src/lib/windows-text.ts

@@ -0,0 +1,106 @@
+/**
+ * Decode bounded text emitted by Windows system tools.
+ *
+ * [Decision Log]
+ * - Purpose: preserve non-ASCII paths when a Windows tool writes the active
+ *   legacy code page instead of UTF-8.
+ * - Existing constraint: generated service assets may be UTF-16, while
+ *   redirected `schtasks` output follows the Windows locale on affected hosts.
+ * - Alternatives considered: replacement-character heuristics and a new
+ *   iconv dependency. The former can reinterpret valid text; the latter widens
+ *   the install/security surface for two small, already-supported codecs.
+ * - Choice: recognize UTF-16 first, accept only strict UTF-8 next, then use the
+ *   locale-appropriate WHATWG decoder (CP949 through `euc-kr`, or Windows-1252
+ *   only for locales that actually use that family). Unknown/unsupported
+ *   locales fail back to the old replacement-preserving UTF-8 result instead
+ *   of guessing another code page or throwing in diagnostics.
+ * - Impact: decoding stays dependency-free and bounded, but this deliberately
+ *   does not guess arbitrary OEM code pages that the runtime cannot identify.
+ */
+
+function trimWindowsText(value: string): string {
+  return value.replace(/^\uFEFF/, "").trim();
+}
+
+function currentWindowsLocale(): string {
+  try {
+    return Intl.DateTimeFormat().resolvedOptions().locale;
+  } catch {
+    return "en-US";
+  }
+}
+
+function decodeStrict(buffer: Uint8Array, encoding: string): string | null {
+  try {
+    return trimWindowsText(new TextDecoder(encoding, { fatal: true }).decode(buffer));
+  } catch {
+    return null;
+  }
+}
+
+function decodeUtf16Be(buffer: Uint8Array): string {
+  const payloadLength = buffer.length - 2;
+  const swapped = Buffer.alloc(payloadLength - (payloadLength % 2));
+  for (let i = 2; i + 1 < buffer.length; i += 2) {
+    swapped[i - 2] = buffer[i + 1]!;
+    swapped[i - 1] = buffer[i]!;
+  }
+  return trimWindowsText(swapped.toString("utf16le"));
+}
+
+/**
+ * CP949 is exposed by the Encoding Standard under the `euc-kr` label. Keep the
+ * Western fallback deliberately narrow: treating CP932, CP1250, or CP1251
+ * bytes as Windows-1252 can fabricate a different valid-looking filesystem
+ * path, which is worse than the previous replacement-character refusal.
+ */
+function legacyEncodingForLocale(locale: string): "euc-kr" | "windows-1252" | null {
+  const language = locale.trim().split(/[-_]/, 1)[0]?.toLowerCase();
+  if (language === "ko") return "euc-kr";
+  if (language && WINDOWS_1252_LANGUAGES.has(language)) return "windows-1252";
+  return null;
+}
+
+const WINDOWS_1252_LANGUAGES = new Set([
+  "af", "br", "ca", "co", "cy", "da", "de", "en", "es", "eu", "fi", "fo", "fr",
+  "ga", "gd", "gl", "id", "is", "it", "lb", "ms", "nl", "no", "oc", "pt", "sq",
+  "sv", "sw",
+]);
+
+export interface WindowsTextDecodeOptions {
+  /** Test seam and explicit locale override; production uses the active Intl locale. */
+  readonly locale?: string;
+}
+
+export function decodeWindowsTextBytes(
+  buffer: Uint8Array,
+  options: WindowsTextDecodeOptions = {},
+): string {
+  if (buffer.length === 0) return "";
+
+  const bomUtf16Le = buffer.length >= 2 && buffer[0] === 0xff && buffer[1] === 0xfe;
+  const bomUtf16Be = buffer.length >= 2 && buffer[0] === 0xfe && buffer[1] === 0xff;
+  const looksUtf16Le = buffer.length >= 4
+    && buffer[1] === 0x00
+    && buffer[3] === 0x00
+    && buffer[0] !== 0x00;
+
+  if (bomUtf16Le || looksUtf16Le) {
+    return trimWindowsText(Buffer.from(buffer).toString("utf16le"));
+  }
+  if (bomUtf16Be) return decodeUtf16Be(buffer);
+
+  const utf8 = decodeStrict(buffer, "utf-8");
+  if (utf8 !== null) return utf8;
+
+  const locale = options.locale ?? currentWindowsLocale();
+  const legacyEncoding = legacyEncodingForLocale(locale);
+  if (legacyEncoding !== null) {
+    const legacy = decodeStrict(buffer, legacyEncoding);
+    if (legacy !== null) return legacy;
+  }
+
+  // Preserve the previous fail-soft behavior when the runtime lacks a codec or
+  // the bytes are malformed even for the selected Windows code page.
+  return trimWindowsText(new TextDecoder("utf-8").decode(buffer));
+}

