@bitkyc08/opencodex 2.63.0 → 2.64.0-preview.20260923

package/src/providers/resolved-model-policy.ts

@@ -37,7 +37,7 @@ export type StaticProviderPolicyField =
   | "supportsResponsesCustomTools" | "preserveResponsesReasoningContent" | "dropResponsesReasoningItems"
   | "modelSupportsReasoningSummaries"
   | "supportsVerbosity" | "modelSupportsVerbosity" | "responsesItemIdRepair" | "autoToolChoiceOnlyModels"
-  | "preserveReasoningContentModels" | "requiresReasoningPlaceholderModels" | "reasoningSplitModels"
+  | "preserveReasoningContentModels" | "requiresReasoningPlaceholderModels" | "reasoningSplitModels" | "inlineThinkTagModels"
   | "reasoningDetailsModels" | "thinkingToggleModels" | "thinkingBudgetModels" | "showThinkingSummary"
   | "escapeBuiltinToolNames" | "googleMode" | "project" | "location" | "modelCapabilities"
   | "modelAutoCompactTokenLimits" | "modelSuppressSyntheticMax" | "modelReasoningSummaryDelivery"
@@ -230,6 +230,8 @@ export function resolveModelPolicy(input: ResolveModelPolicyInput): ResolvedMode
     "preserveReasoningContentModels", "requiresReasoningPlaceholderModels",
     "reasoningSplitModels", "reasoningDetailsModels", "thinkingToggleModels", "thinkingBudgetModels",
   ] as const) putUnion(key, entry?.[key]);
+  // This parser is opt-in: an explicit list, including [], overrides registry defaults.
+  putScalar("inlineThinkTagModels", entry?.inlineThinkTagModels);
   for (const directModel of entry?.directReasoningEffortModels ?? []) {
     const staleBudget = [directModel, ...(entry?.thinkingBudgetModels ?? [])];
     const routedStaleBudget = [...(entry?.thinkingBudgetModels ?? []), directModel];
@@ -281,7 +283,7 @@ export function resolveModelPolicy(input: ResolveModelPolicyInput): ResolvedMode
     return exact !== "unknown" ? exact : operatorDefault !== undefined ? "operator" : registryDefault !== undefined ? "registry" : "unknown";
   };
   const configuredAdapter = provider.modelAdapters?.[input.modelId];
-  const pin = pinnedWireAdapter(input.providerName, input.modelId);
+  const pin = pinnedWireAdapter(input.providerName, input.modelId, provider);
   const normalizedModelId = input.modelId.trim().toLowerCase();
   const registryWire = wireDefault(entry?.modelWireDefaults?.[normalizedModelId], provider, entry,
     input.inboundWire ?? "responses", resolvedAuthMode);

package/src/providers/service-tier.ts

@@ -1,5 +1,5 @@
 import type { OcxProviderConfig } from "../types";
-import { captureWireAdapterHardPins } from "../types";
+import { captureWireAdapterHardPinPrefixes, captureWireAdapterHardPins } from "../types";
 import { isCanonicalOpenAiForwardProvider } from "./openai-tiers";
 import {
   getProviderRegistryEntry,
@@ -113,6 +113,7 @@ function buildFastPolicyAuthority(
     }),
     modelAdapters: Object.freeze({ ...(provider.modelAdapters ?? {}) }),
     hardPins: captureWireAdapterHardPins(providerName),
+    hardPinPrefixes: captureWireAdapterHardPinPrefixes(providerName, provider),
     registryWireDefaults: cloneRegistryWireDefaults(registry?.modelWireDefaults),
   });
   return authority;
@@ -158,6 +159,7 @@ function authorityForProvider(
       ...authority,
       modelAdapters: Object.freeze({}),
       hardPins: Object.freeze({}),
+      hardPinPrefixes: Object.freeze({}),
       registryWireDefaults: Object.freeze({}),
     });
   }

