@bitkyc08/opencodex 2.64.0-preview.20260923 → 2.65.0-preview.20260925

package/src/lib/upstream-retry.ts

@@ -440,6 +440,25 @@ function invitesResendAfterReplacement(status: number): boolean {
     || status === 307 || status === 308 || status === 413 || status >= 500;
 }
 
+/**
+ * The answer a request keeps once its one operator replacement has gone out.
+ *
+ * A status that invites another send settles as the refusal. Any other answer keeps its real
+ * status: no client retries it, and the caller needs the evidence (a 400 names the request
+ * defect). The marker still stops this process from using it as a recovery trigger, such as the
+ * opaque-blob rebuild of a 400 or a combo hop on a context overflow, because each of those checks
+ * it before sending again.
+ */
+export function settleOperatorReplacement(response: Response): Response {
+  if (response.ok) return response;
+  if (invitesResendAfterReplacement(response.status)) {
+    cancelResponseBodyBestEffort(response);
+    return replayRefusalResponse();
+  }
+  markResponseNonReplayable(response);
+  return response;
+}
+
 export async function fetchWithAttemptDeadline(
   url: string,
   init: RequestInit,
@@ -624,18 +643,7 @@ export async function fetchWithResetRetry(
     opts.onSendsConsumed?.(1);
     try {
       const response = await doFetch(attempt === 0 ? firstRecovery : "connection-reset");
-      if (spentOperatorReplacement && !response.ok) {
-        if (invitesResendAfterReplacement(response.status)) {
-          cancelResponseBodyBestEffort(response);
-          return replayRefusalResponse();
-        }
-        // Any other answer keeps its real status: no client retries it, and the caller needs the
-        // evidence (a 400 names the request defect). The marker still stops this process from
-        // using it as a recovery trigger, such as the opaque-blob rebuild of a 400 or a combo hop
-        // on a context overflow, because each of those checks it before sending again.
-        markResponseNonReplayable(response);
-      }
-      return response;
+      return spentOperatorReplacement ? settleOperatorReplacement(response) : response;
     } catch (err) {
       if (opts.abortSignal?.aborted) throw err;
       if (!isConnectionResetError(err)) {

package/src/oauth/index.ts

@@ -1270,6 +1270,7 @@ const OAUTH_RECONCILE_FIELDS: (keyof OcxProviderConfig)[] = [
   "modelReasoningEffortMap",
   "noTemperatureModels",
   "noTopPModels",
+  "noStopModels",
   "noPenaltyModels",
   "autoToolChoiceOnlyModels",
   "preserveReasoningContentModels",

package/src/oauth/kiro-credentials.ts

@@ -179,6 +179,12 @@ export function resolveKiroCliNativeSessionEntries(
  * Windows: official MSI installs to `C:\Program Files\Kiro-Cli\kiro-cli.exe`, while some local
  * installs keep the binary next to `%LOCALAPPDATA%\Kiro-Cli\data.sqlite3`.
  * macOS/Linux: prefer PATH, then the usual user-local bin directories.
+ *
+ * The canonical `kiro-cli` name is exhausted everywhere first. Only then, and only on Windows, does
+ * the short `kiro.exe` name count, and only inside the two dedicated `Kiro-Cli` install folders
+ * already trusted for `kiro-cli.exe`, resolved from an absolute base. A short name is never looked
+ * up on PATH or in shared POSIX bin directories (`~/.local/bin`, `/usr/local/bin`, `/opt/homebrew/bin`):
+ * an unrelated `kiro` there, such as the Kiro IDE launcher, must not be run for credential commands.
  */
 export function resolveKiroCliExecutable(
   inputs: KiroCliNativeInputs & {
@@ -212,6 +218,8 @@ export function resolveKiroCliExecutable(
     : pathEntries.map(entry => posix.join(entry, "kiro-cli"));
 
   const installCandidates: string[] = [];
+  // Windows only: kiro.exe inside the dedicated Kiro-Cli folders, tried after every canonical name.
+  const shortInstallCandidates: string[] = [];
   if (inputs.platform === "win32") {
     const localBase = inputs.env.LOCALAPPDATA?.trim()
       || (inputs.env.USERPROFILE?.trim() ? win32.join(inputs.env.USERPROFILE.trim(), "AppData", "Local") : "")
@@ -221,6 +229,11 @@ export function resolveKiroCliExecutable(
       win32.join(localBase, "Kiro-Cli", "kiro-cli.exe"),
       win32.join(programFiles, "Kiro-Cli", "kiro-cli.exe"),
     );
+    // A relative or drive-relative base would make the short-name lookup depend on the process
+    // working directory or current drive, so only a fully qualified drive path qualifies.
+    for (const base of [localBase, programFiles]) {
+      if (/^[A-Za-z]:[\\/]/.test(base)) shortInstallCandidates.push(win32.join(base, "Kiro-Cli", "kiro.exe"));
+    }
   } else if (inputs.platform === "darwin") {
     installCandidates.push(
       posix.join(inputs.home, ".local", "bin", "kiro-cli"),
@@ -234,7 +247,7 @@ export function resolveKiroCliExecutable(
     );
   }
 
