@bitkyc08/opencodex 2.7.30 → 2.7.33-preview.20260722

package/src/oauth/store.ts

@@ -36,6 +36,38 @@ export function getAuthRefreshIntentLockPath(provider: string, accountId: string
   const accountHash = createHash("sha256").update(accountId).digest("hex").slice(0, 24);
   return join(getConfigDir(), `auth.refresh.${safeProvider}.${accountHash}.lock`);
 }
+export function getAuthRefreshIntentPath(provider: string, accountId: string): string {
+  return `${getAuthRefreshIntentLockPath(provider, accountId)}.json`;
+}
+export interface OAuthRefreshIntent { version: 1; provider: string; accountId: string; generation: string; createdAt: number; uncertain?: true }
+export function readOAuthRefreshIntent(provider: string, accountId: string): OAuthRefreshIntent | undefined {
+  const path = getAuthRefreshIntentPath(provider, accountId);
+  try {
+    hardenConfigDir();
+    hardenExistingSecret(path);
+    const value = JSON.parse(readFileSync(path, "utf8")) as Partial<OAuthRefreshIntent>;
+    if (value.version !== 1 || value.provider !== provider || value.accountId !== accountId || typeof value.generation !== "string" || typeof value.createdAt !== "number") {
+      return { version: 1, provider, accountId, generation: "", createdAt: 0, uncertain: true };
+    }
+    return value as OAuthRefreshIntent;
+  } catch (error) {
+    if (errorCode(error) === "ENOENT") return undefined;
+    return { version: 1, provider, accountId, generation: "", createdAt: 0, uncertain: true };
+  }
+}
+export function writeOAuthRefreshIntent(provider: string, accountId: string, generation: string, createdAt = Date.now()): void {
+  const dir = getConfigDir();
+  if (!existsSync(dir)) mkdirSync(dir, { recursive: true, mode: 0o700 });
+  hardenConfigDir();
+  const intent: OAuthRefreshIntent = { version: 1, provider, accountId, generation, createdAt };
+  atomicWriteFile(getAuthRefreshIntentPath(provider, accountId), `${JSON.stringify(intent)}\n`);
+}
+export function clearOAuthRefreshIntent(provider: string, accountId: string, generation: string): boolean {
+  const current = readOAuthRefreshIntent(provider, accountId);
+  if (!current || current.generation !== generation) return false;
+  try { unlinkSync(getAuthRefreshIntentPath(provider, accountId)); return true; }
+  catch (error) { if (errorCode(error) === "ENOENT") return false; throw error; }
+}
 export function credentialGeneration(cred: OAuthCredentials): string {
   return createHash("sha256").update(JSON.stringify([cred.refresh, cred.access, cred.expires])).digest("hex");
 }
@@ -147,6 +179,7 @@ function normalizeAccount(value: unknown): ProviderAccount | null {
   const credential = normalizeCredential(candidate.credential);
   if (!credential) return null;
   const account: ProviderAccount = { id: candidate.id, credential };
+  if (typeof candidate.alias === "string" && candidate.alias.trim()) account.alias = candidate.alias.trim();
   if (candidate.needsReauth === true) account.needsReauth = true;
   if (typeof candidate.addedAt === "number") account.addedAt = candidate.addedAt;
   return account;
@@ -309,6 +342,16 @@ export async function setActiveAccount(provider: string, accountId: string): Pro
   });
 }
 
+export async function setAccountAlias(provider: string, accountId: string, alias: string | undefined): Promise<boolean> {
+  return await mutateStore(store => {
+    const account = store[provider]?.accounts.find(a => a.id === accountId);
+    if (!account) return false;
+    if (alias) account.alias = alias;
+    else delete account.alias;
+    return true;
+  });
+}
+
 /** Remove one account by id; active removal promotes the first remaining account. */
 export async function removeAccount(provider: string, accountId: string): Promise<boolean> {
   return await mutateStore(store => {

package/src/oauth/types.ts

@@ -21,6 +21,8 @@ export type OAuthCredentials = {
 export interface ProviderAccount {
   /** Stable short id, generated once at append time; never re-derived after rotation. */
   id: string;
+  /** User-owned display label; never participates in auth identity or routing. */
+  alias?: string;
   credential: OAuthCredentials;
   /** Terminal refresh failure (invalid_grant / reused / revoked) — re-login required. */
   needsReauth?: boolean;
@@ -34,7 +36,7 @@ export interface ProviderAccountSet {
 }
 
 export interface OAuthController {
-  onAuth?(info: { url: string; instructions?: string }): void;
+  onAuth?(info: { url: string; instructions?: string; deviceCode?: string }): void;
   onProgress?(message: string): void;
   onManualCodeInput?(expectedState?: string): Promise<string>;
   signal?: AbortSignal;