package/src/reasoning-effort.ts

@@ -168,11 +168,12 @@ export function configuredReasoningEfforts(provider: OcxProviderConfig, modelId:
   }
   // models.dev publishes the per-model ladder that routed providers never expose on /models.
   // (OpenCode Zen Go answers ids only). Only consulted when nothing was configured for this
-  // model, so every hand-written contract stays authoritative. The snapshot refreshes itself in
-  // the background; no snapshot means the previous behaviour.
-  // The refresh is asked for only once a snapshot has already answered, which means it only ever
-  // refreshes a STALE snapshot. Review asked for the opposite — refresh when the snapshot is
-  // missing or corrupt, since that is the case this lookup cannot serve. That is declined here:
+  // model, so every hand-written contract stays authoritative. Catalog sync bootstraps the
+  // snapshot with a bounded wait; an existing stale snapshot refreshes in the background.
+  // The refresh helper refuses to fetch a missing snapshot, so it only ever refreshes a STALE
+  // snapshot, including when a classified model supplied the fallback ladder. Review asked for
+  // the opposite — refresh when the snapshot is missing or corrupt, since that is the case this
+  // lookup cannot serve. That is declined here:
   // a missing snapshot is the default state of every fresh install and every test process, so
   // requesting the fetch here puts a models.dev request on the request path of the first routed
   // turn to a gated destination. Refreshing a snapshot that does not exist is catalog-sync work,

package/src/responses/code-mode-helper-compat.ts

@@ -4,6 +4,7 @@ import {
   unwrapFreeformToolInput,
 } from "./apply-patch-envelope";
 import { declaresCodeModeExec } from "../types/tools";
+import { parseCodeModeShellInput } from "./code-mode-shell-input";
 
 function isPlainObject(value: unknown): value is Record<string, unknown> {
   return !!value && typeof value === "object" && !Array.isArray(value);
@@ -31,6 +32,10 @@ export function compileCodeModeHelperInput(
   const helperName = toolName.startsWith("default.")
     ? toolName.slice("default.".length)
     : toolName;
+  if (helperName === "exec_command" && wireToolName === "exec") {
+    const args = parseCodeModeShellInput(argumentsText);
+    if (args) return `const result = await tools.exec_command(${JSON.stringify(args)});\ntext(result);`;
+  }
   if (helperName === "apply_patch") {
     // `resolveCodeModeHelperName` decides this IS an apply-patch call by reading
     // `unwrapFreeformToolInput(argumentsText, wireToolName)`, which strips an outer Markdown
@@ -43,8 +48,12 @@ export function compileCodeModeHelperInput(
     // is an apply_patch wrapper and is not an `exec` fallback field, and the recognizer already
     // declines it under `exec`; reading it here would compile a body that recognition rejected,
     // which is exactly the drift a second, looser unwrap introduces.
+    const bodyToolName = wireToolName ?? helperName;
+    const normalizedBodyToolName = bodyToolName.startsWith("default.")
+      ? bodyToolName.slice("default.".length)
+      : bodyToolName;
     const patch = normalizeApplyPatchDelimiters(
-      unwrapFreeformToolInput(argumentsText, wireToolName ?? helperName),
+      unwrapFreeformToolInput(argumentsText, normalizedBodyToolName),
     );
     return `const result = await tools.apply_patch(${JSON.stringify(patch)});\ntext(result);`;
   }
@@ -96,8 +105,8 @@ export function compileCodeModeHelperInput(
  * wrong.
  *
  * This adds that second case: the name is already `exec` so nothing was rewritten, but
- * the body is a complete patch envelope and therefore cannot be the JavaScript that
- * `exec` runs. Same inference the name-based path makes, drawn from the payload.
+ * the body is a complete patch envelope or an unambiguous structured shell call.
+ * Same inference the name-based path makes, drawn from the payload.
  *
  * Returns undefined for everything else, including JavaScript that merely mentions a
  * patch envelope — that body is a real program and is forwarded byte-identical.
@@ -116,5 +125,6 @@ export function resolveCodeModeHelperName(
   // `tools.apply_patch(...)` JavaScript would be the mis-route this repair exists to avoid.
   if (!declaresCodeModeExec(declaredNames)) return undefined;
   if (typeof argumentsText !== "string" || argumentsText === "") return undefined;
-  return isCompletePatchEnvelope(unwrapFreeformToolInput(argumentsText, "exec")) ? "apply_patch" : undefined;
+  if (isCompletePatchEnvelope(unwrapFreeformToolInput(argumentsText, "exec"))) return "apply_patch";
+  return parseCodeModeShellInput(argumentsText) ? "exec_command" : undefined;
 }

