@bitkyc08/opencodex 2.48.0-preview.20260908 → 2.49.0

package/src/images/loop.ts

@@ -537,6 +537,7 @@ export async function runWithImageBridge(deps: ImageBridgeDeps): Promise<Respons
                 // hop-by-hop header alone (oven-sh/bun#20492).
                 return requestFetch(request.url, applyUpstreamRecoveryInit({
                   method: request.method,
+                  redirect: "manual",
                   headers: h,
                   body: request.body,
                   signal: headerDeadline.signal,

package/src/images/xai-video-client.ts

@@ -80,6 +80,7 @@ export async function submitVideoJob(
 
   const resp = await fetch(`${auth.baseUrl}/videos/generations`, {
     method: "POST",
+    redirect: "manual",
     headers: {
       "Authorization": `Bearer ${auth.token}`,
       "Content-Type": "application/json",
@@ -118,6 +119,7 @@ export async function pollVideoJob(
 
   const resp = await fetch(`${auth.baseUrl}/videos/${encodeURIComponent(requestId)}`, {
     method: "GET",
+    redirect: "manual",
     headers: {
       "Authorization": `Bearer ${auth.token}`,
     },

package/src/integrations/registry.ts

@@ -190,6 +190,7 @@ export const INTEGRATION_CLIENTS: Record<IntegrationClientId, IntegrationClientS
     id: "hermes",
     configPath: (env = process.env, home = homedir()) => hermesConfigPath(env, home),
     detectDir: (env = process.env, home = homedir()) => hermesHomeDir(env, home),
+    sourcePreservingYaml: { path: ["providers", "opencodex"] },
   },
   openclaw: {
     id: "openclaw",

package/src/lib/process-control.ts

@@ -66,12 +66,30 @@ export function gracefulStopHost(hostname: string | undefined): string {
 }
 
 /**
- * Outcome of a graceful stop attempt. `"refused"` is distinct from failure: the proxy answered
- * that it must NOT be stopped from here, so callers must not escalate to a forced kill.
+ * `"refused"` forbids forced stop. `"teardown-unconfirmed"` means the process exited,
+ * but its assigned shared teardown was not confirmed; callers must not kill it again.
  */
-export type GracefulStopResult = boolean | "refused";
+export type GracefulStopResult = boolean | "refused" | "teardown-unconfirmed";
 
-/** A proxy declined shutdown because a service under another home owns it (HTTP 409). */
+/**
+ * The server's own explanation for the most recent 409, captured so `stopProxy` can report
+ * the real reason. There is more than one: a scheduler wrapper under another home, or the
+ * proxy being the installed service itself (#4023). Module-scoped because
+ * `GracefulStopResult` is a public contract with several callers, and widening it to carry
+ * the text would change every one of them for a message only this file reports.
+ */
+let lastRefusalMessage: string | null = null;
+
+/** The server's explanation for the most recent 409, or `null` when it sent none. */
+export function lastStopRefusalMessage(): string | null {
+  return lastRefusalMessage;
+}
+
+/**
+ * A proxy declined shutdown (HTTP 409). There is more than one reason it can say no — a
+ * scheduler wrapper under another home, or the proxy being the installed service itself
+ * (#4023) — so the server's own message is carried through rather than guessed at.
+ */
 export class ProxyOwnershipRefusedError extends Error {}
 
