@bitkyc08/opencodex 2.82.0 → 2.83.0

package/src/grok/reset-coupon-ledger.ts

@@ -1,9 +1,10 @@
-import { existsSync, readFileSync } from "node:fs";
-import { join } from "node:path";
-import { atomicWriteFile } from "../config/atomic-write";
+import { closeSync, fsyncSync, openSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { atomicWriteFileStreamed } from "../config/atomic-write";
+import { withConfigMutationLockSync } from "../config/mutation-lock";
 import { getConfigDir } from "../config/paths";
 
-export type GrokResetCouponOperationKind = "execute" | "replay" | "identity-mismatch" | "capacity";
+export type GrokResetCouponOperationKind = "execute" | "replay" | "identity-mismatch" | "token-mismatch" | "capacity";
 
 export interface GrokResetCouponOperationIdentity {
   accountId: string;
@@ -16,6 +17,12 @@ export interface GrokResetCouponOperationRecord {
   operationId: string;
   accountId?: string;
   tokenId?: string;
+  /** Token expiry (ms) captured at claim time as journal metadata. Remaining
+   * availability or expiry cannot establish this operation's outcome. */
+  tokenValidityEnd?: number;
+  /** When the attempt was marked (ms) — set only on an "attempted" replay so
+   * the route can defer inspection while the attempt may still be in flight. */
+  attemptedAt?: number;
   code?: string;
   settledAt?: number;
 }
@@ -23,14 +30,18 @@ export interface GrokResetCouponOperationRecord {
 interface GrokResetCouponOperationState {
   accountId: string;
   tokenId?: string;
-  status: "open" | "settled" | "failed";
+  // "attempted" sits between open and settled: the spend call may have fired,
+  // so the operation must never execute again. Its replay carries no code —
+  // the route reconciles it against upstream instead of trusting a status.
+  status: "open" | "attempted" | "settled" | "failed";
   code?: string;
+  tokenValidityEnd?: number;
   createdAt: number;
   updatedAt: number;
 }
 
 interface GrokResetCouponLedger {
-  version: 1;
+  version: 2;
   operations: Record<string, GrokResetCouponOperationState>;
 }
 
@@ -40,95 +51,249 @@ export function grokCouponJournalPath(customDir?: string): string {
 }
 
 function readGrokCouponLedger(filePath: string): GrokResetCouponLedger {
-  if (!existsSync(filePath)) {
-    return { version: 1, operations: {} };
+  let raw: string;
+  try { raw = readFileSync(filePath, "utf-8"); }
+  catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") return { version: 2, operations: {} };
+    throw new Error("Grok coupon ledger is unavailable; existing records were preserved.");
   }
   try {
-    const raw = readFileSync(filePath, "utf-8");
-    const parsed = JSON.parse(raw) as GrokResetCouponLedger;
-    return parsed && parsed.version === 1 && parsed.operations && typeof parsed.operations === "object"
-      ? parsed
-      : { version: 1, operations: {} };
+    const parsed = JSON.parse(raw) as Omit<GrokResetCouponLedger, "version"> & { version: unknown };
+    if (!parsed || (parsed.version !== 1 && parsed.version !== 2) || !parsed.operations
+      || typeof parsed.operations !== "object" || Array.isArray(parsed.operations)) throw new Error();
+    for (const op of Object.values(parsed.operations)) {
+      if (!op || typeof op.accountId !== "string" || !op.accountId
+        || !["open", "attempted", "settled", "failed"].includes(op.status)
+        || !Number.isFinite(op.createdAt) || !Number.isFinite(op.updatedAt)
+        || (op.tokenId !== undefined && typeof op.tokenId !== "string")
+        || (op.code !== undefined && typeof op.code !== "string")
+        || (op.tokenValidityEnd !== undefined && !Number.isFinite(op.tokenValidityEnd))) throw new Error();
+    }
+    if (parsed.version === 1) {
+      for (const op of Object.values(parsed.operations)) {
+        // Old opens (and transport failures recorded as failed) may already
+        // have dispatched. Only version-two opens prove pre-dispatch state.
+        if (op.status === "open" || (op.status === "failed" && op.code === "redeem_failed")) {
+          op.status = "attempted";
+          delete op.code;
+        }
+      }
+    }
+    return { version: 2, operations: parsed.operations };
   } catch {
-    return { version: 1, operations: {} };
+    throw new Error("Grok coupon ledger is unreadable; existing records were preserved.");
   }
 }
 
