@bitkyc08/opencodex 2.83.0 → 2.86.0

package/src/update/job.ts

@@ -2,18 +2,8 @@ import { spawn, spawnSync, type ChildProcess } from "node:child_process";
 import { existsSync, mkdirSync, openSync, readFileSync, writeSync } from "node:fs";
 import { dirname, join, sep } from "node:path";
 import { fileURLToPath } from "node:url";
-import {
-  atomicWriteFile,
-  getConfigDir,
-  loadConfig,
-} from "../config";
-import {
-  readPid,
-  readRuntimePort,
-  removePid,
-  removeRuntimePort,
-  verifyPidIdentity,
-} from "../config/process-state";
+import { atomicWriteFile, getConfigDir, loadConfig } from "../config";
+import { readPid, readRuntimePort, removePid, removeRuntimePort, verifyPidIdentity } from "../config/process-state";
 import { isProcessAlive, killProxy } from "../lib/process-control";
 import { selfLaunchArgv } from "../lib/self-launch-argv";
 import { killWindowsSchedulerWrappers } from "../lib/windows-service-wrappers";
@@ -33,9 +23,10 @@ import {
 } from "../server/proxy-liveness";
 import { isServiceInstalled, isServiceViable, readServiceBackend, stopWindows } from "../service";
 import { runUpdateRestartWithOwnershipLease, type ServiceOwnershipResolution } from "./restart-ownership";
+import { restartServiceManagerAfterUpdate, unsettledManagerRestartFailure, unsupervisedRestartFailure, type ManagerRestartFn } from "./job-supervised-restart";
 import {
   type Channel, type Installer,
-  PKG,
+  PKG, STANDALONE_UPDATE_HINT,
   checkUpdatePackageIntegrity,
   currentVersion,
   defaultUpdateTag,
@@ -492,17 +483,17 @@ export function checkForUpdate(
   const ownership = deps.detectInstallOwnership?.();
   const installer = ownership?.installer ?? deps.detectInstall();
   const channel = requestedChannel ?? normalizeUpdateChannel(null, current);
-  const latest = installer === "source" ? null : deps.latestVersion(channel);
+  const latest = installer === "source" || installer === "standalone" ? null : deps.latestVersion(channel);
   const updateAvailable = !!latest && isNewer(latest, current, channel);
   let reason: string | undefined;
-  let command = installer === "source"
+  let command = installer === "standalone" ? STANDALONE_UPDATE_HINT : installer === "source"
     ? manualSourceCommand()
     : installer === "mise"
       ? (ownership && deps.miseUpdateCommand?.(ownership)) ?? ""
       : updateExecutionCommand(installer, channel).display;
 
-  if (installer === "source") {
-    reason = "source_checkout";
+  if (installer === "source" || installer === "standalone") {
+    reason = installer === "source" ? "source_checkout" : "standalone_install";
   } else if (installer === "mise") {
     reason = command ? "externally_managed" : "external_ownership_invalid";
   } else if (!latest) {
@@ -517,7 +508,7 @@ export function checkForUpdate(
     channel,
     installer,
     updateAvailable,
-    canUpdate: installer !== "source" && installer !== "mise" && updateAvailable,
+    canUpdate: installer !== "source" && installer !== "standalone" && installer !== "mise" && updateAvailable,
     command,
     releaseNotesUrl: RELEASE_NOTES_URL,
     ...(reason ? { reason } : {}),
@@ -1005,6 +996,7 @@ export interface RestartIo {
   releaseForServiceManagerFn?: () => void;
   /** Re-acquire the lease for the direct-start fallthrough, then re-run the veto; a notice stops the restart. */
   reacquireForDirectStartFn?: () => { readonly notice: string; readonly failed: boolean } | null;
+  restartServiceManagerFn?: ManagerRestartFn; // launchd/systemd restart before a managed direct fallback (#7043)
   probeProxy?: (port: number, hostname?: string) => Promise<boolean>;
   /** Richer /healthz read for update-correlated restart evidence (pid + version). */
   probeProxyIdentity?: (port: number, hostname?: string) => Promise<RestartProxyIdentity | null>;
@@ -1035,7 +1027,7 @@ export interface RestartIo {
     job: UpdateJobState,
     captured?: { port: number; hostname: string; oldPid?: number },
     io?: RestartIo,
-  ) => Promise<false | void>;
+  ) => Promise<false | void | "unsupervised">;
   /**
    * PIDs currently LISTENing on the captured port. Used to widen the post-update
    * kill allowlist beyond the pre-update PID (Windows often leaves a respawned
@@ -1098,7 +1090,7 @@ async function restartAfterUpdate(
   job: UpdateJobState,
   captured?: { port: number; hostname: string; oldPid?: number },
   io: RestartIo = {},
-): Promise<false | void> {
+): Promise<false | void | "unsupervised"> {
   const serviceInstalled = (io.serviceInstalledFn ?? isServiceInstalled)();
   const config = loadConfig();
   // Stop-first update already cleared pid/runtime state, so the pre-update capture is
@@ -1250,6 +1242,12 @@ async function restartAfterUpdate(
     }
   }
 
