@bitkyc08/opencodex 2.59.0 → 2.61.0-preview.20260922

package/src/providers/reasoning-metadata.ts

@@ -18,6 +18,7 @@
  * entitlement gap (muse-spark max needs an active Muse Code subscription) costs one rejected
  * request instead of failing every turn that selects that rung.
  */
+import { createHash } from "node:crypto";
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 // Leaf modules on purpose: this file is imported from reasoning-effort.ts, which combos/types.ts
@@ -26,6 +27,7 @@ import { join } from "node:path";
 import { atomicWriteFile } from "../config/atomic-write";
 import { getConfigDir } from "../config/paths";
 import type { OcxProviderConfig } from "../types";
+import { resolveProviderApiKey } from "./api-key-resolve";
 
 const FILENAME = "reasoning-metadata-cache.json";
 const SUPPORT_FILENAME = "reasoning-support-cache.json";
@@ -87,7 +89,7 @@ interface MetadataSnapshot {
 }
 
 interface SupportSnapshot {
-  version: 1;
+  version: 2;
   rows: Record<string, { effort: string; at: number; evidence?: string }>;
 }
 
@@ -159,11 +161,31 @@ function modelLadderValue(
   return undefined;
 }
 
-/** Opaque row key: providerKey|modelId|effort. None of the three may contain a pipe. */
-const KEY_SEP = "|";
+/**
+ * Bind learned capability to the credential that supplied the evidence. A digest keeps the
+ * credential itself out of the persisted cache while remaining stable across restarts and key
+ * selection. Providers without key-auth identity may use metadata, but cannot teach the cache.
+ *
+ * The hash input is the resolved wire credential, not the configured expression: the catalog
+ * path carries the raw config string in apiKey (a keychain:/env reference stays unresolved
+ * there), while the request path carries the resolved secret in apiKey and the configured
+ * expression in _apiKeyAttempt.reference. The request path hashes apiKey exactly as routed --
+ * the reference is only provenance, and re-resolving it at record time could read a credential
+ * rotated since the request was served. The catalog path resolves the configured expression,
+ * so both sides still bind learned refusals to the same wire credential, and a rotation behind
+ * a stable reference starts clean instead of inheriting the previous credential's refusals.
+ */
+function credentialIdentity(provider: OcxProviderConfig): string | undefined {
+  const resolved = provider._apiKeyAttempt?.reference !== undefined
+    ? provider.apiKey
+    : resolveProviderApiKey(provider.apiKey);
+  if (typeof resolved !== "string" || resolved.length === 0) return undefined;
+  return createHash("sha256").update(resolved).digest("hex");
+}
 
-function supportKey(providerKey: string, modelId: string, effort: string): string {
-  return providerKey + KEY_SEP + modelId + KEY_SEP + effort;
+/** JSON encoding avoids delimiter ambiguity in provider, model, and effort identifiers. */
+function supportKey(providerKey: string, credential: string, modelId: string, effort: string): string {
+  return JSON.stringify([providerKey, credential, modelId, effort]);
 }
 
 function loadSnapshot(): MetadataSnapshot | null {
@@ -220,7 +242,9 @@ function loadSupport(): Map<string, number> {
   }
   const rows = new Map<string, number>();
   const parsed = readJsonFile<SupportSnapshot>(SUPPORT_FILENAME);
-  if (parsed && parsed.version === 1 && parsed.rows && typeof parsed.rows === "object") {
+  // Version 1 rows had no credential identity and are deliberately invalidated: accepting them
+  // would preserve destination-wide refusals written by a lower-entitlement account.
+  if (parsed && parsed.version === 2 && parsed.rows && typeof parsed.rows === "object") {
     for (const [key, row] of Object.entries(parsed.rows)) {
       if (!row || typeof row.at !== "number") continue;
       if (nowMs - row.at > SUPPORT_TTL_MS) continue;
@@ -273,8 +297,9 @@ export function metadataDeclaresType(provider: OcxProviderConfig, modelId: strin
 
 export function isReasoningEffortLearnedUnsupported(provider: OcxProviderConfig, modelId: string, effort: string): boolean {
   const key = metadataProviderKey(provider);
-  if (!key) return false;
-  return loadSupport().has(supportKey(key, modelId, effort));
+  const credential = credentialIdentity(provider);
+  if (!key || !credential) return false;
+  return loadSupport().has(supportKey(key, credential, modelId, effort));
 }
 