-  for (const candidate of [...pathCandidates, ...installCandidates]) {
+  for (const candidate of [...pathCandidates, ...installCandidates, ...shortInstallCandidates]) {
     if (exists(candidate) && isFile(candidate)) return candidate;
   }
   return inputs.platform === "win32" ? "kiro-cli.exe" : "kiro-cli";

package/src/oauth/login-cli.ts

@@ -189,6 +189,7 @@ export function providerConfigFromKeyLoginProvider(def: KeyLoginProvider, key: s
     ...(def.noReasoningModels ? { noReasoningModels: [...def.noReasoningModels] } : {}),
     ...(def.noTemperatureModels ? { noTemperatureModels: [...def.noTemperatureModels] } : {}),
     ...(def.noTopPModels ? { noTopPModels: [...def.noTopPModels] } : {}),
+    ...(def.noStopModels ? { noStopModels: [...def.noStopModels] } : {}),
     ...(def.noPenaltyModels ? { noPenaltyModels: [...def.noPenaltyModels] } : {}),
     ...(def.autoToolChoiceOnlyModels ? { autoToolChoiceOnlyModels: [...def.autoToolChoiceOnlyModels] } : {}),
     ...(def.preserveReasoningContentModels ? { preserveReasoningContentModels: [...def.preserveReasoningContentModels] } : {}),

package/src/providers/derive.ts

@@ -41,6 +41,7 @@ export interface DerivedKeyLoginProvider {
   noReasoningModels?: string[];
   noTemperatureModels?: string[];
   noTopPModels?: string[];
+  noStopModels?: string[];
   noPenaltyModels?: string[];
   autoToolChoiceOnlyModels?: string[];
   preserveReasoningContentModels?: string[];
@@ -269,6 +270,7 @@ export function providerConfigSeed(entry: ProviderRegistryEntry): OcxProviderCon
     ...(entry.noReasoningModels ? { noReasoningModels: [...entry.noReasoningModels] } : {}),
     ...(entry.noTemperatureModels ? { noTemperatureModels: [...entry.noTemperatureModels] } : {}),
     ...(entry.noTopPModels ? { noTopPModels: [...entry.noTopPModels] } : {}),
+    ...(entry.noStopModels ? { noStopModels: [...entry.noStopModels] } : {}),
     ...(entry.noPenaltyModels ? { noPenaltyModels: [...entry.noPenaltyModels] } : {}),
     ...(entry.parallelToolCalls !== undefined ? { parallelToolCalls: entry.parallelToolCalls } : {}),
     ...(entry.promptCacheKey !== undefined ? { promptCacheKey: entry.promptCacheKey } : {}),
@@ -336,6 +338,7 @@ export function deriveKeyLoginMap(): Record<string, DerivedKeyLoginProvider> {
       ...(entry.noReasoningModels ? { noReasoningModels: [...entry.noReasoningModels] } : {}),
       ...(entry.noTemperatureModels ? { noTemperatureModels: [...entry.noTemperatureModels] } : {}),
       ...(entry.noTopPModels ? { noTopPModels: [...entry.noTopPModels] } : {}),
+      ...(entry.noStopModels ? { noStopModels: [...entry.noStopModels] } : {}),
       ...(entry.noPenaltyModels ? { noPenaltyModels: [...entry.noPenaltyModels] } : {}),
       ...(entry.autoToolChoiceOnlyModels ? { autoToolChoiceOnlyModels: [...entry.autoToolChoiceOnlyModels] } : {}),
       ...(entry.preserveReasoningContentModels ? { preserveReasoningContentModels: [...entry.preserveReasoningContentModels] } : {}),
@@ -552,6 +555,7 @@ export function enrichProviderFromRegistry(name: string, prov: OcxProviderConfig
   if (!prov.noReasoningModels && seed.noReasoningModels) prov.noReasoningModels = [...seed.noReasoningModels];
   if (!prov.noTemperatureModels && seed.noTemperatureModels) prov.noTemperatureModels = [...seed.noTemperatureModels];
   if (!prov.noTopPModels && seed.noTopPModels) prov.noTopPModels = [...seed.noTopPModels];
+  if (!prov.noStopModels && seed.noStopModels) prov.noStopModels = [...seed.noStopModels];
   if (!prov.noPenaltyModels && seed.noPenaltyModels) prov.noPenaltyModels = [...seed.noPenaltyModels];
   if (prov.parallelToolCalls === undefined && seed.parallelToolCalls !== undefined) prov.parallelToolCalls = seed.parallelToolCalls;
   if (prov.promptCacheKey === undefined && seed.promptCacheKey !== undefined) prov.promptCacheKey = seed.promptCacheKey;

package/src/providers/fast-opt-in.ts

@@ -0,0 +1,31 @@
+import type { OcxProviderConfig } from "../types";
+import { getProviderRegistryEntry } from "./registry";
+import type { ProviderRegistryEntry } from "./registry/types";
+
+/**
+ * Whether a provider's Fast lane is switched off.
+ *
+ * `fastEnabled: false` turns Fast off on any provider. A registry entry marked `fastOptIn` bills its
+ * Fast lane beyond the plan (Anthropic fast mode draws usage credits at 2x price), so it stays off
+ * until the operator sets `fastEnabled: true`. Off is expressed as provider capability `false`,
+ * which every Fast consumer already treats as a global denial.
+ *
+ * The registry entry is matched by name without a transport check on purpose: this can only turn
+ * Fast off, so a custom endpoint that reuses the name loses nothing it could safely keep.
+ */
+export function fastSwitchOff(
+  provider: Pick<OcxProviderConfig, "fastEnabled">,
+  entry: Pick<ProviderRegistryEntry, "fastOptIn"> | undefined,
+): boolean {
+  if (provider.fastEnabled === false) return true;
+  if (provider.fastEnabled === true) return false;
+  return entry?.fastOptIn === true;
+}
+
+/** `fastSwitchOff` with the registry entry looked up by provider name. */
+export function providerFastSwitchOff(
+  providerName: string | undefined,
+  provider: Pick<OcxProviderConfig, "fastEnabled">,
+): boolean {
+  return fastSwitchOff(provider, providerName ? getProviderRegistryEntry(providerName) : undefined);
+}