 function writeGrokCouponLedger(filePath: string, ledger: GrokResetCouponLedger, now = Date.now()): void {
-  // Prune settled/failed operations older than 30 days to avoid unbounded growth
+  // Prune every record past the 30-day window — including "open" and
+  // "attempted". Idempotency retention is explicitly bounded to 30 days;
+  // operations are not retry authorities after that window.
   const retentionCutoff = now - 30 * 24 * 60 * 60_000;
   ledger.operations = Object.fromEntries(
-    Object.entries(ledger.operations).filter(
-      ([, op]) => op.status === "open" || op.updatedAt > retentionCutoff,
-    ),
+    Object.entries(ledger.operations).filter(([, op]) => op.updatedAt > retentionCutoff),
   );
-  atomicWriteFile(filePath, JSON.stringify(ledger, null, 2));
+  atomicWriteFileStreamed(filePath, descriptor => writeFileSync(descriptor, JSON.stringify(ledger, null, 2)), {
+    afterRename: target => {
+      // The shared streamed writer flushes the temp. A spend claim must also
+      // refuse on a POSIX directory-sync failure before dispatch, rather than
+      // relying on that writer's best-effort parent sync. Windows has no
+      // portable directory descriptor and retains the writer's platform contract.
+      if (process.platform === "win32") return;
+      const descriptor = openSync(dirname(target), "r");
+      try { fsyncSync(descriptor); }
+      finally { closeSync(descriptor); }
+    },
+  });
 }
 
 const MAX_GROK_RESET_COUPON_OPERATION_IDS = 256;
 
+/** Resolve an omitted-account retry from its durable identity, within retention. */
+export function getGrokResetCouponOperationAccountId(
+  operationId: string,
+  now = Date.now(),
+  journalPath?: string,
+): string | undefined {
+  return withConfigMutationLockSync(() => {
+    const record = readGrokCouponLedger(journalPath ?? grokCouponJournalPath()).operations[operationId];
+    if (!record || record.updatedAt <= now - 30 * 24 * 60 * 60_000) return undefined;
+    return record.accountId;
+  });
+}
+
 export function openGrokResetCouponOperation(
   identity: GrokResetCouponOperationIdentity,
   now = Date.now(),
   journalPath?: string,
 ): GrokResetCouponOperationRecord {
-  const filePath = journalPath ?? grokCouponJournalPath();
-  const ledger = readGrokCouponLedger(filePath);
+  // Read→decide→write under the shared config mutation lock: two concurrent
+  // coupon requests on the same home must not lose an operation record — the
+  // ledger exists precisely to make an irreversible spend replay-safe.
+  return withConfigMutationLockSync(() => {
+    const filePath = journalPath ?? grokCouponJournalPath();
+    const ledger = readGrokCouponLedger(filePath);
 
-  if (Object.keys(ledger.operations).length >= MAX_GROK_RESET_COUPON_OPERATION_IDS) {
-    return { kind: "capacity", operationId: identity.operationId };
-  }
+    // Prune BEFORE the capacity check: expiry is enforced on write, so a ledger
+    // full of stale records would otherwise reject every new operation forever
+    // (the prune path inside writeGrokCouponLedger is never reached when all
+    // openings are rejected).
+    const retentionCutoff = now - 30 * 24 * 60 * 60_000;
+    ledger.operations = Object.fromEntries(
+      Object.entries(ledger.operations).filter(([, op]) => op.updatedAt > retentionCutoff),
+    );
 
