@bitkyc08/opencodex 2.40.0 → 2.42.0

package/src/generated/model-metadata.ts

@@ -42,7 +42,7 @@ const DATA: Record<string, readonly Row[]> = {
   "azure-openai": [["gpt-4.1",1047576,32768,"text,image",0,null,2,8,0.5,0],["gpt-4o",128000,16384,"text,image",0,null,2.5,10,1.25,0],["gpt-4o-mini",128000,16384,"text,image",0,null,0.15,0.6,0.075,0],["o3",200000,100000,"text,image",1,null,2,8,0.5,0],["o3-mini",200000,100000,"text",1,null,1.1,4.4,0.55,0]],
   "cerebras": [["gemma-4-31b",131072,40960,"text,image",1,null,0.99,1.49,0,0],["gpt-oss-120b",131072,40960,"text",1,null,0.35,0.75,0,0],["llama3.1-8b",32000,8000,"text",0,null,0.1,0.1,0,0],["qwen-3-235b-a22b-instruct-2507",131000,32000,"text",0,null,0.6,1.2,0,0],["qwen-3-coder-480b",131072,32768,"text",0,null,0,0,0,0],["zai-glm-4.6",131072,32768,"text",0,null,0,0,0,0],["zai-glm-4.7",131072,40960,"text",1,null,2.25,2.75,2.25,0]],
   "deepseek": [["deepseek-v4-flash",1048576,384000,"text",1,null,0.14,0.28,0.0028,0],["deepseek-v4-pro",1048576,384000,"text",1,null,0.435,0.87,0.003625,0]],
-  "google": [["deep-research-max-preview-04-2026",131072,65536,"text,image",1,null,2,12,0.2,0],["deep-research-preview-04-2026",131072,65536,"text,image",1,null,2,12,0.2,0],["gemini-1.5-flash",1000000,8192,"text,image",0,null,0.075,0.3,0.01875,0],["gemini-1.5-flash-8b",1000000,8192,"text,image",0,null,0.0375,0.15,0.01,0],["gemini-1.5-pro",1000000,8192,"text,image",0,null,1.25,5,0.3125,0],["gemini-2.0-flash",1048576,8192,"text,image",0,null,0.1,0.4,0.025,0],["gemini-2.0-flash-lite",1048576,8192,"text,image",0,null,0.075,0.3,0,0],["gemini-2.5-computer-use-preview-10-2025",131072,65536,"text,image",1,null,1.25,10,0,0],["gemini-2.5-flash",1048576,65536,"text,image",1,null,0.3,2.5,0.03,0],["gemini-2.5-flash-lite",1048576,65536,"text,image",1,null,0.1,0.4,0.01,0],["gemini-2.5-flash-lite-preview-06-17",1048576,65536,"text,image",1,null,0.1,0.4,0.025,0],["gemini-2.5-flash-lite-preview-09-2025",1048576,65536,"text,image",1,null,0.1,0.4,0.025,0],["gemini-2.5-flash-preview-04-17",1048576,65536,"text,image",1,null,0.15,0.6,0.0375,0],["gemini-2.5-flash-preview-05-20",1048576,65536,"text,image",1,null,0.15,0.6,0.0375,0],["gemini-2.5-flash-preview-09-2025",1048576,65536,"text,image",1,null,0.3,2.5,0.075,0],["gemini-2.5-pro",1048576,65536,"text,image",1,null,1.25,10,0.125,0],["gemini-2.5-pro-preview-05-06",1048576,65536,"text,image",1,null,1.25,10,0.31,0],["gemini-2.5-pro-preview-06-05",1048576,65536,"text,image",1,null,1.25,10,0.31,0],["gemini-3-flash-preview",1048576,65536,"text,image",1,null,0.5,3,0.05,0],["gemini-3-pro-preview",1048576,65536,"text,image",1,null,2,12,0.2,0],["gemini-3.1-flash-lite",1048576,65536,"text,image",1,null,0.25,1.5,0.025,0],["gemini-3.1-flash-lite-image",65536,65536,"text,image",1,null,0.25,30,0,0],["gemini-3.1-flash-lite-preview",1048576,65536,"text,image",1,null,0.25,1.5,0.025,0],["gemini-3.1-flash-live-preview",131072,65536,"text,image",1,null,0.75,4.5,0,0],["gemini-3.1-pro-preview",1048576,65536,"text,image",1,null,2,12,0.2,0],["gemini-3.1-pro-preview-customtools",1048576,65536,"text,image",1,null,2,12,0.2,0],["gemini-3.5-flash",1048576,65536,"text,image",1,null,1.5,9,0.15,0],["gemini-3.5-flash-lite",1048576,65536,"text,image",1,null,0.3,2.5,0.03,0],["gemini-3.6-flash",1048576,65536,"text,image",1,null,1.5,7.5,0.15,0],["gemini-3.7-flash",1048576,65536,"text,image",1],["gemini-flash-latest",1048576,65536,"text,image",1,null,1.5,9,0.15,0],["gemini-flash-lite-latest",1048576,65536,"text,image",1,null,0.25,1.5,0.025,0],["gemini-live-2.5-flash",128000,8000,"text,image",1,null,0.5,2,0,0],["gemini-live-2.5-flash-preview-native-audio",131072,65536,"text",1,null,0.5,2,0,0],["gemini-robotics-er-1.6-preview",131072,65536,"text,image",1,null,1,5,0,0],["gemma-3-27b-it",131072,8192,"text,image",0,null,0,0,0,0],["gemma-4-26b",256000,8192,"text,image",1,null,0,0,0,0],["gemma-4-26b-a4b-it",262144,32768,"text,image",1,null,0,0,0,0],["gemma-4-26b-it",256000,8192,"text,image",1,null,0,0,0,0],["gemma-4-31b",256000,8192,"text,image",1,null,0,0,0,0],["gemma-4-31b-it",262144,32768,"text,image",1,null,0,0,0,0],["gemma-4-E2B-it",131072,8192,"text,image",1,null,0,0,0,0],["gemma-4-E4B-it",131072,8192,"text,image",1,null,0,0,0,0]],
+  "google": [["deep-research-max-preview-04-2026",131072,65536,"text,image",1,null,2,12,0.2,0],["deep-research-preview-04-2026",131072,65536,"text,image",1,null,2,12,0.2,0],["gemini-1.5-flash",1000000,8192,"text,image",0,null,0.075,0.3,0.01875,0],["gemini-1.5-flash-8b",1000000,8192,"text,image",0,null,0.0375,0.15,0.01,0],["gemini-1.5-pro",1000000,8192,"text,image",0,null,1.25,5,0.3125,0],["gemini-2.0-flash",1048576,8192,"text,image",0,null,0.1,0.4,0.025,0],["gemini-2.0-flash-lite",1048576,8192,"text,image",0,null,0.075,0.3,0,0],["gemini-2.5-computer-use-preview-10-2025",131072,65536,"text,image",1,null,1.25,10,0,0],["gemini-2.5-flash",1048576,65536,"text,image",1,null,0.3,2.5,0.03,0],["gemini-2.5-flash-lite",1048576,65536,"text,image",1,null,0.1,0.4,0.01,0],["gemini-2.5-flash