@bitkyc08/opencodex 2.69.0 → 2.70.0

package/src/providers/registry/model-seeds.ts

@@ -9,8 +9,11 @@ import type { ProviderModelDiscoverySpec } from "./types";
 // 260923 Claude Opus 5.5 (`claude-opus-5-5`, released 2026-09-22): 1M context / 128K output /
 // adaptive thinking always on / effort low..max with a medium default, per the Opus 5.5
 // overview, effort and pricing pages (platform.claude.com).
-export const ANTHROPIC_MODELS = ["claude-fable-5-1", "claude-fable-5", "claude-sonnet-5", "claude-opus-5-5", "claude-opus-5", "claude-opus-4-8", "claude-opus-4-7", "claude-opus-4-6", "claude-sonnet-4-6", "claude-haiku-4-5"];
-export const ANTHROPIC_MODEL_CONTEXT_WINDOWS: Record<string, number> = { "claude-fable-5-1": 1_000_000, "claude-sonnet-5": 1_000_000, "claude-fable-5": 1_000_000, "claude-opus-5-5": 1_000_000, "claude-opus-5": 1_000_000, "claude-opus-4-8": 1_000_000, "claude-opus-4-7": 1_000_000, "claude-opus-4-6": 1_000_000, "claude-sonnet-4-6": 1_000_000, "claude-haiku-4-5": 200_000 };
+// 260929 Claude Sonnet 5.5 (`claude-sonnet-5-5`, released 2026-09-28): 1M context / 128K output /
+// adaptive thinking / effort low..max with a high default, same price as Sonnet 5, per the Sonnet 5.5
+// overview, migration guide, effort and pricing pages (platform.claude.com).
+export const ANTHROPIC_MODELS = ["claude-fable-5-1", "claude-fable-5", "claude-sonnet-5-5", "claude-sonnet-5", "claude-opus-5-5", "claude-opus-5", "claude-opus-4-8", "claude-opus-4-7", "claude-opus-4-6", "claude-sonnet-4-6", "claude-haiku-4-5"];
+export const ANTHROPIC_MODEL_CONTEXT_WINDOWS: Record<string, number> = { "claude-fable-5-1": 1_000_000, "claude-sonnet-5-5": 1_000_000, "claude-sonnet-5": 1_000_000, "claude-fable-5": 1_000_000, "claude-opus-5-5": 1_000_000, "claude-opus-5": 1_000_000, "claude-opus-4-8": 1_000_000, "claude-opus-4-7": 1_000_000, "claude-opus-4-6": 1_000_000, "claude-sonnet-4-6": 1_000_000, "claude-haiku-4-5": 200_000 };
 // All seeded Claude models support vision: https://platform.claude.com/docs/en/models/overview
 export const ANTHROPIC_MODEL_INPUT_MODALITIES: Record<string, string[]> = Object.fromEntries(
   ANTHROPIC_MODELS.map(id => [id, ["text", "image"]]),

package/src/responses/compaction-images.ts

@@ -0,0 +1,27 @@
+import type { OcxMessage } from "../types";
+
+export const COMPACTION_IMAGE_NOTE = "[Earlier image omitted from this compaction request. "
+  + "Retain existing analysis and source references; reopen the original attachment if visual details are still needed.]";
+
+/**
+ * Summarize earlier image-bearing turns from their text, without paying their vision cost again.
+ * A later explicit final answer is a structural boundary, not proof that every image was read.
+ * Keep unphased/commentary-only turns and pending images. Never rewrite stored/raw history.
+ */
+export function omitEarlierCompactionImages(messages: readonly OcxMessage[]): OcxMessage[] {
+  let finalAnswerSeen = false;
+  const result = [...messages];
+  for (let index = messages.length - 1; index >= 0; index--) {
+    const message = messages[index]!;
+    if (message.role === "assistant") {
+      if (message.phase === "final_answer"
+        && message.content.some(part => part.type === "text" && part.text.trim())) finalAnswerSeen = true;
+      continue;
+    }
+    if (!finalAnswerSeen || (message.role !== "user" && message.role !== "toolResult")
+      || !Array.isArray(message.content) || !message.content.some(part => part.type === "image")) continue;
+    result[index] = { ...message, content: message.content.map(part => part.type === "image"
+      ? { type: "text" as const, text: COMPACTION_IMAGE_NOTE } : part) };
+  }
+  return result;
+}

