@bitkyc08/opencodex 2.58.0 → 2.60.0

package/src/providers/opencode-go-transport.ts

@@ -12,10 +12,12 @@ function hasHeaderCaseInsensitive(
   return Object.keys(headers ?? {}).some(key => key.toLowerCase() === target);
 }
 
-/** Derive a provider-scoped opaque value without exposing Codex task or subagent ids. */
-export function deriveOpenCodeGoSessionId(sessionLane: string): string {
+/** Derive a provider- and wire-scoped opaque value without exposing Codex task or subagent ids. */
+export function deriveOpenCodeGoSessionId(sessionLane: string, wireProtocol: string): string {
   const digest = createHash("sha256")
-    .update("opencodex/opencode-go/session/v1\0")
+    .update("opencodex/opencode-go/session/v2\0")
+    .update(wireProtocol)
+    .update("\0")
     .update(sessionLane)
     .digest("hex")
     .slice(0, 32);
@@ -30,12 +32,19 @@ export function deriveOpenCodeGoSessionId(sessionLane: string): string {
  * request reaching this helper from the proxy always carries a lane. The `!sessionLane` guard stays
  * for direct callers that have no request context; it is not a per-request identity of its own, and
  * minting one here would hand each retry a different value.
+ *
+ * `provider` is already settled onto the final wire, while `destinationProvider` is the original
+ * routed row. Keeping both explicit prevents an Anthropic hard pin from defeating the registry's
+ * adapter-sensitive destination recognition.
  */
 export function resolveOpenCodeGoTransport<T extends OcxProviderConfig>(
   provider: T,
   sessionLane: string | undefined,
+  destinationProvider:
+    Pick<OcxProviderConfig, "baseUrl" | "adapter">
+    & Partial<Pick<OcxProviderConfig, "authMode">>,
 ): T {
-  if (registryEntryForProviderDestination(provider)?.id !== "opencode-go") return provider;
+  if (registryEntryForProviderDestination(destinationProvider)?.id !== "opencode-go") return provider;
   if (!sessionLane) return provider;
   if (hasHeaderCaseInsensitive(provider.headers, OPENCODE_GO_SESSION_HEADER)) return provider;
 
@@ -43,7 +52,7 @@ export function resolveOpenCodeGoTransport<T extends OcxProviderConfig>(
     ...provider,
     headers: {
       ...(provider.headers ?? {}),
-      [OPENCODE_GO_SESSION_HEADER]: deriveOpenCodeGoSessionId(sessionLane),
+      [OPENCODE_GO_SESSION_HEADER]: deriveOpenCodeGoSessionId(sessionLane, provider.adapter),
     },
   };
 }

package/src/providers/quota/antigravity.ts

@@ -1,6 +1,6 @@
 import { antigravityUserAgent } from "../../adapters/client-fingerprint";
 import { DestinationDnsResolutionError } from "../../lib/destination-policy";
-import { PinnedHttpError } from "../../lib/pinned-http";
+import { PinnedHttpError, type PinnedHttpErrorCode } from "../../lib/pinned-http";
 import { ProviderOutboundPolicyError, providerOutboundPost, providerRedirectError, type ProviderOutboundDependencies } from "../../lib/provider-outbound";
 import { getValidAccessToken } from "../../oauth";
 import { getAccountCredential, getCredential } from "../../oauth/store";
@@ -193,10 +193,30 @@ type AntigravityQuotaProbeResult =
   | { kind: "available"; quota: ProviderQuota; source: "google-antigravity:retrieveUserQuotaSummary" | "google-antigravity:fetchAvailableModels" }
   | { kind: "unavailable"; failure: QuotaFailureCode; legacy: { kind: "null" } | { kind: "throw"; error: unknown } };
 
+/**
+ * Every pinned-transport failure code, classified once.
+ *
+ * A conditional that named one code and sent the rest to `timeout` was correct only for as long
+ * as the union held exactly the codes it was written against. When the transport learned to
+ * report a coding it cannot undo, that answer was reported as a timeout, which is a different
+ * operational story entirely. A total map makes a new code a compile error here rather than a
+ * quiet misdiagnosis.
+ */
+const PINNED_QUOTA_FAILURES = {
+  connect_timeout: "timeout",
+  first_byte_timeout: "timeout",
+  inactivity_timeout: "timeout",
+  // The response arrived and cannot be used: too large, coded in a format this transport cannot
+  // undo, or coded bytes that did not decode. None of these is a timing failure.
+  output_byte_limit: "response_unusable",
+  unsupported_content_encoding: "response_unusable",
+  content_decode_failed: "response_unusable",
+} satisfies Record<PinnedHttpErrorCode, QuotaFailureCode>;
+
 function quotaTransportFailure(error: unknown): QuotaFailureCode {
   if (error instanceof ProviderOutboundPolicyError) return "destination_blocked";
   if (error instanceof DestinationDnsResolutionError) return "dns_failed";
-  if (error instanceof PinnedHttpError) return error.code === "output_byte_limit" ? "response_unusable" : "timeout";
+  if (error instanceof PinnedHttpError) return PINNED_QUOTA_FAILURES[error.code];
   if (error instanceof DOMException && error.name === "TimeoutError") return "timeout";
   return "transport_error";
 }

