@bitkyc08/opencodex 2.83.0 → 2.86.0

package/src/providers/api-key-resolve.ts

@@ -39,17 +39,25 @@ function defaultEntryFactory(service: string, account: string): ProviderKeychain
 let entryFactory: ProviderKeychainEntryFactory = defaultEntryFactory;
 const resolvedCache = new Map<string, string>();
 const warnedAccounts = new Set<string>();
+let resolutionGeneration = 0;
+
+/** Advances whenever cached secrets may have changed, so derived snapshots can rebuild. */
+export function providerKeyResolutionGeneration(): number {
+  return resolutionGeneration;
+}
 
 /** Test seam: swap the OS entry for an in-memory one and drop caches. */
 export function setProviderKeychainEntryFactoryForTests(factory: ProviderKeychainEntryFactory | null): void {
   entryFactory = factory ?? defaultEntryFactory;
   resolvedCache.clear();
+  resolutionGeneration++;
   warnedAccounts.clear();
 }
 
 /** Write-path seam: a store/restore mutated secrets, so cached reads and warnings are stale. */
 export function invalidateResolvedProviderKeyCache(): void {
   resolvedCache.clear();
+  resolutionGeneration++;
   warnedAccounts.clear();
 }
 
@@ -76,7 +84,7 @@ export function providerKeychainEntry(account: string): ProviderKeychainEntry {
   return entryFactory(PROVIDER_KEYCHAIN_SERVICE, account);
 }
 
-function readKeychain(account: string): string | undefined {
+function readKeychain(account: string, quiet = false): string | undefined {
   const cached = resolvedCache.get(account);
   if (cached !== undefined) return cached;
   try {
@@ -88,7 +96,7 @@ function readKeychain(account: string): string | undefined {
   } catch {
     // fall through to the single warning below
   }
-  if (!warnedAccounts.has(account)) {
+  if (!quiet && !warnedAccounts.has(account)) {
     warnedAccounts.add(account);
     console.warn(`[opencodex] provider key reference keychain:${account} could not be read from the OS keychain; requests for this provider have no credential until the keychain is available (no plaintext fallback)`);
   }
@@ -105,6 +113,13 @@ export function resolveProviderApiKey(value: string | undefined): string | undef
   return resolveEnvValue(value);
 }
 
+/** The same resolution without the unreadable-reference warning, for observe-only callers. */
+export function resolveProviderApiKeyQuietly(value: string | undefined): string | undefined {
+  if (!value) return undefined;
+  if (isKeychainReference(value)) return readKeychain(keychainAccount(value), true);
+  return resolveEnvValue(value);
+}
+
 export type ProviderKeyStoreKind = "keychain" | "env" | "file" | "none";
 
 export function providerKeyStoreKind(provider: Pick<OcxProviderConfig, "apiKey"> | undefined): ProviderKeyStoreKind {

package/src/providers/key-failover.ts

@@ -8,7 +8,7 @@
  *
  * Modelled after src/codex/routing.ts cooldown logic but scoped to plain API-key pools.
  */
-import { commitProviderApiKeySelection } from "./api-key-selection";
+import { commitProviderApiKeySelection, providerApiKeySelectionIsCurrent } from "./api-key-selection";
 import type { ProviderApiKeySelection } from "../types/provider";
 import { routedProviderConfig } from "../router";
 import { getProviderRegistryEntry } from "./registry";
@@ -30,6 +30,16 @@ interface KeyCooldown {
 
 const DEFAULT_COOLDOWN_MS = 60_000;
 const MAX_COOLDOWN_MS = 10 * 60_000; // cap at 10 min for api-key rotation
+/**
+ * Anthropic credit-balance refusal (#6958). An empty prepaid balance is account state, not a
+ * rate signal: it clears only when someone buys credits or auto-reload fires, so the
+ * ten-minute credential cap would hand a dead key back to rotation six times an hour. One hour
+ * keeps it out of replacement and proactive selection while a funded sibling exists, and still
+ * notices a top-up without a restart. When every key is held, requests keep using the active
+ * key and return Anthropic's original refusal. The hold is in memory; dashboard key management
+ * clears it.
+ */
+export const ANTHROPIC_BILLING_COOLDOWN_MS = 60 * 60_000;
 
 /**
  * Cap for a cooldown the upstream itself dated, as opposed to one we inferred.
@@ -688,12 +698,13 @@ export function rateLimitRetryDelayMs(
 function rotateKeyAfterFailure(
   config: OcxConfig,
   providerName: string,
-  failureStatus: 401 | 429,
+  failureStatus: 401 | 429 | "billing",
   retryAfterHeader: string | null | undefined,
   now = Date.now(),
   attemptedKey?: string,
   attemptedSelection?: ProviderApiKeySelection,
   quotaResetAt?: number,
+  acceptsFreshProvider?: (provider: OcxProviderConfig) => boolean,
 ): OcxProviderConfig | null {
   const provider = config.providers[providerName];
   if (!provider) return null;
@@ -704,6 +715,11 @@ function rotateKeyAfterFailure(
     | { failedId?: string; candidateId?: string }
     | { exhaustedCount: number; failedId?: string };
   const outcome = commitProviderApiKeySelection<Rotation | null>(config, providerName, freshProvider => {
+    // Run on every persisted transaction attempt, including a freshness rebase.
+    if (acceptsFreshProvider) {
+      try { if (!acceptsFreshProvider(freshProvider)) return { changed: false, value: null }; }
+      catch { return { changed: false, value: null }; }
+    }
     const pool = freshProvider.apiKeyPool;
     if (!pool || pool.length < 2) return { changed: false, value: null };
 
