@bitkyc08/opencodex 2.86.0 → 2.88.0

package/src/types/provider.ts

@@ -14,6 +14,8 @@ export interface ProviderApiKeySelection {
   entryId?: string;
   reference?: string;
   revision?: string;
+  /** Request-local allocation; does not replace the saved active key. */
+  distributed?: boolean;
 }
 
 export interface OpenRouterProviderRouting {
@@ -164,16 +166,25 @@ export interface ProviderWebSearchBridgeConfig {
   endpoint?: string;
 }
 
-/**
- * User-configured display price for one model (USD per 1M tokens).
- * Mirrors the `Cost4` shape used by the usage cost estimator; structurally
- * compatible so config rows can be lifted directly into price overlays.
- */
+/** Optional user-owned prompt-length policy; rates are USD per 1M tokens. */
+export type PromptLengthPricing =
+  | { mode: "automatic" }
+  | { mode: "flat" }
+  | {
+    mode: "custom";
+    thresholdTokens: number;
+    comparison: "gt" | "gte";
+    rates: { input: number; output: number; cacheRead: number; cacheWrite: number };
+  };
+
+/** Complete base rates for one model, with automatic pricing when policy is absent. */
 export interface ProviderCostOverlay {
   input: number;
   output: number;
   cacheRead: number;
   cacheWrite: number;
+  /** Absent means automatic vendor prompt-length pricing. */
+  promptLengthPricing?: PromptLengthPricing;
 }
 
 export interface RequestPacingRule {
@@ -190,6 +201,10 @@ export interface ProviderRequestPacingConfig extends RequestPacingRule {
   enabled: boolean;
   /** Exact upstream model-id overrides; other models inherit the provider rule. */
   models?: Record<string, RequestPacingRule>;
+  /** Normal request allocation, separate from cooldown recovery ordering. */
+  keySelection?: "active" | "round-robin";
+  /** Additional uniform limits per pool credential, across all models. */
+  keys?: RequestPacingRule;
 }
 
 export interface FastWire {
@@ -432,6 +447,11 @@ export interface OcxProviderConfig {
    * to extract turn provenance (#6220).
    */
   preserveResponsesMessageMetadata?: boolean;
+  /**
+   * Opt in to lossy hosted-search history notes on ordinary canonical Codex Lite requests.
+   * Default off; only literal true enables it, and non-Lite/native compact stay unchanged.
+   */
+  projectResponsesLiteHostedSearchHistory?: boolean;
   /**
    * Treat this provider's `modelReasoningEfforts` as authoritative at the wire, not only in the
    * catalog. Adapters that ship their own per-model effort table (currently `command-code`)
@@ -453,6 +473,10 @@ export interface OcxProviderConfig {
    * compaction blobs. Absent or false degrades foreign blobs to an opaque note.
    */
   decodesNativeCompactionBlobs?: boolean;
+  /** Accept native Responses v2 `input` compaction_trigger items. Responses adapter only. */
+  supportsNativeCompactionTrigger?: boolean;
+  /** Serve native Responses v1 /responses/compact. Responses adapter only; no auth authority. */
+  supportsNativeCompactEndpoint?: boolean;
   /**
    * Trust this direct key-auth Responses provider to consume or relay opaque encrypted
    * V2 agent tasks. OpenCodex does not decrypt, translate, or recover an eligible task.
@@ -712,12 +736,14 @@ export interface OcxProviderConfig {
     /** Kiro OAuth only: active serving requests per account, 1..100. */
     maxConcurrentPerAccount?: number;
     enabled?: boolean;
+    /** Opt-in process-local conversation ownership; requires proactive enablement. */
+    sessionAffinity?: "conversation" | "none";
     /**
      * Generic OAuth pool selection strategy (#695). Persisted through the pool-settings
      * contract. Consumed by the selector only while `pool.kernel` is on; with the flag off
      * it is still merely persisted, so omitted and set behave the same.
      */
-    strategy?: "quota" | "round-robin" | "fill-first" | "least-loaded";
+    strategy?: "quota" | "round-robin" | "fill-first" | "reset-first" | "least-loaded";
     /**
      * 0-100 usage percent at which fill-first advances off the active account (#695).
      * Read only under `pool.kernel` with `strategy: "fill-first"`; 80 when unset, matching

package/src/types/request.ts

@@ -2,6 +2,7 @@ import type { KiroOAuthMetadata } from "../oauth/types";
 import type { NativeReasoningOwner } from "../responses/reasoning-replay-cache";
 import type { OcxTool, OcxToolChoice } from "./tools";
 import type { TierDecision, TierObservationContext } from "./provider";
+import type { TranslatorBudget } from "../lib/translator-budget";
 
