@bitkyc08/opencodex 2.8.0 → 2.9.0

package/src/oauth/store.ts

@@ -21,10 +21,28 @@ import { join } from "node:path";
 import { getConfigDir, atomicWriteFile, backupInvalidConfig, hardenConfigDir, hardenExistingSecret } from "../config";
 import { assertNotRealHomeUnderTest } from "../lib/test-home-guard";
 import { recordOwnedConfigPath } from "../lib/config-ownership";
+import { MAX_PENDING_OAUTH_MUTATIONS } from "../lib/translator-budget";
+import {
+  captureConfigGeneration,
+  type GenerationContext,
+} from "../lib/state-store-sweeper";
 import { validateCopilotApiBaseUrl } from "./github-copilot";
 import type { OAuthCredentialSource, OAuthCredentials, ProviderAccount, ProviderAccountSet } from "./types";
 
 type AuthStore = Record<string, ProviderAccountSet>;
+let lastReconciledGeneration = 0;
+let liveOAuthAccountKeys = new Set<string>();
+
+function oauthAccountKey(provider: string, accountId: string): string {
+  return `${provider}\0${accountId}`;
+}
+
+export function reconcileOAuthReauthState(context: GenerationContext): number {
+  if (context.generation <= lastReconciledGeneration) return 0;
+  liveOAuthAccountKeys = new Set(context.oauthAccountKeys);
+  lastReconciledGeneration = context.generation;
+  return 0;
+}
 
