@bitkyc08/opencodex 2.58.0 → 2.59.0

package/src/oauth/generic-account-failover.ts

@@ -22,6 +22,8 @@ import {
   hasHeadroomEvidence,
   isAccountQuotaExhausted,
   rankAccountsByHeadroom,
+  classifyModelFamilyForQuota,
+  type QuotaModelFamily,
 } from "./account-quota-rank";
 import {
   genericPoolKey,
@@ -81,13 +83,14 @@ const health = new Map<string, AccountHealth>();
 /** Provider -> recent eligible-account count. TTL-bounded; never holds credential material. */
 const presence = new Map<string, PresenceEntry>();
 
-const healthKey = (provider: string, accountId: string) => `${provider}\u0000${accountId}`;
+const healthKey = (provider: string, accountId: string, family?: QuotaModelFamily) =>
+  family ? `${provider}\u0000${accountId}\u0000${family}` : `${provider}\u0000${accountId}`;
 
-function isCooled(provider: string, accountId: string, now: number): boolean {
-  const entry = health.get(healthKey(provider, accountId));
+function isCooled(provider: string, accountId: string, now: number, family?: QuotaModelFamily): boolean {
+  const entry = health.get(healthKey(provider, accountId, family));
   if (!entry) return false;
   if (entry.cooldownUntil <= now) {
-    health.delete(healthKey(provider, accountId));
+    health.delete(healthKey(provider, accountId, family));
     return false;
   }
   return true;
@@ -175,11 +178,11 @@ function isProactivePreferenceEnabled(config: OcxConfig, providerName: string, n
 }
 
 /** Accounts that may serve traffic right now: not cooled, not flagged for reauth. */
-export function eligibleFailoverAccounts(providerName: string, now = Date.now()): string[] {
+export function eligibleFailoverAccounts(providerName: string, now = Date.now(), family?: QuotaModelFamily): string[] {
   const set = getAccountSet(providerName);
   if (!set) return [];
   return set.accounts
-    .filter(account => account.needsReauth !== true && !isCooled(providerName, account.id, now))
+    .filter(account => account.needsReauth !== true && !isCooled(providerName, account.id, now, family))
     .map(account => account.id);
 }
 
