@bitkyc08/opencodex 2.58.0 → 2.60.0

package/src/oauth/index.ts

@@ -1,6 +1,5 @@
 import type { KiroOAuthMetadata, OAuthController, OAuthCredentials } from "./types";
 import { initializeProviderModelSelection } from "../providers/initial-model-selection";
-import { parseCallbackInput } from "./callback-server";
 import type { OcxConfig, OcxProviderConfig, RefreshPolicy } from "../types";
 import { ConfigMutationLockError, loadConfig, mutatePersistedConfig, saveConfig } from "../config";
 import { resolveProviderApiKey } from "../providers/key-store";
@@ -51,8 +50,9 @@ import { providerModelsUrl, resolveProviderModelDiscoveryUrl } from "../provider
 import { resolveProviderTransport } from "../providers/xai-transport";
 import { detectClaudeCodeToken, detectGrokCliToken, hasComparableGrokIdentity, isSameGrokIdentity, shouldAdoptGrokGeneration } from "./local-token-detect";
 import { logOAuthEvent } from "./log";
-import { captureConfigGeneration, sweepExpiredOnWrite, type GenerationContext } from "../lib/state-store-sweeper";
-import { retainedUtf8Bytes } from "../lib/admission";
+import { captureConfigGeneration, sweepExpiredOnWrite } from "../lib/state-store-sweeper";
+import { clearManualCodeSlot, ensureManualCodeSlot, kiroLoginSettling, loginAbort, loginState, waitForManualLoginCode } from "./login-flow-state";
+export { reconcileOAuthFlowState, submitManualLoginCode } from "./login-flow-state";
 import { randomUUID } from "node:crypto";
 export {
   CODEX_HEALTH_AUTH_FAILED_NOTE,
@@ -1710,110 +1710,6 @@ export async function runLogin(
  * localhost), the GUI can POST the final redirect URL or authorization code via
  * submitManualLoginCode(), which feeds OAuthController.onManualCodeInput.
  */
-const loginState = new Map<string, { error?: string; done: boolean }>();
-const loginAbort = new Map<string, AbortController>();
-const kiroLoginSettling = new Set<string>();
-
-/** Pending paste for a login in progress: either a waiter or a stashed early submission. */
-interface ManualCodeSlot {
-  pendingInput?: string;
-  resolve?: (value: string) => void;
-  /** Registered by the callback flow so submits can validate state synchronously. */
-  expectedState?: string;
-}
-const loginManual = new Map<string, ManualCodeSlot>();
-const OAUTH_PENDING_CODE_MAX_BYTES = 4 * 1024;
-let lastOAuthFlowReconciledGeneration = 0;
-
-export function reconcileOAuthFlowState(context: GenerationContext): number {
-  if (context.generation <= lastOAuthFlowReconciledGeneration) return 0;
-  let removed = 0;
-  for (const [provider, state] of loginState) {
-    if (context.providerNames.has(provider) || !state.done || loginAbort.has(provider)) continue;
-    if (loginState.delete(provider)) removed += 1;
-    if (loginManual.delete(provider)) removed += 1;
-    if (loginAbort.delete(provider)) removed += 1;
-  }
-  lastOAuthFlowReconciledGeneration = context.generation;
-  return removed;
-}
-
-function clearManualCodeSlot(provider: string): void {
-  loginManual.delete(provider);
-}
-
-function ensureManualCodeSlot(provider: string): ManualCodeSlot {
-  let slot = loginManual.get(provider);
-  if (!slot) {
-    slot = {};
-    loginManual.set(provider, slot);
-  }
-  return slot;
-}
-
-/** Wait for a GUI/CLI paste of the OAuth redirect URL or code (or return a stashed early submit). */
-function waitForManualLoginCode(provider: string, signal: AbortSignal, expectedState?: string): Promise<string> {
-  if (signal.aborted) {
-    return Promise.reject(new Error(`OAuth callback cancelled: ${signal.reason}`));
-  }
-  const slot = ensureManualCodeSlot(provider);
-  if (expectedState !== undefined) slot.expectedState = expectedState;
-  if (slot.pendingInput !== undefined) {
-    const value = slot.pendingInput;
-    slot.pendingInput = undefined;
-    return Promise.resolve(value);
-  }
-  return new Promise<string>((resolve, reject) => {
-    const onAbort = () => {
-      if (slot.resolve === resolve) slot.resolve = undefined;
-      reject(new Error(`OAuth callback cancelled: ${signal.reason}`));
-    };
-    signal.addEventListener("abort", onAbort, { once: true });
-    slot.resolve = (value: string) => {
-      signal.removeEventListener("abort", onAbort);
-      if (slot.resolve === resolve) slot.resolve = undefined;
-      resolve(value);
-    };
-  });
-}
-
-/**
- * Feed a pasted redirect URL or authorization code into an in-progress GUI login.
- * Returns ok:false when no login is waiting (or input is empty). Invalid pastes are accepted
- * here and re-prompted by the OAuth callback loop if they cannot be parsed / fail state checks.
- */
-export function submitManualLoginCode(provider: string, input: string): { ok: true } | { ok: false; error: string } {
-  const trimmed = input.trim();
-  if (!trimmed) return { ok: false, error: "empty code" };
-  if (retainedUtf8Bytes(trimmed) > OAUTH_PENDING_CODE_MAX_BYTES) return { ok: false, error: "code too large" };
-  const st = loginState.get(provider);
-  if (!st || st.done) return { ok: false, error: "no login in progress" };
-  const slot = ensureManualCodeSlot(provider);
-  // Synchronous validation (validated request/ack): reject un-parseable input and
-  // authorization responses (url/query kind) whose state is missing or mismatched
-  // once the flow has registered its expected state. Raw codes stay in-session-PKCE
-  // protected. Early posts (flow not yet waiting, no expectedState) are stashed and
-  // re-validated by the callback loop.
-  const parsed = parseCallbackInput(trimmed);
-  // Command Code's manual fallback accepts a pasted JSON callback payload
-  // (`{ apiKey, state, ... }`) which has no `code` param. Let it through the
-  // shared gate so the provider-specific parser can validate it.
-  const isCommandCodeJson = provider === "command-code" && trimmed.startsWith("{") && !parsed.code;
-  if (!parsed.code && !isCommandCodeJson) return { ok: false, error: "no authorization code found in input" };
-  if (parsed.kind !== "raw" && slot.expectedState !== undefined) {
-    if (parsed.state === undefined) return { ok: false, error: "redirect URL is missing the state parameter" };
-    if (parsed.state !== slot.expectedState) return { ok: false, error: "state mismatch — paste the redirect URL from THIS login attempt" };
-  }
-  if (slot.resolve) {
-    const resolve = slot.resolve;
-    slot.resolve = undefined;
-    resolve(trimmed);
-  } else {
-    // Race: GUI may POST before the flow reaches onManualCodeInput — stash for the waiter.
-    slot.pendingInput = trimmed;
-  }
-  return { ok: true };
-}
 
