@bitkyc08/opencodex 2.57.0 → 2.59.0

package/src/types/wire.ts

@@ -46,7 +46,15 @@ export const MODEL_ADAPTER_OVERRIDE_ALLOWED: ReadonlySet<string> = new Set([
  * Anthropic for these models.
  */
 const ANTHROPIC_WIRE_MODELS: Record<string, ReadonlySet<string>> = {
-  "opencode-go": new Set(["minimax-m2.5", "minimax-m2.7", "minimax-m3"]),
+  "opencode-go": new Set([
+    "minimax-m2.5",
+    "minimax-m2.7",
+    "minimax-m3",
+    // OpenCode's catalog identifies Union Alpha as @ai-sdk/anthropic while the
+    // provider defaults to OpenAI-compatible; direct Chat returns 500 and direct
+    // Messages reaches the session check (#4847).
+    "union-alpha",
+  ]),
 };
 
 function anthropicWireModelsForProvider(providerName: string): ReadonlySet<string> | undefined {

package/src/usage/expected-prices.ts

@@ -124,6 +124,16 @@ const META_MUSE_SPARK_13_CONTRIBUTOR: Cost4 = { input: 0.1, output: 0.2, cacheRe
 const META_SPARK_SOURCE = `Meta Model API published price ${META_MODEL_PRICING}`;
 const META_SPARK_CONTRIBUTOR_SOURCE = `Meta Model API published Contributor-tier price ${META_MODEL_PRICING}; data-sharing discount tier`;
 const DEEPSEEK_PRICING = "https://api-docs.deepseek.com/quick_start/pricing-details-usd; V4 Flash alias transition scheduled 2026-07-24 — re-verify after";
+/*
+ * DeepSeek V4.1-Flash list prices (USD / 1M tokens), verified 2026-09-17 against
+ * https://api-docs.deepseek.com/quick_start/pricing. The page prices a peak window
+ * (09:30-24:00 Beijing) and an off-peak window; the tuple below is the peak-window
+ * list rate and the off-peak discount (0.15 / 0.60, cache-hit 0.003) is deliberately
+ * not baked in — the same rule as the Devin time-boxed promos. cacheWrite=0 follows
+ * the existing deepseek-chat / deepseek-reasoner rows: DeepSeek publishes no
+ * cache-write charge.
+ */
+const DEEPSEEK_V41_FLASH: Cost4 = { input: 0.3, output: 1.2, cacheRead: 0.006, cacheWrite: 0 };
 // Kimi official tables publish input/output/cache-hit only; cacheWrite is mapped to the
 // cache-miss input price (Kimi auto-caches with no separate write billing). 2026-07-20 re-verified.
 const KIMI_PRICING = "https://platform.kimi.ai/docs/pricing (official table; cacheWrite derived = input, Kimi auto-cache has no write billing)";
@@ -142,6 +152,14 @@ const BIGMODEL_NOTE = "z.ai international list price shown as estimate; domestic
 // anywhere. Cache stays 0 rather than inheriting the reseller's 0.15 — a reseller number
 // under a vendor-price label would be a wrong value wearing a verified badge.
 const QWEN38_MAX_PRICING = "https://qwen.ai/blog?id=qwen3.8 (Qwen release announcement; no Model Studio billing row yet; cache rates unpublished -> 0)";
+// Qwen-published qwen3.8-flash rate ($0.16 in / $0.47 out per 1M tokens) via the
+// Qwen3.8 release announcement, corroborated by API-vendor price tables. No cache
+// rate is published anywhere, so cache stays 0 rather than borrowing a reseller's
+// number — the same hold QWEN38_MAX takes. The announcement marks API availability
+// as coming soon, but the id is already served (and logged) on OpenCode Go, so the
+// estimate applies to real usage rows now.
+const QWEN38_FLASH: Cost4 = { input: 0.16, output: 0.47, cacheRead: 0, cacheWrite: 0 };
+const QWEN38_FLASH_PRICING = "https://qwen.ai/blog?id=qwen3.8-2026 (Qwen release announcement; API marked coming soon at announcement; cache rates unpublished -> 0; input/output corroborated by https://docs.b.ai/guides/models/qwen/qwen3.8-flash)";
 
