@bitkyc08/opencodex 2.83.0 → 2.86.0

package/src/generated/model-metadata.ts

@@ -47,7 +47,7 @@ const DATA: Record<string, readonly Row[]> = {
   "azure-openai": [["gpt-4.1",1047576,32768,"text,image",0,null,2,8,0.5,0],["gpt-4o",128000,16384,"text,image",0,null,2.5,10,1.25,0],["gpt-4o-mini",128000,16384,"text,image",0,null,0.15,0.6,0.075,0],["o3",200000,100000,"text,image",1,null,2,8,0.5,0],["o3-mini",200000,100000,"text",1,null,1.1,4.4,0.55,0]],
   "cerebras": [["gemma-4-31b",131072,40960,"text,image",1,null,0.99,1.49,0,0],["gpt-oss-120b",131072,40960,"text",1,null,0.35,0.75,0,0],["llama3.1-8b",32000,8000,"text",0,null,0.1,0.1,0,0],["qwen-3-235b-a22b-instruct-2507",131000,32000,"text",0,null,0.6,1.2,0,0],["qwen-3-coder-480b",131072,32768,"text",0,null,0,0,0,0],["zai-glm-4.6",131072,32768,"text",0,null,0,0,0,0],["zai-glm-4.7",131072,40960,"text",1,null,2.25,2.75,2.25,0]],
   "deepseek": [["deepseek-v4-flash",1048576,384000,"text",1,null,0.14,0.28,0.0028,0],["deepseek-v4-pro",1048576,384000,"text",1,null,0.435,0.87,0.003625,0]],
-  "google": [["deep-research-max-preview-04-2026",131072,65536,"text,image",1,null,2,12,0.2,0],["deep-research-preview-04-2026",131072,65536,"text,image",1,null,2,12,0.2,0],["gemini-1.5-flash",1000000,8192,"text,image",0,null,0.075,0.3,0.01875,0],["gemini-1.5-flash-8b",1000000,8192,"text,image",0,null,0.0375,0.15,0.01,0],["gemini-1.5-pro",1000000,8192,"text,image",0,null,1.25,5,0.3125,0],["gemini-2.0-flash",1048576,8192,"text,image",0,null,0.1,0.4,0.025,0],["gemini-2.0-flash-lite",1048576,8192,"text,image",0,null,0.075,0.3,0,0],["gemini-2.5-computer-use-preview-10-2025",131072,65536,"text,image",1,null,1.25,10,0,0],["gemini-2.5-flash",1048576,65536,"text,image",1,null,0.3,2.5,0.03,0],["gemini-2.5-flash-lite",1048576,65536,"text,image",1,null,0.1,0.4,0.01,0],["gemini-2.5-flash-lite-preview-06-17",1048576,65536,"text,image",1,null,0.1,0.4,0.025,0],["gemini-2.5-flash-lite-preview-09-2025",1048576,65536,"text,image",1,null,0.1,0.4,0.025,0],["gemini-2.5-flash-preview-04-17",1048576,65536,"text,image",1,null,0.15,0.6,0.0375,0],["gemini-2.5-flash-preview-05-20",1048576,65536,"text,image",1,null,0.15,0.6,0.0375,0],["gemini-2.5-flash-preview-09-2025",1048576,65536,"text,image",1,null,0.3,2.5,0.075,0],["gemini-2.5-pro",1048576,65536,"text,image",1,null,1.25,10,0.125,0],["gemini-2.5-pro-preview-05-06",1048576,65536,"text,image",1,null,1.25,10,0.31,0],["gemini-2.5-pro-preview-06-05",1048576,65536,"text,image",1,null,1.25,10,0.31,0],["gemini-3-flash-preview",1048576,65536,"text,image",1,null,0.5,3,0.05,0],["gemini-3-pro-preview",1048576,65536,"text,image",1,null,2,12,0.2,0],["gemini-3.1-flash-lite",1048576,65536,"text,image",1,null,0.25,1.5,0.025,0],["gemini-3.1-flash-lite-image",65536,65536,"text,image",1,null,0.25,30,0,0],["gemini-3.1-flash-lite-preview",1048576,65536,"text,image",1,null,0.25,1.5,0.025,0],["gemini-3.1-flash-live-preview",131072,65536,"text,image",1,null,0.75,4.5,0,0],["gemini-3.1-pro-preview",1048576,65536,"text,image",1,null,2,12,0.2,0],["gemini-3.1-pro-preview-customtools",1048576,65536,"text,image",1,null,2,12,0.2,0],["gemini-3.5-flash",1048576,65536,"text,image",1,null,1.5,9,0.15,0],["gemini-3.5-flash-lite",1048576,65536,"text,image",1,null,0.3,2.5,0.03,0],["gemini-3.6-flash",1048576,65536,"text,image",1,null,1.5,7.5,0.15,0],["gemini-3.7-flash",1048576,65536,"text,image",1],["gemini-3.8-flash",1048576,65536,"text,image",1],["gemini-flash-latest",1048576,65536,"text,image",1,null,1.5,9,0.15,0],["gemini-flash-lite-latest",1048576,65536,"text,image",1,null,0.25,1.5,0.025,0],["gemini-live-2.5-flash",128000,8000,"text,image",1,null,0.5,2,0,0],["gemini-live-2.5-flash-preview-native-audio",131072,65536,"text",1,null,0.5,2,0,0],["gemini-robotics-er-1.6-preview",131072,65536,"text,image",1,null,1,5,0,0],["gemma-3-27b-it",131072,8192,"text,image",0,null,0,0,0,0],["gemma-4-26b",256000,8192,"text,image",1,null,0,0,0,0],["gemma-4-26b-a4b-it",262144,32768,"text,image",1,null,0,0,0,0],["gemma-4-26b-it",256000,8192,"text,image",1,null,0,0,0,0],["gemma-4-31b",256000,8192,"text,image",1,null,0,0,0,0],["gemma-4-31b-it",262144,32768,"text,image",1,null,0,0,0,0],["gemma-4-E2B-it",131072,8192,"text,image",1,null,0,0,0,0],["gemma-4-E4B-it",131072,8192,"text,image",1,null,0,0,0,0]],
+  "google": [["deep-research-max-preview-04-2026",131072,65536,"text,image",1,null,2,12,0.2,0],["deep-research-preview-04-2026",131072,65536,"text,image",1,null,2,12,0.2,0],["gemini-1.5-flash",1000000,8192,"text,image",0,null,0.075,0.3,0.01875,0],["gemini-1.5-flash-8b",1000000,8192,"text,image",0,null,0.0375,0.15,0.01,0],["gemini-1.5-pro",1000000,8192,"text,image",0,null,1.25,5,0.3125,0],["gemini-2.0-flash",1048576,8192,"text,image",0,null,0.1,0.4,0.025,0],["gemini-2.0-flash-lite",1048576,8192,"text,image",0,null,0.075,0.3,0,0],["gemini-2.5-computer-use-preview-10-2025",131072,65536,"text,image",1,null,1.25,10,0,0],["gemini-2.5-flash",1048576,65536,"text,image",1,null,0.3,2.5,0.03,0],["gemini-2.5-flash-lite",1048576,65536,"text,image",1,null,0.1,0.4,0.01,0],["gemini-2.5-flash-lite-preview-06-17",1048576,65