@bitkyc08/opencodex 2.83.0 → 2.84.0

package/src/providers/anthropic-reset-grant-ledger.ts

@@ -44,6 +44,8 @@ interface OperationRecord {
   status: "open" | "settled";
   code?: string;
   resetsLeft?: number | null;
+  /** Windows the settled claim reported cleared; absent on records written before this field. */
+  cleared?: string[];
   attempts: number;
   leaseUntil: number;
   createdAt: number;
@@ -64,7 +66,7 @@ export interface AnthropicResetOperationIdentity {
 
 export type AnthropicResetBegin =
   | { kind: "execute"; attempt: number }
-  | { kind: "replay"; code: string; resetsLeft: number | null; settledAt: number }
+  | { kind: "replay"; code: string; resetsLeft: number | null; settledAt: number; claimedAt: number; cleared: string[] }
   | { kind: "identity-mismatch" }
   | { kind: "in-flight" }
   | { kind: "expired" }
@@ -102,7 +104,9 @@ function isRecordShape(value: unknown): value is OperationRecord {
   return typeof record.accountId === "string" && typeof record.grantId === "string"
     && typeof record.orgDigest === "string" && (record.status === "open" || record.status === "settled")
     && typeof record.attempts === "number" && typeof record.leaseUntil === "number"
-    && typeof record.createdAt === "number" && typeof record.updatedAt === "number";
+    && typeof record.createdAt === "number" && typeof record.updatedAt === "number"
+    && (record.cleared === undefined
+      || Array.isArray(record.cleared) && record.cleared.every(window => typeof window === "string"));
 }
 
 /** Missing file → empty journal. Present but unreadable → throws; never an empty fallback. */
@@ -197,7 +201,10 @@ export function beginAnthropicResetOperation(
         return { kind: "identity-mismatch" };
       }
       if (existing.status === "settled") {
-        return { kind: "replay", code: existing.code ?? "unavailable", resetsLeft: existing.resetsLeft ?? null, settledAt: existing.updatedAt };
+        return {
+          kind: "replay", code: existing.code ?? "unavailable", resetsLeft: existing.resetsLeft ?? null,
+          settledAt: existing.updatedAt, claimedAt: existing.createdAt, cleared: existing.cleared ?? [],
+        };
       }
       if (existing.leaseUntil > now) return { kind: "in-flight" };
       if (now - existing.createdAt >= ANTHROPIC_RESET_RETRY_WINDOW_MS) return { kind: "expired" };
@@ -232,6 +239,12 @@ export function beginAnthropicResetOperation(
 export interface AnthropicResetSettlement {
   code: string;
   resetsLeft: number | null;
+  /** When the canonical (first) settlement was journaled, not when this caller arrived. */
+  settledAt: number;
+  /** When the operation was first journaled, before its first claim was sent. */
+  claimedAt: number;
+  /** Windows the canonical settlement reported cleared. */
+  cleared: string[];
 }
 
 /**
@@ -241,7 +254,7 @@ export interface AnthropicResetSettlement {
  * throws, because an answer with no journal entry cannot be reported as durable.
  */
 export function settleAnthropicResetOperation(
-  settlement: { operationId: string; code: string; resetsLeft: number | null },
+  settlement: { operationId: string; code: string; resetsLeft: number | null; cleared?: readonly string[] },
   options: AnthropicResetLedgerOptions = {},
 ): AnthropicResetSettlement {
   const now = options.now ?? Date.now();
@@ -250,14 +263,23 @@ export function settleAnthropicResetOperation(
     const journal = readJournal(filePath);
     const existing = journal.operations[settlement.operationId];
     if (!existing) throw new AnthropicResetLedgerError("unavailable");
-    if (existing.status === "settled") return { code: existing.code ?? "unavailable", resetsLeft: existing.resetsLeft ?? null };
+    if (existing.status === "settled") {
+      return {
+        code: existing.code ?? "unavailable", resetsLeft: existing.resetsLeft ?? null,
+        settledAt: existing.updatedAt, claimedAt: existing.createdAt, cleared: existing.cleared ?? [],
+      };
+    }
     existing.status = "settled";
     existing.code = settlement.code;
     existing.resetsLeft = settlement.resetsLeft;
+    existing.cleared = [...(settlement.cleared ?? [])];
     existing.leaseUntil = 0;
     existing.updatedAt = now;
     writeJournal(filePath, journal, now);
-    return { code: settlement.code, resetsLeft: settlement.resetsLeft };
+    return {
+      code: settlement.code, resetsLeft: settlement.resetsLeft, settledAt: now,
+      claimedAt: existing.createdAt, cleared: [...existing.cleared],
+    };
   });
 }
 

package/src/providers/api-key-resolve.ts

@@ -39,17 +39,25 @@ function defaultEntryFactory(service: string, account: string): ProviderKeychain
 let entryFactory: ProviderKeychainEntryFactory = defaultEntryFactory;
 const resolvedCache = new Map<string, string>();
 const warnedAccounts = new Set<string>();
+let resolutionGeneration = 0;
+
+/** Advances whenever cached secrets may have changed, so derived snapshots can rebuild. */
+export function providerKeyResolutionGeneration(): number {
+  return resolutionGeneration;
+}
 
