@bitkyc08/opencodex 2.64.0 → 2.65.0-preview.20260925

package/src/update/install-detection.d.mts

@@ -1,6 +1,33 @@
-export type DetectedInstall = "bun" | "npm" | "pnpm" | "source";
+export type DetectedInstall = "bun" | "mise" | "npm" | "pnpm" | "source";
+
+export interface MiseInstallOwner {
+  tool: string;
+  backend: string;
+  installPath: string;
+  toolRoot: string;
+}
+
+export type InstallOwnership =
+  | { installer: Exclude<DetectedInstall, "mise"> }
+  | {
+      installer: "mise";
+      owner: MiseInstallOwner | null;
+      error?: "metadata_unreadable" | "metadata_inconsistent";
+    };
+
+export interface InstallDetectionDeps {
+  exists?: (path: string) => boolean;
+  probe?: (path: string) => "present" | "absent" | "unreadable";
+  readFile?: (path: string) => string;
+  realpath?: (path: string) => string;
+}
 
 export declare function detectInstallFromPath(
   packagePath: string,
-  deps?: { exists?: (path: string) => boolean; realpath?: (path: string) => string },
+  deps?: InstallDetectionDeps,
 ): DetectedInstall;
+
+export declare function detectInstallOwnershipFromPath(
+  packagePath: string,
+  deps?: InstallDetectionDeps,
+): InstallOwnership;

package/src/update/install-detection.mjs

@@ -1,4 +1,29 @@
-import { realpathSync } from "node:fs";
+import { existsSync, readFileSync, realpathSync, statSync } from "node:fs";
+
+const OPENCODEX_MISE_BACKEND = "npm:@bitkyc08/opencodex";
+const OPENCODEX_MISE_BACKEND_DIR = "npm-bitkyc08-opencodex";
+/** mise's core Node runtime. npm -g under it is an npm install that mise did not make. */
+const MISE_NODE_RUNTIME = { tool: "node", backend: "core:node" };
+const OPENCODEX_PACKAGE_SEGMENT = "/node_modules/@bitkyc08/opencodex";
+
+/**
+ * @typedef {{
+ *   tool: string;
+ *   backend: string;
+ *   installPath: string;
+ *   toolRoot: string;
+ * }} MiseInstallOwner
+ */
+
+/**
+ * @typedef {{
+ *   installer: "bun" | "npm" | "pnpm" | "source";
+ * } | {
+ *   installer: "mise";
+ *   owner: MiseInstallOwner | null;
+ *   error?: "metadata_unreadable" | "metadata_inconsistent";
+ * }} InstallOwnership
+ */
 
 /**
  * Infer the package manager from the path of the running package.
@@ -14,7 +39,30 @@ import { realpathSync } from "node:fs";
  * virtual store.
  */
 export function detectInstallFromPath(packagePath, deps = {}) {
-  const exists = deps.exists;
+  return detectInstallOwnershipFromPath(packagePath, deps).installer;
+}
+
+/**
+ * Infer the outer owner of the running package.
+ *
+ * mise's npm backend deliberately contains an ordinary npm/aube installation, so
+ * package-manager layout alone reports npm. The adjacent backend record is the
+ * stronger ownership signal: it identifies the mise alias and canonical backend,
+ * while containment proves that the running package belongs to that installation.
+ *
+ * @param {string} packagePath
+ * @param {{
+ *   exists?: (path: string) => boolean;
+ *   probe?: (path: string) => "present" | "absent" | "unreadable";
+ *   readFile?: (path: string) => string;
+ *   realpath?: (path: string) => string;
+ * }} deps
+ * @returns {InstallOwnership}
+ */
+export function detectInstallOwnershipFromPath(packagePath, deps = {}) {
+  const exists = deps.exists ?? existsSync;
+  const probe = deps.probe ?? probeMetadata;
+  const readFile = deps.readFile ?? (path => readFileSync(path, "utf8"));
   const candidates = [String(packagePath)];
   try {
     const resolved = (deps.realpath ?? realpathSync)(String(packagePath));
@@ -24,17 +72,175 @@ export function detectInstallFromPath(packagePath, deps = {}) {
     // realpath. The lexical path still carries the evidence when it is available.
   }
 