package/src/responses/code-mode-shell-input.ts

@@ -0,0 +1,54 @@
+import { unwrapFreeformToolInput } from "./apply-patch-envelope";
+import { scanFreeformWrapper } from "./freeform-wrapper-scan";
+
+const SHELL_ARGUMENT_KEYS = new Set([
+  "cmd", "command", "workdir", "shell", "login", "tty", "yield_time_ms",
+  "max_output_tokens", "sandbox_permissions", "justification", "prefix_rule",
+]);
+let javascriptParser: Bun.Transpiler | undefined;
+
+/** Recognize shell arguments, never guess a shell from an ordinary freeform program. */
+export function parseCodeModeShellInput(argumentsText: string): Record<string, unknown> | undefined {
+  let parsed: unknown;
+  try {
+    // Only the canonical input wrapper is removed: the cmd/command object is the payload.
+    parsed = JSON.parse(unwrapFreeformToolInput(argumentsText));
+  } catch {
+    return undefined;
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return undefined;
+  const args = parsed as Record<string, unknown>;
+  if (Object.keys(args).some(key => !SHELL_ARGUMENT_KEYS.has(key))) return undefined;
+  const keys = ["cmd", "command"].filter(key => Object.hasOwn(args, key));
+  if (keys.length !== 1) return undefined;
+  const command = args[keys[0]!];
+  if (typeof command !== "string" || command.trim() === "") return undefined;
+  // cmd/command also exist as historical JavaScript fallback fields. Preserve every valid
+  // program, including ambiguous identifiers such as `ls`. Parsing never executes the source.
+  try {
+    javascriptParser ??= new Bun.Transpiler({ loader: "js" });
+    javascriptParser.scan(`async function __codeModeInput() {\n${command}\n}`);
+    return undefined;
+  } catch {
+    const { command: _alias, ...rest } = args;
+    return { ...rest, cmd: command };
+  }
+}
+
+/** Hold possible shell objects until completion can choose their executable representation. */
+export function mayBecomeCodeModeShellInput(argumentsText: string, input: string): boolean {
+  const head = input.trimStart();
+  if (head === "" || head.startsWith("{")) return true;
+  // Canonical JavaScript streams progressively; avoid reparsing its growing wrapper on every
+  // delta. The shared prefix scanner is bounded independently of the command's size.
+  if (input === argumentsText || scanFreeformWrapper(argumentsText).kind === "input") return false;
+  try {
+    const args = JSON.parse(argumentsText);
+    // A fallback cmd value becomes visible only when the outer object closes. Do not emit
+    // that command before completion replaces it with tools.exec_command JavaScript.
+    return !!args && typeof args === "object" && !Object.hasOwn(args, "input")
+      && (Object.hasOwn(args, "cmd") || Object.hasOwn(args, "command"));
+  } catch {
+    return false;
+  }
+}

package/src/responses/custom-tool-compat.ts

@@ -241,6 +241,160 @@ function rewriteForUpstream(
   return changed ? next : value;
 }
 