package/src/lib/windows-user-principal.ts

@@ -105,8 +105,6 @@ const POWERSHELL_ARGS = [
   "-NoLogo",
   "-NoProfile",
   "-NonInteractive",
-  "-WindowStyle",
-  "Hidden",
   "-Command",
   SID_EXPRESSION,
 ] as const;

package/src/oauth/index.ts

@@ -1124,7 +1124,7 @@ export async function runLogin(
       await (deps.saveAccountCredential ?? saveAccountCredential)(provider, opts.reauthAccountId, cred);
     } else {
       await (deps.saveCredential ?? saveCredential)(provider, cred, {
-        preserveIdentityless: provider === "kiro" && opts?.forceLogin === true,
+        preserveIdentityless: opts?.forceLogin === true,
       });
     }
     if (provider !== "chatgpt") {

package/src/oauth/store.ts

@@ -10,10 +10,11 @@
  * Exceptions:
  * - `chatgpt` stays single-slot (always replaced): codex-auth-api uses it as a scratch slot
  *   for Codex pool logins, which have their own ledger (codex-accounts.json).
- * - Credentials without identity (no accountId/email) replace the active slot
- *   instead of appending: their refresh tokens rotate, so a derived id would duplicate the
- *   same human on every re-login. Kimi extracts JWT `user_id`/`sub` as accountId; Cursor
- *   extracts JWT `sub` — both append distinct accounts under multiauth.
+ * - Credentials without identity (no accountId/email) replace the active slot on a normal
+ *   login: their refresh tokens rotate, so a derived id would duplicate the same human on every
+ *   re-login. An explicit add-account login instead preserves the prior slot and appends a
+ *   distinct one. Kimi extracts JWT `user_id`/`sub` as accountId; Cursor extracts JWT `sub` —
+ *   both append distinct identified accounts under multiauth.
  */
 import { createHash, randomUUID } from "node:crypto";
 import { chmodSync, closeSync, copyFileSync, existsSync, fstatSync, mkdirSync, openSync, readFileSync, statSync, unlinkSync, writeFileSync } from "node:fs";
@@ -300,6 +301,17 @@ function newAccountId(cred: OAuthCredentials): string {
   return createHash("sha256").update(identity).digest("hex").slice(0, 32);
 }
 
