@bitkyc08/opencodex 2.88.0 → 2.89.0

package/src/routing/compatibility/behavior.ts

@@ -4,6 +4,7 @@ import type { OcxConfig, OcxProviderConfig } from "../../types";
 import { PROVIDER_REGISTRY } from "../../providers/registry";
 import { fastPolicyForModel, serviceTierSupportFromPolicy } from "../../providers/service-tier";
 import { resolveProviderAuthTransport } from "../../providers/fastwire";
+import { defaultAnthropicCacheRetention } from "../../adapters/anthropic/cache-retention";
 import { localFingerprint } from "../../lab/digest";
 import type { LabBehaviorSource, LabBehaviorValues } from "../../lab/live/types";
 
@@ -237,7 +238,9 @@ export function resolveProductionBehaviorValues(
     }),
     "tools.builtinNameEscaping": behaviorRow("provider_config", effective.escapeBuiltinToolNames === true),
     "cache.forwarding": behaviorRow("provider_config", effective.promptCacheKey === true),
-    "cache.retention": behaviorRow("global_config", config.cacheRetention ?? "short"),
+    // The wire TTL, not just the setting: an omitted value means 1h on first-party Anthropic.
+    "cache.retention": behaviorRow("global_config", config.cacheRetention
+      ?? (adapter === "anthropic" ? defaultAnthropicCacheRetention(effective) : "short")),
     "anthropic.eofPolicy": behaviorRow("provider_config", effective.anthropicEofTolerance === true ? "tolerant" : "strict"),
     "openai-chat.eofPolicy": behaviorRow("provider_config", effective.openaiChatEofTolerance === true ? "tolerant" : "strict"),
     "google.mode": behaviorRow("provider_config", effective.googleMode ?? null),

package/src/server/auth-cors.ts

@@ -40,6 +40,7 @@ import { DECLARABLE_HOSTED_TOOL_TYPES } from "../responses/hosted-tool-policy";
 import { effectiveGoogleMode, getProviderRegistryEntry, providerCodexAccountMode, providerMatchesRegistryTransport, registryEntryForProviderDestination } from "../providers/registry";
 import { providerConfigSeed } from "../providers/derive";
 import { anthropicOAuthInstanceConfigError } from "../config/schema/anthropic-account-pool";
+import { accountAutoPausePolicySchema } from "../config/schema/account-auto-pause";
 import type { OcxConfig, OcxProviderConfig } from "../types";
 import { openRouterRoutingConfigError } from "../providers/openrouter-routing";
 import { modelAutoCompactTokenLimitsConfigError } from "../providers/auto-compact-budget";
@@ -740,6 +741,9 @@ export function providerManagementConfigError(
     return "provider must be a plain object";
   }
   const raw = provider as Record<string, unknown>;
+  if (raw.accountAutoPause !== undefined && !accountAutoPausePolicySchema.safeParse(raw.accountAutoPause).success) {
+    return "accountAutoPause must be an object with optional boolean enabled and integer consecutiveFailures (1-100)";
+  }
   const contextTiersError = contextTierRecordConfigError(raw.modelContextTiers);
   if (contextTiersError) return contextTiersError;
   const capabilitiesError = modelCapabilitiesConfigError(raw.modelCapabilities);
@@ -796,6 +800,8 @@ export function providerManagementConfigError(
     // sends recover, not what the canonical forward seed is. Validated below
     // (retryOnResetPolicyConfigError).
     delete canonicalCandidate.retryOnReset;
+    // Validated account eligibility policy is independent of the canonical transport.
+    delete canonicalCandidate.accountAutoPause;
     // Context windows are the same kind of user-owned overlay as requestPacing: the operator
     // narrowing what their own native rows advertise. They can only ever LOWER the measured
     // window (see nativeOpenAiContextWindow), so admitting them cannot widen what the proxy
@@ -1087,6 +1093,7 @@ const PROVIDER_CONFIG_FIELD_POLICY = {
   apiKeyPool: "redacted",
   // Ordering preference only; it names no key material, so an editor may read and set it.
   apiKeyPoolStrategy: "editor",
+  accountAutoPause: "editor",
   apiKeySelectionRevision: "runtime",
   _apiKeyAttempt: "runtime",
   defaultModel: "editor",

package/src/server/background-lifecycle.ts

@@ -1,5 +1,6 @@
 import type { OcxConfig, StorageCleanupPolicy } from "../types";
 import { registerCodexLowQuotaProtection, type LowQuotaRegistration } from "../codex/low-quota-protection";
+import { resolveLowQuotaDesktopSink } from "../codex/low-quota-desktop-notifier";
 import type { LowQuotaEvent } from "../codex/low-quota-events";
 import { startStateStoreSweeper } from "../lib/state-store-sweeper";
 import {
@@ -209,7 +210,7 @@ export function acquireServerBackgroundLifecycle(
     fanoutRevoked: false,
     applyPolicy,
     resources: acquireServerResourceOwner(),
-    lowQuota: registerCodexLowQuotaProtection(config),
+    lowQuota: registerCodexLowQuotaProtection(config, { desktopSink: () => resolveLowQuotaDesktopSink() }),
   };
   try {
     if (!processLoops) {

