@bitkyc08/opencodex 2.46.0 → 2.47.0

package/src/types/config.ts

@@ -544,6 +544,8 @@ export interface OcxConfig {
    * set, the lower one wins for sub-agents. See src/server/effort-policy.ts.
    */
   subagentEffortCap?: string;
+  /** Global model effort overrides, after provider model/wide pins; none means omission. */
+  modelPinnedEfforts?: Record<string, string>;
   /**
    * Models hidden from Codex discovery without blocking direct proxy calls. Routed provider ids
    * are excluded from the catalog + /v1/models entirely. Account-qualified native ids hide only
@@ -723,6 +725,9 @@ export interface OcxConfig {
     /** Upstream reset timestamps already activated, retained across restarts. */
     lastFiveHourResetAt?: number;
     lastWeeklyResetAt?: number;
+    /** Observed boundaries retained until activation, even if an idle upstream clock moves. */
+    nextFiveHourResetAt?: number;
+    nextWeeklyResetAt?: number;
   }>;
   /**
    * Selection order per account id, higher used earlier; absent = 0. Keyed by id

package/src/types/provider.ts

@@ -493,6 +493,10 @@ export interface OcxProviderConfig {
   modelReasoningEfforts?: Record<string, string[]>;
   /** Model-specific default Codex reasoning tier; must also be present in the visible tier list. */
   modelDefaultReasoningEfforts?: Record<string, string>;
+  /** Operator-owned effort override; none omits effort and uses the provider default. */
+  pinnedReasoningEffort?: string;
+  /** Per-model operator override, ahead of provider-wide and global pins; caps still apply. */
+  modelPinnedReasoningEfforts?: Record<string, string>;
   /**
    * Model-specific Codex reasoning-summary capability. Set false when an OpenAI-compatible
    * Responses backend rejects Codex summary-delivery fields for that model.

package/src/usage/cost.ts

@@ -16,10 +16,10 @@ import {
 } from "../generated/model-metadata";
 import type { AttemptTierOutcome, OcxUsage } from "../types";
 import { canonicalFastTierMarker } from "../providers/fastwire";
-import { baseProviderLabel, canonicalUsageProviderLabel } from "../providers/label";
+import { baseProviderLabel } from "../providers/label";
 import type { PersistedUsageAttempt, UsageStatus } from "./log";
 import { canonicalAntigravityUsageModel } from "../providers/antigravity-models";
-import { activeConfiguredProviders, activeUserCostOverlays, userCostOverlayVersion } from "./user-cost-overlays";
+import { activeAccountPricingProviders, activeConfiguredProviders, activeUserCostOverlays, userCostOverlayVersion } from "./user-cost-overlays";
 import {
   EXPECTED_PRICE_OVERLAYS,
   findExpectedPriceOverlay,
@@ -177,8 +177,8 @@ export function calculateCost(tokens: CostTokens, cost4: Cost4): CostBreakdown {
  * bundle) nonzero -> overlay verified -> overlay verified-derived -> jawcode
  * model-level vendor price (cross-provider fallback: a model follows its official
