@bitkyc08/opencodex 2.52.0-preview.20260911 → 2.52.0

package/src/providers/devin-cli-authmode-migration.ts

@@ -0,0 +1,57 @@
+/**
+ * Repair a saved `devin-cli` row that still claims `authMode: "local"`.
+ *
+ * `derive.ts` seeds `authMode` from the registry's `authKind`, so every config
+ * written while `devin-cli` was a local provider carries `"local"`. The registry
+ * now classifies it as an account provider, and the management write boundary
+ * fails closed on that mismatch: `auth-cors.ts` rejects `authMode: "local"` when
+ * the registry entry is not local. Without this, an existing install can no
+ * longer save provider changes from the dashboard.
+ *
+ * It rewrites exactly that one field, on exactly that mismatch. A row the user
+ * retargeted at another adapter is left alone, and so is any other value.
+ *
+ * It also WARNS, without changing anything, when the saved row still names the
+ * ACP adapter. That field no longer selects the transport — `routedProviderConfig`
+ * pins the adapter from the registry for any row whose name is a registry id — so
+ * an operator who deliberately chose ACP would otherwise switch transports
+ * silently. The warning names the custom-id row that still gets them ACP.
+ */
+import { PROVIDER_REGISTRY } from "./registry";
+import type { OcxConfig } from "../types";
+
+export interface DevinCliAuthModeProjection {
+  config: OcxConfig;
+  changed: boolean;
+  warnings: string[];
+}
+
+const ACP_ESCAPE_HATCH =
+  'a custom-named row still reaches it, e.g. "devin-acp": { "adapter": "devin-cli", "baseUrl": "https://cli.devin.ai" }';
+
+export function projectDevinCliAuthMode(config: OcxConfig): DevinCliAuthModeProjection {
+  const warnings: string[] = [];
+  const prov = config.providers?.["devin-cli"];
+  if (!prov) return { config, changed: false, warnings };
+
+  const entry = PROVIDER_REGISTRY.find(row => row.id === "devin-cli");
+  if (!entry || entry.authKind !== "oauth") return { config, changed: false, warnings };
+
+  // Non-mutating: the saved adapter no longer decides the transport, so leaving
+  // it in place preserves nothing except a signal worth reporting once.
+  if (prov.adapter === "devin-cli") {
+    warnings.push(
+      'the saved "devin-cli" row names the ACP adapter, but that provider id now streams over '
+      + `Cognition's api-server and the adapter is pinned from the registry; for the CLI's own agent loop, ${ACP_ESCAPE_HATCH}.`,
+    );
+  }
+
+  if (prov.authMode !== "local") return { config, changed: warnings.length > 0 ? false : false, warnings };
+  prov.authMode = "oauth";
+  warnings.push(
+    'rewrote "devin-cli" authMode local -> oauth: the registry no longer classifies it as local, '
+    + "and the management write boundary fails closed on the mismatch.",
+  );
+  return { config, changed: true, warnings };
+}
+

package/src/providers/key-failover.ts

@@ -15,6 +15,10 @@ import type { OcxConfig, OcxProviderConfig, RateLimitRetryPolicy, TransientRetry
 import { OPENCODE_GO_SESSION_HEADER } from "./opencode-go-transport";
 import { resolveProviderTransport, type OcxProviderTransport } from "./xai-transport";
 import { sweepExpiredOnWrite } from "../lib/state-store-sweeper";
+// quota-key-accounts imports only node:crypto, the key store and the quota types -- NOT
+// providers/quota.ts -- so the cached reader reaches the dispatch path without dragging the
+// probe machinery onto it.
+import { cachedApiKeyQuota } from "./quota-key-accounts";
 
 // ---- cooldown state (in-memory, same as codex/routing.ts) ----
 
@@ -100,6 +104,177 @@ export function hasKeyPoolFailover(provider: OcxProviderConfig): boolean {
   return (provider.apiKeyPool?.length ?? 0) >= 2;
 }
 