package/src/router.ts

@@ -89,6 +89,12 @@ export interface RouteResult {
   combo?: ComboPick;
   /** Bounded route-decision trace (RI-01); never contains secrets. */
   routeDecision?: RouteDecisionTraceV1;
+  /**
+   * Set when a blocked-model redirect moved the request to a different
+   * provider. Caller credentials addressed to the source route must not follow
+   * it, exactly as for combo and policy routes.
+   */
+  credentialDomainRewrite?: true;
 }
 
 export function captureRouteStaticPolicy(
@@ -549,6 +555,44 @@ export function comboRouteDecisionTrace(
 // Codex uses a small number of control-plane model ids that are not part of the public GPT/o
 // naming families. Keep this exact: a broad `codex-*` rule could capture a third-party model.
 const CODEX_INTERNAL_OPENAI_MODELS = new Set(["codex-auto-review"]);
+const MAX_BLOCKED_MODEL_REDIRECT_EDGES = 5;
+
+interface BlockedModelRedirectState {
+  visited: Set<string>;
+  edges: number;
+}
+
+function crossProviderRedirectTarget(config: OcxConfig, providerName: string, value: string | undefined): string | undefined {
+  if (!value) return undefined;
+  const slash = value.indexOf("/");
+  if (slash <= 0) return undefined;
+  const targetProvider = value.slice(0, slash);
+  if (targetProvider === providerName || !hasOwnProvider(config.providers, targetProvider)) return undefined;
+  const configured = config.providers[targetProvider];
+  if (configured.disabled === true) return undefined;
+  try {
+    const effective = routedProviderConfig(targetProvider, configured);
+    const registry = providerMatchesRegistryTransportWithStaticGuards(targetProvider, configured)
+      ? PROVIDER_REGISTRY.find(entry => entry.id === targetProvider)
+      : undefined;
+    const authMode = effective.authMode ?? registry?.authKind ?? "key";
+    if (authMode === "forward") return undefined; // The source caller bearer is stripped on a redirect.
+    if (authMode === "oauth") {
+      if (registry?.authKind !== "oauth") return undefined;
+      const usable = peekAuthStore()[targetProvider]?.accounts.some(account =>
+        account.paused !== true && account.needsReauth !== true
+        && (account.credential.expires > Date.now()
+          ? Boolean(account.credential.access.trim())
+          : Boolean(account.credential.refresh.trim()))
+      );
+      return usable ? value : undefined;
+    }
+    return authMode === "local" || effective.keyOptional === true || Boolean(effective.apiKey?.trim())
+      ? value : undefined;
+  } catch {
+    return undefined;
+  }
+}
 