 /** Providers whose account set is pinned to a single slot (see module doc). */
 const SINGLE_SLOT_PROVIDERS = new Set(["chatgpt"]);
@@ -41,7 +59,7 @@ export function getAuthRefreshIntentLockPath(provider: string, accountId: string
 export function getAuthRefreshIntentPath(provider: string, accountId: string): string {
   return `${getAuthRefreshIntentLockPath(provider, accountId)}.json`;
 }
-export interface OAuthRefreshIntent { version: 1; provider: string; accountId: string; generation: string; createdAt: number; uncertain?: true }
+export interface OAuthRefreshIntent { version: 1; provider: string; accountId: string; generation: string; createdAt: number; flightId?: string; staleOwner?: true; uncertain?: true }
 function parseOAuthRefreshIntent(
   provider: string,
   accountId: string,
@@ -54,6 +72,8 @@ function parseOAuthRefreshIntent(
     || value.accountId !== accountId
     || typeof value.generation !== "string"
     || typeof value.createdAt !== "number"
+    || (value.flightId !== undefined && typeof value.flightId !== "string")
+    || (value.staleOwner !== undefined && value.staleOwner !== true)
   ) {
     return { version: 1, provider, accountId, generation: "", createdAt: 0, uncertain: true };
   }
@@ -82,13 +102,19 @@ export function peekOAuthRefreshIntent(provider: string, accountId: string): OAu
     return { version: 1, provider, accountId, generation: "", createdAt: 0, uncertain: true };
   }
 }
-export function writeOAuthRefreshIntent(provider: string, accountId: string, generation: string, createdAt = Date.now()): void {
+export function writeOAuthRefreshIntent(provider: string, accountId: string, generation: string, createdAt = Date.now(), flightId?: string): void {
   const dir = getConfigDir();
   if (!existsSync(dir)) mkdirSync(dir, { recursive: true, mode: 0o700 });
   hardenConfigDir();
-  const intent: OAuthRefreshIntent = { version: 1, provider, accountId, generation, createdAt };
+  const intent: OAuthRefreshIntent = { version: 1, provider, accountId, generation, createdAt, ...(flightId ? { flightId } : {}) };
   atomicWriteFile(getAuthRefreshIntentPath(provider, accountId), `${JSON.stringify(intent)}\n`);
 }
+export function markOAuthRefreshIntentStaleOwner(provider: string, accountId: string, generation: string, flightId: string): boolean {
+  const current = readOAuthRefreshIntent(provider, accountId);
+  if (current?.uncertain || current?.generation !== generation || current.flightId !== flightId) return false;
+  atomicWriteFile(getAuthRefreshIntentPath(provider, accountId), `${JSON.stringify({ ...current, staleOwner: true })}\n`);
+  return true;
+}
 export function clearOAuthRefreshIntent(provider: string, accountId: string, generation: string): boolean {
   const current = readOAuthRefreshIntent(provider, accountId);
   if (!current || current.generation !== generation) return false;
@@ -294,15 +320,118 @@ function normalizeAuthStore(raw: unknown): { store: AuthStore; hadLegacy: boolea
  * a guardian refresh persisting a non-active account cannot roll back a concurrent
  * active-account switch (lost update). Cross-process races are accepted (single proxy).
  */
+const OAUTH_MUTATION_WAIT_MS = 30_000;
+const oauthMutationEncoder = new TextEncoder();
 let mutationTail: Promise<void> = Promise.resolve();
-function serializeMutation<T>(work:()=>Promise<T>):Promise<T>{const result=mutationTail.then(work,work);mutationTail=result.then(()=>undefined,()=>undefined);return result;}
-export function mutateStore<T>(fn:(store:AuthStore)=>T|Promise<T>):Promise<T>{return serializeMutation(async()=>{const guard=await createOAuthFileLock({path:getAuthStoreLockPath(),staleAfterMs:30000}).acquire();try{
+let pendingMutations = 0;
+let mutationCurrentBytes = 0;
+let mutationHighWaterBytes = 0;
+interface QueuedOAuthMutation {
+  started: boolean;
+  settled: boolean;
+  timeout?: ReturnType<typeof setTimeout>;
+  run(): Promise<void>;
+}
+const mutationWaiters: QueuedOAuthMutation[] = [];
+let mutationRunning = false;
+
+export class OAuthMutationBusyError extends Error {
+  readonly code = "oauth_mutation_busy";
+  constructor(message = "OAuth mutation queue is busy") {
+    super(message);
+    this.name = "OAuthMutationBusyError";
+  }
+}
+
+export function oauthMutationTailSnapshot(): { currentBytes: number; highWaterBytes: number; active: number } {
+  return { currentBytes: mutationCurrentBytes, highWaterBytes: mutationHighWaterBytes, active: pendingMutations };
+}
+
+function retainedClosureStringBytes(values: readonly unknown[]): number {
+  const visit = (value: unknown): number => {
+    if (typeof value === "string") return oauthMutationEncoder.encode(value).byteLength;
+    if (Array.isArray(value)) return value.reduce((sum, entry) => sum + visit(entry), 0);
+    if (value && typeof value === "object") {
+      return Object.entries(value as Record<string, unknown>)
+        .reduce((sum, [key, entry]) => sum + oauthMutationEncoder.encode(key).byteLength + visit(entry), 0);
+    }
+    return 0;
+  };
+  return values.reduce<number>((sum, value) => sum + visit(value), 0);
+}
+
+function drainOAuthMutations(): void {
+  if (mutationRunning) return;
+  const next = mutationWaiters.shift();
+  if (!next) return;
+  if (next.settled) {
+    drainOAuthMutations();
+    return;
+  }
+  next.started = true;
+  if (next.timeout) clearTimeout(next.timeout);
+  mutationRunning = true;
+  mutationTail = next.run().finally(() => {
+    mutationRunning = false;
+    drainOAuthMutations();
+  });
+}
+
+function serializeMutation<T>(work: () => Promise<T>, retainedValues: readonly unknown[], waitMs = OAUTH_MUTATION_WAIT_MS): Promise<T> {
+  if (pendingMutations >= MAX_PENDING_OAUTH_MUTATIONS) return Promise.reject(new OAuthMutationBusyError());
+  pendingMutations += 1;
+  const retainedBytes = retainedClosureStringBytes(retainedValues);
+  mutationCurrentBytes += retainedBytes;
+  mutationHighWaterBytes = Math.max(mutationHighWaterBytes, mutationCurrentBytes);
+
+  let resolveResult!: (value: T | PromiseLike<T>) => void;
+  let rejectResult!: (reason?: unknown) => void;
+  const result = new Promise<T>((resolve, reject) => {
+    resolveResult = resolve;
+    rejectResult = reject;
+  });
+  const entry: QueuedOAuthMutation = {
+    started: false,
+    settled: false,
+    async run() {
+      try {
+        resolveResult(await work());
+      } catch (error) {
+        rejectResult(error);
+      } finally {
+        release();
+      }
+    },
+  };
+  const release = () => {
+    if (entry.settled) return;
+    entry.settled = true;
+    pendingMutations -= 1;
+    mutationCurrentBytes = Math.max(0, mutationCurrentBytes - retainedBytes);
+  };
+  entry.timeout = setTimeout(() => {
+    if (entry.started || entry.settled) return;
+    const index = mutationWaiters.indexOf(entry);
+    if (index >= 0) mutationWaiters.splice(index, 1);
+    release();
+    rejectResult(new OAuthMutationBusyError("OAuth mutation queue wait timed out"));
+  }, waitMs);
+  // Only unref the long default wait. Short waitMs (tests) must stay ref'd:
+  // on Windows Bun under `bun test --isolate`, an unref'd timer can fail to
+  // fire while the head mutation holds an unresolved Promise, hanging the
+  // waiter forever (#827 / full admission queue hang on windows-latest).
+  if (waitMs >= OAUTH_MUTATION_WAIT_MS) entry.timeout.unref?.();
+  mutationWaiters.push(entry);
+  drainOAuthMutations();
+  return result;
+}
+export function mutateStore<T>(fn:(store:AuthStore)=>T|Promise<T>, retainedValues: readonly unknown[] = [], options?: { waitMs?: number }):Promise<T>{return serializeMutation(async()=>{const guard=await createOAuthFileLock({path:getAuthStoreLockPath(),staleAfterMs:30000}).acquire();try{
     const { store, hadLegacy } = loadAuthStoreInternal();
     if (hadLegacy) backupLegacyOnce();
     const result = await fn(store);
     persist(store);
     return result;
-  }finally{guard.release();}});
+  }finally{guard.release();}}, retainedValues, options?.waitMs);
 }
 