 /**
@@ -291,10 +316,11 @@ export function dropLearnedUnsupportedReasoningEfforts(
 ): string[] {
   if (efforts.length === 0) return [...efforts];
   const key = metadataProviderKey(provider);
-  if (!key) return [...efforts];
+  const credential = credentialIdentity(provider);
+  if (!key || !credential) return [...efforts];
   const support = loadSupport();
   if (support.size === 0) return [...efforts];
-  const kept = efforts.filter(effort => !support.has(supportKey(key, modelId, effort)));
+  const kept = efforts.filter(effort => !support.has(supportKey(key, credential, modelId, effort)));
   return kept.length === 0 ? [...efforts] : kept;
 }
 
@@ -334,8 +360,9 @@ export function recordUnsupportedReasoningEffort(
   evidence?: string,
 ): boolean {
   const key = metadataProviderKey(provider);
-  if (!key || !effort) return false;
-  const rowKey = supportKey(key, modelId, effort);
+  const credential = credentialIdentity(provider);
+  if (!key || !credential || !effort) return false;
+  const rowKey = supportKey(key, credential, modelId, effort);
   const rows = loadSupport();
   if (rows.has(rowKey)) return false;
   rows.set(rowKey, Date.now());
@@ -346,15 +373,14 @@ export function recordUnsupportedReasoningEffort(
     try {
       const out: SupportSnapshot["rows"] = {};
       for (const [rowKey, at] of rows) {
-        const parts = rowKey.split(KEY_SEP);
         const evidenceText = supportEvidence.get(rowKey);
         out[rowKey] = {
-          effort: parts[2] ?? "",
+          effort: JSON.parse(rowKey)[3] ?? "",
           at,
           ...(evidenceText ? { evidence: evidenceText } : {}),
         };
       }
-      atomicWriteFile(join(getConfigDir(), SUPPORT_FILENAME), JSON.stringify({ version: 1, rows: out }) + "\n");
+      atomicWriteFile(join(getConfigDir(), SUPPORT_FILENAME), JSON.stringify({ version: 2, rows: out }) + "\n");
     } catch {
       // Best-effort persistence only.
     }
@@ -371,11 +397,10 @@ export function flushReasoningSupportCache(): void {
     const rows = loadSupport();
     const out: SupportSnapshot["rows"] = {};
     for (const [rowKey, at] of rows) {
-      const parts = rowKey.split(KEY_SEP);
       const evidenceText = supportEvidence.get(rowKey);
-      out[rowKey] = { effort: parts[2] ?? "", at, ...(evidenceText ? { evidence: evidenceText } : {}) };
+      out[rowKey] = { effort: JSON.parse(rowKey)[3] ?? "", at, ...(evidenceText ? { evidence: evidenceText } : {}) };
     }
-    atomicWriteFile(join(getConfigDir(), SUPPORT_FILENAME), JSON.stringify({ version: 1, rows: out }) + "\n");
+    atomicWriteFile(join(getConfigDir(), SUPPORT_FILENAME), JSON.stringify({ version: 2, rows: out }) + "\n");
   } catch {
     // Best-effort persistence only.
   }

