@bitkyc08/opencodex 2.81.0 → 2.83.0

package/src/providers/github-copilot-auto.ts

@@ -0,0 +1,169 @@
+import { createHash } from "node:crypto";
+import type { OcxParsedRequest, OcxProviderConfig } from "../types";
+import { readBoundedResponseBody } from "../lib/bounded-body";
+import { ProviderOutboundSendCancelledError, providerOutboundGet, providerOutboundPost } from "../lib/provider-outbound";
+import { githubCopilotHttpError, resolveCopilotApiBaseUrl } from "../oauth/github-copilot";
+import { resolveGithubCopilotTransport } from "./github-copilot-transport";
+import { waitForProviderRequestSlot, releaseProviderRequestSlot } from "./request-pacing";
+
+export interface CopilotModel {
+  id: string;
+  model_picker_enabled?: boolean;
+  supported_endpoints?: string[];
+  [key: string]: unknown;
+}
+const catalogs = new Map<string, { expires: number; models: CopilotModel[] }>();
+const MAX_MODELS = 512;
+const MAX_RESPONSE_BYTES = 1_048_576;
+export class CopilotAutoHttpError extends Error {
+  /** Preserve only the upstream status and bounded retry delay; never retain response bodies. */
+  constructor(readonly status: number, readonly retryAfter?: string) {
+    super(githubCopilotHttpError("Auto negotiation", status).message);
+  }
+}
+/** Reject array/scalar payloads before interpreting negotiation objects. */
+function record(value: unknown): Record<string, unknown> | undefined {
+  return value !== null && typeof value === "object" && !Array.isArray(value)
+    ? value as Record<string, unknown> : undefined;
+}
+/** Accept a bounded, homogeneous list so malformed pools cannot grant routing eligibility. */
+function strings(value: unknown): string[] {
+  return Array.isArray(value) && value.length <= MAX_MODELS
+    && value.every(/** Require every pool entry to be a bounded nonempty string before it can authorize model selection. */
+      v => typeof v === "string" && v.length > 0 && v.length <= 256)
+    ? value as string[] : [];
+}
+/** Isolate discovery caches by endpoint and credential without storing plaintext cache keys. */
+function authority(provider: OcxProviderConfig): string {
+  return createHash("sha256").update(JSON.stringify([provider.baseUrl, provider.apiKey])).digest("hex");
+}
+/** Make one paced, origin-fenced negotiation send with bounded decoding and secret-safe errors. */
+async function requestJson(provider: OcxProviderConfig, path: string, signal?: AbortSignal, body?: unknown,
+  sessionToken?: string, beforeSend?: () => boolean, concurrency = true): Promise<Record<string, unknown>> {
+  const boundedSignal = signal ? AbortSignal.any([signal, AbortSignal.timeout(8_000)]) : AbortSignal.timeout(8_000);
+  boundedSignal.throwIfAborted();
+  const headers = new Headers(provider.headers);
+  headers.set("Authorization", `Bearer ${provider.apiKey}`);
+  headers.set("X-GitHub-Api-Version", "2026-08-01");
+  headers.set("Content-Type", "application/json");
+  headers.delete("Copilot-Session-Token");
+  if (sessionToken) headers.set("Copilot-Session-Token", sessionToken);
+  const url = `${provider.baseUrl}${path}`;
+  // Queued-dispatch rebuilding can already own a provider concurrency lease; that
+  // caller opts out of taking a second lease while retaining interval pacing.
+  const slot = await waitForProviderRequestSlot("github-copilot", provider, "auto", boundedSignal, { concurrency });
+  try {
+    const init = { headers, signal: boundedSignal };
+    const response = body === undefined
+      ? await providerOutboundGet("github-copilot", provider, url, init, { beforeSend })
+      : await providerOutboundPost("github-copilot", provider, url, { ...init, body: JSON.stringify(body) }, { beforeSend });
+    // Status-only failures: session endpoints can echo secret material in their bodies.
+    if (!response.ok) {
+      void response.body?.cancel().catch(/** Ignore cleanup failures after discarding a refusal body that may contain reflected credentials. */
+        () => undefined);
+      const retry = response.headers.get("retry-after");
+      throw new CopilotAutoHttpError(response.status, retry && /^\d{1,4}$/.test(retry)
+        ? String(Math.max(1, Math.min(3600, Number(retry)))) : undefined);
+    }
+    const bounded = await readBoundedResponseBody(response, { maxBytes: MAX_RESPONSE_BYTES,
+      signal: boundedSignal, totalTimeoutMs: 8_000, fatalUtf8: true });
+    if (bounded.truncated) throw new Error("GitHub Copilot Auto negotiation returned an incomplete response");
+    let value: unknown;
+    try { value = JSON.parse(bounded.text); } catch { /* never include raw bodies */ }
+    const payload = record(value);
+    if (!payload) throw new Error("GitHub Copilot Auto negotiation returned invalid JSON");
+    return payload;
+  } catch (error) {
+    if (error instanceof CopilotAutoHttpError || error instanceof ProviderOutboundSendCancelledError) throw error;
+    // Transport/decoder exception messages may contain reflected header values.
+    throw new Error(boundedSignal.aborted ? "GitHub Copilot Auto negotiation cancelled"
+      : "GitHub Copilot Auto negotiation transport failed");
+  } finally { releaseProviderRequestSlot(slot); }
+}
+
+/** Detect Auto-only permission only when every row explicitly denies named selection. */
+export function copilotRequiresAuto(_provider: OcxProviderConfig, models: CopilotModel[]): boolean {
+  return models.length > 0 && models.every(/** Missing or malformed metadata cannot establish an account-wide picker denial. */
+    model => model.model_picker_enabled === false);
+}
+/** Retain legacy rows with unknown permissions; only an explicit denial removes a named picker row. */
+export function copilotPickerModels(provider: OcxProviderConfig, models: CopilotModel[]): CopilotModel[] {
+  if (copilotRequiresAuto(provider, models)) return [{ id: "auto" }];