-lite-preview-06-17",1048576,65536,"text,image",1,null,0.1,0.4,0.025,0],["gemini-2.5-flash-lite-preview-09-2025",1048576,65536,"text,image",1,null,0.1,0.4,0.025,0],["gemini-2.5-flash-preview-04-17",1048576,65536,"text,image",1,null,0.15,0.6,0.0375,0],["gemini-2.5-flash-preview-05-20",1048576,65536,"text,image",1,null,0.15,0.6,0.0375,0],["gemini-2.5-flash-preview-09-2025",1048576,65536,"text,image",1,null,0.3,2.5,0.075,0],["gemini-2.5-pro",1048576,65536,"text,image",1,null,1.25,10,0.125,0],["gemini-2.5-pro-preview-05-06",1048576,65536,"text,image",1,null,1.25,10,0.31,0],["gemini-2.5-pro-preview-06-05",1048576,65536,"text,image",1,null,1.25,10,0.31,0],["gemini-3-flash-preview",1048576,65536,"text,image",1,null,0.5,3,0.05,0],["gemini-3-pro-preview",1048576,65536,"text,image",1,null,2,12,0.2,0],["gemini-3.1-flash-lite",1048576,65536,"text,image",1,null,0.25,1.5,0.025,0],["gemini-3.1-flash-lite-image",65536,65536,"text,image",1,null,0.25,30,0,0],["gemini-3.1-flash-lite-preview",1048576,65536,"text,image",1,null,0.25,1.5,0.025,0],["gemini-3.1-flash-live-preview",131072,65536,"text,image",1,null,0.75,4.5,0,0],["gemini-3.1-pro-preview",1048576,65536,"text,image",1,null,2,12,0.2,0],["gemini-3.1-pro-preview-customtools",1048576,65536,"text,image",1,null,2,12,0.2,0],["gemini-3.5-flash",1048576,65536,"text,image",1,null,1.5,9,0.15,0],["gemini-3.5-flash-lite",1048576,65536,"text,image",1,null,0.3,2.5,0.03,0],["gemini-3.6-flash",1048576,65536,"text,image",1,null,1.5,7.5,0.15,0],["gemini-3.7-flash",1048576,65536,"text,image",1],["gemini-3.8-flash",1048576,65536,"text,image",1],["gemini-flash-latest",1048576,65536,"text,image",1,null,1.5,9,0.15,0],["gemini-flash-lite-latest",1048576,65536,"text,image",1,null,0.25,1.5,0.025,0],["gemini-live-2.5-flash",128000,8000,"text,image",1,null,0.5,2,0,0],["gemini-live-2.5-flash-preview-native-audio",131072,65536,"text",1,null,0.5,2,0,0],["gemini-robotics-er-1.6-preview",131072,65536,"text,image",1,null,1,5,0,0],["gemma-3-27b-it",131072,8192,"text,image",0,null,0,0,0,0],["gemma-4-26b",256000,8192,"text,image",1,null,0,0,0,0],["gemma-4-26b-a4b-it",262144,32768,"text,image",1,null,0,0,0,0],["gemma-4-26b-it",256000,8192,"text,image",1,null,0,0,0,0],["gemma-4-31b",256000,8192,"text,image",1,null,0,0,0,0],["gemma-4-31b-it",262144,32768,"text,image",1,null,0,0,0,0],["gemma-4-E2B-it",131072,8192,"text,image",1,null,0,0,0,0],["gemma-4-E4B-it",131072,8192,"text,image",1,null,0,0,0,0]],
   "minimax": [["MiniMax-M2",196608,128000,"text",1,null,0.3,1.2,0,0],["MiniMax-M2.1",204800,131072,"text",1,null,0.3,1.2,0,0],["MiniMax-M2.5",204800,131072,"text",1,null,0.3,1.2,0.03,0.375],["MiniMax-M2.5-highspeed",204800,131072,"text",1,null,0.6,2.4,0.06,0.375],["MiniMax-M2.5-lightning",204800,32000,"text",1,null,0.3,2.4,0,0],["MiniMax-M2.7",204800,131072,"text",1,null,0.3,1.2,0.06,0.375],["MiniMax-M2.7-highspeed",204800,131072,"text",1,null,0.6,2.4,0.06,0.375],["minimax-m3",512000,128000,"text,image",1,null,0.6,2.4,0.12,0],["MiniMax-M3",1000000,128000,"text,image,video",1,null,0.3,1.2,0.06,0]],
   "mistral": [["codestral-latest",256000,4096,"text",0,null,0.3,0.9,0,0],["devstral-2512",262144,262144,"text",0,null,0.4,2,0,0],["devstral-latest",262144,262144,"text",0,null,0.4,2,0,0],["devstral-medium-2507",128000,128000,"text",0,null,0.4,2,0,0],["devstral-medium-latest",262144,262144,"text",0,null,0.4,2,0,0],["devstral-small-2505",128000,128000,"text",0,null,0.1,0.3,0,0],["devstral-small-2507",128000,128000,"text",0,null,0.1,0.3,0,0],["labs-devstral-small-2512",256000,256000,"text,image",0,null,0,0,0,0],["magistral-medium-latest",128000,16384,"text",1,null,2,5,0,0],["magistral-small",128000,128000,"text",1,null,0.5,1.5,0,0],["ministral-3b-latest",128000,128000,"text",0,null,0.04,0.04,0,0],["ministral-8b-latest",128000,128000,"text",0,null,0.1,0.1,0,0],["mistral-large-2411",131072,16384,"text",0,null,2,6,0,0],["mistral-large-2512",262144,262144,"text,image",0,null,0.5,1.5,0,0],["mistral-large-latest",262144,262144,"text,image",0,null,0.5,1.5,0,0],["mistral-medium-2505",131072,131072,"text,image",0,null,0.4,2,0,0],["mistral-medium-2508",262144,262144,"text,image",0,null,0.4,2,0,0],["mistral-medium-2604",262144,262144,"text,image",1,null,1.5,7.5,0,0],["mistral-medium-latest",262144,262144,"text,image",1,null,1.5,7.5,0,0],["mistral-nemo",128000,128000,"text",0,null,0.15,0.15,0,0],["mistral-small-2506",128000,16384,"text,image",0,null,0.1,0.3,0,0],["mistral-small-2603",256000,256000,"text,image",1,null,0.15,0.6,0,0],["mistral-small-latest",256000,256000,"text,image",1,null,0.15,0.6,0,0],["open-mistral-7b",8000,8000,"text",0,null,0.25,0.25,0,0],["open-mistral-nemo",128000,128000,"text",0,null,0.15,0.15,0,0],["open-mixtral-8x22b",64000,64000,"text",0,null,2,6,0,0],["open-mixtral-8x7b",32000,32000,"text",0,null,0.7,0.7,0,0],["pixtral-12b",128000,128000,"text,image",0,null,0.15,0.15,0,0],["pixtral-large-latest",128000,128000,"text,image",0,null,2,6,0,0]],
   "moonshot": [["kimi-k2.5",262144,65536,"text,image",1,null,0,0,0,0]],

