@bitkyc08/opencodex 2.84.0 → 2.87.0

package/src/providers/request-pacing.ts

@@ -1,4 +1,5 @@
 import type { OcxProviderConfig, RequestPacingRule } from "../types";
+import { createHash } from "node:crypto";
 import type { GenerationContext } from "../lib/state-store-sweeper";
 import { carryReplayRefusal, isNonReplayableResponse, markResponseNonReplayable } from "../lib/upstream-retry";
 import { redactSecretString } from "../lib/redact";
@@ -39,7 +40,7 @@ export function registerProviderResponseProvenance(markers: WeakMap<Response, un
   responseProvenance.add(markers);
 }
 
-export type RequestPacingQueueOverloadReason = "queue_full" | "queue_expired";
+export type RequestPacingQueueOverloadReason = "queue_full" | "queue_expired" | "keys_exhausted";
 
 export class RequestPacingQueueOverloadError extends Error {
   constructor(
@@ -47,7 +48,7 @@ export class RequestPacingQueueOverloadError extends Error {
     public readonly reason: RequestPacingQueueOverloadReason,
     public readonly retryAfterSeconds: number,
   ) {
-    super(reason === "queue_full"
+    super(reason === "keys_exhausted" ? "No eligible API key remains; wait for the provider cooldown before retrying" : reason === "queue_full"
       ? `request pacing queue for provider '${providerName}' is full`
       : `request pacing queue for provider '${providerName}' exceeded the maximum queued age`);
     this.name = "RequestPacingQueueOverloadError";
@@ -62,6 +63,10 @@ export class RequestPacingProviderRemovedError extends Error {
 }
 
 interface Waiter {
+  keyLease: boolean;
+  keyId?: string;
+  keyIntervalMs: number;
+  keyMaxConcurrent: number;
   modelId?: string;
   providerIntervalMs: number;
   modelIntervalMs: number;
@@ -75,6 +80,9 @@ interface Waiter {
 }
 
 interface ProviderPacer {
+  keyNextStartAt: Map<string, number>;
+  keyInFlight: Map<string, number>;
+  keyStarts: Map<string, number>;
   queue: Waiter[];
   providerNextStartAt: number;
   modelNextStartAt: Map<string, number>;
@@ -138,6 +146,7 @@ export interface ProviderRequestPacingStatus {
   inFlight?: number;
   lastStartedAt?: number;
   lastModelId?: string;
+  keys?: Array<{ id: string; starts: number; inFlight: number; queued: number; nextSlotInMs: number }>;
 }
 
 const pacers = new Map<string, ProviderPacer>();
@@ -165,6 +174,13 @@ function normalizedInterval(rule: RequestPacingRule | undefined): number {
   return Math.max(rpmInterval, fixedInterval);
 }
 
+function keyBucket(provider: OcxProviderConfig): string | undefined {
+  if (provider.authMode === "oauth" || provider.authMode === "forward" || !provider.apiKey) return;
+  if (!provider.requestPacing?.enabled || (!provider.requestPacing.keys && provider.requestPacing.keySelection !== "round-robin")) return;
+  // Internal only: duplicate references share one bucket; never serialize a key or digest.
+  return createHash("sha256").update(provider._apiKeyAttempt?.reference ?? provider.apiKey).digest("hex");
+}
+
 function normalizedMaxConcurrent(rule: RequestPacingRule | undefined): number {
   return typeof rule?.maxConcurrentRequests === "number" && rule.maxConcurrentRequests > 0
     // Floor so runtime-injected configs that bypass the integer schema cannot admit
@@ -178,10 +194,14 @@ export function requestPacingIntervalMs(provider: OcxProviderConfig, modelId?: s
   const policy = provider.requestPacing;
   if (!policy?.enabled) return 0;
   const override = modelId ? policy.models?.[modelId] : undefined;
-  return Math.max(normalizedInterval(policy), normalizedInterval(override));
+  return Math.max(normalizedInterval(policy), normalizedInterval(override), keyBucket(provider) ? normalizedInterval(policy.keys) : 0);
 }
 
 function requestPacingIntervals(provider: OcxProviderConfig, modelId?: string): {
+  keyLease: boolean;
+  keyId?: string;
+  keyIntervalMs: number;
+  keyMaxConcurrent: number;
   providerIntervalMs: number;
   modelIntervalMs: number;
   providerMaxConcurrent: number;
@@ -189,9 +209,14 @@ function requestPacingIntervals(provider: OcxProviderConfig, modelId?: string):
 } {
   const policy = provider.requestPacing;
   if (!policy?.enabled) {
-    return { providerIntervalMs: 0, modelIntervalMs: 0, providerMaxConcurrent: 0, modelMaxConcurrent: 0 };
+    return { keyLease: false, keyIntervalMs: 0, keyMaxConcurrent: 0, providerIntervalMs: 0, modelIntervalMs: 0, providerMaxConcurrent: 0, modelMaxConcurrent: 0 };
   }
+  const keyId = keyBucket(provider);
   return {
+    keyLease: true,
+    keyId,
+    keyIntervalMs: keyId ? normalizedInterval(policy.keys) : 0,
+    keyMaxConcurrent: keyId ? normalizedMaxConcurrent(policy.keys) : 0,
     providerIntervalMs: normalizedInterval(policy),
     modelIntervalMs: modelId ? normalizedInterval(policy.models?.[modelId]) : 0,
     providerMaxConcurrent: normalizedMaxConcurrent(policy),
@@ -209,13 +234,14 @@ function requestPacingIntervals(provider: OcxProviderConfig, modelId?: string):
  */
 export function requestPacingMaxConcurrentRequests(provider: OcxProviderConfig, modelId?: string): number {
   const limits = requestPacingIntervals(provider, modelId);
-  return Math.max(limits.providerMaxConcurrent, limits.modelMaxConcurrent);
+  return Math.max(limits.providerMaxConcurrent, limits.modelMaxConcurrent, limits.keyMaxConcurrent);
 }
 
