@bitkyc08/opencodex 2.18.2 → 2.20.0

package/src/lib/errors.ts

@@ -43,6 +43,25 @@ function isSubscriptionGateMessage(text: string): boolean {
   );
 }
 
+function isLocalAclHardeningMessage(text: string): boolean {
+  const secretPathHardening = text.includes("secret path") && (
+    text.includes("acl") ||
+    text.includes("harden") ||
+    text.includes("permission") ||
+    text.includes("access denied") ||
+    text.includes("inheritance")
+  );
+  return (
+    text.includes("icacls") ||
+    text.includes("acl hardening") ||
+    text.includes("ntfs") ||
+    secretPathHardening ||
+    text.includes("inheritance:r") ||
+    /\bwindows\b.*\bacl\b/.test(text) ||
+    text.includes("/grant:r")
+  );
+}
+
 function isAuthenticationMessage(text: string): boolean {
   const accessDeniedWithCredentialCue = (
     text.includes("access denied") ||
@@ -170,6 +189,11 @@ export function classifyError(status: number, type: string, message: string): Oc
   if (type === "origin_rejected") {
     return { message, type: "invalid_request_error", code: "origin_rejected" };
   }
+  // Local ACL setup failures can contain provider-like auth wording (for example
+  // "access denied" or "authentication") but represent unavailable infrastructure.
+  if (status === 503 && isLocalAclHardeningMessage(text)) {
+    return { message, type: "server_error", code: "upstream_server_error" };
+  }
   // HTTP 401 and explicit auth failures are authoritative even when provider text
   // also advertises an upgrade or subscription.
   if (
@@ -280,6 +304,9 @@ export function inferHttpStatusFromAdapterMessage(message: string): number {
     lower.includes("too many requests") ||
     lower.includes("throttling")
   ) return 429;
+  // Local Windows filesystem hardening is infrastructure, not provider authentication.
+  // Keep this ahead of auth/permission and timeout keyword inference.
+  if (isLocalAclHardeningMessage(lower)) return 503;
   // Strong authentication signals win when a message contains mixed auth and
   // subscription/permission wording.
   if (isAuthenticationMessage(lower)) return 401;

package/src/lib/lab-activation.ts

@@ -29,6 +29,7 @@ import { labAutomationPolicyPath } from "../lab/paths";
 import type { OcxConfig } from "../types";
 import { LabAutomationError } from "../lab/automation/types";
 import { registerLabPassiveRouteLinker } from "./lab-passive-linker-registration";
+import { registerCurrentServerResourceCleanup } from "./server-resource-ownership";
 import { setCompatibilityEvidenceProvider } from "../routing/compatibility/provider-slot";
 import { labCompatibilityEvidenceProvider } from "../routing/compatibility/lab-evidence-provider";
 import {
@@ -37,8 +38,18 @@ import {
 } from "../lab/automation/orchestrator";
 import { createProductionLabRouteExecutor } from "./lab-live-route-production";
 
+interface LabRuntimeBinding {
+  release(): void;
+}
+
+interface LabActivationRecord {
+  staticDetach: Array<() => void>;
+  runtime: LabRuntimeBinding | null;
+  seenRuntimeConfigs: WeakSet<OcxConfig>;
+}
+
 /** Activation records keyed by configDir, so one process can own several configs. */
-const activated = new Map<string, Array<() => void>>();
+const activated = new Map<string, LabActivationRecord>();
 
 const activationKey = (configDir?: string): string => configDir ?? "";
 
@@ -83,60 +94,110 @@ export function labActivationRequired(config: OcxConfig, configDir?: string): bo
   return labAutomationEnabledOnDisk(configDir);
 }
 
