@bitkyc08/opencodex 2.59.0 → 2.61.0-preview.20260922

package/src/providers/key-failover.ts

@@ -11,7 +11,9 @@
 import { commitProviderApiKeySelection } from "./api-key-selection";
 import type { ProviderApiKeySelection } from "../types/provider";
 import { routedProviderConfig } from "../router";
-import type { OcxConfig, OcxProviderConfig, RateLimitRetryPolicy, TransientRetryPolicy } from "../types";
+import { getProviderRegistryEntry } from "./registry";
+import { normalizedBaseUrl } from "./quota/vendor-probes-key";
+import type { OcxConfig, OcxProviderConfig, RateLimitRetryPolicy, ResetReplayPolicy, TransientRetryPolicy } from "../types";
 import { OPENCODE_GO_SESSION_HEADER } from "./opencode-go-transport";
 import { resolveProviderTransport, type OcxProviderTransport } from "./xai-transport";
 import { sweepExpiredOnWrite } from "../lib/state-store-sweeper";
@@ -278,6 +280,43 @@ const DEFAULT_RATE_LIMIT_RETRY = {
   respectRetryAfter: true,
 } as const satisfies Required<RateLimitRetryPolicy>;
 
+/**
+ * Patient same-target 429 fallback for the OpenCode Go destination
+ * (https://opencode.ai/zen/go/v1), which serves subscription traffic such as Muse Spark.
+ * Single-key pools cannot fail over, so without this a burst 429 surfaces immediately and
+ * the client retry budget aborts the goal. Six 10s-paced attempts absorb a short burst
+ * window (effective replays are additionally bounded by the shared per-request send
+ * budget); Retry-After is still honored and capped. An explicit `retryOn429` (including
+ * `enabled: false`) always overrides this fallback.
+ */
+const OPENCODE_GO_RATE_LIMIT_RETRY = {
+  enabled: true,
+  attempts: 6,
+  intervalMs: 10_000,
+  maxIntervalMs: 60_000,
+  respectRetryAfter: true,
+} as const satisfies Required<RateLimitRetryPolicy>;
+
+/** True when the provider row points at the OpenCode Go destination. */
+export function isOpenCodeGoDestination(
+  provider: Partial<Pick<OcxProviderConfig, "baseUrl" | "authMode">>,
+): boolean {
+  const raw = typeof provider.baseUrl === "string" ? provider.baseUrl : "";
+  if (!raw.trim()) return false;
+  // Endpoint identity, not adapter identity: the runtime adapter is already overridden
+  // per model by the time the recovery loop runs (muse-spark rides `openai-responses`
+  // while the preset declares `openai-chat`), so an adapter-strict lookup misses it.
+  // Canonicalize with the shared quota-probe normalizer so host case and explicit
+  // default ports compare equal; userinfo, query, and fragment never match
+  // (follow-up to the review on #5067).
+  const endpoint = normalizedBaseUrl(raw.trim());
+  if (!endpoint) return false;
+  const entry = getProviderRegistryEntry("opencode-go");
+  if (!entry) return false;
+  const candidates = [entry.baseUrl, ...(entry.destinationAliases ?? []).map(alias => alias.baseUrl)];
+  return candidates.some(url => normalizedBaseUrl(url.trim()) === endpoint);
+}
+
 /**
  * Default transient-5xx retry used when a provider opts in with a bare
  * `transientRetryOn5xx: {}`. `attempts` is a TOTAL send budget, not extra retries.
@@ -287,6 +326,16 @@ const DEFAULT_TRANSIENT_RETRY = {
   attempts: 3,
 } as const satisfies Required<TransientRetryPolicy>;
 
+/**
+ * Default used when a provider opts in with a bare `retryOnReset: {}`: one replacement for
+ * the whole logical request. `replacements` counts duplicate inferences the operator accepts,
+ * not retries and not sends.
+ */
+const DEFAULT_RESET_REPLAY = {
+  enabled: true,
+  replacements: 1,
+} as const satisfies Required<ResetReplayPolicy>;
+
 /** Map<`${providerName}\0${keyId}`, KeyCooldown> */
 const keyCooldowns = new Map<string, KeyCooldown>();
 
