@bitkyc08/opencodex 2.84.0 → 2.87.0

package/src/responses/schema.ts

@@ -1,4 +1,5 @@
 import * as z from "zod/v4";
+import { isCompactionItemType } from "./compaction";
 
 const inputTextSchema = z.object({ type: z.literal("input_text"), text: z.string() });
 const plainTextSchema = z.object({ type: z.literal("text"), text: z.string() });
@@ -75,6 +76,28 @@ const reasoningItemSchema = z.object({
   // Round-tripped opaque payload (native OpenAI encryption OR the proxy's ocxr1 envelope).
   encrypted_content: z.string().optional(),
 });
+
+/** A native v1 replacement history may establish replay provenance only after body success. */
+export const nativeCompactResponseSchema = z.object({
+  status: z.literal("completed").optional(),
+  error: z.null().optional(),
+  output: z.array(z.union([
+    userMessageItemSchema.required({ content: true }),
+    systemMessageItemSchema.required({ content: true }),
+    assistantMessageItemSchema.required({ content: true }),
+    reasoningItemSchema,
+    z.object({
+      type: z.string().refine(isCompactionItemType),
+      encrypted_content: z.string().refine(value => value.trim().length > 0),
+    }),
+  ])).min(1).refine(items => items.some(item => {
+    if (isCompactionItemType(item.type)) return true;
+    if (!("role" in item)) return false;
+    return typeof item.content === "string" ? item.content.trim().length > 0
+      : item.content.some(part => "text" in part && part.text.trim().length > 0);
+  })),
+});
+
 const functionCallItemSchema = z.object({
   type: z.literal("function_call"),
   id: z.string().optional(),

package/src/responses/state.ts

@@ -710,11 +710,6 @@ export function sweepOrphanedResponseSpills(): number {
 type SnapshotWriteOutcome = "stable" | "unstable" | "failed";
 
 async function writeBoundedSnapshot(path: string, attemptLimit: number): Promise<SnapshotWriteOutcome> {
-  // Serialize writers so concurrent flush + debounce cannot race on temps / ACL (#612).
-  const previous = persistGate;
-  let release!: () => void;
-  persistGate = new Promise<void>(resolve => { release = resolve; });
-  await previous;
   try {
     for (let attempt = 0; attempt < attemptLimit; attempt += 1) {
       const revision = stateRevision;
@@ -751,13 +746,19 @@ async function writeBoundedSnapshot(path: string, attemptLimit: number): Promise
         lastSnapshotTarget = resolveWriteTarget(path);
       }
       persistAttemptHookForTests?.();
-      if (revision === stateRevision) return "stable";
+      if (revision === stateRevision) {
+        // Cancel only the timer whose mutation this stable revision includes,
+        // before an awaiting caller's microtask can record a newer revision.
+        if (persistTimer) clearTimeout(persistTimer);
+        persistTimer = null;
+        pendingPersistPath = null;
+        drainPendingSpillUnlinks();
+        return "stable";
+      }
     }
     return "unstable";
   } catch {
     return "failed";
-  } finally {
-    release();
   }
 }
 
@@ -792,21 +793,30 @@ function schedulePersistAt(path: string, replace = false): void {
 }
 
 async function persistNow(path: string, awaitFollowUp = false): Promise<void> {
-  if (persistTimer) {
-    clearTimeout(persistTimer);
-    persistTimer = null;
-  }
-  pendingPersistPath = null;
-  const attemptLimit = awaitFollowUp ? MAX_SNAPSHOT_REWRITE_ATTEMPTS : 1;
-  let outcome = await writeBoundedSnapshot(path, attemptLimit);
-  if (outcome === "unstable" && awaitFollowUp) {
-    if (persistTimer) clearTimeout(persistTimer);
-    persistTimer = null;
+  // Include follow-up scheduling in the gate: releasing after only the disk write
+  // lets shutdown observe an empty timer before the background pass re-arms it.
+  const previous = persistGate;
+  let release!: () => void;
+  persistGate = new Promise<void>(resolve => { release = resolve; });
+  await previous;
+  try {
+    if (persistTimer) {
+      clearTimeout(persistTimer);
+      persistTimer = null;
+    }
     pendingPersistPath = null;
-    outcome = await writeBoundedSnapshot(path, attemptLimit);
+    const attemptLimit = awaitFollowUp ? MAX_SNAPSHOT_REWRITE_ATTEMPTS : 1;
+    let outcome = await writeBoundedSnapshot(path, attemptLimit);
+    if (outcome === "unstable" && awaitFollowUp) {
+      if (persistTimer) clearTimeout(persistTimer);
+      persistTimer = null;
+      pendingPersistPath = null;
+      outcome = await writeBoundedSnapshot(path, attemptLimit);
+    }
+    if (outcome === "unstable" && !awaitFollowUp) schedulePersistAt(path, true);
+  } finally {
+    release();
   }
-  if (outcome === "stable") drainPendingSpillUnlinks();
-  else if (outcome === "unstable" && !awaitFollowUp) schedulePersistAt(path, true);
 }
 
