@bitkyc08/opencodex 2.43.0 → 2.44.0

package/src/oauth/store.ts

@@ -23,12 +23,13 @@ import { getConfigDir, atomicWriteFile, backupInvalidConfig, hardenConfigDir, ha
 import { assertNotRealHomeUnderTest } from "../lib/test-home-guard";
 import { recordOwnedConfigPath } from "../lib/config-ownership";
 import { MAX_PENDING_OAUTH_MUTATIONS } from "../lib/translator-budget";
+import { publishAccountSelection } from "../lib/account-selection-events";
 import {
   captureConfigGeneration,
   type GenerationContext,
 } from "../lib/state-store-sweeper";
 import { validateCopilotApiBaseUrl } from "./github-copilot";
-import type { OAuthCredentialSource, OAuthCredentials, ProviderAccount, ProviderAccountSet } from "./types";
+import type { OAuthAccountSelection, OAuthCredentialSource, OAuthCredentials, ProviderAccount, ProviderAccountSet } from "./types";
 
 export type AuthStore = Record<string, ProviderAccountSet>;
 
@@ -536,7 +537,15 @@ function normalizeAccountSet(raw: unknown): { set: ProviderAccountSet | null; wa
     const active = typeof candidate.activeAccountId === "string" && accounts.some(a => a.id === candidate.activeAccountId)
       ? candidate.activeAccountId
       : accounts[0]!.id;
-    return { set: { activeAccountId: active, accounts }, wasLegacy: false };
+    const set: ProviderAccountSet = { activeAccountId: active, accounts };
+    // Healing a dangling active id invalidates its old selection generation. Reads stay
+    // deterministic; only the serialized writer creates new revisions.
+    if (active === candidate.activeAccountId
+      && typeof candidate.selectionRevision === "string"
+      && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(candidate.selectionRevision)) {
+      set.selectionRevision = candidate.selectionRevision;
+    }
+    return { set, wasLegacy: false };
   }
   // Legacy single-credential value.
   const cred = normalizeCredential(raw);
@@ -670,9 +679,35 @@ function serializeMutation<T>(work: () => Promise<T>, retainedValues: readonly u
 export function mutateStore<T>(fn:(store:AuthStore)=>T|Promise<T>, retainedValues: readonly unknown[] = [], options?: { waitMs?: number; assertBeforePersist?: () => void }):Promise<T>{return serializeMutation(async()=>{const guard=await createOAuthFileLock({path:getAuthStoreLockPath(),staleAfterMs:30000}).acquire();try{
     const { store, hadLegacy } = loadAuthStoreInternal();
     if (hadLegacy) backupLegacyOnce();
+    const selections = new Map(Object.entries(store).map(([provider, set]) => [provider, {
+      set,
+      accountId: set.activeAccountId,
+      revision: set.selectionRevision,
+      accountIds: set.accounts.map(account => account.id),
+    }]));
     const result = await fn(store);
     options?.assertBeforePersist?.();
+    const changedProviders: string[] = [];
+    for (const provider of new Set([...selections.keys(), ...Object.keys(store)])) {
+      const before = selections.get(provider);
+      const after = store[provider];
+      if (!after) {
+        if (before) changedProviders.push(provider);
+        continue;
+      }
+      const replaced = before?.set !== after;
+      const removed = before?.accountIds.some(id => !after.accounts.some(account => account.id === id));
+      if (replaced || removed || before?.accountId !== after.activeAccountId) {
+        // Replacement/rollback must never restore a previous generation. A common
+        // selection commit already assigned its revision before forming its result.
+        if (replaced || before?.revision === after.selectionRevision) after.selectionRevision = randomUUID();
+      }
+      if (!before || before.accountId !== after.activeAccountId || before.revision !== after.selectionRevision) {
+        changedProviders.push(provider);
+      }
+    }
     persist(store);
+    for (const provider of changedProviders) publishAccountSelection(provider, "oauth");
     return result;
   }finally{guard.release();}}, retainedValues, options?.waitMs);
 }
@@ -700,6 +735,8 @@ export async function saveCredential(
   if (!safe) return;
   await mutateStore(store => {
     const set = store[provider];
+    // Login explicitly selects an account, including a re-login to the same slot.
+    if (set) set.selectionRevision = randomUUID();
     const identity = safe.accountId ?? safe.email;
     if (!set || SINGLE_SLOT_PROVIDERS.has(provider)) {
       const id = newAccountId(safe);
@@ -876,13 +913,60 @@ export async function saveAccountCredential(
   }, [provider, accountId, safe], { assertBeforePersist: opts.assertBeforePersist });
 }
 
