@bitkyc08/opencodex 2.81.0 → 2.83.0

package/src/oauth/anthropic-account-refusal.ts

@@ -3,7 +3,7 @@ import { anthropicModelFamily } from "./anthropic-model-quota";
 import { readBoundedResponseBody } from "../lib/bounded-body";
 import { classifyAnthropic429, anthropicRetryAfterMs, anthropicRatePolicyFor, ANTHROPIC_SHORT_RETRY_MS, ANTHROPIC_MAX_INLINE_THROTTLE_MS } from "./anthropic-rate-limit-policy";
 import { isNonReplayableResponse, sleepWithAbort } from "../lib/upstream-retry";
-import { credentialGeneration, getAccountCredentialWithStatus } from "./store";
+import { credentialGeneration, getAccountCredentialWithStatus, markAccountNeedsReauthIfGeneration } from "./store";
 import type { OAuthAccessSnapshot } from "./index";
 import type { OcxConfig } from "../types";
 import type { AnthropicRouteDecision } from "./anthropic-model-routes";
@@ -31,6 +31,22 @@ export function bindAnthropicRefusalCredentialForSend(response: Response, owner:
   responseCredentials.set(response, Object.freeze({ ...owner, providerAccountUuid, checkProviderUuid: arguments.length >= 3 }));
 }
 
+async function isRevokedOAuthToken(response: Response, signal?: AbortSignal): Promise<boolean> {
+  if (response.status !== 401) return false;
+  try {
+    const body = await readBoundedResponseBody(response.clone(), { signal, fatalUtf8: true });
+    if (!body.displaySafe || body.truncated) return false;
+    const payload: unknown = JSON.parse(body.text);
+    if (!payload || typeof payload !== "object" || Array.isArray(payload)
+      || !("type" in payload) || payload.type !== "error" || !("error" in payload)) return false;
+    const error = payload.error;
+    return !!error && typeof error === "object" && !Array.isArray(error)
+      && "type" in error && error.type === "authentication_error"
+      && "message" in error && error.message === "OAuth access token has been revoked."
+      && (!("code" in error) || error.code == null);
+  } catch { return false; }
+}
+
 async function isAccountRefusal(response: Response, signal?: AbortSignal): Promise<boolean> {
   try {
     const body = await readBoundedResponseBody(response.clone(), { signal });
@@ -91,6 +107,28 @@ export async function rotateAnthropicAccountOnResponseForInstance(
       && credentialGeneration(row.credential) === sent.generation
       && (!sent.checkProviderUuid || row.credential.accountId === sent.providerAccountUuid) ? row : undefined;
   };
+  if (response.status === 401) {
+    if (options.allowAccountRefusal === false) return null;
+    let verdict = verdicts.get(response);
+    if (!verdict) { verdict = isRevokedOAuthToken(response, options.signal); verdicts.set(response, verdict); }
+    if (!await verdict || options.signal?.aborted || !ownedCurrent()) return null;
+    options.currentDecision?.();
+    let marked: boolean;
+    try {
+      marked = await markAccountNeedsReauthIfGeneration(instance, sent.accountId, sent.generation, undefined, undefined, store => {
+        const row = store[instance]?.accounts.find(account => account.id === sent.accountId);
+        return !options.signal?.aborted && configuredAnthropicInstance(options.config, instance) === instance
+          && anthropicPhysicalSendOwnershipIsCurrent(sent, store)
+          && (!sent.checkProviderUuid || row?.credential.accountId === sent.providerAccountUuid);
+      });
+    } catch { return null; }
+    if (!marked || configuredAnthropicInstance(options.config, instance) !== instance
+      || !anthropicPhysicalSendOwnershipIsCurrent(sent)) return null;
+    routing.clearAnthropicSessionAffinityForAccount(sent.accountId);
+    if (!options.canRetry || options.signal?.aborted) return null;
+    const decision = options.currentDecision ? options.currentDecision() : options.decision ?? null;
+    return pickAlternateAnthropicAccount(options.config, sent.accountId, Date.now(), decision, options.model, options.excludedAccountIds);
+  }
   if (response.status === 429) {
     const current = ownedCurrent();
     if (!current) return null;

