@bitkyc08/opencodex 2.59.0 → 2.60.0

package/src/oauth/index.ts

@@ -1,6 +1,5 @@
 import type { KiroOAuthMetadata, OAuthController, OAuthCredentials } from "./types";
 import { initializeProviderModelSelection } from "../providers/initial-model-selection";
-import { parseCallbackInput } from "./callback-server";
 import type { OcxConfig, OcxProviderConfig, RefreshPolicy } from "../types";
 import { ConfigMutationLockError, loadConfig, mutatePersistedConfig, saveConfig } from "../config";
 import { resolveProviderApiKey } from "../providers/key-store";
@@ -51,8 +50,9 @@ import { providerModelsUrl, resolveProviderModelDiscoveryUrl } from "../provider
 import { resolveProviderTransport } from "../providers/xai-transport";
 import { detectClaudeCodeToken, detectGrokCliToken, hasComparableGrokIdentity, isSameGrokIdentity, shouldAdoptGrokGeneration } from "./local-token-detect";
 import { logOAuthEvent } from "./log";
-import { captureConfigGeneration, sweepExpiredOnWrite, type GenerationContext } from "../lib/state-store-sweeper";
-import { retainedUtf8Bytes } from "../lib/admission";
+import { captureConfigGeneration, sweepExpiredOnWrite } from "../lib/state-store-sweeper";
+import { clearManualCodeSlot, ensureManualCodeSlot, kiroLoginSettling, loginAbort, loginState, waitForManualLoginCode } from "./login-flow-state";
+export { reconcileOAuthFlowState, submitManualLoginCode } from "./login-flow-state";
 import { randomUUID } from "node:crypto";
 export {
   CODEX_HEALTH_AUTH_FAILED_NOTE,
@@ -1710,110 +1710,6 @@ export async function runLogin(
  * localhost), the GUI can POST the final redirect URL or authorization code via
  * submitManualLoginCode(), which feeds OAuthController.onManualCodeInput.
  */
-const loginState = new Map<string, { error?: string; done: boolean }>();
-const loginAbort = new Map<string, AbortController>();
-const kiroLoginSettling = new Set<string>();
-
-/** Pending paste for a login in progress: either a waiter or a stashed early submission. */
-interface ManualCodeSlot {
-  pendingInput?: string;
-  resolve?: (value: string) => void;
-  /** Registered by the callback flow so submits can validate state synchronously. */
-  expectedState?: string;
-}
-const loginManual = new Map<string, ManualCodeSlot>();
-const OAUTH_PENDING_CODE_MAX_BYTES = 4 * 1024;
-let lastOAuthFlowReconciledGeneration = 0;
-
-export function reconcileOAuthFlowState(context: GenerationContext): number {
-  if (context.generation <= lastOAuthFlowReconciledGeneration) return 0;
-  let removed = 0;
-  for (const [provider, state] of loginState) {
-    if (context.providerNames.has(provider) || !state.done || loginAbort.has(provider)) continue;
-    if (loginState.delete(provider)) removed += 1;
-    if (loginManual.delete(provider)) removed += 1;
-    if (loginAbort.delete(provider)) removed += 1;
-  }
-  lastOAuthFlowReconciledGeneration = context.generation;
-  return removed;
-}
-
-function clearManualCodeSlot(provider: string): void {
-  loginManual.delete(provider);
-}
-
-function ensureManualCodeSlot(provider: string): ManualCodeSlot {
-  let slot = loginManual.get(provider);
-  if (!slot) {
-    slot = {};
-    loginManual.set(provider, slot);
-  }
-  return slot;
-}
-
-/** Wait for a GUI/CLI paste of the OAuth redirect URL or code (or return a stashed early submit). */