-  const existing = ledger.operations[identity.operationId];
-  if (existing) {
-    if (existing.accountId !== identity.accountId) {
-      return { kind: "identity-mismatch", operationId: identity.operationId };
-    }
-    if (existing.status !== "open") {
-      // Durably settled already: replay the recorded outcome instead of
-      // trusting upstream idempotency for an irreversible spend.
+    const existing = ledger.operations[identity.operationId];
+    if (existing) {
+      if (existing.accountId !== identity.accountId) {
+        return { kind: "identity-mismatch", operationId: identity.operationId };
+      }
+      if (identity.tokenId !== undefined && existing.tokenId !== undefined && existing.tokenId !== identity.tokenId) {
+        return { kind: "token-mismatch", operationId: identity.operationId };
+      }
+      if (existing.status !== "open") {
+        // Non-open: replay the recorded outcome. "attempted" records carry no
+        // code — the caller must reconcile them against upstream, never re-run.
+        return {
+          kind: "replay",
+          operationId: identity.operationId,
+          accountId: existing.accountId,
+          tokenId: existing.tokenId,
+          tokenValidityEnd: existing.tokenValidityEnd,
+          attemptedAt: existing.status === "attempted" ? existing.updatedAt : undefined,
+          code: existing.code,
+          settledAt: existing.updatedAt,
+        };
+      }
       return {
-        kind: "replay",
+        kind: "execute",
         operationId: identity.operationId,
         accountId: existing.accountId,
         tokenId: existing.tokenId,
-        code: existing.code,
-        settledAt: existing.updatedAt,
       };
     }
+
+    if (Object.keys(ledger.operations).length >= MAX_GROK_RESET_COUPON_OPERATION_IDS) {
+      return { kind: "capacity", operationId: identity.operationId };
+    }
+
+    ledger.operations[identity.operationId] = {
+      accountId: identity.accountId,
+      ...(identity.tokenId === undefined ? {} : { tokenId: identity.tokenId }),
+      status: "open",
+      createdAt: now,
+      updatedAt: now,
+    };
+    writeGrokCouponLedger(filePath, ledger, now);
     return {
       kind: "execute",
       operationId: identity.operationId,
-      accountId: existing.accountId,
-      tokenId: existing.tokenId,
+      accountId: identity.accountId,
+      tokenId: identity.tokenId,
     };
-  }
+  });
+}
 
-  ledger.operations[identity.operationId] = {
-    accountId: identity.accountId,
-    ...(identity.tokenId === undefined ? {} : { tokenId: identity.tokenId }),
-    status: "open",
-    createdAt: now,
-    updatedAt: now,
-  };
-  writeGrokCouponLedger(filePath, ledger, now);
-  return {
-    kind: "execute",
-    operationId: identity.operationId,
-    accountId: identity.accountId,
-    tokenId: identity.tokenId,
-  };
+/**
+ * Flip an open operation to `attempted` BEFORE the upstream spend call. The
+ * write happens while nothing is irreversible yet: if it throws, the caller
+ * aborts without spending; if a later settle write dies instead, the
+ * operation still refuses blind re-execution — the next open returns a
+ * code-less replay the route resolves via the upstream remaining-resets list.
+ */
+export function markGrokResetCouponAttempt(
+  operationId: string,
+  tokenId: string,
+  now = Date.now(),
+  journalPath?: string,
+  tokenValidityEnd?: number,
+): boolean {
+  return withConfigMutationLockSync(() => {
+    const filePath = journalPath ?? grokCouponJournalPath();
+    const ledger = readGrokCouponLedger(filePath);
+    const existing = ledger.operations[operationId];
+    if (!existing || existing.status !== "open"
+      || (existing.tokenId !== undefined && existing.tokenId !== tokenId)) return false;
+    existing.status = "attempted";
+    existing.tokenId = tokenId;
+    if (tokenValidityEnd !== undefined) existing.tokenValidityEnd = tokenValidityEnd;
+    existing.updatedAt = now;
+    writeGrokCouponLedger(filePath, ledger, now);
+    return true;
+  });
+}
+
+type GrokResetCouponSettlement = { operationId: string; accountId: string; code: string } & (
+  | { tokenId?: string; status: "failed"; expectedStatus: "open" }
+  | { tokenId: string; status: "success"; expectedStatus: "attempted" }
+);
+
+type GrokResetCouponPreflightResult =
+  | { kind: "recorded" | "changed" }
+  | { kind: "replay"; code: string; tokenId?: string; settledAt: number };
+
+const UNRESOLVED_COUPON_CODES = new Set(["redeem_failed", "attempt_unresolved", "attempt_in_progress", "attempt_reconcile_failed", "operation_state_changed"]);
+
+/** The durable definitive outcome for this account and token, if the operation has one. */
+function terminalReplay(
+  ledger: GrokResetCouponLedger, operationId: string, accountId: string, tokenId: string | undefined,
+): Extract<GrokResetCouponPreflightResult, { kind: "replay" }> | null {
+  const existing = ledger.operations[operationId];
+  if (!existing || existing.accountId !== accountId) return null;
+  if (tokenId !== undefined && existing.tokenId !== undefined && existing.tokenId !== tokenId) return null;
+  if ((existing.status !== "settled" && existing.status !== "failed") || !existing.code || UNRESOLVED_COUPON_CODES.has(existing.code)) return null;
+  return { kind: "replay", code: existing.code, tokenId: existing.tokenId, settledAt: existing.updatedAt };
 }
 
