@bitkyc08/opencodex 2.75.0 → 2.76.0

package/src/oauth/zed.ts

@@ -0,0 +1,134 @@
+import type { OAuthController, OAuthCredentials } from "./types";
+import {
+  createZedNativeAuthData,
+  decryptZedAccessToken,
+  parseZedCallbackPayload,
+} from "../providers/zed";
+
+const LOGIN_TIMEOUT_MS = 300_000;
+
+type ZedServer = ReturnType<typeof Bun.serve>;
+
+function closingResponse(body: string, status: number): Response {
+  return new Response(body, {
+    status,
+    headers: { "Content-Type": "text/html; charset=utf-8", Connection: "close" },
+  });
+}
+
+function callbackSuccess(): Response {
+  return closingResponse(
+    "<!doctype html><html><body><h2>Login complete</h2><p>You can close this tab.</p></body></html>",
+    200,
+  );
+}
+
+function callbackFailure(message: string): Response {
+  // Do not reflect the callback query, encrypted token, or decryption error details into HTML.
+  void message;
+  return closingResponse(
+    "<!doctype html><html><body><h2>Login failed</h2><p>Return to OpenCodex and retry the login.</p></body></html>",
+    400,
+  );
+}
+
+async function parseManualCallback(input: string, privateKeyVerifier: string): Promise<OAuthCredentials> {
+  const payload = parseZedCallbackPayload(input);
+  const access = decryptZedAccessToken(payload.encryptedAccessToken, privateKeyVerifier);
+  return {
+    access,
+    refresh: access,
+    expires: Number.MAX_SAFE_INTEGER,
+    accountId: payload.userId,
+    source: "oauth",
+  };
+}
+
+/** Zed native-app login: local RSA callback, not OAuth2/PKCE and not refreshable. */
+export async function loginZed(ctrl: OAuthController): Promise<OAuthCredentials> {
+  let resolveCallback: ((credential: OAuthCredentials) => void) | undefined;
+  const callback = new Promise<OAuthCredentials>(resolve => {
+    resolveCallback = resolve;
+  });
+
+  let privateKeyVerifier: string | undefined;
+  let server: ZedServer | undefined;
+  // Ends the manual-paste branch once the race settles, so a late paste can neither re-prompt
+  // nor keep the private key alive after the callback (or cancellation) already won.
+  const manualStop = new AbortController();
+  const manualStopped = new Promise<undefined>(resolve => {
+    manualStop.signal.addEventListener("abort", () => resolve(undefined), { once: true });
+  });
+  try {
+    server = Bun.serve({
+      hostname: "127.0.0.1",
+      port: 0,
+      fetch: async request => {
+        const url = new URL(request.url);
+        if (request.method !== "GET" || url.pathname !== "/") return closingResponse("Not found", 404);
+        try {
+          if (!privateKeyVerifier) throw new Error("Zed login callback is not initialized");
+          const credential = await parseManualCallback(url.toString(), privateKeyVerifier);
+          resolveCallback?.(credential);
+          return callbackSuccess();
+        } catch (error) {
+          return callbackFailure(error instanceof Error ? error.message : "invalid callback");
+        }
+      },
+    });
+    if (!server.port) throw new Error("Zed login callback port was not allocated");
+    const authData = createZedNativeAuthData(server.port);
+    privateKeyVerifier = authData.privateKeyVerifier;
+    ctrl.onAuth?.({
+      url: authData.authUrl,
+      instructions: "Sign in with your Zed account in the browser, then return here after Zed redirects to the local callback.",
+    });
+    ctrl.onProgress?.("Waiting for Zed login callback…");
+
+    const timeout = AbortSignal.timeout(LOGIN_TIMEOUT_MS);
+    const signal = ctrl.signal ? AbortSignal.any([ctrl.signal, timeout]) : timeout;
+    const cancelled = new Promise<never>((_, reject) => {
+      if (signal.aborted) {
+        reject(new Error("Zed login cancelled"));
+        return;
+      }
+      signal.addEventListener("abort", () => reject(new Error("Zed login cancelled")), { once: true });
+    });
+    const manual = ctrl.onManualCodeInput
+      ? (async (): Promise<OAuthCredentials> => {
+          let verifier: string | undefined = authData.privateKeyVerifier;
+          while (!manualStop.signal.aborted && !signal.aborted) {
+            const input = await Promise.race([ctrl.onManualCodeInput?.(), manualStopped]);
+            if (manualStop.signal.aborted || signal.aborted) break;
+            if (!input) {
+              await new Promise(resolve => setTimeout(resolve, 0));
+              continue;
+            }
+            try { return await parseManualCallback(input, verifier); } catch { /* keep waiting */ }
+          }
+          verifier = undefined;
+          // Never settles: the race already has its answer, and this branch must not override it.
+          return new Promise<never>(() => {});
+        })()
+      : undefined;
+    return await Promise.race([callback, cancelled, ...(manual ? [manual] : [])]);
+  } catch (error) {
+    throw error;
+  } finally {
+    manualStop.abort();
+    server?.stop(true);
+  }
+}
+
+/** Zed's long-lived native token has no refresh endpoint. */
+export async function refreshZedToken(refresh: string, _signal?: AbortSignal, credential?: OAuthCredentials): Promise<OAuthCredentials> {
+  const accountId = credential?.accountId;
+  if (!accountId || !refresh) throw new Error("Zed credential is missing its user id");
+  return {
+    access: refresh,
+    refresh,
+    expires: Number.MAX_SAFE_INTEGER,
+    accountId,
+    source: credential?.source ?? "oauth",
+  };
+}

