@bitkyc08/opencodex 2.7.23 → 2.7.24

package/src/server/search.ts

@@ -12,19 +12,18 @@ import { formatErrorResponse } from "../bridge";
 import {
   CodexAccountCooldownError,
   CodexAuthContextError,
+  CodexPoolAuthenticationError,
   CodexThreadAffinityExpiredError,
-  headersForCodexAuthContext,
-  isCodexAuthContextUsable,
-  resolveCodexAuthContext,
 } from "../codex/auth-context";
 import { formatCodexProviderForLog } from "../codex/routing";
 import { signalWithTimeout } from "../lib/abort";
 import { sidecarEnter } from "../lib/sidecar-tracker";
-import type { OcxConfig, OcxProviderConfig } from "../types";
-import { isProxyAdmissionSecret } from "./auth-cors";
+import type { OcxConfig } from "../types";
+import { listOpenAiForwardSidecarCandidates, resolveFirstUsableOpenAiSidecar } from "../providers/openai-sidecar";
 import { readJsonRequestBody } from "./request-decompress";
+import { ForwardAdmissionCredentialError, validateForwardAdmissionCredential } from "./auth-cors";
 import type { RequestLogContext } from "./request-log";
-import { codexLogAccountId, decodeRequestErrorResponse, sidecarOutcomeRecorder } from "./responses";
+import { codexLogAccountId, decodeRequestErrorResponse } from "./responses";
 
 /**
  * Default TOTAL deadline for one search relay. alpha/search is non-streaming JSON — response
@@ -36,23 +35,16 @@ import { codexLogAccountId, decodeRequestErrorResponse, sidecarOutcomeRecorder }
 const SEARCH_UPSTREAM_TIMEOUT_MS = 200_000;
 const SEARCH_RESPONSE_MAX_BYTES = 16 * 1024 * 1024;
 
-interface NamedProvider {
-  name: string;
-  provider: OcxProviderConfig;
-}
-
-function findSearchUpstream(config: OcxConfig): NamedProvider | undefined {
-  for (const [name, provider] of Object.entries(config.providers)) {
-    if (provider.disabled !== true && provider.authMode === "forward") return { name, provider };
-  }
-  return undefined;
-}
-
 export async function handleSearch(
   req: Request,
   config: OcxConfig,
   logCtx: RequestLogContext,
 ): Promise<Response> {
+  try { validateForwardAdmissionCredential(req.headers, config); }
+  catch (err) {
+    if (err instanceof ForwardAdmissionCredentialError) return formatErrorResponse(401, "authentication_error", err.message);
+    throw err;
+  }
   let body: unknown;
   try {
     body = await readJsonRequestBody(req);
@@ -62,8 +54,8 @@ export async function handleSearch(
   const model = (body as { model?: unknown } | null)?.model;
   if (typeof model === "string" && model) logCtx.model = model;
 
-  const upstream = findSearchUpstream(config);
-  if (!upstream) {
+  const candidates = listOpenAiForwardSidecarCandidates(config);
+  if (candidates.length === 0) {
     return formatErrorResponse(
       400,
       "invalid_request_error",
@@ -72,25 +64,17 @@ export async function handleSearch(
     );
   }
 