package/src/providers/model-rename-fields.ts

@@ -25,6 +25,7 @@ export const PROVIDER_MODEL_RENAME_ROLES = {
   requiresPairedResponsesToolResults: "none",
   annotateEmptyToolOutputs: "none",
   supportsServiceTier: "none",
+  fastEnabled: "none",
   modelSupportsServiceTier: "record",
   preserveResponsesReasoningContent: "none",
   modelReasoningEffortsAuthoritative: "none",
@@ -101,6 +102,7 @@ export const PROVIDER_MODEL_RENAME_ROLES = {
   noReasoningModels: "list",
   noTemperatureModels: "list",
   noTopPModels: "list",
+  noStopModels: "list",
   noPenaltyModels: "list",
   noStructuredOutputModels: "list",
   noJsonSchemaModels: "list",

package/src/providers/provider-id-rewrite.ts

@@ -95,6 +95,8 @@ export function rewriteProviderReferences(config: OcxConfig, from: string, to: s
 
   routeRecordValues(config.claudeCode?.tierModels as Record<string, string> | undefined);
   routeRecordValues(config.claudeCode?.modelMap as Record<string, string> | undefined);
+  // First-party picker bindings hold routes too; their keys are Anthropic picker ids.
+  routeRecordValues(config.claudeCode?.intercept?.modelMap);
 
   // Bare provider ids.
   for (const model of config.customModels ?? []) {

package/src/providers/quota/vendor-probes-key.ts

@@ -371,9 +371,15 @@ async function fetchDeepSeekQuota(provider: string, config: OcxProviderConfig):
   const toppedUp = toFiniteNumber(preferred.topped_up_balance);
   const balance = totalBalance ?? grantedBalance ?? toppedUp;
   if (balance === undefined || balance < 0) return null;
+  // The rows are currency-scoped, so the symbol has to follow the row that was
+  // picked: the two glyph currencies keep their sign, any other ISO code
+  // prefixes the amount, and a row without one keeps the legacy dollar.
+  const currency = String(preferred.currency ?? "").trim().toUpperCase();
+  const sign = currency === "CNY" ? "¥" : currency === "" || currency === "USD" ? "$" : `${currency} `;
+  const amount = (value: number) => `${sign}${value.toFixed(2)}`;
   const label = grantedBalance !== undefined && grantedBalance > 0
-    ? `API balance ($${balance.toFixed(2)} total, $${grantedBalance.toFixed(2)} granted)`
-    : `API balance ($${balance.toFixed(2)})`;
+    ? `API balance (${amount(balance)} total, ${amount(grantedBalance)} granted)`
+    : `API balance (${amount(balance)})`;
   return report(provider, "deepseek:balance", {
     customWindows: [{ label, percent: 0 }],
     updatedAt: Date.now(),

