@bitkyc08/opencodex 2.46.0 → 2.47.0-preview.20260908

package/src/lib/json-byte-size.ts

@@ -0,0 +1,61 @@
+import { TRANSLATOR_MAX_TURN_BYTES, TranslatorBudgetExceededError } from "./translator-budget";
+
+/** Measure plain JSON data without allocating its serialized string or UTF-8 copy. */
+export function jsonUtf8Bytes(value: unknown, limit = TRANSLATOR_MAX_TURN_BYTES): number {
+  let bytes = 0;
+  const add = (count: number) => {
+    if (count > limit - bytes) throw new TranslatorBudgetExceededError("request_copies", limit);
+    bytes += count;
+  };
+  const string = (text: string) => {
+    // Every UTF-16 code unit needs at least one JSON UTF-8 byte; reject large inputs
+    // before walking them. Escapes and unpaired surrogates are counted below.
+    if (text.length + 2 > limit - bytes) throw new TranslatorBudgetExceededError("request_copies", limit);
+    add(2);
+    for (let i = 0; i < text.length; i++) {
+      const code = text.charCodeAt(i);
+      if (code === 0x22 || code === 0x5c || code === 8 || code === 9 || code === 10 || code === 12 || code === 13) add(2);
+      else if (code < 0x20) add(6);
+      else if (code < 0x80) add(1);
+      else if (code < 0x800) add(2);
+      else if (code >= 0xd800 && code <= 0xdbff) {
+        const next = text.charCodeAt(i + 1);
+        if (next >= 0xdc00 && next <= 0xdfff) { add(4); i++; }
+        else add(6);
+      } else if (code >= 0xdc00 && code <= 0xdfff) add(6);
+      else add(3);
+    }
+  };
+  const visit = (item: unknown): void => {
+    if (item === null) { add(4); return; }
+    if (typeof item === "string") { string(item); return; }
+    if (typeof item === "boolean") { add(item ? 4 : 5); return; }
+    if (typeof item === "number") { add(Number.isFinite(item) ? String(item).length : 4); return; }
+    if (Array.isArray(item)) {
+      add(2);
+      for (let i = 0; i < item.length; i++) {
+        if (i > 0) add(1);
+        if (item[i] === undefined) add(4);
+        else visit(item[i]);
+      }
+      return;
+    }
+    if (typeof item === "object" && item !== null) {
+      add(2);
+      let first = true;
+      for (const key of Object.keys(item)) {
+        const field = (item as Record<string, unknown>)[key];
+        if (field === undefined) continue;
+        if (!first) add(1);
+        first = false;
+        string(key);
+        add(1);
+        visit(field);
+      }
+      return;
+    }
+    throw new TypeError("Expected plain JSON data for translation sizing");
+  };
+  visit(value);
+  return bytes;
+}