-  let authHeaders: Headers;
-  let recordOutcome: ReturnType<typeof sidecarOutcomeRecorder>;
+  let upstream: Awaited<ReturnType<typeof resolveFirstUsableOpenAiSidecar>>;
   try {
-    const authCtx = await resolveCodexAuthContext(req.headers, config);
-    if (!isCodexAuthContextUsable(authCtx, config)) {
-      return formatErrorResponse(401, "authentication_error", "Selected Codex account needs reauthentication");
-    }
-    authHeaders = headersForCodexAuthContext(req.headers, authCtx);
-    const bearer = authHeaders.get("authorization")?.replace(/^Bearer\s+/i, "") ?? "";
-    if (bearer && isProxyAdmissionSecret(bearer, config)) authHeaders.delete("authorization");
-    if (!authHeaders.get("authorization")) {
+    upstream = await resolveFirstUsableOpenAiSidecar(candidates, req.headers, config);
+    if (!upstream) {
       return formatErrorResponse(
         401,
         "authentication_error",
         "web search relay needs ChatGPT auth (Authorization header)",
       );
     }
-    recordOutcome = sidecarOutcomeRecorder(config, authCtx);
-    logCtx.provider = formatCodexProviderForLog(upstream.name, codexLogAccountId(authCtx), config);
+    logCtx.provider = formatCodexProviderForLog(upstream.providerName, codexLogAccountId(upstream.authContext), config);
   } catch (err) {
     if (err instanceof CodexAccountCooldownError) {
       return formatErrorResponse(429, "rate_limit_error", "Selected Codex account is cooling down");
@@ -99,16 +83,17 @@ export async function handleSearch(
       return formatErrorResponse(409, "invalid_request_error", "Codex thread account affinity expired; start a new session");
     }
     if (err instanceof CodexAuthContextError) {
-      const safeAccountLabel = formatCodexProviderForLog(upstream.name, err.accountId, config);
+      const safeAccountLabel = formatCodexProviderForLog("openai", err.accountId, config);
       console.error(`[search] Pool account ${safeAccountLabel} token failed; reauthentication required`);
       return formatErrorResponse(401, "authentication_error", "Selected Codex account needs reauthentication");
     }
+    if (err instanceof CodexPoolAuthenticationError) return formatErrorResponse(401, "authentication_error", err.message);
     throw err;
   }
 
   const headers: Record<string, string> = { "content-type": "application/json" };
   if (upstream.provider.headers) Object.assign(headers, upstream.provider.headers);
-  for (const [name, value] of authHeaders) headers[name] = value;
+  for (const [name, value] of upstream.headers) headers[name] = value;
   const url = `${upstream.provider.baseUrl}/alpha/search`;
   const timeoutMs = config.search?.timeoutMs ?? SEARCH_UPSTREAM_TIMEOUT_MS;
   const linkedSignal = signalWithTimeout(timeoutMs, req.signal);
@@ -124,7 +109,7 @@ export async function handleSearch(
     if (payload.byteLength > SEARCH_RESPONSE_MAX_BYTES) {
       return formatErrorResponse(502, "upstream_error", `search response too large (${payload.byteLength} bytes)`);
     }
-    recordOutcome?.(upstreamResponse.status);
+    upstream.recordOutcome?.(upstreamResponse.status);
     const relayHeaders: Record<string, string> = {};
     const contentType = upstreamResponse.headers.get("content-type");
     if (contentType) relayHeaders["content-type"] = contentType;
@@ -134,10 +119,10 @@ export async function handleSearch(
       return formatErrorResponse(499, "client_closed_request", "search request canceled by client");
     }
     if (err instanceof Error && err.name === "TimeoutError") {
-      recordOutcome?.("timeout");
+      upstream.recordOutcome?.("timeout");
       return formatErrorResponse(504, "upstream_error", "search upstream timed out");
     }
-    recordOutcome?.("connect_error");
+    upstream.recordOutcome?.("connect_error");
     return formatErrorResponse(
       502,
       "upstream_error",

package/src/types.ts

@@ -349,6 +349,8 @@ export interface OcxConfig {
   port: number;
   providers: Record<string, OcxProviderConfig>;
   defaultProvider: string;
+  /** OpenAI provider-contract migration marker (v2 = single `openai` provider with account mode). */
+  openaiProviderTierVersion?: 1 | 2;
   /** Claude Code inbound + launcher settings. */
   claudeCode?: OcxClaudeCodeConfig;
   /**
@@ -467,12 +469,34 @@ export interface OcxConfig {
   autoSwitchThreshold?: number;
   /** Consecutive non-2xx upstream responses before switching future new threads. Default 3. 0 = disabled. */
   upstreamFailoverThreshold?: number;
+  /** Virtual `combo/<id>` models spanning concrete provider/model targets (issue #133). */
+  combos?: Record<string, OcxComboConfig>;
   /** Background proactive token refresh ("Token Guardian"). Off by default; see OcxTokenGuardianConfig. */
   tokenGuardian?: OcxTokenGuardianConfig;
   /** Additional origins allowed for CORS (e.g. ["https://clisu-oracle.tail19a2d7.ts.net"]). Loopback origins are always allowed. */
   corsAllowOrigins?: string[];
 }
 