 function isBareOpenAiFamilyModel(modelId: string): boolean {
   return !modelId.includes("/")
@@ -562,8 +606,32 @@ function routeResult(
   modelId: string,
   routeKind: RouteDecisionKind,
   routeReason: string,
+  redirectState: BlockedModelRedirectState,
 ): RouteResult {
-  const redirected = resolveBlockedModelRedirect(config, modelId);
+  const qualified = resolveBlockedModelRedirect(config, `${providerName}/${modelId}`);
+  const bare = resolveBlockedModelRedirect(config, modelId);
+  const crossTarget = config && (
+    crossProviderRedirectTarget(config, providerName, qualified)
+    ?? crossProviderRedirectTarget(config, providerName, bare)
+  );
+  if (crossTarget && config) {
+    if (routeKind === "explicit-account") {
+      throw new Error("Blocked model redirect cannot leave a pinned account route");
+    }
+    const source = `${providerName}/${modelId}`;
+    if (redirectState.visited.has(source)) {
+      throw new Error(`Blocked model redirect cycle detected: ${source}`);
+    }
+    if (redirectState.edges >= MAX_BLOCKED_MODEL_REDIRECT_EDGES) {
+      throw new Error(`Blocked model redirect exceeded maximum redirect depth (${MAX_BLOCKED_MODEL_REDIRECT_EDGES})`);
+    }
+    redirectState.visited.add(source);
+    redirectState.edges += 1;
+    const targetRoute = routeModelInternal(config, crossTarget, true, undefined, false, false, redirectState);
+    return { ...targetRoute, routeReason: "blocked-model-redirect", credentialDomainRewrite: true };
+  }
+  // Existing bare mappings remain one post-resolution, same-provider substitution.
+  const redirected = bare;
   const effectiveModelId = redirected ?? modelId;
   const effectiveRouteReason = redirected ? "blocked-model-redirect" : routeReason;
   const codexAccountMode = providerCodexAccountMode(providerName, provider);
@@ -628,6 +696,7 @@ function routeModelInternal(
   policyEvidence?: PolicyRequestEvidence,
   allowCompactionNativeFallback = false,
   preview = false,
+  redirectState: BlockedModelRedirectState = { visited: new Set<string>(), edges: 0 },
 ): RouteResult {
   const slash = modelId.indexOf("/");
   // Policy namespace is system-reserved: an explicit `policy/<id>` or a
@@ -654,12 +723,25 @@ function routeModelInternal(
     }
     const selected = evaluation.candidates[evaluation.selectedIndex]!;
     const concrete = `${selected.provider}/${selected.model}`;
-    const routed = routeModelInternal(config, concrete, true);
+    const routed = routeModelInternal(config, concrete, true, undefined, false, preview, redirectState);
+    if (routed.routeReason === "blocked-model-redirect" && !evaluation.candidates.some(candidate =>
+      candidate.provider === routed.providerName && candidate.model === routed.modelId && candidate.eligible
+    )) {
+      throw new NoEligiblePolicyCandidateError(policyId, evaluation.trace);
+    }
     return {
       ...routed,
       routeKind: "policy" as const,
-      routeReason: "policy-selected",
-      routeDecision: evaluation.trace,
+      routeReason: routed.routeReason === "blocked-model-redirect" ? "blocked-model-redirect" : "policy-selected",
+      routeDecision: {
+        ...evaluation.trace,
+        selected: {
+          ...evaluation.trace.selected,
+          provider: routed.providerName,
+          model: routed.modelId,
+          reason: routed.routeReason === "blocked-model-redirect" ? "blocked-model-redirect" : evaluation.trace.selected.reason,
+        },
+      },
     };
   }
   if (slash > 0) {
@@ -683,8 +765,12 @@ function routeModelInternal(
       if (!isCanonicalOpenAiForwardProvider(providerForCanonicalCheck)) {
         throw new NoEnabledOpenAiProviderError(nativeModelId);
       }
+      const accountQualified = resolveBlockedModelRedirect(config, modelId);
+      if (crossProviderRedirectTarget(config, OPENAI_CODEX_PROVIDER_ID, accountQualified)) {
+        throw new Error("Blocked model redirect cannot leave a pinned account route");
+      }
       return {
-        ...routeResult(config, OPENAI_CODEX_PROVIDER_ID, provider, nativeModelId, "explicit-account", "account-namespace"),
+        ...routeResult(config, OPENAI_CODEX_PROVIDER_ID, provider, nativeModelId, "explicit-account", "account-namespace", redirectState),
         // Exact account injection uses the pool credential machinery even when the canonical
         // provider is globally Direct. The fixed id bypasses pool selection entirely.
         codexAccountMode: "pool",
@@ -700,8 +786,8 @@ function routeModelInternal(
       const concrete = `${combo.target.provider}/${combo.target.model}`;
       // The selected target is already a concrete provider/model reference. Resolve it without
       // consulting combo aliases again, otherwise an alias that shadows the target can recurse.
-      const routed = routeModelInternal(config, concrete, true, undefined);
-      return { ...routed, combo, routeKind: "combo" as const, routeReason: "combo-pick" };
+      const routed = routeModelInternal(config, concrete, true, undefined, false, preview, redirectState);
+      return { ...routed, combo, routeKind: "combo" as const, routeReason: routed.routeReason === "blocked-model-redirect" ? "blocked-model-redirect" : "combo-pick" };
     }
   }
 
@@ -761,7 +847,7 @@ function routeModelInternal(
       // itself a known model (e.g. orcarouter/auto). Route it whole instead of stripping to the
       // remainder, which would send a bare `auto` the upstream cannot resolve.
       if (known.includes(modelId)) {
-        return routeResult(config, provName, prov, modelId, "explicit-provider", "explicit-provider-namespace");
+        return routeResult(config, provName, prov, modelId, "explicit-provider", "explicit-provider-namespace", redirectState);
       }
       // Codex-facing alias ids (`provider/vendor-model`) decode back to the native
       // slash id via an exact known-id lookup; raw full-slash selectors keep working.
@@ -777,6 +863,7 @@ function routeModelInternal(
         nativeModel,
         "explicit-provider",
         "explicit-provider-namespace",
+        redirectState,
       );
     }
     }
@@ -785,7 +872,7 @@ function routeModelInternal(
   if (isBareOpenAiFamilyModel(modelId)) {
     const provider = config.providers[OPENAI_CODEX_PROVIDER_ID];
     if (provider && provider.disabled !== true) {
-      return routeResult(config, OPENAI_CODEX_PROVIDER_ID, provider, modelId, "native", "native-family");
+      return routeResult(config, OPENAI_CODEX_PROVIDER_ID, provider, modelId, "native", "native-family", redirectState);
     }
     // Codex chooses a bare native model for compaction even when the operator's
     // ordinary route is a third-party provider. Keep the native reservation
@@ -806,6 +893,7 @@ function routeModelInternal(
           modelId,
           "default-provider",
           "compaction-default-provider",
+          redirectState,
         );
       }
     }
@@ -815,18 +903,18 @@ function routeModelInternal(
   for (const [provName, prov] of activeProviderEntries(config)) {
     if (prov.defaultModel === modelId
       || (typeof prov.defaultModel === "string" && encodeRoutedModelId(prov.defaultModel) === modelId)) {
-      return routeResult(config, provName, prov, prov.defaultModel as string, "explicit-provider", "configured-default-model");
+      return routeResult(config, provName, prov, prov.defaultModel as string, "explicit-provider", "configured-default-model", redirectState);
     }
   }
 