@@ -741,6 +757,8 @@ function rotateKeyAfterFailure(
   }, attemptedSelection);
   if (outcome.status === "unavailable") return null;
   if (outcome.status === "superseded") {
+    // Billing authority is bound to the sent selection; a newer manual choice grants no replay.
+    if (acceptsFreshProvider) return null;
     // A newer manual selection (including A→B→A) owns subsequent dispatch. Reusing the
     // same failed key here would loop forever; preserve its original failure instead.
     return outcome.provider.apiKey !== failedKey ? structuredClone(outcome.provider) : null;
@@ -750,7 +768,9 @@ function rotateKeyAfterFailure(
     // A 401 is a verdict about the credential itself, not a timing signal: the key is rejected
     // until an operator replaces it, and upstreams send no Retry-After for it. Hold it for the
     // full cap instead of the 429 default so a dead key is not re-tried once a minute.
-    const cooldownMs = failureStatus === 401
+    const cooldownMs = failureStatus === "billing"
+      ? ANTHROPIC_BILLING_COOLDOWN_MS
+      : failureStatus === 401
       ? MAX_COOLDOWN_MS
       // A reset instant the upstream dated outranks both the header and the
       // default: it is the only one of the three that knows when the quota
@@ -762,7 +782,7 @@ function rotateKeyAfterFailure(
     sweepExpiredOnWrite(now);
   }
   if ("exhaustedCount" in outcome.value) {
-    console.warn(`[key-failover] ${providerName}: all ${outcome.value.exhaustedCount} keys in cooldown after ${failureStatus}; returning the upstream status to the client`);
+    console.warn(`[key-failover] ${providerName}: all ${outcome.value.exhaustedCount} keys in cooldown after ${failureLabel(failureStatus)}; returning the upstream status to the client`);
     return null;
   }
 
@@ -771,12 +791,16 @@ function rotateKeyAfterFailure(
   if (outcome.value.candidateId) {
     console.warn(
       // Log ids only — labels are user-supplied free text and could carry secret material.
-      `[key-failover] ${providerName}: ${failureStatus} on key ${outcome.value.failedId ?? "?"}; rotating to key ${outcome.value.candidateId}`,
+      `[key-failover] ${providerName}: ${failureLabel(failureStatus)} on key ${outcome.value.failedId ?? "?"}; rotating to key ${outcome.value.candidateId}`,
     );
   }
   return structuredClone(committed);
 }
 
+function failureLabel(failureStatus: 401 | 429 | "billing"): string {
+  return failureStatus === "billing" ? "credit-balance refusal" : String(failureStatus);
+}
+
 export function rotateKeyOn429(
   config: OcxConfig,
   providerName: string,
@@ -865,6 +889,29 @@ export function rotateProviderTransportOn401(
   return applyRotatedTransport(providerName, routedProvider, rotated, options.promptCacheKey);
 }
 
+/** Exact Anthropic billing refusal: cool the key for ANTHROPIC_BILLING_COOLDOWN_MS. */
+export function rotateProviderTransportOnAnthropicBilling(
+  config: OcxConfig,
+  providerName: string,
+  routedProvider: OcxProviderTransport,
+  options: Omit<RotateProviderTransportOptions, "retryAfter"> = {},
+): OcxProviderTransport | null {
+  if (routedProvider.adapter !== "anthropic"
+    || (routedProvider.authMode !== undefined && routedProvider.authMode !== "key")
+    || !hasKeyPoolFailover(routedProvider)) return null;
+  const headerShape = (provider: OcxProviderConfig) => JSON.stringify(Object.entries(provider.headers ?? {}).sort(([a], [b]) => a.localeCompare(b)));
+  const sentHeaders = headerShape(routedProvider);
+  const acceptsFreshProvider = (fresh: OcxProviderConfig): boolean => fresh.adapter === routedProvider.adapter
+    && (fresh.authMode === undefined || fresh.authMode === "key") && hasKeyPoolFailover(fresh)
+    && (fresh.apiKeyTransport ?? "x-api-key") === (routedProvider.apiKeyTransport ?? "x-api-key")
+    && headerShape(fresh) === sentHeaders
+    && providerApiKeySelectionIsCurrent({ ...config, providers: { ...config.providers, [providerName]: fresh } },
+      providerName, routedProvider);
+  const rotated = rotateKeyAfterFailure(config, providerName, "billing", null, options.now,
+    options.attemptedKey, options.attemptedSelection ?? routedProvider._apiKeyAttempt, undefined, acceptsFreshProvider);
+  return rotated ? applyRotatedTransport(providerName, routedProvider, rotated, options.promptCacheKey) : null;
+}
+
 function applyRotatedTransport(
   providerName: string,
   routedProvider: OcxProviderTransport,

package/src/providers/model-rename-fields.ts

@@ -59,6 +59,7 @@ export const PROVIDER_MODEL_RENAME_ROLES = {
   newModelPolicy: "none",
   modelPreset: "none",
   contextWindow: "none",
+  inferContextWindow: "none",
   modelContextWindows: "record",
   modelContextTiers: "record",
   modelInputModalities: "record",
@@ -66,6 +67,7 @@ export const PROVIDER_MODEL_RENAME_ROLES = {
   modelMaxInputTokens: "record",
   modelAutoCompactTokenLimits: "record",
   defaultMaxOutputTokens: "none",
+  minMaxOutputTokens: "none",
   modelMaxOutputTokens: "record",
   modelCosts: "record",
   autoReviewModel: "none",