+  return models.filter(/** Preserve named selection unless the provider explicitly marks the row unavailable. */
+    model => model.model_picker_enabled !== false);
+}
+/** Read the credential-bound catalog; callers may disable caching or reuse an existing lease. */
+export async function fetchCopilotAutoModels(provider: OcxProviderConfig, signal?: AbortSignal,
+  beforeSend?: () => boolean, cacheTtlMs = 60_000, concurrency = true): Promise<CopilotModel[]> {
+  const key = authority(provider);
+  const cached = catalogs.get(key);
+  if (cacheTtlMs > 0 && cached && cached.expires > Date.now()) return cached.models;
+  const payload = await requestJson(provider, "/models", signal, undefined, undefined, beforeSend, concurrency);
+  if (!Array.isArray(payload.data) || payload.data.length > MAX_MODELS)
+    throw new Error("GitHub Copilot model discovery returned an invalid catalog");
+  const models = payload.data.flatMap(/** Discard malformed catalog rows while retaining metadata for bounded model identifiers. */
+    value => {
+    const row = record(value);
+    if (!row || typeof row.id !== "string" || !row.id || row.id.length > 256) return [];
+    return [{ ...row, id: row.id } as CopilotModel];
+  });
+  if (cacheTtlMs > 0) {
+    if (!catalogs.has(key) && catalogs.size >= 32) catalogs.delete(catalogs.keys().next().value!);
+    catalogs.set(key, { expires: Date.now() + Math.min(cacheTtlMs, 60_000), models });
+  }
+  return models;
+}
+/** Reset discovery state between isolated account/permission regression cases. */
+export function clearCopilotAutoModelsForTests(): void { catalogs.clear(); }
+
+/** Resolve before adapter construction: the server can choose either wire on every turn. */
+export async function resolveCopilotAuto(provider: OcxProviderConfig, requestedModel: string,
+  parsed: OcxParsedRequest, signal?: AbortSignal, beforeSend?: () => boolean, concurrency = true): Promise<{
+    provider: OcxProviderConfig; modelId: string; auto: boolean; expiresAt?: number;
+  }> {
+  const transport = resolveGithubCopilotTransport(provider, provider.authMode === "oauth"
+    ? resolveCopilotApiBaseUrl(provider.baseUrl) : undefined);
+  // Never inherit a session token from a previous account or persist it in config.
+  const cleanHeaders = new Headers(transport.headers);
+  cleanHeaders.delete("Copilot-Session-Token");
+  transport.headers = Object.fromEntries(cleanHeaders);
+  let models: CopilotModel[];
+  try { models = await fetchCopilotAutoModels(transport, signal, beforeSend, 60_000, concurrency); }
+  catch (error) {
+    if (signal?.aborted || error instanceof ProviderOutboundSendCancelledError) throw error;
+    // Permission discovery is additive for legacy paid configurations. A temporary
+    // discovery outage must not turn a previously usable named route into a refusal.
+    return { provider: transport, modelId: requestedModel, auto: false };
+  }
+  if (!copilotRequiresAuto(provider, models))
+    return { provider: transport, modelId: requestedModel, auto: false };
+  const session = await requestJson(transport, "/models/session", signal,
+    { auto_mode: { model_hints: ["auto"] } }, undefined, beforeSend, concurrency);
+  const pool = strings(session.available_models);
+  if (typeof session.session_token !== "string" || !session.session_token || session.session_token.length > 32_768 || !/^[\x21-\x7e]+$/.test(session.session_token) || !pool.length)
+    throw new Error("GitHub Copilot Auto session omitted its routing credentials");
+  if (session.expires_at !== undefined && (typeof session.expires_at !== "number" || !Number.isFinite(session.expires_at)))
+    throw new Error("GitHub Copilot Auto session returned an invalid expiry");
+  const expiresAt = typeof session.expires_at === "number" && Number.isFinite(session.expires_at)
+    ? session.expires_at * 1000 : Date.now() + 60_000;
+  if (!Number.isFinite(expiresAt) || expiresAt <= Date.now() + 1000) throw new Error("GitHub Copilot Auto session is already expired");
+  const lastUser = [...parsed.context.messages].reverse().find(/** Find the newest user turn as the intent-routing source instead of replaying earlier conversation text. */
+    message => message.role === "user");
+  const prompt = lastUser?.role === "user"
+    ? typeof lastUser.content === "string" ? lastUser.content : lastUser.content.flatMap(/** Extract text parts for intent negotiation without forwarding image or other multimodal payloads. */
+      part => part.type === "text" ? [part.text] : []).join("\n")
+    : "";
+  const intent = await requestJson(transport, "/models/session/intent", signal,
+    { prompt: prompt.slice(0, 32_768), available_models: pool }, session.session_token, beforeSend, concurrency);
+  const modelId = strings(intent.candidate_models).find(/** Choose the first server-ranked candidate that belongs to this credential-bound session pool. */
+    candidate => pool.includes(candidate));
+  if (!modelId) throw new Error("GitHub Copilot Auto intent returned no eligible model");
+  const endpoints = strings(models.find(/** Read endpoint capabilities for the selected model before choosing its inference adapter. */
+    model => model.id === modelId)?.supported_endpoints);
+  const adapter = endpoints.includes("/responses") ? "openai-responses"
+    : endpoints.includes("/chat/completions") ? "openai-chat" : undefined;
+  if (!adapter) throw new Error("GitHub Copilot Auto selected a model with no supported inference endpoint");
+  return { auto: true, modelId, expiresAt: Math.min(expiresAt, Date.now() + 60_000), provider: { ...transport, adapter,
+    ...(adapter === "openai-responses" ? { responsesPath: "/responses" } : { chatCompletionsPath: "/chat/completions" }),
+    headers: { ...transport.headers, "X-GitHub-Api-Version": "2026-08-01", "Copilot-Session-Token": session.session_token } } };
+}