+export type OcxComboStrategy = "failover" | "round-robin";
+export type OcxComboDefaultEffort = "low" | "medium" | "high" | "xhigh" | "max" | "ultra";
+
+export interface OcxComboTarget {
+  provider: string;
+  model: string;
+  /** Relative SWRR batch weight. Default 1; valid range 1..10000. */
+  weight?: number;
+}
+
+export interface OcxComboConfig {
+  targets: OcxComboTarget[];
+  /** Ordered failover (default) or deterministic smooth weighted round-robin. */
+  strategy?: OcxComboStrategy;
+  /** Successful requests retained on one RR selection batch. Default 1; range 1..100. */
+  stickyLimit?: number;
+  /** Used when the client omits reasoning.effort. Default medium. */
+  defaultEffort?: OcxComboDefaultEffort;
+}
+
 /**
  * Per-provider proactive-refresh policy. The guardian only ever touches a provider whose EFFECTIVE
  * policy is "proactive"; "lazy-only" keeps today's on-demand refresh, "disabled" forbids the
@@ -566,6 +590,12 @@ export interface OcxProviderConfig {
   allowPrivateNetwork?: boolean;
   /** Keep provider settings on disk but exclude it from routing and model/catalog listings. */
   disabled?: boolean;
+  /**
+   * Codex account-selection mode. Valid ONLY on the canonical built-in `openai` forward provider.
+   * "pool" (default) rotates main + added Codex accounts through the affinity/quota/cooldown/
+   * failover engine; "direct" pins the caller's main Codex login and never touches pool state.
+   */
+  codexAccountMode?: CodexAccountMode;
   apiKey?: string;
   /**
    * Multi-key pool (API-key twin of OAuth multiauth). `apiKey` always mirrors the ACTIVE
@@ -595,16 +625,27 @@ export interface OcxProviderConfig {
   modelContextWindows?: Record<string, number>;
   /** Model-specific Codex catalog input modalities, e.g. ["text"] or ["text", "image"]. */
   modelInputModalities?: Record<string, string[]>;
+  /** Model-specific max input token limits. Values cap auto_compact_token_limit. */
+  modelMaxInputTokens?: Record<string, number>;
   headers?: Record<string, string>;
   /**
    * "key" (default): authenticate upstream with `apiKey`.
    * "forward": relay the caller's incoming auth headers verbatim (OAuth passthrough; gpt only).
    * "oauth": resolve a stored OAuth access token (auto-refreshed) and use it as the Bearer key.
    * Only the openai-responses adapter implements "forward"; openai-chat uses its own key/token.
+   * "local": local runtime (Ollama etc.) — no remote key required. Valid only for
+   * providers whose registry entry declares authKind "local" (management API enforces).
    */
-  authMode?: "key" | "forward" | "oauth";
+  authMode?: "key" | "forward" | "oauth" | "local";
   /** Allow an explicitly key/oauth provider to run without a credential (for keyless local proxies). */
   keyOptional?: boolean;
+  /**
+   * Free-tier pricing flag for UI/catalog (Free badge, Free filter). Not the same as
+   * `keyOptional` — free tiers may still require an API key (e.g. NVIDIA NIM free credits).
+   */
+  freeTier?: boolean;
+  /** Optional human note shown in the providers UI (not used for routing). */
+  note?: string;
   /** Strip one trailing bracketed suffix from model ids before sending them upstream. */
   modelSuffixBracketStrip?: boolean;
   /**
@@ -621,6 +662,8 @@ export interface OcxProviderConfig {
   reasoningEfforts?: string[];
   /** Model-specific Codex-visible reasoning tiers. An empty array means “do not expose effort”. */
   modelReasoningEfforts?: Record<string, string[]>;
+  /** Model-specific default Codex reasoning tier; must also be present in the visible tier list. */
+  modelDefaultReasoningEfforts?: Record<string, string>;
   /** Provider-wide mapping from Codex effort labels to upstream `reasoning_effort` values. */
   reasoningEffortMap?: Record<string, string>;
   /** Model-specific mapping from Codex effort labels to upstream `reasoning_effort` values. */
@@ -712,6 +755,11 @@ export interface OcxProviderConfig {
   nativeLocalExec?: "off" | "codex-sandbox" | "on";
 }
 
