@bitkyc08/opencodex 2.88.0 → 2.89.0

package/src/providers/quota-decision-publication.ts

@@ -0,0 +1,77 @@
+/** Producer projection: only measured subscription windows reach advisory snapshots. */
+import type { ProviderQuota } from "./quota-types";
+import type { StoredAccountQuota } from "../codex/quota-types";
+import { resetAtToMs } from "../codex/quota-types";
+import type { DecisionQuotaWindow } from "./quota-decision-snapshot";
+import { decisionQuotaSinkActive, publishDecisionAccountQuota } from "../lib/decision-quota-sink";
+const rawWindows = new WeakMap<ProviderQuota, readonly DecisionQuotaWindow[]>();
+/** Producer retains raw advisory projection separately from unchanged display/hard policy. */
+export function bindRawDecisionWindows(quota: ProviderQuota, windows: readonly DecisionQuotaWindow[]): void { if (decisionQuotaSinkActive()) rawWindows.set(quota, windows); }
+/**
+ * Raw windows a binding producer attached to this observation, or undefined. Binding producers
+ * (Anthropic usage/header parsers) bind only while advisory evidence is active, so an observation
+ * parsed while inactive has none and must stay unknown rather than fall back to display fields,
+ * which drop invalid resets and clamp percentages.
+ */
+export function boundDecisionWindows(quota: ProviderQuota): DecisionQuotaWindow[] | undefined {
+  const raw = rawWindows.get(quota);
+  return raw ? raw.map(row => ({ ...row })) : undefined;
+}
+/** Project a provider quota report onto decision windows, preferring raw windows bound by the producer over the display fields. */
+export function providerDecisionWindows(quota: ProviderQuota): DecisionQuotaWindow[] {
+  const raw = rawWindows.get(quota);
+  if (raw) return raw.map(row => ({ ...row }));
+  const windows: DecisionQuotaWindow[] = [];
+  for (const [window, percent, reset] of [
+    ["5h", "fiveHourPercent", "fiveHourResetAt"], ["weekly", "weeklyPercent", "weeklyResetAt"], ["monthly", "monthlyPercent", "monthlyResetAt"],
+  ] as const) {
+    if (quota[percent] !== undefined) windows.push({ window, percent: quota[percent]!, observedAt: quota.updatedAt, ...(quota[reset] !== undefined ? { resetAt: quota[reset] } : {}) });
+  }
+  for (const row of Array.isArray(quota.customWindows) ? quota.customWindows : []) {
+    const window = typeof row?.label === "string" ? row.label.trim().toLowerCase() : "";
+    if (row?.scope === "model" && (window === "fable" || window === "opus" || window === "sonnet")) {
+      windows.push({ window, percent: row.percent, observedAt: row.passiveObservedAt ?? quota.updatedAt, ...(row.resetAt !== undefined ? { resetAt: row.resetAt } : {}) });
+    }
+  }
+  return windows;
+}
+/** Publish decision windows for one Anthropic pool account, bound to its credential generation; a null quota publishes no windows. */
+export function publishAnthropicDecisionQuota(id: string, generation: string, quota: ProviderQuota | null, partial = false): void {
+  if (!decisionQuotaSinkActive()) return;
+  // A non-null observation without a raw binding was parsed while inactive: unknown, never display fallback.
+  const windows = quota ? boundDecisionWindows(quota) : [];
+  if (windows) publishDecisionAccountQuota("anthropic", id, generation, windows, partial);
+}
+type CodexObservation = Omit<StoredAccountQuota, "updatedAt">;
+type CodexWindow = "short" | "weekly" | "monthly";
+const rawCodexWindows = new WeakMap<CodexObservation, readonly DecisionQuotaWindow[]>();
+/** Keep invalid resets and the producer clock apart from compatibility display/policy parsing. */
+export function bindRawCodexDecisionResets(raw: CodexObservation, resets: Record<CodexWindow, unknown>, observedAt: number): void {
+  if (!decisionQuotaSinkActive()) return;
+  const windows = codexDecisionWindows(raw, observedAt).map(row => {
+    const value = resets[row.window === "5h" ? "short" : row.window as CodexWindow];
+    if (value === undefined || value === null) return row;
+    const numeric = typeof value === "number" ? value : typeof value === "string" && value.trim() !== "" ? Number(value) : NaN;
+    return { ...row, resetAt: Number.isFinite(numeric) && numeric >= 0 ? resetAtToMs(numeric) : NaN };
+  });
+  rawCodexWindows.set(raw, windows);
+}
+/** Build decision windows from a raw Codex observation, stamping each with the producer clock rather than a merge-time clock. */
+function codexDecisionWindows(raw: CodexObservation, observedAt: number): DecisionQuotaWindow[] {
+  const windows: DecisionQuotaWindow[] = [];
+  for (const kind of ["short", "weekly", "monthly"] as const) {
+    const percent = raw[`${kind}Percent`];
+    const reset = raw[`${kind}ResetAt`];
+    if (percent !== undefined) windows.push({ window: kind === "short" ? "5h" : kind, percent, observedAt,
+      ...(reset !== undefined ? { resetAt: resetAtToMs(reset) } : {}) });
+  }
+  return windows;
+}
+/** Publish decision windows for a Codex or main account from the raw observation, never from the display merge, so carried windows cannot acquire a fresh clock. */
+export function publishCodexDecisionQuota(id: string, generation: number, raw: CodexObservation, observedAt: number, provider = "codex", partial = true): void {
+  if (!decisionQuotaSinkActive()) return;
+  // RAW observation, never the display merge: carried windows cannot acquire a fresh clock.
+  // Header/WHAM parsers bind reset validity only while active; an unbound observation stays unknown.
+  const windows = rawCodexWindows.get(raw);
+  if (windows) publishDecisionAccountQuota(provider, id, generation, windows, partial);
+}