-function waiterReadyAt(state: ProviderPacer, modelId: string | undefined): number {
+function waiterReadyAt(state: ProviderPacer, modelId: string | undefined, keyId?: string): number {
   return Math.max(
     state.providerNextStartAt,
     modelId ? (state.modelNextStartAt.get(modelId) ?? 0) : 0,
+    keyId ? (state.keyNextStartAt.get(keyId) ?? 0) : 0,
   );
 }
 
@@ -224,8 +250,9 @@ function pacingRetryAfterSeconds(
   modelId: string | undefined,
   now: number,
   concurrencyCapped = false,
+  keyId?: string,
 ): number {
-  const intervalSeconds = Math.max(1, Math.ceil(Math.max(0, waiterReadyAt(state, modelId) - now) / 1000));
+  const intervalSeconds = Math.max(1, Math.ceil(Math.max(0, waiterReadyAt(state, modelId, keyId) - now) / 1000));
   // A waiter blocked by an in-flight lease has no interval to report: when the wait ends
   // in refusal, the honest answer is that the cap is saturated, not "retry every second".
   return concurrencyCapped
@@ -240,7 +267,7 @@ function makeProviderRequestSlot(
 ): BodyTrackableProviderRequestSlot {
   let released = false;
   let bodyTracked = false;
-  const leased = waiter.providerMaxConcurrent > 0 || waiter.modelMaxConcurrent > 0;
+  const leased = (!!waiter.keyId && waiter.keyLease) || waiter.providerMaxConcurrent > 0 || waiter.modelMaxConcurrent > 0;
   const slot: BodyTrackableProviderRequestSlot = {
     providerName,
     leased,
@@ -258,6 +285,7 @@ function makeProviderRequestSlot(
       released = true;
       waiter.signal?.removeEventListener("abort", releaseOnAbort);
       if (waiter.providerMaxConcurrent > 0 && state.providerInFlight > 0) state.providerInFlight -= 1;
+      if (waiter.keyId && waiter.keyLease) state.keyInFlight.set(waiter.keyId, Math.max(0, (state.keyInFlight.get(waiter.keyId) ?? 0) - 1));
       if (waiter.modelId && waiter.modelMaxConcurrent > 0) {
         const current = state.modelInFlight.get(waiter.modelId) ?? 0;
         if (current <= 1) state.modelInFlight.delete(waiter.modelId);
@@ -293,7 +321,8 @@ function rejectExpiredWaiters(providerName: string, state: ProviderPacer, now: n
         state,
         waiter.modelId,
         now,
-        waiter.providerMaxConcurrent > 0 || waiter.modelMaxConcurrent > 0,
+        waiter.providerMaxConcurrent > 0 || waiter.modelMaxConcurrent > 0 || waiter.keyMaxConcurrent > 0,
+        waiter.keyId,
       ),
     ));
   }
@@ -327,17 +356,18 @@ function runQueue(providerName: string, state: ProviderPacer): void {
 