package/src/providers/model-presets.ts

@@ -12,7 +12,7 @@
  * The preset is a SEED, not a lock. Materialization evaluates these rules against the provider's
  * current catalog and stores CONCRETE ids in `selectedModels`, so the visibility hot path
  * (`filterCatalogVisibleModels`) never learns about patterns and an older binary still sees a
- * plain allowlist. Design: devlog/_plan/260824_model_ux_aliases_and_defaults/030_default_preset.md
+ * plain allowlist. Design: devlog/_fin/260824_model_ux_aliases_and_defaults/030_default_preset.md
  */
 
 import type { OcxProviderConfig } from "../types";

package/src/providers/muse-subscription-usage.ts

@@ -99,7 +99,7 @@ export function museUsageWindowsToQuota(usage: unknown): ProviderQuota | null {
  *
  * Kept as a thin adapter over the shared mapper: the frame nests the same two windows
  * under `subscription`, the muse-code/key response nests them under `subs_usage`
- * (devlog/_plan/260912_muse_device_oauth/001 C). Two parsers would drift, and the
+ * (devlog/_fin/260912_muse_device_oauth/001 C). Two parsers would drift, and the
  * five-hour-window discrimination above is the part that must not.
  */
 export function parseMuseSubscriptionUsage(payload: unknown): ProviderQuota | null {

package/src/providers/quota/vendor-probes-key.ts

@@ -38,6 +38,7 @@ const DEEPSEEK_BASE_URL = "https://api.deepseek.com";
 const CLINE_BASE_URL = "https://api.cline.bot";
 const OLLAMA_CLOUD_BASE_URL = "https://ollama.com";
 const OLLAMA_CLOUD_USAGE_URL = `${OLLAMA_CLOUD_BASE_URL}/api/usage`;
+const OLLAMA_CLOUD_BALANCE_URL = `${OLLAMA_CLOUD_BASE_URL}/api/balance`;
 const ZAI_BASE_URL = "https://api.z.ai";
 const ZAI_CN_BASE_URL = "https://open.bigmodel.cn";
 const MINIMAX_REMAINS_PATH = "/v1/api/openplatform/coding_plan/remains";
@@ -439,11 +440,80 @@ async function fetchClineQuota(provider: string, config: OcxProviderConfig): Pro
 }
 