package/src/providers/antigravity-models.ts

@@ -1,13 +1,16 @@
 // Google Antigravity (Cloud Code Assist) bundled model list.
 //
 // Single source of truth: the Antigravity `:fetchAvailableModels` backend, the same one the `agy`
-// CLI resolves labels against. The ids below are the CCA WIRE ids followed by CLIProxyAPI-style
-// client aliases. The CCA envelope's `model` field must receive the wire id (for example
-// "Gemini 3.1 Pro (High)" => gemini-pro-agent), while the picker can expose label-shaped aliases.
+// CLI resolves labels against. The ids below separate CCA wire ids, collapsed picker entries,
+// and hidden compatibility aliases for saved selections. The CCA envelope's `model` field must
+// receive the wire id (for example "Gemini 3.1 Pro (High)" => gemini-pro-agent), while the
+// picker exposes collapsed base models with reasoning-effort routing.
+
+// ── Wire IDs (what CCA :fetchAvailableModels returns) ──
 const ANTIGRAVITY_WIRE_MODELS = [
-  "gemini-3.5-flash-low",
-  "gemini-3-flash-agent",
-  "gemini-3.5-flash-extra-low",
+  "gemini-3.6-flash-low",
+  "gemini-3.6-flash-medium",
+  "gemini-3.6-flash-high",
   "gemini-3.1-pro-low",
   "gemini-pro-agent",
   "claude-sonnet-4-6",
@@ -15,23 +18,76 @@ const ANTIGRAVITY_WIRE_MODELS = [
   "gpt-oss-120b-medium",
 ];
 
-export const ANTIGRAVITY_MODEL_ALIASES: Record<string, string> = {
-  "gemini-3.5-flash-mid": "gemini-3.5-flash-low",
-  "gemini-3.5-flash-high": "gemini-3-flash-agent",
+// ── Effort ladders per collapsed base model ──
+// Gemini models: effort → wire model suffix (official agy UI pattern).
+// Claude Opus: effort → thinkingConfig.thinkingLevel (CLIProxyAPI proven pattern).
+export const ANTIGRAVITY_MODEL_EFFORTS: Record<string, string[]> = {
+  "gemini-3.6-flash": ["low", "medium", "high"],
+  "gemini-3.1-pro": ["low", "high"],
+  "claude-sonnet-4-6": ["low", "medium", "high", "max"],
+  "claude-opus-4-6-thinking": ["low", "medium", "high", "max"],
+};
+
+// ── Effort → wire model map for Gemini base models ──
+const ANTIGRAVITY_EFFORT_WIRE_MAP: Record<string, Record<string, string>> = {
+  "gemini-3.6-flash": {
+    low: "gemini-3.6-flash-low",
+    medium: "gemini-3.6-flash-medium",
+    high: "gemini-3.6-flash-high",
+  },
+  "gemini-3.1-pro": {
+    low: "gemini-3.1-pro-low",
+    high: "gemini-pro-agent",
+  },
+};
+
+// ── Default effort per Gemini base model ──
+const ANTIGRAVITY_DEFAULT_EFFORT: Record<string, string> = {
+  "gemini-3.6-flash": "medium",
+  "gemini-3.1-pro": "high",
+};
+
+// ── Visible client aliases (kept for saved-config compat, not picker-visible) ──
+const ANTIGRAVITY_VISIBLE_MODEL_ALIASES: Record<string, string> = {
   "gemini-3.1-pro-high": "gemini-pro-agent",
   "gemini-3.1-pro-preview": "gemini-pro-agent",
 };
 
+// ── Hidden compatibility aliases for saved selections ──
+// Wire suffix IDs are identity aliases — they resolve to themselves so saved configs
+// with explicit suffixes (e.g. gemini-3.6-flash-low) continue to work.
+const ANTIGRAVITY_COMPATIBILITY_MODEL_ALIASES: Record<string, string> = {
+  "gemini-3.6-flash-low": "gemini-3.6-flash-low",
+  "gemini-3.6-flash-medium": "gemini-3.6-flash-medium",
+  "gemini-3.6-flash-high": "gemini-3.6-flash-high",
+  "gemini-3.1-pro-low": "gemini-3.1-pro-low",
+  "gemini-pro-agent": "gemini-pro-agent",
+  "gemini-3.5-flash-extra-low": "gemini-3.6-flash-low",
+  "gemini-3.5-flash-low": "gemini-3.6-flash-medium",
+  "gemini-3.5-flash-mid": "gemini-3.6-flash-medium",
+  "gemini-3.5-flash-high": "gemini-3.6-flash-high",
+  "gemini-3-flash-agent": "gemini-3.6-flash-high",
+};
+
+export const ANTIGRAVITY_MODEL_ALIASES: Record<string, string> = {
+  ...ANTIGRAVITY_VISIBLE_MODEL_ALIASES,
+  ...ANTIGRAVITY_COMPATIBILITY_MODEL_ALIASES,
+};
+
+// Picker-visible: collapsed base models only.
 export const ANTIGRAVITY_MODELS = [
-  ...ANTIGRAVITY_WIRE_MODELS,
-  ...Object.keys(ANTIGRAVITY_MODEL_ALIASES),
+  "gemini-3.6-flash",
+  "gemini-3.1-pro",
+  "claude-sonnet-4-6",
+  "claude-opus-4-6-thinking",
+  "gpt-oss-120b-medium",
 ];
 