   const providerReadyAt = Math.max(now, state.providerNextStartAt);
   const waiterIndex = state.queue.findIndex(waiter => {
+    if (waiter.keyId && waiter.keyMaxConcurrent > 0 && (state.keyInFlight.get(waiter.keyId) ?? 0) >= waiter.keyMaxConcurrent) return false;
     if (waiter.providerMaxConcurrent > 0 && state.providerInFlight >= waiter.providerMaxConcurrent) return false;
     if (waiter.modelId && waiter.modelMaxConcurrent > 0
       && (state.modelInFlight.get(waiter.modelId) ?? 0) >= waiter.modelMaxConcurrent) return false;
     const modelReadyAt = waiter.modelId ? (state.modelNextStartAt.get(waiter.modelId) ?? 0) : 0;
-    return Math.max(providerReadyAt, modelReadyAt) <= now;
+    return Math.max(providerReadyAt, modelReadyAt, waiter.keyId ? state.keyNextStartAt.get(waiter.keyId) ?? 0 : 0) <= now;
   });
   if (waiterIndex < 0) {
     let earliestAt = Number.POSITIVE_INFINITY;
     for (const waiter of state.queue) {
       const modelReadyAt = waiter.modelId ? (state.modelNextStartAt.get(waiter.modelId) ?? 0) : 0;
-      const readyAt = Math.max(providerReadyAt, modelReadyAt);
+      const readyAt = Math.max(providerReadyAt, modelReadyAt, waiter.keyId ? state.keyNextStartAt.get(waiter.keyId) ?? 0 : 0);
       const expiresAt = waiter.queuedAt + maxQueueAgeMs;
       // A waiter whose start time already passed is blocked on an in-flight lease; its release
       // re-runs this queue through a microtask, so the timer only needs its expiry backstop.
@@ -362,6 +392,11 @@ function runQueue(providerName: string, state: ProviderPacer): void {
   state.lastStartedAt = startedAt;
   state.lastModelId = waiter.modelId;
   state.providerNextStartAt = startedAt + waiter.providerIntervalMs;
+  if (waiter.keyId) {
+    state.keyNextStartAt.set(waiter.keyId, startedAt + waiter.keyIntervalMs);
+    if (waiter.keyLease) state.keyInFlight.set(waiter.keyId, (state.keyInFlight.get(waiter.keyId) ?? 0) + 1);
+    state.keyStarts.set(waiter.keyId, (state.keyStarts.get(waiter.keyId) ?? 0) + 1);
+  }
   if (waiter.modelId && waiter.modelIntervalMs > 0) {
     state.modelNextStartAt.set(waiter.modelId, startedAt + waiter.modelIntervalMs);
   }
@@ -386,22 +421,34 @@ export async function waitForProviderRequestSlot(
   // by interval only, or a follow-up would queue behind the lease its own turn holds.
   const concurrency = options?.concurrency !== false;
   const waiterIntervals = concurrency ? intervals : {
+    keyId: intervals.keyId, keyLease: false, keyIntervalMs: intervals.keyIntervalMs, keyMaxConcurrent: 0,
     providerIntervalMs: intervals.providerIntervalMs,
     modelIntervalMs: intervals.modelIntervalMs,
     providerMaxConcurrent: 0,
     modelMaxConcurrent: 0,
   };
   const paced = Math.max(intervals.providerIntervalMs, intervals.modelIntervalMs) > 0
+    || intervals.keyId !== undefined
     || waiterIntervals.providerMaxConcurrent > 0
     || waiterIntervals.modelMaxConcurrent > 0;
   if (!paced) return inertProviderRequestSlot;
   if (signal?.aborted) throw abortReason(signal);
 
   const state = pacers.get(providerName) ?? {
+    keyNextStartAt: new Map<string, number>(), keyInFlight: new Map<string, number>(), keyStarts: new Map<string, number>(),
     queue: [], providerNextStartAt: 0, modelNextStartAt: new Map<string, number>(),
     providerInFlight: 0, modelInFlight: new Map<string, number>(),
   };
   pacers.set(providerName, state);
+  // Retire removed credentials only after their queued work, leases and spacing debt end.
+  const currentKeys = new Set((provider.apiKeyPool ?? []).map(entry =>
+    keyBucket({ ...provider, apiKey: entry.key, _apiKeyAttempt: undefined })));
+  currentKeys.add(intervals.keyId);
+  for (const key of state.keyStarts.keys()) {
+    if (currentKeys.has(key) || (state.keyInFlight.get(key) ?? 0) > 0
+      || (state.keyNextStartAt.get(key) ?? 0) > runtime.now() || state.queue.some(waiter => waiter.keyId === key)) continue;
+    state.keyStarts.delete(key); state.keyInFlight.delete(key); state.keyNextStartAt.delete(key);
+  }
 