 function schedulePersist(): void {
@@ -816,15 +826,8 @@ function schedulePersist(): void {
 }
 
 async function flushResponseSnapshot(): Promise<void> {
-  if (persistTimer) {
-    await persistNow(pendingPersistPath ?? snapshotPath(), true);
-    return;
-  }
-  // No pending timer: still await any in-flight write so shutdown does not race (#612).
+  // The gate includes the background pass's timer decision, not just its write.
   await persistGate;
-  // A bounded background pass may have scheduled its same-path follow-up while
-  // this flush was waiting on the single-flight gate. Shutdown owns one awaited
-  // bounded follow-up rather than returning behind that unref'd timer.
   if (persistTimer) await persistNow(pendingPersistPath ?? snapshotPath(), true);
 }
 

package/src/router.ts

@@ -14,25 +14,16 @@ import {
 import type { NormalizedComboConfig } from "./combos/types";
 import { hasOwnProvider } from "./config/provider-name";
 import { anthropicInstanceRowShapeMatches } from "./providers/anthropic-instance-id";
-import { providerUsesKeyAuthOverride, resolveProviderApiKey } from "./providers/key-store";
-import { captureProviderApiKeySelection } from "./providers/api-key-selection-capture";
+import { reconcileRouterWarningMemos, routedProviderConfig } from "./providers/routed-config";
 import { assertProviderDestinationAllowed } from "./lib/destination-policy";
-import { redactSecretString, redactUrlForLog } from "./lib/redact";
 import {
   PROVIDER_REGISTRY,
   providerCodexAccountMode,
-  registryEntryForProviderDestination,
 } from "./providers/registry";
 // Imported from the module directly rather than through the registry facade, which is at its
 // file-size cap.
 import { registryModelIdKeys } from "./providers/registry/model-ids";
-import { applyDirectReasoningEffortContracts, hasLegacyClinePassReasoningEfforts } from "./providers/derive";
-import { cloneFastWire } from "./providers/fastwire";
-import { fastSwitchOff } from "./providers/fast-opt-in";
-import {
-  providerMatchesRegistryTransportWithStaticGuards,
-  providerSupportsLiveModelDiscovery,
-} from "./providers/static-model-discovery";
+import { providerMatchesRegistryTransportWithStaticGuards } from "./providers/static-model-discovery";
 import {
   isCanonicalOpenAiForwardProvider,
   LEGACY_CHATGPT_PROVIDER_ID,
@@ -202,82 +193,6 @@ export function knownModelIdsForProvider(
   return [...ids];
 }
 