 // Context windows from the upstream `:fetchAvailableModels` maxTokens per model.
 const ANTIGRAVITY_WIRE_MODEL_CONTEXT_WINDOWS: Record<string, number> = {
-  "gemini-3.5-flash-low": 1_048_576,
-  "gemini-3-flash-agent": 1_048_576,
-  "gemini-3.5-flash-extra-low": 1_048_576,
+  "gemini-3.6-flash-low": 1_048_576,
+  "gemini-3.6-flash-medium": 1_048_576,
+  "gemini-3.6-flash-high": 1_048_576,
   "gemini-3.1-pro-low": 1_048_576,
   "gemini-pro-agent": 1_048_576,
   "claude-sonnet-4-6": 200_000,
@@ -40,6 +96,10 @@ const ANTIGRAVITY_WIRE_MODEL_CONTEXT_WINDOWS: Record<string, number> = {
 };
 
 export const ANTIGRAVITY_MODEL_CONTEXT_WINDOWS: Record<string, number> = {
+  // Collapsed base IDs — explicit entries for the picker.
+  "gemini-3.6-flash": 1_048_576,
+  "gemini-3.1-pro": 1_048_576,
+  // Wire IDs and aliases via derivation.
   ...ANTIGRAVITY_WIRE_MODEL_CONTEXT_WINDOWS,
   ...Object.fromEntries(
     Object.entries(ANTIGRAVITY_MODEL_ALIASES).map(([alias, wire]) => [
@@ -52,3 +112,52 @@ export const ANTIGRAVITY_MODEL_CONTEXT_WINDOWS: Record<string, number> = {
 export function resolveAntigravityWireModelId(modelId: string): string {
   return ANTIGRAVITY_MODEL_ALIASES[modelId] ?? modelId;
 }
+
+/**
+ * Whether the given model ID is a suffix wire ID or compat alias that already encodes
+ * an effort level. For these IDs, the caller must NOT send thinkingConfig — the suffix
+ * IS the effort, and sending both creates a contradictory request.
+ */
+export function isAntigravitySuffixModelId(modelId: string): boolean {
+  return !(ANTIGRAVITY_MODELS as string[]).includes(modelId);
+}
+
+/**
+ * Resolve a picker-visible base model + optional reasoning effort to the CCA wire model ID.
+ *
+ * Precedence (evaluated in order):
+ * 1. Suffix wire ID or compat alias → resolve via `resolveAntigravityWireModelId`, no thinkingConfig.
+ * 2. Mapped Gemini base with effort → return mapped wire ID + thinkingLevel.
+ * 3. Mapped Gemini base without effort → return default-effort wire ID, no thinkingConfig.
+ * 4. Claude Opus with effort → return identity + thinkingLevel (no suffix variants exist).
+ * 5. All other IDs → return `resolveAntigravityWireModelId(modelId)`, no thinkingConfig.
+ */
+export function resolveAntigravityEffortWireModel(
+  modelId: string,
+  effort?: string,
+): { wireModelId: string; thinkingLevel?: string } {
+  // Rule 1: suffix/compat alias — suffix IS the effort.
+  if (isAntigravitySuffixModelId(modelId)) {
+    return { wireModelId: resolveAntigravityWireModelId(modelId) };
+  }
+
+  // Rule 2/3: mapped Gemini base model.
+  const effortMap = ANTIGRAVITY_EFFORT_WIRE_MAP[modelId];
+  if (effortMap) {
+    if (effort && effort in effortMap) {
+      return { wireModelId: effortMap[effort]!, thinkingLevel: effort };
+    }
+    const defaultEffort = ANTIGRAVITY_DEFAULT_EFFORT[modelId]!;
+    return { wireModelId: effortMap[defaultEffort]! };
+  }
+
+  // Rule 4: Claude models — effort via thinkingConfig only (no suffix variants).
+  // Anthropic adaptive thinking supports low/medium/high/max for both Sonnet 4.6 and Opus 4.6.
+  // CLIProxyAPI proves CCA accepts thinkingConfig on base IDs (validation confirmed).
+  if (/^claude-/.test(modelId) && effort) {
+    return { wireModelId: modelId, thinkingLevel: effort };
+  }
+
+  // Rule 5: everything else.
+  return { wireModelId: resolveAntigravityWireModelId(modelId) };
+}

package/src/providers/api-keys.ts

@@ -102,6 +102,18 @@ export function setActiveProviderApiKey(config: OcxConfig, name: string, id: str
   return true;
 }
 
