@bitkyc08/opencodex 2.59.0 → 2.60.0

package/src/providers/openai-virtual-models.ts

@@ -3,6 +3,9 @@ import { OPENAI_API_PROVIDER_ID } from "./openai-tiers";
 import type { OcxParsedRequest } from "../types";
 import type { RouteResult } from "../router";
 import type { RequestLogContext } from "../server/request-log";
+import type { InboundWire } from "./registry/types";
+import { providerMatchesRegistryTransportWithStaticGuards } from "./static-model-discovery";
+import { resolveModelPolicy } from "./resolved-model-policy";
 
 export interface OpenAiVirtualModelResolution {
   selectedModelId: string;
@@ -49,18 +52,55 @@ export function resolveOpenAiVirtualModel(
   return validateOpenAiVirtualModelDefinition(selectedModelId, definition);
 }
 
+export function captureOpenAiVirtualWirePolicy(
+  route: RouteResult,
+  resolution: OpenAiVirtualModelResolution,
+  inboundWire: InboundWire = "responses",
+): void {
+  // applyOpenAiVirtualModel is also a public mutation helper with older focused callers that
+  // construct only providerName/modelId/provider. Production RouteResult builders always capture
+  // staticPolicy; a legacy partial shape has no authority to recapture and keeps the old rewrite.
+  if (!route.staticPolicy) return;
+  const entry = PROVIDER_REGISTRY.find(candidate => candidate.id === route.providerName);
+  route.staticPolicy = resolveModelPolicy({
+    providerName: route.providerName,
+    modelId: resolution.wireModelId,
+    provider: route.provider,
+    registryEntry: entry,
+    transportMatchedRegistry: !!entry
+      && providerMatchesRegistryTransportWithStaticGuards(route.providerName, route.provider),
+    inboundWire,
+    modelCapabilities: route.provider.modelCapabilities?.[resolution.wireModelId],
+    ...(route.provider.authMode ? { effectiveAuth: { authMode: route.provider.authMode } } : {}),
+    ...(route.staticPolicy?.effectiveAlias !== undefined
+      ? { effectiveAlias: route.staticPolicy.effectiveAlias }
+      : {}),
+  });
+}
+
 export function applyOpenAiVirtualModel(
   parsed: OcxParsedRequest,
   route: RouteResult,
   logCtx: RequestLogContext,
+  inboundWire: InboundWire = "responses",
 ): OpenAiVirtualModelResolution | undefined {
-  const selectedModelId = logCtx.model && logCtx.model !== route.modelId ? logCtx.model : route.modelId;
-  const resolution = resolveOpenAiVirtualModel(route.providerName, selectedModelId);
+  // Routing has already removed the provider namespace and resolved model aliases. Never use
+  // logCtx.model for identity: it is reporting state and can still contain a namespaced selector.
+  const resolution = resolveOpenAiVirtualModel(route.providerName, route.modelId)
+    ?? (() => {
+      // Preserve the public helper's idempotent second-call contract from its own mutation
+      // provenance, without promoting reporting state back into routing authority.
+      const selected = parsed._openAiVirtualSelectedModelId;
+      if (typeof selected !== "string") return undefined;
+      const remembered = resolveOpenAiVirtualModel(route.providerName, selected);
+      return remembered?.wireModelId === route.modelId ? remembered : undefined;
+    })();
   if (!resolution) return undefined;
 
   logCtx.model = resolution.selectedModelId;
   logCtx.resolvedModel = resolution.wireModelId;
   route.modelId = resolution.wireModelId;
+  captureOpenAiVirtualWirePolicy(route, resolution, inboundWire);
   parsed.modelId = resolution.wireModelId;
   parsed._openAiVirtualSelectedModelId = resolution.selectedModelId;
 

package/src/providers/quota/antigravity.ts

@@ -1,6 +1,6 @@
 import { antigravityUserAgent } from "../../adapters/client-fingerprint";
 import { DestinationDnsResolutionError } from "../../lib/destination-policy";
-import { PinnedHttpError } from "../../lib/pinned-http";
+import { PinnedHttpError, type PinnedHttpErrorCode } from "../../lib/pinned-http";
 import { ProviderOutboundPolicyError, providerOutboundPost, providerRedirectError, type ProviderOutboundDependencies } from "../../lib/provider-outbound";
 import { getValidAccessToken } from "../../oauth";
 import { getAccountCredential, getCredential } from "../../oauth/store";
@@ -193,10 +193,30 @@ type AntigravityQuotaProbeResult =
   | { kind: "available"; quota: ProviderQuota; source: "google-antigravity:retrieveUserQuotaSummary" | "google-antigravity:fetchAvailableModels" }
   | { kind: "unavailable"; failure: QuotaFailureCode; legacy: { kind: "null" } | { kind: "throw"; error: unknown } };
 