-export async function setActiveAccount(provider: string, accountId: string): Promise<boolean> {
+function accountSelection(set: ProviderAccountSet): OAuthAccountSelection {
+  return {
+    accountId: set.activeAccountId,
+    ...(set.selectionRevision !== undefined ? { revision: set.selectionRevision } : {}),
+  };
+}
+
+export function captureOAuthAccountSelection(provider: string): OAuthAccountSelection | null {
+  const set = getAccountSet(provider);
+  return set ? accountSelection(set) : null;
+}
+
+/**
+ * Shared manual/automatic selection owner. An expected snapshot marks an automatic
+ * proposal: validating an unchanged selection preserves its revision. An unconditional
+ * (manual) selection always advances it, even when reselecting the current account.
+ */
+export async function commitOAuthAccountSelection(
+  provider: string,
+  accountId: string,
+  options: {
+    expectedSelection?: OAuthAccountSelection;
+    expectedCredentialGeneration?: string;
+    requireUsableAccount?: boolean;
+  } = {},
+): Promise<OAuthAccountSelection | null> {
+  // Snapshot caller-owned options before waiting for the serialized writer.
+  const expected = options.expectedSelection ? { ...options.expectedSelection } : undefined;
+  const { expectedCredentialGeneration, requireUsableAccount } = options;
+  const valid = (set: ProviderAccountSet): boolean => {
+    if (expected && (set.activeAccountId !== expected.accountId || set.selectionRevision !== expected.revision)) return false;
+    const account = set.accounts.find(account => account.id === accountId);
+    if (!account || (requireUsableAccount && account.needsReauth === true)) return false;
+    return expectedCredentialGeneration === undefined || credentialGeneration(account.credential) === expectedCredentialGeneration;
+  };
+  if (expected?.accountId === accountId) {
+    // Ordinary admission is one synchronous read/validation, with no await, writer
+    // queue, or persistence. A changed selection must still take the guarded writer.
+    const set = getAccountSet(provider);
+    return set && valid(set) ? accountSelection(set) : null;
+  }
   return await mutateStore(store => {
     const set = store[provider];
-    if (!set || !set.accounts.some(a => a.id === accountId)) return false;
-    set.activeAccountId = accountId;
-    return true;
-  }, [provider, accountId]);
+    if (!set || !valid(set)) return null;
+    if (!expected || set.activeAccountId !== accountId) {
+      set.activeAccountId = accountId;
+      set.selectionRevision = randomUUID();
+    }
+    return accountSelection(set);
+  }, [provider, accountId, expected, expectedCredentialGeneration]);
+}
+
+export async function setActiveAccount(provider: string, accountId: string): Promise<boolean> {
+  return (await commitOAuthAccountSelection(provider, accountId)) !== null;
 }
 
 export async function setAccountAlias(provider: string, accountId: string, alias: string | undefined): Promise<boolean> {

package/src/oauth/types.ts

@@ -59,9 +59,17 @@ export interface ProviderAccount {
 /** auth.json value per provider: N accounts + which one requests use. */
 export interface ProviderAccountSet {
   activeAccountId: string;
+  /** Opaque selection generation; absent in legacy stores, independent of token refresh. */
+  selectionRevision?: string;
   accounts: ProviderAccount[];
 }
 
+/** Non-secret snapshot used to condition a selection on the choice that started a request. */
+export interface OAuthAccountSelection {
+  accountId: string;
+  revision?: string;
+}
+
 export interface OAuthController {
   onAuth?(info: { url: string; instructions?: string; deviceCode?: string }): void;
   onProgress?(message: string): void;

