@bitkyc08/opencodex 2.86.0 → 2.87.0

package/src/router.ts

@@ -14,25 +14,16 @@ import {
 import type { NormalizedComboConfig } from "./combos/types";
 import { hasOwnProvider } from "./config/provider-name";
 import { anthropicInstanceRowShapeMatches } from "./providers/anthropic-instance-id";
-import { providerUsesKeyAuthOverride, resolveProviderApiKey } from "./providers/key-store";
-import { captureProviderApiKeySelection } from "./providers/api-key-selection-capture";
+import { reconcileRouterWarningMemos, routedProviderConfig } from "./providers/routed-config";
 import { assertProviderDestinationAllowed } from "./lib/destination-policy";
-import { redactSecretString, redactUrlForLog } from "./lib/redact";
 import {
   PROVIDER_REGISTRY,
   providerCodexAccountMode,
-  registryEntryForProviderDestination,
 } from "./providers/registry";
 // Imported from the module directly rather than through the registry facade, which is at its
 // file-size cap.
 import { registryModelIdKeys } from "./providers/registry/model-ids";
-import { applyDirectReasoningEffortContracts, hasLegacyClinePassReasoningEfforts } from "./providers/derive";
-import { cloneFastWire } from "./providers/fastwire";
-import { fastSwitchOff } from "./providers/fast-opt-in";
-import {
-  providerMatchesRegistryTransportWithStaticGuards,
-  providerSupportsLiveModelDiscovery,
-} from "./providers/static-model-discovery";
+import { providerMatchesRegistryTransportWithStaticGuards } from "./providers/static-model-discovery";
 import {
   isCanonicalOpenAiForwardProvider,
   LEGACY_CHATGPT_PROVIDER_ID,
@@ -202,82 +193,6 @@ export function knownModelIdsForProvider(
   return [...ids];
 }
 
-/** Same endpoint modulo surrounding space and trailing slashes — matches `matchBaseUrlChoice`. */
-function isSameEndpoint(a: string, b: string): boolean {
-  return a.trim().replace(/\/+$/, "") === b.trim().replace(/\/+$/, "");
-}
-
-/**
- * Origin of a user-configured URL, with the path withheld.
- *
- * A configured `baseUrl` is user-controlled and its path may itself be the credential — an
- * account-scoped route token such as `https://proxy.example/v1/8fK2mP7qR4nV6x` is opaque and
- * high-entropy, so it matches none of the prefix patterns in `redactSecretString`. Pattern
- * redaction cannot be trusted for this value, so no path segment is logged at all. `URL.origin`
- * also excludes userinfo, query and fragment.
- *
- * `…/…` marks that a path was present without revealing it, so a reader can tell an origin-only
- * config apart from one whose path was dropped.
- */
-function configuredOriginForLog(url: string): string {
-  try {
-    const parsed = new URL(url.trim());
-    // "null" is what URL.origin yields for non-special schemes; treat it as unusable.
-    if (!parsed.origin || parsed.origin === "null") return "(unloggable URL)";
-    const hasPath = parsed.pathname !== "" && parsed.pathname !== "/";
-    return hasPath ? `${parsed.origin}/…` : parsed.origin;
-  } catch {
-    return "(unparseable URL)";
-  }
-}
-
-// `routedProviderConfig` runs per request, so warn once per (provider, discarded, effective) triple.
-// Keyed by the URLs too: editing config.json to a different wrong value warns again.
-const discardedBaseUrlWarnings = new Set<string>();
-let lastWarningReconciledGeneration = 0;
-
-export function reconcileRouterWarningMemos(generation: number): number {
-  if (generation <= lastWarningReconciledGeneration) return 0;
-  const removed = discardedBaseUrlWarnings.size;
-  discardedBaseUrlWarnings.clear();
-  lastWarningReconciledGeneration = generation;
-  return removed;
-}
-
-/**
- * A pinned registry entry — non-template `baseUrl`, no `allowBaseUrlOverride` — outranks a saved
- * `baseUrl`. Dropping it silently is a footgun: requests go to an endpoint the user never
- * configured, and a wrong-region or wrong-account URL then surfaces only as a 401 with nothing
- * pointing back at the discarded setting.
- *
- * Warns rather than throws. The effective route is exactly what it was before, so a hard error
- * here would break configs that route fine today (a stale `baseUrl` left over from an earlier
- * provider is harmless whenever it names the same endpoint the registry pins).
- */
-function warnIfBaseUrlDiscarded(providerName: string, userBaseUrl: string, effectiveBaseUrl: string): void {
-  if (isSameEndpoint(userBaseUrl, effectiveBaseUrl)) return;
-  // Asymmetric on purpose. Past the guard above, `effectiveBaseUrl` is necessarily
-  // `registryEntry.baseUrl`: the caller passes the resolved URL, and whenever that resolution
-  // kept the user's value the two are equal and we have already returned. So the effective side
-  // is a constant from this repo's registry and safe to print in full — it is also the useful
-  // half, naming the endpoint requests will actually use. The configured side is untrusted.
-  const discarded = configuredOriginForLog(userBaseUrl);
-  const effective = redactSecretString(redactUrlForLog(effectiveBaseUrl));
-  // Key off the logged forms: no raw credential is retained for the process lifetime, and
-  // rotating a key embedded in the URL no longer re-warns about the same endpoint mismatch.
-  // Coarser than the raw URLs — two bad paths on one host warn once, which is the right grain.
-  const key = `${providerName} | ${discarded} | ${effective}`;
-  if (discardedBaseUrlWarnings.has(key)) return;
-  discardedBaseUrlWarnings.add(key);
-  console.warn(
-    // Routing is what this warning speaks for: an adapter may adjust the endpoint again
-    // downstream (kiro re-derives the region), so do not promise where the request lands.
-    `⚠️  config.json provider "${providerName}": configured baseUrl ${discarded} is ignored`
-    + ` because this provider's endpoint is fixed at ${effective}. A URL saved for a different`
-    + ` account or region is a common cause of 401s here — drop it, or use the provider whose endpoint matches.`,
-  );
-}
-
 /**
  * One notice per provider id: the destination is an operator-configured key
  * (never a caller-supplied string), so the log carries no request content.
@@ -297,239 +212,10 @@ export function resetCompactionFallbackWarningsForTests(): void {
   compactionFallbackWarnings.clear();
 }
 