package/src/providers/quota-decision-snapshot.ts

@@ -0,0 +1,145 @@
+/** Loaded-only advisory evidence. No auth, disk, keychain, selectors, timers or probes. Imported only by src/combos/jev-quota-activation.ts; core producers reach it through src/lib/decision-quota-sink.ts while activation is registered. */
+import { createHash } from "node:crypto";
+import { getConfigDir } from "../config/paths";
+import { captureConfigGeneration } from "../lib/state-store-sweeper";
+import type { OcxProviderConfig } from "../types";
+
+export interface DecisionQuotaWindow {
+  window: "5h" | "weekly" | "monthly" | "fable" | "opus" | "sonnet";
+  percent: number;
+  observedAt: number;
+  resetAt?: number;
+}
+export interface DecisionQuotaAccount {
+  id: string;
+  generation: string | number;
+  usable: boolean;
+}
+type Evidence = { generation: string | number; windows: readonly DecisionQuotaWindow[] };
+type Roster = { root: string; accounts: readonly DecisionQuotaAccount[] };
+const rosters = new Map<string, Roster>();
+const accounts = new Map<string, Evidence>();
+const unusable = new Map<string, string | number | true>();
+const POOL_PROVIDERS = new Set(["anthropic", "codex", "codex-main"]);
+const MAX_ROWS = 1024;
+const MAX_WINDOWS = 64;
+let keyEpoch = 0;
+let writesForTests = 0;
+/** Test-only: count of write entry calls, so signals-off tests can assert that nothing reached the snapshot. */
+export function decisionQuotaSnapshotWriteCountForTests(): number { return writesForTests; }
+const credentialVersions = new Map<string, string>();
+/** Credential owner calls this after its normal read; JEV never invokes that owner. */
+export function observeDecisionKeyCredential(reference: string, resolved: string | undefined): void {
+  writesForTests++;
+  const version = createHash("sha256").update(resolved ?? "").digest("hex");
+  const referenceId = createHash("sha256").update(reference).digest("hex");
+  const previous = credentialVersions.get(referenceId);
+  if (previous !== undefined && previous !== version) invalidateDecisionKeyQuotas();
+  if (credentialVersions.size >= 256 && !credentialVersions.has(referenceId)) {
+    credentialVersions.delete(credentialVersions.keys().next().value!);
+    invalidateDecisionKeyQuotas();
+  }
+  credentialVersions.set(referenceId, version);
+}
+const keys = new Map<string, { root: string; epoch: number; configGeneration: number; policy: string; windows: readonly DecisionQuotaWindow[] }>();
+/** Compose the per-provider, per-account map key. */
+const accountKey = (provider: string, id: string) => `${provider}\0${id}`;
+// Private policy digest, never returned or serialized. Resolving the configured credential is
+// the collector's responsibility; request reads only this already-published generation.
+/** Digest the provider settings a key-based evidence row was published under; it is never returned or serialized. */
+function keyPolicy(provider: OcxProviderConfig): string {
+  return createHash("sha256").update(JSON.stringify([
+    provider.adapter, provider.baseUrl, provider.authMode, provider.apiKey, provider.apiKeyPool, provider.headers,
+    provider.apiKey && credentialVersions.get(createHash("sha256").update(provider.apiKey).digest("hex")),
+  ])).digest("hex");
+}
+/** Drop all key-based decision evidence and advance the epoch so earlier publications cannot be read. */
+export function invalidateDecisionKeyQuotas(): void { keyEpoch++; keys.clear(); }
+/** Publish decision windows for a single-key provider; pooled, disabled or non-key providers are never published, and the table is bounded. */
+export function publishDecisionKeyQuota(name: string, provider: OcxProviderConfig, windows: readonly DecisionQuotaWindow[]): void {
+  writesForTests++;
+  if (name.length > 1024 || provider.disabled || (provider.authMode ?? "key") !== "key" || (provider.apiKeyPool?.length ?? 0) > 1) return;
+  if (keys.size >= 256 && !keys.has(name)) keys.delete(keys.keys().next().value!);
+  keys.set(name, { root: getConfigDir(), epoch: keyEpoch, configGeneration: captureConfigGeneration(), policy: keyPolicy(provider), windows: copyWindows(windows) });
+}
+/** Read key-based evidence only when the config root, epoch, generation and provider policy still match what was published. */
+export function readLoadedDecisionKeyQuota(name: string, provider: OcxProviderConfig): readonly DecisionQuotaWindow[] | undefined {
+  const row = keys.get(name);
+  if (!row || provider.disabled || (provider.authMode ?? "key") !== "key" || (provider.apiKeyPool?.length ?? 0) > 1
+    || row.root !== getConfigDir() || row.epoch !== keyEpoch || row.configGeneration !== captureConfigGeneration()
+    || row.policy !== keyPolicy(provider)) return undefined;
+  return row.windows.map(row => ({ ...row }));
+}
+/** Replace a pool provider's roster; an oversized pool makes the whole pool unknown rather than hiding usable rows. */
+export function publishDecisionQuotaRoster(provider: string, rows: readonly DecisionQuotaAccount[]): void {
+  writesForTests++;
+  if (!POOL_PROVIDERS.has(provider)) return;
+  const old = rosters.get(provider);
+  if (old?.root !== getConfigDir()) {
+    clearDecisionAccountQuotas(provider);
+    for (const key of unusable.keys()) if (key.startsWith(`${provider}\0`)) unusable.delete(key);
+  }
+  // Overflow or oversized identities make the WHOLE pool unknown; never hide a usable row.
+  if (rows.length > MAX_ROWS || rows.some(row => row.id.length > 1024
+    || typeof row.generation === "string" && row.generation.length > 128)) {
+    clearDecisionAccountQuotas(provider);
+    rosters.delete(provider);
+    return;
+  }
+  const live = new Map(rows.map(row => [row.id, row]));
+  for (const row of old?.accounts ?? []) {
+    if (live.get(row.id)?.generation !== row.generation) {
+      const key = accountKey(provider, row.id);
+      accounts.delete(key);
+      if (!live.has(row.id) || unusable.get(key) !== true) unusable.delete(key);
+    }
+  }
+  rosters.set(provider, { root: getConfigDir(), accounts: rows.map(row => ({ id: row.id, generation: row.generation, usable: row.usable })) });
+}
+/** Withdraw a pool provider's roster and evidence so readers see it as unknown rather than stale or empty. */
+export function withdrawDecisionQuotaRoster(provider: string): void {
+  clearDecisionAccountQuotas(provider);
+  rosters.delete(provider);
+  for (const key of unusable.keys()) if (key.startsWith(`${provider}\0`)) unusable.delete(key);
+}
+/** Publish windows for a roster account at the matching credential generation; a partial observation retains other windows of the same generation. */
+export function publishDecisionAccountQuota(provider: string, id: string, generation: string | number, windows: readonly DecisionQuotaWindow[], partial = false): void {
+  writesForTests++;
+  const roster = rosters.get(provider);
+  if (roster?.root !== getConfigDir() || !roster.accounts.some(row => row.id === id && row.generation === generation)) return;
+  const key = accountKey(provider, id);
+  const previous = accounts.get(key);
+  const retained = partial && previous?.generation === generation ? previous.windows.filter(row => !windows.some(next => row.window === next.window)) : [];
+  accounts.set(key, { generation, windows: copyWindows([...retained, ...windows]) });
+}
+/** Read a pool's already-loaded roster with generation-matched windows; undefined when nothing is loaded for the current config root. */
+export function readLoadedDecisionQuotaPool(provider: string): readonly { id: string; usable: boolean; windows?: readonly DecisionQuotaWindow[] }[] | undefined {
+  const roster = rosters.get(provider);
+  if (roster?.root !== getConfigDir()) return undefined;
+  return roster.accounts.map(row => {
+    const evidence = accounts.get(accountKey(provider, row.id));
+    const quarantine = unusable.get(accountKey(provider, row.id));
+    return { id: row.id, usable: row.usable && quarantine !== true && quarantine !== row.generation, ...(evidence?.generation === row.generation ? { windows: evidence.windows.map(window => ({ ...window })) } : {}) };
+  });
+}
+/** Mark a roster account usable or unusable, optionally scoped to one credential generation so an unrelated generation is left intact. */
+export function setDecisionAccountUsable(provider: string, id: string, usable: boolean, generation?: string | number): void {
+  writesForTests++;
+  const roster = rosters.get(provider);
+  if (roster?.root !== getConfigDir()) return;
+  const row = roster.accounts.find(row => row.id === id && (generation === undefined || generation === row.generation));
+  if (!row) return;
+  const key = accountKey(provider, id);
+  if (usable) {
+    if (generation === undefined || unusable.get(key) !== true) unusable.delete(key);
+  } else if (generation === undefined || unusable.get(key) !== true) unusable.set(key, generation ?? true);
+}
+/** Drop published account windows for a provider or one account, or for every provider when none is given. */
+export function clearDecisionAccountQuotas(provider?: string, id?: string): void {
+  for (const key of accounts.keys()) if (!provider || key.startsWith(`${provider}\0`) && (!id || key === accountKey(provider, id))) accounts.delete(key);
+}
+/** Copy only known window kinds into the bounded evidence table, so callers cannot retain a mutable reference. */
+function copyWindows(windows: readonly DecisionQuotaWindow[]): DecisionQuotaWindow[] {
+  if (windows.length > MAX_WINDOWS) return [];
+  return windows.filter(row => ["5h", "weekly", "monthly", "fable", "opus", "sonnet"].includes(row.window)).map(row => ({ window: row.window, percent: row.percent, observedAt: row.observedAt, ...(row.resetAt !== undefined ? { resetAt: row.resetAt } : {}) }));
+}