package/src/providers/registry/entries-core.ts

@@ -30,6 +30,8 @@ import {
   OPENAI_API_GPT56_REASONING_EFFORTS,
   META_MUSE_REASONING_EFFORTS,
   META_MUSE_REASONING_EFFORT_MAP,
+  META_MUSE_CODE_REASONING_EFFORTS,
+  META_MUSE_CODE_REASONING_EFFORT_MAP,
   META_MUSE_CONTEXT_WINDOW,
   META_MUSE_MODELS,
   OPENAI_DAYBREAK_MODELS,
@@ -53,7 +55,7 @@ import {
   deepseekThinkingEffortsFor,
   deepseekReasoningMapFor,
   KIMI_K3_STANDARD_CONTEXT_WINDOW,
-  KIMI_CODING_MODELS,
+  KIMI_CODING_LIVE_MODELS,
   KIMI_THINKING_MODELS,
   KIMI_CODING_NO_REASONING_MODELS,
   KIMI_CODING_K3_REASONING_EFFORTS,
@@ -442,8 +444,14 @@ export const PROVIDER_REGISTRY_CORE: readonly ProviderRegistryEntry[] = [
     oauthId: "kimi",
     jawcodeBundle: "moonshot",
     note: "Log in with your Kimi account",
-    models: KIMI_CODING_MODELS,
-    defaultModel: "kimi-k2.7-code",
+    // 260921: the retired k2.x ids stay out of the picker — live /coding/v1/models lists
+    // only kimi-for-coding[-highspeed], k3, k3-256k. Saved rows still naming kimi-k2.7-code
+    // are repaired by MODEL_RENAMES in model-rename-migration.ts.
+    models: KIMI_CODING_LIVE_MODELS,
+    // 260921: kimi-k2.7-code was retired from the subscription endpoint (live /models lists
+    // only kimi-for-coding[-highspeed], k3, k3-256k). The kimi-for-coding alias is the
+    // stable ID and currently routes to K2.8 Preview.
+    defaultModel: "kimi-for-coding",
     modelContextWindows: KIMI_CODING_MODEL_CONTEXT_WINDOWS,
     modelInputModalities: KIMI_CODING_MODEL_INPUT_MODALITIES,
     // K3 accepts low/high/max; Codex aliases are normalized by the model-scoped wire map.
@@ -599,12 +607,15 @@ export const PROVIDER_REGISTRY_CORE: readonly ProviderRegistryEntry[] = [
     label: "Meta Muse Code (CLI credential)",
     adapter: "openai-responses",
     baseUrl: "https://api.meta.ai/v1",
-    // Meta own client sends this on every Muse Code call. We never have, so a future
-    // server-side requirement would break every Muse request with no local signal.
+    // Meta's own client sends these on every Muse Code call. The compatibility marker
+    // is transparent while selecting the credential surface that accepts `max`.
     // Declared here rather than in a transport hook so it also covers model discovery
     // (src/oauth/index.ts:1176) and still yields to a user-set header
     // (mergeRegistryStaticHeaders, src/providers/registry.ts:3494).
-    staticHeaders: { "x-api-version": "1.0.0" },
+    staticHeaders: {
+      "User-Agent": "muse-build/1.3.0 (opencodex compatibility)",
+      "x-api-version": "1.0.0",
+    },
     authKind: "oauth",
     oauthId: "meta-muse",
     dashboardUrl: "https://dev.meta.ai",
@@ -615,8 +626,8 @@ export const PROVIDER_REGISTRY_CORE: readonly ProviderRegistryEntry[] = [
     liveModels: false,
     modelContextWindows: Object.fromEntries(META_MUSE_MODELS.map(id => [id, META_MUSE_CONTEXT_WINDOW])),
     modelInputModalities: Object.fromEntries(META_MUSE_MODELS.map(id => [id, ["text", "image"] as ["text", "image"]])),
-    modelReasoningEfforts: Object.fromEntries(META_MUSE_MODELS.map(id => [id, META_MUSE_REASONING_EFFORTS])),
-    modelReasoningEffortMap: Object.fromEntries(META_MUSE_MODELS.map(id => [id, META_MUSE_REASONING_EFFORT_MAP])),
+    modelReasoningEfforts: Object.fromEntries(META_MUSE_MODELS.map(id => [id, META_MUSE_CODE_REASONING_EFFORTS])),
+    modelReasoningEffortMap: Object.fromEntries(META_MUSE_MODELS.map(id => [id, META_MUSE_CODE_REASONING_EFFORT_MAP])),
     note: "Signs in to Meta with a browser device code on any platform, then mints the Muse Code subscription key. That grant is reimplemented from the one the Muse Code CLI performs and has NOT been exercised against Meta from OpenCodex, so treat the first login as unverified. If the Muse Code CLI is already signed in on macOS, the existing key is imported instead of starting a new grant. A pasted key from https://dev.meta.ai still works as a fallback when a device login cannot complete, and faces the same format check and live validation. A device login authenticates as Meta own Muse Code client, which is a stronger claim than reusing a key the CLI already minted. Meta scopes that credential to the Muse Code CLI, so this is an UNSUPPORTED use: Meta does not authorize subscription coverage outside its own CLI, how these calls settle is not observable from the API, and you should treat every call as billable against your account. The key, imported or pasted, is copied into OpenCodex's auth store. For an account signed in with the device login, OpenCodex refreshes Meta's subscription windows on demand from the same key endpoint the login uses, at most once every five minutes. For an imported or pasted key there is no endpoint to query them on demand, so OpenCodex reads them from streaming responses and shows the last observed value with its age; refreshing one then requires another streaming turn, and translated (non-passthrough) turns report none. Rate limits apply per team, not per key. For a supported path use the meta-model provider with your own key (export it as META_MODEL_API_KEY).",
