@bitkyc08/opencodex 2.63.0 → 2.64.0-preview.20260923

package/src/usage/expected-prices.ts

@@ -146,9 +146,12 @@ const DEEPSEEK_PRICING = "https://api-docs.deepseek.com/quick_start/pricing-deta
  * cache-write charge.
  */
 const DEEPSEEK_V41_FLASH: Cost4 = { input: 0.3, output: 1.2, cacheRead: 0.006, cacheWrite: 0 };
-// Kimi official tables publish input/output/cache-hit only; cacheWrite is mapped to the
-// cache-miss input price (Kimi auto-caches with no separate write billing). 2026-07-20 re-verified.
-const KIMI_PRICING = "https://platform.kimi.ai/docs/pricing (official table; cacheWrite derived = input, Kimi auto-cache has no write billing)";
+// Historical K2 rows retain their 2026-07-20 verification; they do not price retargeted aliases.
+const KIMI_PRICING = "https://platform.kimi.ai/docs/pricing (historical official table; cacheWrite derived from cache-miss input)";
+// K3 publishes a separate cache-write price: $3/1M for the default 5-minute TTL.
+// Coding presets share an endpoint/product, but these API reference estimates are not plan
+// billing or quota: K3's 1M model consumes about twice the quota of k3-256k.
+const KIMI_K3_PRICING = "https://platform.kimi.ai/docs/pricing/chat (API reference estimate; default 5-minute cache-write rate, not Code Plan billing/quota); https://www.kimi.com/code/docs/en/kimi-code/models.html";
 // Z.AI publishes one USD table for the international surface; the Coding Plan
 // subscription and the domestic bigmodel.cn endpoints bill differently
 // (subscription quota / CNY tiers), so every GLM row below is verified-derived:
@@ -306,25 +309,31 @@ export const EXPECTED_PRICE_OVERLAYS: readonly ExpectedPriceOverlay[] = [
   // Kimi / Moonshot — official price tables are now published (2026-07-20 re-check;
   // previously empty). kimi = Kimi Code OAuth surface, moonshot = CN key surface,
   // kimi-code = API key surface (expected list price, not actual billing).
-  { provider: "kimi", modelId: "k3", cost4: KIMI_K3, source: KIMI_PRICING, verifiedAt: "2026-07-20", status: "verified-derived" },
-  { provider: "kimi", modelId: "k3[1m]", cost4: KIMI_K3, source: `derived: k3 (official docs: k3[1m] is the 1M-context compat notation for k3) ${KIMI_PRICING}`, verifiedAt: "2026-07-20", status: "verified-derived" },
+  { provider: "kimi", modelId: "k3", cost4: KIMI_K3, source: KIMI_K3_PRICING, verifiedAt: "2026-09-23", status: "verified-derived" },
+  { provider: "kimi", modelId: "k3[1m]", cost4: KIMI_K3, source: `derived: local alias sent as k3; ${KIMI_K3_PRICING}`, verifiedAt: "2026-09-23", status: "verified-derived" },
+  { provider: "kimi", modelId: "k3-256k", cost4: KIMI_K3, source: `derived: K3 with a fixed 256K ceiling; ${KIMI_K3_PRICING}`, verifiedAt: "2026-09-23", status: "verified-derived" },
   { provider: "kimi", modelId: "kimi-k2.7-code", cost4: KIMI_K27_CODE, source: KIMI_PRICING, verifiedAt: "2026-07-20", status: "verified-derived" },
   { provider: "kimi", modelId: "kimi-k2.7-code-highspeed", cost4: KIMI_K27_CODE_HIGHSPEED, source: KIMI_PRICING, verifiedAt: "2026-07-20", status: "verified-derived" },
   { provider: "kimi", modelId: "kimi-k2.6", cost4: KIMI_K26, source: KIMI_PRICING, verifiedAt: "2026-07-20", status: "verified-derived" },
   { provider: "kimi", modelId: "kimi-k2.5", cost4: KIMI_K25, source: KIMI_PRICING, verifiedAt: "2026-07-20", status: "verified-derived" },
-  { provider: "kimi", modelId: "kimi-for-coding", cost4: KIMI_K27_CODE, source: `derived: kimi-k2.7-code (Kimi Code maps to K2.7 Code per official model docs) ${KIMI_PRICING}`, verifiedAt: "2026-07-20", status: "verified-derived" },
-  { provider: "moonshot", modelId: "kimi-k3", cost4: KIMI_K3, source: KIMI_PRICING, verifiedAt: "2026-07-20", status: "verified-derived" },
+  // kimi-for-coding now serves K2.8 Preview. No verified K2.8 price: keep all three
