@bitkyc08/opencodex 2.58.0 → 2.60.0

package/src/router.ts

@@ -15,10 +15,12 @@ import { assertProviderDestinationAllowed } from "./lib/destination-policy";
 import { redactSecretString, redactUrlForLog } from "./lib/redact";
 import {
   PROVIDER_REGISTRY,
-  mergeRegistryStaticHeaders,
   providerCodexAccountMode,
-  registryModelServiceTierCapabilityApplies,
+  registryEntryForProviderDestination,
 } from "./providers/registry";
+// Imported from the module directly rather than through the registry facade, which is at its
+// file-size cap.
+import { registryModelIdKeys } from "./providers/registry/model-ids";
 import { applyDirectReasoningEffortContracts, hasLegacyClinePassReasoningEfforts } from "./providers/derive";
 import { cloneFastWire } from "./providers/fastwire";
 import {
@@ -29,11 +31,10 @@ import {
   isCanonicalOpenAiForwardProvider,
   LEGACY_CHATGPT_PROVIDER_ID,
   LEGACY_OPENAI_MULTI_PROVIDER_ID,
-  OPENAI_API_PROVIDER_ID,
   OPENAI_CODEX_PROVIDER_ID,
 } from "./providers/openai-tiers";
 import { decodeRoutedModelIdOrThrow, encodeRoutedModelId } from "./providers/slug-codec";
-import { resolveModelAlias } from "./providers/default-aliases";
+import { effectiveProviderAliasDecision, resolveModelAlias } from "./providers/default-aliases";
 import { resolveBlockedModelRedirect } from "./lib/shadow-call";
 import { getStaleCached } from "./codex/model-cache";
 import { codexAccountNamespaceEntries } from "./codex/account-namespaces";
@@ -46,6 +47,7 @@ import {
 import { getRoutingProfile, resolvePolicyProfileId, POLICY_NAMESPACE } from "./routing/profile";
 import { evaluatePolicyProfile, type PolicyRequestEvidence } from "./routing/evaluator";
 import { assemblePolicyCandidateEvidence } from "./routing/compatibility/assemble";
+import { resolveModelPolicy, type ResolvedModelPolicy } from "./providers/resolved-model-policy";
 
 export class UnknownRoutingPolicyError extends Error {
   constructor(readonly profileId: string) {
@@ -69,6 +71,8 @@ export interface RouteResult {
   providerName: string;
   provider: OcxProviderConfig;
   modelId: string;
+  /** Immutable static policy for the current final wire model. */
+  staticPolicy: ResolvedModelPolicy;
   /** Which deterministic routing path produced this route (RI-01). */
   routeKind: RouteDecisionKind;
   /** Stable wire reason code for the selected route (RI-01). */
@@ -83,6 +87,29 @@ export interface RouteResult {
   routeDecision?: RouteDecisionTraceV1;
 }
 
+export function captureRouteStaticPolicy(
+  providerName: string,
+  modelId: string,
+  provider: OcxProviderConfig,
+  effectiveAlias?: string | null,
+  inboundWire: "responses" | "chat" | "anthropic" = "responses",
+): ResolvedModelPolicy {
+  const registryEntry = PROVIDER_REGISTRY.find(entry => entry.id === providerName);
+  const transportMatchedRegistry = !!registryEntry
+    && providerMatchesRegistryTransportWithStaticGuards(providerName, provider);
+  return resolveModelPolicy({
+    providerName,
+    modelId,
+    provider,
+    registryEntry,
+    transportMatchedRegistry,
+    inboundWire,
+    modelCapabilities: provider.modelCapabilities?.[modelId],
+    ...(provider.authMode ? { effectiveAuth: { authMode: provider.authMode } } : {}),
+    ...(effectiveAlias !== undefined ? { effectiveAlias } : {}),
+  });
+}
+
 const MODEL_PROVIDER_PATTERNS: Array<{ providerNames: string[]; prefixes: string[] }> = [
   {
     providerNames: ["anthropic"],
@@ -117,19 +144,11 @@ export function knownModelIdsForProvider(
     : undefined;
   for (const id of registry?.models ?? []) ids.add(id);
   // Registry model-keyed hint maps double as known native ids (e.g. NVIDIA carries no
-  // static models list but names `moonshotai/kimi-k2.6` in its effort/window maps).
-  for (const map of [
-    registry?.modelContextWindows,
-    registry?.modelInputModalities,
-    registry?.modelReasoningEfforts,
-    registry?.modelDefaultReasoningEfforts,
-    registry?.modelReasoningEffortMap,
-    registry?.modelMaxOutputTokens,
-    registry?.modelSupportsServiceTier,
-    registry?.modelSupportsVerbosity,
-  ]) {
-    for (const id of Object.keys(map ?? {})) ids.add(id);
-  }
+  // static models list but names `moonshotai/kimi-k2.6` in its effort/window maps). Which
+  // maps count is classified by the registry itself rather than listed here, so an id declared
+  // only in a map this function forgot is no longer undecodable, and a new model-keyed field
+  // fails typecheck until its keys are given a meaning.
+  for (const id of registry ? registryModelIdKeys(registry) : []) ids.add(id);
   for (const cached of getStaleCached(provName) ?? []) ids.add(cached.id);
   for (const model of config?.customModels ?? []) {
     if (model.provider === provName && model.modelId) ids.add(model.modelId);
@@ -137,66 +156,6 @@ export function knownModelIdsForProvider(
   return [...ids];
 }
 