+/** Trusted runtime ownership for Codex-account credentials. Never persisted per provider. */
+export type CodexAccountMode = "direct" | "pool";
+
+export const OPENAI_PROVIDER_TIER_VERSION = 2 as const;
+
 export interface CodexAccount {
   id: string;
   email: string;

package/src/update/index.ts

@@ -66,20 +66,51 @@ export function latestVersion(tag: string): string | null {
 }
 
 /** The global-install command opencodex would run to update on this channel. */
-export function updateCommand(installer: Installer, tag: Channel): { bin: string; args: string[] } {
+export function updateCommand(installer: Installer, tag: Channel, resolvedVersion?: string | null): { bin: string; args: string[] } {
   const bin = installer === "bun" ? "bun" : "npm";
+  // Immutable target: when the registry resolved a concrete version, install exactly
+  // that version — the dist-tag can move between resolution and install (TOCTOU).
+  const target = resolvedVersion || tag;
   const args = installer === "bun"
-    ? ["add", "-g", `${PKG}@${tag}`]
-    : ["install", "-g", `${PKG}@${tag}`];
+    ? ["add", "-g", `${PKG}@${target}`]
+    : ["install", "-g", `${PKG}@${target}`];
   return { bin, args };
 }
 
 /** Human-readable form of {@link updateCommand}, used in the update prompt label. */
-export function updateCommandStr(installer: Installer, tag: Channel): string {
-  const { bin, args } = updateCommand(installer, tag);
+export function updateCommandStr(installer: Installer, tag: Channel, resolvedVersion?: string | null): string {
+  const { bin, args } = updateCommand(installer, tag, resolvedVersion);
   return `${bin} ${args.join(" ")}`;
 }
 
+/**
+ * Pre-flight integrity metadata check (NOT independent tamper-proofing — the installer
+ * verifies tarballs against the same registry metadata). Two failure lanes:
+ *  - transient registry failure (spawn error/timeout/nonzero exit) → `{ ok: "skipped" }`
+ *    so registry absence never turns into an unconditional update failure;
+ *  - successful query with missing/malformed SRI → `{ ok: false }` (anomalous
+ *    metadata — fail closed BEFORE the running proxy is stopped).
+ * `dist.integrity` may be a quoted, space-separated multi-hash list; any sha512 token passes.
+ */
+export function checkUpdatePackageIntegrity(
+  version: string | null,
+  spawn: typeof spawnSync = spawnSync,
+): { ok: true; integrity: string } | { ok: false; reason: string } | { ok: "skipped"; reason: string } {
+  if (!version) return { ok: "skipped", reason: "no resolved version (registry unavailable)" };
+  const npm = npmSpawnTarget("npm");
+  const r = spawn(
+    npm.bin,
+    ["view", `${PKG}@${version}`, "dist.integrity"],
+    { encoding: "utf8", timeout: 12000, windowsHide: true, shell: npm.shell },
+  );
+  // status !== 0 covers nonzero exits AND timeouts (status === null).
+  if (r.status !== 0) return { ok: "skipped", reason: `registry integrity query failed (status ${r.status ?? "timeout"})` };
+  const tokens = (r.stdout ?? "").replace(/["']/g, "").trim().split(/\s+/).filter(Boolean);
+  const match = tokens.find(token => /^sha512-[A-Za-z0-9+/=]+$/.test(token));
+  if (!match) return { ok: false, reason: `registry returned no sha512 integrity for ${PKG}@${version}` };
+  return { ok: true, integrity: match };
+}
+
 /**
  * `ocx update` fallback for source checkouts and Bun global installs. npm global installs are updated
  * in the Node bin launcher before Bun starts, so Windows does not replace the running Bun binary.
@@ -101,6 +132,19 @@ export async function runUpdate(): Promise<void> {
     return;
   }
 