package/src/server/chat-native.ts

@@ -1,3 +1,4 @@
+import { captureAccountAutoPauseAttempt, wasAccountAutoPaused } from "../oauth/account-auto-pause";
 import { createPhysicalSendReporter } from "../lib/request-execution-budget";
 import { createInferenceSendBudget } from "./inference/context";
 import { observeAdvisorNativeReasoning } from "./inference/advisor-diagnostics";
@@ -64,11 +65,10 @@ import { RequestPacingQueueOverloadError } from "../providers/request-pacing";
 import { stampApiKeyAccountLabel } from "../providers/label";
 import { distributedKeyPhysicalFetch, distributedKeyResponseOwner } from "../providers/api-key-response-ownership";
 import { providerApiKeySelectionIsCurrent, resolveCurrentProviderApiKeyTransport } from "../providers/api-key-selection";
-import { enrichOpenCodeZenFreeTierMessage } from "../providers/opencode-zen-rate-limit";
 import type { OcxProviderTransport } from "../providers/xai-transport";
 import type { RouteResult } from "../router";
 import type { OcxConfig, OcxProviderConfig } from "../types";
-import { fetchWithHeaderTimeout, providerFetch, safeHostLabel, sendWithConnectionPolicy } from "./responses/fetch-helpers";
+import { fetchWithHeaderTimeout, physicalSendObserverInit, providerFetch, safeHostLabel, sendWithConnectionPolicy } from "./responses/fetch-helpers";
 import { isLocalUpstream } from "../lib/local-upstream";
 import { linkAbortSignal } from "./responses";
 import {
@@ -449,7 +449,7 @@ export async function runNativeChatAttempt(
   let responseOwnsDistributedKey = true;
   const send = async (
     request: AdapterRequest,
-    recovery?: "rate-limit-429" | "key-429" | "key-401" | UpstreamSendRecovery,
+    recovery?: "rate-limit-429" | "key-401" | "key-429" | UpstreamSendRecovery,
     singleShot = false,
   ): Promise<Response> => {
     try {
@@ -516,6 +516,7 @@ export async function runNativeChatAttempt(
               const spendReport = createPhysicalSendReporter(physicalBudget, () => ({
                 poolId: logCtx.spendPoolId ?? route.providerName, identityId: logCtx.accountLogLabel,
               }), execution.comboDispatchPermit);
+              const observeAutoPause = captureAccountAutoPauseAttempt(route.providerName, activeProvider, { config, oauth: undefined }, headers);
               let dispatched: Response;
               try {
                 // Capture this request's spend policy at its first physical boundary, including
@@ -538,6 +539,7 @@ export async function runNativeChatAttempt(
                   request.url,
                   applyUpstreamRecoveryInit({
                     ...init, method: request.method, headers, body: request.body,
+                    ...physicalSendObserverInit(observeAutoPause, request.url),
                   }, transportRecovery),
                   // Reselection can replace the provider transport and the wire shape, so the
                   // egress route is bound to the provider this send actually uses. Omitting it
@@ -552,7 +554,7 @@ export async function runNativeChatAttempt(
               responseOwnsDistributedKey = !activeProvider._apiKeyAttempt?.distributed
                 || distributedKeyResponseOwner(dispatched, config, route.providerName) !== null;
               if (!dispatched.ok) await recordKeyAttemptFailure(logCtx, dispatched, init.signal ?? upstream.signal);
-              return dispatched;
+              return observeAutoPause ? observeAutoPause(dispatched) : dispatched;
             },
           }),
         );
@@ -585,6 +587,23 @@ export async function runNativeChatAttempt(
     response = await send(activeRequest);
     const retryPolicy = rateLimitRetryPolicyFor(activeProvider);
     let retries = 0;
+    let autoPauseMoves = 0;
+    for (;;) {
+      const priorResponse = response;
+      for (; wasAccountAutoPaused(response) && config.providers[route.providerName]?.apiKey && autoPauseMoves < 3 && transientSendAvailable(); autoPauseMoves++) {
+        const fresh = resolveCurrentProviderApiKeyTransport(config, route.providerName, { ...activeProvider, _apiKeyAttempt: undefined });
+        const next = fresh && (selectProactiveApiKeyTransport(config, route.providerName, fresh) ?? fresh);
+        if (!next) break;
+        try { void response.body?.cancel().catch(() => {}); } catch { /* closed */ }
+        activeProvider = next;
+        stampApiKeyAccountLabel(logCtx, route.providerName, activeProvider);
+        activeAdapter = createOpenAIChatAdapter(activeProvider);
+        releaseRetainedRequest();
+        activeRequest = buildActiveRequest();
+        retainRequest(activeRequest);
+        response = await send(activeRequest, "key-401");
+      }
+
     while (
       response.status === 429
       // A 429 this proxy synthesized for a refused reset replay is not a provider rate
@@ -632,6 +651,10 @@ export async function runNativeChatAttempt(
       retainRequest(activeRequest);
       response = await send(activeRequest, failureStatus === 401 ? "key-401" : "key-429");
     }
+      if (response !== priorResponse && wasAccountAutoPaused(response)) continue;
+      break;
+    }
+
   } catch (error) {
     releaseRetainedRequest();
     cleanupAbort();
@@ -694,20 +717,12 @@ export async function runNativeChatAttempt(
       && (isCyberPolicyCode(upstreamCode) || isCyberPolicyMessage(upstreamMessage))
       ? upstreamMessage
       : detail ? `Provider error ${response.status}: ${detail}` : `Provider error ${response.status}`;
-    // Zen's keyless free tier refuses the request outright rather than rate-limiting it, and
-    // the raw `MissingSessionID` tells a user nothing about why or what to do (#4121).
-    const clientMessage = enrichOpenCodeZenFreeTierMessage(message, {
-      providerName: route.providerName,
-      baseUrl: route.provider.baseUrl,
-      adapter: route.provider.adapter,
-      upstreamErrorType: upstreamType,
-    });
     const classified = classifyError(
       response.status,
       upstreamType ?? (response.status === 401 ? "authentication_error"
         : response.status === 429 ? "rate_limit_error"
           : response.status >= 500 ? "server_error" : "invalid_request_error"),
-      clientMessage,
+      message,
     );
     // The verdict is read once, from the response that carries it and from the code a
     // re-wrapped body kept -- never from the status, which a real rate limit shares.