+/** Request-layer compatibility failure. Callers map this to HTTP 400, never an unhandled 500. */
+export class RoutedCustomToolCompatError extends Error {
+  readonly code = "custom_tool_compat";
+  constructor(
+    readonly stage: string,
+    readonly itemType: string,
+  ) {
+    super(`custom_tool_compat: ${stage}: ${itemType}`);
+    this.name = "RoutedCustomToolCompatError";
+  }
+}
+
+function collectDeclaredFunctionWireNames(body: unknown): Set<string> {
+  const names = new Set<string>();
+  const register = (tool: unknown, namespace?: string): void => {
+    if (!isPlainObject(tool) || tool.type !== "function" || typeof tool.name !== "string") return;
+    names.add(customToolWireName(namespace, tool.name));
+  };
+  for (const group of collectResponsesToolGroups(body)) {
+    for (const tool of group) {
+      if (!isPlainObject(tool)) continue;
+      if (tool.type === "namespace" && typeof tool.name === "string" && Array.isArray(tool.tools)) {
+        for (const child of tool.tools) register(child, tool.name);
+        continue;
+      }
+      register(tool);
+    }
+  }
+  return names;
+}
+
+function historicalCallIdentity(
+  item: Record<string, unknown>,
+): { name: string; namespace?: string } | undefined {
+  if (typeof item.name !== "string" || item.name.length === 0) return undefined;
+  return {
+    name: item.name,
+    ...(typeof item.namespace === "string" ? { namespace: item.namespace } : {}),
+  };
+}
+
+function sameHistoricalIdentity(
+  left: { name: string; namespace?: string },
+  right: { name: string; namespace?: string },
+): boolean {
+  return left.name === right.name && left.namespace === right.namespace;
+}
+
+/**
+ * Convert remaining protocol-history custom items when the destination has denied native custom
+ * tools. Walks only the top-level `input` array so tool-output JSON cannot be rewritten, and does
+ * not merge historical names into the live declaration / restore sets.
+ */
+function rewriteHistoricalCustomItems(
+  body: unknown,
+  declaredFunctionWireNames: ReadonlySet<string>,
+): unknown {
+  if (!isPlainObject(body) || !Array.isArray(body.input)) return body;
+
+  const calls = new Map<string, { name: string; namespace?: string }>();
+  const historicalCustomCallIds = new Set<string>();
+  for (const item of body.input) {
+    if (!isPlainObject(item)) continue;
+    if (item.type !== "custom_tool_call" && item.type !== "function_call") continue;
+    if (typeof item.call_id !== "string" || item.call_id.length === 0) {
+      if (item.type === "custom_tool_call") {
+        throw new RoutedCustomToolCompatError("historical_item", "custom_tool_call.call_id");
+      }
+      continue;
+    }
+    const identity = historicalCallIdentity(item);
+    if (!identity) {
+      if (item.type === "custom_tool_call") {
+        throw new RoutedCustomToolCompatError("historical_item", "custom_tool_call.name");
+      }
+      continue;
+    }
+    const existing = calls.get(item.call_id);
+    if (existing) {
+      throw new RoutedCustomToolCompatError(
+        "historical_item",
+        sameHistoricalIdentity(existing, identity) ? "duplicate_call_id" : "call_id",
+      );
+    }
+    calls.set(item.call_id, identity);
+    if (item.type === "custom_tool_call") historicalCustomCallIds.add(item.call_id);
+  }
+
+  let changed = false;
+  const input = body.input.map(item => {
+    if (!isPlainObject(item)) return item;
+    if (item.type === "custom_tool_call") {
+      if (typeof item.call_id !== "string" || item.call_id.length === 0) {
+        throw new RoutedCustomToolCompatError("historical_item", "custom_tool_call.call_id");
+      }
+      if (typeof item.name !== "string" || item.name.length === 0) {
+        throw new RoutedCustomToolCompatError("historical_item", "custom_tool_call.name");
+      }
+      if (typeof item.input !== "string") {
+        throw new RoutedCustomToolCompatError("historical_item", "custom_tool_call.input");
+      }
+      const wireName = customToolWireName(
+        typeof item.namespace === "string" ? item.namespace : undefined,
+        item.name,
+      );
+      if (declaredFunctionWireNames.has(wireName)) {
+        throw new RoutedCustomToolCompatError("historical_collision", "declared_function_name");
+      }
+      const { input: rawInput, id: _id, ...rest } = item;
+      changed = true;
+      return {
+        ...rest,
+        type: "function_call",
+        arguments: JSON.stringify({ input: rawInput }),
+      };
+    }
+    if (
+      item.type === "custom_tool_call_output"
+      && typeof item.call_id === "string"
+      && historicalCustomCallIds.has(item.call_id)
+    ) {
+      changed = true;
+      return { ...item, type: "function_call_output" };
+    }
+    return item;
+  });
+  return changed ? { ...body, input } : body;
+}
+
+export function validateFinalCustomToolCompatibility(
+  body: unknown,
+  supportsResponsesCustomTools?: boolean,
+): void {
+  if (supportsResponsesCustomTools !== false || !isPlainObject(body)) return;
+
+  const rejectCustomDeclaration = (tool: unknown): void => {
+    if (!isPlainObject(tool)) return;
+    if (tool.type === "custom") throw new RoutedCustomToolCompatError("final_guard", "custom");
+    if (tool.type === "namespace" && Array.isArray(tool.tools)) {
+      for (const child of tool.tools) rejectCustomDeclaration(child);
+    }
+  };
+  for (const group of collectResponsesToolGroups(body)) {
+    for (const tool of group) rejectCustomDeclaration(tool);
+  }
+  if (!Array.isArray(body.input)) return;
+  for (const item of body.input) {
+    if (!isPlainObject(item) || typeof item.type !== "string") continue;
+    if (item.type === "custom_tool_call" || item.type === "custom_tool_call_output") {
+      throw new RoutedCustomToolCompatError("final_guard", item.type);
+    }
+  }
+}
+
 export function rewriteRoutedCustomToolsForUpstream(
   body: unknown,
   supportsResponsesCustomTools?: boolean,
@@ -255,22 +409,36 @@ export function rewriteRoutedCustomToolsForUpstream(
   for (const name of repairNames) {
     if (!toolChoiceAllowsRoutedCustomTool(body, name, repairNames)) repairNames.delete(name);
   }
-  if (conversionNames.size === 0) return { body, names, repairNames };
-  const callIds = new Set<string>();
-  collectConvertedCallIds(body, conversionNames, callIds);
-  return { body: rewriteForUpstream(body, conversionNames, callIds), names, repairNames };
+  if (conversionNames.size === 0 && supportsResponsesCustomTools !== false) {
+    return { body, names, repairNames };
+  }
+  let next = body;
+  if (conversionNames.size > 0) {
+    const callIds = new Set<string>();
+    collectConvertedCallIds(body, conversionNames, callIds);
+    next = rewriteForUpstream(body, conversionNames, callIds);
+  }
+  if (supportsResponsesCustomTools === false) {
+    next = rewriteHistoricalCustomItems(next, collectDeclaredFunctionWireNames(body));
+  }
+  return { body: next, names, repairNames };
 }
 