+/** Allocate a persisted slot id without reusing any existing account's ownership key. */
+function distinctAccountId(cred: OAuthCredentials, accounts: readonly ProviderAccount[]): string {
+  const base = newAccountId(cred);
+  const occupied = new Set(accounts.map(account => account.id));
+  if (!occupied.has(base)) return base;
+  for (let suffix = 1; ; suffix += 1) {
+    const candidate = `${base}-${suffix}`;
+    if (!occupied.has(candidate)) return candidate;
+  }
+}
+
 function normalizeAccount(value: unknown): ProviderAccount | null {
   if (!value || typeof value !== "object") return null;
   const candidate = value as Partial<ProviderAccount>;
@@ -473,7 +485,8 @@ export function getCredential(provider: string): OAuthCredentials | null {
  * Persist a credential as the ACTIVE account. Identity-matching (accountId ?? email) upserts
  * the same human's slot; a new identity appends a new account. Credentials without identity
  * (rotating refresh tokens would fabricate duplicates) and single-slot providers replace the
- * active slot / whole set instead.
+ * active slot / whole set instead. An explicit add-account login can preserve the legacy slot;
+ * an identity-less credential then gets its deterministic refresh-derived account id.
  */
 export async function saveCredential(
   provider: string,
@@ -508,18 +521,24 @@ export async function saveCredential(
         delete active.needsReauth;
         return;
       }
-      const id = newAccountId(safe);
+      const id = distinctAccountId(safe, set.accounts);
+      set.accounts.push({ id, credential: safe, addedAt: Date.now() });
+      set.activeAccountId = id;
+      return;
+    }
+    if (opts.preserveIdentityless) {
+      const id = distinctAccountId(safe, set.accounts);
       set.accounts.push({ id, credential: safe, addedAt: Date.now() });
       set.activeAccountId = id;
       return;
     }
-    // No identity: replace the active slot in place (single-account semantics).
+    // No identity during a normal login: replace the active slot in place.
     const active = set.accounts.find(a => a.id === set.activeAccountId);
     if (active) {
       active.credential = safe;
       delete active.needsReauth;
     } else {
-      const id = newAccountId(safe);
+      const id = distinctAccountId(safe, set.accounts);
       set.accounts.push({ id, credential: safe, addedAt: Date.now() });
       set.activeAccountId = id;
     }
@@ -541,15 +560,7 @@ export async function upsertCredentialByIdentity(
   }
   return await mutateStore(store => {
     const set = store[provider];
-    const matches = (account: ProviderAccount): boolean => {
-      if (safe.accountId) {
-        if (account.credential.accountId) return account.credential.accountId === safe.accountId;
-        return Boolean(
-          safe.email
-          && account.credential.email
-          && account.credential.email.toLowerCase() === safe.email.toLowerCase(),
-        );
-      }
+    const matchesEmailOnly = (account: ProviderAccount): boolean => {
       if (account.credential.accountId) return false;
       return Boolean(
         safe.email
@@ -557,7 +568,10 @@ export async function upsertCredentialByIdentity(
         && account.credential.email.toLowerCase() === safe.email.toLowerCase(),
       );
     };
-    const existing = set?.accounts.find(matches);
+    const existing = safe.accountId
+      ? set?.accounts.find(account => account.credential.accountId === safe.accountId)
+        ?? set?.accounts.find(matchesEmailOnly)
+      : set?.accounts.find(matchesEmailOnly);
     if (existing && set) {
       existing.credential = safe;
       delete existing.needsReauth;

package/src/providers/antigravity-models.ts

@@ -14,6 +14,13 @@ import { isValidModelDiscoveryModelId, MODEL_DISCOVERY_MAX_MODELS } from "./mode
 /** Current Antigravity Flash generation. */
 const GEMINI_FLASH_CURRENT = "gemini-3.7-flash";
 
+/**
+ * Wire ID that CCA actually accepts for the current Flash generation.
+ * Google renamed the model to include a `-tiered` suffix; the picker-visible
+ * ID stays `gemini-3.7-flash` (stripped by `pickerModelIdForDiscoveredWireId`).
+ */
+const GEMINI_FLASH_WIRE_ID = "gemini-3.7-flash-tiered";
+
 /**
  * Retired Flash ids → the reasoning tier they used to encode.
  *
@@ -42,7 +49,7 @@ const RETIRED_FLASH_TIERS: Record<string, string> = {
 };
 
 const ANTIGRAVITY_WIRE_MODELS = [
-  "gemini-3.7-flash",
+  "gemini-3.7-flash-tiered",
   "gemini-3.1-pro-low",
   "gemini-pro-agent",
   "gemini-3.1-flash-image",
@@ -133,6 +140,19 @@ const ANTIGRAVITY_THINKING_LEVEL_MODELS: Record<string, string> = {
 // Flash generation, where it is an error rather than a quieter tier.
 const ANTIGRAVITY_THINKING_LEVELS = new Set(["low", "medium", "high"]);
 