package/src/providers/registry/entries-core.ts

@@ -267,6 +267,29 @@ export const PROVIDER_REGISTRY_CORE: readonly ProviderRegistryEntry[] = [
     // 260813: grok-4.6 added per docs.x.ai/developers/grok-4-6. Context/vision still match
     // grok-4.5; the reasoning ladder does not — 4.6 adds the documented xhigh rung.
     models: XAI_MODELS,
+    // grok-4.7-build-fast arrives only through OAuth discovery. We read it as the Grok Build id of
+    // what xAI documents as Grok 4.7 Fast: "the same model served on faster infrastructure",
+    // offered in Cursor and Grok Build only, not on the public xAI API (docs.x.ai/developers/grok-4-7,
+    // fetched 2026-09-24). It therefore inherits grok-4.7's documented facts in the lists below.
+    // Its wire pin and service tier stay unclaimed until probed, which is why it is absent from
+    // XAI_MODELS, modelWireDefaults and modelSupportsServiceTier.
+    // Live 2026-09-20: Chat Completions rejects `stop` on grok-4.6
+    // (`400 invalid-argument "Model grok-4.6 does not support parameter stop."`).
+    // xAI documents `stop` as unsupported for reasoning models. Claude Code
+    // auto-mode always sends stop_sequences; forwarding that as `stop` makes
+    // the classifier treat Grok as temporarily unavailable while chat turns
+    // still work. Keep caller stop sequences on non-reasoning ids.
+    // Live 2026-09-23: grok-4.7 answers the same 400.
+    noStopModels: [
+      "grok-4.7",
+      "grok-4.7-build-fast",
+      "grok-4.6",
+      "grok-4.5",
+      "grok-4.3",
+      "grok-4.20-multi-agent-0309",
+      "grok-4.20-0309-reasoning",
+      "grok-build-0.1",
+    ],
     // Measured only on grok-4.6 against cli-chat-proxy.grok.com: even an invalid
     // `text.verbosity` value is accepted and low/high/omitted output length is non-monotonic.
     // Apply the resulting opt-out to the whole xAI lineup because `text.verbosity` is an OpenAI
@@ -278,6 +301,20 @@ export const PROVIDER_REGISTRY_CORE: readonly ProviderRegistryEntry[] = [
     // absent from xAI's documented API, so a model discovered later has no more support for it
     // than the seeded ones do.
     supportsVerbosity: false,
+    // docs.x.ai/docs/guides/reasoning: presencePenalty and frequencyPenalty "cannot be used with
+    // reasoning models. Requests that include them return an error." Live 2026-09-23: grok-4.7
+    // answers 400 invalid-argument "Model grok-4.7 does not support parameter presencePenalty."
+    // Non-reasoning ids keep caller penalties.
+    noPenaltyModels: [
+      "grok-4.7",
+      "grok-4.7-build-fast",
+      "grok-4.6",
+      "grok-4.5",
+      "grok-4.3",
+      "grok-4.20-multi-agent-0309",
+      "grok-4.20-0309-reasoning",
+      "grok-build-0.1",
+    ],
     defaultModel: "grok-4.5",
     // Grok 4.7/4.6/4.5 subscription Responses callers use the native wire with the existing
     // namespace/web-search/replay normalization. Chat remains an explicit modelAdapters
@@ -335,6 +372,7 @@ export const PROVIDER_REGISTRY_CORE: readonly ProviderRegistryEntry[] = [
     // (they are already listed in noVisionModels below).
     modelInputModalities: {
       "grok-4.7": ["text", "image"],
+      "grok-4.7-build-fast": ["text", "image"],
       "grok-4.6": ["text", "image"],
       "grok-4.5": ["text", "image"],
       "grok-4.3": ["text", "image"],
@@ -347,7 +385,7 @@ export const PROVIDER_REGISTRY_CORE: readonly ProviderRegistryEntry[] = [
     // reasoning_content as the top cause of prompt-cache misses on multi-turn conversations
     // (docs.x.ai prompt-caching/multi-turn, verified 2026-07-13 — devlog/_plan/260713_grok_caching).
     // Models that never emit reasoning simply have no thinking parts to replay (no-op).
-    preserveReasoningContentModels: ["grok-4.7", "grok-4.6", "grok-4.5", "grok-4.3", "grok-4.20-0309-reasoning"],
+    preserveReasoningContentModels: ["grok-4.7", "grok-4.7-build-fast", "grok-4.6", "grok-4.5", "grok-4.3", "grok-4.20-0309-reasoning"],
     // grok-4.5 reasoning is always-on with low/medium/high (no off tier, no xhigh).
     // grok-4.6 adds xhigh per docs.x.ai/developers/model-capabilities/text/reasoning;
     // multi-agent accepts the same four wire values to select 4 or 16 collaborators. xAI
@@ -356,15 +394,17 @@ export const PROVIDER_REGISTRY_CORE: readonly ProviderRegistryEntry[] = [
       // 2026-09-23 live probe accepted low..xhigh and rejected max on both wires;
       // devlog/_plan/260923_grok47_parity/010_probe-evidence.md.
       "grok-4.7": ["low", "medium", "high", "xhigh"],
+      "grok-4.7-build-fast": ["low", "medium", "high", "xhigh"],
       "grok-4.6": ["low", "medium", "high", "xhigh"],
       "grok-4.5": ["low", "medium", "high"],
       "grok-4.20-multi-agent-0309": ["low", "medium", "high", "xhigh"],
     },
-    modelDefaultReasoningEfforts: { "grok-4.7": "high", "grok-4.6": "high" },
+    modelDefaultReasoningEfforts: { "grok-4.7": "high", "grok-4.7-build-fast": "high", "grok-4.6": "high" },
     modelContextWindows: {
       // 500k confirmed by context_length_exceeded:
       // devlog/_plan/260923_grok47_parity/010_probe-evidence.md.
       "grok-4.7": 500_000,
+      "grok-4.7-build-fast": 500_000,
       "grok-4.6": 500_000,
       "grok-4.5": 500_000,
       "grok-4.3": 1_000_000,
@@ -446,9 +486,11 @@ export const PROVIDER_REGISTRY_CORE: readonly ProviderRegistryEntry[] = [
     // Claude fast mode on the subscription lane (Claude Code `/fast`): the OAuth route accepts
     // `speed` and gates it on account entitlement (usage credits / org enablement), probed live
     // 2026-09-23 (devlog/_plan/260923_anthropic_fast_speed/020_probe-evidence.md).
+    // Off until the operator opts in: fast mode draws usage credits at 2x price.
     fastWire: ANTHROPIC_FAST_WIRE,
     modelSupportsServiceTier: { ...ANTHROPIC_FAST_MODELS },
     fastTierDescription: ANTHROPIC_FAST_TIER_DESCRIPTION,
+    fastOptIn: true,
   },
   {
     id: "anthropic-apikey",
@@ -471,6 +513,7 @@ export const PROVIDER_REGISTRY_CORE: readonly ProviderRegistryEntry[] = [
     fastWire: ANTHROPIC_FAST_WIRE,
     modelSupportsServiceTier: { ...ANTHROPIC_FAST_MODELS },
     fastTierDescription: ANTHROPIC_FAST_TIER_DESCRIPTION,
+    fastOptIn: true,
   },
   {
     id: "kimi",

package/src/providers/registry/entries-extended.ts

@@ -108,6 +108,12 @@ import {
   STEPFUN_MODEL_INPUT_MODALITIES,
   STEPFUN_NO_VISION_MODELS,
   STEPFUN_REASONING_EFFORTS,
+  ANTHROPIC_MODELS,
+  ANTHROPIC_MODEL_CONTEXT_WINDOWS,
+  ANTHROPIC_MODEL_INPUT_MODALITIES,
+  ANTHROPIC_MODEL_REASONING_EFFORTS,
+  ANTHROPIC_REASONING_EFFORTS,
+  ANTHROPIC_DEFAULT_MAX_OUTPUT_TOKENS,
 } from "./model-seeds";
 