package/src/providers/model-discovery.ts

@@ -78,6 +78,8 @@ function discoveryPredicateError(predicate: ProviderModelDiscoveryPredicate): st
   if (predicate.path.some(segment => typeof segment !== "string" || !segment.trim() || segment.length > 64)) {
     return "predicate path segments must be nonblank strings up to 64 characters";
   }
+  // One projection is sufficient for providers[].id and avoids combinatorial traversal.
+  if (predicate.path.filter(segment => segment === "*").length > 1) return "predicate path may contain at most one array projection";
   const values = "equalsAny" in predicate
     ? predicate.equalsAny
     : "containsAny" in predicate
@@ -145,7 +147,7 @@ export function providerModelDiscoverySpecError(spec: ProviderModelDiscoverySpec
       return `${field} must be a positive integer no greater than ${hardLimit}`;
     }
   }
-  for (const [group, predicates] of Object.entries(spec.filter ?? {})) {
+  for (const [group, predicates] of Object.entries({ ...spec.filter, ...(spec.preferFirst === undefined ? {} : { preferFirst: spec.preferFirst }) })) {
     if (!Array.isArray(predicates) || predicates.length === 0 || predicates.length > 32) {
       return `${group} must contain 1-32 predicates`;
     }
@@ -349,12 +351,17 @@ export async function readBoundedDiscoveryJson(
 }
 
 function valueAtPath(item: Record<string, unknown>, path: readonly string[]): unknown {
-  let current: unknown = item;
-  for (const segment of path) {
+  const visit = (current: unknown, index: number): unknown => {
+    if (index === path.length) return current;
+    const segment = path[index];
+    if (segment === "*") {
+      if (!Array.isArray(current)) return undefined;
+      return current.slice(0, MODEL_DISCOVERY_MAX_FILTER_VALUES).map(value => visit(value, index + 1));
+    }
     if (current === null || typeof current !== "object" || Array.isArray(current)) return undefined;
-    current = (current as Record<string, unknown>)[segment];
-  }
-  return current;
+    return visit((current as Record<string, unknown>)[segment!], index + 1);
+  };
+  return visit(item, 0);
 }
 
 function comparableScalar(value: unknown, caseInsensitive: boolean): ProviderModelDiscoveryScalar | undefined {
@@ -522,6 +529,7 @@ export function extractProviderModelItems(
   }
 
   const items: ProviderModelsApiItem[] = [];
+  const preferred: ProviderModelsApiItem[] = [];
   const seen = new Set<string>();
   const idField = discovery.spec?.idField ?? "id";
   for (const raw of data) {
@@ -547,7 +555,10 @@ export function extractProviderModelItems(
     // are published, only what is known about an already-admitted one.
     if (!providerModelMatchesDiscoveryFilter(item, discovery.spec?.filter) || seen.has(finalId)) continue;
     seen.add(finalId);
-    items.push(siblings ? enrichAdmittedModel(item, siblings) : item);
+    // Preference, like admission, must not be supplied by sibling enrichment.
+    const target = discovery.spec?.preferFirst?.some(predicate => predicateMatches(raw as ProviderModelsApiItem, predicate))
+      ? preferred : items;
+    target.push(siblings ? enrichAdmittedModel(item, siblings) : item);
   }
-  return { ok: true, items, rawCount: data.length };
+  return { ok: true, items: [...preferred, ...items], rawCount: data.length };
 }

