@bitkyc08/opencodex 2.87.0 → 2.89.0

package/src/server/index.ts

@@ -267,17 +267,17 @@ function startServerWithSpendLedgerOwner(port: number | undefined, deps: StartSe
     startupOwnershipHomes = homes;
     startupOwnershipStatePaths = statePaths;
   } catch { /* inspection below stays unknown */ }
-  const startupCacheOwnership = inspectStartupOwnership(
+  const startupCacheOwnership = shouldSyncCodexOnStart(config) ? inspectStartupOwnership(
     deps,
     startupOwnershipHomes,
     startupOwnershipStatePaths,
     startupWindowsTaskListingCache,
-  );
+  ) : null;
   // Startup cache invalidation is best-effort and applies only when startup sync is enabled.
   // Check OFF before taking K: on Windows K resolves SID + LocalAppData through PowerShell,
   // and run 35093667426 exceeded healthy controls by 33.8 s against that 30 s child budget.
   // The permit callback still re-reads intent under K to close a concurrent disable race.
-  if (shouldSyncCodexOnStart(config) && startupCacheOwnership.ownership === "owned" && startupOwnershipHomes !== null) {
+  if (startupCacheOwnership?.ownership === "owned" && startupOwnershipHomes !== null) {
     try {
       const startupCodexHome = startupOwnershipHomes.codexHome;
       // #1046: record whether this actually rewrote the cache. `handleStart` ORs this
@@ -549,12 +549,12 @@ function startServerWithSpendLedgerOwner(port: number | undefined, deps: StartSe
   // clients; no Codex request can use this lifecycle in that state.
   // Re-probe here instead of trusting the earlier cache decision: startup work
   // between the two sites must not widen the service-install race.
-  const nativeOwnership = inspectStartupOwnership(
+  const nativeOwnership = shouldSyncCodexOnStart(config) ? inspectStartupOwnership(
     deps,
     startupOwnershipHomes,
     startupOwnershipStatePaths,
-  );
-  const preparedNativeMainLifecycle = nativeOwnership.ownership !== "foreign"
+  ) : null;
+  const preparedNativeMainLifecycle = nativeOwnership !== null && nativeOwnership.ownership !== "foreign"
     && startupOwnershipHomes !== null
     ? prepareNativeMainStartupLifecycle(
       deps.nativeMainStartup,
@@ -600,7 +600,7 @@ function startServerWithSpendLedgerOwner(port: number | undefined, deps: StartSe
       return retryPreparedNativeMainLifecycle.start();
     },
   };
-  const nativeMainLifecycle: NativeMainStartupLifecycle = shouldSyncCodexOnStart(config)
+  const nativeMainLifecycle: NativeMainStartupLifecycle = nativeOwnership !== null
     ? nativeOwnership.ownership === "owned"
       ? preparedNativeMainLifecycle
         ? preparedNativeMainLifecycle.start()

package/src/server/lifecycle.ts

@@ -38,6 +38,7 @@ export interface ActiveTurnLease extends AdmissionLease {
   attach(lease: AdmissionLease): void;
   bindAbortSignal(signal: AbortSignal): () => void;
   bindAbortController(ac: AbortController): void;
+  unbindAbortController(ac: AbortController): void;
   beginCodexAccountSelection(): CodexAccountSelectionAdmission;
   isTransferred(): boolean;
 }
@@ -231,6 +232,17 @@ export function tryAdmitTurn(sessionLaneId?: string, clientSignal?: AbortSignal)
       activeTurns.set(ac, lease);
       lease.bindAbortSignal(ac.signal);
     },
+    unbindAbortController(ac) {
+      if (!controllers.delete(ac)) return;
+      if (activeTurns.get(ac) === lease) activeTurns.delete(ac);
+      const listener = abortListeners.get(ac.signal);
+      if (listener) {
+        ac.signal.removeEventListener("abort", listener);
+        abortListeners.delete(ac.signal);
+      }
+      // A completed child relay cannot retire its still-running parent turn.
+      if (controllers.size === 0) lease.release();
+    },
     beginCodexAccountSelection() {
       const mainProfileDraining = nativeMainDrainOwners.size > 0;
       let selectionActive = active && !mainProfileDraining;
@@ -327,7 +339,7 @@ export function unregisterTurn(ac: AbortController): void {
     turnReleaseMisses += 1;
     return;
   }
-  lease.release();
+  lease.unbindAbortController(ac);
 }
 export function isDraining(): boolean { return shutdownDraining || temporaryDrainOwners.size > 0; }
 export function getActiveTurnCount(): number { return turnGate.metrics().active; }

package/src/server/management/combo-routes.ts

@@ -63,7 +63,7 @@ import {
 } from "../../vision/eligibility";
 import type { OcxClaudeCodeConfig, OcxComboConfig, OcxConfig, OcxCustomModel, OcxProviderConfig, OcxComboCooldownWaitPolicy } from "../../types";
 import { drainAndShutdown } from "../lifecycle";
-import { reconcileLiveStateStores } from "../../lib/state-store-registrations";
+import { notifyLiveConfigObservers, reconcileLiveStateStores } from "../../lib/state-store-registrations";
 import { filterRequestLogs, getRequestLogEntries, type RequestLogEntry } from "../request-log";
 import { estimateComboCost, estimateRequestCost, normalizeCostTokens, tokensPerSecond } from "../../usage/cost";
 import type { PersistedUsageAttempt } from "../../usage/log";
@@ -162,6 +162,7 @@ function parseVisionSidecarTargets(
   return { targets };
 }
 