-/** Same endpoint modulo surrounding space and trailing slashes — matches `matchBaseUrlChoice`. */
-function isSameEndpoint(a: string, b: string): boolean {
-  return a.trim().replace(/\/+$/, "") === b.trim().replace(/\/+$/, "");
-}
-
-/**
- * Origin of a user-configured URL, with the path withheld.
- *
- * A configured `baseUrl` is user-controlled and its path may itself be the credential — an
- * account-scoped route token such as `https://proxy.example/v1/8fK2mP7qR4nV6x` is opaque and
- * high-entropy, so it matches none of the prefix patterns in `redactSecretString`. Pattern
- * redaction cannot be trusted for this value, so no path segment is logged at all. `URL.origin`
- * also excludes userinfo, query and fragment.
- *
- * `…/…` marks that a path was present without revealing it, so a reader can tell an origin-only
- * config apart from one whose path was dropped.
- */
-function configuredOriginForLog(url: string): string {
-  try {
-    const parsed = new URL(url.trim());
-    // "null" is what URL.origin yields for non-special schemes; treat it as unusable.
-    if (!parsed.origin || parsed.origin === "null") return "(unloggable URL)";
-    const hasPath = parsed.pathname !== "" && parsed.pathname !== "/";
-    return hasPath ? `${parsed.origin}/…` : parsed.origin;
-  } catch {
-    return "(unparseable URL)";
-  }
-}
-
-// `routedProviderConfig` runs per request, so warn once per (provider, discarded, effective) triple.
-// Keyed by the URLs too: editing config.json to a different wrong value warns again.
-const discardedBaseUrlWarnings = new Set<string>();
-let lastWarningReconciledGeneration = 0;
-
-export function reconcileRouterWarningMemos(generation: number): number {
-  if (generation <= lastWarningReconciledGeneration) return 0;
-  const removed = discardedBaseUrlWarnings.size;
-  discardedBaseUrlWarnings.clear();
-  lastWarningReconciledGeneration = generation;
-  return removed;
-}
-
-/**
- * A pinned registry entry — non-template `baseUrl`, no `allowBaseUrlOverride` — outranks a saved
- * `baseUrl`. Dropping it silently is a footgun: requests go to an endpoint the user never
- * configured, and a wrong-region or wrong-account URL then surfaces only as a 401 with nothing
- * pointing back at the discarded setting.
- *
- * Warns rather than throws. The effective route is exactly what it was before, so a hard error
- * here would break configs that route fine today (a stale `baseUrl` left over from an earlier
- * provider is harmless whenever it names the same endpoint the registry pins).
- */
-function warnIfBaseUrlDiscarded(providerName: string, userBaseUrl: string, effectiveBaseUrl: string): void {
-  if (isSameEndpoint(userBaseUrl, effectiveBaseUrl)) return;
-  // Asymmetric on purpose. Past the guard above, `effectiveBaseUrl` is necessarily
-  // `registryEntry.baseUrl`: the caller passes the resolved URL, and whenever that resolution
-  // kept the user's value the two are equal and we have already returned. So the effective side
-  // is a constant from this repo's registry and safe to print in full — it is also the useful
-  // half, naming the endpoint requests will actually use. The configured side is untrusted.
-  const discarded = configuredOriginForLog(userBaseUrl);
-  const effective = redactSecretString(redactUrlForLog(effectiveBaseUrl));
-  // Key off the logged forms: no raw credential is retained for the process lifetime, and
-  // rotating a key embedded in the URL no longer re-warns about the same endpoint mismatch.
-  // Coarser than the raw URLs — two bad paths on one host warn once, which is the right grain.
-  const key = `${providerName} | ${discarded} | ${effective}`;
-  if (discardedBaseUrlWarnings.has(key)) return;
-  discardedBaseUrlWarnings.add(key);
-  console.warn(
-    // Routing is what this warning speaks for: an adapter may adjust the endpoint again
-    // downstream (kiro re-derives the region), so do not promise where the request lands.
-    `⚠️  config.json provider "${providerName}": configured baseUrl ${discarded} is ignored`
-    + ` because this provider's endpoint is fixed at ${effective}. A URL saved for a different`
-    + ` account or region is a common cause of 401s here — drop it, or use the provider whose endpoint matches.`,
-  );
-}
-
 /**
  * One notice per provider id: the destination is an operator-configured key
  * (never a caller-supplied string), so the log carries no request content.
@@ -297,239 +212,10 @@ export function resetCompactionFallbackWarningsForTests(): void {
   compactionFallbackWarnings.clear();
 }
 