-  let sawNodeModules = false;
+  let detectedManager = "source";
+  /** @type {MiseInstallOwner[]} */
+  const miseOwners = [];
+  /** @type {"metadata_unreadable" | "metadata_inconsistent" | undefined} */
+  let miseError;
   for (const candidate of candidates) {
+    const mise = detectMiseOwner(candidate, { probe, readFile });
+    if (mise.recognized) {
+      if (mise.owner) miseOwners.push(mise.owner);
+      else miseError = mise.error;
+    }
     const detected = detectInstallCandidate(candidate, exists);
-    if (detected === "pnpm" || detected === "bun") return detected;
-    if (detected === "npm") sawNodeModules = true;
+    if (detected === "pnpm" || detected === "bun") detectedManager = detected;
+    else if (detected === "npm" && detectedManager === "source") detectedManager = "npm";
+  }
+  // Any recognized ownership error on either spelling takes precedence over every verified
+  // owner. Keeping a command from the other candidate could authorize mutation across a
+  // lexical/resolved-path mismatch, so fail closed without recovery guidance.
+  if (miseError) return { installer: "mise", owner: null, error: miseError };
+  const miseOwner = miseOwners.at(-1);
+  if (miseOwner) {
+    // The lexical and resolved spellings of one install differ when an ancestor such as the
+    // mise data directory is a symlink (macOS /var -> /private/var). Both still name the same
+    // physical tool directory and the same backend file, so compare canonical directories;
+    // any other disagreement stays inconsistent.
+    const realpath = deps.realpath ?? realpathSync;
+    const consistent = miseOwners.every(owner =>
+      owner.tool === miseOwner.tool
+      && owner.backend === miseOwner.backend
+      && sameDirectory(owner.toolRoot, miseOwner.toolRoot, realpath)
+    );
+    return consistent
+      ? { installer: "mise", owner: miseOwner }
+      : { installer: "mise", owner: null, error: "metadata_inconsistent" };
+  }
+  return { installer: detectedManager };
+}
+
+function parseBackendMetadata(content) {
+  const fields = new Map();
+  for (const line of String(content).split(/\r?\n/)) {
+    const match = /^\s*(short|full)\s*=\s*("(?:[^"\\]|\\.)*"|'[^']*')\s*(?:#.*)?$/.exec(line);
+    if (!match) continue;
+    if (fields.has(match[1])) return null;
+    try {
+      fields.set(
+        match[1],
+        match[2].startsWith('"') ? JSON.parse(match[2]) : match[2].slice(1, -1),
+      );
+    } catch {
+      return null;
+    }
   }
-  return sawNodeModules ? "npm" : "source";
+  const tool = fields.get("short");
+  const backend = fields.get("full");
+  return typeof tool === "string" && typeof backend === "string"
+    ? { tool, backend }
+    : null;
+}
+
+function detectMiseOwner(packagePath, deps) {
+  const windowsPath = /^[A-Za-z]:[\\/]/.test(String(packagePath))
+    || String(packagePath).startsWith("\\\\");
+  const normalized = (windowsPath ? String(packagePath).replaceAll("\\", "/") : String(packagePath))
+    .replace(/\/+$/, "");
+  const lower = normalized.toLowerCase();
+  let marker = -1;
+  let installPath;
+  let toolRoot;
+  let metadataPath;
+  while ((marker = lower.indexOf("/node_modules/", marker + 1)) >= 1) {
+    installPath = normalized.slice(0, marker);