 /*
  * Cognition/Devin list prices (USD / 1M tokens), verified 2026-09-13 against the
@@ -289,6 +307,16 @@ export const EXPECTED_PRICE_OVERLAYS: readonly ExpectedPriceOverlay[] = [
   // for what that source does and does not cover.
   { provider: "alibaba-token-plan", modelId: "qwen3.8-max", cost4: QWEN38_MAX, source: QWEN38_MAX_PRICING, verifiedAt: "2026-08-04", status: "verified" },
   { provider: "alibaba-token-plan-intl", modelId: "qwen3.8-max", cost4: QWEN38_MAX, source: QWEN38_MAX_PRICING, verifiedAt: "2026-08-04", status: "verified" },
+  // OpenCode Go — five served ids with no jawcode bundle row and no vendor-level
+  // fallback (the fallback only searches jawcode metadata, never overlays), so the
+  // Usage estimated-cost column and the per-model breakdown rendered an em dash for
+  // every request through them. Each row reuses the vendor's own published list
+  // price as an estimate: Go itself is subscription-billed, hence verified-derived.
+  { provider: "opencode-go", modelId: "qwen3.8-max", cost4: QWEN38_MAX, source: `vendor list price applied to the OpenCode Go surface; ${QWEN38_MAX_PRICING}`, verifiedAt: "2026-09-17", status: "verified-derived" },
+  { provider: "opencode-go", modelId: "qwen3.8-flash", cost4: QWEN38_FLASH, source: `vendor list price applied to the OpenCode Go surface; ${QWEN38_FLASH_PRICING}`, verifiedAt: "2026-09-17", status: "verified-derived" },
+  { provider: "opencode-go", modelId: "deepseek-v4.1-flash", cost4: DEEPSEEK_V41_FLASH, source: `peak-window list rate applied to the OpenCode Go surface (off-peak 0.15/0.60 + cache-hit 0.003 not baked in); ${DEEPSEEK_PRICING}`, verifiedAt: "2026-09-17", status: "verified-derived" },
+  { provider: "opencode-go", modelId: "glm-5.3-flash", cost4: GLM_53_FLASH, source: `z.ai list price applied to the OpenCode Go surface as an estimate; ${ZAI_PRICING}`, verifiedAt: "2026-09-17", status: "verified-derived" },
+  { provider: "opencode-go", modelId: "muse-spark-1.3-contributor", cost4: META_MUSE_SPARK_13_CONTRIBUTOR, source: `Meta Model API Contributor-tier price applied to the OpenCode Go surface as an estimate; ${META_SPARK_CONTRIBUTOR_SOURCE}`, verifiedAt: "2026-09-17", status: "verified-derived" },
   // Cursor Auto router — Cursor's published fixed token price (verified).
   { provider: "cursor", modelId: "auto", cost4: { input: 1.25, output: 6, cacheRead: 0.25, cacheWrite: 1.25 }, source: "https://docs.cursor.com/account/pricing + https://cursor.com/blog/aug-2025-pricing", verifiedAt: "2026-07-20", status: "verified" },
   // Z.AI GLM family — the zai bundle's rows are all-zero upstream, and the four

package/src/usage/log.ts

@@ -77,6 +77,26 @@ export type AttemptRecoveryKind =
   | "empty-completion"
   | "reasoning-effort-downgrade";
 
+/**
+ * Why a recovery this request was otherwise willing to make did not happen.
+ *
+ * Recorded separately from `recoveryKinds` and from `sendCount`, because the question it
+ * answers is different from either. A log showing one physical send and no recovery kind used
+ * to be ambiguous: it could mean nothing was eligible, or that something was eligible and the
+ * send budget withheld it. Those need opposite follow-ups, and the second one was invisible
+ * (#5044).
+ *
+ * `sendCount` deliberately does not move for these. A refused attempt is not a physical send,
+ * and inflating the count to signal the refusal would corrupt the one number that means
+ * "requests this proxy actually made".
+ *
+ * Bounded vocabulary on purpose: it is a wire value a maintainer reads, never a credential, an
+ * account id, an upstream body, prompt content, or exception text.
+ */
+export type AttemptRecoveryWithheld =
+  | "retry-send-budget"
+  | "rotation-send-budget";
+
 /** Request-time upstream credential class, never a credential or account identifier. */
 export type UsageCredentialSource = "grok-oauth" | "xai-api-key";
 