 /** The ACTIVE account's credential for a provider (what requests should use). */
@@ -366,7 +495,7 @@ export async function saveCredential(
       set.accounts.push({ id, credential: safe, addedAt: Date.now() });
       set.activeAccountId = id;
     }
-  });
+  }, [provider, safe]);
 }
 
 /** Remove the ACTIVE account; remaining accounts promote the first one. */
@@ -380,7 +509,7 @@ export async function removeCredential(provider: string): Promise<void> {
       return;
     }
     set.activeAccountId = set.accounts[0]!.id;
-  });
+  }, [provider]);
 }
 
 // ---------------------------------------------------------------------------
@@ -395,6 +524,17 @@ export function listAccounts(provider: string): ProviderAccount[] {
   return loadAuthStore()[provider]?.accounts ?? [];
 }
 
+export function listLiveOAuthAccountKeys(
+  providerNames: ReadonlySet<string>,
+): ReadonlySet<string> {
+  const keys = new Set<string>();
+  for (const [provider, accountSet] of Object.entries(loadAuthStore())) {
+    if (!providerNames.has(provider)) continue;
+    for (const account of accountSet.accounts) keys.add(`${provider}\0${account.id}`);
+  }
+  return keys;
+}
+
 export function getAccountCredential(provider: string, accountId: string): OAuthCredentials | null {
   return loadAuthStore()[provider]?.accounts.find(a => a.id === accountId)?.credential ?? null;
 }
@@ -408,7 +548,7 @@ export async function saveAccountCredential(provider: string, accountId: string,
     if (!account) return;
     account.credential = safe;
     delete account.needsReauth;
-  });
+  }, [provider, accountId, safe]);
 }
 
 export async function setActiveAccount(provider: string, accountId: string): Promise<boolean> {
@@ -417,7 +557,7 @@ export async function setActiveAccount(provider: string, accountId: string): Pro
     if (!set || !set.accounts.some(a => a.id === accountId)) return false;
     set.activeAccountId = accountId;
     return true;
-  });
+  }, [provider, accountId]);
 }
 
 export async function setAccountAlias(provider: string, accountId: string, alias: string | undefined): Promise<boolean> {
@@ -427,12 +567,12 @@ export async function setAccountAlias(provider: string, accountId: string, alias
     if (alias) account.alias = alias;
     else delete account.alias;
     return true;
-  });
+  }, [provider, accountId, alias]);
 }
 
 /** Remove one account by id; active removal promotes the first remaining account. */
 export async function removeAccount(provider: string, accountId: string): Promise<boolean> {
-  return await mutateStore(store => {
+  const removed = await mutateStore(store => {
     const set = store[provider];
     if (!set) return false;
     const before = set.accounts.length;
@@ -444,7 +584,8 @@ export async function removeAccount(provider: string, accountId: string): Promis
     }
     if (set.activeAccountId === accountId) set.activeAccountId = set.accounts[0]!.id;
     return true;
-  });
+  }, [provider, accountId]);
+  return removed;
 }
 