package/src/providers/quota/report-cache.ts

@@ -151,6 +151,9 @@ export function providerQuotaFromCodexQuota(
   const projected: CodexCapacityQuota = {
     ...(quota.shortPercent !== undefined ? { fiveHourPercent: quota.shortPercent } : {}),
     ...(quota.shortResetAt !== undefined ? { fiveHourResetAt: quota.shortResetAt } : {}),
+    // Freshness for the reset-less terminal rule. Without it the dashboard evaluates that rule
+    // with no evidence and returns null while routing refuses the same account (#5045).
+    ...(quota.shortObservedAt !== undefined ? { shortObservedAt: quota.shortObservedAt } : {}),
     ...(quota.weeklyPercent !== undefined ? { weeklyPercent: quota.weeklyPercent } : {}),
     ...(quota.weeklyResetAt !== undefined ? { weeklyResetAt: quota.weeklyResetAt } : {}),
     ...(quota.monthlyPercent !== undefined ? { monthlyPercent: quota.monthlyPercent } : {}),

package/src/providers/quota/vendor-probes-key.ts

@@ -915,7 +915,7 @@ async function fetchNeuralwattQuota(provider: string, config: OcxProviderConfig)
 }
 
 
-function normalizedBaseUrl(value: string): string | null {
+export function normalizedBaseUrl(value: string): string | null {
   try {
     const url = new URL(value);
     if (url.username || url.password || url.search || url.hash) return null;