 /**
- * Ollama Cloud `GET https://ollama.com/api/usage` — returns account usage.
- * Legacy plans report rolling 5-hour `limits.session.usage` and 7-day
- * `limits.weekly.usage`. Migrated monthly-credit plans report
- * `limits.monthly.usage`. `usage` values are normalized fractions (0..1).
+ * Ollama Cloud quota. `GET https://ollama.com/api/balance` is the live source: it
+ * returns the included (plan) balance plus purchased credits. Legacy plans report
+ * rolling 5-hour `included.session.remaining_percent` and 7-day
+ * `included.weekly.remaining_percent` (remaining shares, so used = 100 - remaining);
+ * credit plans report `included.balance_usd`/`included.allowance_usd` over a
+ * `period`.
+ *
+ * `GET https://ollama.com/api/usage` used to carry `limits.{session,weekly,monthly}.usage`
+ * as normalized fractions but now returns only a request-count timeseries, so it is
+ * kept as a fallback for older deployments.
  */
+function parseOllamaUsedPercent(row: Record<string, unknown>): number | undefined {
+  if (row.remaining_percent !== undefined) {
+    const remaining = toFiniteNumber(row.remaining_percent);
+    if (remaining === undefined) return undefined;
+    return normalizePercent(Math.round((100 - remaining) * 100) / 100);
+  }
+  return parseOllamaPercent(row.usage);
+}
+
+export function parseOllamaCloudBalance(body: Record<string, unknown> | null): ProviderQuota | null {
+  if (!body) return null;
+  const included = asRecord(body.included);
+  if (!included) return null;
+
+  const quota: ProviderQuota = { updatedAt: Date.now() };
+  let windows = 0;
+
+  const rows: Array<[string, "fiveHour" | "weekly" | "monthly"]> = [
+    ["session", "fiveHour"],
+    ["weekly", "weekly"],
+    ["monthly", "monthly"],
+  ];
+  for (const [key, window] of rows) {
+    const row = asRecord(included[key]);
+    if (!row) continue;
+    const percent = parseOllamaUsedPercent(row);
+    if (percent === undefined) continue;
+    const resetAt = normalizeResetAt(row.resets_at);
+    if (window === "fiveHour") {
+      quota.fiveHourPercent = percent;
+      if (resetAt !== undefined) quota.fiveHourResetAt = resetAt;
+    } else if (window === "weekly") {
+      quota.weeklyPercent = percent;
+      if (resetAt !== undefined) quota.weeklyResetAt = resetAt;
+    } else {
+      quota.monthlyPercent = percent;
+      if (resetAt !== undefined) quota.monthlyResetAt = resetAt;
+    }
+    windows += 1;
+  }
+
+  const allowance = toFiniteNumber(included.allowance_usd);
+  const balance = toFiniteNumber(included.balance_usd);
+  if (allowance !== undefined && allowance > 0 && balance !== undefined) {
+    const used = Math.max(0, allowance - balance);
+    const percent = normalizePercent(Math.round((used / allowance) * 10000) / 100);
+    if (percent !== undefined) {
+      const expiresAt = normalizeResetAt(asRecord(included.period)?.until);
+      // creditsUsd is the included allowance only; purchased credits are ignored.
+      quota.creditsUsd = {
+        used,
+        limit: allowance,
+        remaining: balance,
+        percent,
+        ...(expiresAt !== undefined ? { expiresAt } : {}),
+      };
+      windows += 1;
+    }
+  }
+
+  return windows > 0 ? quota : null;
+}
+
 function parseOllamaPercent(usageValue: unknown): number | undefined {
   const usage = toFiniteNumber(usageValue);
   if (usage === undefined || usage < 0) return undefined;
@@ -489,25 +559,65 @@ export function parseOllamaCloudQuota(body: Record<string, unknown> | null): Pro
   return windows > 0 ? quota : null;
 }
 
+/**
+ * Routing projection for an `/api/balance` report. `creditsUsd` covers the included
+ * allowance only, so it may veto routing only when purchased credit is known to be empty;
+ * otherwise an exhausted allowance would block an account that still has paid balance.
+ */
+function ollamaBalanceInferenceQuota(quota: ProviderQuota, body: Record<string, unknown> | null): ProviderQuota {
+  if (!quota.creditsUsd) return quota;
+  const purchased = toFiniteNumber(asRecord(body?.purchased)?.balance_usd);
+  if (purchased !== undefined && purchased <= 0) return quota;
+  const { creditsUsd: _includedOnly, ...inference } = quota;
+  return inference;
+}
+
 async function fetchOllamaCloudQuota(provider: string, config: OcxProviderConfig): Promise<ProviderQuotaProbeResult> {
   const effectiveBaseUrl = config.baseUrl ?? getProviderRegistryEntry(provider)?.baseUrl ?? "";
   if (!isCanonicalOllamaCloudBaseUrl(effectiveBaseUrl)) return null;
   const apiKey = resolveProviderApiKey(config.apiKey)?.trim();
   if (!apiKey) return null;
-  const response = await quotaFetch(provider, config, OLLAMA_CLOUD_USAGE_URL, {
-    headers: { Accept: "application/json", Authorization: `Bearer ${apiKey}` },
-    redirect: "error",
-    signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
-  });
-  if (!response.ok) {
-    if (response.status === 404) return null;
-    return response.status >= 400 && response.status < 500 && response.status !== 408 && response.status !== 429
-      ? TERMINAL_QUOTA_FAILURE
-      : null;
+  const attempts: Array<{
+    url: string;
+    source: string;
+    parse: (body: Record<string, unknown> | null) => ProviderQuota | null;
+  }> = [
+    { url: OLLAMA_CLOUD_BALANCE_URL, source: "ollama-cloud:balance", parse: parseOllamaCloudBalance },
+    { url: OLLAMA_CLOUD_USAGE_URL, source: "ollama-cloud:usage", parse: parseOllamaCloudQuota },
+  ];
+  let terminalFailure = false;
+  for (const attempt of attempts) {
+    let response: Response;
+    try {
+      response = await quotaFetch(provider, config, attempt.url, {
+        headers: { Accept: "application/json", Authorization: `Bearer ${apiKey}` },
+        redirect: "error",
+        signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+      });
+    } catch {
+      continue;
+    }
+    if (!response.ok) {
+      if (response.status !== 404 && response.status >= 400 && response.status < 500 && response.status !== 408 && response.status !== 429) {
+        terminalFailure = true;
+      }
+      try {
+        void response.body?.cancel().catch(() => undefined);
+      } catch {
+        // Best-effort cancellation only.
+      }
+      continue;
+    }
+    const raw = await readQuotaJson(response);
+    if (raw === QUOTA_JSON_READ_FAILURE) return terminalFailure ? TERMINAL_QUOTA_FAILURE : null;
+    const body = asRecord(raw);
+    const quota = attempt.parse(body);
+    if (quota) {
+      const inference = attempt.url === OLLAMA_CLOUD_BALANCE_URL ? ollamaBalanceInferenceQuota(quota, body) : quota;
+      return keyReport(provider, attempt.source, quota, config, apiKey, inference);
+    }
   }
-  const body = asRecord(await readQuotaJson(response));
-  const quota = parseOllamaCloudQuota(body);
-  return quota ? keyReport(provider, "ollama-cloud:usage", quota, config, apiKey, quota) : null;
+  return terminalFailure ? TERMINAL_QUOTA_FAILURE : null;
 }
 