+/** Rename a key slot without changing its id, secret, or active routing state. */
+export function setProviderApiKeyLabel(config: OcxConfig, name: string, id: string, label: string | undefined): boolean {
+  const provider = config.providers[name];
+  if (!provider || !isKeyAuthProvider(provider)) return false;
+  const entry = ensurePool(provider).find(e => e.id === id);
+  if (!entry) return false;
+  if (label) entry.label = label;
+  else delete entry.label;
+  saveConfig(config);
+  return true;
+}
+
 /** Remove one key; removing the active one promotes the first remaining. Persists config. */
 export function removeProviderApiKey(config: OcxConfig, name: string, id: string): boolean {
   const provider = config.providers[name];

package/src/providers/openrouter-routing.ts

@@ -0,0 +1,102 @@
+import type { OcxProviderConfig, OpenRouterProviderRouting } from "../types";
+
+const ROUTING_KEYS = new Set(["order", "only", "allowFallbacks"]);
+const MAX_PROVIDER_SLUGS = 64;
+
+function isPlainRecord(value: unknown): value is Record<string, unknown> {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
+
+export function isCanonicalOpenRouterTarget(baseUrl: string): boolean {
+  try {
+    const url = new URL(baseUrl);
+    return url.origin === "https://openrouter.ai"
+      && !url.username
+      && !url.password
+      && !url.search
+      && !url.hash
+      && url.pathname.replace(/\/+$/, "") === "/api/v1";
+  } catch {
+    return false;
+  }
+}
+
+function routingPreferenceError(value: unknown, field: string): string | null {
+  if (!isPlainRecord(value)) return `${field} must be a plain object`;
+  const unknown = Object.keys(value).find(key => !ROUTING_KEYS.has(key));
+  if (unknown) return `${field} contains unknown field "${unknown}"`;
+
+  for (const listField of ["order", "only"] as const) {
+    const list = value[listField];
+    if (list === undefined) continue;
+    if (!Array.isArray(list) || list.length === 0 || list.length > MAX_PROVIDER_SLUGS) {
+      return `${field}.${listField} must contain 1-${MAX_PROVIDER_SLUGS} provider slugs`;
+    }
+    const seen = new Set<string>();
+    for (const slug of list) {
+      if (typeof slug !== "string" || !slug.trim() || slug !== slug.trim() || slug.length > 128) {
+        return `${field}.${listField} must contain nonblank trimmed provider slugs up to 128 characters`;
+      }
+      if (seen.has(slug)) return `${field}.${listField} must not contain duplicate provider slugs`;
+      seen.add(slug);
+    }
+  }
+  if (value.allowFallbacks !== undefined && typeof value.allowFallbacks !== "boolean") {
+    return `${field}.allowFallbacks must be a boolean`;
+  }
+  if (value.order === undefined && value.only === undefined && value.allowFallbacks === undefined) {
+    return `${field} must define order, only, or allowFallbacks`;
+  }
+  return null;
+}
+
+export function openRouterRoutingConfigError(provider: OcxProviderConfig): string | null {
+  const hasDefault = provider.openRouterRouting !== undefined;
+  const hasModels = provider.modelOpenRouterRouting !== undefined;
+  if (!hasDefault && !hasModels) return null;
+  if (provider.adapter !== "openai-chat") {
+    return "OpenRouter routing preferences require the openai-chat adapter";
+  }
+  if (!isCanonicalOpenRouterTarget(provider.baseUrl)) {
+    return "OpenRouter routing preferences require the canonical https://openrouter.ai/api/v1 baseUrl";
+  }
+  if (hasDefault) {
+    const error = routingPreferenceError(provider.openRouterRouting, "openRouterRouting");
+    if (error) return error;
+  }
+  if (hasModels) {
+    const routes = provider.modelOpenRouterRouting;
+    if (!isPlainRecord(routes)) return "modelOpenRouterRouting must be a plain object";
+    for (const [modelId, preference] of Object.entries(routes)) {
+      if (!modelId.trim() || modelId !== modelId.trim()) {
+        return "modelOpenRouterRouting keys must be nonblank trimmed model ids";
+      }
+      const error = routingPreferenceError(preference, `modelOpenRouterRouting.${modelId}`);
+      if (error) return error;
+    }
+  }
+  return null;
+}
+
+export function resolveOpenRouterRouting(
+  provider: OcxProviderConfig,
+  modelId: string,
+): OpenRouterProviderRouting | undefined {
+  if (!isCanonicalOpenRouterTarget(provider.baseUrl)) return undefined;
+  const modelRoutes = provider.modelOpenRouterRouting;
+  return modelRoutes && Object.hasOwn(modelRoutes, modelId)
+    ? modelRoutes[modelId]
+    : provider.openRouterRouting;
+}
+
+export function openRouterProviderPayload(
+  preference: OpenRouterProviderRouting,
+): Record<string, unknown> {
+  return {
+    ...(preference.order ? { order: [...preference.order] } : {}),
+    ...(preference.only ? { only: [...preference.only] } : {}),
+    ...(preference.allowFallbacks !== undefined ? { allow_fallbacks: preference.allowFallbacks } : {}),
+  };
+}

