@bitkyc08/opencodex 2.48.0-preview.20260908 → 2.49.0

package/src/providers/codebuddy-models.ts

@@ -0,0 +1,184 @@
+/**
+ * Curated CodeBuddy model catalogs, transcribed from the OFFICIAL model manifest bundled with the
+ * vendor CLI (`@tencent-ai/codebuddy-code` v2.143.0: `product.json` for the global/`public`
+ * environment, `product.internal.json` for the China/`internal` environment) and cross-checked
+ * against the CLI's own `--model` accept-list. Verified 2026-09-03.
+ *
+ * Global and CN are deliberately NOT the same roster (§八). Context windows, output caps, vision
+ * and reasoning ladders are filled ONLY where the official manifest states them; a model with no
+ * published figure is omitted rather than guessed (§二十八/§二十九). CodeBuddy exposes no documented
+ * third-party live `/v1/models` endpoint, so these providers seed a static catalog
+ * (`liveModels: false`) exactly like the Kiro and Command Code entries.
+ */
+
+/** Global (`public`) session models accepted by `codebuddy --model`. */
+export const CODEBUDDY_GLOBAL_MODELS = [
+  "default-model",
+  "fast-model",
+  "balanced-model",
+  "primary-model",
+  "deep-model",
+  "gpt-5.6-sol",
+  "gpt-5.6-terra",
+  "gpt-5.6-luna",
+  "gpt-5.5",
+  "gpt-5.4",
+  "gpt-5.3-codex",
+  "gemini-3.5-flash",
+  "glm-5.3",
+  "glm-5.2",
+  "kimi-k3",
+  "kimi-k2.6",
+  "minimax-m3",
+];
+
+/** China (`internal`) session models from the official internal manifest (text/chat models only). */
+export const CODEBUDDY_CN_MODELS = [
+  "default",
+  "deepseek-v4-pro",
+  "deepseek-v4-flash",
+  "minimax-m3",
+  "minimax-m2.7",
+  "glm-5.2",
+  "glm-5.1",
+  "glm-5.0",
+  "glm-5.0-turbo",
+  "glm-5v-turbo",
+  "glm-4.7",
+  "kimi-k3-1",
+  "kimi-k2.7",
+  "kimi-k2.6",
+  "kimi-k2.5",
+  "deepseek-v3-2-volc",
+  "hy3",
+  "hunyuan-chat",
+];
+
+/**
+ * The CLI documents a single `--effort` ladder (minimal, low, medium, high, xhigh, max). The Codex
+ * reasoning ladder overlaps it at low..max; `minimal`/`none` are Codex sentinels normalized by
+ * `mapReasoningEffort`, and `ultra` folds to `max`. Declared provider-wide, then narrowed per model
+ * where the official manifest publishes a smaller `supportedEfforts`.
+ */
+export const CODEBUDDY_REASONING_EFFORTS = ["low", "medium", "high", "xhigh", "max"];
+
+export const CODEBUDDY_GLOBAL_MODEL_CONTEXT_WINDOWS: Record<string, number> = {
+  "default-model": 176_000,
+  "fast-model": 200_000,
+  "balanced-model": 256_000,
+  "primary-model": 272_000,
+  "deep-model": 176_000,
+  "gpt-5.6-sol": 1_000_000,
+  "gpt-5.6-terra": 1_000_000,
+  "gpt-5.6-luna": 1_000_000,
+  "gpt-5.5": 1_000_000,
+  "gpt-5.4": 272_000,
+  "gpt-5.3-codex": 272_000,
+  "gemini-3.5-flash": 1_000_000,
+  "glm-5.3": 1_000_000,
+  "glm-5.2": 1_000_000,
+  "kimi-k3": 1_000_000,
+  "kimi-k2.6": 256_000,
+  "minimax-m3": 512_000,
+};
+