536,"text,image",1,null,0.1,0.4,0.025,0],["gemini-2.5-flash-lite-preview-09-2025",1048576,65536,"text,image",1,null,0.1,0.4,0.025,0],["gemini-2.5-flash-preview-04-17",1048576,65536,"text,image",1,null,0.15,0.6,0.0375,0],["gemini-2.5-flash-preview-05-20",1048576,65536,"text,image",1,null,0.15,0.6,0.0375,0],["gemini-2.5-flash-preview-09-2025",1048576,65536,"text,image",1,null,0.3,2.5,0.075,0],["gemini-2.5-pro",1048576,65536,"text,image",1,null,1.25,10,0.125,0],["gemini-2.5-pro-preview-05-06",1048576,65536,"text,image",1,null,1.25,10,0.31,0],["gemini-2.5-pro-preview-06-05",1048576,65536,"text,image",1,null,1.25,10,0.31,0],["gemini-3-flash-preview",1048576,65536,"text,image",1,null,0.5,3,0.05,0],["gemini-3-pro-preview",1048576,65536,"text,image",1,null,2,12,0.2,0],["gemini-3.1-flash-lite",1048576,65536,"text,image",1,null,0.25,1.5,0.025,0],["gemini-3.1-flash-lite-image",65536,65536,"text,image",1,null,0.25,30,0,0],["gemini-3.1-flash-lite-preview",1048576,65536,"text,image",1,null,0.25,1.5,0.025,0],["gemini-3.1-flash-live-preview",131072,65536,"text,image",1,null,0.75,4.5,0,0],["gemini-3.1-pro-preview",1048576,65536,"text,image",1,null,2,12,0.2,0],["gemini-3.1-pro-preview-customtools",1048576,65536,"text,image",1,null,2,12,0.2,0],["gemini-3.5-flash",1048576,65536,"text,image",1,null,1.5,9,0.15,0],["gemini-3.5-flash-lite",1048576,65536,"text,image",1,null,0.3,2.5,0.03,0],["gemini-3.6-flash",1048576,65536,"text,image",1,null,1.5,7.5,0.15,0],["gemini-3.7-flash",1048576,65536,"text,image",1],["gemini-3.8-flash",1048576,65536,"text,image",1],["gemini-4-argon",1048576,65536,"text,image",1],["gemini-flash-latest",1048576,65536,"text,image",1,null,1.5,9,0.15,0],["gemini-flash-lite-latest",1048576,65536,"text,image",1,null,0.25,1.5,0.025,0],["gemini-live-2.5-flash",128000,8000,"text,image",1,null,0.5,2,0,0],["gemini-live-2.5-flash-preview-native-audio",131072,65536,"text",1,null,0.5,2,0,0],["gemini-robotics-er-1.6-preview",131072,65536,"text,image",1,null,1,5,0,0],["gemma-3-27b-it",131072,8192,"text,image",0,null,0,0,0,0],["gemma-4-26b",256000,8192,"text,image",1,null,0,0,0,0],["gemma-4-26b-a4b-it",262144,32768,"text,image",1,null,0,0,0,0],["gemma-4-26b-it",256000,8192,"text,image",1,null,0,0,0,0],["gemma-4-31b",256000,8192,"text,image",1,null,0,0,0,0],["gemma-4-31b-it",262144,32768,"text,image",1,null,0,0,0,0],["gemma-4-E2B-it",131072,8192,"text,image",1,null,0,0,0,0],["gemma-4-E4B-it",131072,8192,"text,image",1,null,0,0,0,0]],
   "minimax": [["MiniMax-M2",196608,128000,"text",1,null,0.3,1.2,0,0],["MiniMax-M2.1",204800,131072,"text",1,null,0.3,1.2,0,0],["MiniMax-M2.5",204800,131072,"text",1,null,0.3,1.2,0.03,0.375],["MiniMax-M2.5-highspeed",204800,131072,"text",1,null,0.6,2.4,0.06,0.375],["MiniMax-M2.5-lightning",204800,32000,"text",1,null,0.3,2.4,0,0],["MiniMax-M2.7",204800,131072,"text",1,null,0.3,1.2,0.06,0.375],["MiniMax-M2.7-highspeed",204800,131072,"text",1,null,0.6,2.4,0.06,0.375],["minimax-m3",512000,128000,"text,image",1,null,0.6,2.4,0.12,0],["MiniMax-M3",1000000,128000,"text,image,video",1,null,0.3,1.2,0.06,0],["MiniMax-M3.1-Flash-Preview",1000000,null,"text,image,video",1]],
   "mistral": [["codestral-latest",256000,4096,"text",0,null,0.3,0.9,0,0],["devstral-2512",262144,262144,"text",0,null,0.4,2,0,0],["devstral-latest",262144,262144,"text",0,null,0.4,2,0,0],["devstral-medium-2507",128000,128000,"text",0,null,0.4,2,0,0],["devstral-medium-latest",262144,262144,"text",0,null,0.4,2,0,0],["devstral-small-2505",128000,128000,"text",0,null,0.1,0.3,0,0],["devstral-small-2507",128000,128000,"text",0,null,0.1,0.3,0,0],["labs-devstral-small-2512",256000,256000,"text,image",0,null,0,0,0,0],["magistral-medium-latest",128000,16384,"text",1,null,2,5,0,0],["magistral-small",128000,128000,"text",1,null,0.5,1.5,0,0],["ministral-3b-latest",128000,128000,"text",0,null,0.04,0.04,0,0],["ministral-8b-latest",128000,128000,"text",0,null,0.1,0.1,0,0],["mistral-large-2411",131072,16384,"text",0,null,2,6,0,0],["mistral-large-2512",262144,262144,"text,image",0,null,0.5,1.5,0,0],["mistral-large-latest",262144,262144,"text,image",0,null,0.5,1.5,0,0],["mistral-medium-2505",131072,131072,"text,image",0,null,0.4,2,0,0],["mistral-medium-2508",262144,262144,"text,image",0,null,0.4,2,0,0],["mistral-medium-2604",262144,262144,"text,image",1,null,1.5,7.5,0,0],["mistral-medium-latest",262144,262144,"text,image",1,null,1.5,7.5,0,0],["mistral-nemo",128000,128000,"text",0,null,0.15,0.15,0,0],["mistral-small-2506",128000,16384,"text,image",0,null,0.1,0.3,0,0],["mistral-small-2603",256000,256000,"text,image",1,null,0.15,0.6,0,0],["mistral-small-latest",256000,256000,"text,image",1,null,0.15,0.6,0,0],["open-mistral-7b",8000,8000,"text",0,null,0.25,0.25,0,0],["open-mistral-nemo",128000,128000,"text",0,null,0.15,0.15,0,0],["open-mixtral-8x22b",64000,64000,"text",0,null,2,6,0,0],["open-mixtral-8x7b",32000,32000,"text",0,null,0.7,0.7,0,0],["pixtral-12b",128000,128000,"text,image",0,null,0.15,0.15,0,0],["pixtral-large-latest",128000,128000,"text,image",0,null,2,6,0,0]],
   "moonshot": [["kimi-k2.5",262144,65536,"text,image",1,null,0,0,0,0]],