  * vendor price — WP5 policy, e.g. kiro/claude-opus-4-6 uses the anthropic price)
- * -> null. All-zero rows are overlay candidates (zero is "not billable here",
- * not "free").
+ * -> null. An explicit all-zero user override means free; all-zero catalog
+ * rows remain overlay candidates rather than evidence of free pricing.
  */
 export function resolveMatchedPrice(
   provider: string,
@@ -187,21 +187,18 @@ export function resolveMatchedPrice(
   userOverlays: readonly ExpectedPriceOverlay[] = activeUserCostOverlays(),
   options: PriceResolutionOptions = {},
 ): MatchedPrice | null {
-  // User-configured overlays are keyed by the EXACT configured provider name.
-  // A provider that literally exists in config.providers keeps its own pricing
-  // namespace: a real custom provider can legitimately end with a label-shaped
-  // suffix (e.g. acme-pabcdef) and must not inherit the base provider's user
-  // overlay. Only NON-configured names (generated account log labels) collapse
-  // to their label base. chatgpt/openai-multi are the same OpenAI usage surface
-  // and always canonicalize to openai.
-  const collapsed = baseProviderLabel(provider);
-  if (collapsed !== provider && (canonicalUsageProviderLabel(provider) !== provider || !activeConfiguredProviders().has(provider))) {
+  // Literal configured providers win over account identities. Only then use
+  // config-owned Codex identities, followed by the existing historical suffix
+  // grammar. Never infer an account by stripping an arbitrary suffix.
+  const namespace = activeConfiguredProviders().has(provider)
+    ? provider
+    : activeAccountPricingProviders().get(provider) ?? baseProviderLabel(provider);
+  if (namespace !== provider) {
+    // An exact override (including caller-supplied rows) owns its namespace.
+    // Unchanged names use the memoized inner lookup's existing user-first order.
     const exactUserOverlay = userOverlayMatch(provider, modelId, userOverlays);
     if (exactUserOverlay) return exactUserOverlay;
-    // Pool/account log suffixes (e.g. google-antigravity-p442fff) must collapse
-    // before the compiled/overlay lookup; configured providers keep their own
-    // namespace above.
-    provider = collapsed;
+    provider = namespace;
   }
   // Memoize by (provider, model): usage summaries iterate hundreds of thousands of
   // rows that share a handful of provider/model keys, so resolving each time would
@@ -247,7 +244,7 @@ function resolveMatchedPriceInner(
 /**
  * Exact provider/model price lookup: user-configured `modelCosts` first, then
  * an exact official correction, the jawcode provider bundle, the expected-price overlay, then the
- * model-level vendor fallback. All-zero rows fall through ("not billable").
+ * model-level vendor fallback. All-zero catalog rows fall through; user zeros win.
  */
 function resolveMatchedPriceExact(
   provider: string,
@@ -305,14 +302,14 @@ function resolveMatchedPriceExact(
   };
 }
 