package/src/providers/model-rename-fields.ts

@@ -142,6 +142,7 @@ export const PROVIDER_MODEL_RENAME_ROLES = {
   desktopExecutor: "none",
   unsafeAllowNativeLocalExec: "none",
   nativeLocalExec: "none",
+  tlsProfile: "none",
 } as const satisfies Record<keyof OcxProviderConfig, ModelRenameRole>;
 
 function fieldsWithRole(role: ModelRenameRole): string[] {

package/src/providers/provider-id-rewrite.ts

@@ -19,8 +19,8 @@ export interface ProviderRewriteResult {
  * Re-point every config reference from one provider id to another.
  *
  * Three shapes exist and the difference matters: routed model strings
- * (`"<provider>/<model>"`), bare provider ids (`customModels[].provider`,
- * `combos[*].targets[].provider`, `routingProfiles[*].candidates[].provider`),
+ * (`"<provider>/<model>"`, including `combos[*].decisionModel`), bare provider ids (`customModels[].provider`,
+ * `combos[*].targets[].provider`, `combos[*].decisionProvider`, `routingProfiles[*].candidates[].provider`),
  * and keys that ARE provider ids or routes (`providerContextCaps`,
  * `claudeCode.desktopProfile.assignments`). A rewrite that handles only the
  * first leaves an orphaned context cap and — worse — a combo target or routing
@@ -106,12 +106,19 @@ export function rewriteProviderReferences(config: OcxConfig, from: string, to: s
     }
   }
   for (const combo of Object.values(config.combos ?? {})) {
+    const decisionModel = route(typeof combo.decisionModel === "string" ? combo.decisionModel.trim() : combo.decisionModel);
+    if (decisionModel) combo.decisionModel = decisionModel;
     for (const target of combo.targets ?? []) {
       if (target.provider === from) {
         target.provider = to;
         changed += 1;
       }
     }
+    // A JEV Combo's decision service is validated against configured providers too.
+    if (typeof combo.decisionProvider === "string" && combo.decisionProvider.trim() === from) {
+      combo.decisionProvider = to;
+      changed += 1;
+    }
   }
 
