@bitkyc08/opencodex 2.39.0 → 2.40.0

package/src/types/provider.ts

@@ -106,7 +106,13 @@ export interface ProviderRequestPacingConfig extends RequestPacingRule {
 }
 
 export interface FastWire {
-  kind: "service-tier" | "anthropic-speed";
+  /**
+   * How the provider expresses Fast on the wire. `service-tier` is OpenAI's
+   * `service_tier` request field; `cursor-variant` is a MODEL-VARIANT switch, because
+   * Cursor has no tier field — its fast product is a different model id
+   * (`claude-opus-5-thinking-high-fast`) or a `{id:"fast"}` request parameter for Grok.
+   */
+  kind: "service-tier" | "anthropic-speed" | "cursor-variant";
   /** Canonical tier name to upstream wire spelling. */
   canonicalToWire: Readonly<Record<string, string>>;
   /** Policy for non-canonical caller-provided tier values. */
@@ -168,6 +174,8 @@ export interface OcxProviderConfig {
   alias?: string;
   /** Native model id -> short, slash-free request alias. */
   modelAliases?: Record<string, string>;
+  /** Display-only labels for exact native model ids discovered under this provider. */
+  modelDisplayNames?: Record<string, string>;
   /** Override the global built-in model-alias switch for this provider. */
   defaultAliases?: boolean;
   adapter: string;
@@ -275,6 +283,18 @@ export interface OcxProviderConfig {
    * (current behavior unchanged). Only meaningful for https: base URLs.
   */
   upstreamHttpVersion?: UpstreamHttpVersion;
+  /**
+   * Opt-in upstream Responses WebSocket transport for `openai-responses` requests. When true,
+   * streaming POST turns use the configured Responses path (default `/v1/responses`): forward
+   * providers use `{baseUrl}/responses`, while key-auth providers use `responsesPath` or the
+   * legacy `/v1/responses` fallback. HTTPS providers use wss and are re-encoded to SSE; HTTP
+   * providers continue using SSE, and `openai-chat` requests stay on HTTP. This mirrors the
+   * canonical ChatGPT backend optimization for any OpenAI-compatible gateway that speaks the
+   * Responses WebSocket protocol (for example an aggregator like sub2api whose WS ingress is
+   * measurably faster than its SSE queue). Default false. Canonical ChatGPT backend WS selection
+   * is independent of this flag.
+   */
+  upstreamWebsocket?: boolean;
   /**
    * Google only. When `false`, the AI Studio (direct) path sends Gemini Flash ids
    * unchanged to the wire instead of applying the `-tiered` suffix (`gemini-3.7-flash`
@@ -319,6 +339,16 @@ export interface OcxProviderConfig {
    * full set so the user can pick). See devlog issue_052_provider-model-allowlist.
    */
   selectedModels?: string[];
+  /**
+   * Per-provider retention allowlist for authoritative live discovery. When non-empty, any
+   * model id in this list is preserved in the routed catalog even if the live `/models`
+   * endpoint omits it (ad-hoc / private providers whose live discovery drops callable ids).
+   * Mirrors the built-in `kimi`/`xai` compatibility tables — opt-in for every other provider.
+   * Ids listed here need not be repeated in `models`: discovery folds them into the configured
+   * seed, so they exist under `liveModels: false` too. `selectedModels` still narrows what is
+   * visible. Empty/undefined = no opt-in (default behavior). See #1690.
+   */
+  retainModels?: string[];
   /** Override for newly discovered models. Absent/"inherit" uses the install policy. */
   newModelPolicy?: "on" | "off" | "inherit";
   /**
@@ -402,6 +432,13 @@ export interface OcxProviderConfig {
    */
   oauthAccountFailover?: {
     enabled?: boolean;
+    /**
+     * Generic OAuth pool selection strategy (#695). Persisted through the pool-settings
+     * contract; the selector does not consume it yet, so omitted keeps today's behavior.
+     */
+    strategy?: "quota" | "round-robin" | "fill-first";
+    /** 0-100 usage percent at which a proactive switch may be considered (#695); inert today. */
+    autoSwitchThreshold?: number;
   };
   /** Allow an explicitly key/oauth provider to run without a credential (for keyless local proxies). */
   keyOptional?: boolean;
@@ -504,6 +541,14 @@ export interface OcxProviderConfig {
    * per-model compatibility escape hatch for mixed-capability gateways.
    */
   noStructuredOutputModels?: string[];
+  /**
+   * Model ids that accept a reasoning-effort field on an ordinary turn but reject it
+   * once function tools are present. The model keeps its advertised effort ladder;
+   * OpenCodex omits the wire field for tool-bearing requests only and lets the
+   * upstream default apply. Narrower than `noReasoningModels`, which strips reasoning
+   * from every request and costs the model its picker entirely.
+   */
+  omitReasoningEffortWithToolsModels?: string[];
   /**
    * Allow multiple tool calls per completion. DEFAULT-ON for openai-chat providers (the
    * buffered stream parser assembles interleaved/fragmented multi-call turns safely);
@@ -596,6 +641,14 @@ export interface OcxProviderConfig {
    * thinking separately in `reasoning_content` / `reasoning_details` instead of visible content.
    */
   reasoningSplitModels?: string[];
+  /**
+   * Model ids whose chat endpoint carries thinking as a structured `reasoning_details` array
+   * (MiniMax M-series with `reasoning_split`): stream deltas repeat each detail's `text` as a
+   * cumulative snapshot, so the adapter prefix-diffs instead of appending, and preserved
+   * reasoning replays as a `reasoning_details` array rather than a `reasoning_content` string
+   * (upstream requires the array back verbatim to keep interleaved thinking intact).
+   */
+  reasoningDetailsModels?: string[];
   /**
    * Model ids whose reasoning is a vendor `thinking: {type}` toggle on the
    * chat-completions wire (MiMo v2.x, GLM 5/5.1 style), NOT an OpenAI `reasoning_effort` ladder.

