@bitkyc08/opencodex 2.88.0 → 2.90.0

package/src/server/claude-messages.ts

@@ -1110,7 +1110,8 @@ async function handleClaudeMessagesWithBudget(
   const finalizeNativeLog = createFinalRequestLog(logIds, logCtx).finish;
   const upstream = await handleResponses(internalReq, {
     ...buildClaudeReplayConfig(config),
-    // Operator config wins; otherwise the caller's own 1h breakpoints keep 1h here.
+    // Operator config wins; otherwise the caller's explicit TTLs (all 1h, or a pinned 5m) carry
+    // over, and TTL-less breakpoints take the destination default.
     cacheRetention: config.cacheRetention ?? callerCacheRetention(anthropicBody),
   }, logCtx, {
     // Routing keeps Claude-only sidecar overrides; admission policy must follow the live owner.

package/src/server/index/optional-listeners.ts

@@ -17,6 +17,7 @@ import { createLinkSupervisor, type LinkSupervisor } from "../../link/supervisor
 import { linkManagementRouteAllowed } from "../../link/management-routes";
 import { saveConfigPreservingClaudeCode } from "../../config/live-reconcile";
 import { reconcileLiveStateStores } from "../../lib/state-store-registrations";
+import { startJevQuotaActivation } from "../../combos/jev-quota-activation";
 export { LINK_INGRESS_HOSTNAME } from "./link-listener";
 import type { ServerIngress } from "./serve-options";
 
@@ -51,6 +52,7 @@ export function createOptionalListenerSet<T>(linkDeps: LinkListenerDeps = {}): O
   const claudeIntercept: ClaudeInterceptLifecycle<T> = createClaudeInterceptLifecycle<T>();
   const linkListener: LinkListenerLifecycle<T> = createLinkListenerLifecycle<T>(linkDeps);
   let activeConfig: OcxConfig | undefined;
+  let stopJevQuotaActivation: (() => void) | undefined;
   const supervisor = createLinkSupervisor({
     apiKeys: () => activeConfig?.apiKeys ?? [],
     revokeApiKey: id => {
@@ -114,6 +116,8 @@ export function createOptionalListenerSet<T>(linkDeps: LinkListenerDeps = {}): O
         maxRequestBodySize: ctx.maxRequestBodySize,
         dispatch: ctx.dispatch,
       });
+      // Last, after every listener started: JEV advisory quota follows the live config while serving.
+      stopJevQuotaActivation = startJevQuotaActivation(ctx.config);
     },
     ensureStarted: () => linkListener.ensureStarted(),
     close: () => linkListener.close(),
@@ -132,6 +136,8 @@ export function createOptionalListenerSet<T>(linkDeps: LinkListenerDeps = {}): O
       try { await claudeIntercept.stop(); } catch (error) { failure ??= error; }
       unregisterSupervisorAdmission?.();
       unregisterSupervisorAdmission = undefined;
+      stopJevQuotaActivation?.();
+      stopJevQuotaActivation = undefined;
       if (failure) throw failure;
     },
   };

package/src/server/index/serve-options.ts

@@ -206,6 +206,7 @@ import type { WorkflowRefusalLog } from "../workflow-refusal";
 import { readyProtocolMetadata } from "../../remote/protocol";
 import { modelCapabilityFields } from "../models-capabilities";
 import { createWebsocketHandler } from "./websocket-handler";
+import { reasoningArchiveErrorResponse } from "../responses/reasoning-archive-error";
 import { withGrokSessionIdentity } from "../../grok/session-identity";
 import { withCallerSessionIdentity } from "../caller-session-identity";
 