-function usableResolvedApiKey(apiKey: string | undefined): string | undefined {
-  const resolved = resolveProviderApiKey(apiKey);
-  return typeof resolved === "string" && resolved.trim().length > 0 ? resolved : undefined;
-}
-
-export function routedProviderConfig(providerName: string, provider: OcxProviderConfig): OcxProviderConfig {
-  provider = { ...provider, _apiKeyAttempt: provider._apiKeyAttempt ?? captureProviderApiKeySelection(provider) };
-  const registryEntry = PROVIDER_REGISTRY.find(entry => entry.id === providerName);
-  if (!registryEntry || !providerMatchesRegistryTransportWithStaticGuards(providerName, provider)) {
-    assertProviderDestinationAllowed(providerName, provider);
-    // A row whose adapter no longer matches its registry entry still reaches the Responses
-    // adapter when one model opts in through `modelAdapters` — a Volcengine Coding Plan config
-    // saved on Chat, for instance. The replay-drop flag belongs to the DESTINATION rather than
-    // to the provider-wide wire, so it is filled here too; without it that continuation forwards
-    // the reasoning item the upstream answers 400 to. Destination matching refuses templated and
-    // overridable base URLs, so this cannot follow a retargeted row, and an explicit value wins.
-    const destination = registryEntryForProviderDestination(provider);
-    return {
-      ...provider,
-      apiKey: usableResolvedApiKey(provider.apiKey),
-      ...(provider.dropResponsesReasoningItems === undefined && destination?.dropResponsesReasoningItems !== undefined
-        ? { dropResponsesReasoningItems: destination.dropResponsesReasoningItems }
-        : {}),
-    };
-  }
-  const resolvedApiKey = usableResolvedApiKey(provider.apiKey);
-  const staticModelCatalog = !providerSupportsLiveModelDiscovery(providerName, provider);
-  const repairLegacyMimoFreeAuth = providerName === "mimo-free"
-    && staticModelCatalog
-    && (provider.authMode === undefined || provider.authMode === "local");
-  const explicitKeyOverride = providerUsesKeyAuthOverride(registryEntry, provider, resolvedApiKey);
-  const canonicalAuthMode = explicitKeyOverride
-    ? "key"
-    : repairLegacyMimoFreeAuth
-      ? "key"
-      : registryEntry.authKind === "forward" || registryEntry.authKind === "oauth"
-        ? registryEntry.authKind
-        : provider.authMode === "forward" ? undefined : provider.authMode;
-  const staticPolicy = resolveModelPolicy({
-    providerName,
-    modelId: "__provider_static__",
-    provider,
-    registryEntry,
-    transportMatchedRegistry: true,
-    ...(canonicalAuthMode ? { effectiveAuth: { authMode: canonicalAuthMode } } : {}),
-  }).provider;
-  const reasoningEffortMap = staticPolicy.reasoningEffortMap;
-  const modelReasoningEffortMap = staticPolicy.modelReasoningEffortMap;
-  const modelReasoningEfforts = staticPolicy.modelReasoningEfforts;
-  const modelDefaultReasoningEfforts = staticPolicy.modelDefaultReasoningEfforts;
-  const modelContextWindows = staticPolicy.modelContextWindows;
-  const modelInputModalities = staticPolicy.modelInputModalities;
-  // Registry static headers are documented as applying to every upstream request, so they are
-  // filled at resolve time rather than only at seed time: a config written before a header
-  // existed, or one carrying any header of its own, would otherwise never receive it. User
-  // headers win, matched case-insensitively so an override replaces rather than duplicates.
-  const headers = staticPolicy.headers;
-  const modelMaxInputTokens = staticPolicy.modelMaxInputTokens;
-  const modelMaxOutputTokens = staticPolicy.modelMaxOutputTokens;
-  const modelSupportsServiceTier = staticPolicy.modelSupportsServiceTier;
-  const modelSupportsVerbosity = staticPolicy.modelSupportsVerbosity;
-  const noVisionModels = staticPolicy.noVisionModels;
-  const noReasoningModels = staticPolicy.noReasoningModels;
-  const noTemperatureModels = staticPolicy.noTemperatureModels;
-  const noTopPModels = staticPolicy.noTopPModels;
