@bitkyc08/opencodex 2.25.0 → 2.26.0

package/src/types.ts

@@ -14,6 +14,12 @@ export interface OcxReasoningReplayIdentity {
   modelId: string;
   /** Opaque process-local credential identity; never a raw token or API key. */
   credentialIdentity: string;
+  /**
+   * Salted-HMAC credential identity that survives restarts, for the durable
+   * thought-signature store (#1926). Absent when no durable identity could be
+   * derived — the durable store then refuses to key the entry (fail closed).
+   */
+  credentialDurableIdentity?: string;
 }
 
 /**
@@ -301,6 +307,10 @@ export interface OcxRequestOptions {
   reasoning?: string;
   hideThinkingSummary?: boolean;
   serviceTier?: string;
+  /** Final outbound tier action, resolved after the provider/model wire is settled. */
+  tierDecision?: TierDecision;
+  /** Internal B0 observation inputs; adapters combine these with the wire they actually serialize. */
+  tierObservation?: TierObservationContext;
   presencePenalty?: number;
   frequencyPenalty?: number;
   /** Responses prompt-cache affinity key. Passthrough preserves it via _rawBody; routed adapters do not consume it unless their upstream wire supports it. */
@@ -1315,6 +1325,51 @@ export interface ProviderRequestPacingConfig extends RequestPacingRule {
   models?: Record<string, RequestPacingRule>;
 }
 