+/** Handle the `/api/combos` management routes (list, save, delete and related combo endpoints), validating and preserving the opt-in quota signal fields; null when no route matches. */
 export async function handleComboRoutes(ctx: ManagementContext): Promise<Response | null> {
   const { req, url, config, deps, convergeCodexCatalog, syncClaudeAgentDefsBestEffort } = ctx;
 
@@ -222,6 +223,8 @@ export async function handleComboRoutes(ctx: ManagementContext): Promise<Respons
     const requestedCombo: Record<string, unknown> = body.combo;
     const effectiveCombo = {
       ...requestedCombo,
+      ...(!Object.hasOwn(requestedCombo, "decisionQuotaSignals") && requestedCombo.strategy === "jev" && previous?.decisionQuotaSignals !== undefined ? { decisionQuotaSignals: previous.decisionQuotaSignals } : {}),
+      ...(!Object.hasOwn(requestedCombo, "decisionQuotaTiers") && requestedCombo.strategy === "jev" && previous?.decisionQuotaTiers !== undefined ? { decisionQuotaTiers: previous.decisionQuotaTiers } : {}),
       ...(!Object.hasOwn(requestedCombo, "allowMeteredTargets") && previous?.allowMeteredTargets === true
         ? { allowMeteredTargets: true }
         : {}),
@@ -244,6 +247,11 @@ export async function handleComboRoutes(ctx: ManagementContext): Promise<Respons
       ...(!Object.hasOwn(requestedCombo, "imageInput") && previous?.imageInput !== undefined
         ? { imageInput: previous.imageInput }
         : {}),
+      // #7229: the dashboard does not edit the row description, so a round trip that omits it
+      // (including a rename) keeps it. An explicit empty string still clears it.
+      ...(!Object.hasOwn(requestedCombo, "description") && previous?.description !== undefined
+        ? { description: previous.description }
+        : {}),
       // `lastResort` rides on each target, so a GUI that re-sends the target list without the
       // flag would strip it. Carry it over per target, matched on provider+model.
       ...(Array.isArray(requestedCombo.targets) && Array.isArray(previous?.targets)
@@ -516,6 +524,8 @@ export async function handleComboRoutes(ctx: ManagementContext): Promise<Respons
       if (!(error instanceof ConfigWritePublishedError)) {
         return jsonResponse({ error: "combo could not be saved" }, 500);
       }
+      // Published but bookkeeping failed: live observers (JEV quota activation) still follow the saved combo.
+      notifyLiveConfigObservers(config);
       throw error;
     }
     reconcileLiveStateStores();
@@ -548,7 +558,12 @@ export async function handleComboRoutes(ctx: ManagementContext): Promise<Respons
     const { clearComboSelectionState, clearComboTargetCooldowns } = await import("../../combos");
     delete config.combos![id];
     if (Object.keys(config.combos!).length === 0) deleteConfigTopLevelKey(config, "combos");
-    saveConfigPreservingClaudeCode(config);
+    try {
+      saveConfigPreservingClaudeCode(config);
+    } catch (error) {
+      if (error instanceof ConfigWritePublishedError) notifyLiveConfigObservers(config);
+      throw error;
+    }
     reconcileLiveStateStores();
     clearComboSelectionState(id);
     clearComboTargetCooldowns(id);

package/src/server/management/oauth-account-routes.ts

@@ -510,7 +510,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
               reauthReason: summary.needsReauth === true ? "refresh_failed" : undefined,
             });
           return { ...summary, ...oauthAccountHealthFields(provider, summary.id, health), quotaMode,
-            ...(supportsPause ? { paused: full?.paused === true } : {}),
+            ...(supportsPause ? { paused: full?.paused === true, ...(full?.pauseDetails ? { pauseDetails: full.pauseDetails } : {}) } : {}),
             ...(isAnthropicOAuthInstance(provider) && supportsPause ? { autoSwitchThresholdOverride: full?.autoSwitchThresholdOverride ?? null,
               effectiveAutoSwitchThreshold: effectiveAnthropicAccountThresholdForInstance(provider as AnthropicInstanceId, config, full),
               autoSwitchThreshold: effectiveAnthropicAccountThresholdForInstance(provider as AnthropicInstanceId, config) } : {}),
@@ -1116,6 +1116,15 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     clearProviderQuotaCache();
     return jsonResponse({ ...result, name, store: providerKeyStoreKind(config.providers[name]) });
   }
+  if (url.pathname === "/api/providers/keys/pause" && req.method === "PUT") {
+    const body = await readManagementJsonBodyOr(req, {});
+    if (!isPlainRecord(body)) return jsonResponse({ error: "body must be an object" }, 400);
+    if (typeof body.name !== "string" || typeof body.id !== "string" || typeof body.paused !== "boolean") return jsonResponse({ error: "name, id and paused required" }, 400);
+    if (!isValidProviderName(body.name) || !hasOwnProvider(config.providers, body.name)) return jsonResponse({ error: "unknown provider" }, 404);
+    const { setProviderApiKeyPaused } = await import("../../providers/api-key-pause");
+    return setProviderApiKeyPaused(config, body.name, body.id, body.paused)
+      ? jsonResponse({ ok: true }) : jsonResponse({ error: "key not found" }, 404);
+  }
   if (url.pathname === "/api/providers/keys/active" && req.method === "PUT") {
     const body = await readManagementJsonBodyOr(req, {}) as { name?: string; id?: string };
     const name = (body.name ?? "").trim();

