@bitkyc08/opencodex 2.84.0 → 2.86.0

package/src/protocols/settings.ts

@@ -64,6 +64,7 @@ export interface ProtocolRolloutSettings {
   managedMessagesNative: boolean;
   managedMessagesNativeOAuth: boolean;
   directEncoders: boolean;
+  antigravityDirect: boolean;
   shadowPlan: boolean;
 }
 
@@ -101,6 +102,12 @@ export function resolveProtocolSettings(config: ProtocolConfig, providerName?: s
       // OAuth extension is meaningless without the key-auth path it extends.
       managedMessagesNativeOAuth: managedMessagesNative && nativeOn("managedMessagesNativeOAuth"),
       directEncoders: on("directEncoders"),
+      // Default on: an absent switch takes the Antigravity direct lane, which falls back to the
+      // bridge per request whenever its eligibility rule declines. Only an explicit `false` turns
+      // it off; a non-boolean value or a malformed container fails closed like every other switch.
+      antigravityDirect: validContainers && (Object.hasOwn(rollout, "antigravityDirect")
+        ? rollout.antigravityDirect === true
+        : true),
       shadowPlan: on("shadowPlan"),
     }),
   });
@@ -145,6 +152,7 @@ export function protocolPolicyRevision(config: ProtocolConfig & Pick<OcxConfig,
       secondarySettings.rollout.managedMessagesNative,
       secondarySettings.rollout.managedMessagesNativeOAuth,
       settings.rollout.directEncoders,
+      settings.rollout.antigravityDirect,
       settings.rollout.shadowPlan,
     ],
   });

package/src/providers/antigravity-account-roster.ts

@@ -0,0 +1,102 @@
+import { getConfigDir } from "../config/paths";
+import { ANTIGRAVITY_MODEL_ALIASES, canonicalAntigravityUsageModel, type AntigravityAvailableModel } from "./antigravity-models";
+
+/**
+ * Per-account Antigravity model rosters, taken from each account's own live
+ * `:fetchAvailableModels` discovery.
+ *
+ * Google gates models per account, not per client. Measured 2026-10-14: one account lists
+ * `claude-sonnet-4-6` / `claude-opus-4-6-thinking` and answers 404 "Requested entity was not
+ * found" for every `claude-{opus,sonnet}-5-5-*` id, while other accounts list only the 5.5
+ * families. Gemini 4 Argon is likewise Ultra / Enterprise only. Google documents Claude 5.5 as
+ * needing a directly billed, non-trial Pro or Ultra plan and rolls it out gradually, so the static
+ * lineup is a superset and only discovery says what one account can actually call.
+ *
+ * The catalog already exposes only the ACTIVE account's discovered rows (an authoritative live
+ * roster drops static rows it did not return). This store keeps every account's last roster so
+ * that account selection can prefer an account that lists the requested model, instead of
+ * landing a 5.5 request on a 4.6-only account. Absence of a roster is "unknown", never "no":
+ * an account that was never active during discovery stays fully usable.
+ */
+
+/** A roster older than this is treated as unknown; entitlements change with plan and rollout. */
+export const ANTIGRAVITY_ACCOUNT_ROSTER_TTL_MS = 6 * 60 * 60 * 1000;
+
+interface AccountRoster {
+  readonly ids: ReadonlySet<string>;
+  readonly modelIds: readonly string[];
+  readonly observedAt: number;
+}
+
+const rosters = new Map<string, AccountRoster>();
+
+function rosterKey(providerName: string, accountId: string): string {
+  return `${getConfigDir()}\0${providerName}\0${accountId}`;
+}
+
+/** Record one account's discovered roster: picker ids, representative wire ids, and tier wire ids. */
+export function recordAntigravityAccountRoster(
+  providerName: string,
+  accountId: string,
+  models: readonly AntigravityAvailableModel[],
+  now = Date.now(),
+): void {
+  if (!providerName || !accountId) return;
+  const ids = new Set<string>();
+  for (const model of models) {
+    ids.add(model.id);
+    ids.add(model.wireModelId);
+    for (const wire of Object.values(model.effortWireModelIds ?? {})) if (wire) ids.add(wire);
+  }
+  rosters.set(rosterKey(providerName, accountId), {
+    ids,
+    modelIds: models.map(model => model.id),
+    observedAt: now,
+  });
+}
+
+function freshRoster(providerName: string, accountId: string, now: number): AccountRoster | undefined {
+  const roster = rosters.get(rosterKey(providerName, accountId));
+  if (!roster || now - roster.observedAt > ANTIGRAVITY_ACCOUNT_ROSTER_TTL_MS) return undefined;
+  return roster;
+}
+
+/** The picker ids one account's last discovery returned, or `undefined` when unknown. */
+export function antigravityAccountRosterModelIds(
+  providerName: string,
+  accountId: string,
+  now = Date.now(),
+): readonly string[] | undefined {
+  return freshRoster(providerName, accountId, now)?.modelIds;
+}
+
+/**
+ * Whether one account's roster lists `modelId`: `true` / `false` from its last discovery,
+ * `undefined` when that account has no fresh roster. A picker id, one of its tier wire ids, or a
+ * compatibility alias of either all count as listed.
+ */
+export function antigravityAccountSupportsModel(
+  providerName: string,
+  accountId: string,
+  modelId: string,
+  now = Date.now(),
+): boolean | undefined {
+  const roster = freshRoster(providerName, accountId, now);
+  if (!roster) return undefined;
+  const id = modelId.trim();
+  if (!id) return undefined;
+  if (roster.ids.has(id)) return true;
+  const canonical = canonicalAntigravityUsageModel(id);
+  if (roster.ids.has(canonical)) return true;
+  const alias = Object.hasOwn(ANTIGRAVITY_MODEL_ALIASES, id) ? ANTIGRAVITY_MODEL_ALIASES[id] : undefined;
+  return alias !== undefined && roster.ids.has(alias);
+}
+
+/** Forget rosters (one account, or all). For account removal and tests. */
+export function clearAntigravityAccountRosters(providerName?: string, accountId?: string): void {
+  if (providerName && accountId) {
+    rosters.delete(rosterKey(providerName, accountId));
+    return;
+  }
+  rosters.clear();
+}