+function startAutomationIfEnabled(configDir?: string): void {
+  if (!labAutomationEnabledOnDisk(configDir)) return;
+  try {
+    startLabAutomationScheduler(configDir);
+  } catch (err) {
+    // Neither a malformed automation file nor a busy state lock may take the proxy down
+    // at startup. Lab automation stays off for this run; routing, evidence, and every
+    // other subsystem keep working.
+    //
+    // The two causes get different messages because they need different actions, and a
+    // lock-contention failure reported as "invalid config" sends the operator to fix a
+    // file that is fine. Contention can also stall startup by up to the 5s lock wait.
+    const code = err instanceof LabAutomationError ? err.code : null;
+    if (code === "state_lock_busy" || code === "state_lock_failed") {
+      console.warn(
+        "[lab] Lab automation did not start: another process holds the automation state lock."
+        + " Automation stays off for this run and will be retried on the next start.",
+      );
+    } else {
+      console.warn(
+        "[lab] Lab automation is disabled for this run because its configuration could not be"
+        + " loaded:",
+        err instanceof Error ? err.message : err,
+      );
+    }
+  }
+}
+
+function installLabAutomationRuntime(
+  record: LabActivationRecord,
+  config: OcxConfig,
+  configDir?: string,
+): void {
+  const previous = record.runtime;
+  const routeExecutor = createProductionLabRouteExecutor({ configDir, loadConfig: () => config });
+  const releaseDispatchDeps = setLabAutomationDispatchDeps({
+    configDir,
+    loadConfig: () => config,
+    routeExecutor,
+  });
+
+  let released = false;
+  let detachOwnerCleanup = () => {};
+  const binding: LabRuntimeBinding = {
+    release() {
+      if (released) return;
+      released = true;
+      detachOwnerCleanup();
+      releaseDispatchDeps();
+      if (record.runtime === binding) record.runtime = null;
+    },
+  };
+  // `setLabAutomationDispatchDeps` already registers its own owner cleanup. This second
+  // receipt only keeps the activation record in sync with that owner-scoped lifetime, so a
+  // later same-process server can see that the static Lab slots survived but CL-08 authority
+  // did not. The release is idempotent, so cleanup order does not matter.
+  detachOwnerCleanup = registerCurrentServerResourceCleanup(binding.release);
+
+  // Install the successor before releasing the predecessor. The dispatcher token check then
+  // makes the predecessor release a no-op for the successor scheduler/authority.
+  record.runtime = binding;
+  record.seenRuntimeConfigs.add(config);
+  previous?.release();
+}
+
 /**
- * Register Lab into the core slots. Idempotent per configDir and safe to call again after
- * a routing profile is created at runtime.
+ * Register Lab into the core slots. Static activation is idempotent per configDir. The
+ * server-owned CL-08 runtime binding is refreshed when its prior owner ended or when a new
+ * server instance arrives with a config object that has not owned this activation before.
  */
 export function activateLab(config: OcxConfig, configDir?: string): void {
   const key = activationKey(configDir);
-  // INVARIANT: activation is all-or-nothing and reason-independent. Every slot is
-  // registered here regardless of WHY activation was required, which is what makes this
-  // key safe as configDir alone -- an automation-only activation still installs the
-  // compatibility provider a later profile needs. If any registration ever becomes
-  // conditional on the activation reason, this key must include that reason, or the early
-  // return will silently skip it forever.
-  if (activated.has(key)) return;
-
-  const detach: Array<() => void> = [];
-  detach.push(registerLabPassiveRouteLinker(configDir));
-  detach.push(setCompatibilityEvidenceProvider(labCompatibilityEvidenceProvider));
+  const existing = activated.get(key);
+  if (existing) {
+    // A released predecessor leaves the static Lab slots resident but removes dispatch
+    // authority and its scheduler. A live successor uses a fresh config object. Rebind in
+    // either case, but never let an older already-seen server steal authority back from a
+    // newer successor merely because it receives another management request.
+    if (existing.runtime === null || !existing.seenRuntimeConfigs.has(config)) {
+      installLabAutomationRuntime(existing, config, configDir);
+      startAutomationIfEnabled(configDir);
+    }
+    return;
+  }
 