+  // Pre-flight integrity metadata check — runs BEFORE the proxy is stopped so an
+  // anomalous registry entry aborts without unloading the running service.
+  const integrity = checkUpdatePackageIntegrity(latest);
+  if (integrity.ok === false) {
+    console.error(`⚠️  ${integrity.reason} — aborting the update before stopping the proxy.`);
+    process.exit(1);
+  }
+  if (integrity.ok === "skipped") {
+    console.warn(`⚠️  Integrity pre-flight skipped: ${integrity.reason}. Proceeding best-effort.`);
+  } else {
+    console.log(`Verified ${PKG}@${latest} integrity metadata ${integrity.integrity.slice(0, 24)}…`);
+  }
+
   // Remember whether a background service manages the proxy BEFORE stopping — `ocx stop`
   // unloads it permanently, so a successful update must reinstall/restart it afterwards.
   let serviceWasInstalled = false;
@@ -130,7 +174,7 @@ export async function runUpdate(): Promise<void> {
     }
   }
 
-  const { bin, args: cmdArgs } = updateCommand(installer, tag);
+  const { bin, args: cmdArgs } = updateCommand(installer, tag, latest);
   console.log(`Updating${latest ? ` to v${latest}` : ""}…\n$ ${bin} ${cmdArgs.join(" ")}`);
 
   const target = npmSpawnTarget(bin);

package/src/update/job.ts

@@ -8,6 +8,8 @@ import { isServiceInstalled } from "../service";
 import {
   type Channel,
   type Installer,
+  PKG,
+  checkUpdatePackageIntegrity,
   currentVersion,
   defaultUpdateTag,
   detectInstall,
@@ -136,15 +138,18 @@ export function updateExecutionCommand(
   installer: Installer,
   channel: Channel,
   launcher = packageLauncherPath(),
+  resolvedVersion?: string | null,
 ): { bin: string; args: string[]; display: string } {
   if (installer === "npm") {
     const bin = nodeBin();
     const args = [launcher, "update", "--tag", channel];
+    // The Node launcher self-update re-resolves the tag at its own time — a residual
+    // divergence window this path cannot close (documented, not claimed immutable).
     return { bin, args, display: formatCommand(bin, args) };
   }
   if (installer === "bun") {
-    const { bin, args } = updateCommand(installer, channel);
-    return { bin, args, display: updateCommandStr(installer, channel) };
+    const { bin, args } = updateCommand(installer, channel, resolvedVersion);
+    return { bin, args, display: updateCommandStr(installer, channel, resolvedVersion) };
   }
   return { bin: "sh", args: ["-lc", manualSourceCommand()], display: manualSourceCommand() };
 }
@@ -319,13 +324,25 @@ export function runGuiUpdateWorker(jobId: string, channel: Channel, restart: boo
       throw new Error(check.reason ?? "No update is available");
     }
 
-    const cmd = updateExecutionCommand(check.installer, channel);
+    // Pre-flight integrity metadata check (same lanes as the CLI): anomalous registry
+    // metadata for a resolved version fails the job BEFORE anything is spawned or the
+    // proxy is stopped; transient registry failure degrades to a logged skip.
+    const integrity = checkUpdatePackageIntegrity(check.latestVersion);
+    if (integrity.ok === false) {
+      updateJob(job, { status: "failed", error: integrity.reason });
+      return;
+    }
+    const integrityLine = integrity.ok === "skipped"
+      ? `Integrity pre-flight skipped: ${integrity.reason}. Proceeding best-effort.`
+      : `Verified ${PKG}@${check.latestVersion} integrity metadata ${integrity.integrity.slice(0, 24)}…`;
+
+    const cmd = updateExecutionCommand(check.installer, channel, undefined, check.latestVersion);
     job = updateJob(job, {
       currentVersion: check.currentVersion,
       latestVersion: check.latestVersion,
       installer: check.installer,
       command: cmd.display,
-    });
+    }, integrityLine);
 