   },
   {
@@ -652,6 +663,11 @@ export const PROVIDER_REGISTRY_CORE: readonly ProviderRegistryEntry[] = [
     // Zen Go can close a Chat stream after a fully assembled function call without sending
     // finish_reason or [DONE] (#2260). The adapter still rejects incomplete argument JSON.
     openaiChatEofTolerance: true,
+    // Muse Spark on OpenCode Go can sit silent during prolonged reasoning and close without a protocol terminal.
+    modelResponsesTerminalRepair: {
+      "muse-spark-1.2-contributor": { graceMs: 5_000 },
+      "muse-spark-1.3-contributor": { graceMs: 5_000 },
+    },
     // Go rejects reasoning.encrypted_content with previous_response_id (#3838).
     // Use explicit replay history and the existing stateless Responses policy.
     statelessResponses: true,
@@ -696,17 +712,25 @@ export const PROVIDER_REGISTRY_CORE: readonly ProviderRegistryEntry[] = [
       "glm-5.3-flash": ["text", "image"],
       // Experimental DeepSeek vision preview — expected to merge into deepseek-v4-flash later.
       [DEEPSEEK_VISION_PREVIEW_MODEL]: ["text", "image"],
-      // This route is text-only upstream — it is already listed in this preset's
-      // noVisionModels, which routes images through the proxy's vision sidecar and
-      // makes the catalog advertise image input on its behalf. The positive
-      // text-only declaration is what reaches an EXISTING install: derive.ts fills
-      // noVisionModels all-or-nothing, so a config persisted before this id joined
-      // the list keeps a stale list, the sidecar predicate never matches, the row
-      // carries no modality at all, and any combo containing it collapses to
-      // ["text"] (#4505). modelInputModalities IS per-key filled, so this
-      // declaration lands on old configs. It states the route's real upstream
-      // capability and keeps the sidecar explicitly distinct from native vision.
-      "deepseek-v4.1-flash": ["text"],
+      // This route became natively multimodal; it is NOT a sidecar consumer.
+      //
+      // History: the id was declared text-only here and listed in this preset's
+      // noVisionModels, which routed its images through the vision sidecar (#4505).
+      // That classification came from jawcode metadata and went stale. Probed
+      // 2026-09-19 against https://opencode.ai/zen/go/v1/chat/completions with the
+      // headers this proxy sends: the route accepts an image_url part and the model
+      // reads it correctly (a four-band colour chart was described in the right
+      // order). Its sibling deepseek-v4-flash on the same gateway still answers
+      // HTTP 400 "Model only supports text input", which is what keeps the two
+      // distinct here rather than collapsing them.
+      //
+      // The declaration is what reaches an EXISTING install: derive.ts fills
+      // noVisionModels all-or-nothing, so a config persisted while the stale list
+      // was current keeps it forever, and modelInputModalities is filled per-key
+      // BENEATH the saved value. Both halves are repaired by
+      // stale-vision-classification-migration.ts; correcting the registry alone
+      // would fix new installs and leave existing ones stripping images.
+      "deepseek-v4.1-flash": ["text", "image"],
       // Muse Spark Contributor is natively multimodal on Zen Go: it accepts input_image
       // parts over /responses (probed 2026-08-26). Without this declaration the catalog
       // advertises it text-only and the Codex app blocks image attachments client-side with
@@ -760,7 +784,10 @@ export const PROVIDER_REGISTRY_CORE: readonly ProviderRegistryEntry[] = [
     // Kimi K2.7 Code accepts text+image+video: do NOT list it here.
     noVisionModels: [
       "glm-5.3", "glm-5.2", "glm-5", "glm-5.1",
-      "deepseek-v4.1-flash", "deepseek-v4-flash",
+      // deepseek-v4.1-flash is deliberately absent: probed natively multimodal on this
+      // gateway 2026-09-19 (see the modelInputModalities note above). Its sibling
+      // deepseek-v4-flash stays listed — that route rejects image_url upstream.
+      "deepseek-v4-flash",
       "mimo-v2-pro", "mimo-v2.5-pro",
       "minimax-m2.5", "minimax-m2.7",
       "qwen3.7-max",