package/src/providers/registry/entries-core.ts

@@ -30,6 +30,8 @@ import {
   OPENAI_API_GPT56_REASONING_EFFORTS,
   META_MUSE_REASONING_EFFORTS,
   META_MUSE_REASONING_EFFORT_MAP,
+  META_MUSE_CODE_REASONING_EFFORTS,
+  META_MUSE_CODE_REASONING_EFFORT_MAP,
   META_MUSE_CONTEXT_WINDOW,
   META_MUSE_MODELS,
   OPENAI_DAYBREAK_MODELS,
@@ -599,12 +601,15 @@ export const PROVIDER_REGISTRY_CORE: readonly ProviderRegistryEntry[] = [
     label: "Meta Muse Code (CLI credential)",
     adapter: "openai-responses",
     baseUrl: "https://api.meta.ai/v1",
-    // Meta own client sends this on every Muse Code call. We never have, so a future
-    // server-side requirement would break every Muse request with no local signal.
+    // Meta's own client sends these on every Muse Code call. The compatibility marker
+    // is transparent while selecting the credential surface that accepts `max`.
     // Declared here rather than in a transport hook so it also covers model discovery
     // (src/oauth/index.ts:1176) and still yields to a user-set header
     // (mergeRegistryStaticHeaders, src/providers/registry.ts:3494).
-    staticHeaders: { "x-api-version": "1.0.0" },
+    staticHeaders: {
+      "User-Agent": "muse-build/1.3.0 (opencodex compatibility)",
+      "x-api-version": "1.0.0",
+    },
     authKind: "oauth",
     oauthId: "meta-muse",
     dashboardUrl: "https://dev.meta.ai",
@@ -615,8 +620,8 @@ export const PROVIDER_REGISTRY_CORE: readonly ProviderRegistryEntry[] = [
     liveModels: false,
     modelContextWindows: Object.fromEntries(META_MUSE_MODELS.map(id => [id, META_MUSE_CONTEXT_WINDOW])),
     modelInputModalities: Object.fromEntries(META_MUSE_MODELS.map(id => [id, ["text", "image"] as ["text", "image"]])),
-    modelReasoningEfforts: Object.fromEntries(META_MUSE_MODELS.map(id => [id, META_MUSE_REASONING_EFFORTS])),
-    modelReasoningEffortMap: Object.fromEntries(META_MUSE_MODELS.map(id => [id, META_MUSE_REASONING_EFFORT_MAP])),
+    modelReasoningEfforts: Object.fromEntries(META_MUSE_MODELS.map(id => [id, META_MUSE_CODE_REASONING_EFFORTS])),
+    modelReasoningEffortMap: Object.fromEntries(META_MUSE_MODELS.map(id => [id, META_MUSE_CODE_REASONING_EFFORT_MAP])),
     note: "Signs in to Meta with a browser device code on any platform, then mints the Muse Code subscription key. That grant is reimplemented from the one the Muse Code CLI performs and has NOT been exercised against Meta from OpenCodex, so treat the first login as unverified. If the Muse Code CLI is already signed in on macOS, the existing key is imported instead of starting a new grant. A pasted key from https://dev.meta.ai still works as a fallback when a device login cannot complete, and faces the same format check and live validation. A device login authenticates as Meta own Muse Code client, which is a stronger claim than reusing a key the CLI already minted. Meta scopes that credential to the Muse Code CLI, so this is an UNSUPPORTED use: Meta does not authorize subscription coverage outside its own CLI, how these calls settle is not observable from the API, and you should treat every call as billable against your account. The key, imported or pasted, is copied into OpenCodex's auth store. For an account signed in with the device login, OpenCodex refreshes Meta's subscription windows on demand from the same key endpoint the login uses, at most once every five minutes. For an imported or pasted key there is no endpoint to query them on demand, so OpenCodex reads them from streaming responses and shows the last observed value with its age; refreshing one then requires another streaming turn, and translated (non-passthrough) turns report none. Rate limits apply per team, not per key. For a supported path use the meta-model provider with your own key (export it as META_MODEL_API_KEY).",
   },
   {
@@ -652,6 +657,11 @@ export const PROVIDER_REGISTRY_CORE: readonly ProviderRegistryEntry[] = [
     // Zen Go can close a Chat stream after a fully assembled function call without sending
     // finish_reason or [DONE] (#2260). The adapter still rejects incomplete argument JSON.
     openaiChatEofTolerance: true,