@@ -1347,8 +1348,9 @@ export function createServeOptions(ctx: ServeOptionsContext) {
             response = await handleResponsesCompact(req, config, logCtx, turnAdmissionLease, admission, {
               onRequestBodyRead: () => disableResponsesRequestTimeout(req, requestServer),
             });
-          } catch {
-            response = formatErrorResponse(500, "server_error", "Unexpected compact request failure");
+          } catch (error) {
+            response = reasoningArchiveErrorResponse(error)
+              ?? formatErrorResponse(500, "server_error", "Unexpected compact request failure");
           }
           addFinalRequestLog(requestId, start, logCtx, response.status,
             response.status === 499 ? { closeReason: "client_cancel" } : undefined);
@@ -1519,6 +1521,10 @@ export function createServeOptions(ctx: ServeOptionsContext) {
               },
             });
           } catch (error) {
+            const archiveError = reasoningArchiveErrorResponse(error);
+            if (archiveError) return withRequestLogId(
+              withCors(responseWithDeferredRequestLog(archiveError, requestId, start, logCtx), req, policy), requestId,
+            );
             // A bounded upstream body can fail before handleResponses returns a client response.
             // Finalize before rethrow so accounting observes the physical send while the caller
             // retains the existing reset/rejection instead of receiving a synthesized response.

package/src/server/index/websocket-handler.ts

@@ -2,6 +2,7 @@ import { nativeSteeringUnavailableReason, nativeResponseControlMode, type Native
 import { NativeInjectionChannel } from "../responses/native-injection";
 import { NativeSteeringChannel, NativeSteeringError } from "../responses/native-steering";
 import { createNativeSteeringLogObserver } from "../responses/native-steering-log";
+import { reasoningArchiveErrorResponse } from "../responses/reasoning-archive-error";
 import type { Server, ServerWebSocket } from "bun";
 import {
   LIVE_SIDEBAND_UPSTREAM_OPEN_TIMEOUT_MS,
@@ -396,6 +397,15 @@ export function createWebsocketHandler(
                 }));
                 return;
               }
+              // A local archive refusal happens before any send. Carry the same sanitized 503
+              // body and stable code as HTTP so no filesystem path reaches the client frame.
+              const archiveError = reasoningArchiveErrorResponse(err);
+              if (archiveError) {
+                finalizeLog(archiveError.status);
+                const body = await archiveError.json() as { error: Record<string, unknown> };
+                sendJsonFrame(ws, buildWsErrorFrame(archiveError.status, body.error));
+                return;
+              }
               finalizeLog(502);
               sendJsonFrame(ws, buildWsErrorFrame(502, {
                 type: "proxy_error",

package/src/server/lifecycle.ts

@@ -476,13 +476,25 @@ export function trackStreamLifetime(
   registerTurn(ac, lease);
   const reader = body.getReader();
   let closed = false;
+  let streamController: ReadableStreamDefaultController<Uint8Array> | undefined;
+  // A drain aborts the turn's controller; many callers pass a fresh one nothing else listens to,
+  // so the tracked stream itself has to stop.
+  const onAbort = () => {
+    if (closed) return;
+    // Stop the stream before the caller's onDone runs, so a throwing callback cannot leave it open.
+    reader.cancel(ac.signal.reason).catch(() => {});
+    try { streamController?.error(ac.signal.reason); } catch { /* already closed */ }
+    finish();
+  };
   const finish = () => {
     if (closed) return;
     closed = true;
+    ac.signal.removeEventListener("abort", onAbort);
     unregisterTurn(ac);
     onDone?.();
   };
-  return new ReadableStream<Uint8Array>({
+  const tracked = new ReadableStream<Uint8Array>({
+    start(controller) { streamController = controller; },
     async pull(controller) {
       try {
         const { done, value } = await reader.read();
@@ -499,6 +511,10 @@ export function trackStreamLifetime(
       reader.cancel(reason).catch(() => {});
     },
   });
+  // After registerTurn, so the lease's own abort listener (release the turn) runs first. A
+  // controller registerTurn already aborted (a settled lease) keeps its previous behaviour.
+  ac.signal.addEventListener("abort", onAbort, { once: true });
+  return tracked;
 }
 