+export interface FastWire {
+  kind: "service-tier" | "anthropic-speed";
+  /** Canonical tier name to upstream wire spelling. */
+  canonicalToWire: Readonly<Record<string, string>>;
+  /** Policy for non-canonical caller-provided tier values. */
+  foreignCallerTiers: "verbatim" | "drop";
+  /** Anthropic speed headers/betas reserved for the later wire implementation. */
+  betas?: readonly string[];
+}
+
+/** Durable per-attempt service-tier fact produced at the adapter serialization boundary. */
+export interface AttemptTierOutcome {
+  canonical?: "priority";
+  wireKind?: FastWire["kind"] | null;
+  wireValue?: string | null;
+  fastOutcome: "not-requested" | "applied" | "downgraded" | "unknown";
+  fastDowngradeReason?: "route-unsupported" | "wire-unavailable" | "response-declined";
+  callerTierDropped?: boolean;
+  callerFastSuppressedByConfig?: boolean;
+  confirmation: "confirmed" | "assumed" | "downgraded" | "unknown";
+  responseServiceTier?: string;
+}
+
+/**
+ * Request-local observation inputs captured before the final tier action mutates the parsed view.
+ * This is not persisted; the final adapter turns it into AttemptTierOutcome after serialization.
+ */
+export interface TierObservationContext {
+  capability: boolean | undefined;
+  eligibility:
+    | "eligible"
+    | "capability-unsupported"
+    | "unclassified"
+    | "wire-unavailable"
+    | "pin-unavailable";
+  fastWire: FastWire | null;
+  demandDecision: "force-fast" | "force-default" | "inherit";
+  callerTier?: string;
+}
+
+export type TierDecision =
+  | { readonly kind: "forward-caller" }
+  | { readonly kind: "drop" }
+  | { readonly kind: "set"; readonly value: string };
+
 /**
  * One configured provider entry. `authMode` (default `"key"`) decides whether same-target 429
  * retries are allowed; OAuth/forward credentials and local runtimes are never replayed.
@@ -1338,6 +1393,11 @@ export interface OcxProviderConfig {
    * as before.
    */
   modelAdapters?: Record<string, string>;
+  /**
+   * Fast-wire declaration. `null` explicitly disables adapter-derived defaults;
+   * absence derives from the final model adapter.
+   */
+  fastWire?: FastWire | null;
   baseUrl: string;
   /**
    * Optional relative resource path for key-auth openai-responses requests. Must start with `/`
@@ -1365,14 +1425,14 @@ export interface OcxProviderConfig {
    */
   requiresAdjacentResponsesToolResults?: boolean;
   /**
-   * Provider fallback for the OpenAI `service_tier` parameter. On Responses routes this
-   * is the complete wire opt-in; Chat routes additionally require `chatServiceTier` or an
-   * exact-model true declaration.
-   * Tri-state: `true` lets fast mode inject/remove the field (an unset
-   * fast mode preserves a caller-supplied value); `false` strips the field and
+   * Provider fallback for canonical Fast capability over an OpenAI `service_tier` wire.
+   * This pure tri-state feeds catalog publication, routing eligibility, compatibility
+   * fingerprints, and proxy-owned canonical Fast injection on both Responses and Chat routes.
+   * Tri-state: `true` lets fast mode inject/remove the canonical field; `false` strips it and
    * never injects, because an upstream documented as not supporting the parameter
-   * must not receive it; absent (`undefined`) leaves the provider unclassified —
-   * caller-supplied values are preserved untouched, and fast mode never injects.
+   * must not receive it; absent (`undefined`) leaves the provider unclassified — fast mode never
+   * injects or translates, and caller values pass only under the final wire's forwarding permission.
+   * On Chat, that CallerTierForward permission is `chatServiceTier`; Responses retains passthrough.
    * An explicit config value always wins over the registry default.
    */
   supportsServiceTier?: boolean;
@@ -1396,8 +1456,10 @@ export interface OcxProviderConfig {
    * HTTP/2 via TLS ALPN by default; some Cloudflare-fronted SSE endpoints hang on
    * HTTP/2 streaming responses (issue #1668). "http1.1" / "h1" forces HTTP/1.1,
    * "http2" / "h2" forces HTTP/2. Absent or "auto" keeps Bun's default negotiation
-   * (current behavior unchanged). Only meaningful for https: base URLs.
-  */
+   * (current behavior unchanged). Explicit pins require an https: target and fail locally when the
+   * pin cannot be honored. Cursor additionally maps an HTTP/1.1 pin onto its RunSSE + BidiAppend
+   * compatibility transport.
+   */
   upstreamHttpVersion?: UpstreamHttpVersion;
   /**
    * Google only. When `false`, the AI Studio (direct) path sends Gemini Flash ids
@@ -1589,13 +1651,16 @@ export interface OcxProviderConfig {
    */
   promptCacheKey?: boolean;
   /**
-   * Opt-in: forward `service_tier` to the upstream `/chat/completions` body.
+   * Opt-in: forward caller `service_tier` values to the upstream `/chat/completions` body.
+   * On a classified route it governs foreign values (for example `flex`), not proxy-owned
+   * canonical Fast after capability validation. On an unclassified route it governs every caller
+   * value, including canonical spellings, because no Fast capability has been validated.
    * OpenAI-specific extension with the same hazard as `promptCacheKey` — strict backends
    * reject unknown fields, and 66 registry providers share the `openai-chat` adapter, so a
    * caller-supplied `service_tier` would otherwise turn working requests into upstream 400s.
-   * Exact models may opt in through `modelSupportsServiceTier` instead; provider-level
-   * `supportsServiceTier: false` remains a global denial. Default off; only enable for
-   * providers that document this parameter on the chat wire.
+   * Exact-model `true` enables canonical Fast capability but does not grant foreign-tier
+   * forwarding; provider-level `supportsServiceTier: false` remains a global denial. Default off;
+   * only enable for providers that document this parameter on the chat wire.
    */
   chatServiceTier?: boolean;
   /**
@@ -1750,6 +1815,19 @@ const ANTHROPIC_WIRE_MODELS: Record<string, ReadonlySet<string>> = {
   "opencode-go": new Set(["minimax-m2.5", "minimax-m2.7", "minimax-m3"]),
 };
 
