@bitkyc08/opencodex 2.7.28 → 2.7.29-preview.20260721

package/src/cli/index.ts

@@ -22,7 +22,7 @@ import {
 import { collectStatus } from "./status";
 import { installCrashGuards } from "../lib/crash-guard";
 import { hasHelpFlag, printSubcommandUsage, printUsage, printVersion } from "./help";
-import { findAvailablePort, isAddrInUse, shouldPersistSelectedPort } from "../server/ports";
+import { findAvailablePort, isAddrInUse, PortUnavailableError, shouldPersistSelectedPort, waitForPortAvailable } from "../server/ports";
 import { findLiveProxy, probeHostname, type LiveProxy } from "../server/proxy-liveness";
 import { stopProxy } from "../lib/process-control";
 import { loadServiceTokenFromFile } from "../lib/service-secrets";
@@ -85,23 +85,43 @@ async function waitForProxy(timeoutMs = 8_000): Promise<LiveProxy | null> {
   return null;
 }
 
+/** Argv for detached `start`, optionally hard-pinning the listen port. */
+function startArgv(port?: number): string[] {
+  const args = [process.argv[1], "start"];
+  if (typeof port === "number" && Number.isFinite(port) && port > 0 && port <= 65535) {
+    args.push("--port", String(Math.trunc(port)));
+  }
+  return args;
+}
+
 async function chooseListenPort(requestedPort?: number): Promise<number> {
   const config = loadConfig();
   const preferred = requestedPort ?? config.port ?? 10100;
-  // Brief prefer-retry covers stop→start races (update restart, `ocx restart`) where the
-  // old process has exited but the listen socket is still draining.
-  const selected = await findAvailablePort(preferred, config.hostname ?? "127.0.0.1", {
-    preferRetryMs: 750,
-    preferRetryIntervalMs: 50,
-  });
-  if (selected !== preferred) {
-    console.log(`⚠️  Port ${preferred} is busy; starting opencodex on ${selected}.`);
-  }
-  if (shouldPersistSelectedPort(config.port, selected, preferred)) {
-    config.port = selected;
-    saveConfig(config);
+  const hardPin = requestedPort !== undefined && requestedPort > 0;
+  // Soft start: brief prefer-retry then ephemeral hop.
+  // Explicit `--port` (service wrappers / update restart): longer prefer-retry, never hop.
+  try {
+    const selected = await findAvailablePort(preferred, config.hostname ?? "127.0.0.1", {
+      preferRetryMs: hardPin ? 8_000 : 750,
+      preferRetryIntervalMs: 50,
+      allowEphemeralFallback: !hardPin,
+    });
+    if (selected !== preferred) {
+      console.log(`⚠️  Port ${preferred} is busy; starting opencodex on ${selected}.`);
+    }
+    if (shouldPersistSelectedPort(config.port, selected, preferred)) {
+      config.port = selected;
+      saveConfig(config);
+    }
+    return selected;
+  } catch (err) {
+    if (err instanceof PortUnavailableError) {
+      console.error(`❌ ${err.message}`);
+      console.error("   Stop whatever holds that port, or change config.port, then retry.");
+      process.exit(1);
+    }
+    throw err;
   }
-  return selected;
 }
 
 async function handleStart(options: { block?: boolean } = {}) {
@@ -128,7 +148,8 @@ async function handleStart(options: { block?: boolean } = {}) {
   await maybeShowUpdatePrompt();
 