 export const PROVIDER_REGISTRY_EXTENDED: readonly ProviderRegistryEntry[] = [
@@ -824,15 +830,30 @@ export const PROVIDER_REGISTRY_EXTENDED: readonly ProviderRegistryEntry[] = [
     // glm-5.3 carry live end-to-end evidence there (custom tools, reasoning replay, streaming,
     // multi-turn continuation).
     //
-    // That is deliberately NOT expressed as a modelWireDefaults pin. Pinning would move every
-    // existing Codex user of those models onto a different upstream with no config change, and
-    // one delta is unresolved: preserveReasoningContentModels below is read by the CHAT adapter,
-    // while the Responses serializer reads preserveResponsesReasoningContent, which this entry
-    // does not set. On the Responses wire those models would replay with blanked reasoning
-    // content -- less state than they carry today. Z.AI and DeepSeek set both flags together for
-    // exactly this reason. Until that flag is justified against this gateway, Responses stays a
-    // documented per-model modelAdapters opt-in;
-    // tests/providers/alibaba-token-plan-responses-optin.test.ts holds both halves.
+    // That evidence is now expressed as a modelWireDefaults pin scoped to Responses inbound
+    // only: Codex clients ride the native wire with zero translation hops, while chat and
+    // anthropic inbound keep the provider-wide chat wire and its measured prefix-cache
+    // behavior. The pin was held back until the one open delta was closed with its own live
+    // evidence: the Responses serializer replays reasoning content through the separate
+    // preserveResponsesReasoningContent flag, which the Chat-side preserveReasoningContentModels
+    // list does not cover. Measured 260922 on this gateway (#5188): a two-turn replay that
+    // round-trips a reasoning item WITH its plaintext content array is accepted (HTTP 200) and
+    // the model continues from it, so the flag is set beside the pins — the same pairing Z.AI
+    // and DeepSeek use. qwen3.7-plus is the one pinned model in thinkingBudgetModels, and its
+    // full low/medium/high/xhigh/max effort ladder is accepted as reasoning.effort strings on
+    // this wire (measured same day), so the Responses path does not need the numeric
+    // thinking_budget translation the Chat wire applies. The rest of the family stays a
+    // documented per-model modelAdapters opt-in; modelAdapters always wins over the pin in
+    // both directions.
+    // tests/providers/alibaba-token-plan-responses-optin.test.ts holds the opt-in half and the
+    // flag guard; tests/providers/alibaba-token-plan-wire-defaults.test.ts holds the pins.
+    // The intl sibling stays unpinned until the same four-axis verification runs against its
+    // gateway (its /responses route is registered, #5097).
+    modelWireDefaults: {
+      "qwen3.8-flash": { wire: "openai-responses", inbound: ["responses"] },
+      "qwen3.7-plus": { wire: "openai-responses", inbound: ["responses"] },
+      "glm-5.3": { wire: "openai-responses", inbound: ["responses"] },
+    },
     note: "Token Plan Personal Edition · China (Beijing)",
     modelInputModalities: ALIBABA_TOKEN_PLAN_INPUT_MODALITIES,
     modelContextWindows: ALIBABA_TOKEN_PLAN_CONTEXT_WINDOWS,
@@ -862,6 +883,10 @@ export const PROVIDER_REGISTRY_EXTENDED: readonly ProviderRegistryEntry[] = [
     directReasoningEffortModels: QWEN38_FAMILY,
     thinkingBudgetModels: ALIBABA_TOKEN_PLAN_QWEN_MODELS.filter(id => !QWEN38_FAMILY.includes(id)),
     preserveReasoningContentModels: ALIBABA_TOKEN_PLAN_PRESERVE_REASONING,
+    // Responses replay uses this provider-level flag, not the Chat-path model list above;
+    // measured live on this gateway (see the pin comment). The model list still covers a
+    // caller who opts back into Chat.
+    preserveResponsesReasoningContent: true,
     noVisionModels: ALIBABA_TOKEN_PLAN_NO_VISION,
     // The gateway accepts prompt_cache_key on every Token Plan chat model (probed 260902).
     promptCacheKey: true,
@@ -1199,11 +1224,23 @@ export const PROVIDER_REGISTRY_EXTENDED: readonly ProviderRegistryEntry[] = [
     adapter: "openai-chat",
     authKind: "key",
     dashboardUrl: "https://xiaomimimo.com",
-    // Token-plan roster per Xiaomi's token-plan model list (V2.6 Pro and Flash). No jawcodeBundle,
-    // so no plan-specific facts are claimed; usage estimates still come from the model-level vendor
-    // price fallback (the pay-as-you-go equivalent), exactly as they did for V2.5.
+    // Token-plan roster per Xiaomi's token-plan model list (V2.6 Pro and Flash). Model-level facts
+    // come from Xiaomi's model pages (mimo.mi.com/models/en-US/<id>, fetched 2026-09-24): 1M context,
+    // 128K max output; V2.6 Pro/Flash and V2.5 take text/image/video/audio, V2.5 Pro text only. The
+    // catalog vocabulary has no video or audio, so only text/image are claimed. The token plan speaks
+    // the same API format as pay-as-you-go, so these are model facts rather than plan facts. No
+    // jawcodeBundle: pricing and entitlement stay unclaimed, and usage estimates still come from the
+    // model-level vendor price fallback, exactly as they did for V2.5.
     defaultModel: "mimo-v2.6-pro",
     models: ["mimo-v2.6-pro", "mimo-v2.6-flash", "mimo-v2.5-pro", "mimo-v2.5"],