+  // Coding presets unknown rather than reusing the alias's retired K2.7 price.
+  { provider: "moonshot", modelId: "kimi-k3", cost4: KIMI_K3, source: KIMI_K3_PRICING, verifiedAt: "2026-09-23", status: "verified-derived" },
   { provider: "moonshot", modelId: "kimi-k2.7-code", cost4: KIMI_K27_CODE, source: KIMI_PRICING, verifiedAt: "2026-07-20", status: "verified-derived" },
   { provider: "moonshot", modelId: "kimi-k2.7-code-highspeed", cost4: KIMI_K27_CODE_HIGHSPEED, source: KIMI_PRICING, verifiedAt: "2026-07-20", status: "verified-derived" },
   { provider: "moonshot", modelId: "kimi-k2.6", cost4: KIMI_K26, source: KIMI_PRICING, verifiedAt: "2026-07-20", status: "verified-derived" },
   { provider: "moonshot", modelId: "kimi-k2.5", cost4: KIMI_K25, source: KIMI_PRICING, verifiedAt: "2026-07-20", status: "verified-derived" },
-  { provider: "kimi-code", modelId: "k3", cost4: KIMI_K3, source: KIMI_PRICING, verifiedAt: "2026-07-20", status: "verified-derived" },
-  { provider: "kimi-code", modelId: "k3[1m]", cost4: KIMI_K3, source: `derived: k3 ${KIMI_PRICING}`, verifiedAt: "2026-07-20", status: "verified-derived" },
+  { provider: "kimi-code", modelId: "k3", cost4: KIMI_K3, source: KIMI_K3_PRICING, verifiedAt: "2026-09-23", status: "verified-derived" },
+  { provider: "kimi-code", modelId: "k3[1m]", cost4: KIMI_K3, source: `derived: local alias sent as k3; ${KIMI_K3_PRICING}`, verifiedAt: "2026-09-23", status: "verified-derived" },
+  { provider: "kimi-code", modelId: "k3-256k", cost4: KIMI_K3, source: `derived: K3 with a fixed 256K ceiling; ${KIMI_K3_PRICING}`, verifiedAt: "2026-09-23", status: "verified-derived" },
   { provider: "kimi-code", modelId: "kimi-k2.7-code", cost4: KIMI_K27_CODE, source: KIMI_PRICING, verifiedAt: "2026-07-20", status: "verified-derived" },
   { provider: "kimi-code", modelId: "kimi-k2.7-code-highspeed", cost4: KIMI_K27_CODE_HIGHSPEED, source: KIMI_PRICING, verifiedAt: "2026-07-20", status: "verified-derived" },
   { provider: "kimi-code", modelId: "kimi-k2.6", cost4: KIMI_K26, source: KIMI_PRICING, verifiedAt: "2026-07-20", status: "verified-derived" },
   { provider: "kimi-code", modelId: "kimi-k2.5", cost4: KIMI_K25, source: KIMI_PRICING, verifiedAt: "2026-07-20", status: "verified-derived" },
-  { provider: "kimi-code", modelId: "kimi-for-coding", cost4: KIMI_K27_CODE, source: `derived: kimi-k2.7-code ${KIMI_PRICING}`, verifiedAt: "2026-07-20", status: "verified-derived" },
+  // Responses reuses the kimi OAuth account and the same Coding endpoint/model seeds.
+  { provider: "kimi-responses", modelId: "k3", cost4: KIMI_K3, source: KIMI_K3_PRICING, verifiedAt: "2026-09-23", status: "verified-derived" },
+  { provider: "kimi-responses", modelId: "k3[1m]", cost4: KIMI_K3, source: `derived: local alias sent as k3; ${KIMI_K3_PRICING}`, verifiedAt: "2026-09-23", status: "verified-derived" },
+  { provider: "kimi-responses", modelId: "k3-256k", cost4: KIMI_K3, source: `derived: K3 with a fixed 256K ceiling; ${KIMI_K3_PRICING}`, verifiedAt: "2026-09-23", status: "verified-derived" },
   // Qwen3.8-Max: vendor-published input/output rate (verified). See QWEN38_MAX_PRICING
   // for what that source does and does not cover.
   { provider: "alibaba-token-plan", modelId: "qwen3.8-max", cost4: QWEN38_MAX, source: QWEN38_MAX_PRICING, verifiedAt: "2026-08-04", status: "verified" },
@@ -440,6 +449,14 @@ export const VERIFIED_PRICE_OVERRIDES: readonly ExpectedPriceOverlay[] = [
     verifiedAt: "2026-08-18",
     status: "verified",
   },
+  {
+    provider: "xai",
+    modelId: "grok-4.7",
+    cost4: { input: 2, output: 6, cacheRead: 0.5, cacheWrite: 0 },
+    source: "https://docs.x.ai/developers/models/grok-4.7",
+    verifiedAt: "2026-09-23",
+    status: "verified",
+  },
 ];
 