@@ -230,8 +233,8 @@ function stableGenericRoster(providerName: string): string[] {
  * statement about observed usage, and treating "no observation" as "spent" would evacuate every
  * quota-less provider off its active account on the very first request.
  */
-function isOverAutoSwitchThreshold(providerName: string, accountId: string, threshold: number): boolean {
-  const headroom = accountHeadroomPercent(providerName, accountId);
+function isOverAutoSwitchThreshold(providerName: string, accountId: string, threshold: number, requestedModelId?: string | null): boolean {
+  const headroom = accountHeadroomPercent(providerName, accountId, requestedModelId);
   if (headroom === null) return false;
   return 100 - headroom >= threshold;
 }
@@ -245,15 +248,17 @@ function pickFillFirstGenericAccount(
   providerName: string,
   activeId: string | undefined,
   now: number,
+  requestedModelId?: string | null,
 ): string | null {
   const stableAll = stableGenericRoster(providerName);
   if (stableAll.length < 2) return null;
-  const eligible = new Set(eligibleFailoverAccounts(providerName, now));
+  const family = classifyModelFamilyForQuota(providerName, requestedModelId);
+  const eligible = new Set(eligibleFailoverAccounts(providerName, now, family));
   const stored = config.providers?.[providerName]?.oauthAccountFailover?.autoSwitchThreshold;
   const threshold = typeof stored === "number" && Number.isInteger(stored) && stored >= 0 && stored <= 100
     ? stored
     : DEFAULT_GENERIC_AUTO_SWITCH_THRESHOLD;
-  if (activeId && eligible.has(activeId) && !isOverAutoSwitchThreshold(providerName, activeId, threshold)) {
+  if (activeId && eligible.has(activeId) && !isOverAutoSwitchThreshold(providerName, activeId, threshold, requestedModelId)) {
     return null;
   }
   const start = activeId ? stableAll.indexOf(activeId) : -1;
@@ -277,11 +282,17 @@ function pickFillFirstGenericAccount(
  * advance and round-robin would propose the same account forever. This is the same shape
  * `commitAnthropicSelectionRouting` already commits with.
  */
-export function noteGenericPoolSelection(config: OcxConfig, providerName: string, accountId: string): void {
+export function noteGenericPoolSelection(
+  config: OcxConfig,
+  providerName: string,
+  accountId: string,
+  requestedModelId?: string | null,
+): void {
   if (activeGenericStrategy(config, providerName) !== "round-robin") return;
   const poolKey = genericPoolKey(providerName);
   const limit = genericStickyLimit(config, providerName);
-  const picked = pickRoundRobinAccount(poolKey, eligibleFailoverAccounts(providerName), limit);
+  const family = classifyModelFamilyForQuota(providerName, requestedModelId);
+  const picked = pickRoundRobinAccount(poolKey, eligibleFailoverAccounts(providerName, Date.now(), family), limit);
   // The resolver may have admitted a different account than the ring proposed: a removal, a
   // reauth verdict or a manual selection can land during credential resolution. Realign the
   // cursor onto what actually served rather than leaving it on a road not taken.
@@ -302,6 +313,7 @@ export function rotateGenericOAuthAccountOn429(
   failedAccountId: string,
   retryAfterHeader: string | null | undefined,
   now = Date.now(),
+  requestedModelId?: string | null,
 ): string | null {
   if (!isGenericOAuthFailoverEnabled(config, providerName)) return null;
   const set = getAccountSet(providerName);
@@ -314,13 +326,14 @@ export function rotateGenericOAuthAccountOn429(
   // A Retry-After from upstream still wins — it is the server's own instruction.
   const exhausted = parsed === undefined ? exhaustedCooldownMs(providerName, failedAccountId, now) : null;
   const cooldownMs = exhausted ?? Math.min(parsed ?? DEFAULT_COOLDOWN_MS, MAX_COOLDOWN_MS);
-  health.set(healthKey(providerName, failedAccountId), {
+  const family = classifyModelFamilyForQuota(providerName, requestedModelId);
+  health.set(healthKey(providerName, failedAccountId, family), {
     cooldownUntil: now + cooldownMs,
     cooldownSource: parsed ? "retry-after" : "default",
   });
   sweepExpiredOnWrite(now);
 
-  const eligible = eligibleFailoverAccounts(providerName, now).filter(id => id !== failedAccountId);
+  const eligible = eligibleFailoverAccounts(providerName, now, family).filter(id => id !== failedAccountId);
   if (eligible.length === 0) return null;
   // A rotation means the roster in use just changed; do not answer the next activation question
   // from a count read before the failure.
@@ -359,7 +372,7 @@ export function rotateGenericOAuthAccountOn429(
   }
   // With no quota evidence this returns the ring untouched, so providers without
   // per-account quota keep exactly the traversal they have today.
-  return rankAccountsByHeadroom(providerName, candidates)[0] ?? null;
+  return rankAccountsByHeadroom(providerName, candidates, requestedModelId)[0] ?? null;
 }
 
 /**
@@ -392,6 +405,7 @@ export function preferredInitialAccount(
   config: OcxConfig,
   providerName: string,
   now = Date.now(),
+  requestedModelId?: string | null,
 ): string | null {
   // The PROACTIVE predicate, not the reactive one: this steers a request upstream has not
   // refused, so `oauthAccountFailover.enabled: false` must still be able to refuse it.
@@ -411,7 +425,8 @@ export function preferredInitialAccount(
   // would never reach its own test. Cooldowns and reauth are still honoured inside each pick.
   const strategy = activeGenericStrategy(config, providerName);
   if (strategy === "round-robin") {
-    const eligibleNow = eligibleFailoverAccounts(providerName, now);
+    const family = classifyModelFamilyForQuota(providerName, requestedModelId);
+    const eligibleNow = eligibleFailoverAccounts(providerName, now, family);
     if (eligibleNow.length === 0) return null;
     // PEEK, not pick: this proposal is discardable, and advancing the ring for an account the
     // resolver then rejects would skip a turn for nothing. noteGenericPoolSelection commits.
@@ -423,26 +438,26 @@ export function preferredInitialAccount(
     return picked && picked !== active ? picked : null;
   }
   if (strategy === "fill-first") {
-    const picked = pickFillFirstGenericAccount(config, providerName, active, now);
+    const picked = pickFillFirstGenericAccount(config, providerName, active, now, requestedModelId);
     return picked && picked !== active ? picked : null;
   }
 