+  // #7043: a managed install asks launchd/systemd first; only the manager's own job counts as recovered.
+  const managed = !serviceInstalled ? "failed" : await (io.restartServiceManagerFn ?? restartServiceManagerAfterUpdate)(
+    { port, hostname, release: io.releaseForServiceManagerFn }, line => updateJob(job, {}, line));
+  if (managed === "supervised") return;
+  if (managed === "unsettled") { updateJob(job, ...unsettledManagerRestartFailure(port)); return false; }
+  const fallback = serviceInstalled ? "unsupervised" as const : undefined; // every exit below is unproven ownership
   // The service refresh ran outside the lease; take it back so the veto and the kills/start below stay serialized.
   const restartVeto = io.reacquireForDirectStartFn?.();
   if (restartVeto) {
@@ -1282,7 +1280,7 @@ async function restartAfterUpdate(
     );
     if (liveHolders.length > 0) {
       updateJob(job, {}, `Live holder(s) remain on port ${port}; not starting on another port. Retry 'ocx start --port ${port}'.`);
-      return;
+      return fallback;
     }
     // Dead PIDs can still own LISTEN rows. SetTcpEntry needs elevation (rc 317 on a
     // normal update worker), so poll until netstat is empty and the start runtime can bind.
@@ -1306,7 +1304,7 @@ async function restartAfterUpdate(
             + `${formatPortHolders(port, listPids, verifyOcx, directAllow)} `
             + `Retry 'ocx start --port ${port}'.`,
         );
-        return;
+        return fallback;
       }
     }
   }
@@ -1314,7 +1312,7 @@ async function restartAfterUpdate(
   // retries on missing /healthz after prepare + ghost-LISTEN clear.
   if (io.spawnStart) {
     io.spawnStart(job, job.installer, port, launcher);
-    return;
+    return fallback;
   }
   const sleep = io.sleepMs ?? ((ms: number) => new Promise<void>(r => setTimeout(r, ms)));
   const probe = io.probeProxy ?? (async (p: number, host?: string) => (
@@ -1334,7 +1332,7 @@ async function restartAfterUpdate(
         {},
         `Proxy already healthy on ${hostname}:${port} at ${expectedVersion}; skipping pinned start.`,
       );
-      return;
+      return fallback;
     }
   }
   const attempts = 3;
@@ -1393,12 +1391,13 @@ async function restartAfterUpdate(
     child.once("close", retireChild);
     const healthDeadline = now() + perAttemptHealthMs;
     while (now() < healthDeadline) {
-      if (await probe(port, hostname)) return;
+      if (await probe(port, hostname)) return fallback;
       await sleep(500);
     }
   }
   // Exhausted retries: do not leave a hung pinned-start child owning the port.
   killSpawnAttempt(lastChild);
+  return fallback;
 }
 
 /** Compact listen-holder summary for update-job logs when reclaim fails. */
@@ -1454,7 +1453,7 @@ export function restartAfterUpdateForTests(
   job: UpdateJobState,
   captured: { port: number; hostname: string; oldPid?: number },
   io: RestartIo,
-): Promise<false | void> {
+): Promise<false | void | "unsupervised"> {
   return restartAfterUpdate(job, captured, io);
 }
 