-  const noStopModels = staticPolicy.noStopModels;
-  const noPenaltyModels = staticPolicy.noPenaltyModels;
-  const noJsonSchemaModels = staticPolicy.noJsonSchemaModels;
-  const autoToolChoiceOnlyModels = staticPolicy.autoToolChoiceOnlyModels;
-  const preserveReasoningContentModels = staticPolicy.preserveReasoningContentModels;
-  const requiresReasoningPlaceholderModels = staticPolicy.requiresReasoningPlaceholderModels;
-  const reasoningSplitModels = staticPolicy.reasoningSplitModels;
-  const inlineThinkTagModels = staticPolicy.inlineThinkTagModels;
-  const reasoningDetailsModels = staticPolicy.reasoningDetailsModels;
-  const thinkingToggleModels = staticPolicy.thinkingToggleModels;
-  const thinkingBudgetModels = staticPolicy.thinkingBudgetModels;
-  const registryBaseUrlIsTemplate = /\{[^}]*\}/.test(registryEntry.baseUrl);
-  const userBaseUrl = typeof provider.baseUrl === "string" ? provider.baseUrl.trim() : "";
-  const userBaseUrlIsResolved = userBaseUrl.length > 0 && !/\{[^}]*\}/.test(userBaseUrl);
-  if (registryEntry.allowBaseUrlOverride && !userBaseUrlIsResolved) {
-    throw new Error(`Invalid baseUrl for provider "${providerName}": expected a nonblank URL without unresolved placeholders`);
-  }
-  // Registry template URLs are presets; local/self-hosted entries opt in explicitly.
-  const baseUrl = (registryBaseUrlIsTemplate || registryEntry.allowBaseUrlOverride) && userBaseUrlIsResolved
-    ? userBaseUrl
-    : registryEntry.baseUrl;
-  if (userBaseUrlIsResolved) warnIfBaseUrlDiscarded(providerName, userBaseUrl, baseUrl);
-  assertProviderDestinationAllowed(providerName, { baseUrl, allowPrivateNetwork: provider.allowPrivateNetwork });
-
-  const resolved: OcxProviderConfig = {
-    ...provider,
-    adapter: registryEntry.adapter,
-    baseUrl,
-    ...(provider.responsesPath === undefined && registryEntry.responsesPath !== undefined
-      ? { responsesPath: registryEntry.responsesPath }
-      : {}),
-    ...(provider.chatCompletionsPath === undefined && registryEntry.chatCompletionsPath !== undefined
-      ? { chatCompletionsPath: registryEntry.chatCompletionsPath }
-      : {}),
-    ...(provider.requiresAdjacentResponsesToolResults === undefined
-      && registryEntry.requiresAdjacentResponsesToolResults !== undefined
-      ? { requiresAdjacentResponsesToolResults: registryEntry.requiresAdjacentResponsesToolResults }
-      : {}),
-    ...(provider.requiresPairedResponsesToolResults === undefined
-      && registryEntry.requiresPairedResponsesToolResults !== undefined
-      ? { requiresPairedResponsesToolResults: registryEntry.requiresPairedResponsesToolResults }
-      : {}),
-    ...(provider.annotateEmptyToolOutputs === undefined
-      && registryEntry.annotateEmptyToolOutputs !== undefined
-      ? { annotateEmptyToolOutputs: registryEntry.annotateEmptyToolOutputs }
-      : {}),
-    ...(provider.fastWire === undefined && registryEntry.fastWire !== undefined
-      ? {
-        fastWire: cloneFastWire(registryEntry.fastWire),
-      }
-      : {}),
-    ...(provider.supportsServiceTier === undefined && registryEntry.supportsServiceTier !== undefined
-      ? { supportsServiceTier: registryEntry.supportsServiceTier }
-      : {}),
-    // An off Fast switch is a provider-wide denial on the runtime provider, so a Fast policy
-    // resolved without the provider name still refuses (providerFastSwitchOff).
-    ...(fastSwitchOff(provider, registryEntry) ? { supportsServiceTier: false } : {}),
-    // Registry-only web-search capability: without this backfill a saved provider row reaches
-    // the Responses adapter with the flag `undefined`, so the capability gate added in #2262
-    // reads "unclassified" and forwards Codex's OpenAI-only `web_search` config fields. xAI
-    // rejects the whole request before inference ("Argument not supported:
-    // external_web_access"), which killed every routed Grok turn on the Responses lane.
-    // enrichProviderFromRegistry() already fills this, but the request path resolves through