@@ -513,29 +562,38 @@ export function selectProactiveApiKeyTransport(
 }
 
 /**
- * Normalize a provider's `retryOn429` policy, or return null when the knob is absent,
- * explicitly disabled, or the provider is not key-auth (OAuth/forward credentials must not be
- * replayed on the same token, forward passthrough never reaches the recovery loop anyway, and
- * local runtimes have no remote key to preserve). The returned policy is fully defaulted so
- * callers never re-check fields.
+ * Normalize a provider's `retryOn429` policy. An explicit object always wins (including
+ * `enabled: false` to opt out). When the knob is absent, the OpenCode Go destination
+ * (subscription traffic such as Muse Spark) falls back to a patient same-key policy so a
+ * burst 429 waits and replays instead of surfacing to the client and aborting a long
+ * session; every other provider without the knob keeps today's fail-fast behavior.
+ * OAuth/forward/local credentials are never replayed on the same token. The returned
+ * policy is fully defaulted so callers never re-check fields.
  */
 export function rateLimitRetryPolicyFor(
-  provider: Pick<OcxProviderConfig, "retryOn429" | "authMode">,
+  provider: Pick<OcxProviderConfig, "retryOn429" | "authMode"> &
+    Partial<Pick<OcxProviderConfig, "baseUrl" | "adapter">>,
 ): Required<RateLimitRetryPolicy> | null {
   const policy = provider.retryOn429;
-  if (!policy || policy.enabled === false) return null;
-  // Fail closed: only explicit key auth or the documented omitted-default (undefined == key for
-  // custom API-key providers) may use same-key replays. OAuth/forward are never replayed on the
-  // same token, local runtimes have no remote key to preserve, and unknown/custom values are
-  // rejected rather than guessed at.
+  if (policy) {
+    if (policy.enabled === false) return null;
+    // Fail closed: only explicit key auth or the documented omitted-default (undefined == key for
+    // custom API-key providers) may use same-key replays. OAuth/forward are never replayed on the
+    // same token, local runtimes have no remote key to preserve, and unknown/custom values are
+    // rejected rather than guessed at.
+    if (provider.authMode !== undefined && provider.authMode !== "key") return null;
+    return {
+      enabled: policy.enabled ?? DEFAULT_RATE_LIMIT_RETRY.enabled,
+      attempts: policy.attempts ?? DEFAULT_RATE_LIMIT_RETRY.attempts,
+      intervalMs: policy.intervalMs ?? DEFAULT_RATE_LIMIT_RETRY.intervalMs,
+      maxIntervalMs: policy.maxIntervalMs ?? DEFAULT_RATE_LIMIT_RETRY.maxIntervalMs,
+      respectRetryAfter: policy.respectRetryAfter ?? DEFAULT_RATE_LIMIT_RETRY.respectRetryAfter,
+    };
+  }
+  // No explicit knob: patient fallback for the OpenCode Go destination only.
   if (provider.authMode !== undefined && provider.authMode !== "key") return null;
-  return {
-    enabled: policy.enabled ?? DEFAULT_RATE_LIMIT_RETRY.enabled,
-    attempts: policy.attempts ?? DEFAULT_RATE_LIMIT_RETRY.attempts,
-    intervalMs: policy.intervalMs ?? DEFAULT_RATE_LIMIT_RETRY.intervalMs,
-    maxIntervalMs: policy.maxIntervalMs ?? DEFAULT_RATE_LIMIT_RETRY.maxIntervalMs,
-    respectRetryAfter: policy.respectRetryAfter ?? DEFAULT_RATE_LIMIT_RETRY.respectRetryAfter,
-  };
+  if (!isOpenCodeGoDestination(provider)) return null;
+  return { ...OPENCODE_GO_RATE_LIMIT_RETRY };
 }
 