package/src/oauth/anthropic-routing.ts

@@ -704,7 +704,7 @@ function createAnthropicRouting(instance: AnthropicInstanceId): AnthropicRouting
     excludedAccountIds?: ReadonlySet<string>,
   ): string | null {
     if (!admitted(config)) return null;
-    const strategy = anthropicPoolStrategy(config);
+    const strategy = isAnthropicAccountPoolEnabled(config) ? anthropicPoolStrategy(config) : "quota";
     const eligible = routeCandidates(getEligibleAnthropicAccounts(now, model), decision).filter(id => id !== excludeId && !excludedAccountIds?.has(id));
     if (strategy === "round-robin") {
       return peekRoundRobinAccount(poolKey, eligible, stickyLimitForPool(config));

package/src/oauth/anthropic-send-ownership.ts

@@ -1,6 +1,6 @@
 /** Ownership captured before a physical send, independent of subsequent cooldown observations. */
 import type { OAuthAccessSnapshot } from "./index";
-import { credentialGeneration, getAccountSet } from "./store";
+import { credentialGeneration, getAccountSet, type AuthStore } from "./store";
 import { isAnthropicInstanceId, type AnthropicInstanceId } from "../providers/anthropic-instance-id";
 import { anthropicCooldownRecoveryFor } from "../providers/quota/anthropic-cooldown-recovery";
 import { captureProviderAccountQuotaEpoch } from "../providers/quota/account-cache";
@@ -32,8 +32,8 @@ export function captureAnthropicPhysicalSendOwnership(snapshot: OAuthAccessSnaps
 }
 
 /** Pure ownership read: never adopt or reserve the replacement account's current incarnation. */
-export function anthropicPhysicalSendOwnershipIsCurrent(owner: AnthropicPhysicalSendOwnership): boolean {
-  const row = getAccountSet(owner.provider)?.accounts.find(account => account.id === owner.accountId);
+export function anthropicPhysicalSendOwnershipIsCurrent(owner: AnthropicPhysicalSendOwnership, store?: AuthStore): boolean {
+  const row = (store ? store[owner.provider] : getAccountSet(owner.provider))?.accounts.find(account => account.id === owner.accountId);
   return !!row && row.loginId === owner.loginId && row.addedAt === owner.addedAt
     && row.credential.access === owner.accessToken && credentialGeneration(row.credential) === owner.generation
     && anthropicCooldownRecoveryFor(owner.provider).anthropicAccountIncarnation(owner.accountId) === owner.accountIncarnation