   // Port selection is check-then-bind: a concurrent `ocx start`/`ensure` can win the port
-  // between the probe and Bun.serve. Retry the pick instead of dying on EADDRINUSE.
+  // between the probe and Bun.serve. Soft starts may re-pick; hard-pinned `--port` retries
+  // the same port only (never hop — that was the remaining PR #152 gap).
   let port = await chooseListenPort(requestedPort);
   let server: ReturnType<typeof startServer>;
   for (let attempt = 0; ; attempt++) {
@@ -137,6 +158,16 @@ async function handleStart(options: { block?: boolean } = {}) {
       break;
     } catch (err) {
       if (!isAddrInUse(err) || attempt >= 2) throw err;
+      if (requestedPort !== undefined) {
+        console.log(`⚠️  Port ${port} was taken while starting; waiting to retry the same port...`);
+        const hostname = loadConfig().hostname ?? "127.0.0.1";
+        const freed = await waitForPortAvailable(port, hostname, { timeoutMs: 3_000, intervalMs: 50 });
+        if (!freed) {
+          console.error(`❌ Port ${port} stayed busy; refusing to hop to an ephemeral port.`);
+          process.exit(1);
+        }
+        continue;
+      }
       console.log(`⚠️  Port ${port} was taken while starting; picking another...`);
       port = await chooseListenPort(requestedPort);
     }
@@ -249,7 +280,8 @@ async function handleEnsure() {
       return;
     }
 
-  const child = spawn(process.execPath, [process.argv[1], "start"], {
+  const pinPort = config.port ?? 10100;
+  const child = spawn(process.execPath, startArgv(pinPort > 0 ? pinPort : undefined), {
     detached: true,
     stdio: "ignore",
     windowsHide: true,
@@ -537,7 +569,7 @@ switch (command) {
     let live = await findLiveProxy();
     if (!live) {
       console.log("Proxy not running. Starting...");
-      const child = spawn(process.execPath, [process.argv[1], "start"], {
+      const child = spawn(process.execPath, startArgv((config.port ?? 10100) > 0 ? (config.port ?? 10100) : undefined), {
         detached: true,
         stdio: "ignore",
         windowsHide: true,
@@ -545,6 +577,10 @@ switch (command) {
       });
       child.unref();
       live = await waitForProxy();
+      if (!live) {
+        console.error("❌ Proxy did not become healthy after starting. Not opening the GUI.");
+        process.exit(1);
+      }
     }
     // Open the host the proxy actually binds — `localhost` only answers for
     // loopback/wildcard binds, not a concrete LAN/IPv6 hostname.
@@ -628,6 +664,11 @@ switch (command) {
     await handleProviderCommand(args.slice(1));
     break;
   }
+  case "account": {
+    const { cmdAccount } = await import("./account");
+    process.exitCode = await cmdAccount(args.slice(1));
+    break;
+  }
   case "models": {
     const { handleModels } = await import("./models");
     handleModels(args.slice(1));

package/src/cli/init.ts

@@ -82,6 +82,16 @@ export async function runInit(): Promise<void> {
     } else {
       // key + local: collect a key (local usually blank).
       if (p.dashboardUrl) console.log(`   🔑 Get your key: ${p.dashboardUrl}`);
+      // Template URL with placeholders (e.g. Cloudflare's {account_id}) needs a resolved value.
+      let baseUrl = p.baseUrl;
+      if (/\{[^}]*\}/.test(baseUrl)) {
+        const resolved = (await prompt.ask(`   Your endpoint URL (${baseUrl}): `)).trim();
+        if (!resolved) {
+          console.error("   A resolved URL is required — replace the {placeholder} with your actual value.");
+          process.exit(1);
+        }
+        baseUrl = resolved;
+      }
       const env = envKeyFor(p.id);
       const hint = p.kind === "local" ? "API key (usually blank — press Enter): " : `API key (paste, or env var $${env}): `;
       const apiKey = (await prompt.ask(`\n${hint}`)).trim();
@@ -89,7 +99,7 @@ export async function runInit(): Promise<void> {
       const defaultModel = modelChoice || p.defaultModel;
       providerConfig = {
         adapter: p.adapter,
-        baseUrl: p.baseUrl,
+        baseUrl,
         ...(p.kind === "key" ? { apiKey: apiKey || `\${${env}}` } : apiKey ? { apiKey } : {}),
         ...(defaultModel ? { defaultModel } : {}),
       };