+function anthropicWireModelsForProvider(providerName: string): ReadonlySet<string> | undefined {
+  return Object.hasOwn(ANTHROPIC_WIRE_MODELS, providerName)
+    ? ANTHROPIC_WIRE_MODELS[providerName]
+    : undefined;
+}
+
+/** Detached provider-local hard-pin table for pure wire-policy resolution. */
+export function captureWireAdapterHardPins(providerName: string): Readonly<Record<string, string>> {
+  const models = anthropicWireModelsForProvider(providerName);
+  if (!models) return Object.freeze({});
+  return Object.freeze(Object.fromEntries([...models].map(modelId => [modelId, "anthropic"])));
+}
+
 /**
  * True when the upstream speaks exactly one wire for this model, so a configured
  * override must not apply.
@@ -1759,7 +1837,7 @@ const ANTHROPIC_WIRE_MODELS: Record<string, ReadonlySet<string>> = {
  * adapter" would pass on the first pass and then let the override win on the second.
  */
 export function isWirePinnedModel(providerName: string, modelId: string): boolean {
-  return ANTHROPIC_WIRE_MODELS[providerName]?.has(modelId) ?? false;
+  return anthropicWireModelsForProvider(providerName)?.has(modelId) ?? false;
 }
 
 /** The wire a pinned model must use, or undefined when the model is not pinned. */
@@ -1773,6 +1851,15 @@ export interface CodexAccount {
   /** User-owned display label; never participates in routing or identity checks. */
   alias?: string;
   plan?: string;
+  /**
+   * Provenance of `plan`. WHAM (live quota API) is authoritative; the JWT
+   * `chatgpt_plan_type` claim is a fallback that may lag a plan change. A JWT write
+   * must never overwrite a WHAM-sourced plan observed for the same credential
+   * generation — only a newer generation (token refresh after the WHAM read) may.
+   */
+  planSource?: "jwt" | "wham";
+  /** Credential generation at which `plan`/`planSource` was recorded. */
+  planCredentialGeneration?: number;
   chatgptAccountId?: string;
   logLabel?: string;
   isMain: boolean;

package/src/update/job.ts

@@ -14,6 +14,7 @@ import {
 } from "../config";
 import { isProcessAlive, killProxy } from "../lib/process-control";
 import { selfLaunchArgv } from "../lib/self-launch-argv";
+import { killWindowsSchedulerWrappers } from "../lib/windows-service-wrappers";
 import {
   buildWindowsElevatedArgumentList,
   resolveTrustedWindowsPowerShellExe,
@@ -1371,26 +1372,16 @@ function stopWindowsServiceWrappersBestEffort(): void {
  * Best-effort termination of surviving Windows scheduler launcher/wrapper processes.
  * `schtasks /end` ends the task instance but often leaves wscript/cmd running the
  * `:loop` batch, which brings the proxy back during post-update reclaim.
+ *
+ * This used to match the bare filenames with -like '*name*', which could stop a
+ * wrapper belonging to a DIFFERENT OpenCodex home under the same account. The
+ * shared killer scopes to this home's canonical paths as complete tokens.
  */
 function killWindowsServiceWrapperProcesses(): void {
-  if (process.platform !== "win32") return;
-  try {
-    const ps = [
-      "$pats = @('opencodex-service.cmd','opencodex-service-launcher.vbs');",
-      "Get-CimInstance Win32_Process | Where-Object {",
-      "  if ($_.ProcessId -eq $PID) { return $false };",
-      "  $c = $_.CommandLine; if (-not $c) { return $false };",
-      "  foreach ($p in $pats) { if ($c -like ('*' + $p + '*')) { return $true } };",
-      "  $false",
-      "} | ForEach-Object { Stop-Process -Id $_.ProcessId -Force -ErrorAction SilentlyContinue }",
-    ].join(" ");
-    spawnSync(resolveTrustedWindowsPowerShellExe(), [
-      "-NoProfile", "-NoLogo", "-NonInteractive",
-      "-Command", ps,
-    ], { stdio: "ignore", timeout: 5000, windowsHide: true });
-  } catch {
-    /* best-effort */
-  }
+  killWindowsSchedulerWrappers({
+    scriptPath: join(getConfigDir(), "opencodex-service.cmd"),
+    launcherPath: join(getConfigDir(), "opencodex-service-launcher.vbs"),
+  });
 }
 