 /** Exact provider/credential namespace for process-local reasoning replay. */
 export interface OcxReasoningReplayIdentity {
@@ -62,6 +63,16 @@ export interface OcxParsedRequest {
   _nativeReasoningReplay?: ReadonlyMap<string, string>;
   _nativeReasoningBoundOwner?: NativeReasoningOwner;
   _nativeReasoningMint?: { owner?: NativeReasoningOwner };
+  /**
+   * The Claude client's typed Anthropic web tools, as declared. Only the anthropic adapter reads
+   * them, and only for api.anthropic.com; every other destination never sees them.
+   */
+  _anthropicServerTools?: readonly Record<string, unknown>[];
+  /**
+   * Completed server-tool exchanges from the Claude client's history, keyed by the block that
+   * followed them (`call:<tool_use id>` / `text:<text>`). Same audience as `_anthropicServerTools`.
+   */
+  _anthropicServerReplay?: ReadonlyMap<string, readonly Record<string, unknown>[]>;
   /**
    * Boundary between replayed history and this turn's newly appended input. Usually the
    * items the proxy restored from local previous_response_id state; also set when the
@@ -92,11 +103,17 @@ export interface OcxParsedRequest {
   _cursorClientThreadId?: string;
   /** Conversation/provider/account/model-bound namespace for reasoning replay state. */
   _reasoningReplayScope?: OcxReasoningReplayScopeRef;
+  /** Trusted configuration snapshot; never read from the client's request body. */
+  _nativeReasoningRetention?: Readonly<{ modelSwitch: boolean; accountSwitch: boolean }>;
   /**
    * Set by bindRouteReasoningReplayScope after a proven serving-identity change, or by
    * prepareOpaqueBlobRecovery after an authoritative rejection; consumers strip replayed blobs.
    */
   _stripReasoningEncryptedContent?: boolean;
+  /** Native compaction remains nonportable even when reasoning-only retention is enabled. */
+  _stripNativeCompactionEncryptedContent?: boolean;
+  /** Retention kept reasoning ciphertext across a model/account change; arms streamed rejection recovery. */
+  _nativeReasoningRetainedAcrossRoute?: boolean;
   /**
    * Set when replayed reasoning item ids name items in a store this destination cannot read: by
    * prepareOpaqueBlobRecovery before the one recovery rebuild, and by bindRouteReasoningReplayScope
@@ -150,6 +167,8 @@ export interface OcxParsedRequest {
    * (see src/responses/compaction.ts).
    */
   _compactionRequest?: boolean;
+  /** Request-owned encoding of readable routed v2 retention; never used for native ciphertext. */
+  _compactionRetention?: { encode(summary: string): string; commit(): void };
   /** Manual compaction moved to another provider: summarize portably even on a canonical ChatGPT target. */
   _portableCompaction?: boolean;
   /**
@@ -173,6 +192,7 @@ export interface OcxParsedRequest {
    */
   _advisorGuard?: (options: {
     parsed: OcxParsedRequest;
+    translatorBudget?: TranslatorBudget;
     firstEvents: AsyncIterable<AdapterEvent>;
     /** One bounded worker continuation re-dispatch (same machinery as the terminal guard). */
     continuation: (parsed: OcxParsedRequest) => AsyncIterable<AdapterEvent> | Promise<AsyncIterable<AdapterEvent>>;
@@ -399,9 +419,14 @@ export interface OcxProviderContinuationState {
   [provider: string]: Record<string, unknown> | undefined;
 }
 