 export interface OAuthAccountSummary {
   id: string;

package/src/oauth/login-flow-state.ts

@@ -0,0 +1,127 @@
+import { parseCallbackInput } from "./callback-server";
+import { retainedUtf8Bytes } from "../lib/admission";
+import type { GenerationContext } from "../lib/state-store-sweeper";
+
+/**
+ * In-flight login flow state and the manual paste slot that feeds it.
+ *
+ * Split out of `index.ts` when that file crossed the repository file-size ratchet at 2009
+ * lines. The cut follows a seam rather than a line count: everything here is bookkeeping for
+ * a login that has started and not yet settled, and none of it reads or writes a stored
+ * credential. `index.ts` re-exports the two public names, so existing importers are unaffected.
+ */
+export const loginState = new Map<string, { error?: string; done: boolean }>();
+export const loginAbort = new Map<string, AbortController>();
+export const kiroLoginSettling = new Set<string>();
+
+/** Pending paste for a login in progress: either a waiter or a stashed early submission. */
+export interface ManualCodeSlot {
+  pendingInput?: string;
+  resolve?: (value: string) => void;
+  /** Registered by the callback flow so submits can validate state synchronously. */
+  expectedState?: string;
+}
+const loginManual = new Map<string, ManualCodeSlot>();
+const OAUTH_PENDING_CODE_MAX_BYTES = 4 * 1024;
+let lastOAuthFlowReconciledGeneration = 0;
+
+export function reconcileOAuthFlowState(context: GenerationContext): number {
+  if (context.generation <= lastOAuthFlowReconciledGeneration) return 0;
+  let removed = 0;
+  for (const [provider, state] of loginState) {
+    if (context.providerNames.has(provider) || !state.done || loginAbort.has(provider)) continue;
+    if (loginState.delete(provider)) removed += 1;
+    if (loginManual.delete(provider)) removed += 1;
+    if (loginAbort.delete(provider)) removed += 1;
+  }
+  lastOAuthFlowReconciledGeneration = context.generation;
+  return removed;
+}
+
+export function clearManualCodeSlot(provider: string): void {
+  loginManual.delete(provider);
+}
+
+export function ensureManualCodeSlot(provider: string): ManualCodeSlot {
+  let slot = loginManual.get(provider);
+  if (!slot) {
+    slot = {};
+    loginManual.set(provider, slot);
+  }
+  return slot;
+}
+
+/** Wait for a GUI/CLI paste of the OAuth redirect URL or code (or return a stashed early submit). */
+export function waitForManualLoginCode(provider: string, signal: AbortSignal, expectedState?: string): Promise<string> {
+  if (signal.aborted) {
+    return Promise.reject(new Error(`OAuth callback cancelled: ${signal.reason}`));
+  }
+  const slot = ensureManualCodeSlot(provider);
+  if (expectedState !== undefined) slot.expectedState = expectedState;
+  if (slot.pendingInput !== undefined) {
+    const value = slot.pendingInput;
+    slot.pendingInput = undefined;
+    return Promise.resolve(value);
+  }
+  return new Promise<string>((resolve, reject) => {
+    const onAbort = () => {
+      if (slot.resolve === resolve) slot.resolve = undefined;
+      reject(new Error(`OAuth callback cancelled: ${signal.reason}`));
+    };
+    signal.addEventListener("abort", onAbort, { once: true });
+    slot.resolve = (value: string) => {
+      signal.removeEventListener("abort", onAbort);
+      if (slot.resolve === resolve) slot.resolve = undefined;
+      resolve(value);
+    };
+  });
+}
+
+/**
+ * Feed a pasted redirect URL or authorization code into an in-progress GUI login.
+ * Returns ok:false when no login is waiting (or input is empty). Invalid pastes are accepted
+ * here and re-prompted by the OAuth callback loop if they cannot be parsed / fail state checks.
+ */
+export function submitManualLoginCode(provider: string, input: string): { ok: true } | { ok: false; error: string } {
+  const trimmed = input.trim();
+  if (!trimmed) return { ok: false, error: "empty code" };
+  if (retainedUtf8Bytes(trimmed) > OAUTH_PENDING_CODE_MAX_BYTES) return { ok: false, error: "code too large" };
+  const st = loginState.get(provider);
+  if (!st || st.done) return { ok: false, error: "no login in progress" };
+  const slot = ensureManualCodeSlot(provider);
+  // Synchronous validation (validated request/ack): reject un-parseable input and
+  // authorization responses (url/query kind) whose state is missing or mismatched
+  // once the flow has registered its expected state. Raw codes stay in-session-PKCE
+  // protected — but a raw paste carrying an explicit #state suffix is state-bearing
+  // and checked too. Early posts (flow not yet waiting, no expectedState) are
+  // stashed and re-validated by the callback loop.
+  const parsed = parseCallbackInput(trimmed);
+  // Command Code's manual fallback accepts a pasted JSON callback payload
+  // (`{ apiKey, state, ... }`) which has no `code` param. Let it through the
+  // shared gate so the provider-specific parser can validate it.
+  const isCommandCodeJson = provider === "command-code" && trimmed.startsWith("{") && !parsed.code;
+  if (!parsed.code && !isCommandCodeJson) return { ok: false, error: "no authorization code found in input" };
+  // A raw paste carrying an explicit code#state suffix is state-bearing too: it
+  // must match the expected state rather than bypass validation.
+  const stateBearing = parsed.kind !== "raw" || parsed.state !== undefined;
+  if (stateBearing && slot.expectedState !== undefined) {
+    if (parsed.state === undefined) return { ok: false, error: "redirect URL is missing the state parameter" };
+    if (parsed.state !== slot.expectedState) {
+      return {
+        ok: false,
+        error: parsed.kind === "raw"
+          ? "state mismatch — paste the bare code, or the correct code#state from THIS login attempt"
+          : "state mismatch — paste the redirect URL from THIS login attempt",
+      };
+    }
+  }
+  if (slot.resolve) {
+    const resolve = slot.resolve;
+    slot.resolve = undefined;
+    resolve(trimmed);
+  } else {
+    // Race: GUI may POST before the flow reaches onManualCodeInput — stash for the waiter.
+    slot.pendingInput = trimmed;
+  }
+  return { ok: true };
+}

package/src/oauth/orcarouter.ts

@@ -2,6 +2,7 @@
 import { OAuthCallbackFlow, type OAuthCallbackFlowOptions } from "./callback-server";
 import { generatePKCE } from "./pkce";
 import type { OAuthController, OAuthCredentials } from "./types";
+import { BOUNDED_BODY_MAX_BYTES, readBoundedResponseBytes } from "../lib/bounded-body";
 
 export const ORCAROUTER_DEFAULT_API_BASE_URL = "https://api.orcarouter.ai";
 export const ORCAROUTER_DEFAULT_AUTH_BASE_URL = "https://www.orcarouter.ai";
@@ -147,6 +148,7 @@ export class OrcaRouterOAuthFlow extends OAuthCallbackFlow {
 