-function usableResolvedApiKey(apiKey: string | undefined): string | undefined {
-  const resolved = resolveProviderApiKey(apiKey);
-  return typeof resolved === "string" && resolved.trim().length > 0 ? resolved : undefined;
-}
-
-export function routedProviderConfig(providerName: string, provider: OcxProviderConfig): OcxProviderConfig {
-  provider = { ...provider, _apiKeyAttempt: provider._apiKeyAttempt ?? captureProviderApiKeySelection(provider) };
-  const registryEntry = PROVIDER_REGISTRY.find(entry => entry.id === providerName);
-  if (!registryEntry || !providerMatchesRegistryTransportWithStaticGuards(providerName, provider)) {
-    assertProviderDestinationAllowed(providerName, provider);
-    // A row whose adapter no longer matches its registry entry still reaches the Responses
-    // adapter when one model opts in through `modelAdapters` — a Volcengine Coding Plan config
-    // saved on Chat, for instance. The replay-drop flag belongs to the DESTINATION rather than
-    // to the provider-wide wire, so it is filled here too; without it that continuation forwards
-    // the reasoning item the upstream answers 400 to. Destination matching refuses templated and
-    // overridable base URLs, so this cannot follow a retargeted row, and an explicit value wins.
-    const destination = registryEntryForProviderDestination(provider);
-    return {
-      ...provider,
-      apiKey: usableResolvedApiKey(provider.apiKey),
-      ...(provider.dropResponsesReasoningItems === undefined && destination?.dropResponsesReasoningItems !== undefined
-        ? { dropResponsesReasoningItems: destination.dropResponsesReasoningItems }
-        : {}),
-    };
-  }
-  const resolvedApiKey = usableResolvedApiKey(provider.apiKey);
-  const staticModelCatalog = !providerSupportsLiveModelDiscovery(providerName, provider);
-  const repairLegacyMimoFreeAuth = providerName === "mimo-free"
-    && staticModelCatalog
-    && (provider.authMode === undefined || provider.authMode === "local");
-  const explicitKeyOverride = providerUsesKeyAuthOverride(registryEntry, provider, resolvedApiKey);
-  const canonicalAuthMode = explicitKeyOverride
-    ? "key"
-    : repairLegacyMimoFreeAuth
-      ? "key"
-      : registryEntry.authKind === "forward" || registryEntry.authKind === "oauth"
-        ? registryEntry.authKind
-        : provider.authMode === "forward" ? undefined : provider.authMode;
-  const staticPolicy = resolveModelPolicy({
-    providerName,
-    modelId: "__provider_static__",
-    provider,
-    registryEntry,
-    transportMatchedRegistry: true,
-    ...(canonicalAuthMode ? { effectiveAuth: { authMode: canonicalAuthMode } } : {}),
-  }).provider;
-  const reasoningEffortMap = staticPolicy.reasoningEffortMap;
-  const modelReasoningEffortMap = staticPolicy.modelReasoningEffortMap;
-  const modelReasoningEfforts = staticPolicy.modelReasoningEfforts;
-  const modelDefaultReasoningEfforts = staticPolicy.modelDefaultReasoningEfforts;
-  const modelContextWindows = staticPolicy.modelContextWindows;
-  const modelInputModalities = staticPolicy.modelInputModalities;
-  // Registry static headers are documented as applying to every upstream request, so they are
-  // filled at resolve time rather than only at seed time: a config written before a header
-  // existed, or one carrying any header of its own, would otherwise never receive it. User
-  // headers win, matched case-insensitively so an override replaces rather than duplicates.
-  const headers = staticPolicy.headers;
-  const modelMaxInputTokens = staticPolicy.modelMaxInputTokens;
-  const modelMaxOutputTokens = staticPolicy.modelMaxOutputTokens;
-  const modelSupportsServiceTier = staticPolicy.modelSupportsServiceTier;
-  const modelSupportsVerbosity = staticPolicy.modelSupportsVerbosity;
-  const noVisionModels = staticPolicy.noVisionModels;
-  const noReasoningModels = staticPolicy.noReasoningModels;
-  const noTemperatureModels = staticPolicy.noTemperatureModels;
-  const noTopPModels = staticPolicy.noTopPModels;