 /** Test seam: swap the OS entry for an in-memory one and drop caches. */
 export function setProviderKeychainEntryFactoryForTests(factory: ProviderKeychainEntryFactory | null): void {
   entryFactory = factory ?? defaultEntryFactory;
   resolvedCache.clear();
+  resolutionGeneration++;
   warnedAccounts.clear();
 }
 
 /** Write-path seam: a store/restore mutated secrets, so cached reads and warnings are stale. */
 export function invalidateResolvedProviderKeyCache(): void {
   resolvedCache.clear();
+  resolutionGeneration++;
   warnedAccounts.clear();
 }
 
@@ -76,7 +84,7 @@ export function providerKeychainEntry(account: string): ProviderKeychainEntry {
   return entryFactory(PROVIDER_KEYCHAIN_SERVICE, account);
 }
 
-function readKeychain(account: string): string | undefined {
+function readKeychain(account: string, quiet = false): string | undefined {
   const cached = resolvedCache.get(account);
   if (cached !== undefined) return cached;
   try {
@@ -88,7 +96,7 @@ function readKeychain(account: string): string | undefined {
   } catch {
     // fall through to the single warning below
   }
-  if (!warnedAccounts.has(account)) {
+  if (!quiet && !warnedAccounts.has(account)) {
     warnedAccounts.add(account);
     console.warn(`[opencodex] provider key reference keychain:${account} could not be read from the OS keychain; requests for this provider have no credential until the keychain is available (no plaintext fallback)`);
   }
@@ -105,6 +113,13 @@ export function resolveProviderApiKey(value: string | undefined): string | undef
   return resolveEnvValue(value);
 }
 
+/** The same resolution without the unreadable-reference warning, for observe-only callers. */
+export function resolveProviderApiKeyQuietly(value: string | undefined): string | undefined {
+  if (!value) return undefined;
+  if (isKeychainReference(value)) return readKeychain(keychainAccount(value), true);
+  return resolveEnvValue(value);
+}
+
 export type ProviderKeyStoreKind = "keychain" | "env" | "file" | "none";
 
 export function providerKeyStoreKind(provider: Pick<OcxProviderConfig, "apiKey"> | undefined): ProviderKeyStoreKind {

package/src/providers/key-failover.ts

@@ -8,7 +8,7 @@
  *
  * Modelled after src/codex/routing.ts cooldown logic but scoped to plain API-key pools.
  */
-import { commitProviderApiKeySelection } from "./api-key-selection";
+import { commitProviderApiKeySelection, providerApiKeySelectionIsCurrent } from "./api-key-selection";
 import type { ProviderApiKeySelection } from "../types/provider";
 import { routedProviderConfig } from "../router";
 import { getProviderRegistryEntry } from "./registry";
@@ -30,6 +30,16 @@ interface KeyCooldown {
 
 const DEFAULT_COOLDOWN_MS = 60_000;
 const MAX_COOLDOWN_MS = 10 * 60_000; // cap at 10 min for api-key rotation
+/**
+ * Anthropic credit-balance refusal (#6958). An empty prepaid balance is account state, not a
+ * rate signal: it clears only when someone buys credits or auto-reload fires, so the
+ * ten-minute credential cap would hand a dead key back to rotation six times an hour. One hour
+ * keeps it out of replacement and proactive selection while a funded sibling exists, and still
+ * notices a top-up without a restart. When every key is held, requests keep using the active
+ * key and return Anthropic's original refusal. The hold is in memory; dashboard key management
+ * clears it.
+ */
+export const ANTHROPIC_BILLING_COOLDOWN_MS = 60 * 60_000;
 
 /**
  * Cap for a cooldown the upstream itself dated, as opposed to one we inferred.
@@ -688,12 +698,13 @@ export function rateLimitRetryDelayMs(
 function rotateKeyAfterFailure(
   config: OcxConfig,
   providerName: string,
-  failureStatus: 401 | 429,
+  failureStatus: 401 | 429 | "billing",
   retryAfterHeader: string | null | undefined,
   now = Date.now(),
   attemptedKey?: string,
   attemptedSelection?: ProviderApiKeySelection,
   quotaResetAt?: number,
+  acceptsFreshProvider?: (provider: OcxProviderConfig) => boolean,
 ): OcxProviderConfig | null {
   const provider = config.providers[providerName];
   if (!provider) return null;
@@ -704,6 +715,11 @@ function rotateKeyAfterFailure(
     | { failedId?: string; candidateId?: string }
     | { exhaustedCount: number; failedId?: string };
   const outcome = commitProviderApiKeySelection<Rotation | null>(config, providerName, freshProvider => {
+    // Run on every persisted transaction attempt, including a freshness rebase.
+    if (acceptsFreshProvider) {
+      try { if (!acceptsFreshProvider(freshProvider)) return { changed: false, value: null }; }
+      catch { return { changed: false, value: null }; }
+    }
     const pool = freshProvider.apiKeyPool;
     if (!pool || pool.length < 2) return { changed: false, value: null };
 