package/src/types/request.ts

@@ -333,6 +333,8 @@ export type AdapterEvent =
   | {
       type: "done";
       usage?: OcxUsage;
+      /** Native opaque compaction ciphertext returned by a Responses backend. */
+      compactionEncryptedContent?: string;
       stopReason?: string;
       endTurn?: boolean;
       providerState?: OcxProviderContinuationState;

package/src/types.ts

@@ -63,11 +63,16 @@ export type {
   OcxApiKeyEntry,
   OcxClientIntegrationsConfig,
   OcxConfigRebaseProvenance,
+  OcxHubConfig,
+  OcxRemoteGuiConfig,
+  OcxConnectedClientId,
+  OcxClientConnectionConfig,
   OcxConfig,
   OcxAccountPoolRotationStrategy,
   OcxAccountPoolQuotaWindow,
   OcxComboStrategy,
   OcxComboDefaultEffort,
+  OcxComboReasoningEffortMode,
   OcxComboTarget,
   OcxComboConfig,
   OcxRoutingUnknownEvidenceMode,

package/src/update/job.ts

@@ -51,6 +51,11 @@ const RELEASE_NOTES_URL = "https://github.com/lidge-jun/opencodex/releases/lates
 const UPDATE_JOB_FILENAME = "update-job.json";
 const UPDATE_TIMEOUT_MS = 180_000;
 const RESTART_TIMEOUT_MS = 60_000;
+// A Windows `service repair` can spend up to 45s in its own serving probe after
+// Task Scheduler/ACL work. The generic 60s child ceiling can kill that valid repair
+// and launch a competing foreground proxy. Keep this below the update worker's 180s
+// ceiling while covering the measured probe plus bounded Windows setup work.
+const WINDOWS_SERVICE_REPAIR_TIMEOUT_MS = 150_000;
 const RESTART_HEALTH_TIMEOUT_MS = 30_000;
 const RESTART_STABILITY_WINDOW_MS = 15_000;
 /** Legacy active records did not persist a worker PID, so age is their only safe recovery signal. */
@@ -687,7 +692,12 @@ export function startUpdateJob(
  * and a bounded, structured summary — enough to tell a user which step failed and how, with no
  * free-form vendor text passing through the boundary. Detailed output stays ephemeral.
  */
-function runLoggedCommand(job: UpdateJobState, bin: string, args: string[], timeout: number): { status: number | null; signal: NodeJS.Signals | null } {
+function runLoggedCommand(
+  job: UpdateJobState,
+  bin: string,
+  args: string[],
+  timeout: number,
+): { status: number | null; signal: NodeJS.Signals | null; timedOut: boolean } {
   job = updateJob(job, {}, `$ ${formatCommand(bin, args)}`);
   const result = spawnSync(bin, args, {
     encoding: "utf8",
@@ -698,7 +708,11 @@ function runLoggedCommand(job: UpdateJobState, bin: string, args: string[], time
   const stderr = typeof result.stderr === "string" ? result.stderr.trim() : "";
   const summary = summarizeCommandOutput(stdout, stderr, result.status, result.signal);
   if (summary) updateJob(job, {}, summary);
-  return { status: result.status, signal: result.signal };
+  return {
+    status: result.status,
+    signal: result.signal,
+    timedOut: (result.error as NodeJS.ErrnoException | undefined)?.code === "ETIMEDOUT",
+  };
 }
 