package/src/grok/sync.ts

@@ -7,6 +7,7 @@
  * Deps are injectable (mirrors src/codex/sync.ts) so tests can run without a live proxy.
  */
 import type { CatalogModel } from "../codex/catalog";
+import { standaloneCodexRoutingTarget } from "../codex/inject";
 import type { OcxConfig } from "../types";
 import { projectGrokCatalog } from "./catalog";
 import { injectGrokConfig, type GrokInjectResult } from "./inject";
@@ -47,8 +48,15 @@ export async function syncGrokConfig(
   // Pass the FULL list plus the exclusion set: the writer allocates aliases over
   // everything and emits only what is switched on, so a model's alias never depends on
   // its neighbours' switches. Absent/empty selection keeps today's behaviour exactly.
-  return deps.injectGrokConfig(port, projection.models, {
-    ...(opts.hostname !== undefined ? { hostname: opts.hostname } : {}),
+  const target = standaloneCodexRoutingTarget(port, {
+    hostname: opts.hostname ?? config.hostname,
+    unauthenticatedLoopbackListener: config.unauthenticatedLoopbackListener,
+  });
+  const targetUrl = new URL(target.baseUrl);
+  return deps.injectGrokConfig(Number(targetUrl.port), projection.models, {
+    hostname: target.requiresAdmissionToken
+      ? (opts.hostname ?? config.hostname)
+      : targetUrl.hostname,
     ...(opts.grokHome !== undefined ? { grokHome: opts.grokHome } : {}),
     excluded: new Set(config.grokExcludedModels ?? []),
     catalogModelIds: projection.catalogModelIds,