package/src/grok/grpc-web.ts

@@ -5,6 +5,7 @@
 
 export interface GrpcWebTrailer {
   status: number;
+  statusValues: string[];
   statusMessage?: string;
   metadata: Record<string, string>;
 }
@@ -12,6 +13,8 @@ export interface GrpcWebTrailer {
 export interface DecodedGrpcWebResponse {
   messages: Uint8Array[];
   status: number;
+  statusValues: string[];
+  framingComplete: boolean;
   statusMessage?: string;
   trailers?: GrpcWebTrailer;
 }
@@ -51,6 +54,7 @@ export function parseGrpcWebTrailers(bytes: Uint8Array): GrpcWebTrailer {
   const text = new TextDecoder("utf-8").decode(bytes);
   const lines = text.split(/\r?\n/);
   const metadata: Record<string, string> = {};
+  const statusValues: string[] = [];
   let status = 0;
   let statusMessage: string | undefined;
 
@@ -62,6 +66,7 @@ export function parseGrpcWebTrailers(bytes: Uint8Array): GrpcWebTrailer {
     if (!key) continue;
     metadata[key] = value;
     if (key === "grpc-status") {
+      statusValues.push(value);
       const parsed = parseInt(value, 10);
       if (!Number.isNaN(parsed)) {
         status = parsed;
@@ -75,7 +80,7 @@ export function parseGrpcWebTrailers(bytes: Uint8Array): GrpcWebTrailer {
     }
   }
 
-  return { status, statusMessage, metadata };
+  return { status, statusValues, statusMessage, metadata };
 }
 
 /**
@@ -83,8 +88,11 @@ export function parseGrpcWebTrailers(bytes: Uint8Array): GrpcWebTrailer {
  */
 export function decodeGrpcWebResponse(bytes: Uint8Array): DecodedGrpcWebResponse {
   const messages: Uint8Array[] = [];
+  const statusValues: string[] = [];
   let offset = 0;
   let trailer: GrpcWebTrailer | undefined;
+  let firstTrailerPayload: Uint8Array | undefined;
+  let framingComplete = true;
 
   while (offset + HEADER_SIZE <= bytes.length) {
     const flag = bytes[offset];
@@ -99,10 +107,22 @@ export function decodeGrpcWebResponse(bytes: Uint8Array): DecodedGrpcWebResponse
 
     const payload = bytes.subarray(frameStart, frameEnd);
 
+    // Preserve legacy decoding; callers needing confirmation inspect framingComplete.
     if (flag === FRAME_DATA) {
+      if (firstTrailerPayload !== undefined) framingComplete = false;
       messages.push(payload);
     } else if (flag === FRAME_TRAILER) {
+      const firstTrailer = firstTrailerPayload;
+      if (firstTrailer === undefined) {
+        firstTrailerPayload = payload;
+      } else if (payload.length !== firstTrailer.length
+        || payload.some((byte, index) => byte !== firstTrailer[index])) {
+        framingComplete = false;
+      }
       trailer = parseGrpcWebTrailers(payload);
+      for (const value of trailer.statusValues) statusValues.push(value);
+    } else {
+      framingComplete = false;
     }
 
     offset = frameEnd;
@@ -114,6 +134,8 @@ export function decodeGrpcWebResponse(bytes: Uint8Array): DecodedGrpcWebResponse
   return {
     messages,
     status: finalStatus,
+    statusValues,
+    framingComplete: framingComplete && offset === bytes.length,
     statusMessage: finalMessage,
     trailers: trailer,
   };