package/src/providers/model-rename-migration.ts

@@ -124,16 +124,18 @@ export const MODEL_RENAMES: readonly ModelRename[] = [
   // Assist almost immediately when the next ships, so a saved 3.6 (or older 3.5) id is a
   // dead selection rather than a merely outdated one. Routing already redirects these ids
   // at request time; this migration repairs the saved config so the picker, the allowlist
-  // and the capability maps stop naming a model the backend no longer serves.
+  // and the capability maps stop naming a model the backend no longer serves. The target is
+  // the live 3.8 base: 3.7 left the static lineup on 2026-10-14 (CCA 404s its wire id), and
+  // registrySeedsTarget refuses to write an id the registry no longer seeds.
   ...(["gemini-3.6-flash", "gemini-3.6-flash-low", "gemini-3.6-flash-medium", "gemini-3.6-flash-high",
     "gemini-3.5-flash-extra-low", "gemini-3.5-flash-low", "gemini-3.5-flash-mid", "gemini-3.5-flash-high",
     "gemini-3-flash-agent"] as const).map(from => ({
     provider: "google-antigravity",
     from,
-    to: "gemini-3.7-flash",
+    to: "gemini-3.8-flash",
     reason: "Google retires the previous Antigravity Flash generation from Cloud Code Assist when its successor ships, so the saved id no longer resolves to a live model",
     // The retired Flash tiers were wire ids, so any saved per-model record keyed by one
-    // may also hold one as a value. 3.7 expresses tiers as thinkingLevel names instead.
+    // may also hold one as a value. 3.8 resolves tiers from its own suffix ladder instead.
     dropReasoningEffortMap: true,
   })),
 ];

package/src/providers/model-rename-startup.ts

@@ -3,6 +3,7 @@ import { projectModelRenames } from "./model-rename-migration";
 import { projectStaleContextWindows } from "./stale-context-window-migration";
 import { projectStaleModelRosters } from "./stale-model-roster-migration";
 import { projectStaleVisionClassifications } from "./stale-vision-classification-migration";
+import { projectStaleNoVisionSeeds } from "./stale-no-vision-seed-migration";
 import { projectDevinCliAuthMode } from "./devin-cli-authmode-migration";
 import type { OcxConfig } from "../types";
 
@@ -17,12 +18,13 @@ export function projectStartupConfigRepairs(config: OcxConfig): ReturnType<typeo
   const renames = projectModelRenames(config);
   const windows = projectStaleContextWindows(renames.config);
   const vision = projectStaleVisionClassifications(windows.config);
-  const rosters = projectStaleModelRosters(vision.config);
+  const noVision = projectStaleNoVisionSeeds(vision.config);
+  const rosters = projectStaleModelRosters(noVision.config);
   const devinCli = projectDevinCliAuthMode(rosters.config);
   return {
     config: devinCli.config,
-    changed: renames.changed || windows.changed || vision.changed || rosters.changed || devinCli.changed,
-    warnings: [...renames.warnings, ...windows.warnings, ...vision.warnings, ...rosters.warnings, ...devinCli.warnings],
+    changed: renames.changed || windows.changed || vision.changed || noVision.changed || rosters.changed || devinCli.changed,
+    warnings: [...renames.warnings, ...windows.warnings, ...vision.warnings, ...noVision.warnings, ...rosters.warnings, ...devinCli.warnings],
   };
 }
 

package/src/providers/quota/account-cache.ts

@@ -473,6 +473,17 @@ export function clearAccountQuotaCache(provider?: string): void {
   persistAccountQuotaCache();
 }
 
+/** Drop one account's cached bars and any joined probe so a reset is not ranked from the old window. */
+export function forgetCachedProviderAccountQuota(provider: string, accountId: string): void {
+  hydrateAccountQuotaCache();
+  const key = accountCacheKey(provider, accountId);
+  accountQuotaCache.delete(key);
+  for (const flight of [...accountQuotaInflight.keys()]) {
+    if (flight === key || flight.startsWith(key + "\u0000")) accountQuotaInflight.delete(flight);
+  }
+  persistAccountQuotaCache();
+}
+
 /**
  * Resolve a bearer for quota probing without silently adopting a newer global
  * Claude CLI credential into a background multiauth slot.

package/src/providers/quota/anthropic-account-quota.ts

@@ -20,6 +20,8 @@ import {
  */
 export async function fetchAnthropicAccountQuota(
   instance: AnthropicInstanceId, accountId: string, force: boolean, config: OcxConfig = loadConfig(),
+  /** Never join an older account or vendor flight; a reset reread needs post-grant evidence. */
+  freshDispatch = false,
 ): Promise<AccountQuotaCacheEntry> {
   const unavailable = (): AccountQuotaCacheEntry => ({ ts: Date.now(), quota: null, unavailable: true });
   const target = config.providers[instance];
@@ -52,7 +54,7 @@ export async function fetchAnthropicAccountQuota(
   const flightKey = recovery.anthropicCredentialQuotaFlightKey(key, accountId);
   const flightCurrent = () => ownerCurrent()
     && recovery.anthropicCredentialQuotaFlightKey(key, accountId) === flightKey;
-  const joinable = accountQuotaInflight.get(flightKey);
+  const joinable = freshDispatch ? undefined : accountQuotaInflight.get(flightKey);
   if (joinable) {
     const joined = await joinable;
     return ownerCurrent() && (joined.isCurrent?.() ?? flightCurrent()) ? joined : unavailable();
@@ -78,7 +80,7 @@ export async function fetchAnthropicAccountQuota(
       const result = await recovery.probeAnthropicQuotaWithRecovery(accountId, token, fresh => {
         if (!flightCurrent()) throw new AnthropicQuotaProbeOwnershipError("quota flight changed");
         recovery.assertAnthropicQuotaSendAllowed(accountId, token);
-        return fetchAnthropicUsageQuotaForInstance(instance, token, fresh);
+        return fetchAnthropicUsageQuotaForInstance(instance, token, fresh || freshDispatch);
       }, () => ownerCurrent() && mayCommitAccountQuotaKey(key, writerGeneration));
       if (result && !result.isCurrent()) return unavailable();
       if (!result && !flightCurrent()) return unavailable();

