@bitkyc08/opencodex 2.57.0 → 2.59.0

package/src/providers/codex-capacity.ts

@@ -36,6 +36,15 @@ export const CODEX_CAPACITY_MAX_QUOTA_AGE_MS = 30 * 60_000;
 export type CodexCapacityQuota = {
   fiveHourPercent?: number;
   fiveHourResetAt?: number;
+  /**
+   * Local observation time for the burst-window percentage.
+   *
+   * Carried because the terminal-short-window rule needs it whenever the reading has no reset
+   * instant, and the dashboard's account-switch warning evaluates that rule against this DTO.
+   * Dropping it here made the warning return "no opinion" for a snapshot routing was already
+   * refusing on (#5045).
+   */
+  shortObservedAt?: number;
   weeklyPercent?: number;
   weeklyResetAt?: number;
   monthlyPercent?: number;

package/src/providers/derive.ts

@@ -266,6 +266,9 @@ export function providerConfigSeed(entry: ProviderRegistryEntry): OcxProviderCon
     ...(entry.requiresAdjacentResponsesToolResults !== undefined
       ? { requiresAdjacentResponsesToolResults: entry.requiresAdjacentResponsesToolResults }
       : {}),
+    ...(entry.requiresPairedResponsesToolResults !== undefined
+      ? { requiresPairedResponsesToolResults: entry.requiresPairedResponsesToolResults }
+      : {}),
     ...(entry.annotateEmptyToolOutputs !== undefined
       ? { annotateEmptyToolOutputs: entry.annotateEmptyToolOutputs }
       : {}),
@@ -541,6 +544,9 @@ export function enrichProviderFromRegistry(name: string, prov: OcxProviderConfig
   if (prov.requiresAdjacentResponsesToolResults === undefined && seed.requiresAdjacentResponsesToolResults !== undefined) {
     prov.requiresAdjacentResponsesToolResults = seed.requiresAdjacentResponsesToolResults;
   }
+  if (prov.requiresPairedResponsesToolResults === undefined && seed.requiresPairedResponsesToolResults !== undefined) {
+    prov.requiresPairedResponsesToolResults = seed.requiresPairedResponsesToolResults;
+  }
   if (prov.annotateEmptyToolOutputs === undefined && seed.annotateEmptyToolOutputs !== undefined) {
     prov.annotateEmptyToolOutputs = seed.annotateEmptyToolOutputs;
   }

package/src/providers/devin-provider-merge-migration.ts

@@ -195,33 +195,54 @@ const DEFAULT_DEPS: DevinProviderMergeStartupDeps = {
  * the snapshot is taken strictly before the save, and a backup failure throws
  * rather than writing without a rollback point.
  *
- * The auth half is deliberately detached. `startServer` is synchronous — an
- * `await` in the boot window would suspend the composition root — and
+ * Both destination slots are inspected before either account-bound file is
+ * changed. The auth write itself is deliberately detached. `startServer` is
+ * synchronous — an `await` in the boot window would suspend the composition root — and
  * `mutateStore` is async-only, so the rekey is fired after its snapshot and
- * its outcome is logged when it lands. That is safe here: the credential is
- * valid under either slot name while the `devin-cli` alias exists, a conflict
- * refuses by design, and a failed rekey simply retries on the next boot.
+ * its outcome is logged when it lands. A late concurrent conflict refuses by
+ * design, and a failed rekey simply retries on the next boot.
  */
 export function runDevinProviderMergeStartupMigration(
   config: OcxConfig,
   deps: DevinProviderMergeStartupDeps = DEFAULT_DEPS,
 ): OcxConfig {
   const projection = deps.project(config);
-  // Warnings are emitted even on a no-op: the collision case IS the warning.
+  const hasSourceConfig = config.providers?.[FROM_ID] !== undefined;
+  const hasSourceAuth = deps.hasAuthSlot(FROM_ID);
+  const hasDestinationAuth = deps.hasAuthSlot(TO_ID);
+
+  // A configured provider and its credentials are one account-bound unit. Do
+  // not move either half if the config projection refused, or if the target
+  // credential slot could belong to another account.
+  if (hasSourceConfig && (!projection.changed || hasDestinationAuth)) {
+    // Projection warnings still matter on a no-op: a config collision is the warning.
+    for (const warning of projection.warnings) console.warn(`[devin-provider-merge] ${warning}`);
+    if (projection.changed && hasDestinationAuth) {
+      console.warn(
+        `[devin-provider-merge] auth.json already has a "${TO_ID}" credential slot; `
+        + `provider "${FROM_ID}" and both credential slots were left untouched. Remove the `
+        + "unused destination credential manually, then restart.",
+      );
+    }
+    return config;
+  }
+
   for (const warning of projection.warnings) console.warn(`[devin-provider-merge] ${warning}`);
+
   let result = config;
   if (projection.changed) {
+    // Snapshot both account-bound files before changing either one.
+    if (hasSourceAuth) deps.backupAuth();
     deps.backupConfig();
     deps.save(projection.config);
     result = projection.config;
   }
 