-    // routedProviderConfig() and never called it.
-    ...(provider.supportsOpenAiWebSearchToolFields === undefined
-      && registryEntry.supportsOpenAiWebSearchToolFields !== undefined
-      ? { supportsOpenAiWebSearchToolFields: registryEntry.supportsOpenAiWebSearchToolFields }
-      : {}),
-    ...(provider.supportsResponsesCustomTools === undefined && registryEntry.supportsResponsesCustomTools !== undefined
-      ? { supportsResponsesCustomTools: registryEntry.supportsResponsesCustomTools }
-      : {}),
-    ...(provider.preserveResponsesReasoningContent === undefined && registryEntry.preserveResponsesReasoningContent !== undefined
-      ? { preserveResponsesReasoningContent: registryEntry.preserveResponsesReasoningContent }
-      : {}),
-    ...(provider.preserveResponsesInputItemIds === undefined && registryEntry.preserveResponsesInputItemIds !== undefined
-      ? { preserveResponsesInputItemIds: registryEntry.preserveResponsesInputItemIds }
-      : {}),
-    ...(provider.preserveResponsesMessageMetadata === undefined && registryEntry.preserveResponsesMessageMetadata !== undefined
-      ? { preserveResponsesMessageMetadata: registryEntry.preserveResponsesMessageMetadata }
-      : {}),
-    ...(provider.dropResponsesReasoningItems === undefined && registryEntry.dropResponsesReasoningItems !== undefined
-      ? { dropResponsesReasoningItems: registryEntry.dropResponsesReasoningItems }
-      : {}),
-    // The request path resolves through routedProviderConfig() and never calls
-    // enrichProviderFromRegistry(), so a saved provider row written before the
-    // registry learned this flag must be backfilled here or route.provider never
-    // carries it and the showThinkingSummary opt-in stays dead.
-    ...(provider.showThinkingSummary === undefined && registryEntry.showThinkingSummary !== undefined
-      ? { showThinkingSummary: registryEntry.showThinkingSummary }
-      : {}),
-    // Registry-only client-facing repair policy (#938): fill only when the
-    // saved provider has no explicit policy; clone so runtime never aliases
-    // the registry constant.
-    ...(provider.responsesItemIdRepair === undefined && registryEntry.responsesItemIdRepair
-      ? {
-        responsesItemIdRepair: {
-          ...(registryEntry.responsesItemIdRepair.message ? { message: [...registryEntry.responsesItemIdRepair.message] } : {}),
-          ...(registryEntry.responsesItemIdRepair.reasoning ? { reasoning: [...registryEntry.responsesItemIdRepair.reasoning] } : {}),
-          ...(registryEntry.responsesItemIdRepair.repairMissingTerminalIds !== undefined
-            ? { repairMissingTerminalIds: registryEntry.responsesItemIdRepair.repairMissingTerminalIds }
-            : {}),
-          ...(registryEntry.responsesItemIdRepair.repairInvalidIds !== undefined
-            ? { repairInvalidIds: registryEntry.responsesItemIdRepair.repairInvalidIds }
-            : {}),
-        },
-      }
-      : {}),
-    authMode: canonicalAuthMode,
-    apiKey: resolvedApiKey,
-    ...(staticModelCatalog ? { liveModels: false } : {}),
-    ...(headers ? { headers } : {}),
-    // Backfill the Google wire mode + Vertex project/location from the registry when the user
-    // config omits them, so a minimal `google-vertex`/`google-antigravity` entry still routes
-    // through the correct branch (CCA/Vertex) instead of falling back to AI Studio.
-    ...(provider.googleMode === undefined && registryEntry.googleMode !== undefined ? { googleMode: registryEntry.googleMode } : {}),
-    ...(provider.project === undefined && registryEntry.project !== undefined ? { project: registryEntry.project } : {}),
-    ...(provider.location === undefined && registryEntry.location !== undefined ? { location: registryEntry.location } : {}),
-    ...(provider.contextWindow === undefined && registryEntry.contextWindow !== undefined ? { contextWindow: registryEntry.contextWindow } : {}),
-    ...((provider.reasoningEfforts === undefined || hasLegacyClinePassReasoningEfforts(providerName, provider))
