@bitkyc08/opencodex 2.48.0 → 2.50.0

package/src/oauth/xai.ts

@@ -1,4 +1,5 @@
 /** xAI OAuth flow (Grok account login). Ported from jawcode oauth/xai.ts. */
+import { abortError, sleepWithAbort } from "../lib/upstream-retry";
 import { OAuthCallbackFlow, type OAuthCallbackFlowOptions } from "./callback-server";
 import { generatePKCE } from "./pkce";
 import type { LocalTokenImportMode, OAuthController, OAuthCredentials } from "./types";
@@ -11,6 +12,9 @@ const XAI_OAUTH_CALLBACK_PORT = 56121;
 const XAI_OAUTH_CALLBACK_PATH = "/callback";
 const XAI_OAUTH_REFRESH_SKEW_MS = 2 * 60 * 1000;
 const TOKEN_REQUEST_TIMEOUT_MS = 30_000;
+const RETRY_AFTER_MAX_DELAY_MS = 60_000;
+const JITTER_DELAY_CAP_MS = 2_000;
+const XAI_TRUSTED_AUTH_HOSTS = new Set(["auth.x.ai", "accounts.x.ai"]);
 
 export const XAI_LOCAL_CLI_DETACH_WARNING =
   "[oauth:xai] Grok CLI credential was stale; refreshed into OpenCodex ownership. Grok CLI may require login again.";
@@ -45,10 +49,21 @@ function requestSignal(signal: AbortSignal | undefined): AbortSignal {
 }
 
 function validateXaiEndpoint(rawUrl: string): string {
-  const parsed = new URL(rawUrl);
+  let parsed: URL;
+  try {
+    parsed = new URL(rawUrl);
+  } catch {
+    throw new Error("xAI OAuth discovery returned an unparseable endpoint URL");
+  }
   const host = parsed.hostname.toLowerCase();
-  if (parsed.protocol !== "https:" || (host !== "x.ai" && !host.endsWith(".x.ai"))) {
-    throw new Error(`xAI OAuth discovery returned an unexpected endpoint: ${rawUrl}`);
+  if (
+    parsed.protocol !== "https:"
+    || parsed.username !== ""
+    || parsed.password !== ""
+    || parsed.port !== ""
+    || !XAI_TRUSTED_AUTH_HOSTS.has(host)
+  ) {
+    throw new Error(`xAI OAuth discovery returned an unexpected endpoint (host: ${host || "none"})`);
   }
   return parsed.toString();
 }
@@ -94,15 +109,135 @@ function getTokenIdentity(accessToken: string, idToken: string | undefined): { a
 