package/src/integrations/cursor-effort-table.ts

@@ -0,0 +1,143 @@
+/**
+ * Cursor's local-agent effort table, read from the installed bundle.
+ *
+ * Cursor Private Inference decides which model rows get a Reasoning control from a table
+ * compiled into extensions/cursor-agent-exec/dist/main.js, not from the gateway's
+ * reasoning_effort list (devlog 260902_cursor_bundle_effort_table/000). Reading that table
+ * from the install the dashboard already detects lets the prediction follow a Cursor update
+ * instead of a hand-copied mirror. Read-only, size-bounded, cached by (path, mtime, size);
+ * any parse failure yields null so the caller falls back to the static mirror.
+ */
+import { readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
+import type { CursorInstall } from "./cursor-detect";
+
+export interface CursorEffortFamily {
+  id: string;
+  pattern: RegExp;
+  /** [] = family matched but Cursor shows no control. */
+  ladder: readonly string[];
+  param?: "reasoning_effort" | "output_config.effort";
+  defaultValue?: string;
+  outputCap?: number;
+  requiresReasoningCapability: boolean;
+}
+
+export interface CursorBareGpt5Rule {
+  pattern: RegExp;
+  ladder: readonly string[];
+  defaultValue: string;
+}
+
+export interface CursorEffortTable {
+  families: readonly CursorEffortFamily[];
+  /** The bare gpt-5 / gpt-5.x rule that runs when no family matched. */
+  bareGpt5: CursorBareGpt5Rule | null;
+  version: string | null;
+  bundlePath: string;
+}
+
+const BUNDLE_MAX_BYTES = 32 * 1024 * 1024;
+
+/** Bundle path under the install root cursor-detect reports. */
+export function cursorAgentBundlePath(install: Pick<CursorInstall, "path">, platform: string = process.platform): string {
+  const tail = ["extensions", "cursor-agent-exec", "dist", "main.js"];
+  return platform === "darwin"
+    ? join(install.path, "Contents", "Resources", "app", ...tail)
+    : join(install.path, "resources", "app", ...tail);
+}
+
+/**
+ * Parse the family table out of the minified source:
+ *   const w={param:"reasoning_effort",values:[...],defaultValue:"medium"};
+ *   ...const T={...},k={...},S={...},b=[{id:"...",matches:e=>/.../u.test(e),effort:k,outputCap:128e3},...];
+ * Identifier names are minifier-assigned, so binding is by structure: every
+ * <ident>={param:"...",values:[...],defaultValue:"..."} is an effort constant, and a family's
+ * effort: is either such an identifier or an inline object.
+ */
+export function parseCursorEffortTable(source: string): Omit<CursorEffortTable, "version" | "bundlePath"> | null {
+  const constants = new Map<string, { param: string; values: string[]; defaultValue: string }>();
+  const constRe = /(?:const |,)([A-Za-z_$][\w$]*)=\{param:"(reasoning_effort|output_config\.effort)",values:\[([^\]]*)\],defaultValue:"([a-z]+)"\}/gu;
+  for (const m of source.matchAll(constRe)) {
+    constants.set(m[1]!, { param: m[2]!, values: splitStrings(m[3]!), defaultValue: m[4]! });
+  }
+  const tableStart = source.indexOf('=[{id:"anthropic-');
+  if (tableStart === -1) return null;
+  const tableEnd = source.indexOf("];", tableStart);
+  if (tableEnd === -1) return null;
+  const body = source.slice(tableStart + 2, tableEnd + 1);
+  const entryRe = /\{id:"([^"]+)",matches:e=>\/((?:\\\/|[^/])+)\/([a-z]*)\.test\(e\)((?:,(?:effort:(?:[A-Za-z_$][\w$]*|\{[^}]*\})|outputCap:[\de.]+|effortRequiresReasoningCapability:!0))*)\}/gu;
+  const families: CursorEffortFamily[] = [];
+  // Every "{id:" opener in the window must be consumed by entryRe. A build that adds a
+  // property to one family would otherwise drop that family silently and the caller would
+  // report a bundle-sourced "no control" for it instead of falling back to the mirror.
+  const openers = body.split('{id:"').length - 1;
+  for (const m of body.matchAll(entryRe)) {
+    let pattern: RegExp;
+    try { pattern = new RegExp(m[2]!, m[3]!); } catch { return null; }
+    const tail = m[4]!;
+    const effortRef = /effort:([A-Za-z_$][\w$]*)(?:,|$)/u.exec(tail)?.[1];
+    const inline = /effort:\{param:"([^"]+)",values:\[([^\]]*)\],defaultValue:"([a-z]+)"\}/u.exec(tail);
+    const effort = inline
+      ? { param: inline[1]!, values: splitStrings(inline[2]!), defaultValue: inline[3]! }
+      : effortRef ? constants.get(effortRef) : undefined;
+    if (effortRef && !inline && !effort) return null; // unknown constant: structure changed
+    const cap = /outputCap:([\de.]+)/u.exec(tail)?.[1];
+    families.push({
+      id: m[1]!,
+      pattern,
+      ladder: effort?.values ?? [],
+      ...(effort ? { param: effort.param as CursorEffortFamily["param"], defaultValue: effort.defaultValue } : {}),
+      ...(cap ? { outputCap: Number(cap) } : {}),
+      requiresReasoningCapability: tail.includes("effortRequiresReasoningCapability:!0"),
+    });
+  }
+  if (families.length === 0 || families.length !== openers) return null;
+  // The tested variable and the returned constant are minifier-assigned names; bind by shape.
+  const bareRe = /if\(\/(\^gpt-5[^/]+)\/([a-z]*)\.test\([A-Za-z_$][\w$]*\)\)return ([A-Za-z_$][\w$]*)\}/u.exec(source);
+  const bareConst = bareRe ? constants.get(bareRe[3]!) : undefined;
+  let bareGpt5: CursorBareGpt5Rule | null = null;
+  if (bareRe && bareConst) {
+    let pattern: RegExp;
+    try { pattern = new RegExp(bareRe[1]!, bareRe[2]!); } catch { return null; }
+    bareGpt5 = { pattern, ladder: bareConst.values, defaultValue: bareConst.defaultValue };
+  }
+  return { families, bareGpt5 };
+}
+
+function splitStrings(list: string): string[] {
+  return [...list.matchAll(/"([^"]+)"/gu)].map(m => m[1]!);
+}
+
+export interface CursorEffortTableDeps {
+  platform: string;
+  stat(path: string): { mtimeMs: number; size: number } | null;
+  readText(path: string): string | null;
+}
+
+export function realCursorEffortTableDeps(): CursorEffortTableDeps {
+  return {
+    platform: process.platform,
+    stat: path => { try { const s = statSync(path); return { mtimeMs: s.mtimeMs, size: s.size }; } catch { return null; } },
+    readText: path => { try { return readFileSync(path, "utf8"); } catch { return null; } },
+  };
+}
+
+let cache: { key: string; table: CursorEffortTable | null } | null = null;
+
+/** Table from the Private Inference install, else null (caller falls back to the static mirror). */
+export function loadCursorEffortTable(install: CursorInstall | undefined, deps: CursorEffortTableDeps = realCursorEffortTableDeps()): CursorEffortTable | null {
+  if (!install) return null;
+  const bundlePath = cursorAgentBundlePath(install, deps.platform);
+  const st = deps.stat(bundlePath);
+  if (!st || st.size > BUNDLE_MAX_BYTES) return null;
+  const key = `${bundlePath}|${st.mtimeMs}|${st.size}`;
+  if (cache?.key === key) return cache.table;
+  const text = deps.readText(bundlePath);
+  const parsed = text ? parseCursorEffortTable(text) : null;
+  const table = parsed ? { ...parsed, version: install.version, bundlePath } : null;
+  cache = { key, table };
+  return table;
+}
+
+export function resetCursorEffortTableCacheForTests(): void { cache = null; }