-function waitForManualLoginCode(provider: string, signal: AbortSignal, expectedState?: string): Promise<string> {
-  if (signal.aborted) {
-    return Promise.reject(new Error(`OAuth callback cancelled: ${signal.reason}`));
-  }
-  const slot = ensureManualCodeSlot(provider);
-  if (expectedState !== undefined) slot.expectedState = expectedState;
-  if (slot.pendingInput !== undefined) {
-    const value = slot.pendingInput;
-    slot.pendingInput = undefined;
-    return Promise.resolve(value);
-  }
-  return new Promise<string>((resolve, reject) => {
-    const onAbort = () => {
-      if (slot.resolve === resolve) slot.resolve = undefined;
-      reject(new Error(`OAuth callback cancelled: ${signal.reason}`));
-    };
-    signal.addEventListener("abort", onAbort, { once: true });
-    slot.resolve = (value: string) => {
-      signal.removeEventListener("abort", onAbort);
-      if (slot.resolve === resolve) slot.resolve = undefined;
-      resolve(value);
-    };
-  });
-}
-
-/**
- * Feed a pasted redirect URL or authorization code into an in-progress GUI login.
- * Returns ok:false when no login is waiting (or input is empty). Invalid pastes are accepted
- * here and re-prompted by the OAuth callback loop if they cannot be parsed / fail state checks.
- */
-export function submitManualLoginCode(provider: string, input: string): { ok: true } | { ok: false; error: string } {
-  const trimmed = input.trim();
-  if (!trimmed) return { ok: false, error: "empty code" };
-  if (retainedUtf8Bytes(trimmed) > OAUTH_PENDING_CODE_MAX_BYTES) return { ok: false, error: "code too large" };
-  const st = loginState.get(provider);
-  if (!st || st.done) return { ok: false, error: "no login in progress" };
-  const slot = ensureManualCodeSlot(provider);
-  // Synchronous validation (validated request/ack): reject un-parseable input and
-  // authorization responses (url/query kind) whose state is missing or mismatched
-  // once the flow has registered its expected state. Raw codes stay in-session-PKCE
-  // protected. Early posts (flow not yet waiting, no expectedState) are stashed and
-  // re-validated by the callback loop.
-  const parsed = parseCallbackInput(trimmed);
-  // Command Code's manual fallback accepts a pasted JSON callback payload
-  // (`{ apiKey, state, ... }`) which has no `code` param. Let it through the
-  // shared gate so the provider-specific parser can validate it.
-  const isCommandCodeJson = provider === "command-code" && trimmed.startsWith("{") && !parsed.code;
-  if (!parsed.code && !isCommandCodeJson) return { ok: false, error: "no authorization code found in input" };
-  if (parsed.kind !== "raw" && slot.expectedState !== undefined) {
-    if (parsed.state === undefined) return { ok: false, error: "redirect URL is missing the state parameter" };
-    if (parsed.state !== slot.expectedState) return { ok: false, error: "state mismatch — paste the redirect URL from THIS login attempt" };
-  }
-  if (slot.resolve) {
-    const resolve = slot.resolve;
-    slot.resolve = undefined;
-    resolve(trimmed);
-  } else {
-    // Race: GUI may POST before the flow reaches onManualCodeInput — stash for the waiter.
-    slot.pendingInput = trimmed;
-  }
-  return { ok: true };
-}
 