 /**
@@ -568,6 +626,26 @@ export function transientRetryPolicyFor(
   };
 }
 
+/**
+ * Normalize a provider's `retryOnReset` policy, or return null when it is absent or explicitly
+ * disabled.
+ *
+ * No auth-mode gate: the canonical ChatGPT backend is `forward` auth and is the send this
+ * policy exists for. Whether a given REQUEST may be replaced is a per-body decision made in
+ * src/server/responses/reset-replay.ts, and how many replacements the request gets is the
+ * shared allowance on its execution budget. This function only reads the operator's intent.
+ */
+export function resetReplayPolicyFor(
+  provider: Pick<OcxProviderConfig, "retryOnReset">,
+): Required<ResetReplayPolicy> | null {
+  const policy = provider.retryOnReset;
+  if (!policy || policy.enabled === false) return null;
+  return {
+    enabled: policy.enabled ?? DEFAULT_RESET_REPLAY.enabled,
+    replacements: policy.replacements ?? DEFAULT_RESET_REPLAY.replacements,
+  };
+}
+
 /**
  * Wait before the next same-target replay: upstream Retry-After (seconds or HTTP-date) when
  * `respectRetryAfter` is on and the header parses, capped at `maxIntervalMs`; otherwise the

package/src/providers/key-store.ts

@@ -1,7 +1,34 @@
-import { createRequire } from "node:module";
 import { resolveEnvValue, saveConfigPreservingClaudeCode } from "../config";
 import type { OcxConfig, OcxProviderConfig } from "../types";
 import type { ProviderRegistryEntry } from "./registry";
+import {
+  KEYCHAIN_REFERENCE_PREFIX,
+  invalidateResolvedProviderKeyCache,
+  isKeychainReference,
+  keychainAccount,
+  keychainReferenceBelongsToProvider,
+  probeProviderKeychain,
+  providerKeychainEntry,
+} from "./api-key-resolve";
+
+// The read-path (reference predicates, the OS entry factory, resolveProviderApiKey, the probe
+// and the kind classification) lives in ./api-key-resolve -- a leaf module that
+// reasoning-metadata can also import without pulling the ../config barrel into its
+// cycle-sensitive graph. Re-exported here so existing key-store consumers keep working.
+export {
+  KEYCHAIN_REFERENCE_PREFIX,
+  PROVIDER_KEYCHAIN_SERVICE,
+  isKeychainReference,
+  probeProviderKeychain,
+  providerKeyStoreKind,
+  resolveProviderApiKey,
+  setProviderKeychainEntryFactoryForTests,
+} from "./api-key-resolve";
+export type {
+  ProviderKeychainEntry,
+  ProviderKeychainEntryFactory,
+  ProviderKeyStoreKind,
+} from "./api-key-resolve";
 
 /** Shared with routing: a key-mode override is effective only while its key resolves. */
 export function providerUsesKeyAuthOverride(
@@ -27,109 +54,8 @@ export function providerUsesKeyAuthOverride(
  * (headless service, locked session) refuses rather than half-migrating.
  */
 