package/src/providers/registry.ts

@@ -1,6 +1,6 @@
 import type { CodexAccountMode, OcxProviderConfig } from "../types";
 import { KIRO_MODELS, KIRO_MODEL_CONTEXT_WINDOWS, KIRO_MODEL_REASONING_EFFORTS } from "./kiro-models";
-import { ANTIGRAVITY_MODELS, ANTIGRAVITY_MODEL_CONTEXT_WINDOWS } from "./antigravity-models";
+import { ANTIGRAVITY_MODELS, ANTIGRAVITY_MODEL_CONTEXT_WINDOWS, ANTIGRAVITY_MODEL_EFFORTS } from "./antigravity-models";
 import type { ProviderBaseUrlChoice } from "./base-url-choices";
 import {
   QWEN_CLOUD_BASE_URL_CHOICES, QWEN_CLOUD_TOKEN_PLAN_BASE_URL,
@@ -65,6 +65,8 @@ export interface ProviderRegistryEntry {
   noPenaltyModels?: string[];
   /** Opt this provider into parallel tool calls (see OcxProviderConfig.parallelToolCalls). */
   parallelToolCalls?: boolean;
+  /** Opt this provider into forwarding prompt_cache_key (OpenAI-specific; strict backends reject it). */
+  promptCacheKey?: boolean;
   autoToolChoiceOnlyModels?: string[];
   preserveReasoningContentModels?: string[];
   thinkingToggleModels?: string[];
@@ -196,36 +198,42 @@ const ALIBABA_TOKEN_PLAN_QWEN_MODELS = [
 ];
 const ALIBABA_TOKEN_PLAN_INPUT_MODALITIES: Record<string, string[]> = {
   "qwen3.8-max-preview": ["text", "image"],
-  "qwen3.7-max": ["text"],
+  "qwen3.7-max": ["text", "image"],
   "qwen3.7-plus": ["text", "image"],
   "qwen3.6-flash": ["text", "image"],
   "glm-5.2": ["text"],
   "deepseek-v4-pro": ["text"],
 };
 
-// 260721 Alibaba Token Plan International (ap-southeast-1 / Singapore).
+// 260721 Alibaba Token Plan International (ap-southeast-1 / Singapore, hardened 260721).
 // Multi-vendor lineup distinct from Beijing — includes DeepSeek V4 flash, Kimi K2.7, MiniMax.
 // Evidence: https://www.alibabacloud.com/help/en/model-studio/token-plan-overview
+//           https://qwencloud.com/pricing/token-plan (qwen3.8 metadata)
 const ALIBABA_INTL_TOKEN_PLAN_MODELS = [
-  "qwen3.7-max", "qwen3.7-plus", "qwen3.6-plus", "qwen3.6-flash",
+  "qwen3.8-max-preview", "qwen3.7-max", "qwen3.7-plus", "qwen3.6-plus", "qwen3.6-flash",
   "deepseek-v4-pro", "deepseek-v4-flash", "deepseek-v3.2",
-  "kimi-k2.7-code",
-  "glm-5.2",
+  "kimi-k2.7-code", "kimi-k2.6", "kimi-k2.5",
+  "glm-5.2", "glm-5.1", "glm-5",
   "MiniMax-M2.5",
 ];
 const ALIBABA_INTL_TOKEN_PLAN_QWEN_MODELS = [
-  "qwen3.7-max", "qwen3.7-plus", "qwen3.6-plus", "qwen3.6-flash",
+  "qwen3.8-max-preview", "qwen3.7-max", "qwen3.7-plus", "qwen3.6-plus", "qwen3.6-flash",
 ];
 const ALIBABA_INTL_TOKEN_PLAN_INPUT_MODALITIES: Record<string, string[]> = {
-  "qwen3.7-max": ["text"],
+  "qwen3.8-max-preview": ["text", "image"],
+  "qwen3.7-max": ["text", "image"],
   "qwen3.7-plus": ["text", "image"],
   "qwen3.6-plus": ["text", "image"],
   "qwen3.6-flash": ["text", "image"],
   "deepseek-v4-pro": ["text"],
   "deepseek-v4-flash": ["text"],
   "deepseek-v3.2": ["text"],
-  "kimi-k2.7-code": ["text"],
+  "kimi-k2.7-code": ["text", "image"],
+  "kimi-k2.6": ["text", "image"],
+  "kimi-k2.5": ["text", "image"],
   "glm-5.2": ["text"],
+  "glm-5.1": ["text"],
+  "glm-5": ["text"],
   "MiniMax-M2.5": ["text"],
 };
 