package/src/lib/provider-outbound.ts

@@ -42,7 +42,7 @@ function pickPinnedAddress(addresses: Array<{ address: string; family: number }>
  *
  * Under TUN mode the packet path intercepts the fake-IP destination itself, so a
  * canonical registry destination whose local DNS answers include Clash fake-IP
- * space (198.18.0.0/15) is reachable by pin-connecting through the TUN — no
+ * space (198.18.0.0/15 or fdfe:dcba:9876::/48) is reachable by pin-connecting through the TUN — no
  * outbound HTTP(S) proxy env is required. The exception is deliberately narrow:
  *
  * - hostname-only: a literal 198.18.x.x URL never reaches it (the literal gate
@@ -143,11 +143,12 @@ async function providerOutboundRequest(
   // below reason about the same value. `null` here means "no proxy fetch would actually use",
   // even if some other proxy variable is set.
   const effectiveProxy = effectiveProxyFor(parsed);
-  const allowMihomoIpv6FakeIp = effectiveProxy !== null && !noProxyMatches(parsed);
+  const isCanonicalUrl = dependencies.isCanonicalUrl ?? (() => false);
+  const allowMihomoIpv6FakeIp = (effectiveProxy !== null && !noProxyMatches(parsed))
+    || transparentFakeIpException(url, parsed, isCanonicalUrl, name);
   const resolveAddresses = dependencies.resolveAddresses ?? resolvePublicAddresses;
   const pinnedGet = dependencies.pinnedGet ?? pinnedHttpGet;
   const pinnedPost = dependencies.pinnedPost ?? pinnedHttpPost;
-  const isCanonicalUrl = dependencies.isCanonicalUrl ?? (() => false);
   const allowPrivate = providerAllowsPrivateNetwork(name, provider);
   let resolved: Awaited<ReturnType<typeof resolvePublicAddresses>>;
   try {
@@ -169,11 +170,9 @@ async function providerOutboundRequest(
       // pinned to the registry destination independently.
       allowBenchmarkAddresses: (proxyConfigured && !noProxyMatches(parsed))
         || transparentFakeIpException(url, parsed, isCanonicalUrl, name),
-      // Mihomo IPv6 fake-IP (fdfe:dcba:9876::/48) answers are admitted on a stricter gate
-      // than the benchmark range: the proxy must be the one fetch will use for this URL's
-      // scheme, and the request below is then bound to it explicitly (#3462). A ULA answer
-      // is otherwise indistinguishable from a real private host, so proxy presence alone
-      // is not enough.
+      // Mihomo IPv6 fake-IP (fdfe:dcba:9876::/48) answers are admitted either when bound
+      // to a scheme-matched proxy (#3462) or under the TUN transparency exception for a
+      // canonical registry/accounting destination.
       allowMihomoIpv6FakeIp,
     });
   } catch (error) {
@@ -187,11 +186,13 @@ async function providerOutboundRequest(
     warnProxyDnsDegradationOnce();
     return globalThis.fetch(url, { ...init, method, redirect: "manual" });
   }
-  if (proxyConfigured && !resolved.privateNetwork) {
+  // A canonical TUN exception with no scheme-matched proxy must retain the
+  // validated address, even when an unrelated HTTP_PROXY/ALL_PROXY is present.
+  if (proxyConfigured && !resolved.privateNetwork && (effectiveProxy !== null || !allowMihomoIpv6FakeIp)) {
     warnProxyBoundaryOnce();
     // When the Mihomo exception could have admitted an answer, pin the transport to the
     // proxy the admission assumed instead of letting fetch re-infer it from the environment.
-    const proxy = allowMihomoIpv6FakeIp ? effectiveProxy : undefined;
+    const proxy = (allowMihomoIpv6FakeIp && effectiveProxy) ? effectiveProxy : undefined;
     return globalThis.fetch(url, { ...init, method, redirect: "manual", ...(proxy ? { proxy } : {}) });
   }
   if (proxyConfigured && resolved.privateNetwork && !noProxyMatches(parsed)) {

package/src/oauth/index.ts

@@ -41,6 +41,7 @@ import { loginCursor, refreshCursorToken } from "./cursor";
 import { loginGithubCopilot, refreshGithubCopilotToken, validateCopilotApiBaseUrl } from "./github-copilot";
 import { loginCommandCode, refreshCommandCodeToken } from "./command-code";
 import { loginMetaMuse, refreshMetaMuseToken } from "./meta-muse";
+import { loginOrcaRouter, orcaRouterInferenceBaseUrl, refreshOrcaRouterKey } from "./orcarouter";
 import { ANTIGRAVITY_REQUEST_UA } from "../adapters/google-antigravity-wire";
 import { deriveOAuthDefaultModel, deriveOAuthProviderConfig } from "../providers/derive";
 import { apiKeyPoolEntryId, sanitizeApiKeyValue } from "../providers/api-keys";
@@ -180,7 +181,7 @@ export interface LoginFlowLifecycle {
 }
 