-  const patternRoute = routeByKnownModelPattern(config, modelId);
+  const patternRoute = routeByKnownModelPattern(config, modelId, redirectState);
   if (patternRoute) return patternRoute;
 
   for (const [provName, prov] of activeProviderEntries(config)) {
     if (prov.models && Array.isArray(prov.models)) {
       const hit = (prov.models as string[]).find(id => id === modelId || encodeRoutedModelId(id) === modelId);
       if (hit !== undefined) {
-        return routeResult(config, provName, prov, hit, "explicit-provider", "configured-model-list");
+        return routeResult(config, provName, prov, hit, "explicit-provider", "configured-model-list", redirectState);
       }
     }
   }
@@ -846,7 +934,7 @@ function routeModelInternal(
   }
   if (aliasMatches[0]) {
     const match = aliasMatches[0];
-    return routeResult(config, match.provider, config.providers[match.provider], match.model, "explicit-provider", "model-alias");
+    return routeResult(config, match.provider, config.providers[match.provider], match.model, "explicit-provider", "model-alias", redirectState);
   }
 
   if (config.defaultProvider === LEGACY_CHATGPT_PROVIDER_ID) {
@@ -855,7 +943,7 @@ function routeModelInternal(
   if (hasOwnProvider(config.providers, config.defaultProvider)) {
     const defaultProv = config.providers[config.defaultProvider];
     if (defaultProv.disabled === true) throw new Error(`Default provider is disabled: ${config.defaultProvider}`);
-    return routeResult(config, config.defaultProvider, defaultProv, modelId, "default-provider", "default-provider");
+    return routeResult(config, config.defaultProvider, defaultProv, modelId, "default-provider", "default-provider", redirectState);
   }
 
   throw new Error(`No provider configured for model: ${modelId}`);
@@ -921,7 +1009,7 @@ export function routeConcreteModel(config: OcxConfig, modelId: string): RouteRes
   return routeModelInternal(config, modelId, true, undefined);
 }
 
-function routeByKnownModelPattern(config: OcxConfig, modelId: string): RouteResult | undefined {
+function routeByKnownModelPattern(config: OcxConfig, modelId: string, redirectState: BlockedModelRedirectState): RouteResult | undefined {
   for (const { providerNames, prefixes } of MODEL_PROVIDER_PATTERNS) {
     if (prefixes.some(prefix => modelId.startsWith(prefix))) {
       const matchingProvider = Object.entries(config.providers).find(
@@ -929,7 +1017,7 @@ function routeByKnownModelPattern(config: OcxConfig, modelId: string): RouteResu
       );
       if (matchingProvider) {
         const [provName, prov] = matchingProvider;
-        return routeResult(config, provName, prov, modelId, "explicit-provider", "model-pattern");
+        return routeResult(config, provName, prov, modelId, "explicit-provider", "model-pattern", redirectState);
       }
       // Deliberately no "first provider with an Anthropic adapter" fallback here. Picking by
       // object insertion order, without checking `models`, `selectedModels`, `disabledModels` or

package/src/routing/analytics.ts

@@ -119,6 +119,7 @@ const COOLDOWN_RECOVERY_KINDS = new Set([
   "key-401",
   "key-429",
   "oauth-401",
+  "oauth-account-403",
   "anthropic-oauth-429",
   "oauth-account-429",
 ]);