package/src/providers/api-key-selection.ts

@@ -0,0 +1,110 @@
+import { randomUUID } from "node:crypto";
+import { mutatePersistedConfig } from "../config";
+import { publishAccountSelection } from "../lib/account-selection-events";
+import type { OcxConfig, OcxProviderConfig } from "../types";
+import type { ProviderApiKeySelection } from "../types/provider";
+import { routedProviderConfig } from "../router";
+import { OPENCODE_GO_SESSION_HEADER } from "./opencode-go-transport";
+import { resolveProviderTransport, XAI_GROK_COMPATIBILITY, type OcxProviderTransport } from "./xai-transport";
+
+export function captureProviderApiKeySelection(provider: OcxProviderConfig): ProviderApiKeySelection {
+  return {
+    entryId: provider.apiKeyPool?.find(entry => entry.key === provider.apiKey)?.id,
+    reference: provider.apiKey,
+    revision: provider.apiKeySelectionRevision,
+  };
+}
+
+function matchesSelection(provider: OcxProviderConfig, expected: ProviderApiKeySelection): boolean {
+  const current = captureProviderApiKeySelection(provider);
+  return current.entryId === expected.entryId && current.reference === expected.reference
+    && current.revision === expected.revision;
+}
+
+function currentKeyProvider(config: OcxConfig, name: string): OcxProviderConfig | null {
+  const configured = config.providers[name];
+  if (!configured || configured.disabled) return null;
+  const current = routedProviderConfig(name, { ...configured, _apiKeyAttempt: undefined });
+  if (current.authMode === "oauth" || current.authMode === "forward") return null;
+  if (current.authMode === "key" && !current.keyOptional && !current.apiKey?.trim()) return null;
+  return current;
+}
+
+/** Physical-send check; stored references alone do not detect a changed env/keychain value. */
+export function providerApiKeySelectionIsCurrent(
+  config: OcxConfig,
+  name: string,
+  routedProvider: OcxProviderConfig,
+): boolean {
+  const current = currentKeyProvider(config, name);
+  const expected = routedProvider._apiKeyAttempt;
+  return current !== null && expected !== undefined
+    && matchesSelection(config.providers[name]!, expected)
+    && current.apiKey === routedProvider.apiKey
+    && current.authMode === routedProvider.authMode
+    && current.baseUrl === routedProvider.baseUrl;
+}
+
+/** Rebuild transport from the already committed choice; never allocate or publish a selection. */
+export function resolveCurrentProviderApiKeyTransport(
+  config: OcxConfig,
+  name: string,
+  routedProvider: OcxProviderConfig,
+): OcxProviderConfig | null {
+  const current = currentKeyProvider(config, name);
+  if (!current) return null;
+  const runtime = routedProvider as OcxProviderTransport;
+  const headers = { ...current.headers };
+  const affinityHeaders = name === "xai"
+    ? [XAI_GROK_COMPATIBILITY.headers.conversationId, XAI_GROK_COMPATIBILITY.headers.sessionId]
+    : [OPENCODE_GO_SESSION_HEADER];
+  for (const header of affinityHeaders) {
+    const configured = Object.keys(headers).some(key => key.toLowerCase() === header.toLowerCase());
+    const value = Object.entries(runtime.headers ?? {}).find(([key]) => key.toLowerCase() === header.toLowerCase())?.[1];
+    if (!configured && value !== undefined) headers[header] = value;
+  }
+  const fetch = (current as OcxProviderTransport).fetch ?? runtime.fetch;
+  return resolveProviderTransport(name, {
+    ...current,
+    ...(Object.keys(headers).length ? { headers } : {}),
+    ...(fetch ? { fetch } : {}),
+  });
+}
+
+type SelectionMutation<T> = { changed: boolean; value: T; selectionChanged?: boolean };
+export type ProviderApiKeyCommit<T> =
+  | { status: "committed"; provider: OcxProviderConfig; value: T }
+  | { status: "superseded"; provider: OcxProviderConfig }
+  | { status: "unavailable" };
+
+/** GUI and recovery share one persisted selection transaction and post-commit notification. */
+export function commitProviderApiKeySelection<T>(
+  config: OcxConfig,
+  name: string,
+  mutation: (provider: OcxProviderConfig) => SelectionMutation<T>,
+  expectedSelection?: ProviderApiKeySelection,
+): ProviderApiKeyCommit<T> {
+  const outcome = mutatePersistedConfig<ProviderApiKeyCommit<T> & { notify?: boolean }>(fresh => {
+    const provider = fresh.providers[name];
+    if (!provider || provider.authMode === "oauth" || provider.authMode === "forward") {
+      return { changed: false, value: { status: "unavailable" } };
+    }
+    if (expectedSelection && !matchesSelection(provider, expectedSelection)) {
+      return { changed: false, value: { status: "superseded", provider: structuredClone(provider) } };
+    }
+    const before = provider.apiKey;
+    const result = mutation(provider);
+    const notify = result.selectionChanged === true || before !== provider.apiKey;
+    if (notify) provider.apiKeySelectionRevision = randomUUID();
+    delete provider._apiKeyAttempt;
+    return {
+      changed: result.changed || notify,
+      value: { status: "committed", provider: structuredClone(provider), value: result.value, notify },
+    };
+  });
+  if (outcome.status === "unavailable") return { status: "unavailable" };
+  const committed = outcome.value;
+  if (committed.status !== "unavailable") config.providers[name] = structuredClone(committed.provider);
+  if (committed.status === "committed" && committed.notify) publishAccountSelection(name, "api-key");
+  return committed;
+}