 interface OAuthProviderDef {
-  login(ctrl: OAuthController, opts?: LoginOpts): Promise<OAuthCredentials>;
+  login(ctrl: OAuthController, opts?: LoginOpts, providerConfig?: OcxProviderConfig): Promise<OAuthCredentials>;
   refresh(
     refreshToken: string,
     signal?: AbortSignal,
@@ -188,6 +189,8 @@ interface OAuthProviderDef {
   ): Promise<OAuthCredentials>;
   /** provider entry written into config.json on first login. */
   providerConfig: OcxProviderConfig;
+  /** Resolve login-owned config from the latest disk state (for configurable OAuth origins). */
+  resolveProviderConfig?: (config: OcxConfig) => OcxProviderConfig;
   defaultModel: string;
   /**
    * Built-in proactive-refresh policy, risk-tiered by the provider's ToS exposure (devlog
@@ -218,6 +221,27 @@ export const OAUTH_PROVIDERS: Record<string, OAuthProviderDef> = {
     defaultModel: oauthDefaultModel("command-code"),
     defaultRefreshPolicy: "disabled",
   },
+  "orcarouter-oauth": {
+    login: (ctrl, _opts, providerConfig) => loginOrcaRouter(ctrl, {
+      baseUrl: process.env.ORCAROUTER_API_BASE_URL
+        ?? process.env.ORCAROUTER_BASE_URL
+        ?? providerConfig?.baseUrl,
+      authBaseUrl: process.env.ORCAROUTER_AUTH_BASE_URL,
+    }),
+    refresh: refreshOrcaRouterKey,
+    providerConfig: oauthConfig("orcarouter-oauth"),
+    resolveProviderConfig: config => ({
+      ...oauthConfig("orcarouter-oauth"),
+      baseUrl: orcaRouterInferenceBaseUrl(
+        process.env.ORCAROUTER_API_BASE_URL
+          ?? process.env.ORCAROUTER_BASE_URL
+          ?? config.providers["orcarouter-oauth"]?.baseUrl,
+      ),
+    }),
+    defaultModel: oauthDefaultModel("orcarouter-oauth"),
+    // The credential is a durable API key. There is no refresh endpoint.
+    defaultRefreshPolicy: "disabled",
+  },
   xai: {
     // forceLogin skips the local grok-cli import so a SECOND account can be chosen in the browser.
     login: (ctrl, opts) => loginXai(ctrl, { importLocal: opts?.forceLogin ? "off" : "fallback" }),
@@ -548,7 +572,13 @@ export async function getValidAccessTokenSnapshot(provider: string): Promise<OAu
 }
 
 /** Providers whose upstream-401 replay path may force a snapshot refresh. */
-const FORCE_REFRESH_PROVIDERS = new Set(["xai", "github-copilot", "kiro", "google-antigravity"]);
+const FORCE_REFRESH_PROVIDERS = new Set([
+  "xai",
+  "github-copilot",
+  "kiro",
+  "google-antigravity",
+  "orcarouter-oauth",
+]);
 
 export async function forceRefreshOAuthAccessSnapshot(
   rejected: OAuthAccessSnapshot,
@@ -1442,10 +1472,11 @@ export function upsertOAuthProvider(config: OcxConfig, provider: string): void {
   const namespaceCollision = codexAccountNamespaceProviderCollisionError(config.codexAccountNamespaces, provider);
   if (namespaceCollision) throw new Error(namespaceCollision);
   const existing = config.providers[provider];
+  const providerConfig = def.resolveProviderConfig?.(config) ?? def.providerConfig;
   // Clone operator state, including xAI wire choices and their migration version.
-  const next: OcxProviderConfig = structuredClone(existing ?? def.providerConfig);
+  const next: OcxProviderConfig = structuredClone(existing ?? providerConfig);
   for (const field of OAUTH_LOGIN_OWNED_PROVIDER_FIELDS) {
-    const value = def.providerConfig[field];
+    const value = providerConfig[field];
     if (value === undefined) delete next[field];
     else next[field] = structuredClone(value) as never;
   }
@@ -1454,7 +1485,7 @@ export function upsertOAuthProvider(config: OcxConfig, provider: string): void {
   if (next.googleMode === "cloud-code-assist") delete next.project;
   // Login used to rebuild the whole row from the preset, so catalog data refreshed
   // immediately. Keep that timing without overwriting unrelated operator-owned fields.
-  applyOAuthPresetCatalog(next, def.providerConfig);
+  applyOAuthPresetCatalog(next, providerConfig);
   // The original Command Code seed was an implementation-owned static catalog, not an
   // operator opt-out. Promote that exact legacy shape when OAuth login refreshes the row.
   if (provider === "command-code" && existing && isLegacyCommandCodeStaticCatalog(existing)) {
@@ -1532,8 +1563,8 @@ export async function runLogin(
   if (!def) throw new UnsupportedOAuthProviderError(provider);
   const loadLatestConfig = deps.loadConfig ?? loadConfig;
   const saveLatestConfig = deps.saveConfig ?? saveConfig;
-  if (provider !== "chatgpt") {
-    const preflightConfig = loadLatestConfig();
+  const preflightConfig = provider !== "chatgpt" ? loadLatestConfig() : undefined;
+  if (preflightConfig) {
     const namespaceCollision = codexAccountNamespaceProviderCollisionError(
       preflightConfig.codexAccountNamespaces,
       provider,
@@ -1546,7 +1577,10 @@ export async function runLogin(
   const previousKiroAccounts = shouldRollbackKiroAccounts ? getAccountSet(provider) : undefined;
   const previousKiroActiveId = previousKiroAccounts?.activeAccountId;
   const previousKiroAccountIds = new Set(previousKiroAccounts?.accounts.map(account => account.id) ?? []);
-  const rawCred = await def.login(ctrl, opts);
+  const loginProviderConfig = preflightConfig
+    ? (def.resolveProviderConfig?.(preflightConfig) ?? preflightConfig.providers[provider] ?? def.providerConfig)
+    : def.providerConfig;
+  const rawCred = await def.login(ctrl, opts, loginProviderConfig);
   const cred: OAuthCredentials = rawCred.source ? rawCred : { ...rawCred, source: "oauth" };
   const settleKiroTransaction = deps.settleKiroLoginTransaction ?? settleKiroLoginTransaction;
   try {