@@ -1729,12 +1728,13 @@ export async function finishGuiUpdateRestart(
     }
   }
   const restartFn = io.restartAfterUpdateFn ?? restartAfterUpdate;
-  if ((await restartFn(job, captured, io)) === false) return false;
-  if (!usesNodeLauncher(installer)) {
-    // Bun/source: health alone remains enough unless a richer identity probe is supplied.
-    if (!io.probeProxyIdentity) return confirmRestartedProxy(job, captured, io);
-  }
-  return confirmPackageManagerExplicitRestart(job, captured, io);
+  const restarted = await restartFn(job, captured, io);
+  if (restarted === false) return false;
+  // Bun/source: health alone remains enough unless a richer identity probe is supplied.
+  const confirm = !usesNodeLauncher(installer) && !io.probeProxyIdentity ? confirmRestartedProxy : confirmPackageManagerExplicitRestart;
+  const confirmed = await confirm(job, captured, io);
+  if (confirmed && restarted === "unsupervised") updateJob(job, ...unsupervisedRestartFailure(captured.port)); // #7043
+  return confirmed && restarted !== "unsupervised";
 }
 
 /**

package/src/update/notify.ts

@@ -152,7 +152,7 @@ export function interactiveGuardOk(): boolean {
  */
 export function shouldConsider(): { channel: Channel; current: string } | null {
   const installer = detectInstall();
-  if (installer === "source" || installer === "mise") return null;
+  if (installer === "source" || installer === "standalone" || installer === "mise") return null;
   const current = currentVersion();
   if (current === "?" || isSourceBuildVersion(current)) return null;
   if (!interactiveGuardOk()) return null;

package/src/update/refresh-scheduler.ts

@@ -53,7 +53,7 @@ export function createRefreshScheduler(deps: RefreshDeps = defaults) {
     const version = deps.current();
     const installer = deps.install();
     return !deps.disabled() && version !== "?" && !isSourceBuildVersion(version)
-      && installer !== "source" && installer !== "mise";
+      && installer !== "source" && installer !== "standalone" && installer !== "mise";
   };
   const channel = () => defaultUpdateTag(deps.current());
   const stale = (tag: Channel) => {
@@ -123,7 +123,7 @@ export function createRefreshScheduler(deps: RefreshDeps = defaults) {
     },
     async check(tag: Channel): Promise<UpdateCheckResult> {
       const installer = deps.install();
-      const latest = installer === "source" || installer === "mise" ? null : await lookup(tag, false);
+      const latest = installer === "source" || installer === "standalone" || installer === "mise" ? null : await lookup(tag, false);
       return checkForUpdate(tag, {
         currentVersion: deps.current,
         detectInstall: deps.install,

package/src/update/supervised-recovery.d.mts

@@ -0,0 +1,27 @@
+/** Declarations for the plain-ESM manager recovery shared with `bin/ocx.mjs` (#7043). */
+export type ServiceManagerRun = (file: string, args: string[]) => { ok: boolean; stdout: string; stderr: string; timedOut?: boolean };
+export interface ServiceManagerDeps {
+  platform?: NodeJS.Platform;
+  uid?: number;
+  run?: ServiceManagerRun;
+}
+export type SupervisionVerdict =
+  | { kind: "supervised"; managerPid: number; servingPid: number }
+  | { kind: "failed"; reason: string };
+export declare const LAUNCHD_SERVICE_LABEL: string;
+export declare const SYSTEMD_SERVICE_UNIT: string;
+export declare function parseLaunchdJobPid(printOutput: string): number | null;
+export declare function parseSystemdMainPid(showOutput: string): number | null;
+export declare function hasRestartableServiceManager(deps?: ServiceManagerDeps): boolean;
+export declare function restartServiceManagerJob(deps?: ServiceManagerDeps):
+  { ok: true } | { ok: false; reason: string; unsettled?: true };
+export declare function freshServingPid(recordPid: number, staleRecordPid: number | null): number | null;
+export declare function unsettledManagerWarning(port: number): string;
+export declare function readServiceManagerPid(deps?: ServiceManagerDeps): number | null;
+export declare function readParentPid(pid: number, deps?: ServiceManagerDeps): number | null;
+export declare function supervisionVerdict(input: {
+  servingPid: number | null;
+  managerPid: number | null;
+  parentPid: (pid: number) => number | null;
+}): SupervisionVerdict;
+export declare function unsupervisedRuntimeWarning(port: number): string;