+    const slash = installPath.lastIndexOf("/");
+    if (slash < 1) continue;
+    toolRoot = installPath.slice(0, slash);
+    metadataPath = `${toolRoot}/.mise.backend.toml`;
+    const metadataState = deps.probe(metadataPath);
+    if (metadataState === "present") break;
+    if (metadataState === "unreadable") {
+      return { recognized: true, owner: null, error: "metadata_unreadable" };
+    }
+    metadataPath = undefined;
+  }
+  if (!metadataPath || !installPath || !toolRoot) return { recognized: false };
+
+  let metadata;
+  try {
+    metadata = parseBackendMetadata(deps.readFile(metadataPath));
+  } catch {
+    return { recognized: true, owner: null, error: "metadata_unreadable" };
+  }
+  const toolDir = toolRoot.slice(toolRoot.lastIndexOf("/") + 1);
+  // On Windows, npm -g under a mise-managed Node writes the package straight into
+  // <mise>/installs/node/<version>/node_modules, so the adjacent record is Node's own
+  // (short = "node", full = "core:node"), not a statement about OpenCodex. Only that exact
+  // runtime record with the package directly in the runtime's global node_modules is an
+  // npm install; any other backend or layout stays fail-closed below.
+  if (
+    metadata
+    && metadata.tool === MISE_NODE_RUNTIME.tool
+    && metadata.backend === MISE_NODE_RUNTIME.backend
+    && samePath(toolDir, MISE_NODE_RUNTIME.tool, windowsPath)
+    && isRuntimeGlobalPackage(normalized, installPath, windowsPath)
+  ) {
+    return { recognized: false };
+  }
+  const expectedToolDir = metadata?.tool === OPENCODEX_MISE_BACKEND
+    ? OPENCODEX_MISE_BACKEND_DIR
+    : metadata?.tool;
+  if (
+    !metadata
+    || metadata.backend !== OPENCODEX_MISE_BACKEND
+    || (metadata.tool !== OPENCODEX_MISE_BACKEND
+      && !/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(metadata.tool))
+    || !samePath(expectedToolDir, toolDir, windowsPath)
+  ) {
+    return { recognized: true, owner: null, error: "metadata_inconsistent" };
+  }
+  return {
+    recognized: true,
+    owner: {
+      tool: metadata.tool,
+      backend: metadata.backend,
+      installPath,
+      toolRoot,
+    },
+  };
+}
+
+/**
+ * True when the package sits directly in the runtime's global node_modules:
+ * <toolRoot>/<version>/node_modules/@bitkyc08/opencodex[/...].
+ */
+function isRuntimeGlobalPackage(packagePath, installPath, windowsPath) {
+  const rest = packagePath.slice(installPath.length);
+  const probe = windowsPath ? rest.toLowerCase() : rest;
+  return probe === OPENCODEX_PACKAGE_SEGMENT || probe.startsWith(`${OPENCODEX_PACKAGE_SEGMENT}/`);
+}
+
+function probeMetadata(path) {
+  try {
+    statSync(path);
+    return "present";
+  } catch (error) {
+    const code = error && typeof error === "object" && "code" in error
+      ? error.code
+      : undefined;
+    return code === "ENOENT" || code === "ENOTDIR" ? "absent" : "unreadable";
+  }
+}
+
+function sameDirectory(left, right, realpath) {
+  if (samePath(left, right)) return true;
+  try {
+    return samePath(realpath(left), realpath(right));
+  } catch {
+    return false;
+  }
+}
+
+function samePath(left, right, windows = /^[A-Za-z]:\//.test(left) && /^[A-Za-z]:\//.test(right)) {
+  return windows ? left.toLowerCase() === right.toLowerCase() : left === right;
 }
 