 export function findVerifiedPriceOverride(
@@ -503,6 +520,7 @@ export interface PriorityPricingRule {
 }
 
 const XAI_PRIORITY_PRICING = "https://docs.x.ai/developers/advanced-api-usage/priority-processing";
+const ANTHROPIC_FAST_PRICING = "https://platform.claude.com/docs/en/about-claude/pricing";
 
 /**
  * Exact provider/model priority premiums. Routed resellers never inherit a vendor rule merely
@@ -529,14 +547,25 @@ export const PRIORITY_PRICING_RULES: readonly PriorityPricingRule[] = [
     source: "https://developers.openai.com/api/docs/pricing (derived from the virtual selection's base wire model)",
     verifiedAt: "2026-09-05",
   })),
-  ...["grok-4.5", "grok-4.6"].map((modelId): PriorityPricingRule => ({
+  ...["grok-4.5", "grok-4.6", "grok-4.7"].map((modelId): PriorityPricingRule => ({
     provider: "xai",
     modelId,
     multiplier: 2,
     requiresResponseConfirmation: true,
     source: XAI_PRIORITY_PRICING,
-    verifiedAt: "2026-08-18",
+    verifiedAt: modelId === "grok-4.7" ? "2026-09-23" : "2026-08-18",
   })),
+  // Claude Code subscription fast draws usage credits at API fast rates, so OAuth is included.
+  ...["anthropic", "anthropic-apikey"].flatMap(provider =>
+    ["claude-opus-5-5", "claude-opus-5", "claude-opus-4-8"].map((modelId): PriorityPricingRule => ({
+      provider,
+      modelId,
+      multiplier: 2,
+      requiresResponseConfirmation: true,
+      source: ANTHROPIC_FAST_PRICING,
+      verifiedAt: "2026-09-23",
+    })),
+  ),
 ];
 
 /** Exact provider/model priority-pricing lookup. */
@@ -662,6 +691,19 @@ export const CONTEXT_TIERS: readonly ContextTier[] = [
     source: "https://docs.x.ai/developers/pricing",
     verifiedAt: "2026-08-18",
   },
+  {
+    // xAI documents the same whole-request >=200k band for grok-4.7;
+    // priority stacking remains a lower bound. See
+    // devlog/_plan/260923_grok47_parity/010_probe-evidence.md.
+    provider: "xai",
+    modelId: "grok-4.7",
+    thresholdInputTokens: 200_000,
+    inclusive: true,
+    multiplier: UNIFORM_DOUBLE,
+    confirmedPriorityRelation: "lower-bound",
+    source: "https://docs.x.ai/developers/models/grok-4.7",
+    verifiedAt: "2026-09-23",
+  },
   ...["minimax", "minimax-cn"].map((provider): ContextTier => ({
     provider,
     modelId: "MiniMax-M3",

package/src/usage/log.ts

@@ -5,7 +5,7 @@ import { getConfigDir } from "../config";
 import type { CodexAffinityMove, CodexAffinityReason } from "../codex/routing";
 import { enforceAppOwnedMemoryBudget } from "../lib/app-owned-memory";
 import { recordOwnedConfigPath } from "../lib/config-ownership";
-import { sanitizeLogMetadataString } from "../lib/redact";
+import { redactSecretString, sanitizeLogMetadataString } from "../lib/redact";
 import { usageDisplayTotalTokens } from "./totals";
 import { normalizeAttemptDeliverySummary } from "./attempt-delivery";
 import {
@@ -222,8 +222,39 @@ export interface PersistedRequestSpend extends RequestSpendTotals {
 }
 
 const MAX_PERSISTED_MOVE_REASONS = 8;
+// Model selectors are NOT length-bound at admission: configured and discovered
+// model ids reach MODEL_DISCOVERY_MAX_MODEL_ID_LENGTH, and the wire `model`
+// field is raw client input. Persisting a plain prefix would merge selectors
+// that share it, so over-long selectors persist as prefix + a digest of the
+// FULL selector — bounded, deterministic, and still exact-matchable.
+const MAX_PERSISTED_REQUESTED_MODEL_LEN = 130;
+const REQUESTED_MODEL_DIGEST_HEX_LEN = 16;
 const LOGICAL_REQUEST_ID_RE = /^[A-Za-z0-9_.:-]{1,64}$/;
 