package/src/integrations/state.ts

@@ -369,7 +369,7 @@ export function exportContextOf(input: {
      * loopback, and every client we write into deserves the same answer the
      * export command already gives.
      */
-    baseUrl: opencodeProxyBaseUrl(input.port, input.config.hostname),
+    baseUrl: opencodeProxyBaseUrl(input.port, input.config.hostname, input.config),
     models: input.models,
     config: input.config,
   };

package/src/integrations/writer.ts

@@ -12,7 +12,7 @@
 import { homedir } from "node:os";
 import { dirname } from "node:path";
 import { EXPORT_CLIENTS, type ExportModel, type ManagedContribution } from "../clients/config-export";
-import { isLoopbackHostname } from "../codex/inject";
+import { shouldInjectApiAuthHeader } from "../codex/inject";
 import type { OcxConfig } from "../types";
 import { PARSE_FAILED, defaultIntegrationIO, loadTarget, parseConfig, type IntegrationIO } from "./config-io";
 import {
@@ -290,7 +290,7 @@ function applyOrRefreshIntegration(
   if (io.statKind(detectDir) !== "dir") {
     return refuse(clientId, "not_installed", "absent", `${clientId} is not installed`);
   }
-  if (isLoopbackOnly(clientId) && !isLoopbackHostname(input.config.hostname)) {
+  if (isLoopbackOnly(clientId) && shouldInjectApiAuthHeader(input.config)) {
     return refuse(clientId, "non_loopback", classified.state,
       `The generated ${clientId} integration is loopback-only and does not emit the admission header a non-loopback bind requires. Give it loopback access instead, through a tunnel or a local forwarder.`);
   }

package/src/lib/app-owned-memory-stores.ts

@@ -38,6 +38,10 @@ import {
   discardRetainedUsageSnapshot,
   retainedUsageSnapshotStats,
 } from "../usage/log";
+import {
+  discardRetainedUsageAggregate,
+  usageAggregateRetainedStats,
+} from "../server/management/usage-aggregate-cache";
 import {
   cursorBlobRetainedStoreSnapshot,
   evictOldestCursorBlobForBudget,
@@ -61,18 +65,33 @@ function ringSnapshot(metrics: { entries: number; bytes: number; oldestAt: numbe
   };
 }
 
-/** The retained usage tail is a single all-or-nothing entry: evicting it drops the whole tail. */
+/** Legacy parsed tail and streaming aggregate share one stable public store id. */
 function usageSnapshotRetainedStoreSnapshot(): RetainedStoreSnapshot {
-  const stats = retainedUsageSnapshotStats();
+  const legacy = retainedUsageSnapshotStats();
+  const aggregate = usageAggregateRetainedStats();
+  const oldest = [legacy.oldestAt, aggregate.oldestAt]
+    .filter((value): value is number => value !== null)
+    .sort((a, b) => a - b)[0] ?? null;
   return {
-    count: stats.count,
-    bytes: stats.bytes,
-    evictableBytes: stats.bytes,
-    pinnedBytes: 0,
-    oldestAt: stats.oldestAt,
+    count: legacy.count + aggregate.count,
+    bytes: legacy.bytes + aggregate.bytes,
+    evictableBytes: legacy.bytes + aggregate.evictableBytes,
+    pinnedBytes: aggregate.pinnedBytes,
+    oldestAt: oldest,
   };
 }
 