@@ -632,9 +640,11 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
   // devlog/_plan/260710_provider_hardening/001_research_frontier.md.
   {
     id: "google", label: "Google Gemini", adapter: "google", baseUrl: "https://generativelanguage.googleapis.com", authKind: "key", featured: true,
-    dashboardUrl: "https://aistudio.google.com/apikey", defaultModel: "gemini-3.5-flash", models: ["gemini-3.5-flash", "gemini-3.1-pro-preview"],
-    modelContextWindows: { "gemini-3.5-flash": 1_000_000 },
+    dashboardUrl: "https://aistudio.google.com/apikey", defaultModel: "gemini-3.5-flash", models: ["gemini-3.6-flash", "gemini-3.5-flash", "gemini-3.5-flash-lite", "gemini-3.1-pro-preview"],
+    modelContextWindows: { "gemini-3.6-flash": 1_048_576, "gemini-3.5-flash": 1_000_000, "gemini-3.5-flash-lite": 1_048_576 },
+    modelInputModalities: { "gemini-3.6-flash": ["text", "image"], "gemini-3.5-flash-lite": ["text", "image"] },
     modelReasoningEfforts: {
+      "gemini-3.6-flash": ["minimal", "low", "medium", "high"],
       "gemini-3.5-flash": ["minimal", "low", "medium", "high"],
       "gemini-3.1-pro-preview": ["low", "medium", "high"],
     },
@@ -643,7 +653,7 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
   // 2026-07-10: defaultModel is frozen pending Vertex-specific Tier-2 evidence; Gemini API
   // evidence from ai.google.dev does not establish Vertex publisher availability.
   { id: "google-vertex", label: "Google Vertex AI", adapter: "google", baseUrl: "https://aiplatform.googleapis.com", authKind: "key", dashboardUrl: "https://console.cloud.google.com/vertex-ai", defaultModel: "gemini-3-pro", googleMode: "vertex", jawcodeBundle: "google", extraMetadataAliases: ["gemini-vertex"] },
-  { id: "google-antigravity", label: "Google Antigravity", adapter: "google", baseUrl: "https://daily-cloudcode-pa.googleapis.com", authKind: "oauth", dashboardUrl: "https://antigravity.google", models: ANTIGRAVITY_MODELS, defaultModel: "gemini-3.5-flash-low", modelContextWindows: ANTIGRAVITY_MODEL_CONTEXT_WINDOWS, googleMode: "cloud-code-assist", jawcodeBundle: "google", extraMetadataAliases: ["antigravity", "gemini-antigravity"] },
+  { id: "google-antigravity", label: "Google Antigravity", adapter: "google", baseUrl: "https://daily-cloudcode-pa.googleapis.com", authKind: "oauth", dashboardUrl: "https://antigravity.google", models: ANTIGRAVITY_MODELS, defaultModel: "gemini-3.6-flash", modelContextWindows: ANTIGRAVITY_MODEL_CONTEXT_WINDOWS, modelReasoningEfforts: ANTIGRAVITY_MODEL_EFFORTS, googleMode: "cloud-code-assist", jawcodeBundle: "google", extraMetadataAliases: ["antigravity", "gemini-antigravity"] },
   { id: "azure-openai", label: "Azure OpenAI", adapter: "azure-openai", baseUrl: "https://{resource}.openai.azure.com/openai", authKind: "key", featured: true, dashboardUrl: "https://portal.azure.com" },
   { id: "ollama", label: "Ollama (local)", adapter: "openai-chat", baseUrl: "http://localhost:11434/v1", authKind: "local", allowPrivateNetworkByDefault: true, allowBaseUrlOverride: true, featured: true, note: "Local — key usually blank" },
   { id: "vllm", label: "vLLM (local)", adapter: "openai-chat", baseUrl: "http://localhost:8000/v1", authKind: "local", allowPrivateNetworkByDefault: true, allowBaseUrlOverride: true, featured: true, note: "Local — key usually blank" },
@@ -762,6 +772,10 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
     liveModels: false,