 /**
  * A delta result has no tool name. Without its call, lowering cannot tell whether it belongs
  * to a converted function or a native custom tool. Request full replay instead of guessing.
+ * A destination that has denied custom tools also cannot map an orphan result when the current
+ * catalog is empty, so that case must request replay rather than forwarding the native type.
  */
 export function hasUnmappedRoutedCustomToolOutput(
   body: unknown,
   supportsResponsesCustomTools?: boolean,
 ): boolean {
   if (!isPlainObject(body) || !Array.isArray(body.input)) return false;
-  if (collectRoutedCustomToolNames(body, supportsResponsesCustomTools).size === 0) return false;
+  if (
+    supportsResponsesCustomTools !== false
+    && collectRoutedCustomToolNames(body, supportsResponsesCustomTools).size === 0
+  ) return false;
   const callIds = new Set<string>();
   for (const item of body.input) {
     if (isPlainObject(item)

package/src/responses/parser.ts

@@ -42,6 +42,28 @@ function replayThoughtSignatureMetadata(
   return signature ? { google: { thoughtSignature: signature } } : undefined;
 }
 
+/**
+ * Repair one bounded inbound-history corruption: a JSON object literal that lost exactly
+ * its opening brace (observed as `code":"…}` after `{"` went missing, taking the key's
+ * opening quote with it). Only a text that ends with `}` and parses into an object once
+ * the brace is restored counts — anything looser keeps the tolerated-{} fallback so
+ * freeform text that merely resembles JSON is never rewritten.
+ */
+function repairJsonObjectEnvelope(text: string): Record<string, unknown> | undefined {
+  if (!text.endsWith("}")) return undefined;
+  // A body that still opens with a quoted key lost only `{`; the observed shape lost
+  // `{"` together, taking the key's opening quote with it. Both restorations must parse
+  // into an object, so freeform text that merely resembles JSON is never rewritten.
+  const candidate = text.startsWith('"') ? `{${text}` : `{"${text}`;
+  try {
+    const parsed: unknown = JSON.parse(candidate);
+    if (isObj(parsed)) return parsed;
+  } catch {
+    /* fall through to the tolerated-{} path */
+  }
+  return undefined;
+}
+
 
 
 function ensureAssistantPlaceholder(messages: OcxMessage[], modelId: string, now: number): OcxAssistantMessage {
@@ -94,6 +116,10 @@ function attachPendingReasoningToCallOwner(
 
 const REASONING_EFFORTS = new Set(["none", "minimal", "low", "medium", "high", "xhigh", "max"]);
 