package/src/oauth/chatgpt.ts

@@ -1,6 +1,106 @@
 import { OAuthCallbackFlow } from "./callback-server";
 import type { OAuthController, OAuthCredentials } from "./types";
 import { generatePKCE } from "./pkce";
+import { classifyChatgptRefreshFailure } from "../codex/chatgpt-refresh-failure";
+import { readBoundedResponseBytes } from "../lib/bounded-body";
+
+/**
+ * Per-fetch deadline for ChatGPT auth endpoint calls. The deviceauth grant got the
+ * same bound in #3898 after one stuck TCP connection held the login slot for the
+ * whole grant; a hung refresh would pin the refresh intent lock indefinitely.
+ */
+export const CHATGPT_FETCH_TIMEOUT_MS = 30_000;
+
+/** Non-HTTP failures retain no caller reason, upstream error, or cause. */
+export class ChatGptTokenRequestError extends Error {
+  readonly terminal = false;
+
+  constructor(kind: "abort" | "timeout" | "transport") {
+    super(kind === "abort" ? "ChatGPT token request cancelled"
+      : kind === "timeout" ? "ChatGPT token request timed out" : "ChatGPT token request failed");
+    this.name = kind === "abort" ? "AbortError" : kind === "timeout" ? "TimeoutError" : "ChatGptTokenRequestError";
+  }
+}
+
+const CHATGPT_ERROR_BODY_MAX_BYTES = 16 * 1024;
+const CHATGPT_SUCCESS_BODY_MAX_BYTES = 64 * 1024;
+
+/** One deadline covers headers and body; every settled call detaches its caller. */
+async function chatGptTokenRequest(
+  body: URLSearchParams,
+  label: "ChatGPT refresh" | "ChatGPT token exchange",
+  options: { signal?: AbortSignal; timeoutMs?: number },
+): Promise<OAuthCredentials> {
+  const controller = new AbortController();
+  const onAbort = () => controller.abort(new ChatGptTokenRequestError("abort"));
+  options.signal?.addEventListener("abort", onAbort, { once: true });
+  if (options.signal?.aborted) onAbort();
+  const timer = setTimeout(() => controller.abort(new ChatGptTokenRequestError("timeout")),
+    options.timeoutMs ?? CHATGPT_FETCH_TIMEOUT_MS);
+  let endpointError: ChatGptTokenError | undefined;
+  try {
+    controller.signal.throwIfAborted();
+    const response = await fetch(TOKEN_URL, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: body.toString(),
+      signal: controller.signal,
+    });
+    const result = await readBoundedResponseBytes(response, {
+      signal: controller.signal,
+      maxBytes: response.ok ? CHATGPT_SUCCESS_BODY_MAX_BYTES : CHATGPT_ERROR_BODY_MAX_BYTES,
+    });
+    controller.signal.throwIfAborted();
+    const text = new TextDecoder().decode(result.bytes);
+    if (!response.ok) {
+      endpointError = chatGptTokenError(response.status, result.oversized ? "" : text, label);
+      throw endpointError;
+    }
+    if (result.oversized) throw new ChatGptTokenRequestError("transport");
+    return credsFromToken(JSON.parse(text) as Record<string, unknown>);
+  } catch (error) {
+    if (controller.signal.aborted) throw controller.signal.reason;
+    if (endpointError && error === endpointError) throw endpointError;
+    throw new ChatGptTokenRequestError("transport");
+  } finally {
+    clearTimeout(timer);
+    options.signal?.removeEventListener("abort", onAbort);
+  }
+}
+
+/**
+ * Token-endpoint failure carrying the HTTP status, the allowlisted OAuth error code,
+ * and a terminal verdict requiring an explicit grant-refusal code. The shared
+ * Codex classifier supplies the code vocabulary; free text is never grant evidence.
+ */
+export class ChatGptTokenError extends Error {
+  constructor(
+    public readonly httpStatus: number,
+    public readonly oauthError: string | undefined,
+    public readonly terminal: boolean,
+    message: string,
+  ) {
+    super(message);
+    this.name = "ChatGptTokenError";
+  }
+}
+
+function chatGptTokenError(status: number, body: string, label: string): ChatGptTokenError {
+  const failure = classifyChatgptRefreshFailure(status, body);
+  // Reclassify the allowlisted code alone to reuse the shared terminal vocabulary
+  // without its description-only compatibility rule for other Codex callers.
+  const terminal = failure.reason !== "unknown" && failure.code !== undefined
+    && classifyChatgptRefreshFailure(status, JSON.stringify({ error: failure.code })).reason !== "unknown";
+  // The message carries the status and the allowlisted OAuth code only — never the
+  // free-text `error_description`, which can echo OAuth material into log surfaces
+  // (the same closed vocabulary the pool's noteChatgptRefreshFailure logs with).
+  return new ChatGptTokenError(
+    status,
+    failure.code,
+    terminal,
+    `${label} failed: ${status} code=${failure.code ?? "none"}`,
+  );
+}
 
 const CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
 const AUTH_URL = "https://auth.openai.com/oauth/authorize";
@@ -202,34 +302,16 @@ export class ChatGPTOAuthFlow extends OAuthCallbackFlow {
 