     /* [Decision Log]
     - 목적: GUI 요청 처리 프로세스가 자신이 실행 중인 패키지를 직접 덮어쓰지 않도록 업데이트를 별도 worker에서 수행한다.

package/src/usage/log.ts

@@ -6,6 +6,29 @@ import type { OcxUsage } from "../types";
 
 export type UsageStatus = "reported" | "unreported" | "unsupported" | "estimated";
 
+export type AttemptRecoveryKind =
+  | "transient-5xx"
+  | "connection-reset"
+  | "oauth-401"
+  | "key-429"
+  | "image-413";
+
+export interface PersistedUsageAttempt {
+  ordinal: number;
+  provider: string;
+  model: string;
+  adapter: string;
+  status: number;
+  durationMs: number;
+  sendCount: number;
+  recoveryKinds: AttemptRecoveryKind[];
+  usageStatus: UsageStatus;
+  inputTokenEstimate?: number;
+  usage?: OcxUsage;
+  totalTokens?: number;
+  errorCode?: string;
+}
+
 export interface PersistedUsageEntry {
   requestId: string;
   timestamp: number;
@@ -13,11 +36,13 @@ export interface PersistedUsageEntry {
   model: string;
   surface?: "claude";
   resolvedModel?: string;
+  requestedModel?: string;
   status: number;
   durationMs: number;
   usageStatus: UsageStatus;
   usage?: OcxUsage;
   totalTokens?: number;
+  attempts?: PersistedUsageAttempt[];
   // Failure diagnostics (devlog/_plan/260716_claudecode_hardening/030): persisted for
   // status>=400 or non-completed terminals so incidents survive the in-memory ring buffer.
   errorCode?: string;
@@ -70,7 +95,101 @@ function normalizeUsageValue(usage: OcxUsage | undefined): OcxUsage | undefined
   };
 }
 