+/**
+ * Process-local round-robin cursor per provider, deliberately parallel to `keyCooldowns`
+ * rather than borrowing the Codex pool-rotation state: an API key is not an OAuth account
+ * and must not share a quota scope key. Multi-process desync is the same accepted limit
+ * the cooldown map already carries.
+ */
+const keyRotationCursor = new Map<string, string>();
+
+/**
+ * Forget a provider's cursor so an operator's manual key selection is not second-guessed.
+ *
+ * Optional name, mirroring `clearKeyCooldowns`, because the batch provider PUT rewrites the
+ * entire roster: a cursor that survives a reorder still names a real id, so round-robin
+ * resumes after the pre-edit position and can skip the first eligible key in the new pool.
+ */
+export function forgetApiKeyRotationCursor(providerName?: string): void {
+  if (!providerName) {
+    keyRotationCursor.clear();
+    return;
+  }
+  keyRotationCursor.delete(providerName);
+}
+
+/** The pool entry shape is inline on OcxProviderConfig; name it once rather than re-spelling it. */
+type ApiKeyPoolEntry = NonNullable<OcxProviderConfig["apiKeyPool"]>[number];
+
+/**
+ * Remaining headroom for one key, or null when nothing current measures it.
+ *
+ * Same definition as `headroomOf` on the OAuth side, so the two pools cannot disagree about
+ * what "more room" means. `creditsUsd` is deliberately excluded: it is a currency amount, not
+ * a percentage, and ranking one against the other produces an order that means nothing.
+ */
+function keyHeadroom(providerName: string, provider: OcxProviderConfig, entry: ApiKeyPoolEntry): number | null {
+  const quota = cachedApiKeyQuota(providerName, provider, entry.id, entry.key);
+  if (!quota) return null;
+  const percents = [
+    quota.fiveHourPercent,
+    quota.weeklyPercent,
+    quota.monthlyPercent,
+    ...(quota.customWindows ?? []).map((window: { percent?: number }) => window.percent),
+  ].filter((value): value is number => typeof value === "number");
+  if (percents.length === 0) return null;
+  return 100 - Math.max(...percents);
+}
+
+/**
+ * Order eligible keys best-first, in the same three buckets `rankAccountsByHeadroom` uses:
+ * measured-with-headroom, then unmeasured, then measured-and-spent. Ties keep the roster order.
+ *
+ * An unmeasured key is NOT assumed spent, and not assumed fresh either -- it sits between the
+ * two, which is the only honest position for a key nothing has looked at. A provider that
+ * publishes no per-key differentiation (DeepSeek reports every key at the same percent) ties
+ * across the board and falls through to the roster order, which is exactly today's behaviour.
+ */
+function rankKeysByHeadroom(
+  providerName: string,
+  provider: OcxProviderConfig,
+  eligible: readonly ApiKeyPoolEntry[],
+): ApiKeyPoolEntry[] {
+  return eligible
+    .map((entry, index) => {
+      const headroom = keyHeadroom(providerName, provider, entry);
+      const bucket = headroom === null ? 1 : headroom <= 0 ? 2 : 0;
+      return { entry, bucket, headroom: headroom ?? 0, index };
+    })
+    .sort((left, right) => (left.bucket - right.bucket)
+      || (right.headroom - left.headroom)
+      || (left.index - right.index))
+    .map(row => row.entry);
+}
+
+
+/**
+ * Pick a better key BEFORE the first attempt when the committed one is already cooling.
+ *
+ * This is intentionally narrow. It never overrides a healthy key: if the committed
+ * `apiKey` is not in cooldown it returns null, so an operator's manual selection stands
+ * and no config write happens. It only acts when the committed key is known-cooled (or
+ * missing from the pool), which is exactly the case where the first request would
+ * otherwise be spent earning a 429 the runtime could already predict.
+ *
+ * Returning null is the common path, so the persisted-selection transaction is not on
+ * the per-request hot path.
+ *
+ * Like `rotateKeyAfterFailure`, the returned object is a snapshot of the PERSISTED config
+ * and carries none of the registry backfills `routedProviderConfig` merges in at request
+ * time. A request path must not assign it to an active route wholesale -- for a built-in
+ * provider stored in its valid minimal form that would drop the adapter id, the base URL and
+ * the static headers, so `resolveAdapter()` throws `Unknown adapter: undefined` and a
+ * hand-built URL dereferences a missing `baseUrl`. Use
+ * `selectProactiveApiKeyTransport`, the pre-dispatch twin of `rotateProviderTransportOn429`.
+ */
+export function selectProactiveApiKey(
+  config: OcxConfig,
+  providerName: string,
+  now = Date.now(),
+): OcxProviderConfig | null {
+  const provider = config.providers?.[providerName];
+  if (!provider) return null;
+  const strategy = provider.apiKeyPoolStrategy;
+  if (!strategy) return null;
+  if (!hasKeyPoolFailover(provider)) return null;
+  const pool = provider.apiKeyPool ?? [];
+
+  const activeEntry = pool.find(entry => entry.key === provider.apiKey);
+  // A healthy committed key wins, whether the operator chose it or a previous rotation did.
+  if (activeEntry && !isKeyInCooldown(providerName, activeEntry.id, now)) return null;
+
+  const eligible = pool.filter(entry => !isKeyInCooldown(providerName, entry.id, now));
+  if (eligible.length === 0) return null;
+
+  let chosen = eligible[0]!;
+  if (strategy === "round-robin") {
+    const lastId = keyRotationCursor.get(providerName);
+    const lastIndex = lastId ? pool.findIndex(entry => entry.id === lastId) : -1;
+    for (let offset = 1; offset <= pool.length; offset += 1) {
+      const candidate = pool[(lastIndex + offset) % pool.length]!;
+      if (isKeyInCooldown(providerName, candidate.id, now)) continue;
+      chosen = candidate;
+      break;
+    }
+  } else if (strategy === "quota") {
+    // else-if, deliberately. `fill-first` is not a named branch here -- it is the eligible[0]
+    // default above, so replacing that default would silently retarget it.
+    chosen = rankKeysByHeadroom(providerName, provider, eligible)[0] ?? chosen;
+  }
+  if (chosen.key === provider.apiKey) return null;
+
+  const outcome = commitProviderApiKeySelection<string | null>(config, providerName, freshProvider => {
+    const freshPool = freshProvider.apiKeyPool ?? [];
+    const target = freshPool.find(entry => entry.id === chosen.id);
+    if (!target) return { changed: false, value: null };
+    if (freshProvider.apiKey === target.key) return { changed: false, value: null };
+    const freshActive = freshPool.find(entry => entry.key === freshProvider.apiKey);
+    // Re-check under the lock: a concurrent manual selection may have landed a healthy key.
+    if (freshActive && !isKeyInCooldown(providerName, freshActive.id, now)) {
+      return { changed: false, value: null };
+    }
+    freshProvider.apiKey = target.key;
+    return { changed: true, value: target.id };
+  });
+  if (outcome.status !== "committed" || outcome.value === null) return null;
+
+  keyRotationCursor.set(providerName, outcome.value);
+  const committed = structuredClone(outcome.provider);
+  config.providers[providerName] = committed;
+  return structuredClone(committed);
+}
+
+/**
+ * Pre-dispatch twin of `rotateProviderTransportOn429`: pick a warm key, then rebuild the
+ * active route from the committed row through the same seam the 429 path uses, so the
+ * registry backfills survive and only explicit runtime transport state (`fetch` and a
+ * generated OpenCode session header) is carried over from the route being replaced.
+ *
+ * Every request path that assigns the result to a live route must call THIS, not
+ * `selectProactiveApiKey`, which answers with a persisted snapshot.
+ */
+export function selectProactiveApiKeyTransport(
+  config: OcxConfig,
+  providerName: string,
+  routedProvider: OcxProviderTransport,
+  promptCacheKey?: string,
+  now = Date.now(),
+): OcxProviderTransport | null {
+  const committed = selectProactiveApiKey(config, providerName, now);
+  if (!committed) return null;
+  return applyRotatedTransport(providerName, routedProvider, committed, promptCacheKey);
+}
+
 /**
  * Normalize a provider's `retryOn429` policy, or return null when the knob is absent,
  * explicitly disabled, or the provider is not key-auth (OAuth/forward credentials must not be