 /** Exposed for tests: drives the non-service restart path with injected io. */

package/src/update/transactional-install.d.mts

@@ -0,0 +1,22 @@
+export type InstallTreeVerification = { ok: boolean; failures: string[] };
+export function verifyInstallTree(packageDir: string, expectedVersion?: string): InstallTreeVerification;
+export function bootRestoreProbe(
+  packageDir: string,
+  deps?: { rename?: (from: string, to: string) => void },
+): { action: "none" | "reaped" | "restored" | "failed"; count?: number; from?: string; error?: string };
+export function transactionalNpmUpdate(args: {
+  packageDir: string;
+  pkgName: string;
+  targetVersion?: string;
+  tag: string;
+  runNpm: (args: string[]) => { status: number | null };
+  log?: (line: string) => void;
+  deps?: { rename?: (from: string, to: string) => void };
+}): {
+  ok: boolean;
+  phase: "stage" | "verify" | "swap-backup" | "swap-live" | "post-verify" | "double-fault" | "done";
+  error?: string;
+  rolledBack?: boolean;
+  backup?: string;
+};
+

package/src/update/transactional-install.mjs

@@ -0,0 +1,259 @@
+/**
+ * Transactional npm self-update: stage -> verify -> swap -> rollback (#1942 / #1849).
+ *
+ * The legacy path ran `npm install -g` straight into the live global tree, so a
+ * failure after npm removed the old files left a file-less package skeleton with no
+ * recovery. This module stages the new version into a SIBLING directory of the live
+ * package (same volume, so directory renames are atomic-ish and never cross devices),
+ * verifies the staged tree with a manifest before anything live is touched, then swaps
+ * live -> backup -> stage-into-live with a reverse-rename rollback on failure and a
+ * recovery marker on double fault.
+ *
+ * Layout (siblings, never children — a child would travel WITH the live rename and the
+ * live dir cannot move into its own subtree):
+ *   <scopeDir>/opencodex                      live package
+ *   <scopeDir>/.ocx-staging-<ts>/             npm --prefix root (contains node_modules/...)
+ *   <scopeDir>/.ocx-backup-<ts>/opencodex     previous live tree during/after the swap
+ *   <scopeDir>/.ocx-recovery.json             double-fault marker with a one-line restore
+ */
+import { spawnSync } from "node:child_process";
+import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+
+/** Verification manifest for a staged (or live) package tree. */
+export function verifyInstallTree(packageDir, expectedVersion) {
+  const failures = [];
+  let pkg;
+  try {
+    pkg = JSON.parse(readFileSync(join(packageDir, "package.json"), "utf8"));
+  } catch (error) {
+    return { ok: false, failures: ["package.json unreadable: " + (error?.message ?? String(error))] };
+  }
+  if (expectedVersion && pkg.version !== expectedVersion) {
+    failures.push("package.json version " + pkg.version + " != expected " + expectedVersion);
+  }
+  const launcher = join(packageDir, "bin", "ocx.mjs");
+  try {
+    const st = statSync(launcher);
+    if (!st.isFile() || st.size < 1024) failures.push("bin/ocx.mjs missing or truncated");
+  } catch {
+    failures.push("bin/ocx.mjs absent");
+  }
+  // The bundled Bun binary is the load-bearing artifact: without it the launcher exits
+  // before serving anything, and a boot probe that called this tree healthy would reap
+  // the only backup (review High 3). Size-gate the real binary, not just its package.json.
+  const bunPkgDir = join(packageDir, "node_modules", "bun");
+  if (existsSync(bunPkgDir)) {
+    const bunBinary = findLargestFile(bunPkgDir);
+    if (!bunBinary || bunBinary.size < 10 * 1024 * 1024) {
+      failures.push("bundled Bun binary missing or truncated (< 10MB)");
+    }
+  }
+  // Sentinel direct deps: each must have an intact package.json. The bundled Bun dep is
+  // the load-bearing one — without it the launcher cannot start the proxy at all.
+  const deps = Object.keys(pkg.dependencies ?? {});
+  const sentinels = deps.filter(name => name === "bun" || name === "zod").length > 0
+    ? deps.filter(name => name === "bun" || name === "zod")
+    : deps.slice(0, 2);
+  for (const name of sentinels) {
+    const depPkg = join(packageDir, "node_modules", ...name.split("/"), "package.json");
+    if (!existsSync(depPkg)) failures.push("sentinel dependency missing: " + name);
+  }
+  return failures.length === 0 ? { ok: true, failures: [] } : { ok: false, failures };
+}
+
+function stampedName(prefix) {
+  return prefix + "-" + new Date().toISOString().replace(/[:.]/g, "-");
+}
+
+/** Largest regular file under a directory tree (bounded depth) — locates the Bun binary. */