   // Routing-profile candidates carry a bare provider id next to a bare model

package/src/providers/quota/account-cache.ts

@@ -1,6 +1,8 @@
+import { parseAnthropicFamilyHeaders, mergeAnthropicFamilyWindows } from "./anthropic-family-headers";
+import { observeAnthropicFamilyQuota, clearAnthropicRequestedFamilyQuota, ANTHROPIC_PASSIVE_FAMILY_MAX_AGE_MS } from "../../oauth/anthropic-model-quota";
 import { createHash } from "node:crypto";
 import { getValidAccessTokenForAccount } from "../../oauth";
-import { getAccountCredential, getAccountCredentialWithStatus, getAccountSet } from "../../oauth/store";
+import { credentialGeneration, getAccountCredential, getAccountCredentialWithStatus, getAccountSet } from "../../oauth/store";
 import type { GenerationContext } from "../../lib/state-store-sweeper";
 import { ACCOUNT_QUOTA_TTL_MS, toFiniteNumber } from "../quota-wire";
 import { clearKiroAccountUsageState, hydrateKiroUsageVerdict, kiroPersistableVerdicts, reconcileKiroAccountUsageState } from "../kiro-usage";
@@ -34,6 +36,8 @@ export type AccountQuotaCacheEntry = {
   quotaFailureIsCurrent?: () => boolean;
   /** Private new-reader identity; never persisted or serialized. */
   identity?: string;
+  /** Private passive Anthropic ownership fence; not serialized with quota bars. */
+  anthropicCredentialGeneration?: string;
   isCurrent?: () => boolean;
 };
 /** Expired measurements become unknown; missing reset evidence never implies a fresh allowance. */
@@ -67,7 +71,10 @@ export function normalizeAnthropicQuota(quota: ProviderQuota | null | undefined,
         changed = true;
         continue;
       }
-      if (validReset(window.resetAt) && window.resetAt <= now) {
+      if ((window.passiveObservedAt !== undefined && (typeof window.passiveObservedAt !== "number"
+          || !Number.isFinite(window.passiveObservedAt) || window.passiveObservedAt <= 0 || window.passiveObservedAt > now
+          || now - window.passiveObservedAt >= ANTHROPIC_PASSIVE_FAMILY_MAX_AGE_MS))
+        || validReset(window.resetAt) && window.resetAt <= now) {
         changed = true;
         continue;
       }
@@ -202,6 +209,10 @@ export function getCachedProviderAccountQuota(provider: string, accountId: strin
     const account = getAccountSet("kiro")?.accounts.find(row => row.id === accountId);
     if (!account || entry?.identity !== kiroEvidenceIdentity(account)) return null;
   }
+  if (provider === "anthropic" && entry?.anthropicCredentialGeneration) {
+    const credential = getAccountCredential(provider, accountId);
+    if (!credential || credentialGeneration(credential) !== entry.anthropicCredentialGeneration) return null;
+  }
   if (entry?.isCurrent && !entry.isCurrent()) return null;
   return provider === "anthropic" ? normalizeAnthropicQuota(entry?.quota, Date.now()) : entry?.quota ?? null;
 }
@@ -230,10 +241,11 @@ function anthropicHeaderResetAt(value: string | null): number | undefined {
   return Number.isFinite(new Date(timestamp).getTime()) ? timestamp : undefined;
 }
 
-export function parseAnthropicRateLimitHeaders(headers: Headers): ProviderQuota | null {
+export function parseAnthropicRateLimitHeaders(headers: Headers, status?: number): ProviderQuota | null {
   const fiveHourPercent = normalizeUtilizationFraction(headers.get("anthropic-ratelimit-unified-5h-utilization"));
   const weeklyPercent = normalizeUtilizationFraction(headers.get("anthropic-ratelimit-unified-7d-utilization"));
-  if (fiveHourPercent === undefined && weeklyPercent === undefined) return null;
+  const customWindows = parseAnthropicFamilyHeaders(headers, Date.now(), status);
+  if (fiveHourPercent === undefined && weeklyPercent === undefined && !customWindows.length) return null;
   const fiveHourResetAt = anthropicHeaderResetAt(headers.get("anthropic-ratelimit-unified-5h-reset"));
   const weeklyResetAt = anthropicHeaderResetAt(headers.get("anthropic-ratelimit-unified-7d-reset"));
   return {
@@ -241,6 +253,7 @@ export function parseAnthropicRateLimitHeaders(headers: Headers): ProviderQuota
     ...(fiveHourPercent !== undefined && fiveHourResetAt !== undefined ? { fiveHourResetAt } : {}),
     ...(weeklyPercent !== undefined ? { weeklyPercent } : {}),
     ...(weeklyPercent !== undefined && weeklyResetAt !== undefined ? { weeklyResetAt } : {}),
+    ...(customWindows.length ? { customWindows } : {}),
     updatedAt: Date.now(),
   };
 }
@@ -261,25 +274,34 @@ export function recordAnthropicAccountQuotaFromHeaders(
   accountId: string,
   headers: Headers,
   writerGeneration: number,
+  status?: number,
+  model?: string,
 ): void {
   if (!accountId) return;
-  const observed = parseAnthropicRateLimitHeaders(headers);
-  if (!observed) return;
   const key = accountCacheKey("anthropic", accountId);
   if (!mayCommitAccountQuotaKey(key, writerGeneration)) return;
+  if (status !== undefined && status >= 200 && status < 300) clearAnthropicRequestedFamilyQuota(accountId, model);
+  const observed = parseAnthropicRateLimitHeaders(headers, status);
+  if (!observed) return;
   // Hydrate before writing, for the same reason `recordPassiveAccountQuota` does: this write
   // arrives unprompted from the request path, and `persistAccountQuotaCache` serializes the
   // whole map. Landing before any reader has hydrated would persist this single row and erase
   // every other provider's saved row.
   hydrateAccountQuotaCache();
   const candidate = accountQuotaCache.get(key);
-  const previous = candidate?.isCurrent?.() === false ? undefined : candidate;
+  const credential = getAccountCredential("anthropic", accountId);
+  const generation = credential && credentialGeneration(credential);
+  const previous = candidate?.isCurrent?.() === false
+    || candidate?.anthropicCredentialGeneration && candidate.anthropicCredentialGeneration !== generation ? undefined : candidate;
+  if (observed.customWindows) observeAnthropicFamilyQuota(accountId, observed.customWindows, observed.updatedAt);
   accountQuotaCache.set(key, {
     ...previous,
+    ...(generation ? { anthropicCredentialGeneration: generation, isCurrent: undefined } : {}),
     // Headers do not prove that the last usage probe succeeded.
     ts: previous?.ts ?? 0,
     quota: normalizeAnthropicQuota({
       ...normalizeAnthropicQuota(previous?.quota, observed.updatedAt), ...observed,
+      ...(observed.customWindows ? { customWindows: mergeAnthropicFamilyWindows(previous?.quota?.customWindows, observed.customWindows) } : {}),
     }, observed.updatedAt),
   });
   persistAccountQuotaCache();