-  // The auth rekey runs even when the config half refused or had nothing to
-  // do: a `devin-cli` credential slot is orphaned state regardless of whether
-  // a provider row still points at it, and the conflict check inside the
-  // rekey is the same refuse-on-occupied rule the config half applies.
-  if (!deps.hasAuthSlot(FROM_ID)) return result;
-  deps.backupAuth();
+  // With no legacy config row, a `devin-cli` credential slot is orphaned and
+  // can still be rekeyed under the helper's refuse-on-occupied rule. A refused
+  // config migration returned above so its account-bound slot stays put.
+  if (!hasSourceAuth) return result;
+  if (!projection.changed) deps.backupAuth();
   void deps.rekey(FROM_ID, TO_ID).then(outcome => {
     if (outcome === "conflict") {
       console.warn(

package/src/providers/free-directory.ts

@@ -1,3 +1,5 @@
+import { getProviderRegistryEntry } from "./registry";
+
 export type ProviderAccessGroup =
   | "recurring-or-keyless"
   | "recurring-uncapped"
@@ -18,7 +20,7 @@ export const FREE_PROVIDER_ACCESS_GROUPS = {
   ],
   "recurring-credit": ["bytez", "nous-research"],
   "signup-credit": [
-    "agentrouter", "ai21", "baichuan", "baseten", "deepinfra", "deepseek", "doubao", "fireworks", "freemodel-dev", "glm-cn",
+    "agentrouter", "ai21", "baichuan", "baseten", "crusoe", "deepinfra", "deepseek", "doubao", "fireworks", "freemodel-dev", "glm-cn",
     "hyperbolic", "longcat", "monsterapi", "nebius", "novita", "nscale", "nvidia", "predibase", "publicai", "qoder", "qoder-cn",
     "scaleway", "sensenova", "stepfun", "together", "vertex",
   ],
@@ -72,6 +74,21 @@ const openAi = (baseUrl: string, dashboardUrl: string, extra: Partial<Connectabl
   ...extra,
 });
 
+function registryLiveKeyProvider(id: string): ConnectableOverride {
+  const entry = getProviderRegistryEntry(id);
+  if (!entry || entry.authKind !== "key" || !entry.dashboardUrl || entry.liveModels !== true) {
+    throw new TypeError(`Free directory registry projection requires a live key provider with a dashboard: ${id}`);
+  }
+  return {
+    baseUrl: entry.baseUrl,
+    dashboardUrl: entry.dashboardUrl,
+    adapter: entry.adapter,
+    authKind: "key",
+    discovery: "live",
+    liveModels: true,
+  };
+}
+
 // API roots are limited to documented or primary-source integrations. Consumer-web/session
 // providers remain reference-only: this directory never asks users to paste cookies or bypass WAFs.
 const CONNECTABLE: Record<string, ConnectableOverride> = {
@@ -127,6 +144,7 @@ const CONNECTABLE: Record<string, ConnectableOverride> = {
   // Verified end-to-end 2026-07-30: /v1/models returns the OpenAI-shaped live catalog (13 models),
   // and a chat completion against moonshotai/Kimi-K3 returned a standard chat.completion payload.
   baseten: openAi("https://inference.baseten.co/v1", "https://app.baseten.co/settings/api_keys", { supportLevel: "supported", verification: "official", documentationUrl: "https://docs.baseten.co/inference/model-apis/overview", modelsUrl: "https://inference.baseten.co/v1/models", lastVerified: "2026-07-30" }),
+  crusoe: { ...registryLiveKeyProvider("crusoe"), supportLevel: "supported", verification: "official", documentationUrl: "https://docs.crusoecloud.com/quickstart/getting-started-with-serverless-inference", modelsUrl: "https://api.inference.crusoecloud.com/v1/models", lastVerified: "2026-09-11" },
   deepinfra: openAi("https://api.deepinfra.com/v1/openai", "https://deepinfra.com/dash/api_keys", { supportLevel: "supported", verification: "official", documentationUrl: "https://deepinfra.com/docs/openai_api" }),
   deepseek: openAi("https://api.deepseek.com", "https://platform.deepseek.com/api_keys", { supportLevel: "supported", verification: "official", documentationUrl: "https://api-docs.deepseek.com/api/list-models" }),
   doubao: openAi("https://ark.cn-beijing.volces.com/api/v3", "https://console.volcengine.com/ark/region:ark+cn-beijing/apiKey", { verification: "official" }),
@@ -181,7 +199,7 @@ const LABELS: Record<string, string> = {
   "t3-web": "T3 Web", uncloseai: "UncloseAI", ainative: "AI Native", baidu: "Baidu Qianfan",
   glm: "Z.AI GLM", "glm-cn": "BigModel GLM (CN)", "kilo-gateway": "Kilo Gateway", "opencode-zen": "OpenCode Zen",
   sealion: "SEA-LION", bytez: "Bytez", "nous-research": "Nous Research", agentrouter: "AgentRouter",
-  ai21: "AI21", baichuan: "Baichuan", deepinfra: "DeepInfra", deepseek: "DeepSeek", doubao: "Doubao",
+  ai21: "AI21", baichuan: "Baichuan", crusoe: "Crusoe", deepinfra: "DeepInfra", deepseek: "DeepSeek", doubao: "Doubao",
   "freemodel-dev": "FreeModel.dev", sambanova: "SambaNova Cloud", nebius: "Nebius Token Factory",
   novita: "Novita", nscale: "Nscale", nvidia: "NVIDIA NIM",
   publicai: "PublicAI", qoder: "Qoder", "qoder-cn": "Qoder CN", sensenova: "SenseNova", stepfun: "StepFun", vertex: "Google Vertex AI",