package/src/update/supervised-recovery.mjs

@@ -0,0 +1,157 @@
+import { spawnSync } from "node:child_process";
+
+/**
+ * Manager-mediated runtime recovery after an update (#7043).
+ *
+ * When the service refresh after an update fails or leaves a non-viable manager, both update
+ * lanes used to fall straight back to a detached `ocx start`. That proxy answers, but launchd
+ * or systemd no longer owns it: a crash is not restarted, and the next `launchctl kickstart`
+ * races the detached process for the port. Before that fallback, the lanes now ask the manager
+ * to restart the job it already holds, and count it as recovered only when the serving proxy is
+ * provably the manager's process: the runtime record's PID is the manager's main PID, or that
+ * PID's direct child (the job execs the Node launcher, which runs the Bun proxy as its child).
+ *
+ * Plain synchronous ESM because `bin/ocx.mjs` runs under Node, cannot import TypeScript, and
+ * keeps straight-line control flow; `src/update/index.ts` composes the same pieces with its own
+ * asynchronous identity wait.
+ */
+
+/** Must match `LABEL` / `TASK` in src/service/state.ts; a test pins the pairing. */
+export const LAUNCHD_SERVICE_LABEL = "com.opencodex.proxy";
+export const SYSTEMD_SERVICE_UNIT = "opencodex-proxy";
+
+function positivePid(value) {
+  if (typeof value !== "string" || !/^\d+$/.test(value.trim())) return null;
+  const pid = Number(value.trim());
+  return Number.isSafeInteger(pid) && pid > 0 ? pid : null;
+}
+
+function defaultRun(file, args) {
+  // An armed test process must never reach the developer's real launchd or systemd job;
+  // same refusal as `assertLiveServiceManagerAllowed` for the TypeScript service layer.
+  if (process.env.OCX_TEST_HOME_GUARD === "1") {
+    return { ok: false, stdout: "", stderr: `refusing to run ${file} from an armed test process` };
+  }
+  // A bare SSH session has no user-bus address; systemd's user manager still lives at the
+  // conventional runtime directory (same fallback as the service layer's ensureUserBusEnv).
+  const env = file === "systemctl" && !process.env.XDG_RUNTIME_DIR && typeof process.getuid === "function"
+    ? { ...process.env, XDG_RUNTIME_DIR: `/run/user/${process.getuid()}` }
+    : process.env;
+  const result = spawnSync(file, args, { encoding: "utf8", timeout: 20_000, windowsHide: true, env });
+  if (result.error) {
+    // A timeout kills only the waiting client; the manager's queued job keeps running.
+    const timedOut = result.error.code === "ETIMEDOUT";
+    return { ok: false, stdout: "", stderr: String(result.error.message ?? ""), ...(timedOut ? { timedOut } : {}) };
+  }
+  return { ok: result.status === 0, stdout: String(result.stdout ?? ""), stderr: String(result.stderr ?? "").trim() };
+}
+
+function launchdTarget(uid) {
+  return `gui/${uid}/${LAUNCHD_SERVICE_LABEL}`;
+}
+
+/** `launchctl print` reports a running job as a `pid = <n>` line. */
+export function parseLaunchdJobPid(printOutput) {
+  const match = /^\s*pid\s*=\s*(\d+)\s*$/m.exec(String(printOutput ?? ""));
+  return positivePid(match?.[1]);
+}
+
+/** `systemctl show -p MainPID` prints `MainPID=<n>`; 0 means not running. */
+export function parseSystemdMainPid(showOutput) {
+  const match = /^MainPID=(\d+)\s*$/m.exec(String(showOutput ?? ""));
+  return positivePid(match?.[1]);
+}
+
+function resolve(deps) {
+  const platform = deps.platform ?? process.platform;
+  const uid = deps.uid ?? (typeof process.getuid === "function" ? process.getuid() : 0);
+  return { platform, uid, run: deps.run ?? defaultRun };
+}
+
+/** Whether this platform has a manager this module can ask (launchd or systemd). */
+export function hasRestartableServiceManager(deps = {}) {
+  const { platform } = resolve(deps);
+  return platform === "darwin" || platform === "linux";
+}
+
+/**
+ * Ask the manager to restart the job in place. Never throws. `unsettled` means the client gave up
+ * waiting while the manager may still complete the restart: callers must not start a competing
+ * proxy on that answer.
+ */
+export function restartServiceManagerJob(deps = {}) {
+  const { platform, uid, run } = resolve(deps);
+  const result = platform === "darwin"
+    ? run("/bin/launchctl", ["kickstart", "-k", launchdTarget(uid)])
+    : platform === "linux"
+      ? run("systemctl", ["--user", "restart", SYSTEMD_SERVICE_UNIT])
+      : null;
+  if (result === null) return { ok: false, reason: "no launchd or systemd manager on this platform" };
+  if (result.timedOut) return { ok: false, unsettled: true, reason: "the service manager did not finish the restart in time" };
+  if (!result.ok) return { ok: false, reason: result.stderr.split("\n")[0] || "the service manager refused the restart" };
+  return { ok: true };
+}
+
+/** The manager's main PID for the job, or null when it reports none. Never throws. */
+export function readServiceManagerPid(deps = {}) {
+  const { platform, uid, run } = resolve(deps);
+  if (platform === "darwin") {
+    const printed = run("/bin/launchctl", ["print", launchdTarget(uid)]);
+    return printed.ok ? parseLaunchdJobPid(printed.stdout) : null;
+  }
+  if (platform === "linux") {
+    const shown = run("systemctl", ["--user", "show", "-p", "MainPID", SYSTEMD_SERVICE_UNIT]);
+    return shown.ok ? parseSystemdMainPid(shown.stdout) : null;
+  }
+  return null;
+}
+
+/** Parent PID of a process, or null when it cannot be read. Never throws. */
+export function readParentPid(pid, deps = {}) {
+  const { run } = resolve(deps);
+  if (!Number.isSafeInteger(pid) || pid <= 0) return null;
+  const result = run("ps", ["-o", "ppid=", "-p", String(pid)]);
+  return result.ok ? positivePid(result.stdout) : null;
+}
+
+/**
+ * Whether the serving proxy is the manager's job. `parentPid` is consulted only when the
+ * serving PID is not the manager's own.
+ */
+export function supervisionVerdict({ servingPid, managerPid, parentPid }) {
+  if (!Number.isSafeInteger(servingPid) || servingPid <= 0) {
+    return { kind: "failed", reason: "the manager restarted the job but no proxy answered" };
+  }
+  if (!Number.isSafeInteger(managerPid) || managerPid <= 0) {
+    return { kind: "failed", reason: "the manager reports no running process for the job" };
+  }
+  if (servingPid === managerPid || parentPid(servingPid) === managerPid) {
+    return { kind: "supervised", managerPid, servingPid };
+  }
+  return { kind: "failed", reason: `the serving proxy (pid ${servingPid}) is not the manager's job (pid ${managerPid})` };
+}
+
+/**
+ * The serving PID to judge after a restart: a record still naming the pre-restart process is not
+ * evidence about the restarted one.
+ */
+export function freshServingPid(recordPid, staleRecordPid) {
+  return Number.isSafeInteger(recordPid) && recordPid > 0 && recordPid !== staleRecordPid ? recordPid : null;
+}
+
+/** The warning printed when an update had to leave a proxy the manager does not own. */
+export function unsupervisedRuntimeWarning(port) {
+  return [
+    `⚠️  The proxy on port ${port} is running UNSUPERVISED: the background service manager did not take it back after the update.`,
+    "   A crash will not be restarted, and a later service start can race it for the port.",
+    "   Run 'ocx service repair' to hand it back to the background service.",
+  ].join("\n");
+}
+
+/** The warning printed when the manager may still be restarting; no second proxy is started. */
+export function unsettledManagerWarning(port) {
+  return [
+    `⚠️  The service manager is still restarting the proxy on port ${port}; no second proxy was started.`,
+    "   Check it with 'ocx service status', and run 'ocx service repair' if it does not come back.",
+  ].join("\n");
+}