 /**

package/src/providers/quota.ts

@@ -97,7 +97,7 @@ export {
   type ProviderAccountQuota,
 } from "./quota/account-cache";
 export { fetchAntigravityUsageQuota, isCanonicalAntigravityQuotaUrl, setAntigravityAccountQuotaTransportForTests } from "./quota/antigravity";
-export { parseOllamaCloudQuota, parseZaiQuotaLimits, providerApiKeyQuotaMode } from "./quota/vendor-probes-key";
+export { parseOllamaCloudBalance, parseOllamaCloudQuota, parseZaiQuotaLimits, providerApiKeyQuotaMode } from "./quota/vendor-probes-key";
 export { parseXaiCreditsResponse } from "./quota/vendor-probes-oauth";
 export async function fetchProviderApiKeyQuotas(config: OcxConfig, name: string, forceRefresh = false): Promise<ProviderApiKeyQuota[]> {
   const provider = config.providers[name];

package/src/providers/registry/entries-core.ts

@@ -94,7 +94,7 @@ import {
  * Only the models Anthropic documents for the lane are classified; Opus 4.6 silently runs
  * standard and Opus 4.7, Sonnet, Haiku and Fable reject `speed`, so they and future ids stay
  * unclassified. Source: https://platform.claude.com/docs/en/build-with-claude/fast-mode
- * (2026-09-23) and the live probe in devlog/_plan/260923_anthropic_fast_speed.
+ * (2026-09-23) and the live probe in devlog/_fin/260923_anthropic_fast_speed.
  */
 const ANTHROPIC_FAST_WIRE = Object.freeze({
   kind: "anthropic-speed" as const,
@@ -209,7 +209,7 @@ export const PROVIDER_REGISTRY_CORE: readonly ProviderRegistryEntry[] = [
   },
   {
     // The canonical Cognition account provider, after absorbing `devin-cli`
-    // (devlog/_plan/260913_devin_provider_merge). The two ids were the same
+    // (devlog/_fin/260913_devin_provider_merge). The two ids were the same
     // `devin` adapter, the same server.codeium.com api-server, and the same
     // `devin-session-token$<JWT>` credential — only the account source
     // differed: this entry did an Auth0 browser sign-in while `devin-cli`
@@ -273,7 +273,7 @@ export const PROVIDER_REGISTRY_CORE: readonly ProviderRegistryEntry[] = [
     // the field but answers service_tier "default" — a live downgrade, not a fast tier.
     // Unlisted and future-discovered ids stay unclassified.
     // grok-4.7 applied and confirmed priority on OAuth Responses in the 2026-09-23
-    // live probe: devlog/_plan/260923_grok47_parity/010_probe-evidence.md.
+    // live probe: devlog/_fin/260923_grok47_parity/010_probe-evidence.md.
     modelSupportsServiceTier: {
       "grok-4.7": true,
       "grok-4.6": true,
@@ -320,7 +320,7 @@ export const PROVIDER_REGISTRY_CORE: readonly ProviderRegistryEntry[] = [
     models: XAI_MODELS,
     // grok-4.7-build-fast arrives only through OAuth discovery: xAI's Grok 4.7 Fast, "the same model
     // served on faster infrastructure" (docs.x.ai/developers/grok-4-7). Probed 2026-09-30
-    // (devlog/_plan/260930_grok47_build_unify/010_probe-evidence.md): identical effort ladder, image
+    // (devlog/_fin/260930_grok47_build_unify/010_probe-evidence.md): identical effort ladder, image
     // input, 500k limit and advertised defaults, 1.5-1.7x faster, ~2x the ticks per output token. It is
     // not a second model row: shouldExposeProviderModel hides it, and grok-4.7's Fast selection on OAuth
     // serializes it (src/providers/xai-fast-model.ts). It keeps grok-4.7's facts in the lists below so an
@@ -450,7 +450,7 @@ export const PROVIDER_REGISTRY_CORE: readonly ProviderRegistryEntry[] = [
     // documents high as the 4.6 default but no multi-agent default, so do not invent one.
     modelReasoningEfforts: {
       // 2026-09-23 live probe accepted low..xhigh and rejected max on both wires;
-      // devlog/_plan/260923_grok47_parity/010_probe-evidence.md.
+      // devlog/_fin/260923_grok47_parity/010_probe-evidence.md.
       "grok-4.7": ["low", "medium", "high", "xhigh"],
       "grok-4.7-build-fast": ["low", "medium", "high", "xhigh"],
       "grok-4.6": ["low", "medium", "high", "xhigh"],
@@ -460,7 +460,7 @@ export const PROVIDER_REGISTRY_CORE: readonly ProviderRegistryEntry[] = [
     modelDefaultReasoningEfforts: { "grok-4.7": "high", "grok-4.7-build-fast": "high", "grok-4.6": "high" },
     modelContextWindows: {
       // 500k confirmed by context_length_exceeded:
-      // devlog/_plan/260923_grok47_parity/010_probe-evidence.md.
+      // devlog/_fin/260923_grok47_parity/010_probe-evidence.md.
       "grok-4.7": 500_000,
       "grok-4.7-build-fast": 500_000,
       "grok-4.6": 500_000,