 /**
@@ -987,7 +1001,8 @@ export interface RestartIo {
     job: UpdateJobState,
     bin: string,
     args: string[],
-  ) => { status: number | null; signal?: NodeJS.Signals | null };
+    timeoutMs: number,
+  ) => { status: number | null; signal?: NodeJS.Signals | null; timedOut?: boolean };
   /** Override the explicit restart path (used by finishGuiUpdateRestart tests). */
   restartAfterUpdateFn?: (
     job: UpdateJobState,
@@ -1155,10 +1170,23 @@ async function restartAfterUpdate(
       process.env.OCX_BAKE_PORT = String(Math.trunc(port));
       let serviceOk = false;
       try {
-        const run = io.runService ?? ((j, bin, args) => runLoggedCommand(j, bin, args, RESTART_TIMEOUT_MS));
-        const result = run(job, cmd.bin, cmd.args);
+        const repairTimeoutMs = (io.platform ?? process.platform) === "win32"
+          ? WINDOWS_SERVICE_REPAIR_TIMEOUT_MS
+          : RESTART_TIMEOUT_MS;
+        const run = io.runService ?? ((j, bin, args, timeoutMs) => runLoggedCommand(j, bin, args, timeoutMs));
+        const result = run(job, cmd.bin, cmd.args, repairTimeoutMs);
         serviceOk = result.status === 0;
         if (!serviceOk) {
+          if (result.timedOut) {
+            // UAC and scheduler mutation can outlive a fixed child deadline. Once the
+            // worker kills that child, ownership is ambiguous: launching a foreground
+            // proxy here can race a registration that completes moments later.
+            updateJob(job, {}, "Service repair timed out with Task Scheduler state unknown; refusing a competing direct start.");
+            throw new Error(
+              "Service repair timed out with Task Scheduler state unknown; refusing a competing direct start. "
+              + "Run 'ocx service status', then 'ocx service repair' by hand.",
+            );
+          }
           // The refresh that just failed was `ocx service repair` (serviceReinstallArgs).
           // It normally reuses a healthy registration, but a stale definition may have tried
           // guarded re-registration/elevation. Advising `install` here would unconditionally

package/src/usage/cost.ts

@@ -319,7 +319,8 @@ function resolveModelLevelPrice(provider: string, modelId: string): MatchedPrice
   // dots where the catalog uses dashes (kiro "claude-opus-4.6" vs anthropic
   // "claude-opus-4-6"). No fuzzy matching beyond this one normalization.
   const found = findVendorCostByModelId(modelId)
-    ?? (modelId.includes(".") ? findVendorCostByModelId(modelId.replaceAll(".", "-")) : undefined);
+    ?? (modelId.includes(".") ? findVendorCostByModelId(modelId.replaceAll(".", "-")) : undefined)
+    ?? vendorPrefixedCost(modelId);
   if (!found) return null;
   return {
     provider,
@@ -331,6 +332,36 @@ function resolveModelLevelPrice(provider: string, modelId: string): MatchedPrice
   };
 }
 