package/src/usage/cache-diagnostic.ts

@@ -294,11 +294,13 @@ export function appendFinalCacheDiagnostic(facts: CacheDiagnosticFinalFacts): vo
 
 const CACHE_DIAGNOSTIC_HOOK = Symbol.for("opencodex.cache-diagnostic.v1");
 interface CacheDiagnosticHooks {
+  enabled(): boolean;
   observeInbound(body: unknown, headers: Headers, source: PromptCacheKeySource): CacheDiagnosticDraft;
   rebind(body: unknown, draft: CacheDiagnosticDraft | undefined): void;
   finalize(facts: CacheDiagnosticFinalFacts): void;
 }
 (globalThis as Record<symbol, CacheDiagnosticHooks | undefined>)[CACHE_DIAGNOSTIC_HOOK] = {
+  enabled: isCacheDiagnosticEnabled,
   observeInbound,
   rebind: rebindCacheDiagnosticBodyAlias,
   finalize: appendFinalCacheDiagnostic,

package/src/usage/expected-prices.ts

@@ -88,6 +88,10 @@ const GEMINI_37_FLASH: Cost4 = { input: 0.75, output: 3.75, cacheRead: 0.075, ca
 // rising to $1.50 / $7.50 on 2027-01-01. A SEPARATE constant on purpose: equal today, but
 // aliasing them would silently drag 3.8 along if 3.7's row is ever re-verified differently.
 const GEMINI_38_FLASH: Cost4 = { input: 0.75, output: 3.75, cacheRead: 0.075, cacheWrite: 0 };
+// Gemini 4 Argon introductory paid-tier rate: $2 in / $10 out (thinking included) / $0.10 cached
+// per 1M through 2026-11-30, stepping up to $4 / $20 / $0.20 on 2026-12-01. Revisit this row
+// then. No free tier. Implicit caching only, so there is no per-token cache-write price.
+const GEMINI_4_ARGON: Cost4 = { input: 2, output: 10, cacheRead: 0.1, cacheWrite: 0 };
 const MINIMAX_M21_HIGHSPEED: Cost4 = { input: 0.6, output: 2.4, cacheRead: 0.03, cacheWrite: 0.375 };
 const KIMI_K3: Cost4 = { input: 3, output: 15, cacheRead: 0.3, cacheWrite: 3 };
 const KIMI_K27_CODE: Cost4 = { input: 0.95, output: 4, cacheRead: 0.19, cacheWrite: 0.95 };
@@ -200,6 +204,7 @@ export function cursorFastPriceSource(provider: string, modelId: string): string
 