package/src/providers/registry/entries-extended.ts

@@ -72,10 +72,10 @@ import {
   VOLCENGINE_PLAN_TEXT_ONLY_MODELS,
   ALIBABA_INTL_TOKEN_PLAN_INPUT_MODALITIES,
   KIMI_API_MODELS,
-  KIMI_CODING_MODELS,
   KIMI_THINKING_MODELS,
   KIMI_CODING_NO_REASONING_MODELS,
   KIMI_API_NO_REASONING_MODELS,
+  KIMI_CODING_LIVE_MODELS,
   KIMI_CODING_REASONING_EFFORTS,
   KIMI_CODING_DEFAULT_REASONING_EFFORTS,
   KIMI_CODING_REASONING_EFFORT_MAPS,
@@ -102,6 +102,11 @@ import {
   OPPER_MODEL_CONTEXT_WINDOWS,
   OPPER_MODEL_MAX_OUTPUT_TOKENS,
   OPPER_MODEL_INPUT_MODALITIES,
+  STEPFUN_MODELS,
+  STEPFUN_MODEL_CONTEXT_WINDOWS,
+  STEPFUN_MODEL_INPUT_MODALITIES,
+  STEPFUN_NO_VISION_MODELS,
+  STEPFUN_REASONING_EFFORTS,
 } from "./model-seeds";
 