   async exchangeToken(code: string, _state: string, redirectUri: string): Promise<OAuthCredentials> {
     if (!this.#verifier) throw new Error("ChatGPT PKCE verifier not initialized");
-    const resp = await fetch(TOKEN_URL, {
-      method: "POST",
-      headers: { "Content-Type": "application/x-www-form-urlencoded" },
-      body: new URLSearchParams({
-        grant_type: "authorization_code",
-        client_id: CLIENT_ID,
-        code,
-        redirect_uri: redirectUri,
-        code_verifier: this.#verifier,
-      }).toString(),
-    });
-    if (!resp.ok) {
-      const errDesc = await safeErrorDescription(resp);
-      throw new Error(`ChatGPT token exchange failed: ${resp.status} ${errDesc}`);
-    }
-    return credsFromToken((await resp.json()) as Record<string, unknown>);
+    return chatGptTokenRequest(new URLSearchParams({
+      grant_type: "authorization_code",
+      client_id: CLIENT_ID,
+      code,
+      redirect_uri: redirectUri,
+      code_verifier: this.#verifier,
+    }), "ChatGPT token exchange", { signal: this.ctrl.signal });
   }
 }
 
-function safeErrorDescription(resp: Response): Promise<string> {
-  return resp.text().catch(() => "").then(text => {
-    try {
-      const parsed = JSON.parse(text) as { error?: string; error_description?: string };
-      return [parsed.error, parsed.error_description].filter(Boolean).join(": ") || `HTTP ${resp.status}`;
-    } catch { return `HTTP ${resp.status}`; }
-  });
-}
-
 /**
  * How the user proves identity. `browser` runs the localhost:1455 callback flow;
  * `device` runs the deviceauth grant, which needs no local browser or listener
@@ -255,21 +337,11 @@ export async function loginChatGPT(
 // Codex-rs uses JSON for refresh — intentional divergence; both accepted by auth.openai.com.
 export async function refreshChatGPTToken(
   refreshToken: string,
-  options: { signal?: AbortSignal } = {},
+  options: { signal?: AbortSignal; timeoutMs?: number } = {},
 ): Promise<OAuthCredentials> {
-  const resp = await fetch(TOKEN_URL, {
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams({
-      grant_type: "refresh_token",
-      client_id: CLIENT_ID,
-      refresh_token: refreshToken,
-    }).toString(),
-    signal: options.signal,
-  });
-  if (!resp.ok) {
-    const errDesc = await safeErrorDescription(resp);
-    throw new Error(`ChatGPT refresh failed: ${resp.status} ${errDesc}`);
-  }
-  return credsFromToken((await resp.json()) as Record<string, unknown>);
+  return chatGptTokenRequest(new URLSearchParams({
+    grant_type: "refresh_token",
+    client_id: CLIENT_ID,
+    refresh_token: refreshToken,
+  }), "ChatGPT refresh", options);
 }