package/src/codex/catalog.ts

@@ -1266,7 +1266,12 @@ async function fetchProviderModels(name: string, prov: OcxProviderConfig, ttlMs:
     const staleCursor = getStaleCached(name);
     return staleCursor ? applyConfigHintsToCachedModels(name, prov, staleCursor) : configured;
   }
-  if (prov.authMode === "oauth" && !apiKey) return []; // not logged in → skip
+  if (prov.authMode === "oauth" && !apiKey) {
+    // No usable token (logged out, or account marked needsReauth). Still surface the
+    // configured static catalog so the GUI Models tab / rail counts are not empty —
+    // matching Cursor's !apiKey → configured degradation and fetch-failure fallback.
+    return configured;
+  }
   if (prov.liveModels === false) {
     return configured;
   }

package/src/lib/errors.ts

@@ -99,6 +99,9 @@ export function classifyError(status: number, type: string, message: string): Oc
   ) {
     return { message, type: "invalid_request_error", code: "context_length_exceeded" };
   }
+  if (text.includes("cursor resource limit exceeded")) {
+    return { message, type: "invalid_request_error", code: "tool_catalog_too_large" };
+  }
   if (
     text.includes("insufficient_quota") ||
     text.includes("exceeded your current quota") ||
@@ -199,6 +202,7 @@ export function inferHttpStatusFromAdapterMessage(message: string): number {
   const lower = message.toLowerCase();
   // Client aborts (e.g. mid web-search loop) must not look like upstream 502s in /api/logs.
   if (isClientClosedMessage(lower)) return 499;
+  if (lower.includes("cursor resource limit exceeded")) return 400;
   if (
     lower.includes("resource_exhausted") ||
     lower.includes("resource exhausted") ||

package/src/lib/winsw.ts

@@ -18,7 +18,7 @@ import { execFileSync } from "node:child_process";
 import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join, resolve } from "node:path";
-import { expandUserPath, getConfigDir } from "../config";
+import { expandUserPath, getConfigDir, loadConfig } from "../config";
 import { durableBunPath } from "./bun-runtime";
 import { serviceApiTokenFilePath } from "./service-secrets";
 
@@ -72,9 +72,20 @@ export interface WinswEntry {
  * Task Scheduler wrapper / launchd / systemd: the SCM service environment lacks the
  * user's interactive PATH, which provider subprocesses may need.
  */
-export function buildWinswXml(entry: WinswEntry, env: NodeJS.ProcessEnv = process.env): string {
+export function buildWinswXml(entry: WinswEntry, env: NodeJS.ProcessEnv = process.env, port?: number): string {
   const domain = env.USERDOMAIN?.trim() || ".";
   const user = env.USERNAME?.trim() || "";
+  const listenPort = (() => {
+    if (typeof port === "number" && Number.isFinite(port) && port > 0 && port <= 65535) return Math.trunc(port);
+    const baked = env.OCX_BAKE_PORT?.trim();
+    if (baked && /^\d+$/.test(baked)) {
+      const n = Number(baked);
+      if (n > 0 && n <= 65535) return n;
+    }
+    return loadConfig().port ?? 10100;
+  })();
+  // Services never bake `--port 0` (parsePortOption rejects it); treat as default.
+  const safeListenPort = listenPort > 0 && listenPort <= 65535 ? listenPort : 10100;
   const envLines = [
     `  <env name="OCX_SERVICE" value="1"/>`,
     `  <env name="OCX_API_TOKEN_FILE" value="${xmlEscape(serviceApiTokenFilePath())}"/>`,
@@ -88,7 +99,7 @@ export function buildWinswXml(entry: WinswEntry, env: NodeJS.ProcessEnv = proces
   <name>OpenCodex Proxy (native)</name>
   <description>OpenCodex proxy running as a native Windows service (windowless, starts at boot).</description>
   <executable>${xmlEscape(entry.bun)}</executable>
-  <arguments>${xmlEscape(`"${entry.cli}" start`)}</arguments>
+  <arguments>${xmlEscape(`"${entry.cli}" start --port ${safeListenPort}`)}</arguments>
 ${envLines.join("\n")}
   <logpath>${xmlEscape(winswLogDir())}</logpath>
   <log mode="roll-by-size">

package/src/oauth/login-cli.ts

@@ -62,10 +62,10 @@ async function handleOAuthLogin(name: string): Promise<void> {
   console.log(`\n✅ Logged in to ${name}. Try: ocx sync`);
 }
 