package/src/providers/api-keys.ts

@@ -10,6 +10,7 @@ import { createHash } from "node:crypto";
 import { saveConfigPreservingClaudeCode } from "../config";
 import type { OcxConfig, OcxProviderConfig } from "../types";
 import type { AccountQuotaFields } from "./quota-types";
+import { commitProviderApiKeySelection } from "./api-key-selection";
 
 export interface ProviderApiKeyInfo extends AccountQuotaFields {
   id: string;
@@ -85,28 +86,33 @@ export function addProviderApiKey(config: OcxConfig, name: string, key: string,
   if (typeof key !== "string" || !key.trim()) return { error: "key is required" };
   const trimmed = sanitizeApiKeyValue(key);
   if (!trimmed) return { error: "key must not include line breaks" };
-  const pool = ensurePool(provider);
   const id = apiKeyPoolEntryId(trimmed);
-  const existing = pool.find(e => e.id === id);
-  if (existing) {
-    if (label?.trim()) existing.label = label.trim();
-  } else {
-    pool.push({ id, key: trimmed, ...(label?.trim() ? { label: label.trim() } : {}), addedAt: Date.now() });
-  }
-  provider.apiKey = trimmed;
-  saveConfigPreservingClaudeCode(config);
-  return { id };
+  const committed = commitProviderApiKeySelection(config, name, fresh => {
+    const pool = ensurePool(fresh);
+    const existing = pool.find(e => e.id === id);
+    if (existing) {
+      if (label?.trim()) existing.label = label.trim();
+    } else {
+      pool.push({ id, key: trimmed, ...(label?.trim() ? { label: label.trim() } : {}), addedAt: Date.now() });
+    }
+    fresh.apiKey = trimmed;
+    return { changed: true, selectionChanged: true, value: id };
+  });
+  return committed.status === "committed" ? { id } : { error: "provider selection unavailable" };
 }
 
 /** Switch the ACTIVE key (mirrors into `provider.apiKey`). Persists config. */
 export function setActiveProviderApiKey(config: OcxConfig, name: string, id: string): boolean {
-  const provider = config.providers[name];
-  if (!provider || !isKeyAuthProvider(provider)) return false;
-  const entry = ensurePool(provider).find(e => e.id === id);
-  if (!entry) return false;
-  provider.apiKey = entry.key;
-  saveConfigPreservingClaudeCode(config);
-  return true;
+  const committed = commitProviderApiKeySelection(config, name, provider => {
+    const entry = provider.apiKeyPool?.find(e => e.id === id)
+      ?? (!provider.apiKeyPool?.length && provider.apiKey && apiKeyPoolEntryId(provider.apiKey) === id
+        ? { id, key: provider.apiKey } : undefined);
+    if (!entry) return { changed: false, value: false };
+    ensurePool(provider);
+    provider.apiKey = entry.key;
+    return { changed: true, selectionChanged: true, value: true };
+  });
+  return committed.status === "committed" && committed.value;
 }
 
 /** Rename a key slot without changing its id, secret, or active routing state. */
@@ -123,18 +129,19 @@ export function setProviderApiKeyLabel(config: OcxConfig, name: string, id: stri
 
