@bitkyc08/opencodex 2.6.1 → 2.6.2

package/src/codex-catalog.ts

@@ -36,23 +36,49 @@ function isDefaultCatalogPath(path: string): boolean {
 
 /**
  * Native OpenAI / Codex models served via ChatGPT OAuth passthrough — FALLBACK only. The ChatGPT
- * backend has no `GET /models`, so the real set is read from the live Codex catalog (the slugs Codex
- * itself ships for the installed version) via nativeOpenAiSlugs(); this static list is used only when
- * no catalog is present. Keep it to ids ChatGPT actually accepts — advertising a phantom (e.g. an
- * old `gpt-5.2`/`gpt-5.3-codex` that a newer Codex dropped) makes it 400 "model is not supported".
+ * backend has no `GET /models`, so the real set is read from the live Codex catalog via
+ * nativeOpenAiSlugs(); this static list is used when no catalog is present, plus selected documented
+ * Codex-native additions that may lag in a user's installed Codex catalog.
  */
 export const NATIVE_OPENAI_MODELS = [
   "gpt-5.5", "gpt-5.4", "gpt-5.4-mini", "gpt-5.3-codex-spark",
 ];
 
+const DOCUMENTED_NATIVE_OPENAI_ADDITIONS = ["gpt-5.3-codex-spark"];
+
+/**
+ * The ONLY native OpenAI/Codex slugs opencodex advertises. A user's installed Codex ships extra
+ * native models in its live catalog (e.g. `gpt-5.2`, `gpt-5.3-codex`, `codex-auto-review`); those
+ * are legacy/internal and must never surface in `/v1/models` or the subagent picker. Live-catalog
+ * native slugs are filtered against this allowlist so only the supported set is exposed.
+ */
+const SUPPORTED_NATIVE_OPENAI_SLUGS = new Set(NATIVE_OPENAI_MODELS);
+
+/**
+ * True when a bare slug is an OpenAI/Codex-family native that opencodex does NOT support
+ * (legacy/internal like `gpt-5.2`, `gpt-5.3-codex`, `codex-auto-review`). Used to drop these
+ * from the ON-DISK catalog so the Codex file picker matches the live `/v1/models` filter,
+ * WITHOUT removing genuine user-added natives (non gpt-/codex- slugs are preserved).
+ */
+function isUnsupportedOpenAiNativeSlug(slug: string): boolean {
+  if (slug.includes("/")) return false;
+  if (SUPPORTED_NATIVE_OPENAI_SLUGS.has(slug)) return false;
+  return /^(?:gpt|codex)-/.test(slug);
+}
+
+const NATIVE_OPENAI_CONTEXT_OVERRIDES: Record<string, { contextWindow?: number; maxContextWindow?: number }> = {
+  "gpt-5.5": { contextWindow: 272_000, maxContextWindow: 272_000 },
+  "gpt-5.4": { maxContextWindow: 1_000_000 },
+};
+
 /**
  * The native (passthrough) OpenAI slugs to advertise — the LIVE Codex catalog's own bare slugs when
- * available (always-latest: matches exactly what the installed Codex supports), else the static
- * fallback above. Single source for the /v1/models native list and the subagent-default seed.
+ * available, with documented Codex-native additions layered in, else the static fallback above.
+ * Single source for the /v1/models native list and the subagent-default seed.
  */
 export function nativeOpenAiSlugs(): string[] {
   const live = listCatalogNativeSlugs();
-  return live.length > 0 ? live : NATIVE_OPENAI_MODELS;
+  return live.length > 0 ? unique([...live, ...DOCUMENTED_NATIVE_OPENAI_ADDITIONS]) : NATIVE_OPENAI_MODELS;
 }
 
 export interface CatalogModel { id: string; provider: string; owned_by?: string; reasoningEfforts?: string[]; contextWindow?: number; inputModalities?: string[]; }
@@ -142,6 +168,23 @@ function ensureAutoCompactTokenLimit(entry: RawEntry): RawEntry {
   return entry;
 }
 