 export class XaiTokenRequestError extends Error { constructor(public readonly status?:number,public readonly oauthError?:string,message="xAI token request failed",options?:{cause?:unknown}){super(message,options);this.name="XaiTokenRequestError";} }
 export interface XaiTokenRetryDeps { sleep?:(ms:number)=>Promise<void>; random?:()=>number }
-function isAbortError(error:unknown):boolean{return error instanceof DOMException&&error.name==="AbortError";}
-function retryDelay(attempt:number,retryAfter:string|null,random:()=>number):number{const base=attempt===1?100:250,j=Math.round(base*(.75+random()*.5)),seconds=retryAfter!==null&&/^\d+$/.test(retryAfter)?Number(retryAfter):0;return Math.min(2000,Math.max(j,seconds*1000));}
-async function readTokenError(response:Response):Promise<XaiTokenRequestError>{let oauthError:string|undefined,detail="";try{const body=await response.json() as {error?:unknown;error_description?:unknown};if(typeof body.error==="string")oauthError=body.error;if(typeof body.error_description==="string")detail=body.error_description;}catch{}const suffix=detail?`: ${detail}`:oauthError?`: ${oauthError}`:"";return new XaiTokenRequestError(response.status,oauthError,`xAI token request failed: ${response.status}${suffix}`);}
+const IMF_FIXDATE_RE = /^(?:Mon|Tue|Wed|Thu|Fri|Sat|Sun), (\d{2}) (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) (\d{4}) (\d{2}):(\d{2}):(\d{2}) GMT$/i;
+const RFC850_DATE_RE = /^(?:Monday|Tuesday|Wednesday|Thursday|Friday|Saturday|Sunday), (\d{2})-(Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)-(\d{2}) (\d{2}):(\d{2}):(\d{2}) GMT$/i;
+const ASCTIME_DATE_RE = /^(?:Mon|Tue|Wed|Thu|Fri|Sat|Sun) (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) ( \d|\d{2}) (\d{2}):(\d{2}):(\d{2}) (\d{4})$/i;
+const HTTP_MONTH_INDEX: Record<string, number> = {
+  jan: 0, feb: 1, mar: 2, apr: 3, may: 4, jun: 5,
+  jul: 6, aug: 7, sep: 8, oct: 9, nov: 10, dec: 11,
+};
+
+function parseUtcDateParts(
+  year: number,
+  monthName: string,
+  day: number,
+  hour: number,
+  minute: number,
+  second: number,
+): number | undefined {
+  const month = HTTP_MONTH_INDEX[monthName.toLowerCase()];
+  if (month === undefined) return undefined;
+  const timestamp = Date.UTC(year, month, day, hour, minute, second);
+  const parsed = new Date(timestamp);
+  return parsed.getUTCFullYear() === year
+    && parsed.getUTCMonth() === month
+    && parsed.getUTCDate() === day
+    && parsed.getUTCHours() === hour
+    && parsed.getUTCMinutes() === minute
+    && parsed.getUTCSeconds() === second
+    ? timestamp
+    : undefined;
+}
+
+function parseHttpDateMs(value: string, now: number): number | undefined {
+  const match = IMF_FIXDATE_RE.exec(value);
+  if (match) {
+    return parseUtcDateParts(
+      Number(match[3]), match[2]!, Number(match[1]),
+      Number(match[4]), Number(match[5]), Number(match[6]),
+    );
+  }
+  const rfc850 = RFC850_DATE_RE.exec(value);
+  if (rfc850) {
+    // Two-digit years more than 50 years in the future are in the past (RFC 9110).
+    const currentYear = new Date(now).getUTCFullYear();
+    let year = Math.floor(currentYear / 100) * 100 + Number(rfc850[3]);
+    const candidateTimeOfYear = Date.UTC(
+      2000, HTTP_MONTH_INDEX[rfc850[2]!.toLowerCase()]!, Number(rfc850[1]),
+      Number(rfc850[4]), Number(rfc850[5]), Number(rfc850[6]),
+    );
+    const current = new Date(now);
+    const currentTimeOfYear = Date.UTC(
+      2000, current.getUTCMonth(), current.getUTCDate(),
+      current.getUTCHours(), current.getUTCMinutes(), current.getUTCSeconds(),
+      current.getUTCMilliseconds(),
+    );
+    const yearDelta = year - currentYear;
+    if (yearDelta < -50 || (yearDelta === -50 && candidateTimeOfYear < currentTimeOfYear)) {
+      year += 100;
+    } else if (yearDelta > 50 || (yearDelta === 50 && candidateTimeOfYear > currentTimeOfYear)) {
+      year -= 100;
+    }
+    return parseUtcDateParts(
+      year, rfc850[2]!, Number(rfc850[1]),
+      Number(rfc850[4]), Number(rfc850[5]), Number(rfc850[6]),
+    );
+  }
+  const asctime = ASCTIME_DATE_RE.exec(value);
+  if (!asctime) return undefined;
+  return parseUtcDateParts(
+    Number(asctime[6]), asctime[1]!, Number(asctime[2]),
+    Number(asctime[3]), Number(asctime[4]), Number(asctime[5]),
+  );
+}
+
+function parseRetryAfterMs(retryAfter: string | null): number | undefined {