 function detectInstallCandidate(packagePath, exists) {
-  const normalized = String(packagePath).replaceAll("\\", "/");
+  const path = String(packagePath);
+  const normalized = /^[A-Za-z]:[\\/]/.test(path) || path.startsWith("\\\\")
+    ? path.replaceAll("\\", "/")
+    : path;
   const segments = normalized.split("/").filter(Boolean);
   // Windows paths are case-insensitive. Treating the structural marker this way also
   // keeps a preserved-symlink path from being downgraded merely because its casing came

package/src/update/job.ts

@@ -34,19 +34,22 @@ import {
 import { isServiceInstalled, isServiceViable, readServiceBackend, stopWindows } from "../service";
 import { runUpdateRestartWithOwnershipLease, type ServiceOwnershipResolution } from "./restart-ownership";
 import {
-  type Channel,
-  type Installer,
+  type Channel, type Installer,
   PKG,
   checkUpdatePackageIntegrity,
   currentVersion,
   defaultUpdateTag,
   detectInstall,
+  detectInstallOwnership,
   latestVersion,
+  miseUpdateCommand,
   updateCommand,
   updateCommandStr,
   resolveCurrentPnpmGlobalOwner,
   resolvePnpmActiveLauncher,
 } from "./index";
+import type { UpdateCheckDeps } from "./check-types";
+export type { UpdateCheckDeps } from "./check-types";
 import type { PnpmGlobalOwner } from "./pnpm-global-install.mjs";
 import { isNewer } from "./notify";
 import { isRealBunBinary } from "../lib/bun-binary-validator.mjs";
@@ -114,12 +117,6 @@ export class UpdateJobError extends Error {
   }
 }
 
-export interface UpdateCheckDeps {
-  currentVersion: () => string;
-  detectInstall: () => Installer;
-  latestVersion: (tag: Channel) => string | null;
-}
-
 interface UpdateWorkerProcess {
   pid?: number;
   unref(): void;
@@ -136,7 +133,9 @@ export interface StartUpdateJobDeps {
 const defaultCheckDeps: UpdateCheckDeps = {
   currentVersion,
   detectInstall,
+  detectInstallOwnership,
   latestVersion,
+  miseUpdateCommand,
 };
 
 function nodeBin(): string {
@@ -489,16 +488,22 @@ export function checkForUpdate(
   deps: UpdateCheckDeps = defaultCheckDeps,
 ): UpdateCheckResult {
   const current = deps.currentVersion();
-  const installer = deps.detectInstall();
+  const ownership = deps.detectInstallOwnership?.();
+  const installer = ownership?.installer ?? deps.detectInstall();
   const channel = requestedChannel ?? normalizeUpdateChannel(null, current);
   const latest = installer === "source" ? null : deps.latestVersion(channel);
   const updateAvailable = !!latest && isNewer(latest, current, channel);
   let reason: string | undefined;
-  let command = installer === "source" ? manualSourceCommand() : updateExecutionCommand(installer, channel).display;
+  let command = installer === "source"
+    ? manualSourceCommand()
+    : installer === "mise"
+      ? (ownership && deps.miseUpdateCommand?.(ownership)) ?? ""
+      : updateExecutionCommand(installer, channel).display;
 
   if (installer === "source") {
     reason = "source_checkout";
-    command = manualSourceCommand();
+  } else if (installer === "mise") {
+    reason = command ? "externally_managed" : "external_ownership_invalid";
   } else if (!latest) {
     reason = "latest_unavailable";
   } else if (!updateAvailable) {
@@ -511,7 +516,7 @@ export function checkForUpdate(
     channel,
     installer,
     updateAvailable,
-    canUpdate: installer !== "source" && updateAvailable,
+    canUpdate: installer !== "source" && installer !== "mise" && updateAvailable,
     command,
     releaseNotesUrl: RELEASE_NOTES_URL,
     ...(reason ? { reason } : {}),

package/src/update/notify.ts

@@ -17,7 +17,8 @@ import {
 } from "./index";
 
 const VERSION_FILENAME = "version.json";
-const REFRESH_INTERVAL_MS = 20 * 60 * 60 * 1000; // 20h, matching codex-rs
+export const REFRESH_INTERVAL_MS = 20 * 60 * 60 * 1000; // 20h, matching codex-rs
+export const CACHE_MAX_AGE_MS = 40 * 60 * 60 * 1000;
 const RELEASE_NOTES_URL = "https://github.com/lidge-jun/opencodex/releases/latest";
 
 export interface VersionCache {
@@ -62,6 +63,17 @@ export function writeVersionCache(cache: VersionCache): void {
   }
 }
 