-      && registryEntry.reasoningEfforts !== undefined
-      ? { reasoningEfforts: [...registryEntry.reasoningEfforts] }
-      : {}),
-    ...(provider.escapeBuiltinToolNames === undefined && registryEntry.escapeBuiltinToolNames !== undefined ? { escapeBuiltinToolNames: registryEntry.escapeBuiltinToolNames } : {}),
-    ...(provider.keyOptional === undefined && registryEntry.keyOptional !== undefined ? { keyOptional: registryEntry.keyOptional } : {}),
-    ...(provider.modelSuffixBracketStrip === undefined && registryEntry.modelSuffixBracketStrip !== undefined ? { modelSuffixBracketStrip: registryEntry.modelSuffixBracketStrip } : {}),
-    // Scalar backfill: a persisted config created before the flag shipped inherits the registry
-    // opt-in, while an explicit user `false` keeps overriding registry `true`.
-    ...(provider.parallelToolCalls === undefined && registryEntry.parallelToolCalls !== undefined ? { parallelToolCalls: registryEntry.parallelToolCalls } : {}),
-    ...(provider.promptCacheKey === undefined && registryEntry.promptCacheKey !== undefined ? { promptCacheKey: registryEntry.promptCacheKey } : {}),
-    ...(provider.chatServiceTier === undefined && registryEntry.chatServiceTier !== undefined ? { chatServiceTier: registryEntry.chatServiceTier } : {}),
-    ...(provider.openaiChatEofTolerance === undefined && registryEntry.openaiChatEofTolerance !== undefined
-      ? { openaiChatEofTolerance: registryEntry.openaiChatEofTolerance }
-      : {}),
-    ...(provider.reasoningWireFormat === undefined && registryEntry.reasoningWireFormat !== undefined
-      ? { reasoningWireFormat: registryEntry.reasoningWireFormat }
-      : {}),
-    ...(provider.defaultMaxOutputTokens === undefined && registryEntry.defaultMaxOutputTokens !== undefined
-      ? { defaultMaxOutputTokens: registryEntry.defaultMaxOutputTokens }
-      : {}),
-    ...(modelContextWindows ? { modelContextWindows } : {}),
-    ...(modelInputModalities ? { modelInputModalities } : {}),
-    ...(modelMaxInputTokens ? { modelMaxInputTokens } : {}),
-    ...(modelMaxOutputTokens ? { modelMaxOutputTokens } : {}),
-    ...(modelSupportsServiceTier ? { modelSupportsServiceTier } : {}),
-    ...(modelSupportsVerbosity ? { modelSupportsVerbosity } : {}),
-    ...(modelReasoningEfforts ? { modelReasoningEfforts } : {}),
-    ...(modelDefaultReasoningEfforts ? { modelDefaultReasoningEfforts } : {}),
-    ...(reasoningEffortMap ? { reasoningEffortMap } : {}),
-    ...(modelReasoningEffortMap ? { modelReasoningEffortMap } : {}),
-    ...(noVisionModels ? { noVisionModels } : {}),
-    ...(noReasoningModels ? { noReasoningModels } : {}),
-    ...(noTemperatureModels ? { noTemperatureModels } : {}),
-    ...(noTopPModels ? { noTopPModels } : {}),
-    ...(noStopModels ? { noStopModels } : {}),
-    ...(noPenaltyModels ? { noPenaltyModels } : {}),
-    ...(noJsonSchemaModels ? { noJsonSchemaModels } : {}),
-    ...(autoToolChoiceOnlyModels ? { autoToolChoiceOnlyModels } : {}),
-    ...(preserveReasoningContentModels ? { preserveReasoningContentModels } : {}),
-    ...(requiresReasoningPlaceholderModels ? { requiresReasoningPlaceholderModels } : {}),
-    ...(reasoningSplitModels ? { reasoningSplitModels } : {}),
-    ...(inlineThinkTagModels ? { inlineThinkTagModels } : {}),
-    ...(reasoningDetailsModels ? { reasoningDetailsModels } : {}),
-    ...(thinkingToggleModels ? { thinkingToggleModels } : {}),
-    ...(thinkingBudgetModels ? { thinkingBudgetModels } : {}),
-  };
-  applyDirectReasoningEffortContracts(registryEntry, resolved, provider);
-  return resolved;
-}
+// `routedProviderConfig` and its warning memo moved to `providers/routed-config.ts`: the
+// request-time resolver needs no routing state, and `providers/api-key-selection.ts` importing
+// it through this file created an import cycle (router -> quota -> api-keys -> api-key-selection).
+export { reconcileRouterWarningMemos, routedProviderConfig } from "./providers/routed-config";
 