 /**
@@ -82,6 +100,8 @@ export class ProxyOwnershipRefusedError extends Error {}
  * chance to run its shutdown handlers. Returns false when the proxy can't be reached
  * or doesn't exit in time — callers fall back to {@link killProxy}. Returns `"refused"`
  * when the proxy declines the stop (HTTP 409), which callers must NOT force past.
+ * True requires the expected shared-teardown response and an observed exit. It does not
+ * attest the process exit code or completion of every drain/shutdown hook.
  */
 export async function stopProxyGracefully(pid: number, io: GracefulStopIo = {}): Promise<GracefulStopResult> {
   const readRuntime = io.readRuntime ?? readRuntimePort;
@@ -92,6 +112,7 @@ export async function stopProxyGracefully(pid: number, io: GracefulStopIo = {}):
   const token = configuredAdminToken(env.OPENCODEX_HOME?.trim() || undefined, env as NodeJS.ProcessEnv);
   if (token) headers["x-opencodex-api-key"] = token;
   const fetchFn = io.fetchFn ?? fetch;
+  let sharedTeardownConfirmed = false;
   try {
     // `ocx stop` asks the proxy NOT to restore shared client config: it does that itself,
     // after verifying a stopped Task Scheduler did not respawn the proxy (#3008). Letting
@@ -111,8 +132,23 @@ export async function stopProxyGracefully(pid: number, io: GracefulStopIo = {}):
     // would respawn it anyway). That is a policy answer, not a dead endpoint — escalating to
     // SIGTERM here would run the daemon's cleanup and strip shared config out from under the
     // still-running service. Report the refusal instead of forcing.
-    if (res.status === 409) return "refused";
+    if (res.status === 409) {
+      lastRefusalMessage = await res.json()
+        .then(body => {
+          const message = (body as { message?: unknown } | null)?.message;
+          return typeof message === "string" && message.trim() ? message.trim() : null;
+        })
+        .catch(() => null);
+      return "refused";
+    }
     if (!res.ok) return false;
+    const body: unknown = await res.json().catch(() => null);
+    const expectedTeardown = io.deferSharedTeardownNonce ? "deferred" : "performed";
+    sharedTeardownConfirmed = body !== null
+      && typeof body === "object"
+      && !Array.isArray(body)
+      && "success" in body && body.success === true
+      && "sharedTeardown" in body && body.sharedTeardown === expectedTeardown;
   } catch {
     return false;
   }
@@ -120,7 +156,8 @@ export async function stopProxyGracefully(pid: number, io: GracefulStopIo = {}):
   // Honor the server's own drain window: /api/stop answers 200 first, then drains for
   // config.shutdownTimeoutMs. Waiting less than that hard-kills mid-drain.
   const exitTimeoutMs = io.exitTimeoutMs ?? drainDeadlineMs();
-  return waitExit(pid, exitTimeoutMs);
+  if (!waitExit(pid, exitTimeoutMs)) return false;
+  return sharedTeardownConfirmed ? true : "teardown-unconfirmed";
 }
 
 function drainDeadlineMs(): number {
@@ -140,10 +177,17 @@ export async function stopProxy(pid: number, io: GracefulStopIo = {}): Promise<b
     // The proxy refused on purpose (foreign service owns it). Forcing would strip shared
     // config while that service keeps the proxy alive.
     throw new ProxyOwnershipRefusedError(
-      "The running proxy refused to stop: a service installed under a different "
-      + "CODEX_HOME/OPENCODEX_HOME owns it. Run the stop from that home.",
+      lastRefusalMessage
+      ?? "The running proxy refused to stop: a service installed under a different "
+        + "CODEX_HOME/OPENCODEX_HOME owns it. Run the stop from that home.",
     );
   }
+  if (graceful === "teardown-unconfirmed") {
+    // Exit was observed, so do not enter the forced-stop fallback. Returning false keeps
+    // shared restoration with `ocx stop` instead of claiming that the proxy completed it.
+    await waitForStoppedPort(runtime, pid);
+    return false;
+  }
   if (graceful) {
     await waitForStoppedPort(runtime, pid);
     return true;

package/src/lib/upstream-retry.ts

@@ -226,6 +226,7 @@ export async function fetchWithAttemptDeadline(
     return await executor(url, {
       ...init,
       headers,
+      redirect: "manual",
       signal: attemptTimeout.signal,
     });
   } finally {

package/src/oauth/chatgpt.ts

@@ -40,6 +40,62 @@ export function extractAccountId(idToken?: string, accessToken?: string): string
   return undefined;
 }
 