+    // Muse Spark on OpenCode Go can sit silent during prolonged reasoning and close without a protocol terminal.
+    modelResponsesTerminalRepair: {
+      "muse-spark-1.2-contributor": { graceMs: 5_000 },
+      "muse-spark-1.3-contributor": { graceMs: 5_000 },
+    },
     // Go rejects reasoning.encrypted_content with previous_response_id (#3838).
     // Use explicit replay history and the existing stateless Responses policy.
     statelessResponses: true,
@@ -696,17 +706,25 @@ export const PROVIDER_REGISTRY_CORE: readonly ProviderRegistryEntry[] = [
       "glm-5.3-flash": ["text", "image"],
       // Experimental DeepSeek vision preview — expected to merge into deepseek-v4-flash later.
       [DEEPSEEK_VISION_PREVIEW_MODEL]: ["text", "image"],
-      // This route is text-only upstream — it is already listed in this preset's
-      // noVisionModels, which routes images through the proxy's vision sidecar and
-      // makes the catalog advertise image input on its behalf. The positive
-      // text-only declaration is what reaches an EXISTING install: derive.ts fills
-      // noVisionModels all-or-nothing, so a config persisted before this id joined
-      // the list keeps a stale list, the sidecar predicate never matches, the row
-      // carries no modality at all, and any combo containing it collapses to
-      // ["text"] (#4505). modelInputModalities IS per-key filled, so this
-      // declaration lands on old configs. It states the route's real upstream
-      // capability and keeps the sidecar explicitly distinct from native vision.
-      "deepseek-v4.1-flash": ["text"],
+      // This route became natively multimodal; it is NOT a sidecar consumer.
+      //
+      // History: the id was declared text-only here and listed in this preset's
+      // noVisionModels, which routed its images through the vision sidecar (#4505).
+      // That classification came from jawcode metadata and went stale. Probed
+      // 2026-09-19 against https://opencode.ai/zen/go/v1/chat/completions with the
+      // headers this proxy sends: the route accepts an image_url part and the model
+      // reads it correctly (a four-band colour chart was described in the right
+      // order). Its sibling deepseek-v4-flash on the same gateway still answers
+      // HTTP 400 "Model only supports text input", which is what keeps the two
+      // distinct here rather than collapsing them.
+      //
+      // The declaration is what reaches an EXISTING install: derive.ts fills
+      // noVisionModels all-or-nothing, so a config persisted while the stale list
+      // was current keeps it forever, and modelInputModalities is filled per-key
+      // BENEATH the saved value. Both halves are repaired by
+      // stale-vision-classification-migration.ts; correcting the registry alone
+      // would fix new installs and leave existing ones stripping images.
+      "deepseek-v4.1-flash": ["text", "image"],
       // Muse Spark Contributor is natively multimodal on Zen Go: it accepts input_image
       // parts over /responses (probed 2026-08-26). Without this declaration the catalog
       // advertises it text-only and the Codex app blocks image attachments client-side with
@@ -760,7 +778,10 @@ export const PROVIDER_REGISTRY_CORE: readonly ProviderRegistryEntry[] = [
     // Kimi K2.7 Code accepts text+image+video: do NOT list it here.
     noVisionModels: [
       "glm-5.3", "glm-5.2", "glm-5", "glm-5.1",
-      "deepseek-v4.1-flash", "deepseek-v4-flash",
+      // deepseek-v4.1-flash is deliberately absent: probed natively multimodal on this
+      // gateway 2026-09-19 (see the modelInputModalities note above). Its sibling
+      // deepseek-v4-flash stays listed — that route rejects image_url upstream.
+      "deepseek-v4-flash",
       "mimo-v2-pro", "mimo-v2.5-pro",
       "minimax-m2.5", "minimax-m2.7",
       "qwen3.7-max",
@@ -1237,3 +1258,4 @@ export const PROVIDER_REGISTRY_CORE: readonly ProviderRegistryEntry[] = [
     note: "Serverless Inference subscription API. Live discovery exposes only kimi-k2-instruct because Vultr documents it as the sole tool-calling model.",
   },
 ];
+