+/** One Anthropic server-side call as the API returned it: `server_tool_use` + its `*_tool_result`. */
+export interface AnthropicServerBlocks { use: Record<string, unknown>; result: Record<string, unknown> }
+
 export type AdapterEvent =
   | { type: "heartbeat"; replayUnsafe?: true; preflightReady?: true }
-  | { type: "text_delta"; text: string; phase?: OcxMessagePhase }
+  | { type: "text_delta"; text: string; phase?: OcxMessagePhase;
+      /** Complete documented Anthropic progress block: text remains signed thinking on replay. */
+      anthropicThinkingSignature?: string }
   | { type: "thinking_delta"; thinking: string }
   // Anthropic extended-thinking round-trip: signature_delta for the current thinking block, and
   // opaque redacted_thinking blocks. Both must be replayed verbatim or tool-use turns 400.
@@ -424,7 +449,11 @@ export type AdapterEvent =
   // output_item.added(in_progress) and end → the matching output_item.done(completed|failed) under
   // the SAME output index, so the activity animates instead of flashing completed instantly.
   | { type: "web_search_call_begin"; id: string }
-  | { type: "web_search_call_end"; id: string; queries: string[]; status?: "completed" | "failed"; sources?: OcxUrlCitation[] }
+  | {
+      type: "web_search_call_end"; id: string; queries: string[]; status?: "completed" | "failed"; sources?: OcxUrlCitation[];
+      /** Anthropic's server-side call (adapters/anthropic.ts): its `server_tool_use` and result block, verbatim. */
+      anthropic?: AnthropicServerBlocks;
+    }
   | {
       type: "done";
       usage?: OcxUsage;

package/src/types/wire.ts

@@ -1,3 +1,6 @@
+import { isOpenCodeGoGeminiDestination, OPENCODE_GO_BASE_URL, OPENCODE_GO_MODEL_WIRES, OPENCODE_GO_LEGACY_NAME_PINS, type OpenCodeGoDestination } from "./opencode-go";
+import { openCodeZenBaseUrl, openCodeZenKeyBaseUrl, type OpenCodeZenDestination } from "./opencode-zen";
+
 /**
  * Accepted values for the per-provider upstream HTTP-version pin (#1668). Shared by the
  * zod load schema, the management write boundary (POST/PATCH), and the fetch runtime, so
@@ -40,35 +43,16 @@ export const MODEL_ADAPTER_OVERRIDE_ALLOWED: ReadonlySet<string> = new Set([
   "openai-responses",
 ]);
 
-/**
- * Providers whose listed model ids must be driven over the Anthropic wire even when
- * the provider's configured adapter says otherwise — the upstream only speaks
- * Anthropic for these models.
- */
-const ANTHROPIC_WIRE_MODELS: Record<string, ReadonlySet<string>> = {
-  "opencode-go": new Set([
-    "claude-haiku-5-5",
-    "minimax-m2.5",
-    "minimax-m2.7",
-    "minimax-m3",
-    // OpenCode's catalog identifies Union Alpha as @ai-sdk/anthropic while the
-    // provider defaults to OpenAI-compatible; direct Chat returns 500 and direct
-    // Messages reaches the session check (#4847).
-    "union-alpha",
-  ]),
-};
-
-function anthropicWireModelsForProvider(providerName: string): ReadonlySet<string> | undefined {
-  return Object.hasOwn(ANTHROPIC_WIRE_MODELS, providerName)
-    ? ANTHROPIC_WIRE_MODELS[providerName]
-    : undefined;
-}
-
-/** Detached provider-local hard-pin table for pure wire-policy resolution. */
-export function captureWireAdapterHardPins(providerName: string): Readonly<Record<string, string>> {
-  const models = anthropicWireModelsForProvider(providerName);
-  if (!models) return Object.freeze({});
-  return Object.freeze(Object.fromEntries([...models].map(modelId => [modelId, "anthropic"])));
+/** Native Go wire pins share the exact-model table with registry Responses defaults. */
+export function captureWireAdapterHardPins(providerName: string, provider?: WirePinProvider): Readonly<Record<string, string>> {
+  if (providerName !== "opencode-go") return Object.freeze({});
+  // The existing Go preset pins saved URLs to this endpoint before dispatch. Pure policy
+  // captures must use that same destination even when handed an unnormalized config row.
+  const destination = provider && { ...provider, baseUrl: OPENCODE_GO_BASE_URL };
+  return Object.freeze(Object.fromEntries(Object.entries(OPENCODE_GO_MODEL_WIRES).filter(([modelId, wire]) =>
+    (wire === "anthropic" && OPENCODE_GO_LEGACY_NAME_PINS.has(modelId))
+    || (wire !== "openai-responses" && isOpenCodeGoGeminiDestination(destination)),
+  )));
 }
 
 interface WirePinPrefixRule {
@@ -98,9 +82,7 @@ const WIRE_ADAPTER_PIN_PREFIXES: Readonly<Record<string, WirePinPrefixRule>> = O
 });
 
 /** Just enough of a provider config to tell whether it still points at the pinned endpoint. */
-export interface WirePinProvider {
-  readonly baseUrl?: unknown;
-}
+export interface WirePinProvider extends OpenCodeGoDestination, OpenCodeZenDestination {}
 
 function normalizedEndpoint(value: unknown): string | undefined {
   if (typeof value !== "string") return undefined;
@@ -112,7 +94,21 @@ function normalizedEndpoint(value: unknown): string | undefined {
   }
 }
 