@@ -741,6 +757,8 @@ function rotateKeyAfterFailure(
   }, attemptedSelection);
   if (outcome.status === "unavailable") return null;
   if (outcome.status === "superseded") {
+    // Billing authority is bound to the sent selection; a newer manual choice grants no replay.
+    if (acceptsFreshProvider) return null;
     // A newer manual selection (including A→B→A) owns subsequent dispatch. Reusing the
     // same failed key here would loop forever; preserve its original failure instead.
     return outcome.provider.apiKey !== failedKey ? structuredClone(outcome.provider) : null;
@@ -750,7 +768,9 @@ function rotateKeyAfterFailure(
     // A 401 is a verdict about the credential itself, not a timing signal: the key is rejected
     // until an operator replaces it, and upstreams send no Retry-After for it. Hold it for the
     // full cap instead of the 429 default so a dead key is not re-tried once a minute.
-    const cooldownMs = failureStatus === 401
+    const cooldownMs = failureStatus === "billing"
+      ? ANTHROPIC_BILLING_COOLDOWN_MS
+      : failureStatus === 401
       ? MAX_COOLDOWN_MS
       // A reset instant the upstream dated outranks both the header and the
       // default: it is the only one of the three that knows when the quota
@@ -762,7 +782,7 @@ function rotateKeyAfterFailure(
     sweepExpiredOnWrite(now);
   }
   if ("exhaustedCount" in outcome.value) {
-    console.warn(`[key-failover] ${providerName}: all ${outcome.value.exhaustedCount} keys in cooldown after ${failureStatus}; returning the upstream status to the client`);
+    console.warn(`[key-failover] ${providerName}: all ${outcome.value.exhaustedCount} keys in cooldown after ${failureLabel(failureStatus)}; returning the upstream status to the client`);
     return null;
   }
 
@@ -771,12 +791,16 @@ function rotateKeyAfterFailure(
   if (outcome.value.candidateId) {
     console.warn(
       // Log ids only — labels are user-supplied free text and could carry secret material.
-      `[key-failover] ${providerName}: ${failureStatus} on key ${outcome.value.failedId ?? "?"}; rotating to key ${outcome.value.candidateId}`,
+      `[key-failover] ${providerName}: ${failureLabel(failureStatus)} on key ${outcome.value.failedId ?? "?"}; rotating to key ${outcome.value.candidateId}`,
     );
   }
   return structuredClone(committed);
 }
 
+function failureLabel(failureStatus: 401 | 429 | "billing"): string {
+  return failureStatus === "billing" ? "credit-balance refusal" : String(failureStatus);
+}
+
 export function rotateKeyOn429(
   config: OcxConfig,
   providerName: string,
@@ -865,6 +889,29 @@ export function rotateProviderTransportOn401(
   return applyRotatedTransport(providerName, routedProvider, rotated, options.promptCacheKey);
 }
 
+/** Exact Anthropic billing refusal: cool the key for ANTHROPIC_BILLING_COOLDOWN_MS. */
+export function rotateProviderTransportOnAnthropicBilling(
+  config: OcxConfig,
+  providerName: string,
+  routedProvider: OcxProviderTransport,
+  options: Omit<RotateProviderTransportOptions, "retryAfter"> = {},
+): OcxProviderTransport | null {
+  if (routedProvider.adapter !== "anthropic"
+    || (routedProvider.authMode !== undefined && routedProvider.authMode !== "key")
+    || !hasKeyPoolFailover(routedProvider)) return null;
+  const headerShape = (provider: OcxProviderConfig) => JSON.stringify(Object.entries(provider.headers ?? {}).sort(([a], [b]) => a.localeCompare(b)));
+  const sentHeaders = headerShape(routedProvider);
+  const acceptsFreshProvider = (fresh: OcxProviderConfig): boolean => fresh.adapter === routedProvider.adapter
+    && (fresh.authMode === undefined || fresh.authMode === "key") && hasKeyPoolFailover(fresh)
+    && (fresh.apiKeyTransport ?? "x-api-key") === (routedProvider.apiKeyTransport ?? "x-api-key")
+    && headerShape(fresh) === sentHeaders
+    && providerApiKeySelectionIsCurrent({ ...config, providers: { ...config.providers, [providerName]: fresh } },
+      providerName, routedProvider);
+  const rotated = rotateKeyAfterFailure(config, providerName, "billing", null, options.now,
+    options.attemptedKey, options.attemptedSelection ?? routedProvider._apiKeyAttempt, undefined, acceptsFreshProvider);
+  return rotated ? applyRotatedTransport(providerName, routedProvider, rotated, options.promptCacheKey) : null;
+}
+
 function applyRotatedTransport(
   providerName: string,
   routedProvider: OcxProviderTransport,

package/src/providers/model-rename-startup.ts

@@ -3,6 +3,7 @@ import { projectModelRenames } from "./model-rename-migration";
 import { projectStaleContextWindows } from "./stale-context-window-migration";
 import { projectStaleModelRosters } from "./stale-model-roster-migration";
 import { projectStaleVisionClassifications } from "./stale-vision-classification-migration";
+import { projectStaleNoVisionSeeds } from "./stale-no-vision-seed-migration";
 import { projectDevinCliAuthMode } from "./devin-cli-authmode-migration";
 import type { OcxConfig } from "../types";
 