package/src/providers/registry/entries-extended.ts

@@ -98,6 +98,10 @@ import {
   DIGITALOCEAN_CHAT_COMPLETION_MODELS,
   SCALEWAY_SERVERLESS_CHAT_MODELS,
   SCALEWAY_MODEL_INPUT_MODALITIES,
+  OPPER_MODELS,
+  OPPER_MODEL_CONTEXT_WINDOWS,
+  OPPER_MODEL_MAX_OUTPUT_TOKENS,
+  OPPER_MODEL_INPUT_MODALITIES,
 } from "./model-seeds";
 
 export const PROVIDER_REGISTRY_EXTENDED: readonly ProviderRegistryEntry[] = [
@@ -219,6 +223,72 @@ export const PROVIDER_REGISTRY_EXTENDED: readonly ProviderRegistryEntry[] = [
     },
     note: "Shared Token Factory text-output inference only; live discovery excludes embedding and image-generation rows.",
   },
+  {
+    // Primary sources checked 2026-09-11:
+    // - https://docs.crusoecloud.com/quickstart/getting-started-with-serverless-inference documents
+    //   the fixed OpenAI-compatible host https://api.inference.crusoecloud.com/v1, Bearer API keys
+    //   created in the Cloud console (Intelligence Foundry > Inference > Create API Key), and an
+    //   OpenAI SDK chat.completions example against meta-llama/Llama-3.3-70B-Instruct.
+    // - https://docs.crusoecloud.com/serverless-inference/available-models lists the served models
+    //   with slash-delimited ids; https://docs.crusoecloud.com/serverless-inference/rate-limits
+    //   documents per-project, per-model TPM/RPM limits (429 when exceeded, 503 under shared load).
+    // - GET /v1/models rejects unauthenticated requests with 401 {"errors":["Authentication failed"]},
+    //   so a successful authenticated list response is evidence that the supplied key is valid.
+    //   An authenticated capture on 2026-09-12 returned 18 rows shaped like OpenRouter's catalog
+    //   (`is_public`, `type`, `context_length`, `architecture.modality` of "text" or "multimodal",
+    //   `tags`, `pricing`, `supported_parameters`); 17 were public serverless models and one was an
+    //   account-private dedicated deployment with empty `type`/`modality`. `type` is blank on one
+    //   public model, so the filter keys on `is_public` plus `architecture.modality` instead.
+    // - https://legal.crusoe.ai/ hosts the Crusoe Cloud Platform Terms of Service v1.10 (effective
+    //   2026-08-10), which name Crusoe Technologies LLC as the contracting entity, and the Service
+    //   Specific Terms v5.0 (effective 2026-07-14), whose Crusoe Intelligence Foundry Terms cover the
+    //   Managed Inference Service reached through the Crusoe API.
+    // - https://models.dev/api.json (provider "crusoe") records openai/gpt-oss-120b as the one served
+    //   model with a low/medium/high reasoning_effort ladder; the other reasoning models expose an
+    //   on/off toggle only.
+    // Maintainer: @acheamponge, who works at Crusoe (affiliation disclosed) and also maintains the
+    // models.dev crusoe entry.
+    id: "crusoe",
+    label: "Crusoe",
+    baseUrl: "https://api.inference.crusoecloud.com/v1",
+    adapter: "openai-chat",
+    authKind: "key",
+    dashboardUrl: "https://console.crusoecloud.com",
+    liveModels: true,
+    preserveCustomDestination: true,
+    // The getting-started guide documents tools through the OpenAI SDK but no provider-wide
+    // parallel tool-call contract.
+    parallelToolCalls: false,
+    // Only gpt-oss-120b has a real effort ladder; toggle-style reasoning models must not be promoted
+    // to Codex's full fallback ladder.
+    reasoningEfforts: [],
+    modelReasoningEfforts: { "openai/gpt-oss-120b": ["low", "medium", "high"] },
+    directReasoningEffortModels: ["openai/gpt-oss-120b"],
+    // The catalog reports `architecture.modality: "multimodal"` without an input list. Four rows
+    // also carry the explicit "image text to text" tag; yutori/n2 instead reports multimodal
+    // type/modality plus browser/computer-use tags. Those five captured rows are classified here.
+    modelInputModalities: {
+      "google/gemma-4-31b-it": ["text", "image"],
+      "moonshotai/Kimi-K2.6": ["text", "image"],
+      "nvidia/Nemotron-3-Nano-Omni-Reasoning-30B-A3B": ["text", "image"],
+      "yutori/n2": ["text", "image"],
+      "zai-org/GLM-5.3-Flash": ["text", "image"],
+    },
+    modelDiscovery: {