+    modelContextWindows: { "mimo-v2.6-pro": 1_048_576, "mimo-v2.6-flash": 1_048_576, "mimo-v2.5-pro": 1_048_576, "mimo-v2.5": 1_048_576 },
+    modelMaxOutputTokens: { "mimo-v2.6-pro": 131_072, "mimo-v2.6-flash": 131_072, "mimo-v2.5-pro": 131_072, "mimo-v2.5": 131_072 },
+    modelInputModalities: {
+      "mimo-v2.6-pro": ["text", "image"],
+      "mimo-v2.6-flash": ["text", "image"],
+      "mimo-v2.5": ["text", "image"],
+      "mimo-v2.5-pro": ["text"],
+    },
     // The gateway validates the ladder strictly and rejects anything above `high`.
     reasoningEfforts: ["low", "medium", "high"],
     reasoningEffortMap: { xhigh: "high", max: "high", ultra: "high" },
@@ -1401,4 +1438,54 @@ export const PROVIDER_REGISTRY_EXTENDED: readonly ProviderRegistryEntry[] = [
     reasoningEfforts: STEPFUN_REASONING_EFFORTS,
     note: "StepFun (阶跃星辰) official OpenAI-compatible API.",
   },
+  {
+    // Official Claude Code CLI as the transport for a Claude subscription (§三十一). The CLI owns
+    // the account: this row stores no token and the adapter reads and injects none, so the request
+    // path is Anthropic's own harness rather than a replayed Claude Code identity against the
+    // Messages API. `baseUrl` is the destination the subscription's traffic reaches; OpenCodex
+    // never sends it. Fails closed if the row's base URL is overridden.
+    // v1 runs tools-disabled (`--tools ""`, no `--mcp-config`) so the client keeps tool ownership:
+    // text/reasoning only until the shared capture-only tool bridge lands. Requires the CLI:
+    // `npm i -g @anthropic-ai/claude-code`, plus a signed-in session (`claude` -> /login).
+    // GOVERNANCE: whether a subscription login may be driven through a proxy for a third-party
+    // agent is Anthropic's call rather than OpenCodex's — flagged for maintainer review, as with
+    // the CodeBuddy rows above.
+    id: "claude-cli",
+    label: "Claude Code CLI (subscription)",
+    adapter: "claude-cli",
+    baseUrl: "https://api.anthropic.com",
+    // `key` + `keyOptional`, deliberately not `local`. "local" (Ollama, vLLM, LM Studio) means the
+    // traffic never leaves the machine and there is no credential to classify; this row reaches
+    // api.anthropic.com, so `local` misreported it wherever auth is classified — the account
+    // surface answered "local provider ... has no credentials" (`classifyAccount`,
+    // src/cli/account-api.ts) and the dashboard filed the row as a local runtime. What IS true is
+    // keyless: the CLI reads the operator's own sign-in, so `keyOptional` is the existing flag that
+    // exempts a row from key enforcement without claiming a key exists. Key rows are also what
+    // `deriveProviderPresets` lists, so this entry needs no `dashboardPreset` flag to stay
+    // reachable from the Providers page.
+    authKind: "key",
+    keyOptional: true,
+    // There is no key console for a keyless row: the link that helps an operator is the one that
+    // documents the install and sign-in this provider requires.
+    dashboardUrl: "https://docs.claude.com/en/docs/claude-code/setup",
+    defaultModel: "claude-sonnet-5",
+    models: [...ANTHROPIC_MODELS],
+    // Static roster, exactly like the CodeBuddy rows. Without this the catalog treats the row as a
+    // live-discovery candidate and requests a model list the CLI route never serves: a real start
+    // logged `Provider model discovery for "claude-cli" failed with HTTP 404` and then fell back to
+    // these ids anyway. `liveModels: false` makes the configured roster authoritative and skips the
+    // request entirely (src/codex/catalog/provider-models.ts).
+    liveModels: false,
+    modelContextWindows: { ...ANTHROPIC_MODEL_CONTEXT_WINDOWS },
+    // Text-only for v1, not the image modality the Messages API rows publish. The CLI parses an
+    // image frame (verified against 2.1.270), but a headless turn has no verified contract that the
+    // harness hands those bytes to the model, and advertising a modality the route cannot honour
+    // makes a route selection pick this row for a picture it then answers blind. The adapter refuses
+    // direct image input for the same reason; the vision sidecar still captions images into text.
+    noVisionModels: [...ANTHROPIC_MODELS],
+    reasoningEfforts: ANTHROPIC_REASONING_EFFORTS,
+    modelReasoningEfforts: { ...ANTHROPIC_MODEL_REASONING_EFFORTS },
+    defaultMaxOutputTokens: ANTHROPIC_DEFAULT_MAX_OUTPUT_TOKENS,
+    note: "Runs Claude subscription traffic through Anthropic's own harness: the official Claude Code CLI headlessly (`claude -p`), one turn per request. OpenCodex stores no Claude token, reads none and injects none — the CLI signs in and bills the account itself, which is why this row is keyless and an API key saved here never reaches the harness (use `anthropic-apikey` for key billing). The sign-in is the one of the user this proxy runs as, so every request served through this row — by any client of this proxy — spends that same account; OpenCodex neither pools nor multiplexes Claude sign-ins. Requires the CLI (`npm i -g @anthropic-ai/claude-code`) and a signed-in session (`claude` -> /login). v1 disables CLI tools (--tools \"\", --strict-mcp-config) so the client retains tool ownership: text/reasoning only for now. Subscription routing authorization flagged for maintainer review.",
+  },
 ];