package/src/server/claude-messages.ts

@@ -1110,7 +1110,8 @@ async function handleClaudeMessagesWithBudget(
   const finalizeNativeLog = createFinalRequestLog(logIds, logCtx).finish;
   const upstream = await handleResponses(internalReq, {
     ...buildClaudeReplayConfig(config),
-    // Operator config wins; otherwise the caller's own 1h breakpoints keep 1h here.
+    // Operator config wins; otherwise the caller's explicit TTLs (all 1h, or a pinned 5m) carry
+    // over, and TTL-less breakpoints take the destination default.
     cacheRetention: config.cacheRetention ?? callerCacheRetention(anthropicBody),
   }, logCtx, {
     // Routing keeps Claude-only sidecar overrides; admission policy must follow the live owner.

package/src/server/index/optional-listeners.ts

@@ -17,6 +17,7 @@ import { createLinkSupervisor, type LinkSupervisor } from "../../link/supervisor
 import { linkManagementRouteAllowed } from "../../link/management-routes";
 import { saveConfigPreservingClaudeCode } from "../../config/live-reconcile";
 import { reconcileLiveStateStores } from "../../lib/state-store-registrations";
+import { startJevQuotaActivation } from "../../combos/jev-quota-activation";
 export { LINK_INGRESS_HOSTNAME } from "./link-listener";
 import type { ServerIngress } from "./serve-options";
 
@@ -51,6 +52,7 @@ export function createOptionalListenerSet<T>(linkDeps: LinkListenerDeps = {}): O
   const claudeIntercept: ClaudeInterceptLifecycle<T> = createClaudeInterceptLifecycle<T>();
   const linkListener: LinkListenerLifecycle<T> = createLinkListenerLifecycle<T>(linkDeps);
   let activeConfig: OcxConfig | undefined;
+  let stopJevQuotaActivation: (() => void) | undefined;
   const supervisor = createLinkSupervisor({
     apiKeys: () => activeConfig?.apiKeys ?? [],
     revokeApiKey: id => {
@@ -114,6 +116,8 @@ export function createOptionalListenerSet<T>(linkDeps: LinkListenerDeps = {}): O
         maxRequestBodySize: ctx.maxRequestBodySize,
         dispatch: ctx.dispatch,
       });
+      // Last, after every listener started: JEV advisory quota follows the live config while serving.
+      stopJevQuotaActivation = startJevQuotaActivation(ctx.config);
     },
     ensureStarted: () => linkListener.ensureStarted(),
     close: () => linkListener.close(),
@@ -132,6 +136,8 @@ export function createOptionalListenerSet<T>(linkDeps: LinkListenerDeps = {}): O
       try { await claudeIntercept.stop(); } catch (error) { failure ??= error; }
       unregisterSupervisorAdmission?.();
       unregisterSupervisorAdmission = undefined;
+      stopJevQuotaActivation?.();
+      stopJevQuotaActivation = undefined;
       if (failure) throw failure;
     },
   };

package/src/server/management/combo-routes.ts

@@ -63,7 +63,7 @@ import {
 } from "../../vision/eligibility";
 import type { OcxClaudeCodeConfig, OcxComboConfig, OcxConfig, OcxCustomModel, OcxProviderConfig, OcxComboCooldownWaitPolicy } from "../../types";
 import { drainAndShutdown } from "../lifecycle";
-import { reconcileLiveStateStores } from "../../lib/state-store-registrations";
+import { notifyLiveConfigObservers, reconcileLiveStateStores } from "../../lib/state-store-registrations";
 import { filterRequestLogs, getRequestLogEntries, type RequestLogEntry } from "../request-log";
 import { estimateComboCost, estimateRequestCost, normalizeCostTokens, tokensPerSecond } from "../../usage/cost";
 import type { PersistedUsageAttempt } from "../../usage/log";
@@ -162,6 +162,7 @@ function parseVisionSidecarTargets(
   return { targets };
 }
 
+/** Handle the `/api/combos` management routes (list, save, delete and related combo endpoints), validating and preserving the opt-in quota signal fields; null when no route matches. */
 export async function handleComboRoutes(ctx: ManagementContext): Promise<Response | null> {
   const { req, url, config, deps, convergeCodexCatalog, syncClaudeAgentDefsBestEffort } = ctx;
 