+      path: "models",
+      maxResponseBytes: 256 * 1024,
+      maxModels: 256,
+      filter: {
+        // Keep public serverless rows whose architecture produces text; account-private
+        // deployments (blank modality) and any embedding or media rows fail closed.
+        allOf: [
+          { path: ["is_public"], equalsAny: [true] },
+          { path: ["architecture", "modality"], equalsAny: ["text", "multimodal"] },
+        ],
+      },
+    },
+    note: "Public Serverless Inference chat models on the shared OpenAI-compatible host; account-private and self-serve dedicated deployments are excluded from discovery and out of scope.",
+  },
   {
     id: "digitalocean",
     label: "DigitalOcean Serverless Inference",
@@ -676,9 +746,22 @@ export const PROVIDER_REGISTRY_EXTENDED: readonly ProviderRegistryEntry[] = [
     id: "volcengine-coding-plan",
     label: "Volcengine Ark Coding Plan",
     baseUrl: "https://ark.cn-beijing.volces.com/api/coding/v3",
-    adapter: "openai-chat",
+    responsesPath: "/responses",
+    adapter: "openai-responses",
     authKind: "key",
+    supportsServiceTier: false,
     preserveCustomDestination: true,
+    // A row already saved on Chat keeps Chat. This is a `preserveCustomDestination` key entry,
+    // so `providerMatchesRegistryTransport` refuses the adapter mismatch and the request path
+    // returns the stored row untouched; the alias below still hands it this entry's metadata.
+    // Deliberately no startup config migration: the Z.AI one (`zai-responses-migration.ts`) is
+    // safe only because it rewrites rows the router already canonicalizes, and it gates on
+    // `providerMatchesRegistryTransport` to guarantee that. A Chat row here is NOT canonicalized,
+    // so migrating it would change a wire the operator is actually using, and a marker added
+    // now cannot tell the old default apart from a deliberate pre-upgrade Chat choice.
+    destinationAliases: [{ baseUrl: "https://ark.cn-beijing.volces.com/api/coding/v3", adapter: "openai-chat" }],
+    // Validated Ark Coding Plan continuations reject replayed reasoning items.
+    dropResponsesReasoningItems: true,
     dashboardUrl: "https://console.volcengine.com/ark/region:ark+cn-beijing/overview",
     defaultModel: "ark-code-latest",
     models: VOLCENGINE_CODING_PLAN_MODELS,
@@ -728,6 +811,21 @@ export const PROVIDER_REGISTRY_EXTENDED: readonly ProviderRegistryEntry[] = [
     defaultModel: "qwen3.8-max",
     models: ALIBABA_TOKEN_PLAN_MODELS,
     liveModels: false,
+    // Alibaba documents an OpenAI-compatible Responses API on this same /compatible-mode/v1 base
+    // and ships an official Codex integration guide on wire_api = "responses" (#5097). The
+    // gateway serves the same models over both wires, and qwen3.8-flash, qwen3.7-plus and
+    // glm-5.3 carry live end-to-end evidence there (custom tools, reasoning replay, streaming,
+    // multi-turn continuation).
+    //
+    // That is deliberately NOT expressed as a modelWireDefaults pin. Pinning would move every
+    // existing Codex user of those models onto a different upstream with no config change, and
+    // one delta is unresolved: preserveReasoningContentModels below is read by the CHAT adapter,
+    // while the Responses serializer reads preserveResponsesReasoningContent, which this entry
+    // does not set. On the Responses wire those models would replay with blanked reasoning
+    // content -- less state than they carry today. Z.AI and DeepSeek set both flags together for
+    // exactly this reason. Until that flag is justified against this gateway, Responses stays a
+    // documented per-model modelAdapters opt-in;
+    // tests/providers/alibaba-token-plan-responses-optin.test.ts holds both halves.
     note: "Token Plan Personal Edition · China (Beijing)",
     modelInputModalities: ALIBABA_TOKEN_PLAN_INPUT_MODALITIES,
     modelContextWindows: ALIBABA_TOKEN_PLAN_CONTEXT_WINDOWS,
@@ -736,6 +834,7 @@ export const PROVIDER_REGISTRY_EXTENDED: readonly ProviderRegistryEntry[] = [
       ...Object.fromEntries(ALIBABA_TOKEN_PLAN_QWEN_MODELS.map(id => [id, THINKING_BUDGET_EFFORTS])),