package/src/oauth/orcarouter.ts

@@ -0,0 +1,200 @@
+/** OrcaRouter browser authorization: OAuth-style consent + PKCE, yielding a durable API key. */
+import { OAuthCallbackFlow, type OAuthCallbackFlowOptions } from "./callback-server";
+import { generatePKCE } from "./pkce";
+import type { OAuthController, OAuthCredentials } from "./types";
+
+export const ORCAROUTER_DEFAULT_API_BASE_URL = "https://api.orcarouter.ai";
+export const ORCAROUTER_DEFAULT_AUTH_BASE_URL = "https://www.orcarouter.ai";
+/** Backwards-compatible name for the inference/API origin. */
+export const ORCAROUTER_DEFAULT_BASE_URL = ORCAROUTER_DEFAULT_API_BASE_URL;
+const ORCAROUTER_CALLBACK_PORT = 51733;
+const ORCAROUTER_CALLBACK_PATH = "/callback";
+const ORCAROUTER_KEY_PREFIX = "sk-orca-";
+const TOKEN_REQUEST_TIMEOUT_MS = 30_000;
+
+export interface OrcaRouterLoginOptions {
+  /** Inference base URL. A non-public value also acts as the auth origin for one-origin self-hosting. */
+  baseUrl?: string;
+  /** Optional dedicated auth origin; the public service defaults to www.orcarouter.ai. */
+  authBaseUrl?: string;
+}
+
+interface OrcaRouterKeyPayload {
+  key?: unknown;
+  user_id?: unknown;
+  scope?: unknown;
+}
+
+function requestSignal(signal: AbortSignal | undefined): AbortSignal {
+  const timeout = AbortSignal.timeout(TOKEN_REQUEST_TIMEOUT_MS);
+  return signal ? AbortSignal.any([signal, timeout]) : timeout;
+}
+
+/**
+ * Resolve the one configurable OrcaRouter origin used by both auth and inference.
+ * Plain HTTP is accepted only on loopback so a long-lived key is never sent over a
+ * clear-text remote connection by a typo in `ORCAROUTER_BASE_URL`.
+ */
+export function normalizeOrcaRouterBaseUrl(raw = ORCAROUTER_DEFAULT_BASE_URL): string {
+  let parsed: URL;
+  try {
+    parsed = new URL(raw.trim());
+  } catch {
+    // Do not echo malformed input: it may contain credentials pasted into the URL.
+    throw new Error("OrcaRouter base URL is invalid");
+  }
+  const hostname = parsed.hostname.replace(/^\[|\]$/g, "").toLowerCase();
+  const loopback = hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1";
+  if (parsed.protocol !== "https:" && !(parsed.protocol === "http:" && loopback)) {
+    throw new Error("OrcaRouter base URL must use HTTPS (HTTP is allowed only on loopback)");
+  }
+  if (parsed.username || parsed.password || parsed.search || parsed.hash) {
+    throw new Error("OrcaRouter base URL must not contain credentials, a query, or a fragment");
+  }
+  const path = parsed.pathname.replace(/\/+$/, "");
+  if (path && path !== "/v1") {
+    throw new Error("OrcaRouter base URL path must be empty or /v1");
+  }
+  return parsed.origin;
+}
+
+export function orcaRouterInferenceBaseUrl(raw?: string): string {
+  return `${normalizeOrcaRouterBaseUrl(raw)}/v1`;
+}
+
+export function orcaRouterAuthBaseUrl(apiBaseUrl?: string, authBaseUrl?: string): string {
+  if (authBaseUrl) return normalizeOrcaRouterBaseUrl(authBaseUrl);
+  const apiOrigin = normalizeOrcaRouterBaseUrl(apiBaseUrl);
+  return apiOrigin === ORCAROUTER_DEFAULT_API_BASE_URL
+    ? ORCAROUTER_DEFAULT_AUTH_BASE_URL
+    : apiOrigin;
+}
+
+function parseKeyPayload(value: unknown): OAuthCredentials {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("OrcaRouter key exchange returned an invalid response");
+  }
+  const payload = value as OrcaRouterKeyPayload;
+  const key = typeof payload.key === "string" ? payload.key.trim() : "";
+  if (!key.startsWith(ORCAROUTER_KEY_PREFIX) || key.length > 4096 || /[\r\n]/.test(key)) {
+    throw new Error("OrcaRouter key exchange did not return a valid API key");
+  }
+  // The documented key/user_id response omits scope. If supplied, it must match
+  // the api scope requested by this PKCE flow.
+  if (payload.scope !== undefined && payload.scope !== "api") {
+    throw new Error("OrcaRouter key exchange did not grant the required api scope");
+  }
+  const accountId = typeof payload.user_id === "string"
+    ? payload.user_id.trim()
+    : typeof payload.user_id === "number" && Number.isSafeInteger(payload.user_id)
+      ? String(payload.user_id)
+      : "";
+  if (!accountId || accountId.length > 256 || /[\x00-\x1f\x7f]/.test(accountId)) {
+    throw new Error("OrcaRouter key exchange did not return a valid user id");