package/src/providers/quota/report-cache.ts

@@ -344,3 +344,17 @@ export function isProviderQuotaReportCurrent(value: ProviderQuotaReport): boolea
   return (generation === undefined || isMainAccountIdentityGenerationLive(generation))
     && (accountReportCurrent.get(value)?.() ?? true);
 }
+
+/**
+ * The reports this process already holds for the configured providers, for a passive read (#6959):
+ * no probe, token refresh, account snapshot or publication into routing evidence. The Home's own
+ * dashboard and traffic keep the cache current.
+ */
+export function heldProviderQuotaReports(configuredProviders: readonly string[]): ProviderQuotaResponse {
+  const held = getProviderQuotaReportCache()?.response;
+  const configured = new Set(configuredProviders);
+  return {
+    generatedAt: held?.generatedAt ?? Date.now(),
+    reports: (held?.reports ?? []).filter(item => configured.has(item.provider) && isProviderQuotaReportCurrent(item)),
+  };
+}

package/src/providers/quota/vendor-probes-oauth.ts

@@ -327,9 +327,9 @@ async function readAnthropicUsageQuota(accessToken: string): Promise<ProviderQuo
  * This endpoint reports quota only. Its body carries `five_hour`, `seven_day`, the
  * model-scoped weekly buckets (`seven_day_fable`/`_opus`/`_sonnet`) and a `limits` array,
  * and **no subscription or tier field** — nor does the OAuth token response, which yields only
- * `account.uuid` and `account.email_address` (`src/oauth/anthropic.ts`). That is why
- * `OAuthAccountSummary.plan` is `null` for Anthropic rather than populated here (#3777); it is
- * a missing upstream field, not an unfinished mapping.
+ * `account.uuid` and `account.email_address` (`src/oauth/anthropic.ts`). Subscription labels
+ * instead come from the authenticated profile in `src/oauth/anthropic-identity.ts`, never
+ * from this quota response.
  *
  * A tier must not be inferred from what is here. Percentages are normalized per account, so a
  * Max x5 seat at 50% is byte-identical to a Max x20 seat at 50%, and the presence of a

package/src/providers/quota.ts

@@ -15,6 +15,7 @@ import {
 } from "./kiro-usage";
 import { mapQuotaRoster, readProviderApiKeyQuotas, type ProviderApiKeyQuota } from "./quota-key-accounts";
 import type { OcxConfig, OcxProviderConfig } from "../types";
+import { isPassiveRead } from "../lib/passive-read";
 import type { ProviderQuota, QuotaFailureCode } from "./quota-types";
 import {
   accountReportCurrent,
@@ -23,7 +24,7 @@ import {
   captureProviderReportEpochs, providerReportEpochChanged,
   cacheKeyWithAggregationState,
   getProviderQuotaReportCache,
-  hasCodexPoolProvider,
+  hasCodexPoolProvider, heldProviderQuotaReports,
   inflight,
   invalidationEpoch,
   isBuiltInChatGptForwardProvider,
@@ -229,6 +230,8 @@ export function flushProviderQuotaObservationsForTests(): Promise<void> {
 }
 
 export async function fetchProviderQuotaReports(config: OcxConfig, forceRefresh = false): Promise<ProviderQuotaResponse> {
+  // A passive read (a Remote Link Child's, #6959) shows the held reports and starts nothing.
+  if (isPassiveRead()) return heldProviderQuotaReports(Object.keys(config.providers));
   // A Pool report's cache signature and provider fetch must share one account snapshot.
   // Preserve force semantics when deciding whether that snapshot refreshes upstream data.
   const prefetchedCodexSnapshot = hasCodexPoolProvider(config)