   async exchangeToken(code: string, _state: string, _redirectUri: string): Promise<OAuthCredentials> {
     if (!this.#verifier) throw new Error("OrcaRouter PKCE verifier was not initialized");
+    const signal = requestSignal(this.ctrl.signal);
     let response: Response;
     try {
       response = await fetch(new URL("/api/v1/auth/keys", this.#authBaseUrl), {
@@ -158,7 +160,7 @@ export class OrcaRouterOAuthFlow extends OAuthCallbackFlow {
           code_challenge_method: "S256",
         }),
         redirect: "error",
-        signal: requestSignal(this.ctrl.signal),
+        signal,
       });
     } catch (error) {
       if (this.ctrl.signal?.aborted) {
@@ -171,9 +173,20 @@ export class OrcaRouterOAuthFlow extends OAuthCallbackFlow {
       // never turn a code, verifier, or accidentally returned key into console output.
       throw new Error(`OrcaRouter key exchange failed with HTTP ${response.status}`);
     }
+    const { bytes, oversized } = await readBoundedResponseBytes(response, {
+      maxBytes: BOUNDED_BODY_MAX_BYTES,
+      signal,
+    }).catch(() => {
+      if (signal.aborted) throw signal.reason;
+      // Preserve the existing non-reflective error for response-body failures.
+      throw new Error("OrcaRouter key exchange returned invalid JSON");
+    });
+    if (oversized) {
+      throw new Error(`OrcaRouter key exchange response exceeded the ${BOUNDED_BODY_MAX_BYTES}-byte limit`);
+    }
     let payload: unknown;
     try {
-      payload = await response.json();
+      payload = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
     } catch {
       throw new Error("OrcaRouter key exchange returned invalid JSON");
     }

package/src/oauth/store.ts

@@ -437,6 +437,14 @@ function backupLegacyOnce(): void {
   try {
     copyFileSync(path, backup);
     try { chmodSync(backup, 0o600); } catch { /* best-effort */ }
+    try {
+      // Register only the copy we just created. An unowned home still needs downgrade recovery.
+      if (!recordOwnedConfigPath(getConfigDir(), backup)) {
+        console.warn("[oauth] Recovery backup created, but uninstall ownership registration failed.");
+      }
+    } catch {
+      console.warn("[oauth] Recovery backup created, but uninstall ownership registration failed.");
+    }
   } catch { /* best-effort */ }
 }
 

package/src/providers/codex-capacity.ts

@@ -36,6 +36,15 @@ export const CODEX_CAPACITY_MAX_QUOTA_AGE_MS = 30 * 60_000;
 export type CodexCapacityQuota = {
   fiveHourPercent?: number;
   fiveHourResetAt?: number;
+  /**
+   * Local observation time for the burst-window percentage.
+   *
+   * Carried because the terminal-short-window rule needs it whenever the reading has no reset
+   * instant, and the dashboard's account-switch warning evaluates that rule against this DTO.
+   * Dropping it here made the warning return "no opinion" for a snapshot routing was already
+   * refusing on (#5045).
+   */
+  shortObservedAt?: number;
   weeklyPercent?: number;
   weeklyResetAt?: number;
   monthlyPercent?: number;

