@bitkyc08/opencodex 2.72.0 → 2.73.0

package/src/server/responses/request-transport.ts

@@ -15,8 +15,10 @@ import type { AdapterEvent, OcxParsedRequest, OcxProviderConfig, OcxUsage } from
 import type { AnthropicAccountSelectionReason } from "../../oauth/anthropic-routing";
 import { resolveAnthropicModelRoute, routeCandidates, type AnthropicRouteDecision } from "../../oauth/anthropic-model-routes";
 import {
+  resolveAnthropicDispatchAccountId,
   isAnthropicAccountPoolEnabled,
   getAnthropicPoolAccessSnapshot,
+  getAnthropicAccountHealthSnapshot,
   getEligibleAnthropicAccounts,
   commitAnthropicSelectionRouting,
   formatAnthropicProviderForLog,
@@ -191,9 +193,13 @@ export async function prepareResponsesTransport(
       // Resolve that choice, not the rejected candidate, before trying admission again.
       oauthSelection = captureOAuthAccountSelection(route.providerName);
       if (!oauthSelection) return null;
-      const revisedAnthropicId = route.providerName === "anthropic" && anthropicRouteDecision
-        ? resolveAnthropicAccountForSession(anthropicSessionKey, config, Date.now(), anthropicRouteDecision).accountId : null;
-      if (route.providerName === "anthropic" && anthropicRouteDecision && !revisedAnthropicId) return null;
+      // A revision also changes on per-account policy edits. Re-evaluate the selector
+      // after credential waits even without a model route, rather than reusing stale active.
+      const revisedAnthropic = route.providerName === "anthropic"
+        ? resolveAnthropicAccountForSession(anthropicSessionKey, config, Date.now(), anthropicRouteDecision) : null;
+      const revisedAnthropicId = revisedAnthropic?.accountId;
+      if (route.providerName === "anthropic" && !revisedAnthropicId) return null;
+      if (revisedAnthropic) anthropicReason = revisedAnthropic.reason;
       candidate = route.providerName === "anthropic"
         ? await getAnthropicPoolAccessSnapshot(revisedAnthropicId ?? oauthSelection.accountId)
         : await getValidAccessSnapshotForAccount(route.providerName, oauthSelection.accountId, { requireUsableAccount: true });
@@ -337,7 +343,8 @@ export async function prepareResponsesTransport(
     const selected = captureOAuthAccountSelection(route.providerName);
     const row = getAccountCredentialWithStatus(route.providerName, binding.snapshot.accountId);
     return selected?.accountId === binding.selection.accountId && selected?.revision === binding.selection.revision
-      && !!row && !row.needsReauth && row.credential.expires > Date.now()
+      && !!row && !row.paused && !row.needsReauth && row.credential.expires > Date.now()
+      && (route.providerName !== "anthropic" || !getAnthropicAccountHealthSnapshot(binding.snapshot.accountId))
       && credentialGeneration(row.credential) === binding.snapshot.generation;
   };
   const resolveSelectionAdapter = (provider: OcxProviderConfig, retention = config.cacheRetention): ProviderAdapter => {
@@ -399,7 +406,16 @@ export async function prepareResponsesTransport(
   };
   const refreshDispatchAdapter = async (requestParsed: OcxParsedRequest): Promise<ProviderAdapter> => {
     if (route.provider.authMode === "oauth") {
-      if (!servingOAuthSnapshot || !await applyFailoverSnapshot(servingOAuthSnapshot, requestParsed)) {
+      // Pacing may outlive admission. Preserve local pause/cooldown reasons even when
+      // a strict route rejects the old proposal before another bearer can be resolved.
+      let candidate = servingOAuthSnapshot;
+      if (route.providerName === "anthropic") {
+        oauthSelection = captureOAuthAccountSelection(route.providerName);
+        const accountId = await resolveAnthropicDispatchAccountId(config, anthropicSessionKey, anthropicRouteDecision);
+        candidate = await getAnthropicPoolAccessSnapshot(accountId);
+      }
+      if (!candidate || !await applyFailoverSnapshot(candidate, requestParsed)) {
+        if (route.providerName === "anthropic") await resolveAnthropicDispatchAccountId(config, anthropicSessionKey, anthropicRouteDecision);
         throw new Error("OAuth account selection changed before dispatch");
       }
     } else {
@@ -561,6 +577,7 @@ export async function prepareResponsesTransport(
         anthropicRouteDecision = routeResult.decision;
         const selection = resolveAnthropicAccountForSession(anthropicSessionKey, config, Date.now(), anthropicRouteDecision);
         if (!selection.accountId) {
+          if (selection.reason === "paused") return formatErrorResponse(403, "permission_error", "Anthropic OAuth accounts are paused. Resume an account in account settings and retry.");
           // Route names may resemble account IDs; log only the matched rule position.
           if (anthropicRouteDecision) console.warn(`[anthropic-pool] route:#${anthropicRouteDecision.position} ${selection.reason}; answering locally`);
           if (selection.reason === "all-cooled") {