package/src/providers/model-rename-startup.ts

@@ -1,7 +1,27 @@
 import { mutatePersistedConfig } from "../config";
 import { projectModelRenames } from "./model-rename-migration";
+import { projectStaleContextWindows } from "./stale-context-window-migration";
+import { projectDevinCliAuthMode } from "./devin-cli-authmode-migration";
 import type { OcxConfig } from "../types";
 
+/**
+ * The startup projection: registry model renames, then the context-window
+ * repair. Both fix a saved row the registry can no longer reach on its own —
+ * `enrichProviderFromRegistry` backfills a missing field and never rewrites a
+ * present one — so they share this pass rather than adding a second boot step
+ * with its own persistence, adopt, and failure handling.
+ */
+export function projectStartupConfigRepairs(config: OcxConfig): ReturnType<typeof projectModelRenames> {
+  const renames = projectModelRenames(config);
+  const windows = projectStaleContextWindows(renames.config);
+  const devinCli = projectDevinCliAuthMode(windows.config);
+  return {
+    config: devinCli.config,
+    changed: renames.changed || windows.changed || devinCli.changed,
+    warnings: [...renames.warnings, ...windows.warnings, ...devinCli.warnings],
+  };
+}
+
 export interface ModelRenameStartupDeps {
   project: typeof projectModelRenames;
   /** Injected writer for tests and callers that own their own persistence. */
@@ -59,7 +79,7 @@ function adoptConfig(target: OcxConfig, source: OcxConfig): void {
  */
 export function runModelRenameStartupMigration(
   config: OcxConfig,
-  deps: ModelRenameStartupDeps = { project: projectModelRenames },
+  deps: ModelRenameStartupDeps = { project: projectStartupConfigRepairs },
 ): OcxConfig {
   const projection = deps.project(structuredClone(config));
   if (!projection.changed) {