+/** Settle a refusal or inspect its winner without releasing the mutation transaction. */
+export function settleGrokResetCouponPreflightRefusal(
+  settlement: Extract<GrokResetCouponSettlement, { status: "failed" }>,
+  now = Date.now(),
+  journalPath?: string,
+): GrokResetCouponPreflightResult {
+  return withConfigMutationLockSync(() => {
+    const filePath = journalPath ?? grokCouponJournalPath();
+    const ledger = readGrokCouponLedger(filePath);
+    if (recordSettlement(ledger, filePath, settlement, now)) return { kind: "recorded" };
+    return terminalReplay(ledger, settlement.operationId, settlement.accountId, settlement.tokenId) ?? { kind: "changed" };
+  });
+}
+
+/**
+ * After a lost claim: the definitive winner to replay, or null while the
+ * operation is still unresolved. Terminal states never revert, so reading after
+ * the failed claim cannot replay an outcome that is later replaced.
+ */
+export function readGrokResetCouponTerminalReplay(
+  operationId: string, accountId: string, tokenId?: string, journalPath?: string,
+): Extract<GrokResetCouponPreflightResult, { kind: "replay" }> | null {
+  return withConfigMutationLockSync(() => {
+    const filePath = journalPath ?? grokCouponJournalPath();
+    return terminalReplay(readGrokCouponLedger(filePath), operationId, accountId, tokenId);
+  });
+}
+
+/** A preflight refusal cannot replace a claim or a terminal result. */
 export function recordGrokResetCouponSettlement(
-  settlement: { operationId: string; tokenId?: string; code: string; status: "success" | "failed" },
+  settlement: GrokResetCouponSettlement,
   now = Date.now(),
   journalPath?: string,
-): void {
-  const filePath = journalPath ?? grokCouponJournalPath();
-  const ledger = readGrokCouponLedger(filePath);
+): boolean {
+  return withConfigMutationLockSync(() => {
+    const filePath = journalPath ?? grokCouponJournalPath();
+    const ledger = readGrokCouponLedger(filePath);
+    return recordSettlement(ledger, filePath, settlement, now);
+  });
+}
+
+function recordSettlement(
+  ledger: GrokResetCouponLedger, filePath: string, settlement: GrokResetCouponSettlement, now: number,
+): boolean {
   const existing = ledger.operations[settlement.operationId];
-  if (!existing) return;
+  if (!existing || existing.status !== settlement.expectedStatus
+    || existing.accountId !== settlement.accountId
+    || (settlement.tokenId !== undefined && existing.tokenId !== undefined && existing.tokenId !== settlement.tokenId)
+    || (settlement.status === "success" && existing.tokenId !== settlement.tokenId)) return false;
 
   existing.status = settlement.status === "success" ? "settled" : "failed";
   existing.code = settlement.code;
@@ -136,4 +301,5 @@ export function recordGrokResetCouponSettlement(
   existing.updatedAt = now;
 