package/src/providers/antigravity-models.ts

@@ -17,6 +17,21 @@ import { readAntigravityWireSnapshot, writeAntigravityWireSnapshot, type Antigra
 /** Current Antigravity Flash generation. */
 const GEMINI_FLASH_CURRENT = "gemini-3.8-flash";
 
+/**
+ * Gemini 4 Argon. Like 3.8 it publishes one wire id per tier (`-low/-medium/-high`) and no
+ * `-tiered` row, verified 2026-10-14 against live CCA. CCA serves these ids only to the CLI
+ * User-Agent (see antigravityUserAgentForWireModel), and only to AI Ultra / Enterprise accounts.
+ */
+const GEMINI_ARGON = "gemini-4-argon";
+
+/**
+ * Claude 5.5 on Antigravity: one wire id per tier (`-low/-medium/-high`), each 1,000,000 tokens
+ * with image input, observed in live CCA discovery on 2026-10-03
+ * (devlog/_fin/261003_release_lane_c). They ride the IDE User-Agent like every non-Argon model.
+ */
+const CLAUDE_OPUS_55 = "claude-opus-5-5";
+const CLAUDE_SONNET_55 = "claude-sonnet-5-5";
+
 /**
  * Previous Flash generation — still served, still picker-visible.
  *
@@ -75,6 +90,15 @@ const ANTIGRAVITY_WIRE_MODELS = [
 ];
 