+function findLargestFile(root, depth = 3) {
+  let best;
+  let names = [];
+  try { names = readdirSync(root); } catch { return undefined; }
+  for (const name of names) {
+    const full = join(root, name);
+    let st;
+    try { st = statSync(full); } catch { continue; }
+    if (st.isFile()) {
+      if (!best || st.size > best.size) best = { path: full, size: st.size };
+    } else if (st.isDirectory() && depth > 0) {
+      const sub = findLargestFile(full, depth - 1);
+      if (sub && (!best || sub.size > best.size)) best = sub;
+    }
+  }
+  return best;
+}
+
+/** Bounded Windows-class rename retry: EPERM/EBUSY/EACCES from AV/indexers clears in ms. */
+function renameWithRetry(rename, from, to, attempts = 5) {
+  for (let attempt = 0; ; attempt += 1) {
+    try {
+      rename(from, to);
+      return;
+    } catch (error) {
+      const code = error?.code;
+      const retryable = code === "EPERM" || code === "EBUSY" || code === "EACCES";
+      if (!retryable || attempt >= attempts - 1) throw error;
+      // Synchronous bounded backoff (launcher context has no async loop here).
+      const until = Date.now() + 100 * (attempt + 1);
+      while (Date.now() < until) { /* spin briefly; total worst case ~1.5s */ }
+    }
+  }
+}
+
+function recoveryMarkerPath(scopeDir) {
+  return join(scopeDir, ".ocx-recovery.json");
+}
+
+/** Startup probe: restore a backup when the live tree is broken (D4 power-loss rows). */
+export function bootRestoreProbe(packageDir, deps = {}) {
+  const rename = deps.rename ?? renameSync;
+  const scopeDir = dirname(packageDir);
+  let backups = [];
+  try {
+    backups = readdirSync(scopeDir).filter(name => name.startsWith(".ocx-backup-")).sort();
+  } catch {
+    return { action: "none" };
+  }
+  if (backups.length === 0) return { action: "none" };
+  const liveOk = existsSync(join(packageDir, "package.json"))
+    && verifyInstallTree(packageDir).ok;
+  const newestBackup = join(scopeDir, backups[backups.length - 1], "opencodex");
+  if (liveOk) {
+    // Live is healthy: the backups are leftovers from a completed swap. Reap them.
+    for (const name of backups) {
+      try { rmSync(join(scopeDir, name), { recursive: true, force: true }); } catch { /* keep */ }
+    }
+    try { rmSync(recoveryMarkerPath(scopeDir), { force: true }); } catch { /* keep */ }
+    return { action: "reaped", count: backups.length };
+  }
+  if (!existsSync(join(newestBackup, "package.json"))) return { action: "none" };
+  try {
+    try { rmSync(packageDir, { recursive: true, force: true }); } catch { /* may not exist */ }
+    rename(newestBackup, packageDir);
+    return { action: "restored", from: newestBackup };
+  } catch (error) {
+    return { action: "failed", error: error?.message ?? String(error) };
+  }
+}
+
+/**
+ * Run the transactional update. `runNpm(args, opts)` is injected so the caller keeps
+ * its hardened npm resolution (npm-invocation.mjs) and logging.
+ */
+export function transactionalNpmUpdate({
+  packageDir,
+  pkgName,
+  targetVersion,
+  tag,
+  runNpm,
+  log = () => {},
+  deps = {},
+}) {
+  const rename = deps.rename ?? renameSync;
+  const scopeDir = dirname(packageDir);
+  const stageRoot = join(scopeDir, stampedName(".ocx-staging"));
+  // GLOBAL-style staging (-g --prefix): npm nests the package's dependencies INSIDE the
+  // package dir, exactly like the live global tree this stage will replace. A local-style
+  // install would hoist bun/zod to stageRoot/node_modules — siblings that the swap would
+  // leave behind, shipping a dependency-less live tree (release-audit blocker).
+  // Layout: <stageRoot>/lib/node_modules/<pkg> on POSIX, <stageRoot>/node_modules/<pkg>
+  // on Windows.
+  const stagedCandidates = [
+    join(stageRoot, "lib", "node_modules", ...pkgName.split("/")),
+    join(stageRoot, "node_modules", ...pkgName.split("/")),
+  ];
+
+  // D1: stage to the side. --prefix keeps npm entirely inside stageRoot; the live tree
+  // and the npm bin shims are untouched until the swap. A failure HERE (mkdir EACCES,
+  // ENOSPC) must NOT fall back to the destructive legacy install (review High 4): the
+  // caller sees a normal phase failure with live untouched.
+  try {
+    mkdirSync(stageRoot, { recursive: true });
+  } catch (error) {
+    return { ok: false, phase: "stage", error: "could not create staging directory: " + (error?.message ?? String(error)) };
+  }
+  const spec = pkgName + "@" + (targetVersion || tag);
+  log("Staging " + spec + " into " + stageRoot);
+  const install = runNpm(["install", "-g", "--prefix", stageRoot, "--no-audit", "--no-fund", spec]);