   // Give already-eligible or expired waiters a chance to leave before applying the
   // admission bound to the newest request. This preserves FIFO-ish fairness while
@@ -419,7 +466,8 @@ export async function waitForProviderRequestSlot(
         state,
         modelId,
         runtime.now(),
-        waiterIntervals.providerMaxConcurrent > 0 || waiterIntervals.modelMaxConcurrent > 0,
+        waiterIntervals.providerMaxConcurrent > 0 || waiterIntervals.modelMaxConcurrent > 0 || waiterIntervals.keyMaxConcurrent > 0,
+        waiterIntervals.keyId,
       ),
     );
   }
@@ -464,14 +512,13 @@ export async function waitForProviderRequestSlot(
  * means the exchange is already finished, so the lease returns immediately. A body that
  * is neither read nor cancelled for REQUEST_PACING_UNCONSUMED_BODY_MS releases its lease
  * and cancels the body, so a dropped Response cannot hold a slot forever. The returned
- * Response preserves status, statusText, headers, and the identity-based replay markers.
+ * Response preserves status, statusText, headers, replay markers, and registered provenance.
  */
 export function trackProviderRequestSlotBody(
   slot: ProviderRequestSlot | undefined,
   response: Response,
 ): Response {
-  // An unleased slot has nothing to return on body close, and rewrapping the Response
-  // would break identity-based markers (the eager WS relay registry is a WeakSet).
+  // An unleased slot has nothing to return on body close; preserve the response identity.
   if (!slot?.leased) return response;
   // Slots built outside waitForProviderRequestSlot (test doubles) satisfy only the public
   // ProviderRequestSlot shape; their bodies still own the release through the wrapper below.
@@ -657,24 +704,35 @@ export function providerRequestPacingStatus(
   if (state && state.queue.length > 0) {
     let earliestQueuedSlotAt = Number.POSITIVE_INFINITY;
     for (const waiter of state.queue) {
-      earliestQueuedSlotAt = Math.min(earliestQueuedSlotAt, waiterReadyAt(state, waiter.modelId));
+      earliestQueuedSlotAt = Math.min(earliestQueuedSlotAt, waiterReadyAt(state, waiter.modelId, waiter.keyId));
     }
     if (Number.isFinite(earliestQueuedSlotAt)) nextSlotAt = earliestQueuedSlotAt;
   }
-  const providerConcurrencyCap = requestPacingMaxConcurrentRequests(provider);
+  const providerConcurrencyCap = normalizedMaxConcurrent(provider.requestPacing);
+  const hasKeyAccounting = provider.requestPacing?.enabled === true && keyBucket(provider) !== undefined;
   // Gate on enabled so the status surface agrees with enforcement: a disabled requestPacing
   // block must not report in-flight leases alongside enabled: false.
-  const anyConcurrencyCap = provider.requestPacing?.enabled === true && (providerConcurrencyCap > 0
+  const anyConcurrencyCap = provider.requestPacing?.enabled === true && (hasKeyAccounting || providerConcurrencyCap > 0
     || Object.values(provider.requestPacing?.models ?? {}).some(rule => normalizedMaxConcurrent(rule) > 0));
   return {
     provider: providerName,
     enabled: provider.requestPacing?.enabled === true,
     queued: state?.queue.length ?? 0,
     nextSlotInMs: Math.max(0, Math.ceil(nextSlotAt - now)),
+    ...(provider.requestPacing?.enabled && (provider.requestPacing.keys || provider.requestPacing.keySelection === "round-robin") ? {
+      keys: (provider.apiKeyPool ?? []).map(entry => {
+        const bucket = keyBucket({ ...provider, apiKey: entry.key, _apiKeyAttempt: undefined })!;
+        return { id: entry.id, starts: state?.keyStarts.get(bucket) ?? 0, inFlight: state?.keyInFlight.get(bucket) ?? 0,
+          queued: state?.queue.filter(waiter => waiter.keyId === bucket).length ?? 0,
+          nextSlotInMs: Math.max(0, Math.ceil((state?.keyNextStartAt.get(bucket) ?? 0) - now)) };
+      }),
+    } : {}),
     // A provider cap counts every paced send in providerInFlight; model-only caps keep
     // providerInFlight at zero, so report the per-model sum for those providers instead.
     ...(anyConcurrencyCap ? {
-      inFlight: providerConcurrencyCap > 0
+      inFlight: hasKeyAccounting
+        ? [...(state?.keyInFlight.values() ?? [])].reduce((sum, count) => sum + count, 0)
+        : providerConcurrencyCap > 0
         ? state?.providerInFlight ?? 0
         : [...(state?.modelInFlight.values() ?? [])].reduce((sum, count) => sum + count, 0),
     } : {}),