+  const text = retryAfter?.trim();
+  if (!text) return undefined;
+  if (/^\d+(?:\.\d+)?$/.test(text)) {
+    const ms = Math.ceil(Number(text) * 1000);
+    return ms > 0 ? ms : undefined;
+  }
+  const now = Date.now();
+  const timestamp = parseHttpDateMs(text, now);
+  if (timestamp === undefined) return undefined;
+  const delay = timestamp - now;
+  return delay > 0 ? delay : undefined;
+}
+
+function jitterDelay(attempt: number, random: () => number): number {
+  const base = attempt === 1 ? 100 : 250;
+  return Math.min(JITTER_DELAY_CAP_MS, Math.round(base * (0.75 + random() * 0.5)));
+}
+
+/**
+ * Delay before the next attempt, or undefined when the server asked for a wait
+ * beyond the retry budget — retrying earlier than Retry-After would hammer the
+ * token endpoint, so the caller fails the request instead of clamping.
+ */
+function retryDelay(attempt: number, retryAfter: string | null, random: () => number): number | undefined {
+  const serverMs = parseRetryAfterMs(retryAfter);
+  if (serverMs === undefined) return jitterDelay(attempt, random);
+  return serverMs <= RETRY_AFTER_MAX_DELAY_MS ? serverMs : undefined;
+}
+
+async function sleepAbortable(
+  ms: number,
+  sleep: (ms: number) => Promise<void>,
+  signal: AbortSignal | undefined,
+): Promise<void> {
+  if (!signal) return sleep(ms);
+  if (signal.aborted) throw abortError(signal);
+  let onAbort!: () => void;
+  try {
+    await Promise.race([
+      sleep(ms),
+      new Promise<never>((_, reject) => {
+        onAbort = () => reject(abortError(signal));
+        signal.addEventListener("abort", onAbort, { once: true });
+      }),
+    ]);
+  } finally {
+    signal.removeEventListener("abort", onAbort);
+  }
+}
+async function readTokenError(response:Response):Promise<XaiTokenRequestError>{let oauthError:string|undefined,detail="";try{const body=await response.json() as {error?:unknown;error_description?:unknown};if(typeof body.error==="string")oauthError=body.error;if(typeof body.error_description==="string")detail=body.error_description;}catch{/* non-JSON error body: fall through to the generic message */}const suffix=detail?`: ${detail}`:oauthError?`: ${oauthError}`:"";return new XaiTokenRequestError(response.status,oauthError,`xAI token request failed: ${response.status}${suffix}`);}
 export async function postXaiToken(
   tokenEndpoint: string,
   body: Record<string, string>,
   signal?: AbortSignal, deps:XaiTokenRetryDeps={},
 ): Promise<XaiTokenPayload> {
- const sleep=deps.sleep??(ms=>Bun.sleep(ms)),random=deps.random??Math.random;let last:unknown;
+ const sleep=deps.sleep??((ms:number)=>sleepWithAbort(ms,signal)),random=deps.random??Math.random;let last:unknown;
  for(let attempt=1;attempt<=3;attempt++){let response:Response;try{response=await fetch(tokenEndpoint, {
     method: "POST",
     headers: {
@@ -111,7 +246,15 @@ export async function postXaiToken(
     },
     body: new URLSearchParams(body).toString(),
     signal: requestSignal(signal),
-  });}catch(error){if(isAbortError(error)&&signal?.aborted)throw error;last=error;if(attempt===3)throw new XaiTokenRequestError(undefined,undefined,"xAI token request failed: network error",{cause:error});await sleep(retryDelay(attempt,null,random));continue;}if(response.ok)return await response.json() as XaiTokenPayload;const error=await readTokenError(response);last=error;if(!(response.status===429||response.status>=500)||attempt===3)throw error;await sleep(retryDelay(attempt,response.headers.get("retry-after"),random));}throw last;
+  });}catch(error){
+  if(signal?.aborted)throw error;
+  const name=(error as {name?:string}|undefined)?.name;
+  if(name==="AbortError"||name==="TimeoutError")throw error;
+  last=error;
+  if(attempt===3)throw new XaiTokenRequestError(undefined,undefined,"xAI token request failed: network error",{cause:error});
+  await sleepAbortable(jitterDelay(attempt,random),sleep,signal);
+  continue;
+  }if(response.ok)return await response.json() as XaiTokenPayload;const error=await readTokenError(response);last=error;if(!(response.status===429||response.status>=500)||attempt===3)throw error;if(signal?.aborted)throw error;const delay=retryDelay(attempt,response.headers.get("retry-after"),random);if(delay===undefined)throw error;await sleepAbortable(delay,sleep,signal);}throw last;
 }
 