package/src/providers/registry/entries-core.ts

@@ -32,12 +32,12 @@ import {
   OPENAI_API_GPT56_MAX_INPUT_TOKENS,
   OPENAI_API_GPT56_VIRTUAL_MODELS,
   OPENAI_API_GPT56_REASONING_EFFORTS,
-  META_MUSE_REASONING_EFFORTS,
-  META_MUSE_REASONING_EFFORT_MAP,
+  META_MODEL_API_REASONING_EFFORTS,
+  META_MODEL_API_REASONING_EFFORT_MAPS,
   META_MUSE_CODE_REASONING_EFFORTS,
   META_MUSE_CODE_REASONING_EFFORT_MAP,
   META_MUSE_CONTEXT_WINDOW,
-  META_MUSE_MODELS,
+  META_MODEL_API_MODELS,
   OPENAI_DAYBREAK_MODELS,
   OPENAI_DAYBREAK_CONTEXT_WINDOWS,
   OPENAI_DAYBREAK_MAX_INPUT_TOKENS,
@@ -736,7 +736,7 @@ export const PROVIDER_REGISTRY_CORE: readonly ProviderRegistryEntry[] = [
     authKind: "key",
     dashboardUrl: "https://dev.meta.ai/docs/authentication",
     defaultModel: "muse-spark-1.3",
-    models: META_MUSE_MODELS,
+    models: META_MODEL_API_MODELS,
     // Static roster: no authenticated /v1/models payload was ever observed (the only
     // contact was an unauthenticated GET returning 401 invalid_api_key), and Meta serves
     // non-agent families on this same base URL. Turning discovery on would publish an
@@ -746,20 +746,20 @@ export const PROVIDER_REGISTRY_CORE: readonly ProviderRegistryEntry[] = [
     // without this, registry transport canonicalization would retarget it and send their
     // saved key to Meta.
     preserveCustomDestination: true,
-    modelContextWindows: Object.fromEntries(META_MUSE_MODELS.map(id => [id, META_MUSE_CONTEXT_WINDOW])),
+    modelContextWindows: Object.fromEntries(META_MODEL_API_MODELS.map(id => [id, META_MUSE_CONTEXT_WINDOW])),
     // text+image only. Meta also documents video, audio (degraded on 1.3), and PDF, but
     // the catalog modality enum is text/image and over-advertising poisons the exported
     // client config (see tests/codex-integration/catalog-input-modality-enum.test.ts).
-    modelInputModalities: Object.fromEntries(META_MUSE_MODELS.map(id => [id, ["text", "image"] as ["text", "image"]])),
-    modelReasoningEfforts: Object.fromEntries(META_MUSE_MODELS.map(id => [id, META_MUSE_REASONING_EFFORTS])),
-    modelReasoningEffortMap: Object.fromEntries(META_MUSE_MODELS.map(id => [id, META_MUSE_REASONING_EFFORT_MAP])),
+    modelInputModalities: Object.fromEntries(META_MODEL_API_MODELS.map(id => [id, ["text", "image"] as ["text", "image"]])),
+    modelReasoningEfforts: META_MODEL_API_REASONING_EFFORTS,
+    modelReasoningEffortMap: META_MODEL_API_REASONING_EFFORT_MAPS,
     // No defaultMaxOutputTokens: Meta publishes none. The only number in its docs
     // (131072) appears inside a third-party config sample, and the protocol pages call
     // the real limit "model-dependent".
     // Meta names its variable MODEL_API_KEY, but the env var opencodex reads is derived
     // from the provider id (META_MODEL_API_KEY). Saying only Meta's name would send a
     // user to export a variable this proxy never reads.
-    note: "Pay-as-you-go Meta Model API. Get a key at https://dev.meta.ai (Meta calls it MODEL_API_KEY; export it here as META_MODEL_API_KEY) — a Meta developer account needs a payment method before it can serve requests, and every call is metered per token. A Muse Code subscription does NOT work here: Meta scopes that credential to the Muse Code CLI and bills any other key pay-as-you-go (dev.meta.ai/docs/muse-code/subscriptions). The Contributor tier (muse-spark-1.3-contributor) is cheap because Meta trains on your prompts — about 92% off input, 95% off output, 99% off cached input; do not send confidential material through it. Muse Spark is also reachable through resellers: command-code carries both tiers, opencode-go serves only muse-spark-1.3-contributor.",
+    note: "Pay-as-you-go Meta Model API. Get a key at https://dev.meta.ai (Meta calls it MODEL_API_KEY; export it here as META_MODEL_API_KEY) — a Meta developer account needs a payment method before it can serve requests, and every call is metered per token. A Muse Code subscription does NOT work here: Meta scopes that credential to the Muse Code CLI and bills any other key pay-as-you-go (dev.meta.ai/docs/muse-code/subscriptions). The Contributor tier (muse-spark-1.3-contributor) is cheap because Meta trains on your prompts — about 92% off input, 95% off output, 99% off cached input; do not send confidential material through it. Muse Wonder (muse-wonder-1.0, preview) is Standard mode only on this API ($4 input / $20 output per 1M tokens, no Contributor tier) and accepts reasoning effort up to max; the Spark rows stop at xhigh. Muse Spark is also reachable through resellers: command-code carries both tiers, opencode-go serves only muse-spark-1.3-contributor.",
   },
   /* [Decision Log]
   - 목적과 의도: Let an operator who already signed the Muse Code CLI in reach Muse Spark with that credential, instead of provisioning a second key.
@@ -787,14 +787,14 @@ export const PROVIDER_REGISTRY_CORE: readonly ProviderRegistryEntry[] = [
     oauthId: "meta-muse",
     dashboardUrl: "https://dev.meta.ai",
     defaultModel: "muse-spark-1.3",
-    models: META_MUSE_MODELS,
+    models: META_MODEL_API_MODELS,
     // Same reason as meta-model: the authenticated roster carries muse-image-1.0 and
     // muse-voice-transcribe-1.0, which this Responses-agent provider cannot drive.
     liveModels: false,
-    modelContextWindows: Object.fromEntries(META_MUSE_MODELS.map(id => [id, META_MUSE_CONTEXT_WINDOW])),
-    modelInputModalities: Object.fromEntries(META_MUSE_MODELS.map(id => [id, ["text", "image"] as ["text", "image"]])),