+  }
+  // OrcaRouter issues a normal long-lived API key, not a refresh token. The OAuth
+  // store requires both fields, so mirror the established Command Code key-grant
+  // representation. `expires` prevents background refresh; an upstream 401 asks the
+  // user to reconnect and mint a replacement key.
+  return {
+    access: key,
+    refresh: key,
+    expires: Number.MAX_SAFE_INTEGER,
+    accountId,
+    source: "oauth",
+  };
+}
+
+function assertDurableApiKey(apiKey: string): void {
+  const key = apiKey.trim();
+  if (!key.startsWith(ORCAROUTER_KEY_PREFIX) || key.length > 4096 || /[\r\n]/.test(key)) {
+    throw new Error("OrcaRouter API key is invalid; reconnect with ocx login orcarouter-oauth");
+  }
+}
+
+export class OrcaRouterOAuthFlow extends OAuthCallbackFlow {
+  readonly #authBaseUrl: string;
+  #verifier = "";
+
+  constructor(ctrl: OAuthController, options: OrcaRouterLoginOptions = {}) {
+    super(ctrl, {
+      preferredPort: ORCAROUTER_CALLBACK_PORT,
+      callbackPath: ORCAROUTER_CALLBACK_PATH,
+      callbackHostname: "127.0.0.1",
+      callbackBindHostname: "127.0.0.1",
+    } satisfies OAuthCallbackFlowOptions);
+    this.#authBaseUrl = orcaRouterAuthBaseUrl(options.baseUrl, options.authBaseUrl);
+  }
+
+  async generateAuthUrl(state: string, redirectUri: string): Promise<{ url: string; instructions: string }> {
+    const pkce = await generatePKCE();
+    this.#verifier = pkce.verifier;
+    const url = new URL("/auth", this.#authBaseUrl);
+    url.search = new URLSearchParams({
+      callback_url: redirectUri,
+      code_challenge: pkce.challenge,
+      code_challenge_method: "S256",
+      state,
+      app_name: "OpenCodex",
+      scope: "api",
+    }).toString();
+    return {
+      url: url.toString(),
+      instructions:
+        "Approve access in your browser. If the browser cannot reach this machine, choose the displayed-code option and paste the code here.",
+    };
+  }
+
+  async exchangeToken(code: string, _state: string, _redirectUri: string): Promise<OAuthCredentials> {
+    if (!this.#verifier) throw new Error("OrcaRouter PKCE verifier was not initialized");
+    let response: Response;
+    try {
+      response = await fetch(new URL("/api/v1/auth/keys", this.#authBaseUrl), {
+        method: "POST",
+        headers: { Accept: "application/json", "Content-Type": "application/json" },
+        body: JSON.stringify({
+          code,
+          code_verifier: this.#verifier,
+          code_challenge_method: "S256",
+        }),
+        redirect: "error",
+        signal: requestSignal(this.ctrl.signal),
+      });
+    } catch (error) {
+      if (this.ctrl.signal?.aborted) {
+        throw this.ctrl.signal.reason ?? new DOMException("OrcaRouter login aborted", "AbortError");
+      }
+      throw new Error("OrcaRouter key exchange failed: network error", { cause: error });
+    }
+    if (!response.ok) {
+      // The body is deliberately not reflected: authentication error payloads must
+      // never turn a code, verifier, or accidentally returned key into console output.
+      throw new Error(`OrcaRouter key exchange failed with HTTP ${response.status}`);
+    }
+    let payload: unknown;
+    try {
+      payload = await response.json();
+    } catch {
+      throw new Error("OrcaRouter key exchange returned invalid JSON");
+    }
+    return parseKeyPayload(payload);
+  }
+}
+
+export async function loginOrcaRouter(
+  ctrl: OAuthController,
+  options: OrcaRouterLoginOptions = {},
+): Promise<OAuthCredentials> {
+  if (ctrl.signal?.aborted) {
+    throw ctrl.signal.reason ?? new DOMException("OrcaRouter login aborted", "AbortError");
+  }
+  return new OrcaRouterOAuthFlow(ctrl, options).login();
+}
+
+export async function refreshOrcaRouterKey(apiKey: string): Promise<never> {
+  assertDurableApiKey(apiKey);
+  // This hook is reached only after upstream rejected the durable key. There is no refresh
+  // grant to replay, so classify the credential as terminal and let the shared generation-safe
+  // refresh path mark this exact account as needing a new browser login.
+  throw new Error("invalid_grant: OrcaRouter API keys cannot be refreshed; reconnect with ocx login orcarouter-oauth");
+}