 /**
  * Rows eligible for bare-model inference (configured default model, model list, model alias).
@@ -622,7 +308,8 @@ function crossProviderRedirectTarget(config: OcxConfig, providerName: string, va
   }
 }
 
-function isBareOpenAiFamilyModel(modelId: string): boolean {
+/** Exported for the main-account hard-lock fallback: only this family is ever redirected. */
+export function isBareOpenAiFamilyModel(modelId: string): boolean {
   return !modelId.includes("/")
     && (/^(?:gpt-|o1-|o3-|o4-)/.test(modelId) || CODEX_INTERNAL_OPENAI_MODELS.has(modelId));
 }

package/src/routing/health.ts

@@ -94,7 +94,6 @@ interface HealthSample {
 }
 
 interface HealthRow extends HealthSample {
-  attemptCount?: number;
   rowJson?: string | null;
 }
 
@@ -103,33 +102,53 @@ interface HealthRow extends HealthSample {
  * Combo/failover requests store each upstream try in `entry.attempts` while
  * the top-level row records the final outcome; a provider/model that failed
  * as a non-final attempt must still contribute its own health samples.
+ *
+ * Only physical sends are evidence: an attempt answered locally or refused
+ * before it left the proxy says nothing about the target. The row's terminal
+ * facts belong to its last physical send. Returns `undefined` when the row
+ * itself is the sample (no attempts, a single attempt, or none named for this
+ * candidate) and `[]` when the row sent nothing upstream at all.
  */
 function attemptSamplesFor(
-  row: Pick<HealthRow, "timestamp" | "attemptCount" | "rowJson">,
+  row: Pick<HealthRow, "timestamp" | "rowJson">,
   provider: string,
   model: string,
-): HealthSample[] {
-  if (!row.rowJson || (row.attemptCount ?? 1) <= 1) return [];
+): HealthSample[] | undefined {
+  if (!row.rowJson) return undefined;
   try {
-    const parsed = JSON.parse(row.rowJson) as { attempts?: unknown };
-    if (!Array.isArray(parsed.attempts)) return [];
+    const parsed = JSON.parse(row.rowJson) as {
+      attempts?: unknown;
+      closeReason?: unknown;
+      terminalStatus?: unknown;
+      failureCause?: unknown;
+    };
+    // A local refusal logged before any attempt began never reached a target.
+    if (!Array.isArray(parsed.attempts)) return parsed.failureCause === "local-refusal" ? [] : undefined;
+    const attempts = parsed.attempts.filter(
+      (attempt): attempt is Record<string, unknown> =>
+        !!attempt && typeof attempt === "object" && !Array.isArray(attempt),
+    );
+    const sent = attempts.filter(attempt => attempt.locallyAnswered !== true && attempt.sendCount !== 0);
+    if (sent.length === 0) return [];
+    const mine = attempts.filter(attempt => attempt.provider === provider && attempt.model === model);
+    if (attempts.length <= 1 || mine.length === 0) return undefined;
+    const finalSend = sent.at(-1);
     const samples: HealthSample[] = [];
-    for (const attempt of parsed.attempts) {
-      if (!attempt || typeof attempt !== "object" || Array.isArray(attempt)) continue;
-      const record = attempt as Record<string, unknown>;
-      if (record.provider !== provider || record.model !== model) continue;
+    for (const record of mine) {
+      if (!sent.includes(record)) continue;
       if (typeof record.status !== "number" || typeof record.durationMs !== "number") continue;
+      const isFinal = record === finalSend;
       samples.push({
         status: record.status,
-        closeReason: null,
-        terminalStatus: null,
+        closeReason: isFinal && typeof parsed.closeReason === "string" ? parsed.closeReason : null,
+        terminalStatus: isFinal && typeof parsed.terminalStatus === "string" ? parsed.terminalStatus : null,
         durationMs: record.durationMs,
         timestamp: row.timestamp,
       });
     }
     return samples;
   } catch {
-    return [];
+    return undefined;
   }
 }
 
@@ -243,8 +262,7 @@ function computeHistoricalHealthEvidence(
     }
     const rows = handle.query(
       `SELECT status, close_reason AS closeReason, terminal_status AS terminalStatus,
-              duration_ms AS durationMs, timestamp,
-              attempt_count AS attemptCount, row_json AS rowJson
+              duration_ms AS durationMs, timestamp, row_json AS rowJson
        FROM requests WHERE ${where.join(" AND ")}
        ORDER BY timestamp DESC LIMIT ?`,
     ).all(...values, HEALTH_MAX_SAMPLES) as HealthRow[];
@@ -254,7 +272,7 @@ function computeHistoricalHealthEvidence(
     // rows that cannot contribute samples for this candidate.
     const escapeLike = (value: string): string => value.replace(/[\\%_]/g, match => `\\${match}`);
     const attemptRows = handle.query(
-      `SELECT timestamp, attempt_count AS attemptCount, row_json AS rowJson
+      `SELECT timestamp, row_json AS rowJson
        FROM requests WHERE timestamp >= ? AND attempt_count > 1
          AND row_json LIKE ? ESCAPE '\\'
          AND row_json LIKE ? ESCAPE '\\'
@@ -267,17 +285,14 @@ function computeHistoricalHealthEvidence(
       input.provider,
       input.model,
       HEALTH_MAX_SAMPLES,
-    ) as Array<
-      Pick<HealthRow, "timestamp" | "attemptCount" | "rowJson">
-    >;
+    ) as Array<Pick<HealthRow, "timestamp" | "rowJson">>;
 
     const samples: HealthSample[] = [];
     for (const row of rows) {
-      const attemptSamples = attemptSamplesFor(row, input.provider, input.model);
-      samples.push(...(attemptSamples.length > 0 ? attemptSamples : [row]));
+      samples.push(...(attemptSamplesFor(row, input.provider, input.model) ?? [row]));
     }
     for (const row of attemptRows) {
-      samples.push(...attemptSamplesFor(row, input.provider, input.model));
+      samples.push(...(attemptSamplesFor(row, input.provider, input.model) ?? []));
     }
     // Newest first for the consecutive-failure walk; attempt samples inherit
     // their row's timestamp.