-// Merge registry-default effort maps under user values so built-in provider configs can
-// carry real upstream aliases without a disk migration. User overrides win per-key.
-function mergeRecord(
-  seed: Record<string, string> | undefined,
-  user: Record<string, string> | undefined,
-): Record<string, string> | undefined {
-  if (!seed && !user) return undefined;
-  return { ...(seed ?? {}), ...(user ?? {}) };
-}
-
-function mergeNestedRecord(
-  seed: Record<string, Record<string, string>> | undefined,
-  user: Record<string, Record<string, string>> | undefined,
-): Record<string, Record<string, string>> | undefined {
-  if (!seed && !user) return undefined;
-  const out: Record<string, Record<string, string>> = {};
-  for (const [key, value] of Object.entries(seed ?? {})) out[key] = { ...value };
-  for (const [key, value] of Object.entries(user ?? {})) out[key] = { ...(out[key] ?? {}), ...value };
-  return out;
-}
-
-function mergeStringArray(
-  seed: string[] | undefined,
-  user: string[] | undefined,
-): string[] | undefined {
-  if (!seed && !user) return undefined;
-  return [...new Set([...(seed ?? []), ...(user ?? [])])];
-}
-
-function mergeRecordFill<T>(
-  seed: Record<string, T> | undefined,
-  user: Record<string, T> | undefined,
-): Record<string, T> | undefined {
-  if (!seed && !user) return undefined;
-  return { ...(seed ?? {}), ...(user ?? {}) };
-}
-
-function mergePositiveNumberCaps(
-  seed: Record<string, number> | undefined,
-  user: Record<string, number> | undefined,
-): Record<string, number> | undefined {
-  if (!seed && !user) return undefined;
-  const out = { ...(seed ?? {}) };
-  for (const [key, value] of Object.entries(user ?? {})) {
-    out[key] = typeof out[key] === "number" ? Math.min(out[key]!, value) : value;
-  }
-  return out;
-}
-
-function mergeStringArrayRecord(
-  seed: Record<string, string[]> | undefined,
-  user: Record<string, string[]> | undefined,
-): Record<string, string[]> | undefined {
-  if (!seed && !user) return undefined;
-  const out: Record<string, string[]> = {};
-  for (const [key, value] of Object.entries(seed ?? {})) out[key] = [...value];
-  for (const [key, value] of Object.entries(user ?? {})) out[key] = [...value];
-  return out;
-}
-
 /** Same endpoint modulo surrounding space and trailing slashes — matches `matchBaseUrlChoice`. */
 function isSameEndpoint(a: string, b: string): boolean {
   return a.trim().replace(/\/+$/, "") === b.trim().replace(/\/+$/, "");
@@ -302,7 +261,20 @@ export function routedProviderConfig(providerName: string, provider: OcxProvider
   const registryEntry = PROVIDER_REGISTRY.find(entry => entry.id === providerName);
   if (!registryEntry || !providerMatchesRegistryTransportWithStaticGuards(providerName, provider)) {
     assertProviderDestinationAllowed(providerName, provider);
-    return { ...provider, apiKey: usableResolvedApiKey(provider.apiKey) };
+    // A row whose adapter no longer matches its registry entry still reaches the Responses
+    // adapter when one model opts in through `modelAdapters` — a Volcengine Coding Plan config
+    // saved on Chat, for instance. The replay-drop flag belongs to the DESTINATION rather than
+    // to the provider-wide wire, so it is filled here too; without it that continuation forwards
+    // the reasoning item the upstream answers 400 to. Destination matching refuses templated and
+    // overridable base URLs, so this cannot follow a retargeted row, and an explicit value wins.
+    const destination = registryEntryForProviderDestination(provider);
+    return {
+      ...provider,
+      apiKey: usableResolvedApiKey(provider.apiKey),
+      ...(provider.dropResponsesReasoningItems === undefined && destination?.dropResponsesReasoningItems !== undefined
+        ? { dropResponsesReasoningItems: destination.dropResponsesReasoningItems }
+        : {}),
+    };
   }