@@ -17,12 +18,13 @@ export function projectStartupConfigRepairs(config: OcxConfig): ReturnType<typeo
   const renames = projectModelRenames(config);
   const windows = projectStaleContextWindows(renames.config);
   const vision = projectStaleVisionClassifications(windows.config);
-  const rosters = projectStaleModelRosters(vision.config);
+  const noVision = projectStaleNoVisionSeeds(vision.config);
+  const rosters = projectStaleModelRosters(noVision.config);
   const devinCli = projectDevinCliAuthMode(rosters.config);
   return {
     config: devinCli.config,
-    changed: renames.changed || windows.changed || vision.changed || rosters.changed || devinCli.changed,
-    warnings: [...renames.warnings, ...windows.warnings, ...vision.warnings, ...rosters.warnings, ...devinCli.warnings],
+    changed: renames.changed || windows.changed || vision.changed || noVision.changed || rosters.changed || devinCli.changed,
+    warnings: [...renames.warnings, ...windows.warnings, ...vision.warnings, ...noVision.warnings, ...rosters.warnings, ...devinCli.warnings],
   };
 }
 

package/src/providers/quota/account-cache.ts

@@ -473,6 +473,17 @@ export function clearAccountQuotaCache(provider?: string): void {
   persistAccountQuotaCache();
 }
 
+/** Drop one account's cached bars and any joined probe so a reset is not ranked from the old window. */
+export function forgetCachedProviderAccountQuota(provider: string, accountId: string): void {
+  hydrateAccountQuotaCache();
+  const key = accountCacheKey(provider, accountId);
+  accountQuotaCache.delete(key);
+  for (const flight of [...accountQuotaInflight.keys()]) {
+    if (flight === key || flight.startsWith(key + "\u0000")) accountQuotaInflight.delete(flight);
+  }
+  persistAccountQuotaCache();
+}
+
 /**
  * Resolve a bearer for quota probing without silently adopting a newer global
  * Claude CLI credential into a background multiauth slot.

package/src/providers/quota/anthropic-account-quota.ts

@@ -20,6 +20,8 @@ import {
  */
 export async function fetchAnthropicAccountQuota(
   instance: AnthropicInstanceId, accountId: string, force: boolean, config: OcxConfig = loadConfig(),
+  /** Never join an older account or vendor flight; a reset reread needs post-grant evidence. */
+  freshDispatch = false,
 ): Promise<AccountQuotaCacheEntry> {
   const unavailable = (): AccountQuotaCacheEntry => ({ ts: Date.now(), quota: null, unavailable: true });
   const target = config.providers[instance];
@@ -52,7 +54,7 @@ export async function fetchAnthropicAccountQuota(
   const flightKey = recovery.anthropicCredentialQuotaFlightKey(key, accountId);
   const flightCurrent = () => ownerCurrent()
     && recovery.anthropicCredentialQuotaFlightKey(key, accountId) === flightKey;
-  const joinable = accountQuotaInflight.get(flightKey);
+  const joinable = freshDispatch ? undefined : accountQuotaInflight.get(flightKey);
   if (joinable) {
     const joined = await joinable;
     return ownerCurrent() && (joined.isCurrent?.() ?? flightCurrent()) ? joined : unavailable();
@@ -78,7 +80,7 @@ export async function fetchAnthropicAccountQuota(
       const result = await recovery.probeAnthropicQuotaWithRecovery(accountId, token, fresh => {
         if (!flightCurrent()) throw new AnthropicQuotaProbeOwnershipError("quota flight changed");
         recovery.assertAnthropicQuotaSendAllowed(accountId, token);
-        return fetchAnthropicUsageQuotaForInstance(instance, token, fresh);
+        return fetchAnthropicUsageQuotaForInstance(instance, token, fresh || freshDispatch);
       }, () => ownerCurrent() && mayCommitAccountQuotaKey(key, writerGeneration));
       if (result && !result.isCurrent()) return unavailable();
       if (!result && !flightCurrent()) return unavailable();

package/src/providers/quota/report-cache.ts

@@ -344,3 +344,17 @@ export function isProviderQuotaReportCurrent(value: ProviderQuotaReport): boolea
   return (generation === undefined || isMainAccountIdentityGenerationLive(generation))
     && (accountReportCurrent.get(value)?.() ?? true);
 }
+
+/**
+ * The reports this process already holds for the configured providers, for a passive read (#6959):
+ * no probe, token refresh, account snapshot or publication into routing evidence. The Home's own
+ * dashboard and traffic keep the cache current.
+ */
+export function heldProviderQuotaReports(configuredProviders: readonly string[]): ProviderQuotaResponse {
+  const held = getProviderQuotaReportCache()?.response;
+  const configured = new Set(configuredProviders);
+  return {
+    generatedAt: held?.generatedAt ?? Date.now(),
+    reports: (held?.reports ?? []).filter(item => configured.has(item.provider) && isProviderQuotaReportCurrent(item)),
+  };
+}