-/** User-configured overlay match (all-zero rows fall through like any other source). */
+/** User-configured overlay match; explicit zero rates are authoritative too. */
 function userOverlayMatch(
   provider: string,
   modelId: string,
   userOverlays: readonly ExpectedPriceOverlay[],
 ): MatchedPrice | null {
   const overlay = findExpectedPriceOverlay(provider, modelId, userOverlays);
-  if (!overlay || !validCost4(overlay.cost4) || !hasNonZeroCost(overlay.cost4)) return null;
+  if (!overlay || !validCost4(overlay.cost4)) return null;
   return {
     provider,
     modelId,
@@ -466,7 +463,7 @@ function applyContextTier(
   tier?: ServiceTierInput,
 ): [Cost4, ContextTierName | undefined, boolean] {
   if (rawInputTokens === undefined) return [cost4, undefined, false];
-  const rule = findContextTier(baseProviderLabel(provider), modelId);
+  const rule = findContextTier(provider, modelId);
   if (!rule || !isLongContext(rule, rawInputTokens)) return [cost4, undefined, false];
   const confirmedFast = isConfirmedFast(tier);
   if (confirmedFast && rule.confirmedPriorityRelation === "exclusive") {
@@ -494,9 +491,8 @@ function applyPriorityMultiplier(
   contextTier?: ContextTierName,
 ): [Cost4, number] {
   if (canonicalFastTierMarker(tierScalar(serviceTier)) !== "priority") return [cost4, 1];
-  const base = baseProviderLabel(provider);
-  if (contextTier && findContextTier(base, modelId)?.confirmedPriorityRelation !== "stack") return [cost4, 1];
-  const rule = findPriorityPricingRule(base, modelId);
+  if (contextTier && findContextTier(provider, modelId)?.confirmedPriorityRelation !== "stack") return [cost4, 1];
+  const rule = findPriorityPricingRule(provider, modelId);
   if (rule?.requiresResponseConfirmation && !isConfirmedFast(serviceTier)) return [cost4, 1];
   const multiplier = rule?.multiplier ?? 1;
   if (multiplier === 1) return [cost4, 1];
@@ -524,7 +520,7 @@ function isOpenRouterPriorityLowerBound(
   provider: string,
   outcome: AttemptTierOutcome | undefined,
 ): boolean {
-  return baseProviderLabel(provider) === "openrouter"
+  return provider === "openrouter"
     && outcome?.canonical === "priority"
     && outcome.fastOutcome === "applied"
     && (outcome.confirmation === "confirmed" || outcome.confirmation === "assumed");
@@ -550,13 +546,13 @@ export function estimateAttemptCost(
     ? serviceTierContextFromOutcome(attempt.tierOutcome)
     : serviceTier;
   const [tieredCost4, contextTier, contextPriorityLowerBound] = applyContextTier(
-    price.cost4, attempt.provider, attempt.model, attempt.usage.inputTokens, attemptServiceTier,
+    price.cost4, price.provider, attempt.model, attempt.usage.inputTokens, attemptServiceTier,
   );
   const [effectiveCost4, multiplier] = applyPriorityMultiplier(
-    tieredCost4, attempt.provider, attempt.model, attemptServiceTier, contextTier,
+    tieredCost4, price.provider, attempt.model, attemptServiceTier, contextTier,
   );
   const priorityLowerBound = contextPriorityLowerBound
-    || isOpenRouterPriorityLowerBound(attempt.provider, attempt.tierOutcome);
+    || isOpenRouterPriorityLowerBound(price.provider, attempt.tierOutcome);
   return {
     ordinal: attempt.ordinal,
     provider: attempt.provider,
@@ -635,13 +631,13 @@ export function estimateRequestCost(
   const price = resolveMatchedPrice(input.provider, input.model, overlays, userOverlays, input);
   if (!price) return null;
   const [tieredCost4, contextTier, contextPriorityLowerBound] = applyContextTier(
-    price.cost4, input.provider, input.model, input.usage.inputTokens, input.serviceTier,
+    price.cost4, price.provider, input.model, input.usage.inputTokens, input.serviceTier,
   );
   const [effectiveCost4, multiplier] = applyPriorityMultiplier(
-    tieredCost4, input.provider, input.model, input.serviceTier, contextTier,
+    tieredCost4, price.provider, input.model, input.serviceTier, contextTier,
   );
   const priorityLowerBound = contextPriorityLowerBound || isOpenRouterPriorityLowerBound(
-    input.provider,
+    price.provider,
     typeof input.serviceTier === "object" ? input.serviceTier.tierOutcome : undefined,
   );
   return {

