@bitkyc08/opencodex 2.34.0 → 2.35.0

package/src/server/responses/core.ts

@@ -40,6 +40,10 @@ import {
   previousResponseScopeMismatch,
   rememberResponseState,
 } from "../../responses/state";
+import {
+  bindTurnTerminationScope,
+  rememberDeliveredFinalAnswer,
+} from "../../responses/turn-termination";
 import {
   isValidProviderContinuationOwner,
   mergeProviderContinuationPayload,
@@ -115,6 +119,7 @@ import {
   resolveAnthropicAccountForSession,
   rotateAnthropicAccountOn429,
 } from "../../oauth/anthropic-routing";
+import { stampOAuthAccountLabel } from "../../providers/label";
 import {
   failoverAccountSnapshot,
   GENERIC_OAUTH_MAX_FAILOVERS_PER_REQUEST,
@@ -2380,6 +2385,10 @@ async function handleResponsesInner(
     threadIdHeader: req.headers.get("thread-id"),
     cursorConversationId: parsed._cursorConversationId,
   });
+  bindTurnTerminationScope(parsed, resolvedConversationId);
+  const rememberKiroDeliveredFinalAnswer = (adapterName: string, response: unknown): void => {
+    if (adapterName === "kiro") rememberDeliveredFinalAnswer(parsed, response);
+  };
   // _clientThreadId remains the routing/continuation identity supplied by Codex. Replay state uses
   // a dedicated raw conversation namespace so mixed headers that carry the same identity still
   // match, and a shared/synthetic session_id cannot coalesce distinct thread/Cursor conversations.
@@ -2841,6 +2850,10 @@ async function handleResponsesInner(
     if (snapshot.projectId) rotatedProvider = { ...rotatedProvider, project: snapshot.projectId };
     route.provider = rotatedProvider;
     if (route.providerName === "kiro") parsed._kiroAuthContext = { ...(snapshot.kiro ?? {}) };
+    // Re-stamp: a request that rotated accounts must be attributed to the account that actually
+    // served it. All three rotation sites funnel through here, so this is the only re-stamp
+    // needed -- and putting it anywhere else would let one of the three drift.
+    stampOAuthAccountLabel(logCtx, route.providerName, route.provider, snapshot.accountId);
     return true;
   };
   const anthropicSessionKey = route.providerName === "anthropic" && route.provider.authMode === "oauth"
@@ -2882,6 +2895,10 @@ async function handleResponsesInner(
         };
         if (isOAuth401ReplayProvider) sentOAuthSnapshot = resolved;
         route.provider = { ...route.provider, apiKey: resolved.accessToken };
+        // Attribution is independent of failover (#2699): stamped from the resolved snapshot
+        // itself, not from inside the `isGenericFailoverProvider` branch below, so a future
+        // narrowing of that predicate cannot silently switch attribution off.
+        stampOAuthAccountLabel(logCtx, route.providerName, route.provider, resolved.accountId);
         // Remember which account actually served this request so a 429 cools THAT one, not
         // whichever account is active by the time the response comes back (#2568).
         if (isGenericFailoverProvider(route.providerName, route.provider)) {
@@ -4440,6 +4457,7 @@ async function handleResponsesInner(
       ...(options.forceEmptyResponseId ? { forceEmptyResponseId: true } : {}),
       onCompletedResponse: (response, providerState) => {
         commitReasoningReplayServingRoute();
+        rememberKiroDeliveredFinalAnswer(adapter.name, response);
         rememberResponseState(
           parsed._rawBody,
           response,
@@ -4755,6 +4773,7 @@ async function handleResponsesInner(
           },
           onCompletedResponse: (response: Record<string, unknown>, providerState?: OcxProviderContinuationState) => {
             commitReasoningReplayServingRoute();
+            rememberKiroDeliveredFinalAnswer(adapter.name, response);
             if (!routedCompaction) {
               rememberResponseState(
                 parsed._rawBody,
@@ -4824,6 +4843,7 @@ async function handleResponsesInner(
       },
     });
     if (!routedCompaction) {
+      rememberKiroDeliveredFinalAnswer(adapter.name, json);
       rememberResponseState(
         parsed._rawBody,