+/**
+ * Every pinned-transport failure code, classified once.
+ *
+ * A conditional that named one code and sent the rest to `timeout` was correct only for as long
+ * as the union held exactly the codes it was written against. When the transport learned to
+ * report a coding it cannot undo, that answer was reported as a timeout, which is a different
+ * operational story entirely. A total map makes a new code a compile error here rather than a
+ * quiet misdiagnosis.
+ */
+const PINNED_QUOTA_FAILURES = {
+  connect_timeout: "timeout",
+  first_byte_timeout: "timeout",
+  inactivity_timeout: "timeout",
+  // The response arrived and cannot be used: too large, coded in a format this transport cannot
+  // undo, or coded bytes that did not decode. None of these is a timing failure.
+  output_byte_limit: "response_unusable",
+  unsupported_content_encoding: "response_unusable",
+  content_decode_failed: "response_unusable",
+} satisfies Record<PinnedHttpErrorCode, QuotaFailureCode>;
+
 function quotaTransportFailure(error: unknown): QuotaFailureCode {
   if (error instanceof ProviderOutboundPolicyError) return "destination_blocked";
   if (error instanceof DestinationDnsResolutionError) return "dns_failed";
-  if (error instanceof PinnedHttpError) return error.code === "output_byte_limit" ? "response_unusable" : "timeout";
+  if (error instanceof PinnedHttpError) return PINNED_QUOTA_FAILURES[error.code];
   if (error instanceof DOMException && error.name === "TimeoutError") return "timeout";
   return "transport_error";
 }

package/src/providers/quota/vendor-probes-key.ts

@@ -915,7 +915,7 @@ async function fetchNeuralwattQuota(provider: string, config: OcxProviderConfig)
 }
 
 
-function normalizedBaseUrl(value: string): string | null {
+export function normalizedBaseUrl(value: string): string | null {
   try {
     const url = new URL(value);
     if (url.username || url.password || url.search || url.hash) return null;