+/**
+ * Picker-visible model IDs whose CCA wire ID differs (the `-tiered` rename).
+ * Models not listed here use themselves as the wire ID.
+ */
+const ANTIGRAVITY_PICKER_TO_WIRE: Record<string, string> = {
+  "gemini-3.7-flash": GEMINI_FLASH_WIRE_ID,
+};
+
+/** Map a picker-visible base model to its CCA wire ID. Identity when no mapping exists. */
+function pickerToWireId(pickerId: string): string {
+  return ANTIGRAVITY_PICKER_TO_WIRE[pickerId] ?? pickerId;
+}
+
 function resolveAntigravityThinkingLevel(effort: string): string | undefined {
   if (effort === "xhigh" || effort === "max" || effort === "ultra") return "high";
   return ANTIGRAVITY_THINKING_LEVELS.has(effort) ? effort : undefined;
@@ -157,7 +177,7 @@ const ANTIGRAVITY_COMPATIBILITY_MODEL_ALIASES: Record<string, string> = {
   // because `parseAntigravityAvailableModels` uses THIS map to keep a stale CCA
   // payload from republishing a dead wire id as a picker row.
   ...Object.fromEntries(
-    Object.keys(RETIRED_FLASH_TIERS).map(retired => [retired, GEMINI_FLASH_CURRENT]),
+    Object.keys(RETIRED_FLASH_TIERS).map(retired => [retired, GEMINI_FLASH_WIRE_ID]),
   ),
 };
 
@@ -182,7 +202,7 @@ function isKnownAntigravityPickerModelId(value: string): boolean {
 
 // Context windows from the upstream `:fetchAvailableModels` maxTokens per model.
 const ANTIGRAVITY_WIRE_MODEL_CONTEXT_WINDOWS: Record<string, number> = {
-  "gemini-3.7-flash": 1_048_576,
+  "gemini-3.7-flash-tiered": 1_048_576,
   "gemini-3.1-pro-low": 1_048_576,
   "gemini-pro-agent": 1_048_576,
   "gemini-3.1-flash-image": 1_048_576,
@@ -357,7 +377,7 @@ export function resolveAntigravityEffortWireModel(
   const retiredTier = retiredAntigravityFlashTier(modelId);
   if (retiredTier) {
     return {
-      wireModelId: GEMINI_FLASH_CURRENT,
+      wireModelId: GEMINI_FLASH_WIRE_ID,
       thinkingLevel: effort ? resolveAntigravityThinkingLevel(effort) ?? retiredTier : retiredTier,
     };
   }
@@ -372,7 +392,7 @@ export function resolveAntigravityEffortWireModel(
   const defaultLevel = ANTIGRAVITY_THINKING_LEVEL_MODELS[modelId];
   if (defaultLevel) {
     return {
-      wireModelId: modelId,
+      wireModelId: pickerToWireId(modelId),
       thinkingLevel: effort ? resolveAntigravityThinkingLevel(effort) ?? defaultLevel : defaultLevel,
     };
   }