@@ -222,6 +223,8 @@ export async function handleComboRoutes(ctx: ManagementContext): Promise<Respons
     const requestedCombo: Record<string, unknown> = body.combo;
     const effectiveCombo = {
       ...requestedCombo,
+      ...(!Object.hasOwn(requestedCombo, "decisionQuotaSignals") && requestedCombo.strategy === "jev" && previous?.decisionQuotaSignals !== undefined ? { decisionQuotaSignals: previous.decisionQuotaSignals } : {}),
+      ...(!Object.hasOwn(requestedCombo, "decisionQuotaTiers") && requestedCombo.strategy === "jev" && previous?.decisionQuotaTiers !== undefined ? { decisionQuotaTiers: previous.decisionQuotaTiers } : {}),
       ...(!Object.hasOwn(requestedCombo, "allowMeteredTargets") && previous?.allowMeteredTargets === true
         ? { allowMeteredTargets: true }
         : {}),
@@ -244,6 +247,11 @@ export async function handleComboRoutes(ctx: ManagementContext): Promise<Respons
       ...(!Object.hasOwn(requestedCombo, "imageInput") && previous?.imageInput !== undefined
         ? { imageInput: previous.imageInput }
         : {}),
+      // #7229: the dashboard does not edit the row description, so a round trip that omits it
+      // (including a rename) keeps it. An explicit empty string still clears it.
+      ...(!Object.hasOwn(requestedCombo, "description") && previous?.description !== undefined
+        ? { description: previous.description }
+        : {}),
       // `lastResort` rides on each target, so a GUI that re-sends the target list without the
       // flag would strip it. Carry it over per target, matched on provider+model.
       ...(Array.isArray(requestedCombo.targets) && Array.isArray(previous?.targets)
@@ -516,6 +524,8 @@ export async function handleComboRoutes(ctx: ManagementContext): Promise<Respons
       if (!(error instanceof ConfigWritePublishedError)) {
         return jsonResponse({ error: "combo could not be saved" }, 500);
       }
+      // Published but bookkeeping failed: live observers (JEV quota activation) still follow the saved combo.
+      notifyLiveConfigObservers(config);
       throw error;
     }
     reconcileLiveStateStores();
@@ -548,7 +558,12 @@ export async function handleComboRoutes(ctx: ManagementContext): Promise<Respons
     const { clearComboSelectionState, clearComboTargetCooldowns } = await import("../../combos");
     delete config.combos![id];
     if (Object.keys(config.combos!).length === 0) deleteConfigTopLevelKey(config, "combos");
-    saveConfigPreservingClaudeCode(config);
+    try {
+      saveConfigPreservingClaudeCode(config);
+    } catch (error) {
+      if (error instanceof ConfigWritePublishedError) notifyLiveConfigObservers(config);
+      throw error;
+    }
     reconcileLiveStateStores();
     clearComboSelectionState(id);
     clearComboTargetCooldowns(id);

package/src/server/management/oauth-account-routes.ts

@@ -510,7 +510,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
               reauthReason: summary.needsReauth === true ? "refresh_failed" : undefined,
             });
           return { ...summary, ...oauthAccountHealthFields(provider, summary.id, health), quotaMode,
-            ...(supportsPause ? { paused: full?.paused === true } : {}),
+            ...(supportsPause ? { paused: full?.paused === true, ...(full?.pauseDetails ? { pauseDetails: full.pauseDetails } : {}) } : {}),
             ...(isAnthropicOAuthInstance(provider) && supportsPause ? { autoSwitchThresholdOverride: full?.autoSwitchThresholdOverride ?? null,
               effectiveAutoSwitchThreshold: effectiveAnthropicAccountThresholdForInstance(provider as AnthropicInstanceId, config, full),
               autoSwitchThreshold: effectiveAnthropicAccountThresholdForInstance(provider as AnthropicInstanceId, config) } : {}),
@@ -1116,6 +1116,15 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     clearProviderQuotaCache();
     return jsonResponse({ ...result, name, store: providerKeyStoreKind(config.providers[name]) });
   }
+  if (url.pathname === "/api/providers/keys/pause" && req.method === "PUT") {
+    const body = await readManagementJsonBodyOr(req, {});
+    if (!isPlainRecord(body)) return jsonResponse({ error: "body must be an object" }, 400);
+    if (typeof body.name !== "string" || typeof body.id !== "string" || typeof body.paused !== "boolean") return jsonResponse({ error: "name, id and paused required" }, 400);
+    if (!isValidProviderName(body.name) || !hasOwnProvider(config.providers, body.name)) return jsonResponse({ error: "unknown provider" }, 404);
+    const { setProviderApiKeyPaused } = await import("../../providers/api-key-pause");
+    return setProviderApiKeyPaused(config, body.name, body.id, body.paused)
+      ? jsonResponse({ ok: true }) : jsonResponse({ error: "key not found" }, 404);
+  }
   if (url.pathname === "/api/providers/keys/active" && req.method === "PUT") {
     const body = await readManagementJsonBodyOr(req, {}) as { name?: string; id?: string };
     const name = (body.name ?? "").trim();