package/src/server/responses/terminal-error-redaction.ts

@@ -0,0 +1,53 @@
+import { REDACTED_SECRET, SENSITIVE_KEY_PATTERN, redactSecrets } from "../../lib/redact";
+import { replaceSseDataPayload, sseDataPayload, type SseBlockRewrite } from "../sse-payload-rewrite";
+
+/** Mask the selected outbound credential even when upstream echoes only its raw value. */
+export function createOutboundCredentialMask(outboundHeaders: Record<string, string>): (text: string) => string {
+  const knownSecrets = Object.entries(outboundHeaders)
+    .filter(([name]) => SENSITIVE_KEY_PATTERN.test(name))
+    .flatMap(([name, value]) => {
+      const credential = /^(?:authorization|proxy-authorization)$/i.test(name)
+        ? value.replace(/^\S+\s+/, "")
+        : value;
+      return credential ? [credential] : [];
+    })
+    .sort((a, b) => b.length - a.length);
+  return (text) => knownSecrets.reduce((safe, secret) => safe.replaceAll(secret, REDACTED_SECRET), text);
+}
+
+/** Mask upstream diagnostics before either SSE delivery or buffered JSON reconstruction. */
+export function createTerminalErrorRedactionBlockRewrite(
+  outboundHeaders: Record<string, string>,
+  maskCredential = createOutboundCredentialMask(outboundHeaders),
+): SseBlockRewrite {
+  const redactDiagnostic = (value: unknown): unknown => {
+    const safe = redactSecrets(value);
+    const maskKnown = (entry: unknown): unknown => {
+      if (typeof entry === "string") return maskCredential(entry);
+      if (Array.isArray(entry)) return entry.map(maskKnown);
+      if (entry && typeof entry === "object") {
+        return Object.fromEntries(Object.entries(entry).map(([key, item]) => [key, maskKnown(item)]));
+      }
+      return entry;
+    };
+    return maskKnown(safe);
+  };
+  return (block) => {
+    const terminalFrame = /^event:[ \t]*response\.(?:failed|incomplete)[ \t]*\r?$/m.test(block);
+    const payload = sseDataPayload(block);
+    if (payload === null) return [terminalFrame ? maskCredential(block) : block];
+    let event: Record<string, unknown>;
+    try {
+      event = JSON.parse(payload) as Record<string, unknown>;
+    } catch {
+      return [terminalFrame ? maskCredential(block) : block];
+    }
+    if (event?.type !== "response.failed" && event?.type !== "response.incomplete") {
+      return [terminalFrame ? maskCredential(block) : block];
+    }
+    const safeEvent = redactDiagnostic(event);
+    const rewritten = JSON.stringify(safeEvent);
+    // SSE comments and extension fields can also carry upstream text.
+    return [maskCredential(rewritten === payload ? block : replaceSseDataPayload(block, rewritten))];
+  };
+}

package/src/service/windows-taskxml.ts

@@ -427,6 +427,25 @@ function taskXmlDecodedLossyValueEquals(xml: string, tag: string, expected: stri
   return taskXmlLossyValueEquals(taskXmlDecodeEntities(value), expected);
 }
 