+/**
+ * Three-way answer to "is this token marked as belonging to the ChatGPT account domain".
+ * Only ChatGPT-specific claims count as markers: a top-level chatgpt_account_id or the
+ * https://api.openai.com/auth namespace claim. A generic organizations claim is NOT domain
+ * evidence. JWT claims are decoded locally as routing markers, never as authenticity proof.
+ *
+ * absent  — no JWT, a payload that is not a JSON object, or an object carrying neither
+ *           marker key: the token may be a foreign credential and legacy foreign handling
+ *           applies. This function is total; it never throws on an attacker-shaped token.
+ * invalid — a marker key is present but yields no usable account id (non-string, blank,
+ *           namespace that is not an object, namespace without the claim) or the two
+ *           markers disagree. Presence is decided by the KEY, not by its shape, so a token
+ *           that claims this domain can never fall through to foreign handling just
+ *           because its marker is malformed.
+ * valid   — one consistent, non-blank ChatGPT account id.
+ */
+export type ChatGptDomainClaim =
+  | { kind: "absent" }
+  | { kind: "invalid" }
+  | { kind: "valid"; accountId: string };
+
+const CHATGPT_AUTH_NAMESPACE = "https://api.openai.com/auth";
+
+/** A usable account id is a non-blank string; blank or non-string values are malformed. */
+function usableAccountId(value: unknown): string | undefined {
+  return typeof value === "string" && value.trim() ? value.trim() : undefined;
+}
+
+export function inspectChatGptDomainClaim(token: string): ChatGptDomainClaim {
+  const payload: unknown = decodeJwtPayload(token);
+  // decodeJwtPayload returns whatever the payload segment parses to, which may be a
+  // primitive or an array. Those carry no marker and must not reach the key lookups,
+  // where `in`/hasOwn would throw and take the whole request down.
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) return { kind: "absent" };
+  const claims = payload as Record<string, unknown>;
+  // Presence is the KEY being there, as an own key. A reserved namespace that is null, a
+  // primitive, an array, or an object without the claim is a present-but-broken marker, so
+  // it stays invalid instead of being treated as a foreign token.
+  const topPresent = Object.hasOwn(claims, "chatgpt_account_id");
+  const nsPresent = Object.hasOwn(claims, CHATGPT_AUTH_NAMESPACE);
+  if (!topPresent && !nsPresent) return { kind: "absent" };
+  const topId = topPresent ? usableAccountId(claims.chatgpt_account_id) : undefined;
+  if (topPresent && !topId) return { kind: "invalid" };
+  let nsId: string | undefined;
+  if (nsPresent) {
+    const ns = claims[CHATGPT_AUTH_NAMESPACE];
+    const nsObj = ns !== null && typeof ns === "object" && !Array.isArray(ns)
+      ? ns as Record<string, unknown> : undefined;
+    nsId = nsObj ? usableAccountId(nsObj.chatgpt_account_id) : undefined;
+    if (!nsId) return { kind: "invalid" };
+  }
+  if (topId && nsId && topId !== nsId) return { kind: "invalid" };
+  const accountId = topId ?? nsId;
+  return accountId ? { kind: "valid", accountId } : { kind: "invalid" };
+}
+
 export function extractEmail(idToken?: string, accessToken?: string): string | undefined {
   for (const token of [idToken, accessToken]) {
     if (!token) continue;
@@ -50,6 +106,33 @@ export function extractEmail(idToken?: string, accessToken?: string): string | u
   return undefined;
 }
 
+/**
+ * Identity-agreement view of one token for security-sensitive bindings. `accountId` follows the
+ * existing extractAccountId precedence (top-level, then namespaced, then organizations[0]).
+ * `conflict` is true only when the two chatgpt_account_id encodings are both present and
+ * disagree — organizations entries are workspace memberships, not identity, so they never
+ * participate. Never logs token material.
+ */
+export function extractAccountIdClaims(token?: string): { accountId: string | undefined; conflict: boolean } {
+  if (!token) return { accountId: undefined, conflict: false };
+  const payload = decodeJwtPayload(token);
+  if (!payload) return { accountId: undefined, conflict: false };
+  const top = typeof payload.chatgpt_account_id === "string" ? payload.chatgpt_account_id : undefined;
+  const ns = payload["https://api.openai.com/auth"];
+  const namespaced = ns && typeof ns === "object"
+    && typeof (ns as Record<string, unknown>).chatgpt_account_id === "string"
+    ? (ns as Record<string, unknown>).chatgpt_account_id as string
+    : undefined;
+  const orgs = payload.organizations;
+  const org = Array.isArray(orgs) && orgs[0] && typeof orgs[0].id === "string"
+    ? orgs[0].id as string
+    : undefined;
+  return {
+    accountId: top ?? namespaced ?? org,
+    conflict: top !== undefined && namespaced !== undefined && top !== namespaced,
+  };
+}
+
 export function credsFromToken(data: Record<string, unknown>): OAuthCredentials {
   const idToken = typeof data.id_token === "string" ? data.id_token : undefined;
   // This parses a response from an external boundary, so the access token is