package/src/server/management/provider-completion-test.ts

@@ -0,0 +1,289 @@
+/**
+ * Explicit single-model diagnostic, isolated from discovery, routing health and request history.
+ * Unsupported transports: TLS profiles, HTTP version pins, enabled pacing, custom fetch + proxy.
+ * Adding an exclusion requires a regression test. No retries, failover, or output preview.
+ */
+import type { OcxConfig, OcxProviderConfig } from "../../types";
+import { routedProviderConfig } from "../../providers/routed-config";
+import { PROVIDER_REGISTRY } from "../../providers/registry";
+import { resolveModelAlias } from "../../providers/default-aliases";
+import { providerApiKeySelectionIsCurrent } from "../../providers/api-key-selection";
+import { resolveWireProtocolOverride } from "../adapter-resolve";
+import { openAIChatTransport, stripBracketedModelSuffix } from "../../adapters/openai-chat/wire";
+import { buildResponsesTransport } from "../../adapters/openai-responses/transport";
+import { openRouterProviderPayload, resolveOpenRouterRouting } from "../../providers/openrouter-routing";
+import { resolveVercelGatewayRouting, vercelGatewayProviderPayload } from "../../providers/vercel-gateway-routing";
+import { assertProviderDestinationAllowed, providerAllowsPrivateNetwork } from "../../lib/destination-policy";
+import { providerOutboundPost, ProviderOutboundPolicyError, ProviderOutboundSendCancelledError,
+  type ProviderOutboundDependencies } from "../../lib/provider-outbound";
+import { redactSecretString } from "../../lib/redact";
+import { decodeServerSentEvents } from "../../lib/sse-decoder";
+import { createTranslatorBudget } from "../../lib/translator-budget";
+import { jsonResponse } from "../auth-cors";
+import type { ManagementContext } from "./context";
+import { managementBodyTooLargeResponse, readManagementJsonBody } from "./body";
+
+export const COMPLETION_TEST_PROMPT = "Reply exactly OK.";
+export const COMPLETION_TEST_OUTPUT_TOKEN_CAP = 32;
+export const COMPLETION_TEST_TIMEOUT_MS = 20_000;
+export const COMPLETION_TEST_MAX_BYTES = 64 * 1024;
+
+type Wire = "openai-chat" | "openai-responses";
+type Code = "destination_refused" | "credential_missing" | "credential_changed" | "http_status" | "redirect"
+  | "network" | "stream_error" | "premature_eof" | "no_content" | "timeout" | "aborted" | "too_large";
+const MESSAGES: Record<Code, string> = {
+  destination_refused: "Provider destination refused by policy.",
+  credential_missing: "Provider credential is missing.",
+  credential_changed: "Provider request authority changed before send.",
+  http_status: "Upstream returned an unsuccessful HTTP status.",
+  redirect: "Upstream redirect refused.",
+  network: "Upstream network request failed.",
+  stream_error: "Upstream stream reported an error.",
+  premature_eof: "Upstream stream ended without a terminal event.",
+  no_content: "Upstream completed without a text delta.",
+  timeout: "Completion test deadline exceeded.",
+  aborted: "Completion test was cancelled.",
+  too_large: "Upstream stream exceeded the byte limit.",
+};
+export type ProviderCompletionTestResult = {
+  applicable: false;
+  reason: "disabled" | "forward_auth" | "oauth_auth" | "unsupported_adapter" | "unsupported_transport";
+  adapter?: string;
+  detail?: "tls_profile" | "upstream_http_version" | "request_pacing" | "custom_executor_egress";
+} | {
+  applicable: true; ok: boolean; provider: string; requestedModel: string; wireModel: string; wire: Wire;
+  upstreamModel: string | null; modelComparison: "match" | "mismatch" | "unknown";
+  comparisonNote?: "missing_metadata" | "conflicting_metadata";
+  identityVerified: false; ttftMs: number | null; totalLatencyMs: number; outputTokenCap: 32;
+  termination: "completed" | "failed" | "timeout" | "aborted" | "too_large";
+  error: null | { code: Code; status?: number; message: string };
+};
+export interface ProviderCompletionTestInput { config: OcxConfig; name: string; model: string; signal?: AbortSignal }
+export interface ProviderCompletionTestDependencies {
+  now?: () => number;
+  timeoutMs?: number;
+  outboundDependencies?: ProviderOutboundDependencies;
+}
+
+function transportExclusion(row: OcxProviderConfig): Extract<ProviderCompletionTestResult, { applicable: false }>["detail"] {
+  if (row.tlsProfile !== undefined) return "tls_profile";
+  if (row.upstreamHttpVersion !== undefined) return "upstream_http_version";
+  if (row.requestPacing?.enabled) return "request_pacing";
+  if (typeof (row as { fetch?: unknown }).fetch === "function" && "proxy" in row) return "custom_executor_egress";
+  return undefined;
+}
+function nativeModel(config: OcxConfig, row: OcxProviderConfig, model: string): string {
+  const known = new Set([...(row.models ?? []), ...Object.keys(row.modelAliases ?? {})]);
+  return known.has(model) ? model : resolveModelAlias(config, row, known, model) ?? model;
+}
+function derive(config: OcxConfig, name: string, row: OcxProviderConfig, model: string) {
+  const resolved = routedProviderConfig(name, row);
+  const native = nativeModel(config, resolved, model);
+  const routed = resolveWireProtocolOverride(name, native, resolved);
+  const wire = routed.adapter;
+  if (wire !== "openai-chat" && wire !== "openai-responses") throw new Error("unsupported adapter");
+  const transport = wire === "openai-chat" ? openAIChatTransport(routed)
+    : buildResponsesTransport(routed, { headers: new Headers() });
+  const headers = new Headers(transport.headers);
+  headers.set("Accept", "text/event-stream");
+  const wireModel = routed.modelSuffixBracketStrip ? stripBracketedModelSuffix(native) : native;
+  const openRouterRouting = wire === "openai-chat" ? resolveOpenRouterRouting(routed, native) : undefined;
+  const vercelRouting = wire === "openai-chat" ? resolveVercelGatewayRouting(routed, native) : undefined;
+  const providerRouting = vercelRouting ? vercelGatewayProviderPayload(vercelRouting)
+    : openRouterRouting ? openRouterProviderPayload(openRouterRouting) : undefined;
+  // Normal inference admits registry-local defaults as well as the operator's explicit opt-in.