package/src/providers/key-failover.ts

@@ -29,6 +29,243 @@ interface KeyCooldown {
 const DEFAULT_COOLDOWN_MS = 60_000;
 const MAX_COOLDOWN_MS = 10 * 60_000; // cap at 10 min for api-key rotation
 
+/**
+ * Cap for a cooldown the upstream itself dated, as opposed to one we inferred.
+ *
+ * `MAX_COOLDOWN_MS` is deliberately short because an undated 429 is a guess: ten
+ * minutes bounds how long a transient limit can park a working key. A free-tier
+ * quota is not a guess — OpenRouter replies `Weekly/Monthly Limit Exhausted ...
+ * will reset at <date>`, and until that date the key cannot serve anything. Held
+ * for ten minutes instead, it comes back, takes a 429, and rotates again, every
+ * ten minutes for the rest of the week (#4024).
+ *
+ * 32 days rather than unbounded. The wording this parses is
+ * `Weekly/Monthly Limit Exhausted`, so the cap has to clear a monthly window —
+ * 31 days plus a day of slack for timezone and month length. An earlier 8-day
+ * cap looked generous against the weekly case in the issue and silently clamped
+ * every monthly reset to ~23 days early, which puts the key back into exactly
+ * the 429 loop this exists to stop. Caught by the cap's own test.
+ *
+ * Bounded at all because the date is upstream-controlled input: a malformed or
+ * hostile `reset at 2999-01-01` must not park a working key past any horizon an
+ * operator would think to look at.
+ */
+const MAX_QUOTA_COOLDOWN_MS = 32 * 24 * 60 * 60_000;
+const QUOTA_RESET_PEEK_TIMEOUT_MS = 250;
+
+interface QuotaResetReadOptions {
+  now?: number;
+  signal?: AbortSignal;
+  timeoutMs?: number;
+}
+
+function rebuiltResponse(response: Response, body: ReadableStream<Uint8Array>): Response {
+  return new Response(body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers: response.headers,
+  });
+}
+
+function replayOnlyResponse(response: Response, chunks: readonly Uint8Array[]): Response {
+  return rebuiltResponse(response, new ReadableStream<Uint8Array>({
+    start(controller) {
+      for (const chunk of chunks) controller.enqueue(chunk);
+      controller.close();
+    },
+  }));
+}
+
+/**
+ * Read a bounded prefix of a 429 body and pull the upstream's declared reset instant.
+ *
+ * The returned response replays the bounded prefix and any boundary-chunk overflow
+ * before streaming the unread remainder. A rotation storm must not be gated on
+ * reading N full error payloads. Any failure — no body, already consumed, slow,
+ * malformed — returns undefined and leaves the `Retry-After` path in charge.
+ */
+export async function readQuotaResetAt(
+  response: Response,
+  nowOrOptions: number | QuotaResetReadOptions = {},
+): Promise<{ at: number | undefined; response: Response }> {
+  if (!response.body) return { at: undefined, response };
+  const options = typeof nowOrOptions === "number" ? { now: nowOrOptions } : nowOrOptions;
+  const now = options.now ?? Date.now();
+  let reader: ReadableStreamDefaultReader<Uint8Array>;
+  try {
+    reader = response.body.getReader();
+  } catch {
+    return { at: undefined, response };
+  }
+  const chunks: Uint8Array[] = [];
+  let transferred = false;
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  const deadline = new AbortController();
+  const timeoutReason = new DOMException("Quota reset body peek timed out", "TimeoutError");
+  try {
+    const decoder = new TextDecoder();
+    let seen = 0;
+    let text = "";
+    timer = setTimeout(() => deadline.abort(timeoutReason), options.timeoutMs ?? QUOTA_RESET_PEEK_TIMEOUT_MS);
+    const signal = options.signal
+      ? AbortSignal.any([options.signal, deadline.signal])
+      : deadline.signal;