package/src/grok/reset-coupon-ledger.ts

@@ -25,6 +25,8 @@ export interface GrokResetCouponOperationRecord {
   attemptedAt?: number;
   code?: string;
   settledAt?: number;
+  /** Durable status of a replayed record, so callers apply the terminal-replay predicate. */
+  status?: "attempted" | "settled" | "failed";
 }
 
 interface GrokResetCouponOperationState {
@@ -77,8 +79,15 @@ function readGrokCouponLedger(filePath: string): GrokResetCouponLedger {
           op.status = "attempted";
           delete op.code;
         }
+        // A v1 attempted record never carried a confirmed outcome.
+        if (op.status === "attempted") delete op.code;
       }
     }
+    // Only a settled or failed record carries an outcome. An open or attempted
+    // record with a code would replay an unconfirmed result as definitive.
+    for (const op of Object.values(parsed.operations)) {
+      if ((op.status === "open" || op.status === "attempted") && op.code !== undefined) throw new Error();
+    }
     return { version: 2, operations: parsed.operations };
   } catch {
     throw new Error("Grok coupon ledger is unreadable; existing records were preserved.");
@@ -163,6 +172,7 @@ export function openGrokResetCouponOperation(
           attemptedAt: existing.status === "attempted" ? existing.updatedAt : undefined,
           code: existing.code,
           settledAt: existing.updatedAt,
+          status: existing.status,
         };
       }
       return {
@@ -232,17 +242,37 @@ type GrokResetCouponPreflightResult =
   | { kind: "recorded" | "changed" }
   | { kind: "replay"; code: string; tokenId?: string; settledAt: number };
 
-const UNRESOLVED_COUPON_CODES = new Set(["redeem_failed", "attempt_unresolved", "attempt_in_progress", "attempt_reconcile_failed", "operation_state_changed"]);
+/**
+ * Codes that never prove an outcome. A record carrying one is not replayed as
+ * definitive, even if a restored or hand-edited ledger stores it as settled/failed.
+ */
+const UNRESOLVED_COUPON_CODES = new Set([
+  "redeem_failed", "attempt_unresolved", "attempt_in_progress", "attempt_reconcile_failed", "operation_state_changed",
+  "attempt_mark_failed", "operation_token_mismatch", "ledger_unavailable", "capacity",
+]);
+
+/**
+ * Whether a durable record is a definitive outcome this account and token may replay:
+ * settled or failed, same account, same token when both are known, and a code that
+ * does not itself mean "unconfirmed".
+ */
+export function isTerminalGrokCouponReplay(
+  record: { status?: string; accountId?: string; tokenId?: string; code?: string } | undefined,
+  accountId: string, tokenId: string | undefined,
+): boolean {
+  if (!record || record.accountId !== accountId) return false;
+  if (tokenId !== undefined && record.tokenId !== undefined && record.tokenId !== tokenId) return false;
+  return (record.status === "settled" || record.status === "failed")
+    && !!record.code && !UNRESOLVED_COUPON_CODES.has(record.code);
+}
 
 /** The durable definitive outcome for this account and token, if the operation has one. */
 function terminalReplay(
   ledger: GrokResetCouponLedger, operationId: string, accountId: string, tokenId: string | undefined,
 ): Extract<GrokResetCouponPreflightResult, { kind: "replay" }> | null {
   const existing = ledger.operations[operationId];
-  if (!existing || existing.accountId !== accountId) return null;
-  if (tokenId !== undefined && existing.tokenId !== undefined && existing.tokenId !== tokenId) return null;
-  if ((existing.status !== "settled" && existing.status !== "failed") || !existing.code || UNRESOLVED_COUPON_CODES.has(existing.code)) return null;
-  return { kind: "replay", code: existing.code, tokenId: existing.tokenId, settledAt: existing.updatedAt };
+  if (!existing || !isTerminalGrokCouponReplay(existing, accountId, tokenId)) return null;
+  return { kind: "replay", code: existing.code!, tokenId: existing.tokenId, settledAt: existing.updatedAt };
 }
 
 /** Settle a refusal or inspect its winner without releasing the mutation transaction. */
@@ -259,6 +289,46 @@ export function settleGrokResetCouponPreflightRefusal(
   });
 }
 
+export type GrokResetCouponPreOpenRefusalResult =
+  | GrokResetCouponPreflightResult
+  | { kind: "identity-mismatch" | "capacity" };
+
+/**
+ * Refuse a request that never opened its supplied operationId. Under the mutation lock
+ * an absent id is reserved as a failed record, so a later open of the same id replays
+ * the refusal and can never be claimed (within the 30-day retention window). An id
+ * that already exists is never overwritten: a definitive outcome replays, anything
+ * else reports "changed" so the caller keeps its hold.
+ */
+export function refuseGrokResetCouponBeforeOpen(
+  refusal: { operationId: string; accountId: string; tokenId?: string; code: string },
+  now = Date.now(),
+  journalPath?: string,
+): GrokResetCouponPreOpenRefusalResult {
+  return withConfigMutationLockSync(() => {
+    const filePath = journalPath ?? grokCouponJournalPath();
+    const ledger = readGrokCouponLedger(filePath);
+    const retentionCutoff = now - 30 * 24 * 60 * 60_000;
+    ledger.operations = Object.fromEntries(
+      Object.entries(ledger.operations).filter(([, op]) => op.updatedAt > retentionCutoff),
+    );
+    const existing = ledger.operations[refusal.operationId];
+    if (existing) {
+      if (existing.accountId !== refusal.accountId) return { kind: "identity-mismatch" };
+      // Same token binding as a normal replay: a different requested coupon never
+      // replays another coupon's outcome.
+      return terminalReplay(ledger, refusal.operationId, refusal.accountId, refusal.tokenId) ?? { kind: "changed" };
+    }
+    if (Object.keys(ledger.operations).length >= MAX_GROK_RESET_COUPON_OPERATION_IDS) return { kind: "capacity" };
+    ledger.operations[refusal.operationId] = {
+      accountId: refusal.accountId, ...(refusal.tokenId !== undefined ? { tokenId: refusal.tokenId } : {}),
+      status: "failed", code: refusal.code, createdAt: now, updatedAt: now,
+    };
+    writeGrokCouponLedger(filePath, ledger, now);
+    return { kind: "recorded" };
+  });
+}
+
 /**
  * After a lost claim: the definitive winner to replay, or null while the
  * operation is still unresolved. Terminal states never revert, so reading after