package/src/server/management/provider-completion-test.ts

@@ -0,0 +1,289 @@
+/**
+ * Explicit single-model diagnostic, isolated from discovery, routing health and request history.
+ * Unsupported transports: TLS profiles, HTTP version pins, enabled pacing, custom fetch + proxy.
+ * Adding an exclusion requires a regression test. No retries, failover, or output preview.
+ */
+import type { OcxConfig, OcxProviderConfig } from "../../types";
+import { routedProviderConfig } from "../../providers/routed-config";
+import { PROVIDER_REGISTRY } from "../../providers/registry";
+import { resolveModelAlias } from "../../providers/default-aliases";
+import { providerApiKeySelectionIsCurrent } from "../../providers/api-key-selection";
+import { resolveWireProtocolOverride } from "../adapter-resolve";
+import { openAIChatTransport, stripBracketedModelSuffix } from "../../adapters/openai-chat/wire";
+import { buildResponsesTransport } from "../../adapters/openai-responses/transport";
+import { openRouterProviderPayload, resolveOpenRouterRouting } from "../../providers/openrouter-routing";
+import { resolveVercelGatewayRouting, vercelGatewayProviderPayload } from "../../providers/vercel-gateway-routing";
+import { assertProviderDestinationAllowed, providerAllowsPrivateNetwork } from "../../lib/destination-policy";
+import { providerOutboundPost, ProviderOutboundPolicyError, ProviderOutboundSendCancelledError,
+  type ProviderOutboundDependencies } from "../../lib/provider-outbound";
+import { redactSecretString } from "../../lib/redact";
+import { decodeServerSentEvents } from "../../lib/sse-decoder";
+import { createTranslatorBudget } from "../../lib/translator-budget";
+import { jsonResponse } from "../auth-cors";
+import type { ManagementContext } from "./context";
+import { managementBodyTooLargeResponse, readManagementJsonBody } from "./body";
+
+export const COMPLETION_TEST_PROMPT = "Reply exactly OK.";
+export const COMPLETION_TEST_OUTPUT_TOKEN_CAP = 32;
+export const COMPLETION_TEST_TIMEOUT_MS = 20_000;
+export const COMPLETION_TEST_MAX_BYTES = 64 * 1024;
+
+type Wire = "openai-chat" | "openai-responses";
+type Code = "destination_refused" | "credential_missing" | "credential_changed" | "http_status" | "redirect"
+  | "network" | "stream_error" | "premature_eof" | "no_content" | "timeout" | "aborted" | "too_large";
+const MESSAGES: Record<Code, string> = {
+  destination_refused: "Provider destination refused by policy.",
+  credential_missing: "Provider credential is missing.",
+  credential_changed: "Provider request authority changed before send.",
+  http_status: "Upstream returned an unsuccessful HTTP status.",
+  redirect: "Upstream redirect refused.",
+  network: "Upstream network request failed.",
+  stream_error: "Upstream stream reported an error.",
+  premature_eof: "Upstream stream ended without a terminal event.",
+  no_content: "Upstream completed without a text delta.",
+  timeout: "Completion test deadline exceeded.",
+  aborted: "Completion test was cancelled.",
+  too_large: "Upstream stream exceeded the byte limit.",
+};
+export type ProviderCompletionTestResult = {
+  applicable: false;
+  reason: "disabled" | "forward_auth" | "oauth_auth" | "unsupported_adapter" | "unsupported_transport";
+  adapter?: string;
+  detail?: "tls_profile" | "upstream_http_version" | "request_pacing" | "custom_executor_egress";
+} | {
+  applicable: true; ok: boolean; provider: string; requestedModel: string; wireModel: string; wire: Wire;
+  upstreamModel: string | null; modelComparison: "match" | "mismatch" | "unknown";
+  comparisonNote?: "missing_metadata" | "conflicting_metadata";
+  identityVerified: false; ttftMs: number | null; totalLatencyMs: number; outputTokenCap: 32;
+  termination: "completed" | "failed" | "timeout" | "aborted" | "too_large";
+  error: null | { code: Code; status?: number; message: string };
+};
+export interface ProviderCompletionTestInput { config: OcxConfig; name: string; model: string; signal?: AbortSignal }
+export interface ProviderCompletionTestDependencies {
+  now?: () => number;
+  timeoutMs?: number;
+  outboundDependencies?: ProviderOutboundDependencies;
+}
+
+function transportExclusion(row: OcxProviderConfig): Extract<ProviderCompletionTestResult, { applicable: false }>["detail"] {
+  if (row.tlsProfile !== undefined) return "tls_profile";
+  if (row.upstreamHttpVersion !== undefined) return "upstream_http_version";
+  if (row.requestPacing?.enabled) return "request_pacing";
+  if (typeof (row as { fetch?: unknown }).fetch === "function" && "proxy" in row) return "custom_executor_egress";
+  return undefined;
+}
+function nativeModel(config: OcxConfig, row: OcxProviderConfig, model: string): string {
+  const known = new Set([...(row.models ?? []), ...Object.keys(row.modelAliases ?? {})]);
+  return known.has(model) ? model : resolveModelAlias(config, row, known, model) ?? model;
+}
+function derive(config: OcxConfig, name: string, row: OcxProviderConfig, model: string) {
+  const resolved = routedProviderConfig(name, row);
+  const native = nativeModel(config, resolved, model);
+  const routed = resolveWireProtocolOverride(name, native, resolved);
+  const wire = routed.adapter;
+  if (wire !== "openai-chat" && wire !== "openai-responses") throw new Error("unsupported adapter");
+  const transport = wire === "openai-chat" ? openAIChatTransport(routed)
+    : buildResponsesTransport(routed, { headers: new Headers() });
+  const headers = new Headers(transport.headers);
+  headers.set("Accept", "text/event-stream");
+  const wireModel = routed.modelSuffixBracketStrip ? stripBracketedModelSuffix(native) : native;
+  const openRouterRouting = wire === "openai-chat" ? resolveOpenRouterRouting(routed, native) : undefined;
+  const vercelRouting = wire === "openai-chat" ? resolveVercelGatewayRouting(routed, native) : undefined;
+  const providerRouting = vercelRouting ? vercelGatewayProviderPayload(vercelRouting)
+    : openRouterRouting ? openRouterProviderPayload(openRouterRouting) : undefined;
+  // Normal inference admits registry-local defaults as well as the operator's explicit opt-in.