package/src/server/auth-cors.ts

@@ -1,5 +1,5 @@
 import { providerRelativeSendPathConfigError } from "../config/provider-relative-send-path";
-import { modelCapabilitiesConfigError } from "../config/provider-validation";
+import { contextTierRecordConfigError, modelCapabilitiesConfigError } from "../config/provider-validation";
 import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
 import { initialModelSelection } from "../providers/initial-model-selection";
 import { extractAccountId } from "../oauth/chatgpt";
@@ -16,6 +16,7 @@ import {
 } from "../config";
 import {
   apiKeyTransportConfigError,
+  projectContextConfigError,
   autoReviewModelOverridesConfigError,
   autoReviewModelTargetConfigError,
   booleanRecordConfigError,
@@ -693,6 +694,8 @@ export function providerManagementConfigError(
     return "provider must be a plain object";
   }
   const raw = provider as Record<string, unknown>;
+  const contextTiersError = contextTierRecordConfigError(raw.modelContextTiers);
+  if (contextTiersError) return contextTiersError;
   const capabilitiesError = modelCapabilitiesConfigError(raw.modelCapabilities);
   if (capabilitiesError) return capabilitiesError;
   const pinsError = providerReasoningPinsConfigError(raw);
@@ -828,6 +831,8 @@ export function providerManagementConfigError(
   }
   const apiKeyTransportError = apiKeyTransportConfigError(typed);
   if (apiKeyTransportError) return `provider ${name} ${apiKeyTransportError}`;
+  const projectContextError = projectContextConfigError(typed);
+  if (projectContextError) return `provider ${JSON.stringify(redactSecretString(name))} ${projectContextError}`;
   const maxInputError = positiveIntegerRecordConfigError(raw.modelMaxInputTokens, "modelMaxInputTokens");
   if (maxInputError) return `provider ${name} ${maxInputError}`;
   const autoCompactError = modelAutoCompactTokenLimitsConfigError(
@@ -967,6 +972,7 @@ const PROVIDER_CONFIG_FIELD_POLICY = {
   defaultAliases: "editor",
   adapter: "editor",
   codexToolMode: "editor",
+  projectContext: "editor",
   requestPacing: "editor",
   mcpMaxTools: "editor",
   mcpMaxSchemaBytes: "editor",
@@ -1021,6 +1027,7 @@ const PROVIDER_CONFIG_FIELD_POLICY = {
   modelPreset: "editor",
   contextWindow: "editor",
   modelContextWindows: "editor",
+  modelContextTiers: "editor",
   modelInputModalities: "editor",
   modelCapabilities: "editor",
   modelMaxInputTokens: "runtime",
@@ -1084,6 +1091,7 @@ const PROVIDER_CONFIG_FIELD_POLICY = {
   preserveReasoningContentModels: "editor",
   requiresReasoningPlaceholderModels: "editor",
   showThinkingSummary: "editor",
+  hideRawReasoning: "editor",
   retryOn429: "editor",
   transientRetryOn5xx: "editor",
   retryOnReset: "editor",

package/src/server/background-lifecycle.ts

@@ -1,4 +1,6 @@
-import type { StorageCleanupPolicy } from "../types";
+import type { OcxConfig, StorageCleanupPolicy } from "../types";
+import { registerCodexLowQuotaProtection, type LowQuotaRegistration } from "../codex/low-quota-protection";
+import type { LowQuotaEvent } from "../codex/low-quota-events";
 import { startStateStoreSweeper } from "../lib/state-store-sweeper";
 import {
   abortStorageCleanupPolicyJobAsync,
@@ -40,10 +42,12 @@ type LeaseOwner = {
   token: symbol;
   applyPolicy: PolicyApply;
   resources: ServerResourceOwnerLease;
+  lowQuota: LowQuotaRegistration;
 };
 
 export type ServerBackgroundLifecycleLease = {
   scheduleStartupRun(): void;
+  listLowQuotaEvents(limit?: number): LowQuotaEvent[];
   release(): Promise<void>;
   releaseAfterFailedStart(): void;
 };
@@ -148,6 +152,7 @@ function removeOwner(owner: LeaseOwner): boolean {
 
 function releaseOwnerSynchronously(owner: LeaseOwner): "inactive" | "shared" | "last" {
   if (!removeOwner(owner)) return "inactive";
+  owner.lowQuota();
   owner.resources.release();
   const nextOwner = owners.at(-1);
   if (nextOwner) {
@@ -168,6 +173,7 @@ function releaseOwnerSynchronously(owner: LeaseOwner): "inactive" | "shared" | "
  */
 export function acquireServerBackgroundLifecycle(
   applyPolicy: PolicyApply,
+  config: OcxConfig,
 ): ServerBackgroundLifecycleLease {
   if (cleanupInProgress) {
     throw new Error("server background lifecycle cleanup is still in progress");
@@ -177,6 +183,7 @@ export function acquireServerBackgroundLifecycle(
     token: Symbol("server-background-lifecycle"),
     applyPolicy,
     resources: acquireServerResourceOwner(),
+    lowQuota: registerCodexLowQuotaProtection(config),
   };
   try {
     if (!processLoops) {
@@ -186,12 +193,20 @@ export function acquireServerBackgroundLifecycle(
     }
     owners.push(owner);
   } catch (error) {
+    owner.lowQuota();
     owner.resources.release();
     throw error;
   }
 