 export async function drainAndShutdown(

package/src/server/management/combo-routes.ts

@@ -63,7 +63,7 @@ import {
 } from "../../vision/eligibility";
 import type { OcxClaudeCodeConfig, OcxComboConfig, OcxConfig, OcxCustomModel, OcxProviderConfig, OcxComboCooldownWaitPolicy } from "../../types";
 import { drainAndShutdown } from "../lifecycle";
-import { reconcileLiveStateStores } from "../../lib/state-store-registrations";
+import { notifyLiveConfigObservers, reconcileLiveStateStores } from "../../lib/state-store-registrations";
 import { filterRequestLogs, getRequestLogEntries, type RequestLogEntry } from "../request-log";
 import { estimateComboCost, estimateRequestCost, normalizeCostTokens, tokensPerSecond } from "../../usage/cost";
 import type { PersistedUsageAttempt } from "../../usage/log";
@@ -162,6 +162,7 @@ function parseVisionSidecarTargets(
   return { targets };
 }
 
+/** Handle the `/api/combos` management routes (list, save, delete and related combo endpoints), validating and preserving the opt-in quota signal fields; null when no route matches. */
 export async function handleComboRoutes(ctx: ManagementContext): Promise<Response | null> {
   const { req, url, config, deps, convergeCodexCatalog, syncClaudeAgentDefsBestEffort } = ctx;
 
@@ -222,6 +223,8 @@ export async function handleComboRoutes(ctx: ManagementContext): Promise<Respons
     const requestedCombo: Record<string, unknown> = body.combo;
     const effectiveCombo = {
       ...requestedCombo,
+      ...(!Object.hasOwn(requestedCombo, "decisionQuotaSignals") && requestedCombo.strategy === "jev" && previous?.decisionQuotaSignals !== undefined ? { decisionQuotaSignals: previous.decisionQuotaSignals } : {}),
+      ...(!Object.hasOwn(requestedCombo, "decisionQuotaTiers") && requestedCombo.strategy === "jev" && previous?.decisionQuotaTiers !== undefined ? { decisionQuotaTiers: previous.decisionQuotaTiers } : {}),
       ...(!Object.hasOwn(requestedCombo, "allowMeteredTargets") && previous?.allowMeteredTargets === true
         ? { allowMeteredTargets: true }
         : {}),
@@ -244,6 +247,11 @@ export async function handleComboRoutes(ctx: ManagementContext): Promise<Respons
       ...(!Object.hasOwn(requestedCombo, "imageInput") && previous?.imageInput !== undefined
         ? { imageInput: previous.imageInput }
         : {}),
+      // #7229: the dashboard does not edit the row description, so a round trip that omits it
+      // (including a rename) keeps it. An explicit empty string still clears it.
+      ...(!Object.hasOwn(requestedCombo, "description") && previous?.description !== undefined
+        ? { description: previous.description }
+        : {}),
       // `lastResort` rides on each target, so a GUI that re-sends the target list without the
       // flag would strip it. Carry it over per target, matched on provider+model.
       ...(Array.isArray(requestedCombo.targets) && Array.isArray(previous?.targets)
@@ -516,6 +524,8 @@ export async function handleComboRoutes(ctx: ManagementContext): Promise<Respons
       if (!(error instanceof ConfigWritePublishedError)) {
         return jsonResponse({ error: "combo could not be saved" }, 500);
       }
+      // Published but bookkeeping failed: live observers (JEV quota activation) still follow the saved combo.
+      notifyLiveConfigObservers(config);
       throw error;
     }
     reconcileLiveStateStores();
@@ -548,7 +558,12 @@ export async function handleComboRoutes(ctx: ManagementContext): Promise<Respons
     const { clearComboSelectionState, clearComboTargetCooldowns } = await import("../../combos");
     delete config.combos![id];
     if (Object.keys(config.combos!).length === 0) deleteConfigTopLevelKey(config, "combos");
-    saveConfigPreservingClaudeCode(config);
+    try {
+      saveConfigPreservingClaudeCode(config);
+    } catch (error) {
+      if (error instanceof ConfigWritePublishedError) notifyLiveConfigObservers(config);
+      throw error;
+    }
     reconcileLiveStateStores();
     clearComboSelectionState(id);
     clearComboTargetCooldowns(id);