package/src/providers/quota-routing-cache.ts

@@ -1,3 +1,4 @@
+import { invalidateDecisionKeyQuotas } from "../lib/decision-quota-sink";
 import { createHash } from "node:crypto";
 import type { OcxProviderConfig } from "../types";
 import type { ProviderQuota, ProviderQuotaReport } from "./quota";
@@ -38,7 +39,9 @@ export function providerQuotaRoutingBinding(
   ])).digest("hex");
 }
 
+/** Clear the routing quota cache together with key-based decision evidence, so one cannot outlive the other. */
 export function clearCachedProviderQuotas(): void {
+  invalidateDecisionKeyQuotas();
   quotaCache.clear();
 }
 

package/src/providers/quota-types.ts

@@ -19,7 +19,12 @@ export interface ProviderQuotaWindow {
   label: string;
   percent: number;
   resetAt?: number;
-  /** Exact CCA wire model measured by this window; display evidence only, not eligibility. */
+  /**
+   * Model this window is attributed to: the exact CCA wire model of a fallback measurement, or
+   * the canonical model of a quota-summary bucket dedicated to one model (Antigravity's Gemini 4
+   * Argon pool). Display evidence only, never eligibility: routing, exhaustion, reset ordering
+   * and reset notifications ignore every window that carries it.
+   */
   modelId?: string;
   /**
    * Set only when the PRODUCER proved this window covers one model family, structurally rather

package/src/providers/quota.ts

@@ -31,7 +31,7 @@ import {
   isProviderQuotaReportCurrent,
   LAST_GOOD_MAX_AGE_MS,
   providerQuotaBeforePublishForTests,
-  routingEvidence,
+  routingEvidence, publishCollectedDecisionQuota,
   setProviderQuotaReportCache,
   TERMINAL_QUOTA_FAILURE,
   type CodexAuthAccountsSnapshotPromise,
@@ -228,6 +228,7 @@ export function flushProviderQuotaObservationsForTests(): Promise<void> {
   return pendingProviderObservation;
 }
 
+/** Collect provider quota reports, using the cache unless refresh is forced, and publish the secret-free decision evidence from the collected reports. */
 export async function fetchProviderQuotaReports(config: OcxConfig, forceRefresh = false): Promise<ProviderQuotaResponse> {
   // A passive read (a Remote Link Child's, #6959) shows the held reports and starts nothing.
   if (isPassiveRead()) return heldProviderQuotaReports(Object.keys(config.providers));
@@ -328,7 +329,7 @@ export async function fetchProviderQuotaReports(config: OcxConfig, forceRefresh
     ) {
       const reports = response.reports.filter(item => mayCommitProviderQuotaKey(item.provider, writerGeneration));
       setProviderQuotaReportCache({ key, ts: Date.now(), response: { ...response, reports } });
-      replaceCachedProviderQuotas(reports, routingEvidence);
+      replaceCachedProviderQuotas(reports, routingEvidence); publishCollectedDecisionQuota(reports, config);
       notifyProviderQuotaSnapshot(reports, config);
     }
     return response;