 /** Replace or clear a provider account set (used for transactional Kiro add-account rollback). */
@@ -467,17 +608,23 @@ export async function replaceProviderAccountSet(
         ...(account.addedAt !== undefined ? { addedAt: account.addedAt } : {}),
       })),
     };
-  });
+  }, [provider, set]);
 }
 
-export async function markAccountNeedsReauth(provider: string, accountId: string, needsReauth: boolean): Promise<void> {
+export async function markAccountNeedsReauth(
+  provider: string,
+  accountId: string,
+  needsReauth: boolean,
+  writerGeneration = captureConfigGeneration(),
+): Promise<void> {
+  if (writerGeneration < lastReconciledGeneration && !liveOAuthAccountKeys.has(oauthAccountKey(provider, accountId))) return;
   await mutateStore(store => {
     const account = store[provider]?.accounts.find(a => a.id === accountId);
     if (!account) return;
     if (needsReauth) account.needsReauth = true;
     else delete account.needsReauth;
-  });
+  }, [provider, accountId]);
 }
 
-export async function mergeAccountCredential(provider:string,accountId:string,credential:OAuthCredentials,opts:{expectedGeneration?:string;afterPrePersistRead?:()=>void|Promise<void>}={}):Promise<{superseded:false}|{superseded:true;stored:OAuthCredentials}>{const safe=normalizeCredential(credential);if(!safe)throw new Error("Refusing to persist invalid OAuth credential");return await mutateStore(async store=>{await opts.afterPrePersistRead?.();const account=store[provider]?.accounts.find(x=>x.id===accountId);if(!account)throw new Error(`OAuth account disappeared before persist: ${provider}`);if(opts.expectedGeneration!==undefined&&credentialGeneration(account.credential)!==opts.expectedGeneration)return{superseded:true,stored:account.credential};account.credential=safe;delete account.needsReauth;return{superseded:false};});}
-export async function markAccountNeedsReauthIfGeneration(provider:string,accountId:string,generation:string):Promise<boolean>{return await mutateStore(store=>{const account=store[provider]?.accounts.find(x=>x.id===accountId);if(!account?.credential||credentialGeneration(account.credential)!==generation)return false;account.needsReauth=true;return true;});}
+export async function mergeAccountCredential(provider:string,accountId:string,credential:OAuthCredentials,opts:{expectedGeneration?:string;afterPrePersistRead?:()=>void|Promise<void>}={}):Promise<{superseded:false}|{superseded:true;stored:OAuthCredentials}>{const safe=normalizeCredential(credential);if(!safe)throw new Error("Refusing to persist invalid OAuth credential");return await mutateStore(async store=>{await opts.afterPrePersistRead?.();const account=store[provider]?.accounts.find(x=>x.id===accountId);if(!account)throw new Error(`OAuth account disappeared before persist: ${provider}`);if(opts.expectedGeneration!==undefined&&credentialGeneration(account.credential)!==opts.expectedGeneration)return{superseded:true,stored:account.credential};account.credential=safe;delete account.needsReauth;return{superseded:false};},[provider,accountId,safe,opts.expectedGeneration]);}
+export async function markAccountNeedsReauthIfGeneration(provider:string,accountId:string,generation:string,writerGeneration=captureConfigGeneration()):Promise<boolean>{const key=oauthAccountKey(provider,accountId);if(writerGeneration<lastReconciledGeneration&&!liveOAuthAccountKeys.has(key))return false;return await mutateStore(store=>{const account=store[provider]?.accounts.find(x=>x.id===accountId);if(!account?.credential||credentialGeneration(account.credential)!==generation)return false;if(writerGeneration<lastReconciledGeneration&&!liveOAuthAccountKeys.has(key))return false;account.needsReauth=true;return true;},[provider,accountId,generation]);}

package/src/oauth/token-guardian.ts

@@ -22,11 +22,14 @@ import {
   markCodexAccountValidationFailed,
   readCodexAccountRecord,
   TokenRefreshError,
+  CodexCredentialRefreshBusyError,
+  CodexCredentialRefreshStaleError,
 } from "../codex/account-store";
 import { codexWarmupFailureReason, warmCodexAccount } from "../codex/warmup";
 import { getMainAccountToken, MAIN_CODEX_ACCOUNT_ID } from "../codex/main-account";
 import { isCanonicalOpenAiForwardProvider, OPENAI_CODEX_PROVIDER_ID } from "../providers/openai-tiers";
 import { providerCodexAccountMode } from "../providers/registry";
+import { captureConfigGeneration, type GenerationContext } from "../lib/state-store-sweeper";
 
 export interface TokenGuardianHandle {
   stop(): void;
@@ -58,6 +61,8 @@ interface BackoffEntry {
 