-  const routeExecutor = createProductionLabRouteExecutor({ configDir, loadConfig: () => config });
-  detach.push(setLabAutomationDispatchDeps({ configDir, loadConfig: () => config, routeExecutor }));
+  // INVARIANT: static activation is all-or-nothing and reason-independent. Every static
+  // slot is registered here regardless of WHY activation was required, so automation-only
+  // activation still installs the compatibility provider a later profile needs.
+  const record: LabActivationRecord = {
+    staticDetach: [],
+    runtime: null,
+    seenRuntimeConfigs: new WeakSet<OcxConfig>(),
+  };
+  record.staticDetach.push(registerLabPassiveRouteLinker(configDir));
+  record.staticDetach.push(setCompatibilityEvidenceProvider(labCompatibilityEvidenceProvider));
+  installLabAutomationRuntime(record, config, configDir);
 
   // Record the activation BEFORE the scheduler start. startLabAutomationScheduler runs the
   // full automation normalizer, which throws on any field violation, and this call sits on
   // the startup path of every install that has a routing profile. Storing the record first
   // means a throw cannot orphan the detach receipts and leave slots registered with no
-  // activation record -- which would let a later activateLab register them a second time.
-  activated.set(key, detach);
-
-  if (labAutomationEnabledOnDisk(configDir)) {
-    try {
-      startLabAutomationScheduler(configDir);
-    } catch (err) {
-      // Neither a malformed automation file nor a busy state lock may take the proxy down
-      // at startup. Lab automation stays off for this run; routing, evidence, and every
-      // other subsystem keep working.
-      //
-      // The two causes get different messages because they need different actions, and a
-      // lock-contention failure reported as "invalid config" sends the operator to fix a
-      // file that is fine. Contention can also stall startup by up to the 5s lock wait.
-      const code = err instanceof LabAutomationError ? err.code : null;
-      if (code === "state_lock_busy" || code === "state_lock_failed") {
-        console.warn(
-          "[lab] Lab automation did not start: another process holds the automation state lock."
-          + " Automation stays off for this run and will be retried on the next start.",
-        );
-      } else {
-        console.warn(
-          "[lab] Lab automation is disabled for this run because its configuration could not be"
-          + " loaded:",
-          err instanceof Error ? err.message : err,
-        );
-      }
-    }
-  }
+  // activation record, which would let a later activateLab register them a second time.
+  activated.set(key, record);
+  startAutomationIfEnabled(configDir);
 }
 
 /** True when this configDir has been activated. */
@@ -152,9 +213,10 @@ export function isLabActivated(configDir?: string): boolean {
  * users who never opted in.
  */
 export function resetLabActivationForTests(): void {
-  for (const [key, detach] of [...activated]) {
+  for (const [key, record] of [...activated]) {
     activated.delete(key);
-    for (const release of [...detach].reverse()) {
+    try { record.runtime?.release(); } catch { /* teardown is best-effort */ }
+    for (const release of [...record.staticDetach].reverse()) {
       try { release(); } catch { /* teardown is best-effort */ }
     }
   }