package/src/oauth/xai.ts

@@ -1,4 +1,5 @@
 /** xAI OAuth flow (Grok account login). Ported from jawcode oauth/xai.ts. */
+import { abortError, sleepWithAbort } from "../lib/upstream-retry";
 import { OAuthCallbackFlow, type OAuthCallbackFlowOptions } from "./callback-server";
 import { generatePKCE } from "./pkce";
 import type { LocalTokenImportMode, OAuthController, OAuthCredentials } from "./types";
@@ -11,6 +12,9 @@ const XAI_OAUTH_CALLBACK_PORT = 56121;
 const XAI_OAUTH_CALLBACK_PATH = "/callback";
 const XAI_OAUTH_REFRESH_SKEW_MS = 2 * 60 * 1000;
 const TOKEN_REQUEST_TIMEOUT_MS = 30_000;
+const RETRY_AFTER_MAX_DELAY_MS = 60_000;
+const JITTER_DELAY_CAP_MS = 2_000;
+const XAI_TRUSTED_AUTH_HOSTS = new Set(["auth.x.ai", "accounts.x.ai"]);
 
 export const XAI_LOCAL_CLI_DETACH_WARNING =
   "[oauth:xai] Grok CLI credential was stale; refreshed into OpenCodex ownership. Grok CLI may require login again.";
@@ -45,10 +49,21 @@ function requestSignal(signal: AbortSignal | undefined): AbortSignal {
 }
 
 function validateXaiEndpoint(rawUrl: string): string {
-  const parsed = new URL(rawUrl);
+  let parsed: URL;
+  try {
+    parsed = new URL(rawUrl);
+  } catch {
+    throw new Error("xAI OAuth discovery returned an unparseable endpoint URL");
+  }
   const host = parsed.hostname.toLowerCase();
-  if (parsed.protocol !== "https:" || (host !== "x.ai" && !host.endsWith(".x.ai"))) {
-    throw new Error(`xAI OAuth discovery returned an unexpected endpoint: ${rawUrl}`);
+  if (
+    parsed.protocol !== "https:"
+    || parsed.username !== ""
+    || parsed.password !== ""
+    || parsed.port !== ""
+    || !XAI_TRUSTED_AUTH_HOSTS.has(host)
+  ) {
+    throw new Error(`xAI OAuth discovery returned an unexpected endpoint (host: ${host || "none"})`);
   }
   return parsed.toString();
 }
@@ -94,15 +109,135 @@ function getTokenIdentity(accessToken: string, idToken: string | undefined): { a
 