+export const CODEBUDDY_GLOBAL_MODEL_MAX_OUTPUT_TOKENS: Record<string, number> = {
+  "default-model": 24_000,
+  "fast-model": 32_000,
+  "balanced-model": 32_000,
+  "primary-model": 72_000,
+  "deep-model": 24_000,
+  "gpt-5.6-sol": 128_000,
+  "gpt-5.6-terra": 128_000,
+  "gpt-5.6-luna": 128_000,
+  "gpt-5.5": 72_000,
+  "gpt-5.4": 128_000,
+  "gpt-5.3-codex": 128_000,
+  "gemini-3.5-flash": 65_536,
+  "glm-5.3": 48_000,
+  "glm-5.2": 48_000,
+  "kimi-k3": 32_000,
+  "kimi-k2.6": 32_000,
+  "minimax-m3": 128_000,
+};
+
+/** Per-model ladders narrowed from the official manifest's `reasoning.supportedEfforts`. */
+export const CODEBUDDY_GLOBAL_MODEL_REASONING_EFFORTS: Record<string, string[]> = {
+  "gpt-5.6-sol": ["low", "medium", "high", "xhigh"],
+  "gpt-5.6-terra": ["low", "medium", "high", "xhigh"],
+  "gpt-5.6-luna": ["low", "medium", "high", "xhigh"],
+  "glm-5.3": ["low", "high", "max"],
+  "glm-5.2": ["high", "xhigh"],
+};
+
+export const CODEBUDDY_GLOBAL_MODEL_DEFAULT_REASONING_EFFORTS: Record<string, string> = {
+  "gpt-5.6-sol": "high",
+  "gpt-5.6-terra": "high",
+  "gpt-5.6-luna": "high",
+  "glm-5.3": "high",
+  "glm-5.2": "high",
+};
+
+export const CODEBUDDY_CN_MODEL_CONTEXT_WINDOWS: Record<string, number> = {
+  "default": 200_000,
+  "deepseek-v4-pro": 1_000_000,
+  "deepseek-v4-flash": 1_000_000,
+  "minimax-m3": 512_000,
+  "minimax-m2.7": 200_000,
+  "glm-5.2": 1_000_000,
+  "glm-5.1": 200_000,
+  "glm-5.0": 200_000,
+  "glm-5.0-turbo": 200_000,
+  "glm-5v-turbo": 200_000,
+  "glm-4.7": 200_000,
+  "kimi-k3-1": 1_000_000,
+  "kimi-k2.7": 256_000,
+  "kimi-k2.6": 256_000,
+  "kimi-k2.5": 164_000,
+  "deepseek-v3-2-volc": 96_000,
+  "hy3": 192_000,
+  "hunyuan-chat": 200_000,
+};
+
+export const CODEBUDDY_CN_MODEL_MAX_OUTPUT_TOKENS: Record<string, number> = {
+  "default": 24_000,
+  "deepseek-v4-pro": 50_000,
+  "deepseek-v4-flash": 50_000,
+  "minimax-m3": 128_000,
+  "minimax-m2.7": 48_000,
+  "glm-5.2": 48_000,
+  "glm-5.1": 48_000,
+  "glm-5.0": 48_000,
+  "glm-5.0-turbo": 48_000,
+  "glm-5v-turbo": 64_000,
+  "glm-4.7": 48_000,
+  "kimi-k3-1": 32_000,
+  "kimi-k2.7": 32_000,
+  "kimi-k2.6": 32_000,
+  "kimi-k2.5": 32_000,
+  "deepseek-v3-2-volc": 32_000,
+  "hy3": 64_000,
+  "hunyuan-chat": 8_192,
+};
+
+export const CODEBUDDY_CN_MODEL_REASONING_EFFORTS: Record<string, string[]> = {
+  "hy3": ["low", "high"],
+};
+
+export const CODEBUDDY_CN_MODEL_DEFAULT_REASONING_EFFORTS: Record<string, string> = {
+  "hy3": "high",
+};
+
+/**
+ * Text-only models (official manifest `supportsImages: false`). Images for any OTHER model are
+ * passed through natively; a model listed here has its images routed through the proxy's vision
+ * sidecar rather than being silently dropped (§二十九).
+ */
+export const CODEBUDDY_CN_NO_VISION_MODELS = [
+  "default",
+  "glm-5.0",
+  "glm-5.0-turbo",
+  "glm-4.7",
+  "deepseek-v3-2-volc",
+  "hunyuan-chat",
+];