+export function writeFreshVersionCache(channel: Channel, latest: string, nowMs = Date.now()): void {
+  const previous = readVersionCache(channel);
+  writeVersionCache({
+    latest_version: latest,
+    last_checked_at: new Date(nowMs).toISOString(),
+    dismissed_version: previous?.latest_version === latest && previous.dismissed_version === latest
+      ? latest : undefined,
+    tag: channel,
+  });
+}
+
 function parseStable(v: string): [number, number, number] | null {
   const m = /^(\d+)\.(\d+)\.(\d+)$/.exec(v.trim());
   if (!m) return null;
@@ -139,7 +151,8 @@ export function interactiveGuardOk(): boolean {
  * the one-time star prompt has already run (first-run yield, O1).
  */
 export function shouldConsider(): { channel: Channel; current: string } | null {
-  if (detectInstall() === "source") return null;
+  const installer = detectInstall();
+  if (installer === "source" || installer === "mise") return null;
   const current = currentVersion();
   if (current === "?" || isSourceBuildVersion(current)) return null;
   if (!interactiveGuardOk()) return null;
@@ -195,14 +208,7 @@ export function triggerBackgroundRefreshIfStale(channel: Channel, cache: Version
  */
 export async function refreshVersionCache(channel: Channel): Promise<void> {
   const latest = latestVersion(channel);
-  if (!latest) return; // do not dirty the cache or advance the timestamp
-  const prev = readVersionCache(channel);
-  writeVersionCache({
-    latest_version: latest,
-    last_checked_at: new Date().toISOString(),
-    dismissed_version: prev?.dismissed_version,
-    tag: channel,
-  });
+  if (latest) writeFreshVersionCache(channel, latest);
 }
 
 /** Persist a dismissal so this exact version stops prompting. */
@@ -241,7 +247,6 @@ export async function maybeShowUpdatePrompt(): Promise<void> {
     const { channel, current } = eligible;
 
     const cache = readVersionCache(channel);
-    triggerBackgroundRefreshIfStale(channel, cache);
 
     const latest = getUpgradeVersionForPopup(cache, current, channel);
     if (!latest) return;

package/src/update/pnpm-owner-worker.ts

@@ -0,0 +1,12 @@
+import { resolveCurrentPnpmGlobalOwner } from "./index";
+
+onmessage = event => {
+  try {
+    const invoked = typeof event.data === "string" ? event.data : "";
+    if (!invoked) { postMessage(null); return; }
+    const result = resolveCurrentPnpmGlobalOwner(invoked);
+    postMessage(result.ok ? result.owner : null);
+  } catch {
+    postMessage(null);
+  }
+};