package/src/providers/registry/entries-core.ts

@@ -30,6 +30,8 @@ import {
   OPENAI_API_GPT56_REASONING_EFFORTS,
   META_MUSE_REASONING_EFFORTS,
   META_MUSE_REASONING_EFFORT_MAP,
+  META_MUSE_CODE_REASONING_EFFORTS,
+  META_MUSE_CODE_REASONING_EFFORT_MAP,
   META_MUSE_CONTEXT_WINDOW,
   META_MUSE_MODELS,
   OPENAI_DAYBREAK_MODELS,
@@ -599,12 +601,15 @@ export const PROVIDER_REGISTRY_CORE: readonly ProviderRegistryEntry[] = [
     label: "Meta Muse Code (CLI credential)",
     adapter: "openai-responses",
     baseUrl: "https://api.meta.ai/v1",
-    // Meta own client sends this on every Muse Code call. We never have, so a future
-    // server-side requirement would break every Muse request with no local signal.
+    // Meta's own client sends these on every Muse Code call. The compatibility marker
+    // is transparent while selecting the credential surface that accepts `max`.
     // Declared here rather than in a transport hook so it also covers model discovery
     // (src/oauth/index.ts:1176) and still yields to a user-set header
     // (mergeRegistryStaticHeaders, src/providers/registry.ts:3494).
-    staticHeaders: { "x-api-version": "1.0.0" },
+    staticHeaders: {
+      "User-Agent": "muse-build/1.3.0 (opencodex compatibility)",
+      "x-api-version": "1.0.0",
+    },
     authKind: "oauth",
     oauthId: "meta-muse",
     dashboardUrl: "https://dev.meta.ai",
@@ -615,8 +620,8 @@ export const PROVIDER_REGISTRY_CORE: readonly ProviderRegistryEntry[] = [
     liveModels: false,
     modelContextWindows: Object.fromEntries(META_MUSE_MODELS.map(id => [id, META_MUSE_CONTEXT_WINDOW])),
     modelInputModalities: Object.fromEntries(META_MUSE_MODELS.map(id => [id, ["text", "image"] as ["text", "image"]])),
-    modelReasoningEfforts: Object.fromEntries(META_MUSE_MODELS.map(id => [id, META_MUSE_REASONING_EFFORTS])),
-    modelReasoningEffortMap: Object.fromEntries(META_MUSE_MODELS.map(id => [id, META_MUSE_REASONING_EFFORT_MAP])),
+    modelReasoningEfforts: Object.fromEntries(META_MUSE_MODELS.map(id => [id, META_MUSE_CODE_REASONING_EFFORTS])),
+    modelReasoningEffortMap: Object.fromEntries(META_MUSE_MODELS.map(id => [id, META_MUSE_CODE_REASONING_EFFORT_MAP])),
     note: "Signs in to Meta with a browser device code on any platform, then mints the Muse Code subscription key. That grant is reimplemented from the one the Muse Code CLI performs and has NOT been exercised against Meta from OpenCodex, so treat the first login as unverified. If the Muse Code CLI is already signed in on macOS, the existing key is imported instead of starting a new grant. A pasted key from https://dev.meta.ai still works as a fallback when a device login cannot complete, and faces the same format check and live validation. A device login authenticates as Meta own Muse Code client, which is a stronger claim than reusing a key the CLI already minted. Meta scopes that credential to the Muse Code CLI, so this is an UNSUPPORTED use: Meta does not authorize subscription coverage outside its own CLI, how these calls settle is not observable from the API, and you should treat every call as billable against your account. The key, imported or pasted, is copied into OpenCodex's auth store. For an account signed in with the device login, OpenCodex refreshes Meta's subscription windows on demand from the same key endpoint the login uses, at most once every five minutes. For an imported or pasted key there is no endpoint to query them on demand, so OpenCodex reads them from streaming responses and shows the last observed value with its age; refreshing one then requires another streaming turn, and translated (non-passthrough) turns report none. Rate limits apply per team, not per key. For a supported path use the meta-model provider with your own key (export it as META_MODEL_API_KEY).",
   },
   {
@@ -652,6 +657,11 @@ export const PROVIDER_REGISTRY_CORE: readonly ProviderRegistryEntry[] = [
     // Zen Go can close a Chat stream after a fully assembled function call without sending
     // finish_reason or [DONE] (#2260). The adapter still rejects incomplete argument JSON.
     openaiChatEofTolerance: true,
+    // Muse Spark on OpenCode Go can sit silent during prolonged reasoning and close without a protocol terminal.
+    modelResponsesTerminalRepair: {
+      "muse-spark-1.2-contributor": { graceMs: 5_000 },
+      "muse-spark-1.3-contributor": { graceMs: 5_000 },
+    },
     // Go rejects reasoning.encrypted_content with previous_response_id (#3838).
     // Use explicit replay history and the existing stateless Responses policy.
     statelessResponses: true,
@@ -696,17 +706,25 @@ export const PROVIDER_REGISTRY_CORE: readonly ProviderRegistryEntry[] = [
       "glm-5.3-flash": ["text", "image"],
       // Experimental DeepSeek vision preview — expected to merge into deepseek-v4-flash later.
       [DEEPSEEK_VISION_PREVIEW_MODEL]: ["text", "image"],
-      // This route is text-only upstream — it is already listed in this preset's
-      // noVisionModels, which routes images through the proxy's vision sidecar and
-      // makes the catalog advertise image input on its behalf. The positive
-      // text-only declaration is what reaches an EXISTING install: derive.ts fills
-      // noVisionModels all-or-nothing, so a config persisted before this id joined
-      // the list keeps a stale list, the sidecar predicate never matches, the row
-      // carries no modality at all, and any combo containing it collapses to
-      // ["text"] (#4505). modelInputModalities IS per-key filled, so this
-      // declaration lands on old configs. It states the route's real upstream
-      // capability and keeps the sidecar explicitly distinct from native vision.
-      "deepseek-v4.1-flash": ["text"],
+      // This route became natively multimodal; it is NOT a sidecar consumer.
+      //
+      // History: the id was declared text-only here and listed in this preset's
+      // noVisionModels, which routed its images through the vision sidecar (#4505).
+      // That classification came from jawcode metadata and went stale. Probed
+      // 2026-09-19 against https://opencode.ai/zen/go/v1/chat/completions with the
+      // headers this proxy sends: the route accepts an image_url part and the model
+      // reads it correctly (a four-band colour chart was described in the right
+      // order). Its sibling deepseek-v4-flash on the same gateway still answers
+      // HTTP 400 "Model only supports text input", which is what keeps the two
+      // distinct here rather than collapsing them.
+      //
+      // The declaration is what reaches an EXISTING install: derive.ts fills
+      // noVisionModels all-or-nothing, so a config persisted while the stale list
+      // was current keeps it forever, and modelInputModalities is filled per-key
+      // BENEATH the saved value. Both halves are repaired by
+      // stale-vision-classification-migration.ts; correcting the registry alone
+      // would fix new installs and leave existing ones stripping images.
+      "deepseek-v4.1-flash": ["text", "image"],
       // Muse Spark Contributor is natively multimodal on Zen Go: it accepts input_image
       // parts over /responses (probed 2026-08-26). Without this declaration the catalog
       // advertises it text-only and the Codex app blocks image attachments client-side with
@@ -760,7 +778,10 @@ export const PROVIDER_REGISTRY_CORE: readonly ProviderRegistryEntry[] = [
     // Kimi K2.7 Code accepts text+image+video: do NOT list it here.
     noVisionModels: [
       "glm-5.3", "glm-5.2", "glm-5", "glm-5.1",
-      "deepseek-v4.1-flash", "deepseek-v4-flash",
+      // deepseek-v4.1-flash is deliberately absent: probed natively multimodal on this
+      // gateway 2026-09-19 (see the modelInputModalities note above). Its sibling
+      // deepseek-v4-flash stays listed — that route rejects image_url upstream.
+      "deepseek-v4-flash",
       "mimo-v2-pro", "mimo-v2.5-pro",
       "minimax-m2.5", "minimax-m2.7",
       "qwen3.7-max",
@@ -1237,3 +1258,4 @@ export const PROVIDER_REGISTRY_CORE: readonly ProviderRegistryEntry[] = [
     note: "Serverless Inference subscription API. Live discovery exposes only kimi-k2-instruct because Vultr documents it as the sole tool-calling model.",
   },
 ];
+