 /** Remove one key; removing the active one promotes the first remaining. Persists config. */
 export function removeProviderApiKey(config: OcxConfig, name: string, id: string): boolean {
-  const provider = config.providers[name];
-  if (!provider || !isKeyAuthProvider(provider)) return false;
-  const pool = ensurePool(provider);
-  const entry = pool.find(e => e.id === id);
-  if (!entry) return false;
-  provider.apiKeyPool = pool.filter(e => e.id !== id);
-  if (provider.apiKey === entry.key) {
-    const next = provider.apiKeyPool[0];
-    if (next) provider.apiKey = next.key;
-    else delete provider.apiKey;
-  }
-  if (provider.apiKeyPool.length === 0) delete provider.apiKeyPool;
-  saveConfigPreservingClaudeCode(config);
-  return true;
+  const committed = commitProviderApiKeySelection(config, name, provider => {
+    const pool = provider.apiKeyPool?.length ? provider.apiKeyPool
+      : provider.apiKey ? [{ id: apiKeyPoolEntryId(provider.apiKey), key: provider.apiKey }] : [];
+    const entry = pool.find(e => e.id === id);
+    if (!entry) return { changed: false, value: false };
+    provider.apiKeyPool = pool.filter(e => e.id !== id);
+    if (provider.apiKey === entry.key) {
+      const next = provider.apiKeyPool[0];
+      if (next) provider.apiKey = next.key;
+      else delete provider.apiKey;
+    }
+    if (provider.apiKeyPool.length === 0) delete provider.apiKeyPool;
+    return { changed: true, value: true };
+  });
+  return committed.status === "committed" && committed.value;
 }

package/src/providers/context-cap.ts

@@ -43,13 +43,22 @@ export function globalContextCapValue(config: Pick<OcxConfig, "contextCapValue">
   return isValidContextCap(value) ? Math.floor(value) : DEFAULT_PROVIDER_CONTEXT_CAP;
 }
 
+/** Active caps win over remembered values from an earlier switch-off. */
+export function selectedProviderContextCaps(config: Pick<OcxConfig, "providerContextCaps" | "providerContextCapValues">): Record<string, number> {
+  return { ...providerContextCaps({ providerContextCaps: config.providerContextCapValues }), ...providerContextCaps(config) };
+}
+
 export function setProviderContextCap(config: OcxConfig, provider: string, enabled: boolean, value?: number): void {
   const next = providerContextCaps(config);
+  const selected = selectedProviderContextCaps(config);
   if (enabled) {
-    next[provider] = isValidContextCap(value) ? Math.floor(value) : globalContextCapValue(config);
+    const remembered = Object.hasOwn(selected, provider) ? selected[provider] : undefined;
+    next[provider] = isValidContextCap(value) ? Math.floor(value) : (isValidContextCap(remembered) ? remembered : globalContextCapValue(config));
+    selected[provider] = next[provider];
   } else {
     delete next[provider];
   }
+  if (Object.keys(selected).length > 0) config.providerContextCapValues = selected;
   if (Object.keys(next).length > 0) config.providerContextCaps = next;
   else deleteConfigTopLevelKey(config, "providerContextCaps");
 }
@@ -66,18 +75,33 @@ export function setGlobalContextCapValue(config: OcxConfig, value: number, apply
   if (!applyToAll) return;
   const caps = providerContextCaps(config);
   for (const provider of Object.keys(caps)) caps[provider] = next;
-  if (Object.keys(caps).length > 0) config.providerContextCaps = caps;
+  if (Object.keys(caps).length > 0) {
+    config.providerContextCaps = caps;
+    config.providerContextCapValues = { ...selectedProviderContextCaps(config), ...caps };
+  }
 }
 
 /** Enable the cap for every named provider at the current value, or clear all caps. */
 export function setAllProviderContextCaps(config: OcxConfig, providerNames: string[], enabled: boolean): void {
+  const selected = selectedProviderContextCaps(config);
   if (!enabled) {
+    if (Object.keys(selected).length > 0) config.providerContextCapValues = selected;
     deleteConfigTopLevelKey(config, "providerContextCaps");
     return;
   }
   const value = globalContextCapValue(config);
   const next: Record<string, number> = {};
-  for (const name of providerNames) next[name] = value;
+  for (const name of providerNames) { next[name] = value; selected[name] = value; }
+  if (Object.keys(selected).length > 0) config.providerContextCapValues = selected;
   if (Object.keys(next).length > 0) config.providerContextCaps = next;
   else deleteConfigTopLevelKey(config, "providerContextCaps");
 }
+
+/** Provider removal clears both the active limit and its remembered selection. */
+export function forgetProviderContextCap(config: OcxConfig, provider: string): void {
+  setProviderContextCap(config, provider, false);
+  const values = { ...config.providerContextCapValues };
+  delete values[provider];
+  if (Object.keys(values).length > 0) config.providerContextCapValues = values;
+  else deleteConfigTopLevelKey(config, "providerContextCapValues");
+}