 function credentialsFromTokenPayload(payload: XaiTokenPayload, refreshFallback = ""): OAuthCredentials {

package/src/providers/api-key-selection-capture.ts

@@ -0,0 +1,10 @@
+import type { OcxProviderConfig } from "../types";
+import type { ProviderApiKeySelection } from "../types/provider";
+
+export function captureProviderApiKeySelection(provider: OcxProviderConfig): ProviderApiKeySelection {
+  return {
+    entryId: provider.apiKeyPool?.find(entry => entry.key === provider.apiKey)?.id,
+    reference: provider.apiKey,
+    revision: provider.apiKeySelectionRevision,
+  };
+}

package/src/providers/api-key-selection.ts

@@ -6,14 +6,9 @@ import type { ProviderApiKeySelection } from "../types/provider";
 import { routedProviderConfig } from "../router";
 import { OPENCODE_GO_SESSION_HEADER } from "./opencode-go-transport";
 import { resolveProviderTransport, XAI_GROK_COMPATIBILITY, type OcxProviderTransport } from "./xai-transport";
+import { captureProviderApiKeySelection } from "./api-key-selection-capture";
 
-export function captureProviderApiKeySelection(provider: OcxProviderConfig): ProviderApiKeySelection {
-  return {
-    entryId: provider.apiKeyPool?.find(entry => entry.key === provider.apiKey)?.id,
-    reference: provider.apiKey,
-    revision: provider.apiKeySelectionRevision,
-  };
-}
+export { captureProviderApiKeySelection } from "./api-key-selection-capture";
 
 function matchesSelection(provider: OcxProviderConfig, expected: ProviderApiKeySelection): boolean {
   const current = captureProviderApiKeySelection(provider);

package/src/providers/caller-authorization.ts

@@ -0,0 +1,36 @@
+import type { OcxConfig, OcxProviderConfig } from "../types";
+import { inspectChatGptDomainClaim } from "../oauth/chatgpt";
+import { isProxyAdmissionSecret } from "../server/auth-cors";
+import { isCanonicalOpenAiForwardProvider } from "./openai-tiers";
+
+/** The caller's own ChatGPT-domain credential as plain Direct forwarding would use it. */
+export type CallerDirectAuth = Readonly<{ authorization: string; chatgptAccountId?: string }>;
+
+/** Whether this transport can consume the request's Authorization as its upstream credential. */
+export function providerConsumesCallerAuthorization(provider: OcxProviderConfig): boolean {
+  return isCanonicalOpenAiForwardProvider(provider)
+    || (provider.adapter === "cursor" && provider.authMode !== "oauth" && !provider.apiKey?.trim());
+}
+
+/**
+ * Capture the caller's Direct credential for a canonical-route restore after an internal
+ * rewrite. This restore is intentionally STRICTER than plain unchanged-route Direct
+ * forwarding: only a bearer with a VALID ChatGPT-domain claim qualifies (a clean single
+ * non-proxy JWT whose ChatGPT-specific account marker is well-formed and unambiguous, with
+ * any explicit account header matching it). An opaque bearer, a foreign JWT carrying only a
+ * generic organizations claim, and a ChatGPT-marked but malformed/conflicting token are all
+ * rejected: after a shadow/thread rewrite a self-asserted header cannot distinguish a
+ * caller-owned main credential from a foreign source-route token, so those cases stay
+ * fail-closed. Claims are decoded locally as routing markers, not authenticity proof, and
+ * unchanged-route Direct forwarding is governed by its own legacy rules.
+ */
+export function captureCallerDirectAuth(incomingHeaders: Headers, config: OcxConfig): CallerDirectAuth | null {
+  const raw = incomingHeaders.get("authorization")?.trim();
+  const bearer = /^Bearer[\t ]+([^\s,]+)$/i.exec(raw ?? "")?.[1];
+  if (!bearer || isProxyAdmissionSecret(bearer, config)) return null;
+  const claim = inspectChatGptDomainClaim(bearer);
+  if (claim.kind !== "valid") return null;
+  const headerAccount = incomingHeaders.get("chatgpt-account-id")?.trim();
+  if (headerAccount && headerAccount !== claim.accountId) return null;
+  return { authorization: `Bearer ${bearer}`, chatgptAccountId: claim.accountId };
+}