+  // Materialize that effective policy for the outbound wrapper's narrower local HTTP safeguard.
+  const allowLocalCleartextPost = providerAllowsPrivateNetwork(name, routed);
+  // Capture primitive values now: rows and their nested header objects may mutate in place.
+  const selection = routed._apiKeyAttempt;
+  const fingerprint = JSON.stringify({ wire, providerRouting, allowLocalCleartextPost, url: transport.url, wireModel, headers: [...headers].sort(([a], [b]) => a.localeCompare(b)),
+    authMode: routed.authMode, apiKey: routed.apiKey,
+    selection: selection && { entryId: selection.entryId, reference: selection.reference, revision: selection.revision },
+    allowPrivateNetwork: routed.allowPrivateNetwork, proxy: routed.proxy, noProxy: routed.noProxy, disabled: row.disabled });
+  return { routed, wire: wire as Wire, wireModel, providerRouting, allowLocalCleartextPost, headers, url: transport.url, fingerprint };
+}
+function maskedModel(raw: string, secrets: Array<string | undefined>): string {
+  if (secrets.some(secret => typeof secret === "string" && secret.length > 0 && raw.includes(secret))) return "[redacted]";
+  return redactSecretString(raw.replace(/[\x00-\x1f\x7f-\x9f]/g, "").slice(0, 256));
+}
+function abortable<T>(promise: Promise<T>, signal: AbortSignal): Promise<T> {
+  return new Promise((resolve, reject) => {
+    const abort = () => reject(signal.reason);
+    signal.addEventListener("abort", abort, { once: true });
+    if (signal.aborted) abort();
+    promise.then(resolve, reject).finally(() => signal.removeEventListener("abort", abort));
+  });
+}
+class DiagnosticFailure extends Error { constructor(readonly code: Code) { super(MESSAGES[code]); } }
+
+/** Direct diagnostic; callers supply an existing provider name and an already validated model. */
+export async function runProviderCompletionTest(
+  { config, name, model, signal: requestSignal }: ProviderCompletionTestInput,
+  deps: ProviderCompletionTestDependencies = {},
+): Promise<ProviderCompletionTestResult> {
+  const row = config.providers[name];
+  if (!Object.hasOwn(config.providers, name) || !row) throw new Error("unknown provider");
+  if (row.disabled) return { applicable: false, reason: "disabled" };
+  const authKind = PROVIDER_REGISTRY.find(entry => entry.id === name)?.authKind;
+  if (row.authMode === "forward" || authKind === "forward") return { applicable: false, reason: "forward_auth" };
+  if (row.authMode === "oauth" || authKind === "oauth") return { applicable: false, reason: "oauth_auth" };
+  const detail = transportExclusion(row);
+  if (detail) return { applicable: false, reason: "unsupported_transport", detail };
+  // Metadata resolution must never dereference keychain/env/pool credentials.
+  const { apiKey: _key, apiKeyPool: _pool, _apiKeyAttempt: _attempt, ...metadata } = row;
+  let snapshot: OcxProviderConfig = metadata;
+  let destinationRefused = false;
+  try { snapshot = routedProviderConfig(name, metadata); } catch { destinationRefused = true; }
+  const native = nativeModel(config, snapshot, model);
+  const wire = resolveWireProtocolOverride(name, native, snapshot).adapter;
+  if (wire !== "openai-chat" && wire !== "openai-responses") return { applicable: false, reason: "unsupported_adapter", adapter: wire };
+  const now = deps.now ?? (() => performance.now());
+  const result: Extract<ProviderCompletionTestResult, { applicable: true }> = {
+    applicable: true, ok: false, provider: name, requestedModel: model,
+    wireModel: snapshot.modelSuffixBracketStrip ? stripBracketedModelSuffix(native) : native, wire,
+    upstreamModel: null, modelComparison: "unknown", comparisonNote: "missing_metadata", identityVerified: false,
+    ttftMs: null, totalLatencyMs: 0, outputTokenCap: COMPLETION_TEST_OUTPUT_TOKEN_CAP, termination: "failed", error: null,
+  };
+  const fail = (code: Code, status?: number) => {
+    result.error = { code, message: MESSAGES[code], ...(status !== undefined ? { status } : {}) };
+    result.termination = code === "timeout" || code === "aborted" || code === "too_large" ? code : "failed";
+    return result;
+  };
+  if (destinationRefused) return fail("destination_refused");
+  try { assertProviderDestinationAllowed(name, snapshot); } catch { return fail("destination_refused"); }
+  let resolved: OcxProviderConfig;
+  try { resolved = routedProviderConfig(name, row); } catch { return fail("credential_missing"); }
+  if (resolved.authMode === "key" && !resolved.keyOptional && !resolved.apiKey?.trim()) return fail("credential_missing");
+  let authority: ReturnType<typeof derive>;
+  try { authority = derive(config, name, row, model); } catch { return fail("network"); }
+  const secrets = [authority.routed.apiKey, ...Object.values(authority.routed.headers ?? {}),
+    ...[...authority.headers].filter(([name]) => name === "authorization" || name === "x-api-key").map(([, value]) => value)];
+  result.wire = authority.wire;
+  result.wireModel = authority.wireModel;
+  const controller = new AbortController();
+  const deadline = AbortSignal.timeout(deps.timeoutMs ?? COMPLETION_TEST_TIMEOUT_MS);
+  const signal = AbortSignal.any([...(requestSignal ? [requestSignal] : []), deadline, controller.signal]);
+  const started = now();
+  let reader: ReadableStreamDefaultReader<Uint8Array> | undefined;
+  let response: Response | undefined;
+  const translatorBudget = createTranslatorBudget();
+  let observed: string | undefined;
+  let conflicting = false, terminal = false, content = false, finishReason = false;
+  const observe = (value: unknown) => {
+    if (typeof value !== "string") return;
+    if (observed === undefined) observed = value;
+    else if (value !== observed) conflicting = true;
+  };
+  try {
+    signal.throwIfAborted();
+    const body = JSON.stringify(authority.wire === "openai-chat"
+      ? { model: authority.wireModel, messages: [{ role: "user", content: COMPLETION_TEST_PROMPT }], stream: true, max_tokens: 32,
+        ...(authority.providerRouting ? { provider: authority.providerRouting } : {}) }
+      : { model: authority.wireModel, input: COMPLETION_TEST_PROMPT, stream: true, max_output_tokens: 32, store: false });