-    modelReasoningEfforts: Object.fromEntries(META_MUSE_MODELS.map(id => [id, META_MUSE_CODE_REASONING_EFFORTS])),
-    modelReasoningEffortMap: Object.fromEntries(META_MUSE_MODELS.map(id => [id, META_MUSE_CODE_REASONING_EFFORT_MAP])),
+    modelContextWindows: Object.fromEntries(META_MODEL_API_MODELS.map(id => [id, META_MUSE_CONTEXT_WINDOW])),
+    modelInputModalities: Object.fromEntries(META_MODEL_API_MODELS.map(id => [id, ["text", "image"] as ["text", "image"]])),
+    modelReasoningEfforts: Object.fromEntries(META_MODEL_API_MODELS.map(id => [id, META_MUSE_CODE_REASONING_EFFORTS])),
+    modelReasoningEffortMap: Object.fromEntries(META_MODEL_API_MODELS.map(id => [id, META_MUSE_CODE_REASONING_EFFORT_MAP])),
     note: "Signs in to Meta with a browser device code on any platform, then mints the Muse Code subscription key. That grant is reimplemented from the one the Muse Code CLI performs and has NOT been exercised against Meta from OpenCodex, so treat the first login as unverified. If the Muse Code CLI is already signed in on macOS, the existing key is imported instead of starting a new grant. A pasted key from https://dev.meta.ai still works as a fallback when a device login cannot complete, and faces the same format check and live validation. A device login authenticates as Meta own Muse Code client, which is a stronger claim than reusing a key the CLI already minted. Meta scopes that credential to the Muse Code CLI, so this is an UNSUPPORTED use: Meta does not authorize subscription coverage outside its own CLI, how these calls settle is not observable from the API, and you should treat every call as billable against your account. The key, imported or pasted, is copied into OpenCodex's auth store. For an account signed in with the device login, OpenCodex refreshes Meta's subscription windows on demand from the same key endpoint the login uses, at most once every five minutes. For an imported or pasted key there is no endpoint to query them on demand, so OpenCodex reads them from streaming responses and shows the last observed value with its age; refreshing one then requires another streaming turn, and translated (non-passthrough) turns report none. Rate limits apply per team, not per key. For a supported path use the meta-model provider with your own key (export it as META_MODEL_API_KEY).",
   },
   {
@@ -1140,10 +1140,8 @@ export const PROVIDER_REGISTRY_CORE: readonly ProviderRegistryEntry[] = [
     // https://cf.api.fan/v1 — GET /v1/models answers 401 without a key, so the host is live and
     // discovery narrows to what the key's token group allows. Model ids are bare OpenAI-style
     // ids (the Codex token group lists gpt-5.5 / gpt-5.1-codex).
-    // Standard sponsor under SPONSORS.md; the dashboardUrl carries their affiliate code.
     id: "packycode", label: "PackyCode", adapter: "openai-chat", baseUrl: "https://cf.api.fan/v1",
-    authKind: "key", dashboardUrl: "https://www.packyapi.com/register?aff=k5KT",
-    sponsor: { tier: "standard", url: "https://www.packyapi.com/register?aff=k5KT" },
+    authKind: "key", dashboardUrl: "https://www.packyapi.com",
     defaultModel: "gpt-5.5",
     models: ["gpt-5.5", "gpt-5.1-codex"],
     liveModels: true,
@@ -1170,13 +1168,16 @@ export const PROVIDER_REGISTRY_CORE: readonly ProviderRegistryEntry[] = [
   // devlog/_plan/260710_provider_hardening/001_research_frontier.md.
   {
     id: "google", label: "Google Gemini", adapter: "google", baseUrl: "https://generativelanguage.googleapis.com", authKind: "key", featured: true,
-    dashboardUrl: "https://aistudio.google.com/apikey", defaultModel: "gemini-3.5-flash", models: ["gemini-3.8-flash", "gemini-3.6-flash", "gemini-3.5-flash", "gemini-3.5-flash-lite", "gemini-3.1-pro-preview", "gemini-3.7-flash"],
-    modelContextWindows: { "gemini-3.8-flash": 1_048_576, "gemini-3.6-flash": 1_048_576, "gemini-3.5-flash": 1_000_000, "gemini-3.5-flash-lite": 1_048_576, "gemini-3.7-flash": 1_048_576 },
-    modelInputModalities: { "gemini-3.8-flash": ["text", "image"], "gemini-3.6-flash": ["text", "image"], "gemini-3.5-flash-lite": ["text", "image"], "gemini-3.7-flash": ["text", "image"] },
+    dashboardUrl: "https://aistudio.google.com/apikey", defaultModel: "gemini-3.5-flash", models: ["gemini-4-argon", "gemini-3.8-flash", "gemini-3.6-flash", "gemini-3.5-flash", "gemini-3.5-flash-lite", "gemini-3.1-pro-preview", "gemini-3.7-flash"],
+    modelContextWindows: { "gemini-4-argon": 1_048_576, "gemini-3.8-flash": 1_048_576, "gemini-3.6-flash": 1_048_576, "gemini-3.5-flash": 1_000_000, "gemini-3.5-flash-lite": 1_048_576, "gemini-3.7-flash": 1_048_576 },
+    modelInputModalities: { "gemini-4-argon": ["text", "image"], "gemini-3.8-flash": ["text", "image"], "gemini-3.6-flash": ["text", "image"], "gemini-3.5-flash-lite": ["text", "image"], "gemini-3.7-flash": ["text", "image"] },
     modelReasoningEfforts: {
       // 3.7 and 3.8 omit `minimal`: Google documents it as a validation error on both model
       // pages, so advertising it hands the user a rung the API rejects. 3.5/3.6 keep theirs —
       // their pages still list it, and this unit has no evidence to change them.
+      // Gemini 4 Argon (GA 2026-10-13): low/medium(default)/high; `minimal` and thinking_budget
+      // return HTTP 400 per ai.google.dev/gemini-api/docs/models/gemini-4-argon.
+      "gemini-4-argon": ["low", "medium", "high"],
       "gemini-3.8-flash": ["low", "medium", "high"],
       "gemini-3.7-flash": ["low", "medium", "high"],
       "gemini-3.6-flash": ["minimal", "low", "medium", "high"],