package/src/providers/routed-config.ts

@@ -0,0 +1,339 @@
+/**
+ * Request-time provider resolution: merge a saved config row with its registry entry.
+ *
+ * This lives outside `src/router.ts` because `providers/api-key-selection.ts` needs exactly
+ * one function from the router, and importing the router for it dragged the whole routing
+ * graph into an import cycle. The router re-exports both symbols below so every existing
+ * import keeps working.
+ */
+import type { OcxProviderConfig } from "../types";
+import { providerUsesKeyAuthOverride, resolveProviderApiKey } from "./key-store";
+import { GCP_CREDENTIAL_MARKER_PREFIX } from "../lib/gcp-adc";
+import { captureProviderApiKeySelection } from "./api-key-selection-capture";
+import { assertProviderDestinationAllowed } from "../lib/destination-policy";
+import { redactSecretString, redactUrlForLog } from "../lib/redact";
+import { PROVIDER_REGISTRY, registryEntryForProviderDestination } from "./registry";
+import { applyDirectReasoningEffortContracts, hasLegacyClinePassReasoningEfforts } from "./derive";
+import { cloneFastWire } from "./fastwire";
+import { fastSwitchOff } from "./fast-opt-in";
+import {
+  providerMatchesRegistryTransportWithStaticGuards,
+  providerSupportsLiveModelDiscovery,
+} from "./static-model-discovery";
+import { resolveModelPolicy } from "./resolved-model-policy";
+
+/** Same endpoint modulo surrounding space and trailing slashes — matches `matchBaseUrlChoice`. */
+function isSameEndpoint(a: string, b: string): boolean {
+  return a.trim().replace(/\/+$/, "") === b.trim().replace(/\/+$/, "");
+}
+
+/**
+ * Origin of a user-configured URL, with the path withheld.
+ *
+ * A configured `baseUrl` is user-controlled and its path may itself be the credential — an
+ * account-scoped route token such as `https://proxy.example/v1/8fK2mP7qR4nV6x` is opaque and
+ * high-entropy, so it matches none of the prefix patterns in `redactSecretString`. Pattern
+ * redaction cannot be trusted for this value, so no path segment is logged at all. `URL.origin`
+ * also excludes userinfo, query and fragment.
+ *
+ * `…/…` marks that a path was present without revealing it, so a reader can tell an origin-only
+ * config apart from one whose path was dropped.
+ */
+function configuredOriginForLog(url: string): string {
+  try {
+    const parsed = new URL(url.trim());
+    // "null" is what URL.origin yields for non-special schemes; treat it as unusable.
+    if (!parsed.origin || parsed.origin === "null") return "(unloggable URL)";
+    const hasPath = parsed.pathname !== "" && parsed.pathname !== "/";
+    return hasPath ? `${parsed.origin}/…` : parsed.origin;
+  } catch {
+    return "(unparseable URL)";
+  }
+}
+
+// `routedProviderConfig` runs per request, so warn once per (provider, discarded, effective) triple.
+// Keyed by the URLs too: editing config.json to a different wrong value warns again.
+const discardedBaseUrlWarnings = new Set<string>();
+let lastWarningReconciledGeneration = 0;
+
+export function reconcileRouterWarningMemos(generation: number): number {
+  if (generation <= lastWarningReconciledGeneration) return 0;
+  const removed = discardedBaseUrlWarnings.size;
+  discardedBaseUrlWarnings.clear();
+  lastWarningReconciledGeneration = generation;
+  return removed;
+}
+
+/**
+ * A pinned registry entry — non-template `baseUrl`, no `allowBaseUrlOverride` — outranks a saved
+ * `baseUrl`. Dropping it silently is a footgun: requests go to an endpoint the user never
+ * configured, and a wrong-region or wrong-account URL then surfaces only as a 401 with nothing
+ * pointing back at the discarded setting.
+ *
+ * Warns rather than throws. The effective route is exactly what it was before, so a hard error
+ * here would break configs that route fine today (a stale `baseUrl` left over from an earlier
+ * provider is harmless whenever it names the same endpoint the registry pins).
+ */
+function warnIfBaseUrlDiscarded(providerName: string, userBaseUrl: string, effectiveBaseUrl: string): void {
+  if (isSameEndpoint(userBaseUrl, effectiveBaseUrl)) return;
+  // Asymmetric on purpose. Past the guard above, `effectiveBaseUrl` is necessarily
+  // `registryEntry.baseUrl`: the caller passes the resolved URL, and whenever that resolution
+  // kept the user's value the two are equal and we have already returned. So the effective side
+  // is a constant from this repo's registry and safe to print in full — it is also the useful
+  // half, naming the endpoint requests will actually use. The configured side is untrusted.
+  const discarded = configuredOriginForLog(userBaseUrl);
+  const effective = redactSecretString(redactUrlForLog(effectiveBaseUrl));
+  // Key off the logged forms: no raw credential is retained for the process lifetime, and
+  // rotating a key embedded in the URL no longer re-warns about the same endpoint mismatch.
+  // Coarser than the raw URLs — two bad paths on one host warn once, which is the right grain.
+  const key = `${providerName} | ${discarded} | ${effective}`;
+  if (discardedBaseUrlWarnings.has(key)) return;
+  discardedBaseUrlWarnings.add(key);
+  console.warn(
+    // Routing is what this warning speaks for: an adapter may adjust the endpoint again
+    // downstream (kiro re-derives the region), so do not promise where the request lands.
+    `⚠️  config.json provider "${providerName}": configured baseUrl ${discarded} is ignored`
+    + ` because this provider's endpoint is fixed at ${effective}. A URL saved for a different`
+    + ` account or region is a common cause of 401s here — drop it, or use the provider whose endpoint matches.`,
+  );
+}
+