package/src/providers/key-store.ts

@@ -64,6 +64,16 @@ function keychainAccount(reference: string): string {
   return reference.slice(KEYCHAIN_REFERENCE_PREFIX.length);
 }
 
+/**
+ * A reference belongs to `name` only when its account is that provider's own active account
+ * or one of its pool accounts. `storeProviderKeyInKeychain` writes exactly those two shapes,
+ * so anything else in a provider's config names another provider's secret.
+ */
+function keychainReferenceBelongsToProvider(reference: string, name: string): boolean {
+  const account = keychainAccount(reference);
+  return account === name || account.startsWith(`${name}/`);
+}
+
 function readKeychain(account: string): string | undefined {
   const cached = resolvedCache.get(account);
   if (cached !== undefined) return cached;
@@ -185,6 +195,18 @@ export function restoreProviderKeyFromKeychain(config: OcxConfig, name: string):
   const pool = provider.apiKeyPool ?? [];
   const resolved = new Map<string, string>();
   const refs = [provider.apiKey, ...pool.map(e => e.key)].filter(isKeychainReference);
+  // Restore reads a secret out of the keychain, writes it back to config as plaintext, and then
+  // DELETES the keychain item. Following a reference to another provider's account would both
+  // disclose that secret through this provider's config and destroy the real owner's credential,
+  // so refuse before anything is read or removed.
+  const foreign = refs.filter(ref => !keychainReferenceBelongsToProvider(ref, name));
+  if (foreign.length > 0) {
+    return {
+      ok: false,
+      error: `provider "${name}" references a keychain account it does not own (${foreign.length} reference(s)); config left unchanged`,
+      status: 400,
+    };
+  }
   for (const ref of refs) {
     const account = keychainAccount(ref);
     if (resolved.has(account)) continue;