package/src/providers/registry/entries-extended.ts

@@ -1247,6 +1247,25 @@ export const PROVIDER_REGISTRY_EXTENDED: readonly ProviderRegistryEntry[] = [
     },
     note: "OpenAI-compatible API gateway. Create a workspace API key at tokenlab.sh. Live discovery lists tool-capable chat models available to your key and delivery policy.",
   },
+  {
+    // Modelflare: OpenAI-compatible relay at https://modelflare.dev/v1 (an Anthropic Messages
+    // surface also answers at https://modelflare.dev/v1/messages). Live-checked 2026-10-13 through
+    // the proxy: chat, streaming and tool calls succeed on Chat for all four seeded models, and a
+    // real `codex exec` turn completed on glm-5.3-flash. GET /v1/models lists ~77 rows mixing chat,
+    // image and video models, and includes deepseek-v4.1-flash, which answers 503 on every call,
+    // so the preset seeds the verified chat models statically instead of trusting live discovery.
+    // The conventional env reference derived from the id is ${MODELFLARE_API_KEY}.
+    id: "modelflare",
+    label: "Modelflare",
+    adapter: "openai-chat",
+    baseUrl: "https://modelflare.dev/v1",
+    authKind: "key",
+    dashboardUrl: "https://modelflare.dev",
+    preserveCustomDestination: true,
+    defaultModel: "glm-5.3-flash",
+    models: ["glm-5.3-flash", "claude-sonnet-5-5", "gpt-6.1-sol", "deepseek-v4-flash"],
+    note: "OpenAI-compatible relay for Claude, GPT, GLM and DeepSeek chat models. The seeded models were verified with chat, streaming and tool calls; deepseek-v4.1-flash is listed upstream but currently answers 503 and is left out. An ordinary key only reaches its own routing group's models; a Smart key reaches all seeded models. Image and video models are not served through this Chat preset. Upstream latency varies widely (a few seconds to about 30 s) with occasional transient 503s.",
+  },
   {
     id: "opencode-free",
     label: "OpenCode Free",
@@ -1468,7 +1487,6 @@ export const PROVIDER_REGISTRY_EXTENDED: readonly ProviderRegistryEntry[] = [
     models: [...QODER_GLOBAL_MODELS],
     liveModels: true,
     reasoningEfforts: [...QODER_REASONING_EFFORTS],
-    noVisionModels: [...QODER_GLOBAL_MODELS],
     note: "Official Qoder Global CLI using QODER_PERSONAL_ACCESS_TOKEN. Models are discovered per account with `qoder --list-models`; the documented roster is a degraded fallback. The CLI runs single-turn with tools, MCP, settings hooks, and session persistence disabled. Requires `npm install -g @qoder-ai/qodercli`.",
   },
   {

package/src/providers/registry/model-seeds.ts

@@ -255,6 +255,23 @@ export const META_MUSE_CODE_REASONING_EFFORT_MAP: Record<string, string> = Objec
 /** Both Muse Spark 1.3 tiers publish a 1,048,576-token window (dev.meta.ai/docs/models). */
 export const META_MUSE_CONTEXT_WINDOW = 1_048_576;
 export const META_MUSE_MODELS = ["muse-spark-1.3", "muse-spark-1.3-contributor"];
+/*
+ * Muse Wonder (preview), announced 2026-10-12 (research.meta.ai/blog/muse-wonder). Per
+ * dev.meta.ai/docs/models and dev.meta.ai/docs/pricing-rate-limits, verified 2026-10-13:
+ * id muse-wonder-1.0, a 1,048,576-token window, reasoning effort "minimal" through "max",
+ * and Standard mode only on the Model API (no Contributor variant). Muse Wonder Full is
+ * reachable only inside Muse Code subscriptions and has no Model API id, so it is absent.
+ */
+export const META_MUSE_WONDER_MODEL = "muse-wonder-1.0";
+/** Roster both direct Meta providers serve: the Spark 1.3 tiers plus Muse Wonder. */
+export const META_MODEL_API_MODELS = [...META_MUSE_MODELS, META_MUSE_WONDER_MODEL];
+/** Model API ladders: Spark stops at xhigh; Wonder documents minimal..max. */
+export const META_MODEL_API_REASONING_EFFORTS: Record<string, string[]> = Object.fromEntries(
+  META_MODEL_API_MODELS.map(id => [id, id === META_MUSE_WONDER_MODEL ? META_MUSE_CODE_REASONING_EFFORTS : META_MUSE_REASONING_EFFORTS]),
+);
+export const META_MODEL_API_REASONING_EFFORT_MAPS: Record<string, Record<string, string>> = Object.fromEntries(
+  META_MODEL_API_MODELS.map(id => [id, id === META_MUSE_WONDER_MODEL ? META_MUSE_CODE_REASONING_EFFORT_MAP : META_MUSE_REASONING_EFFORT_MAP]),
+);
 /**
  * Daybreak program aliases. These `-latest` ids are the stable contract: OpenAI repoints
  * them at newer snapshots over time (red -> gpt-5.6-cyber, blue -> gpt-5.6-sol as of

package/src/providers/request-pacing.ts

@@ -33,6 +33,12 @@ export const REQUEST_PACING_CONCURRENCY_RETRY_AFTER_SECONDS = 5;
 let maxQueueDepth = REQUEST_PACING_MAX_QUEUE_DEPTH;
 let maxQueueAgeMs = REQUEST_PACING_MAX_QUEUE_AGE_MS;
 