+/** Accept only the single Exec action emitted for this launcher's task. */
+export function windowsTaskActionMatches(
+  xml: string,
+  launcher: string,
+  wscript = windowsWscript(),
+  allowLossyPaths = false,
+): boolean {
+  const scrubbed = taskXmlWithoutCommentsAndCdata(xml);
+  if (taskXmlElementCount(scrubbed, "Data") > 0 || taskXmlHasPrefixedTag(scrubbed, "Data")
+    || taskXmlHasPrefixedTag(scrubbed, "Actions") || taskXmlHasPrefixedTag(scrubbed, "Exec")
+    || taskXmlElementCount(scrubbed, "Actions") !== 1 || taskXmlElementCount(scrubbed, "Exec") !== 1) return false;
+  const actions = taskXmlSection(scrubbed, "Actions");
+  const exec = /<Exec(?:\s[^>]*)?>([\s\S]*?)<\/Exec>/i.exec(actions);
+  if (!exec || actions.replace(exec[0], "").trim() !== "") return false;
+  const equals = allowLossyPaths ? taskXmlDecodedLossyValueEquals : taskXmlDecodedValueEquals;
+  return equals(exec[1]!, "Command", wscript)
+    && equals(exec[1]!, "Arguments", `/b /nologo "${launcher}"`);
+}
+
 export function taskXmlOptionalValueEquals(xml: string, tag: string, expected: string): boolean {
   // Check the prefixed form first: treating `<t:Enabled>false</t:Enabled>` as an
   // omission would turn an explicitly disabled task into a healthy one.
@@ -520,7 +539,6 @@ function windowsTaskRegistrationBaseHealthy(
   const trigger = taskXmlSection(triggers, "LogonTrigger");
   const principal = taskXmlSection(scrubbed, "Principal");
   const settings = taskXmlSection(scrubbed, "Settings");
-  const action = taskXmlSection(scrubbed, "Exec");
   // A self-closing <LogonTrigger /> leaves an empty section, so look for the element
   // itself — scoped to <Triggers> so a decoy elsewhere cannot satisfy it.
   return taskXmlElementCount(triggers, "LogonTrigger") > 0
@@ -538,11 +556,7 @@ function windowsTaskRegistrationBaseHealthy(
     // cannot carry when the profile is named outside the code page (#3064). Only
     // unrepresentable characters are forgiven; every ASCII segment and every
     // separator is still matched literally.
-    && (allowLossyPaths
-      ? taskXmlDecodedLossyValueEquals(action, "Command", wscript)
-        && taskXmlDecodedLossyValueEquals(action, "Arguments", `/b /nologo "${launcher}"`)
-      : taskXmlDecodedValueEquals(action, "Command", wscript)
-        && taskXmlDecodedValueEquals(action, "Arguments", `/b /nologo "${launcher}"`));
+    && windowsTaskActionMatches(xml, launcher, wscript, allowLossyPaths);
 }
 
 /** Validate the security/lifecycle-critical fields of the registered scheduler task. */

package/src/service-manager-probe.ts

@@ -28,6 +28,10 @@ import {
 } from "./lib/windows-elevation";
 import { decodeWindowsTextBytes } from "./lib/windows-text";
 import { WINSW_SERVICE_ID } from "./lib/winsw";
+import { BUN_RUNTIME_PATH_ENV, BUN_RUNTIME_SOURCE_ENV } from "./lib/bun-runtime";
+import { WINDOWS_WRAPPER_PROTOCOL_ENV, WINDOWS_WRAPPER_STAY_OUT_EXIT_CODE } from "./service/windows-wrapper-exit";
+import { buildWindowsServiceScript, windowsTaskActionMatches } from "./service/windows-taskxml";
+import { inspectServiceStateEvidence, serviceStatePathsForOpenCodexHome } from "./service/state";
 