package/src/providers/codebuddy-models.ts

@@ -0,0 +1,184 @@
+/**
+ * Curated CodeBuddy model catalogs, transcribed from the OFFICIAL model manifest bundled with the
+ * vendor CLI (`@tencent-ai/codebuddy-code` v2.143.0: `product.json` for the global/`public`
+ * environment, `product.internal.json` for the China/`internal` environment) and cross-checked
+ * against the CLI's own `--model` accept-list. Verified 2026-09-03.
+ *
+ * Global and CN are deliberately NOT the same roster (§八). Context windows, output caps, vision
+ * and reasoning ladders are filled ONLY where the official manifest states them; a model with no
+ * published figure is omitted rather than guessed (§二十八/§二十九). CodeBuddy exposes no documented
+ * third-party live `/v1/models` endpoint, so these providers seed a static catalog
+ * (`liveModels: false`) exactly like the Kiro and Command Code entries.
+ */
+
+/** Global (`public`) session models accepted by `codebuddy --model`. */
+export const CODEBUDDY_GLOBAL_MODELS = [
+  "default-model",
+  "fast-model",
+  "balanced-model",
+  "primary-model",
+  "deep-model",
+  "gpt-5.6-sol",
+  "gpt-5.6-terra",
+  "gpt-5.6-luna",
+  "gpt-5.5",
+  "gpt-5.4",
+  "gpt-5.3-codex",
+  "gemini-3.5-flash",
+  "glm-5.3",
+  "glm-5.2",
+  "kimi-k3",
+  "kimi-k2.6",
+  "minimax-m3",
+];
+
+/** China (`internal`) session models from the official internal manifest (text/chat models only). */
+export const CODEBUDDY_CN_MODELS = [
+  "default",
+  "deepseek-v4-pro",
+  "deepseek-v4-flash",
+  "minimax-m3",
+  "minimax-m2.7",
+  "glm-5.2",
+  "glm-5.1",
+  "glm-5.0",
+  "glm-5.0-turbo",
+  "glm-5v-turbo",
+  "glm-4.7",
+  "kimi-k3-1",
+  "kimi-k2.7",
+  "kimi-k2.6",
+  "kimi-k2.5",
+  "deepseek-v3-2-volc",
+  "hy3",
+  "hunyuan-chat",
+];
+
+/**
+ * The CLI documents a single `--effort` ladder (minimal, low, medium, high, xhigh, max). The Codex
+ * reasoning ladder overlaps it at low..max; `minimal`/`none` are Codex sentinels normalized by
+ * `mapReasoningEffort`, and `ultra` folds to `max`. Declared provider-wide, then narrowed per model
+ * where the official manifest publishes a smaller `supportedEfforts`.
+ */
+export const CODEBUDDY_REASONING_EFFORTS = ["low", "medium", "high", "xhigh", "max"];
+
+export const CODEBUDDY_GLOBAL_MODEL_CONTEXT_WINDOWS: Record<string, number> = {
+  "default-model": 176_000,
+  "fast-model": 200_000,
+  "balanced-model": 256_000,
+  "primary-model": 272_000,
+  "deep-model": 176_000,
+  "gpt-5.6-sol": 1_000_000,
+  "gpt-5.6-terra": 1_000_000,
+  "gpt-5.6-luna": 1_000_000,
+  "gpt-5.5": 1_000_000,
+  "gpt-5.4": 272_000,
+  "gpt-5.3-codex": 272_000,
+  "gemini-3.5-flash": 1_000_000,
+  "glm-5.3": 1_000_000,
+  "glm-5.2": 1_000_000,
+  "kimi-k3": 1_000_000,
+  "kimi-k2.6": 256_000,
+  "minimax-m3": 512_000,
+};
+
+export const CODEBUDDY_GLOBAL_MODEL_MAX_OUTPUT_TOKENS: Record<string, number> = {
+  "default-model": 24_000,
+  "fast-model": 32_000,
+  "balanced-model": 32_000,
+  "primary-model": 72_000,
+  "deep-model": 24_000,
+  "gpt-5.6-sol": 128_000,
+  "gpt-5.6-terra": 128_000,
+  "gpt-5.6-luna": 128_000,
+  "gpt-5.5": 72_000,
+  "gpt-5.4": 128_000,
+  "gpt-5.3-codex": 128_000,
+  "gemini-3.5-flash": 65_536,
+  "glm-5.3": 48_000,
+  "glm-5.2": 48_000,
+  "kimi-k3": 32_000,
+  "kimi-k2.6": 32_000,
+  "minimax-m3": 128_000,
+};
+
+/** Per-model ladders narrowed from the official manifest's `reasoning.supportedEfforts`. */
+export const CODEBUDDY_GLOBAL_MODEL_REASONING_EFFORTS: Record<string, string[]> = {
+  "gpt-5.6-sol": ["low", "medium", "high", "xhigh"],
+  "gpt-5.6-terra": ["low", "medium", "high", "xhigh"],
+  "gpt-5.6-luna": ["low", "medium", "high", "xhigh"],
+  "glm-5.3": ["low", "high", "max"],
+  "glm-5.2": ["high", "xhigh"],
+};
+
+export const CODEBUDDY_GLOBAL_MODEL_DEFAULT_REASONING_EFFORTS: Record<string, string> = {
+  "gpt-5.6-sol": "high",
+  "gpt-5.6-terra": "high",
+  "gpt-5.6-luna": "high",
+  "glm-5.3": "high",
+  "glm-5.2": "high",
+};
+
+export const CODEBUDDY_CN_MODEL_CONTEXT_WINDOWS: Record<string, number> = {
+  "default": 200_000,
+  "deepseek-v4-pro": 1_000_000,
+  "deepseek-v4-flash": 1_000_000,
+  "minimax-m3": 512_000,
+  "minimax-m2.7": 200_000,
+  "glm-5.2": 1_000_000,
+  "glm-5.1": 200_000,
+  "glm-5.0": 200_000,
+  "glm-5.0-turbo": 200_000,
+  "glm-5v-turbo": 200_000,
+  "glm-4.7": 200_000,
+  "kimi-k3-1": 1_000_000,
+  "kimi-k2.7": 256_000,
+  "kimi-k2.6": 256_000,
+  "kimi-k2.5": 164_000,
+  "deepseek-v3-2-volc": 96_000,
+  "hy3": 192_000,
+  "hunyuan-chat": 200_000,
+};
+
+export const CODEBUDDY_CN_MODEL_MAX_OUTPUT_TOKENS: Record<string, number> = {
+  "default": 24_000,
+  "deepseek-v4-pro": 50_000,
+  "deepseek-v4-flash": 50_000,
+  "minimax-m3": 128_000,
+  "minimax-m2.7": 48_000,
+  "glm-5.2": 48_000,
+  "glm-5.1": 48_000,
+  "glm-5.0": 48_000,
+  "glm-5.0-turbo": 48_000,
+  "glm-5v-turbo": 64_000,
+  "glm-4.7": 48_000,
+  "kimi-k3-1": 32_000,
+  "kimi-k2.7": 32_000,
+  "kimi-k2.6": 32_000,
+  "kimi-k2.5": 32_000,
+  "deepseek-v3-2-volc": 32_000,
+  "hy3": 64_000,
+  "hunyuan-chat": 8_192,
+};
+
+export const CODEBUDDY_CN_MODEL_REASONING_EFFORTS: Record<string, string[]> = {
+  "hy3": ["low", "high"],
+};
+
+export const CODEBUDDY_CN_MODEL_DEFAULT_REASONING_EFFORTS: Record<string, string> = {
+  "hy3": "high",
+};
+
+/**
+ * Text-only models (official manifest `supportsImages: false`). Images for any OTHER model are
+ * passed through natively; a model listed here has its images routed through the proxy's vision
+ * sidecar rather than being silently dropped (§二十九).
+ */
+export const CODEBUDDY_CN_NO_VISION_MODELS = [
+  "default",
+  "glm-5.0",
+  "glm-5.0-turbo",
+  "glm-4.7",
+  "deepseek-v3-2-volc",
+  "hunyuan-chat",
+];