package/src/providers/derive.ts

@@ -1,5 +1,6 @@
 import type { CodexAccountMode, OcxProviderConfig } from "../types";
 import { cloneFastWire } from "./fastwire";
+import { resolveModelPolicy } from "./resolved-model-policy";
 import {
   PROVIDER_REGISTRY,
   registryEntryForProviderDestination,
@@ -220,6 +221,14 @@ export function applyDirectReasoningEffortContracts(
  */
 export function providerConfigSeed(entry: ProviderRegistryEntry): OcxProviderConfig {
   const liveModels = registryEntrySupportsLiveModelDiscovery(entry) ? entry.liveModels : false;
+  const staticPolicy = resolveModelPolicy({
+    providerName: entry.id,
+    modelId: entry.defaultModel ?? entry.models?.[0] ?? "__provider_seed__",
+    provider: { adapter: entry.adapter, baseUrl: entry.baseUrl, authMode: entry.authKind },
+    registryEntry: entry,
+    transportMatchedRegistry: true,
+    effectiveAuth: { authMode: entry.authKind },
+  }).provider;
   return {
     adapter: entry.adapter,
     baseUrl: entry.baseUrl,
@@ -239,17 +248,17 @@ export function providerConfigSeed(entry: ProviderRegistryEntry): OcxProviderCon
     ...(entry.models ? { models: [...entry.models] } : {}),
     ...(liveModels !== undefined ? { liveModels } : {}),
     ...(entry.contextWindow !== undefined ? { contextWindow: entry.contextWindow } : {}),
-    ...(entry.modelContextWindows ? { modelContextWindows: { ...entry.modelContextWindows } } : {}),
-    ...(entry.modelDisplayNames ? { modelDisplayNames: { ...entry.modelDisplayNames } } : {}),
-    ...(entry.modelInputModalities ? { modelInputModalities: cloneRecordOfArrays(entry.modelInputModalities) } : {}),
-    ...(entry.modelMaxInputTokens ? { modelMaxInputTokens: { ...entry.modelMaxInputTokens } } : {}),
+    ...(staticPolicy.modelContextWindows ? { modelContextWindows: { ...staticPolicy.modelContextWindows } } : {}),
+    ...(staticPolicy.modelDisplayNames ? { modelDisplayNames: { ...staticPolicy.modelDisplayNames } } : {}),
+    ...(staticPolicy.modelInputModalities ? { modelInputModalities: cloneRecordOfArrays(staticPolicy.modelInputModalities) } : {}),
+    ...(staticPolicy.modelMaxInputTokens ? { modelMaxInputTokens: { ...staticPolicy.modelMaxInputTokens } } : {}),
     ...(entry.defaultMaxOutputTokens !== undefined ? { defaultMaxOutputTokens: entry.defaultMaxOutputTokens } : {}),
-    ...(entry.modelMaxOutputTokens ? { modelMaxOutputTokens: { ...entry.modelMaxOutputTokens } } : {}),
+    ...(staticPolicy.modelMaxOutputTokens ? { modelMaxOutputTokens: { ...staticPolicy.modelMaxOutputTokens } } : {}),
     ...(entry.reasoningEfforts ? { reasoningEfforts: [...entry.reasoningEfforts] } : {}),
-    ...(entry.modelReasoningEfforts ? { modelReasoningEfforts: cloneRecordOfArrays(entry.modelReasoningEfforts) } : {}),
-    ...(entry.modelDefaultReasoningEfforts ? { modelDefaultReasoningEfforts: { ...entry.modelDefaultReasoningEfforts } } : {}),
-    ...(entry.reasoningEffortMap ? { reasoningEffortMap: { ...entry.reasoningEffortMap } } : {}),
-    ...(entry.modelReasoningEffortMap ? { modelReasoningEffortMap: cloneNestedRecord(entry.modelReasoningEffortMap) } : {}),
+    ...(staticPolicy.modelReasoningEfforts ? { modelReasoningEfforts: cloneRecordOfArrays(staticPolicy.modelReasoningEfforts) } : {}),
+    ...(staticPolicy.modelDefaultReasoningEfforts ? { modelDefaultReasoningEfforts: { ...staticPolicy.modelDefaultReasoningEfforts } } : {}),
+    ...(staticPolicy.reasoningEffortMap ? { reasoningEffortMap: { ...staticPolicy.reasoningEffortMap } } : {}),
+    ...(staticPolicy.modelReasoningEffortMap ? { modelReasoningEffortMap: cloneNestedRecord(staticPolicy.modelReasoningEffortMap) } : {}),
     ...(entry.reasoningWireFormat ? { reasoningWireFormat: entry.reasoningWireFormat } : {}),
     ...(entry.noVisionModels ? { noVisionModels: [...entry.noVisionModels] } : {}),
     ...(entry.noReasoningModels ? { noReasoningModels: [...entry.noReasoningModels] } : {}),
@@ -447,13 +456,16 @@ function applyVerbosityDefaults(prov: OcxProviderConfig, entry: ProviderRegistry
  * was skipped and the reasoning ladder was advertised without summary support — exactly the
  * inconsistency that makes Codex drop the inbound reasoning object.
  *
- * Deliberately narrow: reasoning-summary and effort metadata only, via
+ * Deliberately narrow: reasoning-summary, effort, and replay-compatibility metadata only, via
  * `registryEntryForProviderDestination`, which matches fixed key destinations and refuses
  * templated or overridable base URLs. A custom row keeps its own identity for everything else.