 /** Short: this runs inside admission, and a slow answer is the same as none. */
 export const SERVICE_PROBE_TIMEOUT_MS = 2_000;
@@ -192,6 +196,8 @@ export interface ProbeDeps {
   readonly windowsLocale?: string;
   /** Startup-local full-listing cache; targeted task queries always bypass it. */
   readonly windowsTaskListingCache?: WindowsTaskListingCache;
+  /** Service-state evidence paths; production derives them from the effective config home. */
+  readonly statePaths?: readonly string[];
 }
 
 const LABEL = "com.opencodex.proxy";
@@ -559,9 +565,95 @@ function decodeBatchPathValue(
     .replaceAll(escapedPercent, "%");
 }
 
-/** Validate the generated wrapper before interpreting omitted optional homes. */
-function wrapperLooksGenerated(body: string): boolean {
-  return /:loop\s*[\s\S]*^"%OCX_BUN%" "%OCX_CLI%" start\b[^\r\n]*$/im.test(body);
+/** One generated quoted assignment, rejecting unquoted and duplicate forms. */
+function generatedBatchSetValue(body: string, name: string): string | null {
+  const assignments = body.split(/\r?\n/).filter(line => new RegExp(`^\\s*@?set\\s+"?${name}=`, "i").test(line));
+  return assignments.length === 1 ? batchSetValue(assignments[0]!, name) : null;
+}
+
+/** Compare executable lines with the actual standalone generator's ordered script. */
+function matchesGeneratedStandaloneControlFlow(body: string, port: number): boolean {
+  const scriptLines = (script: string): string[] => {
+    const lines = script.replace(/\r\n/g, "\n").split("\n");
+    if (lines.at(-1) === "") lines.pop();
+    return lines;
+  };
+  const lines = scriptLines(body);
+  const expected = scriptLines(buildWindowsServiceScript({
+    bun: "C:\\OpenCodex\\ocx.exe", bunRuntimeSource: "standalone", cli: null,
+  }, port, []));
+  const tokenBlock = 'if exist "%OCX_API_TOKEN_FILE%" (';
+  const boundary = lines.indexOf(tokenBlock);
+  const expectedBoundary = expected.indexOf(tokenBlock);
+  if (boundary < 0 || expectedBoundary < 0) return false;
+  const allowed = [
+    "OCX_SERVICE", WINDOWS_WRAPPER_PROTOCOL_ENV, BUN_RUNTIME_SOURCE_ENV,
+    BUN_RUNTIME_PATH_ENV, "PATH", "CODEX_HOME", "CODEX_SQLITE_HOME",
+    "OPENCODEX_HOME", "HTTP_PROXY", "HTTPS_PROXY", "ALL_PROXY", "NO_PROXY",
+    "OCX_API_TOKEN_FILE", "OCX_SERVICE_LOG", "OCX_BUN",
+  ];
+  const required = [
+    "OCX_SERVICE", WINDOWS_WRAPPER_PROTOCOL_ENV, BUN_RUNTIME_SOURCE_ENV,
+    BUN_RUNTIME_PATH_ENV, "OCX_API_TOKEN_FILE",
+    "OCX_SERVICE_LOG", "OCX_BUN",
+  ];
+  let previous = -1;
+  const seen = new Set<string>();
+  for (const line of lines.slice(0, boundary)) {
+    if (line === 'set "ERRORLEVEL="') continue;
+    if (!line.startsWith('set "')) continue;
+    const name = /^set "([A-Z_]+)=[^"\r\n]*"$/.exec(line)?.[1];
+    const index = name ? allowed.indexOf(name) : -1;
+    if (index <= previous || !name) return false;
+    previous = index;