+export function hasValidatedActiveReasoningEffort(options: Pick<OcxRequestOptions, "reasoning">): boolean {
+  return options.reasoning !== undefined && options.reasoning !== "none";
+}
+
 
 export function parseRequest(
   body: unknown,
@@ -333,7 +359,16 @@ export function parseRequest(
             const parsed: unknown = JSON.parse(rawArgs);
             if (isObj(parsed)) args = parsed;
           } catch {
-            console.warn(`[parser] function_call ${call.call_id} has non-JSON arguments; defaulting to {}`);
+            // One observed serialization corruption loses exactly the JSON object's opening
+            // brace; the closed envelope is tight enough to repair back into a call the
+            // routed model can still see and retry, instead of replaying {} forever.
+            const repaired = repairJsonObjectEnvelope(rawArgs);
+            if (repaired === undefined) {
+              console.warn(`[parser] function_call ${call.call_id} has non-JSON arguments; defaulting to {}`);
+            } else {
+              args = repaired;
+              console.warn(`[parser] function_call ${call.call_id} arguments lost the JSON opening brace; repaired from history`);
+            }
           }
         }
         // Do NOT map Responses item `id` (fc_/ctc_/…) onto `thoughtSignature`. That field is
@@ -542,7 +577,8 @@ export function parseRequest(
     options.reasoning = requestedEffort;
   }
   const summaryMode = data.reasoning?.summary;
-  if (!summaryMode || summaryMode === "none") options.hideThinkingSummary = true;
+  const reasoningActive = hasValidatedActiveReasoningEffort(options);
+  if (summaryMode === "none" || (!summaryMode && !reasoningActive)) options.hideThinkingSummary = true;
   if (data.presence_penalty !== undefined) options.presencePenalty = data.presence_penalty;
   if (data.frequency_penalty !== undefined) options.frequencyPenalty = data.frequency_penalty;
   if (data.service_tier !== undefined) options.serviceTier = data.service_tier;

package/src/responses/reasoning-replay-cache.ts

@@ -192,6 +192,32 @@ export function reasoningReplayServingIdentityChanged(
   return previous !== undefined && previous.identity !== current.identity;
 }
 
+/**
+ * Whether the conversation's last serving route kept its items in a store this route cannot
+ * read: a different durable destination or credential.
+ *
+ * A replayed reasoning item's `rs_*` id names an item in that store. Once the store differs, a
+ * stateful Responses destination resolves the id against its own store and fails the turn with
+ * `Item with id … not found` (#5583), so the id is as foreign as the blob beside it. A change of
+ * provider label, adapter or model on the same destination and credential keeps the same store,
+ * and there the id remains resolvable. Unknown, expired, or evicted provenance is not a change.
+ */
+export function reasoningReplayItemStoreChanged(
+  scope: OcxReasoningReplayScopeRef | undefined,
+): boolean {
+  const current = servingIdentityFor(scope);
+  if (!current) return false;
+  const at = now();
+  sweepExpiredServingIdentities(at);
+  const previous = servingIdentities.get(current.threadId);
+  if (previous === undefined || previous.identity === current.identity) return false;
+  const storeOwner = (identity: string): string => {
+    const [, destination, , , credential] = JSON.parse(identity) as ReasoningReplayIdentityTuple;
+    return JSON.stringify([destination, credential]);
+  };
+  return storeOwner(previous.identity) !== storeOwner(current.identity);
+}
+
 /** Record the route only after it has successfully served the conversation. */
 export function commitReasoningReplayServingIdentity(
   scope: OcxReasoningReplayScopeRef | undefined,