+function isNativeOpenAiEntry(entry: RawEntry): boolean {
+  return typeof entry.slug === "string" && !entry.slug.includes("/");
+}
+
+function applyNativeOpenAiContextOverride(entry: RawEntry): void {
+  if (!isNativeOpenAiEntry(entry)) return;
+  const override = NATIVE_OPENAI_CONTEXT_OVERRIDES[entry.slug as string];
+  if (!override) return;
+  if (typeof override.contextWindow === "number") {
+    entry.context_window = override.contextWindow;
+    entry.auto_compact_token_limit = Math.floor(override.contextWindow * 0.9);
+  }
+  if (typeof override.maxContextWindow === "number") {
+    entry.max_context_window = override.maxContextWindow;
+  }
+}
+
 function ensureStrictCatalogFields(entry: RawEntry): RawEntry {
   if (typeof entry.supports_reasoning_summaries !== "boolean") entry.supports_reasoning_summaries = true;
   if (typeof entry.default_reasoning_summary !== "string") entry.default_reasoning_summary = "none";
@@ -160,7 +203,7 @@ function ensureStrictCatalogFields(entry: RawEntry): RawEntry {
   if (
     typeof entry.max_context_window !== "number"
     || entry.max_context_window <= 0
-    || entry.max_context_window > contextWindow
+    || (!isNativeOpenAiEntry(entry) && entry.max_context_window > contextWindow)
   ) {
     entry.max_context_window = contextWindow;
   }
@@ -398,6 +441,8 @@ function deriveEntry(template: RawEntry | null, slug: string, desc: string, prio
       normalizeRoutedCatalogEntry(e);
       applyJawcodeCatalogMetadata(e, slug);
       applyCatalogModelMetadata(e, model);
+    } else {
+      applyNativeOpenAiContextOverride(e);
     }
     return ensureStrictCatalogFields(normalizeServiceTiers(e));
   }
@@ -412,6 +457,7 @@ function deriveEntry(template: RawEntry | null, slug: string, desc: string, prio
   else applyReasoningLevels(entry);
   applyJawcodeCatalogMetadata(entry, slug);
   applyCatalogModelMetadata(entry, model);
+  applyNativeOpenAiContextOverride(entry);
   return ensureStrictCatalogFields(normalizeServiceTiers(entry));
 }
 
@@ -451,8 +497,18 @@ export function buildCatalogEntries(template: RawEntry | null, gptSlugs: string[
 /** Bare picker-visible native slugs in the live Codex catalog (drives the subagent picker UI). */
 export function listCatalogNativeSlugs(): string[] {
   const cat = readCurrentCatalogOrCache();
-  return (cat?.models ?? [])
-    .filter(m => typeof m.slug === "string" && !(m.slug as string).includes("/") && m.visibility === "list")
+  return filterSupportedNativeSlugs(cat?.models ?? []);
+}
+
+/**
+ * Keep only picker-visible, bare (non-routed) native slugs that opencodex actually supports.
+ * A user's installed Codex may list legacy/internal natives (`gpt-5.2`, `gpt-5.3-codex`,
+ * `codex-auto-review`, …); the allowlist drops them so `/v1/models` and the subagent picker
+ * never advertise an unsupported native. Exported for regression coverage.
+ */
+export function filterSupportedNativeSlugs(models: RawEntry[]): string[] {
+  return models
+    .filter(m => typeof m.slug === "string" && !(m.slug as string).includes("/") && m.visibility === "list" && SUPPORTED_NATIVE_OPENAI_SLUGS.has(m.slug as string))
     .map(m => m.slug as string);
 }
 