package/src/providers/derive.ts

@@ -80,6 +80,10 @@ export interface DerivedProviderPreset {
   keyOptional?: boolean;
   /** Free pricing (may still require a key). */
   freeTier?: boolean;
+  /** Sponsor tier from SPONSORS.md; the picker pins and labels these rows. */
+  sponsor?: "main" | "standard";
+  /** Sponsor landing URL (with its tracking parameters), for the picker's row link. */
+  sponsorUrl?: string;
   /**
    * Endpoint picker rows (token plan / payg / custom). When present, the add-provider
    * form shows a dropdown; `custom` reveals a free-text base URL field.
@@ -607,6 +611,7 @@ function entryToPreset(entry: ProviderRegistryEntry): DerivedProviderPreset {
     ...(entry.note ? { note: entry.note } : {}),
     ...(entry.keyOptional ? { keyOptional: true } : {}),
     ...(entry.freeTier ? { freeTier: true } : {}),
+    ...(entry.sponsor ? { sponsor: entry.sponsor.tier, sponsorUrl: entry.sponsor.url } : {}),
     ...(entry.baseUrlChoices ? { baseUrlChoices: entry.baseUrlChoices.map(c => ({ ...c })) } : {}),
   };
 }

package/src/providers/free-directory.ts

@@ -19,7 +19,7 @@ export const FREE_PROVIDER_ACCESS_GROUPS = {
   "recurring-credit": ["bytez", "nous-research"],
   "signup-credit": [
     "agentrouter", "ai21", "baichuan", "baseten", "deepinfra", "deepseek", "doubao", "fireworks", "freemodel-dev", "glm-cn",
-    "hyperbolic", "longcat", "monsterapi", "nebius", "novita", "nscale", "nvidia", "predibase", "publicai", "qoder",
+    "hyperbolic", "longcat", "monsterapi", "nebius", "novita", "nscale", "nvidia", "predibase", "publicai", "qoder", "qoder-cn",
     "scaleway", "sensenova", "stepfun", "together", "vertex",
   ],
 } as const satisfies Record<ProviderAccessGroup, readonly string[]>;
@@ -140,6 +140,30 @@ const CONNECTABLE: Record<string, ConnectableOverride> = {
   nscale: openAi("https://inference.api.nscale.com/v1", "https://console.nscale.com", { supportLevel: "supported", verification: "official", documentationUrl: "https://docs.nscale.com/docs/use-cases/chat", modelsUrl: "https://inference.api.nscale.com/v1/models", lastVerified: "2026-08-03" }),
   nvidia: openAi("https://integrate.api.nvidia.com/v1", "https://build.nvidia.com", { supportLevel: "supported", verification: "official", documentationUrl: "https://docs.api.nvidia.com/nim/reference/llm-apis" }),
   publicai: openAi("https://api.publicai.co/v1", "https://publicai.co"),
+  qoder: {
+    baseUrl: "https://qoder.com",
+    dashboardUrl: "https://qoder.com/account/integrations",
+    adapter: "qoder",
+    authKind: "key",
+    supportLevel: "supported",
+    verification: "official",
+    documentationUrl: "https://docs.qoder.com/cli/authentication",
+    discovery: "live",
+    liveModels: true,
+    lastVerified: "2026-09-03",
+  },
+  "qoder-cn": {
+    baseUrl: "https://qoder.cn",
+    dashboardUrl: "https://qoder.cn/account/integrations",
+    adapter: "qoder",
+    authKind: "key",
+    supportLevel: "supported",
+    verification: "official",
+    documentationUrl: "https://docs.qoder.cn/en/cli/authentication",
+    discovery: "live",
+    liveModels: true,
+    lastVerified: "2026-09-03",
+  },
   scaleway: openAi("https://api.scaleway.ai/v1", "https://console.scaleway.com/generative-api", { supportLevel: "supported", verification: "official", documentationUrl: "https://www.scaleway.com/en/docs/generative-apis/api-cli/using-generative-apis/", modelsUrl: "https://api.scaleway.ai/v1/models", lastVerified: "2026-08-01" }),
   sensenova: openAi("https://token.sensenova.cn/v1", "https://console.sensenova.cn", { verification: "official" }),
   stepfun: openAi("https://api.stepfun.com/v1", "https://platform.stepfun.com", { verification: "official" }),
@@ -160,7 +184,7 @@ const LABELS: Record<string, string> = {
   ai21: "AI21", baichuan: "Baichuan", deepinfra: "DeepInfra", deepseek: "DeepSeek", doubao: "Doubao",
   "freemodel-dev": "FreeModel.dev", sambanova: "SambaNova Cloud", nebius: "Nebius Token Factory",
   novita: "Novita", nscale: "Nscale", nvidia: "NVIDIA NIM",
-  publicai: "PublicAI", qoder: "Qoder", sensenova: "SenseNova", stepfun: "StepFun", vertex: "Google Vertex AI",
+  publicai: "PublicAI", qoder: "Qoder", "qoder-cn": "Qoder CN", sensenova: "SenseNova", stepfun: "StepFun", vertex: "Google Vertex AI",
 };
 