+function evictOldestUsageSnapshot(): number {
+  const legacy = retainedUsageSnapshotStats();
+  const aggregate = usageAggregateRetainedStats();
+  if (legacy.bytes > 0
+    && (aggregate.evictableBytes === 0
+      || (legacy.oldestAt ?? Number.POSITIVE_INFINITY) <= (aggregate.oldestAt ?? Number.POSITIVE_INFINITY))) {
+    return discardRetainedUsageSnapshot();
+  }
+  return discardRetainedUsageAggregate();
+}
+
 function providerDebugSnapshot(): RetainedStoreSnapshot {
   return ringSnapshot(debugBufferMetrics());
 }
@@ -154,7 +173,7 @@ export const APP_OWNED_RETAINED_STORE_REGISTRATIONS = [
     id: "usage_snapshot",
     category: "caches",
     snapshot: usageSnapshotRetainedStoreSnapshot,
-    evictOldest: discardRetainedUsageSnapshot,
+    evictOldest: evictOldestUsageSnapshot,
   },
   {
     id: "cursor_blobs",

package/src/lib/bounded-body.ts

@@ -1,3 +1,5 @@
+import { idleDeadline } from "./abort";
+
 /** Maximum number of response-body bytes that may be retained for an error. */
 export const BOUNDED_BODY_MAX_BYTES = 65_536;
 
@@ -49,6 +51,8 @@ export interface BoundedBytesOptions {
 	signal?: AbortSignal;
 	/** Maximum number of raw bytes retained from the response body. */
 	maxBytes: number;
+	/** Deadline between non-empty raw chunks. Omitted means no body-read deadline. */
+	inactivityTimeoutMs?: number;
 }
 
 export interface BoundedBytesResult {
@@ -136,6 +140,15 @@ export async function readBoundedResponseBytes(
 	let retainedBytes = 0;
 	let mustCancel = false;
 	let cancelReason: unknown;
+	const inactivityReason = new DOMException("Response body stalled", "TimeoutError");
+	let rejectForInactivity: ((reason: unknown) => void) | undefined;
+	const inactive = new Promise<never>((_resolve, reject) => {
+		rejectForInactivity = reject;
+	});
+	const inactivity = options.inactivityTimeoutMs === undefined
+		? null
+		: idleDeadline(options.inactivityTimeoutMs, () => rejectForInactivity?.(inactivityReason));
+	inactivity?.reset();
 
 	let rejectForAbort: ((reason: unknown) => void) | undefined;
 	const aborted = new Promise<never>((_resolve, reject) => {
@@ -151,7 +164,7 @@ export async function readBoundedResponseBytes(
 			const read = reader.read();
 			// Observe a late read rejection when abort/cancellation wins the race.
 			void read.catch(() => undefined);
-			const outcome = await Promise.race([read, aborted]);
+			const outcome = await Promise.race([read, aborted, inactive]);
 			if (signal?.aborted) {
 				mustCancel = true;
 				cancelReason = signal.reason;
@@ -163,6 +176,7 @@ export async function readBoundedResponseBytes(
 				return { bytes: retained.subarray(0, retainedBytes), oversized: false };
 			}
 			if (!value || value.byteLength === 0) continue;
+			inactivity?.reset();
 
 			if (value.byteLength > maxBytes - retainedBytes) {
 				mustCancel = true;
@@ -187,6 +201,7 @@ export async function readBoundedResponseBytes(
 		cancelReason = error;
 		throw error;
 	} finally {
+		inactivity?.cancel();
 		signal?.removeEventListener("abort", onAbort);
 		if (mustCancel) cancelWithoutWaiting(reader, cancelReason);
 		try {

package/src/oauth/account-quota-rank.ts

@@ -10,7 +10,7 @@
  * categories answer the only question rotation asks — "which of these is most likely to
  * serve the retry" — and within the healthy group a simple headroom sort is enough.
  */
-import { getCachedProviderAccountQuota } from "../providers/quota";
+import { getCachedProviderAccountQuota, hasPassiveAccountQuota } from "../providers/quota";
 import { getKiroAccountExhaustion } from "../providers/kiro-usage";
 
 /** Lower sorts earlier. Unknown sits between measured-healthy and measured-empty. */
@@ -27,6 +27,24 @@ interface Ranked {
   index: number;
 }
 
+/**
+ * How old a PASSIVELY observed quota may be and still steer routing.
+ *
+ * A probed row is fresh by construction: it exists only because a probe wrote it, and
+ * `fetchAccountQuota` re-probes once `ACCOUNT_QUOTA_TTL_MS` has passed. So no caller has
+ * ever needed an explicit age check, and `getCachedProviderAccountQuota` does not apply
+ * one.
+ *
+ * A passive row breaks that invariant — nothing re-probes it, so it can be hours or days
+ * old. Routing on such a reading is worse than routing on none: the unranked ring at
+ * least rotates, while a stale ranking sends every first attempt to an account that may
+ * have been spent since. The bound is longer than the probe TTL (an hour-old reading of
+ * a five-hour window is still informative) and far shorter than the six-hour disk
+ * horizon, which exists to preserve a value for DISPLAY — where the age is shown to the
+ * user and no automatic decision rides on it.
+ */
+const PASSIVE_HEADROOM_MAX_AGE_MS = 60 * 60_000;
+
 /**
  * Remaining headroom across every window the provider reports.
  *
@@ -36,6 +54,9 @@ interface Ranked {
 function headroomOf(provider: string, accountId: string): number | null {
   const quota = getCachedProviderAccountQuota(provider, accountId);
   if (!quota) return null;
+  // Null, not a low rank: this must reproduce "no evidence" so a stale roster degrades to
+  // the unranked ring rather than to a differently wrong answer.
+  if (hasPassiveAccountQuota(provider) && Date.now() - quota.updatedAt > PASSIVE_HEADROOM_MAX_AGE_MS) return null;
   const percents = [
     quota.fiveHourPercent,
     quota.weeklyPercent,
@@ -56,6 +77,12 @@ export function rankAccountsByHeadroom(provider: string, ring: readonly string[]
   if (ring.length < 2) return [...ring];
 