         json,
@@ -4858,6 +4878,64 @@ async function handleResponsesInner(
   // reuse is safe, and releaseBodyObservation is idempotent per build.
   let initialRequest: AdapterRequest | undefined;
   let inputTokenEstimate: number | undefined;
+  // An adapter may know the turn needs no inference at all — Kiro's replayed history ending in a
+  // delivered final answer. Answer it locally: no build (so no token estimate), no send (so
+  // sendCount stays 0), and crucially no empty-completion guard, which treats an outputless
+  // terminal as a failed turn and re-invokes the identical request. Routing this through the
+  // ordinary event path would therefore reinstate the loop it exists to end.
+  const localTerminal = activeAdapter.localTerminal?.(parsed);
+  if (localTerminal) {
+    logCtx.localTerminalReason = localTerminal.reason;
+    // Mark the physical attempt too, not just the parent row. `finishRequestAttempt` finalizes the
+    // attempt through the same estimated-provider path, so without this the row reads exact while
+    // its own attempt still claims an estimate — the detailed accounting a maintainer actually
+    // reads for a zero-send turn.
+    if (logCtx.activeAttempt) logCtx.activeAttempt.locallyAnswered = true;
+    cleanupUpstreamAbort();
+    upstream.abort();
+    const terminalEvents: AdapterEvent[] = [{
+      type: "done",
+      endTurn: true,
+      usage: { inputTokens: 0, outputTokens: 0, totalTokens: 0 },
+    }];
+    if (parsed.stream) {
+      const localSse = bridgeToResponsesSSE(
+        (async function* () { yield* terminalEvents; })(),
+        parsed._responseModelId ?? parsed.modelId,
+        toolBridgeMaps.toolNsMap,
+        toolBridgeMaps.freeformToolNames,
+        toolBridgeMaps.toolSearchToolNames,
+        undefined,
+        2_000,
+        {
+          translatorBudget,
+          ...(options.forceEmptyResponseId ? { responseId: "" } : {}),
+          ...(options.onFirstOutput ? { onFirstOutput: options.onFirstOutput } : {}),
+        },
+      );
+      // Same lifetime tracking as every other streaming return in this function: the turn
+      // admission lease is released when the body finishes or the client disconnects. Returning
+      // the raw stream would hold a lease for a turn that already has all of its output.
+      const localTurnAc = new AbortController();
+      return new Response(
+        trackStreamLifetime(localSse, localTurnAc, undefined, options.turnAdmissionLease),
+        {
+          headers: {
+            "Content-Type": "text/event-stream",
+            "Cache-Control": "no-cache",
+            "Connection": "keep-alive",
+            "X-Accel-Buffering": "no",
+          },
+        },
+      );
+    }
+    return new Response(
+      JSON.stringify(buildResponseJSON(terminalEvents, parsed._responseModelId ?? parsed.modelId, {
+        translatorBudget,
+      })),
+      { headers: { "Content-Type": "application/json" } },
+    );
+  }
   try {
     initialRequest = await activeAdapter.buildRequest(parsed, { headers: selectedForwardHeaders, translatorBudget });
     refreshRoutedNamespaceToolAliases(initialRequest);
@@ -5706,6 +5784,7 @@ async function handleResponsesInner(
         },
         onCompletedResponse: (response: Record<string, unknown>, providerState?: OcxProviderContinuationState) => {
           commitReasoningReplayServingRoute();
+          rememberKiroDeliveredFinalAnswer(activeAdapter.name, response);
           // Compaction turns must NOT enter the continuation cache: _rawBody still holds the full
           // PRE-compaction history, and a later previous_response_id expansion would rehydrate the
           // giant stale chain Codex just replaced.
@@ -5783,6 +5862,7 @@ async function handleResponsesInner(
     });
     // See the streaming branch: compaction turns skip the continuation cache.
     if (!routedCompaction) {
+      rememberKiroDeliveredFinalAnswer(activeAdapter.name, json);
       rememberResponseState(
         parsed._rawBody,
         json,