 // Module-scoped so backoff survives across sweeps within one process (keyed "oauth:<p>" / "codex:<id>").
 const backoff = new Map<string, BackoffEntry>();
+let lastReconciledGeneration = 0;
+let liveBackoffKeys = new Set<string>();
 
 /** Test hook: clear backoff state between cases. */
 export function __resetGuardianState(): void {
@@ -87,7 +92,15 @@ function inBackoff(key: string, nowMs: number): boolean {
   return entry !== undefined && entry.retryAfterMs > nowMs;
 }
 
-function recordFailure(key: string, nowMs: number, baseSeconds: number, maxSeconds: number, permanent: boolean): void {
+function recordFailure(
+  key: string,
+  nowMs: number,
+  baseSeconds: number,
+  maxSeconds: number,
+  permanent: boolean,
+  writerGeneration = captureConfigGeneration(),
+): void {
+  if (writerGeneration < lastReconciledGeneration && !liveBackoffKeys.has(key)) return;
   const prev = backoff.get(key);
   const attempts = (prev?.attempts ?? 0) + 1;
   // Permanent failures (revoked/expired refresh token) wait the full ceiling — nothing but a
@@ -116,6 +129,7 @@ async function runWithConcurrency(tasks: Array<() => Promise<void>>, limit: numb
  * ids only, never tokens).
  */
 export async function guardianSweep(nowMs: number = Date.now()): Promise<GuardianSweepResult> {
+  const writerGeneration = captureConfigGeneration();
   const config: OcxConfig = loadConfig();
   const g = config.tokenGuardian;
   const result: GuardianSweepResult = { enabled: !!g?.enabled, refreshed: [], warmed: [], failed: [], skippedBackoff: [] };
@@ -143,7 +157,7 @@ export async function guardianSweep(nowMs: number = Date.now()): Promise<Guardia
           // Terminal grant failures surface as OAuthLoginRequiredError (account marked
           // needsReauth by the resolver) — back off at the ceiling; transient errors backoff exponentially.
           const permanent = err instanceof OAuthLoginRequiredError;
-          recordFailure(key, nowMs, opts.backoffBaseSeconds, opts.backoffMaxSeconds, permanent);
+          recordFailure(key, nowMs, opts.backoffBaseSeconds, opts.backoffMaxSeconds, permanent, writerGeneration);
           result.failed.push(key);
         }
       });
@@ -174,7 +188,7 @@ export async function guardianSweep(nowMs: number = Date.now()): Promise<Guardia
             backoff.delete(key);
             result.warmed.push(key);
           } catch (err) {
-            recordFailure(key, nowMs, opts.backoffBaseSeconds, opts.backoffMaxSeconds, false);
+            recordFailure(key, nowMs, opts.backoffBaseSeconds, opts.backoffMaxSeconds, false, writerGeneration);
             result.failed.push(key);
           }
         });
@@ -210,11 +224,16 @@ export async function guardianSweep(nowMs: number = Date.now()): Promise<Guardia
           }
           backoff.delete(key);
         } catch (err) {
+          if (err instanceof CodexCredentialRefreshBusyError || err instanceof CodexCredentialRefreshStaleError) {
+            recordFailure(key, nowMs, opts.backoffBaseSeconds, opts.backoffMaxSeconds, false, writerGeneration);
+            result.skippedBackoff.push(key);
+            return;
+          }
           const permanent = err instanceof TokenRefreshError && (err.reason === "revoked" || err.reason === "expired");
           if (needsWarmup && !(err instanceof TokenRefreshError)) {
             markCodexAccountValidationFailed(id, codexWarmupFailureReason(err));
           }
-          recordFailure(key, nowMs, opts.backoffBaseSeconds, opts.backoffMaxSeconds, permanent);
+          recordFailure(key, nowMs, opts.backoffBaseSeconds, opts.backoffMaxSeconds, permanent, writerGeneration);
           result.failed.push(key);
         }
       });
@@ -225,6 +244,26 @@ export async function guardianSweep(nowMs: number = Date.now()): Promise<Guardia
   return result;
 }
 