-export const KEYCHAIN_REFERENCE_PREFIX = "keychain:";
-export const PROVIDER_KEYCHAIN_SERVICE = "opencodex.provider-api-key.v1";
-
-export interface ProviderKeychainEntry {
-  getPassword(): string | null;
-  setPassword(password: string): void;
-  deletePassword(): boolean;
-}
-
-export type ProviderKeychainEntryFactory = (service: string, account: string) => ProviderKeychainEntry;
-
-const nodeRequire = createRequire(import.meta.url);
-
-function defaultEntryFactory(service: string, account: string): ProviderKeychainEntry {
-  const { Entry } = nodeRequire("@napi-rs/keyring") as { Entry: new (s: string, a: string) => ProviderKeychainEntry };
-  return new Entry(service, account);
-}
-
-let entryFactory: ProviderKeychainEntryFactory = defaultEntryFactory;
-const resolvedCache = new Map<string, string>();
-const warnedAccounts = new Set<string>();
-
-/** Test seam: swap the OS entry for an in-memory one and drop caches. */
-export function setProviderKeychainEntryFactoryForTests(factory: ProviderKeychainEntryFactory | null): void {
-  entryFactory = factory ?? defaultEntryFactory;
-  resolvedCache.clear();
-  warnedAccounts.clear();
-}
-
-export function isKeychainReference(value: string | undefined): value is string {
-  return typeof value === "string" && value.startsWith(KEYCHAIN_REFERENCE_PREFIX) && value.length > KEYCHAIN_REFERENCE_PREFIX.length;
-}
-
-function keychainAccount(reference: string): string {
-  return reference.slice(KEYCHAIN_REFERENCE_PREFIX.length);
-}
-
-/**
- * A reference belongs to `name` only when its account is that provider's own active account
- * or one of its pool accounts. `storeProviderKeyInKeychain` writes exactly those two shapes,
- * so anything else in a provider's config names another provider's secret.
- */
-function keychainReferenceBelongsToProvider(reference: string, name: string): boolean {
-  const account = keychainAccount(reference);
-  return account === name || account.startsWith(`${name}/`);
-}
-
-function readKeychain(account: string): string | undefined {
-  const cached = resolvedCache.get(account);
-  if (cached !== undefined) return cached;
-  try {
-    const value = entryFactory(PROVIDER_KEYCHAIN_SERVICE, account).getPassword();
-    if (typeof value === "string" && value.trim()) {
-      resolvedCache.set(account, value);
-      return value;
-    }
-  } catch {
-    // fall through to the single warning below
-  }
-  if (!warnedAccounts.has(account)) {
-    warnedAccounts.add(account);
-    console.warn(`[opencodex] provider key reference keychain:${account} could not be read from the OS keychain; requests for this provider have no credential until the keychain is available (no plaintext fallback)`);
-  }
-  return undefined;
-}
-
-/**
- * Single resolver for provider key material: env references, keychain references, or the
- * literal value. Every request-time read of `apiKey` goes through here.
- */
-export function resolveProviderApiKey(value: string | undefined): string | undefined {
-  if (!value) return undefined;
-  if (isKeychainReference(value)) return readKeychain(keychainAccount(value));
-  return resolveEnvValue(value);
-}
-
-export type ProviderKeyStoreKind = "keychain" | "env" | "file" | "none";
-