+    const pending = providerOutboundPost(name, { ...authority.routed, allowPrivateNetwork: authority.allowLocalCleartextPost }, authority.url, { headers: authority.headers, body, signal }, {
+      ...deps.outboundDependencies,
+      allowLocalCleartextPost: authority.allowLocalCleartextPost,
+      beforeSend: () => {
+        try {
+          const current = config.providers[name];
+          return current === row && !current.disabled && !transportExclusion(current)
+            && derive(config, name, current, model).fingerprint === authority.fingerprint
+            && (!authority.routed.apiKey || providerApiKeySelectionIsCurrent(config, name, authority.routed));
+        } catch { return false; }
+      },
+    });
+    // Even an executor ignoring AbortSignal cannot retain a late response body.
+    void pending.then(late => { if (signal.aborted) void late.body?.cancel().catch(() => {}); }, () => {});
+    response = await abortable(pending, signal);
+    if (response.status >= 300 && response.status < 400) return fail("redirect");
+    if (!response.ok) return fail("http_status", response.status);
+    if (!response.body) return fail("premature_eof");
+    reader = response.body.getReader();
+    let bytes = 0;
+    const counted = new ReadableStream<Uint8Array>({
+      async pull(target) {
+        try {
+          const next = await abortable(reader!.read(), signal);
+          if (next.done) { target.close(); return; }
+          bytes += next.value.byteLength;
+          if (bytes > COMPLETION_TEST_MAX_BYTES) throw new DiagnosticFailure("too_large");
+          target.enqueue(next.value);
+        } catch (error) { target.error(error); }
+      },
+      cancel() { void reader!.cancel().catch(() => {}); },
+    }, { highWaterMark: 0 });
+    for await (const event of decodeServerSentEvents(counted, { signal, translatorBudget })) {
+      if (authority.wire === "openai-chat" && event.data.trim() === "[DONE]") { terminal = true; break; }
+      let chunk: Record<string, any>;
+      try { chunk = JSON.parse(event.data); } catch { throw new DiagnosticFailure("stream_error"); }
+      if (!chunk || typeof chunk !== "object" || chunk.error || event.event === "error" || chunk.type === "error" || chunk.type === "response.failed") {
+        throw new DiagnosticFailure("stream_error");
+      }
+      let text = false;
+      if (authority.wire === "openai-chat") {
+        observe(chunk.model);
+        if (Array.isArray(chunk.choices)) for (const choice of chunk.choices) {
+          if (typeof choice?.delta?.content === "string" && choice.delta.content.length > 0) text = true;
+          if (choice?.finish_reason != null) finishReason = true;
+        }
+      } else {
+        const type = chunk.type ?? event.event;
+        if (["response.created", "response.completed", "response.incomplete"].includes(type)) observe(chunk.response?.model);
+        text = type === "response.output_text.delta" && typeof chunk.delta === "string" && chunk.delta.length > 0;
+        terminal = type === "response.completed" || type === "response.incomplete";
+        if (type === "response.failed") throw new DiagnosticFailure("stream_error");
+      }
+      if (text) { content = true; result.ttftMs ??= Math.max(0, Math.round(now() - started)); }
+      if (terminal) break;
+    }
+    signal.throwIfAborted();
+    if (!terminal && !(authority.wire === "openai-chat" && finishReason)) return fail("premature_eof");
+    if (!content) return fail("no_content");
+    result.ok = true;
+    result.termination = "completed";
+    return result;
+  } catch (error) {
+    return fail(requestSignal?.aborted ? "aborted" : deadline.aborted ? "timeout"
+      : error instanceof DiagnosticFailure ? error.code
+      : error instanceof ProviderOutboundSendCancelledError ? "credential_changed"
+      : error instanceof ProviderOutboundPolicyError ? "destination_refused" : "network");
+  } finally {
+    translatorBudget.dispose();
+    result.totalLatencyMs = Math.max(0, Math.round(now() - started));
+    if (observed !== undefined && !conflicting) {
+      result.modelComparison = observed === authority.wireModel ? "match" : "mismatch";
+      delete result.comparisonNote;
+      result.upstreamModel = maskedModel(observed, secrets);
+    } else if (conflicting) result.comparisonNote = "conflicting_metadata";
+    controller.abort();
+    // Cancellation is initiated on every exit; do not wait on a misbehaving executor.
+    if (reader) { void reader.cancel().catch(() => {}); try { reader.releaseLock(); } catch { /* read pending */ } }
+    else void response?.body?.cancel().catch(() => {});
+  }
+}
+
+const inFlight = new Set<string>();
+export async function handleProviderCompletionTestRoute(
+  { req, url, config }: Pick<ManagementContext, "req" | "url" | "config">,
+  deps: ProviderCompletionTestDependencies = {},
+): Promise<Response> {
+  let body: unknown;
+  try { body = await readManagementJsonBody(req); } catch (error) {
+    return managementBodyTooLargeResponse(error, req, config) ?? jsonResponse({ error: "invalid completion test request" }, 400);
+  }
+  if (!body || typeof body !== "object" || Array.isArray(body)
+    || Object.keys(body).some(key => key !== "model" && key !== "confirm")
+    || (body as { confirm?: unknown }).confirm !== true || typeof (body as { model?: unknown }).model !== "string") {
+    return jsonResponse({ error: "invalid completion test request" }, 400);
+  }
+  const model = (body as { model: string }).model.trim();
+  if (!model || model.length > 256 || /[\x00-\x1f\x7f-\x9f]/.test((body as { model: string }).model)) {
+    return jsonResponse({ error: "invalid completion test request" }, 400);
+  }
+  const name = url.searchParams.get("name") ?? "";
+  if (!Object.hasOwn(config.providers, name) || !config.providers[name]) return jsonResponse({ error: "unknown provider" }, 404);
+  if (inFlight.has(name)) return jsonResponse({ error: "completion test already running for this provider" }, 409);
+  inFlight.add(name);
+  try { return jsonResponse(await runProviderCompletionTest({ config, name, model, signal: req.signal }, deps)); }
+  finally { inFlight.delete(name); }
+}