   const resolvedApiKey = usableResolvedApiKey(provider.apiKey);
   const staticModelCatalog = !providerSupportsLiveModelDiscovery(providerName, provider);
@@ -317,46 +289,42 @@ export function routedProviderConfig(providerName: string, provider: OcxProvider
       : registryEntry.authKind === "forward" || registryEntry.authKind === "oauth"
         ? registryEntry.authKind
         : provider.authMode === "forward" ? undefined : provider.authMode;
-  const reasoningEffortMap = mergeRecord(registryEntry.reasoningEffortMap, provider.reasoningEffortMap);
-  const modelReasoningEffortMap = mergeNestedRecord(registryEntry.modelReasoningEffortMap, provider.modelReasoningEffortMap);
-  const modelReasoningEfforts = mergeStringArrayRecord(registryEntry.modelReasoningEfforts, provider.modelReasoningEfforts);
-  const modelDefaultReasoningEfforts = mergeRecordFill(registryEntry.modelDefaultReasoningEfforts, provider.modelDefaultReasoningEfforts);
-  const modelContextWindows = providerName === OPENAI_API_PROVIDER_ID
-    ? mergePositiveNumberCaps(registryEntry.modelContextWindows, provider.modelContextWindows)
-    : mergeRecordFill(registryEntry.modelContextWindows, provider.modelContextWindows);
-  const modelInputModalities = mergeRecordFill(registryEntry.modelInputModalities, provider.modelInputModalities);
+  const staticPolicy = resolveModelPolicy({
+    providerName,
+    modelId: "__provider_static__",
+    provider,
+    registryEntry,
+    transportMatchedRegistry: true,
+    ...(canonicalAuthMode ? { effectiveAuth: { authMode: canonicalAuthMode } } : {}),
+  }).provider;
+  const reasoningEffortMap = staticPolicy.reasoningEffortMap;
+  const modelReasoningEffortMap = staticPolicy.modelReasoningEffortMap;
+  const modelReasoningEfforts = staticPolicy.modelReasoningEfforts;
+  const modelDefaultReasoningEfforts = staticPolicy.modelDefaultReasoningEfforts;
+  const modelContextWindows = staticPolicy.modelContextWindows;
+  const modelInputModalities = staticPolicy.modelInputModalities;
   // Registry static headers are documented as applying to every upstream request, so they are
   // filled at resolve time rather than only at seed time: a config written before a header
   // existed, or one carrying any header of its own, would otherwise never receive it. User
   // headers win, matched case-insensitively so an override replaces rather than duplicates.
-  const headers = mergeRegistryStaticHeaders(registryEntry.staticHeaders, provider.headers);
-  const modelMaxInputTokens = providerName === OPENAI_API_PROVIDER_ID
-    ? mergePositiveNumberCaps(registryEntry.modelMaxInputTokens, provider.modelMaxInputTokens)
-    : mergeRecordFill(registryEntry.modelMaxInputTokens, provider.modelMaxInputTokens);
-  const modelMaxOutputTokens = mergeRecordFill(registryEntry.modelMaxOutputTokens, provider.modelMaxOutputTokens);
-  const modelSupportsServiceTier = mergeRecordFill(
-    registryModelServiceTierCapabilityApplies(registryEntry, provider)
-      ? registryEntry.modelSupportsServiceTier
-      : undefined,
-    provider.modelSupportsServiceTier,
-  );
-  const modelSupportsVerbosity = mergeRecordFill(
-    registryEntry.modelSupportsVerbosity,
-    provider.modelSupportsVerbosity,
-  );
-  const noVisionModels = mergeStringArray(registryEntry.noVisionModels, provider.noVisionModels);
-  const noReasoningModels = mergeStringArray(registryEntry.noReasoningModels, provider.noReasoningModels);
-  const noTemperatureModels = mergeStringArray(registryEntry.noTemperatureModels, provider.noTemperatureModels);
-  const noTopPModels = mergeStringArray(registryEntry.noTopPModels, provider.noTopPModels);
-  const noPenaltyModels = mergeStringArray(registryEntry.noPenaltyModels, provider.noPenaltyModels);
-  const noJsonSchemaModels = mergeStringArray(registryEntry.noJsonSchemaModels, provider.noJsonSchemaModels);
-  const autoToolChoiceOnlyModels = mergeStringArray(registryEntry.autoToolChoiceOnlyModels, provider.autoToolChoiceOnlyModels);