+    seen.add(name);
+  }
+  if (required.some(name => !seen.has(name))) return false;
+  const withoutPrefixSets = (scriptLines: string[], end: number): string[] =>
+    scriptLines.filter((line, index) => index >= end || line === 'set "ERRORLEVEL="' || !line.startsWith('set "'));
+  const actualFlow = withoutPrefixSets(lines, boundary);
+  const generatedFlow = withoutPrefixSets(expected, expectedBoundary);
+  return actualFlow.length === generatedFlow.length
+    && actualFlow.every((line, index) => line === generatedFlow[index]);
+}
+
+/** Validate the generated launch shape before interpreting omitted optional homes. */
+function wrapperLaunchShape(body: string): "source" | { standaloneBun: string } | null {
+  if (!/^:loop\s*$/im.test(body)) return null;
+  const launchLines = body.split(/\r?\n/).filter(line => /^\s*"%OCX_BUN%"/i.test(line));
+  if (launchLines.length !== 1) return null;
+  const launch = launchLines[0]!.trim();
+  const sourceLaunch = /^"%OCX_BUN%" "%OCX_CLI%" start --port ([0-9]{1,5}) >>"%OCX_SERVICE_LOG%" 2>&1$/i;
+  const standaloneLaunch = /^"%OCX_BUN%" start --port ([0-9]{1,5}) >>"%OCX_SERVICE_LOG%" 2>&1$/i;
+  const bun = generatedBatchSetValue(body, "OCX_BUN");
+  if (!bun) return null;
+  const cliAssignments = body.split(/\r?\n/).filter(line => /^\s*@?set\s+"?OCX_CLI=/i.test(line));
+  if (cliAssignments.length > 0) {
+    const port = sourceLaunch.exec(launch)?.[1];
+    return cliAssignments.length === 1 && Boolean(generatedBatchSetValue(body, "OCX_CLI"))
+      && Boolean(port) && Number(port) >= 1 && Number(port) <= 65535
+      ? "source" : null;
+  }
+  const port = standaloneLaunch.exec(launch)?.[1];
+  if (!port || Number(port) < 1 || Number(port) > 65535 || !/^@echo off\s*$/im.test(body)
+    || !/^setlocal EnableExtensions DisableDelayedExpansion\s*$/im.test(body)
+    || !new RegExp(`^if "%ERRORLEVEL%"=="${WINDOWS_WRAPPER_STAY_OUT_EXIT_CODE}" goto stopped\\s*$`, "im").test(body)
+    || !/^:stopped\s*$/im.test(body)) return null;
+  if (!matchesGeneratedStandaloneControlFlow(body, Number(port))) return null;
+  for (const [name, value] of [
+    ["OCX_SERVICE", "1"],
+    [WINDOWS_WRAPPER_PROTOCOL_ENV, "1"],
+    [BUN_RUNTIME_SOURCE_ENV, "standalone"],
+  ]) {
+    if (generatedBatchSetValue(body, name) !== value) return null;
+  }
+  const runtimePath = generatedBatchSetValue(body, BUN_RUNTIME_PATH_ENV);
+  if (!bun || !runtimePath || normalizeWindowsPath(decodeBatchPathValue(bun)) !== normalizeWindowsPath(decodeBatchPathValue(runtimePath))) return null;
+  for (const name of ["CODEX_HOME", "OPENCODEX_HOME"]) {
+    const assignments = body.split(/\r?\n/).filter(line => new RegExp(`^\\s*@?set\\s+"?${name}=`, "i").test(line));
+    if (assignments.length > 0 && generatedBatchSetValue(body, name) === null) return null;
+  }
+  return { standaloneBun: decodeBatchPathValue(bun) };
 }
 