package/src/server/management/provider-routes.ts

@@ -764,7 +764,7 @@ function applyProviderPatchFields(
   if (Object.hasOwn(rawBody, "headers")) {
     const headersValue = rawBody.headers;
     if (headersValue === null || (isPlainRecord(headersValue) && Object.keys(headersValue).length === 0)) {
-      // Registry-owned static metadata (e.g. opencode-free's x-opencode-client marker)
+      // Registry-owned static metadata (e.g. meta-muse's x-api-version marker)
       // is not user-managed: restoring it keeps the upstream transport intact after a
       // clear instead of deleting the whole block.
       const entry = getProviderRegistryEntry(name);
@@ -1357,6 +1357,12 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
       if (submittedModelContextTiers && liveTiers) candidate.modelContextTiers = Object.assign(Object.create(null), liveTiers, candidate.modelContextTiers ?? {});
       else if (!submittedModelContextTiers && liveTiers) candidate.modelContextTiers = { ...liveTiers };
       else if (!submittedModelContextTiers) delete candidate.modelContextTiers;
+      // Read omitted policy at publication time, after any concurrent operator edit.
+      if (!Object.hasOwn(rawProvider, "accountAutoPause")) {
+        const livePolicy = config.providers[name]?.accountAutoPause;
+        if (livePolicy === undefined) delete candidate.accountAutoPause;
+        else candidate.accountAutoPause = structuredClone(livePolicy);
+      }
       // Full forms omit the opt-in; preserve the latest value, including a concurrent clear.
       if (!Object.hasOwn(rawProvider, "inferContextWindow")) {
         const liveInference = config.providers[name]?.inferContextWindow;
@@ -1602,6 +1608,8 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
     });
   }
 