+  // Materialize that effective policy for the outbound wrapper's narrower local HTTP safeguard.
+  const allowLocalCleartextPost = providerAllowsPrivateNetwork(name, routed);
+  // Capture primitive values now: rows and their nested header objects may mutate in place.
+  const selection = routed._apiKeyAttempt;
+  const fingerprint = JSON.stringify({ wire, providerRouting, allowLocalCleartextPost, url: transport.url, wireModel, headers: [...headers].sort(([a], [b]) => a.localeCompare(b)),
+    authMode: routed.authMode, apiKey: routed.apiKey,
+    selection: selection && { entryId: selection.entryId, reference: selection.reference, revision: selection.revision },
+    allowPrivateNetwork: routed.allowPrivateNetwork, proxy: routed.proxy, noProxy: routed.noProxy, disabled: row.disabled });
+  return { routed, wire: wire as Wire, wireModel, providerRouting, allowLocalCleartextPost, headers, url: transport.url, fingerprint };
+}
+function maskedModel(raw: string, secrets: Array<string | undefined>): string {
+  if (secrets.some(secret => typeof secret === "string" && secret.length > 0 && raw.includes(secret))) return "[redacted]";
+  return redactSecretString(raw.replace(/[\x00-\x1f\x7f-\x9f]/g, "").slice(0, 256));
+}
+function abortable<T>(promise: Promise<T>, signal: AbortSignal): Promise<T> {
+  return new Promise((resolve, reject) => {
+    const abort = () => reject(signal.reason);
+    signal.addEventListener("abort", abort, { once: true });
+    if (signal.aborted) abort();
+    promise.then(resolve, reject).finally(() => signal.removeEventListener("abort", abort));
+  });
+}
+class DiagnosticFailure extends Error { constructor(readonly code: Code) { super(MESSAGES[code]); } }
+
+/** Direct diagnostic; callers supply an existing provider name and an already validated model. */
+export async function runProviderCompletionTest(
+  { config, name, model, signal: requestSignal }: ProviderCompletionTestInput,
+  deps: ProviderCompletionTestDependencies = {},
+): Promise<ProviderCompletionTestResult> {
+  const row = config.providers[name];
+  if (!Object.hasOwn(config.providers, name) || !row) throw new Error("unknown provider");
+  if (row.disabled) return { applicable: false, reason: "disabled" };
+  const authKind = PROVIDER_REGISTRY.find(entry => entry.id === name)?.authKind;
+  if (row.authMode === "forward" || authKind === "forward") return { applicable: false, reason: "forward_auth" };
+  if (row.authMode === "oauth" || authKind === "oauth") return { applicable: false, reason: "oauth_auth" };
+  const detail = transportExclusion(row);
+  if (detail) return { applicable: false, reason: "unsupported_transport", detail };
+  // Metadata resolution must never dereference keychain/env/pool credentials.
+  const { apiKey: _key, apiKeyPool: _pool, _apiKeyAttempt: _attempt, ...metadata } = row;
+  let snapshot: OcxProviderConfig = metadata;
+  let destinationRefused = false;
+  try { snapshot = routedProviderConfig(name, metadata); } catch { destinationRefused = true; }
+  const native = nativeModel(config, snapshot, model);
+  const wire = resolveWireProtocolOverride(name, native, snapshot).adapter;
+  if (wire !== "openai-chat" && wire !== "openai-responses") return { applicable: false, reason: "unsupported_adapter", adapter: wire };
+  const now = deps.now ?? (() => performance.now());
+  const result: Extract<ProviderCompletionTestResult, { applicable: true }> = {
+    applicable: true, ok: false, provider: name, requestedModel: model,
+    wireModel: snapshot.modelSuffixBracketStrip ? stripBracketedModelSuffix(native) : native, wire,
+    upstreamModel: null, modelComparison: "unknown", comparisonNote: "missing_metadata", identityVerified: false,
+    ttftMs: null, totalLatencyMs: 0, outputTokenCap: COMPLETION_TEST_OUTPUT_TOKEN_CAP, termination: "failed", error: null,
+  };
+  const fail = (code: Code, status?: number) => {
+    result.error = { code, message: MESSAGES[code], ...(status !== undefined ? { status } : {}) };
+    result.termination = code === "timeout" || code === "aborted" || code === "too_large" ? code : "failed";
+    return result;
+  };
+  if (destinationRefused) return fail("destination_refused");
+  try { assertProviderDestinationAllowed(name, snapshot); } catch { return fail("destination_refused"); }
+  let resolved: OcxProviderConfig;
+  try { resolved = routedProviderConfig(name, row); } catch { return fail("credential_missing"); }
+  if (resolved.authMode === "key" && !resolved.keyOptional && !resolved.apiKey?.trim()) return fail("credential_missing");
+  let authority: ReturnType<typeof derive>;
+  try { authority = derive(config, name, row, model); } catch { return fail("network"); }
+  const secrets = [authority.routed.apiKey, ...Object.values(authority.routed.headers ?? {}),
+    ...[...authority.headers].filter(([name]) => name === "authorization" || name === "x-api-key").map(([, value]) => value)];
+  result.wire = authority.wire;
+  result.wireModel = authority.wireModel;
+  const controller = new AbortController();
+  const deadline = AbortSignal.timeout(deps.timeoutMs ?? COMPLETION_TEST_TIMEOUT_MS);
+  const signal = AbortSignal.any([...(requestSignal ? [requestSignal] : []), deadline, controller.signal]);
+  const started = now();
+  let reader: ReadableStreamDefaultReader<Uint8Array> | undefined;
+  let response: Response | undefined;
+  const translatorBudget = createTranslatorBudget();
+  let observed: string | undefined;
+  let conflicting = false, terminal = false, content = false, finishReason = false;
+  const observe = (value: unknown) => {
+    if (typeof value !== "string") return;
+    if (observed === undefined) observed = value;
+    else if (value !== observed) conflicting = true;
+  };
+  try {
+    signal.throwIfAborted();
+    const body = JSON.stringify(authority.wire === "openai-chat"
+      ? { model: authority.wireModel, messages: [{ role: "user", content: COMPLETION_TEST_PROMPT }], stream: true, max_tokens: 32,
+        ...(authority.providerRouting ? { provider: authority.providerRouting } : {}) }
+      : { model: authority.wireModel, input: COMPLETION_TEST_PROMPT, stream: true, max_output_tokens: 32, store: false });