package/src/providers/derive.ts

@@ -80,6 +80,10 @@ export interface DerivedProviderPreset {
   keyOptional?: boolean;
   /** Free pricing (may still require a key). */
   freeTier?: boolean;
+  /** Sponsor tier from SPONSORS.md; the picker pins and labels these rows. */
+  sponsor?: "main" | "standard";
+  /** Sponsor landing URL (with its tracking parameters), for the picker's row link. */
+  sponsorUrl?: string;
   /**
    * Endpoint picker rows (token plan / payg / custom). When present, the add-provider
    * form shows a dropdown; `custom` reveals a free-text base URL field.
@@ -607,6 +611,7 @@ function entryToPreset(entry: ProviderRegistryEntry): DerivedProviderPreset {
     ...(entry.note ? { note: entry.note } : {}),
     ...(entry.keyOptional ? { keyOptional: true } : {}),
     ...(entry.freeTier ? { freeTier: true } : {}),
+    ...(entry.sponsor ? { sponsor: entry.sponsor.tier, sponsorUrl: entry.sponsor.url } : {}),
     ...(entry.baseUrlChoices ? { baseUrlChoices: entry.baseUrlChoices.map(c => ({ ...c })) } : {}),
   };
 }

package/src/providers/free-directory.ts

@@ -19,7 +19,7 @@ export const FREE_PROVIDER_ACCESS_GROUPS = {
   "recurring-credit": ["bytez", "nous-research"],
   "signup-credit": [
     "agentrouter", "ai21", "baichuan", "baseten", "deepinfra", "deepseek", "doubao", "fireworks", "freemodel-dev", "glm-cn",
-    "hyperbolic", "longcat", "monsterapi", "nebius", "novita", "nscale", "nvidia", "predibase", "publicai", "qoder",
+    "hyperbolic", "longcat", "monsterapi", "nebius", "novita", "nscale", "nvidia", "predibase", "publicai", "qoder", "qoder-cn",
     "scaleway", "sensenova", "stepfun", "together", "vertex",
   ],
 } as const satisfies Record<ProviderAccessGroup, readonly string[]>;
@@ -140,6 +140,30 @@ const CONNECTABLE: Record<string, ConnectableOverride> = {
   nscale: openAi("https://inference.api.nscale.com/v1", "https://console.nscale.com", { supportLevel: "supported", verification: "official", documentationUrl: "https://docs.nscale.com/docs/use-cases/chat", modelsUrl: "https://inference.api.nscale.com/v1/models", lastVerified: "2026-08-03" }),
   nvidia: openAi("https://integrate.api.nvidia.com/v1", "https://build.nvidia.com", { supportLevel: "supported", verification: "official", documentationUrl: "https://docs.api.nvidia.com/nim/reference/llm-apis" }),
   publicai: openAi("https://api.publicai.co/v1", "https://publicai.co"),
+  qoder: {
+    baseUrl: "https://qoder.com",
+    dashboardUrl: "https://qoder.com/account/integrations",
+    adapter: "qoder",
+    authKind: "key",
+    supportLevel: "supported",
+    verification: "official",
+    documentationUrl: "https://docs.qoder.com/cli/authentication",
+    discovery: "live",
+    liveModels: true,
+    lastVerified: "2026-09-03",
+  },
+  "qoder-cn": {
+    baseUrl: "https://qoder.cn",
+    dashboardUrl: "https://qoder.cn/account/integrations",
+    adapter: "qoder",
+    authKind: "key",
+    supportLevel: "supported",
+    verification: "official",
+    documentationUrl: "https://docs.qoder.cn/en/cli/authentication",
+    discovery: "live",
+    liveModels: true,
+    lastVerified: "2026-09-03",
+  },
   scaleway: openAi("https://api.scaleway.ai/v1", "https://console.scaleway.com/generative-api", { supportLevel: "supported", verification: "official", documentationUrl: "https://www.scaleway.com/en/docs/generative-apis/api-cli/using-generative-apis/", modelsUrl: "https://api.scaleway.ai/v1/models", lastVerified: "2026-08-01" }),
   sensenova: openAi("https://token.sensenova.cn/v1", "https://console.sensenova.cn", { verification: "official" }),