+  if (url.pathname === "/api/providers/test-completion" && req.method === "POST") return (await import("./provider-completion-test")).handleProviderCompletionTestRoute(ctx);
+
   // Lightweight connectivity probe: perform the provider's live /models fetch DIRECTLY and
   // report only real upstream evidence. The catalog aggregate (fetchAllModels) deliberately
   // hides fetch failures behind stale/static fallbacks, so a catalog-presence check would

package/src/server/management/route-registry.ts

@@ -364,6 +364,7 @@ export const MANAGEMENT_ROUTES: readonly ManagementRoute[] = [
   { method: "PUT", path: "/api/oauth/accounts/pool", module: "server/management/oauth-account-routes", mutates: true },
   { method: "PUT", path: "/api/providers/keys/active", module: "server/management/oauth-account-routes", mutates: true },
   { method: "PUT", path: "/api/providers/keys/alias", module: "server/management/oauth-account-routes", mutates: true },
+  { method: "PUT", path: "/api/providers/keys/pause", module: "server/management/oauth-account-routes", mutates: true },
   // server/management/provider-routes
   { method: "DELETE", path: "/api/providers", module: "server/management/provider-routes", mutates: true },
   { method: "GET", path: "/api/provider-context-caps", module: "server/management/provider-routes", mutates: false },
@@ -373,6 +374,7 @@ export const MANAGEMENT_ROUTES: readonly ManagementRoute[] = [
   { method: "GET", path: "/api/providers", module: "server/management/provider-routes", mutates: false },
   { method: "PATCH", path: "/api/providers", module: "server/management/provider-routes", mutates: true },
   { method: "POST", path: "/api/providers", module: "server/management/provider-routes", mutates: true },
+  { method: "POST", path: "/api/providers/test-completion", module: "server/management/provider-routes", mutates: true },
   { method: "POST", path: "/api/providers/test", module: "server/management/provider-routes", mutates: true },
   { method: "PUT", path: "/api/providers", module: "server/management/provider-routes", mutates: true },
   { method: "PUT", path: "/api/provider-context-caps", module: "server/management/provider-routes", mutates: true },

package/src/server/messages-native.ts

@@ -1,3 +1,4 @@
+import { captureAccountAutoPauseAttempt, wasAccountAutoPaused } from "../oauth/account-auto-pause";
 import { createPhysicalSendReporter } from "../lib/request-execution-budget";
 import { createInferenceSendBudget } from "./inference/context";
 /**
@@ -44,6 +45,7 @@ import { classifyError } from "../lib/errors";
 import { relaySseWithPayloadRewrite } from "./sse-payload-rewrite";
 import { redactSecretString } from "../lib/redact";
 import { resolveClientRetryAfter } from "../lib/retry-after";
+import { enrichOpenCodeZenUpstreamMessage } from "../providers/opencode-zen-rate-limit";
 import { isTranslatorBudgetExceededError, type TranslatorBudget } from "../lib/translator-budget";
 import {
   applyReplayRefusalClientHeaders,
@@ -119,7 +121,7 @@ import {
   recordKeyWireAttemptUsage,
   type RequestLogContext,
 } from "./request-log";
-import { fetchWithHeaderTimeout, providerFetch, safeHostLabel, sendWithConnectionPolicy } from "./responses/fetch-helpers";
+import { fetchWithHeaderTimeout, physicalSendObserverInit, providerFetch, safeHostLabel, sendWithConnectionPolicy } from "./responses/fetch-helpers";
 import { anthropicBillingPhysicalFetch } from "../providers/anthropic-billing-ownership";
 import { rotateAnthropicBillingKeyOnResponse } from "../providers/anthropic-billing-recovery";
 import { linkAbortSignal } from "./responses/core-lifetime";
@@ -544,6 +546,7 @@ export async function handleNativeMessages(options: HandleNativeMessagesOptions)
     pendingDistributedFailure = undefined;
     record?.();
   };
+  /** Send the native Messages request under the transient retry policy, re-validating the selected OAuth account or API key at the dispatch boundary. */
   const send = async (recovery?: "rate-limit-429" | "oauth-401" | "oauth-account-403" | "key-429" | "key-401"): Promise<Response> => {
     const remaining = remainingTransientSends();
     if (requestTransientPolicy && remaining <= 0) {
@@ -615,6 +618,7 @@ export async function handleNativeMessages(options: HandleNativeMessagesOptions)
             }
             const releaseFamily = snapshot && oauthBinding ? anthropicModelQuotaFor(oauthBinding.instance).claimAnthropicFamilyRevalidation(snapshot.accountId, route.modelId) : () => {};
             if (!releaseFamily) throw new AnthropicAccountCooldownError(1);
+            const observeAutoPause = captureAccountAutoPauseAttempt(route.providerName, activeProvider, { config, oauth: sendingBinding?.snapshot }, headers);
             const selection = activeProvider._apiKeyAttempt;
             let dispatched: Response;
             const spendReport = createPhysicalSendReporter(physicalBudget, () => ({
@@ -640,7 +644,7 @@ export async function handleNativeMessages(options: HandleNativeMessagesOptions)
                   anthropicBillingPhysicalFetch((activeProvider as OcxProviderTransport).fetch ?? execute, route.providerName, activeProvider),
                   route.providerName, activeProvider, wire.url, activeProvider.apiKeyTransport === "bearer" ? "authorization" : "x-api-key"),
                 wire.url,
-                applyUpstreamRecoveryInit({ ...init, method: "POST", headers, body: wire.body }, transportRecovery),
+                applyUpstreamRecoveryInit({ ...init, method: "POST", headers, body: wire.body, ...physicalSendObserverInit(observeAutoPause, wire.url) }, transportRecovery),
                 { providerName: route.providerName, provider: activeProvider },
               );
             } finally {
@@ -658,7 +662,7 @@ export async function handleNativeMessages(options: HandleNativeMessagesOptions)
                   && credentialGeneration(current.credential) === snapshot.generation
                   && current.credential.accountId === providerAccountUuid) {
                   bindAnthropicRefusalCredentialForSend(dispatched, sendOwner, providerAccountUuid);
-                  recordAnthropicAccountQuotaFromHeadersForInstance(nativeInstance!, snapshot.accountId, dispatched.headers, writerGeneration, dispatched.status, route.modelId);
+                  recordAnthropicAccountQuotaFromHeadersForInstance(nativeInstance!, snapshot.accountId, dispatched.headers, writerGeneration, dispatched.status, route.modelId, snapshot.generation);
                 }
               } catch { /* Passive observation must not fail the response. */ }
             }
@@ -671,7 +675,7 @@ export async function handleNativeMessages(options: HandleNativeMessagesOptions)
               ? () => { recordDistributedResponseFailure(dispatched, config, route.providerName, req.signal); }
               : undefined;
             if (!dispatched.ok) await recordKeyAttemptFailure(logCtx, dispatched, init.signal ?? upstream.signal);
-            return dispatched;
+            return observeAutoPause ? observeAutoPause(dispatched) : dispatched;
           },
         }),
       ),
@@ -699,9 +703,19 @@ export async function handleNativeMessages(options: HandleNativeMessagesOptions)
     let billingRecoveryActive = false;
     const keySendAvailable = () => transientSendAvailable()
       && (!billingRecoveryActive || Math.max(physicalSendsUsed, physicalBudget.used) < physicalBudget.policy.maxTotalModelSends);
+    let autoPauseMoves = 0;
     const recoveryPasses = activeProvider._apiKeyAttempt?.distributed ? activeProvider.apiKeyPool?.length ?? 1 : 1;
     for (let pass = 0; ; pass++) {
       const priorResponse = response;
+      for (; wasAccountAutoPaused(response) && !oauthBinding && config.providers[route.providerName]?.apiKey && autoPauseMoves < 3 && keySendAvailable(); autoPauseMoves++) {
+        const fresh = resolveCurrentProviderApiKeyTransport(config, route.providerName, { ...activeProvider, _apiKeyAttempt: undefined });
+        const next = fresh && (selectProactiveApiKeyTransport(config, route.providerName, fresh) ?? fresh);
+        if (!next) break;
+        try { void response.body?.cancel().catch(() => {}); } catch { /* closed */ }
+        rebuildFor(next);
+        response = await send("key-401");
+      }
+
       // A credential-scoped 401 on a static key pool says nothing about the sibling keys.
       while (response.status === 401 && distributedResponseOwnsKey && hasKeyPoolFailover(activeProvider) && keySendAvailable()) {
         const rotated = rotateProviderTransportOn401(config, route.providerName, activeProvider, {
@@ -761,6 +775,7 @@ export async function handleNativeMessages(options: HandleNativeMessagesOptions)
       if (response === priorResponse || isNonReplayableResponse(response) || !keySendAvailable()) break;
       // Billing class transitions share the physical-send ceiling; distributed-only
       // transitions additionally retain their original bounded pool-pass allowance.
+      if (wasAccountAutoPaused(response) && autoPauseMoves < 3) continue;
       if (distributedResponseOwnsKey && (
         (billingRecoveryActive && [401, 429].includes(response.status))
         || (activeProvider.adapter === "anthropic" && hasKeyPoolFailover(activeProvider) && [400, 402].includes(response.status))
@@ -845,7 +860,7 @@ export async function handleNativeMessages(options: HandleNativeMessagesOptions)
       upstream.abort();
       return fail(499, "Client cancelled request", "api_error");
     }
-    return retainUpstreamMessagesRequestId(nativeMessagesErrorResponse(response, bodyText, finishLog), response.headers);
+    return retainUpstreamMessagesRequestId(nativeMessagesErrorResponse(response, bodyText, finishLog, route.providerName, activeProvider), response.headers);
   }
 