 const ANTIGRAVITY_PICKER_MODEL_BY_WIRE_ID: Record<string, string> = {
+  "claude-opus-5-5-low": CLAUDE_OPUS_55,
+  "claude-opus-5-5-medium": CLAUDE_OPUS_55,
+  "claude-opus-5-5-high": CLAUDE_OPUS_55,
+  "claude-sonnet-5-5-low": CLAUDE_SONNET_55,
+  "claude-sonnet-5-5-medium": CLAUDE_SONNET_55,
+  "claude-sonnet-5-5-high": CLAUDE_SONNET_55,
+  "gemini-4-argon-low": GEMINI_ARGON,
+  "gemini-4-argon-medium": GEMINI_ARGON,
+  "gemini-4-argon-high": GEMINI_ARGON,
   "gemini-3.8-flash-low": "gemini-3.8-flash",
   "gemini-3.8-flash-medium": "gemini-3.8-flash",
   "gemini-3.8-flash-high": "gemini-3.8-flash",
@@ -164,8 +188,11 @@ function collapsesIntoKnownPickerModel(candidateId: string): boolean {
 // Claude Opus: effort → thinkingConfig.thinkingLevel (CLIProxyAPI proven pattern).
 export const ANTIGRAVITY_MODEL_EFFORTS: Record<string, string[]> = {
   // No `minimal`: Google documents it as an error for this generation, and CCA exposes only
-  // the three tiers.
+  // the three tiers. Argon documents the same ladder (`minimal` is an HTTP 400).
+  [GEMINI_ARGON]: ["low", "medium", "high"],
   "gemini-3.8-flash": ["low", "medium", "high"],
+  [CLAUDE_OPUS_55]: ["low", "medium", "high"],
+  [CLAUDE_SONNET_55]: ["low", "medium", "high"],
   "gemini-3.7-flash": ["low", "medium", "high"],
   "gemini-3.1-pro": ["low", "high"],
   "claude-sonnet-4-6": ["low", "medium", "high", "max"],
@@ -175,7 +202,23 @@ export const ANTIGRAVITY_MODEL_EFFORTS: Record<string, string[]> = {
 // ── Effort → wire model map for Gemini base models ──
 const ANTIGRAVITY_EFFORT_WIRE_MAP: Record<string, Record<string, string>> = {
   // 3.8 publishes one wire id per tier and no `-tiered` row, so its efforts ride the suffix.
-  // This is the 3.6 shape, not the 3.7 one.
+  // This is the 3.6 shape, not the 3.7 one. Argon has the same shape.
+  [GEMINI_ARGON]: {
+    low: "gemini-4-argon-low",
+    medium: "gemini-4-argon-medium",
+    high: "gemini-4-argon-high",
+  },
+  // Claude 5.5 publishes the same per-tier suffix family.
+  [CLAUDE_OPUS_55]: {
+    low: "claude-opus-5-5-low",
+    medium: "claude-opus-5-5-medium",
+    high: "claude-opus-5-5-high",
+  },
+  [CLAUDE_SONNET_55]: {
+    low: "claude-sonnet-5-5-low",
+    medium: "claude-sonnet-5-5-medium",
+    high: "claude-sonnet-5-5-high",
+  },
   "gemini-3.8-flash": {
     low: "gemini-3.8-flash-low",
     medium: "gemini-3.8-flash-medium",
@@ -198,7 +241,7 @@ const ANTIGRAVITY_EFFORT_WIRE_MAP: Record<string, Record<string, string>> = {
  * `gemini-3.1-pro` is deliberately absent: its `high` rung is `gemini-pro-agent`, which carries
  * no tier suffix, so there the level is the only thing naming the effort.
  */
-const ANTIGRAVITY_SUFFIX_TIER_MODELS = new Set(["gemini-3.8-flash"]);
+const ANTIGRAVITY_SUFFIX_TIER_MODELS = new Set([GEMINI_ARGON, "gemini-3.8-flash", CLAUDE_OPUS_55, CLAUDE_SONNET_55]);
 
 function completeDiscoveredEffortWireModelIds(
   pickerId: string,
@@ -223,7 +266,11 @@ function completeDiscoveredEffortWireModelIds(
 // ── Default effort per Gemini base model ──
 const ANTIGRAVITY_DEFAULT_EFFORT: Record<string, string> = {
   // Google's documented thinking_level default, and the tier CCA marks `recommended`.
+  [GEMINI_ARGON]: "medium",
   "gemini-3.8-flash": "medium",
+  // Matches the discovered-family default (medium), so static and live resolution agree.
+  [CLAUDE_OPUS_55]: "medium",
+  [CLAUDE_SONNET_55]: "medium",
   "gemini-3.1-pro": "high",
 };
 
@@ -285,9 +332,25 @@ export const ANTIGRAVITY_MODEL_ALIASES: Record<string, string> = {
   ...ANTIGRAVITY_COMPATIBILITY_MODEL_ALIASES,
 };
 