-  const preserveReasoningContentModels = mergeStringArray(registryEntry.preserveReasoningContentModels, provider.preserveReasoningContentModels);
-  const requiresReasoningPlaceholderModels = mergeStringArray(registryEntry.requiresReasoningPlaceholderModels, provider.requiresReasoningPlaceholderModels);
-  const reasoningSplitModels = mergeStringArray(registryEntry.reasoningSplitModels, provider.reasoningSplitModels);
-  const reasoningDetailsModels = mergeStringArray(registryEntry.reasoningDetailsModels, provider.reasoningDetailsModels);
-  const thinkingToggleModels = mergeStringArray(registryEntry.thinkingToggleModels, provider.thinkingToggleModels);
-  const thinkingBudgetModels = mergeStringArray(registryEntry.thinkingBudgetModels, provider.thinkingBudgetModels);
+  const headers = staticPolicy.headers;
+  const modelMaxInputTokens = staticPolicy.modelMaxInputTokens;
+  const modelMaxOutputTokens = staticPolicy.modelMaxOutputTokens;
+  const modelSupportsServiceTier = staticPolicy.modelSupportsServiceTier;
+  const modelSupportsVerbosity = staticPolicy.modelSupportsVerbosity;
+  const noVisionModels = staticPolicy.noVisionModels;
+  const noReasoningModels = staticPolicy.noReasoningModels;
+  const noTemperatureModels = staticPolicy.noTemperatureModels;
+  const noTopPModels = staticPolicy.noTopPModels;
+  const noPenaltyModels = staticPolicy.noPenaltyModels;
+  const noJsonSchemaModels = staticPolicy.noJsonSchemaModels;
+  const autoToolChoiceOnlyModels = staticPolicy.autoToolChoiceOnlyModels;
+  const preserveReasoningContentModels = staticPolicy.preserveReasoningContentModels;
+  const requiresReasoningPlaceholderModels = staticPolicy.requiresReasoningPlaceholderModels;
+  const reasoningSplitModels = staticPolicy.reasoningSplitModels;
+  const reasoningDetailsModels = staticPolicy.reasoningDetailsModels;
+  const thinkingToggleModels = staticPolicy.thinkingToggleModels;
+  const thinkingBudgetModels = staticPolicy.thinkingBudgetModels;
   const registryBaseUrlIsTemplate = /\{[^}]*\}/.test(registryEntry.baseUrl);
   const userBaseUrl = typeof provider.baseUrl === "string" ? provider.baseUrl.trim() : "";
   const userBaseUrlIsResolved = userBaseUrl.length > 0 && !/\{[^}]*\}/.test(userBaseUrl);
@@ -417,6 +385,9 @@ export function routedProviderConfig(providerName: string, provider: OcxProvider
     ...(provider.preserveResponsesReasoningContent === undefined && registryEntry.preserveResponsesReasoningContent !== undefined
       ? { preserveResponsesReasoningContent: registryEntry.preserveResponsesReasoningContent }
       : {}),
+    ...(provider.dropResponsesReasoningItems === undefined && registryEntry.dropResponsesReasoningItems !== undefined
+      ? { dropResponsesReasoningItems: registryEntry.dropResponsesReasoningItems }
+      : {}),
     // The request path resolves through routedProviderConfig() and never calls
     // enrichProviderFromRegistry(), so a saved provider row written before the
     // registry learned this flag must be backfilled here or route.provider never
@@ -565,10 +536,15 @@ function routeResult(
   const effectiveModelId = redirected ?? modelId;
   const effectiveRouteReason = redirected ? "blocked-model-redirect" : routeReason;
   const codexAccountMode = providerCodexAccountMode(providerName, provider);
+  const routedProvider = routedProviderConfig(providerName, provider);
+  const effectiveAlias = config
+    ? effectiveProviderAliasDecision(providerName, provider, config)
+    : undefined;
   return {
     providerName,
-    provider: routedProviderConfig(providerName, provider),
+    provider: routedProvider,
     modelId: effectiveModelId,
+    staticPolicy: captureRouteStaticPolicy(providerName, effectiveModelId, routedProvider, effectiveAlias),
     routeKind,
     routeReason: effectiveRouteReason,
     ...(codexAccountMode ? { codexAccountMode } : {}),