+    while (seen < QUOTA_RESET_SCAN_BYTES) {
+      const read = reader.read();
+      let rejectAbort: ((reason: unknown) => void) | undefined;
+      const onAbort = () => rejectAbort?.(signal.reason);
+      const aborted = new Promise<never>((_resolve, reject) => {
+        rejectAbort = reject;
+        if (signal.aborted) reject(signal.reason);
+        else signal.addEventListener("abort", onAbort, { once: true });
+      });
+      // Derived from the reader rather than named directly: Bun's lib types
+      // `ReadableStreamDefaultReader.read()` as returning
+      // `ReadableStreamDefaultReadResult`, which is not assignable to the
+      // `ReadableStreamReadResult` alias.
+      let result: Awaited<ReturnType<typeof reader.read>>;
+      try {
+        result = await Promise.race([read, aborted]);
+      } finally {
+        signal.removeEventListener("abort", onAbort);
+      }
+      const { done, value } = result;
+      if (done) break;
+      const remaining = QUOTA_RESET_SCAN_BYTES - seen;
+      const prefix = value.byteLength > remaining ? value.subarray(0, remaining) : value;
+      const overflow = value.byteLength > remaining ? value.subarray(remaining) : undefined;
+      chunks.push(prefix);
+      if (overflow?.byteLength) chunks.push(overflow);
+      seen += prefix.byteLength;
+      text += decoder.decode(prefix, { stream: true });
+    }
+    // Hand back a Response carrying the bytes already pulled followed by whatever
+    // is left, so the caller can still read or cancel it. `response.clone()` is
+    // NOT usable here: it tees, and with the original branch undrained the tee
+    // stalls once its buffer fills — a 5MB error body hangs the rotation path,
+    // which is worse than the unbounded read this replaced.
+    const rest = new ReadableStream<Uint8Array>({
+      start(controller) {
+        for (const c of chunks) controller.enqueue(c);
+      },
+      async pull(controller) {
+        try {
+          const { done, value } = await reader.read();
+          if (done) {
+            controller.close();
+            reader.releaseLock();
+            return;
+          }
+          controller.enqueue(value);
+        } catch (error) {
+          controller.error(error);
+          reader.releaseLock();
+        }
+      },
+      async cancel(reason) {
+        try {
+          await reader.cancel(reason);
+        } finally {
+          reader.releaseLock();
+        }
+      },
+    });
+    transferred = true;
+    return { at: parseQuotaResetAt(text, now), response: rebuiltResponse(response, rest) };
+  } catch (error) {
+    const clientAborted = options.signal?.aborted === true;
+    void reader.cancel(error).catch(() => {}).finally(() => {
+      try { reader.releaseLock(); } catch { /* already released */ }
+    });
+    if (clientAborted) throw options.signal!.reason ?? error;
+    return { at: undefined, response: replayOnlyResponse(response, chunks) };
+  } finally {
+    if (timer !== undefined) clearTimeout(timer);
+    if (!transferred) {
+      try { reader.releaseLock(); } catch { /* already released */ }
+    }
+  }
+}
+
+/**
+ * How much of a 429 body is read and scanned for the reset instant.
+ *
+ * Bounds the READ, not just the parse: this runs on the rotation path, once per
+ * rotated key under a rate-limit storm, and the body is upstream-controlled.
+ * OpenRouter's rate_limit_error JSON is a few hundred bytes.
+ */
+const QUOTA_RESET_SCAN_BYTES = 4_096;
+
+/**
+ * Reset instant an upstream declared in a 429 *body*, in epoch ms.
+ *
+ * Only the body carries this: OpenRouter sends no `Retry-After` for a quota
+ * exhaustion, so the header path (`parseRetryAfterMs`) sees nothing and falls