package/src/providers/registry/entries-extended.ts

@@ -54,7 +54,7 @@ import {
   DEEPSEEK_VISION_PREVIEW_MODEL,
   COMMAND_CODE_MIMO_CONTEXT_WINDOWS,
   COMMAND_CODE_MODEL_INPUT_MODALITIES,
-  OPENCODE_FREE_DEEPSEEK_MODELS,
+  OPENCODE_ZEN_FREE_DEEPSEEK_MODELS,
   OPENCODE_ZEN_TEXT_ONLY_MODELS,
   OPENCODE_ZEN_IMAGE_MODELS,
   deepseekThinkingEffortsFor,
@@ -1089,20 +1089,20 @@ export const PROVIDER_REGISTRY_EXTENDED: readonly ProviderRegistryEntry[] = [
   },
   {
     id: "opencode-zen", label: "opencode zen", baseUrl: "https://opencode.ai/zen/v1", adapter: "openai-chat", authKind: "key", dashboardUrl: "https://opencode.ai/auth",
-    // Same opencode.ai/zen/v1 gateway as `opencode-free` (keyed tier): DeepSeek thinking mode
+    // Keyed opencode.ai/zen/v1 gateway: DeepSeek thinking mode
     // requires the assistant's original reasoning_content to be replayed on tool-call
     // continuations, or the gateway answers HTTP 400 (issues #950/#994). Mirror the DeepSeek
     // reasoning + thinking metadata so `opencode-zen/deepseek-v4-flash-free` — and the other
     // Zen DeepSeek thinking models — never serialize a bare tool-call turn.
-    note: "Keyed OpenCode Zen gateway. Free models on this tier are often short-window rate-limited at roughly 15-20 requests/minute (community-measured; OpenCode does not publish RPM). Zen may return generic 429s without Retry-After / X-RateLimit headers; when Retry-After is omitted, opencodex adds a synthetic backoff hint (upstream Retry-After still wins). Distinct from the keyless opencode-free desktop quota (~200 Big Pickle/free-model requests per 5 hours). Docs: https://opencode.ai/docs/zen/. Free-model prompts may be retained for training — do not send confidential material.",
+    note: "Keyed OpenCode Zen gateway. Free models on this tier are often short-window rate-limited at roughly 15-20 requests/minute (community-measured; OpenCode does not publish RPM). Zen may return generic 429s without Retry-After / X-RateLimit headers; when Retry-After is omitted, opencodex adds a synthetic backoff hint (upstream Retry-After still wins). Docs: https://opencode.ai/docs/zen/. Free-model prompts may be retained for training — do not send confidential material.",
     modelReasoningEfforts: Object.fromEntries(
-      [...DEEPSEEK_GATEWAY_THINKING_MODELS, ...OPENCODE_FREE_DEEPSEEK_MODELS].map(id => [id, deepseekThinkingEffortsFor(id)]),
+      [...DEEPSEEK_GATEWAY_THINKING_MODELS, ...OPENCODE_ZEN_FREE_DEEPSEEK_MODELS].map(id => [id, deepseekThinkingEffortsFor(id)]),
     ),
     modelReasoningEffortMap: Object.fromEntries(
-      [...DEEPSEEK_GATEWAY_THINKING_MODELS, ...OPENCODE_FREE_DEEPSEEK_MODELS].map(id => [id, deepseekReasoningMapFor(id)]),
+      [...DEEPSEEK_GATEWAY_THINKING_MODELS, ...OPENCODE_ZEN_FREE_DEEPSEEK_MODELS].map(id => [id, deepseekReasoningMapFor(id)]),
     ),
-    preserveReasoningContentModels: [...DEEPSEEK_GATEWAY_THINKING_MODELS, ...OPENCODE_FREE_DEEPSEEK_MODELS],
-    // Same Zen gateway as opencode-free: the DeepSeek vision preview id
+    preserveReasoningContentModels: [...DEEPSEEK_GATEWAY_THINKING_MODELS, ...OPENCODE_ZEN_FREE_DEEPSEEK_MODELS],
+    // The DeepSeek vision preview id
     // (merges into deepseek-v4-flash later).
     modelContextWindows: {
       [DEEPSEEK_VISION_PREVIEW_MODEL]: 1_048_576,
@@ -1114,7 +1114,7 @@ export const PROVIDER_REGISTRY_EXTENDED: readonly ProviderRegistryEntry[] = [
     noVisionModels: [...OPENCODE_ZEN_TEXT_ONLY_MODELS, ...DEEPSEEK_GATEWAY_THINKING_MODELS],
     // Same DeepSeek routes as the Go preset above, behind the same vendor, so they carry
     // the same json_schema rejection (#1338 / #1415).
-    noJsonSchemaModels: [...DEEPSEEK_GATEWAY_THINKING_MODELS, ...OPENCODE_FREE_DEEPSEEK_MODELS],
+    noJsonSchemaModels: [...DEEPSEEK_GATEWAY_THINKING_MODELS, ...OPENCODE_ZEN_FREE_DEEPSEEK_MODELS],
     // Muse Spark on Zen can sit silent during prolonged reasoning and close without a protocol terminal.
     modelResponsesTerminalRepair: {
       "muse-spark-1.2-contributor-free": { graceMs: 5_000 },
@@ -1266,50 +1266,6 @@ export const PROVIDER_REGISTRY_EXTENDED: readonly ProviderRegistryEntry[] = [
     models: ["glm-5.3-flash", "claude-sonnet-5-5", "gpt-6.1-sol", "deepseek-v4-flash"],