-  const noStopModels = staticPolicy.noStopModels;
-  const noPenaltyModels = staticPolicy.noPenaltyModels;
-  const noJsonSchemaModels = staticPolicy.noJsonSchemaModels;
-  const autoToolChoiceOnlyModels = staticPolicy.autoToolChoiceOnlyModels;
-  const preserveReasoningContentModels = staticPolicy.preserveReasoningContentModels;
-  const requiresReasoningPlaceholderModels = staticPolicy.requiresReasoningPlaceholderModels;
-  const reasoningSplitModels = staticPolicy.reasoningSplitModels;
-  const inlineThinkTagModels = staticPolicy.inlineThinkTagModels;
-  const reasoningDetailsModels = staticPolicy.reasoningDetailsModels;
-  const thinkingToggleModels = staticPolicy.thinkingToggleModels;
-  const thinkingBudgetModels = staticPolicy.thinkingBudgetModels;
-  const registryBaseUrlIsTemplate = /\{[^}]*\}/.test(registryEntry.baseUrl);
-  const userBaseUrl = typeof provider.baseUrl === "string" ? provider.baseUrl.trim() : "";
-  const userBaseUrlIsResolved = userBaseUrl.length > 0 && !/\{[^}]*\}/.test(userBaseUrl);
-  if (registryEntry.allowBaseUrlOverride && !userBaseUrlIsResolved) {
-    throw new Error(`Invalid baseUrl for provider "${providerName}": expected a nonblank URL without unresolved placeholders`);
-  }
-  // Registry template URLs are presets; local/self-hosted entries opt in explicitly.
-  const baseUrl = (registryBaseUrlIsTemplate || registryEntry.allowBaseUrlOverride) && userBaseUrlIsResolved
-    ? userBaseUrl
-    : registryEntry.baseUrl;
-  if (userBaseUrlIsResolved) warnIfBaseUrlDiscarded(providerName, userBaseUrl, baseUrl);
-  assertProviderDestinationAllowed(providerName, { baseUrl, allowPrivateNetwork: provider.allowPrivateNetwork });
-
-  const resolved: OcxProviderConfig = {
-    ...provider,
-    adapter: registryEntry.adapter,
-    baseUrl,
-    ...(provider.responsesPath === undefined && registryEntry.responsesPath !== undefined
-      ? { responsesPath: registryEntry.responsesPath }
-      : {}),
-    ...(provider.chatCompletionsPath === undefined && registryEntry.chatCompletionsPath !== undefined
-      ? { chatCompletionsPath: registryEntry.chatCompletionsPath }
-      : {}),
-    ...(provider.requiresAdjacentResponsesToolResults === undefined
-      && registryEntry.requiresAdjacentResponsesToolResults !== undefined
-      ? { requiresAdjacentResponsesToolResults: registryEntry.requiresAdjacentResponsesToolResults }
-      : {}),
-    ...(provider.requiresPairedResponsesToolResults === undefined
-      && registryEntry.requiresPairedResponsesToolResults !== undefined
-      ? { requiresPairedResponsesToolResults: registryEntry.requiresPairedResponsesToolResults }
-      : {}),
-    ...(provider.annotateEmptyToolOutputs === undefined
-      && registryEntry.annotateEmptyToolOutputs !== undefined
-      ? { annotateEmptyToolOutputs: registryEntry.annotateEmptyToolOutputs }
-      : {}),
-    ...(provider.fastWire === undefined && registryEntry.fastWire !== undefined
-      ? {
-        fastWire: cloneFastWire(registryEntry.fastWire),
-      }
-      : {}),
-    ...(provider.supportsServiceTier === undefined && registryEntry.supportsServiceTier !== undefined
-      ? { supportsServiceTier: registryEntry.supportsServiceTier }
-      : {}),
-    // An off Fast switch is a provider-wide denial on the runtime provider, so a Fast policy
-    // resolved without the provider name still refuses (providerFastSwitchOff).
-    ...(fastSwitchOff(provider, registryEntry) ? { supportsServiceTier: false } : {}),
-    // Registry-only web-search capability: without this backfill a saved provider row reaches
-    // the Responses adapter with the flag `undefined`, so the capability gate added in #2262
-    // reads "unclassified" and forwards Codex's OpenAI-only `web_search` config fields. xAI
-    // rejects the whole request before inference ("Argument not supported:
-    // external_web_access"), which killed every routed Grok turn on the Responses lane.
-    // enrichProviderFromRegistry() already fills this, but the request path resolves through