@@ -139,6 +159,11 @@ export interface PersistedUsageAttempt {
   firstOutputMs?: number;
   sendCount: number;
   recoveryKinds: AttemptRecoveryKind[];
+  /**
+   * Recoveries this attempt was eligible for and did not make. Absent on ordinary attempts so
+   * old rows keep their exact shape.
+   */
+  recoveryWithheld?: AttemptRecoveryWithheld[];
   usageStatus: UsageStatus;
   /**
    * True when the proxy answered this turn locally and issued no upstream request. It travels on
@@ -487,6 +512,10 @@ const ATTEMPT_RECOVERY_KINDS = new Set<AttemptRecoveryKind>([
   "empty-completion",
   "reasoning-effort-downgrade",
 ]);
+const ATTEMPT_RECOVERY_WITHHELD = new Set<AttemptRecoveryWithheld>([
+  "retry-send-budget",
+  "rotation-send-budget",
+]);
 const USAGE_STATUSES = new Set<UsageStatus>([
   "reported",
   "unreported",
@@ -620,6 +649,14 @@ function normalizeUsageAttempt(raw: unknown): PersistedUsageAttempt | null {
         && ATTEMPT_RECOVERY_KINDS.has(value as AttemptRecoveryKind),
     ))]
     : [];
+  // Same shape as `recoveryKinds`: unknown values are dropped rather than failing the row, so a
+  // log written by a newer build stays readable by an older one.
+  const recoveryWithheld = Array.isArray(attempt.recoveryWithheld)
+    ? [...new Set(attempt.recoveryWithheld.filter(
+      (value): value is AttemptRecoveryWithheld => typeof value === "string"
+        && ATTEMPT_RECOVERY_WITHHELD.has(value as AttemptRecoveryWithheld),
+    ))]
+    : [];
   return {
     ordinal: attempt.ordinal as number,
     provider: attempt.provider,
@@ -639,6 +676,7 @@ function normalizeUsageAttempt(raw: unknown): PersistedUsageAttempt | null {
       : {}),
     sendCount: attempt.sendCount as number,
     recoveryKinds,
+    ...(recoveryWithheld.length ? { recoveryWithheld } : {}),
     usageStatus: attempt.usageStatus as UsageStatus,
     ...(isCodexUsageAccountLogLabel(attempt.accountLogLabel)
       ? { accountLogLabel: attempt.accountLogLabel }
@@ -852,18 +890,61 @@ function normalizeUsageEntry(entry: PersistedUsageEntry): PersistedUsageEntry {
   };
 }
 
-function ensureUsageLogDir(): void {
+// Bound hot-path filesystem hardening to once per second while ensuring an external mode
+// widening cannot suppress write-triggered repair for the lifetime of the process.
+const USAGE_LOG_PERMISSION_RECHECK_MS = 1_000;
+
+type UsageLogPermissionCheck = {
+  path: string;
+  checkedAt: number;
+};
+
+let ensuredUsageLogDir: UsageLogPermissionCheck | null = null;
+let ensuredUsageLogFile: UsageLogPermissionCheck | null = null;
+
+function usageLogPermissionCheckIsCurrent(
+  check: UsageLogPermissionCheck | null,
+  path: string,
+  now: number,
+): boolean {
+  return check?.path === path
+    && now >= check.checkedAt
+    && now - check.checkedAt < USAGE_LOG_PERMISSION_RECHECK_MS;
+}
+
+function ensureUsageLogDir(now: number): void {
   const dir = getConfigDir();
+  if (usageLogPermissionCheckIsCurrent(ensuredUsageLogDir, dir, now)) return;
   recordOwnedConfigPath(dir, usageLogPath());
   mkdirSync(dir, { recursive: true, mode: 0o700 });
   try { chmodSync(dir, 0o700); } catch { /* best-effort on platforms that ignore chmod */ }
+  ensuredUsageLogDir = { path: dir, checkedAt: now };
 }
 
 export function appendUsageEntry(entry: PersistedUsageEntry): void {
-  ensureUsageLogDir();
+  const line = `${JSON.stringify(normalizeUsageEntry(entry))}\n`;
   const path = usageLogPath();
-  appendFileSync(path, `${JSON.stringify(normalizeUsageEntry(entry))}\n`, { encoding: "utf-8", mode: 0o600 });
-  try { chmodSync(path, 0o600); } catch { /* best-effort on platforms that ignore chmod */ }
+  const now = Date.now();
+  const doAppend = (): void => {
+    ensureUsageLogDir(now);
+    const filePermissionsCurrent = usageLogPermissionCheckIsCurrent(ensuredUsageLogFile, path, now);
+    appendFileSync(path, line, { encoding: "utf-8", mode: 0o600 });
+    if (!filePermissionsCurrent) {
+      try { chmodSync(path, 0o600); } catch { /* best-effort on platforms that ignore chmod */ }
+      ensuredUsageLogFile = { path, checkedAt: now };
+    }
+  };
+  try {
+    doAppend();
+  } catch (error: any) {
+    if (error?.code === "ENOENT") {
+      ensuredUsageLogDir = null;
+      ensuredUsageLogFile = null;
+      doAppend();
+      return;
+    }
+    throw error;
+  }
 }
 