+  if (install.status !== 0) {
+    try { rmSync(stageRoot, { recursive: true, force: true }); } catch { /* best effort */ }
+    return { ok: false, phase: "stage", error: "npm staging install failed (" + (install.status ?? "?") + ")" };
+  }
+  const stagedPackage = stagedCandidates.find(dir => existsSync(join(dir, "package.json")));
+  if (!stagedPackage) {
+    try { rmSync(stageRoot, { recursive: true, force: true }); } catch { /* best effort */ }
+    return { ok: false, phase: "verify", error: "staged package directory not found under " + stageRoot };
+  }
+
+  // D2: verify INSIDE the stage. Live is still untouched on any failure here.
+  const staged = verifyInstallTree(stagedPackage, targetVersion || undefined);
+  if (!staged.ok) {
+    try { rmSync(stageRoot, { recursive: true, force: true }); } catch { /* best effort */ }
+    return { ok: false, phase: "verify", error: "staged tree failed verification: " + staged.failures.join("; ") };
+  }
+
+  // D3: swap. live -> backup, stage -> live, re-verify live, rollback on failure.
+  const backupRoot = join(scopeDir, stampedName(".ocx-backup"));
+  const backupPackage = join(backupRoot, "opencodex");
+  try {
+    mkdirSync(backupRoot, { recursive: true });
+  } catch (error) {
+    try { rmSync(stageRoot, { recursive: true, force: true }); } catch { /* best effort */ }
+    return { ok: false, phase: "swap-backup", error: "could not create backup directory: " + (error?.message ?? String(error)) };
+  }
+  try {
+    renameWithRetry(rename, packageDir, backupPackage);
+  } catch (error) {
+    try { rmSync(stageRoot, { recursive: true, force: true }); } catch { /* best effort */ }
+    try { rmSync(backupRoot, { recursive: true, force: true }); } catch { /* best effort */ }
+    return { ok: false, phase: "swap-backup", error: "could not move live tree aside: " + (error?.message ?? String(error)) };
+  }
+  try {
+    renameWithRetry(rename, stagedPackage, packageDir);
+  } catch (error) {
+    // Rollback: reverse the first rename. Double fault leaves the recovery marker.
+    try {
+      renameWithRetry(rename, backupPackage, packageDir);
+      try { rmSync(stageRoot, { recursive: true, force: true }); } catch { /* best effort */ }
+      try { rmSync(backupRoot, { recursive: true, force: true }); } catch { /* best effort */ }
+      return { ok: false, phase: "swap-live", rolledBack: true, error: "could not place staged tree: " + (error?.message ?? String(error)) };
+    } catch (rollbackError) {
+      writeFileSync(recoveryMarkerPath(scopeDir), JSON.stringify({
+        at: new Date().toISOString(),
+        backup: backupPackage,
+        live: packageDir,
+        restore: 'move "' + backupPackage + '" back to "' + packageDir + '"',
+        error: String(error?.message ?? error),
+        rollbackError: String(rollbackError?.message ?? rollbackError),
+      }, null, 2));
+      return { ok: false, phase: "double-fault", rolledBack: false, error: "swap and rollback both failed; recovery marker written at " + recoveryMarkerPath(scopeDir) };
+    }
+  }
+  const liveCheck = verifyInstallTree(packageDir, targetVersion || undefined);
+  if (!liveCheck.ok) {
+    try {
+      rmSync(packageDir, { recursive: true, force: true });
+      rename(backupPackage, packageDir);
+      try { rmSync(stageRoot, { recursive: true, force: true }); } catch { /* best effort */ }
+      try { rmSync(backupRoot, { recursive: true, force: true }); } catch { /* best effort */ }
+      return { ok: false, phase: "post-verify", rolledBack: true, error: "live tree failed post-swap verification: " + liveCheck.failures.join("; ") };
+    } catch (rollbackError) {
+      writeFileSync(recoveryMarkerPath(scopeDir), JSON.stringify({
+        at: new Date().toISOString(),
+        backup: backupPackage,
+        live: packageDir,
+        restore: 'move "' + backupPackage + '" back to "' + packageDir + '"',
+        error: "post-swap verification failed: " + liveCheck.failures.join("; "),
+        rollbackError: String(rollbackError?.message ?? rollbackError),
+      }, null, 2));
+      return { ok: false, phase: "double-fault", rolledBack: false, error: "post-verify rollback failed; recovery marker written" };
+    }
+  }
+  // Success: stage scaffolding is disposable now; the backup stays until the next
+  // healthy boot reaps it (bootRestoreProbe) — the process that spawned this update may
+  // still hold the old cwd.
+  try { rmSync(stageRoot, { recursive: true, force: true }); } catch { /* best effort */ }
+  return { ok: true, phase: "done", backup: backupPackage };
+}