-export function providerConfigFromKeyLoginProvider(def: KeyLoginProvider, key: string): OcxProviderConfig {
+export function providerConfigFromKeyLoginProvider(def: KeyLoginProvider, key: string, baseUrlOverride?: string): OcxProviderConfig {
   return {
     adapter: def.adapter,
-    baseUrl: def.baseUrl,
+    baseUrl: baseUrlOverride ?? def.baseUrl,
     apiKey: key,
     ...(def.defaultModel ? { defaultModel: def.defaultModel } : {}),
     ...(def.models ? { models: [...def.models] } : {}),
@@ -94,19 +94,30 @@ async function handleKeyLogin(name: string): Promise<void> {
   openUrl(def.dashboardUrl);
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
   const key = (await new Promise<string>((res) => rl.question(`Paste your ${def.label} API key: `, res))).trim();
+  // Template URL with placeholders needs resolution before saving.
+  let baseUrl = def.baseUrl;
+  if (/\{[^}]*\}/.test(baseUrl)) {
+    const resolved = (await new Promise<string>((res) => rl.question(`Your endpoint URL (${baseUrl}): `, res))).trim();
+    if (!resolved) {
+      rl.close();
+      console.error("A resolved URL is required — replace the {placeholder} with your actual value.");
+      process.exit(1);
+    }
+    baseUrl = resolved;
+  }
   rl.close();
   if (!key) {
     console.error("No key entered.");
     process.exit(1);
   }
   process.stdout.write("   validating… ");
-  const valid = await validateApiKey(def, key);
+  const valid = await validateApiKey({ ...def, baseUrl }, key);
   console.log(valid === true ? "valid ✅" : valid === false ? "INVALID ❌" : "couldn't validate (may still work)");
   if (valid === false) {
     console.error("Provider rejected the key. Not saved.");
     process.exit(1);
   }
-  const provider = providerConfigFromKeyLoginProvider(def, key);
+  const provider = providerConfigFromKeyLoginProvider(def, key, baseUrl);
   const config = loadConfig();
   config.providers[name] = provider;
   saveConfig(config);

package/src/providers/base-url-choices.ts

@@ -21,6 +21,21 @@ export const QWEN_CLOUD_BASE_URL_CHOICES: readonly ProviderBaseUrlChoice[] = [
   { id: "custom", label: "Custom" },
 ];
 
+/**
+ * Alibaba Token Plan International (ap-southeast-1) endpoint presets.
+ * Same product as the Beijing Token Plan but for international accounts.
+ */
+export const ALIBABA_INTL_TOKEN_PLAN_BASE_URL =
+  "https://token-plan.ap-southeast-1.maas.aliyuncs.com/compatible-mode/v1";
+export const ALIBABA_INTL_PAYG_BASE_URL =
+  "https://dashscope-intl.aliyuncs.com/compatible-mode/v1";
+
+export const ALIBABA_INTL_BASE_URL_CHOICES: readonly ProviderBaseUrlChoice[] = [
+  { id: "token-plan", label: "Token plan", baseUrl: ALIBABA_INTL_TOKEN_PLAN_BASE_URL },
+  { id: "payg", label: "Pay as you go", baseUrl: ALIBABA_INTL_PAYG_BASE_URL },
+  { id: "custom", label: "Custom" },
+];
+
 /** Match a saved baseUrl to a known choice id (`custom` when it does not match). */
 export function matchBaseUrlChoice(
   choices: readonly ProviderBaseUrlChoice[],