package/src/server/management/oauth-account-routes.ts

@@ -374,7 +374,8 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     // Without a flow id this cancels the provider's newest in-flight login, which is what the
     // single-user GUI has always meant by "Cancel". A host running concurrent code logins for
     // several users passes the flowId it was given at /api/oauth/login.
-    const cancelled = cancelLoginFlow(provider, typeof body.flowId === "string" ? body.flowId : undefined);
+    const cancelled = cancelLoginFlow(provider, typeof body.flowId === "string" ? body.flowId : undefined,
+      { dismissSettledFailure: true });
     return jsonResponse({ ok: true, cancelled });
   }
 
@@ -510,7 +511,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
               reauthReason: summary.needsReauth === true ? "refresh_failed" : undefined,
             });
           return { ...summary, ...oauthAccountHealthFields(provider, summary.id, health), quotaMode,
-            ...(supportsPause ? { paused: full?.paused === true } : {}),
+            ...(supportsPause ? { paused: full?.paused === true, ...(full?.pauseDetails ? { pauseDetails: full.pauseDetails } : {}) } : {}),
             ...(isAnthropicOAuthInstance(provider) && supportsPause ? { autoSwitchThresholdOverride: full?.autoSwitchThresholdOverride ?? null,
               effectiveAutoSwitchThreshold: effectiveAnthropicAccountThresholdForInstance(provider as AnthropicInstanceId, config, full),
               autoSwitchThreshold: effectiveAnthropicAccountThresholdForInstance(provider as AnthropicInstanceId, config) } : {}),
@@ -1116,6 +1117,15 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     clearProviderQuotaCache();
     return jsonResponse({ ...result, name, store: providerKeyStoreKind(config.providers[name]) });
   }
+  if (url.pathname === "/api/providers/keys/pause" && req.method === "PUT") {
+    const body = await readManagementJsonBodyOr(req, {});
+    if (!isPlainRecord(body)) return jsonResponse({ error: "body must be an object" }, 400);
+    if (typeof body.name !== "string" || typeof body.id !== "string" || typeof body.paused !== "boolean") return jsonResponse({ error: "name, id and paused required" }, 400);
+    if (!isValidProviderName(body.name) || !hasOwnProvider(config.providers, body.name)) return jsonResponse({ error: "unknown provider" }, 404);
+    const { setProviderApiKeyPaused } = await import("../../providers/api-key-pause");
+    return setProviderApiKeyPaused(config, body.name, body.id, body.paused)
+      ? jsonResponse({ ok: true }) : jsonResponse({ error: "key not found" }, 404);
+  }
   if (url.pathname === "/api/providers/keys/active" && req.method === "PUT") {
     const body = await readManagementJsonBodyOr(req, {}) as { name?: string; id?: string };
     const name = (body.name ?? "").trim();