@@ -715,7 +771,13 @@ export async function syncCatalogModels(config: OcxConfig): Promise<{ added: num
   const baseline = readNativeBaseline(catalogPath);
   const goIds = new Set(enabledGo.map(m => m.id));
   const native = (catalog.models ?? [])
-    .filter(m => typeof m.slug === "string" && !(m.slug as string).includes("/") && !goIds.has(m.slug as string))
+    .filter(m => typeof m.slug === "string"
+      && !(m.slug as string).includes("/")
+      && !goIds.has(m.slug as string)
+      // Gap B: drop legacy/internal OpenAI-family natives (gpt-5.2, gpt-5.3-codex,
+      // codex-auto-review, …) from the on-disk catalog too, matching the live /v1/models
+      // allowlist. Genuine user-added natives (non gpt-/codex- slugs) are preserved.
+      && !isUnsupportedOpenAiNativeSlug(m.slug as string))
     .map(m => {
       const slug = m.slug as string;
       const baselinePriority = baseline.get(slug) ?? (m.priority as number);
@@ -726,12 +788,34 @@ export async function syncCatalogModels(config: OcxConfig): Promise<{ added: num
           : baselinePriority;
       return normalizeServiceTiers({ ...m, priority });
     });
+  const nativeSlugs = new Set(native.flatMap(m => typeof m.slug === "string" ? [m.slug] : []));
+  for (const slug of nativeOpenAiSlugs()) {
+    if (nativeSlugs.has(slug)) continue;
+    nativeSlugs.add(slug);
+    const priority = rank.has(slug)
+      ? rank.get(slug)!
+      : featured.length > 0
+        ? featured.length + 100
+        : 9;
+    native.push(deriveEntry(template ? JSON.parse(JSON.stringify(template)) : null, slug, "OpenAI native model (Codex OAuth passthrough).", priority));
+  }
   // Central WS capability override on the FINAL on-disk catalog (the file Codex reads). Applies to
   // native AND routed so the advertised flag matches the implemented endpoint (phase 120.4) and a
   // native template can never leak supports_websockets while the flag is off.
   const wsEnabled = websocketsEnabled(config);
-  catalog.models = [...native, ...goEntries].map(m => {
-    const e = ensureStrictCatalogFields(normalizeServiceTiers(m));
+  // Gap A: never let a transient EMPTY routed fetch wipe routed entries that were on disk. If
+  // gatherRoutedModels returned nothing (provider down / flaky / cache miss) but the pre-sync
+  // catalog DID carry routed entries, preserve those prior routed entries instead of overwriting
+  // them with an empty set — otherwise the Codex picker silently loses kiro/opencode-go models.
+  let routedEntries = goEntries;
+  if (goEntries.length === 0 && catalogHasRoutedEntries(catalog)) {
+    routedEntries = (catalog.models ?? []).filter(m => typeof m.slug === "string" && (m.slug as string).includes("/"));
+    console.warn(`[opencodex] catalog sync: routed model fetch returned empty; preserving ${routedEntries.length} existing routed entr${routedEntries.length === 1 ? "y" : "ies"} on disk.`);
+  }
+  catalog.models = [...native, ...routedEntries].map(m => {
+    const normalized = normalizeServiceTiers(m);
+    applyNativeOpenAiContextOverride(normalized);
+    const e = ensureStrictCatalogFields(normalized);
     if (wsEnabled) e.supports_websockets = true;
     else delete e.supports_websockets;
     return e;

package/src/codex-inject.ts

@@ -81,6 +81,23 @@ function stripExistingModelProvider(content: string): string {
   return out.join("\n");
 }
 