 function normalizeWindowsPath(value: string): string {
@@ -711,7 +803,7 @@ function probeWinswRegistration(
 
 function inspectWindows(
   deps: Required<Pick<ProbeDeps, "runRaw" | "home">>
-    & Pick<ProbeDeps, "configDir" | "winswStatus" | "windowsLocale" | "windowsTaskListingCache">,
+    & Pick<ProbeDeps, "configDir" | "winswStatus" | "windowsLocale" | "windowsTaskListingCache" | "statePaths">,
 ): ServiceManagerInstallation {
   const configDir = windowsConfigDirPath(deps);
   const taskXmlPath = join(configDir, "opencodex-service-task.xml");
@@ -802,6 +894,10 @@ function inspectWindows(
     const registeredWalk = walkWindowsChain(deps, registration.registeredXml, taskXmlPath);
     if (registeredWalk.kind !== "present") return registeredWalk;
     const registeredClaim = registeredWalk.claims[0];
+    const registeredLauncher = /"([^"]+)"/.exec(windowsTaskArguments(registration.registeredXml) ?? "")?.[1];
+    if (!registeredLauncher || !windowsTaskActionMatches(registration.registeredXml, registeredLauncher)) {
+      return unknown("the registered scheduled-task action does not match the generated launcher action");
+    }
     if (!homesEqual(registeredClaim.homes, stagedClaim.homes)) {
       return unknown("the registered scheduled task names different homes than the staged task definition");
     }
@@ -837,7 +933,7 @@ function homesEqual(
  * generated service-asset directory.
  */
 function walkWindowsChain(
-  deps: Required<Pick<ProbeDeps, "home">> & Pick<ProbeDeps, "configDir" | "windowsLocale">,
+  deps: Required<Pick<ProbeDeps, "home">> & Pick<ProbeDeps, "configDir" | "windowsLocale" | "statePaths">,
   xml: string,
   definitionPath: string,
 ): ServiceManagerInstallation {
@@ -885,9 +981,21 @@ function walkWindowsChain(
     return unknown(`the launcher wrapper could not be read: ${String(error)}`);
   }
 
-  if (!wrapperLooksGenerated(wrapperBody)) {
+  const launchShape = wrapperLaunchShape(wrapperBody);
+  if (launchShape === null) {
     return unknown(`the launcher wrapper does not look like a generated opencodex service wrapper: ${wrapperPath}`);
   }
+  if (typeof launchShape !== "string") {
+    const executable = launchShape.standaloneBun;
+    const evidence = inspectServiceStateEvidence(deps.statePaths ?? serviceStatePathsForOpenCodexHome(configDir));
+    const valid = evidence.filter(e => e.kind === "valid");
+    if (!win32Path.isAbsolute(executable) || win32Path.extname(executable).toLowerCase() !== ".exe"
+      || valid.length === 0 || evidence.some(e => e.kind === "invalid" || e.kind === "unreadable")
+      || valid.some(e => e.state.version !== 2 || e.state.backend !== "scheduler" || e.state.cliPath !== null
+        || !e.state.bunPath || normalizeWindowsPath(e.state.bunPath) !== normalizeWindowsPath(executable))) {
+      return unknown("the standalone service wrapper executable is not bound to recorded scheduler install state");
+    }
+  }
 
   const rawCodexHome = batchSetValue(wrapperBody, "CODEX_HOME");
   const rawOpencodexHome = batchSetValue(wrapperBody, "OPENCODEX_HOME");
@@ -992,6 +1100,7 @@ export function inspectServiceManagerInstallation(deps: ProbeDeps = {}): Service
       winswStatus: deps.winswStatus,
       windowsLocale: deps.windowsLocale,
       windowsTaskListingCache: deps.windowsTaskListingCache,
+      statePaths: deps.statePaths,
     });
   }
   return unknown(`no service manager probe for platform ${platform}`);

package/src/types/wire.ts

@@ -87,6 +87,13 @@ const WIRE_ADAPTER_PIN_PREFIXES: Readonly<Record<string, WirePinPrefixRule>> = O
     endpoint: "https://api.commandcode.ai/provider/v1",
     prefixes: Object.freeze({ "claude-": "anthropic" }),
   }),
+  // TokenLab declares Claude ids as Chat + Anthropic Messages, never Responses
+  // (`tokenlab.accepted_request_formats` on GET /v1/models/{id}, all 11 live claude-* ids on
+  // 2026-09-30). Messages is their native wire; POST /v1/messages accepts x-api-key.
+  tokenlab: Object.freeze({
+    endpoint: "https://api.tokenlab.sh/v1",
+    prefixes: Object.freeze({ "claude-": "anthropic" }),
+  }),
 });
 