 export const PROVIDER_REGISTRY_EXTENDED: readonly ProviderRegistryEntry[] = [
@@ -746,9 +751,22 @@ export const PROVIDER_REGISTRY_EXTENDED: readonly ProviderRegistryEntry[] = [
     id: "volcengine-coding-plan",
     label: "Volcengine Ark Coding Plan",
     baseUrl: "https://ark.cn-beijing.volces.com/api/coding/v3",
-    adapter: "openai-chat",
+    responsesPath: "/responses",
+    adapter: "openai-responses",
     authKind: "key",
+    supportsServiceTier: false,
     preserveCustomDestination: true,
+    // A row already saved on Chat keeps Chat. This is a `preserveCustomDestination` key entry,
+    // so `providerMatchesRegistryTransport` refuses the adapter mismatch and the request path
+    // returns the stored row untouched; the alias below still hands it this entry's metadata.
+    // Deliberately no startup config migration: the Z.AI one (`zai-responses-migration.ts`) is
+    // safe only because it rewrites rows the router already canonicalizes, and it gates on
+    // `providerMatchesRegistryTransport` to guarantee that. A Chat row here is NOT canonicalized,
+    // so migrating it would change a wire the operator is actually using, and a marker added
+    // now cannot tell the old default apart from a deliberate pre-upgrade Chat choice.
+    destinationAliases: [{ baseUrl: "https://ark.cn-beijing.volces.com/api/coding/v3", adapter: "openai-chat" }],
+    // Validated Ark Coding Plan continuations reject replayed reasoning items.
+    dropResponsesReasoningItems: true,
     dashboardUrl: "https://console.volcengine.com/ark/region:ark+cn-beijing/overview",
     defaultModel: "ark-code-latest",
     models: VOLCENGINE_CODING_PLAN_MODELS,
@@ -798,6 +816,21 @@ export const PROVIDER_REGISTRY_EXTENDED: readonly ProviderRegistryEntry[] = [
     defaultModel: "qwen3.8-max",
     models: ALIBABA_TOKEN_PLAN_MODELS,
     liveModels: false,
+    // Alibaba documents an OpenAI-compatible Responses API on this same /compatible-mode/v1 base
+    // and ships an official Codex integration guide on wire_api = "responses" (#5097). The
+    // gateway serves the same models over both wires, and qwen3.8-flash, qwen3.7-plus and
+    // glm-5.3 carry live end-to-end evidence there (custom tools, reasoning replay, streaming,
+    // multi-turn continuation).
+    //
+    // That is deliberately NOT expressed as a modelWireDefaults pin. Pinning would move every
+    // existing Codex user of those models onto a different upstream with no config change, and
+    // one delta is unresolved: preserveReasoningContentModels below is read by the CHAT adapter,
+    // while the Responses serializer reads preserveResponsesReasoningContent, which this entry
+    // does not set. On the Responses wire those models would replay with blanked reasoning
+    // content -- less state than they carry today. Z.AI and DeepSeek set both flags together for
+    // exactly this reason. Until that flag is justified against this gateway, Responses stays a
+    // documented per-model modelAdapters opt-in;
+    // tests/providers/alibaba-token-plan-responses-optin.test.ts holds both halves.
     note: "Token Plan Personal Edition · China (Beijing)",
     modelInputModalities: ALIBABA_TOKEN_PLAN_INPUT_MODALITIES,
     modelContextWindows: ALIBABA_TOKEN_PLAN_CONTEXT_WINDOWS,
@@ -980,13 +1013,17 @@ export const PROVIDER_REGISTRY_EXTENDED: readonly ProviderRegistryEntry[] = [
   },
   {
     id: "kimi-code", label: "Kimi (coding)", baseUrl: "https://api.kimi.com/coding/v1", adapter: "openai-chat", authKind: "key",
-    dashboardUrl: "https://platform.moonshot.cn/console/api-keys", defaultModel: "kimi-k2.7-code",
+    // 260921: kimi-k2.7-code was retired from the coding endpoint; the kimi-for-coding alias
+    // is the stable ID and currently routes to K2.8 Preview (same as the OAuth preset).
+    dashboardUrl: "https://platform.moonshot.cn/console/api-keys", defaultModel: "kimi-for-coding",
     modelSuffixBracketStrip: true,
     // API-key form of the same Kimi Code Plan transport; keep cache affinity identical to OAuth.
     promptCacheKey: true,
     // Keep Responses tool-result adjacency aligned with the OAuth preset (#4726).
     requiresAdjacentResponsesToolResults: true,
-    models: KIMI_CODING_MODELS,
+    // 260921: same live-id picker as the OAuth preset — the retired k2.x ids are repaired
+    // in saved configs by MODEL_RENAMES, not offered on fresh installs.
+    models: KIMI_CODING_LIVE_MODELS,
     modelContextWindows: KIMI_CODING_MODEL_CONTEXT_WINDOWS,
     modelInputModalities: KIMI_CODING_MODEL_INPUT_MODALITIES,
     noReasoningModels: KIMI_CODING_NO_REASONING_MODELS,
@@ -1027,6 +1064,11 @@ export const PROVIDER_REGISTRY_EXTENDED: readonly ProviderRegistryEntry[] = [
     // Same DeepSeek routes as the Go preset above, behind the same vendor, so they carry
     // the same json_schema rejection (#1338 / #1415).
     noJsonSchemaModels: [...DEEPSEEK_GATEWAY_THINKING_MODELS, ...OPENCODE_FREE_DEEPSEEK_MODELS],
+    // Muse Spark on Zen can sit silent during prolonged reasoning and close without a protocol terminal.
+    modelResponsesTerminalRepair: {
+      "muse-spark-1.2-contributor-free": { graceMs: 5_000 },
+      "muse-spark-1.3-contributor-free": { graceMs: 5_000 },
+    },
   },
   { id: "vercel-ai-gateway", label: "Vercel AI Gateway", baseUrl: "https://ai-gateway.vercel.sh/v1", adapter: "openai-chat", authKind: "key", dashboardUrl: "https://vercel.com/dashboard" },
   {
@@ -1328,4 +1370,21 @@ export const PROVIDER_REGISTRY_EXTENDED: readonly ProviderRegistryEntry[] = [
     noVisionModels: CODEBUDDY_CN_NO_VISION_MODELS,
     note: "Official CodeBuddy Code CLI (Tencent Cloud), China/internal environment. Uses the documented CODEBUDDY_API_KEY + headless CLI surface; never reads desktop sessions or private console endpoints. Region-isolated from codebuddy (Global); credentials are never exchanged across regions. v1 disables CLI tools (--tools \"\"): text/reasoning only for now. Requires `npm i -g @tencent-ai/codebuddy-code`. AUP/routing authorization flagged for maintainer security review.",
   },
+  {
+    id: "stepfun",
+    label: "StepFun",
+    baseUrl: "https://api.stepfun.com/v1",
+    adapter: "openai-chat",
+    authKind: "key",
+    dashboardUrl: "https://platform.stepfun.com",
+    defaultModel: "step-5-preview",
+    models: STEPFUN_MODELS,
+    liveModels: true,
+    preserveCustomDestination: true,
+    modelContextWindows: STEPFUN_MODEL_CONTEXT_WINDOWS,
+    modelInputModalities: STEPFUN_MODEL_INPUT_MODALITIES,
+    noVisionModels: STEPFUN_NO_VISION_MODELS,
+    reasoningEfforts: STEPFUN_REASONING_EFFORTS,
+    note: "StepFun (阶跃星辰) official OpenAI-compatible API.",
+  },
 ];