 const referenceNote = "Reference entry only: no safe documented API integration is enabled. Configure it manually only with provider documentation; consumer-web cookies and anti-bot bypasses are intentionally unsupported.";

package/src/providers/openai-sidecar.ts

@@ -10,7 +10,7 @@ import {
   type CodexAuthPolicyConfig,
 } from "../codex/auth-context";
 import { recordCodexUpstreamOutcome, type CodexUpstreamOutcome } from "../codex/routing";
-import { extractAccountId } from "../oauth/chatgpt";
+import { inspectChatGptDomainClaim } from "../oauth/chatgpt";
 import { ForwardAdmissionCredentialError, validateForwardAdmissionCredential, type DataPlaneAdmission } from "../server/auth-cors";
 import type { CodexAccountMode, OcxConfig, OcxProviderConfig } from "../types";
 import {
@@ -77,21 +77,45 @@ export function listOpenAiForwardSidecarCandidates(config: OcxConfig): OpenAiFor
   }];
 }
 
-function directSidecarHeaders(
-  incomingHeaders: Headers,
-  config: CodexAuthPolicyConfig,
-  admission?: Pick<DataPlaneAdmission, "source">,
-): Headers | undefined {
-  const bearer = incomingHeaders.get("authorization")?.replace(/^Bearer\s+/i, "").trim();
-  if (!bearer) return undefined;
-  const derivedAccountId = extractAccountId(undefined, bearer);
-  if (!derivedAccountId) return undefined;
+/** An explicit caller bearer/account pair for canonical OpenAI destinations; never persist. */
+export type ExplicitOpenAiCallerAuth = Readonly<{ authorization: string; chatgptAccountId: string }>;
+
+function explicitSidecarAuth(incomingHeaders: Headers): ExplicitOpenAiCallerAuth | null {
+  // Combined Authorization values must not smuggle a second credential into a snapshot,
+  // and only a well-formed ChatGPT-specific account marker is domain evidence — a generic
+  // organizations claim is not.
+  const bearer = /^Bearer[\t ]+([^\s,]+)$/i.exec(incomingHeaders.get("authorization")?.trim() ?? "")?.[1];
+  if (!bearer) return null;
+  const claim = inspectChatGptDomainClaim(bearer);
+  if (claim.kind !== "valid") return null;
+  const derivedAccountId = claim.accountId;
   const requestedAccountId = incomingHeaders.get("chatgpt-account-id")?.trim();
   // JWT payloads are decoded locally but not signature-verified. Requiring the caller's
   // explicit account header, and checking it against the token claim, makes forwarding an
   // intentional ChatGPT-auth operation instead of silently reclassifying any JWT-shaped
   // provider credential as a Codex bearer.
-  if (!requestedAccountId || requestedAccountId !== derivedAccountId) return undefined;
+  if (!requestedAccountId || requestedAccountId !== derivedAccountId) return null;
+  return { authorization: incomingHeaders.get("authorization")!, chatgptAccountId: requestedAccountId };
+}
+
+export function captureExplicitOpenAiCallerAuth(incomingHeaders: Headers, config: OcxConfig): ExplicitOpenAiCallerAuth | null {
+  const auth = explicitSidecarAuth(incomingHeaders);
+  if (!auth) return null;
+  try {
+    validateForwardAdmissionCredential(incomingHeaders, config);
+  } catch (error) {
+    if (error instanceof ForwardAdmissionCredentialError) return null;
+    throw error;
+  }
+  return auth;
+}
+
+function directSidecarHeaders(
+  incomingHeaders: Headers,
+  config: CodexAuthPolicyConfig,
+  admission?: Pick<DataPlaneAdmission, "source">,
+): Headers | undefined {
+  if (!explicitSidecarAuth(incomingHeaders)) return undefined;
   const selected = headersForCodexAuthContext(incomingHeaders, { kind: "main", accountId: null }, config, undefined, admission);
   return selected;
 }