package/src/routing/compatibility/behavior.ts

@@ -200,6 +200,12 @@ export function resolveProductionBehaviorValues(
         : reasoningEfforts.length > 0 || Boolean(registryEntry?.reasoningEfforts),
     ),
     "reasoning.efforts": behaviorRow("provider_config", reasoningEfforts),
+    // Whether the configured ladder above is what the WIRE uses, or only what the catalog
+    // advertises. An adapter shipping its own per-model table (command-code) otherwise wins for
+    // models it knows, and it also repairs a refused rung by replaying without the effort. Two
+    // routes that disagree about this send different bytes and recover differently, so they are
+    // not the same compatibility subject and must not share evidence.
+    "reasoning.effortsAuthoritative": behaviorRow("provider_config", effective.modelReasoningEffortsAuthoritative === true),
     "reasoning.defaultEffort": behaviorRow("provider_config", defaultReasoningEffort),
     "reasoning.effortMap": behaviorRow("provider_config", reasoningEffortMap),
     "reasoning.wireFormat": behaviorRow("provider_config", effective.reasoningWireFormat ?? null),
@@ -209,6 +215,9 @@ export function resolveProductionBehaviorValues(
     }),
     "reasoning.replayMode": behaviorRow("provider_config", {
       preserveResponses: effective.preserveResponsesReasoningContent === true,
+      // Dropping replayed reasoning items changes the continuation body, so two routes that
+      // disagree about it are not the same compatibility subject and must not share evidence.
+      dropResponses: effective.dropResponsesReasoningItems === true,
       preserveContent: includesModel(effective.preserveReasoningContentModels, modelId),
       placeholder: includesModel(effective.requiresReasoningPlaceholderModels, modelId),
     }),

package/src/routing/compatibility/subject.ts

@@ -1,5 +1,8 @@
 import type { OcxConfig, OcxProviderConfig } from "../../types";
 import type { InboundWire } from "../../providers/registry";
+import { getProviderRegistryEntry } from "../../providers/registry";
+import { providerMatchesRegistryTransportWithStaticGuards } from "../../providers/static-model-discovery";
+import { resolveModelPolicy } from "../../providers/resolved-model-policy";
 import { subjectIdForSubject } from "../../lab/digest";
 import { buildRouteSubjectV1 } from "../../lab/subject/route-subject";
 import { buildProtocolSubjectV1 } from "../../lab/subject/protocol-subject";
@@ -65,7 +68,19 @@ export function resolveCompatibilitySubjectsForInboundWire(
   inboundWire: InboundWire,
   configDir?: string,
 ): ResolvedPolicyCompatibilitySubjects {
-  const effective = resolveWireProtocolOverride(providerName, modelId, routed, inboundWire);
+  const registryEntry = getProviderRegistryEntry(providerName);
+  const staticPolicy = resolveModelPolicy({
+    providerName,
+    modelId,
+    provider: routed,
+    registryEntry,
+    transportMatchedRegistry: !!registryEntry
+      && providerMatchesRegistryTransportWithStaticGuards(providerName, routed),
+    inboundWire,
+    modelCapabilities: routed.modelCapabilities?.[modelId],
+    ...(routed.authMode ? { effectiveAuth: { authMode: routed.authMode } } : {}),
+  });
+  const effective = resolveWireProtocolOverride(providerName, modelId, routed, inboundWire, staticPolicy);
   const baseUrl = typeof effective.baseUrl === "string" ? effective.baseUrl.trim() : "";
   const adapter = effective.adapter ?? "openai-responses";
   const inboundProtocol = inboundProtocolForWire(inboundWire);

package/src/server/adapter-resolve.ts

@@ -3,6 +3,7 @@ import type { OcxProviderConfig } from "../types";
 import { isWirePinnedModel, MODEL_ADAPTER_OVERRIDE_ALLOWED, pinnedWireAdapter } from "../types";
 import { isCanonicalOpenAiForwardProvider } from "../providers/openai-tiers";
 import { type InboundWire, providerModelWireDefault } from "../providers/registry";
+import type { ResolvedModelPolicy } from "../providers/resolved-model-policy";
 