   writeGrokCouponLedger(filePath, ledger, now);
+  return true;
 }

package/src/grok/reset-coupons.ts

@@ -230,6 +230,17 @@ function buildGrokHeaders(accessToken: string): Record<string, string> {
 /**
  * Reads available Grok reset tokens for the authenticated xAI account.
  */
+function assertConfirmedCouponStatus(decoded: ReturnType<typeof decodeGrpcWebResponse>): void {
+  const rawStatus = decoded.trailers?.metadata["grpc-status"];
+  // The shared decoder defaults a missing/malformed status to zero. Coupon
+  // availability and an irreversible redemption need affirmative confirmation.
+  if (rawStatus === undefined || !/^\d+$/.test(rawStatus) || !Number.isSafeInteger(Number(rawStatus))) {
+    throw new Error("Grok coupon response has no confirmed gRPC status");
+  }
+  const status = Number(rawStatus);
+  if (status !== 0) throw new GrpcWebError(status, decoded.statusMessage ?? "Unknown gRPC error");
+}
+
 export async function getGrokRemainingResets(options: GetRemainingResetsOptions): Promise<{ tokens: GrokResetCoupon[] }> {
   const fetchImpl = options.fetchFn ?? globalThis.fetch;
   const endpoint = options.endpoint ?? GROK_GET_REMAINING_RESETS_ENDPOINT;
@@ -251,9 +262,7 @@ export async function getGrokRemainingResets(options: GetRemainingResetsOptions)
   const rawBytes = new Uint8Array(await res.arrayBuffer());
   const decoded = decodeGrpcWebResponse(rawBytes);
 
-  if (decoded.status !== 0) {
-    throw new GrpcWebError(decoded.status, decoded.statusMessage ?? "Unknown gRPC error");
-  }
+  assertConfirmedCouponStatus(decoded);
 
   if (decoded.messages.length === 0) {
     return { tokens: [] };
@@ -285,9 +294,7 @@ export async function redeemGrokResetCoupon(options: RedeemResetOptions): Promis
   const rawBytes = new Uint8Array(await res.arrayBuffer());
   const decoded = decodeGrpcWebResponse(rawBytes);
 
-  if (decoded.status !== 0) {
-    throw new GrpcWebError(decoded.status, decoded.statusMessage ?? "Unknown gRPC error");
-  }
+  assertConfirmedCouponStatus(decoded);
 
   return {
     success: true,

package/src/integrations/cursor-detect.ts

@@ -9,7 +9,7 @@
  *
  * Detection is read-only and injectable: the proxy never writes anything into a Cursor
  * install, its state database, or its keychain entries (the T20 exclusion in
- * devlog/_plan/260822_senpi_cursor_transfer/090), and the tests run against a temp tree.
+ * devlog/_fin/260822_senpi_cursor_transfer/090), and the tests run against a temp tree.
  */
 import { existsSync, readdirSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";

package/src/lib/errors.ts

@@ -17,6 +17,7 @@ export const ENCRYPTED_FUNCTION_OUTPUT_REJECTION =
  * string for a client to be able to tell this apart from a provider rate limit.
  */
 export const SEND_BUDGET_EXHAUSTED_CODE = "request_send_budget_exhausted";
+export const SPEND_LEDGER_STORAGE_UNAVAILABLE_CODE = "spend_ledger_storage_unavailable";
 
 /** First nonblank string across the canonical upstream error paths, in priority order. */
 export function upstreamErrorMessageFromPayload(payload: unknown): string | undefined {
@@ -357,6 +358,9 @@ export function isUpstreamResetReplayRefusedMessage(text: string): boolean {
 
 export function classifyError(status: number, type: string, message: string): OcxErrorPayload {
   const text = message.toLowerCase();
+  if (type === SPEND_LEDGER_STORAGE_UNAVAILABLE_CODE) {
+    return { message, type: "server_error", code: SPEND_LEDGER_STORAGE_UNAVAILABLE_CODE };
+  }
   if (type === "previous_response_not_found") {
     return { message, type: "invalid_request_error", code: "previous_response_not_found" };
   }
@@ -639,6 +643,24 @@ export function adapterFailureFromMessage(message: string): { httpStatus: number
   return { httpStatus, error };
 }
 