     note: "OpenAI-compatible relay for Claude, GPT, GLM and DeepSeek chat models. The seeded models were verified with chat, streaming and tool calls; deepseek-v4.1-flash is listed upstream but currently answers 503 and is left out. An ordinary key only reaches its own routing group's models; a Smart key reaches all seeded models. Image and video models are not served through this Chat preset. Upstream latency varies widely (a few seconds to about 30 s) with occasional transient 503s.",
   },
-  {
-    id: "opencode-free",
-    label: "OpenCode Free",
-    adapter: "openai-chat",
-    baseUrl: "https://opencode.ai/zen/v1",
-    authKind: "key",
-    keyOptional: true,
-    featured: true,
-    liveModels: true,
-    note: "No key needed, but OpenCode now gates this tier to its own client: Zen refuses any request that arrives without an x-opencode-session header (error type MissingSessionID, \"OpenCode's free tier can only be used in OpenCode\"). opencodex does not mint that header or claim an OpenCode client identity, because no upstream contract authorizes a third-party agent to present itself as OpenCode. Until OpenCode publishes a third-party integration path for the keyless tier, use the keyed opencode-zen provider instead (https://opencode.ai/auth). Quota figures for when the tier admitted a request: OpenCode advertises about 200 Big Pickle/free-model requests per 5 hours, and the same Zen gateway can short-window rate-limit free models at roughly 15-20 requests/minute, and may return generic 429s without Retry-After (opencodex synthesizes backoff only when that header is omitted). Free models are discovered live from Zen. Data use: per OpenCode's Zen docs (https://opencode.ai/docs/zen/), prompts sent to free models may be retained and used for training/improvement — do not send confidential material through this provider.",
-    dashboardUrl: "https://opencode.ai",
-    staticHeaders: {
-      // Zen answers a bare runtime User-Agent (Bun/x.y.z) more aggressively than a client
-      // that identifies itself, which is what the 429 in #2067 traced to. The value is
-      // deliberately unversioned: a pinned "opencode-cli/<version>" is a claim about an
-      // install we do not have and goes stale on the vendor's schedule, not ours.
-      // Corroboration, not authority: OmniRoute — an independent open-source broker against
-      // the same Zen upstream — defaults to exactly this pair (userAgent "opencode", client
-      // "desktop") in open-sse/executors/opencode.ts, and got there by RETREATING from its
-      // own earlier "opencode-cli/1.0.0" pin. An operator can still override either value
-      // through the provider headers API; user headers win case-insensitively at route time.
-      "User-Agent": "opencode",
-      "x-opencode-client": "desktop",
-    },
-    modelReasoningEfforts: Object.fromEntries(OPENCODE_FREE_DEEPSEEK_MODELS.map(id => [id, deepseekThinkingEffortsFor(id)])),
-    modelReasoningEffortMap: Object.fromEntries(OPENCODE_FREE_DEEPSEEK_MODELS.map(id => [id, deepseekReasoningMapFor(id)])),
-    preserveReasoningContentModels: OPENCODE_FREE_DEEPSEEK_MODELS,
-    // The DeepSeek vision preview id is preemptive metadata for when Zen starts
-    // serving it (merges into v4-flash later).
-    modelContextWindows: {
-      [DEEPSEEK_VISION_PREVIEW_MODEL]: 1_048_576,
-    },
-    modelInputModalities: {
-      [DEEPSEEK_VISION_PREVIEW_MODEL]: ["text", "image"],
-      ...Object.fromEntries(OPENCODE_ZEN_IMAGE_MODELS.map(id => [id, ["text", "image"] as string[]])),
-    },
-    // Same Zen roster behind the same base URL, so it carries the same measured
-    // text-only list rather than only its DeepSeek member (#1043).
-    noVisionModels: OPENCODE_ZEN_TEXT_ONLY_MODELS,
-    // Same reasoning: the free tier is the same Zen roster, so its DeepSeek members get
-    // the keyed tier's json_schema treatment and its reasoning contract rather than a
-    // narrower table that silently falls behind whenever the keyed one is updated.
-    noJsonSchemaModels: [...DEEPSEEK_GATEWAY_THINKING_MODELS, ...OPENCODE_FREE_DEEPSEEK_MODELS],
-  },
   // Xiaomi retires mimo-v2.5 and mimo-v2.5-pro on 2026-10-21 with no redirect
   // (https://mimo.mi.com/docs/en-US/updates/deprecate), so the first-party presets default to V2.6.
   // Saved defaults are not rewritten; V2.5 stays listed until it stops answering.