package/src/usage/cost.ts

@@ -14,7 +14,7 @@ import {
   getModelMetadata,
   resolveMetadataProvider,
 } from "../generated/model-metadata";
-import type { OcxUsage } from "../types";
+import type { AttemptTierOutcome, OcxUsage } from "../types";
 import { baseProviderLabel, canonicalUsageProviderLabel } from "../providers/label";
 import type { PersistedUsageAttempt, UsageStatus } from "./log";
 import { canonicalAntigravityUsageModel } from "../providers/antigravity-models";
@@ -44,6 +44,7 @@ export interface ServiceTierContext {
   responseServiceTier?: string;
   requestedServiceTier?: string;
   configuredServiceTier?: string;
+  tierOutcome?: AttemptTierOutcome;
 }
 
 export interface CostTokens {
@@ -349,6 +350,7 @@ export type ServiceTierInput = string | ServiceTierContext;
  * and long-context exclusivity depends on that distinction.
  */
 export function serviceTierContext(entry: ServiceTierContext): ServiceTierContext {
+  if (entry.tierOutcome) return serviceTierContextFromOutcome(entry.tierOutcome);
   return {
     responseServiceTier: entry.responseServiceTier,
     requestedServiceTier: entry.requestedServiceTier,
@@ -356,6 +358,30 @@ export function serviceTierContext(entry: ServiceTierContext): ServiceTierContex
   };
 }
 