 export class XaiTokenRequestError extends Error { constructor(public readonly status?:number,public readonly oauthError?:string,message="xAI token request failed",options?:{cause?:unknown}){super(message,options);this.name="XaiTokenRequestError";} }
 export interface XaiTokenRetryDeps { sleep?:(ms:number)=>Promise<void>; random?:()=>number }
-function isAbortError(error:unknown):boolean{return error instanceof DOMException&&error.name==="AbortError";}
-function retryDelay(attempt:number,retryAfter:string|null,random:()=>number):number{const base=attempt===1?100:250,j=Math.round(base*(.75+random()*.5)),seconds=retryAfter!==null&&/^\d+$/.test(retryAfter)?Number(retryAfter):0;return Math.min(2000,Math.max(j,seconds*1000));}
-async function readTokenError(response:Response):Promise<XaiTokenRequestError>{let oauthError:string|undefined,detail="";try{const body=await response.json() as {error?:unknown;error_description?:unknown};if(typeof body.error==="string")oauthError=body.error;if(typeof body.error_description==="string")detail=body.error_description;}catch{}const suffix=detail?`: ${detail}`:oauthError?`: ${oauthError}`:"";return new XaiTokenRequestError(response.status,oauthError,`xAI token request failed: ${response.status}${suffix}`);}
+const IMF_FIXDATE_RE = /^(?:Mon|Tue|Wed|Thu|Fri|Sat|Sun), (\d{2}) (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) (\d{4}) (\d{2}):(\d{2}):(\d{2}) GMT$/i;
+const RFC850_DATE_RE = /^(?:Monday|Tuesday|Wednesday|Thursday|Friday|Saturday|Sunday), (\d{2})-(Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)-(\d{2}) (\d{2}):(\d{2}):(\d{2}) GMT$/i;
+const ASCTIME_DATE_RE = /^(?:Mon|Tue|Wed|Thu|Fri|Sat|Sun) (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) ( \d|\d{2}) (\d{2}):(\d{2}):(\d{2}) (\d{4})$/i;
+const HTTP_MONTH_INDEX: Record<string, number> = {
+  jan: 0, feb: 1, mar: 2, apr: 3, may: 4, jun: 5,
+  jul: 6, aug: 7, sep: 8, oct: 9, nov: 10, dec: 11,
+};
+
+function parseUtcDateParts(
+  year: number,
+  monthName: string,
+  day: number,
+  hour: number,
+  minute: number,
+  second: number,
+): number | undefined {
+  const month = HTTP_MONTH_INDEX[monthName.toLowerCase()];
+  if (month === undefined) return undefined;
+  const timestamp = Date.UTC(year, month, day, hour, minute, second);
+  const parsed = new Date(timestamp);
+  return parsed.getUTCFullYear() === year
+    && parsed.getUTCMonth() === month
+    && parsed.getUTCDate() === day
+    && parsed.getUTCHours() === hour
+    && parsed.getUTCMinutes() === minute
+    && parsed.getUTCSeconds() === second
+    ? timestamp
+    : undefined;
+}
+
+function parseHttpDateMs(value: string, now: number): number | undefined {
+  const match = IMF_FIXDATE_RE.exec(value);
+  if (match) {
+    return parseUtcDateParts(
+      Number(match[3]), match[2]!, Number(match[1]),
+      Number(match[4]), Number(match[5]), Number(match[6]),
+    );
+  }
+  const rfc850 = RFC850_DATE_RE.exec(value);
+  if (rfc850) {
+    // Two-digit years more than 50 years in the future are in the past (RFC 9110).
+    const currentYear = new Date(now).getUTCFullYear();
+    let year = Math.floor(currentYear / 100) * 100 + Number(rfc850[3]);
+    const candidateTimeOfYear = Date.UTC(
+      2000, HTTP_MONTH_INDEX[rfc850[2]!.toLowerCase()]!, Number(rfc850[1]),
+      Number(rfc850[4]), Number(rfc850[5]), Number(rfc850[6]),
+    );
+    const current = new Date(now);
+    const currentTimeOfYear = Date.UTC(
+      2000, current.getUTCMonth(), current.getUTCDate(),
+      current.getUTCHours(), current.getUTCMinutes(), current.getUTCSeconds(),
+      current.getUTCMilliseconds(),
+    );
+    const yearDelta = year - currentYear;
+    if (yearDelta < -50 || (yearDelta === -50 && candidateTimeOfYear < currentTimeOfYear)) {
+      year += 100;
+    } else if (yearDelta > 50 || (yearDelta === 50 && candidateTimeOfYear > currentTimeOfYear)) {
+      year -= 100;
+    }
+    return parseUtcDateParts(
+      year, rfc850[2]!, Number(rfc850[1]),
+      Number(rfc850[4]), Number(rfc850[5]), Number(rfc850[6]),
+    );
+  }
+  const asctime = ASCTIME_DATE_RE.exec(value);
+  if (!asctime) return undefined;
+  return parseUtcDateParts(
+    Number(asctime[6]), asctime[1]!, Number(asctime[2]),
+    Number(asctime[3]), Number(asctime[4]), Number(asctime[5]),
+  );
+}
+
+function parseRetryAfterMs(retryAfter: string | null): number | undefined {