package/src/providers/registry.ts

@@ -2,7 +2,10 @@ import type { CodexAccountMode, OcxProviderConfig } from "../types";
 import { KIRO_MODELS, KIRO_MODEL_CONTEXT_WINDOWS, KIRO_MODEL_REASONING_EFFORTS } from "./kiro-models";
 import { ANTIGRAVITY_MODELS, ANTIGRAVITY_MODEL_CONTEXT_WINDOWS } from "./antigravity-models";
 import type { ProviderBaseUrlChoice } from "./base-url-choices";
-import { QWEN_CLOUD_BASE_URL_CHOICES, QWEN_CLOUD_TOKEN_PLAN_BASE_URL } from "./base-url-choices";
+import {
+  QWEN_CLOUD_BASE_URL_CHOICES, QWEN_CLOUD_TOKEN_PLAN_BASE_URL,
+  ALIBABA_INTL_BASE_URL_CHOICES, ALIBABA_INTL_TOKEN_PLAN_BASE_URL,
+} from "./base-url-choices";
 import {
   CURSOR_STATIC_MODELS,
   cursorModelContextWindows,
@@ -199,6 +202,33 @@ const ALIBABA_TOKEN_PLAN_INPUT_MODALITIES: Record<string, string[]> = {
   "glm-5.2": ["text"],
   "deepseek-v4-pro": ["text"],
 };
+
+// 260721 Alibaba Token Plan International (ap-southeast-1 / Singapore).
+// Multi-vendor lineup distinct from Beijing — includes DeepSeek V4 flash, Kimi K2.7, MiniMax.
+// Evidence: https://www.alibabacloud.com/help/en/model-studio/token-plan-overview
+const ALIBABA_INTL_TOKEN_PLAN_MODELS = [
+  "qwen3.7-max", "qwen3.7-plus", "qwen3.6-plus", "qwen3.6-flash",
+  "deepseek-v4-pro", "deepseek-v4-flash", "deepseek-v3.2",
+  "kimi-k2.7-code",
+  "glm-5.2",
+  "MiniMax-M2.5",
+];
+const ALIBABA_INTL_TOKEN_PLAN_QWEN_MODELS = [
+  "qwen3.7-max", "qwen3.7-plus", "qwen3.6-plus", "qwen3.6-flash",
+];
+const ALIBABA_INTL_TOKEN_PLAN_INPUT_MODALITIES: Record<string, string[]> = {
+  "qwen3.7-max": ["text"],
+  "qwen3.7-plus": ["text", "image"],
+  "qwen3.6-plus": ["text", "image"],
+  "qwen3.6-flash": ["text", "image"],
+  "deepseek-v4-pro": ["text"],
+  "deepseek-v4-flash": ["text"],
+  "deepseek-v3.2": ["text"],
+  "kimi-k2.7-code": ["text"],
+  "glm-5.2": ["text"],
+  "MiniMax-M2.5": ["text"],
+};
+
 // 260717 Kimi K3: the subscription endpoint uses one upstream id (`k3`) for both
 // entitlement tiers. Bare `k3` advertises the Moderato 256K ceiling; the local `[1m]`
 // alias advertises Allegretto's 1M ceiling and is stripped before the upstream request.
@@ -564,6 +594,39 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
     preserveReasoningContentModels: NEURALWATT_REASONING_HISTORY_MODELS,
   },
   { id: "openrouter", label: "OpenRouter", adapter: "openai-chat", baseUrl: "https://openrouter.ai/api/v1", authKind: "key", featured: true, dashboardUrl: "https://openrouter.ai/keys", jawcodeBundle: "openrouter", models: ["anthropic/claude-sonnet-5", ...OPENROUTER_GPT56_MODELS], modelContextWindows: { "anthropic/claude-sonnet-5": 1_000_000, ...OPENROUTER_GPT56_CONTEXT_WINDOWS } },
+  {
+    // OrcaRouter: OpenAI-compatible adaptive router (api.orcarouter.ai). Model ids are
+    // vendor-namespaced (`<vendor>/<model>`) and pass through to the upstream as-is.
+    // The default pins a tool-capable model; the adaptive `orcarouter/auto` router is also
+    // selectable. Live-verified 2026-07-20: /v1/chat/completions accepts the `tools` field