package/src/providers/registry/model-seeds.ts

@@ -477,7 +477,7 @@ export const COMMAND_CODE_MODEL_INPUT_MODALITIES: Record<string, ["text"] | ["te
   ...Object.fromEntries(COMMAND_CODE_IMAGE_MODELS.map(id => [id, ["text", "image"] as ["text", "image"]])),
   ...Object.fromEntries(COMMAND_CODE_TEXT_ONLY_MODELS.map(id => [id, ["text"] as ["text"]])),
 };
-export const OPENCODE_FREE_DEEPSEEK_MODELS = ["deepseek-v4-flash-free"];
+export const OPENCODE_ZEN_FREE_DEEPSEEK_MODELS = ["deepseek-v4-flash-free"];
 /*
  * Zen free models that reject `image_url` upstream (#1043, and the reproducible
  * half of #1024).

package/src/providers/registry.ts

@@ -49,8 +49,7 @@ export function getProviderRegistryEntry(id: string): ProviderRegistryEntry | un
  * was only ever true for a freshly seeded config: `providerConfigSeed` copies the block once
  * (`derive.ts`), `enrichProviderFromCatalog` fills it only when the whole block is absent, and
  * nothing merged it at request time. So an install that predates a header — or that saved any
- * header of its own — never received the new one, which is exactly what #2067 would have
- * shipped for every existing opencode-free user.
+ * header of its own — never received the new one.
  *
  * The comparison is case-insensitive on purpose. HTTP header names are case-insensitive, but a
  * plain object spread is not: merging a registry `User-Agent` over a user's `user-agent`

package/src/providers/stale-vision-classification-migration.ts

@@ -39,7 +39,7 @@
  * Scope is deliberately one entry. The Go gateway's `deepseek-v4.1-flash` was declared text-only
  * from jawcode metadata and was measured natively multimodal on 2026-09-19 (see the note at that
  * entry in `registry/entries-core.ts`). Its sibling `deepseek-v4-flash` still rejects images
- * upstream, and the sibling Zen tiers (`opencode-zen`, `opencode-free`) could not be probed at
+ * upstream, and the keyed Zen tier (`opencode-zen`) could not be probed at
  * all — an unverified tier is not evidence, so neither is touched here.
  */
 import { PROVIDER_REGISTRY, providerMatchesRegistryTransport } from "./registry";

package/src/responses/parser.ts

@@ -22,6 +22,7 @@ import { previousResponseReplayPrefixLength } from "./state";
 import { decodeReasoningEnvelope } from "./reasoning-envelope";
 import { hasRoutedIdentity, nameRoutedIdentity } from "../adapters/identity";
 import { extractHostedWebSearch, WEB_SEARCH_TOOL_NAME } from "../web-search/synthetic-tool";
+import { rewriteReplayedWebSearchCells } from "./web-search-replay";
 import { buildImageTool, extractHostedImageGeneration, IMAGE_GEN_TOOL_NAME } from "../images/synthetic-tool";
 import { toolSearchDescription, toolSearchParameters } from "./tool-search-compat";
 