package/src/service.ts

@@ -19,6 +19,7 @@ import { BUN_RUNTIME_PATH_ENV, BUN_RUNTIME_SOURCE_ENV, durableBunRuntime } from
 import type { BunRuntimeSource } from "./lib/bun-runtime";
 import { isProcessAlive, stopProxy } from "./lib/process-control";
 import { serviceApiTokenFilePath } from "./lib/service-secrets";
+import { tokenCollidesWithAdmin } from "./lib/admin-secrets";
 import { PROXY_ENV_KEYS } from "./lib/proxy-env";
 import { randomUUID } from "node:crypto";
 import {
@@ -366,8 +367,38 @@ export function serviceRetryCommand(
   return diag.installed && !diag.conflict ? "ocx service repair" : "ocx service install";
 }
 
+/**
+ * Refuse a management (admin) token as the data-plane secret.
+ *
+ * The service exports the contents of the service token file as
+ * `OPENCODEX_API_AUTH_TOKEN` before starting the proxy. When that value is the admin
+ * token, the server treats the management credential as a data-plane admission secret
+ * and fails the ENTIRE management plane closed at boot, so every `/api/*` request
+ * returns 503 — even on a loopback install that never needed a data-plane secret.
+ * Exporting the admin token in the CLI cannot recover it, because the fence is decided
+ * server-side at startup (#2696).
+ *
+ * Nothing in this codebase puts an admin token in that env var; it arrives from the
+ * installing shell. This function is the chokepoint that should refuse it rather than
+ * writing a file that produces a broken service. Comparison is the same helper doctor
+ * uses: minted `ocx_admin_…` prefix, or byte-equal to configuredAdminToken (env or file).
+ */
+export function assertNotAdminToken(token: string, env: NodeJS.ProcessEnv = process.env): void {
+  if (!tokenCollidesWithAdmin(token, env)) return;
+  throw new Error(
+    "OPENCODEX_API_AUTH_TOKEN holds a management (admin) token. The service exports it "
+      + "as the data-plane secret, which fences the whole management API closed and makes "
+      + "every ocx management command fail with 503. Unset OPENCODEX_API_AUTH_TOKEN, or set "
+      + "it to a distinct data-plane key, then rerun the install.",
+  );
+}
+
 export function assertServiceAuthEnvironment(): void {
   const config = loadConfig();
+  // Check the collision before the loopback short-circuit: a loopback install writes
+  // the token file too, so returning early here is what let the broken state through.
+  const present = process.env.OPENCODEX_API_AUTH_TOKEN?.trim();
+  if (present) assertNotAdminToken(present);
   if (isLoopbackHostname(config.hostname)) return;
   if (process.env.OPENCODEX_API_AUTH_TOKEN?.trim()) return;
   // Reached from `service repair` as well as `install`, so name a command that can
@@ -383,6 +414,9 @@ export function assertServiceAuthEnvironment(): void {
 function writeServiceApiTokenFile(): string | null {
   const token = process.env.OPENCODEX_API_AUTH_TOKEN?.trim();
   if (!token) return null;
+  // Last line of defence: every install/repair path funnels through here, so a
+  // collision cannot reach disk regardless of which caller ran (#2696).
+  assertNotAdminToken(token);
   const path = serviceApiTokenFilePath();
   const dir = getConfigDir();
   recordOwnedConfigPath(dir, path);

package/src/storage/policy-job.ts

@@ -38,6 +38,7 @@ export interface PolicyJobOutcome {
   freedBytes?: number;
   removed?: number;
   trashDir?: string;
+  metadataPersistenceError?: PolicyRunResult["metadataPersistenceError"];
 }
 
 export interface PolicyJobState {
@@ -238,6 +239,7 @@ export async function abortStorageCleanupPolicyJobAsync(): Promise<void> {
   }
 }
 