+    const pending = providerOutboundPost(name, { ...authority.routed, allowPrivateNetwork: authority.allowLocalCleartextPost }, authority.url, { headers: authority.headers, body, signal }, {
+      ...deps.outboundDependencies,
+      allowLocalCleartextPost: authority.allowLocalCleartextPost,
+      beforeSend: () => {
+        try {
+          const current = config.providers[name];
+          return current === row && !current.disabled && !transportExclusion(current)
+            && derive(config, name, current, model).fingerprint === authority.fingerprint
+            && (!authority.routed.apiKey || providerApiKeySelectionIsCurrent(config, name, authority.routed));
+        } catch { return false; }
+      },
+    });
+    // Even an executor ignoring AbortSignal cannot retain a late response body.
+    void pending.then(late => { if (signal.aborted) void late.body?.cancel().catch(() => {}); }, () => {});
+    response = await abortable(pending, signal);
+    if (response.status >= 300 && response.status < 400) return fail("redirect");
+    if (!response.ok) return fail("http_status", response.status);
+    if (!response.body) return fail("premature_eof");
+    reader = response.body.getReader();
+    let bytes = 0;
+    const counted = new ReadableStream<Uint8Array>({
+      async pull(target) {
+        try {
+          const next = await abortable(reader!.read(), signal);
+          if (next.done) { target.close(); return; }
+          bytes += next.value.byteLength;
+          if (bytes > COMPLETION_TEST_MAX_BYTES) throw new DiagnosticFailure("too_large");
+          target.enqueue(next.value);
+        } catch (error) { target.error(error); }
+      },
+      cancel() { void reader!.cancel().catch(() => {}); },
+    }, { highWaterMark: 0 });
+    for await (const event of decodeServerSentEvents(counted, { signal, translatorBudget })) {
+      if (authority.wire === "openai-chat" && event.data.trim() === "[DONE]") { terminal = true; break; }
+      let chunk: Record<string, any>;
+      try { chunk = JSON.parse(event.data); } catch { throw new DiagnosticFailure("stream_error"); }
+      if (!chunk || typeof chunk !== "object" || chunk.error || event.event === "error" || chunk.type === "error" || chunk.type === "response.failed") {
+        throw new DiagnosticFailure("stream_error");
+      }
+      let text = false;
+      if (authority.wire === "openai-chat") {
+        observe(chunk.model);
+        if (Array.isArray(chunk.choices)) for (const choice of chunk.choices) {
+          if (typeof choice?.delta?.content === "string" && choice.delta.content.length > 0) text = true;
+          if (choice?.finish_reason != null) finishReason = true;
+        }
+      } else {
+        const type = chunk.type ?? event.event;
+        if (["response.created", "response.completed", "response.incomplete"].includes(type)) observe(chunk.response?.model);
+        text = type === "response.output_text.delta" && typeof chunk.delta === "string" && chunk.delta.length > 0;
+        terminal = type === "response.completed" || type === "response.incomplete";
+        if (type === "response.failed") throw new DiagnosticFailure("stream_error");
+      }
+      if (text) { content = true; result.ttftMs ??= Math.max(0, Math.round(now() - started)); }
+      if (terminal) break;
+    }
+    signal.throwIfAborted();
+    if (!terminal && !(authority.wire === "openai-chat" && finishReason)) return fail("premature_eof");
+    if (!content) return fail("no_content");
+    result.ok = true;
+    result.termination = "completed";
+    return result;
+  } catch (error) {
+    return fail(requestSignal?.aborted ? "aborted" : deadline.aborted ? "timeout"
+      : error instanceof DiagnosticFailure ? error.code
+      : error instanceof ProviderOutboundSendCancelledError ? "credential_changed"
+      : error instanceof ProviderOutboundPolicyError ? "destination_refused" : "network");
+  } finally {
+    translatorBudget.dispose();
+    result.totalLatencyMs = Math.max(0, Math.round(now() - started));
+    if (observed !== undefined && !conflicting) {
+      result.modelComparison = observed === authority.wireModel ? "match" : "mismatch";
+      delete result.comparisonNote;
+      result.upstreamModel = maskedModel(observed, secrets);
+    } else if (conflicting) result.comparisonNote = "conflicting_metadata";
+    controller.abort();
+    // Cancellation is initiated on every exit; do not wait on a misbehaving executor.
+    if (reader) { void reader.cancel().catch(() => {}); try { reader.releaseLock(); } catch { /* read pending */ } }
+    else void response?.body?.cancel().catch(() => {});
+  }
+}
+
+const inFlight = new Set<string>();
+export async function handleProviderCompletionTestRoute(
+  { req, url, config }: Pick<ManagementContext, "req" | "url" | "config">,
+  deps: ProviderCompletionTestDependencies = {},
+): Promise<Response> {
+  let body: unknown;
+  try { body = await readManagementJsonBody(req); } catch (error) {
+    return managementBodyTooLargeResponse(error, req, config) ?? jsonResponse({ error: "invalid completion test request" }, 400);
+  }
+  if (!body || typeof body !== "object" || Array.isArray(body)
+    || Object.keys(body).some(key => key !== "model" && key !== "confirm")
+    || (body as { confirm?: unknown }).confirm !== true || typeof (body as { model?: unknown }).model !== "string") {
+    return jsonResponse({ error: "invalid completion test request" }, 400);
+  }
+  const model = (body as { model: string }).model.trim();
+  if (!model || model.length > 256 || /[\x00-\x1f\x7f-\x9f]/.test((body as { model: string }).model)) {
+    return jsonResponse({ error: "invalid completion test request" }, 400);
+  }
+  const name = url.searchParams.get("name") ?? "";
+  if (!Object.hasOwn(config.providers, name) || !config.providers[name]) return jsonResponse({ error: "unknown provider" }, 404);
+  if (inFlight.has(name)) return jsonResponse({ error: "completion test already running for this provider" }, 409);
+  inFlight.add(name);
+  try { return jsonResponse(await runProviderCompletionTest({ config, name, model, signal: req.signal }, deps)); }
+  finally { inFlight.delete(name); }
+}