package/src/router.ts

@@ -1,6 +1,7 @@
 import type { CodexAccountMode, OcxConfig, OcxProviderConfig } from "./types";
 import { createHash } from "node:crypto";
 import { peekAuthStore } from "./oauth/store";
+import { resolveDevinApiBaseUrl, validateDevinApiBaseUrl } from "./oauth/devin/api-base";
 import {
   getCombo,
   isComboTargetInCooldown,
@@ -155,14 +156,21 @@ export function knownModelIdsForProvider(
     // This callback runs only for a scoped entry, not for each provider in an alias scan.
     const routed = routedProviderConfig(provName, prov);
     let key = routed.apiKey;
+    let destination = routed.baseUrl;
     if (routed.authMode === "oauth") {
       const set = peekAuthStore()[provName];
       const account = set?.accounts.find(row => row.id === set.activeAccountId);
       if (!account || account.needsReauth || !Number.isFinite(account.credential.expires)
         || account.credential.expires <= Date.now()) return undefined;
       key = account.credential.access;
+      if (routed.adapter === "devin") destination = validateDevinApiBaseUrl(account.credential.apiBaseUrl) ?? routed.baseUrl;
     }
-    return key ? createHash("sha256").update(key).digest("hex") : undefined;
+    if (!key) return undefined;
+    return createHash("sha256")
+      .update(routed.adapter === "devin"
+        ? JSON.stringify([key, resolveDevinApiBaseUrl(destination)])
+        : key)
+      .digest("hex");
   });
   for (const cached of cachedModels ?? []) ids.add(cached.id);
   for (const model of config?.customModels ?? []) {
@@ -337,6 +345,7 @@ export function routedProviderConfig(providerName: string, provider: OcxProvider
   const preserveReasoningContentModels = staticPolicy.preserveReasoningContentModels;
   const requiresReasoningPlaceholderModels = staticPolicy.requiresReasoningPlaceholderModels;
   const reasoningSplitModels = staticPolicy.reasoningSplitModels;
+  const inlineThinkTagModels = staticPolicy.inlineThinkTagModels;
   const reasoningDetailsModels = staticPolicy.reasoningDetailsModels;
   const thinkingToggleModels = staticPolicy.thinkingToggleModels;
   const thinkingBudgetModels = staticPolicy.thinkingBudgetModels;
@@ -479,6 +488,7 @@ export function routedProviderConfig(providerName: string, provider: OcxProvider
     ...(preserveReasoningContentModels ? { preserveReasoningContentModels } : {}),
     ...(requiresReasoningPlaceholderModels ? { requiresReasoningPlaceholderModels } : {}),
     ...(reasoningSplitModels ? { reasoningSplitModels } : {}),
+    ...(inlineThinkTagModels ? { inlineThinkTagModels } : {}),
     ...(reasoningDetailsModels ? { reasoningDetailsModels } : {}),
     ...(thinkingToggleModels ? { thinkingToggleModels } : {}),
     ...(thinkingBudgetModels ? { thinkingBudgetModels } : {}),

package/src/routing/history/indexer.ts

@@ -22,6 +22,7 @@ import { getConfigDir } from "../../config";
 import { recordOwnedConfigPath } from "../../lib/config-ownership";
 import {
   currentUsageLogRevision,
+  encodePersistedRequestedModel,
   normalizeUsageEntryForTest,
   usageLogPath,
   type PersistedUsageEntry,
@@ -157,7 +158,9 @@ function extractRow(entry: PersistedUsageEntry): Array<string | number | null> {
     entry.timestamp,
     entry.provider,
     entry.model,
-    entry.requestedModel ?? null,
+    // Old canonical JSONL rows can predate bounded selector persistence. Encode
+    // the disposable projection on rebuild so exact filters match across versions.
+    typeof entry.requestedModel === "string" ? encodePersistedRequestedModel(entry.requestedModel) : null,
     entry.status,
     entry.surface ?? null,
     entry.inboundProtocol ?? null,
@@ -510,7 +513,9 @@ function queryRows(
   };
   if (filters.provider !== undefined) add("provider = ?", filters.provider);
   if (filters.model !== undefined) add("model = ?", filters.model);
-  if (filters.requestedModel !== undefined) add("requested_model = ?", filters.requestedModel);
+  // Rows store the bounded encoded form, so the lookup value must be encoded the
+  // same way — short selectors encode to themselves and still match verbatim.
+  if (filters.requestedModel !== undefined) add("requested_model = ?", encodePersistedRequestedModel(filters.requestedModel));
   if (filters.status !== undefined) add("status = ?", filters.status);
   if (filters.conversationId !== undefined) add("conversation_id = ?", filters.conversationId);
   if (filters.surface !== undefined) add("surface = ?", filters.surface);

package/src/routing/history/schema.ts

@@ -6,7 +6,9 @@
  * (ADR-1/ADR-8 in devlog/_fin/260804_router_intelligence/000_master_plan.md).
  */
 