 export interface OAuthAccountSummary {
   id: string;

package/src/oauth/login-flow-state.ts

@@ -0,0 +1,127 @@
+import { parseCallbackInput } from "./callback-server";
+import { retainedUtf8Bytes } from "../lib/admission";
+import type { GenerationContext } from "../lib/state-store-sweeper";
+
+/**
+ * In-flight login flow state and the manual paste slot that feeds it.
+ *
+ * Split out of `index.ts` when that file crossed the repository file-size ratchet at 2009
+ * lines. The cut follows a seam rather than a line count: everything here is bookkeeping for
+ * a login that has started and not yet settled, and none of it reads or writes a stored
+ * credential. `index.ts` re-exports the two public names, so existing importers are unaffected.
+ */
+export const loginState = new Map<string, { error?: string; done: boolean }>();
+export const loginAbort = new Map<string, AbortController>();
+export const kiroLoginSettling = new Set<string>();
+
+/** Pending paste for a login in progress: either a waiter or a stashed early submission. */
+export interface ManualCodeSlot {
+  pendingInput?: string;
+  resolve?: (value: string) => void;
+  /** Registered by the callback flow so submits can validate state synchronously. */
+  expectedState?: string;
+}
+const loginManual = new Map<string, ManualCodeSlot>();
+const OAUTH_PENDING_CODE_MAX_BYTES = 4 * 1024;
+let lastOAuthFlowReconciledGeneration = 0;
+
+export function reconcileOAuthFlowState(context: GenerationContext): number {
+  if (context.generation <= lastOAuthFlowReconciledGeneration) return 0;
+  let removed = 0;
+  for (const [provider, state] of loginState) {
+    if (context.providerNames.has(provider) || !state.done || loginAbort.has(provider)) continue;
+    if (loginState.delete(provider)) removed += 1;
+    if (loginManual.delete(provider)) removed += 1;
+    if (loginAbort.delete(provider)) removed += 1;
+  }
+  lastOAuthFlowReconciledGeneration = context.generation;
+  return removed;
+}
+
+export function clearManualCodeSlot(provider: string): void {
+  loginManual.delete(provider);
+}
+
+export function ensureManualCodeSlot(provider: string): ManualCodeSlot {
+  let slot = loginManual.get(provider);
+  if (!slot) {
+    slot = {};
+    loginManual.set(provider, slot);
+  }
+  return slot;
+}
+
+/** Wait for a GUI/CLI paste of the OAuth redirect URL or code (or return a stashed early submit). */
+export function waitForManualLoginCode(provider: string, signal: AbortSignal, expectedState?: string): Promise<string> {
+  if (signal.aborted) {
+    return Promise.reject(new Error(`OAuth callback cancelled: ${signal.reason}`));
+  }
+  const slot = ensureManualCodeSlot(provider);
+  if (expectedState !== undefined) slot.expectedState = expectedState;
+  if (slot.pendingInput !== undefined) {
+    const value = slot.pendingInput;
+    slot.pendingInput = undefined;
+    return Promise.resolve(value);
+  }
+  return new Promise<string>((resolve, reject) => {
+    const onAbort = () => {
+      if (slot.resolve === resolve) slot.resolve = undefined;
+      reject(new Error(`OAuth callback cancelled: ${signal.reason}`));
+    };
+    signal.addEventListener("abort", onAbort, { once: true });
+    slot.resolve = (value: string) => {
+      signal.removeEventListener("abort", onAbort);
+      if (slot.resolve === resolve) slot.resolve = undefined;
+      resolve(value);
+    };
+  });
+}
+
+/**
+ * Feed a pasted redirect URL or authorization code into an in-progress GUI login.
+ * Returns ok:false when no login is waiting (or input is empty). Invalid pastes are accepted
+ * here and re-prompted by the OAuth callback loop if they cannot be parsed / fail state checks.
+ */
+export function submitManualLoginCode(provider: string, input: string): { ok: true } | { ok: false; error: string } {
+  const trimmed = input.trim();
+  if (!trimmed) return { ok: false, error: "empty code" };
+  if (retainedUtf8Bytes(trimmed) > OAUTH_PENDING_CODE_MAX_BYTES) return { ok: false, error: "code too large" };
+  const st = loginState.get(provider);
+  if (!st || st.done) return { ok: false, error: "no login in progress" };
+  const slot = ensureManualCodeSlot(provider);
+  // Synchronous validation (validated request/ack): reject un-parseable input and
+  // authorization responses (url/query kind) whose state is missing or mismatched
+  // once the flow has registered its expected state. Raw codes stay in-session-PKCE
+  // protected — but a raw paste carrying an explicit #state suffix is state-bearing
+  // and checked too. Early posts (flow not yet waiting, no expectedState) are
+  // stashed and re-validated by the callback loop.
+  const parsed = parseCallbackInput(trimmed);
+  // Command Code's manual fallback accepts a pasted JSON callback payload
+  // (`{ apiKey, state, ... }`) which has no `code` param. Let it through the
+  // shared gate so the provider-specific parser can validate it.
+  const isCommandCodeJson = provider === "command-code" && trimmed.startsWith("{") && !parsed.code;
+  if (!parsed.code && !isCommandCodeJson) return { ok: false, error: "no authorization code found in input" };
+  // A raw paste carrying an explicit code#state suffix is state-bearing too: it
+  // must match the expected state rather than bypass validation.
+  const stateBearing = parsed.kind !== "raw" || parsed.state !== undefined;
+  if (stateBearing && slot.expectedState !== undefined) {
+    if (parsed.state === undefined) return { ok: false, error: "redirect URL is missing the state parameter" };
+    if (parsed.state !== slot.expectedState) {
+      return {
+        ok: false,
+        error: parsed.kind === "raw"
+          ? "state mismatch — paste the bare code, or the correct code#state from THIS login attempt"
+          : "state mismatch — paste the redirect URL from THIS login attempt",
+      };
+    }
+  }
+  if (slot.resolve) {
+    const resolve = slot.resolve;
+    slot.resolve = undefined;
+    resolve(trimmed);
+  } else {
+    // Race: GUI may POST before the flow reaches onManualCodeInput — stash for the waiter.
+    slot.pendingInput = trimmed;
+  }
+  return { ok: true };
+}