package/src/providers/quota/vendor-probes-oauth.ts

@@ -327,9 +327,9 @@ async function readAnthropicUsageQuota(accessToken: string): Promise<ProviderQuo
  * This endpoint reports quota only. Its body carries `five_hour`, `seven_day`, the
  * model-scoped weekly buckets (`seven_day_fable`/`_opus`/`_sonnet`) and a `limits` array,
  * and **no subscription or tier field** — nor does the OAuth token response, which yields only
- * `account.uuid` and `account.email_address` (`src/oauth/anthropic.ts`). That is why
- * `OAuthAccountSummary.plan` is `null` for Anthropic rather than populated here (#3777); it is
- * a missing upstream field, not an unfinished mapping.
+ * `account.uuid` and `account.email_address` (`src/oauth/anthropic.ts`). Subscription labels
+ * instead come from the authenticated profile in `src/oauth/anthropic-identity.ts`, never
+ * from this quota response.
  *
  * A tier must not be inferred from what is here. Percentages are normalized per account, so a
  * Max x5 seat at 50% is byte-identical to a Max x20 seat at 50%, and the presence of a

package/src/providers/quota.ts

@@ -15,6 +15,7 @@ import {
 } from "./kiro-usage";
 import { mapQuotaRoster, readProviderApiKeyQuotas, type ProviderApiKeyQuota } from "./quota-key-accounts";
 import type { OcxConfig, OcxProviderConfig } from "../types";
+import { isPassiveRead } from "../lib/passive-read";
 import type { ProviderQuota, QuotaFailureCode } from "./quota-types";
 import {
   accountReportCurrent,
@@ -23,7 +24,7 @@ import {
   captureProviderReportEpochs, providerReportEpochChanged,
   cacheKeyWithAggregationState,
   getProviderQuotaReportCache,
-  hasCodexPoolProvider,
+  hasCodexPoolProvider, heldProviderQuotaReports,
   inflight,
   invalidationEpoch,
   isBuiltInChatGptForwardProvider,
@@ -229,6 +230,8 @@ export function flushProviderQuotaObservationsForTests(): Promise<void> {
 }
 
 export async function fetchProviderQuotaReports(config: OcxConfig, forceRefresh = false): Promise<ProviderQuotaResponse> {
+  // A passive read (a Remote Link Child's, #6959) shows the held reports and starts nothing.
+  if (isPassiveRead()) return heldProviderQuotaReports(Object.keys(config.providers));
   // A Pool report's cache signature and provider fetch must share one account snapshot.
   // Preserve force semantics when deciding whether that snapshot refreshes upstream data.
   const prefetchedCodexSnapshot = hasCodexPoolProvider(config)