package/src/usage/summary.ts

@@ -1,6 +1,7 @@
 import { baseProviderLabel } from "../providers/label";
 import { canonicalAntigravityUsageModel } from "../providers/antigravity-models";
 import { usageDisplayTotalTokens } from "./totals";
+import type { UsageTimeWindow } from "./time-range";
 import { isUnresolvedRequestedModel, usageModelPriceOptions } from "./model-identity";
 import { isCodexUsageAccountLogLabel, type PersistedUsageEntry, type UsageStatus } from "./log";
 import { type AttemptCostEstimate, type CostEstimate, estimateAttemptCost, estimateRequestCost, serviceTierContext, type ServiceTierContext } from "./cost";
@@ -145,6 +146,8 @@ export interface UsageSummary {
   range: UsageRange;
   surface: UsageSurface;
   since: number | null;
+  customWindow?: true;
+  until?: number;
   generatedAt: number;
   summary: UsageSummaryTotals;
   days: UsageDay[];
@@ -297,6 +300,25 @@ function dayCountForAllRange(oldest: number | null, now: number): number {
   return Math.min(MAX_USAGE_DAY_BUCKETS, Math.max(1, days));
 }
 
+function customWindowDates(window: UsageTimeWindow): string[] {
+  const start = startOfLocalDay(window.since);
+  const date = new Date(startOfLocalDay(window.until));
+  const dates: string[] = [];
+  while (date.getTime() >= start && dates.length < MAX_USAGE_DAY_BUCKETS) {
+    dates.push(localDateKey(date.getTime()));
+    const previous = date.getTime();
+    date.setDate(date.getDate() - 1);
+    date.setHours(0, 0, 0, 0);
+    // A skipped civil day can normalize back to this same midnight (Apia, 2011).
+    // Move through the preceding instant to find the prior existing local day.
+    if (date.getTime() >= previous) {
+      date.setTime(previous - 1);
+      date.setHours(0, 0, 0, 0);
+    }
+  }
+  return dates.reverse();
+}
+
 function blankTotals(): UsageSummaryTotals {
   return {
     requests: 0,
@@ -1015,6 +1037,7 @@ class StreamingUsageSummaryAccumulator implements UsageSummaryAccumulator {
   private readonly requestIds: Map<string, number> | null;
   private readonly filter: NormalizedUsageFilter | null;
   private readonly mode: UsageAccumulatorMode;
+  private readonly window: UsageTimeWindow | undefined;
   private nextRequestId = 0;
   private nextOrdinal = 0;
   private snapshotStart: number | null = null;
@@ -1025,6 +1048,7 @@ class StreamingUsageSummaryAccumulator implements UsageSummaryAccumulator {
   constructor(options?: {
     filter?: { provider?: string | null; model?: string | null; apiKeyId?: string | null };
     mode?: UsageAccumulatorMode;
+    window?: UsageTimeWindow;
   }) {
     const provider = normalizeFilterValue(options?.filter?.provider);
     const model = normalizeFilterValue(options?.filter?.model);
@@ -1033,6 +1057,7 @@ class StreamingUsageSummaryAccumulator implements UsageSummaryAccumulator {
       ? null
       : { provider, model, apiKeyId };
     this.mode = options?.mode ?? "exact";
+    this.window = options?.window ? Object.freeze({ ...options.window }) : undefined;
     this.requestIds = this.mode === "exact" ? new Map() : null;
   }
 
@@ -1048,6 +1073,7 @@ class StreamingUsageSummaryAccumulator implements UsageSummaryAccumulator {
     const cloned = new StreamingUsageSummaryAccumulator({
       ...(this.filter ? { filter: this.filter } : {}),
       mode: this.mode,
+      window: this.window,
     });
     cloned.nextRequestId = this.nextRequestId;
     cloned.nextOrdinal = this.nextOrdinal;
@@ -1276,6 +1302,8 @@ class StreamingUsageSummaryAccumulator implements UsageSummaryAccumulator {
         ? sourceEntry.timestamp
         : Math.max(this.snapshotEnd, sourceEntry.timestamp);
     }
+    if (this.window && (!Number.isFinite(sourceEntry.timestamp)
+      || sourceEntry.timestamp < this.window.since || sourceEntry.timestamp > this.window.until)) return;
     const projected = this.filter ? projectedEntryForFilter(sourceEntry, this.filter) : { entry: sourceEntry, comboOverlap: false };
     if (!projected) return;
     this.comboOverlap ||= projected.comboOverlap;
@@ -1340,7 +1368,9 @@ class StreamingUsageSummaryAccumulator implements UsageSummaryAccumulator {
     now: number,
     surface: UsageSurface = "all",
   ): UsageSummary & { filter?: UsageFilterEcho } {
-    const { since, days: fixedDays } = rangeWindow(range, now);
+    const preset = rangeWindow(range, now);
+    const since = this.window?.since ?? preset.since;
+    const fixedDays = preset.days;
     const totals = blankTotals();
     const models = new Map<string, UsageModelAccumulator>();
     const providers = new Map<string, UsageModelAccumulator>();
@@ -1351,7 +1381,7 @@ class StreamingUsageSummaryAccumulator implements UsageSummaryAccumulator {
 
     for (const partition of this.partitions.values()) {
       if (!usageSurfaceMatches(partition.surface, surface)) continue;
-      if (since !== null && partition.dayStart < since) continue;
+      if (!this.window && since !== null && partition.dayStart < since) continue;
       mergeTotals(totals, partition.totals);
       mergeModelMaps(models, partition.models);
       if (partition.providers) mergeModelMaps(providers, partition.providers);
@@ -1377,27 +1407,34 @@ class StreamingUsageSummaryAccumulator implements UsageSummaryAccumulator {
     }
     finalizeCoverage(totals);
 