+ * back to `DEFAULT_COOLDOWN_MS`. Returns undefined for anything it cannot read
+ * as a date, so an unparsable body keeps today's behaviour exactly.
+ */
+/**
+ * Whether `YYYY-MM-DD…` names a day that exists.
+ *
+ * `Date.parse` does NOT reject an out-of-range day: measured on Bun,
+ * `2026-02-30T00:00:00Z` yields March 2 and `2026-04-31T00:00:00Z` yields
+ * May 1, so a malformed upstream body would park a key past the instant it
+ * actually named. Only the month is rejected outright (`2026-13-01` is NaN).
+ *
+ * Checked on the date text alone rather than by round-tripping the parsed
+ * instant, because a value carrying an explicit offset (`…T23:00+05:30`)
+ * legitimately lands on a different UTC day than the one written.
+ */
+function isRealCalendarDate(value: string): boolean {
+  const [year, month, day] = value.slice(0, 10).split("-").map(Number);
+  if (month < 1 || month > 12 || day < 1) return false;
+  const leap = (year % 4 === 0 && year % 100 !== 0) || year % 400 === 0;
+  const lengths = [31, leap ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
+  return day <= lengths[month - 1]!;
+}
+
+export function parseQuotaResetAt(body: string | null | undefined, now = Date.now()): number | undefined {
+  const text = body?.slice(0, QUOTA_RESET_SCAN_BYTES);
+  if (!text) return undefined;
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    return undefined;
+  }
+  if (!parsed || typeof parsed !== "object") return undefined;
+  const error = (parsed as { error?: unknown }).error;
+  if (!error || typeof error !== "object") return undefined;
+  const code = (error as { code?: unknown }).code;
+  const message = (error as { message?: unknown }).message;
+  if ((code !== "rate_limit_error" && code !== 429) || typeof message !== "string") return undefined;
+  if (!/^(?:Weekly|Monthly) Limit Exhausted\b/i.test(message.trim())) return undefined;
+  // `will reset at 2026-09-09 03:30:06` / `... at 2026-09-09T03:30:06Z` / `resets at <date>`
+  const match = /reset[s]?\s+at\s+([0-9]{4}-[0-9]{2}-[0-9]{2}(?:[T ][0-9]{2}:[0-9]{2}(?::[0-9]{2})?(?:\.[0-9]+)?(?:Z|[+-][0-9]{2}:?[0-9]{2})?)?)/i.exec(message);
+  if (!match) return undefined;
+  // Pin a bare `YYYY-MM-DD hh:mm:ss` to UTC explicitly.
+  //
+  // ECMA-262 says a date-TIME form with no offset is LOCAL time, and Node follows
+  // that: `Date.parse("2026-09-09 03:30:06")` differs from the UTC reading by the
+  // host offset (7h on a PDT box, measured). Bun currently returns the UTC value
+  // for the same string, so on this runtime the normalisation is a no-op today —
+  // which is exactly why it is written out rather than relied upon. If Bun ever
+  // conforms, an un-normalised parse would silently shift every park-until by the
+  // operator's offset, and the early direction resumes the 429 loop.
+  //
+  // A consequence worth knowing: no Bun test can observe this branch being
+  // removed. The explicit-zone case below is the part the suite can pin.
+  const raw = match[1].includes("T") || /(?:Z|[+-][0-9]{2}:?[0-9]{2})$/.test(match[1])
+    ? match[1]
+    : `${match[1].replace(" ", "T")}Z`;
+  if (!isRealCalendarDate(match[1])) return undefined;
+  const at = Date.parse(raw);
+  if (!Number.isFinite(at)) return undefined;
+  // Already past, or beyond the cap: not usable as a park-until instant.
+  if (at <= now) return undefined;
+  return Math.min(at, now + MAX_QUOTA_COOLDOWN_MS);
+}
+
 /**
  * Default same-target 429 retry policy used when a provider opts in via a bare
  * `retryOn429: {}` (presence = opt-in with these defaults).
@@ -303,11 +540,11 @@ export function rateLimitRetryPolicyFor(
 