   const activeRow = selected.accounts.find(account => account.id === active);
   if (activeRow && activeRow.needsReauth !== true
-    && !isCooled(providerName, activeRow.id, now)
-    && !isAccountQuotaExhausted(providerName, activeRow.id)) return null;
+    && !isCooled(providerName, activeRow.id, now, classifyModelFamilyForQuota(providerName, requestedModelId))
+    && !isAccountQuotaExhausted(providerName, activeRow.id, requestedModelId)) return null;
 
   // Evidence is required BEFORE eligibility narrows the field. Without this, a provider
   // with no quota data at all could still be redirected: cool the active account with a
   // 429 and the eligible list collapses to one candidate, which any ranking returns
   // unchanged — an answer that looks ranked but was never measured. The no-op guarantee
   // for quota-less providers has to be checked on the full roster.
-  if (!hasHeadroomEvidence(providerName, order)) return null;
+  if (!hasHeadroomEvidence(providerName, order, requestedModelId)) return null;
 
   // Cooldowns are respected here, unlike in the presence count: this picks the account to
   // send to right now, and one inside its 429 window is the single candidate we hold
   // positive evidence against.
-  const eligible = order.filter(id => !isCooled(providerName, id, now));
+  const eligible = order.filter(id => !isCooled(providerName, id, now, classifyModelFamilyForQuota(providerName, requestedModelId)));
   if (eligible.length === 0) return null;
 
   // Start the ring at the active account so an unranked outcome reproduces today's choice.
@@ -451,7 +466,7 @@ export function preferredInitialAccount(
   const candidates = ring.filter(id => eligible.includes(id));
   if (candidates.length === 0) return null;
 
-  const best = rankAccountsByHeadroom(providerName, candidates)[0] ?? null;
+  const best = rankAccountsByHeadroom(providerName, candidates, requestedModelId)[0] ?? null;
   // Nothing to do when the ranking agrees with the account we would have used anyway.
   //
   // A proposal still needs guarded selection commit after credential resolution: a
@@ -461,12 +476,10 @@ export function preferredInitialAccount(
 
 /** Earliest remaining cooldown, for a client-facing Retry-After when every account is cooled. */
 export function genericFailoverRetryAfterSeconds(providerName: string, now = Date.now()): number | null {
-  const set = getAccountSet(providerName);
-  if (!set) return null;
+  const prefix = `${providerName}\u0000`;
   let earliest: number | null = null;
-  for (const account of set.accounts) {
-    const entry = health.get(healthKey(providerName, account.id));
-    if (!entry || entry.cooldownUntil <= now) continue;
+  for (const [key, entry] of health) {
+    if (!key.startsWith(prefix) || entry.cooldownUntil <= now) continue;
     if (earliest === null || entry.cooldownUntil < earliest) earliest = entry.cooldownUntil;
   }
   return earliest === null ? null : Math.max(1, Math.ceil((earliest - now) / 1000));

package/src/oauth/orcarouter.ts

@@ -2,6 +2,7 @@
 import { OAuthCallbackFlow, type OAuthCallbackFlowOptions } from "./callback-server";
 import { generatePKCE } from "./pkce";
 import type { OAuthController, OAuthCredentials } from "./types";
+import { BOUNDED_BODY_MAX_BYTES, readBoundedResponseBytes } from "../lib/bounded-body";
 