 /** Just enough of a provider config to tell whether it still points at the pinned endpoint. */

package/src/usage/expected-prices.ts

@@ -51,6 +51,12 @@ const ASTRA_API_PRICING = "https://developers.openai.com/api/docs/models/gpt-6-a
 const GPT6_SOL: Cost4 = { input: 2, output: 10, cacheRead: 0.2, cacheWrite: 2.5 };
 const GPT6_LUNA: Cost4 = { input: 0.1, output: 0.5, cacheRead: 0.01, cacheWrite: 0.125 };
 const GPT6_API_PRICING = "https://developers.openai.com/api/docs/changelog (2026-09-22: GPT-6 Sol $2 / $0.20 cached / $10; GPT-6 Luna $0.10 / $0.01 cached / $0.50)";
+/**
+ * GPT-6.1 Sol API list prices (released 2026-09-29). Same input, output and cache write as GPT-6
+ * Sol; only cached input halves, to $0.10. Prompts over 272K take the OPENAI_LONG_CONTEXT tier.
+ */
+const GPT61_SOL: Cost4 = { input: 2, output: 10, cacheRead: 0.1, cacheWrite: 2.5 };
+const GPT61_SOL_API_PRICING = "https://developers.openai.com/api/docs/pricing (2026-09-30: GPT-6.1 Sol $2 / $0.10 cached / $2.50 cache write / $10; >272K $4 / $0.20 / $5 / $15)";
 /**
  * Daybreak aliases. `daybreak-*-latest` never appears in the pricing table itself — only its
  * current snapshot does — so these tuples are the snapshot's published rates and carry
@@ -256,8 +262,10 @@ export const EXPECTED_PRICE_OVERLAYS: readonly ExpectedPriceOverlay[] = [
   { provider: "openai-apikey", modelId: "gpt-6-astra", cost4: GPT6_ASTRA, source: ASTRA_API_PRICING, verifiedAt: "2026-09-05", status: "verified" },
   // Display estimates use API prices for both login and API-key routes, including cache writes.
   { provider: "openai", modelId: "gpt-6-astra", cost4: GPT6_ASTRA, source: `API-reference comparison estimate: ${ASTRA_API_PRICING}`, verifiedAt: "2026-09-05", status: "verified-derived" },
+  { provider: "openai-apikey", modelId: "gpt-6.1-sol", cost4: GPT61_SOL, source: GPT61_SOL_API_PRICING, verifiedAt: "2026-09-30", status: "verified" },
   { provider: "openai-apikey", modelId: "gpt-6-sol", cost4: GPT6_SOL, source: GPT6_API_PRICING, verifiedAt: "2026-09-23", status: "verified" },
   { provider: "openai-apikey", modelId: "gpt-6-luna", cost4: GPT6_LUNA, source: GPT6_API_PRICING, verifiedAt: "2026-09-23", status: "verified" },
+  { provider: "openai", modelId: "gpt-6.1-sol", cost4: GPT61_SOL, source: `API-reference comparison estimate: ${GPT61_SOL_API_PRICING}`, verifiedAt: "2026-09-30", status: "verified-derived" },
   { provider: "openai", modelId: "gpt-6-sol", cost4: GPT6_SOL, source: `API-reference comparison estimate: ${GPT6_API_PRICING}`, verifiedAt: "2026-09-23", status: "verified-derived" },
   { provider: "openai", modelId: "gpt-6-luna", cost4: GPT6_LUNA, source: `API-reference comparison estimate: ${GPT6_API_PRICING}`, verifiedAt: "2026-09-23", status: "verified-derived" },
   // claude-fable-5-1 now HAS a generated jawcode row, so the two Anthropic surfaces resolve
@@ -459,6 +467,7 @@ export const EXPECTED_PRICE_OVERLAYS: readonly ExpectedPriceOverlay[] = [
   { provider: "devin-cli", modelId: "swe-1-6", cost4: DEVIN_SWE_17, source: DEVIN_PRICING, verifiedAt: "2026-09-13", status: "verified-derived" },