package/src/lib/lab-live-pinned-sender.ts

@@ -19,22 +19,33 @@ export function createLabAuthorizedPinnedSender(
       headers,
       maxBytes: limits.maxOutputBytes,
       connectTimeoutMs: limits.connectTimeoutMs,
-      idleTimeoutMs: Math.min(limits.firstByteTimeoutMs, limits.inactivityTimeoutMs),
+      firstByteTimeoutMs: limits.firstByteTimeoutMs,
+      inactivityTimeoutMs: limits.inactivityTimeoutMs,
       rejectUnauthorized: true,
       context: "Lab provider response",
     };
     let response: Response;
+    let body: string;
     try {
       response = request.method === "POST"
         ? await pinnedHttpPost(url, pinned, request.body ?? "", signal, options)
         : await pinnedHttpGet(url, pinned, signal, options);
+      body = await response.text();
     } catch (error) {
-      if (error instanceof PinnedHttpError && error.code === "connect_timeout") {
-        throw new TransportError("connect_timeout", "pinned provider connection timed out");
+      if (error instanceof PinnedHttpError) {
+        switch (error.code) {
+          case "connect_timeout":
+            throw new TransportError("connect_timeout", "pinned provider connection timed out");
+          case "first_byte_timeout":
+            throw new TransportError("first_byte_timeout", "pinned provider first byte timed out");
+          case "inactivity_timeout":
+            throw new TransportError("inactivity_timeout", "pinned provider response stalled");
+          case "output_byte_limit":
+            throw new TransportError("output_byte_limit", "pinned provider response exceeded byte budget");
+        }
       }
       throw error;
     }
-    const body = await response.text();
     const responseHeaders: Record<string, string> = {};
     for (const headerName of LAB_RESPONSE_HEADER_ALLOWLIST) {
       const value = response.headers.get(headerName);
@@ -42,4 +53,4 @@ export function createLabAuthorizedPinnedSender(
     }
     return { status: response.status, headers: responseHeaders, body };
   };
-}
+}

package/src/lib/pinned-http.ts

@@ -3,7 +3,11 @@ import https from "node:https";
 
 export type PinnedAddress = { address: string; family: number };
 
-export type PinnedHttpErrorCode = "connect_timeout";
+export type PinnedHttpErrorCode =
+  | "connect_timeout"
+  | "first_byte_timeout"
+  | "inactivity_timeout"
+  | "output_byte_limit";
 
 export class PinnedHttpError extends Error {
   override readonly name = "PinnedHttpError";
@@ -15,6 +19,11 @@ export interface PinnedHttpRequestOptions {
   maxBytes?: number;
   /** Optional deadline for establishing the TCP connection and, for HTTPS, completing TLS. */
   connectTimeoutMs?: number;
+  /** Optional deadline from connection establishment until response headers arrive. */
+  firstByteTimeoutMs?: number;
+  /** Optional maximum idle interval between response-body chunks. */
+  inactivityTimeoutMs?: number;
+  /** @deprecated Use firstByteTimeoutMs and inactivityTimeoutMs. */
   idleTimeoutMs?: number;
   rejectUnauthorized?: boolean;
   context?: string;
@@ -37,7 +46,11 @@ function pinnedHttpRequest(
   }
   const context = options?.context ?? "request";
   const connectTimeoutMs = options?.connectTimeoutMs;
-  const idleTimeoutMs = options?.idleTimeoutMs ?? 60_000;
+  const legacyIdleTimeoutMs = options?.idleTimeoutMs ?? 60_000;
+  const usesLegacyIdleTimeout = options?.firstByteTimeoutMs === undefined
+    && options?.inactivityTimeoutMs === undefined;
+  const firstByteTimeoutMs = options?.firstByteTimeoutMs ?? legacyIdleTimeoutMs;
+  const inactivityTimeoutMs = options?.inactivityTimeoutMs ?? legacyIdleTimeoutMs;
   const maxBytes = options?.maxBytes;
   const headers = new Headers(options?.headers);
   headers.set("host", parsed.host);
@@ -56,17 +69,30 @@ function pinnedHttpRequest(
     let settled = false;
     let req: ClientRequest | undefined;
     let connectTimer: ReturnType<typeof setTimeout> | undefined;
+    let firstByteTimer: ReturnType<typeof setTimeout> | undefined;
     const clearConnectTimer = () => {
       if (connectTimer !== undefined) clearTimeout(connectTimer);
       connectTimer = undefined;
     };
+    const clearFirstByteTimer = () => {
+      if (firstByteTimer !== undefined) clearTimeout(firstByteTimer);
+      firstByteTimer = undefined;
+    };
     const fail = (error: unknown) => {
       clearConnectTimer();
+      clearFirstByteTimer();
       try { req?.destroy(); } catch { /* ignore */ }
       if (settled) return;
       settled = true;
       reject(error instanceof Error ? error : new Error(String(error)));
     };
+    const startFirstByteTimer = () => {
+      clearFirstByteTimer();
+      firstByteTimer = setTimeout(
+        () => fail(new PinnedHttpError("first_byte_timeout", `${context} first byte timed out`)),
+        firstByteTimeoutMs,
+      );
+    };
     const requestOptions: RequestOptions & { servername?: string } = {
       protocol: parsed.protocol,
       hostname: parsed.hostname,
@@ -101,6 +127,7 @@ function pinnedHttpRequest(
 