package/src/grok/reset-coupons.ts

@@ -231,10 +231,12 @@ function buildGrokHeaders(accessToken: string): Record<string, string> {
  * Reads available Grok reset tokens for the authenticated xAI account.
  */
 function assertConfirmedCouponStatus(decoded: ReturnType<typeof decodeGrpcWebResponse>): void {
-  const rawStatus = decoded.trailers?.metadata["grpc-status"];
+  const rawStatus = decoded.statusValues[0];
   // The shared decoder defaults a missing/malformed status to zero. Coupon
   // availability and an irreversible redemption need affirmative confirmation.
-  if (rawStatus === undefined || !/^\d+$/.test(rawStatus) || !Number.isSafeInteger(Number(rawStatus))) {
+  if (decoded.framingComplete !== true || rawStatus === undefined
+    || decoded.statusValues.some((value) => !/^\d+$/.test(value)
+      || !Number.isSafeInteger(Number(value)) || value !== rawStatus)) {
     throw new Error("Grok coupon response has no confirmed gRPC status");
   }
   const status = Number(rawStatus);

package/src/integrations/catalog-refresh.ts

@@ -12,7 +12,7 @@ import {
 /** Refresh only previously connected clients; a refused file never blocks its peers. */
 export async function refreshOwnedCatalogIntegrations(
   input: Omit<OwnedIntegrationRefreshInput, "clientId">,
-  clientIds: readonly IntegrationClientId[] = ["pi", "aside", "raycast", "omo", "commandcode", "droid", "opencode", "kilo"],
+  clientIds: readonly IntegrationClientId[] = ["pi", "aside", "raycast", "omo", "commandcode", "droid", "opencode", "kilo", "qoder"],
   options: { refreshOnly?: boolean; admit?: () => boolean } = {},
 ): Promise<OwnedIntegrationRefreshOutcome[]> {
   // Client files are shared with the live proxy a sibling instance runs beside; their entries

package/src/integrations/config-io.ts

@@ -7,8 +7,9 @@
  *
  * Design of record: devlog/_fin/260802_client_toggle_api/021 §5-6.
  */
-import { lstatSync, mkdirSync, readFileSync, rmSync, statSync } from "node:fs";
+import { lstatSync, mkdirSync, rmSync, statSync } from "node:fs";
 import type { ConfigFormat } from "../clients/config-export";
+import { readBoundedRegularFileSync } from "../lib/bounded-file-read";
 import { canonicalizeJsonc } from "../lib/jsonc";
 import { MAX_JSON_NESTING } from "./serialize";
 import { atomicWriteFileNoFollow, isMissingPathError } from "../config/atomic-write";
@@ -24,6 +25,10 @@ import type { IntegrationClientId } from "./registry";
  * then overwritten.
  */
 export const PARSE_FAILED = Symbol("parse-failed");
+const MAX_INTEGRATION_CONFIG_FILE_BYTES = 4 * 1024 * 1024;
+
+/** Raised before any target mutation, including pending-marker creation. */
+export class IntegrationWriteSizeError extends Error {}
 
 /**
  * What `JSON.parse` has already discarded by the time we hold the parsed value,
@@ -285,7 +290,7 @@ export function fileIO(): Omit<IntegrationIO, "appendJournal" | "putRecord" | "d
     lstatKind,
     readText: path => {
       try {
-        return { kind: "text", text: readFileSync(path, "utf8") };
+        return { kind: "text", text: readBoundedRegularFileSync(path, MAX_INTEGRATION_CONFIG_FILE_BYTES).toString("utf8") };
       } catch (error) {
         const code = (error as NodeJS.ErrnoException).code;
         return code === "ENOENT" ? { kind: "missing" } : { kind: "failed", ...(code ? { code } : {}) };
@@ -300,6 +305,19 @@ export function fileIO(): Omit<IntegrationIO, "appendJournal" | "putRecord" | "d
       }
     },
     writeText: (path, text) => {
+      /*
+       * One bound on both halves of the seam: a file past this size is one
+       * readText refuses, so writing it would strand the integration against
+       * its own configuration — or, for Cline's pending marker, leave a
+       * transaction recovery could never read back.
+       */
+      const bytes = Buffer.byteLength(text, "utf8");
+      if (bytes > MAX_INTEGRATION_CONFIG_FILE_BYTES) {
+        throw new IntegrationWriteSizeError(
+          `refusing oversized integration write to ${path}: `
+          + `${bytes} bytes is past the ${MAX_INTEGRATION_CONFIG_FILE_BYTES}-byte read bound`,
+        );
+      }
       const kind = lstatKind(path);
       if (kind !== "file" && kind !== "missing") {
         throw new Error(`refusing unsafe integration write target: ${path}`);

package/src/integrations/journal.ts

@@ -16,7 +16,7 @@ import { randomUUID } from "node:crypto";
 import { appendFileSync, existsSync, readFileSync, readdirSync, rmSync } from "node:fs";
 import { join, resolve, sep } from "node:path";
 import { atomicWriteFile } from "../config";
-import { ensureDir, fingerprint, integrationsDir, isOwnershipRecord, type OwnershipRecord } from "./ownership";
+import { ensureDir, fingerprint, integrationsDir, isOwnershipRecord, readRecordsStrict, type OwnershipRecord } from "./ownership";
 import { isIntegrationClientId, type IntegrationClientId } from "./registry";
 