package/src/providers/registry.ts

@@ -1122,6 +1122,45 @@ const CLINE_PASS_MODELS = [
   "cline-pass/qwen3.7-max",
   "cline-pass/qwen3.7-plus",
 ];
+
+const ORCAROUTER_MODEL_DISCOVERY: ProviderModelDiscoverySpec = {
+  path: "models",
+  query: { capability: "chat" },
+  maxResponseBytes: 512 * 1024,
+  maxModels: 512,
+  filter: {
+    anyOf: [{
+      path: ["supported_endpoint_types"],
+      containsAny: ["openai", "openai-response", "anthropic", "gemini"],
+      caseInsensitive: true,
+    }],
+    noneOf: [{
+      path: ["supported_endpoint_types"],
+      containsAny: ["image-generation", "openai-video", "jina-rerank"],
+      caseInsensitive: true,
+    }],
+  },
+};
+// Preserve the previously verified cold-start catalog. Live discovery remains authoritative
+// when it succeeds, but a temporary catalog outage must not erase the provider's known-good
+// selectors from the picker. `orcarouter/auto` is intentionally retained here even though the
+// public catalog did not enumerate it at the latest verification (2026-09-07).
+const ORCAROUTER_MODELS = [
+  "openai/gpt-5.5",
+  "anthropic/claude-opus-4.8",
+  "google/gemini-3.5-flash",
+  "deepseek/deepseek-v4-pro",
+  "orcarouter/auto",
+];
+const ORCAROUTER_TEXT_ONLY_MODELS = ["deepseek/deepseek-v4-pro"];
+const ORCAROUTER_MODEL_REASONING_EFFORTS = {
+  // Live /models currently exposes ids and modalities, not the accepted reasoning ladder.
+  "openai/gpt-5.5": ["low", "medium", "high", "xhigh"],
+  "deepseek/deepseek-v4-pro": deepseekThinkingEffortsFor("deepseek/deepseek-v4-pro"),
+};
+const ORCAROUTER_MODEL_REASONING_EFFORT_MAP = {
+  "deepseek/deepseek-v4-pro": deepseekReasoningMapFor("deepseek/deepseek-v4-pro"),
+};
 const CLINE_PASS_MODEL_CONTEXT_WINDOWS: Record<string, number> = {
   "cline-pass/glm-5.3": 1_048_576,
   "cline-pass/glm-5.3-flash": 1_048_576,
@@ -1360,6 +1399,25 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
     // The proprietary generate wire has no verified per-request serialization flag.
     parallelToolCalls: false,
   },
+  {
+    id: "orcarouter-oauth",
+    label: "OrcaRouter - Auth",
+    adapter: "openai-chat",
+    baseUrl: "https://api.orcarouter.ai/v1",
+    authKind: "oauth",
+    oauthId: "orcarouter-oauth",
+    featured: true,
+    allowBaseUrlOverride: true,
+    defaultModel: "openai/gpt-5.5",
+    models: ORCAROUTER_MODELS,
+    liveModels: true,
+    modelDiscovery: ORCAROUTER_MODEL_DISCOVERY,
+    noVisionModels: ORCAROUTER_TEXT_ONLY_MODELS,
+    modelReasoningEfforts: ORCAROUTER_MODEL_REASONING_EFFORTS,
+    modelReasoningEffortMap: ORCAROUTER_MODEL_REASONING_EFFORT_MAP,
+    preserveReasoningContentModels: ORCAROUTER_TEXT_ONLY_MODELS,
+    note: "Connect your OrcaRouter account with OAuth 2.0 + PKCE; the issued API key is stored in OpenCodex's existing credential store.",
+  },
   {
     id: "anthropic",
     label: "Anthropic Claude",
@@ -1834,37 +1892,23 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
     note: "Cline usage-billing API: one key, 100+ models, OpenRouter-style ids. Promotional free models are IDE/CLI-only per Cline docs; minimax/minimax-m2.5 is the documented API free experimentation model.",
   },
   {
-    // OrcaRouter: OpenAI-compatible adaptive router (api.orcarouter.ai). Model ids are
-    // vendor-namespaced (`<vendor>/<model>`) and pass through to the upstream as-is.
-    // The default pins a tool-capable model; the adaptive `orcarouter/auto` router is also
-    // selectable. Live-verified 2026-07-20: /v1/chat/completions accepts the `tools` field
-    // and routes to a function-calling-capable upstream.
-    id: "orcarouter", label: "OrcaRouter", adapter: "openai-chat", baseUrl: "https://api.orcarouter.ai/v1",