package/src/providers/derive.ts

@@ -1,5 +1,6 @@
 import type { CodexAccountMode, OcxProviderConfig } from "../types";
 import { cloneFastWire } from "./fastwire";
+import { resolveModelPolicy } from "./resolved-model-policy";
 import {
   PROVIDER_REGISTRY,
   registryEntryForProviderDestination,
@@ -220,6 +221,14 @@ export function applyDirectReasoningEffortContracts(
  */
 export function providerConfigSeed(entry: ProviderRegistryEntry): OcxProviderConfig {
   const liveModels = registryEntrySupportsLiveModelDiscovery(entry) ? entry.liveModels : false;
+  const staticPolicy = resolveModelPolicy({
+    providerName: entry.id,
+    modelId: entry.defaultModel ?? entry.models?.[0] ?? "__provider_seed__",
+    provider: { adapter: entry.adapter, baseUrl: entry.baseUrl, authMode: entry.authKind },
+    registryEntry: entry,
+    transportMatchedRegistry: true,
+    effectiveAuth: { authMode: entry.authKind },
+  }).provider;
   return {
     adapter: entry.adapter,
     baseUrl: entry.baseUrl,
@@ -239,17 +248,17 @@ export function providerConfigSeed(entry: ProviderRegistryEntry): OcxProviderCon
     ...(entry.models ? { models: [...entry.models] } : {}),
     ...(liveModels !== undefined ? { liveModels } : {}),
     ...(entry.contextWindow !== undefined ? { contextWindow: entry.contextWindow } : {}),
-    ...(entry.modelContextWindows ? { modelContextWindows: { ...entry.modelContextWindows } } : {}),
-    ...(entry.modelDisplayNames ? { modelDisplayNames: { ...entry.modelDisplayNames } } : {}),
-    ...(entry.modelInputModalities ? { modelInputModalities: cloneRecordOfArrays(entry.modelInputModalities) } : {}),
-    ...(entry.modelMaxInputTokens ? { modelMaxInputTokens: { ...entry.modelMaxInputTokens } } : {}),
+    ...(staticPolicy.modelContextWindows ? { modelContextWindows: { ...staticPolicy.modelContextWindows } } : {}),
+    ...(staticPolicy.modelDisplayNames ? { modelDisplayNames: { ...staticPolicy.modelDisplayNames } } : {}),
+    ...(staticPolicy.modelInputModalities ? { modelInputModalities: cloneRecordOfArrays(staticPolicy.modelInputModalities) } : {}),
+    ...(staticPolicy.modelMaxInputTokens ? { modelMaxInputTokens: { ...staticPolicy.modelMaxInputTokens } } : {}),
     ...(entry.defaultMaxOutputTokens !== undefined ? { defaultMaxOutputTokens: entry.defaultMaxOutputTokens } : {}),
-    ...(entry.modelMaxOutputTokens ? { modelMaxOutputTokens: { ...entry.modelMaxOutputTokens } } : {}),
+    ...(staticPolicy.modelMaxOutputTokens ? { modelMaxOutputTokens: { ...staticPolicy.modelMaxOutputTokens } } : {}),
     ...(entry.reasoningEfforts ? { reasoningEfforts: [...entry.reasoningEfforts] } : {}),
-    ...(entry.modelReasoningEfforts ? { modelReasoningEfforts: cloneRecordOfArrays(entry.modelReasoningEfforts) } : {}),
-    ...(entry.modelDefaultReasoningEfforts ? { modelDefaultReasoningEfforts: { ...entry.modelDefaultReasoningEfforts } } : {}),
-    ...(entry.reasoningEffortMap ? { reasoningEffortMap: { ...entry.reasoningEffortMap } } : {}),
-    ...(entry.modelReasoningEffortMap ? { modelReasoningEffortMap: cloneNestedRecord(entry.modelReasoningEffortMap) } : {}),
+    ...(staticPolicy.modelReasoningEfforts ? { modelReasoningEfforts: cloneRecordOfArrays(staticPolicy.modelReasoningEfforts) } : {}),
+    ...(staticPolicy.modelDefaultReasoningEfforts ? { modelDefaultReasoningEfforts: { ...staticPolicy.modelDefaultReasoningEfforts } } : {}),
+    ...(staticPolicy.reasoningEffortMap ? { reasoningEffortMap: { ...staticPolicy.reasoningEffortMap } } : {}),
+    ...(staticPolicy.modelReasoningEffortMap ? { modelReasoningEffortMap: cloneNestedRecord(staticPolicy.modelReasoningEffortMap) } : {}),
     ...(entry.reasoningWireFormat ? { reasoningWireFormat: entry.reasoningWireFormat } : {}),
     ...(entry.noVisionModels ? { noVisionModels: [...entry.noVisionModels] } : {}),
     ...(entry.noReasoningModels ? { noReasoningModels: [...entry.noReasoningModels] } : {}),
@@ -447,13 +456,16 @@ function applyVerbosityDefaults(prov: OcxProviderConfig, entry: ProviderRegistry
  * was skipped and the reasoning ladder was advertised without summary support — exactly the
  * inconsistency that makes Codex drop the inbound reasoning object.
  *
- * Deliberately narrow: reasoning-summary and effort metadata only, via
+ * Deliberately narrow: reasoning-summary, effort, and replay-compatibility metadata only, via
  * `registryEntryForProviderDestination`, which matches fixed key destinations and refuses
  * templated or overridable base URLs. A custom row keeps its own identity for everything else.