+/**
+ * Providers whose adapter is their credential boundary: the adapter alone pins the destination and
+ * the auth header for an account token. No model may switch wires, whatever `baseUrl` or the row's
+ * own `adapter` says, because a generic wire would send that token as a Bearer key to the configured
+ * URL. The empty prefix covers every model id.
+ */
+const CREDENTIAL_PINNED_ADAPTERS: Readonly<Record<string, Readonly<Record<string, string>>>> = Object.freeze({
+  "dsh-account": Object.freeze({ "": "dsh-account" }),
+});
+
 function prefixPinsFor(providerName: string, provider: WirePinProvider | undefined): Readonly<Record<string, string>> | undefined {
+  if (Object.hasOwn(CREDENTIAL_PINNED_ADAPTERS, providerName)) return CREDENTIAL_PINNED_ADAPTERS[providerName];
+  if (providerName === "opencode-zen" && openCodeZenKeyBaseUrl(provider)) {
+    return openCodeZenBaseUrl(provider) ? { "gemini-": "google", "claude-": "anthropic" } : { "claude-": "anthropic" };
+  }
   if (!provider || !Object.hasOwn(WIRE_ADAPTER_PIN_PREFIXES, providerName)) return undefined;
   const rule = WIRE_ADAPTER_PIN_PREFIXES[providerName]!;
   return normalizedEndpoint(provider.baseUrl) === rule.endpoint ? rule.prefixes : undefined;
@@ -148,13 +144,11 @@ function prefixedWireAdapter(providerName: string, modelId: string, provider: Wi
  * adapter" would pass on the first pass and then let the override win on the second.
  */
 export function isWirePinnedModel(providerName: string, modelId: string, provider?: WirePinProvider): boolean {
-  return (anthropicWireModelsForProvider(providerName)?.has(modelId) ?? false)
-    || prefixedWireAdapter(providerName, modelId, provider) !== undefined;
+  return pinnedWireAdapter(providerName, modelId, provider) !== undefined;
 }
 
 /** The wire a pinned model must use, or undefined when the model is not pinned. */
 export function pinnedWireAdapter(providerName: string, modelId: string, provider?: WirePinProvider): string | undefined {
-  return anthropicWireModelsForProvider(providerName)?.has(modelId)
-    ? "anthropic"
-    : prefixedWireAdapter(providerName, modelId, provider);
+  const pins = captureWireAdapterHardPins(providerName, provider);
+  return Object.hasOwn(pins, modelId) ? pins[modelId] : prefixedWireAdapter(providerName, modelId, provider);
 }

package/src/types.ts

@@ -61,6 +61,7 @@ export type {
   OcxProviderContinuationOwner,
   OcxProviderContinuationState,
   AdapterEvent,
+  AnthropicServerBlocks,
   OcxUrlCitation,
   OcxUsage,
 } from "./types/request";
@@ -122,6 +123,7 @@ export type {
   ProviderWebSearchBridgeBackend,
   ProviderWebSearchBridgeConfig,
   ProviderCostOverlay,
+  PromptLengthPricing,
   RequestPacingRule,
   ProviderRequestPacingConfig,
   FastWire,

package/src/update/npm-invocation.mjs

@@ -95,12 +95,22 @@ export function resolveNpmCommand(
   return null;
 }
 
+function shellEnvValue(env, name) {
+  // Copying process.env loses Windows' case-insensitive property access. Keep
+  // the existing exact-key precedence; do not choose between conflicting aliases.
+  if (env[name] !== undefined) return env[name];
+  const values = new Set(Object.entries(env)
+    .filter(([key, value]) => key.toLowerCase() === name.toLowerCase() && value !== undefined)
+    .map(([, value]) => value));
+  return values.size === 1 ? values.values().next().value : undefined;
+}
+
 function systemCommandProcessor(env) {
-  const systemRoot = env.SystemRoot ?? env.windir;
+  const systemRoot = shellEnvValue(env, "SystemRoot") ?? shellEnvValue(env, "windir");
   if (systemRoot && win32.isAbsolute(systemRoot)) {
     return win32.join(systemRoot, "System32", "cmd.exe");
   }
-  const comSpec = env.ComSpec;
+  const comSpec = shellEnvValue(env, "ComSpec");
   return comSpec && win32.isAbsolute(comSpec) ? win32.resolve(comSpec) : null;
 }
 