package/src/providers/registry/model-ids.ts

@@ -0,0 +1,168 @@
+import type { ProviderRegistryEntry } from "./types";
+
+/**
+ * What a registry field's KEYS mean for selector decoding.
+ *
+ * An encoded selector is decoded against the native model ids a provider is known to accept.
+ * That set used to be a hand-written list of eight registry maps, so an id declared only in an
+ * unlisted map could not be decoded, and every new model-keyed field had to be remembered.
+ *
+ * Every field of ProviderRegistryEntry is classified below, including the ones that carry no
+ * model identity at all. That is deliberate: the "satisfies" check makes a new registry field a
+ * TYPE error until somebody decides what its keys mean, rather than letting it default to
+ * invisible. The two checks are different and both matter - the satisfies clause proves the
+ * classification is exhaustive when this compiles, and the parity test proves the fields the
+ * shipped registry actually carries are the ones classified here.
+ *
+ * These are decode hints and nothing more. A hint does not publish a catalog row, grant
+ * availability or entitlement, and it does not confer transport authority: the caller still
+ * checks registry transport identity before asking for them, and an ambiguous selector is still
+ * rejected rather than guessed.
+ */
+type RegistryFieldModelIdRole =
+  | { readonly kind: "none" }
+  | { readonly kind: "record-keys" }
+  | { readonly kind: "nested-record-keys"; readonly key: "modelSupportsServiceTier" };
+
+const NONE = { kind: "none" } as const;
+const RECORD_KEYS = { kind: "record-keys" } as const;
+/**
+ * Key-auth declares its own service-tier support under a nested map.
+ *
+ * Reading its keys is identity evidence only. It does not activate the key-auth service tier,
+ * which stays the business of the service-tier resolver.
+ */
+const KEY_AUTH_SERVICE_TIER = { kind: "nested-record-keys", key: "modelSupportsServiceTier" } as const;
+
+/**
+ * Not a configuration surface. Exported so the parity suite can compare this classification
+ * against the fields the shipped registry entries actually carry at runtime.
+ */
+export const REGISTRY_FIELD_MODEL_ID_ROLES = {
+  id: NONE,
+  label: NONE,
+  adapter: NONE,
+  baseUrl: NONE,
+  apiKeyTransport: NONE,
+  alias: NONE,
+  authKind: NONE,
+  codexAccountMode: NONE,
+  allowKeyAuthOverride: NONE,
+  allowPrivateNetworkByDefault: NONE,
+  keyOptional: NONE,
+  apiKeyValidation: NONE,
+  freeTier: NONE,
+  allowBaseUrlOverride: NONE,
+  preserveCustomDestination: NONE,
+  baseUrlChoices: NONE,
+  staticHeaders: NONE,
+  modelSuffixBracketStrip: NONE,
+  featured: NONE,
+  sponsor: NONE,
+  dashboardPreset: NONE,
+  note: NONE,
+  dashboardUrl: NONE,
+  defaultModel: NONE,
+  models: NONE,
+  liveModels: NONE,
+  modelWireDefaults: RECORD_KEYS,
+  fastWire: NONE,
+  modelResponsesUpstreamStreaming: RECORD_KEYS,
+  modelResponsesTerminalRepair: RECORD_KEYS,
+  responsesItemIdRepair: NONE,
+  responsesPath: NONE,
+  chatCompletionsPath: NONE,
+  destinationAliases: NONE,
+  statelessResponses: NONE,
+  requiresAdjacentResponsesToolResults: NONE,
+  requiresPairedResponsesToolResults: NONE,
+  annotateEmptyToolOutputs: NONE,
+  supportsServiceTier: NONE,
+  supportsOpenAiWebSearchToolFields: NONE,