 const GEMINI_PRICING = "https://ai.google.dev/gemini-api/docs/pricing (2026-07-22); cacheWrite=0: storage is billed per-hour, not per-token";
 const GEMINI_37_PRICING = "https://ai.google.dev/gemini-api/docs/pricing (2026-08-14); promotional rate through 2026-12-31, rises to 1.50/7.50 on 2027-01-01; cacheWrite=0: storage is billed per-hour, not per-token";
+const GEMINI_4_ARGON_PRICING = "https://ai.google.dev/gemini-api/docs/pricing (2026-10-14); introductory rate through 2026-11-30, rises to 4/20 (0.20 cached) on 2026-12-01; cacheWrite=0: implicit caching only";
 const GEMINI_38_PRICING = "https://ai.google.dev/gemini-api/docs/pricing (2026-09-03); promotional rate through 2026-12-31, rises to 1.50/7.50 on 2027-01-01; cacheWrite=0: storage is billed per-hour, not per-token";
 const MINIMAX_PRICING = "https://platform.minimax.io/docs/guides/pricing-paygo";
 const OPENAI_GPT56_PRICING = "https://developers.openai.com/api/docs/pricing";
@@ -211,6 +216,8 @@ const META_MODEL_PRICING = "https://dev.meta.ai/docs/pricing-rate-limits";
  */
 const META_MUSE_SPARK_13: Cost4 = { input: 1.25, output: 4.25, cacheRead: 0.15, cacheWrite: 0 };
 const META_MUSE_SPARK_13_CONTRIBUTOR: Cost4 = { input: 0.1, output: 0.2, cacheRead: 0.002, cacheWrite: 0 };
+// Muse Wonder (muse-wonder-1.0): Standard mode only, no long-context premium (verified 2026-10-13).
+const META_MUSE_WONDER_10: Cost4 = { input: 4, output: 20, cacheRead: 0.2, cacheWrite: 0 };
 const META_SPARK_SOURCE = `Meta Model API published price ${META_MODEL_PRICING}`;
 const META_SPARK_CONTRIBUTOR_SOURCE = `Meta Model API published Contributor-tier price ${META_MODEL_PRICING}; data-sharing discount tier`;
 const DEEPSEEK_PRICING = "https://api-docs.deepseek.com/quick_start/pricing-details-usd; V4 Flash alias transition scheduled 2026-07-24 — re-verify after";
@@ -344,6 +351,12 @@ export const EXPECTED_PRICE_OVERLAYS: readonly ExpectedPriceOverlay[] = [
   // 3.7 Flash rides CCA, whose billing equivalence to the Developer API list price is
   // not published, so this is `verified-derived` rather than `verified`: the number is
   // proven, the claim that Antigravity charges it is inferred.
+  // Gemini 4 Argon on Antigravity (AI Ultra / Enterprise only): the picker id plus its three
+  // verified CCA wire ids. Billing equivalence to the API price is inferred.
+  { provider: "google-antigravity", modelId: "gemini-4-argon", cost4: GEMINI_4_ARGON, source: `derived: Gemini 4 Argon introductory rate through 2026-11-30 ${GEMINI_4_ARGON_PRICING}`, verifiedAt: "2026-10-14", status: "verified-derived" },
+  { provider: "google-antigravity", modelId: "gemini-4-argon-low", cost4: GEMINI_4_ARGON, source: `derived: gemini-4-argon ${GEMINI_4_ARGON_PRICING}`, verifiedAt: "2026-10-14", status: "verified-derived" },
+  { provider: "google-antigravity", modelId: "gemini-4-argon-medium", cost4: GEMINI_4_ARGON, source: `derived: gemini-4-argon ${GEMINI_4_ARGON_PRICING}`, verifiedAt: "2026-10-14", status: "verified-derived" },
+  { provider: "google-antigravity", modelId: "gemini-4-argon-high", cost4: GEMINI_4_ARGON, source: `derived: gemini-4-argon ${GEMINI_4_ARGON_PRICING}`, verifiedAt: "2026-10-14", status: "verified-derived" },