package/src/routing/history/indexer.ts

@@ -195,17 +195,18 @@ function readStoredMetaField(dbHandle: Database, key: string): string {
   return metaValue(dbHandle, key) ?? "";
 }
 
-function sourceIdentityMatches(dbHandle: Database, revision: UsageLogRevision | null): boolean {
+export function sourceIdentityMatches(dbHandle: Database, revision: UsageLogRevision | null): boolean {
   const stored = readIndexedMeta(dbHandle);
   if (revision === null) return stored.sourceSize === 0;
   const storedPath = readStoredMetaField(dbHandle, HISTORY_META_KEYS.sourcePath);
   if (!storedPath) return false;
-  const storedDev = Number(readStoredMetaField(dbHandle, HISTORY_META_KEYS.sourceDev));
-  const storedIno = Number(readStoredMetaField(dbHandle, HISTORY_META_KEYS.sourceIno));
+  // Compared as exact decimal strings; see UsageLogRevision for why ids are not Numbers.
+  const storedDev = readStoredMetaField(dbHandle, HISTORY_META_KEYS.sourceDev);
+  const storedIno = readStoredMetaField(dbHandle, HISTORY_META_KEYS.sourceIno);
   const storedBirthtimeMs = Number(readStoredMetaField(dbHandle, HISTORY_META_KEYS.sourceBirthtimeMs));
   return storedPath === revision.path
-    && storedDev === Number(revision.dev)
-    && storedIno === Number(revision.ino)
+    && storedDev === revision.dev
+    && storedIno === revision.ino
     && storedBirthtimeMs === Number(revision.birthtimeMs);
 }
 

package/src/routing/history/ingest.ts

@@ -10,6 +10,7 @@ import type { Database } from "bun:sqlite";
 import { closeSync, fstatSync, openSync, readSync } from "node:fs";
 import {
   encodePersistedRequestedModel,
+  exactFileIdentity,
   type PersistedUsageEntry,
   type UsageLogRevision,
 } from "../../usage/log";
@@ -177,8 +178,11 @@ export function ingestSourceTail(
     fd = openSync(path, "r");
     const stat = fstatSync(fd);
     const expected = options.expected;
-    if (expected && (Number(stat.dev) !== Number(expected.dev) || Number(stat.ino) !== Number(expected.ino))) {
-      throw new RequestHistoryIndexStaleError("usage log changed before indexing");
+    if (expected) {
+      const opened = exactFileIdentity(fd);
+      if (opened.dev !== expected.dev || opened.ino !== expected.ino) {
+        throw new RequestHistoryIndexStaleError("usage log changed before indexing");
+      }
     }
     const size = options.endOffset === undefined
       ? Number(stat.size)

package/src/routing/profile.ts

@@ -12,7 +12,7 @@ import type {
   OcxRoutingUnknownCostCapMode,
 } from "../types";
 import { codexAccountNamespaceEntries } from "../codex/account-namespaces";
-import { listComboIds, resolveComboId } from "../combos";
+import { resolveComboId } from "../combos/identifiers";
 import { hasOwnProvider } from "../config/provider-name";
 import { MAX_COMPATIBILITY_REQUIRED_SUITES } from "./compatibility/types";
 import { POLICY_NAMESPACE } from "./profile-namespace";

package/src/server/admission-model-scope.ts

@@ -1,4 +1,5 @@
 import type { DataPlaneAdmission } from "./auth-cors";
+import { isApiAuthRequired } from "./auth-cors";
 import type { OcxApiKeyEntry, OcxConfig } from "../types";
 import { markResponseNonReplayable } from "../lib/upstream-retry";
 
@@ -77,6 +78,22 @@ export function resolveAdmissionModelScope(
   return entry ? admissionModelScopeOf(entry) : undefined;
 }
 
+/** Consent comes from stored operator config, never request headers. Use the full listener config. */
+export function admissionMayUseMeteredComboTargets(
+  config: Pick<OcxConfig, "apiKeys" | "hostname">,
+  admission: DataPlaneAdmission | undefined,
+  combo?: { allowMeteredTargets?: boolean },
+): boolean {
+  if (admission?.kind === "configured") {
+    const entry = (config.apiKeys ?? []).find(key => key.id === admission.keyId);
+    return entry?.allowMeteredComboTargets === true;
+  }
+  // Linked ingress always carries keyed admission, even when the primary bind is loopback.
+  // A secondary loopback listener on a public proxy does not qualify either.
+  return (!admission || admission.kind === "loopback")
+    && !isApiAuthRequired(config) && combo?.allowMeteredTargets === true;
+}
+
 /**
  * Does this scope admit this resolved destination?
  *