 /**
  * Resolve the wire a single model should use: a hard pin first, then a configured
@@ -22,7 +23,15 @@ export function resolveWireProtocolOverride(
   modelId: string,
   providerConfig: OcxProviderConfig,
   inbound: InboundWire = "responses",
+  staticPolicy?: ResolvedModelPolicy,
 ): OcxProviderConfig {
+  // RouteResult policy is recaptured for the original inbound protocol whenever routing selects
+  // or replaces a destination, so every downstream rebuild consumes the same adapter authority.
+  if (staticPolicy) {
+    return staticPolicy.model.adapter !== providerConfig.adapter
+      ? { ...providerConfig, adapter: staticPolicy.model.adapter }
+      : providerConfig;
+  }
   const pinned = pinnedWireAdapter(providerName, modelId);
   if (pinned && providerConfig.adapter !== pinned) {
     return { ...providerConfig, adapter: pinned };

package/src/server/auth-cors.ts

@@ -1,3 +1,4 @@
+import { providerRelativeSendPathConfigError } from "../config/provider-relative-send-path";
 import { modelCapabilitiesConfigError } from "../config/provider-validation";
 import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
 import { initialModelSelection } from "../providers/initial-model-selection";
@@ -29,6 +30,7 @@ import {
 } from "../config/provider-validation";
 import { providerDestinationConfigError } from "../lib/destination-policy";
 import { redactSecretString } from "../lib/redact";
+import { DECLARABLE_HOSTED_TOOL_TYPES } from "../responses/hosted-tool-policy";
 import { effectiveGoogleMode, getProviderRegistryEntry, providerCodexAccountMode, providerMatchesRegistryTransport, registryEntryForProviderDestination } from "../providers/registry";
 import { providerConfigSeed } from "../providers/derive";
 import type { OcxConfig, OcxProviderConfig } from "../types";
@@ -754,6 +756,10 @@ export function providerManagementConfigError(
   }
   const destinationError = providerDestinationConfigError(name, typed);
   if (destinationError) return `provider ${name} ${destinationError}`;
+  for (const field of ["responsesPath", "chatCompletionsPath"] as const) {
+    const sendPathError = providerRelativeSendPathConfigError(field, raw[field]);
+    if (sendPathError) return `provider ${JSON.stringify(redactSecretString(name))} ${sendPathError}`;
+  }
   const headersError = providerHeadersConfigError(typed.headers);
   if (headersError) return `provider ${name} ${headersError}`;
   const retryOn429Error = retryOn429PolicyConfigError(raw.retryOn429);
@@ -793,6 +799,8 @@ export function providerManagementConfigError(
   }
   const reasoningSummariesError = booleanRecordConfigError(raw.modelSupportsReasoningSummaries, "modelSupportsReasoningSummaries");
   if (reasoningSummariesError) return `provider ${name} ${reasoningSummariesError}`;
+  const suppressSyntheticMaxError = booleanRecordConfigError(raw.modelSuppressSyntheticMax, "modelSuppressSyntheticMax");
+  if (suppressSyntheticMaxError) return `provider ${name} ${suppressSyntheticMaxError}`;
   const reasoningSummaryDeliveryError = reasoningSummaryDeliveryRecordConfigError(
     raw.modelReasoningSummaryDelivery,
     raw.modelSupportsReasoningSummaries,
@@ -834,6 +842,22 @@ export function providerManagementConfigError(
     "omitReasoningEffortWithToolsModels",
   );
   if (toolReasoningOptOutError) return `provider ${name} ${toolReasoningOptOutError}`;
+  const unsupportedHostedToolsError = nonBlankStringArrayConfigError(
+    raw.unsupportedHostedTools,
+    "unsupportedHostedTools",
+  );
+  if (unsupportedHostedToolsError) return `provider ${name} ${unsupportedHostedToolsError}`;
+  if (Array.isArray(raw.unsupportedHostedTools)) {
+    // Closed vocabulary, same reason as the config schema: an unrecognized name would be
+    // stored and then strip nothing, so the operator would keep getting the upstream 400
+    // this field exists to prevent.
+    const unknownTool = (raw.unsupportedHostedTools as unknown[])
+      .find(tool => typeof tool === "string" && !DECLARABLE_HOSTED_TOOL_TYPES.has(tool.trim()));
+    if (unknownTool !== undefined) {
+      return `provider ${name} unsupportedHostedTools must name only hosted tool types: `
+        + `${[...DECLARABLE_HOSTED_TOOL_TYPES].join(", ")}`;
+    }
+  }
   const openRouterError = openRouterRoutingConfigError(typed);
   if (openRouterError) return `provider ${name} ${openRouterError}`;
   const vercelError = vercelGatewayRoutingConfigError(typed);
@@ -918,12 +942,15 @@ const PROVIDER_CONFIG_FIELD_POLICY = {
   supportsServiceTier: "editor",
   modelSupportsServiceTier: "editor",
   preserveResponsesReasoningContent: "editor",
+  dropResponsesReasoningItems: "editor",
+  modelReasoningEffortsAuthoritative: "editor",
   decodesNativeCompactionBlobs: "editor",
   allowEncryptedV2AgentTasks: "editor",
   allowPrivateNetwork: "editor",
   upstreamHttpVersion: "editor",
   upstreamWebsocket: "editor",
   directGeminiWireRenames: "editor",
+  googleToolSchemaPolicy: "editor",
   disabled: "editor",
   codexAccountMode: "editor",
   apiKey: "redacted",
@@ -964,6 +991,7 @@ const PROVIDER_CONFIG_FIELD_POLICY = {
   refreshPolicy: "editor",
   reasoningEfforts: "editor",
   modelReasoningEfforts: "editor",
+  modelSuppressSyntheticMax: "editor",
   modelDefaultReasoningEfforts: "editor",
   pinnedReasoningEffort: "editor",
   modelPinnedReasoningEfforts: "editor",
@@ -979,6 +1007,7 @@ const PROVIDER_CONFIG_FIELD_POLICY = {
   xaiResponsesDefaultVersion: "runtime",
   zaiResponsesDefaultVersion: "runtime",
   supportsResponsesCustomTools: "editor",
+  unsupportedHostedTools: "editor",
   responsesSnapshotRepair: "editor",
   webSearchBridge: "editor",
   reasoningEffortMap: "editor",