package/src/providers/free-directory.ts

@@ -82,7 +82,7 @@ const CONNECTABLE: Record<string, ConnectableOverride> = {
   "cloudflare-ai": openAi("https://api.cloudflare.com/client/v4/accounts/{account_id}/ai/v1", "https://dash.cloudflare.com/?to=/:account/ai/workers-ai", { supportLevel: "supported", verification: "official", documentationUrl: "https://developers.cloudflare.com/workers-ai/configuration/open-ai-compatibility/", discovery: "static", liveModels: false, models: ["@cf/meta/llama-3.3-70b-instruct-fp8-fast", "@cf/qwen/qwq-32b"] }),
   cohere: openAi("https://api.cohere.com/compatibility/v1", "https://dashboard.cohere.com/api-keys", { supportLevel: "supported", verification: "official", documentationUrl: "https://docs.cohere.com/reference/list-models", modelsUrl: "https://api.cohere.com/compatibility/v1/models" }),
   friendliai: openAi("https://api.friendli.ai/serverless/v1", "https://suite.friendli.ai", { modelsUrl: "https://api.friendli.ai/serverless/v1/models" }),
-  gemini: { baseUrl: "https://generativelanguage.googleapis.com", dashboardUrl: "https://aistudio.google.com/apikey", adapter: "google", authKind: "key", supportLevel: "supported", verification: "official", documentationUrl: "https://ai.google.dev/api/models", lastVerified: LAST_VERIFIED, discovery: "live", liveModels: true, googleMode: "ai-studio", models: ["gemini-3.6-flash", "gemini-3.5-flash", "gemini-3.5-flash-lite", "gemini-3.1-pro-preview"] },
+  gemini: { baseUrl: "https://generativelanguage.googleapis.com", dashboardUrl: "https://aistudio.google.com/apikey", adapter: "google", authKind: "key", supportLevel: "supported", verification: "official", documentationUrl: "https://ai.google.dev/api/models", lastVerified: LAST_VERIFIED, discovery: "live", liveModels: true, googleMode: "ai-studio", models: ["gemini-3.7-flash", "gemini-3.6-flash", "gemini-3.5-flash", "gemini-3.5-flash-lite", "gemini-3.1-pro-preview"] },
   "github-models": openAi("https://models.github.ai/inference", "https://github.com/settings/tokens", { supportLevel: "supported", verification: "official", documentationUrl: "https://docs.github.com/en/github-models/prototyping-with-ai-models", discovery: "static", liveModels: false, models: ["openai/gpt-4.1", "meta/llama-4-scout-17b-16e-instruct"] }),
   groq: openAi("https://api.groq.com/openai/v1", "https://console.groq.com/keys", { supportLevel: "supported", verification: "official", documentationUrl: "https://console.groq.com/docs/api-reference#models" }),
   hackclub: openAi("https://ai.hackclub.com/proxy/v1", "https://ai.hackclub.com", { modelsUrl: "https://ai.hackclub.com/proxy/v1/models" }),

package/src/providers/registry.ts

@@ -1438,12 +1438,13 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
   // devlog/_plan/260710_provider_hardening/001_research_frontier.md.
   {
     id: "google", label: "Google Gemini", adapter: "google", baseUrl: "https://generativelanguage.googleapis.com", authKind: "key", featured: true,
-    dashboardUrl: "https://aistudio.google.com/apikey", defaultModel: "gemini-3.5-flash", models: ["gemini-3.6-flash", "gemini-3.5-flash", "gemini-3.5-flash-lite", "gemini-3.1-pro-preview"],
-    modelContextWindows: { "gemini-3.6-flash": 1_048_576, "gemini-3.5-flash": 1_000_000, "gemini-3.5-flash-lite": 1_048_576 },
-    modelInputModalities: { "gemini-3.6-flash": ["text", "image"], "gemini-3.5-flash-lite": ["text", "image"] },
+    dashboardUrl: "https://aistudio.google.com/apikey", defaultModel: "gemini-3.5-flash", models: ["gemini-3.6-flash", "gemini-3.5-flash", "gemini-3.5-flash-lite", "gemini-3.1-pro-preview", "gemini-3.7-flash"],
+    modelContextWindows: { "gemini-3.6-flash": 1_048_576, "gemini-3.5-flash": 1_000_000, "gemini-3.5-flash-lite": 1_048_576, "gemini-3.7-flash": 1_048_576 },
+    modelInputModalities: { "gemini-3.6-flash": ["text", "image"], "gemini-3.5-flash-lite": ["text", "image"], "gemini-3.7-flash": ["text", "image"] },
     modelReasoningEfforts: {
       "gemini-3.6-flash": ["minimal", "low", "medium", "high"],
       "gemini-3.5-flash": ["minimal", "low", "medium", "high"],
+      "gemini-3.7-flash": ["minimal", "low", "medium", "high"],
       "gemini-3.1-pro-preview": ["low", "medium", "high"],
     },
     jawcodeBundle: "google", extraMetadataAliases: ["gemini"],