   stepfun: openAi("https://api.stepfun.com/v1", "https://platform.stepfun.com", { verification: "official" }),
@@ -160,7 +184,7 @@ const LABELS: Record<string, string> = {
   ai21: "AI21", baichuan: "Baichuan", deepinfra: "DeepInfra", deepseek: "DeepSeek", doubao: "Doubao",
   "freemodel-dev": "FreeModel.dev", sambanova: "SambaNova Cloud", nebius: "Nebius Token Factory",
   novita: "Novita", nscale: "Nscale", nvidia: "NVIDIA NIM",
-  publicai: "PublicAI", qoder: "Qoder", sensenova: "SenseNova", stepfun: "StepFun", vertex: "Google Vertex AI",
+  publicai: "PublicAI", qoder: "Qoder", "qoder-cn": "Qoder CN", sensenova: "SenseNova", stepfun: "StepFun", vertex: "Google Vertex AI",
 };
 
 const referenceNote = "Reference entry only: no safe documented API integration is enabled. Configure it manually only with provider documentation; consumer-web cookies and anti-bot bypasses are intentionally unsupported.";

package/src/providers/google-ai-studio-model-discovery.ts

@@ -0,0 +1,74 @@
+import {
+  extractModelEnvelopeRows,
+  isValidModelDiscoveryModelId,
+  type ProviderModelItemsResult,
+  type ProviderModelsApiItem,
+} from "./model-discovery";
+
+const GOOGLE_MODEL_PREFIX = "models/";
+const MAX_GENERATION_METHODS = 32;
+const MAX_GENERATION_METHOD_LENGTH = 64;
+
+/** Returns the value if it is a positive safe integer; otherwise undefined. */
+function positiveSafeInteger(value: unknown): number | undefined {
+  return typeof value === "number" && Number.isSafeInteger(value) && value > 0
+    ? value
+    : undefined;
+}
+
+/**
+ * Extracts and normalizes supported model items from a Google AI Studio
+ * /v1beta/models response payload.
+ *
+ * Validates the native models[] envelope, strips the 'models/' prefix, filters
+ * to rows supporting 'generateContent', maps input/output token limits, and
+ * resiliently skips toxic or malformed individual rows.
+ */
+export function extractGoogleAiStudioModelItems(
+  value: unknown,
+  maxModels: number,
+): ProviderModelItemsResult {
+  const envelope = extractModelEnvelopeRows(value, maxModels, ["models"]);
+  if (!envelope.ok) return envelope;
+
+  const items: ProviderModelsApiItem[] = [];
+  const seen = new Set<string>();
+  for (const raw of envelope.rows) {
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+      continue;
+    }
+    const name = Reflect.get(raw, "name");
+    const generationMethods = Reflect.get(raw, "supportedGenerationMethods");
+    if (!isValidModelDiscoveryModelId(name)) {
+      continue;
+    }
+    if (generationMethods === undefined) continue;
+    if (
+      !Array.isArray(generationMethods)
+      || generationMethods.length > MAX_GENERATION_METHODS
+      || generationMethods.some(method => typeof method !== "string" || method.length > MAX_GENERATION_METHOD_LENGTH)
+    ) {
+      continue;
+    }
+    if (!generationMethods.includes("generateContent")) continue;
+
+    const id = name.startsWith(GOOGLE_MODEL_PREFIX)
+      ? name.slice(GOOGLE_MODEL_PREFIX.length)
+      : name;
+    if (!isValidModelDiscoveryModelId(id) || seen.has(id)) continue;
+    seen.add(id);
+
+    const inputTokenLimit = positiveSafeInteger(Reflect.get(raw, "inputTokenLimit"));
+    const outputTokenLimit = positiveSafeInteger(Reflect.get(raw, "outputTokenLimit"));
+    items.push({
+      id,
+      owned_by: "google",
+      ...(inputTokenLimit !== undefined
+        ? { context_length: inputTokenLimit, max_input_tokens: inputTokenLimit }
+        : {}),
+      ...(outputTokenLimit !== undefined ? { max_output_tokens: outputTokenLimit } : {}),
+    });
+  }
+  return { ok: true, items, rawCount: envelope.rows.length };
+}
+