+function usableResolvedApiKey(apiKey: string | undefined): string | undefined {
+  // A `gcp-sa:` marker must pass through UNCHANGED: it resolves to `undefined` here (it is not a
+  // keychain/env ref, and the marker itself is not a literal), and replacing it would silently
+  // drop the marker from the routed config — the vertex adapter would then read
+  // `gcpCredentialMarkerAccount(undefined)` and fall back to host ADC instead of the configured
+  // service account. Return the marker verbatim so the adapter passes its account per request.
+  if (typeof apiKey === "string" && apiKey.startsWith(GCP_CREDENTIAL_MARKER_PREFIX)) return apiKey;
+  const resolved = resolveProviderApiKey(apiKey);
+  return typeof resolved === "string" && resolved.trim().length > 0 ? resolved : undefined;
+}
+
+export function routedProviderConfig(providerName: string, provider: OcxProviderConfig): OcxProviderConfig {
+  provider = { ...provider, _apiKeyAttempt: provider._apiKeyAttempt ?? captureProviderApiKeySelection(provider) };
+  const registryEntry = PROVIDER_REGISTRY.find(entry => entry.id === providerName);
+  if (!registryEntry || !providerMatchesRegistryTransportWithStaticGuards(providerName, provider)) {
+    assertProviderDestinationAllowed(providerName, provider);
+    // A row whose adapter no longer matches its registry entry still reaches the Responses
+    // adapter when one model opts in through `modelAdapters` — a Volcengine Coding Plan config
+    // saved on Chat, for instance. The replay-drop flag belongs to the DESTINATION rather than
+    // to the provider-wide wire, so it is filled here too; without it that continuation forwards
+    // the reasoning item the upstream answers 400 to. Destination matching refuses templated and
+    // overridable base URLs, so this cannot follow a retargeted row, and an explicit value wins.
+    const destination = registryEntryForProviderDestination(provider);
+    return {
+      ...provider,
+      apiKey: usableResolvedApiKey(provider.apiKey),
+      ...(provider.dropResponsesReasoningItems === undefined && destination?.dropResponsesReasoningItems !== undefined
+        ? { dropResponsesReasoningItems: destination.dropResponsesReasoningItems }
+        : {}),
+    };
+  }
+  const resolvedApiKey = usableResolvedApiKey(provider.apiKey);
+  const staticModelCatalog = !providerSupportsLiveModelDiscovery(providerName, provider);
+  const repairLegacyMimoFreeAuth = providerName === "mimo-free"
+    && staticModelCatalog
+    && (provider.authMode === undefined || provider.authMode === "local");
+  const explicitKeyOverride = providerUsesKeyAuthOverride(registryEntry, provider, resolvedApiKey);
+  const canonicalAuthMode = explicitKeyOverride
+    ? "key"
+    : repairLegacyMimoFreeAuth
+      ? "key"
+      : registryEntry.authKind === "forward" || registryEntry.authKind === "oauth"
+        ? registryEntry.authKind
+        : provider.authMode === "forward" ? undefined : provider.authMode;
+  const staticPolicy = resolveModelPolicy({
+    providerName,
+    modelId: "__provider_static__",
+    provider,
+    registryEntry,
+    transportMatchedRegistry: true,
+    ...(canonicalAuthMode ? { effectiveAuth: { authMode: canonicalAuthMode } } : {}),
+  }).provider;
+  const reasoningEffortMap = staticPolicy.reasoningEffortMap;
+  const modelReasoningEffortMap = staticPolicy.modelReasoningEffortMap;
+  const modelReasoningEfforts = staticPolicy.modelReasoningEfforts;
+  const modelDefaultReasoningEfforts = staticPolicy.modelDefaultReasoningEfforts;
+  const modelContextWindows = staticPolicy.modelContextWindows;
+  const modelInputModalities = staticPolicy.modelInputModalities;
+  // Registry static headers are documented as applying to every upstream request, so they are
+  // filled at resolve time rather than only at seed time: a config written before a header
+  // existed, or one carrying any header of its own, would otherwise never receive it. User
+  // headers win, matched case-insensitively so an override replaces rather than duplicates.
+  const headers = staticPolicy.headers;
+  const modelMaxInputTokens = staticPolicy.modelMaxInputTokens;
+  const modelMaxOutputTokens = staticPolicy.modelMaxOutputTokens;
+  const modelSupportsServiceTier = staticPolicy.modelSupportsServiceTier;
+  const modelSupportsVerbosity = staticPolicy.modelSupportsVerbosity;
+  const noVisionModels = staticPolicy.noVisionModels;
+  const noReasoningModels = staticPolicy.noReasoningModels;
+  const noTemperatureModels = staticPolicy.noTemperatureModels;
+  const noTopPModels = staticPolicy.noTopPModels;
+  const noStopModels = staticPolicy.noStopModels;
+  const noPenaltyModels = staticPolicy.noPenaltyModels;
+  const noJsonSchemaModels = staticPolicy.noJsonSchemaModels;
+  const autoToolChoiceOnlyModels = staticPolicy.autoToolChoiceOnlyModels;
+  const preserveReasoningContentModels = staticPolicy.preserveReasoningContentModels;
+  const requiresReasoningPlaceholderModels = staticPolicy.requiresReasoningPlaceholderModels;
+  const reasoningSplitModels = staticPolicy.reasoningSplitModels;
+  const inlineThinkTagModels = staticPolicy.inlineThinkTagModels;
+  const reasoningDetailsModels = staticPolicy.reasoningDetailsModels;
+  const thinkingToggleModels = staticPolicy.thinkingToggleModels;
+  const thinkingBudgetModels = staticPolicy.thinkingBudgetModels;
+  const registryBaseUrlIsTemplate = /\{[^}]*\}/.test(registryEntry.baseUrl);
+  const userBaseUrl = typeof provider.baseUrl === "string" ? provider.baseUrl.trim() : "";
+  const userBaseUrlIsResolved = userBaseUrl.length > 0 && !/\{[^}]*\}/.test(userBaseUrl);