+  const text = retryAfter?.trim();
+  if (!text) return undefined;
+  if (/^\d+(?:\.\d+)?$/.test(text)) {
+    const ms = Math.ceil(Number(text) * 1000);
+    return ms > 0 ? ms : undefined;
+  }
+  const now = Date.now();
+  const timestamp = parseHttpDateMs(text, now);
+  if (timestamp === undefined) return undefined;
+  const delay = timestamp - now;
+  return delay > 0 ? delay : undefined;
+}
+
+function jitterDelay(attempt: number, random: () => number): number {
+  const base = attempt === 1 ? 100 : 250;
+  return Math.min(JITTER_DELAY_CAP_MS, Math.round(base * (0.75 + random() * 0.5)));
+}
+
+/**
+ * Delay before the next attempt, or undefined when the server asked for a wait
+ * beyond the retry budget — retrying earlier than Retry-After would hammer the
+ * token endpoint, so the caller fails the request instead of clamping.
+ */
+function retryDelay(attempt: number, retryAfter: string | null, random: () => number): number | undefined {
+  const serverMs = parseRetryAfterMs(retryAfter);
+  if (serverMs === undefined) return jitterDelay(attempt, random);
+  return serverMs <= RETRY_AFTER_MAX_DELAY_MS ? serverMs : undefined;
+}
+
+async function sleepAbortable(
+  ms: number,
+  sleep: (ms: number) => Promise<void>,
+  signal: AbortSignal | undefined,
+): Promise<void> {
+  if (!signal) return sleep(ms);
+  if (signal.aborted) throw abortError(signal);
+  let onAbort!: () => void;
+  try {
+    await Promise.race([
+      sleep(ms),
+      new Promise<never>((_, reject) => {
+        onAbort = () => reject(abortError(signal));
+        signal.addEventListener("abort", onAbort, { once: true });
+      }),
+    ]);
+  } finally {
+    signal.removeEventListener("abort", onAbort);
+  }
+}
+async function readTokenError(response:Response):Promise<XaiTokenRequestError>{let oauthError:string|undefined,detail="";try{const body=await response.json() as {error?:unknown;error_description?:unknown};if(typeof body.error==="string")oauthError=body.error;if(typeof body.error_description==="string")detail=body.error_description;}catch{/* non-JSON error body: fall through to the generic message */}const suffix=detail?`: ${detail}`:oauthError?`: ${oauthError}`:"";return new XaiTokenRequestError(response.status,oauthError,`xAI token request failed: ${response.status}${suffix}`);}
 export async function postXaiToken(
   tokenEndpoint: string,
   body: Record<string, string>,
   signal?: AbortSignal, deps:XaiTokenRetryDeps={},
 ): Promise<XaiTokenPayload> {
- const sleep=deps.sleep??(ms=>Bun.sleep(ms)),random=deps.random??Math.random;let last:unknown;
+ const sleep=deps.sleep??((ms:number)=>sleepWithAbort(ms,signal)),random=deps.random??Math.random;let last:unknown;
  for(let attempt=1;attempt<=3;attempt++){let response:Response;try{response=await fetch(tokenEndpoint, {
     method: "POST",
     headers: {
@@ -111,7 +246,15 @@ export async function postXaiToken(
     },
     body: new URLSearchParams(body).toString(),
     signal: requestSignal(signal),
-  });}catch(error){if(isAbortError(error)&&signal?.aborted)throw error;last=error;if(attempt===3)throw new XaiTokenRequestError(undefined,undefined,"xAI token request failed: network error",{cause:error});await sleep(retryDelay(attempt,null,random));continue;}if(response.ok)return await response.json() as XaiTokenPayload;const error=await readTokenError(response);last=error;if(!(response.status===429||response.status>=500)||attempt===3)throw error;await sleep(retryDelay(attempt,response.headers.get("retry-after"),random));}throw last;
+  });}catch(error){
+  if(signal?.aborted)throw error;
+  const name=(error as {name?:string}|undefined)?.name;
+  if(name==="AbortError"||name==="TimeoutError")throw error;
+  last=error;
+  if(attempt===3)throw new XaiTokenRequestError(undefined,undefined,"xAI token request failed: network error",{cause:error});
+  await sleepAbortable(jitterDelay(attempt,random),sleep,signal);
+  continue;
+  }if(response.ok)return await response.json() as XaiTokenPayload;const error=await readTokenError(response);last=error;if(!(response.status===429||response.status>=500)||attempt===3)throw error;if(signal?.aborted)throw error;const delay=retryDelay(attempt,response.headers.get("retry-after"),random);if(delay===undefined)throw error;await sleepAbortable(delay,sleep,signal);}throw last;
 }
 