+/**
+ * Drop ROOT-level `model_context_window` / `model_auto_compact_token_limit` overrides (keys before
+ * the first table header). Codex treats these root keys as a global override that wins over the
+ * per-model catalog values, so a stale `model_context_window = 1000000` makes every model (e.g.
+ * gpt-5.5) report a 1M window. Stripping them on (re)injection lets the catalog drive context size.
+ */
+export function stripRootContextWindowOverrides(content: string): string {
+  const lines = content.split("\n");
+  const firstTable = lines.findIndex(l => /^\s*\[/.test(l));
+  return lines
+    .filter((line, i) => {
+      const isRoot = firstTable === -1 || i < firstTable;
+      return !isRoot || !/^\s*model_(?:context_window|auto_compact_token_limit)\s*=/.test(line);
+    })
+    .join("\n");
+}
+
 function stripRootRoutedModel(content: string): string {
   const lines = content.split("\n");
   const firstTable = lines.findIndex(l => /^\s*\[/.test(l));
@@ -243,6 +260,7 @@ export async function injectCodexConfig(port: number, config?: OcxConfig, option
   }
   content = removeProfileSection(content);
   content = stripExistingModelProvider(content);
+  content = stripRootContextWindowOverrides(content);
   content = normalizeServiceTier(content);
   content = ensureFastModeFeature(content);
 

package/src/config.ts

@@ -47,6 +47,16 @@ const providerConfigSchema = z.object({
 
 const RESERVED_PROVIDER_NAMES = new Set(["__proto__", "prototype", "constructor"]);
 const PROVIDER_NAME_PATTERN = /^[A-Za-z0-9](?:[A-Za-z0-9._-]{0,62}[A-Za-z0-9])?$/;
+const HEADER_NAME_PATTERN = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+const SENSITIVE_PROVIDER_HEADERS = new Set([
+  "authorization",
+  "cookie",
+  "set-cookie",
+  "proxy-authorization",
+  "x-api-key",
+  "x-goog-api-key",
+  "x-amz-security-token",
+]);
 
 export function isValidProviderName(name: string): boolean {
   const trimmed = name.trim();
@@ -59,6 +69,31 @@ export function hasOwnProvider(providers: Record<string, unknown>, name: string)
   return Object.prototype.hasOwnProperty.call(providers, name);
 }
 
+export function providerBaseUrlConfigError(baseUrl: string): string | null {
+  try {
+    const parsed = new URL(baseUrl.trim());
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return "baseUrl must be an http(s) URL";
+    if (parsed.username || parsed.password) return "baseUrl must not include embedded credentials";
+    if (parsed.search || parsed.hash) return "baseUrl must not include query strings or fragments";
+  } catch {
+    return "baseUrl must be a valid URL";
+  }
+  return null;
+}
+
+export function providerHeadersConfigError(headers: unknown): string | null {
+  if (headers === undefined) return null;
+  if (!headers || typeof headers !== "object" || Array.isArray(headers)) return "headers must be an object";
+  for (const [name, value] of Object.entries(headers)) {
+    const normalized = name.trim().toLowerCase();
+    if (!normalized || !HEADER_NAME_PATTERN.test(name)) return "headers must use valid HTTP header names";
+    if (SENSITIVE_PROVIDER_HEADERS.has(normalized)) return `headers must not include sensitive header "${name}"; use apiKey/authMode instead`;
+    if (typeof value !== "string") return `header "${name}" value must be a string`;
+    if (/[\r\n]/.test(value)) return `header "${name}" value must not include line breaks`;
+  }
+  return null;
+}
+
 const configSchema = z.object({
   port: z.number().int().min(0).max(65535).default(10100),
   providers: z.record(z.string(), providerConfigSchema),
@@ -72,6 +107,23 @@ const configSchema = z.object({
         message: "provider names must use letters, numbers, dot, underscore, or hyphen and cannot be reserved JavaScript object keys",
       });
     }
+    const provider = config.providers[name];
+    const baseUrlError = providerBaseUrlConfigError(provider.baseUrl);
+    if (baseUrlError) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["providers", name, "baseUrl"],
+        message: baseUrlError,
+      });
+    }
+    const headersError = providerHeadersConfigError((provider as { headers?: unknown }).headers);
+    if (headersError) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["providers", name, "headers"],
+        message: headersError,
+      });
+    }
   }
   if (!hasOwnProvider(config.providers, config.defaultProvider)) {
     ctx.addIssue({

package/src/crash-guard.ts

@@ -1,6 +1,8 @@
 import { appendFileSync, mkdirSync } from "node:fs";
 import { join } from "node:path";
 import { getConfigDir } from "./config";
+import { redactSecretString, redactUrlForLog } from "./redact";
+import { sidecarBreadcrumb, activityBreadcrumb } from "./sidecar-tracker";
 