package/src/usage/cost.ts

@@ -15,6 +15,7 @@ import {
   resolveMetadataProvider,
 } from "../generated/model-metadata";
 import type { AttemptTierOutcome, OcxUsage } from "../types";
+import type { PromptLengthPricing } from "../types/provider";
 import { canonicalFastTierMarker } from "../providers/fastwire";
 import { baseProviderLabel } from "../providers/label";
 import type { PersistedUsageAttempt, UsageStatus } from "./log";
@@ -79,6 +80,7 @@ export interface MatchedPrice {
   modelId: string;
   jawcodeProvider?: string;
   cost4: Cost4;
+  promptLengthPricing?: PromptLengthPricing;
   source: "jawcode" | "expected" | "user";
   sourceRef?: string;
   verifiedAt?: string;
@@ -97,6 +99,8 @@ export interface AttemptCostEstimate {
   priorityMultiplier?: number;
   /** Set when the published long-context rate was applied (#908). */
   contextTier?: ContextTierName;
+  /** User absolute rates selected for this attempt, separate from catalog tiers. */
+  customThresholdApplied?: true;
   /** The numeric estimate is a known floor because the exact Priority price is unavailable. */
   priorityLowerBound?: boolean;
 }
@@ -111,6 +115,8 @@ export interface CostEstimate {
   priorityMultiplier?: number;
   /** Set when any priced attempt used the published long-context rate (#908). */
   contextTier?: ContextTierName;
+  /** At least one request/attempt selected the user threshold rates. */
+  customThresholdApplied?: true;
   /** The aggregate is a known floor because every priced attempt is a lower bound. */
   priorityLowerBound?: boolean;
 }
@@ -343,6 +349,7 @@ function userOverlayMatch(
     modelId,
     cost4: overlay.cost4,
     source: "user",
+    ...(overlay.promptLengthPricing ? { promptLengthPricing: overlay.promptLengthPricing } : {}),
     sourceRef: overlay.source,
     verifiedAt: overlay.verifiedAt,
     status: "verified",
@@ -397,6 +404,15 @@ function vendorPrefixedCost(modelId: string): ReturnType<typeof findVendorCostBy
   return normalize(found.provider) === normalize(claimedVendor) ? found : undefined;
 }
 
+/**
+ * Only measured usage is priced. An `unreported` or `unsupported` row can still carry tokens — a
+ * combo whose first leg failed without usage keeps the second leg's — and pricing them reports an
+ * understated cost as if it were complete.
+ */
+export function isMeasuredStatus(usageStatus: UsageStatus): boolean {
+  return usageStatus === "reported" || usageStatus === "estimated";
+}
+
 function isEstimated(usage: OcxUsage, usageStatus: UsageStatus, priceStatus: ExpectedPriceStatus | "verified"): boolean {
   return usage.estimated === true || usageStatus === "estimated" || priceStatus === "verified-derived";
 }
@@ -475,8 +491,8 @@ function isConfirmedFast(tier?: ServiceTierInput): boolean {
 }
 