+    // and routes to a function-calling-capable upstream.
+    id: "orcarouter", label: "OrcaRouter", adapter: "openai-chat", baseUrl: "https://api.orcarouter.ai/v1",
+    authKind: "key", dashboardUrl: "https://www.orcarouter.ai/console",
+    defaultModel: "openai/gpt-5.5",
+    models: [
+      "openai/gpt-5.5",
+      "anthropic/claude-opus-4.8",
+      "google/gemini-3.5-flash",
+      "deepseek/deepseek-v4-pro",
+      "orcarouter/auto",
+    ],
+    // Text-only models → the vision sidecar describes images instead.
+    noVisionModels: ["deepseek/deepseek-v4-pro"],
+    // Reasoning/temperature behavior verified live 2026-07-20 against api.orcarouter.ai:
+    // - openai/gpt-5.5 accepts reasoning_effort none|low|medium|high|xhigh but rejects `max` (400),
+    //   so advertise up to xhigh and let mapReasoningEffort clamp a `max`/`ultra` request to xhigh.
+    // - deepseek/deepseek-v4-pro mirrors the direct-DeepSeek wiring (thinking-effort map +
+    //   reasoning_content history replay) so the namespaced selection behaves identically.
+    // - temperature is accepted by every seeded model (gpt-5.5, claude-opus-4.8, deepseek-v4-pro all
+    //   returned 200), so no noTemperatureModels entry is warranted here.
+    modelReasoningEfforts: {
+      "openai/gpt-5.5": ["low", "medium", "high", "xhigh"],
+      "deepseek/deepseek-v4-pro": DEEPSEEK_THINKING_EFFORTS,
+    },
+    modelReasoningEffortMap: { "deepseek/deepseek-v4-pro": DEEPSEEK_THINKING_REASONING_MAP },
+    preserveReasoningContentModels: ["deepseek/deepseek-v4-pro"],
+    note: "OpenAI-compatible adaptive router. Default is a tool-capable model; orcarouter/auto (adaptive routing) is also selectable. Full catalog: https://www.orcarouter.ai/models",
+  },
   { id: "groq", label: "Groq", adapter: "openai-chat", baseUrl: "https://api.groq.com/openai/v1", authKind: "key", featured: true, dashboardUrl: "https://console.groq.com/keys" },
   // 2026-07-10 Gemini API refresh: Tier-2 ai.google.dev evidence recorded in
   // devlog/_plan/260710_provider_hardening/001_research_frontier.md.
@@ -706,7 +769,36 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
     },
     modelReasoningEffortMap: { "deepseek-v4-pro": DEEPSEEK_THINKING_REASONING_MAP },
     thinkingBudgetModels: ALIBABA_TOKEN_PLAN_QWEN_MODELS,
-    preserveReasoningContentModels: ["glm-5.2", "deepseek-v4-pro"],
+    preserveReasoningContentModels: ["glm-5.2", "deepseek-v4-pro", "qwen3.8-max-preview"],
+  },
+  {
+    id: "alibaba-token-plan-intl",
+    label: "Alibaba Token Plan (International)",
+    baseUrl: ALIBABA_INTL_TOKEN_PLAN_BASE_URL,
+    adapter: "openai-chat",
+    authKind: "key",
+    allowBaseUrlOverride: true,
+    baseUrlChoices: ALIBABA_INTL_BASE_URL_CHOICES,
+    dashboardUrl: "https://modelstudio.console.alibabacloud.com/?tab=api#/api",
+    defaultModel: "qwen3.7-max",
+    models: ALIBABA_INTL_TOKEN_PLAN_MODELS,
+    liveModels: false,
+    note: "Token Plan Team Edition · Singapore (ap-southeast-1)",
+    modelInputModalities: ALIBABA_INTL_TOKEN_PLAN_INPUT_MODALITIES,