-    // routedProviderConfig() and never called it.
-    ...(provider.supportsOpenAiWebSearchToolFields === undefined
-      && registryEntry.supportsOpenAiWebSearchToolFields !== undefined
-      ? { supportsOpenAiWebSearchToolFields: registryEntry.supportsOpenAiWebSearchToolFields }
-      : {}),
-    ...(provider.supportsResponsesCustomTools === undefined && registryEntry.supportsResponsesCustomTools !== undefined
-      ? { supportsResponsesCustomTools: registryEntry.supportsResponsesCustomTools }
-      : {}),
-    ...(provider.preserveResponsesReasoningContent === undefined && registryEntry.preserveResponsesReasoningContent !== undefined
-      ? { preserveResponsesReasoningContent: registryEntry.preserveResponsesReasoningContent }
-      : {}),
-    ...(provider.preserveResponsesInputItemIds === undefined && registryEntry.preserveResponsesInputItemIds !== undefined
-      ? { preserveResponsesInputItemIds: registryEntry.preserveResponsesInputItemIds }
-      : {}),
-    ...(provider.preserveResponsesMessageMetadata === undefined && registryEntry.preserveResponsesMessageMetadata !== undefined
-      ? { preserveResponsesMessageMetadata: registryEntry.preserveResponsesMessageMetadata }
-      : {}),
-    ...(provider.dropResponsesReasoningItems === undefined && registryEntry.dropResponsesReasoningItems !== undefined
-      ? { dropResponsesReasoningItems: registryEntry.dropResponsesReasoningItems }
-      : {}),
-    // The request path resolves through routedProviderConfig() and never calls
-    // enrichProviderFromRegistry(), so a saved provider row written before the
-    // registry learned this flag must be backfilled here or route.provider never
-    // carries it and the showThinkingSummary opt-in stays dead.
-    ...(provider.showThinkingSummary === undefined && registryEntry.showThinkingSummary !== undefined
-      ? { showThinkingSummary: registryEntry.showThinkingSummary }
-      : {}),
-    // Registry-only client-facing repair policy (#938): fill only when the
-    // saved provider has no explicit policy; clone so runtime never aliases
-    // the registry constant.
-    ...(provider.responsesItemIdRepair === undefined && registryEntry.responsesItemIdRepair
-      ? {
-        responsesItemIdRepair: {
-          ...(registryEntry.responsesItemIdRepair.message ? { message: [...registryEntry.responsesItemIdRepair.message] } : {}),
-          ...(registryEntry.responsesItemIdRepair.reasoning ? { reasoning: [...registryEntry.responsesItemIdRepair.reasoning] } : {}),
-          ...(registryEntry.responsesItemIdRepair.repairMissingTerminalIds !== undefined
-            ? { repairMissingTerminalIds: registryEntry.responsesItemIdRepair.repairMissingTerminalIds }
-            : {}),
-          ...(registryEntry.responsesItemIdRepair.repairInvalidIds !== undefined
-            ? { repairInvalidIds: registryEntry.responsesItemIdRepair.repairInvalidIds }
-            : {}),
-        },
-      }
-      : {}),
-    authMode: canonicalAuthMode,
-    apiKey: resolvedApiKey,
-    ...(staticModelCatalog ? { liveModels: false } : {}),
-    ...(headers ? { headers } : {}),
-    // Backfill the Google wire mode + Vertex project/location from the registry when the user
-    // config omits them, so a minimal `google-vertex`/`google-antigravity` entry still routes
-    // through the correct branch (CCA/Vertex) instead of falling back to AI Studio.
-    ...(provider.googleMode === undefined && registryEntry.googleMode !== undefined ? { googleMode: registryEntry.googleMode } : {}),
-    ...(provider.project === undefined && registryEntry.project !== undefined ? { project: registryEntry.project } : {}),
-    ...(provider.location === undefined && registryEntry.location !== undefined ? { location: registryEntry.location } : {}),
-    ...(provider.contextWindow === undefined && registryEntry.contextWindow !== undefined ? { contextWindow: registryEntry.contextWindow } : {}),
-    ...((provider.reasoningEfforts === undefined || hasLegacyClinePassReasoningEfforts(providerName, provider))