-export function providerKeyStoreKind(provider: Pick<OcxProviderConfig, "apiKey"> | undefined): ProviderKeyStoreKind {
-  const key = provider?.apiKey;
-  if (!key) return "none";
-  if (isKeychainReference(key)) return "keychain";
-  if (/^\$\{?\w+\}?$/.test(key)) return "env";
-  return "file";
-}
-
-/** Probe the OS keychain with a throwaway account: write, read back, delete. */
-export function probeProviderKeychain(): { available: true } | { available: false; reason: string } {
-  const account = `probe-${process.pid}-${Date.now()}`;
-  try {
-    const entry = entryFactory(PROVIDER_KEYCHAIN_SERVICE, account);
-    entry.setPassword("ok");
-    const back = entry.getPassword();
-    try { entry.deletePassword(); } catch { /* best effort */ }
-    if (back !== "ok") return { available: false, reason: "keychain read-back did not match" };
-    return { available: true };
-  } catch (error) {
-    return { available: false, reason: error instanceof Error ? error.message : "keychain unavailable" };
-  }
-}
-
 function writeVerified(account: string, secret: string): void {
-  const entry = entryFactory(PROVIDER_KEYCHAIN_SERVICE, account);
+  const entry = providerKeychainEntry(account);
   entry.setPassword(secret);
   if (entry.getPassword() !== secret) throw new Error(`keychain read-back mismatch for ${account}`);
 }
@@ -177,13 +103,12 @@ export function storeProviderKeyInKeychain(config: OcxConfig, name: string): { o
     }
   } catch (error) {
     for (const account of written) {
-      try { entryFactory(PROVIDER_KEYCHAIN_SERVICE, account).deletePassword(); } catch { /* best effort */ }
+      try { providerKeychainEntry(account).deletePassword(); } catch { /* best effort */ }
     }
     return { ok: false, error: `OS keychain write failed: ${error instanceof Error ? error.message : "unknown"}`, status: 503 };
   }
   for (const apply of planned) apply();
-  resolvedCache.clear();
-  warnedAccounts.clear();
+  invalidateResolvedProviderKeyCache();
   saveConfigPreservingClaudeCode(config);
   return { ok: true, moved: written.length };
 }
@@ -211,7 +136,7 @@ export function restoreProviderKeyFromKeychain(config: OcxConfig, name: string):
     const account = keychainAccount(ref);
     if (resolved.has(account)) continue;
     let value: string | null = null;
-    try { value = entryFactory(PROVIDER_KEYCHAIN_SERVICE, account).getPassword(); } catch { value = null; }
+    try { value = providerKeychainEntry(account).getPassword(); } catch { value = null; }
     if (!value) return { ok: false, error: `OS keychain has no readable secret for ${ref}; config left unchanged`, status: 503 };
     resolved.set(account, value);
   }
@@ -220,10 +145,9 @@ export function restoreProviderKeyFromKeychain(config: OcxConfig, name: string):
   }
   if (isKeychainReference(provider.apiKey)) provider.apiKey = resolved.get(keychainAccount(provider.apiKey))!;
   for (const account of resolved.keys()) {
-    try { entryFactory(PROVIDER_KEYCHAIN_SERVICE, account).deletePassword(); } catch { /* best effort */ }
+    try { providerKeychainEntry(account).deletePassword(); } catch { /* best effort */ }
   }
-  resolvedCache.clear();
-  warnedAccounts.clear();
+  invalidateResolvedProviderKeyCache();
   saveConfigPreservingClaudeCode(config);
   return { ok: true, restored: resolved.size };
 }