+    modelContextWindows: { "deepseek-v4-pro": 1_000_000, "deepseek-v4-flash": 1_000_000, "glm-5.2": 1_000_000 },
+    modelReasoningEfforts: {
+      ...Object.fromEntries(ALIBABA_INTL_TOKEN_PLAN_QWEN_MODELS.map(id => [id, THINKING_BUDGET_EFFORTS])),
+      "glm-5.2": ZAI_GLM_52_REASONING_EFFORTS,
+      "deepseek-v4-pro": DEEPSEEK_THINKING_EFFORTS,
+      "deepseek-v4-flash": DEEPSEEK_THINKING_EFFORTS,
+    },
+    modelReasoningEffortMap: {
+      "deepseek-v4-pro": DEEPSEEK_THINKING_REASONING_MAP,
+      "deepseek-v4-flash": DEEPSEEK_THINKING_REASONING_MAP,
+    },
+    thinkingBudgetModels: ALIBABA_INTL_TOKEN_PLAN_QWEN_MODELS,
+    preserveReasoningContentModels: ["glm-5.2", "deepseek-v4-pro", "deepseek-v4-flash", "qwen3.7-max"],
+    noVisionModels: ["deepseek-v4-pro", "deepseek-v4-flash", "deepseek-v3.2", "kimi-k2.7-code", "glm-5.2", "MiniMax-M2.5", "qwen3.7-max"],
   },
   // NEEDS_HUMAN 2026-07-10: kept for config compatibility, but this is a dashboard URL,
   // no /models endpoint is documented, and tools are silently ignored upstream per docs.parallel.ai.
@@ -816,6 +908,25 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
     note: "No key needed — uses Xiaomi MiMo's free public tier (limited-time offer). A JWT is bootstrapped automatically with an anonymous random client id stored locally. The endpoint contract mirrors the official MiMoCode client and is not publicly documented — Xiaomi may change or restrict it at any time. Prompts may be processed/retained by Xiaomi; do not send confidential material.",
   },
   { id: "cloudflare-ai-gateway", label: "Cloudflare AI Gateway", baseUrl: "https://gateway.ai.cloudflare.com/v1/{account-id}/{gateway}/anthropic", adapter: "anthropic", authKind: "key", dashboardUrl: "https://dash.cloudflare.com/?to=/:account/ai/ai-gateway" },
+  {
+    // Cloudflare Workers AI: OpenAI-compatible endpoint. The base URL contains {account_id}
+    // which must be resolved by the user at setup time. Model IDs use the @cf/ prefix.
+    // Live-verified 2026-07-21 against https://developers.cloudflare.com/workers-ai/models/
+    id: "cloudflare-workers-ai", label: "Cloudflare Workers AI",
+    baseUrl: "https://api.cloudflare.com/client/v4/accounts/{account_id}/ai/v1",
+    adapter: "openai-chat", authKind: "key", freeTier: true,
+    dashboardUrl: "https://dash.cloudflare.com/?to=/:account/ai/workers-ai",
+    defaultModel: "@cf/meta/llama-3.3-70b-instruct-fp8-fast",
+    models: [
+      "@cf/meta/llama-3.3-70b-instruct-fp8-fast",
+      "@cf/qwen/qwq-32b",
+      "@cf/deepseek-ai/deepseek-r1-distill-qwen-32b",
+      "@cf/moonshotai/kimi-k2.7-code",
+      "@cf/zai-org/glm-5.2",
+      "@cf/mistralai/mistral-small-3.1-24b-instruct",
+    ],
+    note: "Workers AI · Free tier included · Account ID required in base URL",
+  },
   // FREEZE 2026-07-10: /models was auth-gated under key login. OAuth device-flow + copilot_internal
   // exchange (issue #151) unlocks live discovery; static seed is a cold-start fallback only.
   {