 /**
  * Process-level safety net for the long-running proxy daemon.
@@ -32,15 +34,106 @@ function crashLogPath(): string {
   return join(dir, "crash.log");
 }
 
-function formatError(kind: string, err: unknown): string {
+export function formatCrashEntry(kind: string, err: unknown, promise?: unknown): string {
   const ts = new Date().toISOString();
   const detail =
     err instanceof Error
-      ? `${err.name}: ${err.message}\n${err.stack ?? "(no stack)"}`
+      ? `${err.name}: ${redactDiagnosticText(err.message)}\n${redactDiagnosticText(err.stack ?? "(no stack)")}`
       : typeof err === "object"
-        ? safeStringify(err)
-        : String(err);
-  return `\n[${ts}] ${kind}\n${detail}\n`;
+        ? redactDiagnosticText(safeStringify(err))
+        : redactDiagnosticText(String(err));
+  return `\n[${ts}] ${kind}\n${detail}${diagnose(err)}${diagnosePromise(promise)}${breadcrumb()}\n`;
+}
+
+/**
+ * Bun surfaces some request-time stream/abort errors with only native frames
+ * (`at <anonymous> (native:1:11)`), so `err.stack` alone cannot locate the
+ * fault. JSC still records the true throw site on hidden own properties
+ * (`sourceURL` / `originalLine` / `originalColumn`) and `Bun.inspect` renders a
+ * code snippet from them — capture both so the next occurrence is pinpointable.
+ */
+function diagnose(err: unknown): string {
+  const lines: string[] = [];
+  try {
+    const ctor = (err as { constructor?: { name?: string } } | null)?.constructor?.name;
+    if (ctor && ctor !== "Error" && ctor !== "Object") lines.push(`  ctor: ${ctor}`);
+    if (err && typeof err === "object") {
+      const e = err as Record<string, unknown>;
+      const cause = e.cause;
+      if (cause !== undefined) {
+        lines.push(`  cause: ${redactDiagnosticText(cause instanceof Error ? `${cause.name}: ${cause.message}` : String(cause))}`);
+      }
+      if (e.code !== undefined) lines.push(`  code: ${redactDiagnosticText(String(e.code))}`);
+      // JSC hidden throw-site fields survive even when the stack is native-only.
+      const sourceURL = e.sourceURL;
+      const line = e.line ?? e.originalLine;
+      const column = e.column ?? e.originalColumn;
+      if (typeof sourceURL === "string" && sourceURL) {
+        lines.push(`  origin: ${redactUrlForLog(sourceURL)}${line !== undefined ? `:${String(line)}` : ""}${column !== undefined ? `:${String(column)}` : ""}`);
+      }
+    }
+    const stack = err instanceof Error ? err.stack ?? "" : "";
+    const hasUsableStack = /\((?!native:)[^)]*:\d+:\d+\)/.test(stack);
+    if (!hasUsableStack) {
+      const snippet = inspectErr(err);
+      if (snippet) lines.push(`  inspect:\n${snippet.split("\n").map(l => `    ${l}`).join("\n")}`);
+    }
+  } catch {
+    /* diagnosis must never throw */
+  }
+  return lines.length ? `\n${lines.join("\n")}` : "";
+}
+
+/**
+ * Bun.inspect renders the JSC source snippet (with the offending line + caret)
+ * for errors whose throw site is otherwise lost to native frames.
+ */
+function inspectErr(err: unknown): string {
+  try {
+    const bun = (globalThis as { Bun?: { inspect?: (v: unknown, o?: unknown) => string } }).Bun;
+    if (!bun?.inspect) return "";
+    return redactDiagnosticText(bun.inspect(err, { depth: 2 }).trim());
+  } catch {
+    return "";
+  }
+}
+
+/**
+ * Inspect the rejected promise itself. Bun sometimes attaches richer context to the promise object
+ * than to the reason, and the rendered form helps distinguish a fetch/stream teardown from app code.
+ */
+function diagnosePromise(promise: unknown): string {
+  if (promise === undefined) return "";
+  try {
+    const bun = (globalThis as { Bun?: { inspect?: (v: unknown, o?: unknown) => string } }).Bun;
+    const rendered = bun?.inspect ? bun.inspect(promise, { depth: 1 }).trim() : String(promise);
+    if (!rendered || rendered === "Promise { <rejected> }") return "";
+    return `\n  promise: ${redactDiagnosticText(rendered.split("\n").join(" "))}`;
+  } catch {
+    return "";
+  }
+}
+
+/**
+ * Record whether a sidecar (web-search / vision) was in flight when the fault fired. A native-only
+ * rejection coinciding with sidecar work is the prime suspect; this turns the correlation into a
+ * logged fact instead of an inference.
+ */
+function breadcrumb(): string {
+  try {
+    const lines: string[] = [];
+    const b = sidecarBreadcrumb();
+    if (b.inFlight > 0 || b.lastLabel) {
+      lines.push(`  sidecar: inFlight=${b.inFlight} last=${b.lastLabel || "-"} sinceMs=${b.sinceMs}`);
+    }
+    const a = activityBreadcrumb();
+    if (a.note) lines.push(`  activity: ${a.note} sinceMs=${a.sinceMs}`);
+    const fetches = recentFetches();
+    if (fetches) lines.push(fetches);
+    return lines.length ? `\n${lines.join("\n")}` : "";
+  } catch {
+    return "";
+  }
 }
 