package/src/update/refresh-scheduler.ts

@@ -0,0 +1,141 @@
+import { checkForUpdate, type UpdateCheckResult } from "./job";
+import { currentVersion, defaultUpdateTag, detectInstall, detectInstallOwnership, miseUpdateCommand, type Channel, type Installer } from "./index";
+import { isSourceBuildVersion, readVersionCache, REFRESH_INTERVAL_MS, writeFreshVersionCache } from "./notify";
+import { latestVersionAsync } from "./async-check";
+
+export const STALENESS_TICK_MS = 60 * 60 * 1000;
+export const RETRY_BASE_MS = 60_000;
+export const RETRY_CAP_MS = STALENESS_TICK_MS;
+
+export interface RefreshDeps {
+  now: () => number;
+  lookup: (channel: Channel, installer: Installer) => Promise<string | null>;
+  current: () => string;
+  install: () => Installer;
+  ownership: typeof detectInstallOwnership;
+  guidance: typeof miseUpdateCommand;
+  read: typeof readVersionCache;
+  write: typeof writeFreshVersionCache;
+  setTimer: typeof setTimeout;
+  clearTimer: typeof clearTimeout;
+  disabled: () => boolean;
+}
+
+const defaults: RefreshDeps = {
+  now: Date.now,
+  lookup: latestVersionAsync,
+  current: currentVersion,
+  install: detectInstall,
+  ownership: detectInstallOwnership,
+  guidance: miseUpdateCommand,
+  read: readVersionCache,
+  write: writeFreshVersionCache,
+  setTimer: setTimeout,
+  clearTimer: clearTimeout,
+  disabled: () => process.env.OCX_DISABLE_UPDATE_CHECK === "1",
+};
+
+export function createRefreshScheduler(deps: RefreshDeps = defaults) {
+  const inFlight = new Map<Channel, { task: Promise<string | null>; epoch: number; markExplicit: () => void }>();
+  // Flight order per channel: a flight started earlier never overwrites a cache entry that a
+  // later-started flight already wrote (an explicit caller can keep an old flight writable
+  // across stop/start while the new listener's flight finishes first).
+  const lastWrittenFlight = new Map<Channel, number>();
+  let flightSeq = 0;
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  let running = false;
+  let starts = 0;
+  let failures = 0;
+  let retryAt = 0;
+  let generation = 0;
+
+  const eligible = () => {
+    const version = deps.current();
+    const installer = deps.install();
+    return !deps.disabled() && version !== "?" && !isSourceBuildVersion(version)
+      && installer !== "source" && installer !== "mise";
+  };
+  const channel = () => defaultUpdateTag(deps.current());
+  const stale = (tag: Channel) => {
+    const checked = Date.parse(deps.read(tag)?.last_checked_at ?? "");
+    return !Number.isFinite(checked) || checked > deps.now() || deps.now() - checked >= REFRESH_INTERVAL_MS;
+  };
+  const schedule = (delay: number) => {
+    if (!running) return;
+    if (timer) deps.clearTimer(timer);
+    timer = deps.setTimer(() => { timer = undefined; void tick(); }, delay);
+    timer.unref?.();
+  };
+  const lookup = (tag: Channel, automatic: boolean): Promise<string | null> => {
+    const existing = inFlight.get(tag);
+    // An automatic tick joins only a flight of its own generation. A flight left over from a
+    // stopped listener cannot write for the new one, so joining it would push the next check an
+    // hour out with nothing written. Explicit callers may join any flight: their interest writes.
+    if (existing && (!automatic || existing.epoch === generation)) {
+      if (!automatic) existing.markExplicit();
+      return existing.task;
+    }
+    const epoch = generation;
+    const seq = ++flightSeq;
+    let explicitInterest = !automatic;
+    const task = Promise.resolve().then(() => deps.lookup(tag, deps.install())).then(latest => {
+      if (latest && (explicitInterest || (automatic && running && epoch === generation))
+        && seq > (lastWrittenFlight.get(tag) ?? 0)) {
+        lastWrittenFlight.set(tag, seq);
+        deps.write(tag, latest, deps.now());
+      }
+      if (automatic && running && epoch === generation) {
+        failures = latest ? 0 : failures + 1;
+        retryAt = latest ? 0 : deps.now() + Math.min(RETRY_CAP_MS, RETRY_BASE_MS * 2 ** Math.min(failures - 1, 6));
+      }
+      return latest;
+    }).catch(() => {
+      if (automatic && running && epoch === generation) {
+        failures += 1;
+        retryAt = deps.now() + Math.min(RETRY_CAP_MS, RETRY_BASE_MS * 2 ** Math.min(failures - 1, 6));
+      }
+      return null;
+    }).finally(() => { if (inFlight.get(tag)?.task === task) inFlight.delete(tag); });
+    inFlight.set(tag, { task, epoch, markExplicit: () => { explicitInterest = true; } });
+    return task;
+  };
+  const tick = async () => {
+    if (!running || !eligible()) return;
+    const tag = channel();
+    if (stale(tag) && deps.now() >= retryAt) await lookup(tag, true);
+    schedule(retryAt > deps.now() ? Math.min(STALENESS_TICK_MS, retryAt - deps.now()) : STALENESS_TICK_MS);
+  };
+  return {
+    start() {
+      starts += 1;
+      if (starts !== 1 || !eligible()) return;
+      running = true;
+      schedule(0);
+    },
+    stop() {
+      if (starts === 0) return;
+      starts -= 1;
+      if (starts !== 0) return;
+      running = false;
+      generation += 1;
+      if (timer) deps.clearTimer(timer);
+      timer = undefined;
+    },
+    async check(tag: Channel): Promise<UpdateCheckResult> {
+      const installer = deps.install();
+      const latest = installer === "source" || installer === "mise" ? null : await lookup(tag, false);
+      return checkForUpdate(tag, {
+        currentVersion: deps.current,
+        detectInstall: deps.install,
+        detectInstallOwnership: deps.ownership,
+        miseUpdateCommand: deps.guidance,
+        latestVersion: () => latest,
+      });
+    },
+  };
+}
+
+export const packageRefresh = createRefreshScheduler();
+
+export function startPackageRefresh(): void { packageRefresh.start(); }
+export function stopPackageRefresh(): void { packageRefresh.stop(); }