  */
 function enrichReasoningMetadataByDestination(prov: OcxProviderConfig): void {
   const destination = registryEntryForProviderDestination(prov);
   applyReasoningSummaryDefaults(prov, destination?.modelSupportsReasoningSummaries);
+  if (prov.dropResponsesReasoningItems === undefined && destination?.dropResponsesReasoningItems !== undefined) {
+    prov.dropResponsesReasoningItems = destination.dropResponsesReasoningItems;
+  }
   if (destination?.modelReasoningEfforts) {
     prov.modelReasoningEfforts = fillRecordOfArrays(destination.modelReasoningEfforts, prov.modelReasoningEfforts);
   }
@@ -491,6 +503,14 @@ export function enrichProviderFromRegistry(name: string, prov: OcxProviderConfig
     modelReasoningEffortMap: prov.modelReasoningEffortMap,
   };
   const seed = providerConfigSeed(entry);
+  const resolvedStatic = resolveModelPolicy({
+    providerName: name,
+    modelId: prov.defaultModel ?? entry.defaultModel ?? "__provider_enrich__",
+    provider: prov,
+    registryEntry: entry,
+    transportMatchedRegistry: true,
+    ...(prov.authMode ? { effectiveAuth: { authMode: prov.authMode } } : {}),
+  }).provider;
   repairStaticModelCatalogProvider(name, prov);
   if (prov.apiKeyTransport === undefined && seed.apiKeyTransport !== undefined) prov.apiKeyTransport = seed.apiKeyTransport;
   if (!prov.defaultModel && seed.defaultModel) prov.defaultModel = seed.defaultModel;
@@ -504,10 +524,8 @@ export function enrichProviderFromRegistry(name: string, prov: OcxProviderConfig
   if (!prov.modelContextWindows && seed.modelContextWindows) prov.modelContextWindows = { ...seed.modelContextWindows };
   // Per-model fill, not all-or-nothing: an operator who renamed ONE model must still receive
   // labels for the rest, and an existing install must pick up newly seeded rows on enrich.
-  if (seed.modelDisplayNames) {
-    prov.modelDisplayNames = { ...seed.modelDisplayNames, ...(prov.modelDisplayNames ?? {}) };
-  }
-  if (seed.modelInputModalities) prov.modelInputModalities = fillRecordOfArrays(seed.modelInputModalities, prov.modelInputModalities);
+  if (resolvedStatic.modelDisplayNames) prov.modelDisplayNames = { ...resolvedStatic.modelDisplayNames };
+  if (resolvedStatic.modelInputModalities) prov.modelInputModalities = cloneRecordOfArrays(resolvedStatic.modelInputModalities);
   if (prov.defaultMaxOutputTokens === undefined && seed.defaultMaxOutputTokens !== undefined) prov.defaultMaxOutputTokens = seed.defaultMaxOutputTokens;
   if (!prov.modelMaxOutputTokens && seed.modelMaxOutputTokens) prov.modelMaxOutputTokens = { ...seed.modelMaxOutputTokens };
   if ((!prov.reasoningEfforts || hasLegacyClinePassReasoningEfforts(name, prov)) && seed.reasoningEfforts) {
@@ -518,9 +536,7 @@ export function enrichProviderFromRegistry(name: string, prov: OcxProviderConfig
   // provider. That split the two planes apart — routing merges these maps per key
   // (mergeRecordFill in src/router.ts), so the wire honored the effort while /v1/models and
   // every client export showed no effort control at all.
-  if (seed.modelReasoningEfforts) {
-    prov.modelReasoningEfforts = fillRecordOfArrays(seed.modelReasoningEfforts, prov.modelReasoningEfforts);
-  }
+  if (resolvedStatic.modelReasoningEfforts) prov.modelReasoningEfforts = cloneRecordOfArrays(resolvedStatic.modelReasoningEfforts);
   if (!prov.modelDefaultReasoningEfforts && seed.modelDefaultReasoningEfforts) prov.modelDefaultReasoningEfforts = { ...seed.modelDefaultReasoningEfforts };
   if (!prov.reasoningEffortMap && seed.reasoningEffortMap) prov.reasoningEffortMap = { ...seed.reasoningEffortMap };
   if (!prov.modelReasoningEffortMap && seed.modelReasoningEffortMap) prov.modelReasoningEffortMap = cloneNestedRecord(seed.modelReasoningEffortMap);
@@ -563,6 +579,7 @@ export function enrichProviderFromRegistry(name: string, prov: OcxProviderConfig
     prov.supportsResponsesCustomTools = entry.supportsResponsesCustomTools;
   }
   if (prov.preserveResponsesReasoningContent === undefined && entry.preserveResponsesReasoningContent !== undefined) prov.preserveResponsesReasoningContent = entry.preserveResponsesReasoningContent;
+  if (prov.dropResponsesReasoningItems === undefined && entry.dropResponsesReasoningItems !== undefined) prov.dropResponsesReasoningItems = entry.dropResponsesReasoningItems;
   applyReasoningSummaryDefaults(prov, entry.modelSupportsReasoningSummaries);
   applyServiceTierModelDefaults(prov, serviceTierModelDefaultsFor(entry, prov));
   applyVerbosityDefaults(prov, entry);