 function safeStringify(value: unknown): string {
@@ -51,8 +144,40 @@ function safeStringify(value: unknown): string {
   }
 }
 
-function record(kind: string, err: unknown): void {
-  const line = formatError(kind, err);
+let benignSuppressed = 0;
+let benignLastLoggedAt = 0;
+const BENIGN_LOG_INTERVAL_MS = 5 * 60_000;
+
+/**
+ * Bun raises an off-path `unhandledRejection: TypeError: null is not an object` (native-only stack)
+ * whenever a streaming `fetch(..., { signal })` response body is torn down by an abort before/while
+ * we read it — turn supersede, client disconnect, upstream RST. The daemon is never at risk (the
+ * failed request is already isolated), the throw has no JS source location, and call-site body
+ * cancellation cannot fully close the runtime-internal window. Treat this exact shape as benign:
+ * keep the process alive, drop the alarmist banner, and fold repeats into a rate-limited summary so
+ * crash.log stays readable for genuinely novel faults.
+ */
+export function isBenignAbortTeardown(err: unknown): boolean {
+  if (!(err instanceof TypeError)) return false;
+  if (err.message !== "null is not an object") return false; // bare form only (no `(evaluating …)`)
+  const stack = err.stack ?? "";
+  // Native-only: no JS source frame. A real app TypeError would carry a `(file:line:col)` frame.
+  return !/\((?!native:)[^)]*:\d+:\d+\)/.test(stack);
+}
+
+function record(kind: string, err: unknown, promise?: unknown): void {
+  if (kind === "unhandledRejection" && isBenignAbortTeardown(err)) {
+    benignSuppressed++;
+    const now = Date.now();
+    if (now - benignLastLoggedAt < BENIGN_LOG_INTERVAL_MS) return; // fold repeats silently
+    benignLastLoggedAt = now;
+    const summary = `\n[${new Date(now).toISOString()}] benign-abort-teardown x${benignSuppressed}`
+      + ` (Bun fetch-body abort; proxy unaffected)${diagnose(err)}${diagnosePromise(promise)}${breadcrumb()}\n`;
+    benignSuppressed = 0;
+    try { appendFileSync(crashLogPath(), summary); } catch { /* logging must never throw */ }
+    return; // no stderr banner — this is expected noise, not a crash
+  }
+  const line = formatCrashEntry(kind, err, promise);
   // Always surface to stderr so foreground `ocx start` users still see it,
   // then persist for later diagnosis.
   console.error(`⚠️  ${kind} (proxy stayed up; logged to crash.log)`);
@@ -64,6 +189,68 @@ function record(kind: string, err: unknown): void {
   }
 }
 