package/src/providers/openai-sidecar.ts

@@ -10,7 +10,7 @@ import {
   type CodexAuthPolicyConfig,
 } from "../codex/auth-context";
 import { recordCodexUpstreamOutcome, type CodexUpstreamOutcome } from "../codex/routing";
-import { extractAccountId } from "../oauth/chatgpt";
+import { inspectChatGptDomainClaim } from "../oauth/chatgpt";
 import { ForwardAdmissionCredentialError, validateForwardAdmissionCredential, type DataPlaneAdmission } from "../server/auth-cors";
 import type { CodexAccountMode, OcxConfig, OcxProviderConfig } from "../types";
 import {
@@ -77,21 +77,45 @@ export function listOpenAiForwardSidecarCandidates(config: OcxConfig): OpenAiFor
   }];
 }
 
-function directSidecarHeaders(
-  incomingHeaders: Headers,
-  config: CodexAuthPolicyConfig,
-  admission?: Pick<DataPlaneAdmission, "source">,
-): Headers | undefined {
-  const bearer = incomingHeaders.get("authorization")?.replace(/^Bearer\s+/i, "").trim();
-  if (!bearer) return undefined;
-  const derivedAccountId = extractAccountId(undefined, bearer);
-  if (!derivedAccountId) return undefined;
+/** An explicit caller bearer/account pair for canonical OpenAI destinations; never persist. */
+export type ExplicitOpenAiCallerAuth = Readonly<{ authorization: string; chatgptAccountId: string }>;
+
+function explicitSidecarAuth(incomingHeaders: Headers): ExplicitOpenAiCallerAuth | null {
+  // Combined Authorization values must not smuggle a second credential into a snapshot,
+  // and only a well-formed ChatGPT-specific account marker is domain evidence — a generic
+  // organizations claim is not.
+  const bearer = /^Bearer[\t ]+([^\s,]+)$/i.exec(incomingHeaders.get("authorization")?.trim() ?? "")?.[1];
+  if (!bearer) return null;
+  const claim = inspectChatGptDomainClaim(bearer);
+  if (claim.kind !== "valid") return null;
+  const derivedAccountId = claim.accountId;
   const requestedAccountId = incomingHeaders.get("chatgpt-account-id")?.trim();
   // JWT payloads are decoded locally but not signature-verified. Requiring the caller's
   // explicit account header, and checking it against the token claim, makes forwarding an
   // intentional ChatGPT-auth operation instead of silently reclassifying any JWT-shaped
   // provider credential as a Codex bearer.
-  if (!requestedAccountId || requestedAccountId !== derivedAccountId) return undefined;
+  if (!requestedAccountId || requestedAccountId !== derivedAccountId) return null;
+  return { authorization: incomingHeaders.get("authorization")!, chatgptAccountId: requestedAccountId };
+}
+
+export function captureExplicitOpenAiCallerAuth(incomingHeaders: Headers, config: OcxConfig): ExplicitOpenAiCallerAuth | null {
+  const auth = explicitSidecarAuth(incomingHeaders);
+  if (!auth) return null;
+  try {
+    validateForwardAdmissionCredential(incomingHeaders, config);
+  } catch (error) {
+    if (error instanceof ForwardAdmissionCredentialError) return null;
+    throw error;
+  }
+  return auth;
+}
+
+function directSidecarHeaders(
+  incomingHeaders: Headers,
+  config: CodexAuthPolicyConfig,
+  admission?: Pick<DataPlaneAdmission, "source">,
+): Headers | undefined {
+  if (!explicitSidecarAuth(incomingHeaders)) return undefined;
   const selected = headersForCodexAuthContext(incomingHeaders, { kind: "main", accountId: null }, config, undefined, admission);
   return selected;
 }