+  if (registryEntry.allowBaseUrlOverride && !userBaseUrlIsResolved) {
+    throw new Error(`Invalid baseUrl for provider "${providerName}": expected a nonblank URL without unresolved placeholders`);
+  }
+  // Registry template URLs are presets; local/self-hosted entries opt in explicitly.
+  const baseUrl = (registryBaseUrlIsTemplate || registryEntry.allowBaseUrlOverride) && userBaseUrlIsResolved
+    ? userBaseUrl
+    : registryEntry.baseUrl;
+  if (userBaseUrlIsResolved) warnIfBaseUrlDiscarded(providerName, userBaseUrl, baseUrl);
+  assertProviderDestinationAllowed(providerName, { baseUrl, allowPrivateNetwork: provider.allowPrivateNetwork });
+
+  const resolved: OcxProviderConfig = {
+    ...provider,
+    adapter: registryEntry.adapter,
+    baseUrl,
+    ...(provider.responsesPath === undefined && registryEntry.responsesPath !== undefined
+      ? { responsesPath: registryEntry.responsesPath }
+      : {}),
+    ...(provider.chatCompletionsPath === undefined && registryEntry.chatCompletionsPath !== undefined
+      ? { chatCompletionsPath: registryEntry.chatCompletionsPath }
+      : {}),
+    ...(provider.requiresAdjacentResponsesToolResults === undefined
+      && registryEntry.requiresAdjacentResponsesToolResults !== undefined
+      ? { requiresAdjacentResponsesToolResults: registryEntry.requiresAdjacentResponsesToolResults }
+      : {}),
+    ...(provider.requiresPairedResponsesToolResults === undefined
+      && registryEntry.requiresPairedResponsesToolResults !== undefined
+      ? { requiresPairedResponsesToolResults: registryEntry.requiresPairedResponsesToolResults }
+      : {}),
+    ...(provider.annotateEmptyToolOutputs === undefined
+      && registryEntry.annotateEmptyToolOutputs !== undefined
+      ? { annotateEmptyToolOutputs: registryEntry.annotateEmptyToolOutputs }
+      : {}),
+    ...(provider.fastWire === undefined && registryEntry.fastWire !== undefined
+      ? {
+        fastWire: cloneFastWire(registryEntry.fastWire),
+      }
+      : {}),
+    ...(provider.supportsServiceTier === undefined && registryEntry.supportsServiceTier !== undefined
+      ? { supportsServiceTier: registryEntry.supportsServiceTier }
+      : {}),
+    // An off Fast switch is a provider-wide denial on the runtime provider, so a Fast policy
+    // resolved without the provider name still refuses (providerFastSwitchOff).
+    ...(fastSwitchOff(provider, registryEntry) ? { supportsServiceTier: false } : {}),
+    // Registry-only web-search capability: without this backfill a saved provider row reaches
+    // the Responses adapter with the flag `undefined`, so the capability gate added in #2262
+    // reads "unclassified" and forwards Codex's OpenAI-only `web_search` config fields. xAI
+    // rejects the whole request before inference ("Argument not supported:
+    // external_web_access"), which killed every routed Grok turn on the Responses lane.
+    // enrichProviderFromRegistry() already fills this, but the request path resolves through
+    // routedProviderConfig() and never called it.
+    ...(provider.supportsOpenAiWebSearchToolFields === undefined
+      && registryEntry.supportsOpenAiWebSearchToolFields !== undefined
+      ? { supportsOpenAiWebSearchToolFields: registryEntry.supportsOpenAiWebSearchToolFields }
+      : {}),
+    ...(provider.supportsResponsesCustomTools === undefined && registryEntry.supportsResponsesCustomTools !== undefined
+      ? { supportsResponsesCustomTools: registryEntry.supportsResponsesCustomTools }
+      : {}),
+    ...(provider.preserveResponsesReasoningContent === undefined && registryEntry.preserveResponsesReasoningContent !== undefined
+      ? { preserveResponsesReasoningContent: registryEntry.preserveResponsesReasoningContent }
+      : {}),
+    ...(provider.preserveResponsesInputItemIds === undefined && registryEntry.preserveResponsesInputItemIds !== undefined
+      ? { preserveResponsesInputItemIds: registryEntry.preserveResponsesInputItemIds }
+      : {}),
+    ...(provider.preserveResponsesMessageMetadata === undefined && registryEntry.preserveResponsesMessageMetadata !== undefined
+      ? { preserveResponsesMessageMetadata: registryEntry.preserveResponsesMessageMetadata }
+      : {}),
+    ...(provider.dropResponsesReasoningItems === undefined && registryEntry.dropResponsesReasoningItems !== undefined
+      ? { dropResponsesReasoningItems: registryEntry.dropResponsesReasoningItems }
+      : {}),
+    // The request path resolves through routedProviderConfig() and never calls
+    // enrichProviderFromRegistry(), so a saved provider row written before the
+    // registry learned this flag must be backfilled here or route.provider never
+    // carries it and the showThinkingSummary opt-in stays dead.
+    ...(provider.showThinkingSummary === undefined && registryEntry.showThinkingSummary !== undefined
+      ? { showThinkingSummary: registryEntry.showThinkingSummary }
+      : {}),
+    // Registry-only client-facing repair policy (#938): fill only when the
+    // saved provider has no explicit policy; clone so runtime never aliases
+    // the registry constant.
+    ...(provider.responsesItemIdRepair === undefined && registryEntry.responsesItemIdRepair
+      ? {
+        responsesItemIdRepair: {
+          ...(registryEntry.responsesItemIdRepair.message ? { message: [...registryEntry.responsesItemIdRepair.message] } : {}),
+          ...(registryEntry.responsesItemIdRepair.reasoning ? { reasoning: [...registryEntry.responsesItemIdRepair.reasoning] } : {}),
+          ...(registryEntry.responsesItemIdRepair.repairMissingTerminalIds !== undefined
+            ? { repairMissingTerminalIds: registryEntry.responsesItemIdRepair.repairMissingTerminalIds }