package/src/oauth/index.ts

@@ -38,7 +38,7 @@ import { anthropicOAuthDefinition, assertAnthropicInstanceLoginConfig, Anthropic
   resumeAnthropicRefreshIntentCleanup, clearObservedAnthropicRefreshIntent } from "./anthropic-oauth-definitions";
 import { loginKimi, refreshKimiToken } from "./kimi";
 import { loginNous, NousTokenError, refreshNousToken, clearNousRefreshIntent, RefreshIntentIOError } from "./nous";
-import { loginChatGPT, refreshChatGPTToken, type ChatGPTLoginFlow } from "./chatgpt";
+import { ChatGptTokenRequestError, ChatGptTokenError, loginChatGPT, refreshChatGPTToken, type ChatGPTLoginFlow } from "./chatgpt";
 import { loginAntigravity, refreshAntigravityToken } from "./google-antigravity";
 import { loginCursor, refreshCursorToken } from "./cursor";
 import { loginZed, refreshZedToken } from "./zed";
@@ -350,7 +350,7 @@ export const OAUTH_PROVIDERS: Record<string, OAuthProviderDef> = {
   },
   chatgpt: {
     login: (ctrl, opts) => loginChatGPT(ctrl, { forceLogin: opts?.forceLogin, flow: opts?.flow }),
-    refresh: (rt) => refreshChatGPTToken(rt),
+    refresh: (rt, signal) => refreshChatGPTToken(rt, { signal }),
     providerConfig: { adapter: "openai-responses", baseUrl: "https://chatgpt.com/backend-api/codex", authMode: "forward" as const },
     defaultModel: "gpt-5.6-luna",
   },
@@ -360,7 +360,7 @@ export const OAUTH_PROVIDERS: Record<string, OAuthProviderDef> = {
  * Removed provider ids that still name a live successor.
  *
  * `devin-cli` was merged into `devin` (import-first login absorbed the CLI
- * credential import; devlog/_plan/260913_devin_provider_merge). The id can
+ * credential import; devlog/_fin/260913_devin_provider_merge). The id can
  * still arrive here from a saved config row or a stored credential slot that
  * the startup migration has not rekeyed yet, and from a user typing the old
  * name at `ocx login`. It is deliberately NOT an OAUTH_PROVIDERS entry:
@@ -712,10 +712,14 @@ function isTerminalRefreshError(err: unknown): boolean {
     || msg.includes("expired_token");
 }
 function terminal(error:unknown):boolean{
+  if (error instanceof ChatGptTokenRequestError) return false;
   if(error instanceof XaiTokenRequestError)return ["invalid_grant","refresh_token_reused","revoked_token"].includes(error.oauthError??"");
   if(error instanceof AnthropicTokenError)return (error.httpStatus===400||error.httpStatus===401)&&["invalid_grant","refresh_token_reused","revoked","revoked_token","refresh_token_revoked"].includes(error.oauthError??"");
   if(error instanceof KiroTokenRefreshError)return (error.httpStatus===400||error.httpStatus===401)&&error.oauthError!==undefined;
   if(error instanceof NousTokenError)return error.terminal===true||["invalid_grant","refresh_token_reused","revoked","revoked_token","expired_token"].includes(error.oauthError??"");
+  // ChatGPT carries the pool classifier's verdict on the error itself: revoked and
+  // expired grants are terminal; unknown/transient failures stay retryable.
+  if(error instanceof ChatGptTokenError)return error.terminal;
   // Local durable-write/read/cleanup failures are operational, not credential
   // death: the provider credential was never rejected or consumed. Never mark
   // the account needsReauth for broken local persistence infrastructure.

package/src/oauth/meta-muse-device.ts

@@ -6,7 +6,7 @@
  * resulting account token into the `LLM|` Model API key our request path sends as a
  * bearer.
  *
- * Protocol source: devlog/_plan/260912_muse_device_oauth/001_reference_measurements.md.
+ * Protocol source: devlog/_fin/260912_muse_device_oauth/001_reference_measurements.md.
  * It is second-party, not vendor documentation, so every response is parsed defensively
  * and every failure names a kind instead of throwing a bare string.
  *

package/src/oauth/store.ts

@@ -1508,7 +1508,7 @@ export async function markAccountNeedsReauth(
 export async function mergeAccountCredential(provider:string,accountId:string,credential:OAuthCredentials,opts:{expectedGeneration?:string;afterPrePersistRead?:()=>void|Promise<void>;assertOwnership?: (store: AuthStore) => void}={}):Promise<{superseded:false}|{superseded:true;stored:OAuthCredentials}>{const safe=normalizeCredential(credential);if(!safe)throw new Error("Refusing to persist invalid OAuth credential");if(isAnthropicInstanceId(provider))assertAnthropicCredentialSource(provider,safe);return await mutateStore(async store=>{await opts.afterPrePersistRead?.();const account=store[provider]?.accounts.find(x=>x.id===accountId);if(!account)throw new Error(`OAuth account disappeared before persist: ${provider}`);if(opts.expectedGeneration!==undefined&&credentialGeneration(account.credential)!==opts.expectedGeneration)return{superseded:true,stored:account.credential};opts.assertOwnership?.(store);account.credential=safe;delete account.refreshAttentionGeneration;if(account.needsReauthReason!=="verify_account"){delete account.needsReauth;delete account.needsReauthReason;}return{superseded:false};},[provider,accountId,safe,opts.expectedGeneration]);}
 // A late refresh failure must not change an operator-paused account's health. Check under
 // the mutation lock, not before awaiting it, so a concurrent pause cannot be overwritten.
-export async function markAccountNeedsReauthIfGeneration(provider:string,accountId:string,generation:string,writerGeneration=captureConfigGeneration(),reason?:"verify_account"):Promise<boolean>{const key=oauthAccountKey(provider,accountId);if(writerGeneration<lastReconciledGeneration&&!liveOAuthAccountKeys.has(key))return false;return await mutateStore(store=>{const account=store[provider]?.accounts.find(x=>x.id===accountId);if(!account?.credential||account.paused||credentialGeneration(account.credential)!==generation)return false;if(writerGeneration<lastReconciledGeneration&&!liveOAuthAccountKeys.has(key))return false;account.needsReauth=true;if(reason==="verify_account")account.needsReauthReason=reason;return true;},[provider,accountId,generation]);}
+export async function markAccountNeedsReauthIfGeneration(provider:string,accountId:string,generation:string,writerGeneration=captureConfigGeneration(),reason?:"verify_account",isCurrent?:(store:AuthStore)=>boolean):Promise<boolean>{const key=oauthAccountKey(provider,accountId);if(writerGeneration<lastReconciledGeneration&&!liveOAuthAccountKeys.has(key))return false;return await mutateStore(store=>{const account=store[provider]?.accounts.find(x=>x.id===accountId);if(!account?.credential||account.paused||credentialGeneration(account.credential)!==generation)return false;if(writerGeneration<lastReconciledGeneration&&!liveOAuthAccountKeys.has(key))return false;if(isCurrent&&!isCurrent(store))return false;account.needsReauth=true;if(reason==="verify_account")account.needsReauthReason=reason;return true;},[provider,accountId,generation]);}
 