package/src/providers/key-failover.ts

@@ -8,7 +8,8 @@
  *
  * Modelled after src/codex/routing.ts cooldown logic but scoped to plain API-key pools.
  */
-import { mutatePersistedConfig } from "../config";
+import { commitProviderApiKeySelection } from "./api-key-selection";
+import type { ProviderApiKeySelection } from "../types/provider";
 import { routedProviderConfig } from "../router";
 import type { OcxConfig, OcxProviderConfig, RateLimitRetryPolicy, TransientRetryPolicy } from "../types";
 import { OPENCODE_GO_SESSION_HEADER } from "./opencode-go-transport";
@@ -186,33 +187,32 @@ function rotateKeyAfterFailure(
   retryAfterHeader: string | null | undefined,
   now = Date.now(),
   attemptedKey?: string,
+  attemptedSelection?: ProviderApiKeySelection,
 ): OcxProviderConfig | null {
   const provider = config.providers[providerName];
   if (!provider) return null;
   if (provider.authMode === "oauth" || provider.authMode === "forward") return null;
 
-  const failedKey = attemptedKey ?? provider.apiKey;
+  const failedKey = attemptedSelection?.reference ?? attemptedKey ?? provider.apiKey;
   type Rotation =
-    | { provider: OcxProviderConfig; failedId?: string; candidateId?: string }
+    | { failedId?: string; candidateId?: string }
     | { exhaustedCount: number; failedId?: string };
-  const outcome = mutatePersistedConfig<Rotation | null>(fresh => {
-    const freshProvider = fresh.providers[providerName];
-    if (!freshProvider || freshProvider.authMode === "oauth" || freshProvider.authMode === "forward") {
-      return { changed: false, value: null };
-    }
+  const outcome = commitProviderApiKeySelection<Rotation | null>(config, providerName, freshProvider => {
     const pool = freshProvider.apiKeyPool;
     if (!pool || pool.length < 2) return { changed: false, value: null };
 
     // The callback can be rerun after rebasing, so identify the failed key here but
     // defer the in-memory cooldown side effect until persistence has succeeded.
-    const failedEntry = pool.find(entry => entry.key === failedKey);
+    const failedEntry = attemptedSelection?.entryId
+      ? pool.find(entry => entry.id === attemptedSelection.entryId && entry.key === failedKey)
+      : pool.find(entry => entry.key === failedKey);
 
     if (freshProvider.apiKey !== failedKey) {
       const activeEntry = pool.find(entry => entry.key === freshProvider.apiKey);
       if (activeEntry && !isKeyInCooldown(providerName, activeEntry.id, now)) {
         return {
           changed: false,
-          value: { provider: structuredClone(freshProvider), failedId: failedEntry?.id },
+          value: { failedId: failedEntry?.id },
         };
       }
     }
@@ -226,15 +226,20 @@ function rotateKeyAfterFailure(
       return {
         changed: true,
         value: {
-          provider: structuredClone(freshProvider),
           failedId: failedEntry?.id,
           candidateId: candidate.id,
         },
       };
     }
     return { changed: false, value: { exhaustedCount: pool.length, failedId: failedEntry?.id } };
-  });
-  if (outcome.status === "unavailable" || outcome.value === null) return null;
+  }, attemptedSelection);
+  if (outcome.status === "unavailable") return null;
+  if (outcome.status === "superseded") {
+    // A newer manual selection (including A→B→A) owns subsequent dispatch. Reusing the
+    // same failed key here would loop forever; preserve its original failure instead.
+    return outcome.provider.apiKey !== failedKey ? structuredClone(outcome.provider) : null;
+  }
+  if (outcome.value === null) return null;
   if (outcome.value.failedId) {
     // A 401 is a verdict about the credential itself, not a timing signal: the key is rejected
     // until an operator replaces it, and upstreams send no Retry-After for it. Hold it for the
@@ -250,7 +255,7 @@ function rotateKeyAfterFailure(
     return null;
   }
 
-  const committed = structuredClone(outcome.value.provider);
+  const committed = structuredClone(outcome.provider);
   config.providers[providerName] = committed;
   if (outcome.value.candidateId) {
     console.warn(
@@ -267,8 +272,9 @@ export function rotateKeyOn429(
   retryAfterHeader: string | null | undefined,
   now = Date.now(),
   attemptedKey?: string,
+  attemptedSelection?: ProviderApiKeySelection,
 ): OcxProviderConfig | null {
-  return rotateKeyAfterFailure(config, providerName, 429, retryAfterHeader, now, attemptedKey);
+  return rotateKeyAfterFailure(config, providerName, 429, retryAfterHeader, now, attemptedKey, attemptedSelection);
 }
 