package/src/providers/registry/entries-core.ts

@@ -32,12 +32,12 @@ import {
   OPENAI_API_GPT56_MAX_INPUT_TOKENS,
   OPENAI_API_GPT56_VIRTUAL_MODELS,
   OPENAI_API_GPT56_REASONING_EFFORTS,
-  META_MUSE_REASONING_EFFORTS,
-  META_MUSE_REASONING_EFFORT_MAP,
+  META_MODEL_API_REASONING_EFFORTS,
+  META_MODEL_API_REASONING_EFFORT_MAPS,
   META_MUSE_CODE_REASONING_EFFORTS,
   META_MUSE_CODE_REASONING_EFFORT_MAP,
   META_MUSE_CONTEXT_WINDOW,
-  META_MUSE_MODELS,
+  META_MODEL_API_MODELS,
   OPENAI_DAYBREAK_MODELS,
   OPENAI_DAYBREAK_CONTEXT_WINDOWS,
   OPENAI_DAYBREAK_MAX_INPUT_TOKENS,
@@ -736,7 +736,7 @@ export const PROVIDER_REGISTRY_CORE: readonly ProviderRegistryEntry[] = [
     authKind: "key",
     dashboardUrl: "https://dev.meta.ai/docs/authentication",
     defaultModel: "muse-spark-1.3",
-    models: META_MUSE_MODELS,
+    models: META_MODEL_API_MODELS,
     // Static roster: no authenticated /v1/models payload was ever observed (the only
     // contact was an unauthenticated GET returning 401 invalid_api_key), and Meta serves
     // non-agent families on this same base URL. Turning discovery on would publish an
@@ -746,20 +746,20 @@ export const PROVIDER_REGISTRY_CORE: readonly ProviderRegistryEntry[] = [
     // without this, registry transport canonicalization would retarget it and send their
     // saved key to Meta.
     preserveCustomDestination: true,
-    modelContextWindows: Object.fromEntries(META_MUSE_MODELS.map(id => [id, META_MUSE_CONTEXT_WINDOW])),
+    modelContextWindows: Object.fromEntries(META_MODEL_API_MODELS.map(id => [id, META_MUSE_CONTEXT_WINDOW])),
     // text+image only. Meta also documents video, audio (degraded on 1.3), and PDF, but
     // the catalog modality enum is text/image and over-advertising poisons the exported
     // client config (see tests/codex-integration/catalog-input-modality-enum.test.ts).
-    modelInputModalities: Object.fromEntries(META_MUSE_MODELS.map(id => [id, ["text", "image"] as ["text", "image"]])),
-    modelReasoningEfforts: Object.fromEntries(META_MUSE_MODELS.map(id => [id, META_MUSE_REASONING_EFFORTS])),
-    modelReasoningEffortMap: Object.fromEntries(META_MUSE_MODELS.map(id => [id, META_MUSE_REASONING_EFFORT_MAP])),
+    modelInputModalities: Object.fromEntries(META_MODEL_API_MODELS.map(id => [id, ["text", "image"] as ["text", "image"]])),
+    modelReasoningEfforts: META_MODEL_API_REASONING_EFFORTS,
+    modelReasoningEffortMap: META_MODEL_API_REASONING_EFFORT_MAPS,
     // No defaultMaxOutputTokens: Meta publishes none. The only number in its docs
     // (131072) appears inside a third-party config sample, and the protocol pages call
     // the real limit "model-dependent".
     // Meta names its variable MODEL_API_KEY, but the env var opencodex reads is derived
     // from the provider id (META_MODEL_API_KEY). Saying only Meta's name would send a
     // user to export a variable this proxy never reads.
-    note: "Pay-as-you-go Meta Model API. Get a key at https://dev.meta.ai (Meta calls it MODEL_API_KEY; export it here as META_MODEL_API_KEY) — a Meta developer account needs a payment method before it can serve requests, and every call is metered per token. A Muse Code subscription does NOT work here: Meta scopes that credential to the Muse Code CLI and bills any other key pay-as-you-go (dev.meta.ai/docs/muse-code/subscriptions). The Contributor tier (muse-spark-1.3-contributor) is cheap because Meta trains on your prompts — about 92% off input, 95% off output, 99% off cached input; do not send confidential material through it. Muse Spark is also reachable through resellers: command-code carries both tiers, opencode-go serves only muse-spark-1.3-contributor.",
+    note: "Pay-as-you-go Meta Model API. Get a key at https://dev.meta.ai (Meta calls it MODEL_API_KEY; export it here as META_MODEL_API_KEY) — a Meta developer account needs a payment method before it can serve requests, and every call is metered per token. A Muse Code subscription does NOT work here: Meta scopes that credential to the Muse Code CLI and bills any other key pay-as-you-go (dev.meta.ai/docs/muse-code/subscriptions). The Contributor tier (muse-spark-1.3-contributor) is cheap because Meta trains on your prompts — about 92% off input, 95% off output, 99% off cached input; do not send confidential material through it. Muse Wonder (muse-wonder-1.0, preview) is Standard mode only on this API ($4 input / $20 output per 1M tokens, no Contributor tier) and accepts reasoning effort up to max; the Spark rows stop at xhigh. Muse Spark is also reachable through resellers: command-code carries both tiers, opencode-go serves only muse-spark-1.3-contributor.",
   },
   /* [Decision Log]
   - 목적과 의도: Let an operator who already signed the Muse Code CLI in reach Muse Spark with that credential, instead of provisioning a second key.
@@ -787,14 +787,14 @@ export const PROVIDER_REGISTRY_CORE: readonly ProviderRegistryEntry[] = [
     oauthId: "meta-muse",
     dashboardUrl: "https://dev.meta.ai",
     defaultModel: "muse-spark-1.3",
-    models: META_MUSE_MODELS,
+    models: META_MODEL_API_MODELS,
     // Same reason as meta-model: the authenticated roster carries muse-image-1.0 and
     // muse-voice-transcribe-1.0, which this Responses-agent provider cannot drive.
     liveModels: false,
-    modelContextWindows: Object.fromEntries(META_MUSE_MODELS.map(id => [id, META_MUSE_CONTEXT_WINDOW])),
-    modelInputModalities: Object.fromEntries(META_MUSE_MODELS.map(id => [id, ["text", "image"] as ["text", "image"]])),
-    modelReasoningEfforts: Object.fromEntries(META_MUSE_MODELS.map(id => [id, META_MUSE_CODE_REASONING_EFFORTS])),
-    modelReasoningEffortMap: Object.fromEntries(META_MUSE_MODELS.map(id => [id, META_MUSE_CODE_REASONING_EFFORT_MAP])),
+    modelContextWindows: Object.fromEntries(META_MODEL_API_MODELS.map(id => [id, META_MUSE_CONTEXT_WINDOW])),
+    modelInputModalities: Object.fromEntries(META_MODEL_API_MODELS.map(id => [id, ["text", "image"] as ["text", "image"]])),
+    modelReasoningEfforts: Object.fromEntries(META_MODEL_API_MODELS.map(id => [id, META_MUSE_CODE_REASONING_EFFORTS])),
+    modelReasoningEffortMap: Object.fromEntries(META_MODEL_API_MODELS.map(id => [id, META_MUSE_CODE_REASONING_EFFORT_MAP])),
     note: "Signs in to Meta with a browser device code on any platform, then mints the Muse Code subscription key. That grant is reimplemented from the one the Muse Code CLI performs and has NOT been exercised against Meta from OpenCodex, so treat the first login as unverified. If the Muse Code CLI is already signed in on macOS, the existing key is imported instead of starting a new grant. A pasted key from https://dev.meta.ai still works as a fallback when a device login cannot complete, and faces the same format check and live validation. A device login authenticates as Meta own Muse Code client, which is a stronger claim than reusing a key the CLI already minted. Meta scopes that credential to the Muse Code CLI, so this is an UNSUPPORTED use: Meta does not authorize subscription coverage outside its own CLI, how these calls settle is not observable from the API, and you should treat every call as billable against your account. The key, imported or pasted, is copied into OpenCodex's auth store. For an account signed in with the device login, OpenCodex refreshes Meta's subscription windows on demand from the same key endpoint the login uses, at most once every five minutes. For an imported or pasted key there is no endpoint to query them on demand, so OpenCodex reads them from streaming responses and shows the last observed value with its age; refreshing one then requires another streaming turn, and translated (non-passthrough) turns report none. Rate limits apply per team, not per key. For a supported path use the meta-model provider with your own key (export it as META_MODEL_API_KEY).",
   },
   {