   let releaseFlight: Promise<void> | null = null;
+  function finishRelease(): Promise<void> {
+    const outcome = releaseOwnerSynchronously(owner);
+    if (outcome !== "last") return Promise.resolve();
+    cleanupInProgress = true;
+    return stopStoragePolicyWorker().finally(() => { cleanupInProgress = false; });
+  }
   return {
+    listLowQuotaEvents(limit) { return owner.lowQuota.listEvents(limit); },
     scheduleStartupRun() {
       if (owners.some(candidate => candidate.token === owner.token)) {
         scheduleStorageCleanupStartupRun();
@@ -199,19 +214,15 @@ export function acquireServerBackgroundLifecycle(
     },
     release() {
       if (releaseFlight) return releaseFlight;
-      const outcome = releaseOwnerSynchronously(owner);
-      if (outcome !== "last") {
-        releaseFlight = Promise.resolve();
-        return releaseFlight;
-      }
-      cleanupInProgress = true;
-      releaseFlight = stopStoragePolicyWorker().finally(() => {
-        cleanupInProgress = false;
-      });
+      // Default installs have no low-quota write. Preserve synchronous owner removal;
+      // an unconditional await here extends process-global ownership into later starts.
+      if (!owner.lowQuota.hasPendingSave()) releaseFlight = finishRelease();
+      else releaseFlight = owner.lowQuota.flush().then(finishRelease, finishRelease);
       return releaseFlight;
     },
     releaseAfterFailedStart() {
       if (releaseFlight) return;
+      owner.lowQuota();
       // Startup evaluation is scheduled only after both listeners bind, so a
       // failed start cannot have spawned a Worker for this lease. Keep rollback
       // synchronous so a caller may immediately retry a different port.

package/src/server/chat-completions.ts

@@ -200,7 +200,8 @@ async function handleChatCompletionsWithBudget(
     logCtx.provider = route.providerName;
     logCtx.routeDecision = route.routeDecision;
     settledRoute = route;
-    routeMayChangeCredentialDomain = route.combo !== undefined || route.routeKind === "policy";
+    routeMayChangeCredentialDomain = route.combo !== undefined || route.routeKind === "policy"
+      || route.credentialDomainRewrite === true;
     callerAuthorizationRoute = !routeMayChangeCredentialDomain
       && providerConsumesCallerAuthorization(route.provider);
     if (route.provider.adapter === "cursor" || route.provider.adapter === "kiro") {

package/src/server/chat-native.ts

@@ -336,6 +336,7 @@ export async function runNativeChatAttempt(
       requestedStream,
       fastPolicyForModel(activeProvider, route.modelId, route.providerName, "chat"),
       config.fastMode,
+      route.providerName,
     );
   };
   try {

package/src/server/index.ts

@@ -640,6 +640,7 @@ function startServerWithSpendLedgerOwner(port: number | undefined, deps: StartSe
   let remoteWorkspaceShutdown: (() => Promise<void>) | undefined;
   const managementApiDeps: ManagementApiDeps = {
     ...deps.managementApi,
+    listLowQuotaEvents: limit => backgroundLifecycle?.listLowQuotaEvents(limit) ?? [],
     remoteWorkspaceStopping: () => remoteWorkspaceStopping,
     onRemoteWorkspaceShutdown: shutdown => { remoteWorkspaceShutdown = shutdown; }, linkSupervisor: () => optionalListeners.linkSupervisor(), linkListener: () => optionalListeners,
   };
@@ -655,13 +656,10 @@ function startServerWithSpendLedgerOwner(port: number | undefined, deps: StartSe
     return workspaceRuntimeFlight;
   };
   try {
-    backgroundLifecycle = acquireServerBackgroundLifecycle(applyPolicy);
+    backgroundLifecycle = acquireServerBackgroundLifecycle(applyPolicy, config);
     unregisterQuotaAutoRefresh = (deps.registerCodexQuotaAutoRefreshWorker
       ?? registerCodexQuotaAutoRefreshWorker)(config);
-    // External `ocx config set` / direct config.json edits run in other
-    // processes; poll the file so Logs/Usage display prices follow them live.
-    // Started inside the guarded startup transaction so the catch below can
-    // release the owner-scoped lease on any listener failure.
+    // Poll external pricing edits; the startup catch releases this owner-scoped lease.
     userCostOverlayReconciler = startUserCostOverlayReconciler({ liveConfig: config });
     const serveOptions = createServeOptions({
       drainingResponse,
@@ -754,9 +752,7 @@ function startServerWithSpendLedgerOwner(port: number | undefined, deps: StartSe
     value: async (closeActiveConnections?: boolean): Promise<void> => {
       remoteWorkspaceStopping = true;
       liveCallBindings.clear();
-      // Disarm the package-tree restart timer before listener teardown: a queued
-      // replacement callback must not call acceptSystemRestart() after stop() has
-      // begun, or it would schedule a drain-and-restart on a stopped server.
+      // Disarm the package-tree restart timer before teardown can schedule another restart.
       if (!packageRefreshStopped) {
         packageRefreshStopped = true;
         stopPackageRefresh();