   let sawEvidence = false;
+  // Same rule as hasHeadroomEvidence: a passive provider's partial roster must not rank
+  // at all. The failover path calls this directly (selectFailoverAccount), so the guard
+  // cannot live only in the pre-dispatch predicate.
+  if (hasPassiveAccountQuota(provider) && !ring.every(id => headroomOf(provider, id) !== null)) {
+    return [...ring];
+  }
   const ranked: Ranked[] = ring.map((id, index) => {
     // A provider-declared exhaustion verdict outranks the percentage: an account may sit at
     // 100% and still be servable when overage is enabled, and the verdict knows that.
@@ -84,6 +111,18 @@ export function rankAccountsByHeadroom(provider: string, ring: readonly string[]
  * can decline to act on a roster it knows nothing about.
  */
 export function hasHeadroomEvidence(provider: string, ids: readonly string[]): boolean {
+  // A PASSIVE provider needs evidence for EVERY candidate, not any one of them.
+  //
+  // A probe fills the whole roster in one pass (fetchProviderAccountQuotas), so "any"
+  // and "every" coincide there. An observation arrives one account at a time, so the
+  // normal passive state is "one measured, N unknown" -- and RANK_UNKNOWN (1) sorts
+  // AFTER RANK_HEALTHY (0), including behind a measured row sitting at 100% with zero
+  // headroom. Accepting partial evidence would therefore redirect the first attempt
+  // AWAY from an unmeasured account and TOWARD the one account known to be spent, which
+  // is the exact inversion of what ranking is for.
+  if (hasPassiveAccountQuota(provider)) {
+    return ids.length > 0 && ids.every(id => headroomOf(provider, id) !== null);
+  }
   return ids.some(id =>
     headroomOf(provider, id) !== null
     || (provider === "kiro" && getKiroAccountExhaustion(`${provider}\u0000${id}`) !== null));