-    const dayCount = range === "all" ? dayCountForAllRange(oldestTimestamp, now) : fixedDays;
-    const startOfToday = startOfLocalDay(now);
+    const customDates = this.window ? new Set(customWindowDates(this.window)) : null;
+    const dayCount = customDates?.size ?? (range === "all" ? dayCountForAllRange(oldestTimestamp, now) : fixedDays);
+    const startOfToday = startOfLocalDay(this.window?.until ?? now);
     const firstVisibleDay = new Date(startOfToday);
     firstVisibleDay.setDate(firstVisibleDay.getDate() - dayCount + 1);
     const firstVisibleDate = localDateKey(firstVisibleDay.getTime());
     const lastVisibleDate = localDateKey(startOfToday);
-    for (let offset = dayCount - 1; offset >= 0; offset--) {
+    const visibleDates = customDates ?? new Set<string>();
+    for (let offset = dayCount - 1; !customDates && offset >= 0; offset--) {
       const date = new Date(startOfToday);
       date.setDate(date.getDate() - offset);
-      const key = localDateKey(date.getTime());
+      visibleDates.add(localDateKey(date.getTime()));
+    }
+    for (const key of visibleDates) {
       if (!dayAccumulators.has(key)) {
         dayAccumulators.set(key, { totals: blankTotals(), models: new Map(), modelOverlaps: [] });
       }
     }
-    const days = [...dayAccumulators]
+    const visibleDays = customDates
+      ? [...customDates].map(date => [date, dayAccumulators.get(date)!] as const)
+      : [...dayAccumulators]
       // All-history totals, models, providers, and accounts still cover every
       // retained row. Only the chart buckets are bounded so one malformed or
       // ancient timestamp cannot synthesize an enormous JSON response.
       .filter(([date]) => range !== "all"
         || (date >= firstVisibleDate && date <= lastVisibleDate))
-      .sort(([a], [b]) => a.localeCompare(b))
+      .sort(([a], [b]) => a.localeCompare(b));
+    const days = visibleDays
       .map(([date, day]): UsageDay => ({
         date,
         requests: day.totals.requests,
@@ -1412,6 +1449,7 @@ class StreamingUsageSummaryAccumulator implements UsageSummaryAccumulator {
       range,
       surface,
       since,
+      ...(this.window ? { customWindow: true as const, until: this.window.until } : {}),
       generatedAt: now,
       summary: totals,
       days,
@@ -1449,6 +1487,7 @@ class StreamingUsageSummaryAccumulator implements UsageSummaryAccumulator {
 export function createUsageSummaryAccumulator(options?: {
   filter?: { provider?: string | null; model?: string | null; apiKeyId?: string | null };
   mode?: UsageAccumulatorMode;
+  window?: UsageTimeWindow;
 }): UsageSummaryAccumulator {
   return new StreamingUsageSummaryAccumulator(options);
 }
@@ -1501,7 +1540,11 @@ export function projectUsageSummary<T extends UsageSummary>(
   const model = normalizeFilterValue(filter.model);
   const apiKeyId = normalizeExactFilterValue(filter.apiKeyId);
   if (provider === null && model === null && apiKeyId === null) return summary;
-  const accumulator = createUsageSummaryAccumulator({ filter: { provider, model, apiKeyId } });
+  const accumulator = createUsageSummaryAccumulator({
+    filter: { provider, model, apiKeyId },
+    ...(summary.customWindow && summary.since !== null && summary.until !== undefined
+      ? { window: { since: summary.since, until: summary.until } } : {}),
+  });
   for (const entry of entries ?? []) accumulator.add(entry);
   const projected = accumulator.summarize(summary.range, summary.generatedAt, summary.surface);
   return {