package/src/responses/parser.ts

@@ -525,13 +525,18 @@ export function parseRequest(body: unknown): OcxParsedRequest {
 
   const declaredTools = buildTools(data.tools as unknown[] | undefined) ?? [];
   const loadedTools = buildTools(loadedToolSpecs) ?? [];
+  const loadedToolNames = new Set(loadedTools.map(t => namespacedToolName(t.namespace, t.name)));
   const seenTools = new Set<string>();
-  const mergedTools = [...declaredTools, ...loadedTools].filter(t => {
-    const k = namespacedToolName(t.namespace, t.name);
-    if (seenTools.has(k)) return false;
-    seenTools.add(k);
-    return true;
-  });
+  const mergedTools = [...declaredTools, ...loadedTools]
+    .filter(t => {
+      const k = namespacedToolName(t.namespace, t.name);
+      if (seenTools.has(k)) return false;
+      seenTools.add(k);
+      return true;
+    })
+    .map(t => loadedToolNames.has(namespacedToolName(t.namespace, t.name))
+      ? { ...t, loadedFromToolSearch: true }
+      : t);
   const context: OcxContext = {
     ...(systemPrompt.length > 0 ? { systemPrompt } : {}),
     messages,

package/src/router.ts

@@ -253,9 +253,14 @@ export function routeModel(config: OcxConfig, modelId: string): RouteResult {
     if (hasOwnProvider(config.providers, provName)) {
       const prov = config.providers[provName];
       if (prov.disabled === true) throw new Error(`Provider is disabled: ${provName}`);
+      const known = knownModelIdsForProvider(provName, prov);
+      // Self-namespaced native id — the vendor segment equals the provider id, so the FULL ref is
+      // itself a known model (e.g. orcarouter/auto). Route it whole instead of stripping to the
+      // remainder, which would send a bare `auto` the upstream cannot resolve.
+      if (known.includes(modelId)) return routeResult(provName, prov, modelId);
       // Codex-facing alias ids (`provider/vendor-model`) decode back to the native
       // slash id via an exact known-id lookup; raw full-slash selectors keep working.
-      return routeResult(provName, prov, decodeRoutedModelId(modelId.slice(slash + 1), knownModelIdsForProvider(provName, prov)));
+      return routeResult(provName, prov, decodeRoutedModelId(modelId.slice(slash + 1), known));
     }
   }
 

package/src/server/index.ts

@@ -54,6 +54,7 @@ export {
 } from "./lifecycle";
 import {
   addFinalRequestLog,
+  hydrateRequestLogsFromDisk,
   httpStatusForRequestLogTerminal,
   httpStatusForTerminalStatus,
   inspectResponseLogSsePayload,
@@ -65,6 +66,7 @@ import {
 export {
   addFinalRequestLog,
   filterRequestLogs,
+  hydrateRequestLogsFromDisk,
   httpStatusForTerminalStatus,
   httpStatusFromTerminalError,
   nextRequestLogId,
@@ -175,6 +177,9 @@ export function startServer(port?: number) {
     }
   }
   invalidateCodexModelsCache();
+  // usage.jsonl already persists every request; rehydrate the in-memory Logs ring so
+  // /api/logs (and the GUI) survive `ocx stop` / `ocx start` process restarts.
+  hydrateRequestLogsFromDisk();
 
   const listenPort = port ?? config.port ?? 10100;
   setCorsOrigin(listenPort);

package/src/server/ports.ts

@@ -49,14 +49,30 @@ export type FindAvailablePortOptions = {
   /** How long to keep retrying the preferred port before falling back to an ephemeral port. */
   preferRetryMs?: number;
   preferRetryIntervalMs?: number;
+  /**
+   * When false, never bind `port: 0` — prefer-retry then throw if the preferred port
+   * stays busy. Used for explicit `ocx start --port N` and service-baked pins so an
+   * update restart cannot hop to a random ephemeral listener (PR #152 gap).
+   */
+  allowEphemeralFallback?: boolean;
 };
 
+export class PortUnavailableError extends Error {
+  readonly port: number;
+  constructor(port: number, hostname: string) {
+    super(`Port ${port} on ${hostname} is still busy after prefer-retry; refusing ephemeral fallback.`);
+    this.name = "PortUnavailableError";
+    this.port = port;
+  }
+}
+
 export async function findAvailablePort(
   preferredPort: number,
   hostname = "127.0.0.1",
   opts: FindAvailablePortOptions = {},
 ): Promise<number> {
   const preferRetryMs = opts.preferRetryMs ?? 0;
+  const allowEphemeral = opts.allowEphemeralFallback !== false;
   if (preferRetryMs > 0) {
     if (await waitForPortAvailable(preferredPort, hostname, {
       timeoutMs: preferRetryMs,
@@ -68,6 +84,10 @@ export async function findAvailablePort(
     return preferredPort;
   }
 
+  if (!allowEphemeral) {
+    throw new PortUnavailableError(preferredPort, hostname);
+  }
+
   return await new Promise((resolve, reject) => {
     const server = createServer();
     server.once("error", reject);