package/src/providers/qoder-models.ts

@@ -0,0 +1,25 @@
+/**
+ * Cold-start fallback from the official Qoder Global model documentation, verified 2026-09-03.
+ * The account-specific `qoder --list-models` result is authoritative whenever discovery succeeds.
+ */
+export const QODER_GLOBAL_MODELS = [
+  "Qwen3.8-Max",
+  "Qwen3.7-Max",
+  "Qwen3.7-Plus",
+  "Kimi-K3",
+  "Kimi-K2.7-Code",
+  "GLM-5.3",
+  "GLM-5.2",
+  "DeepSeek-V4-Pro",
+] as const;
+
+/** Live Qoder CN roster captured from the official CLI on 2026-09-03. */
+export const QODER_CN_MODELS = [
+  "Qwen3.8-Max",
+  "Qwen3.8-Flash",
+  "Qwen3.7-Max",
+  "Qwen3.7-Plus",
+  "Qwen3.7-Flash",
+] as const;
+
+export const QODER_REASONING_EFFORTS = ["low", "medium", "high", "xhigh", "max"] as const;

package/src/providers/registry.ts

@@ -21,6 +21,21 @@ import {
 import { cursorFastCapableBases } from "../adapters/cursor/catalog";
 import { COMMAND_CODE_MODEL_REASONING_EFFORTS } from "./command-code-efforts";
 import { isCanonicalOpenRouterTarget } from "./openrouter-routing";
+import {
+  CODEBUDDY_CN_MODELS,
+  CODEBUDDY_CN_MODEL_CONTEXT_WINDOWS,
+  CODEBUDDY_CN_MODEL_DEFAULT_REASONING_EFFORTS,
+  CODEBUDDY_CN_MODEL_MAX_OUTPUT_TOKENS,
+  CODEBUDDY_CN_MODEL_REASONING_EFFORTS,
+  CODEBUDDY_CN_NO_VISION_MODELS,
+  CODEBUDDY_GLOBAL_MODELS,
+  CODEBUDDY_GLOBAL_MODEL_CONTEXT_WINDOWS,
+  CODEBUDDY_GLOBAL_MODEL_DEFAULT_REASONING_EFFORTS,
+  CODEBUDDY_GLOBAL_MODEL_MAX_OUTPUT_TOKENS,
+  CODEBUDDY_GLOBAL_MODEL_REASONING_EFFORTS,
+  CODEBUDDY_REASONING_EFFORTS,
+} from "./codebuddy-models";
+import { QODER_CN_MODELS, QODER_GLOBAL_MODELS, QODER_REASONING_EFFORTS } from "./qoder-models";
 