package/src/providers/registry/entries-extended.ts

@@ -1468,7 +1468,6 @@ export const PROVIDER_REGISTRY_EXTENDED: readonly ProviderRegistryEntry[] = [
     models: [...QODER_GLOBAL_MODELS],
     liveModels: true,
     reasoningEfforts: [...QODER_REASONING_EFFORTS],
-    noVisionModels: [...QODER_GLOBAL_MODELS],
     note: "Official Qoder Global CLI using QODER_PERSONAL_ACCESS_TOKEN. Models are discovered per account with `qoder --list-models`; the documented roster is a degraded fallback. The CLI runs single-turn with tools, MCP, settings hooks, and session persistence disabled. Requires `npm install -g @qoder-ai/qodercli`.",
   },
   {

package/src/providers/registry/model-seeds.ts

@@ -255,6 +255,23 @@ export const META_MUSE_CODE_REASONING_EFFORT_MAP: Record<string, string> = Objec
 /** Both Muse Spark 1.3 tiers publish a 1,048,576-token window (dev.meta.ai/docs/models). */
 export const META_MUSE_CONTEXT_WINDOW = 1_048_576;
 export const META_MUSE_MODELS = ["muse-spark-1.3", "muse-spark-1.3-contributor"];
+/*
+ * Muse Wonder (preview), announced 2026-10-12 (research.meta.ai/blog/muse-wonder). Per
+ * dev.meta.ai/docs/models and dev.meta.ai/docs/pricing-rate-limits, verified 2026-10-13:
+ * id muse-wonder-1.0, a 1,048,576-token window, reasoning effort "minimal" through "max",
+ * and Standard mode only on the Model API (no Contributor variant). Muse Wonder Full is
+ * reachable only inside Muse Code subscriptions and has no Model API id, so it is absent.
+ */
+export const META_MUSE_WONDER_MODEL = "muse-wonder-1.0";
+/** Roster both direct Meta providers serve: the Spark 1.3 tiers plus Muse Wonder. */
+export const META_MODEL_API_MODELS = [...META_MUSE_MODELS, META_MUSE_WONDER_MODEL];
+/** Model API ladders: Spark stops at xhigh; Wonder documents minimal..max. */
+export const META_MODEL_API_REASONING_EFFORTS: Record<string, string[]> = Object.fromEntries(
+  META_MODEL_API_MODELS.map(id => [id, id === META_MUSE_WONDER_MODEL ? META_MUSE_CODE_REASONING_EFFORTS : META_MUSE_REASONING_EFFORTS]),
+);
+export const META_MODEL_API_REASONING_EFFORT_MAPS: Record<string, Record<string, string>> = Object.fromEntries(
+  META_MODEL_API_MODELS.map(id => [id, id === META_MUSE_WONDER_MODEL ? META_MUSE_CODE_REASONING_EFFORT_MAP : META_MUSE_REASONING_EFFORT_MAP]),
+);
 /**
  * Daybreak program aliases. These `-latest` ids are the stable contract: OpenAI repoints
  * them at newer snapshots over time (red -> gpt-5.6-cyber, blue -> gpt-5.6-sol as of

package/src/providers/request-pacing.ts

@@ -33,6 +33,12 @@ export const REQUEST_PACING_CONCURRENCY_RETRY_AFTER_SECONDS = 5;
 let maxQueueDepth = REQUEST_PACING_MAX_QUEUE_DEPTH;
 let maxQueueAgeMs = REQUEST_PACING_MAX_QUEUE_AGE_MS;
 
+// Optional owners register internal response markers; only this owned body rewrap carries them.
+const responseProvenance = new Set<WeakMap<Response, unknown>>();
+export function registerProviderResponseProvenance(markers: WeakMap<Response, unknown>): void {
+  responseProvenance.add(markers);
+}
+
 export type RequestPacingQueueOverloadReason = "queue_full" | "queue_expired";
 
 export class RequestPacingQueueOverloadError extends Error {
@@ -588,6 +594,9 @@ export function trackProviderRequestSlotBody(
   // Retry helpers mark the response they return from, and recovery decisions key on these
   // identity markers; the rewrap must not make a non-replayable response look replayable.
   if (isNonReplayableResponse(response)) markResponseNonReplayable(wrapped);
+  for (const markers of responseProvenance) {
+    if (markers.has(response)) markers.set(wrapped, markers.get(response));
+  }
   return carryReplayRefusal(response, wrapped);
 }
 