     note: "Token Plan Personal Edition · China (Beijing)",
     modelInputModalities: ALIBABA_TOKEN_PLAN_INPUT_MODALITIES,
+    modelContextWindows: {
+      "qwen3.8-max-preview": 983_616, "qwen3.7-max": 1_000_000, "qwen3.7-plus": 1_000_000,
+      "qwen3.6-flash": 1_000_000, "glm-5.2": 1_000_000, "deepseek-v4-pro": 1_000_000,
+    },
     modelReasoningEfforts: {
       ...Object.fromEntries(ALIBABA_TOKEN_PLAN_QWEN_MODELS.map(id => [id, THINKING_BUDGET_EFFORTS])),
       "glm-5.2": ZAI_GLM_52_REASONING_EFFORTS,
@@ -769,7 +783,8 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
     },
     modelReasoningEffortMap: { "deepseek-v4-pro": DEEPSEEK_THINKING_REASONING_MAP },
     thinkingBudgetModels: ALIBABA_TOKEN_PLAN_QWEN_MODELS,
-    preserveReasoningContentModels: ["glm-5.2", "deepseek-v4-pro", "qwen3.8-max-preview"],
+    preserveReasoningContentModels: ["glm-5.2", "deepseek-v4-pro", "qwen3.8-max-preview", "qwen3.7-max", "qwen3.7-plus", "qwen3.6-flash"],
+    noVisionModels: ["glm-5.2", "deepseek-v4-pro"],
   },
   {
     id: "alibaba-token-plan-intl",
@@ -786,9 +801,17 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
    note: "Token Plan Team Edition · Singapore (ap-southeast-1)",
     metadataModelIdNormalize: "case-insensitive",
    modelInputModalities: ALIBABA_INTL_TOKEN_PLAN_INPUT_MODALITIES,
-    modelContextWindows: { "deepseek-v4-pro": 1_000_000, "deepseek-v4-flash": 1_000_000, "glm-5.2": 1_000_000 },
+    modelContextWindows: {
+      "qwen3.8-max-preview": 983_616,
+      "qwen3.7-max": 1_000_000, "qwen3.7-plus": 1_000_000, "qwen3.6-plus": 1_000_000, "qwen3.6-flash": 1_000_000,
+      "deepseek-v4-pro": 1_000_000, "deepseek-v4-flash": 1_000_000, "deepseek-v3.2": 131_072,
+      "kimi-k2.7-code": 262_144, "kimi-k2.6": 262_144, "kimi-k2.5": 262_144,
+      "glm-5.2": 1_000_000, "glm-5.1": 1_000_000, "glm-5": 1_000_000,
+      "MiniMax-M2.5": 204_800,
+    },
     modelReasoningEfforts: {
       ...Object.fromEntries(ALIBABA_INTL_TOKEN_PLAN_QWEN_MODELS.map(id => [id, THINKING_BUDGET_EFFORTS])),
+      "qwen3.8-max-preview": ["low", "high", "xhigh"],
       "glm-5.2": ZAI_GLM_52_REASONING_EFFORTS,
       "deepseek-v4-pro": DEEPSEEK_THINKING_EFFORTS,
       "deepseek-v4-flash": DEEPSEEK_THINKING_EFFORTS,
@@ -798,9 +821,10 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
       "deepseek-v4-flash": DEEPSEEK_THINKING_REASONING_MAP,
     },
     thinkingBudgetModels: ALIBABA_INTL_TOKEN_PLAN_QWEN_MODELS,
-   preserveReasoningContentModels: ["glm-5.2", "deepseek-v4-pro", "deepseek-v4-flash", "qwen3.7-max"],
-   noVisionModels: ["deepseek-v4-pro", "deepseek-v4-flash", "deepseek-v3.2", "kimi-k2.7-code", "glm-5.2", "MiniMax-M2.5", "qwen3.7-max"],
-    noReasoningModels: ["kimi-k2.7-code", "deepseek-v3.2", "MiniMax-M2.5"],
+    preserveReasoningContentModels: ["glm-5.2", "deepseek-v4-pro", "deepseek-v4-flash", "qwen3.8-max-preview", "qwen3.7-max", "qwen3.7-plus", "qwen3.6-plus", "qwen3.6-flash"],
+    noVisionModels: ["deepseek-v4-pro", "deepseek-v4-flash", "deepseek-v3.2", "glm-5.2", "glm-5.1", "glm-5", "MiniMax-M2.5"],
+    noReasoningModels: ["kimi-k2.7-code", "kimi-k2.6", "kimi-k2.5", "deepseek-v3.2", "glm-5.1", "glm-5", "MiniMax-M2.5"],
+    modelDefaultReasoningEfforts: { "qwen3.8-max-preview": "xhigh" },
   },
   // NEEDS_HUMAN 2026-07-10: kept for config compatibility, but this is a dashboard URL,
   // no /models endpoint is documented, and tools are silently ignored upstream per docs.parallel.ai.