package/src/server/management/provider-completion-test.ts

@@ -0,0 +1,289 @@
+/**
+ * Explicit single-model diagnostic, isolated from discovery, routing health and request history.
+ * Unsupported transports: TLS profiles, HTTP version pins, enabled pacing, custom fetch + proxy.
+ * Adding an exclusion requires a regression test. No retries, failover, or output preview.
+ */
+import type { OcxConfig, OcxProviderConfig } from "../../types";
+import { routedProviderConfig } from "../../providers/routed-config";
+import { PROVIDER_REGISTRY } from "../../providers/registry";
+import { resolveModelAlias } from "../../providers/default-aliases";
+import { providerApiKeySelectionIsCurrent } from "../../providers/api-key-selection";
+import { resolveWireProtocolOverride } from "../adapter-resolve";
+import { openAIChatTransport, stripBracketedModelSuffix } from "../../adapters/openai-chat/wire";
+import { buildResponsesTransport } from "../../adapters/openai-responses/transport";
+import { openRouterProviderPayload, resolveOpenRouterRouting } from "../../providers/openrouter-routing";
+import { resolveVercelGatewayRouting, vercelGatewayProviderPayload } from "../../providers/vercel-gateway-routing";
+import { assertProviderDestinationAllowed, providerAllowsPrivateNetwork } from "../../lib/destination-policy";
+import { providerOutboundPost, ProviderOutboundPolicyError, ProviderOutboundSendCancelledError,
+  type ProviderOutboundDependencies } from "../../lib/provider-outbound";
+import { redactSecretString } from "../../lib/redact";
+import { decodeServerSentEvents } from "../../lib/sse-decoder";
+import { createTranslatorBudget } from "../../lib/translator-budget";
+import { jsonResponse } from "../auth-cors";
+import type { ManagementContext } from "./context";
+import { managementBodyTooLargeResponse, readManagementJsonBody } from "./body";
+
+export const COMPLETION_TEST_PROMPT = "Reply exactly OK.";
+export const COMPLETION_TEST_OUTPUT_TOKEN_CAP = 32;
+export const COMPLETION_TEST_TIMEOUT_MS = 20_000;
+export const COMPLETION_TEST_MAX_BYTES = 64 * 1024;
+
+type Wire = "openai-chat" | "openai-responses";
+type Code = "destination_refused" | "credential_missing" | "credential_changed" | "http_status" | "redirect"
+  | "network" | "stream_error" | "premature_eof" | "no_content" | "timeout" | "aborted" | "too_large";
+const MESSAGES: Record<Code, string> = {
+  destination_refused: "Provider destination refused by policy.",
+  credential_missing: "Provider credential is missing.",
+  credential_changed: "Provider request authority changed before send.",
+  http_status: "Upstream returned an unsuccessful HTTP status.",
+  redirect: "Upstream redirect refused.",
+  network: "Upstream network request failed.",
+  stream_error: "Upstream stream reported an error.",
+  premature_eof: "Upstream stream ended without a terminal event.",
+  no_content: "Upstream completed without a text delta.",
+  timeout: "Completion test deadline exceeded.",
+  aborted: "Completion test was cancelled.",
+  too_large: "Upstream stream exceeded the byte limit.",
+};
+export type ProviderCompletionTestResult = {
+  applicable: false;
+  reason: "disabled" | "forward_auth" | "oauth_auth" | "unsupported_adapter" | "unsupported_transport";
+  adapter?: string;
+  detail?: "tls_profile" | "upstream_http_version" | "request_pacing" | "custom_executor_egress";
+} | {
+  applicable: true; ok: boolean; provider: string; requestedModel: string; wireModel: string; wire: Wire;
+  upstreamModel: string | null; modelComparison: "match" | "mismatch" | "unknown";
+  comparisonNote?: "missing_metadata" | "conflicting_metadata";
+  identityVerified: false; ttftMs: number | null; totalLatencyMs: number; outputTokenCap: 32;
+  termination: "completed" | "failed" | "timeout" | "aborted" | "too_large";
+  error: null | { code: Code; status?: number; message: string };
+};
+export interface ProviderCompletionTestInput { config: OcxConfig; name: string; model: string; signal?: AbortSignal }
+export interface ProviderCompletionTestDependencies {