-// Picker-visible: collapsed base models only.
+// Static picker lineup: collapsed base models only, exactly "3.8 / 4 / 5.5 / 5.5" (2026-10-14).
+// Anything else reaches the picker only when live discovery returns it.
 export const ANTIGRAVITY_MODELS = [
   GEMINI_FLASH_CURRENT,
+  GEMINI_ARGON,
+  CLAUDE_OPUS_55,
+  CLAUDE_SONNET_55,
+];
+
+/**
+ * Every base id the routing and discovery rules recognise: the static lineup plus models that
+ * left it. Removing a model from the picker must not change how a saved selection routes or how
+ * a discovered row collapses, so these legacy bases stay known here. Live discovery on
+ * 2026-10-14 no longer returns gemini-3.7-flash(-tiered) or the gemini-3.1-pro wire ids (both
+ * 404), but still returns the Claude 4.6 rows and gpt-oss-120b-medium, which therefore keep
+ * appearing through discovery.
+ */
+export const ANTIGRAVITY_KNOWN_PICKER_MODELS: readonly string[] = [
+  ...ANTIGRAVITY_MODELS,
   GEMINI_FLASH_PREVIOUS,
   "gemini-3.1-pro",
   "gemini-3.1-flash-image",
@@ -297,11 +360,20 @@ export const ANTIGRAVITY_MODELS = [
 ];
 
 function isKnownAntigravityPickerModelId(value: string): boolean {
-  return isValidModelDiscoveryModelId(value) && ANTIGRAVITY_MODELS.includes(value);
+  return isValidModelDiscoveryModelId(value) && ANTIGRAVITY_KNOWN_PICKER_MODELS.includes(value);
 }
 
 // Context windows from the upstream `:fetchAvailableModels` maxTokens per model.
 const ANTIGRAVITY_WIRE_MODEL_CONTEXT_WINDOWS: Record<string, number> = {
+  "claude-opus-5-5-low": 1_000_000,
+  "claude-opus-5-5-medium": 1_000_000,
+  "claude-opus-5-5-high": 1_000_000,
+  "claude-sonnet-5-5-low": 1_000_000,
+  "claude-sonnet-5-5-medium": 1_000_000,
+  "claude-sonnet-5-5-high": 1_000_000,
+  "gemini-4-argon-low": 1_048_576,
+  "gemini-4-argon-medium": 1_048_576,
+  "gemini-4-argon-high": 1_048_576,
   "gemini-3.8-flash-low": 1_048_576,
   "gemini-3.8-flash-medium": 1_048_576,
   "gemini-3.8-flash-high": 1_048_576,
@@ -316,7 +388,10 @@ const ANTIGRAVITY_WIRE_MODEL_CONTEXT_WINDOWS: Record<string, number> = {
 
 export const ANTIGRAVITY_MODEL_CONTEXT_WINDOWS: Record<string, number> = {
   // Collapsed base IDs — explicit entries for the picker.
+  [GEMINI_ARGON]: 1_048_576,
   "gemini-3.8-flash": 1_048_576,
+  [CLAUDE_OPUS_55]: 1_000_000,
+  [CLAUDE_SONNET_55]: 1_000_000,
   "gemini-3.7-flash": 1_048_576,
   "gemini-3.1-pro": 1_048_576,
   // Wire IDs and aliases via derivation.
@@ -330,6 +405,9 @@ export const ANTIGRAVITY_MODEL_CONTEXT_WINDOWS: Record<string, number> = {
 };
 
 export const ANTIGRAVITY_MODEL_INPUT_MODALITIES: Record<string, string[]> = {
+  [GEMINI_ARGON]: ["text", "image"],
+  [CLAUDE_OPUS_55]: ["text", "image"],
+  [CLAUDE_SONNET_55]: ["text", "image"],
   // Google documents 3.7 Flash as also accepting video, audio and PDF, but this proxy
   // carries only text and image parts (`OcxImageContent`, src/types.ts) and the Codex
   // catalog normalizes `input_modalities` against a closed enum. Advertising a modality
@@ -641,7 +719,7 @@ export function resolveAntigravityWireModelId(modelId: string, baseUrl?: string)
  * IS the effort, and sending both creates a contradictory request.
  */
 export function isAntigravitySuffixModelId(modelId: string): boolean {
-  return !(ANTIGRAVITY_MODELS as string[]).includes(modelId);
+  return !ANTIGRAVITY_KNOWN_PICKER_MODELS.includes(modelId);
 }
 