package/src/server/index.ts

@@ -53,6 +53,7 @@ import { isCanonicalOpenAiForwardProvider, OPENAI_CODEX_PROVIDER_ID } from "../p
 import { providerContextCap } from "../providers/context-cap";
 import { providerCodexAccountMode } from "../providers/registry";
 import type { StorageCleanupPolicy } from "../types";
+import { MAX_DECOMPRESSED_BODY_BYTES } from "./request-decompress";
 import {
   CodexAccountCooldownError,
   cooldownErrorMessage,
@@ -412,6 +413,8 @@ function attachLiveSidebandUpstream(
 // upstream cannot hold Codex open after response.completed; darwin no-rewrite traffic
 // requires explicit config-eager opt-in (`auto` always stays tee on darwin).
 // selectEagerPath(process.platform, needsClientRewrite, config.streamMode ?? "auto")
+// Codex upstream WS runtime gating and the forced bounded single-reader branch
+// are owned by responses/ws-upstream.ts and responses/core.ts respectively.
 // relaySseEagerBounded(upstreamResponse.body, turnAc,
 // new Response(eagerBody,
 // Default shape (tee + background inspection):
@@ -721,6 +724,7 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
     userCostOverlayReconciler = startUserCostOverlayReconciler({ liveConfig: config });
     const serveOptions = {
       idleTimeout: 255,
+      maxRequestBodySize: MAX_DECOMPRESSED_BODY_BYTES,
       async fetch(req: Request, requestServer: Server<WsData>): Promise<Response> {
       // The unauthenticated loopback listener (#1102) serves a fixed allowlist and nothing
       // else. Rejecting here, before any handler runs, is what keeps the surface from growing
@@ -1181,7 +1185,6 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
       }
 
       if (url.pathname === "/v1/responses" && req.method === "POST") {
-        disableResponsesRequestTimeout(req, requestServer);
         if (isDraining()) {
           return drainingResponse(req, policy);
         }
@@ -1210,6 +1213,7 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
         return runAdmittedHttpTurn(req, policy, async turnAdmissionLease => {
           const response = await handleResponses(req, config, logCtx, {
             turnAdmissionLease,
+            onRequestBodyRead: () => disableResponsesRequestTimeout(req, requestServer),
             abortSignal: req.signal,
             onFirstOutput: () => recordFirstOutput(logCtx, start),
             onNativePassthroughTerminal: status => {

package/src/server/management/logs-usage-routes.ts

@@ -55,7 +55,7 @@ import {
   type PersistedUsageEntry,
 } from "../../usage/log";
 import { getUsageDebugLogEntries } from "../../usage/debug";
-import { parseRange, parseUsageSurface, summarizeUsage, type UsageRange, type UsageSummary, type UsageSurface } from "../../usage/summary";
+import { parseRange, parseUsageSurface, rangeWindow, summarizeUsage, type UsageRange, type UsageSummary, type UsageSurface } from "../../usage/summary";
 import { stripCodexRuntimeProviderFields } from "../../codex/auth-context";
 import { getProviderRegistryEntry } from "../../providers/registry";
 import { getDebugLogEntries } from "../../lib/debug-log-buffer";
@@ -87,14 +87,6 @@ import {
 } from "./usage-summary-cache";
 import { cacheApiKeyUsageFromSnapshot } from "./api-key-usage";
 