+export function reconcileGuardianBackoff(context: GenerationContext): number {
+  if (context.generation <= lastReconciledGeneration) return 0;
+  const valid = new Set<string>();
+  for (const id of context.codexAccountIds) valid.add(`codex:${id}`);
+  for (const key of context.oauthAccountKeys) {
+    const separator = key.indexOf("\0");
+    if (separator <= 0) continue;
+    valid.add(`oauth:${key.slice(0, separator)}:${key.slice(separator + 1)}`);
+  }
+  let removed = 0;
+  for (const key of backoff.keys()) {
+    if (valid.has(key)) continue;
+    backoff.delete(key);
+    removed += 1;
+  }
+  liveBackoffKeys = valid;
+  lastReconciledGeneration = context.generation;
+  return removed;
+}
+
 /**
  * Start the background sweep loop. Returns a handle whose stop() clears the pending timer (in-flight
  * refreshes settle on their own). Schedules recursively so each interval gets fresh jitter. The loop

package/src/oauth/types.ts

@@ -13,7 +13,8 @@ export interface KiroOAuthMetadata {
 export type OAuthCredentials = {
   refresh: string;
   access: string;
-  expires: number; // epoch ms (already skew-adjusted by the provider flow)
+  /** Epoch ms after any small provider-specific early-refresh margin; the shared gate adds 1 minute. */
+  expires: number;
   email?: string;
   accountId?: string;
   source?: OAuthCredentialSource;

package/src/providers/base-url-choices.ts

@@ -39,6 +39,16 @@ export const ALIBABA_INTL_BASE_URL_CHOICES: readonly ProviderBaseUrlChoice[] = [
   { id: "custom", label: "Custom" },
 ];
 
+/** Alibaba Coding Plan endpoint presets (international default; China mainland selectable). */
+export const ALIBABA_CODING_INTL_BASE_URL = "https://coding-intl.dashscope.aliyuncs.com/v1";
+export const ALIBABA_CODING_CN_BASE_URL = "https://coding.dashscope.aliyuncs.com/v1";
+
+export const ALIBABA_CODING_BASE_URL_CHOICES: readonly ProviderBaseUrlChoice[] = [
+  { id: "intl", label: "International", baseUrl: ALIBABA_CODING_INTL_BASE_URL },
+  { id: "china", label: "China", baseUrl: ALIBABA_CODING_CN_BASE_URL },
+  { id: "custom", label: "Custom" },
+];
+
 /** Match a saved baseUrl to a known choice id (`custom` when it does not match). */
 export function matchBaseUrlChoice(
   choices: readonly ProviderBaseUrlChoice[],