 /**
@@ -171,6 +171,20 @@ export function captureSnapshot(
   return { kind: "stored", relPath: join("snapshots", clientId, opId) };
 }
 
+/** Remove only an unused pre-write snapshot; uncertain or committed evidence survives. */
+export function discardUncommittedSnapshot(
+  clientId: IntegrationClientId,
+  opId: string,
+  dir: string = integrationsDir(),
+): void {
+  const target = containedPath(dir, "snapshots", assertSafeComponent(clientId, "clientId"), assertSafeComponent(opId, "opId"));
+  if (findCommittedOperation(opId, dir)
+    || Object.values(readRecordsStrict(dir)).some(record => record?.opId === opId)) {
+    throw new Error("integration snapshot still belongs to a recorded operation");
+  }
+  rmSync(target, { force: true });
+}
+
 /** Commit the row. Pruning is post-commit and can never fail the append. */
 export function appendOperation(entry: JournalEntry, dir: string = integrationsDir()): void {
   ensureDir(journalPath(dir));

package/src/integrations/mutation-plan.ts

@@ -32,6 +32,7 @@ import {
   assertDroidRecordedSettingsUnambiguous,
   isLoopbackOnly,
   resolveIntegrationPaths,
+  type ResolvedIntegrationPaths,
   restoreOwnershipCollision,
   type IntegrationClientId,
 } from "./registry";
@@ -130,6 +131,7 @@ export const DYNAMIC_SEGMENT = "*";
  * paths silently have no declaration.
  */
 const CLIENT_MANAGED_PATHS = {
+  qoder: [["providers", OPENCODE_PROVIDER_ID], ["modelConfigs", "customModels", DYNAMIC_SEGMENT]],
   opencode: [["provider", OPENCODE_PROVIDER_ID], ["providers", OPENCODE_PROVIDER_ID]],
   pi: [["providers", OPENCODE_PROVIDER_ID]],
   omp: [["providers", OPENCODE_PROVIDER_ID]],
@@ -567,7 +569,7 @@ export function restoreStoreDirectoryRefusal(
   if (!declared?.lockFile) return null;
   let storePath: string;
   try {
-    storePath = declared.path(input.env, input.home);
+    storePath = declared.path(input.env, input.home, io);
   } catch (error) {
     if (error instanceof ClientPathError) return null;
     throw error;
@@ -602,10 +604,11 @@ export function observeRestore(
   const store = selectedOperation?.store ?? input.store ?? createIntegrationStateStore();
   let io = input.io ?? defaultIntegrationIO(store);
   const clientId = input.clientId;
-  let resolved: { configPath: string; detectDir: string };
+  let resolved: ResolvedIntegrationPaths;
   try {
     const context = exportContextOf(input);
-    resolved = input.resolvedPaths ?? resolveIntegrationPaths(clientId, input.env, input.home, context);
+    resolved = clientId === "zcode" || !input.resolvedPaths
+      ? resolveIntegrationPaths(clientId, input.env, input.home, context, io) : input.resolvedPaths;
     if (clientId === "droid" && input.resolvedPaths) assertDroidPathsUnambiguous(resolved.detectDir, context);
   } catch (error) {
     if (!(error instanceof ClientPathError)) throw error;
@@ -630,7 +633,7 @@ export function observeRestore(
    * config file. The answer also carries the document shape those bytes are in.
    */
   const rowTarget = declaredIntegrationTarget({
-    clientId, configPath, resolvedConfigPath: resolved.configPath, env: input.env, home: input.home,
+    clientId, configPath, resolvedConfigPath: resolved.configPath, env: input.env, home: input.home, io,
   });
   if (rowTarget === null) {
     return {
@@ -848,7 +851,7 @@ export interface IntegrationWriteInput {
   store?: IntegrationStateStore;
   io?: IntegrationIO;
   /** Frozen once by the async coordinator; synchronous callers may omit it. */
-  resolvedPaths?: { configPath: string; detectDir: string };
+  resolvedPaths?: ResolvedIntegrationPaths;
 }
 
 /** A refusal in the planner's own vocabulary, so observation does not depend on the writer's result type. */
@@ -922,7 +925,8 @@ export function observeIntegration(
      * verify account 1 was installed and then write account 0's catalog.
      */
     const context = exportContextOf(input);
-    const resolved = input.resolvedPaths ?? resolveIntegrationPaths(clientId, input.env, input.home, context);
+    const resolved = clientId === "zcode" || !input.resolvedPaths
+      ? resolveIntegrationPaths(clientId, input.env, input.home, context, io) : input.resolvedPaths;
     if (clientId === "droid" && input.resolvedPaths) assertDroidPathsUnambiguous(resolved.detectDir, context);
     detectDir = resolved.detectDir;
     if (clientId === "cline") io = createClineIO(io, resolved.configPath, store, effects.recover);
@@ -945,9 +949,12 @@ export function observeIntegration(
      * collection route.
      */
     effective = resolveIntegrationTarget({
-      clientId, configPath: recordedPath, io, record: stored, env: input.env, home: input.home,
+      clientId, configPath: recordedPath, io, record: stored, env: input.env, home: input.home, resolvedPaths: resolved,
     });
     configPath = effective.configPath;
+    if (effective.pathError && operation !== "disable") {
+      return { failed: observationFailure("unsafe", "unsafe", effective.pathError) } as const;
+    }
   } catch (error) {
     if (error instanceof ClineTransactionError) {
       return { failed: { ...observationFailure("unsafe", "unsafe", error.message, error.snapshotPath), residual: true } } as const;

package/src/integrations/registry.ts

@@ -12,10 +12,13 @@ import { homedir } from "node:os";
 import { assertDroidSettingsUnambiguous } from "./droid-settings";
 import { readPath } from "./merge";
 import type { OwnershipRecord } from "./ownership";
+import type { IntegrationIO } from "./config-io";
 import { dirname, join } from "node:path";
 import {
   ClientPathError,
   buildDroidContribution,
+  qoderConfigPath,
+  qoderHomeDir,
   clineConfigPath,
   clineSettingsDir,
   droidConfigPath,
@@ -49,6 +52,8 @@ import {
   raycastConfigPath,
   zcodeConfigPath,
   zcodeHomeDir,
+  zcodeLegacyHomeDir,
+  ZcodeSettingsPathError,
   zcodeProviderStorePath,
   buildZcodeStoreContribution,
   zcodeStoreSchemaEstablished,
@@ -75,12 +80,21 @@ import {
  */
 export type IntegrationClientId = ExportClientId;
 