package/src/server/inference/client-encoder-delivery.ts

@@ -87,6 +87,7 @@ export interface ClientEncodedDelivery {
   fold: {
     replayCacheScope?: OcxReasoningReplayScopeRef;
     hideThinkingSummary?: boolean;
+    hideRawReasoning?: boolean;
     toolNsMap?: Map<string, { namespace: string; name: string; freeform?: true }>;
     declaredToolNames?: ReadonlySet<string>;
     toolParameterSchemas?: ReadonlyMap<string, Record<string, unknown>>;
@@ -164,6 +165,8 @@ export async function deliverClientEncodedResponse(input: ClientEncodedDelivery)
         enforceDeclaredToolNames: false,
         translatorBudget,
         recordBufferedDelivery: false,
+        // The client never receives this body, and its Chat/Messages wire has no envelope field.
+        omitHiddenReasoningEnvelope: true,
       });
     } catch {
       return undefined;

package/src/server/management/context.ts

@@ -1,4 +1,5 @@
 import type { OcxConfig } from "../../types";
+import type { LowQuotaEvent } from "../../codex/low-quota-events";
 import type { Channel } from "../../update/index";
 import type { UpdateCheckResult } from "../../update/job";
 import type { NativeProfileApiDeps } from "../../codex/native-profile-api";
@@ -44,6 +45,8 @@ export interface ManagementRequestIngress {
 }
 
 export interface ManagementApiDeps {
+  /** Bound to this server's lifecycle owner; absent in direct route tests. */
+  listLowQuotaEvents?: (limit?: number) => LowQuotaEvent[];
   /** Bound Claude intercept state, injectable for isolated management-route tests. */
   getClaudeInterceptState?: typeof import("../../claude/intercept/runtime").getClaudeInterceptState;
   /** Reconciliation seam for field-scoped rollback tests. */

package/src/server/management/low-quota-routes.ts

@@ -0,0 +1,14 @@
+/** Auth is enforced by the management dispatcher before this lazy route runs. */
+import { jsonResponse } from "../auth-cors";
+import type { ManagementContext } from "./context";
+
+export async function handleLowQuotaRoutes(ctx: ManagementContext): Promise<Response | null> {
+  const { url, req, config } = ctx;
+  if (url.pathname !== "/api/codex-auth/low-quota-events" || req.method !== "GET") return null;
+  const raw = url.searchParams.get("limit");
+  if (raw !== null && (!/^[0-9]+$/.test(raw) || !Number.isSafeInteger(Number(raw)))) {
+    return jsonResponse({ error: { code: "invalid_limit", message: "limit must be a non-negative integer" } }, 400, req, config);
+  }
+  const limit = raw === null ? 20 : Math.min(100, Number(raw));
+  return jsonResponse({ events: ctx.deps.listLowQuotaEvents?.(limit) ?? [] }, 200, req, config);
+}