 /** The reasoning tier a retired Flash id used to encode, if it is one. */
@@ -753,7 +831,7 @@ export function resolveAntigravityEffortWireModel(
 // summary aggregation consults this reverse map so one call model = one usage row.
 const ANTIGRAVITY_USAGE_BASE_BY_ID: Record<string, string> = (() => {
   const rev: Record<string, string> = {};
-  for (const base of ANTIGRAVITY_MODELS) rev[base] = base;
+  for (const base of ANTIGRAVITY_KNOWN_PICKER_MODELS) rev[base] = base;
   for (const [base, effortMap] of Object.entries(ANTIGRAVITY_EFFORT_WIRE_MAP)) {
     rev[base] = base;
     for (const wire of Object.values(effortMap)) rev[wire] = base;

package/src/providers/model-rename-fields.ts

@@ -59,6 +59,7 @@ export const PROVIDER_MODEL_RENAME_ROLES = {
   newModelPolicy: "none",
   modelPreset: "none",
   contextWindow: "none",
+  inferContextWindow: "none",
   modelContextWindows: "record",
   modelContextTiers: "record",
   modelInputModalities: "record",
@@ -66,6 +67,7 @@ export const PROVIDER_MODEL_RENAME_ROLES = {
   modelMaxInputTokens: "record",
   modelAutoCompactTokenLimits: "record",
   defaultMaxOutputTokens: "none",
+  minMaxOutputTokens: "none",
   modelMaxOutputTokens: "record",
   modelCosts: "record",
   autoReviewModel: "none",

package/src/providers/model-rename-migration.ts

@@ -124,16 +124,18 @@ export const MODEL_RENAMES: readonly ModelRename[] = [
   // Assist almost immediately when the next ships, so a saved 3.6 (or older 3.5) id is a
   // dead selection rather than a merely outdated one. Routing already redirects these ids
   // at request time; this migration repairs the saved config so the picker, the allowlist
-  // and the capability maps stop naming a model the backend no longer serves.
+  // and the capability maps stop naming a model the backend no longer serves. The target is
+  // the live 3.8 base: 3.7 left the static lineup on 2026-10-14 (CCA 404s its wire id), and
+  // registrySeedsTarget refuses to write an id the registry no longer seeds.
   ...(["gemini-3.6-flash", "gemini-3.6-flash-low", "gemini-3.6-flash-medium", "gemini-3.6-flash-high",
     "gemini-3.5-flash-extra-low", "gemini-3.5-flash-low", "gemini-3.5-flash-mid", "gemini-3.5-flash-high",
     "gemini-3-flash-agent"] as const).map(from => ({
     provider: "google-antigravity",
     from,
-    to: "gemini-3.7-flash",
+    to: "gemini-3.8-flash",
     reason: "Google retires the previous Antigravity Flash generation from Cloud Code Assist when its successor ships, so the saved id no longer resolves to a live model",
     // The retired Flash tiers were wire ids, so any saved per-model record keyed by one
-    // may also hold one as a value. 3.7 expresses tiers as thinkingLevel names instead.
+    // may also hold one as a value. 3.8 resolves tiers from its own suffix ladder instead.
     dropReasoningEffortMap: true,
   })),
 ];