+export interface ResolvedIntegrationPaths {
+  configPath: string;
+  detectDir: string;
+  /** Snapshot of a mutable store resolution from the same bootstrap read. */
+  storePath?: string;
+  /** The default config path is only a recovery hint when the active root is unknown. */
+  pathError?: string;
+}
+
 export interface IntegrationClientSpec {
   id: IntegrationClientId;
   /** The client's config file, honoring that client's own environment override. */
-  configPath: (env?: NodeJS.ProcessEnv, home?: string) => string;
+  configPath: (env?: NodeJS.ProcessEnv, home?: string, io?: Pick<IntegrationIO, "readText">) => string;
   /** Directory whose existence is the cheap "is it installed?" signal. */
-  detectDir: (env?: NodeJS.ProcessEnv, home?: string) => string;
+  detectDir: (env?: NodeJS.ProcessEnv, home?: string, io?: Pick<IntegrationIO, "readText">) => string;
   /**
    * The provider store this client reads INSTEAD of `configPath`.
    *
@@ -98,7 +112,7 @@ export interface IntegrationClientSpec {
    * client, never merged into on a guess.
    */
   currentStore?: {
-    path: (env?: NodeJS.ProcessEnv, home?: string) => string;
+    path: (env?: NodeJS.ProcessEnv, home?: string, io?: Pick<IntegrationIO, "readText">) => string;
     format: ConfigFormat;
     establishes: (parsed: unknown) => boolean;
     buildContribution: BuildContribution;
@@ -139,7 +153,7 @@ export interface IntegrationClientSpec {
    * Droid uses the same seam to check competing settings against the export
    * context before status, preview, or mutation proceeds.
    */
-  resolvePaths?: (env?: NodeJS.ProcessEnv, home?: string, exportContext?: ExportContext) => { configPath: string; detectDir: string };
+  resolvePaths?: (env?: NodeJS.ProcessEnv, home?: string, exportContext?: ExportContext, io?: Pick<IntegrationIO, "readText">) => ResolvedIntegrationPaths;
   /**
    * Where the client's config WOULD live, for a client whose real path cannot
    * be resolved yet.
@@ -183,10 +197,11 @@ export function resolveIntegrationPaths(
   env: NodeJS.ProcessEnv = process.env,
   home: string = homedir(),
   exportContext?: ExportContext,
-): { configPath: string; detectDir: string } {
+  io?: Pick<IntegrationIO, "readText">,
+): ResolvedIntegrationPaths {
   const spec = INTEGRATION_CLIENTS[clientId];
-  if (spec.resolvePaths) return spec.resolvePaths(env, home, exportContext);
-  return { configPath: spec.configPath(env, home), detectDir: spec.detectDir(env, home) };
+  if (spec.resolvePaths) return spec.resolvePaths(env, home, exportContext, io);
+  return { configPath: spec.configPath(env, home, io), detectDir: spec.detectDir(env, home, io) };
 }
 
 export function assertDroidPathsUnambiguous(root: string, exportContext?: ExportContext): void {
@@ -267,6 +282,11 @@ function xdgConfigHome(env: NodeJS.ProcessEnv, home: string): string {
 }
 
 export const INTEGRATION_CLIENTS: Record<IntegrationClientId, IntegrationClientSpec> = {
+  qoder: {
+    id: "qoder",
+    configPath: qoderConfigPath,
+    detectDir: (env = process.env, home = homedir()) => qoderHomeDir(env, home),
+  },
   opencode: {
     id: "opencode",
     // These take `home` explicitly. The export registry's `destination` reads
@@ -357,15 +377,31 @@ export const INTEGRATION_CLIENTS: Record<IntegrationClientId, IntegrationClientS
   },
   zcode: {
     id: "zcode",
-    configPath: (env = process.env, home = homedir()) => zcodeConfigPath(env, home),
-    detectDir: (env = process.env, home = homedir()) => zcodeHomeDir(env, home),
+    configPath: (env = process.env, home = homedir(), io) => zcodeConfigPath(env, home, io),
+    detectDir: (env = process.env, home = homedir(), io) => zcodeHomeDir(env, home, io),
+    resolvePaths: (env = process.env, home = homedir(), _context, io) => {
+      let root: string;
+      let pathError: string | undefined;
+      try { root = zcodeHomeDir(env, home, io); }
+      catch (error) {
+        if (!(error instanceof ZcodeSettingsPathError)) throw error;
+        root = zcodeLegacyHomeDir(env, home);
+        pathError = error.message;
+      }
+      // Passing the resolved root prevents a second bootstrap read. An explicit
+      // provider-file override outranks both the setting and ZCODE_DATA_DIR.
+      const storePath = zcodeProviderStorePath({ ...env, ZCODE_DATA_DIR: root }, home, io);
+      return { configPath: join(root, "v2", "config.json"), detectDir: root, storePath, ...(pathError ? { pathError } : {}) };
+    },
+    bindsDriftedRecord: (path, env = process.env, home = homedir()) =>
+      path === join(zcodeLegacyHomeDir(env, home), "v2", "config.json"),
     /*
      * ZCode 3.14 reads its providers from `v2/provider_config.json` and reaches
      * `v2/config.json` only through the import that seeded it. Where the new
      * file exists the import is spent, so our write is read by nobody (#5348).
      */
     currentStore: {
-      path: (env = process.env, home = homedir()) => zcodeProviderStorePath(env, home),
+      path: (env = process.env, home = homedir(), io) => zcodeProviderStorePath(env, home, io),
       format: "json",
       establishes: zcodeStoreSchemaEstablished,
       buildContribution: buildZcodeStoreContribution,
@@ -496,7 +532,7 @@ export function boundIntegrationConfigPath(input: {
   if (
     record && record.clientId === input.clientId &&
     record.configPath !== input.resolvedPath &&
-    input.statKind(record.configPath) === "file" &&
+    (input.clientId === "zcode" ? input.statKind(record.configPath) !== "missing" : input.statKind(record.configPath) === "file") &&
     INTEGRATION_CLIENTS[input.clientId].bindsDriftedRecord?.(record.configPath, input.env, input.home) === true
   ) {
     return record.configPath;
@@ -529,6 +565,11 @@ export function restoreOwnershipCollision(input: {
 }): string | null {
   const currentPath = input.currentPath;
   if (currentPath === null || currentPath === input.journaledPath) return null;
+  // A relocated ZCode store must not lose its single record to an older
+  // legacy undo, even when both journaled locations are legal for this home.
+  if (input.clientId === "zcode") {
+    return `that operation was recorded for ${input.journaledPath}, but ${currentPath} currently owns this integration`;
+  }
   const binds = INTEGRATION_CLIENTS[input.clientId].bindsDriftedRecord;
   if (!binds) return null;
   if (binds(input.journaledPath, input.env, input.home) !== true) return null;