  */
 function enrichReasoningMetadataByDestination(prov: OcxProviderConfig): void {
   const destination = registryEntryForProviderDestination(prov);
   applyReasoningSummaryDefaults(prov, destination?.modelSupportsReasoningSummaries);
+  if (prov.dropResponsesReasoningItems === undefined && destination?.dropResponsesReasoningItems !== undefined) {
+    prov.dropResponsesReasoningItems = destination.dropResponsesReasoningItems;
+  }
   if (destination?.modelReasoningEfforts) {
     prov.modelReasoningEfforts = fillRecordOfArrays(destination.modelReasoningEfforts, prov.modelReasoningEfforts);
   }
@@ -491,6 +503,14 @@ export function enrichProviderFromRegistry(name: string, prov: OcxProviderConfig
     modelReasoningEffortMap: prov.modelReasoningEffortMap,
   };
   const seed = providerConfigSeed(entry);
+  const resolvedStatic = resolveModelPolicy({
+    providerName: name,
+    modelId: prov.defaultModel ?? entry.defaultModel ?? "__provider_enrich__",
+    provider: prov,
+    registryEntry: entry,
+    transportMatchedRegistry: true,
+    ...(prov.authMode ? { effectiveAuth: { authMode: prov.authMode } } : {}),
+  }).provider;
   repairStaticModelCatalogProvider(name, prov);
   if (prov.apiKeyTransport === undefined && seed.apiKeyTransport !== undefined) prov.apiKeyTransport = seed.apiKeyTransport;
   if (!prov.defaultModel && seed.defaultModel) prov.defaultModel = seed.defaultModel;
@@ -504,10 +524,8 @@ export function enrichProviderFromRegistry(name: string, prov: OcxProviderConfig
   if (!prov.modelContextWindows && seed.modelContextWindows) prov.modelContextWindows = { ...seed.modelContextWindows };
   // Per-model fill, not all-or-nothing: an operator who renamed ONE model must still receive
   // labels for the rest, and an existing install must pick up newly seeded rows on enrich.
-  if (seed.modelDisplayNames) {
-    prov.modelDisplayNames = { ...seed.modelDisplayNames, ...(prov.modelDisplayNames ?? {}) };
-  }
-  if (seed.modelInputModalities) prov.modelInputModalities = fillRecordOfArrays(seed.modelInputModalities, prov.modelInputModalities);
+  if (resolvedStatic.modelDisplayNames) prov.modelDisplayNames = { ...resolvedStatic.modelDisplayNames };
+  if (resolvedStatic.modelInputModalities) prov.modelInputModalities = cloneRecordOfArrays(resolvedStatic.modelInputModalities);
   if (prov.defaultMaxOutputTokens === undefined && seed.defaultMaxOutputTokens !== undefined) prov.defaultMaxOutputTokens = seed.defaultMaxOutputTokens;
   if (!prov.modelMaxOutputTokens && seed.modelMaxOutputTokens) prov.modelMaxOutputTokens = { ...seed.modelMaxOutputTokens };
   if ((!prov.reasoningEfforts || hasLegacyClinePassReasoningEfforts(name, prov)) && seed.reasoningEfforts) {
@@ -518,9 +536,7 @@ export function enrichProviderFromRegistry(name: string, prov: OcxProviderConfig
   // provider. That split the two planes apart — routing merges these maps per key
   // (mergeRecordFill in src/router.ts), so the wire honored the effort while /v1/models and
   // every client export showed no effort control at all.
-  if (seed.modelReasoningEfforts) {
-    prov.modelReasoningEfforts = fillRecordOfArrays(seed.modelReasoningEfforts, prov.modelReasoningEfforts);
-  }
+  if (resolvedStatic.modelReasoningEfforts) prov.modelReasoningEfforts = cloneRecordOfArrays(resolvedStatic.modelReasoningEfforts);
   if (!prov.modelDefaultReasoningEfforts && seed.modelDefaultReasoningEfforts) prov.modelDefaultReasoningEfforts = { ...seed.modelDefaultReasoningEfforts };
   if (!prov.reasoningEffortMap && seed.reasoningEffortMap) prov.reasoningEffortMap = { ...seed.reasoningEffortMap };
   if (!prov.modelReasoningEffortMap && seed.modelReasoningEffortMap) prov.modelReasoningEffortMap = cloneNestedRecord(seed.modelReasoningEffortMap);
@@ -563,6 +579,7 @@ export function enrichProviderFromRegistry(name: string, prov: OcxProviderConfig
     prov.supportsResponsesCustomTools = entry.supportsResponsesCustomTools;
   }
   if (prov.preserveResponsesReasoningContent === undefined && entry.preserveResponsesReasoningContent !== undefined) prov.preserveResponsesReasoningContent = entry.preserveResponsesReasoningContent;
+  if (prov.dropResponsesReasoningItems === undefined && entry.dropResponsesReasoningItems !== undefined) prov.dropResponsesReasoningItems = entry.dropResponsesReasoningItems;
   applyReasoningSummaryDefaults(prov, entry.modelSupportsReasoningSummaries);
   applyServiceTierModelDefaults(prov, serviceTierModelDefaultsFor(entry, prov));
   applyVerbosityDefaults(prov, entry);