+/**
+ * Persisted form of the wire model selector. Selectors within the bound persist
+ * verbatim; longer selectors persist as a prefix plus a short digest of the full
+ * value, so two distinct selectors that share the prefix never collapse into one
+ * persisted identity. Exact-match readers (`requested_model = ?`) must encode
+ * lookup input through this same function. Idempotent — encoded forms fit the
+ * bound — which matters because rows are normalized again on read.
+ *
+ * Idempotence has one cost: a literal selector that equals another selector's
+ * persisted form is indistinguishable from it, so both rows share one display
+ * value and one exact-match filter. Reaching that needs the caller to send the
+ * exact prefix-and-digest string; keeping them apart would need a separate
+ * full-selector digest column.
+ */
+export function encodePersistedRequestedModel(selector: string): string {
+  if (selector.length <= MAX_PERSISTED_REQUESTED_MODEL_LEN) return selector;
+  const digest = createHash("sha256")
+    .update(selector)
+    .digest("hex")
+    .slice(0, REQUESTED_MODEL_DIGEST_HEX_LEN);
+  const prefixLen = MAX_PERSISTED_REQUESTED_MODEL_LEN - REQUESTED_MODEL_DIGEST_HEX_LEN - 1;
+  return `${selector.slice(0, prefixLen)}~${digest}`;
+}
+
 export function isLogicalRequestId(value: unknown): value is string {
   return typeof value === "string" && LOGICAL_REQUEST_ID_RE.test(value);
 }
@@ -284,6 +315,10 @@ export interface PersistedUsageEntry {
   /** Best-effort chat/session correlation for Logs grouping (#330). */
   conversationId?: string;
   resolvedModel?: string;
+  /** Model the upstream actually served (openai-model header or response body). */
+  servedModel?: string;
+  /** The exact model id sent upstream when it differs from the client-facing `model`. */
+  wireModel?: string;
   requestedModel?: string;
   /** Original bare helper model when the opt-in shadow-call route rewrote this request. */
   shadowCallRewrittenFrom?: string;
@@ -806,6 +841,80 @@ function capMetadataString(s: string): string {
   return s.length > MAX_METADATA_STRING_LEN ? s.slice(0, MAX_METADATA_STRING_LEN) : s;
 }
 