 export type ProviderAuthKind = "forward" | "oauth" | "key" | "local";
 export type MetadataModelIdNormalize = "case-insensitive";
@@ -160,6 +175,13 @@ export interface ProviderRegistryEntry {
   staticHeaders?: Record<string, string>;
   modelSuffixBracketStrip?: boolean;
   featured?: boolean;
+  /**
+   * Paid provider sponsorship under SPONSORS.md. `main` is reserved for model developers,
+   * `standard` for relays and gateways. The picker pins sponsor rows first (alphabetical among
+   * themselves) and labels them; nothing else reads this field. Routing, failover, quota, and
+   * defaults never consult it — that boundary is what SPONSORS.md promises users.
+   */
+  sponsor?: { tier: "main" | "standard"; url: string };
   dashboardPreset?: boolean;
   note?: string;
   dashboardUrl?: string;
@@ -1903,6 +1925,9 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
     authKind: "key", dashboardUrl: "https://www.orcarouter.ai/console",
     // The catalog is public, so a successful /models probe cannot validate a submitted key.
     apiKeyValidation: "unknown",
+    // Standard sponsor under SPONSORS.md (agreement signed 2026-09-07). Pins the row in the
+    // picker and adds the chip; nothing about routing or defaults changes.
+    sponsor: { tier: "standard", url: "https://www.orcarouter.ai/?utm_source=opencodex&utm_medium=readme" },
     defaultModel: "openai/gpt-5.5",
     models: ORCAROUTER_MODELS,
     liveModels: true,
@@ -1915,6 +1940,25 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
     preserveReasoningContentModels: ORCAROUTER_TEXT_ONLY_MODELS,
     note: "OpenAI-compatible adaptive router. Models and multimodal capabilities are discovered live from the public chat catalog. Use the OrcaRouter account entry for PKCE login.",
   },
+  {
+    // PackyCode: API relay (packyapi.com) for Claude Code, Codex, Gemini and more. Codex traffic
+    // uses the OpenAI-compatible host from their Codex/Kimi Code guides (docs.packyapi.com):
+    // https://cf.api.fan/v1 — GET /v1/models answers 401 without a key, so the host is live and
+    // discovery narrows to what the key's token group allows. Model ids are bare OpenAI-style
+    // ids (the Codex token group lists gpt-5.5 / gpt-5.1-codex).
+    // Standard sponsor under SPONSORS.md; the dashboardUrl carries their affiliate code.
+    id: "packycode", label: "PackyCode", adapter: "openai-chat", baseUrl: "https://cf.api.fan/v1",
+    authKind: "key", dashboardUrl: "https://www.packyapi.com/register?aff=k5KT",
+    sponsor: { tier: "standard", url: "https://www.packyapi.com/register?aff=k5KT" },
+    defaultModel: "gpt-5.5",
+    models: ["gpt-5.5", "gpt-5.1-codex"],
+    liveModels: true,
+    // New key preset: opt into collision preservation so a row named `packycode` that a user
+    // points at a different PackyCode host keeps its own destination instead of being pulled
+    // back onto the Codex endpoint below.
+    preserveCustomDestination: true,
+    note: "API relay for Claude Code, Codex, Gemini and more. Create a Codex-group token at packyapi.com; live discovery lists what the token group allows.",
+  },
   {
     // BizRouter: Korean enterprise LLM gateway (api.bizrouter.ai). Model ids are
     // vendor-namespaced (`<vendor>/<model>`) and pass through to the upstream as-is.
@@ -3140,6 +3184,101 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
   },
   // FREEZE 2026-07-10: no public OpenAI-compatible endpoint is documented. Evidence: devlog/_plan/260710_provider_hardening/003_research_aggregators.md.
   { id: "gitlab-duo", label: "GitLab Duo", baseUrl: "https://cloud.gitlab.com/ai/v1/proxy/openai/v1", adapter: "openai-chat", authKind: "key", dashboardUrl: "https://gitlab.com/-/user_settings/personal_access_tokens" },
+  {
+    // Official Qoder Global CLI automation surface. The canonical URL is an identity boundary;
+    // inference and model discovery are performed only by the installed vendor CLI. Authentication
+    // uses the documented PAT environment variable and never imports desktop/session credentials.
+    id: "qoder",
+    label: "Qoder (Global)",
+    adapter: "qoder",
+    baseUrl: "https://qoder.com",
+    authKind: "key",
+    apiKeyValidation: "unknown",
+    preserveCustomDestination: true,
+    dashboardUrl: "https://qoder.com/account/integrations",
+    defaultModel: "Qwen3.8-Max",
+    models: [...QODER_GLOBAL_MODELS],
+    liveModels: true,
+    reasoningEfforts: [...QODER_REASONING_EFFORTS],
+    noVisionModels: [...QODER_GLOBAL_MODELS],
+    note: "Official Qoder Global CLI using QODER_PERSONAL_ACCESS_TOKEN. Models are discovered per account with `qoder --list-models`; the documented roster is a degraded fallback. The CLI runs single-turn with tools, MCP, settings hooks, and session persistence disabled. Requires `npm install -g @qoder-ai/qodercli`.",
+  },
+  {
+    // Qoder CN is a separate credential, executable, destination, entitlement cache, and health