package/src/providers/stale-no-vision-seed-migration.ts

@@ -0,0 +1,72 @@
+/**
+ * Drop a saved `noVisionModels` list that is still, byte for byte, a retired registry seed.
+ *
+ * `enrichProviderFromRegistry` fills `noVisionModels` all-or-nothing, so a provider row saved
+ * while the registry seeded a blanket list keeps that list after the registry stops seeding it.
+ * Qoder Global seeded its whole static discovery roster as text-only until the Global adapter
+ * began forwarding image input to the Qoder CLI (#6906). The saved copy would keep every image
+ * on the vision sidecar path, stripped or captioned before the adapter could forward it.
+ *
+ * This projection removes one thing: a saved list identical, in order, to a seed this file names,
+ * on a row the registry still owns (same adapter, and the registry transport rule enrichment uses),
+ * and only while the registry no longer seeds the list at all. Any edited list does not match and
+ * is left alone. `modelCapabilities` and `modelInputModalities` are untouched; they are where a
+ * deliberate per-model text-only declaration belongs.
+ */
+import { PROVIDER_REGISTRY, providerMatchesRegistryTransport } from "./registry";
+import type { OcxConfig } from "../types";
+
+export interface StaleNoVisionSeed {
+  /** Registry provider id whose saved rows may carry the retired list. */
+  provider: string;
+  /** Every list the registry ever seeded, in seed order; only an exact match is removed. */
+  seeds: readonly (readonly string[])[];
+}
+
+export interface StaleNoVisionSeedProjection {
+  config: OcxConfig;
+  changed: boolean;
+  warnings: string[];
+}
+
+export const STALE_NO_VISION_SEEDS: readonly StaleNoVisionSeed[] = [
+  {
+    provider: "qoder",
+    seeds: [
+      // 2026-09-03 (Qoder Global PAT provider) until the DeepSeek V4.1 transition (#4282).
+      ["Qwen3.8-Max", "Qwen3.7-Max", "Qwen3.7-Plus", "Kimi-K3", "Kimi-K2.7-Code", "GLM-5.3", "GLM-5.2", "DeepSeek-V4-Pro"],
+      // #4282 until Global image input (#6906).
+      ["Qwen3.8-Max", "Qwen3.7-Max", "Qwen3.7-Plus", "Kimi-K3", "Kimi-K2.7-Code", "GLM-5.3", "GLM-5.2"],
+    ],
+  },
+];
+
+function sameList(current: readonly unknown[], expected: readonly string[]): boolean {
+  return current.length === expected.length && current.every((value, index) => value === expected[index]);
+}
+
+/** Pure projection. The caller decides whether to persist. */
+export function projectStaleNoVisionSeeds(
+  config: OcxConfig,
+  entries: readonly StaleNoVisionSeed[] = STALE_NO_VISION_SEEDS,
+): StaleNoVisionSeedProjection {
+  const warnings: string[] = [];
+  let changed = false;
+  for (const entry of entries) {
+    const prov = config.providers?.[entry.provider];
+    if (!prov || !Array.isArray(prov.noVisionModels)) continue;
+    const registry = PROVIDER_REGISTRY.find(row => row.id === entry.provider);
+    // While the registry still seeds a list, the saved one is not stale by this file's rule.
+    if (!registry || registry.noVisionModels !== undefined || registry.adapter !== prov.adapter) continue;
+    if (!providerMatchesRegistryTransport(entry.provider, prov)) continue;
+    const saved = prov.noVisionModels;
+    if (!entry.seeds.some(seed => sameList(saved, seed))) continue;
+    delete prov.noVisionModels;
+    changed = true;
+    warnings.push(
+      `removed the retired registry noVisionModels seed (${saved.length} model(s)) from "${entry.provider}"; `
+      + "image input now follows the provider's current classification.",
+    );
+  }
+  return { config, changed, warnings };
+}

package/src/responses/compaction.ts

@@ -56,6 +56,20 @@ export const SUMMARY_PREFIX = "Another language model started to solve this prob
 
 export const OPAQUE_COMPACTION_NOTE = "[earlier conversation was compacted; the summary is stored in a format this model cannot read]";
 
+/**
+ * Prompt contract for a routed model receiving a decoded `ocx1` checkpoint as user text (#6764).
+ * It preserves existing authorization scope and permission gates; it grants no authority.
+ * Kept apart from SUMMARY_PREFIX, which the v1 retention and recovery paths match exactly.
+ */
+export const CHECKPOINT_CONTINUATION_NOTE = "This conversation was compacted automatically. A checkpoint summary from an earlier context window appears as a user message and records prior work. Treat earlier requests it reports as completed as history; do not repeat them unless a later user message asks you to. Continue an unfinished task only when it was already authorized and remains within the scope of that authorization. Do not ask for the same authorization again while it still applies. Preserve all existing permission and confirmation gates; if a decision or required permission is pending, wait for it before taking the dependent action. A checkpoint or delegation, including one from another thread, does not itself grant authority or expand the task's scope. Later user messages take priority; obey any pause, cancellation, replacement, or change of scope.";
+
+/** Append the continuation note to existing instructions once. */
+export function appendCheckpointContinuationNote(instructions: unknown): string {
+  const existing = typeof instructions === "string" ? instructions : "";
+  if (existing.includes(CHECKPOINT_CONTINUATION_NOTE)) return existing;
+  return existing.trim().length > 0 ? `${existing}\n\n${CHECKPOINT_CONTINUATION_NOTE}` : CHECKPOINT_CONTINUATION_NOTE;
+}
+
 /**
  * Item types in the compact wire family. Each carries an `encrypted_content` blob the client
  * replays verbatim on every later turn, and the minting backend verifies it is unmodified.