package/src/providers/qoder-models.ts

@@ -10,7 +10,6 @@ export const QODER_GLOBAL_MODELS = [
   "Kimi-K2.7-Code",
   "GLM-5.3",
   "GLM-5.2",
-  "DeepSeek-V4-Pro",
 ] as const;
 
 /** Live Qoder CN roster captured from the official CLI on 2026-09-03. */

package/src/providers/quota-key-accounts.ts

@@ -29,6 +29,56 @@ export function clearProviderApiKeyQuotaCache(): void {
   flights.clear();
 }
 
+/**
+ * Cached-only, synchronous per-key quota. Never probes, never awaits, never schedules a read.
+ *
+ * The selector that calls this sits on the first-attempt path, where a network read would be a
+ * worse defect than the one it is there to fix. A miss is simply "no evidence".
+ *
+ * An `unavailable` row is a miss too, and that is the whole point of the check. `readEntry`
+ * keeps a last-good quota attached for up to LAST_GOOD_MS after a probe starts failing, so
+ * returning `entry.quota` on any hit would rank on a number up to half an hour stale -- and
+ * rank it ABOVE a key with no row at all. Last-good is a display value, not a selection input.
+ *
+ * A SUCCESSFUL row expires too, on exactly `readEntry`'s freshness predicate. Checking only
+ * `unavailable` was not enough: nothing on the selection path probes or sweeps, so once a
+ * dashboard or CLI read had populated the cache, a row could outlive ACCOUNT_QUOTA_TTL_MS and
+ * keep a "roomy" ten-minute-old measurement ranked above a key with no evidence at all --
+ * until some unrelated write happened to sweep it. Expired is no evidence, same as absent.
+ */
+export function cachedApiKeyQuota(
+  name: string,
+  provider: OcxProviderConfig,
+  keyId: string,
+  key: string,
+): ProviderQuota | null {
+  let resolved: string | undefined;
+  // resolveProviderApiKey swallows its own failures; the catch is belt-and-braces because this
+  // runs on the dispatch path and must not throw there under any future change.
+  try { resolved = resolveProviderApiKey(key)?.trim(); } catch { return null; }
+  if (!resolved) return null;
+  const entry = cache.get(identity(name, provider, keyId, resolved));
+  if (!entry || entry.unavailable || !entry.quota) return null;
+  const now = Date.now();
+  if (now - entry.ts >= ACCOUNT_QUOTA_TTL_MS) return null;
+  if (now - entry.quota.updatedAt >= LAST_GOOD_MS) return null;
+  return entry.quota;
+}
+
+/** Test seam: keyed on identity(), so it takes the raw key rather than an account id. */
+export function setCachedProviderApiKeyQuotaForTests(
+  name: string,
+  provider: OcxProviderConfig,
+  keyId: string,
+  key: string,
+  quota: ProviderQuota | null,
+  unavailable?: true,
+): void {
+  const resolved = resolveProviderApiKey(key)?.trim();
+  if (!resolved) return;
+  remember(identity(name, provider, keyId, resolved), { ts: Date.now(), quota, ...(unavailable ? { unavailable } : {}) });
+}
+
 /** Four workers per roster, not a process-wide network limit. */
 export async function mapQuotaRoster<T, R>(rows: readonly T[], read: (row: T) => Promise<R>): Promise<R[]> {
   const out = new Array<R>(rows.length);

package/src/providers/quota-routing-cache.ts

@@ -1,32 +1,91 @@
+import { createHash } from "node:crypto";
+import type { OcxProviderConfig } from "../types";
 import type { ProviderQuota, ProviderQuotaReport } from "./quota";
+import { providerUsesKeyAuthOverride, resolveProviderApiKey } from "./key-store";
+import { getProviderRegistryEntry } from "./registry";
+import { PROVIDER_QUOTA_MAX_AGE_MS } from "./quota-types";
 