+const MAX_SERVED_MODEL_LENGTH = 200;
+/**
+ * An upstream model is an identifier, never free-form text to truncate into one. A value the
+ * secret redactor would change is dropped rather than logged, because credential-shaped text can
+ * fit the identifier alphabet.
+ */
+export function sanitizeServedModel(value: unknown): string | undefined {
+  return typeof value === "string"
+    && value.length <= MAX_SERVED_MODEL_LENGTH
+    && /^[A-Za-z0-9._:/@+-]+$/.test(value)
+    && redactSecretString(value) === value
+    ? value
+    : undefined;
+}
+
+/** The identity fields that decide whether a response model is ocx's own echo. */
+export interface ServedModelEchoSource {
+  provider?: string;
+  model?: string;
+  wireModel?: string;
+  requestedAlias?: string;
+  requestedModel?: string;
+  /** Client-facing selector this proxy wrote into `response.model` (Anthropic routes keep it). */
+  responseModelEcho?: string;
+}
+
+/**
+ * True when `served` is the client's own selector echoed back rather than a model the upstream
+ * reported. Anthropic routes answer with the Codex-facing selector (`anthropic/claude-opus-5-5`),
+ * and recording that as the served model painted every such row as rerouted. A value equal to
+ * the wire model is never an echo. On adapter paths the upstream's real model is not observable
+ * at all, so this only removes a false signal; passthrough `openai-model` observations are kept.
+ */
+export function isClientSelectorEcho(source: ServedModelEchoSource, served: string | undefined): boolean {
+  if (served === undefined) return false;
+  const wire = source.wireModel ?? source.model;
+  if (served === wire) return false;
+  return served === source.responseModelEcho
+    || served === source.requestedAlias
+    || served === source.requestedModel
+    || (source.provider !== undefined && wire !== undefined && served === `${source.provider}/${wire}`);
+}
+
+/** Record a response-body model as the served model when it is a real upstream observation. */
+export function recordObservedServedModel(
+  target: ServedModelEchoSource & { servedModel?: string; resolvedModel?: string; preserveResolvedModelFromRoute?: boolean },
+  value: unknown,
+): void {
+  const servedModel = sanitizeServedModel(value);
+  if (!servedModel || isClientSelectorEcho(target, servedModel)) return;
+  target.servedModel = servedModel;
+  if (!target.preserveResolvedModelFromRoute) target.resolvedModel = servedModel;
+}
+
+/**
+ * Model identity fields for a log row. The served model is sanitized, and a resolvedModel that
+ * only echoed a dropped served model is dropped with it, so the rejected value cannot survive
+ * under the other name. A client-selector echo is dropped the same way, which also repairs
+ * rows persisted before the echo was filtered at capture.
+ */
+export function modelIdentityLogFields(source: ServedModelEchoSource & { resolvedModel?: string; servedModel?: unknown }): {
+  resolvedModel?: string; servedModel?: string; wireModel?: string;
+} {
+  const sanitized = sanitizeServedModel(source.servedModel);
+  const servedModel = isClientSelectorEcho(source, sanitized) ? undefined : sanitized;
+  const resolvedModel = source.servedModel !== undefined && source.resolvedModel === source.servedModel && !servedModel
+    ? undefined : source.resolvedModel;
+  return {
+    ...(resolvedModel ? { resolvedModel } : {}),
+    ...(servedModel ? { servedModel } : {}),
+    ...(source.wireModel ? { wireModel: source.wireModel } : {}),
+  };
+}
+
 /** Test seam: the normalization branch old rows take is worth asserting directly. */
 export function normalizeUsageEntryForTest(entry: PersistedUsageEntry): PersistedUsageEntry {
   return normalizeUsageEntry(entry);
@@ -817,6 +926,7 @@ function normalizeUsageEntry(entry: PersistedUsageEntry): PersistedUsageEntry {
   const callerServiceTier = sanitizeLogMetadataString(entry.callerServiceTier);
   const responseServiceTier = sanitizeLogMetadataString(entry.responseServiceTier);
   const shadowCallRewrittenFrom = sanitizeLogMetadataString(entry.shadowCallRewrittenFrom);
+  const { servedModel, resolvedModel } = modelIdentityLogFields(entry);
   const claudeCompatibility = normalizeClaudeCompatibilityUsageLog(entry.claudeCompatibility);
   const transportPhase = isKnownTransportPhase(entry.transportPhase) ? entry.transportPhase : undefined;
   const terminalSource = isKnownTerminalSource(entry.terminalSource) ? entry.terminalSource : undefined;
@@ -855,8 +965,12 @@ function normalizeUsageEntry(entry: PersistedUsageEntry): PersistedUsageEntry {
     ...(typeof entry.conversationId === "string" && entry.conversationId.trim()
       ? { conversationId: entry.conversationId.trim().slice(0, 128) }
       : {}),
-    ...(entry.resolvedModel ? { resolvedModel: entry.resolvedModel } : {}),
-    ...(entry.requestedModel ? { requestedModel: entry.requestedModel } : {}),
+    ...(resolvedModel ? { resolvedModel } : {}),
+    ...(servedModel ? { servedModel } : {}),
+    ...(entry.wireModel ? { wireModel: entry.wireModel } : {}),
+    ...(typeof entry.requestedModel === "string" && entry.requestedModel
+      ? { requestedModel: encodePersistedRequestedModel(entry.requestedModel) }
+      : {}),
     ...(shadowCallRewrittenFrom ? { shadowCallRewrittenFrom } : {}),
     ...(typeof entry.requestedEffort === "string" && entry.requestedEffort
       ? { requestedEffort: capMetadataString(entry.requestedEffort) }

package/src/usage/telemetry-contract.ts

@@ -36,6 +36,7 @@ export const ATTEMPT_RECOVERY_KIND_ROSTER = Object.freeze([
   "opaque-blob-rejection",
   "empty-completion",
   "reasoning-effort-downgrade",
+  "anthropic-fast-downgrade",
 ] as const);
 