+/**
+ * Aggregators spell a model as `<vendor>/<model>` — CommandCode serves
+ * `deepseek/deepseek-v4-flash`, and OpenRouter-shaped presets do the same. The cost
+ * catalog stores the bare id, so the exact lookup above misses a price that is present and
+ * every request through such a provider reports no cost at all (#3136).
+ *
+ * Retrying on the tail is only safe while the prefix AGREES with the vendor the matched row
+ * belongs to. `findVendorCostByModelId` returns whichever vendor `COST_VENDOR_PRIORITY`
+ * reaches first, so an unchecked strip would happily price `openai/claude-opus-4-6` from
+ * Anthropic's row — a number that looks authoritative and is wrong. Requiring agreement
+ * keeps the failure closed for a genuinely mismatched id.
+ *
+ * Comparison is normalized because the same vendor is spelled differently across catalogs:
+ * `x-ai/grok-4.6` resolves to vendor `xai`. Dashes and case are the only variance seen;
+ * anything beyond that stays a miss.
+ */
+function vendorPrefixedCost(modelId: string): ReturnType<typeof findVendorCostByModelId> {
+  const slash = modelId.indexOf("/");
+  if (slash <= 0 || slash === modelId.length - 1) return undefined;
+  const claimedVendor = modelId.slice(0, slash);
+  const tail = modelId.slice(slash + 1);
+  // A tail that is itself slashed is not a vendor prefix we understand; leave it alone.
+  if (tail.includes("/")) return undefined;
+  const found = findVendorCostByModelId(tail)
+    ?? (tail.includes(".") ? findVendorCostByModelId(tail.replaceAll(".", "-")) : undefined);
+  if (!found) return undefined;
+  const normalize = (value: string): string => value.toLowerCase().replaceAll("-", "");
+  return normalize(found.provider) === normalize(claimedVendor) ? found : undefined;
+}
+
 function isEstimated(usage: OcxUsage, usageStatus: UsageStatus, priceStatus: ExpectedPriceStatus | "verified"): boolean {
   return usage.estimated === true || usageStatus === "estimated" || priceStatus === "verified-derived";
 }

package/src/usage/expected-prices.ts

@@ -66,6 +66,10 @@ const QWEN38_MAX: Cost4 = { input: 2, output: 6, cacheRead: 0, cacheWrite: 0 };
 // Anthropic official list prices (USD / 1M tokens). Cache write uses the published 5-minute rate.
 const CLAUDE_SONNET_46: Cost4 = { input: 3, output: 15, cacheRead: 0.3, cacheWrite: 3.75 };
 const CLAUDE_OPUS_46: Cost4 = { input: 5, output: 25, cacheRead: 0.5, cacheWrite: 6.25 };
+// Claude Fable 5.1: 10 / 50, 5m cache write 12.50. Cache hits are 0.025x base input
+// (0.25) on Fable 5.1 — NOT the 0.1x (1.00) that Fable 5 and every other family use;
+// the pricing page footnote calls this out explicitly. Verified 2026-09-02.
+const CLAUDE_FABLE_51: Cost4 = { input: 10, output: 50, cacheRead: 0.25, cacheWrite: 12.5 };
 // Opus 5 is priced from the maintainer's confirmation that it matches the previous
 // Opus, not from a published Opus 5 page. Hence `verified-derived`, and a source
 // string that states the provenance instead of pointing at ANTHROPIC_PRICING.
@@ -91,6 +95,18 @@ const KIMI_PRICING = "https://platform.kimi.ai/docs/pricing (official table; cac
 const QWEN38_MAX_PRICING = "https://qwen.ai/blog?id=qwen3.8 (Qwen release announcement; no Model Studio billing row yet; cache rates unpublished -> 0)";
 