 /**
- * Apply the published long-context rate when raw prompt size crosses the vendor
- * threshold. Returns [effectiveCost4, tierName].
+ * Select user prompt-length rates, or apply the published context rule in automatic mode.
+ * Returns [effectiveCost4, catalogTier, priorityLowerBound, customThresholdApplied].
  *
  * `rawInputTokens` MUST be `usage.inputTokens` (total prompt size), never the
  * normalized billable input — normalization subtracts cache read/write, so a
@@ -486,13 +502,27 @@ function isConfirmedFast(tier?: ServiceTierInput): boolean {
  * API rows can stack the bands. xAI publishes neither a combined rate nor an exclusion,
  * so its long-context rate remains the known lower bound instead of inventing a stacked multiplier.
  */
-function applyContextTier(
+function applyPromptLengthPricing(
   cost4: Cost4,
   provider: string,
   modelId: string,
   rawInputTokens: number | undefined,
   tier?: ServiceTierInput,
-): [Cost4, ContextTierName | undefined, boolean] {
+  policy?: PromptLengthPricing,
+): [Cost4, ContextTierName | undefined, boolean, true?] {
+  // A user policy replaces the catalog rule on BOTH sides of its threshold.
+  // Keep custom provenance separate while honoring the published Priority relation.
+  if (policy?.mode === "flat") return [cost4, undefined, false];
+  if (policy?.mode === "custom") {
+    const crossed = rawInputTokens !== undefined && Number.isFinite(rawInputTokens)
+      && (policy.comparison === "gte"
+        ? rawInputTokens >= policy.thresholdTokens : rawInputTokens > policy.thresholdTokens);
+    if (!crossed) return [cost4, undefined, false];
+    const relation = findContextTier(provider, modelId)?.confirmedPriorityRelation;
+    const confirmedFast = isConfirmedFast(tier);
+    if (confirmedFast && relation === "exclusive") return [cost4, undefined, false];
+    return [policy.rates, undefined, confirmedFast && relation === "lower-bound", true];
+  }
   if (rawInputTokens === undefined) return [cost4, undefined, false];
   const rule = findContextTier(provider, modelId);
   if (!rule || !isLongContext(rule, rawInputTokens)) return [cost4, undefined, false];
@@ -520,9 +550,12 @@ function applyPriorityMultiplier(
   modelId: string,
   serviceTier?: ServiceTierInput,
   contextTier?: ContextTierName,
+  customThresholdApplied?: true,
 ): [Cost4, number] {
   if (canonicalFastTierMarker(tierScalar(serviceTier)) !== "priority") return [cost4, 1];
   if (contextTier && findContextTier(provider, modelId)?.confirmedPriorityRelation !== "stack") return [cost4, 1];
+  if (customThresholdApplied && isConfirmedFast(serviceTier)
+    && findContextTier(provider, modelId)?.confirmedPriorityRelation === "lower-bound") return [cost4, 1];
   const rule = findPriorityPricingRule(provider, modelId);
   if (rule?.requiresResponseConfirmation && !isConfirmedFast(serviceTier)) return [cost4, 1];
   const multiplier = rule?.multiplier ?? 1;
@@ -568,7 +601,7 @@ export function estimateAttemptCost(
   serviceTier?: ServiceTierInput,
   userOverlays: readonly ExpectedPriceOverlay[] = activeUserCostOverlays(),
 ): AttemptCostEstimate | null {
-  if (!attempt.usage) return null;
+  if (!isMeasuredStatus(attempt.usageStatus) || !attempt.usage) return null;
   const tokens = normalizeCostTokens(attempt.usage);
   if (!tokens) return null;
   const price = resolveMatchedPrice(attempt.provider, attempt.model, overlays, userOverlays, attempt);
@@ -576,11 +609,11 @@ export function estimateAttemptCost(
   const attemptServiceTier = attempt.tierOutcome
     ? serviceTierContextFromOutcome(attempt.tierOutcome)
     : serviceTier;
-  const [tieredCost4, contextTier, contextPriorityLowerBound] = applyContextTier(
-    price.cost4, price.provider, attempt.model, attempt.usage.inputTokens, attemptServiceTier,
+  const [tieredCost4, contextTier, contextPriorityLowerBound, customThresholdApplied] = applyPromptLengthPricing(
+    price.cost4, price.provider, attempt.model, attempt.usage.inputTokens, attemptServiceTier, price.promptLengthPricing,
   );
   const [effectiveCost4, multiplier] = applyPriorityMultiplier(
-    tieredCost4, price.provider, attempt.model, attemptServiceTier, contextTier,
+    tieredCost4, price.provider, attempt.model, attemptServiceTier, contextTier, customThresholdApplied,
   );
   const priorityLowerBound = contextPriorityLowerBound
     || isOpenRouterPriorityLowerBound(price.provider, attempt.tierOutcome);
@@ -594,6 +627,7 @@ export function estimateAttemptCost(
     estimated: isEstimated(attempt.usage, attempt.usageStatus, price.status),
     ...(multiplier !== 1 ? { priorityMultiplier: multiplier } : {}),
     ...(contextTier ? { contextTier } : {}),
+    ...(customThresholdApplied ? { customThresholdApplied } : {}),
     ...(priorityLowerBound ? { priorityLowerBound: true } : {}),
   };
 }
@@ -637,6 +671,7 @@ export function estimateComboCost(
       ? { priorityMultiplier: estimates.find(est => est.priorityMultiplier)?.priorityMultiplier }
       : {}),
     ...(estimates.some(est => est.contextTier) ? { contextTier: "long" as const } : {}),
+    ...(estimates.some(est => est.customThresholdApplied) ? { customThresholdApplied: true as const } : {}),
     ...(estimates.every(est => est.priorityLowerBound === true)
       ? { priorityLowerBound: true as const }
       : {}),
@@ -656,16 +691,16 @@ export function estimateRequestCost(
   overlays: readonly ExpectedPriceOverlay[] = EXPECTED_PRICE_OVERLAYS,
   userOverlays: readonly ExpectedPriceOverlay[] = activeUserCostOverlays(),
 ): CostEstimate | null {
-  if (!input.usage) return null;
+  if (!isMeasuredStatus(input.usageStatus) || !input.usage) return null;
   const tokens = normalizeCostTokens(input.usage);
   if (!tokens) return null;
   const price = resolveMatchedPrice(input.provider, input.model, overlays, userOverlays, input);
   if (!price) return null;
-  const [tieredCost4, contextTier, contextPriorityLowerBound] = applyContextTier(
-    price.cost4, price.provider, input.model, input.usage.inputTokens, input.serviceTier,
+  const [tieredCost4, contextTier, contextPriorityLowerBound, customThresholdApplied] = applyPromptLengthPricing(
+    price.cost4, price.provider, input.model, input.usage.inputTokens, input.serviceTier, price.promptLengthPricing,
   );
   const [effectiveCost4, multiplier] = applyPriorityMultiplier(
-    tieredCost4, price.provider, input.model, input.serviceTier, contextTier,
+    tieredCost4, price.provider, input.model, input.serviceTier, contextTier, customThresholdApplied,
   );
   const priorityLowerBound = contextPriorityLowerBound || isOpenRouterPriorityLowerBound(
     price.provider,
@@ -678,6 +713,7 @@ export function estimateRequestCost(
     estimated: isEstimated(input.usage, input.usageStatus, price.status),
     ...(multiplier !== 1 ? { priorityMultiplier: multiplier } : {}),
     ...(contextTier ? { contextTier } : {}),
+    ...(customThresholdApplied ? { customThresholdApplied } : {}),
     ...(priorityLowerBound ? { priorityLowerBound: true } : {}),
   };
 }