   { provider: "devin-cli", modelId: "gpt-5-6-sol", cost4: GPT56_SOL, source: `enterprise list column (self-serve shows discounted 1.2/6); ${DEVIN_PRICING}`, verifiedAt: "2026-09-13", status: "verified-derived" },
   { provider: "devin-cli", modelId: "gpt-6-astra", cost4: GPT6_ASTRA, source: DEVIN_PRICING, verifiedAt: "2026-09-13", status: "verified-derived" },
+  { provider: "devin-cli", modelId: "gpt-6-1-sol", cost4: GPT61_SOL, source: `derived: GPT-6.1 Sol added 2026-09-30 ahead of Devin's modelCostData table (devin.ai/blog/gpt-6-1-sol; uid spelled like gpt-5-6-sol); OpenAI API list price ${GPT61_SOL_API_PRICING}`, verifiedAt: "2026-09-30", status: "verified-derived" },
   { provider: "devin-cli", modelId: "gpt-6-sol", cost4: GPT6_SOL, source: `derived: GPT-6 Sol/Luna added 2026-09-23 ahead of Devin's modelCostData table; OpenAI API list price ${GPT6_API_PRICING}`, verifiedAt: "2026-09-23", status: "verified-derived" },
   { provider: "devin-cli", modelId: "gpt-6-luna", cost4: GPT6_LUNA, source: `derived: GPT-6 Sol/Luna added 2026-09-23 ahead of Devin's modelCostData table; OpenAI API list price ${GPT6_API_PRICING}`, verifiedAt: "2026-09-23", status: "verified-derived" },
   { provider: "devin-cli", modelId: "claude-opus-5", cost4: CLAUDE_OPUS_46, source: DEVIN_PRICING, verifiedAt: "2026-09-13", status: "verified-derived" },
@@ -477,6 +486,7 @@ export const EXPECTED_PRICE_OVERLAYS: readonly ExpectedPriceOverlay[] = [
   { provider: "devin", modelId: "gpt-5-6-sol", cost4: GPT56_SOL, source: `enterprise list column (self-serve shows discounted 1.2/6); ${DEVIN_PRICING}`, verifiedAt: "2026-09-13", status: "verified-derived" },
   { provider: "devin", modelId: "gpt-5-6-luna", cost4: GPT56_LUNA, source: DEVIN_PRICING, verifiedAt: "2026-09-13", status: "verified-derived" },
   { provider: "devin", modelId: "gpt-5-6-terra", cost4: GPT56_TERRA, source: DEVIN_PRICING, verifiedAt: "2026-09-13", status: "verified-derived" },
+  { provider: "devin", modelId: "gpt-6-1-sol", cost4: GPT61_SOL, source: `derived: GPT-6.1 Sol added 2026-09-30 ahead of Devin's modelCostData table (devin.ai/blog/gpt-6-1-sol; uid spelled like gpt-5-6-sol); OpenAI API list price ${GPT61_SOL_API_PRICING}`, verifiedAt: "2026-09-30", status: "verified-derived" },
   { provider: "devin", modelId: "gpt-6-sol", cost4: GPT6_SOL, source: `derived: GPT-6 Sol/Luna added 2026-09-23 ahead of Devin's modelCostData table; OpenAI API list price ${GPT6_API_PRICING}`, verifiedAt: "2026-09-23", status: "verified-derived" },
   { provider: "devin", modelId: "gpt-6-luna", cost4: GPT6_LUNA, source: `derived: GPT-6 Sol/Luna added 2026-09-23 ahead of Devin's modelCostData table; OpenAI API list price ${GPT6_API_PRICING}`, verifiedAt: "2026-09-23", status: "verified-derived" },
   { provider: "devin", modelId: "claude-opus-4-8", cost4: CLAUDE_OPUS_46, source: DEVIN_PRICING, verifiedAt: "2026-09-13", status: "verified-derived" },
@@ -690,6 +700,7 @@ const UNIFORM_DOUBLE: Cost4 = { input: 2, output: 2, cacheRead: 2, cacheWrite: 2
 const OPENAI_PRICING_DOC = "https://developers.openai.com/api/docs/pricing";
 const OPENAI_CONTEXT_MODELS = [
   "gpt-6-astra",
+  "gpt-6.1-sol",
   "gpt-6-sol",
   "gpt-6-luna",
   "gpt-5.6-sol",