package/src/providers/derive.ts

@@ -4,6 +4,7 @@ import { PROVIDER_REGISTRY, providerMatchesRegistryTransport, type ProviderRegis
 export interface DerivedKeyLoginProvider {
   label: string;
   baseUrl: string;
+  responsesPath?: string;
   adapter: string;
   apiKeyTransport?: OcxProviderConfig["apiKeyTransport"];
   dashboardUrl: string;
@@ -53,6 +54,7 @@ export interface DerivedProviderPreset {
   label: string;
   adapter: string;
   baseUrl: string;
+  responsesPath?: string;
   defaultModel?: string;
   auth: "oauth" | "forward" | "key" | "local";
   codexAccountMode?: CodexAccountMode;
@@ -105,6 +107,7 @@ export function providerConfigSeed(entry: ProviderRegistryEntry): OcxProviderCon
     adapter: entry.adapter,
     baseUrl: entry.baseUrl,
     ...(entry.apiKeyTransport !== undefined ? { apiKeyTransport: entry.apiKeyTransport } : {}),
+    ...(entry.responsesPath ? { responsesPath: entry.responsesPath } : {}),
     authMode: entry.authKind === "local" ? undefined : entry.authKind,
     ...(entry.codexAccountMode ? { codexAccountMode: entry.codexAccountMode } : {}),
     ...(entry.keyOptional !== undefined ? { keyOptional: entry.keyOptional } : {}),
@@ -132,6 +135,8 @@ export function providerConfigSeed(entry: ProviderRegistryEntry): OcxProviderCon
     ...(entry.noPenaltyModels ? { noPenaltyModels: [...entry.noPenaltyModels] } : {}),
     ...(entry.parallelToolCalls !== undefined ? { parallelToolCalls: entry.parallelToolCalls } : {}),
     ...(entry.promptCacheKey !== undefined ? { promptCacheKey: entry.promptCacheKey } : {}),
+    ...(entry.responsesPath !== undefined ? { responsesPath: entry.responsesPath } : {}),
+    ...(entry.statelessResponses !== undefined ? { statelessResponses: entry.statelessResponses } : {}),
     ...(entry.autoToolChoiceOnlyModels ? { autoToolChoiceOnlyModels: [...entry.autoToolChoiceOnlyModels] } : {}),
     ...(entry.preserveReasoningContentModels ? { preserveReasoningContentModels: [...entry.preserveReasoningContentModels] } : {}),
     ...(entry.reasoningSplitModels ? { reasoningSplitModels: [...entry.reasoningSplitModels] } : {}),
@@ -152,6 +157,7 @@ export function deriveKeyLoginMap(): Record<string, DerivedKeyLoginProvider> {
     out[entry.id] = {
       label: entry.label,
       baseUrl: entry.baseUrl,
+      ...(entry.responsesPath ? { responsesPath: entry.responsesPath } : {}),
       adapter: entry.adapter,
       ...(entry.apiKeyTransport !== undefined ? { apiKeyTransport: entry.apiKeyTransport } : {}),
       dashboardUrl: entry.dashboardUrl,
@@ -227,6 +233,7 @@ export function enrichProviderFromRegistry(name: string, prov: OcxProviderConfig
   const seed = providerConfigSeed(entry);
   if (prov.apiKeyTransport === undefined && seed.apiKeyTransport !== undefined) prov.apiKeyTransport = seed.apiKeyTransport;
   if (!prov.defaultModel && seed.defaultModel) prov.defaultModel = seed.defaultModel;
+  if (prov.responsesPath === undefined && seed.responsesPath !== undefined) prov.responsesPath = seed.responsesPath;
   // Fill mode only when absent: an explicit persisted `direct` must never be overwritten.
   if (prov.codexAccountMode === undefined && seed.codexAccountMode !== undefined) prov.codexAccountMode = seed.codexAccountMode;
   if (!prov.models && seed.models) prov.models = [...seed.models];
@@ -248,6 +255,10 @@ export function enrichProviderFromRegistry(name: string, prov: OcxProviderConfig
   if (!prov.noPenaltyModels && seed.noPenaltyModels) prov.noPenaltyModels = [...seed.noPenaltyModels];
   if (prov.parallelToolCalls === undefined && seed.parallelToolCalls !== undefined) prov.parallelToolCalls = seed.parallelToolCalls;
   if (prov.promptCacheKey === undefined && seed.promptCacheKey !== undefined) prov.promptCacheKey = seed.promptCacheKey;
+  // Fill-only: a hand-edited path must survive, and a config saved before the registry
+  // learned this route still gets backfilled.
+  if (prov.responsesPath === undefined && seed.responsesPath !== undefined) prov.responsesPath = seed.responsesPath;
+  if (prov.statelessResponses === undefined && seed.statelessResponses !== undefined) prov.statelessResponses = seed.statelessResponses;
   if (!prov.autoToolChoiceOnlyModels && seed.autoToolChoiceOnlyModels) prov.autoToolChoiceOnlyModels = [...seed.autoToolChoiceOnlyModels];
   if (!prov.preserveReasoningContentModels && seed.preserveReasoningContentModels) prov.preserveReasoningContentModels = [...seed.preserveReasoningContentModels];
   if (!prov.reasoningSplitModels && seed.reasoningSplitModels) prov.reasoningSplitModels = [...seed.reasoningSplitModels];
@@ -287,6 +298,7 @@ function entryToPreset(entry: ProviderRegistryEntry): DerivedProviderPreset {
     label: entry.label,
     adapter: entry.adapter,
     baseUrl: entry.baseUrl,
+    ...(entry.responsesPath ? { responsesPath: entry.responsesPath } : {}),
     auth: entry.authKind === "forward" ? "forward" : entry.authKind === "oauth" ? "oauth" : entry.authKind === "local" ? "local" : "key",
     ...(entry.codexAccountMode ? { codexAccountMode: entry.codexAccountMode } : {}),
     ...(entry.codexAccountMode ? { provider: providerConfigSeed(entry) } : {}),