 export const ORCAROUTER_DEFAULT_API_BASE_URL = "https://api.orcarouter.ai";
 export const ORCAROUTER_DEFAULT_AUTH_BASE_URL = "https://www.orcarouter.ai";
@@ -147,6 +148,7 @@ export class OrcaRouterOAuthFlow extends OAuthCallbackFlow {
 
   async exchangeToken(code: string, _state: string, _redirectUri: string): Promise<OAuthCredentials> {
     if (!this.#verifier) throw new Error("OrcaRouter PKCE verifier was not initialized");
+    const signal = requestSignal(this.ctrl.signal);
     let response: Response;
     try {
       response = await fetch(new URL("/api/v1/auth/keys", this.#authBaseUrl), {
@@ -158,7 +160,7 @@ export class OrcaRouterOAuthFlow extends OAuthCallbackFlow {
           code_challenge_method: "S256",
         }),
         redirect: "error",
-        signal: requestSignal(this.ctrl.signal),
+        signal,
       });
     } catch (error) {
       if (this.ctrl.signal?.aborted) {
@@ -171,9 +173,20 @@ export class OrcaRouterOAuthFlow extends OAuthCallbackFlow {
       // never turn a code, verifier, or accidentally returned key into console output.
       throw new Error(`OrcaRouter key exchange failed with HTTP ${response.status}`);
     }
+    const { bytes, oversized } = await readBoundedResponseBytes(response, {
+      maxBytes: BOUNDED_BODY_MAX_BYTES,
+      signal,
+    }).catch(() => {
+      if (signal.aborted) throw signal.reason;
+      // Preserve the existing non-reflective error for response-body failures.
+      throw new Error("OrcaRouter key exchange returned invalid JSON");
+    });
+    if (oversized) {
+      throw new Error(`OrcaRouter key exchange response exceeded the ${BOUNDED_BODY_MAX_BYTES}-byte limit`);
+    }
     let payload: unknown;
     try {
-      payload = await response.json();
+      payload = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
     } catch {
       throw new Error("OrcaRouter key exchange returned invalid JSON");
     }

package/src/oauth/store.ts

@@ -437,6 +437,14 @@ function backupLegacyOnce(): void {
   try {
     copyFileSync(path, backup);
     try { chmodSync(backup, 0o600); } catch { /* best-effort */ }
+    try {
+      // Register only the copy we just created. An unowned home still needs downgrade recovery.
+      if (!recordOwnedConfigPath(getConfigDir(), backup)) {
+        console.warn("[oauth] Recovery backup created, but uninstall ownership registration failed.");
+      }
+    } catch {
+      console.warn("[oauth] Recovery backup created, but uninstall ownership registration failed.");
+    }
   } catch { /* best-effort */ }
 }
 

package/src/providers/codex-capacity.ts

@@ -36,6 +36,15 @@ export const CODEX_CAPACITY_MAX_QUOTA_AGE_MS = 30 * 60_000;
 export type CodexCapacityQuota = {
   fiveHourPercent?: number;
   fiveHourResetAt?: number;
+  /**
+   * Local observation time for the burst-window percentage.
+   *
+   * Carried because the terminal-short-window rule needs it whenever the reading has no reset
+   * instant, and the dashboard's account-switch warning evaluates that rule against this DTO.
+   * Dropping it here made the warning return "no opinion" for a snapshot routing was already
+   * refusing on (#5045).
+   */
+  shortObservedAt?: number;
   weeklyPercent?: number;
   weeklyResetAt?: number;
   monthlyPercent?: number;