+/** Convert one adapter-observed attempt outcome into the existing pricing provenance shape. */
+export function serviceTierContextFromOutcome(outcome: AttemptTierOutcome): ServiceTierContext {
+  if (outcome.canonical === "priority" && outcome.confirmation === "confirmed") {
+    return { responseServiceTier: "priority" };
+  }
+  if (outcome.responseServiceTier !== undefined) {
+    return { responseServiceTier: outcome.responseServiceTier };
+  }
+  if (outcome.canonical === "priority" && outcome.confirmation === "assumed") {
+    return { requestedServiceTier: "priority" };
+  }
+  // An unclassified route makes no canonical Fast claim, but its adapter can still prove that
+  // it serialized a caller tier. Preserve that wire evidence instead of discarding the legacy
+  // top-level pricing signal merely because B0 added an outcome row.
+  if (
+    outcome.fastOutcome === "unknown"
+    && outcome.wireKind === "service-tier"
+    && typeof outcome.wireValue === "string"
+  ) {
+    return { requestedServiceTier: outcome.wireValue };
+  }
+  return {};
+}
+
 function tierScalar(tier?: ServiceTierInput): string | undefined {
   return typeof tier === "string" ? tier : tier && effectiveServiceTier(tier);
 }
@@ -428,7 +454,7 @@ function applyPriorityMultiplier(
  * missing so combos can fail closed.
  */
 export function estimateAttemptCost(
-  attempt: Pick<PersistedUsageAttempt, "ordinal" | "provider" | "model" | "usage" | "usageStatus">,
+  attempt: Pick<PersistedUsageAttempt, "ordinal" | "provider" | "model" | "usage" | "usageStatus" | "tierOutcome">,
   overlays: readonly ExpectedPriceOverlay[] = EXPECTED_PRICE_OVERLAYS,
   serviceTier?: ServiceTierInput,
   userOverlays: readonly ExpectedPriceOverlay[] = activeUserCostOverlays(),
@@ -438,15 +464,18 @@ export function estimateAttemptCost(
   if (!tokens) return null;
   const price = resolveMatchedPrice(attempt.provider, attempt.model, overlays, userOverlays);
   if (!price) return null;
+  const attemptServiceTier = attempt.tierOutcome
+    ? serviceTierContextFromOutcome(attempt.tierOutcome)
+    : serviceTier;
   const [tieredCost4, contextTier] = applyContextTier(
-    price.cost4, attempt.provider, attempt.model, attempt.usage.inputTokens, serviceTier,
+    price.cost4, attempt.provider, attempt.model, attempt.usage.inputTokens, attemptServiceTier,
   );
   // Exclusive both ways: if the long rate applied, the request was NOT served as
   // Fast (Fast does not support long context), so the Fast multiplier must not
   // also apply — otherwise a downgraded request bills at both rates.
   const [effectiveCost4, multiplier] = contextTier
     ? [tieredCost4, 1] as const
-    : applyPriorityMultiplier(tieredCost4, attempt.provider, attempt.model, serviceTier);
+    : applyPriorityMultiplier(tieredCost4, attempt.provider, attempt.model, attemptServiceTier);
   return {
     ordinal: attempt.ordinal,
     provider: attempt.provider,
@@ -465,7 +494,7 @@ export function estimateAttemptCost(
  * attempt is unpriced or unnormalizable, return null rather than a partial sum.
  */
 export function estimateComboCost(
-  attempts: readonly Pick<PersistedUsageAttempt, "ordinal" | "provider" | "model" | "usage" | "usageStatus">[],
+  attempts: readonly Pick<PersistedUsageAttempt, "ordinal" | "provider" | "model" | "usage" | "usageStatus" | "tierOutcome">[],
   overlays: readonly ExpectedPriceOverlay[] = EXPECTED_PRICE_OVERLAYS,
   serviceTier?: ServiceTierInput,
   userOverlays: readonly ExpectedPriceOverlay[] = activeUserCostOverlays(),