package/src/usage/time-range.ts

@@ -0,0 +1,48 @@
+/** Inclusive epoch-millisecond bounds, independent of the selected preset. */
+export interface UsageTimeWindow {
+  readonly since: number;
+  readonly until: number;
+}
+
+const MAX_DATE_MS = 8_640_000_000_000_000;
+const ISO_DATETIME = /^(\d{4}|\+\d{6})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.\d{1,3})?(Z|([+-])(\d{2}):(\d{2}))$/;
+
+function parseTimestamp(input: string | number, name: "since" | "until"): number {
+  const invalid = (): never => {
+    throw new Error(`${name} must be nonnegative integer epoch milliseconds or a valid full ISO datetime with timezone`);
+  };
+  let timestamp: number;
+  if (typeof input === "number") timestamp = input;
+  else if (/^\d+$/.test(input)) timestamp = Number(input);
+  else {
+    const parts = ISO_DATETIME.exec(input);
+    if (!parts) return invalid();
+    const year = Number(parts[1]);
+    const month = Number(parts[2]);
+    const day = Number(parts[3]);
+    const leapYear = year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0);
+    const monthDays = [31, leapYear ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
+    // Date.parse normalizes some impossible dates (e.g. February 30).
+    // Validate the written calendar fields before applying its timezone offset.
+    if (month < 1 || month > 12 || day < 1 || day > monthDays[month - 1]!
+      || Number(parts[4]) > 23 || Number(parts[5]) > 59 || Number(parts[6]) > 59
+      || (parts[7] !== "Z" && (Number(parts[9]) > 23 || Number(parts[10]) > 59))) {
+      return invalid();
+    }
+    timestamp = Date.parse(input);
+  }
+  if (!Number.isSafeInteger(timestamp) || timestamp < 0 || timestamp > MAX_DATE_MS) return invalid();
+  return timestamp;
+}
+
+/** No bounds selects the preset; supplying either bound requires both. */
+export function parseUsageTimeWindow(
+  since: string | number | null | undefined,
+  until: string | number | null | undefined,
+): UsageTimeWindow | undefined {
+  if (since == null && until == null) return undefined;
+  if (since == null || until == null) throw new Error("since and until must be supplied together");
+  const window = { since: parseTimestamp(since, "since"), until: parseTimestamp(until, "until") };
+  if (window.since > window.until) throw new Error("since must be less than or equal to until");
+  return Object.freeze(window);
+}

package/src/usage/user-cost-overlays.ts

@@ -13,19 +13,23 @@
  * must not churn the version (see refreshUserCostOverlays). The configured
  * provider-name set is part of the change identity: adding or removing a
  * provider changes which names may collapse to a label base in the resolver,
- * so it bumps the version even when no overlay row changed.
+ * so it bumps the version even when no overlay row changed. Exact selectable
+ * Codex IDs and effective log labels also participate in that identity.
  *
  * Display-time estimation only — these rows never affect billing.
  */
 import type { OcxConfig, OcxProviderConfig, ProviderCostOverlay } from "../types";
 import { MAX_COST4_RATE, type ExpectedPriceOverlay } from "./expected-prices";
 import { redactSecretString } from "../lib/redact";
+import { isSelectableCodexPoolAccount, MAIN_CODEX_ACCOUNT_ID } from "../codex/account-id";
+import { codexAccountLogLabel } from "../codex/account-label";
 
 const EMPTY: readonly ExpectedPriceOverlay[] = [];
 
 let active: readonly ExpectedPriceOverlay[] = EMPTY;
 let activeSignature = "";
 let activeConfigured = new Set<string>();
+let activeAccountProviders = codexAccountProviders([]);
 let version = 0;
 let preservedDiskOnlyProviders: Record<string, OcxProviderConfig> | null = null;
 