 /** Attention is projected only; refresh selection continues to use the stored terminal flag. */
 export function accountNeedsReauthForStatus(provider: string, account: ProviderAccount, now = Date.now()): boolean {

package/src/oauth/types.ts

@@ -30,7 +30,7 @@ export interface KiroOAuthMetadata {
  *
  * The Model API is authenticated by the `LLM|` key in `access`; this token authenticates
  * the Meta ACCOUNT and exists only to mint that key and to read subscription usage
- * (devlog/_plan/260912_muse_device_oauth/002 A). Keeping it out of `access` is what lets
+ * (devlog/_fin/260912_muse_device_oauth/002 A). Keeping it out of `access` is what lets
  * every request path stay unchanged.
  *
  * It must never be added to `OAuthAccountSummary` (src/oauth/index.ts:1803) or to

package/src/providers/anthropic-fast.ts

@@ -12,7 +12,7 @@
  * account rate limit and must keep flowing into the existing wait/rotation handling, so only an
  * error message that names fast mode or the speed parameter, or a fast-pool header reporting
  * zero remaining, counts. Live probe strings (2026-09-23,
- * devlog/_plan/260923_anthropic_fast_speed/020_probe-evidence.md):
+ * devlog/_fin/260923_anthropic_fast_speed/020_probe-evidence.md):
  *   429 "Usage credits are required for fast mode."
  *   400 "Fast mode is not enabled for your organization. ..."
  *   400 "'<model>' does not support the `speed` parameter. ..."

package/src/providers/anthropic-reset-grant-ledger.ts

@@ -7,7 +7,7 @@
  * ten minutes (`b5o = 600000`) and mints a new one afterwards; this journal keeps
  * the same window.
  *
- * Rules (devlog/_plan/260923_claude_reset_grants/010_plan.md, "Ledger contract"):
+ * Rules (devlog/_fin/260923_claude_reset_grants/010_plan.md, "Ledger contract"):
  * - Every read-modify-write runs synchronously inside a cross-process
  *   `BEGIN IMMEDIATE` lock on a sibling SQLite file; nothing awaits inside it,
  *   and the upstream claim always runs after the open record is on disk.