-export const HISTORY_SCHEMA_VERSION = 1;
+// Version 2 rebuilds the derived projection so old raw requested-model selectors
+// are replaced by the bounded encoding already used by canonical JSONL reads.
+export const HISTORY_SCHEMA_VERSION = 2;
 export const HISTORY_DB_FILENAME = "routing-history.sqlite";
 
 export const HISTORY_META_KEYS = {

package/src/server/adapter-resolve.ts

@@ -32,7 +32,7 @@ export function resolveWireProtocolOverride(
       ? { ...providerConfig, adapter: staticPolicy.model.adapter }
       : providerConfig;
   }
-  const pinned = pinnedWireAdapter(providerName, modelId);
+  const pinned = pinnedWireAdapter(providerName, modelId, providerConfig);
   if (pinned && providerConfig.adapter !== pinned) {
     return { ...providerConfig, adapter: pinned };
   }
@@ -47,7 +47,7 @@ export function resolveWireProtocolOverride(
   if (requested
     && MODEL_ADAPTER_OVERRIDE_ALLOWED.has(requested)
     && requested !== providerConfig.adapter
-    && !isWirePinnedModel(providerName, modelId)
+    && !isWirePinnedModel(providerName, modelId, providerConfig)
     // A forward provider hands the caller's own credential upstream; the chat adapter
     // only ever sends provider.apiKey, so switching wires here would drop the auth.
     && !isCanonicalOpenAiForwardProvider(providerConfig)) {

package/src/server/auth-cors.ts

@@ -818,6 +818,8 @@ export function providerManagementConfigError(
   if (reasoningSummariesError) return `provider ${name} ${reasoningSummariesError}`;
   const suppressSyntheticMaxError = booleanRecordConfigError(raw.modelSuppressSyntheticMax, "modelSuppressSyntheticMax");
   if (suppressSyntheticMaxError) return `provider ${name} ${suppressSyntheticMaxError}`;
+  const verbositySupportError = booleanRecordConfigError(raw.modelSupportsVerbosity, "modelSupportsVerbosity");
+  if (verbositySupportError) return `provider ${name} ${verbositySupportError}`;
   const reasoningSummaryDeliveryError = reasoningSummaryDeliveryRecordConfigError(
     raw.modelReasoningSummaryDelivery,
     raw.modelSupportsReasoningSummaries,
@@ -1060,6 +1062,7 @@ const PROVIDER_CONFIG_FIELD_POLICY = {
   transientRetryOn5xx: "editor",
   retryOnReset: "editor",
   reasoningSplitModels: "editor",
+  inlineThinkTagModels: "editor",
   reasoningDetailsModels: "editor",
   thinkingToggleModels: "editor",
   thinkingBudgetModels: "editor",

package/src/server/chat-completions.ts

@@ -199,7 +199,20 @@ async function handleChatCompletionsWithBudget(
     }
     // Combos must enter the Responses routing path so child selection, forced default
     // effort, failover, and per-attempt telemetry run before any native Chat send.
-    if (!route.combo && !effortRow && isNativeChatRouteEligible(route, chatBody, config)) chatNativeRoute = route;
+    if (!route.combo && !effortRow && isNativeChatRouteEligible(route, chatBody, config)) {
+      chatNativeRoute = route;
+      // Reserve an input estimate for spend without recording it as usage: native Chat attempts
+      // keep the provider-reported counts, as they did before the reservation existed.
+      if (logCtx.usageLogInputTokens === undefined) {
+        const parts = [JSON.stringify(chatBody.messages ?? [])];
+        if (chatBody.tools !== undefined) parts.push(JSON.stringify(chatBody.tools));
+        logCtx.spendInputEstimateTokens = Math.max(1, estimateTokens(parts.join("\n"), requestedModel));
+      }
+      const outputCeiling = chatBody.max_completion_tokens ?? chatBody.max_tokens;
+      if (typeof outputCeiling === "number" && outputCeiling > 0) {
+        logCtx.spendOutputCeilingTokens = Math.trunc(outputCeiling);
+      }
+    }
   } catch (err) {
     if (err instanceof AdmissionModelDeniedError) {
       logCtx.requestedModel = requestedModel;