@@ -54,6 +58,24 @@ function providerNames(config: OcxConfig): Set<string> {
   return new Set(Object.keys(config.providers ?? {}));
 }
 
+/** Exact config-owned identities only; aliases and generic OAuth stores are not authority. */
+function codexAccountProviders(accounts: OcxConfig["codexAccounts"]): Map<string, string> {
+  const identities = new Set(["main", MAIN_CODEX_ACCOUNT_ID]);
+  for (const account of accounts ?? []) {
+    if (!isSelectableCodexPoolAccount(account)) continue;
+    identities.add(account.id);
+    identities.add(codexAccountLogLabel(account));
+  }
+  const mapping = new Map<string, string>();
+  for (const identity of identities) {
+    mapping.set(identity, "openai");
+    for (const provider of ["openai", "chatgpt", "openai-multi"]) {
+      mapping.set(`${provider}-${identity}`, "openai");
+    }
+  }
+  return mapping;
+}
+
 /** Register one active live-config owner. Multiple server leases may share one config object. */
 export function registerPreservedProviderOwner(config: OcxConfig): void {
   const tagged = config as PreservationTaggedConfig;
@@ -289,12 +311,17 @@ export function refreshUserCostOverlays(config: OcxConfig): void {
   // removing a provider (even one without an overlay) changes which names are
   // allowed to collapse to a label base, so the resolver memo and the
   // /api/usage summary cache must be invalidated on that change as well.
+  // Sort effective account identities so account order, aliases and plan
+  // metadata do not churn caches; add/remove/label changes still invalidate.
   const configuredNames = Object.keys(providers ?? {}).sort();
-  const signature = `${JSON.stringify(configuredNames)}\u0000${JSON.stringify(rows)}`;
+  const accountProviders = codexAccountProviders(config.codexAccounts);
+  const accountEntries = [...accountProviders].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+  const signature = `${JSON.stringify(configuredNames)}\u0000${JSON.stringify(rows)}\u0000${JSON.stringify(accountEntries)}`;
   if (signature === activeSignature) return;
   activeSignature = signature;
   active = rows;
   activeConfigured = new Set(configuredNames);
+  activeAccountProviders = accountProviders;
   version++;
 }
 
@@ -303,7 +330,7 @@ export function activeUserCostOverlays(): readonly ExpectedPriceOverlay[] {
   return active;
 }
 
-/** Monotonic version bumped on every refresh; used by the estimator memo key. */
+/** Monotonic version bumped on pricing-identity changes; used by the estimator memo key. */
 export function userCostOverlayVersion(): number {
   return version;
 }
@@ -312,3 +339,8 @@ export function userCostOverlayVersion(): number {
 export function activeConfiguredProviders(): ReadonlySet<string> {
   return activeConfigured;
 }
+
+/** Account pricing identities built at refresh, without reading credential stores. */
+export function activeAccountPricingProviders(): ReadonlyMap<string, string> {
+  return activeAccountProviders;
+}

package/src/vision/anthropic-describe.ts

@@ -10,6 +10,8 @@ import type { DescribeOutcome, VisionSettings } from "./describe";
 const ANTHROPIC_VISION_MAX_TOKENS = 1024;
 const ALLOWED_IMAGE_MIME = new Set(["image/png", "image/jpeg", "image/jpg", "image/webp", "image/gif"]);
 const MAX_IMAGE_BYTES = 20 * 1024 * 1024;
+/** Bound the sidecar SSE stream and its untrusted error body; the description is clamped downstream. */
+const MAX_SIDECAR_RESPONSE_BYTES = 64 * 1024;
 const DESCRIBE_INSTRUCTION =
   "You are a vision describer for a text-only model that cannot see the image. Describe the image " +
   "thoroughly and factually so that model can fully reason about it: transcribe any visible text " +
@@ -43,6 +45,34 @@ function buildImageBlock(imageUrl: string): { block?: AnthropicImageBlock; error
   return { error: "unsupported image URL scheme (expected data: or https:)" };
 }
 