+    // domain. It deliberately does not reuse the OAuth/private-protocol design from #3010.
+    id: "qoder-cn",
+    label: "Qoder CN",
+    adapter: "qoder",
+    baseUrl: "https://qoder.cn",
+    authKind: "key",
+    apiKeyValidation: "unknown",
+    preserveCustomDestination: true,
+    dashboardUrl: "https://qoder.cn/account/integrations",
+    defaultModel: "Qwen3.8-Max",
+    models: [...QODER_CN_MODELS],
+    liveModels: true,
+    reasoningEfforts: [...QODER_REASONING_EFFORTS],
+    noVisionModels: [...QODER_CN_MODELS],
+    note: "Official Qoder CN CLI using QODERCN_PERSONAL_ACCESS_TOKEN. Models are discovered per account with `qodercn --list-models`; the verified roster is a degraded fallback. The CLI runs single-turn with tools, MCP, settings hooks, and session persistence disabled. Requires `npm install -g @qodercn-ai/qoderclicn`.",
+  },
+  {
+    // Official CodeBuddy Code CLI provider (Tencent Cloud), GLOBAL / `public` environment.
+    // Transport is the vendor-documented headless CLI automation surface
+    // (`codebuddy -p --output-format stream-json --tools ""`) authenticated with the official
+    // `CODEBUDDY_API_KEY` (https://www.codebuddy.ai/profile/keys). It does NOT read desktop
+    // session files, import desktop bearer tokens, impersonate the desktop client, or call the
+    // private console endpoint — the approach closed in #687 and left in draft in #2244.
+    // baseUrl is the canonical region identity: the adapter fails closed if it is overridden, so a
+    // global key is never sent to the CN environment (that is the separate `codebuddy-cn` entry).
+    // v1 runs tools-disabled so Codex keeps tool ownership; this provider is text/reasoning only
+    // until the control-protocol tool bridge lands (see docs). Free/trial/promotional/subscription
+    // credits draw from the same official API-key pool. Requires the CLI: `npm i -g @tencent-ai/codebuddy-code`.
+    // GOVERNANCE: whether routing this vendor automation surface behind a proxy for a third-party
+    // agent satisfies CodeBuddy's AUP is an open question flagged for maintainer security review.
+    id: "codebuddy",
+    label: "CodeBuddy (Global)",
+    adapter: "codebuddy",
+    baseUrl: "https://www.codebuddy.ai",
+    authKind: "key",
+    apiKeyValidation: "unknown",
+    preserveCustomDestination: true,
+    dashboardUrl: "https://www.codebuddy.ai/profile/keys",
+    defaultModel: "default-model",
+    models: CODEBUDDY_GLOBAL_MODELS,
+    liveModels: false,
+    modelContextWindows: CODEBUDDY_GLOBAL_MODEL_CONTEXT_WINDOWS,
+    modelMaxOutputTokens: CODEBUDDY_GLOBAL_MODEL_MAX_OUTPUT_TOKENS,
+    defaultMaxOutputTokens: 32_000,
+    reasoningEfforts: CODEBUDDY_REASONING_EFFORTS,
+    modelReasoningEfforts: CODEBUDDY_GLOBAL_MODEL_REASONING_EFFORTS,
+    modelDefaultReasoningEfforts: CODEBUDDY_GLOBAL_MODEL_DEFAULT_REASONING_EFFORTS,
+    note: "Official CodeBuddy Code CLI (Tencent Cloud), global/public environment. Uses the documented CODEBUDDY_API_KEY + headless CLI surface; never reads desktop sessions or private console endpoints. Region-isolated from codebuddy-cn. v1 disables CLI tools (--tools \"\") so Codex retains tool ownership: text/reasoning only for now. Requires `npm i -g @tencent-ai/codebuddy-code`. AUP/routing authorization flagged for maintainer security review.",
+  },
+  {
+    // Official CodeBuddy Code CLI provider, CHINA / `internal` environment. Identical adapter and
+    // binary as `codebuddy`; the region is fixed by the profile's CODEBUDDY_INTERNET_ENVIRONMENT
+    // and this canonical baseUrl. CN key: https://copilot.tencent.com/profile/keys. The CN model
+    // roster differs from Global (see codebuddy-models.ts) and is seeded separately (§八).
+    id: "codebuddy-cn",
+    label: "CodeBuddy (CN)",
+    adapter: "codebuddy",
+    baseUrl: "https://www.codebuddy.cn",
+    authKind: "key",
+    apiKeyValidation: "unknown",
+    preserveCustomDestination: true,
+    dashboardUrl: "https://copilot.tencent.com/profile/keys",
+    defaultModel: "default",
+    models: CODEBUDDY_CN_MODELS,
+    liveModels: false,
+    modelContextWindows: CODEBUDDY_CN_MODEL_CONTEXT_WINDOWS,
+    modelMaxOutputTokens: CODEBUDDY_CN_MODEL_MAX_OUTPUT_TOKENS,
+    defaultMaxOutputTokens: 32_000,
+    reasoningEfforts: CODEBUDDY_REASONING_EFFORTS,
+    modelReasoningEfforts: CODEBUDDY_CN_MODEL_REASONING_EFFORTS,
+    modelDefaultReasoningEfforts: CODEBUDDY_CN_MODEL_DEFAULT_REASONING_EFFORTS,
+    noVisionModels: CODEBUDDY_CN_NO_VISION_MODELS,
+    note: "Official CodeBuddy Code CLI (Tencent Cloud), China/internal environment. Uses the documented CODEBUDDY_API_KEY + headless CLI surface; never reads desktop sessions or private console endpoints. Region-isolated from codebuddy (Global); credentials are never exchanged across regions. v1 disables CLI tools (--tools \"\"): text/reasoning only for now. Requires `npm i -g @tencent-ai/codebuddy-code`. AUP/routing authorization flagged for maintainer security review.",
+  },
 ];
 