   { provider: "google-antigravity", modelId: "gemini-3.8-flash", cost4: GEMINI_38_FLASH, source: `derived: Gemini 3.8 Flash promotional rate through 2026-12-31 ${GEMINI_38_PRICING}`, verifiedAt: "2026-09-03", status: "verified-derived" },
   { provider: "google-antigravity", modelId: "gemini-3.8-flash-low", cost4: GEMINI_38_FLASH, source: `derived: gemini-3.8-flash ${GEMINI_38_PRICING}`, verifiedAt: "2026-09-03", status: "verified-derived" },
   { provider: "google-antigravity", modelId: "gemini-3.8-flash-medium", cost4: GEMINI_38_FLASH, source: `derived: gemini-3.8-flash ${GEMINI_38_PRICING}`, verifiedAt: "2026-09-03", status: "verified-derived" },
@@ -369,11 +382,13 @@ export const EXPECTED_PRICE_OVERLAYS: readonly ExpectedPriceOverlay[] = [
   // cacheWrite=0: Meta publishes a cached-input price but no cache-write charge.
   { provider: "meta-model", modelId: "muse-spark-1.3", cost4: META_MUSE_SPARK_13, source: META_SPARK_SOURCE, verifiedAt: "2026-09-03", status: "verified" },
   { provider: "meta-model", modelId: "muse-spark-1.3-contributor", cost4: META_MUSE_SPARK_13_CONTRIBUTOR, source: META_SPARK_CONTRIBUTOR_SOURCE, verifiedAt: "2026-09-03", status: "verified" },
+  { provider: "meta-model", modelId: "muse-wonder-1.0", cost4: META_MUSE_WONDER_10, source: META_SPARK_SOURCE, verifiedAt: "2026-10-13", status: "verified" },
   // Same endpoint, same list price, different credential. Meta does not authorize this
   // reuse and settlement is not observable, so these are the public Model API rates as a
   // conservative estimate — not evidence of how the call is actually billed.
   { provider: "meta-muse", modelId: "muse-spark-1.3", cost4: META_MUSE_SPARK_13, source: META_SPARK_SOURCE, verifiedAt: "2026-09-03", status: "verified-derived" },
   { provider: "meta-muse", modelId: "muse-spark-1.3-contributor", cost4: META_MUSE_SPARK_13_CONTRIBUTOR, source: META_SPARK_CONTRIBUTOR_SOURCE, verifiedAt: "2026-09-03", status: "verified-derived" },
+  { provider: "meta-muse", modelId: "muse-wonder-1.0", cost4: META_MUSE_WONDER_10, source: META_SPARK_SOURCE, verifiedAt: "2026-10-13", status: "verified-derived" },
   // Daybreak aliases: priced as their current snapshots (red -> gpt-5.6-cyber,
   // blue -> gpt-5.6-sol). The alias ids carry no rows of their own upstream, hence
   // verified-derived. Blue deliberately reuses GPT56_SOL rather than duplicating the tuple.
@@ -399,6 +414,7 @@ export const EXPECTED_PRICE_OVERLAYS: readonly ExpectedPriceOverlay[] = [
   // Developer API row: the price IS published for this surface, so `verified`.
   { provider: "google", modelId: "gemini-3.7-flash", cost4: GEMINI_37_FLASH, source: GEMINI_37_PRICING, verifiedAt: "2026-08-14", status: "verified" },
   { provider: "google", modelId: "gemini-3.8-flash", cost4: GEMINI_38_FLASH, source: GEMINI_38_PRICING, verifiedAt: "2026-09-03", status: "verified" },
+  { provider: "google", modelId: "gemini-4-argon", cost4: GEMINI_4_ARGON, source: GEMINI_4_ARGON_PRICING, verifiedAt: "2026-10-14", status: "verified" },
   { provider: "google-antigravity", modelId: "gemini-3.1-pro-preview", cost4: GEMINI_31_PRO, source: GEMINI_PRICING, verifiedAt: "2026-07-20", status: "verified" },
   // Antigravity-bundled third-party models — derived from the underlying vendor's
   // official API price (Antigravity itself bills via subscription quota).