package/src/server/auth-cors.ts

@@ -30,6 +30,7 @@ import {
   providerForwardClientHeadersConfigError,
   reasoningSummaryDeliveryRecordConfigError,
   upstreamHttpVersionConfigError,
+  credentialPinnedProviderConfigError,
 } from "../config/provider-validation";
 import { providerDestinationConfigError } from "../lib/destination-policy";
 import { providerEgressConfigError } from "../lib/provider-egress";
@@ -784,6 +785,8 @@ export function providerManagementConfigError(
     delete canonicalCandidate.pinnedReasoningEffort;
     delete canonicalCandidate.modelPinnedReasoningEfforts;
     delete canonicalCandidate.responsesSnapshotRepair;
+    // Explicit history-loss opt-in changes request content, never auth or transport identity.
+    delete canonicalCandidate.projectResponsesLiteHostedSearchHistory;
     // modelCosts is a user-owned display overlay, not part of the canonical
     // forward seed; it is validated separately below (providerModelCostsConfigError).
     delete canonicalCandidate.modelCosts;
@@ -912,6 +915,8 @@ export function providerManagementConfigError(
   if (reasoningSummaryDeliveryError) return `provider ${name} ${reasoningSummaryDeliveryError}`;
   const modelAdaptersError = modelAdapterRecordConfigError(raw.modelAdapters, "modelAdapters", name, typed);
   if (modelAdaptersError) return `provider ${name} ${modelAdaptersError}`;
+  const credentialPinError = credentialPinnedProviderConfigError(name, typed);
+  if (credentialPinError) return `provider ${name} ${credentialPinError}`;
   const preferHostedToolsError = modelPreferHostedToolsConfigError(
     raw.modelPreferHostedTools,
     "modelPreferHostedTools",
@@ -919,6 +924,9 @@ export function providerManagementConfigError(
     typed,
   );
   if (preferHostedToolsError) return `provider ${name} ${preferHostedToolsError}`;
+  if (raw.projectResponsesLiteHostedSearchHistory !== undefined && typeof raw.projectResponsesLiteHostedSearchHistory !== "boolean") {
+    return `provider ${name} projectResponsesLiteHostedSearchHistory must be a boolean`;
+  }
   if (raw.responsesSnapshotRepair !== undefined && typeof raw.responsesSnapshotRepair !== "boolean") {
     return `provider ${name} responsesSnapshotRepair must be a boolean`;
   }
@@ -1053,9 +1061,12 @@ const PROVIDER_CONFIG_FIELD_POLICY = {
   preserveResponsesReasoningContent: "editor",
   preserveResponsesInputItemIds: "editor",
   preserveResponsesMessageMetadata: "editor",
+  projectResponsesLiteHostedSearchHistory: "editor",
   dropResponsesReasoningItems: "editor",
   modelReasoningEffortsAuthoritative: "editor",
   decodesNativeCompactionBlobs: "editor",
+  supportsNativeCompactionTrigger: "editor",
+  supportsNativeCompactEndpoint: "editor",
   allowEncryptedV2AgentTasks: "editor",
   allowPrivateNetwork: "editor",
   // A proxy URL routinely embeds `user:password@`, so it never reaches the dashboard DTO and

package/src/server/chat-completions.ts

@@ -54,6 +54,7 @@ import {
 } from "./request-log";
 import { createFinalRequestLog } from "./inference/final-log";
 import { clientWireLogOf, clientWireOf } from "./inference/client-wire";
+import { attachAdvisorReasoning } from "./inference/advisor-diagnostics";
 import { directEncodersApply } from "./inference/client-encoder-delivery";
 import { responseWithDeferredRequestLog } from "./relay";
 import { handleResponses } from "./responses";
@@ -114,8 +115,10 @@ export async function handleChatCompletions(
 ): Promise<Response> {
   const translatorBudget = createTranslatorBudget();
   try {
+    let response = await handleChatCompletionsWithBudget(req, config, logCtx, translatorBudget, logIds);
+    if (isInternalCallCapability(req.headers.get(ADVISOR_INTERNAL_CAPABILITY_HEADER))) response = attachAdvisorReasoning(response, logCtx);
     return finalizeTranslatorBudgetResponse(
-      await handleChatCompletionsWithBudget(req, config, logCtx, translatorBudget, logIds),
+      response,
       translatorBudget,
       req.signal,
     );
@@ -601,6 +604,9 @@ async function handleChatCompletionsWithBudget(
       // below could never restore this one -- the translated client was told the provider
       // throttled the turn, and handed a two-second wait to send it again.
       classified.code = UPSTREAM_RESET_REPLAY_REFUSED_CODE;
+    } else if (upstreamCode === "claude_subscription_cooldown") {
+      classified.code = "claude_subscription_cooldown";
+      classified.type = "rate_limit_error";
     } else if (upstreamCode === "model_not_found") {
       // Structured model_not_found must win over classifyError's generic remaps.
       classified.code = "model_not_found";