+/** Project a run result into the bounded management-API job outcome. */
 function outcomeFromResult(result: PolicyRunResult): PolicyJobOutcome {
   return {
     ok: result.ok,
@@ -248,18 +250,26 @@ function outcomeFromResult(result: PolicyRunResult): PolicyJobOutcome {
     ...(result.freedBytes !== undefined ? { freedBytes: result.freedBytes } : {}),
     ...(result.removed !== undefined ? { removed: result.removed } : {}),
     ...(result.trashDir ? { trashDir: result.trashDir } : {}),
+    ...(result.metadataPersistenceError
+      ? { metadataPersistenceError: result.metadataPersistenceError }
+      : {}),
   };
 }
 
+/** Publish one completed evaluation without losing successful cleanup effects. */
 function applyFinished(result: PolicyRunResult): void {
   // Prefer the latest persisted policy over `result.policy`. The worker (or
   // in-process run) already merged run metadata into disk; a concurrent PUT
   // may also have landed after that write. Re-reading avoids applying a stale
   // start-of-job snapshot when the run skipped without saving.
-  try {
-    livePolicyApply?.(readStorageCleanupPolicyFromConfig());
-  } catch {
-    livePolicyApply?.(result.policy);
+  // A best-effort fallback policy may predate concurrent edits; keep the current
+  // live config untouched when the durable metadata write did not land.
+  if (!result.metadataPersistenceError) {
+    try {
+      livePolicyApply?.(readStorageCleanupPolicyFromConfig());
+    } catch {
+      livePolicyApply?.(result.policy);
+    }
   }
   state = {
     status: "idle",

package/src/storage/policy.ts

@@ -8,7 +8,7 @@
  * Privacy: logs never include host paths, digests of file contents, or secrets.
  */
 import { resolveCodexHomeDir } from "../codex/home";
-import { loadConfig, saveConfigPreservingClaudeCode } from "../config";
+import { loadConfig, mutatePersistedConfig, saveConfigPreservingClaudeCode } from "../config";
 import type { StorageCleanupPolicy } from "../types";
 import {
   computePreviewDigest,
@@ -38,6 +38,7 @@ export function setStorageCleanupPolicyLiveSink(
 
 export type PolicySchedule = StorageCleanupPolicy["schedule"];
 export type PolicyRunReason = "startup" | "schedule" | "manual";
+export type PolicyMetadataPersistenceError = "missing" | "invalid" | "conflict" | "write_failed";
 
 export type PolicySkipReason =
   | "disabled"
@@ -54,6 +55,7 @@ export interface PolicyRunResult {
   freedBytes?: number;
   removed?: number;
   trashDir?: string;
+  metadataPersistenceError?: PolicyMetadataPersistenceError;
   policy: StorageCleanupPolicy;
 }
 
@@ -399,6 +401,21 @@ export type PolicyRunMetadataPatch = {
   lastRun?: StorageCleanupPolicy["lastRun"];
 };
 
+/** Apply only run-owned fields while preserving the supplied policy settings. */
+function applyPolicyRunMetadata(
+  policy: StorageCleanupPolicy,
+  patch: PolicyRunMetadataPatch,
+): StorageCleanupPolicy {
+  let next =
+    patch.nextRun === "defer_busy"
+      ? deferBusy(policy, patch.now)
+      : advanceNextRun(policy, patch.now);
+  if (patch.lastRun) {
+    next = { ...next, lastRun: patch.lastRun };
+  }
+  return next;
+}
+
 /**
  * Reload the latest persisted policy and write only run-owned metadata
  * (`lastRun` / `nextRun`). Preserves concurrent edits to enabled, trigger,
@@ -410,17 +427,57 @@ export function commitPolicyRunMetadata(
   patch: PolicyRunMetadataPatch,
 ): StorageCleanupPolicy {
   const latest = normalizeStorageCleanupPolicy(load());
-  let next =
-    patch.nextRun === "defer_busy"
-      ? deferBusy(latest, patch.now)
-      : advanceNextRun(latest, patch.now);
-  if (patch.lastRun) {
-    next = { ...next, lastRun: patch.lastRun };
-  }
+  const next = applyPolicyRunMetadata(latest, patch);
   save(next);
   return next;
 }
 