package/src/providers/devin-cli-authmode-migration.ts

@@ -12,14 +12,12 @@
  * key: the `devin-cli` registry entry is gone, so the PROVIDER_REGISTRY lookup
  * that gated the rewrite here could never fire again.
  *
- * The adapter repair must keep working for CUSTOM-NAMED rows. The ACP adapter
- * was removed, so `"devin-cli"` is not a constructible adapter id and
- * `createRegisteredAdapter` would throw `Unknown adapter: devin-cli`. The
- * canonical `devin` row gets its adapter pinned from the registry by
- * `routedProviderConfig`, but a row named e.g. `"devin-acp"` has nothing
- * pinning it and would fail every request. So every row naming the retired
- * adapter is rewritten to `devin`, whatever the row is called, and each
- * rewrite is reported.
+ * Custom-named rows fail closed. The retired ACP transport used the installed
+ * CLI's identity and ignored both configured and caller credentials, so
+ * silently changing one of those rows into a cloud provider could send a
+ * credential with different provenance to Cognition. The warning tells the
+ * operator to reconfigure it explicitly; retaining the unknown adapter id
+ * prevents requests from reaching any upstream in the meantime.
  *
  * A row carrying the retired ACP identity URL is repointed at the api-server
  * in the same pass. That URL was never a destination — it existed only so
@@ -55,10 +53,16 @@ export function projectDevinCliAuthMode(config: OcxConfig): DevinCliAuthModeProj
   const warnings: string[] = [];
   let changed = false;
 