 export const EXPECTED_PRICE_OVERLAYS: readonly ExpectedPriceOverlay[] = [
+  // claude-fable-5-1 has no jawcode row yet, so both Anthropic surfaces need their own
+  // overlay (the overlay lookup is keyed by the configured provider id; only the jawcode
+  // bundle collapses anthropic-apikey onto anthropic).
+  { provider: "anthropic", modelId: "claude-fable-5-1", cost4: CLAUDE_FABLE_51, source: `anthropic official Claude Fable 5.1 ${ANTHROPIC_PRICING}; cache hit = 0.025x base input`, verifiedAt: "2026-09-02", status: "verified" },
+  { provider: "anthropic-apikey", modelId: "claude-fable-5-1", cost4: CLAUDE_FABLE_51, source: `anthropic official Claude Fable 5.1 ${ANTHROPIC_PRICING}; cache hit = 0.025x base input`, verifiedAt: "2026-09-02", status: "verified" },
+  // Cursor seeds Fable 5.1 preemptively under three spellings (adapters/cursor/catalog.ts);
+  // the model-level vendor fallback only searches jawcode metadata, which has no Fable 5.1
+  // row yet, so each Cursor spelling needs its own overlay. Vendor list price, like the
+  // cursor/claude-opus-5 row.
+  { provider: "cursor", modelId: "claude-fable-5-1", cost4: CLAUDE_FABLE_51, source: `anthropic official Claude Fable 5.1 ${ANTHROPIC_PRICING}; cache hit = 0.025x base input; vendor list price applied to the Cursor surface`, verifiedAt: "2026-09-02", status: "verified-derived" },
+  { provider: "cursor", modelId: "claude-fable-5.1", cost4: CLAUDE_FABLE_51, source: `anthropic official Claude Fable 5.1 ${ANTHROPIC_PRICING}; cache hit = 0.025x base input; vendor list price applied to the Cursor surface`, verifiedAt: "2026-09-02", status: "verified-derived" },
+  { provider: "cursor", modelId: "claude-5.1-fable", cost4: CLAUDE_FABLE_51, source: `anthropic official Claude Fable 5.1 ${ANTHROPIC_PRICING}; cache hit = 0.025x base input; vendor list price applied to the Cursor surface`, verifiedAt: "2026-09-02", status: "verified-derived" },
   // claude-opus-5 is exposed by three providers but absent from the jawcode bundle, so
   // cost resolution returned null and the Logs `~$` column rendered an em dash. The
   // model-level vendor fallback only searches jawcode metadata, never overlays, so one

package/src/usage/log.ts

@@ -322,7 +322,8 @@ function normalizeAttemptTierOutcome(raw: unknown): AttemptTierOutcome | null {
   if ("wireKind" in outcome
     && outcome.wireKind !== null
     && outcome.wireKind !== "service-tier"
-    && outcome.wireKind !== "anthropic-speed") return null;
+    && outcome.wireKind !== "anthropic-speed"
+    && outcome.wireKind !== "cursor-variant") return null;
   if ("wireValue" in outcome && outcome.wireValue !== null && typeof outcome.wireValue !== "string") return null;
   if ("fastDowngradeReason" in outcome
     && (typeof outcome.fastDowngradeReason !== "string"
@@ -337,7 +338,10 @@ function normalizeAttemptTierOutcome(raw: unknown): AttemptTierOutcome | null {
   const responseServiceTier = sanitizeLogMetadataString(outcome.responseServiceTier);
   return {
     ...(outcome.canonical === "priority" ? { canonical: "priority" as const } : {}),
-    ...(outcome.wireKind === null || outcome.wireKind === "service-tier" || outcome.wireKind === "anthropic-speed"
+    ...(outcome.wireKind === null
+      || outcome.wireKind === "service-tier"
+      || outcome.wireKind === "anthropic-speed"
+      || outcome.wireKind === "cursor-variant"
       ? { wireKind: outcome.wireKind }
       : {}),
     ...(outcome.wireValue === null

package/src/usage/summary.ts

@@ -156,6 +156,7 @@ export interface UsageSummary {
 export interface UsageFilterEcho {
   provider: string | null;
   model: string | null;
+  apiKeyId: string | null;
   matched: boolean;
   /**
    * True when a retained row came from a combo attribution. Cost partitions
@@ -1129,6 +1130,11 @@ function normalizeFilterValue(input: string | null | undefined): string | null {
   return trimmed === "" ? null : trimmed.toLowerCase();
 }
 