 export function providerRegistryFastWireError(

package/src/responses/compaction.ts

@@ -17,6 +17,10 @@
 
 export const OCX_COMPACTION_PREFIX = "ocx1:";
 
+export const OCX_NATIVE_REPLAY_RECOVERY_NOTE =
+  "Threads compacted through a routed provider can contain OpenCodeX-owned ocx1 state. "
+  + "Before resuming one through native Codex, run `ocx recover-history --ocx-compaction <thread-id> --yes`.";
+
 /** Mirrors codex-rs core/templates/compact/prompt.md (the local-compaction instruction). */
 export const COMPACT_PROMPT = `You are performing a CONTEXT CHECKPOINT COMPACTION. Create a handoff summary for another LLM that will resume the task.
 

package/src/responses/task-input.ts

@@ -20,9 +20,29 @@ function supportedBlock(value: unknown): value is TaskInputBlock {
   return value.detail === undefined || (typeof value.detail === "string" && imageDetails.has(value.detail));
 }
 
+/**
+ * Does this item carry a pairing key? A tool result is paired by `call_id`; a seed is not.
+ *
+ * Presence of the FIELD is not presence of a KEY (#3807). Codex desktop seeds a sub-agent
+ * thread with a lone `function_call_output` that some client builds emit with an explicit
+ * `call_id: null` or `""` rather than omitting it. Those values can never pair with a
+ * `function_call`, so treating them as a paired result sent the item to the guard in
+ * core.ts and answered 400 for a turn that is really external task input.
+ *
+ * A wrong-typed key (number, object) is NOT relaxed: that is malformed input rather than
+ * the absent-pairing seed shape, and it keeps the #3259 rejection.
+ */
+function hasPairingKey(item: Record<string, unknown>): boolean {
+  if (!("call_id" in item)) return false;
+  const callId = item.call_id;
+  if (callId === null) return false;
+  if (typeof callId === "string") return callId.trim().length > 0;
+  return true;
+}
+
 /** Recognize Codex external task input without repairing ordinary orphaned tool results. */
 export function externalTaskInputContent(item: unknown): string | OcxContentPart[] | undefined {
-  if (!isObj(item) || item.type !== "function_call_output" || "call_id" in item) return undefined;
+  if (!isObj(item) || item.type !== "function_call_output" || hasPairingKey(item)) return undefined;
   if (!nonBlank(item.id) || !nonBlank(item.name) || !nonBlank(item.namespace)) return undefined;
   const output = item.output;
   if (typeof output === "string") return nonBlank(output) ? output : undefined;

package/src/router.ts

@@ -10,7 +10,7 @@ import {
 import type { NormalizedComboConfig } from "./combos/types";
 import { hasOwnProvider } from "./config/provider-name";
 import { providerUsesKeyAuthOverride, resolveProviderApiKey } from "./providers/key-store";
-import { captureProviderApiKeySelection } from "./providers/api-key-selection";
+import { captureProviderApiKeySelection } from "./providers/api-key-selection-capture";
 import { assertProviderDestinationAllowed } from "./lib/destination-policy";
 import { redactSecretString, redactUrlForLog } from "./lib/redact";
 import {