package/src/providers/registry/entries-extended.ts

@@ -1176,6 +1176,10 @@ export const PROVIDER_REGISTRY_EXTENDED: readonly ProviderRegistryEntry[] = [
       "openai/o3-pro": ["text"],
     },
     noVisionModels: ["openai/o3-pro"],
+    // #6877: on the Responses wire OpenGateway answers 400 once history replays native
+    // custom_tool_call/custom_tool_call_output items (Codex code-mode exec), and accepts the
+    // same request after the custom tool is lowered to a function. Same contract as xAI.
+    supportsResponsesCustomTools: false,
     // Chat is the broad wire (77/80 active rows). o3-pro is Responses-only, on all
     // inbounds. Only the two live-verified Sionic models bypass translation for Codex.
     // Other OpenAI/Anthropic/Gemini rows stay on Chat until their Responses tool replay

package/src/providers/registry/model-seeds.ts

@@ -129,7 +129,7 @@ export const ZAI_GLM_5X_SIDECAR_VISION_MODELS = ZAI_GLM_5X_MODELS.filter(id => i
  *
  * Authoritative source: `GET https://api.z.ai/api/v1/models` returns `input_modalities:
  * ["text"]` for glm-5.3 and `["text", "image"]` for glm-5.3-flash (captured in
- * devlog/_plan/260912_zcode_protocol_and_catalog/evidence/zai-responses-models.json).
+ * devlog/_fin/260912_zcode_protocol_and_catalog/evidence/zai-responses-models.json).
  * docs.z.ai/devpack/latest-model says the same in prose: "GLM-5.3 is a text-only model...
  * GLM-5.3-FLASH is a multimodal model". Upstream also lists video and file for Flash;
  * neither the internal vocabulary nor the export vocabulary can express them, so `image`
@@ -158,7 +158,7 @@ export const ZAI_GLM_5X_REASONING_EFFORTS: Record<string, string[]> = {
 // 260930 MiniMax-M3.1-Flash-Preview: Token Plan / MiniMax Code only, 1M context, thinking
 // always on (effort none or thinking disabled answers 400 code 2013), omitted effort = max.
 // It returns thinking as reasoning_content and ignores reasoning_split. The live /v1/models
-// roster does not list it yet. Evidence: devlog/_plan/260930_minimax_m31_flash_preview/.
+// roster does not list it yet. Evidence: devlog/_fin/260930_minimax_m31_flash_preview/.
 export const MINIMAX_M31_FLASH_PREVIEW = "MiniMax-M3.1-Flash-Preview";
 export const MINIMAX_MODELS = [
   MINIMAX_M31_FLASH_PREVIEW,
@@ -416,7 +416,7 @@ export const COMMAND_CODE_IMAGE_MODELS = [
   // Live 2026-09-23 3x3 random-color grid (180x180) via ocx 2.62.0:
   // 4.7 read 9/9 in user messages and tool results; 4.6 read 9/9 and 8/9.
   // Neither route requested a vision sidecar. Evidence:
-  // devlog/_plan/260923_grok47_parity/010_probe-evidence.md.
+  // devlog/_fin/260923_grok47_parity/010_probe-evidence.md.
   "xai/grok-4.6",
   "xai/grok-4.7",
   // Native Z.AI VLM (docs.z.ai/guides/vlm/glm-5.3-flash). This exact id is already