package/src/providers/registry/entries-extended.ts

@@ -746,9 +746,22 @@ export const PROVIDER_REGISTRY_EXTENDED: readonly ProviderRegistryEntry[] = [
     id: "volcengine-coding-plan",
     label: "Volcengine Ark Coding Plan",
     baseUrl: "https://ark.cn-beijing.volces.com/api/coding/v3",
-    adapter: "openai-chat",
+    responsesPath: "/responses",
+    adapter: "openai-responses",
     authKind: "key",
+    supportsServiceTier: false,
     preserveCustomDestination: true,
+    // A row already saved on Chat keeps Chat. This is a `preserveCustomDestination` key entry,
+    // so `providerMatchesRegistryTransport` refuses the adapter mismatch and the request path
+    // returns the stored row untouched; the alias below still hands it this entry's metadata.
+    // Deliberately no startup config migration: the Z.AI one (`zai-responses-migration.ts`) is
+    // safe only because it rewrites rows the router already canonicalizes, and it gates on
+    // `providerMatchesRegistryTransport` to guarantee that. A Chat row here is NOT canonicalized,
+    // so migrating it would change a wire the operator is actually using, and a marker added
+    // now cannot tell the old default apart from a deliberate pre-upgrade Chat choice.
+    destinationAliases: [{ baseUrl: "https://ark.cn-beijing.volces.com/api/coding/v3", adapter: "openai-chat" }],
+    // Validated Ark Coding Plan continuations reject replayed reasoning items.
+    dropResponsesReasoningItems: true,
     dashboardUrl: "https://console.volcengine.com/ark/region:ark+cn-beijing/overview",
     defaultModel: "ark-code-latest",
     models: VOLCENGINE_CODING_PLAN_MODELS,
@@ -798,6 +811,21 @@ export const PROVIDER_REGISTRY_EXTENDED: readonly ProviderRegistryEntry[] = [
     defaultModel: "qwen3.8-max",
     models: ALIBABA_TOKEN_PLAN_MODELS,
     liveModels: false,
+    // Alibaba documents an OpenAI-compatible Responses API on this same /compatible-mode/v1 base
+    // and ships an official Codex integration guide on wire_api = "responses" (#5097). The
+    // gateway serves the same models over both wires, and qwen3.8-flash, qwen3.7-plus and
+    // glm-5.3 carry live end-to-end evidence there (custom tools, reasoning replay, streaming,
+    // multi-turn continuation).
+    //
+    // That is deliberately NOT expressed as a modelWireDefaults pin. Pinning would move every
+    // existing Codex user of those models onto a different upstream with no config change, and
+    // one delta is unresolved: preserveReasoningContentModels below is read by the CHAT adapter,
+    // while the Responses serializer reads preserveResponsesReasoningContent, which this entry
+    // does not set. On the Responses wire those models would replay with blanked reasoning
+    // content -- less state than they carry today. Z.AI and DeepSeek set both flags together for
+    // exactly this reason. Until that flag is justified against this gateway, Responses stays a
+    // documented per-model modelAdapters opt-in;
+    // tests/providers/alibaba-token-plan-responses-optin.test.ts holds both halves.
     note: "Token Plan Personal Edition · China (Beijing)",
     modelInputModalities: ALIBABA_TOKEN_PLAN_INPUT_MODALITIES,
     modelContextWindows: ALIBABA_TOKEN_PLAN_CONTEXT_WINDOWS,
@@ -1027,6 +1055,11 @@ export const PROVIDER_REGISTRY_EXTENDED: readonly ProviderRegistryEntry[] = [
     // Same DeepSeek routes as the Go preset above, behind the same vendor, so they carry
     // the same json_schema rejection (#1338 / #1415).
     noJsonSchemaModels: [...DEEPSEEK_GATEWAY_THINKING_MODELS, ...OPENCODE_FREE_DEEPSEEK_MODELS],
+    // Muse Spark on Zen can sit silent during prolonged reasoning and close without a protocol terminal.
+    modelResponsesTerminalRepair: {
+      "muse-spark-1.2-contributor-free": { graceMs: 5_000 },
+      "muse-spark-1.3-contributor-free": { graceMs: 5_000 },
+    },
   },
   { id: "vercel-ai-gateway", label: "Vercel AI Gateway", baseUrl: "https://ai-gateway.vercel.sh/v1", adapter: "openai-chat", authKind: "key", dashboardUrl: "https://vercel.com/dashboard" },
   {
@@ -1329,3 +1362,4 @@ export const PROVIDER_REGISTRY_EXTENDED: readonly ProviderRegistryEntry[] = [
     note: "Official CodeBuddy Code CLI (Tencent Cloud), China/internal environment. Uses the documented CODEBUDDY_API_KEY + headless CLI surface; never reads desktop sessions or private console endpoints. Region-isolated from codebuddy (Global); credentials are never exchanged across regions. v1 disables CLI tools (--tools \"\"): text/reasoning only for now. Requires `npm i -g @tencent-ai/codebuddy-code`. AUP/routing authorization flagged for maintainer security review.",
   },
 ];
+