+const ATTEMPT_RECOVERY_KINDS = new Set<AttemptRecoveryKind>([
+  "transient-5xx",
+  "connection-reset",
+  "oauth-401",
+  "key-429",
+  "image-413",
+]);
+const USAGE_STATUSES = new Set<UsageStatus>([
+  "reported",
+  "unreported",
+  "unsupported",
+  "estimated",
+]);
+
+function isNonNegativeFiniteNumber(value: unknown): value is number {
+  return typeof value === "number" && Number.isFinite(value) && value >= 0;
+}
+
+function normalizeAttemptUsage(raw: unknown): OcxUsage | null {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
+  const usage = raw as Record<string, unknown>;
+  if (!isNonNegativeFiniteNumber(usage.inputTokens)
+    || !isNonNegativeFiniteNumber(usage.outputTokens)) return null;
+  for (const key of [
+    "totalTokens",
+    "cachedInputTokens",
+    "cacheReadInputTokens",
+    "cacheCreationInputTokens",
+    "reasoningOutputTokens",
+  ] as const) {
+    if (key in usage && !isNonNegativeFiniteNumber(usage[key])) return null;
+  }
+  if ("estimated" in usage && typeof usage.estimated !== "boolean") return null;
+  return normalizeUsageValue(usage as unknown as OcxUsage) ?? null;
+}
+
+function normalizeUsageAttempt(raw: unknown): PersistedUsageAttempt | null {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
+  const attempt = raw as Record<string, unknown>;
+  if (typeof attempt.ordinal !== "number" || !Number.isInteger(attempt.ordinal)
+    || attempt.ordinal < 1
+    || typeof attempt.provider !== "string" || !attempt.provider
+    || typeof attempt.model !== "string" || !attempt.model
+    || typeof attempt.adapter !== "string" || !attempt.adapter
+    || typeof attempt.status !== "number" || !Number.isInteger(attempt.status)
+    || attempt.status < 100 || attempt.status > 599
+    || typeof attempt.durationMs !== "number" || !Number.isFinite(attempt.durationMs)
+    || attempt.durationMs < 0
+    || typeof attempt.sendCount !== "number" || !Number.isInteger(attempt.sendCount)
+    || attempt.sendCount < 0
+    || typeof attempt.usageStatus !== "string"
+    || !USAGE_STATUSES.has(attempt.usageStatus as UsageStatus)) {
+    return null;
+  }
+  if ("inputTokenEstimate" in attempt
+    && !isNonNegativeFiniteNumber(attempt.inputTokenEstimate)) return null;
+  if ("totalTokens" in attempt
+    && !isNonNegativeFiniteNumber(attempt.totalTokens)) return null;
+  const usage = "usage" in attempt ? normalizeAttemptUsage(attempt.usage) : undefined;
+  if ("usage" in attempt && usage === null) return null;
+  const recoveryKinds = Array.isArray(attempt.recoveryKinds)
+    ? [...new Set(attempt.recoveryKinds.filter(
+      (value): value is AttemptRecoveryKind => typeof value === "string"
+        && ATTEMPT_RECOVERY_KINDS.has(value as AttemptRecoveryKind),
+    ))]
+    : [];
+  return {
+    ordinal: attempt.ordinal as number,
+    provider: attempt.provider,
+    model: attempt.model,
+    adapter: attempt.adapter,
+    status: attempt.status,
+    durationMs: attempt.durationMs,
+    sendCount: attempt.sendCount as number,
+    recoveryKinds,
+    usageStatus: attempt.usageStatus as UsageStatus,
+    ...(isNonNegativeFiniteNumber(attempt.inputTokenEstimate)
+      ? { inputTokenEstimate: attempt.inputTokenEstimate }
+      : {}),
+    ...(usage ? { usage } : {}),
+    ...(isNonNegativeFiniteNumber(attempt.totalTokens)
+      ? { totalTokens: attempt.totalTokens }
+      : {}),
+    ...(typeof attempt.errorCode === "string" ? { errorCode: attempt.errorCode } : {}),
+  };
+}
+
+function normalizedAttempts(raw: unknown): PersistedUsageAttempt[] {
+  if (!Array.isArray(raw)) return [];
+  return raw.map(normalizeUsageAttempt)
+    .filter((attempt): attempt is PersistedUsageAttempt => attempt !== null);
+}
+
 function normalizeUsageEntry(entry: PersistedUsageEntry): PersistedUsageEntry {
+  const attempts = normalizedAttempts(entry.attempts);
   return {
     requestId: entry.requestId,
     timestamp: entry.timestamp,
@@ -78,11 +197,13 @@ function normalizeUsageEntry(entry: PersistedUsageEntry): PersistedUsageEntry {
     model: entry.model,
     ...(entry.surface === "claude" ? { surface: entry.surface } : {}),
     ...(entry.resolvedModel ? { resolvedModel: entry.resolvedModel } : {}),
+    ...(entry.requestedModel ? { requestedModel: entry.requestedModel } : {}),
     status: entry.status,
     durationMs: entry.durationMs,
     usageStatus: entry.usageStatus,
     ...(entry.usage ? { usage: normalizeUsageValue(entry.usage) } : {}),
     ...(typeof entry.totalTokens === "number" ? { totalTokens: entry.totalTokens } : {}),
+    ...(attempts.length > 0 ? { attempts } : {}),
     ...(entry.errorCode ? { errorCode: entry.errorCode } : {}),
     ...(entry.terminalStatus ? { terminalStatus: entry.terminalStatus } : {}),
     ...(entry.closeReason ? { closeReason: entry.closeReason } : {}),
@@ -112,7 +233,9 @@ export function readUsageEntries(): PersistedUsageEntry[] {
     if (!line.trim()) continue;
     try {
       const parsed = JSON.parse(line) as PersistedUsageEntry;
-      if (parsed && typeof parsed === "object" && typeof parsed.requestId === "string") entries.push(parsed);
+      if (parsed && typeof parsed === "object" && typeof parsed.requestId === "string") {
+        entries.push(normalizeUsageEntry(parsed));
+      }
     } catch {
       /* keep reading after a partially written or hand-edited line */
     }