     const onResponse = (response: IncomingMessage) => {
       clearConnectTimer();
+      clearFirstByteTimer();
       const status = response.statusCode ?? 0;
       const responseHeaders = new Headers();
       for (const [key, value] of Object.entries(response.headers)) {
@@ -124,28 +151,35 @@ function pinnedHttpRequest(
       let received = 0;
       const stream = new ReadableStream<Uint8Array>({
         start(controller) {
-          response.setTimeout(idleTimeoutMs, () => {
-            const error = new Error(`${context} stalled`);
-            fail(error);
+          let bodySettled = false;
+          const failBody = (error: Error) => {
+            if (bodySettled) return;
+            bodySettled = true;
             try { controller.error(error); } catch { /* closed */ }
+            try { response.destroy(); } catch { /* ignore */ }
+            try { req?.destroy(); } catch { /* ignore */ }
+          };
+
+          response.setTimeout(inactivityTimeoutMs, () => {
+            failBody(new PinnedHttpError("inactivity_timeout", `${context} stalled`));
           });
           response.on("data", (chunk: Buffer | string) => {
+            if (bodySettled) return;
             const buffer = typeof chunk === "string" ? Buffer.from(chunk) : chunk;
             received += buffer.byteLength;
             if (maxBytes !== undefined && received > maxBytes) {
-              const error = new Error(`${context} exceeds ${maxBytes} byte cap`);
-              fail(error);
-              try { controller.error(error); } catch { /* closed */ }
+              failBody(new PinnedHttpError("output_byte_limit", `${context} exceeds ${maxBytes} byte cap`));
               return;
             }
             try { controller.enqueue(buffer); } catch { /* closed */ }
           });
           response.on("end", () => {
+            if (bodySettled) return;
+            bodySettled = true;
             try { controller.close(); } catch { /* closed */ }
           });
           response.on("error", (error: Error) => {
-            fail(error);
-            try { controller.error(error); } catch { /* closed */ }
+            failBody(error);
           });
         },
         cancel() {
@@ -163,20 +197,40 @@ function pinnedHttpRequest(
     const onAbort = () => fail(signal?.reason instanceof Error ? signal.reason : new Error("aborted"));
     signal?.addEventListener("abort", onAbort, { once: true });
     req.on("socket", (socket) => {
-      if (!socket.connecting || connectTimeoutMs === undefined) return;
       const connectedEvent = parsed.protocol === "https:" ? "secureConnect" : "connect";
-      connectTimer = setTimeout(() => fail(new PinnedHttpError("connect_timeout", `${context} connect timed out`)), connectTimeoutMs);
-      socket.once(connectedEvent, clearConnectTimer);
-      socket.once("error", clearConnectTimer);
-      socket.once("close", clearConnectTimer);
+      if (!socket.connecting) {
+        if (!usesLegacyIdleTimeout) startFirstByteTimer();
+        return;
+      }
+      if (connectTimeoutMs !== undefined) {
+        connectTimer = setTimeout(
+          () => fail(new PinnedHttpError("connect_timeout", `${context} connect timed out`)),
+          connectTimeoutMs,
+        );
+      }
+      socket.once(connectedEvent, () => {
+        clearConnectTimer();
+        if (!usesLegacyIdleTimeout) startFirstByteTimer();
+      });
+      socket.once("error", () => {
+        clearConnectTimer();
+        clearFirstByteTimer();
+      });
+      socket.once("close", () => {
+        clearConnectTimer();
+        clearFirstByteTimer();
+      });
     });
-    req.setTimeout(idleTimeoutMs, () => fail(new Error(`${context} timed out`)));
+    if (usesLegacyIdleTimeout) {
+      req.setTimeout(legacyIdleTimeoutMs, () => fail(new Error(`${context} timed out`)));
+    }
     req.on("error", error => {
       signal?.removeEventListener("abort", onAbort);
       fail(error);
     });
     req.on("close", () => {
       clearConnectTimer();
+      clearFirstByteTimer();
       signal?.removeEventListener("abort", onAbort);
     });
     req.end(body);