package/src/providers/registry/model-ids.ts

@@ -0,0 +1,168 @@
+import type { ProviderRegistryEntry } from "./types";
+
+/**
+ * What a registry field's KEYS mean for selector decoding.
+ *
+ * An encoded selector is decoded against the native model ids a provider is known to accept.
+ * That set used to be a hand-written list of eight registry maps, so an id declared only in an
+ * unlisted map could not be decoded, and every new model-keyed field had to be remembered.
+ *
+ * Every field of ProviderRegistryEntry is classified below, including the ones that carry no
+ * model identity at all. That is deliberate: the "satisfies" check makes a new registry field a
+ * TYPE error until somebody decides what its keys mean, rather than letting it default to
+ * invisible. The two checks are different and both matter - the satisfies clause proves the
+ * classification is exhaustive when this compiles, and the parity test proves the fields the
+ * shipped registry actually carries are the ones classified here.
+ *
+ * These are decode hints and nothing more. A hint does not publish a catalog row, grant
+ * availability or entitlement, and it does not confer transport authority: the caller still
+ * checks registry transport identity before asking for them, and an ambiguous selector is still
+ * rejected rather than guessed.
+ */
+type RegistryFieldModelIdRole =
+  | { readonly kind: "none" }
+  | { readonly kind: "record-keys" }
+  | { readonly kind: "nested-record-keys"; readonly key: "modelSupportsServiceTier" };
+
+const NONE = { kind: "none" } as const;
+const RECORD_KEYS = { kind: "record-keys" } as const;
+/**
+ * Key-auth declares its own service-tier support under a nested map.
+ *
+ * Reading its keys is identity evidence only. It does not activate the key-auth service tier,
+ * which stays the business of the service-tier resolver.
+ */
+const KEY_AUTH_SERVICE_TIER = { kind: "nested-record-keys", key: "modelSupportsServiceTier" } as const;
+
+/**
+ * Not a configuration surface. Exported so the parity suite can compare this classification
+ * against the fields the shipped registry entries actually carry at runtime.
+ */
+export const REGISTRY_FIELD_MODEL_ID_ROLES = {
+  id: NONE,
+  label: NONE,
+  adapter: NONE,
+  baseUrl: NONE,
+  apiKeyTransport: NONE,
+  alias: NONE,
+  authKind: NONE,
+  codexAccountMode: NONE,
+  allowKeyAuthOverride: NONE,
+  allowPrivateNetworkByDefault: NONE,
+  keyOptional: NONE,
+  apiKeyValidation: NONE,
+  freeTier: NONE,
+  allowBaseUrlOverride: NONE,
+  preserveCustomDestination: NONE,
+  baseUrlChoices: NONE,
+  staticHeaders: NONE,
+  modelSuffixBracketStrip: NONE,
+  featured: NONE,
+  sponsor: NONE,
+  dashboardPreset: NONE,
+  note: NONE,
+  dashboardUrl: NONE,
+  defaultModel: NONE,
+  models: NONE,
+  liveModels: NONE,
+  modelWireDefaults: RECORD_KEYS,
+  fastWire: NONE,
+  modelResponsesUpstreamStreaming: RECORD_KEYS,
+  modelResponsesTerminalRepair: RECORD_KEYS,
+  responsesItemIdRepair: NONE,
+  responsesPath: NONE,
+  chatCompletionsPath: NONE,
+  destinationAliases: NONE,
+  statelessResponses: NONE,
+  requiresAdjacentResponsesToolResults: NONE,
+  requiresPairedResponsesToolResults: NONE,
+  annotateEmptyToolOutputs: NONE,
+  supportsServiceTier: NONE,
+  supportsOpenAiWebSearchToolFields: NONE,
+  supportsResponsesCustomTools: NONE,
+  modelSupportsServiceTier: RECORD_KEYS,
+  keyAuthServiceTier: KEY_AUTH_SERVICE_TIER,
+  fastTierDescription: NONE,
+  modelServiceTierCapabilityBaseUrlGuard: NONE,
+  preserveResponsesReasoningContent: NONE,
+  dropResponsesReasoningItems: NONE,
+  modelSupportsReasoningSummaries: RECORD_KEYS,
+  modelSupportsVerbosity: RECORD_KEYS,
+  supportsVerbosity: NONE,
+  modelDiscovery: NONE,
+  contextWindow: NONE,
+  modelContextWindows: RECORD_KEYS,
+  modelDisplayNames: RECORD_KEYS,
+  modelInputModalities: RECORD_KEYS,
+  defaultMaxOutputTokens: NONE,
+  modelMaxOutputTokens: RECORD_KEYS,
+  reasoningEfforts: NONE,
+  modelReasoningEfforts: RECORD_KEYS,
+  modelDefaultReasoningEfforts: RECORD_KEYS,
+  reasoningEffortMap: NONE,
+  modelReasoningEffortMap: RECORD_KEYS,
+  directReasoningEffortModels: NONE,
+  reasoningWireFormat: NONE,
+  noVisionModels: NONE,
+  noReasoningModels: NONE,
+  noTemperatureModels: NONE,
+  noTopPModels: NONE,
+  noPenaltyModels: NONE,
+  noJsonSchemaModels: NONE,
+  parallelToolCalls: NONE,
+  promptCacheKey: NONE,
+  chatServiceTier: NONE,
+  openaiChatEofTolerance: NONE,
+  autoToolChoiceOnlyModels: NONE,
+  preserveReasoningContentModels: NONE,
+  requiresReasoningPlaceholderModels: NONE,
+  showThinkingSummary: NONE,
+  reasoningSplitModels: NONE,
+  reasoningDetailsModels: NONE,
+  thinkingToggleModels: NONE,
+  thinkingBudgetModels: NONE,
+  escapeBuiltinToolNames: NONE,
+  oauthId: NONE,
+  virtualModels: RECORD_KEYS,
+  modelMaxInputTokens: RECORD_KEYS,
+  jawcodeBundle: NONE,
+  extraMetadataAliases: NONE,
+  metadataModelIdNormalize: NONE,
+  googleMode: NONE,
+  project: NONE,
+  location: NONE,
+} satisfies Record<keyof ProviderRegistryEntry, RegistryFieldModelIdRole>;
+
+/**
+ * The native model ids this registry entry names, in registry-field order, first seen wins.
+ *
+ * Only KEYS are collected. virtualModels is a map whose keys are the selected identities and
+ * whose values name a transport target, so its wireModelId values are deliberately not read:
+ * a wire target is not something a client may select by name.
+ */
+export function registryModelIdKeys(entry: ProviderRegistryEntry): readonly string[] {
+  const ids: string[] = [];
+  const seen = new Set<string>();
+  const add = (key: string): void => {
+    if (key.length === 0 || seen.has(key)) return;
+    seen.add(key);
+    ids.push(key);
+  };
+  for (const field of Object.keys(REGISTRY_FIELD_MODEL_ID_ROLES) as (keyof ProviderRegistryEntry)[]) {
+    const role = REGISTRY_FIELD_MODEL_ID_ROLES[field];
+    if (role.kind === "none") continue;
+    if (role.kind === "record-keys") {
+      const map = entry[field];
+      if (typeof map !== "object" || map === null) continue;
+      for (const key of Object.keys(map)) add(key);
+      continue;
+    }
+    // The nested role belongs to keyAuthServiceTier alone, so its owner is read by name.
+    // ProviderRegistryEntry is an interface and carries no implicit index signature, so a
+    // by-name read is what keeps this loop typed instead of asserted through unknown.
+    const nested = entry.keyAuthServiceTier?.[role.key];
+    if (typeof nested !== "object" || nested === null) continue;
+    for (const key of Object.keys(nested)) add(key);
+  }
+  return Object.freeze(ids);
+}