-const quotaCache = new Map<string, ProviderQuota>();
+export interface ProviderQuotaRoutingEvidence {
+  quota: ProviderQuota;
+  binding: string;
+}
+
+type CachedQuota = {
+  quota: ProviderQuota;
+  routing?: ProviderQuotaRoutingEvidence | { quota: ProviderQuota; testOnly: true };
+};
+
+const quotaCache = new Map<string, CachedQuota>();
+
+/** Private cache identity; neither key material nor this digest enters management reports. */
+export function providerQuotaRoutingBinding(
+  name: string,
+  provider: OcxProviderConfig,
+  credential = resolveProviderApiKey(provider.apiKey)?.trim(),
+): string | null {
+  if ((provider.authMode ?? "key") !== "key" || !credential) return null;
+  // Registry-owned OAuth/forward rows normalize saved authMode before dispatch.
+  // A key probe must not constrain that later account selection.
+  const entry = getProviderRegistryEntry(name);
+  if (entry && (entry.authKind === "oauth" || entry.authKind === "forward")
+    && !providerUsesKeyAuthOverride(entry, provider, credential)) return null;
+  // Static auth headers can replace or combine with the probed API-key header.
+  // Its semantics belong to the adapter, so it is not provider-wide quota evidence.
+  if (Object.keys(provider.headers ?? {}).some(header =>
+    ["authorization", "x-api-key", "x-goog-api-key"].includes(header.toLowerCase()))) return null;
+  return createHash("sha256").update(JSON.stringify([
+    name, provider.adapter, provider.baseUrl, credential,
+  ])).digest("hex");
+}
 
 export function clearCachedProviderQuotas(): void {
   quotaCache.clear();
 }
 
-export function replaceCachedProviderQuotas(reports: ProviderQuotaReport[]): void {
+export function replaceCachedProviderQuotas(
+  reports: ProviderQuotaReport[],
+  routingEvidence?: WeakMap<ProviderQuotaReport, ProviderQuotaRoutingEvidence>,
+): void {
   quotaCache.clear();
   for (const report of reports) {
-    quotaCache.set(report.provider, report.quota);
+    quotaCache.set(report.provider, { quota: report.quota, routing: routingEvidence?.get(report) });
   }
 }
 
 export function getCachedProviderQuota(
   provider: string,
   now: number,
-  maxAgeMs = 30 * 60_000,
+  maxAgeMs = PROVIDER_QUOTA_MAX_AGE_MS,
 ): ProviderQuota | null {
-  const quota = quotaCache.get(provider);
+  const quota = quotaCache.get(provider)?.quota;
   if (!quota) return null;
   if (now - quota.updatedAt > maxAgeMs) return null;
   return quota;
 }
 
+/** Only inference-wide evidence for this sole credential may rank or veto a whole provider. */
+export function getCachedProviderRoutingQuota(
+  name: string,
+  provider: OcxProviderConfig | undefined,
+  now: number,
+  maxAgeMs = PROVIDER_QUOTA_MAX_AGE_MS,
+): ProviderQuota | null {
+  if (!provider || provider.disabled === true || (provider.authMode ?? "key") !== "key") return null;
+  // An active-key report cannot speak for the other keys the dispatcher may select.
+  if ((provider.apiKeyPool?.length ?? 0) > 1) return null;
+  const routing = quotaCache.get(name)?.routing;
+  if (!routing || !Number.isFinite(routing.quota.updatedAt) || routing.quota.updatedAt < 0
+    || routing.quota.updatedAt > now || now - routing.quota.updatedAt >= maxAgeMs) return null;
+  const binding = providerQuotaRoutingBinding(name, provider);
+  if (!binding || (!("testOnly" in routing) && routing.binding !== binding)) return null;
+  return routing.quota;
+}
+
 export function setCachedProviderQuotaForTests(
   provider: string,
   quota: ProviderQuota,
 ): void {
-  quotaCache.set(provider, quota);
+  // Unit tests deliberately assert the supplied quota's scope. Production publication
+  // requires the producer's private, credential-bound evidence map above.
+  quotaCache.set(provider, { quota, routing: { quota, testOnly: true } });
 }

package/src/providers/quota-types.ts

@@ -8,6 +8,13 @@
  * blocks any later attempt to load one side without the other.
  */
 
+export const PROVIDER_QUOTA_MAX_AGE_MS = 30 * 60_000;
+
+/** Management-only eligibility evidence; private credential binding never leaves the server. */
+export type ProviderRoutingQuota =
+  | { state: "unknown" }
+  | { state: "available" | "exhausted"; updatedAt: number; validUntil: number };
+
 export interface ProviderQuotaWindow {
   label: string;
   percent: number;