-      && registryEntry.reasoningEfforts !== undefined
-      ? { reasoningEfforts: [...registryEntry.reasoningEfforts] }
-      : {}),
-    ...(provider.escapeBuiltinToolNames === undefined && registryEntry.escapeBuiltinToolNames !== undefined ? { escapeBuiltinToolNames: registryEntry.escapeBuiltinToolNames } : {}),
-    ...(provider.keyOptional === undefined && registryEntry.keyOptional !== undefined ? { keyOptional: registryEntry.keyOptional } : {}),
-    ...(provider.modelSuffixBracketStrip === undefined && registryEntry.modelSuffixBracketStrip !== undefined ? { modelSuffixBracketStrip: registryEntry.modelSuffixBracketStrip } : {}),
-    // Scalar backfill: a persisted config created before the flag shipped inherits the registry
-    // opt-in, while an explicit user `false` keeps overriding registry `true`.
-    ...(provider.parallelToolCalls === undefined && registryEntry.parallelToolCalls !== undefined ? { parallelToolCalls: registryEntry.parallelToolCalls } : {}),
-    ...(provider.promptCacheKey === undefined && registryEntry.promptCacheKey !== undefined ? { promptCacheKey: registryEntry.promptCacheKey } : {}),
-    ...(provider.chatServiceTier === undefined && registryEntry.chatServiceTier !== undefined ? { chatServiceTier: registryEntry.chatServiceTier } : {}),
-    ...(provider.openaiChatEofTolerance === undefined && registryEntry.openaiChatEofTolerance !== undefined
-      ? { openaiChatEofTolerance: registryEntry.openaiChatEofTolerance }
-      : {}),
-    ...(provider.reasoningWireFormat === undefined && registryEntry.reasoningWireFormat !== undefined
-      ? { reasoningWireFormat: registryEntry.reasoningWireFormat }
-      : {}),
-    ...(provider.defaultMaxOutputTokens === undefined && registryEntry.defaultMaxOutputTokens !== undefined
-      ? { defaultMaxOutputTokens: registryEntry.defaultMaxOutputTokens }
-      : {}),
-    ...(modelContextWindows ? { modelContextWindows } : {}),
-    ...(modelInputModalities ? { modelInputModalities } : {}),
-    ...(modelMaxInputTokens ? { modelMaxInputTokens } : {}),
-    ...(modelMaxOutputTokens ? { modelMaxOutputTokens } : {}),
-    ...(modelSupportsServiceTier ? { modelSupportsServiceTier } : {}),
-    ...(modelSupportsVerbosity ? { modelSupportsVerbosity } : {}),
-    ...(modelReasoningEfforts ? { modelReasoningEfforts } : {}),
-    ...(modelDefaultReasoningEfforts ? { modelDefaultReasoningEfforts } : {}),
-    ...(reasoningEffortMap ? { reasoningEffortMap } : {}),
-    ...(modelReasoningEffortMap ? { modelReasoningEffortMap } : {}),
-    ...(noVisionModels ? { noVisionModels } : {}),
-    ...(noReasoningModels ? { noReasoningModels } : {}),
-    ...(noTemperatureModels ? { noTemperatureModels } : {}),
-    ...(noTopPModels ? { noTopPModels } : {}),
-    ...(noStopModels ? { noStopModels } : {}),
-    ...(noPenaltyModels ? { noPenaltyModels } : {}),
-    ...(noJsonSchemaModels ? { noJsonSchemaModels } : {}),
-    ...(autoToolChoiceOnlyModels ? { autoToolChoiceOnlyModels } : {}),
-    ...(preserveReasoningContentModels ? { preserveReasoningContentModels } : {}),
-    ...(requiresReasoningPlaceholderModels ? { requiresReasoningPlaceholderModels } : {}),
-    ...(reasoningSplitModels ? { reasoningSplitModels } : {}),
-    ...(inlineThinkTagModels ? { inlineThinkTagModels } : {}),
-    ...(reasoningDetailsModels ? { reasoningDetailsModels } : {}),
-    ...(thinkingToggleModels ? { thinkingToggleModels } : {}),
-    ...(thinkingBudgetModels ? { thinkingBudgetModels } : {}),
-  };
-  applyDirectReasoningEffortContracts(registryEntry, resolved, provider);
-  return resolved;
-}
+// `routedProviderConfig` and its warning memo moved to `providers/routed-config.ts`: the
+// request-time resolver needs no routing state, and `providers/api-key-selection.ts` importing
+// it through this file created an import cycle (router -> quota -> api-keys -> api-key-selection).
+export { reconcileRouterWarningMemos, routedProviderConfig } from "./providers/routed-config";
 