+type PolicyRunMetadataCommit = {
+  policy: StorageCleanupPolicy;
+  persistenceError?: PolicyMetadataPersistenceError;
+};
+
+/** Attach the durable metadata outcome without replacing cleanup status or metrics. */
+function withMetadataCommit(
+  result: Omit<PolicyRunResult, "policy" | "metadataPersistenceError">,
+  committed: PolicyRunMetadataCommit,
+): PolicyRunResult {
+  return {
+    ...result,
+    policy: committed.policy,
+    ...(committed.persistenceError ? { metadataPersistenceError: committed.persistenceError } : {}),
+  };
+}
+
+/** Recompute run-owned metadata from the latest config inside the mutation lock. */
+function commitPolicyRunMetadataToConfig(
+  patch: PolicyRunMetadataPatch,
+  fallbackPolicy: StorageCleanupPolicy,
+): PolicyRunMetadataCommit {
+  const unavailable = (reason: PolicyMetadataPersistenceError): PolicyRunMetadataCommit => {
+    console.warn(`[storage-policy] metadata_persist_failed reason=${reason}`);
+    return {
+      policy: applyPolicyRunMetadata(fallbackPolicy, patch),
+      persistenceError: reason,
+    };
+  };
+  try {
+    const outcome = mutatePersistedConfig(config => {
+      const next = applyPolicyRunMetadata(
+        normalizeStorageCleanupPolicy(config.storageCleanupPolicy),
+        patch,
+      );
+      config.storageCleanupPolicy = next;
+      return { changed: true, value: next };
+    });
+    if (outcome.status === "unavailable") return unavailable(outcome.reason);
+    livePolicySink?.(outcome.value);
+    return { policy: outcome.value };
+  } catch {
+    return unavailable("write_failed");
+  }
+}
+
 function logPolicyEvent(message: string): void {
   console.log(`[storage-policy] ${message}`);
 }
@@ -434,8 +491,14 @@ export function runStorageCleanupPolicy(deps: PolicyRunDeps): PolicyRunResult {
   const load = deps.loadPolicy ?? readStorageCleanupPolicyFromConfig;
   const save = deps.savePolicy ?? writeStorageCleanupPolicyToConfig;
   const execute = deps.execute ?? executeArchivedCleanup;
-
   const policy = normalizeStorageCleanupPolicy(load());
+  // Injected stores retain the existing load/save contract. The production path
+  // recomputes metadata from the latest persisted policy inside the config lock.
+  const commitMetadata = deps.loadPolicy !== undefined || deps.savePolicy !== undefined
+    ? (patch: PolicyRunMetadataPatch): PolicyRunMetadataCommit => ({
+        policy: commitPolicyRunMetadata(load, save, patch),
+      })
+    : (patch: PolicyRunMetadataPatch) => commitPolicyRunMetadataToConfig(patch, policy);
 
   if (typeof deps.holdAfterLoadMs === "number" && Number.isFinite(deps.holdAfterLoadMs) && deps.holdAfterLoadMs > 0) {
     Bun.sleepSync(Math.floor(deps.holdAfterLoadMs));
@@ -451,15 +514,15 @@ export function runStorageCleanupPolicy(deps: PolicyRunDeps): PolicyRunResult {
 
   const selection = selectPolicyPreview(policy, deps.codexHome);
   if (selection.archivedBytes <= policy.trigger.archivedBytesOver) {
-    const saved = commitPolicyRunMetadata(load, save, { now, nextRun: "advance" });
+    const committed = commitMetadata({ now, nextRun: "advance" });
     logPolicyEvent("skip under_threshold");
-    return { ok: true, skipped: "under_threshold", policy: saved };
+    return withMetadataCommit({ ok: true, skipped: "under_threshold" }, committed);
   }
 