package/src/integrations/state.ts

@@ -39,6 +39,7 @@ import {
   assertDroidPathsUnambiguous,
   assertDroidRecordedSettingsUnambiguous,
   resolveIntegrationPaths,
+  type ResolvedIntegrationPaths,
   unresolvedPathHintFor,
   type IntegrationClientId,
 } from "./registry";
@@ -482,7 +483,7 @@ export interface IntegrationStateInput {
   store?: IntegrationStateStore;
   io?: IntegrationIO;
   /** Internal explicit profile target; never accepted as a caller-provided path. */
-  resolvedPaths?: { configPath: string; detectDir: string };
+  resolvedPaths?: ResolvedIntegrationPaths;
 }
 
 export function exportContextOf(input: {
@@ -592,11 +593,11 @@ export function readIntegrationState(input: IntegrationStateInput): IntegrationS
    */
   let installed: boolean;
   let effective: IntegrationTarget;
-  let record: OwnershipRecord | null;
+  let record: OwnershipRecord | null = null;
   try {
     // One resolution for both, so a client whose paths come from mutable state
     // cannot report one account's install beside another account's config path.
-    const paths = resolveStatePaths(input);
+    const paths = resolveStatePaths(input, io);
     installed = io.statKind(paths.detectDir) === "dir";
     if (input.clientId === "cline") io = createClineIO(io, paths.configPath, store);
     /*
@@ -611,7 +612,7 @@ export function readIntegrationState(input: IntegrationStateInput): IntegrationS
       statKind: io.statKind, env: input.env, home: input.home,
     });
     effective = resolveIntegrationTarget({
-      clientId: input.clientId, configPath: recordedPath, io, record, env: input.env, home: input.home,
+      clientId: input.clientId, configPath: recordedPath, io, record, env: input.env, home: input.home, resolvedPaths: paths,
     });
   } catch (error) {
     if (!(error instanceof ClientPathError)) throw error;
@@ -626,6 +627,10 @@ export function readIntegrationState(input: IntegrationStateInput): IntegrationS
      * yet. A client that can name where its config would go gets `installed:
      * false` and that location, which reads as "not installed" in the UI.
      */
+    if (input.clientId === "zcode" && record) return {
+      clientId: input.clientId, state: "unsafe", installed: false, configPath: record.configPath,
+      reason: "unresolvable-path", appliedAt: record.appliedAt, lastOpId: record.opId, ...retention,
+    };
     const hint = unresolvedPathHintFor(input.clientId, input.env, input.home);
     return {
       clientId: input.clientId,
@@ -638,6 +643,12 @@ export function readIntegrationState(input: IntegrationStateInput): IntegrationS
   }
 
   const configPath = effective.configPath;
+  if (effective.pathError) return {
+    clientId: input.clientId, state: "unsafe", installed, configPath,
+    reason: "unresolvable-path",
+    ...(record?.configPath === configPath ? { appliedAt: record.appliedAt, lastOpId: record.opId } : {}),
+    ...retention,
+  };
   if (input.clientId === "kilo") {
     const candidates = inspectKiloCandidates({ io, selectedPath: configPath, env: input.env, home: input.home });
     if (candidates.kind !== "ok") return {
@@ -715,9 +726,10 @@ export function readIntegrationState(input: IntegrationStateInput): IntegrationS
   };
 }
 
-function resolveStatePaths(input: IntegrationStateInput): { configPath: string; detectDir: string } {
+function resolveStatePaths(input: IntegrationStateInput, io: IntegrationIO): ResolvedIntegrationPaths {
   const context = exportContextOf(input);
-  const paths = input.resolvedPaths ?? resolveIntegrationPaths(input.clientId, input.env, input.home, context);
+  const paths = input.clientId === "zcode" || !input.resolvedPaths
+    ? resolveIntegrationPaths(input.clientId, input.env, input.home, context, io) : input.resolvedPaths;
   if (input.clientId === "droid" && input.resolvedPaths) assertDroidPathsUnambiguous(paths.detectDir, context);
   return paths;
 }
@@ -727,7 +739,7 @@ export function readOwnedDroidReasoningDefaults(input: IntegrationStateInput): R
   const store = input.store ?? createIntegrationStateStore();
   const io = input.io ?? store.io();
   try {
-    const paths = resolveStatePaths(input);
+    const paths = resolveStatePaths(input, io);
     const record = store.readRecords().droid;
     if (!record || record.clientId !== "droid" || record.configPath !== paths.configPath) return {};
     const effective = resolveIntegrationTarget({