 /**
  * Normalize a provider's `transientRetryOn5xx` policy, or return null when it is absent,
- * explicitly disabled, not key-auth, or not the `openai-chat` adapter.
+ * explicitly disabled, not key-auth, or not an adapter this policy governs.
  *
- * The adapter gate is part of the accepted scope, not incidental: this first version covers
- * key-auth `openai-chat` only, and without an explicit check any generic key-auth adapter
- * could opt in. Auth mode follows the same fail-closed rule as `rateLimitRetryPolicyFor` —
+ * The adapter gate is part of the accepted scope, not incidental: it names the adapters whose
+ * lanes actually read this policy, so no generic key-auth adapter can opt in by accident.
+ * Auth mode follows the same fail-closed rule as `rateLimitRetryPolicyFor` —
  * explicit `key` or the documented omitted default, never OAuth, forward, local, or an
  * unknown value.
  */
@@ -316,7 +553,14 @@ export function transientRetryPolicyFor(
 ): Required<TransientRetryPolicy> | null {
   const policy = provider.transientRetryOn5xx;
   if (!policy || policy.enabled === false) return null;
-  if (provider.adapter !== "openai-chat") return null;
+  // Both adapters this policy governs. The first version covered chat only, which left a
+  // key-auth Responses provider unable to tune its ladder in either direction, because the
+  // Responses passthrough lane hard-coded TRANSIENT_RETRY_MAX_ATTEMPTS (#4893). Widening this
+  // gate is necessary and not sufficient: the lane also has to call this function, which it
+  // now does. Still an explicit list, so no generic key-auth adapter opts in by accident, and
+  // the auth check below keeps the ChatGPT forward pool out -- those providers are
+  // `authMode: "forward"` and keep the default ladder they have always had.
+  if (provider.adapter !== "openai-chat" && provider.adapter !== "openai-responses") return null;
   if (provider.authMode !== undefined && provider.authMode !== "key") return null;
   return {
     enabled: policy.enabled ?? DEFAULT_TRANSIENT_RETRY.enabled,
@@ -363,6 +607,7 @@ function rotateKeyAfterFailure(
   now = Date.now(),
   attemptedKey?: string,
   attemptedSelection?: ProviderApiKeySelection,
+  quotaResetAt?: number,
 ): OcxProviderConfig | null {
   const provider = config.providers[providerName];
   if (!provider) return null;
@@ -421,7 +666,12 @@ function rotateKeyAfterFailure(
     // full cap instead of the 429 default so a dead key is not re-tried once a minute.
     const cooldownMs = failureStatus === 401
       ? MAX_COOLDOWN_MS
-      : parseRetryAfterMs(retryAfterHeader, now) ?? DEFAULT_COOLDOWN_MS;
+      // A reset instant the upstream dated outranks both the header and the
+      // default: it is the only one of the three that knows when the quota
+      // actually returns (#4024).
+      : quotaResetAt !== undefined
+        ? Math.max(quotaResetAt - now, 1)
+        : parseRetryAfterMs(retryAfterHeader, now) ?? DEFAULT_COOLDOWN_MS;
     keyCooldowns.set(cooldownKey(providerName, outcome.value.failedId), { cooldownUntil: now + cooldownMs });
     sweepExpiredOnWrite(now);
   }
@@ -448,8 +698,9 @@ export function rotateKeyOn429(
   now = Date.now(),
   attemptedKey?: string,
   attemptedSelection?: ProviderApiKeySelection,
+  quotaResetAt?: number,
 ): OcxProviderConfig | null {
-  return rotateKeyAfterFailure(config, providerName, 429, retryAfterHeader, now, attemptedKey, attemptedSelection);
+  return rotateKeyAfterFailure(config, providerName, 429, retryAfterHeader, now, attemptedKey, attemptedSelection, quotaResetAt);
 }
 