package/src/providers/registry/model-seeds.ts

@@ -177,6 +177,15 @@ export const META_MUSE_REASONING_EFFORTS = ["minimal", "low", "medium", "high",
 export const META_MUSE_REASONING_EFFORT_MAP: Record<string, string> = Object.fromEntries(
   META_MUSE_REASONING_EFFORTS.map(effort => [effort, effort]),
 );
+/*
+ * Muse Code credentials have a separate capability contract. Meta's authenticated
+ * /muse-code/models roster advertises max for both 1.3 models, and the Responses API
+ * accepts it when the request identifies the Muse client surface.
+ */
+export const META_MUSE_CODE_REASONING_EFFORTS = [...META_MUSE_REASONING_EFFORTS, "max"];
+export const META_MUSE_CODE_REASONING_EFFORT_MAP: Record<string, string> = Object.fromEntries(
+  META_MUSE_CODE_REASONING_EFFORTS.map(effort => [effort, effort]),
+);
 /** Both Muse Spark 1.3 tiers publish a 1,048,576-token window (dev.meta.ai/docs/models). */
 export const META_MUSE_CONTEXT_WINDOW = 1_048_576;
 export const META_MUSE_MODELS = ["muse-spark-1.3", "muse-spark-1.3-contributor"];

package/src/providers/registry/types.ts

@@ -264,6 +264,8 @@ export interface ProviderRegistryEntry {
   modelServiceTierCapabilityBaseUrlGuard?: (baseUrl: string) => boolean;
   /** Registry default for plaintext reasoning replay; see `OcxProviderConfig.preserveResponsesReasoningContent`. Registry-only like `supportsServiceTier`. */
   preserveResponsesReasoningContent?: boolean;
+  /** Registry default for dropping replayed reasoning items for Responses upstreams that reject them. */
+  dropResponsesReasoningItems?: boolean;
   /** Registry defaults for per-model Codex reasoning propagation; explicit user keys win during enrichment. */
   modelSupportsReasoningSummaries?: Record<string, boolean>;
   /** Registry defaults for per-model Codex Responses verbosity support. */