package/src/providers/devin-cli-authmode-migration.ts

@@ -12,14 +12,12 @@
  * key: the `devin-cli` registry entry is gone, so the PROVIDER_REGISTRY lookup
  * that gated the rewrite here could never fire again.
  *
- * The adapter repair must keep working for CUSTOM-NAMED rows. The ACP adapter
- * was removed, so `"devin-cli"` is not a constructible adapter id and
- * `createRegisteredAdapter` would throw `Unknown adapter: devin-cli`. The
- * canonical `devin` row gets its adapter pinned from the registry by
- * `routedProviderConfig`, but a row named e.g. `"devin-acp"` has nothing
- * pinning it and would fail every request. So every row naming the retired
- * adapter is rewritten to `devin`, whatever the row is called, and each
- * rewrite is reported.
+ * Custom-named rows fail closed. The retired ACP transport used the installed
+ * CLI's identity and ignored both configured and caller credentials, so
+ * silently changing one of those rows into a cloud provider could send a
+ * credential with different provenance to Cognition. The warning tells the
+ * operator to reconfigure it explicitly; retaining the unknown adapter id
+ * prevents requests from reaching any upstream in the meantime.
  *
  * A row carrying the retired ACP identity URL is repointed at the api-server
  * in the same pass. That URL was never a destination — it existed only so
@@ -55,10 +53,16 @@ export function projectDevinCliAuthMode(config: OcxConfig): DevinCliAuthModeProj
   const warnings: string[] = [];
   let changed = false;
 
-  // Every row, not only the registry id: a custom-named row had no registry pin,
-  // so after the ACP removal it is the one that cannot construct an adapter.
   for (const [name, row] of Object.entries(config.providers ?? {})) {
     if (!row || row.adapter !== RETIRED_ACP_ADAPTER) continue;
+    if (name !== RETIRED_ACP_ADAPTER) {
+      warnings.push(
+        `left custom provider "${name}" unchanged because adapter ${RETIRED_ACP_ADAPTER} was removed: `
+        + "the row was not migrated; switch its adapter to devin and configure Devin authentication "
+        + "explicitly before using this provider.",
+      );
+      continue;
+    }
     row.adapter = "devin";
     changed = true;
     let detail = "";

package/src/providers/key-failover.ts

@@ -11,6 +11,8 @@
 import { commitProviderApiKeySelection } from "./api-key-selection";
 import type { ProviderApiKeySelection } from "../types/provider";
 import { routedProviderConfig } from "../router";
+import { getProviderRegistryEntry } from "./registry";
+import { normalizedBaseUrl } from "./quota/vendor-probes-key";
 import type { OcxConfig, OcxProviderConfig, RateLimitRetryPolicy, TransientRetryPolicy } from "../types";
 import { OPENCODE_GO_SESSION_HEADER } from "./opencode-go-transport";
 import { resolveProviderTransport, type OcxProviderTransport } from "./xai-transport";
@@ -278,6 +280,43 @@ const DEFAULT_RATE_LIMIT_RETRY = {
   respectRetryAfter: true,
 } as const satisfies Required<RateLimitRetryPolicy>;
 
+/**
+ * Patient same-target 429 fallback for the OpenCode Go destination
+ * (https://opencode.ai/zen/go/v1), which serves subscription traffic such as Muse Spark.
+ * Single-key pools cannot fail over, so without this a burst 429 surfaces immediately and
+ * the client retry budget aborts the goal. Six 10s-paced attempts absorb a short burst
+ * window (effective replays are additionally bounded by the shared per-request send
+ * budget); Retry-After is still honored and capped. An explicit `retryOn429` (including
+ * `enabled: false`) always overrides this fallback.
+ */
+const OPENCODE_GO_RATE_LIMIT_RETRY = {
+  enabled: true,
+  attempts: 6,
+  intervalMs: 10_000,
+  maxIntervalMs: 60_000,
+  respectRetryAfter: true,
+} as const satisfies Required<RateLimitRetryPolicy>;
+
+/** True when the provider row points at the OpenCode Go destination. */
+export function isOpenCodeGoDestination(
+  provider: Partial<Pick<OcxProviderConfig, "baseUrl" | "authMode">>,
+): boolean {
+  const raw = typeof provider.baseUrl === "string" ? provider.baseUrl : "";
+  if (!raw.trim()) return false;
+  // Endpoint identity, not adapter identity: the runtime adapter is already overridden
+  // per model by the time the recovery loop runs (muse-spark rides `openai-responses`
+  // while the preset declares `openai-chat`), so an adapter-strict lookup misses it.
+  // Canonicalize with the shared quota-probe normalizer so host case and explicit
+  // default ports compare equal; userinfo, query, and fragment never match
+  // (follow-up to the review on #5067).
+  const endpoint = normalizedBaseUrl(raw.trim());
+  if (!endpoint) return false;
+  const entry = getProviderRegistryEntry("opencode-go");
+  if (!entry) return false;
+  const candidates = [entry.baseUrl, ...(entry.destinationAliases ?? []).map(alias => alias.baseUrl)];
+  return candidates.some(url => normalizedBaseUrl(url.trim()) === endpoint);
+}
+
 /**
  * Default transient-5xx retry used when a provider opts in with a bare
  * `transientRetryOn5xx: {}`. `attempts` is a TOTAL send budget, not extra retries.
@@ -513,29 +552,38 @@ export function selectProactiveApiKeyTransport(
 }
 