+    // OrcaRouter: OpenAI-compatible adaptive router (api.orcarouter.ai). The public live
+    // catalog is authoritative; model ids and input modalities are never maintained here.
+    id: "orcarouter", label: "OrcaRouter - API", adapter: "openai-chat", baseUrl: "https://api.orcarouter.ai/v1",
     authKind: "key", dashboardUrl: "https://www.orcarouter.ai/console",
+    // The catalog is public, so a successful /models probe cannot validate a submitted key.
+    apiKeyValidation: "unknown",
     defaultModel: "openai/gpt-5.5",
-    models: [
-      "openai/gpt-5.5",
-      "anthropic/claude-opus-4.8",
-      "google/gemini-3.5-flash",
-      "deepseek/deepseek-v4-pro",
-      "orcarouter/auto",
-    ],
-    // Text-only models → the vision sidecar describes images instead.
-    noVisionModels: ["deepseek/deepseek-v4-pro"],
-    // Reasoning/temperature behavior verified live 2026-07-20 against api.orcarouter.ai:
-    // - openai/gpt-5.5 accepts reasoning_effort none|low|medium|high|xhigh but rejects `max` (400),
-    //   so advertise up to xhigh and let mapReasoningEffort clamp a `max`/`ultra` request to xhigh.
-    // - deepseek/deepseek-v4-pro mirrors the direct-DeepSeek wiring (thinking-effort map +
-    //   reasoning_content history replay) so the namespaced selection behaves identically.
-    // - temperature is accepted by every seeded model (gpt-5.5, claude-opus-4.8, deepseek-v4-pro all
-    //   returned 200), so no noTemperatureModels entry is warranted here.
-    modelReasoningEfforts: {
-      "openai/gpt-5.5": ["low", "medium", "high", "xhigh"],
-      "deepseek/deepseek-v4-pro": deepseekThinkingEffortsFor("deepseek/deepseek-v4-pro"),
-    },
-    modelReasoningEffortMap: { "deepseek/deepseek-v4-pro": deepseekReasoningMapFor("deepseek/deepseek-v4-pro") },
-    preserveReasoningContentModels: ["deepseek/deepseek-v4-pro"],
-    note: "OpenAI-compatible adaptive router. Default is a tool-capable model; orcarouter/auto (adaptive routing) is also selectable. Full catalog: https://www.orcarouter.ai/models",
+    models: ORCAROUTER_MODELS,
+    liveModels: true,
+    modelDiscovery: ORCAROUTER_MODEL_DISCOVERY,
+    // Catalog discovery owns WHICH models exist. These entries only retain verified
+    // request-shaping facts that the upstream catalog does not currently publish.
+    noVisionModels: ORCAROUTER_TEXT_ONLY_MODELS,
+    modelReasoningEfforts: ORCAROUTER_MODEL_REASONING_EFFORTS,
+    modelReasoningEffortMap: ORCAROUTER_MODEL_REASONING_EFFORT_MAP,
+    preserveReasoningContentModels: ORCAROUTER_TEXT_ONLY_MODELS,
+    note: "OpenAI-compatible adaptive router. Models and multimodal capabilities are discovered live from the public chat catalog. Use the OrcaRouter account entry for PKCE login.",
   },
   {
     // BizRouter: Korean enterprise LLM gateway (api.bizrouter.ai). Model ids are
@@ -3081,6 +3125,11 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
       "gpt-5.6-luna": "openai-responses",
       "gpt-5.6-sol": "openai-responses",
       "gpt-5.6-terra": "openai-responses",
+      "gpt-6-astra": "openai-responses",
+      "grok-4.5": "openai-responses",
+      "grok-4.6": "openai-responses",
+      "mai-code-1.1-flash": "openai-responses",
+      "mai-code-1-flash-picker": "openai-responses",
     },
     note: "Experimental unofficial Copilot bridge. Logs in via GitHub device flow using the public VS Code OAuth client id, then exchanges for a short-lived Copilot API token (copilot_internal). Requires an active Copilot subscription. GitHub may tighten or revoke this path; do not send confidential material you would not paste into Copilot Chat.",
   },