@@ -232,6 +233,13 @@ export function parseRequest(
   // Built before the item loop: a custom_tool_call echoed back in `input` needs the
   // namespace from the request's own tool catalog to survive the round trip.
   const customToolNamespacesByName = customToolNamespaces(data.tools);
+  // Stash the hosted web_search config (if Codex enabled it) so the proxy can run searches via the
+  // sidecar for routed providers. buildTools still drops the hosted tool; the sidecar path
+  // re-injects a synthetic function tool only when it will actually handle the call. The same
+  // declaration decides how replayed search cells are rebuilt below.
+  const webSearch = extractHostedWebSearch(data.tools as unknown[] | undefined);
+  // With search declared, replayed hosted cells become web_search call/output pairs (#7269).
+  const webSearchReplay = webSearch && Array.isArray(data.input) ? rewriteReplayedWebSearchCells(data.input) : undefined;
   const systemPrompt: string[] = [];
   // Responses reasoning siblings belong to the following assistant, including across call items.
   // Keep them off the message list until that assistant arrives; turn boundaries clear the array.
@@ -274,9 +282,12 @@ export function parseRequest(
     if (data.previous_response_id) continuationConversationMessageIndex = messages.length;
     messages.push({ role: "user", content: data.input, timestamp: now });
   } else if (data.input) {
-    for (let inputIndex = 0; inputIndex < data.input.length; inputIndex++) {
-      const item = data.input[inputIndex];
-      if (inputIndex > 0 && isAnthropicProgressMirror(item, anthropicProgressEnvelope(data.input[inputIndex - 1]))) continue;
+    const inputItems = (webSearchReplay?.items ?? data.input) as typeof data.input;
+    for (let itemIndex = 0; itemIndex < inputItems.length; itemIndex++) {
+      const item = inputItems[itemIndex];
+      // Boundaries are measured on the caller's input, before any replayed-search rewrite.
+      const inputIndex = webSearchReplay?.sourceIndexes[itemIndex] ?? itemIndex;
+      if (itemIndex > 0 && isAnthropicProgressMirror(item, anthropicProgressEnvelope(inputItems[itemIndex - 1]))) continue;
       const effectiveType = (item as { type?: string }).type ?? ("role" in item ? "message" : undefined);
       const itemRole = (item as { role?: string }).role;
       const externalTaskInput = effectiveType === "function_call_output" ? externalTaskInputContent(item) : undefined;
@@ -529,9 +540,9 @@ export function parseRequest(
       }
 
       if (effectiveType === "web_search_call") {
-        // Replayed hosted web-search evidence has no paired result payload that routed providers can
-        // consume. Keep it out of assistant-visible text: the old marker was useful as an internal
-        // loop hint, but when no sidecar is available the model can echo it as a fake answer.
+        // Without a search declaration the cell stays out of routed history: a call to an undeclared
+        // tool, or assistant-visible marker text the model could echo as a fake answer, would be
+        // worse than the gap. With one, the cell was already rewritten into a web_search pair.
         pendingReasoning.length = 0;
         continue;
       }
@@ -689,10 +700,6 @@ export function parseRequest(
   if (data.service_tier !== undefined) options.serviceTier = data.service_tier;
   if (data.prompt_cache_key !== undefined) options.promptCacheKey = data.prompt_cache_key;
 
-  // Stash the hosted web_search config (if Codex enabled it) so the proxy can run searches via the
-  // gpt-mini sidecar for routed providers. buildTools still drops the hosted tool; the sidecar path
-  // re-injects a synthetic function tool only when it will actually handle the call.
-  const webSearch = extractHostedWebSearch(data.tools as unknown[] | undefined);
   const imageGen = extractHostedImageGeneration([
     ...(data.tools as unknown[] ?? []),
     ...loadedToolSpecs,
@@ -718,6 +725,7 @@ export function parseRequest(
       ? { _continuationConversationMessageIndex: continuationConversationMessageIndex }
       : {}),
     ...(webSearch ? { _webSearch: webSearch } : {}),
+    ...(webSearchReplay ? { _replayedWebSearchCells: webSearchReplay.cells } : {}),
     ...(imageGen ? { _imageGeneration: imageGen } : {}),
     ...(textFormat ? { _structuredOutput: true } : {}),
     ...(compactionRequest ? { _compactionRequest: true } : {}),