+/** Read at most `MAX_SIDECAR_RESPONSE_BYTES` of an untrusted upstream body, then stop reading. */
+async function readBoundedText(res: Response): Promise<string> {
+  if (!res.body) return "";
+  const reader = res.body.getReader();
+  const decoder = new TextDecoder();
+  let out = "";
+  let seen = 0;
+  try {
+    for (;;) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      const remaining = MAX_SIDECAR_RESPONSE_BYTES - seen;
+      const accepted = value.byteLength <= remaining ? value : value.subarray(0, remaining);
+      seen += accepted.byteLength;
+      out += decoder.decode(accepted, { stream: true });
+      if (seen >= MAX_SIDECAR_RESPONSE_BYTES) {
+        try { void reader.cancel("vision sidecar error body byte limit reached").catch(() => undefined); }
+        catch { /* best-effort body teardown */ }
+        break;
+      }
+    }
+    out += decoder.decode();
+  } catch {
+    /* a failed error-body read must not mask the HTTP status we are about to report */
+  }
+  return out;
+}
+
 /** Fold Anthropic Messages text deltas into one description. Malformed frames are ignored. */
 export async function parseAnthropicVisionSSE(res: Response): Promise<DescribeOutcome> {
   if (!res.body) return { text: "", error: "anthropic vision sidecar returned no response body" };
@@ -52,6 +82,7 @@ export async function parseAnthropicVisionSSE(res: Response): Promise<DescribeOu
   const decoder = new TextDecoder();
   const reader = res.body.getReader();
   let buffer = "";
+  let responseBytes = 0;
 
   const processFrame = (rawFrame: string): void => {
     let dataLine = "";
@@ -76,12 +107,24 @@ export async function parseAnthropicVisionSSE(res: Response): Promise<DescribeOu
     for (;;) {
       const { done, value } = await reader.read();
       if (done) break;
-      buffer = (buffer + decoder.decode(value, { stream: true })).replace(/\r\n/g, "\n");
+      // Frames only fold on a `\n\n` separator, so an upstream that never emits one would grow
+      // `buffer` for the whole response. Accept a bounded prefix instead.
+      const remaining = MAX_SIDECAR_RESPONSE_BYTES - responseBytes;
+      const accepted = value.byteLength <= remaining ? value : value.subarray(0, remaining);
+      responseBytes += accepted.byteLength;
+      buffer = (buffer + decoder.decode(accepted, { stream: true })).replace(/\r\n/g, "\n");
       let separator: number;
       while ((separator = buffer.indexOf("\n\n")) !== -1) {
         processFrame(buffer.slice(0, separator));
         buffer = buffer.slice(separator + 2);
       }
+      if (responseBytes >= MAX_SIDECAR_RESPONSE_BYTES) {
+        // Keep the frames folded above, drop the unterminated tail, and do not wait on teardown.
+        try { void reader.cancel("vision sidecar response byte limit reached").catch(() => undefined); }
+        catch { /* best-effort body teardown */ }
+        buffer = "";
+        break;
+      }
     }
     buffer = (buffer + decoder.decode()).replace(/\r\n/g, "\n");
     if (buffer.trim()) processFrame(buffer);
@@ -164,7 +207,8 @@ export async function describeImageAnthropic(
       { abortSignal: linkedSignal.signal, label: "vision-sidecar-anthropic" },
     );
     if (!res.ok) {
-      const responseText = await res.text().catch(() => "");
+      // The body is untrusted and only feeds one auth-failure message, so read a bounded prefix.
+      const responseText = await readBoundedText(res);
       console.warn(`[vision] anthropic sidecar HTTP ${res.status} (${Date.now() - startedAt}ms)`);
       if (res.status === 401) {
         return { text: "", error: `anthropic vision sidecar auth failed: ${publicOAuthAuthenticationErrorMessage(new Error(responseText))}` };