package/src/providers/xai-fast-model.ts

@@ -7,7 +7,7 @@ import type { FastWire, OcxParsedRequest, OcxProviderConfig, TierDecision } from
  * on two lanes (same effort ladder, image input, 500k limit and advertised defaults). Measured live on
  * 2026-09-30: build-fast is 1.5-1.7x faster end to end, while `service_tier: "priority"` on grok-4.7 bought
  * no measurable speed and cost ~5.9x the ticks per output token (build-fast costs ~2x).
- * Evidence: devlog/_plan/260930_grok47_build_unify/010_probe-evidence.md.
+ * Evidence: devlog/_fin/260930_grok47_build_unify/010_probe-evidence.md.
  *
  * So on the OAuth lane only, a Fast grok-4.7 request is SERIALIZED as the build-fast id and sends no tier.
  * The logical id stays grok-4.7 everywhere else (parsed.modelId, route, policy, usage attempt), so effort,

package/src/responses/reasoning-envelope.ts

@@ -36,6 +36,32 @@ export interface ReasoningEnvelope {
    * same way a signature does.
    */
   krc?: string;
+  /**
+   * A Responses provider's own `encrypted_content` for one reasoning item, minted while serving
+   * `model` (the client-facing model the Claude route was asked for). The Claude route has no
+   * other channel to hand a provider its reasoning back: the body is `store: false` and Claude
+   * Code replays only the thinking block. `src/claude/inbound.ts` restores it only for a request
+   * naming the same model, so a model switch cannot carry it to a provider that cannot decrypt it.
+   */
+  nat?: NativeReasoning;
+}
+
+export interface NativeReasoning {
+  /** The provider's opaque `encrypted_content`, verbatim. */
+  enc: string;
+  /** Client-facing model the item was produced for. */
+  model: string;
+  /** Route-bound HMAC for this exact ciphertext. */
+  tag: string;
+  /** The provider's reasoning item id, when it sent one. */
+  id?: string;
+}
+
+function decodeNativeReasoning(value: unknown): NativeReasoning | undefined {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return undefined;
+  const { enc, model, id, tag } = value as { enc?: unknown; model?: unknown; id?: unknown; tag?: unknown };
+  if (typeof enc !== "string" || enc.length === 0 || typeof model !== "string" || model.length === 0 || typeof tag !== "string" || tag.length === 0) return undefined;
+  return typeof id === "string" && id.length > 0 ? { enc, model, tag, id } : { enc, model, tag };
 }
 
 export function encodeReasoningEnvelope(envelope: ReasoningEnvelope, budget?: TranslatorBudget): string {
@@ -116,7 +142,9 @@ export function decodeReasoningEnvelope(encryptedContent: string, budget?: Trans
       if (hasTxt) envelope.txt = txt;
       const krc = (parsed as { krc?: unknown }).krc;
       if (typeof krc === "string" && krc.length > 0) envelope.krc = krc;
-      return envelope.sig || envelope.red || hasTxt || envelope.krc ? envelope : null;
+      const nat = decodeNativeReasoning((parsed as { nat?: unknown }).nat);
+      if (nat) envelope.nat = nat;
+      return envelope.sig || envelope.red || hasTxt || envelope.krc || envelope.nat ? envelope : null;
     } catch {
       return null;
     } finally {

package/src/responses/reasoning-replay-cache.ts

@@ -19,7 +19,8 @@
  * long-lived proxy cannot grow without limit.
  */
 
-import { createHash, createHmac, randomBytes } from "node:crypto";
+import { createHash, createHmac, randomBytes, timingSafeEqual } from "node:crypto";
+import { thoughtSignatureReplaySalt } from "./thought-signature-replay";
 import type {
   OcxProviderConfig,
   OcxReasoningReplayIdentity,
@@ -27,6 +28,21 @@ import type {
 } from "../types";
 
 const MAX_ENTRIES = 64;
+export interface NativeReasoningOwner { destination: string; credential: string }
+
+/** Bind exact ciphertext to the durable route that accepted it. */
+export function nativeReasoningTag(owner: NativeReasoningOwner | undefined, blob: string): string | undefined {
+  const salt = thoughtSignatureReplaySalt();
+  if (!owner || !salt || salt.length < 16 || blob.length === 0) return undefined;
+  return createHmac("sha256", salt).update("native-reasoning\0")
+    .update(JSON.stringify([owner.destination, owner.credential, createHash("sha256").update(blob).digest("hex")]))
+    .digest("hex");
+}
+
+export function nativeReasoningTagMatches(expected: string | undefined, presented: string | undefined): boolean {
+  if (!expected || !presented || !/^[a-f0-9]{64}$/.test(expected) || !/^[a-f0-9]{64}$/.test(presented)) return false;
+  return timingSafeEqual(Buffer.from(expected, "hex"), Buffer.from(presented, "hex"));
+}
 const MAX_TOTAL_BYTES = 256 * 1024;
 const TTL_MS = 60 * 60 * 1000;
 const OPAQUE_BLOB_REJECTION_TTL_MS = 5 * 60 * 1000;