+  supportsResponsesCustomTools: NONE,
+  modelSupportsServiceTier: RECORD_KEYS,
+  keyAuthServiceTier: KEY_AUTH_SERVICE_TIER,
+  fastTierDescription: NONE,
+  modelServiceTierCapabilityBaseUrlGuard: NONE,
+  preserveResponsesReasoningContent: NONE,
+  dropResponsesReasoningItems: NONE,
+  modelSupportsReasoningSummaries: RECORD_KEYS,
+  modelSupportsVerbosity: RECORD_KEYS,
+  supportsVerbosity: NONE,
+  modelDiscovery: NONE,
+  contextWindow: NONE,
+  modelContextWindows: RECORD_KEYS,
+  modelDisplayNames: RECORD_KEYS,
+  modelInputModalities: RECORD_KEYS,
+  defaultMaxOutputTokens: NONE,
+  modelMaxOutputTokens: RECORD_KEYS,
+  reasoningEfforts: NONE,
+  modelReasoningEfforts: RECORD_KEYS,
+  modelDefaultReasoningEfforts: RECORD_KEYS,
+  reasoningEffortMap: NONE,
+  modelReasoningEffortMap: RECORD_KEYS,
+  directReasoningEffortModels: NONE,
+  reasoningWireFormat: NONE,
+  noVisionModels: NONE,
+  noReasoningModels: NONE,
+  noTemperatureModels: NONE,
+  noTopPModels: NONE,
+  noPenaltyModels: NONE,
+  noJsonSchemaModels: NONE,
+  parallelToolCalls: NONE,
+  promptCacheKey: NONE,
+  chatServiceTier: NONE,
+  openaiChatEofTolerance: NONE,
+  autoToolChoiceOnlyModels: NONE,
+  preserveReasoningContentModels: NONE,
+  requiresReasoningPlaceholderModels: NONE,
+  showThinkingSummary: NONE,
+  reasoningSplitModels: NONE,
+  reasoningDetailsModels: NONE,
+  thinkingToggleModels: NONE,
+  thinkingBudgetModels: NONE,
+  escapeBuiltinToolNames: NONE,
+  oauthId: NONE,
+  virtualModels: RECORD_KEYS,
+  modelMaxInputTokens: RECORD_KEYS,
+  jawcodeBundle: NONE,
+  extraMetadataAliases: NONE,
+  metadataModelIdNormalize: NONE,
+  googleMode: NONE,
+  project: NONE,
+  location: NONE,
+} satisfies Record<keyof ProviderRegistryEntry, RegistryFieldModelIdRole>;
+
+/**
+ * The native model ids this registry entry names, in registry-field order, first seen wins.
+ *
+ * Only KEYS are collected. virtualModels is a map whose keys are the selected identities and
+ * whose values name a transport target, so its wireModelId values are deliberately not read:
+ * a wire target is not something a client may select by name.
+ */
+export function registryModelIdKeys(entry: ProviderRegistryEntry): readonly string[] {
+  const ids: string[] = [];
+  const seen = new Set<string>();
+  const add = (key: string): void => {
+    if (key.length === 0 || seen.has(key)) return;
+    seen.add(key);
+    ids.push(key);
+  };
+  for (const field of Object.keys(REGISTRY_FIELD_MODEL_ID_ROLES) as (keyof ProviderRegistryEntry)[]) {
+    const role = REGISTRY_FIELD_MODEL_ID_ROLES[field];
+    if (role.kind === "none") continue;
+    if (role.kind === "record-keys") {
+      const map = entry[field];
+      if (typeof map !== "object" || map === null) continue;
+      for (const key of Object.keys(map)) add(key);
+      continue;
+    }
+    // The nested role belongs to keyAuthServiceTier alone, so its owner is read by name.
+    // ProviderRegistryEntry is an interface and carries no implicit index signature, so a
+    // by-name read is what keeps this loop typed instead of asserted through unknown.
+    const nested = entry.keyAuthServiceTier?.[role.key];
+    if (typeof nested !== "object" || nested === null) continue;
+    for (const key of Object.keys(nested)) add(key);
+  }
+  return Object.freeze(ids);
+}