package/src/providers/registry/model-ids.ts

@@ -83,6 +83,7 @@ export const REGISTRY_FIELD_MODEL_ID_ROLES = {
   modelSupportsServiceTier: RECORD_KEYS,
   keyAuthServiceTier: KEY_AUTH_SERVICE_TIER,
   fastTierDescription: NONE,
+  fastOptIn: NONE,
   modelServiceTierCapabilityBaseUrlGuard: NONE,
   preserveResponsesReasoningContent: NONE,
   dropResponsesReasoningItems: NONE,
@@ -107,6 +108,7 @@ export const REGISTRY_FIELD_MODEL_ID_ROLES = {
   noReasoningModels: NONE,
   noTemperatureModels: NONE,
   noTopPModels: NONE,
+  noStopModels: NONE,
   noPenaltyModels: NONE,
   noJsonSchemaModels: NONE,
   parallelToolCalls: NONE,

package/src/providers/registry/types.ts

@@ -257,6 +257,11 @@ export interface ProviderRegistryEntry {
   };
   /** Provider-specific copy for the Codex catalog's Fast tier. */
   fastTierDescription?: string;
+  /**
+   * The Fast lane is billed beyond the plan, so it stays off until the operator sets
+   * `providers.<name>.fastEnabled: true` (see `providerFastSwitchOff`).
+   */
+  fastOptIn?: boolean;
   /**
    * Registry-only destination guard for `modelSupportsServiceTier`. This scopes vendor evidence
    * without changing provider ownership, routing, authentication, or config validation.
@@ -308,6 +313,7 @@ export interface ProviderRegistryEntry {
   noReasoningModels?: string[];
   noTemperatureModels?: string[];
   noTopPModels?: string[];
+  noStopModels?: string[];
   noPenaltyModels?: string[];
   /**
    * Registry-only seed for `OcxProviderConfig.noJsonSchemaModels`. Merged into the
@@ -359,7 +365,7 @@ export type ProviderConfigSeed = Pick<
   | "modelDisplayNames"
   | "modelMaxInputTokens" | "defaultMaxOutputTokens" | "modelMaxOutputTokens"
   | "reasoningEfforts" | "modelReasoningEfforts" | "modelDefaultReasoningEfforts" | "reasoningEffortMap" | "modelReasoningEffortMap" | "reasoningWireFormat"
-  | "noVisionModels" | "noReasoningModels" | "noTemperatureModels" | "noTopPModels" | "noPenaltyModels"
+  | "noVisionModels" | "noReasoningModels" | "noTemperatureModels" | "noTopPModels" | "noStopModels" | "noPenaltyModels"
   | "autoToolChoiceOnlyModels" | "preserveReasoningContentModels" | "requiresReasoningPlaceholderModels" | "reasoningSplitModels" | "inlineThinkTagModels" | "reasoningDetailsModels" | "thinkingToggleModels" | "thinkingBudgetModels" | "escapeBuiltinToolNames" | "openaiChatEofTolerance" | "showThinkingSummary"
   | "googleMode" | "project" | "location" | "headers"
 >;