 export type UsageLogRevision = {
@@ -1057,6 +1138,8 @@ export function resetUsageReadCacheForTests(): void {
   managementUsageReadInflight?.abort.abort();
   managementUsageReadInflight = null;
   retainedUsageSnapshot = null;
+  ensuredUsageLogDir = null;
+  ensuredUsageLogFile = null;
 }
 
 function readExactly(fd: number, length: number, position: number): Buffer | null {

package/src/web-search/passthrough-bridge.ts

@@ -75,6 +75,7 @@ import {
 } from "./sidecar-providers";
 import { providerDestinationConfigError } from "../lib/destination-policy";
 import { redactSecretString } from "../lib/redact";
+import { rememberBridgeSearchReplay } from "../responses/bridge-search-replay-cache";
 
 /** Canonical Ollama Cloud origin. The only origin the "ollama" backend derives on its own. */
 export const OLLAMA_CLOUD_ORIGIN = "https://ollama.com";
@@ -377,11 +378,18 @@ export interface PassthroughWebSearchBridgeStreamOptions {
   /** Sends one continuation leg and resolves with its response. */
   send: (body: string) => Promise<Response>;
   execute: PassthroughWebSearchBridgeExecutor;
+  /**
+   * Destination identity for the executed-search memo (#4587). When absent nothing is recorded,
+   * and the next turn replays the hosted cell exactly as it does today.
+   */
+  destinationScope?: string;
   /**
    * Re-applies the caller's outbound body ceiling to a continuation body. Returns a refusal
    * message when the extended body may not be sent, or undefined when it is admitted.
    */
   checkOutboundBody?: (body: string) => string | undefined;
+  /** Releases request-scoped resources when the stream completes, fails, or is cancelled. */
+  onFinalize?: () => void;
   signal?: AbortSignal;
 }
 
@@ -1094,11 +1102,22 @@ async function* bridgeStreamBlocks(
         outcome = await options.execute(queries, options.signal);
       }
       yield* emit(state.searchEndFrames(call, queries, outcome));
-      turns.push({
-        call,
-        // The model needs a readable result either way; an executor error is reported as the
-        // tool result rather than as a turn failure, so it can still answer without the search.
-        output: outcome.error ? "Web search failed: " + outcome.error : outcome.text,
+      // The model needs a readable result either way; an executor error is reported as the
+      // tool result rather than as a turn failure, so it can still answer without the search.
+      const output = outcome.error ? "Web search failed: " + outcome.error : outcome.text;
+      turns.push({ call, output });
+      // Record what a continuation leg WOULD put on the wire, whether or not this leg sends one
+      // (#4587). The caller keeps the hosted cell and replays it next turn; the pre-dispatch
+      // rewrite in the Responses adapter uses this to hand the destination back its own call and
+      // result instead of an item type it never produced. Recording the same text that
+      // appendBridgeSearchTurn would append is what keeps a replayed turn and a continued turn
+      // showing the destination one consistent conversation.
+      rememberBridgeSearchReplay(options.destinationScope, call.cellItemId, {
+        callId: call.callId,
+        sourceItemId: call.sourceItemId,
+        name: WEB_SEARCH_TOOL_NAME,
+        argumentsText: call.argumentsText,
+        output,
       });
     }
 
@@ -1170,21 +1189,36 @@ export function createPassthroughWebSearchBridgeStream(
   const aborted = (): boolean => cancelled || options.signal?.aborted === true;
   const iterator = bridgeStreamBlocks(options, aborted)[Symbol.asyncIterator]();
   const encoder = new TextEncoder();
+  let finalized = false;
+  const finalize = (): void => {
+    if (finalized) return;
+    finalized = true;
+    options.onFinalize?.();
+  };
   return new ReadableStream<Uint8Array>({
     async pull(controller) {
       try {
         const next = await iterator.next();
         if (next.done) {
+          finalize();
           controller.close();
           return;
         }
         controller.enqueue(encoder.encode(next.value));
       } catch (error) {
+        finalize();
         controller.error(error);
       }
     },
     cancel(reason) {
       cancelled = true;
+      // Release request-scoped authority immediately. An async generator cannot
+      // process a queued return() while its active next() is blocked on an
+      // upstream read, so deferring finalize until that settles would hold the
+      // sidecar probe lease for as long as the abandoned upstream leg does.
+      // Optional chaining would also skip finalize entirely for an iterator
+      // with no return method.
+      finalize();
       void iterator.return?.(reason);
     },
   });