package/src/providers/resolved-model-policy-merge.ts

@@ -0,0 +1,167 @@
+import type { OcxProviderConfig } from "../types";
+import { MODEL_ADAPTER_OVERRIDE_ALLOWED } from "../types";
+import type { InboundWire, ModelWireDefault, ProviderRegistryEntry } from "./registry/types";
+
+export type StaticPolicySource =
+  | "operator" | "operator-capability" | "captured-auth"
+  | "registry" | "hard-pin" | "provider-default" | "unknown";
+
+export function detachedClone<T>(value: T): T {
+  if (Array.isArray(value)) return value.map(item => detachedClone(item)) as T;
+  if (value && typeof value === "object") {
+    return Object.fromEntries(Object.entries(value as Record<string, unknown>)
+      .map(([key, nested]) => [key, detachedClone(nested)])) as T;
+  }
+  return value;
+}
+
+export function recursivelyFreeze<T>(value: T): T {
+  if (!value || typeof value !== "object" || Object.isFrozen(value)) return value;
+  for (const nested of Object.values(value as Record<string, unknown>)) recursivelyFreeze(nested);
+  return Object.freeze(value);
+}
+
+export function scalar<T>(operator: T | undefined, registry: T | undefined): [T | undefined, StaticPolicySource] {
+  if (operator !== undefined) return [detachedClone(operator), "operator"];
+  if (registry !== undefined) return [detachedClone(registry), "registry"];
+  return [undefined, "unknown"];
+}
+
+export function mapFill<T>(
+  registry: Readonly<Record<string, T>> | undefined,
+  operator: Readonly<Record<string, T>> | undefined,
+): [Record<string, T> | undefined, StaticPolicySource] {
+  if (!registry && !operator) return [undefined, "unknown"];
+  return [detachedClone({ ...(registry ?? {}), ...(operator ?? {}) }), operator ? "operator" : "registry"];
+}
+
+export function nestedMapFill(
+  registry: Readonly<Record<string, Record<string, string>>> | undefined,
+  operator: Readonly<Record<string, Record<string, string>>> | undefined,
+): [Record<string, Record<string, string>> | undefined, StaticPolicySource] {
+  if (!registry && !operator) return [undefined, "unknown"];
+  const merged: Record<string, Record<string, string>> = {};
+  for (const [key, value] of Object.entries(registry ?? {})) merged[key] = { ...value };
+  for (const [key, value] of Object.entries(operator ?? {})) {
+    merged[key] = { ...(merged[key] ?? {}), ...value };
+  }
+  return [merged, operator ? "operator" : "registry"];
+}
+
+export function positiveCapMap(
+  registry: Readonly<Record<string, number>> | undefined,
+  operator: Readonly<Record<string, number>> | undefined,
+): [Record<string, number> | undefined, StaticPolicySource] {
+  if (!registry && !operator) return [undefined, "unknown"];
+  const merged = { ...(registry ?? {}) };
+  for (const [key, value] of Object.entries(operator ?? {})) {
+    merged[key] = typeof merged[key] === "number" ? Math.min(merged[key]!, value) : value;
+  }
+  return [merged, operator ? "operator" : "registry"];
+}
+
+export function stableUnion(
+  registry: readonly string[] | undefined,
+  operator: readonly string[] | undefined,
+): [string[] | undefined, StaticPolicySource] {
+  if (!registry && !operator) return [undefined, "unknown"];
+  return [[...new Set([...(registry ?? []), ...(operator ?? [])])], operator ? "operator" : "registry"];
+}
+
+export function staticHeaders(
+  registry: Readonly<Record<string, string>> | undefined,
+  operator: Readonly<Record<string, string>> | undefined,
+): [Record<string, string> | undefined, StaticPolicySource] {
+  if (!registry && !operator) return [undefined, "unknown"];
+  if (!registry) return [{ ...(operator ?? {}) }, "operator"];
+  if (!operator) return [{ ...registry }, "registry"];
+  const claimed = new Set(Object.keys(operator).map(name => name.toLowerCase()));
+  const merged: Record<string, string> = { ...operator };
+  for (const [name, value] of Object.entries(registry)) {
+    if (!claimed.has(name.toLowerCase())) merged[name] = value;
+  }