   if (selection.count === 0) {
-    const saved = commitPolicyRunMetadata(load, save, { now, nextRun: "advance" });
+    const committed = commitMetadata({ now, nextRun: "advance" });
     logPolicyEvent("skip nothing_selected");
-    return { ok: true, skipped: "nothing_selected", policy: saved };
+    return withMetadataCommit({ ok: true, skipped: "nothing_selected" }, committed);
   }
 
   const result = execute({
@@ -473,25 +536,28 @@ export function runStorageCleanupPolicy(deps: PolicyRunDeps): PolicyRunResult {
   });
 
   if (!result.ok && result.error === "codex_busy") {
-    const saved = commitPolicyRunMetadata(load, save, { now, nextRun: "defer_busy" });
+    const committed = commitMetadata({ now, nextRun: "defer_busy" });
     logPolicyEvent("defer codex_busy");
-    return { ok: false, deferred: "codex_busy", error: "codex_busy", policy: saved };
+    return withMetadataCommit({
+      ok: false,
+      deferred: "codex_busy",
+      error: "codex_busy",
+    }, committed);
   }
 
   if (!result.ok) {
     // Non-busy failure: still advance schedule so we do not tight-loop.
-    const saved = commitPolicyRunMetadata(load, save, { now, nextRun: "advance" });
+    const committed = commitMetadata({ now, nextRun: "advance" });
     logPolicyEvent(`fail ${result.error ?? "cleanup_failed"}`);
-    return {
+    return withMetadataCommit({
       ok: false,
       error: result.error,
       mode: result.mode,
       ...(result.trashDir ? { trashDir: result.trashDir } : {}),
-      policy: saved,
-    };
+    }, committed);
   }
 
-  const saved = commitPolicyRunMetadata(load, save, {
+  const committed = commitMetadata({
     now,
     nextRun: "advance",
     lastRun: {
@@ -503,14 +569,13 @@ export function runStorageCleanupPolicy(deps: PolicyRunDeps): PolicyRunResult {
   logPolicyEvent(
     `ok mode=${result.mode} removed=${result.count} freedBytes=${result.bytes}`,
   );
-  return {
+  return withMetadataCommit({
     ok: true,
     mode: result.mode,
     freedBytes: result.bytes,
     removed: result.count,
     ...(result.trashDir ? { trashDir: result.trashDir } : {}),
-    policy: saved,
-  };
+  }, committed);
 }
 
 /** Startup / schedule tick entry — swallows unexpected errors. */

package/src/usage/log.ts

@@ -8,12 +8,33 @@ import { sanitizeLogMetadataString } from "../lib/redact";
 import { usageDisplayTotalTokens } from "./totals";
 import type { AttemptTierOutcome, OcxUsage } from "../types";
 import { normalizeRouteDecisionTrace, type RouteDecisionTraceV1 } from "../routing/trace";
-import { CODEX_ACCOUNT_LOG_LABEL_RE } from "../codex/account-label";
+import { ACCOUNT_LOG_LABEL_RE, CODEX_ACCOUNT_LOG_LABEL_RE } from "../codex/account-label";
 