package/src/providers/registry/entries-core.ts

@@ -1140,10 +1140,8 @@ export const PROVIDER_REGISTRY_CORE: readonly ProviderRegistryEntry[] = [
     // https://cf.api.fan/v1 — GET /v1/models answers 401 without a key, so the host is live and
     // discovery narrows to what the key's token group allows. Model ids are bare OpenAI-style
     // ids (the Codex token group lists gpt-5.5 / gpt-5.1-codex).
-    // Standard sponsor under SPONSORS.md; the dashboardUrl carries their affiliate code.
     id: "packycode", label: "PackyCode", adapter: "openai-chat", baseUrl: "https://cf.api.fan/v1",
-    authKind: "key", dashboardUrl: "https://www.packyapi.com/register?aff=k5KT",
-    sponsor: { tier: "standard", url: "https://www.packyapi.com/register?aff=k5KT" },
+    authKind: "key", dashboardUrl: "https://www.packyapi.com",
     defaultModel: "gpt-5.5",
     models: ["gpt-5.5", "gpt-5.1-codex"],
     liveModels: true,
@@ -1170,13 +1168,16 @@ export const PROVIDER_REGISTRY_CORE: readonly ProviderRegistryEntry[] = [
   // devlog/_plan/260710_provider_hardening/001_research_frontier.md.
   {
     id: "google", label: "Google Gemini", adapter: "google", baseUrl: "https://generativelanguage.googleapis.com", authKind: "key", featured: true,
-    dashboardUrl: "https://aistudio.google.com/apikey", defaultModel: "gemini-3.5-flash", models: ["gemini-3.8-flash", "gemini-3.6-flash", "gemini-3.5-flash", "gemini-3.5-flash-lite", "gemini-3.1-pro-preview", "gemini-3.7-flash"],
-    modelContextWindows: { "gemini-3.8-flash": 1_048_576, "gemini-3.6-flash": 1_048_576, "gemini-3.5-flash": 1_000_000, "gemini-3.5-flash-lite": 1_048_576, "gemini-3.7-flash": 1_048_576 },
-    modelInputModalities: { "gemini-3.8-flash": ["text", "image"], "gemini-3.6-flash": ["text", "image"], "gemini-3.5-flash-lite": ["text", "image"], "gemini-3.7-flash": ["text", "image"] },
+    dashboardUrl: "https://aistudio.google.com/apikey", defaultModel: "gemini-3.5-flash", models: ["gemini-4-argon", "gemini-3.8-flash", "gemini-3.6-flash", "gemini-3.5-flash", "gemini-3.5-flash-lite", "gemini-3.1-pro-preview", "gemini-3.7-flash"],
+    modelContextWindows: { "gemini-4-argon": 1_048_576, "gemini-3.8-flash": 1_048_576, "gemini-3.6-flash": 1_048_576, "gemini-3.5-flash": 1_000_000, "gemini-3.5-flash-lite": 1_048_576, "gemini-3.7-flash": 1_048_576 },
+    modelInputModalities: { "gemini-4-argon": ["text", "image"], "gemini-3.8-flash": ["text", "image"], "gemini-3.6-flash": ["text", "image"], "gemini-3.5-flash-lite": ["text", "image"], "gemini-3.7-flash": ["text", "image"] },
     modelReasoningEfforts: {
       // 3.7 and 3.8 omit `minimal`: Google documents it as a validation error on both model
       // pages, so advertising it hands the user a rung the API rejects. 3.5/3.6 keep theirs —
       // their pages still list it, and this unit has no evidence to change them.
+      // Gemini 4 Argon (GA 2026-10-13): low/medium(default)/high; `minimal` and thinking_budget
+      // return HTTP 400 per ai.google.dev/gemini-api/docs/models/gemini-4-argon.
+      "gemini-4-argon": ["low", "medium", "high"],
       "gemini-3.8-flash": ["low", "medium", "high"],
       "gemini-3.7-flash": ["low", "medium", "high"],
       "gemini-3.6-flash": ["minimal", "low", "medium", "high"],