-  // Every row, not only the registry id: a custom-named row had no registry pin,
-  // so after the ACP removal it is the one that cannot construct an adapter.
   for (const [name, row] of Object.entries(config.providers ?? {})) {
     if (!row || row.adapter !== RETIRED_ACP_ADAPTER) continue;
+    if (name !== RETIRED_ACP_ADAPTER) {
+      warnings.push(
+        `left custom provider "${name}" unchanged because adapter ${RETIRED_ACP_ADAPTER} was removed: `
+        + "the row was not migrated; switch its adapter to devin and configure Devin authentication "
+        + "explicitly before using this provider.",
+      );
+      continue;
+    }
     row.adapter = "devin";
     changed = true;
     let detail = "";

package/src/providers/devin-provider-merge-migration.ts

@@ -195,33 +195,54 @@ const DEFAULT_DEPS: DevinProviderMergeStartupDeps = {
  * the snapshot is taken strictly before the save, and a backup failure throws
  * rather than writing without a rollback point.
  *
- * The auth half is deliberately detached. `startServer` is synchronous — an
- * `await` in the boot window would suspend the composition root — and
+ * Both destination slots are inspected before either account-bound file is
+ * changed. The auth write itself is deliberately detached. `startServer` is
+ * synchronous — an `await` in the boot window would suspend the composition root — and
  * `mutateStore` is async-only, so the rekey is fired after its snapshot and
- * its outcome is logged when it lands. That is safe here: the credential is
- * valid under either slot name while the `devin-cli` alias exists, a conflict
- * refuses by design, and a failed rekey simply retries on the next boot.
+ * its outcome is logged when it lands. A late concurrent conflict refuses by
+ * design, and a failed rekey simply retries on the next boot.
  */
 export function runDevinProviderMergeStartupMigration(
   config: OcxConfig,
   deps: DevinProviderMergeStartupDeps = DEFAULT_DEPS,
 ): OcxConfig {
   const projection = deps.project(config);
-  // Warnings are emitted even on a no-op: the collision case IS the warning.
+  const hasSourceConfig = config.providers?.[FROM_ID] !== undefined;
+  const hasSourceAuth = deps.hasAuthSlot(FROM_ID);
+  const hasDestinationAuth = deps.hasAuthSlot(TO_ID);
+
+  // A configured provider and its credentials are one account-bound unit. Do
+  // not move either half if the config projection refused, or if the target
+  // credential slot could belong to another account.
+  if (hasSourceConfig && (!projection.changed || hasDestinationAuth)) {
+    // Projection warnings still matter on a no-op: a config collision is the warning.
+    for (const warning of projection.warnings) console.warn(`[devin-provider-merge] ${warning}`);
+    if (projection.changed && hasDestinationAuth) {
+      console.warn(
+        `[devin-provider-merge] auth.json already has a "${TO_ID}" credential slot; `
+        + `provider "${FROM_ID}" and both credential slots were left untouched. Remove the `
+        + "unused destination credential manually, then restart.",
+      );
+    }
+    return config;
+  }
+
   for (const warning of projection.warnings) console.warn(`[devin-provider-merge] ${warning}`);
+
   let result = config;
   if (projection.changed) {
+    // Snapshot both account-bound files before changing either one.
+    if (hasSourceAuth) deps.backupAuth();
     deps.backupConfig();
     deps.save(projection.config);
     result = projection.config;
   }
 
-  // The auth rekey runs even when the config half refused or had nothing to
-  // do: a `devin-cli` credential slot is orphaned state regardless of whether
-  // a provider row still points at it, and the conflict check inside the
-  // rekey is the same refuse-on-occupied rule the config half applies.
-  if (!deps.hasAuthSlot(FROM_ID)) return result;
-  deps.backupAuth();
+  // With no legacy config row, a `devin-cli` credential slot is orphaned and
+  // can still be rekeyed under the helper's refuse-on-occupied rule. A refused
+  // config migration returned above so its account-bound slot stays put.
+  if (!hasSourceAuth) return result;
+  if (!projection.changed) deps.backupAuth();
   void deps.rekey(FROM_ID, TO_ID).then(outcome => {
     if (outcome === "conflict") {
       console.warn(