       ...Object.fromEntries(QWEN38_FAMILY.map(id => [id, QWEN38_REASONING_EFFORTS])),
       "glm-5.2": ZAI_GLM_52_REASONING_EFFORTS,
+      "glm-5.3": ZAI_GLM_53_REASONING_EFFORTS,
       "deepseek-v4-pro": deepseekThinkingEffortsFor("deepseek-v4-pro"),
       "deepseek-v4-pro-0813": deepseekThinkingEffortsFor("deepseek-v4-pro-0813"),
       "deepseek-v4-flash-0731": deepseekThinkingEffortsFor("deepseek-v4-flash-0731"),
@@ -781,6 +880,7 @@ export const PROVIDER_REGISTRY_EXTENDED: readonly ProviderRegistryEntry[] = [
       ...Object.fromEntries(ALIBABA_INTL_TOKEN_PLAN_QWEN_MODELS.map(id => [id, THINKING_BUDGET_EFFORTS])),
       ...Object.fromEntries(QWEN38_FAMILY.map(id => [id, QWEN38_REASONING_EFFORTS])),
       "glm-5.2": ZAI_GLM_52_REASONING_EFFORTS,
+      "glm-5.3": ZAI_GLM_53_REASONING_EFFORTS,
       "deepseek-v4-pro": deepseekThinkingEffortsFor("deepseek-v4-pro"),
       "deepseek-v4-pro-0813": deepseekThinkingEffortsFor("deepseek-v4-pro-0813"),
       "deepseek-v4-flash": deepseekThinkingEffortsFor("deepseek-v4-flash"),
@@ -955,8 +1055,37 @@ export const PROVIDER_REGISTRY_EXTENDED: readonly ProviderRegistryEntry[] = [
     // Same DeepSeek routes as the Go preset above, behind the same vendor, so they carry
     // the same json_schema rejection (#1338 / #1415).
     noJsonSchemaModels: [...DEEPSEEK_GATEWAY_THINKING_MODELS, ...OPENCODE_FREE_DEEPSEEK_MODELS],
+    // Muse Spark on Zen can sit silent during prolonged reasoning and close without a protocol terminal.
+    modelResponsesTerminalRepair: {
+      "muse-spark-1.2-contributor-free": { graceMs: 5_000 },
+      "muse-spark-1.3-contributor-free": { graceMs: 5_000 },
+    },
   },
   { id: "vercel-ai-gateway", label: "Vercel AI Gateway", baseUrl: "https://ai-gateway.vercel.sh/v1", adapter: "openai-chat", authKind: "key", dashboardUrl: "https://vercel.com/dashboard" },
+  {
+    // Opper: EU-hosted AI gateway (Opper AI AB, Stockholm). One OpenAI-compatible endpoint and one
+    // key in front of 30+ upstream providers. Seeded ids are Opper *pools* (bare names such as
+    // `claude-sonnet-4-6`): the gateway chooses the provider/region per request, and a
+    // `vendor/model` id (`anthropic/claude-sonnet-4-6`, `aws/claude-sonnet-4-6-eu`) pins one route.
+    // The original provider author reported on 2026-09-08 that GET /v3/compat/models answers 401
+    // without a key, so the default discovery URL doubles as key validation. Windows, output caps
+    // and modalities live in model-seeds.ts (smallest value / shared modality across each pool's
+    // members); live discovery owns which models exist.
+    id: "opper",
+    label: "Opper",
+    adapter: "openai-chat",
+    baseUrl: "https://api.opper.ai/v3/compat",
+    authKind: "key",
+    dashboardUrl: "https://platform.opper.ai",
+    liveModels: true,
+    preserveCustomDestination: true,
+    defaultModel: "claude-sonnet-4-6",
+    models: OPPER_MODELS,
+    modelContextWindows: OPPER_MODEL_CONTEXT_WINDOWS,
+    modelMaxOutputTokens: OPPER_MODEL_MAX_OUTPUT_TOKENS,
+    modelInputModalities: OPPER_MODEL_INPUT_MODALITIES,
+    note: "EU-hosted AI gateway: one OpenAI-compatible endpoint and one key in front of 30+ providers. Bare model ids are pools (claude-sonnet-4-6, gpt-5.5) and Opper picks the route per request; vendor/model ids (anthropic/claude-sonnet-4-6) pin one provider. The catalogue is discovered live from /v3/compat/models with your key; the public list is at opper.ai/models. Token rates are the model providers' rates with no markup; Opper charges a 3% fee when you buy credits.",
+  },
   {
     id: "opencode-free",
     label: "OpenCode Free",
@@ -1233,3 +1362,4 @@ export const PROVIDER_REGISTRY_EXTENDED: readonly ProviderRegistryEntry[] = [
     note: "Official CodeBuddy Code CLI (Tencent Cloud), China/internal environment. Uses the documented CODEBUDDY_API_KEY + headless CLI surface; never reads desktop sessions or private console endpoints. Region-isolated from codebuddy (Global); credentials are never exchanged across regions. v1 disables CLI tools (--tools \"\"): text/reasoning only for now. Requires `npm i -g @tencent-ai/codebuddy-code`. AUP/routing authorization flagged for maintainer security review.",
   },
 ];
+