-const USAGE_DAY_MS = 86_400_000;
-function usageEntryMatchesSurface(entry: PersistedUsageEntry, surface: UsageSurface): boolean {
-  if (surface === "claude") return entry.surface === "claude" || entry.surface === "claude-desktop";
-  if (surface === "grok") return entry.surface === "grok";
-  if (surface === "codex") return entry.surface === undefined;
-  return true;
-}
-
 function nextLocalMidnight(now: number): number {
   const next = new Date(now);
   next.setHours(24, 0, 0, 0);
@@ -102,24 +94,16 @@ function nextLocalMidnight(now: number): number {
 }
 
 function usageSummaryExpiresAt(
-  entries: PersistedUsageEntry[],
-  range: UsageRange,
-  surface: UsageSurface,
+  _entries: PersistedUsageEntry[],
+  _range: UsageRange,
+  _surface: UsageSurface,
   now: number,
 ): number {
-  let expiresAt = nextLocalMidnight(now);
-  const windowMs = range === "7d" ? 7 * USAGE_DAY_MS : range === "30d" ? 30 * USAGE_DAY_MS : null;
-  if (windowMs === null) return expiresAt;
-  for (const entry of entries) {
-    if (!usageEntryMatchesSurface(entry, surface)) continue;
-    const expiry = entry.timestamp + windowMs;
-    if (expiry > now && expiry < expiresAt) expiresAt = expiry;
-  }
-  return expiresAt;
+  return nextLocalMidnight(now);
 }
 
 function refreshedUsageSummary<T extends UsageSummary & { historyTruncated: boolean }>(summary: T, range: UsageRange, now: number): T {
-  const since = range === "7d" ? now - 7 * USAGE_DAY_MS : range === "30d" ? now - 30 * USAGE_DAY_MS : null;
+  const { since } = rangeWindow(range, now);
   return { ...summary, since, generatedAt: now };
 }
 
@@ -226,6 +210,7 @@ export async function handleLogsUsageRoutes(ctx: ManagementContext): Promise<Res
         && cached.maxReadBytes === effectiveReadLimit
         && cached.overlayVersion === userCostOverlayVersion()
         && now < cached.freshUntil
+        && now < cached.expiresAt
         && observedSize >= cached.lastSeenSize) {
         return jsonResponse(refreshedUsageSummary(cached.summary, range, now));
       }

package/src/server/request-log.ts

@@ -38,6 +38,10 @@ import {
 } from "../usage/debug";
 import { matchesLogConversationId } from "./request-log-conversation";
 import { enforceAppOwnedMemoryBudget, type RetainedStoreSnapshot } from "../lib/app-owned-memory";
+import { capEstimateAtContextWindow } from "../lib/token-estimate";
+import { inferCursorContextWindow } from "../adapters/cursor/discovery";
+import { KIRO_MODEL_CONTEXT_WINDOWS, normalizeKiroModelId } from "../providers/kiro-models";
+import { modelRecordValue } from "../reasoning-effort";
 
 export interface RequestLogContext {
   model: string;
@@ -839,6 +843,7 @@ export function addFinalRequestLog(
     logCtx.providerAdapter ?? logCtx.provider,
     logCtx.usage,
     logCtx.usageLogInputTokens,
+    contextWindowForModel(logCtx.providerAdapter ?? logCtx.provider, logCtx.model),
   );
   const attempts = logCtx.attempts?.map(attempt => ({
     ...attempt,
@@ -960,15 +965,40 @@ interface FinalizedUsageResult {
   totalTokens?: number;
 }
 