package/src/responses/web-search-replay.ts

@@ -0,0 +1,138 @@
+/**
+ * Parse-time rebuild of replayed hosted `web_search_call` cells for routed providers (#7269).
+ *
+ * Codex replays the cell it was shown, which carries the query and at most a source list, never the
+ * result text. Dropping the cell made a routed model forget it had searched: after a client tool
+ * call ended the turn, the next request carried no trace of the search, so the model searched and
+ * ran its tools again in a loop.
+ *
+ * When search is declared, the parser rewrites each cell into the `web_search` function call and
+ * output the routed model made, at the raw-input level, so the ordinary call/output handling owns
+ * turn batching and reasoning attachment. The call takes the cell's place; its output is deferred to
+ * the end of the contiguous run of call/output items that follows, so a cell inside a parallel
+ * client batch never splits it. The output is a fallback built from the cell alone; the web-search
+ * sidecar swaps in the result it recorded for the cell, and removes the pairs again when it does not
+ * run, because the synthetic tool is then undeclared (src/web-search/sidecar-search-replay.ts).
+ */
+import { isObj } from "./parser-content";
+import { WEB_SEARCH_TOOL_NAME } from "../web-search/synthetic-tool";
+import type { OcxReplayedWebSearchCell } from "../types";
+
+const MAX_FIELD_CHARS = 2048;
+const MAX_LIST_ENTRIES = 20;
+const CELL_ID = /^[A-Za-z0-9_-]{1,128}$/;
+
+/** Call items of a batch; a call after the batch's first output starts the next assistant turn. */
+const CALL_TYPES = new Set(["function_call", "custom_tool_call", "local_shell_call", "tool_search_call"]);
+/** Output items of a batch. Anything that is neither a call nor an output ends the batch. */
+const OUTPUT_TYPES = new Set(["function_call_output", "custom_tool_call_output", "local_shell_call_output", "tool_search_output"]);
+
+function capped(value: string): string {
+  return value.length <= MAX_FIELD_CHARS ? value : `${value.slice(0, MAX_FIELD_CHARS)}…`;
+}
+
+function queriesOf(action: Record<string, unknown>): string[] {
+  const queries = Array.isArray(action.queries)
+    ? action.queries.filter((query): query is string => typeof query === "string" && query.trim() !== "")
+    : [];
+  if (queries.length === 0 && typeof action.query === "string" && action.query.trim() !== "") queries.push(action.query);
+  return queries.slice(0, MAX_LIST_ENTRIES).map(capped);
+}
+
+function sourcesOf(item: Record<string, unknown>, action: Record<string, unknown>): string[] {
+  const lines: string[] = [];
+  const seen = new Set<string>();
+  for (const list of [item.sources, action.sources]) {
+    if (!Array.isArray(list)) continue;
+    for (const source of list) {
+      if (lines.length >= MAX_LIST_ENTRIES) return lines;
+      if (!isObj(source) || typeof source.url !== "string" || seen.has(source.url)) continue;
+      seen.add(source.url);
+      lines.push(typeof source.title === "string" && source.title.trim() !== ""
+        ? `- ${capped(source.title)} <${capped(source.url)}>`
+        : `- <${capped(source.url)}>`);
+    }
+  }
+  return lines;
+}
+
+/** The call arguments and fallback result text for one replayed cell. */
+export function replayedWebSearchContent(item: Record<string, unknown>): { arguments: Record<string, unknown>; result: string; failed: boolean } {
+  const action = isObj(item.action) ? item.action : {};
+  const failed = item.status === "failed";
+  const queries = queriesOf(action);
+  const lines: string[] = [];
+  if (action.type === "open_page" && typeof action.url === "string") {
+    lines.push(`Earlier page open: <${capped(action.url)}>.`);
+  } else if (action.type === "find_in_page" && typeof action.url === "string") {
+    lines.push(`Earlier find in page <${capped(action.url)}>${typeof action.pattern === "string" ? ` for "${capped(action.pattern)}"` : ""}.`);
+  } else {
+    lines.push(queries.length > 0 ? `Earlier web search for: ${queries.map(query => `"${query}"`).join(", ")}.` : "Earlier web search.");
+  }
+  if (failed) {
+    lines.push("This search failed and returned no results.");
+  } else {
+    lines.push("The result text of this search is not available in the replayed conversation history.");
+    const sources = sourcesOf(item, action);
+    if (sources.length > 0) lines.push("Sources it returned (titles and URLs only, untrusted):", ...sources);
+  }
+  return { arguments: queries.length > 1 ? { queries } : { query: queries[0] ?? "" }, result: lines.join("\n"), failed };
+}
+
+export interface RewrittenWebSearchInput {
+  items: unknown[];
+  /** Original input index per rewritten item, for boundaries measured on the caller's input. */
+  sourceIndexes: number[];
+  cells: OcxReplayedWebSearchCell[];
+}
+
+/** Rewrite replayed cells into web_search call/output pairs; undefined when the input has none. */
+export function rewriteReplayedWebSearchCells(input: readonly unknown[]): RewrittenWebSearchInput | undefined {
+  if (!input.some(item => isObj(item) && item.type === "web_search_call")) return undefined;
+  // A synthetic call id must not collide with any client call id, nor with another cell's.
+  const taken = new Set(input.flatMap(item => isObj(item) && typeof item.call_id === "string" ? [item.call_id] : []));
+  const allocate = (base: string): string => {
+    let id = base;
+    for (let n = 1; taken.has(id); n++) id = `${base}_${n}`;
+    taken.add(id);
+    return id;
+  };
+  const items: unknown[] = [];
+  const sourceIndexes: number[] = [];
+  const cells: OcxReplayedWebSearchCell[] = [];
+  const seenCells = new Set<string>();
+  let pending: Array<{ item: unknown; sourceIndex: number }> = [];
+  // True once the current batch reached its outputs: the next call opens a new assistant turn.
+  let outputPhase = false;
+  const flush = () => {
+    for (const entry of pending) { items.push(entry.item); sourceIndexes.push(entry.sourceIndex); }
+    pending = [];
+    outputPhase = false;
+  };
+  input.forEach((item, sourceIndex) => {
+    const type = isObj(item) ? item.type : undefined;
+    if (isObj(item) && type === "web_search_call") {
+      const cellId = typeof item.id === "string" && CELL_ID.test(item.id) ? item.id : undefined;
+      // The same cell replayed twice is one search.
+      if (cellId && seenCells.has(cellId)) return;
+      if (cellId) seenCells.add(cellId);
+      if (outputPhase) flush();
+      const content = replayedWebSearchContent(item);
+      const callId = allocate(cellId ?? "ws_replay");
+      cells.push({ ...(cellId ? { cellId } : {}), callId, failed: content.failed });
+      items.push({ type: "function_call", call_id: callId, name: WEB_SEARCH_TOOL_NAME, arguments: JSON.stringify(content.arguments) });
+      sourceIndexes.push(sourceIndex);
+      pending.push({ item: { type: "function_call_output", call_id: callId, output: content.result }, sourceIndex });
+      return;
+    }
+    if (typeof type === "string" && OUTPUT_TYPES.has(type)) {
+      outputPhase = true;
+    } else if (!(typeof type === "string" && CALL_TYPES.has(type)) || outputPhase) {
+      flush();
+    }
+    items.push(item);
+    sourceIndexes.push(sourceIndex);
+  });
+  flush();
+  return { items, sourceIndexes, cells };
+}