+            : {}),
+          ...(registryEntry.responsesItemIdRepair.repairInvalidIds !== undefined
+            ? { repairInvalidIds: registryEntry.responsesItemIdRepair.repairInvalidIds }
+            : {}),
+        },
+      }
+      : {}),
+    authMode: canonicalAuthMode,
+    apiKey: resolvedApiKey,
+    ...(staticModelCatalog ? { liveModels: false } : {}),
+    ...(headers ? { headers } : {}),
+    // Backfill the Google wire mode + Vertex project/location from the registry when the user
+    // config omits them, so a minimal `google-vertex`/`google-antigravity` entry still routes
+    // through the correct branch (CCA/Vertex) instead of falling back to AI Studio.
+    ...(provider.googleMode === undefined && registryEntry.googleMode !== undefined ? { googleMode: registryEntry.googleMode } : {}),
+    ...(provider.project === undefined && registryEntry.project !== undefined ? { project: registryEntry.project } : {}),
+    ...(provider.location === undefined && registryEntry.location !== undefined ? { location: registryEntry.location } : {}),
+    ...(provider.contextWindow === undefined && registryEntry.contextWindow !== undefined ? { contextWindow: registryEntry.contextWindow } : {}),
+    ...((provider.reasoningEfforts === undefined || hasLegacyClinePassReasoningEfforts(providerName, provider))
+      && registryEntry.reasoningEfforts !== undefined
+      ? { reasoningEfforts: [...registryEntry.reasoningEfforts] }
+      : {}),
+    ...(provider.escapeBuiltinToolNames === undefined && registryEntry.escapeBuiltinToolNames !== undefined ? { escapeBuiltinToolNames: registryEntry.escapeBuiltinToolNames } : {}),
+    ...(provider.keyOptional === undefined && registryEntry.keyOptional !== undefined ? { keyOptional: registryEntry.keyOptional } : {}),
+    ...(provider.modelSuffixBracketStrip === undefined && registryEntry.modelSuffixBracketStrip !== undefined ? { modelSuffixBracketStrip: registryEntry.modelSuffixBracketStrip } : {}),
+    // Scalar backfill: a persisted config created before the flag shipped inherits the registry
+    // opt-in, while an explicit user `false` keeps overriding registry `true`.
+    ...(provider.parallelToolCalls === undefined && registryEntry.parallelToolCalls !== undefined ? { parallelToolCalls: registryEntry.parallelToolCalls } : {}),
+    ...(provider.promptCacheKey === undefined && registryEntry.promptCacheKey !== undefined ? { promptCacheKey: registryEntry.promptCacheKey } : {}),
+    ...(provider.chatServiceTier === undefined && registryEntry.chatServiceTier !== undefined ? { chatServiceTier: registryEntry.chatServiceTier } : {}),
+    ...(provider.openaiChatEofTolerance === undefined && registryEntry.openaiChatEofTolerance !== undefined
+      ? { openaiChatEofTolerance: registryEntry.openaiChatEofTolerance }
+      : {}),
+    ...(provider.reasoningWireFormat === undefined && registryEntry.reasoningWireFormat !== undefined
+      ? { reasoningWireFormat: registryEntry.reasoningWireFormat }
+      : {}),
+    ...(provider.defaultMaxOutputTokens === undefined && registryEntry.defaultMaxOutputTokens !== undefined
+      ? { defaultMaxOutputTokens: registryEntry.defaultMaxOutputTokens }
+      : {}),
+    ...(modelContextWindows ? { modelContextWindows } : {}),
+    ...(modelInputModalities ? { modelInputModalities } : {}),
+    ...(modelMaxInputTokens ? { modelMaxInputTokens } : {}),
+    ...(modelMaxOutputTokens ? { modelMaxOutputTokens } : {}),
+    ...(modelSupportsServiceTier ? { modelSupportsServiceTier } : {}),
+    ...(modelSupportsVerbosity ? { modelSupportsVerbosity } : {}),
+    ...(modelReasoningEfforts ? { modelReasoningEfforts } : {}),
+    ...(modelDefaultReasoningEfforts ? { modelDefaultReasoningEfforts } : {}),
+    ...(reasoningEffortMap ? { reasoningEffortMap } : {}),
+    ...(modelReasoningEffortMap ? { modelReasoningEffortMap } : {}),
+    ...(noVisionModels ? { noVisionModels } : {}),
+    ...(noReasoningModels ? { noReasoningModels } : {}),
+    ...(noTemperatureModels ? { noTemperatureModels } : {}),
+    ...(noTopPModels ? { noTopPModels } : {}),
+    ...(noStopModels ? { noStopModels } : {}),
+    ...(noPenaltyModels ? { noPenaltyModels } : {}),
+    ...(noJsonSchemaModels ? { noJsonSchemaModels } : {}),
+    ...(autoToolChoiceOnlyModels ? { autoToolChoiceOnlyModels } : {}),
+    ...(preserveReasoningContentModels ? { preserveReasoningContentModels } : {}),
+    ...(requiresReasoningPlaceholderModels ? { requiresReasoningPlaceholderModels } : {}),
+    ...(reasoningSplitModels ? { reasoningSplitModels } : {}),
+    ...(inlineThinkTagModels ? { inlineThinkTagModels } : {}),
+    ...(reasoningDetailsModels ? { reasoningDetailsModels } : {}),
+    ...(thinkingToggleModels ? { thinkingToggleModels } : {}),
+    ...(thinkingBudgetModels ? { thinkingBudgetModels } : {}),
+  };
+  applyDirectReasoningEffortContracts(registryEntry, resolved, provider);
+  return resolved;
+}

package/src/providers/service-tier.ts

@@ -33,6 +33,7 @@ type ServiceTierCapabilityProvider = Pick<
   | "modelAdapters"
   | "baseUrl"
   | "authMode"
+  | "googleMode"
   | "apiKeyTransport"
   | "chatServiceTier"
   | "fastWire"
@@ -119,7 +120,7 @@ function buildFastPolicyAuthority(
           : {}),
     }),
     modelAdapters: Object.freeze({ ...(provider.modelAdapters ?? {}) }),
-    hardPins: captureWireAdapterHardPins(providerName),
+    hardPins: captureWireAdapterHardPins(providerName, provider),
     hardPinPrefixes: captureWireAdapterHardPinPrefixes(providerName, provider),
     registryWireDefaults: cloneRegistryWireDefaults(registry?.modelWireDefaults),
   });