 /**
- * Normalize a provider's `retryOn429` policy, or return null when the knob is absent,
- * explicitly disabled, or the provider is not key-auth (OAuth/forward credentials must not be
- * replayed on the same token, forward passthrough never reaches the recovery loop anyway, and
- * local runtimes have no remote key to preserve). The returned policy is fully defaulted so
- * callers never re-check fields.
+ * Normalize a provider's `retryOn429` policy. An explicit object always wins (including
+ * `enabled: false` to opt out). When the knob is absent, the OpenCode Go destination
+ * (subscription traffic such as Muse Spark) falls back to a patient same-key policy so a
+ * burst 429 waits and replays instead of surfacing to the client and aborting a long
+ * session; every other provider without the knob keeps today's fail-fast behavior.
+ * OAuth/forward/local credentials are never replayed on the same token. The returned
+ * policy is fully defaulted so callers never re-check fields.
  */
 export function rateLimitRetryPolicyFor(
-  provider: Pick<OcxProviderConfig, "retryOn429" | "authMode">,
+  provider: Pick<OcxProviderConfig, "retryOn429" | "authMode"> &
+    Partial<Pick<OcxProviderConfig, "baseUrl" | "adapter">>,
 ): Required<RateLimitRetryPolicy> | null {
   const policy = provider.retryOn429;
-  if (!policy || policy.enabled === false) return null;
-  // Fail closed: only explicit key auth or the documented omitted-default (undefined == key for
-  // custom API-key providers) may use same-key replays. OAuth/forward are never replayed on the
-  // same token, local runtimes have no remote key to preserve, and unknown/custom values are
-  // rejected rather than guessed at.
+  if (policy) {
+    if (policy.enabled === false) return null;
+    // Fail closed: only explicit key auth or the documented omitted-default (undefined == key for
+    // custom API-key providers) may use same-key replays. OAuth/forward are never replayed on the
+    // same token, local runtimes have no remote key to preserve, and unknown/custom values are
+    // rejected rather than guessed at.
+    if (provider.authMode !== undefined && provider.authMode !== "key") return null;
+    return {
+      enabled: policy.enabled ?? DEFAULT_RATE_LIMIT_RETRY.enabled,
+      attempts: policy.attempts ?? DEFAULT_RATE_LIMIT_RETRY.attempts,
+      intervalMs: policy.intervalMs ?? DEFAULT_RATE_LIMIT_RETRY.intervalMs,
+      maxIntervalMs: policy.maxIntervalMs ?? DEFAULT_RATE_LIMIT_RETRY.maxIntervalMs,
+      respectRetryAfter: policy.respectRetryAfter ?? DEFAULT_RATE_LIMIT_RETRY.respectRetryAfter,
+    };
+  }
+  // No explicit knob: patient fallback for the OpenCode Go destination only.
   if (provider.authMode !== undefined && provider.authMode !== "key") return null;
-  return {
-    enabled: policy.enabled ?? DEFAULT_RATE_LIMIT_RETRY.enabled,
-    attempts: policy.attempts ?? DEFAULT_RATE_LIMIT_RETRY.attempts,
-    intervalMs: policy.intervalMs ?? DEFAULT_RATE_LIMIT_RETRY.intervalMs,
-    maxIntervalMs: policy.maxIntervalMs ?? DEFAULT_RATE_LIMIT_RETRY.maxIntervalMs,
-    respectRetryAfter: policy.respectRetryAfter ?? DEFAULT_RATE_LIMIT_RETRY.respectRetryAfter,
-  };
+  if (!isOpenCodeGoDestination(provider)) return null;
+  return { ...OPENCODE_GO_RATE_LIMIT_RETRY };
 }
 
 /**

package/src/providers/model-rename-migration.ts

@@ -14,9 +14,12 @@
 // This migration is deliberately NOT general reconciliation. It rewrites exactly
 // one thing: an id this file declares retired, on a provider that still carries
 // the registry's transport, and only when the registry currently seeds the
-// replacement. Everything else in the row is left alone.
+// replacement — and it skips a field where the retired entry is registry residue
+// with nothing left to carry forward (see `isRegistryResidue`, issue #5066).
+// Everything else in the row is left alone.
 
 import { PROVIDER_REGISTRY } from "./registry";
+import { providerConfigSeed } from "./derive";
 import type { OcxConfig, OcxProviderConfig } from "../types";
 
 export interface ModelRename {
@@ -194,6 +197,54 @@ function registrySeedsTarget(rename: ModelRename): boolean {
   return !!entry?.models?.includes(rename.to);
 }
 