package/src/responses/spill-store.ts

@@ -765,10 +765,23 @@ export function readResponseSpill(responseId: string, ref: ResponseSpillRef): Re
 export function deleteResponseSpill(ref: ResponseSpillRef): void {
   if (!validSpillRef(ref)) return;
   const dir = responseSpillDirectory();
+  const path = join(dir, ref.fileName);
   try {
-    unlink(join(dir, ref.fileName));
+    unlink(path);
     fsyncDirectoryBestEffort(dir);
-  } catch { /* best effort */ }
+  } catch (error) {
+    // Still best effort, but no longer invisible: a file a failed unlink left behind occupies
+    // the volume, so the accounting owner keeps pricing it until the path is gone (#6747).
+    if (!isErrno(error, "ENOENT")) spillUnlinkFailureObserver?.(path, ref.payloadBytes);
+  }
+}
+
+type SpillUnlinkFailureObserver = (path: string, bytes: number) => void;
+let spillUnlinkFailureObserver: SpillUnlinkFailureObserver | null = null;
+
+/** The owner of spill accounting registers here so a failed unlink cannot under-report disk use. */
+export function setResponseSpillUnlinkFailureObserver(next: SpillUnlinkFailureObserver | null): void {
+  spillUnlinkFailureObserver = next;
 }
 
 type SpillDirNameKind = "spill" | "temp";

package/src/responses/state/metrics.ts

@@ -18,6 +18,10 @@ export interface ResponseStateMetrics {
   spillLastWriteFailureOrigin: ResponseSpillWriteFailureOrigin | null;
   spillAclRetryReturnedTimeouts: number;
   spillAclTimeoutMemoRefusals: number;
+  /** Publications refused because the durable spill cap could not make room (cumulative). */
+  spillCapacityRefusals: number;
+  /** Spills evicted by admission to make room for a newer publication (cumulative). */
+  spillHeadroomEvictions: number;
   spillLastWriteFailureAt: number | null;
   spillLastWriteSuccessAt: number | null;
   spillReadFailures: number;
@@ -37,6 +41,8 @@ export function computeResponseStateMetrics(params: {
   spillLastSuccessAt: number | null;
   spillAclRetryReturnedTimeouts: number;
   spillAclTimeoutMemoRefusals: number;
+  spillCapacityRefusals: number;
+  spillHeadroomEvictions: number;
   spillLastFailureAt: number | null;
   spillReadFailures: number;
   replayScopeMismatchDrops: number;
@@ -79,6 +85,8 @@ export function computeResponseStateMetrics(params: {
     spillLastWriteFailureOrigin: params.spillLastFailureOrigin,
     spillAclRetryReturnedTimeouts: params.spillAclRetryReturnedTimeouts,
     spillAclTimeoutMemoRefusals: params.spillAclTimeoutMemoRefusals,
+    spillCapacityRefusals: params.spillCapacityRefusals,
+    spillHeadroomEvictions: params.spillHeadroomEvictions,
     spillLastWriteFailureAt: params.spillLastFailureAt,
     spillLastWriteSuccessAt: params.spillLastSuccessAt,
     spillReadFailures: params.spillReadFailures,

package/src/responses/state/spill-failure.ts

@@ -1,8 +1,14 @@
 export const spillCounters = {
   writes: 0, writeFailures: 0, readFailures: 0,
   aclRetryReturnedTimeouts: 0, aclTimeoutMemoRefusals: 0,
+  capacityRefusals: 0, headroomEvictions: 0,
 };
 
+/** Test-only: zero every spill counter, including ones added later. */
+export function resetSpillCountersForTests(): void {
+  for (const key of Object.keys(spillCounters) as Array<keyof typeof spillCounters>) spillCounters[key] = 0;
+}
+
 export type ResponseSpillWriteFailureCode =
   | "EACLRETRYEXHAUSTED"
   | "ETIMEDOUT"
@@ -102,6 +108,12 @@ export function noteSpillWriteFailure(
   if (origin === "retry_returned_timeout") spillCounters.aclRetryReturnedTimeouts += 1;
   else if (origin === "timeout_memo_refusal") spillCounters.aclTimeoutMemoRefusals += 1;
 }
+
+/** A publication refused because the durable spill cap could not make room for it (#6747). */
+export function noteSpillCapacityRefusal(): void {
+  spillCounters.capacityRefusals += 1;
+  noteSpillWriteFailure(null, "ECAPACITY");
+}
 /**
  * Admission-boundary observability (test-visible). directSpills: oversized
  * candidates routed straight to durable spill without a resident stay or