package/src/providers/free-directory.ts

@@ -18,7 +18,7 @@ export const FREE_PROVIDER_ACCESS_GROUPS = {
   ],
   "recurring-credit": ["bytez", "nous-research"],
   "signup-credit": [
-    "agentrouter", "ai21", "baichuan", "deepinfra", "deepseek", "doubao", "fireworks", "freemodel-dev", "glm-cn",
+    "agentrouter", "ai21", "baichuan", "baseten", "deepinfra", "deepseek", "doubao", "fireworks", "freemodel-dev", "glm-cn",
     "hyperbolic", "longcat", "monsterapi", "nebius", "novita", "nscale", "nvidia", "predibase", "publicai", "qoder",
     "scaleway", "sensenova", "stepfun", "together", "vertex",
   ],
@@ -119,6 +119,9 @@ const CONNECTABLE: Record<string, ConnectableOverride> = {
   agentrouter: { baseUrl: "https://agentrouter.org", dashboardUrl: "https://agentrouter.org", adapter: "anthropic", authKind: "key", supportLevel: "experimental", verification: "primary", modelsUrl: "https://agentrouter.org/v1/models", lastVerified: LAST_VERIFIED, discovery: "live", liveModels: true },
   ai21: openAi("https://api.ai21.com/studio/v1", "https://studio.ai21.com/account/api-key", { supportLevel: "supported", verification: "official", documentationUrl: "https://docs.ai21.com/reference/models" }),
   baichuan: openAi("https://api.baichuan-ai.com/v1", "https://platform.baichuan-ai.com/console/apikey", { verification: "official" }),
+  // Verified end-to-end 2026-07-30: /v1/models returns the OpenAI-shaped live catalog (13 models),
+  // and a chat completion against moonshotai/Kimi-K3 returned a standard chat.completion payload.
+  baseten: openAi("https://inference.baseten.co/v1", "https://app.baseten.co/settings/api_keys", { supportLevel: "supported", verification: "official", documentationUrl: "https://docs.baseten.co/inference/model-apis/overview", modelsUrl: "https://inference.baseten.co/v1/models", lastVerified: "2026-07-30" }),
   deepinfra: openAi("https://api.deepinfra.com/v1/openai", "https://deepinfra.com/dash/api_keys", { supportLevel: "supported", verification: "official", documentationUrl: "https://deepinfra.com/docs/openai_api" }),
   deepseek: openAi("https://api.deepseek.com", "https://platform.deepseek.com/api_keys", { supportLevel: "supported", verification: "official", documentationUrl: "https://api-docs.deepseek.com/api/list-models" }),
   doubao: openAi("https://ark.cn-beijing.volces.com/api/v3", "https://console.volcengine.com/ark/region:ark+cn-beijing/apiKey", { verification: "official" }),

package/src/providers/key-failover.ts

@@ -11,6 +11,7 @@
 import { saveConfigPreservingClaudeCode } from "../config";
 import type { OcxConfig, OcxProviderConfig } from "../types";
 import { resolveProviderTransport, type OcxProviderTransport } from "./xai-transport";
+import { sweepExpiredOnWrite } from "../lib/state-store-sweeper";
 
 // ---- cooldown state (in-memory, same as codex/routing.ts) ----
 
@@ -99,6 +100,7 @@ export function rotateKeyOn429(
     keyCooldowns.set(cooldownKey(providerName, currentEntry.id), {
       cooldownUntil: now + cooldownMs,
     });
+    sweepExpiredOnWrite(now);
   }
 
   // Lost the race: someone already rotated away from the failed key. If the live key is healthy,
@@ -131,6 +133,16 @@ export function rotateKeyOn429(
   return null;
 }
 
+export function sweepExpiredApiKeyCooldowns(now = Date.now()): number {
+  let removed = 0;
+  for (const [key, cooldown] of keyCooldowns) {
+    if (cooldown.cooldownUntil > now) continue;
+    keyCooldowns.delete(key);
+    removed += 1;
+  }
+  return removed;
+}
+
 interface RotateProviderTransportOptions {
   retryAfter?: string | null;
   now?: number;

package/src/providers/openai-sidecar.ts

@@ -101,7 +101,10 @@ export async function resolveFirstUsableOpenAiSidecar(
             config,
             authContext.accountId,
             outcome,
-            { probeLeaseId: authContext.probeLeaseId },
+            {
+              probeLeaseId: authContext.probeLeaseId,
+              writerGeneration: authContext.writerGeneration,
+            },
           ),
         }
         : {}),