package/src/usage/log.ts

@@ -23,7 +23,7 @@ import { normalizeRouteDecisionTrace, type RouteDecisionTraceV1 } from "../routi
 import { parseProtocolTraceV1, type ProtocolTraceV1 } from "../protocols/dto";
 import { ACCOUNT_LOG_LABEL_RE, CODEX_ACCOUNT_LOG_LABEL_RE } from "../codex/account-label";
 import { claudeCompatibilityReason, normalizeClaudeFeatureCodes, type ClaudeFeatureCode } from "../claude/compatibility";
-import type { CodexWsStageRecord } from "../server/responses/codex-ws-wire";
+import type { CodexWsStageRecord, CodexWsTerminalEvent } from "../server/responses/codex-ws-wire";
 import {
   ATTEMPT_RECOVERY_KIND_ROSTER,
   ATTEMPT_RECOVERY_WITHHELD_ROSTER,
@@ -805,6 +805,15 @@ function normalizeUsageAttempt(raw: unknown): PersistedUsageAttempt | null {
  * injected free-form field — drops the whole record rather than passing
  * attacker text into the DTO.
  */
+// Total over the terminal union by `satisfies`; a type-only import keeps the WS transport out of
+// this module's runtime graph.
+const CODEX_WS_TERMINAL_EVENT_NAMES = {
+  "response.completed": true,
+  "response.failed": true,
+  "response.incomplete": true,
+  error: true,
+} as const satisfies Record<CodexWsTerminalEvent, true>;
+
 function normalizeCodexWsStageRecord(value: unknown): CodexWsStageRecord | undefined {
   if (value === null || typeof value !== "object" || Array.isArray(value)) return undefined;
   const stage = value as Record<string, unknown>;
@@ -839,6 +848,15 @@ function normalizeCodexWsStageRecord(value: unknown): CodexWsStageRecord | undef
     reused: stage.reused,
     ocxVersion: stage.ocxVersion,
     bunVersion: stage.bunVersion,
+    // #6740 fields are newer than the record: absent or malformed values read as unobserved
+    // rather than costing the row the rest of its stage evidence.
+    terminalEvent: typeof stage.terminalEvent === "string" && Object.hasOwn(CODEX_WS_TERMINAL_EVENT_NAMES, stage.terminalEvent)
+      ? stage.terminalEvent as CodexWsTerminalEvent
+      : null,
+    terminalErrorStatus: typeof stage.terminalErrorStatus === "number" && Number.isInteger(stage.terminalErrorStatus)
+      && stage.terminalErrorStatus >= 100 && stage.terminalErrorStatus <= 599
+      ? stage.terminalErrorStatus
+      : null,
   };
 }
 

package/src/web-search/gemini-executor.ts

@@ -15,7 +15,7 @@ import { cancelBodyOnAbort, signalWithTimeout } from "../lib/abort";
 import { readBoundedResponseBytes } from "../lib/bounded-body";
 import { sidecarEnter } from "../lib/sidecar-tracker";
 import { redactSecretString } from "../lib/redact";
-import { ANTIGRAVITY_REQUEST_UA } from "../adapters/google-antigravity-wire";
+import { antigravityUserAgentForWireModel } from "../adapters/google-antigravity-wire";
 import { resolveAntigravityEffortWireModel } from "../providers/antigravity-models";
 import { getProviderRegistryEntry } from "../providers/registry";
 import { MAX_SIDECAR_RESPONSE_BYTES, type WebSearchSource } from "./parse";
@@ -74,7 +74,7 @@ export async function runGeminiWebSearch(
         headers: {
           "Content-Type": "application/json",
           "Authorization": `Bearer ${token}`,
-          "User-Agent": ANTIGRAVITY_REQUEST_UA,
+          "User-Agent": antigravityUserAgentForWireModel(wireModelId),
         },
         body: JSON.stringify(envelope),
         signal: linkedSignal.signal,