package/src/providers/devin-provider-merge-migration.ts

@@ -195,33 +195,54 @@ const DEFAULT_DEPS: DevinProviderMergeStartupDeps = {
  * the snapshot is taken strictly before the save, and a backup failure throws
  * rather than writing without a rollback point.
  *
- * The auth half is deliberately detached. `startServer` is synchronous — an
- * `await` in the boot window would suspend the composition root — and
+ * Both destination slots are inspected before either account-bound file is
+ * changed. The auth write itself is deliberately detached. `startServer` is
+ * synchronous — an `await` in the boot window would suspend the composition root — and
  * `mutateStore` is async-only, so the rekey is fired after its snapshot and
- * its outcome is logged when it lands. That is safe here: the credential is
- * valid under either slot name while the `devin-cli` alias exists, a conflict
- * refuses by design, and a failed rekey simply retries on the next boot.
+ * its outcome is logged when it lands. A late concurrent conflict refuses by
+ * design, and a failed rekey simply retries on the next boot.
  */
 export function runDevinProviderMergeStartupMigration(
   config: OcxConfig,
   deps: DevinProviderMergeStartupDeps = DEFAULT_DEPS,
 ): OcxConfig {
   const projection = deps.project(config);
-  // Warnings are emitted even on a no-op: the collision case IS the warning.
+  const hasSourceConfig = config.providers?.[FROM_ID] !== undefined;
+  const hasSourceAuth = deps.hasAuthSlot(FROM_ID);
+  const hasDestinationAuth = deps.hasAuthSlot(TO_ID);
+
+  // A configured provider and its credentials are one account-bound unit. Do
+  // not move either half if the config projection refused, or if the target
+  // credential slot could belong to another account.
+  if (hasSourceConfig && (!projection.changed || hasDestinationAuth)) {
+    // Projection warnings still matter on a no-op: a config collision is the warning.
+    for (const warning of projection.warnings) console.warn(`[devin-provider-merge] ${warning}`);
+    if (projection.changed && hasDestinationAuth) {
+      console.warn(
+        `[devin-provider-merge] auth.json already has a "${TO_ID}" credential slot; `
+        + `provider "${FROM_ID}" and both credential slots were left untouched. Remove the `
+        + "unused destination credential manually, then restart.",
+      );
+    }
+    return config;
+  }
+
   for (const warning of projection.warnings) console.warn(`[devin-provider-merge] ${warning}`);
+
   let result = config;
   if (projection.changed) {
+    // Snapshot both account-bound files before changing either one.
+    if (hasSourceAuth) deps.backupAuth();
     deps.backupConfig();
     deps.save(projection.config);
     result = projection.config;
   }
 
-  // The auth rekey runs even when the config half refused or had nothing to
-  // do: a `devin-cli` credential slot is orphaned state regardless of whether
-  // a provider row still points at it, and the conflict check inside the
-  // rekey is the same refuse-on-occupied rule the config half applies.
-  if (!deps.hasAuthSlot(FROM_ID)) return result;
-  deps.backupAuth();
+  // With no legacy config row, a `devin-cli` credential slot is orphaned and
+  // can still be rekeyed under the helper's refuse-on-occupied rule. A refused
+  // config migration returned above so its account-bound slot stays put.
+  if (!hasSourceAuth) return result;
+  if (!projection.changed) deps.backupAuth();
   void deps.rekey(FROM_ID, TO_ID).then(outcome => {
     if (outcome === "conflict") {
       console.warn(

package/src/providers/free-directory.ts

@@ -1,3 +1,5 @@
+import { getProviderRegistryEntry } from "./registry";
+
 export type ProviderAccessGroup =
   | "recurring-or-keyless"
   | "recurring-uncapped"
@@ -18,7 +20,7 @@ export const FREE_PROVIDER_ACCESS_GROUPS = {
   ],
   "recurring-credit": ["bytez", "nous-research"],
   "signup-credit": [
-    "agentrouter", "ai21", "baichuan", "baseten", "deepinfra", "deepseek", "doubao", "fireworks", "freemodel-dev", "glm-cn",
+    "agentrouter", "ai21", "baichuan", "baseten", "crusoe", "deepinfra", "deepseek", "doubao", "fireworks", "freemodel-dev", "glm-cn",
     "hyperbolic", "longcat", "monsterapi", "nebius", "novita", "nscale", "nvidia", "predibase", "publicai", "qoder", "qoder-cn",
     "scaleway", "sensenova", "stepfun", "together", "vertex",
   ],
@@ -72,6 +74,21 @@ const openAi = (baseUrl: string, dashboardUrl: string, extra: Partial<Connectabl
   ...extra,
 });
 