+interface FetchTrace { url: string; at: number; origin: string; settled: boolean; rejected?: string }
+const FETCH_RING_MAX = 12;
+const fetchRing: FetchTrace[] = [];
+let fetchInstrumented = false;
+
+/**
+ * The recurring native-only rejection carries no source location, and every JS `await fetch(...)`
+ * is already try/caught — so the offending promise is created INSIDE Bun's fetch and rejects off the
+ * awaited path. Wrap global fetch to record each call's origin (a JS stack captured at call time) and
+ * whether it later rejected. crash-guard then dumps the still-pending / recently-rejected fetches so
+ * the next fault names the exact call site Bun lost.
+ */
+function instrumentFetch(): void {
+  if (fetchInstrumented) return;
+  const g = globalThis as { fetch?: typeof fetch };
+  const original = g.fetch;
+  if (typeof original !== "function") return;
+  fetchInstrumented = true;
+  g.fetch = function instrumentedFetch(this: unknown, ...args: Parameters<typeof fetch>): ReturnType<typeof fetch> {
+    let url = "";
+    try {
+      const input = args[0];
+      url = typeof input === "string" ? input : input instanceof URL ? input.href : (input as Request)?.url ?? "";
+    } catch { /* best-effort */ }
+    const origin = (new Error().stack ?? "").split("\n").slice(2, 5).map(l => l.trim()).join(" <- ");
+    const trace: FetchTrace = { url: redactUrlForLog(url), at: Date.now(), origin, settled: false };
+    fetchRing.push(trace);
+    if (fetchRing.length > FETCH_RING_MAX) fetchRing.shift();
+    let p: ReturnType<typeof fetch>;
+    try {
+      p = original.apply(this, args);
+    } catch (e) {
+      trace.settled = true;
+      trace.rejected = redactDiagnosticText(e instanceof Error ? `${e.name}: ${e.message}` : String(e));
+      throw e;
+    }
+    return p.then(
+      r => { trace.settled = true; return r; },
+      e => { trace.settled = true; trace.rejected = redactDiagnosticText(e instanceof Error ? `${e.name}: ${e.message}` : String(e)); throw e; },
+    );
+  } as typeof fetch;
+}
+
+/** Render the recent fetch ring (pending first) for the crash breadcrumb. */
+function recentFetches(): string {
+  try {
+    if (fetchRing.length === 0) return "";
+    const now = Date.now();
+    const rows = fetchRing.slice(-6).map(f => {
+      const state = !f.settled ? "PENDING" : f.rejected ? `REJECTED(${f.rejected})` : "ok";
+      return `    [${state}] ${f.url} ageMs=${now - f.at}${!f.settled ? ` origin=${f.origin}` : ""}`;
+    });
+    return `  fetches:\n${rows.join("\n")}`;
+  } catch {
+    return "";
+  }
+}
+
+function redactDiagnosticText(value: string): string {
+  return redactSecretString(value);
+}
+
 /**
  * Register global handlers that keep the proxy alive and capture full stacks.
  * Idempotent: safe to call more than once.
@@ -71,9 +258,10 @@ function record(kind: string, err: unknown): void {
 export function installCrashGuards(): void {
   if (installed) return;
   installed = true;
+  instrumentFetch();
 