 /**
  * Rows eligible for bare-model inference (configured default model, model list, model alias).
@@ -622,7 +308,8 @@ function crossProviderRedirectTarget(config: OcxConfig, providerName: string, va
   }
 }
 
-function isBareOpenAiFamilyModel(modelId: string): boolean {
+/** Exported for the main-account hard-lock fallback: only this family is ever redirected. */
+export function isBareOpenAiFamilyModel(modelId: string): boolean {
   return !modelId.includes("/")
     && (/^(?:gpt-|o1-|o3-|o4-)/.test(modelId) || CODEX_INTERNAL_OPENAI_MODELS.has(modelId));
 }

package/src/routing/health.ts

@@ -94,7 +94,6 @@ interface HealthSample {
 }
 
 interface HealthRow extends HealthSample {
-  attemptCount?: number;
   rowJson?: string | null;
 }
 
@@ -103,33 +102,53 @@ interface HealthRow extends HealthSample {
  * Combo/failover requests store each upstream try in `entry.attempts` while
  * the top-level row records the final outcome; a provider/model that failed
  * as a non-final attempt must still contribute its own health samples.
+ *
+ * Only physical sends are evidence: an attempt answered locally or refused
+ * before it left the proxy says nothing about the target. The row's terminal
+ * facts belong to its last physical send. Returns `undefined` when the row
+ * itself is the sample (no attempts, a single attempt, or none named for this
+ * candidate) and `[]` when the row sent nothing upstream at all.
  */
 function attemptSamplesFor(
-  row: Pick<HealthRow, "timestamp" | "attemptCount" | "rowJson">,
+  row: Pick<HealthRow, "timestamp" | "rowJson">,
   provider: string,
   model: string,
-): HealthSample[] {
-  if (!row.rowJson || (row.attemptCount ?? 1) <= 1) return [];
+): HealthSample[] | undefined {
+  if (!row.rowJson) return undefined;
   try {
-    const parsed = JSON.parse(row.rowJson) as { attempts?: unknown };
-    if (!Array.isArray(parsed.attempts)) return [];
+    const parsed = JSON.parse(row.rowJson) as {
+      attempts?: unknown;
+      closeReason?: unknown;
+      terminalStatus?: unknown;
+      failureCause?: unknown;
+    };
+    // A local refusal logged before any attempt began never reached a target.
+    if (!Array.isArray(parsed.attempts)) return parsed.failureCause === "local-refusal" ? [] : undefined;
+    const attempts = parsed.attempts.filter(
+      (attempt): attempt is Record<string, unknown> =>
+        !!attempt && typeof attempt === "object" && !Array.isArray(attempt),
+    );
+    const sent = attempts.filter(attempt => attempt.locallyAnswered !== true && attempt.sendCount !== 0);
+    if (sent.length === 0) return [];
+    const mine = attempts.filter(attempt => attempt.provider === provider && attempt.model === model);
+    if (attempts.length <= 1 || mine.length === 0) return undefined;
+    const finalSend = sent.at(-1);
     const samples: HealthSample[] = [];
-    for (const attempt of parsed.attempts) {
-      if (!attempt || typeof attempt !== "object" || Array.isArray(attempt)) continue;
-      const record = attempt as Record<string, unknown>;
-      if (record.provider !== provider || record.model !== model) continue;
+    for (const record of mine) {
+      if (!sent.includes(record)) continue;
       if (typeof record.status !== "number" || typeof record.durationMs !== "number") continue;
+      const isFinal = record === finalSend;
       samples.push({
         status: record.status,
-        closeReason: null,
-        terminalStatus: null,
+        closeReason: isFinal && typeof parsed.closeReason === "string" ? parsed.closeReason : null,
+        terminalStatus: isFinal && typeof parsed.terminalStatus === "string" ? parsed.terminalStatus : null,
         durationMs: record.durationMs,
         timestamp: row.timestamp,
       });
     }
     return samples;
   } catch {
-    return [];
+    return undefined;
   }
 }
 
@@ -243,8 +262,7 @@ function computeHistoricalHealthEvidence(
     }
     const rows = handle.query(
       `SELECT status, close_reason AS closeReason, terminal_status AS terminalStatus,
-              duration_ms AS durationMs, timestamp,
-              attempt_count AS attemptCount, row_json AS rowJson
+              duration_ms AS durationMs, timestamp, row_json AS rowJson
        FROM requests WHERE ${where.join(" AND ")}
        ORDER BY timestamp DESC LIMIT ?`,
     ).all(...values, HEALTH_MAX_SAMPLES) as HealthRow[];
@@ -254,7 +272,7 @@ function computeHistoricalHealthEvidence(
     // rows that cannot contribute samples for this candidate.
     const escapeLike = (value: string): string => value.replace(/[\\%_]/g, match => `\\${match}`);
     const attemptRows = handle.query(
-      `SELECT timestamp, attempt_count AS attemptCount, row_json AS rowJson
+      `SELECT timestamp, row_json AS rowJson
        FROM requests WHERE timestamp >= ? AND attempt_count > 1
          AND row_json LIKE ? ESCAPE '\\'
          AND row_json LIKE ? ESCAPE '\\'
@@ -267,17 +285,14 @@ function computeHistoricalHealthEvidence(
       input.provider,
       input.model,
       HEALTH_MAX_SAMPLES,
-    ) as Array<
-      Pick<HealthRow, "timestamp" | "attemptCount" | "rowJson">
-    >;
+    ) as Array<Pick<HealthRow, "timestamp" | "rowJson">>;
 
     const samples: HealthSample[] = [];
     for (const row of rows) {
-      const attemptSamples = attemptSamplesFor(row, input.provider, input.model);
-      samples.push(...(attemptSamples.length > 0 ? attemptSamples : [row]));
+      samples.push(...(attemptSamplesFor(row, input.provider, input.model) ?? [row]));
     }
     for (const row of attemptRows) {
-      samples.push(...attemptSamplesFor(row, input.provider, input.model));
+      samples.push(...(attemptSamplesFor(row, input.provider, input.model) ?? []));
     }
     // Newest first for the consecutive-failure walk; attempt samples inherit
     // their row's timestamp.