package/src/providers/registry/entries-extended.ts

@@ -1247,6 +1247,25 @@ export const PROVIDER_REGISTRY_EXTENDED: readonly ProviderRegistryEntry[] = [
     },
     note: "OpenAI-compatible API gateway. Create a workspace API key at tokenlab.sh. Live discovery lists tool-capable chat models available to your key and delivery policy.",
   },
+  {
+    // Modelflare: OpenAI-compatible relay at https://modelflare.dev/v1 (an Anthropic Messages
+    // surface also answers at https://modelflare.dev/v1/messages). Live-checked 2026-10-13 through
+    // the proxy: chat, streaming and tool calls succeed on Chat for all four seeded models, and a
+    // real `codex exec` turn completed on glm-5.3-flash. GET /v1/models lists ~77 rows mixing chat,
+    // image and video models, and includes deepseek-v4.1-flash, which answers 503 on every call,
+    // so the preset seeds the verified chat models statically instead of trusting live discovery.
+    // The conventional env reference derived from the id is ${MODELFLARE_API_KEY}.
+    id: "modelflare",
+    label: "Modelflare",
+    adapter: "openai-chat",
+    baseUrl: "https://modelflare.dev/v1",
+    authKind: "key",
+    dashboardUrl: "https://modelflare.dev",
+    preserveCustomDestination: true,
+    defaultModel: "glm-5.3-flash",
+    models: ["glm-5.3-flash", "claude-sonnet-5-5", "gpt-6.1-sol", "deepseek-v4-flash"],
+    note: "OpenAI-compatible relay for Claude, GPT, GLM and DeepSeek chat models. The seeded models were verified with chat, streaming and tool calls; deepseek-v4.1-flash is listed upstream but currently answers 503 and is left out. An ordinary key only reaches its own routing group's models; a Smart key reaches all seeded models. Image and video models are not served through this Chat preset. Upstream latency varies widely (a few seconds to about 30 s) with occasional transient 503s.",
+  },
   {
     id: "opencode-free",
     label: "OpenCode Free",

package/src/responses/parser.ts

@@ -66,6 +66,35 @@ function repairJsonObjectEnvelope(text: string): Record<string, unknown> | undef
   return undefined;
 }
 
+/**
+ * Decode a function call's serialized arguments the way history replay tolerates them: empty
+ * or non-JSON text becomes `{}` instead of failing every later turn, and the one bounded
+ * lost-brace corruption above is repaired. Shared with the direct Chat decoder
+ * (`src/protocols/codecs/chat-ir.ts`) so both decode the same call to the same object.
+ */
+export function functionCallArgumentsFromText(callId: string, rawArguments: string | undefined): Record<string, unknown> {
+  let args: Record<string, unknown> = {};
+  const rawArgs = rawArguments?.trim();
+  if (rawArgs) {
+    try {
+      const parsed: unknown = JSON.parse(rawArgs);
+      if (isObj(parsed)) args = parsed;
+    } catch {
+      // One observed serialization corruption loses exactly the JSON object's opening
+      // brace; the closed envelope is tight enough to repair back into a call the
+      // routed model can still see and retry, instead of replaying {} forever.
+      const repaired = repairJsonObjectEnvelope(rawArgs);
+      if (repaired === undefined) {
+        console.warn(`[parser] function_call ${callId} has non-JSON arguments; defaulting to {}`);
+      } else {
+        args = repaired;
+        console.warn(`[parser] function_call ${callId} arguments lost the JSON opening brace; repaired from history`);
+      }
+    }
+  }
+  return args;
+}
+
 
 
 function ensureAssistantPlaceholder(messages: OcxMessage[], modelId: string, now: number): OcxAssistantMessage {
@@ -397,25 +426,7 @@ export function parseRequest(
         const call = item as { id?: string; call_id: string; name: string; arguments?: string; namespace?: string; extra_content?: unknown };
         // Tolerate empty/non-JSON arguments (e.g. a no-arg tool call serialized as "") instead of
         // throwing — a single poisoned history item would otherwise 400 every subsequent turn.
-        let args: Record<string, unknown> = {};
-        const rawArgs = call.arguments?.trim();
-        if (rawArgs) {
-          try {
-            const parsed: unknown = JSON.parse(rawArgs);
-            if (isObj(parsed)) args = parsed;
-          } catch {
-            // One observed serialization corruption loses exactly the JSON object's opening
-            // brace; the closed envelope is tight enough to repair back into a call the
-            // routed model can still see and retry, instead of replaying {} forever.
-            const repaired = repairJsonObjectEnvelope(rawArgs);
-            if (repaired === undefined) {
-              console.warn(`[parser] function_call ${call.call_id} has non-JSON arguments; defaulting to {}`);
-            } else {
-              args = repaired;
-              console.warn(`[parser] function_call ${call.call_id} arguments lost the JSON opening brace; repaired from history`);
-            }
-          }
-        }
+        const args = functionCallArgumentsFromText(call.call_id, call.arguments);
         // Do NOT map Responses item `id` (fc_/ctc_/…) onto `thoughtSignature`. That field is
         // reserved for Gemini/Antigravity opaque thought tokens; forwarding item ids as
         // thoughtSignature 400s Antigravity (Base64 / TYPE_BYTES). Continuity for CCA comes from