 function credentialsFromTokenPayload(payload: XaiTokenPayload, refreshFallback = ""): OAuthCredentials {

package/src/providers/api-key-selection-capture.ts

@@ -0,0 +1,10 @@
+import type { OcxProviderConfig } from "../types";
+import type { ProviderApiKeySelection } from "../types/provider";
+
+export function captureProviderApiKeySelection(provider: OcxProviderConfig): ProviderApiKeySelection {
+  return {
+    entryId: provider.apiKeyPool?.find(entry => entry.key === provider.apiKey)?.id,
+    reference: provider.apiKey,
+    revision: provider.apiKeySelectionRevision,
+  };
+}

package/src/providers/api-key-selection.ts

@@ -6,14 +6,9 @@ import type { ProviderApiKeySelection } from "../types/provider";
 import { routedProviderConfig } from "../router";
 import { OPENCODE_GO_SESSION_HEADER } from "./opencode-go-transport";
 import { resolveProviderTransport, XAI_GROK_COMPATIBILITY, type OcxProviderTransport } from "./xai-transport";
+import { captureProviderApiKeySelection } from "./api-key-selection-capture";
 
-export function captureProviderApiKeySelection(provider: OcxProviderConfig): ProviderApiKeySelection {
-  return {
-    entryId: provider.apiKeyPool?.find(entry => entry.key === provider.apiKey)?.id,
-    reference: provider.apiKey,
-    revision: provider.apiKeySelectionRevision,
-  };
-}
+export { captureProviderApiKeySelection } from "./api-key-selection-capture";
 
 function matchesSelection(provider: OcxProviderConfig, expected: ProviderApiKeySelection): boolean {
   const current = captureProviderApiKeySelection(provider);

package/src/providers/caller-authorization.ts

@@ -0,0 +1,36 @@
+import type { OcxConfig, OcxProviderConfig } from "../types";
+import { inspectChatGptDomainClaim } from "../oauth/chatgpt";
+import { isProxyAdmissionSecret } from "../server/auth-cors";
+import { isCanonicalOpenAiForwardProvider } from "./openai-tiers";
+
+/** The caller's own ChatGPT-domain credential as plain Direct forwarding would use it. */
+export type CallerDirectAuth = Readonly<{ authorization: string; chatgptAccountId?: string }>;
+
+/** Whether this transport can consume the request's Authorization as its upstream credential. */
+export function providerConsumesCallerAuthorization(provider: OcxProviderConfig): boolean {
+  return isCanonicalOpenAiForwardProvider(provider)
+    || (provider.adapter === "cursor" && provider.authMode !== "oauth" && !provider.apiKey?.trim());
+}
+
+/**
+ * Capture the caller's Direct credential for a canonical-route restore after an internal
+ * rewrite. This restore is intentionally STRICTER than plain unchanged-route Direct
+ * forwarding: only a bearer with a VALID ChatGPT-domain claim qualifies (a clean single
+ * non-proxy JWT whose ChatGPT-specific account marker is well-formed and unambiguous, with
+ * any explicit account header matching it). An opaque bearer, a foreign JWT carrying only a
+ * generic organizations claim, and a ChatGPT-marked but malformed/conflicting token are all
+ * rejected: after a shadow/thread rewrite a self-asserted header cannot distinguish a
+ * caller-owned main credential from a foreign source-route token, so those cases stay
+ * fail-closed. Claims are decoded locally as routing markers, not authenticity proof, and
+ * unchanged-route Direct forwarding is governed by its own legacy rules.
+ */
+export function captureCallerDirectAuth(incomingHeaders: Headers, config: OcxConfig): CallerDirectAuth | null {
+  const raw = incomingHeaders.get("authorization")?.trim();
+  const bearer = /^Bearer[\t ]+([^\s,]+)$/i.exec(raw ?? "")?.[1];
+  if (!bearer || isProxyAdmissionSecret(bearer, config)) return null;
+  const claim = inspectChatGptDomainClaim(bearer);
+  if (claim.kind !== "valid") return null;
+  const headerAccount = incomingHeaders.get("chatgpt-account-id")?.trim();
+  if (headerAccount && headerAccount !== claim.accountId) return null;
+  return { authorization: `Bearer ${bearer}`, chatgptAccountId: claim.accountId };
+}