 export type UsageStatus = "reported" | "unreported" | "unsupported" | "estimated";
-export type CodexUsageAccountLogLabel = "main" | `p${string}`;
+/**
+ * A persisted account label: a Codex pool account (`main`/`p<hex6>`) or a non-Codex OAuth
+ * provider account (`o<hex6>`, #2699).
+ *
+ * The old name `CodexUsageAccountLogLabel` is kept as an alias because it is exported and used
+ * across modules; the two predicates below are what callers should choose between.
+ */
+export type UsageAccountLogLabel = "main" | `p${string}` | `o${string}`;
+export type CodexUsageAccountLogLabel = UsageAccountLogLabel;
+
+/**
+ * Accepts EITHER label family. This is the predicate the persistence writers use, so widening
+ * it here is what stops six separate call sites from silently dropping an `o`-label -- including
+ * two in the live request path (`request-log.ts:972` and `:1187`).
+ *
+ * The name is unchanged deliberately: renaming it would touch every call site for no behavior,
+ * and the widened contract is what every one of those sites wanted.
+ */
+export function isCodexUsageAccountLogLabel(value: unknown): value is UsageAccountLogLabel {
+  return value === "main" || (typeof value === "string" && ACCOUNT_LOG_LABEL_RE.test(value));
+}
 
-export function isCodexUsageAccountLogLabel(value: unknown): value is CodexUsageAccountLogLabel {
+/** Strictly a Codex pool label. Use when the Codex-only distinction actually matters. */
+export function isCodexPoolAccountLogLabel(value: unknown): value is "main" | `p${string}` {
   return value === "main" || (typeof value === "string" && CODEX_ACCOUNT_LOG_LABEL_RE.test(value));
 }
 
@@ -51,6 +72,13 @@ export interface PersistedUsageAttempt {
   sendCount: number;
   recoveryKinds: AttemptRecoveryKind[];
   usageStatus: UsageStatus;
+  /**
+   * True when the proxy answered this turn locally and issued no upstream request. It travels on
+   * the attempt itself rather than as a `finishRequestAttempt` argument because that function is
+   * called from six places, and a new parameter would silently default to the wrong answer at any
+   * one of them that was missed. Absent on ordinary attempts so old rows keep their exact shape.
+   */
+  locallyAnswered?: boolean;
   /** Stable non-PII identity for the Codex pool account that served this attempt. */
   accountLogLabel?: CodexUsageAccountLogLabel;
   inputTokenEstimate?: number;
@@ -181,8 +209,20 @@ function isEstimatedUsageProvider(providerOrAdapter: string): boolean {
     || providerOrAdapter === "cursor" || providerOrAdapter.startsWith("cursor-");
 }
 
-export function usageForFinalLog(provider: string, usage: OcxUsage | undefined): OcxUsage | undefined {
+export function usageForFinalLog(
+  provider: string,
+  usage: OcxUsage | undefined,
+  /**
+   * True when the proxy answered this turn locally and issued no upstream request. Such a turn's
+   * zero counts are EXACT, so the provider-wide estimated marking must not apply: Kiro and Cursor
+   * are marked estimated because their adapters can only guess a real inference's usage, and a
+   * turn with no inference has nothing to guess. Without this, a no-send turn is indistinguishable
+   * from a real one whose usage frame never arrived.
+   */
+  locallyAnswered = false,
+): OcxUsage | undefined {
   if (!usage) return undefined;
+  if (locallyAnswered) return usage;
   if (usage.estimated || isEstimatedUsageProvider(provider)) return { ...usage, estimated: true };
   return usage;
 }

package/src/usage/summary.ts

@@ -684,6 +684,16 @@ function legacyCodexAccountLabel(provider: string): string | null {
   return suffix ?? LEGACY_AMBIGUOUS_ACCOUNT_LABEL;
 }
 
+/**
+ * An explicitly stamped label of EITHER family is authoritative for any provider (#2699).
+ *
+ * No `o`-label branch is needed here: `isCodexUsageAccountLogLabel` now accepts both families,
+ * and adding a second predicate call would be a no-op guarded by a comment claiming otherwise.
+ *
+ * The legacy fallback stays openai-only on purpose. It infers an account from the PROVIDER
+ * string, and inferring for a non-Codex row would merge unrelated accounts under one label --
+ * so an unlabeled xai row is dropped from the account table rather than guessed at.
+ */
 function accountLabelForAttribution(provider: string, explicit: unknown): string | null {
   if (isCodexUsageAccountLogLabel(explicit)) return explicit;
   return legacyCodexAccountLabel(provider);