package/src/server/management/oauth-account-routes.ts

@@ -1,3 +1,4 @@
+import { parseAnthropicModelRoutes, readAnthropicModelRoutes } from "../../oauth/anthropic-model-routes";
 import { randomBytes, randomUUID } from "node:crypto";
 import { readFileSync } from "node:fs";
 import type { CatalogModel } from "../../codex/catalog";
@@ -545,7 +546,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     if (req.method !== "GET" && !isPlainRecord(rawBody)) {
       return jsonResponse({ error: "body must be an object" }, 400);
     }
-    const fields = rawBody as { provider?: unknown; enabled?: unknown; strategy?: unknown; stickyLimit?: unknown; autoSwitchThreshold?: unknown; quotaWindow?: unknown; maxConcurrentPerAccount?: unknown };
+    const fields = rawBody as { provider?: unknown; enabled?: unknown; strategy?: unknown; stickyLimit?: unknown; autoSwitchThreshold?: unknown; quotaWindow?: unknown; maxConcurrentPerAccount?: unknown; routes?: unknown };
     const provider = req.method === "GET"
       ? (url.searchParams.get("provider") ?? "").trim().toLowerCase()
       : (typeof fields.provider === "string" ? fields.provider.trim().toLowerCase() : "");
@@ -575,6 +576,10 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
       if (parsed === null) return jsonResponse({ error: "autoSwitchThreshold must be an integer 0-100" }, 400);
       autoSwitchThreshold = parsed;
     }
+    if (Object.hasOwn(fields, "routes") && kind !== "anthropic") return jsonResponse({ error: "routes are only part of the anthropic pool contract" }, 400);
+    const parsedRoutes = Object.hasOwn(fields, "routes") && fields.routes !== null
+      ? parseAnthropicModelRoutes(fields.routes) : null;
+    if (parsedRoutes && !parsedRoutes.ok) return jsonResponse({ error: parsedRoutes.error }, 400);
     if (fields.quotaWindow !== undefined && kind !== "anthropic") {
       return jsonResponse({ error: "quotaWindow is only part of the anthropic pool contract" }, 400);
     }
@@ -607,6 +612,10 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
         if (stickyLimit !== undefined) pool.stickyLimit = stickyLimit;
         if (autoSwitchThreshold !== undefined) pool.autoSwitchThreshold = autoSwitchThreshold;
         if (quotaWindow !== undefined) pool.quotaWindow = quotaWindow as never;
+        if (Object.hasOwn(fields, "routes")) {
+          if (fields.routes === null) delete pool.routes;
+          else if (parsedRoutes?.ok) pool.routes = parsedRoutes.routes;
+        }
         config.anthropicAccountPool = pool;
       } else {
         const prov = config.providers[provider]!;
@@ -650,6 +659,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
       strategy: normalizeAccountPoolStrategy(pool.strategy),
       stickyLimit: normalizeAccountPoolStickyLimit(pool.stickyLimit),
       quotaWindow: normalizeAccountPoolQuotaWindow(pool.quotaWindow),
+      ...readAnthropicModelRoutes(pool.routes),
       experimental: true,
     });
   }
@@ -666,6 +676,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
       stickyLimit?: unknown;
       quotaWindow?: unknown;
       maxConcurrentPerAccount?: unknown;
+      routes?: unknown;
     };
     const provider = typeof body.provider === "string" ? body.provider.trim().toLowerCase() : "";
     if (provider !== "anthropic") {
@@ -677,6 +688,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
       if (!provider || !prov || poolSettingsCapability(provider, prov) !== "generic") {
         return jsonResponse({ error: "pool config is only supported for anthropic and generic OAuth providers" }, 400);
       }
+      if (Object.hasOwn(body, "routes")) return jsonResponse({ error: "routes are only part of the anthropic pool contract" }, 400);
       if (body.quotaWindow !== undefined) {
         return jsonResponse({ error: "quotaWindow is not part of the generic pool contract yet" }, 400);
       }
@@ -762,12 +774,19 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
       }
       quotaWindow = parsed;
     }
+    const parsedLegacyRoutes = Object.hasOwn(body, "routes") && body.routes !== null
+      ? parseAnthropicModelRoutes(body.routes) : null;
+    if (parsedLegacyRoutes && !parsedLegacyRoutes.ok) return jsonResponse({ error: parsedLegacyRoutes.error }, 400);
+    const routes = Object.hasOwn(body, "routes")
+      ? (parsedLegacyRoutes?.ok ? parsedLegacyRoutes.routes : undefined)
+      : config.anthropicAccountPool?.routes;
     config.anthropicAccountPool = {
       enabled,
       autoSwitchThreshold: threshold,
       ...(strategy !== undefined ? { strategy } : {}),
       ...(stickyLimit !== undefined ? { stickyLimit } : {}),
       ...(quotaWindow !== undefined ? { quotaWindow } : {}),
+      ...(routes !== undefined ? { routes } : {}),
     };
     saveConfigPreservingClaudeCode(config);
     reconcileLiveStateStores();
@@ -779,6 +798,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
       strategy: normalizeAccountPoolStrategy(strategy),
       stickyLimit: normalizeAccountPoolStickyLimit(stickyLimit),
       quotaWindow: normalizeAccountPoolQuotaWindow(quotaWindow),
+      routes: routes ?? null,
       experimental: true,
     });
   }