+/**
+ * Context window for the routed model, used to cap the token estimate (codex-router PR #140):
+ * a request the provider answered cannot have exceeded the window, so the estimate must never
+ * claim it did. The family is picked by the route ADAPTER, not the model id alone, because
+ * claude-family ids are shared between Kiro and Cursor with different windows. Kiro "auto" is
+ * a router with no fixed window and is never guessed; unknown adapters/models stay uncapped.
+ */
+function contextWindowForModel(adapter: string, modelId: string | undefined): number | undefined {
+  if (!modelId) return undefined;
+  if (adapter === "kiro" || adapter.startsWith("kiro-")) {
+    const normalized = normalizeKiroModelId(modelId);
+    if (normalized === "auto") return undefined;
+    return modelRecordValue(KIRO_MODEL_CONTEXT_WINDOWS, modelId)
+      ?? modelRecordValue(KIRO_MODEL_CONTEXT_WINDOWS, normalized);
+  }
+  if (adapter === "cursor" || adapter.startsWith("cursor-")) {
+    return inferCursorContextWindow(modelId);
+  }
+  return undefined;
+}
+
 function finalizedUsage(
   adapter: string,
   usage: OcxUsage | undefined,
   inputTokenEstimate: number | undefined,
+  contextWindow: number | undefined,
 ): FinalizedUsageResult {
+  // The ESTIMATE itself is capped at the model's context window (codex-router PR #140). The
+  // combined value below keeps its max(inputTokens, estimate) behavior — a provider-reported
+  // positive count is never reduced by this cap, only the estimate that could substitute it.
   const estimate = typeof inputTokenEstimate === "number"
     && Number.isFinite(inputTokenEstimate)
     && inputTokenEstimate >= 0
-    ? inputTokenEstimate
+    ? capEstimateAtContextWindow(inputTokenEstimate, contextWindow)
     : undefined;
   const finalUsage = usageForFinalLog(adapter, usage);
   const usageFallback = !finalUsage && estimate !== undefined
@@ -980,7 +1010,16 @@ function finalizedUsage(
         inputTokens: Math.max(finalUsage.inputTokens, estimate),
         estimated: true,
       }
-    : (finalUsage ?? usageFallback);
+    : finalUsage
+      // When the adapter alone produced an estimated count and no local estimate
+      // exists, cap it at the context window — an adapter estimate above the window
+      // misleads the usage dashboard.  The combined branch (above) already caps the
+      // ESTIMATE via capEstimateAtContextWindow, and Math.max preserves a real
+      // provider-reported count, so it needs no further reduction.
+      ? (finalUsage.estimated && contextWindow !== undefined && finalUsage.inputTokens > contextWindow
+          ? { ...finalUsage, inputTokens: contextWindow }
+          : finalUsage)
+      : usageFallback;
   const totalTokens = usageTotalTokens(loggedUsage);
   return {
     status: usageStatusForFinalLog(loggedUsage),
@@ -1030,7 +1069,12 @@ export function noteAttemptSend(
   if (typeof inputTokenEstimate === "number"
     && Number.isFinite(inputTokenEstimate)
     && inputTokenEstimate >= 0) {
-    attempt.inputTokenEstimate = inputTokenEstimate;
+    // Store the ESTIMATE field already capped at the model's window (codex-router PR #140):
+    // what gets persisted, and later merged into usage, never claims a count above the window.
+    attempt.inputTokenEstimate = capEstimateAtContextWindow(
+      inputTokenEstimate,
+      contextWindowForModel(attempt.adapter, attempt.model),
+    );
   }
   if (recovery && !attempt.recoveryKinds.includes(recovery)) {
     attempt.recoveryKinds.push(recovery);
@@ -1047,6 +1091,7 @@ export function finishRequestAttempt(
     attempt.adapter,
     usage ?? attempt.usage,
     attempt.inputTokenEstimate,
+    contextWindowForModel(attempt.adapter, attempt.model),
   );
   attempt.status = status;
   attempt.durationMs = Math.max(0, durationMs);