package/src/responses/state.ts

@@ -710,11 +710,6 @@ export function sweepOrphanedResponseSpills(): number {
 type SnapshotWriteOutcome = "stable" | "unstable" | "failed";
 
 async function writeBoundedSnapshot(path: string, attemptLimit: number): Promise<SnapshotWriteOutcome> {
-  // Serialize writers so concurrent flush + debounce cannot race on temps / ACL (#612).
-  const previous = persistGate;
-  let release!: () => void;
-  persistGate = new Promise<void>(resolve => { release = resolve; });
-  await previous;
   try {
     for (let attempt = 0; attempt < attemptLimit; attempt += 1) {
       const revision = stateRevision;
@@ -751,13 +746,19 @@ async function writeBoundedSnapshot(path: string, attemptLimit: number): Promise
         lastSnapshotTarget = resolveWriteTarget(path);
       }
       persistAttemptHookForTests?.();
-      if (revision === stateRevision) return "stable";
+      if (revision === stateRevision) {
+        // Cancel only the timer whose mutation this stable revision includes,
+        // before an awaiting caller's microtask can record a newer revision.
+        if (persistTimer) clearTimeout(persistTimer);
+        persistTimer = null;
+        pendingPersistPath = null;
+        drainPendingSpillUnlinks();
+        return "stable";
+      }
     }
     return "unstable";
   } catch {
     return "failed";
-  } finally {
-    release();
   }
 }
 
@@ -792,21 +793,30 @@ function schedulePersistAt(path: string, replace = false): void {
 }
 
 async function persistNow(path: string, awaitFollowUp = false): Promise<void> {
-  if (persistTimer) {
-    clearTimeout(persistTimer);
-    persistTimer = null;
-  }
-  pendingPersistPath = null;
-  const attemptLimit = awaitFollowUp ? MAX_SNAPSHOT_REWRITE_ATTEMPTS : 1;
-  let outcome = await writeBoundedSnapshot(path, attemptLimit);
-  if (outcome === "unstable" && awaitFollowUp) {
-    if (persistTimer) clearTimeout(persistTimer);
-    persistTimer = null;
+  // Include follow-up scheduling in the gate: releasing after only the disk write
+  // lets shutdown observe an empty timer before the background pass re-arms it.
+  const previous = persistGate;
+  let release!: () => void;
+  persistGate = new Promise<void>(resolve => { release = resolve; });
+  await previous;
+  try {
+    if (persistTimer) {
+      clearTimeout(persistTimer);
+      persistTimer = null;
+    }
     pendingPersistPath = null;
-    outcome = await writeBoundedSnapshot(path, attemptLimit);
+    const attemptLimit = awaitFollowUp ? MAX_SNAPSHOT_REWRITE_ATTEMPTS : 1;
+    let outcome = await writeBoundedSnapshot(path, attemptLimit);
+    if (outcome === "unstable" && awaitFollowUp) {
+      if (persistTimer) clearTimeout(persistTimer);
+      persistTimer = null;
+      pendingPersistPath = null;
+      outcome = await writeBoundedSnapshot(path, attemptLimit);
+    }
+    if (outcome === "unstable" && !awaitFollowUp) schedulePersistAt(path, true);
+  } finally {
+    release();
   }
-  if (outcome === "stable") drainPendingSpillUnlinks();
-  else if (outcome === "unstable" && !awaitFollowUp) schedulePersistAt(path, true);
 }
 
 function schedulePersist(): void {
@@ -816,15 +826,8 @@ function schedulePersist(): void {
 }
 
 async function flushResponseSnapshot(): Promise<void> {
-  if (persistTimer) {
-    await persistNow(pendingPersistPath ?? snapshotPath(), true);
-    return;
-  }
-  // No pending timer: still await any in-flight write so shutdown does not race (#612).
+  // The gate includes the background pass's timer decision, not just its write.
   await persistGate;
-  // A bounded background pass may have scheduled its same-path follow-up while
-  // this flush was waiting on the single-flight gate. Shutdown owns one awaited
-  // bounded follow-up rather than returning behind that unref'd timer.
   if (persistTimer) await persistNow(pendingPersistPath ?? snapshotPath(), true);
 }