+/** The row the registry contributes to a saved config, or `undefined` when it dropped the id. */
+function registrySeed(provider: string): Record<string, unknown> | undefined {
+  const entry = PROVIDER_REGISTRY.find(row => row.id === provider);
+  return entry ? (providerConfigSeed(entry) as unknown as Record<string, unknown>) : undefined;
+}
+
+/** Whether a saved list or model-keyed record names this id at all. */
+function publishes(container: unknown, id: string): boolean {
+  if (Array.isArray(container)) return container.includes(id);
+  if (!container || typeof container !== "object") return false;
+  return id in (container as Record<string, unknown>);
+}
+
+/**
+ * Whether this field’s retired entry is registry residue rather than something to repair.
+ *
+ * Two things have to be true. The registry’s own seed — `providerConfigSeed`, the row both the
+ * OAuth preset (`deriveOAuthProviderConfig`) and `enrichProviderFromRegistry` contribute — must
+ * still publish the retired id in this field, so the entry arrives in the config on its own. And
+ * the saved field must already carry the supported id, so the rename would only DELETE a key,
+ * with nothing to carry forward.
+ *
+ * Under those two conditions the rewrite is worse than a no-op, because it never converges.
+ * `startServer` runs this migration and then `reconcileOAuthProviders`, and
+ * `applyOAuthPresetCatalog` copies the preset’s record over the saved one whenever the two
+ * differ. The deletion is undone inside the same boot, the config is written twice, and the user
+ * is told about a rename that never sticks on every single start. Issue #5066 is exactly that:
+ * `ANTIGRAVITY_MODEL_CONTEXT_WINDOWS` derives a window for every compatibility alias, so
+ * `modelContextWindows` holds a key for all nine retired Flash ids beside the live ones — the
+ * nine `[model-rename-migration]` lines the reporter saw at every `ocx start`, none of which
+ * required them to have selected any of those nine models.
+ *
+ * Those registry entries are deliberate and stay: a request that still names `gemini-3.6-flash`
+ * routes to 3.7 and needs a context window under the id it asked for. The second condition is
+ * what keeps this narrow. A row that saved `{ "gemini-3.6-flash": 1048576 }` and nothing else
+ * still gets the value carried onto the supported id, because dropping it there would blank the
+ * record instead of moving it (`tests/adapters/google/gemini-37-flash-migration.test.ts`).
+ */
+function isRegistryResidue(
+  seed: Record<string, unknown> | undefined,
+  field: string,
+  saved: unknown,
+  rename: ModelRename,
+): boolean {
+  if (!seed) return false;
+  return publishes(seed[field], rename.from) && publishes(saved, rename.to);
+}
+
 export interface ModelRenameProjection {
   config: OcxConfig;
   changed: boolean;
@@ -226,14 +277,17 @@ export function projectModelRenames(
     // Provider config is a closed interface, so index through one unknown-cast
     // view rather than casting at each assignment.
     const row = prov as unknown as Record<string, unknown>;
+    const seed = registrySeed(rename.provider);
     let touched = false;
     for (const field of MODEL_ID_LISTS) {
+      if (isRegistryResidue(seed, field, row[field], rename)) continue;
       const next = renameInList(row[field], rename.from, rename.to);
       if (!next) continue;
       row[field] = next;
       touched = true;
     }
     for (const field of MODEL_KEYED_RECORDS) {
+      if (isRegistryResidue(seed, field, row[field], rename)) continue;
       const next = rename.dropReasoningEffortMap && field === "modelReasoningEffortMap"
         ? dropFromRecord(row[field], rename.from)
         : renameInRecord(row[field], rename.from, rename.to);

package/src/providers/model-rename-startup.ts

@@ -1,12 +1,13 @@
 import { mutatePersistedConfig } from "../config";
 import { projectModelRenames } from "./model-rename-migration";
 import { projectStaleContextWindows } from "./stale-context-window-migration";
+import { projectStaleVisionClassifications } from "./stale-vision-classification-migration";
 import { projectDevinCliAuthMode } from "./devin-cli-authmode-migration";
 import type { OcxConfig } from "../types";
 
 /**
- * The startup projection: registry model renames, then the context-window
- * repair. Both fix a saved row the registry can no longer reach on its own —
+ * The startup projection: registry model renames, then the context-window and
+ * vision-classification repairs. All three fix a saved row the registry can no longer reach on its own —
  * `enrichProviderFromRegistry` backfills a missing field and never rewrites a
  * present one — so they share this pass rather than adding a second boot step
  * with its own persistence, adopt, and failure handling.
@@ -14,11 +15,12 @@ import type { OcxConfig } from "../types";
 export function projectStartupConfigRepairs(config: OcxConfig): ReturnType<typeof projectModelRenames> {
   const renames = projectModelRenames(config);
   const windows = projectStaleContextWindows(renames.config);
-  const devinCli = projectDevinCliAuthMode(windows.config);
+  const vision = projectStaleVisionClassifications(windows.config);
+  const devinCli = projectDevinCliAuthMode(vision.config);
   return {
     config: devinCli.config,
-    changed: renames.changed || windows.changed || devinCli.changed,
-    warnings: [...renames.warnings, ...windows.warnings, ...devinCli.warnings],
+    changed: renames.changed || windows.changed || vision.changed || devinCli.changed,
+    warnings: [...renames.warnings, ...windows.warnings, ...vision.warnings, ...devinCli.warnings],
   };
 }