package/src/usage/cost.ts

@@ -25,6 +25,9 @@ import {
   findExpectedPriceOverlay,
   findVerifiedPriceOverride,
   findPriorityPricingRule,
+  cursorFastPriceMultiplier,
+  cursorFastPriceSource,
+  cursorFastPriceSupported,
   findContextTier,
   isLongContext,
   type Cost4,
@@ -257,6 +260,7 @@ function resolveMatchedPriceExact(
   // operator's explicit price is authoritative for the ~$ estimate.
   const userOverlay = userOverlayMatch(provider, modelId, userOverlays);
   if (userOverlay) return userOverlay;
+  if (!cursorFastPriceSupported(provider, modelId)) return null;
   const verifiedOverride = overlays === EXPECTED_PRICE_OVERLAYS
     ? findVerifiedPriceOverride(provider, modelId)
     : undefined;
@@ -264,11 +268,12 @@ function resolveMatchedPriceExact(
     return {
       provider,
       modelId,
-      cost4: verifiedOverride.cost4,
+      cost4: multiplyCursorFastCost(verifiedOverride.cost4, provider, modelId),
       source: "expected",
       sourceRef: verifiedOverride.source,
       verifiedAt: verifiedOverride.verifiedAt,
       status: verifiedOverride.status,
+      ...cursorFastPriceProvenance(provider, modelId),
     };
   }
   const metadataProvider = resolveMetadataProvider(provider);
@@ -280,28 +285,50 @@ function resolveMatchedPriceExact(
       provider,
       modelId,
       jawcodeProvider: metadataProvider,
-      cost4: bundled.cost,
+      cost4: multiplyCursorFastCost(bundled.cost, provider, modelId),
       source: "jawcode",
       status: "verified",
+      ...cursorFastPriceProvenance(provider, modelId),
     };
   }
   const overlay = findExpectedPriceOverlay(provider, modelId, overlays);
   if (!overlay || !validCost4(overlay.cost4) || !hasNonZeroCost(overlay.cost4)) {
-    return options.allowModelLevelFallback === false ? null : resolveModelLevelPrice(provider, modelId);
+    if (options.allowModelLevelFallback === false) return null;
+    const fallback = resolveModelLevelPrice(provider, modelId);
+    return fallback
+      ? { ...fallback, cost4: multiplyCursorFastCost(fallback.cost4, provider, modelId), ...cursorFastPriceProvenance(provider, modelId) }
+      : null;
   }
   if (overlay.status === "unverified") return null;
   return {
     provider,
     modelId,
     ...(metadataProvider ? { jawcodeProvider: metadataProvider } : {}),
-    cost4: overlay.cost4,
+    cost4: multiplyCursorFastCost(overlay.cost4, provider, modelId),
     source: "expected",
     sourceRef: overlay.source,
     verifiedAt: overlay.verifiedAt,
     status: overlay.status,
+    ...cursorFastPriceProvenance(provider, modelId),
   };
 }
 
+function multiplyCursorFastCost(cost4: Cost4, provider: string, modelId: string): Cost4 {
+  const multiplier = cursorFastPriceMultiplier(provider, modelId);
+  if (multiplier === 1) return cost4;
+  return {
+    input: cost4.input * multiplier,
+    output: cost4.output * multiplier,
+    cacheRead: cost4.cacheRead * multiplier,
+    cacheWrite: cost4.cacheWrite * multiplier,
+  };
+}
+
+function cursorFastPriceProvenance(provider: string, modelId: string): Pick<MatchedPrice, "sourceRef" | "status"> | Record<never, never> {
+  const sourceRef = cursorFastPriceSource(provider, modelId);
+  return sourceRef ? { sourceRef, status: "verified" } : {};
+}
+
 /** User-configured overlay match; explicit zero rates are authoritative too. */
 function userOverlayMatch(
   provider: string,