 export type AttemptRecoveryKind = typeof ATTEMPT_RECOVERY_KIND_ROSTER[number];

package/src/usage/timeline.ts

@@ -1,3 +1,4 @@
+import { baseProviderLabel } from "../providers/label";
 import { cacheTokensFromUsage, usageAttributions } from "./summary";
 import type { PersistedUsageEntry } from "./log";
 import { usageDisplayTotalTokens } from "./totals";
@@ -55,6 +56,30 @@ export function isTimelineModelId(value: unknown): value is string {
   return typeof value === "string" && /^[^/\s]+\/\S+$/.test(value);
 }
 
+/**
+ * Pool accounts log as `openai-p<hex6>` (and older rows as `openai-main`/`chatgpt`), so the raw
+ * provider would draw one line per account for the same model. The usage summary already folds these
+ * through `baseProviderLabel`; the timeline keys on the same label so both views agree.
+ */
+function timelineModelId(provider: string, model: string): string {
+  return `${baseProviderLabel(provider)}/${model}`;
+}
+
+/** A saved selection may still name a pool account (`openai-p6bc633/gpt-5`); it selects the merged row. */
+export function normalizeTimelineModelId(id: string): string {
+  const cut = id.indexOf("/");
+  return timelineModelId(id.slice(0, cut), id.slice(cut + 1));
+}
+
+/**
+ * In account grouping the pool suffix is the account when no explicit label was stamped. Codex pool
+ * accounts and Anthropic OAuth accounts (`formatAnthropicProviderForLog`) both log that way.
+ */
+function poolAccountLabel(provider: string): string | undefined {
+  if (baseProviderLabel(provider) === provider) return undefined;
+  return provider.match(/-(main|p[a-f0-9]{6})$/)?.[1];
+}
+
 function parseModels(raw: string | null): string[] | null | { error: string } {
   if (raw === null || raw.trim() === "") return null;
   const models = raw.split(",").map(model => model.trim());
@@ -127,6 +152,7 @@ export function createTimelineAccumulator(query: TimelineQuery): { add(entry: Pe
   const series = new Map<string, SeriesState>();
   const availableModels = new Set<string>();
   const hiddenProviders = new Set(query.hiddenProviders);
+  const selectedModels = query.models === null ? null : new Set(query.models.map(normalizeTimelineModelId));
   let missingMeasurements = 0;
 
   function add(entry: PersistedUsageEntry): void {
@@ -134,19 +160,21 @@ export function createTimelineAccumulator(query: TimelineQuery): { add(entry: Pe
     const bucket = Math.floor((entry.timestamp - startMs) / (bucketSeconds * 1000));
     if (bucket < 0 || bucket >= buckets) return;
     for (const attribution of usageAttributions(entry)) {
-      if (hiddenProviders.has(attribution.provider)) continue;
-      const modelId = `${attribution.provider}/${attribution.model}`;
+      const provider = baseProviderLabel(attribution.provider);
+      if (hiddenProviders.has(attribution.provider) || hiddenProviders.has(provider)) continue;
+      const modelId = timelineModelId(attribution.provider, attribution.model);
       availableModels.add(modelId);
-      if (query.models && !query.models.includes(modelId)) continue;
+      if (selectedModels && !selectedModels.has(modelId)) continue;
+      const accountLogLabel = attribution.accountLogLabel ?? poolAccountLabel(attribution.provider) ?? "unknown";
       const id = query.grouping === "model"
         ? modelId
-        : `${modelId} · ${attribution.accountLogLabel ?? "unknown"}`;
+        : `${modelId} · ${accountLogLabel}`;
       let state = series.get(id);
       if (!state) {
         state = {
-          provider: attribution.provider,
+          provider,
           model: attribution.model,
-          ...(query.grouping === "modelAccount" ? { accountLogLabel: attribution.accountLogLabel ?? "unknown" } : {}),
+          ...(query.grouping === "modelAccount" ? { accountLogLabel } : {}),
           points: Array<number>(buckets).fill(0),
           requests: new Map(),
         };

package/src/usage/user-cost-overlay-reconciler.ts

@@ -22,9 +22,9 @@ import { statSync } from "node:fs";
 