package/src/providers/quota/anthropic-cooldown-recovery.ts

@@ -1,3 +1,6 @@
+import { mergeAnthropicFamilyWindows, hasAnthropicFamilyEnumeration } from "./anthropic-family-headers";
+import { getCachedProviderAccountQuota } from "./account-cache";
+import { observeAnthropicFamilyQuota, anthropicFamilyQuotaGeneration } from "../../oauth/anthropic-model-quota";
 import { credentialGeneration, getAccountCredential, getAccountCredentialWithStatus } from "../../oauth/store";
 import type { ProviderQuota } from "../quota-types";
 
@@ -42,6 +45,7 @@ export function clearAnthropicCooldownGenerations(): void {
 export type AnthropicCooldownRecoveryProbe = Readonly<{
   requiresFreshDispatch: boolean;
   isCurrentCredential(): boolean;
+  isCurrentFamily(): boolean;
   isCurrent(): boolean;
   settle(quota: ProviderQuota): "cleared" | "retained" | "superseded";
 }>;
@@ -67,6 +71,7 @@ export async function captureAnthropicCooldownRecoveryProbe(
   // Lazy because anthropic-routing reads the quota cache on normal request routing.
   const routing = await import("../../oauth/anthropic-routing");
   const cooldownGeneration = anthropicCooldownGeneration(accountId);
+  const familyGeneration = anthropicFamilyQuotaGeneration(accountId);
   const claim = routing.captureAnthropicCooldownRecovery(accountId);
   const isCurrentCredential = () => {
     const current = getAccountCredential("anthropic", accountId);
@@ -75,6 +80,7 @@ export async function captureAnthropicCooldownRecoveryProbe(
   return {
     requiresFreshDispatch: claim !== null,
     isCurrentCredential,
+    isCurrentFamily: () => anthropicFamilyQuotaGeneration(accountId) === familyGeneration,
     isCurrent: () => isCurrentCredential()
       && anthropicCooldownGeneration(accountId) === cooldownGeneration,
     settle: quota => claim === null ? "retained"
@@ -107,12 +113,24 @@ export async function probeAnthropicQuotaWithRecovery(
   }
   // Clearing the claimed cooldown intentionally advances the fence. Adopt that exact new
   // generation; any later observation/429 then invalidates publication before a cache write.
+  const ownsFamily = probe.isCurrentFamily();
+  const authoritative = ownsFamily && hasAnthropicFamilyEnumeration(quota);
+  if (ownsFamily) observeAnthropicFamilyQuota(accountId, quota.customWindows ?? [], quota.updatedAt, authoritative);
+  if (!authoritative) {
+    const cached = getCachedProviderAccountQuota("anthropic", accountId)?.customWindows;
+    const windows = ownsFamily ? mergeAnthropicFamilyWindows(cached, quota.customWindows)
+      : cached ?? [];
+    // A superseded family enumeration has no authority, including over absent families.
+    if (!ownsFamily || windows.length) quota = { ...quota, customWindows: windows };
+  }
   const publicationGeneration = anthropicCooldownGeneration(accountId);
+  const publicationFamilyGeneration = anthropicFamilyQuotaGeneration(accountId);
   afterSettlementForTests?.();
   return {
     quota,
     isCurrent: () => probe.isCurrentCredential()
       && anthropicCooldownGeneration(accountId) === publicationGeneration
+      && anthropicFamilyQuotaGeneration(accountId) === publicationFamilyGeneration
       && mayPublish(),
   };
 }