+/** Narrow structured classes carried through a synthesized bare-error terminal. */
+export function recognizedUpstreamError(error: { type?: unknown; code?: unknown }):
+  { type: string; code: string; httpStatus: 429 | 503 } | undefined {
+  const code = typeof error.code === "string" ? error.code : undefined;
+  // An explicit unknown code must not gain a recognized class from its type or copy.
+  if (code !== undefined && !["rate_limit_exceeded", "rate_limit_error", "server_is_overloaded", "overloaded_error"].includes(code)) return undefined;
+  if (code === "rate_limit_exceeded" || code === "rate_limit_error"
+    || (code === undefined && error.type === "rate_limit_error")) {
+    return { type: "rate_limit_error", code: code ?? "rate_limit_exceeded", httpStatus: 429 };
+  }
+  if (code === "server_is_overloaded" || code === "overloaded_error"
+    || (code === undefined && error.type === "overloaded_error")) {
+    return { type: error.type === "overloaded_error" ? "overloaded_error" : "server_error",
+      code: code ?? "server_is_overloaded", httpStatus: 503 };
+  }
+  return undefined;
+}
+
 /** Map a terminal Responses error object to the HTTP status we record in /api/logs. */
 export function httpStatusFromTerminalError(error: {
   type?: string;
@@ -646,10 +668,13 @@ export function httpStatusFromTerminalError(error: {
   message?: string;
 } | undefined): number {
   if (!error) return 502;
+  if (error.code === SPEND_LEDGER_STORAGE_UNAVAILABLE_CODE) return 503;
   if (error.code === "client_closed_request" || error.code === "client_cancelled") return 499;
   if (isCyberPolicyCode(error.code) || (error.message ? isCyberPolicyMessage(error.message) : false)) {
     return 400;
   }
+  const recognized = recognizedUpstreamError(error);
+  if (recognized) return recognized.httpStatus;
   if (error.type === "rate_limit_error" || error.code === "rate_limit_exceeded") return 429;
   if (error.type === "authentication_error" || error.code === "invalid_api_key") return 401;
   if (

package/src/lib/redact.ts

@@ -7,7 +7,7 @@ export const REDACTED_SECRET = "[REDACTED]";
  * credentials over an unsafe channel (e.g. plaintext non-loopback HTTP) rather than
  * re-deriving a narrower local list.
  */
-export const SENSITIVE_KEY_PATTERN = /^(?:authorization|proxy-authorization|cookie|set-cookie|set-cookie2|api[-_]?key|x-api-key|x-goog-api-key|x-amz-security-token|access[-_]?token|refresh[-_]?token|id[-_]?token|token|secret|client[-_]?secret|password|profile[-_]?arn|exa[-_]?api[-_]?key)$/i;
+export const SENSITIVE_KEY_PATTERN = /^(?:authorization|proxy-authorization|cookie|set-cookie|set-cookie2|api[-_]?key|x-api-key|x-goog-api-key|x-amz-security-token|copilot[-_]?session[-_]?token|session[-_]?token|access[-_]?token|refresh[-_]?token|id[-_]?token|token|secret|client[-_]?secret|password|profile[-_]?arn|exa[-_]?api[-_]?key)$/i;
 
 /**
  * Colon-labelled credential headers echoed back inside an error body
@@ -40,7 +40,7 @@ export const SENSITIVE_KEY_PATTERN = /^(?:authorization|proxy-authorization|cook
 // Every letter position also accepts \u0001, the placeholder the fold emits for
 // an unresolved HTML named reference: `authorⅈzation` is the label with one
 // character we cannot name, and that is still the label.
-const CREDENTIAL_HEADER_LABEL_RAW = "x-api-key|x-goog-api-key|x-amz-security-token|api[_-]?key|apiKey|exa[_-]?api[_-]?key|exaApiKey|access[_-]?token|accessToken|refresh[_-]?token|refreshToken|id[_-]?token|client[_-]?secret|clientSecret|authorization|proxy-authorization|cookie|set-cookie|password|secret|token";
+const CREDENTIAL_HEADER_LABEL_RAW = "copilot[_-]?session[_-]?token|session[_-]?token|sessionToken|x-api-key|x-goog-api-key|x-amz-security-token|api[_-]?key|apiKey|exa[_-]?api[_-]?key|exaApiKey|access[_-]?token|accessToken|refresh[_-]?token|refreshToken|id[_-]?token|client[_-]?secret|clientSecret|authorization|proxy-authorization|cookie|set-cookie|password|secret|token";
 
 const CREDENTIAL_HEADER_LABEL = CREDENTIAL_HEADER_LABEL_RAW
   .replace(/(?<![\[\\])([A-Za-z])(?![\]\-])/g, "[$1\u0001]");