+  return [merged, "operator"];
+}
+
+export function resolvedBaseUrl(
+  entry: Readonly<ProviderRegistryEntry> | undefined,
+  provider: Readonly<OcxProviderConfig>,
+): [string, StaticPolicySource] {
+  if (!entry) return [provider.baseUrl, "operator"];
+  const configured = typeof provider.baseUrl === "string" ? provider.baseUrl.trim() : "";
+  const configuredIsResolved = configured.length > 0 && !/\{[^}]*\}/.test(configured);
+  if (entry.allowBaseUrlOverride && !configuredIsResolved) {
+    throw new Error(`Invalid baseUrl for provider "${entry.id}": expected a nonblank URL without unresolved placeholders`);
+  }
+  return (/\{[^}]*\}/.test(entry.baseUrl) || entry.allowBaseUrlOverride) && configuredIsResolved
+    ? [configured, "operator"]
+    : [entry.baseUrl, "registry"];
+}
+
+export function sameStringArray(left: readonly string[] | undefined, right: readonly string[]): boolean {
+  return left?.length === right.length && left.every((value, index) => value === right[index]);
+}
+
+/** Legacy config-map lookup: exact id, colon family, then case-folded exact id. */
+export function legacyModelValue<T>(record: Readonly<Record<string, T>> | undefined, modelId: string): T | undefined {
+  if (!record) return undefined;
+  if (Object.hasOwn(record, modelId)) return record[modelId];
+  const colon = modelId.indexOf(":");
+  if (colon > 0 && Object.hasOwn(record, modelId.slice(0, colon))) return record[modelId.slice(0, colon)];
+  const folded = modelId.toLowerCase();
+  return Object.entries(record).find(([key]) => key.toLowerCase() === folded)?.[1];
+}
+
+/** Provenance from the same merged-key walk as legacyModelValue. */
+export function legacyModelSource<T>(
+  operator: Readonly<Record<string, T>> | undefined,
+  registry: Readonly<Record<string, T>> | undefined,
+  modelId: string,
+): StaticPolicySource {
+  const merged = { ...(registry ?? {}), ...(operator ?? {}) };
+  let winningKey: string | undefined;
+  if (Object.hasOwn(merged, modelId)) winningKey = modelId;
+  const colon = modelId.indexOf(":");
+  if (winningKey === undefined && colon > 0 && Object.hasOwn(merged, modelId.slice(0, colon))) {
+    winningKey = modelId.slice(0, colon);
+  }
+  if (winningKey === undefined) {
+    const folded = modelId.toLowerCase();
+    winningKey = Object.keys(merged).find(key => key.toLowerCase() === folded);
+  }
+  if (winningKey === undefined) return "unknown";
+  return Object.hasOwn(operator ?? {}, winningKey) ? "operator" : "registry";
+}
+
+export function anthropicFamilyContextWindow(
+  record: Readonly<Record<string, number>> | undefined,
+  id: string,
+): number | undefined {
+  if (!record || !id.toLowerCase().startsWith("claude-")) return undefined;
+  let candidate = id;
+  while (true) {
+    const cut = candidate.lastIndexOf("-");
+    if (cut <= 0 || !/^\d+$/.test(candidate.slice(cut + 1))) return undefined;
+    candidate = candidate.slice(0, cut);
+    const value = record[candidate]
+      ?? Object.entries(record).find(([key]) => key.toLowerCase() === candidate.toLowerCase())?.[1];
+    if (typeof value === "number" && value > 0) return value;
+  }
+}
+
+export function wireDefault(
+  declared: ModelWireDefault | undefined,
+  provider: Readonly<OcxProviderConfig>,
+  entry: Readonly<ProviderRegistryEntry> | undefined,
+  inbound: InboundWire,
+  effectiveAuthMode: OcxProviderConfig["authMode"] | undefined,
+): string | undefined {
+  if (declared === undefined || !MODEL_ADAPTER_OVERRIDE_ALLOWED.has(provider.adapter)) return undefined;
+  if (typeof declared !== "string") {
+    if (!declared.inbound.includes(inbound)) return undefined;
+    const authMode = effectiveAuthMode ?? provider.authMode ?? entry?.authKind;
+    if (declared.authModes && authMode && !declared.authModes.includes(authMode)) return undefined;
+  }
+  const wire = typeof declared === "string" ? declared : declared.wire;
+  return MODEL_ADAPTER_OVERRIDE_ALLOWED.has(wire) ? wire : undefined;
+}