package/src/providers/quota/anthropic-family-headers.ts

@@ -0,0 +1,25 @@
+/** 7d_oi attribution is fixture-confirmed for Fable; it is not a future-family wildcard. */
+import type { ProviderQuotaWindow } from "../quota-types";
+export function parseAnthropicFamilyHeaders(headers: Headers, now: number, status?: number): ProviderQuotaWindow[] {
+  const value = headers.get("anthropic-ratelimit-unified-7d_oi-utilization")?.trim();
+  const rejected = status === 429 && headers.get("anthropic-ratelimit-unified-7d_oi-status")?.trim() === "rejected";
+  const numeric = value && /^\d+(?:\.\d+)?$/.test(value) ? Number(value) : undefined;
+  // The observed overage fixture is 1.01; spent evidence clamps to the display ceiling.
+  const percent = numeric !== undefined && Number.isFinite(numeric) && numeric >= 0 && numeric <= 1.01
+    ? Math.min(100, Math.round(numeric * 10_000) / 100) : rejected ? 100 : undefined;
+  if (percent === undefined) return [];
+  const rawReset = headers.get("anthropic-ratelimit-unified-7d_oi-reset")?.trim();
+  const resetAt = rawReset && /^\d+(?:\.\d+)?$/.test(rawReset) ? Number(rawReset) * 1000 : undefined;
+  return [{ label: "Fable", scope: "model", percent, passiveObservedAt: now, ...(rejected ? { rejected: true as const } : {}),
+    ...(resetAt !== undefined && resetAt > 0 && Number.isFinite(new Date(resetAt).getTime()) ? { resetAt } : {}) }];
+}
+export function mergeAnthropicFamilyWindows(previous: ProviderQuotaWindow[] = [], observed: ProviderQuotaWindow[] = []): ProviderQuotaWindow[] {
+  return [...previous.filter(window => !observed.some(update => update.label === window.label && update.scope === window.scope)), ...observed];
+}
+
+const enumerated = new WeakSet<object>();
+export function markAnthropicFamilyEnumeration<T extends object>(quota: T, authoritative: boolean): T {
+  if (authoritative) enumerated.add(quota);
+  return quota;
+}
+export function hasAnthropicFamilyEnumeration(quota: object): boolean { return enumerated.has(quota); }

package/src/providers/quota/vendor-probes-oauth.ts

@@ -1,3 +1,4 @@
+import { markAnthropicFamilyEnumeration } from "./anthropic-family-headers";
 import { effectiveCodexAuthAccountId, fetchMainAccountInfoSnapshot, listCodexAuthAccountsSnapshot } from "../../codex/auth-api";
 import { MAIN_CODEX_ACCOUNT_ID } from "../../codex/main-account";
 import { getValidAccessToken } from "../../oauth";
@@ -311,7 +312,10 @@ async function readAnthropicUsageQuota(accessToken: string): Promise<ProviderQuo
     updatedAt: Date.now(),
   };
   // Empty / schema-changed payloads must not cache as "success with no bars".
-  return hasQuotaRows(quota) ? quota : null;
+  return hasQuotaRows(quota) ? markAnthropicFamilyEnumeration(quota, Array.isArray(body.limits) && body.limits.every(raw => {
+    const kind = asRecord(raw)?.kind;
+    return kind === "session" || kind === "weekly_all" || kind === "weekly_scoped" && parseClaudeLimit(raw) !== null;
+  })) : null;
 }
 