+function registryLiveKeyProvider(id: string): ConnectableOverride {
+  const entry = getProviderRegistryEntry(id);
+  if (!entry || entry.authKind !== "key" || !entry.dashboardUrl || entry.liveModels !== true) {
+    throw new TypeError(`Free directory registry projection requires a live key provider with a dashboard: ${id}`);
+  }
+  return {
+    baseUrl: entry.baseUrl,
+    dashboardUrl: entry.dashboardUrl,
+    adapter: entry.adapter,
+    authKind: "key",
+    discovery: "live",
+    liveModels: true,
+  };
+}
+
 // API roots are limited to documented or primary-source integrations. Consumer-web/session
 // providers remain reference-only: this directory never asks users to paste cookies or bypass WAFs.
 const CONNECTABLE: Record<string, ConnectableOverride> = {
@@ -127,6 +144,7 @@ const CONNECTABLE: Record<string, ConnectableOverride> = {
   // Verified end-to-end 2026-07-30: /v1/models returns the OpenAI-shaped live catalog (13 models),
   // and a chat completion against moonshotai/Kimi-K3 returned a standard chat.completion payload.
   baseten: openAi("https://inference.baseten.co/v1", "https://app.baseten.co/settings/api_keys", { supportLevel: "supported", verification: "official", documentationUrl: "https://docs.baseten.co/inference/model-apis/overview", modelsUrl: "https://inference.baseten.co/v1/models", lastVerified: "2026-07-30" }),
+  crusoe: { ...registryLiveKeyProvider("crusoe"), supportLevel: "supported", verification: "official", documentationUrl: "https://docs.crusoecloud.com/quickstart/getting-started-with-serverless-inference", modelsUrl: "https://api.inference.crusoecloud.com/v1/models", lastVerified: "2026-09-11" },
   deepinfra: openAi("https://api.deepinfra.com/v1/openai", "https://deepinfra.com/dash/api_keys", { supportLevel: "supported", verification: "official", documentationUrl: "https://deepinfra.com/docs/openai_api" }),
   deepseek: openAi("https://api.deepseek.com", "https://platform.deepseek.com/api_keys", { supportLevel: "supported", verification: "official", documentationUrl: "https://api-docs.deepseek.com/api/list-models" }),
   doubao: openAi("https://ark.cn-beijing.volces.com/api/v3", "https://console.volcengine.com/ark/region:ark+cn-beijing/apiKey", { verification: "official" }),
@@ -181,7 +199,7 @@ const LABELS: Record<string, string> = {
   "t3-web": "T3 Web", uncloseai: "UncloseAI", ainative: "AI Native", baidu: "Baidu Qianfan",
   glm: "Z.AI GLM", "glm-cn": "BigModel GLM (CN)", "kilo-gateway": "Kilo Gateway", "opencode-zen": "OpenCode Zen",
   sealion: "SEA-LION", bytez: "Bytez", "nous-research": "Nous Research", agentrouter: "AgentRouter",
-  ai21: "AI21", baichuan: "Baichuan", deepinfra: "DeepInfra", deepseek: "DeepSeek", doubao: "Doubao",
+  ai21: "AI21", baichuan: "Baichuan", crusoe: "Crusoe", deepinfra: "DeepInfra", deepseek: "DeepSeek", doubao: "Doubao",
   "freemodel-dev": "FreeModel.dev", sambanova: "SambaNova Cloud", nebius: "Nebius Token Factory",
   novita: "Novita", nscale: "Nscale", nvidia: "NVIDIA NIM",
   publicai: "PublicAI", qoder: "Qoder", "qoder-cn": "Qoder CN", sensenova: "SenseNova", stepfun: "StepFun", vertex: "Google Vertex AI",