package/src/lib/self-launch-argv.ts

@@ -0,0 +1,15 @@
+interface SelfLaunchArgvOptions {
+  isStandaloneExecutable?: boolean;
+  sourceEntrypoint?: string;
+}
+
+/** Build argv for re-entering the current CLI in compiled or source mode. */
+export function selfLaunchArgv(
+  args: readonly string[],
+  options: SelfLaunchArgvOptions = {},
+): string[] {
+  const bunStandalone = (Bun as unknown as { isStandaloneExecutable?: boolean }).isStandaloneExecutable;
+  const isStandaloneExecutable = options.isStandaloneExecutable ?? Boolean(bunStandalone);
+  if (isStandaloneExecutable) return [...args];
+  return [options.sourceEntrypoint ?? process.argv[1], ...args];
+}

package/src/lib/state-store-registrations.ts

@@ -34,6 +34,7 @@ import { sweepExpiredAnthropicRoutingHealth } from "../oauth/anthropic-routing";
 import { listLiveOAuthAccountKeys, reconcileOAuthReauthState } from "../oauth/store";
 import { reconcileGuardianBackoff } from "../oauth/token-guardian";
 import { sweepExpiredApiKeyCooldowns } from "../providers/key-failover";
+import { reconcileProviderRequestPacing } from "../providers/request-pacing";
 import { sweepExpiredResponseStates } from "../responses/state";
 import { sweepExpiredAntigravityReplay } from "../adapters/google-antigravity-replay";
 import { reconcileProviderAccountQuotaRows } from "../providers/quota";
@@ -75,6 +76,7 @@ export function buildGenerationContext(): GenerationContext {
 export const STATE_STORE_REGISTRATIONS = [
   { name: "subagent-model-health", sweepExpired: sweepExpiredSubagentModelHealth },
   { name: "api-key-cooldowns", sweepExpired: sweepExpiredApiKeyCooldowns },
+  { name: "provider-request-pacing", reconcileGeneration: reconcileProviderRequestPacing },
   {
     name: "combo-target-cooldowns",
     sweepExpired: sweepExpiredComboTargetCooldowns,

package/src/lib/upstream-reachability.ts

@@ -23,6 +23,7 @@
  * MUST stay a leaf module: imports nothing from server.ts or adapters.
  */
 
+import { RequestPacingQueueOverloadError } from "../providers/request-pacing";
 import { UpstreamRetryEvidenceError } from "./upstream-retry";
 
 export const PRE_CONNECT_REACHABILITY_CODES = new Set([
@@ -68,6 +69,9 @@ export type TransportFailureKind = "timeout" | "connect_neutral" | "connect_erro
  * account-attributed behavior.
  */
 export function classifyTransportFailureKind(err: unknown): TransportFailureKind {
+  // A local pacing admission failure happened before transport classification and must
+  // remain a client-visible overload, not account or host health evidence.
+  if (err instanceof RequestPacingQueueOverloadError) throw err;
   const evidence = err instanceof UpstreamRetryEvidenceError ? err : undefined;
   const rejection = evidence ? evidence.cause : err;
   if (rejection instanceof Error && rejection.name === "TimeoutError") return "timeout";

package/src/lib/windows-elevation.ts

@@ -175,7 +175,7 @@ export function assertTrustedSystemExecutableForTests(candidate: string, label:
   return assertTrustedSystemExecutable(candidate, label);
 }
 