package/src/server/management/provider-routes.ts

@@ -764,7 +764,7 @@ function applyProviderPatchFields(
   if (Object.hasOwn(rawBody, "headers")) {
     const headersValue = rawBody.headers;
     if (headersValue === null || (isPlainRecord(headersValue) && Object.keys(headersValue).length === 0)) {
-      // Registry-owned static metadata (e.g. opencode-free's x-opencode-client marker)
+      // Registry-owned static metadata (e.g. meta-muse's x-api-version marker)
       // is not user-managed: restoring it keeps the upstream transport intact after a
       // clear instead of deleting the whole block.
       const entry = getProviderRegistryEntry(name);
@@ -1357,6 +1357,12 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
       if (submittedModelContextTiers && liveTiers) candidate.modelContextTiers = Object.assign(Object.create(null), liveTiers, candidate.modelContextTiers ?? {});
       else if (!submittedModelContextTiers && liveTiers) candidate.modelContextTiers = { ...liveTiers };
       else if (!submittedModelContextTiers) delete candidate.modelContextTiers;
+      // Read omitted policy at publication time, after any concurrent operator edit.
+      if (!Object.hasOwn(rawProvider, "accountAutoPause")) {
+        const livePolicy = config.providers[name]?.accountAutoPause;
+        if (livePolicy === undefined) delete candidate.accountAutoPause;
+        else candidate.accountAutoPause = structuredClone(livePolicy);
+      }
       // Full forms omit the opt-in; preserve the latest value, including a concurrent clear.
       if (!Object.hasOwn(rawProvider, "inferContextWindow")) {
         const liveInference = config.providers[name]?.inferContextWindow;
@@ -1602,6 +1608,8 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
     });
   }
 
+  if (url.pathname === "/api/providers/test-completion" && req.method === "POST") return (await import("./provider-completion-test")).handleProviderCompletionTestRoute(ctx);
+
   // Lightweight connectivity probe: perform the provider's live /models fetch DIRECTLY and
   // report only real upstream evidence. The catalog aggregate (fetchAllModels) deliberately
   // hides fetch failures behind stale/static fallbacks, so a catalog-presence check would