+// Optional owners register internal response markers; only this owned body rewrap carries them.
+const responseProvenance = new Set<WeakMap<Response, unknown>>();
+export function registerProviderResponseProvenance(markers: WeakMap<Response, unknown>): void {
+  responseProvenance.add(markers);
+}
+
 export type RequestPacingQueueOverloadReason = "queue_full" | "queue_expired";
 
 export class RequestPacingQueueOverloadError extends Error {
@@ -588,6 +594,9 @@ export function trackProviderRequestSlotBody(
   // Retry helpers mark the response they return from, and recovery decisions key on these
   // identity markers; the rewrap must not make a non-replayable response look replayable.
   if (isNonReplayableResponse(response)) markResponseNonReplayable(wrapped);
+  for (const markers of responseProvenance) {
+    if (markers.has(response)) markers.set(wrapped, markers.get(response));
+  }
   return carryReplayRefusal(response, wrapped);
 }
 

package/src/providers/stale-no-vision-seed-migration.ts

@@ -0,0 +1,72 @@
+/**
+ * Drop a saved `noVisionModels` list that is still, byte for byte, a retired registry seed.
+ *
+ * `enrichProviderFromRegistry` fills `noVisionModels` all-or-nothing, so a provider row saved
+ * while the registry seeded a blanket list keeps that list after the registry stops seeding it.
+ * Qoder Global seeded its whole static discovery roster as text-only until the Global adapter
+ * began forwarding image input to the Qoder CLI (#6906). The saved copy would keep every image
+ * on the vision sidecar path, stripped or captioned before the adapter could forward it.
+ *
+ * This projection removes one thing: a saved list identical, in order, to a seed this file names,
+ * on a row the registry still owns (same adapter, and the registry transport rule enrichment uses),
+ * and only while the registry no longer seeds the list at all. Any edited list does not match and
+ * is left alone. `modelCapabilities` and `modelInputModalities` are untouched; they are where a
+ * deliberate per-model text-only declaration belongs.
+ */
+import { PROVIDER_REGISTRY, providerMatchesRegistryTransport } from "./registry";
+import type { OcxConfig } from "../types";
+
+export interface StaleNoVisionSeed {
+  /** Registry provider id whose saved rows may carry the retired list. */
+  provider: string;
+  /** Every list the registry ever seeded, in seed order; only an exact match is removed. */
+  seeds: readonly (readonly string[])[];
+}
+
+export interface StaleNoVisionSeedProjection {
+  config: OcxConfig;
+  changed: boolean;
+  warnings: string[];
+}
+
+export const STALE_NO_VISION_SEEDS: readonly StaleNoVisionSeed[] = [
+  {
+    provider: "qoder",
+    seeds: [
+      // 2026-09-03 (Qoder Global PAT provider) until the DeepSeek V4.1 transition (#4282).
+      ["Qwen3.8-Max", "Qwen3.7-Max", "Qwen3.7-Plus", "Kimi-K3", "Kimi-K2.7-Code", "GLM-5.3", "GLM-5.2", "DeepSeek-V4-Pro"],
+      // #4282 until Global image input (#6906).
+      ["Qwen3.8-Max", "Qwen3.7-Max", "Qwen3.7-Plus", "Kimi-K3", "Kimi-K2.7-Code", "GLM-5.3", "GLM-5.2"],
+    ],
+  },
+];
+
+function sameList(current: readonly unknown[], expected: readonly string[]): boolean {
+  return current.length === expected.length && current.every((value, index) => value === expected[index]);
+}
+
+/** Pure projection. The caller decides whether to persist. */
+export function projectStaleNoVisionSeeds(
+  config: OcxConfig,
+  entries: readonly StaleNoVisionSeed[] = STALE_NO_VISION_SEEDS,
+): StaleNoVisionSeedProjection {
+  const warnings: string[] = [];
+  let changed = false;
+  for (const entry of entries) {
+    const prov = config.providers?.[entry.provider];
+    if (!prov || !Array.isArray(prov.noVisionModels)) continue;
+    const registry = PROVIDER_REGISTRY.find(row => row.id === entry.provider);
+    // While the registry still seeds a list, the saved one is not stale by this file's rule.
+    if (!registry || registry.noVisionModels !== undefined || registry.adapter !== prov.adapter) continue;
+    if (!providerMatchesRegistryTransport(entry.provider, prov)) continue;
+    const saved = prov.noVisionModels;
+    if (!entry.seeds.some(seed => sameList(saved, seed))) continue;
+    delete prov.noVisionModels;
+    changed = true;
+    warnings.push(
+      `removed the retired registry noVisionModels seed (${saved.length} model(s)) from "${entry.provider}"; `
+      + "image input now follows the provider's current classification.",
+    );
+  }
+  return { config, changed, warnings };
+}