 /**

package/src/providers/quota-types.ts

@@ -30,6 +30,10 @@ export interface ProviderQuotaWindow {
    * provider-wide group named "Opus" there would otherwise be mistaken for a per-model window.
    */
   scope?: "model";
+  /** Passive family readings have their own freshness clock, independent of active probes. */
+  passiveObservedAt?: number;
+  /** Upstream refusal evidence, distinct from a measured utilization counter. */
+  rejected?: true;
 }
 
 export interface ProviderQuotaCreditsUsd {

package/src/providers/registry/entries-core.ts

@@ -157,6 +157,24 @@ export const PROVIDER_REGISTRY_CORE: readonly ProviderRegistryEntry[] = [
     // still advertises image for noVision members so Codex can attach (sidecar option B).
     noVisionModels: [...CURSOR_NO_VISION_MODELS],
   },
+  {
+    id: "zed",
+    label: "Zed Hosted AI (experimental)",
+    adapter: "zed",
+    baseUrl: "https://cloud.zed.dev",
+    authKind: "oauth",
+    featured: false,
+    dashboardPreset: true,
+    models: [],
+    liveModels: true,
+    defaultModel: "auto",
+    modelDiscovery: {
+      url: "https://cloud.zed.dev/models",
+      maxResponseBytes: 4 * 1024 * 1024,
+      maxModels: 2_000,
+    },
+    note: "Experimental and unofficial Zed Hosted AI bridge, not endorsed by Zed. Use at your own risk: it consumes the signed-in Zed account's hosted-model entitlement and may be outside Zed's terms, and Zed may limit or suspend the account.",
+  },
   {
     // The canonical Cognition account provider, after absorbing `devin-cli`
     // (devlog/_plan/260913_devin_provider_merge). The two ids were the same

package/src/providers/registry/entries-extended.ts

@@ -1143,6 +1143,61 @@ export const PROVIDER_REGISTRY_EXTENDED: readonly ProviderRegistryEntry[] = [
     modelInputModalities: OPPER_MODEL_INPUT_MODALITIES,
     note: "EU-hosted AI gateway: one OpenAI-compatible endpoint and one key in front of 30+ providers. Bare model ids are pools (claude-sonnet-4-6, gpt-5.5) and Opper picks the route per request; vendor/model ids (anthropic/claude-sonnet-4-6) pin one provider. The catalogue is discovered live from /v3/compat/models with your key; the public list is at opper.ai/models. Token rates are the model providers' rates with no markup; Opper charges a 3% fee when you buy credits.",
   },
+  {
+    // Sionic AI public contract and live streams/tools/images checked 2026-10-02:
+    // https://opengateway.ai/docs/reference/endpoints/models
+    // https://opengateway.ai/docs/reference/endpoints/responses
+    id: "opengateway",
+    label: "OpenGateway",
+    adapter: "openai-chat",
+    baseUrl: "https://apis.opengateway.ai/v1",
+    authKind: "key",
+    dashboardUrl: "https://opengateway.ai/api-keys",
+    liveModels: true,
+    // GET /v1/models is public and answers 200 for any Bearer value, so it cannot verify a key.
+    apiKeyValidation: "unknown",
+    preserveCustomDestination: true,
+    // Both cold-start seeds are active Sionic-served vision models with 1M context.
+    // GLM is the default, not a quality ranking: a verified, large-output coding seed.
+    defaultModel: "z-ai/glm-5.3-flash-ultrafast",
+    models: ["z-ai/glm-5.3-flash-ultrafast", "deepseek/deepseek-v4.1-flash-ultrafast", "openai/o3-pro"],
+    modelContextWindows: {
+      "z-ai/glm-5.3-flash-ultrafast": 1_000_000,
+      "deepseek/deepseek-v4.1-flash-ultrafast": 1_000_000,
+      "openai/o3-pro": 200_000,
+    },
+    modelMaxOutputTokens: { "z-ai/glm-5.3-flash-ultrafast": 131_072 },
+    modelInputModalities: {
+      "z-ai/glm-5.3-flash-ultrafast": ["text", "image"],
+      "deepseek/deepseek-v4.1-flash-ultrafast": ["text", "image"],
+      "openai/o3-pro": ["text"],
+    },
+    noVisionModels: ["openai/o3-pro"],
+    // Chat is the broad wire (77/80 active rows). o3-pro is Responses-only, on all
+    // inbounds. Only the two live-verified Sionic models bypass translation for Codex.
+    // Other OpenAI/Anthropic/Gemini rows stay on Chat until their Responses tool replay
+    // is independently verified; endpoint availability alone is not conformance evidence.
+    modelWireDefaults: {
+      "openai/o3-pro": "openai-responses",
+      "z-ai/glm-5.3-flash-ultrafast": { wire: "openai-responses", inbound: ["responses"] },
+      "deepseek/deepseek-v4.1-flash-ultrafast": { wire: "openai-responses", inbound: ["responses"] },
+    },
+    modelDiscovery: {
+      path: "models", // Public GET; lower-case ?status=active returns 400, so filter locally.
+      // Admit a row only on a wire it is served on: the Chat default needs chat_completions,
+      // and Responses-only rows are admitted only when pinned to Responses above. A future
+      // Responses-only row stays hidden until it is pinned, rather than 404ing on Chat.
+      filter: {
+        allOf: [{ path: ["status"], equalsAny: ["active"] }],
+        anyOf: [
+          { path: ["endpoints"], containsAny: ["chat_completions"] },
+          { path: ["id"], equalsAny: ["openai/o3-pro"] },
+        ],
+      },
+      preferFirst: [{ path: ["providers", "*", "id"], containsAny: ["sionic-ai"] }],
+    },
+    note: "Sionic AI's OpenAI-compatible gateway. Public live discovery lists active models served on Chat Completions (plus pinned Responses-only rows), with Sionic-served ultrafast models first. The public catalog cannot validate keys.",
+  },
   {
     // Public contract checked 2026-09-29: https://docs.tokenlab.sh/api-reference/models/list-models
     // A supplied key is validated and scopes the catalog; anonymous discovery is also public.