-  process.on("unhandledRejection", reason => {
-    record("unhandledRejection", reason);
+  process.on("unhandledRejection", (reason, promise) => {
+    record("unhandledRejection", reason, promise);
   });
 
   process.on("uncaughtException", err => {

package/src/debug.ts

@@ -1,3 +1,5 @@
+import { redactSecrets } from "./redact";
+
 // Opt-in frame-drop visibility. The streaming path is intentionally quiet (no unconditional
 // console output), so this no-ops unless OCX_DEBUG_FRAMES=1. Lets a malformed/chunk-split
 // upstream frame be detected instead of silently truncating content.
@@ -9,3 +11,12 @@ export function debugDroppedFrame(adapter: string, payload: string): void {
   if (!debugFramesEnabled()) return;
   console.error(`[ocx:frame-drop] ${adapter}: dropped malformed upstream frame (payload redacted, bytes=${payload.length})`);
 }
+
+export function debugProviderDiagnostic(adapter: string, event: string, details: Record<string, unknown>): void {
+  if (!debugFramesEnabled()) return;
+  try {
+    console.error(`[ocx:${adapter}:${event}] ${JSON.stringify(redactSecrets(details))}`);
+  } catch {
+    /* diagnostics must never affect request handling */
+  }
+}

package/src/errors.ts

@@ -17,14 +17,38 @@ export function classifyError(status: number, type: string, message: string): Oc
   }
   if (
     text.includes("insufficient_quota") ||
-    text.includes("exceeded your current quota")
+    text.includes("exceeded your current quota") ||
+    text.includes("quota exhausted") ||
+    text.includes("account quota exceeded") ||
+    text.includes("monthly quota exceeded") ||
+    text.includes("daily quota exceeded")
   ) {
     return { message, type: "insufficient_quota", code: "insufficient_quota" };
   }
-  if (status === 429 || text.includes("rate limit") || text.includes("too many requests")) {
+  if (
+    status === 429 ||
+    text.includes("rate limit") ||
+    text.includes("rate limited") ||
+    text.includes("too many requests") ||
+    text.includes("throttlingexception")
+  ) {
     return { message, type: "rate_limit_error", code: "rate_limit_exceeded" };
   }
-  if (status === 401 || status === 403 || type === "authentication_error") {
+  if (type === "origin_rejected") {
+    return { message, type: "invalid_request_error", code: "origin_rejected" };
+  }
+  if (
+    status === 401 ||
+    status === 403 ||
+    type === "authentication_error" ||
+    text.includes("authentication failed") ||
+    text.includes("access denied") ||
+    text.includes("unauthorizedexception") ||
+    text.includes("unrecognizedclientexception") ||
+    text.includes("unrecognizedclient") ||
+    text.includes("expired token") ||
+    text.includes("expiredtoken")
+  ) {
     return { message, type: "authentication_error", code: "invalid_api_key" };
   }
   if (
@@ -37,6 +61,18 @@ export function classifyError(status: number, type: string, message: string): Oc
     // (responses.rs is_server_overloaded_error); generic "upstream_server_error" is not recognized.
     return { message, type: "server_error", code: "server_is_overloaded" };
   }
+  if (
+    text.includes("validationexception") ||
+    text.includes("invalid request") ||
+    text.includes("model unavailable") ||
+    text.includes("model not found") ||
+    text.includes("unsupported model") ||
+    text.includes("profile arn") ||
+    text.includes("wrong region") ||
+    text.includes("invalid region")
+  ) {
+    return { message, type: "invalid_request_error", code: "invalid_request_error" };
+  }
   if (status >= 500) {
     return { message, type: "server_error", code: "upstream_server_error" };
   }