package/src/server/chat-completions.ts

@@ -23,7 +23,7 @@ import { classifyError, cyberPolicyErrorType, CYBER_POLICY_ERROR_CODE, isCyberPo
 import { redactSecretString } from "../lib/redact";
 import { resolveClientRetryAfter } from "../lib/retry-after";
 import { estimateTokens } from "../lib/token-estimate";
-import { NoEligiblePolicyCandidateError, UnknownRoutingPolicyError, routeModel } from "../router";
+import { captureRouteStaticPolicy, NoEligiblePolicyCandidateError, UnknownRoutingPolicyError, routeModel } from "../router";
 import { evidenceFromBody } from "../routing/request-evidence";
 import { resolveWireProtocolOverride } from "./adapter-resolve";
 import { resolveOpenCodeGoTransport } from "../providers/opencode-go-transport";
@@ -150,10 +150,18 @@ async function handleChatCompletionsWithBudget(
   let chatNativeRoute: ReturnType<typeof routeModel> | null = null;
   try {
     const route = routeModel(config, chatBody.model as string, evidenceFromBody(chatBody));
-    route.provider = resolveOpenCodeGoTransport(route.provider, getOrAllocateRequestSessionLane(req));
-    // Settle the wire once so every branch below reads the adapter this model will
-    // actually use, not the provider-wide default (#404).
-    route.provider = resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, "chat");
+    // Preserve the routed destination for Go recognition, then settle the wire before
+    // deriving protocol-scoped affinity. Recognition must not inspect the flipped adapter.
+    const routedProvider = route.provider;
+    route.staticPolicy = captureRouteStaticPolicy(
+      route.providerName, route.modelId, routedProvider, route.staticPolicy.effectiveAlias, "chat",
+    );
+    const wireProvider = resolveWireProtocolOverride(route.providerName, route.modelId, routedProvider, "chat", route.staticPolicy);
+    route.provider = resolveOpenCodeGoTransport(
+      wireProvider,
+      getOrAllocateRequestSessionLane(req),
+      routedProvider,
+    );
     logCtx.model = route.modelId;
     logCtx.providerAdapter = route.provider.adapter;
     logCtx.requestedModel = requestedModel;