package/src/providers/resolved-model-policy.ts

@@ -2,6 +2,7 @@ import type { ModelCapabilities, OcxProviderConfig } from "../types";
 import { MODEL_ADAPTER_OVERRIDE_ALLOWED, pinnedWireAdapter } from "../types";
 import { isCanonicalOpenAiForwardProvider } from "./openai-tiers";
 import { resolveProviderAuthTransport } from "./fastwire";
+import { fastSwitchOff } from "./fast-opt-in";
 import { registryEntrySupportsLiveModelDiscovery } from "./static-model-discovery";
 import type { InboundWire, ProviderRegistryEntry, ResponsesTerminalRepairPolicy } from "./registry/types";
 import {
@@ -30,7 +31,7 @@ export type StaticProviderPolicyField =
   | "modelMaxOutputTokens" | "reasoningEfforts" | "modelReasoningEfforts" | "modelReasoningEffortsAuthoritative"
   | "modelDefaultReasoningEfforts" | "reasoningEffortMap" | "modelReasoningEffortMap"
   | "reasoningWireFormat" | "noVisionModels" | "noReasoningModels" | "noTemperatureModels"
-  | "noTopPModels" | "noPenaltyModels" | "noJsonSchemaModels" | "parallelToolCalls"
+  | "noTopPModels" | "noStopModels" | "noPenaltyModels" | "noJsonSchemaModels" | "parallelToolCalls"
   | "promptCacheKey" | "chatServiceTier" | "openaiChatEofTolerance" | "statelessResponses"
   | "requiresAdjacentResponsesToolResults" | "requiresPairedResponsesToolResults" | "annotateEmptyToolOutputs"
   | "fastWire" | "supportsServiceTier" | "modelSupportsServiceTier" | "supportsOpenAiWebSearchToolFields"
@@ -187,7 +188,10 @@ export function resolveModelPolicy(input: ResolveModelPolicyInput): ResolvedMode
     legacyClinePassLadder || provider.reasoningEfforts === undefined ? entry?.reasoningEfforts ? "registry" : "unknown" : "operator");
   put("chatServiceTier", provider.chatServiceTier ?? keyAuthDefaults?.chatServiceTier ?? entry?.chatServiceTier,
     provider.chatServiceTier !== undefined ? "operator" : keyAuthDefaults?.chatServiceTier !== undefined ? "registry" : entry?.chatServiceTier !== undefined ? "registry" : "unknown");
-  put("supportsServiceTier", provider.supportsServiceTier ?? keyAuthDefaults?.supportsServiceTier ?? entry?.supportsServiceTier,
+  // The Fast switch overrides every capability source; see providerFastSwitchOff.
+  const fastOff = fastSwitchOff(provider, input.registryEntry);
+  if (fastOff) put("supportsServiceTier", false, provider.fastEnabled === false ? "operator" : "registry");
+  else put("supportsServiceTier", provider.supportsServiceTier ?? keyAuthDefaults?.supportsServiceTier ?? entry?.supportsServiceTier,
     provider.supportsServiceTier !== undefined ? "operator" : keyAuthDefaults?.supportsServiceTier !== undefined ? "registry" : entry?.supportsServiceTier !== undefined ? "registry" : "unknown");
   if (entry && !registryEntrySupportsLiveModelDiscovery(entry)) put("liveModels", false, "registry");
   putMergedMap("modelDisplayNames", entry?.modelDisplayNames, provider.modelDisplayNames);
@@ -226,6 +230,7 @@ export function resolveModelPolicy(input: ResolveModelPolicyInput): ResolvedMode
   put("modelReasoningEffortMap", modelEffortMap, modelEffortMapSource);
   for (const key of [
     "noVisionModels", "noReasoningModels", "noTemperatureModels", "noTopPModels",
+    "noStopModels",
     "noPenaltyModels", "noJsonSchemaModels", "autoToolChoiceOnlyModels",
     "preserveReasoningContentModels", "requiresReasoningPlaceholderModels",
     "reasoningSplitModels", "reasoningDetailsModels", "thinkingToggleModels", "thinkingBudgetModels",
@@ -324,7 +329,9 @@ export function resolveModelPolicy(input: ResolveModelPolicyInput): ResolvedMode
   const modelSupportsReasoningSummaries = modelValue(providerPolicy.modelSupportsReasoningSummaries)
     ?? (modelValue(providerPolicy.modelReasoningSummaryDelivery) !== undefined ? true : undefined);
   const modelSupportsVerbosity = modelValue(providerPolicy.modelSupportsVerbosity) ?? providerPolicy.supportsVerbosity;
-  const modelSupportsServiceTier = modelValue(providerPolicy.modelSupportsServiceTier) ?? providerPolicy.supportsServiceTier;
+  const modelSupportsServiceTier = fastOff
+    ? false
+    : modelValue(providerPolicy.modelSupportsServiceTier) ?? providerPolicy.supportsServiceTier;
   const model: ResolvedPerModelStaticPolicy = {
     adapter,
     ...(modelContextWindow !== undefined ? { contextWindow: modelContextWindow } : {}),
@@ -379,7 +386,7 @@ export function resolveModelPolicy(input: ResolveModelPolicyInput): ResolvedMode
   }
   modelProvenance.supportsVerbosity = modelOrProviderSource(provider.modelSupportsVerbosity, entry?.modelSupportsVerbosity, provider.supportsVerbosity, entry?.supportsVerbosity);
   const exactServiceTierSource = modelSource(provider.modelSupportsServiceTier, registryServiceTierDefaults);
-  modelProvenance.supportsServiceTier = exactServiceTierSource !== "unknown" ? exactServiceTierSource
+  modelProvenance.supportsServiceTier = !fastOff && exactServiceTierSource !== "unknown" ? exactServiceTierSource
     : providerProvenance.supportsServiceTier ?? "unknown";
   modelProvenance.responsesUpstreamStreaming = model.responsesUpstreamStreaming === undefined ? "unknown" : "registry";
   modelProvenance.responsesTerminalRepair = model.responsesTerminalRepair === undefined ? "unknown" : "registry";

package/src/providers/service-tier.ts

@@ -15,6 +15,7 @@ import {
   type FastPolicyAuthority,
   type ResolvedFastPolicy,
 } from "./fastwire";
+import { providerFastSwitchOff } from "./fast-opt-in";
 
 /** OpenAI-compatible adapters that can carry the standard `service_tier` field. */
 export const SERVICE_TIER_ADAPTERS = new Set(["openai-chat", "openai-responses"]);
@@ -35,6 +36,7 @@ type ServiceTierCapabilityProvider = Pick<
   | "apiKeyTransport"
   | "chatServiceTier"
   | "fastWire"
+  | "fastEnabled"
 >;
 
 function cloneRegistryWireDefaults(
@@ -83,9 +85,14 @@ function buildFastPolicyAuthority(
     && registryModelServiceTierCapabilityApplies(registry, capabilityProvider)
     ? registry.modelSupportsServiceTier
     : undefined;
-  const providerCapability = capabilityProvider.supportsServiceTier
-    ?? keyAuthDefaults?.supportsServiceTier
-    ?? registry?.supportsServiceTier;
+  const fastSwitchOff = providerFastSwitchOff(providerName, {
+    fastEnabled: capabilityProvider.fastEnabled ?? provider.fastEnabled,
+  });
+  const providerCapability = fastSwitchOff
+    ? false
+    : capabilityProvider.supportsServiceTier
+      ?? keyAuthDefaults?.supportsServiceTier
+      ?? registry?.supportsServiceTier;
   const authority: FastPolicyAuthority = Object.freeze({
     providerAdapter: provider.adapter,
     providerAuthMode: provider.authMode ?? registry?.authKind ?? "key",

package/src/responses/code-mode-helper-compat.ts

@@ -92,6 +92,9 @@ export function compileCodeModeHelperInput(
     }
     return `const result = await tools.view_image(${JSON.stringify(viewArgs)});\nif (result && result.image_url) { image(result.image_url); } else { text(result); }`;
   }
+  if (helperName === "create_goal" || helperName === "get_goal" || helperName === "update_goal") {
+    return `const result = await tools.${helperName}(${JSON.stringify(args)});\ntext(result);`;
+  }
   return `const result = await tools.exec_command(${JSON.stringify(args)});\ntext(result);`;
 }