package/src/oauth/index.ts

@@ -360,7 +360,7 @@ export const OAUTH_PROVIDERS: Record<string, OAuthProviderDef> = {
  * Removed provider ids that still name a live successor.
  *
  * `devin-cli` was merged into `devin` (import-first login absorbed the CLI
- * credential import; devlog/_plan/260913_devin_provider_merge). The id can
+ * credential import; devlog/_fin/260913_devin_provider_merge). The id can
  * still arrive here from a saved config row or a stored credential slot that
  * the startup migration has not rekeyed yet, and from a user typing the old
  * name at `ocx login`. It is deliberately NOT an OAUTH_PROVIDERS entry:

package/src/oauth/meta-muse-device.ts

@@ -6,7 +6,7 @@
  * resulting account token into the `LLM|` Model API key our request path sends as a
  * bearer.
  *
- * Protocol source: devlog/_plan/260912_muse_device_oauth/001_reference_measurements.md.
+ * Protocol source: devlog/_fin/260912_muse_device_oauth/001_reference_measurements.md.
  * It is second-party, not vendor documentation, so every response is parsed defensively
  * and every failure names a kind instead of throwing a bare string.
  *

package/src/oauth/types.ts

@@ -30,7 +30,7 @@ export interface KiroOAuthMetadata {
  *
  * The Model API is authenticated by the `LLM|` key in `access`; this token authenticates
  * the Meta ACCOUNT and exists only to mint that key and to read subscription usage
- * (devlog/_plan/260912_muse_device_oauth/002 A). Keeping it out of `access` is what lets
+ * (devlog/_fin/260912_muse_device_oauth/002 A). Keeping it out of `access` is what lets
  * every request path stay unchanged.
  *
  * It must never be added to `OAuthAccountSummary` (src/oauth/index.ts:1803) or to

package/src/providers/anthropic-fast.ts

@@ -12,7 +12,7 @@
  * account rate limit and must keep flowing into the existing wait/rotation handling, so only an
  * error message that names fast mode or the speed parameter, or a fast-pool header reporting
  * zero remaining, counts. Live probe strings (2026-09-23,
- * devlog/_plan/260923_anthropic_fast_speed/020_probe-evidence.md):
+ * devlog/_fin/260923_anthropic_fast_speed/020_probe-evidence.md):
  *   429 "Usage credits are required for fast mode."
  *   400 "Fast mode is not enabled for your organization. ..."
  *   400 "'<model>' does not support the `speed` parameter. ..."

package/src/providers/anthropic-reset-grant-ledger.ts

@@ -7,7 +7,7 @@
  * ten minutes (`b5o = 600000`) and mints a new one afterwards; this journal keeps
  * the same window.
  *
- * Rules (devlog/_plan/260923_claude_reset_grants/010_plan.md, "Ledger contract"):
+ * Rules (devlog/_fin/260923_claude_reset_grants/010_plan.md, "Ledger contract"):
  * - Every read-modify-write runs synchronously inside a cross-process
  *   `BEGIN IMMEDIATE` lock on a sibling SQLite file; nothing awaits inside it,
  *   and the upstream claim always runs after the open record is on disk.

package/src/providers/devin-cli-authmode-migration.ts

@@ -4,7 +4,7 @@
  * `devin-cli` used to be a local provider whose adapter spawned `devin acp`;
  * it later became an account provider on the shared `devin` adapter, and the
  * registry id itself has since merged into `devin` outright
- * (devlog/_plan/260913_devin_provider_merge).
+ * (devlog/_fin/260913_devin_provider_merge).
  *
  * Only the adapter repair still lives here. The `authMode` half — rewriting
  * `"local"` to `"oauth"` on the registry-id row — moved into

package/src/providers/devin-provider-merge-migration.ts

@@ -1,6 +1,6 @@
 /**
  * Merge the retired `devin-cli` provider id into `devin` at startup
- * (devlog/_plan/260913_devin_provider_merge).
+ * (devlog/_fin/260913_devin_provider_merge).
  *
  * The two registry entries were the same adapter, api-server, and credential
  * shape — only the login path differed — so `devin-cli` was removed from the