package/src/server/chat-native-sse.ts

@@ -152,6 +152,8 @@ export function nativeChatSse(
   let sawFinish = false;
   let sawDone = false;
   let firstOutput = false;
+  let sawTextOutput = false;
+  let sawToolCalls = false;
   let settled = false;
   let cancelled = false;
   let cancelledBySignal = false;
@@ -264,7 +266,7 @@ export function nativeChatSse(
     const choices = Array.isArray(parsed.choices) ? parsed.choices : [];
     const finished = choices.some(choice => isRec(choice) && typeof choice.finish_reason === "string" && choice.finish_reason.length > 0);
     if (finished) sawFinish = true;
-    const hasProgress = choices.some(choice => {
+    const hasText = choices.some(choice => {
       if (!isRec(choice) || !isRec(choice.delta)) return false;
       const delta = choice.delta;
       return (typeof delta.content === "string" && delta.content.length > 0)
@@ -272,15 +274,22 @@ export function nativeChatSse(
         || (typeof delta.reasoning === "string" && delta.reasoning.length > 0)
         || (Array.isArray(delta.reasoning_details) && delta.reasoning_details.some(detail =>
           isRec(detail) && typeof detail.text === "string" && detail.text.length > 0))
-        || (typeof delta.refusal === "string" && delta.refusal.length > 0)
-        || (Array.isArray(delta.tool_calls) && delta.tool_calls.some(tool => {
-          if (!isRec(tool)) return false;
-          const fn = isRec(tool.function) ? tool.function : {};
-          return (typeof tool.id === "string" && tool.id.length > 0)
-            || (typeof fn.name === "string" && fn.name.length > 0)
-            || (typeof fn.arguments === "string" && fn.arguments.length > 0);
-        }));
+        || (typeof delta.refusal === "string" && delta.refusal.length > 0);
     });
+    const hasTool = choices.some(choice => {
+      if (!isRec(choice) || !isRec(choice.delta)) return false;
+      const delta = choice.delta;
+      return Array.isArray(delta.tool_calls) && delta.tool_calls.some(tool => {
+        if (!isRec(tool)) return false;
+        const fn = isRec(tool.function) ? tool.function : {};
+        return (typeof tool.id === "string" && tool.id.length > 0)
+          || (typeof fn.name === "string" && fn.name.length > 0)
+          || (typeof fn.arguments === "string" && fn.arguments.length > 0);
+      });
+    });
+    if (hasText) sawTextOutput = true;
+    if (hasTool) sawToolCalls = true;
+    const hasProgress = hasText || hasTool;
     if (hasProgress || finished) pullDeadline = performance.now() + stallMs;
     else if (performance.now() >= pullDeadline) throw stalled;
     if (!firstOutput && hasProgress) {
@@ -358,6 +367,14 @@ export function nativeChatSse(
             if (!sawDone) enqueue(controller, "data: [DONE]\n\n");
             settle(200);
             controller.close();
+          } else if (sawToolCalls) {
+            // Mid tool-call truncation must fail closed to prevent downstream executing partial arguments.
+            fail(controller, "upstream SSE ended mid tool call without a terminal signal — possible truncation", "upstream_sse_truncated");
+          } else if (sawTextOutput) {
+            // Upstream produced text or reasoning output but missed the terminal frame; recover cleanly with [DONE].
+            enqueue(controller, "data: [DONE]\n\n");
+            settle(200);
+            controller.close();
           } else {
             fail(controller, "upstream SSE ended before a terminal event", "upstream_sse_truncated");
           }

package/src/server/chat-native.ts

@@ -50,7 +50,7 @@ import { enrichOpenCodeZenFreeTierMessage } from "../providers/opencode-zen-rate
 import type { OcxProviderTransport } from "../providers/xai-transport";
 import type { RouteResult } from "../router";
 import type { OcxConfig, OcxProviderConfig } from "../types";
-import { fetchWithHeaderTimeout, providerFetch, safeHostLabel } from "./responses/fetch-helpers";
+import { fetchWithHeaderTimeout, providerFetch, safeHostLabel, sendWithConnectionPolicy } from "./responses/fetch-helpers";
 import { linkAbortSignal } from "./responses";
 import {
   addFinalRequestLog,
@@ -351,9 +351,15 @@ export async function handleNativeChatCompletions(options: HandleNativeChatOptio
                 if (!headers.has("accept-encoding") && encoding) headers.set("accept-encoding", encoding);
                 if (init.signal?.aborted) throw init.signal.reason;
                 noteProviderAttemptSend(logCtx, route.providerName, activeProvider, logCtx.usageLogInputTokens, transportRecovery ?? recovery);
-                const dispatched = await ((activeProvider as OcxProviderTransport).fetch ?? execute)(request.url, applyUpstreamRecoveryInit({
-                  ...init, method: request.method, headers, body: request.body,
-                }, transportRecovery));
+                // A reselected provider transport is still a physical send: the connection policy
+                // and manual-redirect ownership wrap the selected implementation (#4992).
+                const dispatched = await sendWithConnectionPolicy(
+                  (activeProvider as OcxProviderTransport).fetch ?? execute,
+                  request.url,
+                  applyUpstreamRecoveryInit({
+                    ...init, method: request.method, headers, body: request.body,
+                  }, transportRecovery),
+                );
                 if (!dispatched.ok) await recordKeyAttemptFailure(logCtx, dispatched, init.signal ?? upstream.signal);
                 return dispatched;
               },