package/src/oauth/chatgpt-device.ts

@@ -0,0 +1,187 @@
+import type { OAuthController, OAuthCredentials } from "./types";
+import { CHATGPT_CLIENT_ID, CHATGPT_TOKEN_URL, credsFromToken } from "./chatgpt";
+
+/**
+ * OpenAI deviceauth (device-code) grant for the ChatGPT/Codex provider.
+ *
+ * The callback flow in `./chatgpt` needs a browser and a listener on
+ * localhost:1455. A hub running headless in a container or over SSH has
+ * neither, which left "copy the long redirect URL out of the browser error
+ * page" as the only way to add an account there (#3366).
+ *
+ * This is the same grant Codex CLI uses. Three steps, and the middle one is
+ * where it differs from RFC 8628: the poll returns an authorization code plus
+ * a SERVER-generated PKCE verifier, which is then spent at the ordinary token
+ * endpoint. We never generate the verifier ourselves here.
+ */
+const USERCODE_URL = "https://auth.openai.com/api/accounts/deviceauth/usercode";
+const DEVICE_TOKEN_URL = "https://auth.openai.com/api/accounts/deviceauth/token";
+const DEVICE_REDIRECT_URI = "https://auth.openai.com/deviceauth/callback";
+
+/** Where the user types the short code. Fixed, and safe to show anywhere. */
+export const DEVICE_VERIFICATION_URL = "https://auth.openai.com/codex/device";
+
+/** The grant's own lifetime. Polling past this only produces a worse error message. */
+const DEVICE_FLOW_TTL_MS = 15 * 60 * 1000;
+const DEFAULT_POLL_INTERVAL_MS = 5_000;
+const MIN_POLL_INTERVAL_MS = 1_000;
+/**
+ * Above ~2^31 ms a timer overflows and fires immediately, which would turn a
+ * hostile or corrupt `interval` into a hot loop against an auth endpoint. The
+ * grant only lives 15 minutes, so anything longer is meaningless anyway.
+ */
+const MAX_POLL_INTERVAL_MS = DEVICE_FLOW_TTL_MS;
+
+/**
+ * Upstream sends `interval` as a number in some responses and a string in
+ * others. A string would make `setTimeout` treat it as 0 and turn the poll
+ * into a hot loop against an auth endpoint, so coerce and floor it.
+ */
+function normalizeIntervalMs(raw: unknown): number {
+  const seconds = typeof raw === "number" ? raw : typeof raw === "string" ? Number(raw) : NaN;
+  if (!Number.isFinite(seconds) || seconds <= 0) return DEFAULT_POLL_INTERVAL_MS;
+  const ms = Math.round(seconds * 1000);
+  return Math.min(MAX_POLL_INTERVAL_MS, Math.max(MIN_POLL_INTERVAL_MS, ms));
+}
+
+function nonEmptyString(value: unknown): string | undefined {
+  return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+
+async function sleep(ms: number, signal?: AbortSignal): Promise<void> {
+  if (signal?.aborted) throw new Error("Login cancelled");
+  await new Promise<void>((resolve, reject) => {
+    const timer = setTimeout(() => {
+      signal?.removeEventListener("abort", onAbort);
+      resolve();
+    }, ms);
+    const onAbort = (): void => {
+      clearTimeout(timer);
+      reject(new Error("Login cancelled"));
+    };
+    signal?.addEventListener("abort", onAbort, { once: true });
+  });
+}
+
+/**
+ * Device-flow errors carry the HTTP status and nothing else.
+ *
+ * The callback flow's `safeErrorDescription` reflects the upstream body into
+ * the message, which is fine for an OAuth error envelope but not here: these
+ * endpoints can echo request material, and this message reaches CLI output,
+ * the GUI, and issue reports.
+ */
+function deviceError(stage: string, status: number): Error {
+  return new Error(`ChatGPT device authorization ${stage} failed: HTTP ${status}`);
+}
+
+interface DeviceUserCode {
+  deviceAuthId: string;
+  userCode: string;
+  intervalMs: number;
+}
+
+async function requestUserCode(signal?: AbortSignal): Promise<DeviceUserCode> {
+  const response = await fetch(USERCODE_URL, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ client_id: CHATGPT_CLIENT_ID }),
+    signal,
+  });
+  if (!response.ok) throw deviceError("request", response.status);
+  const payload = (await response.json()) as Record<string, unknown>;
+  const deviceAuthId = nonEmptyString(payload.device_auth_id);
+  // Upstream accepts both spellings, so a response using the alias must not be
+  // rejected as malformed.
+  const userCode = nonEmptyString(payload.user_code) ?? nonEmptyString(payload.usercode);
+  if (!deviceAuthId || !userCode) {
+    throw new Error("ChatGPT device authorization response missing required fields");
+  }
+  return { deviceAuthId, userCode, intervalMs: normalizeIntervalMs(payload.interval) };
+}
+
+interface DeviceGrant {
+  authorizationCode: string;
+  codeVerifier: string;
+}
+
+/**
+ * Poll until the user finishes at the verification page.
+ *
+ * Pending is signalled by 403/404 rather than an `authorization_pending` body,
+ * so status is the whole protocol here: any other non-2xx is terminal, and
+ * treating it as pending would keep hammering a permanently failing endpoint.
+ */
+async function pollForGrant(
+  device: DeviceUserCode,
+  signal?: AbortSignal,
+): Promise<DeviceGrant> {
+  const deadline = Date.now() + DEVICE_FLOW_TTL_MS;
+  while (Date.now() < deadline) {
+    if (signal?.aborted) throw new Error("Login cancelled");
+    const response = await fetch(DEVICE_TOKEN_URL, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ device_auth_id: device.deviceAuthId, user_code: device.userCode }),
+      signal,
+    });
+    if (response.status === 403 || response.status === 404) {
+      // Cap the wait at the time actually left. Sleeping a full interval past
+      // the deadline is how a 15-minute grant turns into a 20-minute wait.
+      const remaining = deadline - Date.now();
+      if (remaining <= 0) break;
+      await sleep(Math.min(device.intervalMs, remaining), signal);
+      continue;
+    }
+    if (!response.ok) throw deviceError("poll", response.status);
+    // The deadline is checked again here, not only at the top of the loop: a
+    // single poll can itself outlive the grant, and accepting a code that
+    // expired mid-flight just moves the failure to the token exchange.
+    if (Date.now() >= deadline) break;
+    const payload = (await response.json()) as Record<string, unknown>;
+    const authorizationCode = nonEmptyString(payload.authorization_code);
+    const codeVerifier = nonEmptyString(payload.code_verifier);
+    if (!authorizationCode || !codeVerifier) {
+      throw new Error("ChatGPT device authorization response missing required fields");
+    }
+    return { authorizationCode, codeVerifier };
+  }
+  throw new Error("ChatGPT device authorization expired");
+}
+
+async function exchangeGrant(grant: DeviceGrant, signal?: AbortSignal): Promise<OAuthCredentials> {
+  const response = await fetch(CHATGPT_TOKEN_URL, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: "authorization_code",
+      client_id: CHATGPT_CLIENT_ID,
+      code: grant.authorizationCode,
+      code_verifier: grant.codeVerifier,
+      redirect_uri: DEVICE_REDIRECT_URI,
+    }).toString(),
+    signal,
+  });
+  if (!response.ok) throw deviceError("token exchange", response.status);
+  return credsFromToken((await response.json()) as Record<string, unknown>);
+}
+
+/**
+ * Run the device flow to completion.
+ *
+ * `deviceCode` in the `onAuth` payload is the HUMAN code, matching kimi, nous,
+ * and github-copilot. The opaque `device_auth_id` never leaves this module:
+ * every device-code surface renders `deviceCode` verbatim, and the management
+ * login route also uses its presence to decide a flow must not be handed to a
+ * local browser spawn.
+ */
+export async function loginChatGPTDevice(ctrl: OAuthController): Promise<OAuthCredentials> {
+  const device = await requestUserCode(ctrl.signal);
+  ctrl.onAuth?.({
+    url: DEVICE_VERIFICATION_URL,
+    instructions: `Enter code: ${device.userCode}`,
+    deviceCode: device.userCode,
+  });
+  const grant = await pollForGrant(device, ctrl.signal);
+  return exchangeGrant(grant, ctrl.signal);
+}