package/src/usage/expected-prices.ts

@@ -10,6 +10,7 @@ import { isAnthropicInstanceId } from "../providers/anthropic-instance-id";
 export function pricingFamilyProvider(provider: string): string {
   return isAnthropicInstanceId(provider) ? "anthropic" : provider;
 }
+import type { PromptLengthPricing } from "../types/provider";
 
 /**
  * Expected-price overlay for models whose jawcode cost rows are missing or all-zero
@@ -46,6 +47,8 @@ export interface ExpectedPriceOverlay {
   provider: string;
   modelId: string;
   cost4: Cost4;
+  /** User-owned context policy; catalog rows leave this absent. */
+  promptLengthPricing?: PromptLengthPricing;
   source: string;
   verifiedAt: string;
   status: ExpectedPriceStatus;

package/src/usage/ledger-retention.ts

@@ -22,6 +22,7 @@ import { closeSync, fstatSync, openSync, readSync, writeSync } from "node:fs";
 import { atomicWriteFileStreamed } from "../config/atomic-write";
 import {
   currentUsageLogRevision,
+  exactFileIdentity,
   usageLogIdentityKey,
   usageLogPath,
   usageLogRevisionKey,
@@ -127,7 +128,7 @@ export function enforceUsageLedgerSizeLimit(
   let sourceClosed = false;
   try {
     const opened = fstatSync(sourceFd);
-    if (Number(opened.size) !== captured.size || Number(opened.ino) !== captured.ino) {
+    if (Number(opened.size) !== captured.size || exactFileIdentity(sourceFd).ino !== captured.ino) {
       return { kind: "deferred", currentBytes: captured.size, reason: "revision-changed" };
     }
     const start = firstRowBoundary(sourceFd, Math.max(0, captured.size - target), captured.size);

package/src/usage/ledger-scanner.ts

@@ -2,6 +2,7 @@ import { createHash } from "node:crypto";
 import { closeSync, fstatSync, openSync, readSync } from "node:fs";
 import {
   currentUsageLogRevision,
+  exactFileIdentity,
   normalizePersistedUsageRow,
   usageLogIdentityKey,
   usageLogPath,
@@ -63,13 +64,13 @@ export class UsageLedgerRebuildRequiredError extends Error {
 