   const contentType = response.headers.get("content-type")?.toLowerCase() ?? "";
@@ -999,7 +1014,7 @@ function isNativeOverflowError(error: Rec, message: string): boolean {
  * Messages path, so a client sees the same contract on either lane: transient 5xx become 529
  * with a retry hint, and a proxy-side replay refusal keeps its no-retry marking.
  */
-function nativeMessagesErrorResponse(response: Response, bodyText: string, finishLog: FinishLog): Response {
+function nativeMessagesErrorResponse(response: Response, bodyText: string, finishLog: FinishLog, providerName: string, provider: OcxProviderConfig): Response {
   let upstreamType: string | undefined;
   let upstreamCode: string | undefined;
   let upstreamMessage: string | undefined;
@@ -1013,8 +1028,20 @@ function nativeMessagesErrorResponse(response: Response, bodyText: string, finis
     }
   } catch { /* keep generic classification */ }
   const detail = formatAnthropicErrorBody(response.status, response.headers, bodyText);
-  const message = upstreamMessage
+  const rawMessage = upstreamMessage
     ?? (detail ? `Provider error ${response.status}: ${detail}` : `Provider error ${response.status}`);
+  const message = enrichOpenCodeZenUpstreamMessage(rawMessage, {
+    status: response.status,
+    providerName,
+    baseUrl: provider.baseUrl,
+    adapter: provider.adapter,
+    authMode: provider.authMode,
+    hasApiKey: Boolean(provider.apiKey?.trim()),
+    upstreamRetryAfter: response.headers.get("retry-after"),
+    upstreamErrorType: upstreamType,
+    upstreamErrorCode: upstreamCode,
+    supportsHttpSameKeyRetry: true,
+  });
   const classified = classifyError(
     response.status,
     upstreamType ?? (response.status === 401 ? "authentication_error"