package/src/providers/registry/types.ts

@@ -30,6 +30,7 @@ export interface ResponsesTerminalRepairPolicy {
 
 export type ProviderModelDiscoveryScalar = string | number | boolean;
 
+/** Path segment `*` projects at most 256 array elements; containsAny/All match projected scalars exactly. */
 export type ProviderModelDiscoveryPredicate =
   | {
       path: readonly string[];
@@ -70,6 +71,8 @@ interface ProviderModelDiscoverySharedSpec {
   idField?: string;
   /** Declarative eligibility rules evaluated against each untrusted model row. */
   filter?: ProviderModelDiscoveryFilter;
+  /** Stable partition: admitted original rows matching ANY predicate precede other rows. Registry-only. */
+  preferFirst?: readonly ProviderModelDiscoveryPredicate[];
   /** Optional lower byte ceiling; the process-wide hard ceiling still wins. */
   maxResponseBytes?: number;
   /** Optional lower raw-row ceiling; the process-wide hard ceiling still wins. */

package/src/providers/xai-fast-model.ts

@@ -1,4 +1,4 @@
-import type { FastWire, OcxParsedRequest, OcxProviderConfig } from "../types";
+import type { FastWire, OcxParsedRequest, OcxProviderConfig, TierDecision } from "../types";
 
 /**
  * Grok OAuth Fast is a serving lane, not a tier.
@@ -35,6 +35,16 @@ function modelVariantFastWire(variant: string): FastWire {
   return { kind: "model-variant", canonicalToWire: { priority: variant }, foreignCallerTiers: "drop" };
 }
 
+/** Shared by admission preview and final serialization; explicit operator wires stay authoritative. */
+export function xaiOauthFastModelForDecision(
+  route: { providerName: string; provider: Pick<OcxProviderConfig, "authMode" | "fastWire">; modelId: string },
+  decision: TierDecision | undefined,
+): string | undefined {
+  return decision?.kind === "set" && route.provider.fastWire === undefined
+    ? xaiOauthFastModel(route.providerName, route.provider, route.modelId)
+    : undefined;
+}
+
 function isRecord(value: unknown): value is Record<string, unknown> {
   return !!value && typeof value === "object" && !Array.isArray(value);
 }
@@ -58,9 +68,7 @@ export function applyXaiOauthFastModel(
   // The lane switch replaces the registry's service-tier Fast only. The xai registry entry declares no
   // FastWire, so a provider-level `fastWire` is always the operator's own (service-tier.ts reads it
   // first): that decision carries a wire value they verified, and it is sent unchanged.
-  const variant = parsed.options.tierDecision?.kind === "set" && route.provider.fastWire === undefined
-    ? xaiOauthFastModel(route.providerName, route.provider, route.modelId)
-    : undefined;
+  const variant = xaiOauthFastModelForDecision(route, parsed.options.tierDecision);
   if (!variant) {
     if (previous === undefined) return;
     delete parsed._wireModelOverride;