 /**
@@ -482,6 +733,8 @@ export function sweepExpiredApiKeyCooldowns(now = Date.now()): number {
 
 interface RotateProviderTransportOptions {
   retryAfter?: string | null;
+  /** Epoch ms from `parseQuotaResetAt`, when the upstream dated the reset in its body. */
+  quotaResetAt?: number;
   now?: number;
   attemptedKey?: string;
   attemptedSelection?: ProviderApiKeySelection;
@@ -507,6 +760,7 @@ export function rotateProviderTransportOn429(
     options.now,
     options.attemptedKey,
     options.attemptedSelection ?? routedProvider._apiKeyAttempt,
+    options.quotaResetAt,
   );
   if (!rotated) return null;
   return applyRotatedTransport(providerName, routedProvider, rotated, options.promptCacheKey);

package/src/providers/model-discovery.ts

@@ -129,6 +129,14 @@ export function providerModelDiscoverySpecError(spec: ProviderModelDiscoverySpec
   if (queryEntries.some(([key, value]) => !key.trim() || key.length > 128 || typeof value !== "string" || value.length > 512)) {
     return "discovery query keys/values exceed their bounds";
   }
+  for (const [field, value] of [
+    ["envelopeKey", spec.envelopeKey],
+    ["idField", spec.idField],
+  ] as const) {
+    if (value !== undefined && (
+      typeof value !== "string" || !value || value !== value.trim() || value.length > 128
+    )) return `${field} must be a nonblank field name up to 128 characters`;
+  }
   for (const [field, value, hardLimit] of [
     ["maxResponseBytes", spec.maxResponseBytes, MODEL_DISCOVERY_MAX_RESPONSE_BYTES],
     ["maxModels", spec.maxModels, MODEL_DISCOVERY_MAX_MODELS],
@@ -422,7 +430,7 @@ export function extractModelEnvelopeRows(
   return { ok: true, rows };
 }
 
-/** Validate, bound, deduplicate, and declaratively filter OpenAI `{data:[...]}` or top-level arrays (Together `#617`). */
+/** Validate, bound, deduplicate, and filter the declared envelope or a top-level array (Together `#617`). */
 /**
  * Metadata a sibling `models[]` array may contribute to an ALREADY-ADMITTED
  * `data[]` row (#1797).
@@ -501,24 +509,26 @@ export function extractProviderModelItems(
   let data: unknown[];
   let siblings: SiblingIndex | null = null;
   if (Array.isArray(value)) {
-    // Together-style top-level /models arrays. Catalog discovery must not treat a stray
-    // `models` key on openai-chat responses as valid — only `data` envelopes or top-level arrays.
+    // Together-style top-level /models arrays. The default contract must not treat a stray
+    // `models` key on openai-chat responses as valid; only a provider spec may opt into it.
     if (value.length > limit) return { ok: false, reason: "too_many_models" };
     data = value;
   } else {
-    const envelope = extractModelEnvelopeRows(value, discovery.maxModels, ["data"]);
+    const envelopeKey = discovery.spec?.envelopeKey ?? "data";
+    const envelope = extractModelEnvelopeRows(value, discovery.maxModels, [envelopeKey]);
     if (!envelope.ok) return envelope;
     data = envelope.rows;
-    siblings = buildSiblingIndex(value, limit);
+    siblings = envelopeKey === "data" ? buildSiblingIndex(value, limit) : null;
   }
 
   const items: ProviderModelsApiItem[] = [];
   const seen = new Set<string>();
+  const idField = discovery.spec?.idField ?? "id";
   for (const raw of data) {
     if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
       return { ok: false, reason: "invalid_shape" };
     }
-    const id = (raw as { id?: unknown }).id;
+    const id = (raw as Record<string, unknown>)[idField];
     if (!isValidModelDiscoveryModelId(id)) return { ok: false, reason: "invalid_shape" };
     const prefix = discovery.spec?.stripIdPrefix;
     let finalId = id;
@@ -526,7 +536,9 @@ export function extractProviderModelItems(
       finalId = finalId.slice(prefix.length);
       if (!isValidModelDiscoveryModelId(finalId)) continue;
     }
-    const item = finalId === id ? raw as ProviderModelsApiItem : { ...(raw as ProviderModelsApiItem), id: finalId };
+    const item = finalId === id && idField === "id"
+      ? raw as ProviderModelsApiItem
+      : { ...(raw as Record<string, unknown>), id: finalId };
     // Admission is decided on the ORIGINAL `data[]` row, before any sibling
     // enrichment. Merging first let a `models[]` entry supply the very field a
     // provider filter requires — reproduced against the real Chutes policy,

package/src/providers/model-rename-migration.ts

@@ -86,6 +86,7 @@ const MODEL_KEYED_RECORDS = [
   "modelMaxOutputTokens",
   "modelInputModalities",
   "modelReasoningEfforts",
+  "modelSuppressSyntheticMax",
   "modelDefaultReasoningEfforts",
   "modelReasoningEffortMap",
 ] as const;

package/src/providers/openai-sidecar.ts

@@ -32,6 +32,8 @@ export interface ResolvedOpenAiForwardSidecar extends OpenAiForwardSidecarCandid
   authContext: CodexAuthContext;
   headers: Headers;
   recordOutcome?: (outcome: CodexUpstreamOutcome) => void;
+  /** Hand back an acquired recovery probe when no sidecar request reached upstream. */
+  releaseProbeLease?: () => void;
 }
 