 /**
@@ -284,8 +290,9 @@ export function rotateKeyOn401(
   providerName: string,
   now = Date.now(),
   attemptedKey?: string,
+  attemptedSelection?: ProviderApiKeySelection,
 ): OcxProviderConfig | null {
-  return rotateKeyAfterFailure(config, providerName, 401, null, now, attemptedKey);
+  return rotateKeyAfterFailure(config, providerName, 401, null, now, attemptedKey, attemptedSelection);
 }
 
 export function sweepExpiredApiKeyCooldowns(now = Date.now()): number {
@@ -302,6 +309,7 @@ interface RotateProviderTransportOptions {
   retryAfter?: string | null;
   now?: number;
   attemptedKey?: string;
+  attemptedSelection?: ProviderApiKeySelection;
   promptCacheKey?: string;
 }
 
@@ -323,6 +331,7 @@ export function rotateProviderTransportOn429(
     options.retryAfter,
     options.now,
     options.attemptedKey,
+    options.attemptedSelection ?? routedProvider._apiKeyAttempt,
   );
   if (!rotated) return null;
   return applyRotatedTransport(providerName, routedProvider, rotated, options.promptCacheKey);
@@ -335,7 +344,8 @@ export function rotateProviderTransportOn401(
   routedProvider: OcxProviderTransport,
   options: Omit<RotateProviderTransportOptions, "retryAfter"> = {},
 ): OcxProviderTransport | null {
-  const rotated = rotateKeyOn401(config, providerName, options.now, options.attemptedKey);
+  const rotated = rotateKeyOn401(config, providerName, options.now, options.attemptedKey,
+    options.attemptedSelection ?? routedProvider._apiKeyAttempt);
   if (!rotated) return null;
   return applyRotatedTransport(providerName, routedProvider, rotated, options.promptCacheKey);
 }

package/src/providers/provider-id-rewrite.ts

@@ -112,14 +112,16 @@ export function rewriteProviderReferences(config: OcxConfig, from: string, to: s
 
   // Keys. `providerContextCaps` is KEYED by provider id — a prefix rewrite would
   // silently orphan the cap — and a destination key may already be occupied.
-  const caps = config.providerContextCaps;
-  if (caps && Object.hasOwn(caps, from)) {
-    if (Object.hasOwn(caps, to)) {
-      collisions.push(`providerContextCaps.${to}`);
-    } else {
-      caps[to] = caps[from]!;
-      delete caps[from];
-      changed += 1;
+  for (const field of ["providerContextCaps", "providerContextCapValues"] as const) {
+    const caps = config[field];
+    if (caps && Object.hasOwn(caps, from)) {
+      if (Object.hasOwn(caps, to)) {
+        collisions.push(`${field}.${to}`);
+      } else {
+        caps[to] = caps[from]!;
+        delete caps[from];
+        changed += 1;
+      }
     }
   }
 

package/src/providers/registry.ts

@@ -2175,6 +2175,7 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
     liveModels: true,
     preserveCustomDestination: true,
     defaultModel: "deepseek/deepseek-v4-flash",
+    promptCacheKey: true,
     // The default is also the cold-start seed: live discovery failure must not empty the catalog
     // for a freshly configured provider with no stale cache (issue #308 pattern).
     models: ["deepseek/deepseek-v4-flash"],

package/src/responses/custom-tool-compat.ts

@@ -287,6 +287,16 @@ export function restoreRoutedCustomCalls(
       const helper = aliased && sourceInput !== ""
         ? item.name
         : resolveCodeModeHelperName(undefined, targetName, sourceInput, itemNamespace, declaredNames);
+      // Native custom input is already the tool's raw grammar. Only a recognized
+      // helper/envelope may reinterpret it; a JSON-looking native body is not a wrapper.
+      if (item.type === "custom_tool_call" && !aliased && !helper) {
+        const input = repairNames.has(wireName) && typeof sourceInput === "string"
+          ? normalizeApplyPatchDelimiters(sourceInput)
+          : sourceInput;
+        return input !== sourceInput
+          ? { value: { ...item, input }, changed: true }
+          : { value: item, changed: false };
+      }
       const restored: Record<string, unknown> = {
         ...item,
         type: "custom_tool_call",