package/src/providers/azure-model-metadata.ts

@@ -0,0 +1,115 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { atomicWriteFile } from "../config/atomic-write";
+import { getConfigDir } from "../config/paths";
+import { readBoundedResponseBytes } from "../lib/bounded-body";
+
+const SOURCE_URL = "https://models.dev/api.json";
+const FILENAME = "azure-model-metadata-cache.json";
+const TTL_MS = 24 * 60 * 60 * 1000;
+
+export type AzureModelMetadata = { input?: string[]; contextWindow?: number; maxTokens?: number };
+type Snapshot = { version: 1; fetchedAt: number; models: Record<string, AzureModelMetadata> };
+type CacheState = { snapshot?: Snapshot | null; inFlight?: Promise<void>; retryAfter: number };
+const cacheByConfigDir = new Map<string, CacheState>();
+
+function cacheState(configDir: string): CacheState {
+  let state = cacheByConfigDir.get(configDir);
+  if (!state) {
+    state = { retryAfter: 0 };
+    cacheByConfigDir.set(configDir, state);
+  }
+  return state;
+}
+
+export function isAzureModelMetadataDestination(baseUrl: string | undefined): boolean {
+  try {
+    return !!baseUrl && new URL(baseUrl).hostname.endsWith(".openai.azure.com");
+  } catch {
+    return false;
+  }
+}
+
+function positiveInteger(value: unknown): number | undefined {
+  return typeof value === "number" && Number.isSafeInteger(value) && value > 0 ? value : undefined;
+}
+
+function record(value: unknown): Record<string, unknown> | undefined {
+  return value !== null && typeof value === "object" && !Array.isArray(value)
+    ? value as Record<string, unknown> : undefined;
+}
+
+function parseModels(models: unknown, published: boolean): Record<string, AzureModelMetadata> {
+  const out: Record<string, AzureModelMetadata> = Object.create(null);
+  for (const [id, value] of Object.entries(record(models) ?? {}).slice(0, 2000)) {
+    const row = record(value);
+    if (!row || id.length > 256) continue;
+    const limit = published ? record(row.limit) : row;
+    const input = published ? record(row.modalities)?.input : row.input;
+    const modalities = Array.isArray(input)
+      ? [...new Set(input.filter((item): item is string => item === "text" || item === "image" || item === "audio"))]
+      : [];
+    const contextWindow = positiveInteger(published ? limit?.context : limit?.contextWindow);
+    const maxTokens = positiveInteger(published ? limit?.output : limit?.maxTokens);
+    if (!modalities.length && contextWindow === undefined && maxTokens === undefined) continue;
+    out[id.toLowerCase()] = {
+      ...(modalities.length ? { input: modalities } : {}),
+      ...(contextWindow !== undefined ? { contextWindow } : {}),
+      ...(maxTokens !== undefined ? { maxTokens } : {}),
+    };
+  }
+  return out;
+}
+
+function loadSnapshot(configDir: string, state: CacheState): Snapshot | null {
+  if (state.snapshot !== undefined) return state.snapshot;
+  state.snapshot = null;
+  try {
+    const raw = record(JSON.parse(readFileSync(join(configDir, FILENAME), "utf8")));
+    if (raw?.version === 1 && positiveInteger(raw.fetchedAt) !== undefined && record(raw.models)) {
+      state.snapshot = { version: 1, fetchedAt: raw.fetchedAt as number, models: parseModels(raw.models, false) };
+    }
+  } catch { /* Missing or corrupt optional metadata leaves bundled hints available. */ }
+  return state.snapshot;
+}
+
+/** Synchronous catalog fallback. Generation requests never fetch this snapshot. */
+export function publishedAzureModelMetadata(modelId: string, configDir = getConfigDir()): AzureModelMetadata | undefined {
+  return loadSnapshot(configDir, cacheState(configDir))?.models[modelId.toLowerCase()];
+}
+
+/** Refresh once per day during discovery, coalesced and bounded; retain stale data offline. */
+export async function refreshAzureModelMetadata(baseUrl: string | undefined, configDir = getConfigDir()): Promise<void> {
+  if (!isAzureModelMetadataDestination(baseUrl)) return;
+  // Capture state and destination together: tests and embedders can change config roots.
+  const state = cacheState(configDir);
+  const current = loadSnapshot(configDir, state);
+  if ((current && Date.now() - current.fetchedAt < TTL_MS) || Date.now() < state.retryAfter) return;
+  if (state.inFlight) return state.inFlight;
+  const path = join(configDir, FILENAME);
+  state.inFlight = (async () => {
+    try {
+      const signal = AbortSignal.timeout(2000);
+      const response = await fetch(SOURCE_URL, {
+        headers: { accept: "application/json" },
+        redirect: "error",
+        signal,
+      });
+      if (!response.ok) return;
+      const body = await readBoundedResponseBytes(response, { maxBytes: 16 * 1024 * 1024, signal });
+      if (body.oversized) return;
+      const raw = record(JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(body.bytes)));
+      // Provider-specific rows matter: Azure may expose text only where the direct vendor has vision.
+      const models = parseModels(record(raw?.azure)?.models, true);
+      if (!Object.keys(models).length) return;
+      state.snapshot = { version: 1, fetchedAt: Date.now(), models };
+      try { atomicWriteFile(path, JSON.stringify(state.snapshot) + "\n"); } catch { /* Memory still serves discovery. */ }
+    } catch { /* A public metadata outage must not fail provider discovery. */ }
+    finally { state.retryAfter = Date.now() + 60_000; }
+  })().finally(() => { state.inFlight = undefined; });
+  return state.inFlight;
+}
+
+export function resetAzureModelMetadataForTests(): void {
+  cacheByConfigDir.clear();
+}