 /**
@@ -189,6 +191,7 @@ export async function resolveFirstUsableOpenAiSidecar(
             ...(authContext.kind === "pool" ? { credentialGeneration: authContext.generation } : {}),
           },
         ),
+        releaseProbeLease: () => releaseCodexAuthContextProbeLease(authContext),
       };
     }
     if (candidate.accountMode === "direct") {
@@ -237,6 +240,7 @@ export async function resolveFirstUsableOpenAiSidecar(
               ...(authContext.kind === "pool" ? { credentialGeneration: authContext.generation } : {}),
             },
           ),
+          releaseProbeLease: () => releaseCodexAuthContextProbeLease(authContext),
         }
         : {}),
     };

package/src/providers/opencode-go-transport.ts

@@ -12,10 +12,12 @@ function hasHeaderCaseInsensitive(
   return Object.keys(headers ?? {}).some(key => key.toLowerCase() === target);
 }
 
-/** Derive a provider-scoped opaque value without exposing Codex task or subagent ids. */
-export function deriveOpenCodeGoSessionId(sessionLane: string): string {
+/** Derive a provider- and wire-scoped opaque value without exposing Codex task or subagent ids. */
+export function deriveOpenCodeGoSessionId(sessionLane: string, wireProtocol: string): string {
   const digest = createHash("sha256")
-    .update("opencodex/opencode-go/session/v1\0")
+    .update("opencodex/opencode-go/session/v2\0")
+    .update(wireProtocol)
+    .update("\0")
     .update(sessionLane)
     .digest("hex")
     .slice(0, 32);
@@ -30,12 +32,19 @@ export function deriveOpenCodeGoSessionId(sessionLane: string): string {
  * request reaching this helper from the proxy always carries a lane. The `!sessionLane` guard stays
  * for direct callers that have no request context; it is not a per-request identity of its own, and
  * minting one here would hand each retry a different value.
+ *
+ * `provider` is already settled onto the final wire, while `destinationProvider` is the original
+ * routed row. Keeping both explicit prevents an Anthropic hard pin from defeating the registry's
+ * adapter-sensitive destination recognition.
  */
 export function resolveOpenCodeGoTransport<T extends OcxProviderConfig>(
   provider: T,
   sessionLane: string | undefined,
+  destinationProvider:
+    Pick<OcxProviderConfig, "baseUrl" | "adapter">
+    & Partial<Pick<OcxProviderConfig, "authMode">>,
 ): T {
-  if (registryEntryForProviderDestination(provider)?.id !== "opencode-go") return provider;
+  if (registryEntryForProviderDestination(destinationProvider)?.id !== "opencode-go") return provider;
   if (!sessionLane) return provider;
   if (hasHeaderCaseInsensitive(provider.headers, OPENCODE_GO_SESSION_HEADER)) return provider;
 
@@ -43,7 +52,7 @@ export function resolveOpenCodeGoTransport<T extends OcxProviderConfig>(
     ...provider,
     headers: {
       ...(provider.headers ?? {}),
-      [OPENCODE_GO_SESSION_HEADER]: deriveOpenCodeGoSessionId(sessionLane),
+      [OPENCODE_GO_SESSION_HEADER]: deriveOpenCodeGoSessionId(sessionLane, provider.adapter),
     },
   };
 }

package/src/providers/quota/report-cache.ts

@@ -151,6 +151,9 @@ export function providerQuotaFromCodexQuota(
   const projected: CodexCapacityQuota = {
     ...(quota.shortPercent !== undefined ? { fiveHourPercent: quota.shortPercent } : {}),
     ...(quota.shortResetAt !== undefined ? { fiveHourResetAt: quota.shortResetAt } : {}),
+    // Freshness for the reset-less terminal rule. Without it the dashboard evaluates that rule
+    // with no evidence and returns null while routing refuses the same account (#5045).
+    ...(quota.shortObservedAt !== undefined ? { shortObservedAt: quota.shortObservedAt } : {}),
     ...(quota.weeklyPercent !== undefined ? { weeklyPercent: quota.weeklyPercent } : {}),
     ...(quota.weeklyResetAt !== undefined ? { weeklyResetAt: quota.weeklyResetAt } : {}),
     ...(quota.monthlyPercent !== undefined ? { monthlyPercent: quota.monthlyPercent } : {}),