package/src/providers/model-rename-fields.ts

@@ -0,0 +1,147 @@
+import type { OcxProviderConfig } from "../types";
+
+// Every provider field receives a deliberate identity role. A new field fails typecheck
+// until its model-id semantics are classified; credentials and provider-wide policy are none.
+type ModelRenameRole = "none" | "record" | "list" | "scalar" | "nested-models";
+export const PROVIDER_MODEL_RENAME_ROLES = {
+  alias: "none",
+  modelAliases: "record",
+  modelDisplayNames: "record",
+  defaultAliases: "none",
+  adapter: "none",
+  codexToolMode: "none",
+  requestPacing: "nested-models",
+  mcpMaxTools: "none",
+  mcpMaxSchemaBytes: "none",
+  mcpMaxResultBytes: "none",
+  modelAdapters: "record",
+  fastWire: "none",
+  baseUrl: "none",
+  responsesPath: "none",
+  chatCompletionsPath: "none",
+  commandCodeVersion: "none",
+  statelessResponses: "none",
+  requiresAdjacentResponsesToolResults: "none",
+  requiresPairedResponsesToolResults: "none",
+  annotateEmptyToolOutputs: "none",
+  supportsServiceTier: "none",
+  modelSupportsServiceTier: "record",
+  preserveResponsesReasoningContent: "none",
+  modelReasoningEffortsAuthoritative: "none",
+  dropResponsesReasoningItems: "none",
+  decodesNativeCompactionBlobs: "none",
+  allowEncryptedV2AgentTasks: "none",
+  allowPrivateNetwork: "none",
+  proxy: "none",
+  noProxy: "none",
+  upstreamHttpVersion: "none",
+  upstreamWebsocket: "none",
+  directGeminiWireRenames: "none",
+  disabled: "none",
+  codexAccountMode: "none",
+  apiKey: "none",
+  apiKeyTransport: "none",
+  apiKeyPool: "none",
+  apiKeyPoolStrategy: "none",
+  apiKeySelectionRevision: "none",
+  _apiKeyAttempt: "none",
+  defaultModel: "scalar",
+  models: "list",
+  liveModels: "none",
+  selectedModels: "list",
+  initialModelSelection: "none",
+  retainModels: "list",
+  newModelPolicy: "none",
+  modelPreset: "none",
+  contextWindow: "none",
+  modelContextWindows: "record",
+  modelInputModalities: "record",
+  modelCapabilities: "record",
+  modelMaxInputTokens: "record",
+  modelAutoCompactTokenLimits: "record",
+  defaultMaxOutputTokens: "none",
+  modelMaxOutputTokens: "record",
+  modelCosts: "record",
+  autoReviewModel: "none",
+  autoReviewModelOverrides: "record",
+  headers: "none",
+  openRouterRouting: "none",
+  modelOpenRouterRouting: "record",
+  vercelGatewayRouting: "none",
+  modelVercelGatewayRouting: "record",
+  authMode: "none",
+  oauthAccountFailover: "none",
+  keyOptional: "none",
+  freeTier: "none",
+  note: "none",
+  modelSuffixBracketStrip: "none",
+  refreshPolicy: "none",
+  reasoningEfforts: "none",
+  modelReasoningEfforts: "record",
+  modelSuppressSyntheticMax: "record",
+  modelDefaultReasoningEfforts: "record",
+  pinnedReasoningEffort: "none",
+  modelPinnedReasoningEfforts: "record",
+  modelSupportsReasoningSummaries: "record",
+  modelSupportsVerbosity: "record",
+  supportsVerbosity: "none",
+  modelReasoningSummaryDelivery: "record",
+  modelPreferHostedTools: "record",
+  supportsOpenAiWebSearchToolFields: "none",
+  xaiResponsesXSearch: "none",
+  xaiResponsesDefaultVersion: "none",
+  zaiResponsesDefaultVersion: "none",
+  supportsResponsesCustomTools: "none",
+  unsupportedHostedTools: "none",
+  responsesSnapshotRepair: "none",
+  webSearchBridge: "none",
+  reasoningEffortMap: "none",
+  modelReasoningEffortMap: "record",
+  reasoningWireFormat: "none",
+  noReasoningModels: "list",
+  noTemperatureModels: "list",
+  noTopPModels: "list",
+  noPenaltyModels: "list",
+  noStructuredOutputModels: "list",
+  noJsonSchemaModels: "list",
+  omitReasoningEffortWithToolsModels: "list",
+  parallelToolCalls: "none",
+  pinParallelToolCallsFalse: "none",
+  terminalContinuationGuard: "none",
+  openaiChatEofTolerance: "none",
+  foldDeveloperRoleToSystem: "none",
+  promptCacheKey: "none",
+  chatServiceTier: "none",
+  responsesItemIdRepair: "none",
+  autoToolChoiceOnlyModels: "list",
+  preserveReasoningContentModels: "list",
+  requiresReasoningPlaceholderModels: "list",
+  showThinkingSummary: "none",
+  retryOn429: "none",
+  transientRetryOn5xx: "none",
+  retryOnReset: "none",
+  reasoningSplitModels: "list",
+  reasoningDetailsModels: "list",
+  thinkingToggleModels: "list",
+  thinkingBudgetModels: "list",
+  escapeBuiltinToolNames: "none",
+  anthropicEofTolerance: "none",
+  noVisionModels: "list",
+  googleMode: "none",
+  googleToolSchemaPolicy: "none",
+  project: "none",
+  location: "none",
+  mcpServers: "none",
+  desktopExecutor: "none",
+  unsafeAllowNativeLocalExec: "none",
+  nativeLocalExec: "none",
+} as const satisfies Record<keyof OcxProviderConfig, ModelRenameRole>;
+
+function fieldsWithRole(role: ModelRenameRole): string[] {
+  return Object.entries(PROVIDER_MODEL_RENAME_ROLES).filter(([, value]) => value === role).map(([key]) => key);
+}
+export const MODEL_KEYED_RECORDS = fieldsWithRole("record");
+// Legacy persisted registry field, no longer part of the public provider config interface.
+export const MODEL_ID_LISTS = [...fieldsWithRole("list"), "directReasoningEffortModels"];
+export const MODEL_ID_SCALARS = fieldsWithRole("scalar");
+export const MODEL_NESTED_RECORDS = fieldsWithRole("nested-models");