 function revisionFromStat(
   path: string,
+  fd: number,
   stat: ReturnType<typeof fstatSync>,
 ): UsageLogRevision {
   if (!stat.isFile()) throw new Error("usage log is not a regular file");
   return {
     path,
-    dev: Number(stat.dev),
-    ino: Number(stat.ino),
+    ...exactFileIdentity(fd),
     birthtimeMs: Number(stat.birthtimeMs),
     size: Number(stat.size),
     mtimeMs: Number(stat.mtimeMs),
@@ -276,7 +277,7 @@ export async function scanUsageLedgerCooperatively(
   let pendingLineBytes = 0;
 
   try {
-    const openedRevision = revisionFromStat(path, fstatSync(fd));
+    const openedRevision = revisionFromStat(path, fd, fstatSync(fd));
     const scanEnd = openedRevision.size;
     const openedIdentityKey = usageLogIdentityKey(openedRevision);
     if (options.expectedIdentityKey && options.expectedIdentityKey !== openedIdentityKey) {
@@ -391,7 +392,7 @@ export async function scanUsageLedgerCooperatively(
     }
 
     throwIfAborted(options.signal);
-    const endingRevision = revisionFromStat(path, fstatSync(fd));
+    const endingRevision = revisionFromStat(path, fd, fstatSync(fd));
     if (usageLogIdentityKey(endingRevision) !== openedIdentityKey) {
       throw rebuildRequired("identity_mismatch");
     }
@@ -417,7 +418,7 @@ export async function scanUsageLedgerCooperatively(
         line,
         options.signal,
       );
-      const verifiedFdRevision = revisionFromStat(path, fstatSync(fd));
+      const verifiedFdRevision = revisionFromStat(path, fd, fstatSync(fd));
       const verifiedPathRevision = currentUsageLogRevision();
       if (capturedDigest !== verifiedDigest) throw rebuildRequired("content_changed");
       if (!verifiedPathRevision

package/src/usage/log.ts

@@ -1163,8 +1163,12 @@ export function appendUsageEntry(entry: PersistedUsageEntry): void {
 
 export type UsageLogRevision = {
   path: string;
-  dev: number;
-  ino: number;
+  /**
+   * Exact decimal device and file id. NTFS file ids carry a sequence number in their
+   * high bits and routinely exceed 2^53, so a Number would let two files compare equal.
+   */
+  dev: string;
+  ino: string;
   birthtimeMs: number;
   size: number;
   mtimeMs: number;
@@ -1367,12 +1371,17 @@ function readExactly(fd: number, length: number, position: number): Buffer | nul
   return output;
 }
 
-function usageLogRevision(path: string, stat: ReturnType<typeof fstatSync>): UsageLogRevision {
+/** Exact dev/ino of an open file, read through bigint stats so large ids keep every bit. */
+export function exactFileIdentity(fd: number): { dev: string; ino: string } {
+  const exact = fstatSync(fd, { bigint: true });
+  return { dev: exact.dev.toString(), ino: exact.ino.toString() };
+}
+
+function usageLogRevision(path: string, fd: number, stat: ReturnType<typeof fstatSync>): UsageLogRevision {
   if (!stat.isFile()) throw new Error("usage log is not a regular file");
   return {
     path,
-    dev: Number(stat.dev),
-    ino: Number(stat.ino),
+    ...exactFileIdentity(fd),
     birthtimeMs: Number(stat.birthtimeMs),
     size: Number(stat.size),
     mtimeMs: Number(stat.mtimeMs),
@@ -1405,7 +1414,7 @@ export function currentUsageLogRevision(): UsageLogRevision | null {
   let fd: number | undefined;
   try {
     fd = openSync(path, "r");
-    return usageLogRevision(path, fstatSync(fd));
+    return usageLogRevision(path, fd, fstatSync(fd));
   } finally {
     if (fd !== undefined) closeSync(fd);
   }
@@ -1530,7 +1539,7 @@ async function readUsageEntriesFullCooperatively(
     if (prefixDigest === null) throw new Error("usage log changed while it was being read");
     return {
       entries: parsed.entries,
-      revision: usageLogRevision(path, stat),
+      revision: usageLogRevision(path, fd, stat),
       truncatedPrefixBytes,
       entriesTruncated: parsed.entriesDropped > 0,
       entriesDropped: parsed.entriesDropped,
@@ -1562,7 +1571,7 @@ async function readUsageEntriesIncrementally(
   try {
     fd = openSync(path, "r");
     const stat = fstatSync(fd);
-    const revision = usageLogRevision(path, stat);
+    const revision = usageLogRevision(path, fd, stat);
     if (usageLogIdentityKey(revision) !== retained.identityKey) return null;
     const size = Number(stat.size);
     // A shrink means truncation or replacement-in-place; the retained rows may no