package/src/providers/registry/model-ids.ts

@@ -0,0 +1,168 @@
+import type { ProviderRegistryEntry } from "./types";
+
+/**
+ * What a registry field's KEYS mean for selector decoding.
+ *
+ * An encoded selector is decoded against the native model ids a provider is known to accept.
+ * That set used to be a hand-written list of eight registry maps, so an id declared only in an
+ * unlisted map could not be decoded, and every new model-keyed field had to be remembered.
+ *
+ * Every field of ProviderRegistryEntry is classified below, including the ones that carry no
+ * model identity at all. That is deliberate: the "satisfies" check makes a new registry field a
+ * TYPE error until somebody decides what its keys mean, rather than letting it default to
+ * invisible. The two checks are different and both matter - the satisfies clause proves the
+ * classification is exhaustive when this compiles, and the parity test proves the fields the
+ * shipped registry actually carries are the ones classified here.
+ *
+ * These are decode hints and nothing more. A hint does not publish a catalog row, grant
+ * availability or entitlement, and it does not confer transport authority: the caller still
+ * checks registry transport identity before asking for them, and an ambiguous selector is still
+ * rejected rather than guessed.
+ */
+type RegistryFieldModelIdRole =
+  | { readonly kind: "none" }
+  | { readonly kind: "record-keys" }
+  | { readonly kind: "nested-record-keys"; readonly key: "modelSupportsServiceTier" };
+
+const NONE = { kind: "none" } as const;
+const RECORD_KEYS = { kind: "record-keys" } as const;
+/**
+ * Key-auth declares its own service-tier support under a nested map.
+ *
+ * Reading its keys is identity evidence only. It does not activate the key-auth service tier,
+ * which stays the business of the service-tier resolver.
+ */
+const KEY_AUTH_SERVICE_TIER = { kind: "nested-record-keys", key: "modelSupportsServiceTier" } as const;
+
+/**
+ * Not a configuration surface. Exported so the parity suite can compare this classification
+ * against the fields the shipped registry entries actually carry at runtime.
+ */
+export const REGISTRY_FIELD_MODEL_ID_ROLES = {
+  id: NONE,
+  label: NONE,
+  adapter: NONE,
+  baseUrl: NONE,
+  apiKeyTransport: NONE,
+  alias: NONE,
+  authKind: NONE,
+  codexAccountMode: NONE,
+  allowKeyAuthOverride: NONE,
+  allowPrivateNetworkByDefault: NONE,
+  keyOptional: NONE,
+  apiKeyValidation: NONE,
+  freeTier: NONE,
+  allowBaseUrlOverride: NONE,
+  preserveCustomDestination: NONE,
+  baseUrlChoices: NONE,
+  staticHeaders: NONE,
+  modelSuffixBracketStrip: NONE,
+  featured: NONE,
+  sponsor: NONE,
+  dashboardPreset: NONE,
+  note: NONE,
+  dashboardUrl: NONE,
+  defaultModel: NONE,
+  models: NONE,
+  liveModels: NONE,
+  modelWireDefaults: RECORD_KEYS,
+  fastWire: NONE,
+  modelResponsesUpstreamStreaming: RECORD_KEYS,
+  modelResponsesTerminalRepair: RECORD_KEYS,
+  responsesItemIdRepair: NONE,
+  responsesPath: NONE,
+  chatCompletionsPath: NONE,
+  destinationAliases: NONE,
+  statelessResponses: NONE,
+  requiresAdjacentResponsesToolResults: NONE,
+  requiresPairedResponsesToolResults: NONE,
+  annotateEmptyToolOutputs: NONE,
+  supportsServiceTier: NONE,
+  supportsOpenAiWebSearchToolFields: NONE,
+  supportsResponsesCustomTools: NONE,
+  modelSupportsServiceTier: RECORD_KEYS,
+  keyAuthServiceTier: KEY_AUTH_SERVICE_TIER,
+  fastTierDescription: NONE,
+  modelServiceTierCapabilityBaseUrlGuard: NONE,
+  preserveResponsesReasoningContent: NONE,
+  dropResponsesReasoningItems: NONE,
+  modelSupportsReasoningSummaries: RECORD_KEYS,
+  modelSupportsVerbosity: RECORD_KEYS,
+  supportsVerbosity: NONE,
+  modelDiscovery: NONE,
+  contextWindow: NONE,
+  modelContextWindows: RECORD_KEYS,
+  modelDisplayNames: RECORD_KEYS,
+  modelInputModalities: RECORD_KEYS,
+  defaultMaxOutputTokens: NONE,
+  modelMaxOutputTokens: RECORD_KEYS,
+  reasoningEfforts: NONE,
+  modelReasoningEfforts: RECORD_KEYS,
+  modelDefaultReasoningEfforts: RECORD_KEYS,
+  reasoningEffortMap: NONE,
+  modelReasoningEffortMap: RECORD_KEYS,
+  directReasoningEffortModels: NONE,
+  reasoningWireFormat: NONE,
+  noVisionModels: NONE,
+  noReasoningModels: NONE,
+  noTemperatureModels: NONE,
+  noTopPModels: NONE,
+  noPenaltyModels: NONE,
+  noJsonSchemaModels: NONE,
+  parallelToolCalls: NONE,
+  promptCacheKey: NONE,
+  chatServiceTier: NONE,
+  openaiChatEofTolerance: NONE,
+  autoToolChoiceOnlyModels: NONE,
+  preserveReasoningContentModels: NONE,
+  requiresReasoningPlaceholderModels: NONE,
+  showThinkingSummary: NONE,
+  reasoningSplitModels: NONE,
+  reasoningDetailsModels: NONE,
+  thinkingToggleModels: NONE,
+  thinkingBudgetModels: NONE,
+  escapeBuiltinToolNames: NONE,
+  oauthId: NONE,
+  virtualModels: RECORD_KEYS,
+  modelMaxInputTokens: RECORD_KEYS,
+  jawcodeBundle: NONE,
+  extraMetadataAliases: NONE,
+  metadataModelIdNormalize: NONE,
+  googleMode: NONE,
+  project: NONE,
+  location: NONE,
+} satisfies Record<keyof ProviderRegistryEntry, RegistryFieldModelIdRole>;
+
+/**
+ * The native model ids this registry entry names, in registry-field order, first seen wins.
+ *
+ * Only KEYS are collected. virtualModels is a map whose keys are the selected identities and
+ * whose values name a transport target, so its wireModelId values are deliberately not read:
+ * a wire target is not something a client may select by name.
+ */
+export function registryModelIdKeys(entry: ProviderRegistryEntry): readonly string[] {
+  const ids: string[] = [];
+  const seen = new Set<string>();
+  const add = (key: string): void => {
+    if (key.length === 0 || seen.has(key)) return;
+    seen.add(key);
+    ids.push(key);
+  };
+  for (const field of Object.keys(REGISTRY_FIELD_MODEL_ID_ROLES) as (keyof ProviderRegistryEntry)[]) {
+    const role = REGISTRY_FIELD_MODEL_ID_ROLES[field];
+    if (role.kind === "none") continue;
+    if (role.kind === "record-keys") {
+      const map = entry[field];
+      if (typeof map !== "object" || map === null) continue;
+      for (const key of Object.keys(map)) add(key);
+      continue;
+    }
+    // The nested role belongs to keyAuthServiceTier alone, so its owner is read by name.
+    // ProviderRegistryEntry is an interface and carries no implicit index signature, so a
+    // by-name read is what keeps this loop typed instead of asserted through unknown.
+    const nested = entry.keyAuthServiceTier?.[role.key];
+    if (typeof nested !== "object" || nested === null) continue;
+    for (const key of Object.keys(nested)) add(key);
+  }
+  return Object.freeze(ids);
+}