-type ElevationExeOverrides = { powershell?: string; schtasks?: string };
+type ElevationExeOverrides = { powershell?: string; schtasks?: string; taskkill?: string };
 let elevationExeOverridesForTests: ElevationExeOverrides | null = null;
 
 /**
@@ -211,6 +211,15 @@ export function resolveTrustedWindowsSchtasksExe(): string {
   return assertTrustedSystemExecutable(candidate, "schtasks.exe");
 }
 
+/** Absolute path to System32\\taskkill.exe from a trusted system directory. */
+export function resolveTrustedWindowsTaskkillExe(): string {
+  if (elevationExeOverridesForTests?.taskkill) {
+    return elevationExeOverridesForTests.taskkill;
+  }
+  const candidate = join(resolveTrustedWindowsSystemDirectory(), "taskkill.exe");
+  return assertTrustedSystemExecutable(candidate, "taskkill.exe");
+}
+
 /** Stable machine-readable marker for a denied `schtasks /create`. Crosses the CLI→proxy boundary. */
 export const WINDOWS_SCHTASKS_CREATE_ACCESS_DENIED_MARKER =
   "OCX_ERROR_CODE=WINDOWS_SCHTASKS_CREATE_ACCESS_DENIED";

package/src/providers/derive.ts

@@ -1,10 +1,14 @@
 import type { CodexAccountMode, OcxProviderConfig } from "../types";
 import {
   PROVIDER_REGISTRY,
-  providerMatchesRegistryTransport,
   registryEntryForProviderDestination,
   type ProviderRegistryEntry,
 } from "./registry";
+import {
+  providerMatchesRegistryTransportWithStaticGuards,
+  registryEntrySupportsLiveModelDiscovery,
+  repairStaticModelCatalogProvider,
+} from "./static-model-discovery";
 
 export interface DerivedKeyLoginProvider {
   label: string;
@@ -204,6 +208,7 @@ export function applyDirectReasoningEffortContracts(
  * keep distinguishing local runtimes from API-key providers after the seed round-trip.
  */
 export function providerConfigSeed(entry: ProviderRegistryEntry): OcxProviderConfig {
+  const liveModels = registryEntrySupportsLiveModelDiscovery(entry) ? entry.liveModels : false;
   return {
     adapter: entry.adapter,
     baseUrl: entry.baseUrl,
@@ -219,7 +224,7 @@ export function providerConfigSeed(entry: ProviderRegistryEntry): OcxProviderCon
     ...(entry.staticHeaders ? { headers: { ...entry.staticHeaders } } : {}),
     ...(entry.defaultModel ? { defaultModel: entry.defaultModel } : {}),
     ...(entry.models ? { models: [...entry.models] } : {}),
-    ...(entry.liveModels !== undefined ? { liveModels: entry.liveModels } : {}),
+    ...(liveModels !== undefined ? { liveModels } : {}),
     ...(entry.contextWindow !== undefined ? { contextWindow: entry.contextWindow } : {}),
     ...(entry.modelContextWindows ? { modelContextWindows: { ...entry.modelContextWindows } } : {}),
     ...(entry.modelInputModalities ? { modelInputModalities: cloneRecordOfArrays(entry.modelInputModalities) } : {}),
@@ -263,6 +268,7 @@ export function deriveKeyLoginMap(): Record<string, DerivedKeyLoginProvider> {
   for (const entry of PROVIDER_REGISTRY) {
     if (entry.authKind !== "key") continue;
     if (!entry.dashboardUrl) throw new Error(`Registry key provider missing dashboardUrl: ${entry.id}`);
+    const liveModels = registryEntrySupportsLiveModelDiscovery(entry) ? entry.liveModels : false;
     out[entry.id] = {
       label: entry.label,
       baseUrl: entry.baseUrl,
@@ -272,7 +278,7 @@ export function deriveKeyLoginMap(): Record<string, DerivedKeyLoginProvider> {
       ...(entry.apiKeyTransport !== undefined ? { apiKeyTransport: entry.apiKeyTransport } : {}),
       dashboardUrl: entry.dashboardUrl,
       ...(entry.models ? { models: [...entry.models] } : {}),
-      ...(entry.liveModels !== undefined ? { liveModels: entry.liveModels } : {}),
+      ...(liveModels !== undefined ? { liveModels } : {}),
       ...(entry.defaultModel ? { defaultModel: entry.defaultModel } : {}),
       ...(entry.contextWindow !== undefined ? { contextWindow: entry.contextWindow } : {}),
       ...(entry.modelContextWindows ? { modelContextWindows: { ...entry.modelContextWindows } } : {}),
@@ -359,6 +365,17 @@ function applyReasoningSummaryDefaults(
   };
 }
 