 import { getConfigPath, readConfigDiagnostics } from "../config";
 import type { OcxConfig, OcxProviderConfig } from "../types";
+import { refreshConfigDerivedRegistries } from "../config/derived-registries";
 import {
   refreshPreservedProviderOwner,
-  refreshUserCostOverlays,
   registerPreservedProviderOwner,
   setPreservedDiskOnlyProviders,
   unregisterPreservedProviderOwner,
@@ -169,7 +169,7 @@ export function reconcileUserCostOverlaysFromDisk(liveConfig?: OcxConfig | null)
   }
   // Refresh from the DISK config: overlays for providers only added by the
   // external edit are display-only and must still resolve for historical rows.
-  refreshUserCostOverlays(disk);
+  refreshConfigDerivedRegistries(disk);
   return true;
 }
 
@@ -190,7 +190,7 @@ function reconcileForOwners(): void {
     // cache resurrect providers that were intentionally removed.
     setPreservedDiskOnlyProviders(null);
   }
-  refreshUserCostOverlays(disk);
+  refreshConfigDerivedRegistries(disk);
 }
 
 /** Test-only observation that proves the timer actually read an invalid config fallback. */

package/src/vision/reasoning.ts

@@ -1,4 +1,4 @@
-import { NATIVE_OPENAI_MODELS, nativeReasoningEfforts } from "../codex/catalog/metadata";
+import { SUPPORTED_NATIVE_OPENAI_SLUGS, nativeReasoningEfforts } from "../codex/catalog/metadata";
 import {
   VISION_REASONING_EFFORTS,
   sanitizeVisionReasoning,
@@ -13,15 +13,13 @@ declare module "../types" {
   }
 }
 
-const NATIVE_VISION_MODELS = new Set(NATIVE_OPENAI_MODELS);
-
 /**
  * Return the known vision reasoning ladder for a native OpenAI model.
  * Unknown/custom models deliberately return undefined so callers stay permissive when reliable
  * capability metadata is unavailable.
  */
 export function nativeVisionReasoningEfforts(modelId: string): VisionReasoningEffort[] | undefined {
-  if (!NATIVE_VISION_MODELS.has(modelId)) return undefined;
+  if (!SUPPORTED_NATIVE_OPENAI_SLUGS.has(modelId)) return undefined;
   const advertised = new Set(nativeReasoningEfforts(modelId));
   const supported = VISION_REASONING_EFFORTS.filter(effort => advertised.has(effort));
   return supported.length > 0 ? [...supported] : undefined;

package/src/web-search/xai-executor.ts

@@ -14,6 +14,7 @@ import type { OcxProviderConfig } from "../types";
 import { getValidAccessToken, publicOAuthAuthenticationErrorMessage } from "../oauth";
 import { applyUpstreamRecoveryInit, fetchWithResetRetry } from "../lib/upstream-retry";
 import { cancelBodyOnAbort, signalWithTimeout } from "../lib/abort";
+import { readBoundedResponseBytes } from "../lib/bounded-body";
 import { sidecarEnter } from "../lib/sidecar-tracker";
 import { redactSecretString } from "../lib/redact";
 import { MAX_SIDECAR_RESPONSE_BYTES, type WebSearchSource } from "./parse";
@@ -114,10 +115,19 @@ export async function runXaiWebSearch(
     );
     const detachBodyGuard = cancelBodyOnAbort(res.body, linkedSignal.signal);
     if (!res.ok) {
-      const t = await res.text().catch(() => "");
-      detachBodyGuard();
-      const entitlement = res.status === 401 || res.status === 403 ? " (Grok OAuth entitlement — re-run ocx login xai?)" : "";
-      return { text: "", sources: [], error: `xai sidecar HTTP ${res.status}${entitlement}: ${redactSecretString(t.slice(0, 200))}` };
+      try {
+        const bounded = await readBoundedResponseBytes(res, {
+          maxBytes: MAX_SIDECAR_RESPONSE_BYTES,
+          signal: linkedSignal.signal,
+        });
+        const detail = bounded.oversized
+          ? "response body exceeded byte bound"
+          : redactSecretString(new TextDecoder().decode(bounded.bytes).slice(0, 200));
+        const entitlement = res.status === 401 || res.status === 403 ? " (Grok OAuth entitlement — re-run ocx login xai?)" : "";
+        return { text: "", sources: [], error: `xai sidecar HTTP ${res.status}${entitlement}: ${detail}` };
+      } finally {
+        detachBodyGuard();
+      }
     }
     try {
       return await parseXaiResponsesSSE(res);