package/src/providers/free-directory.ts

@@ -1,3 +1,5 @@
+import { getProviderRegistryEntry } from "./registry";
+
 export type ProviderAccessGroup =
   | "recurring-or-keyless"
   | "recurring-uncapped"
@@ -18,7 +20,7 @@ export const FREE_PROVIDER_ACCESS_GROUPS = {
   ],
   "recurring-credit": ["bytez", "nous-research"],
   "signup-credit": [
-    "agentrouter", "ai21", "baichuan", "baseten", "deepinfra", "deepseek", "doubao", "fireworks", "freemodel-dev", "glm-cn",
+    "agentrouter", "ai21", "baichuan", "baseten", "crusoe", "deepinfra", "deepseek", "doubao", "fireworks", "freemodel-dev", "glm-cn",
     "hyperbolic", "longcat", "monsterapi", "nebius", "novita", "nscale", "nvidia", "predibase", "publicai", "qoder", "qoder-cn",
     "scaleway", "sensenova", "stepfun", "together", "vertex",
   ],
@@ -72,6 +74,21 @@ const openAi = (baseUrl: string, dashboardUrl: string, extra: Partial<Connectabl
   ...extra,
 });
 
+function registryLiveKeyProvider(id: string): ConnectableOverride {
+  const entry = getProviderRegistryEntry(id);
+  if (!entry || entry.authKind !== "key" || !entry.dashboardUrl || entry.liveModels !== true) {
+    throw new TypeError(`Free directory registry projection requires a live key provider with a dashboard: ${id}`);
+  }
+  return {
+    baseUrl: entry.baseUrl,
+    dashboardUrl: entry.dashboardUrl,
+    adapter: entry.adapter,
+    authKind: "key",
+    discovery: "live",
+    liveModels: true,
+  };
+}
+
 // API roots are limited to documented or primary-source integrations. Consumer-web/session
 // providers remain reference-only: this directory never asks users to paste cookies or bypass WAFs.
 const CONNECTABLE: Record<string, ConnectableOverride> = {
@@ -127,6 +144,7 @@ const CONNECTABLE: Record<string, ConnectableOverride> = {
   // Verified end-to-end 2026-07-30: /v1/models returns the OpenAI-shaped live catalog (13 models),
   // and a chat completion against moonshotai/Kimi-K3 returned a standard chat.completion payload.
   baseten: openAi("https://inference.baseten.co/v1", "https://app.baseten.co/settings/api_keys", { supportLevel: "supported", verification: "official", documentationUrl: "https://docs.baseten.co/inference/model-apis/overview", modelsUrl: "https://inference.baseten.co/v1/models", lastVerified: "2026-07-30" }),
+  crusoe: { ...registryLiveKeyProvider("crusoe"), supportLevel: "supported", verification: "official", documentationUrl: "https://docs.crusoecloud.com/quickstart/getting-started-with-serverless-inference", modelsUrl: "https://api.inference.crusoecloud.com/v1/models", lastVerified: "2026-09-11" },
   deepinfra: openAi("https://api.deepinfra.com/v1/openai", "https://deepinfra.com/dash/api_keys", { supportLevel: "supported", verification: "official", documentationUrl: "https://deepinfra.com/docs/openai_api" }),
   deepseek: openAi("https://api.deepseek.com", "https://platform.deepseek.com/api_keys", { supportLevel: "supported", verification: "official", documentationUrl: "https://api-docs.deepseek.com/api/list-models" }),
   doubao: openAi("https://ark.cn-beijing.volces.com/api/v3", "https://console.volcengine.com/ark/region:ark+cn-beijing/apiKey", { verification: "official" }),
@@ -181,7 +199,7 @@ const LABELS: Record<string, string> = {
   "t3-web": "T3 Web", uncloseai: "UncloseAI", ainative: "AI Native", baidu: "Baidu Qianfan",
   glm: "Z.AI GLM", "glm-cn": "BigModel GLM (CN)", "kilo-gateway": "Kilo Gateway", "opencode-zen": "OpenCode Zen",
   sealion: "SEA-LION", bytez: "Bytez", "nous-research": "Nous Research", agentrouter: "AgentRouter",
-  ai21: "AI21", baichuan: "Baichuan", deepinfra: "DeepInfra", deepseek: "DeepSeek", doubao: "Doubao",
+  ai21: "AI21", baichuan: "Baichuan", crusoe: "Crusoe", deepinfra: "DeepInfra", deepseek: "DeepSeek", doubao: "Doubao",
   "freemodel-dev": "FreeModel.dev", sambanova: "SambaNova Cloud", nebius: "Nebius Token Factory",
   novita: "Novita", nscale: "Nscale", nvidia: "NVIDIA NIM",
   publicai: "PublicAI", qoder: "Qoder", "qoder-cn": "Qoder CN", sensenova: "SenseNova", stepfun: "StepFun", vertex: "Google Vertex AI",