+function applyServiceTierModelDefaults(
+  prov: OcxProviderConfig,
+  defaults: Readonly<Record<string, boolean>> | undefined,
+): void {
+  if (!defaults) return;
+  prov.modelSupportsServiceTier = {
+    ...defaults,
+    ...(prov.modelSupportsServiceTier ?? {}),
+  };
+}
+
 /**
  * Last-resort enrichment for a provider whose NAME matches no registry id.
  *
@@ -378,7 +395,7 @@ function enrichReasoningSummariesByDestination(prov: OcxProviderConfig): void {
 
 export function enrichProviderFromRegistry(name: string, prov: OcxProviderConfig): void {
   const entry = PROVIDER_REGISTRY.find(row => row.id === name);
-  if (!entry || !providerMatchesRegistryTransport(name, prov)) {
+  if (!entry || !providerMatchesRegistryTransportWithStaticGuards(name, prov)) {
     // Name lookup failed, but the row may still point at a vendor route we know. #1100 was
     // reported against a hand-added provider literally named "GLM": routing worked, yet every
     // piece of registry metadata was skipped because no registry id is called "GLM".
@@ -386,6 +403,7 @@ export function enrichProviderFromRegistry(name: string, prov: OcxProviderConfig
     // which vendor endpoint is this row talking to — and is already restricted to fixed key
     // destinations, so a templated or overridable base URL cannot be claimed by it.
     enrichReasoningSummariesByDestination(prov);
+    applyServiceTierModelDefaults(prov, registryEntryForProviderDestination(prov)?.modelSupportsServiceTier);
     return;
   }
   const explicitDirectReasoning: DirectReasoningEffortOverrides = {
@@ -395,6 +413,7 @@ export function enrichProviderFromRegistry(name: string, prov: OcxProviderConfig
     modelReasoningEffortMap: prov.modelReasoningEffortMap,
   };
   const seed = providerConfigSeed(entry);
+  repairStaticModelCatalogProvider(name, prov);
   if (prov.apiKeyTransport === undefined && seed.apiKeyTransport !== undefined) prov.apiKeyTransport = seed.apiKeyTransport;
   if (!prov.defaultModel && seed.defaultModel) prov.defaultModel = seed.defaultModel;
   if (prov.responsesPath === undefined && seed.responsesPath !== undefined) prov.responsesPath = seed.responsesPath;
@@ -433,6 +452,7 @@ export function enrichProviderFromRegistry(name: string, prov: OcxProviderConfig
   if (prov.supportsServiceTier === undefined && entry.supportsServiceTier !== undefined) prov.supportsServiceTier = entry.supportsServiceTier;
   if (prov.preserveResponsesReasoningContent === undefined && entry.preserveResponsesReasoningContent !== undefined) prov.preserveResponsesReasoningContent = entry.preserveResponsesReasoningContent;
   applyReasoningSummaryDefaults(prov, entry.modelSupportsReasoningSummaries);
+  applyServiceTierModelDefaults(prov, entry.modelSupportsServiceTier);
   // Registry-only repair policy (#938): fill only when the runtime provider has
   // no explicit policy, and deep-clone so saved/user values never alias the
   // registry constant.