package/src/router.ts

@@ -182,6 +182,7 @@ function routedProviderConfig(providerName: string, provider: OcxProviderConfig)
     // Scalar backfill: a persisted config created before the flag shipped inherits the registry
     // opt-in, while an explicit user `false` keeps overriding registry `true`.
     ...(provider.parallelToolCalls === undefined && registryEntry.parallelToolCalls !== undefined ? { parallelToolCalls: registryEntry.parallelToolCalls } : {}),
+    ...(provider.promptCacheKey === undefined && registryEntry.promptCacheKey !== undefined ? { promptCacheKey: registryEntry.promptCacheKey } : {}),
     ...(modelContextWindows ? { modelContextWindows } : {}),
     ...(modelInputModalities ? { modelInputModalities } : {}),
     ...(modelMaxInputTokens ? { modelMaxInputTokens } : {}),
@@ -208,7 +209,7 @@ function activeProviderEntries(config: OcxConfig): [string, OcxProviderConfig][]
 
 export class NoEnabledOpenAiProviderError extends Error {
   constructor(modelId: string) {
-    super(`No enabled canonical OpenAI provider for model: ${modelId}`);
+    super(`No enabled OpenAI provider for model: ${modelId}. Run 'ocx init' to configure a provider, or check that your config has an enabled 'openai' provider.`);
     this.name = "NoEnabledOpenAiProviderError";
   }
 }

package/src/server/auth-cors.ts

@@ -10,6 +10,7 @@ import { providerDestinationConfigError } from "../lib/destination-policy";
 import { getProviderRegistryEntry, providerCodexAccountMode } from "../providers/registry";
 import { providerConfigSeed } from "../providers/derive";
 import type { OcxConfig, OcxProviderConfig } from "../types";
+import { openRouterRoutingConfigError } from "../providers/openrouter-routing";
 
 let _corsOrigin = "http://localhost:10100";
 export function setCorsOrigin(port: number): void { _corsOrigin = `http://localhost:${port}`; }
@@ -226,6 +227,8 @@ export function providerManagementConfigError(name: unknown, provider: unknown):
   if (headersError) return `provider ${name} ${headersError}`;
   const maxInputError = positiveIntegerRecordConfigError(raw.modelMaxInputTokens, "modelMaxInputTokens");
   if (maxInputError) return `provider ${name} ${maxInputError}`;
+  const openRouterError = openRouterRoutingConfigError(typed);
+  if (openRouterError) return `provider ${name} ${openRouterError}`;
   if (typed.authMode === "local") {
     // "local" bypasses key-requirement enforcement (api-keys/key-failover treat non-oauth/
     // forward as key auth; openai-chat skips credential checks for local). Only providers
@@ -290,6 +293,8 @@ export function safeConfigDTO(config: OcxConfig): unknown {
       "models",
       "contextWindow",
       "modelContextWindows",
+      "openRouterRouting",
+      "modelOpenRouterRouting",
       "reasoningEfforts",
       "modelReasoningEfforts",
       "noVisionModels",

package/src/server/index.ts

@@ -537,7 +537,7 @@ export function startServer(port?: number) {
         void (async () => {
           const start = Date.now();
           const requestId = nextRequestLogId(start);
-          const logCtx = { model: "unknown", provider: "unknown" };
+          const logCtx: RequestLogContext = { model: "unknown", provider: "unknown" };
           let logged = false;
           const finalizeLog = (
             status: number,
@@ -556,7 +556,7 @@ export function startServer(port?: number) {
             body: JSON.stringify({ ...payload, stream: true }),
           });
           try {
-            let terminalRecorder: ((status: ResponsesTerminalStatus) => void) | undefined;
+            let terminalRecorder: ((status: ResponsesTerminalStatus, httpStatusOverride?: number) => void) | undefined;
             const response = await handleResponses(req, config, logCtx, {
               forceEmptyResponseId: true,
               abortSignal: turnAbort.signal,
@@ -570,7 +570,7 @@ export function startServer(port?: number) {
             await sendResponseToWebSocket(ws, response, isCurrent, {
               onSsePayload: payload => inspectResponseLogSsePayload(logCtx, payload),
               onTerminal: status => {
-                terminalRecorder?.(status);
+                terminalRecorder?.(status, logCtx.terminalHttpStatus);
                 finalizeLog(httpStatusForRequestLogTerminal(status, logCtx), {
                   terminalStatus: status,
                   closeReason: "terminal",