+function normalizeExactFilterValue(input: string | null | undefined): string | null {
+  const trimmed = typeof input === "string" ? input.trim() : "";
+  return trimmed === "" ? null : trimmed;
+}
+
 /**
  * Narrow an already-summarised window to one provider and/or model.
  *
@@ -1152,23 +1158,51 @@ function normalizeFilterValue(input: string | null | undefined): string | null {
  */
 export function projectUsageSummary<T extends UsageSummary>(
   summary: T,
-  filter: { provider?: string | null; model?: string | null },
+  filter: { provider?: string | null; model?: string | null; apiKeyId?: string | null },
   entries?: PersistedUsageEntry[],
 ): T & { filter?: UsageFilterEcho } {
   const provider = normalizeFilterValue(filter.provider);
   const model = normalizeFilterValue(filter.model);
-  if (provider === null && model === null) return summary;
+  const apiKeyId = normalizeExactFilterValue(filter.apiKeyId);
+  if (provider === null && model === null && apiKeyId === null) return summary;
+
+  // Re-summarise from the entries the summary was built from, rather than
+  // projecting over its rows.
+  //
+  // Projecting rows looked cheaper and was wrong in three ways that only show
+  // up together: breakdown rows past MAX_USAGE_MODEL_BREAKDOWN_ROWS are
+  // collapsed into a synthetic "other" row, so a provider living only in that
+  // tail is unfindable and reports matched:false despite real usage; a
+  // provider row is a whole-provider aggregate, so a model filter kept the
+  // provider's OTHER models in providers[] while models[] and the totals
+  // excluded them, contradicting itself inside one response; and a model row
+  // carries a single optional cost, so priced/unpriced/unmetered counts could
+  // only be guessed per model rather than counted per request.
+  //
+  // Key ownership is the outer slice: no provider/model attribution or bucket
+  // construction may observe rows belonging to another client key.
+  const keyFilteredEntries = apiKeyId === null
+    ? entries ?? []
+    : (entries ?? []).filter(entry => entry.apiKeyId === apiKeyId);
 
+  // The entries are already in hand on every path that filters, so the honest
+  // computation is also the simple one.
   const matches = (rowProvider: string, rowModel: string): boolean => {
     if (provider !== null && baseProviderLabel(rowProvider).toLowerCase() !== provider) return false;
     if (model !== null && rowModel.toLowerCase() !== model) return false;
     return true;
   };
 
-  const source = entries ?? [];
+  // Narrow to matching ATTRIBUTIONS, not matching entries.
+  //
+  // Keeping a whole combo entry because one of its attempts matched drags the
+  // other attempts' tokens and cost into the filtered totals: a two-attempt
+  // combo filtered to its cheap model reported the expensive model's spend
+  // too. Rewriting the entry down to its matching attempts is what makes the
+  // filtered numbers mean what the flag says.
   let comboOverlap = false;
   const filtered: PersistedUsageEntry[] = [];
-  for (const entry of source) {
+  for (const entry of keyFilteredEntries) {
     if (!entry.attempts?.length) {
       const identity = usageModelIdentity(entry.provider, entry.model, entry.resolvedModel);
       if (matches(entry.provider, identity.model)) filtered.push(entry);
@@ -1194,7 +1228,15 @@ export function projectUsageSummary<T extends UsageSummary>(
     days: projected.days.map(day => ({ ...day, models: day.models.filter(row => matches(row.provider, row.model)) })),
     models,
     providers: projected.providers.filter(row => retainedProviders.has(row.provider)),
-    accounts: [],
-    filter: { provider, model, matched, comboOverlap },
+    // Account rows are not provider-partitioned in a way this projection could
+    // honestly re-derive, and unfiltered account totals sitting beside filtered
+    // model totals would invite exactly the wrong reading — so a provider or model
+    // filter drops them.
+    //
+    // An apiKeyId-only filter is different: it selects whole entries, so the account
+    // rows projected from those entries are exactly the accounts that key used. They
+    // are honest under that filter and are kept.
+    accounts: provider === null && model === null ? projected.accounts : [],
+    filter: { provider, model, apiKeyId, matched, comboOverlap },
   };
 }