package/src/providers/derive.ts

@@ -1,5 +1,7 @@
 import type { CodexAccountMode, OcxProviderConfig } from "../types";
+import { COST_VENDOR_PRIORITY, getModelMetadata, getModelMetadataCaseInsensitive } from "../generated/model-metadata";
 import { cloneFastWire } from "./fastwire";
+import { isAzureModelMetadataDestination, publishedAzureModelMetadata, type AzureModelMetadata } from "./azure-model-metadata";
 import { resolveModelPolicy } from "./resolved-model-policy";
 import {
   PROVIDER_REGISTRY,
@@ -651,6 +653,25 @@ export function shouldCaseFoldMetadataModelId(providerId: string): boolean {
   return entry?.metadataModelIdNormalize === "case-insensitive";
 }
 
+const AZURE_VENDOR_METADATA_PRIORITY = [
+  "azure-openai",
+  ...COST_VENDOR_PRIORITY.filter(provider => provider !== "azure-openai"),
+];
+
+/**
+ * Fill missing Azure model metadata by destination and known model id. Custom provider
+ * names miss PROVIDER_ALIASES; arbitrary deployment aliases still need explicit metadata.
+ */
+export function azureVendorModelMetadata(baseUrl: string | undefined, modelId: string, metadataConfigDir?: string): AzureModelMetadata | undefined {
+  if (!isAzureModelMetadataDestination(baseUrl)) return undefined;
+  const published = publishedAzureModelMetadata(modelId, metadataConfigDir);
+  for (const provider of AZURE_VENDOR_METADATA_PRIORITY) {
+    const meta = getModelMetadata(provider, modelId) ?? getModelMetadataCaseInsensitive(provider, modelId);
+    if (meta) return { ...meta, ...published };
+  }
+  return published;
+}
+
 function entryToPreset(entry: ProviderRegistryEntry): DerivedProviderPreset {
   return {
     id: entry.id,

package/src/providers/devin-cli-authmode-migration.ts

@@ -4,7 +4,7 @@
  * `devin-cli` used to be a local provider whose adapter spawned `devin acp`;
  * it later became an account provider on the shared `devin` adapter, and the
  * registry id itself has since merged into `devin` outright
- * (devlog/_plan/260913_devin_provider_merge).
+ * (devlog/_fin/260913_devin_provider_merge).
  *
  * Only the adapter repair still lives here. The `authMode` half — rewriting
  * `"local"` to `"oauth"` on the registry-id row — moved into

package/src/providers/devin-provider-merge-migration.ts

@@ -1,6 +1,6 @@
 /**
  * Merge the retired `devin-cli` provider id into `devin` at startup
- * (devlog/_plan/260913_devin_provider_merge).
+ * (devlog/_fin/260913_devin_provider_merge).
  *
  * The two registry entries were the same adapter, api-server, and credential
  * shape — only the login path differed — so `devin-cli` was removed from the