+  now?: () => number;
+  timeoutMs?: number;
+  outboundDependencies?: ProviderOutboundDependencies;
+}
+
+function transportExclusion(row: OcxProviderConfig): Extract<ProviderCompletionTestResult, { applicable: false }>["detail"] {
+  if (row.tlsProfile !== undefined) return "tls_profile";
+  if (row.upstreamHttpVersion !== undefined) return "upstream_http_version";
+  if (row.requestPacing?.enabled) return "request_pacing";
+  if (typeof (row as { fetch?: unknown }).fetch === "function" && "proxy" in row) return "custom_executor_egress";
+  return undefined;
+}
+function nativeModel(config: OcxConfig, row: OcxProviderConfig, model: string): string {
+  const known = new Set([...(row.models ?? []), ...Object.keys(row.modelAliases ?? {})]);
+  return known.has(model) ? model : resolveModelAlias(config, row, known, model) ?? model;
+}
+function derive(config: OcxConfig, name: string, row: OcxProviderConfig, model: string) {
+  const resolved = routedProviderConfig(name, row);
+  const native = nativeModel(config, resolved, model);
+  const routed = resolveWireProtocolOverride(name, native, resolved);
+  const wire = routed.adapter;
+  if (wire !== "openai-chat" && wire !== "openai-responses") throw new Error("unsupported adapter");
+  const transport = wire === "openai-chat" ? openAIChatTransport(routed)
+    : buildResponsesTransport(routed, { headers: new Headers() });
+  const headers = new Headers(transport.headers);
+  headers.set("Accept", "text/event-stream");
+  const wireModel = routed.modelSuffixBracketStrip ? stripBracketedModelSuffix(native) : native;
+  const openRouterRouting = wire === "openai-chat" ? resolveOpenRouterRouting(routed, native) : undefined;
+  const vercelRouting = wire === "openai-chat" ? resolveVercelGatewayRouting(routed, native) : undefined;
+  const providerRouting = vercelRouting ? vercelGatewayProviderPayload(vercelRouting)
+    : openRouterRouting ? openRouterProviderPayload(openRouterRouting) : undefined;
+  // Normal inference admits registry-local defaults as well as the operator's explicit opt-in.
+  // Materialize that effective policy for the outbound wrapper's narrower local HTTP safeguard.
+  const allowLocalCleartextPost = providerAllowsPrivateNetwork(name, routed);
+  // Capture primitive values now: rows and their nested header objects may mutate in place.
+  const selection = routed._apiKeyAttempt;
+  const fingerprint = JSON.stringify({ wire, providerRouting, allowLocalCleartextPost, url: transport.url, wireModel, headers: [...headers].sort(([a], [b]) => a.localeCompare(b)),
+    authMode: routed.authMode, apiKey: routed.apiKey,
+    selection: selection && { entryId: selection.entryId, reference: selection.reference, revision: selection.revision },
+    allowPrivateNetwork: routed.allowPrivateNetwork, proxy: routed.proxy, noProxy: routed.noProxy, disabled: row.disabled });
+  return { routed, wire: wire as Wire, wireModel, providerRouting, allowLocalCleartextPost, headers, url: transport.url, fingerprint };
+}
+function maskedModel(raw: string, secrets: Array<string | undefined>): string {
+  if (secrets.some(secret => typeof secret === "string" && secret.length > 0 && raw.includes(secret))) return "[redacted]";
+  return redactSecretString(raw.replace(/[\x00-\x1f\x7f-\x9f]/g, "").slice(0, 256));
+}
+function abortable<T>(promise: Promise<T>, signal: AbortSignal): Promise<T> {
+  return new Promise((resolve, reject) => {
+    const abort = () => reject(signal.reason);
+    signal.addEventListener("abort", abort, { once: true });
+    if (signal.aborted) abort();
+    promise.then(resolve, reject).finally(() => signal.removeEventListener("abort", abort));
+  });
+}
+class DiagnosticFailure extends Error { constructor(readonly code: Code) { super(MESSAGES[code]); } }
+
+/** Direct diagnostic; callers supply an existing provider name and an already validated model. */
+export async function runProviderCompletionTest(
+  { config, name, model, signal: requestSignal }: ProviderCompletionTestInput,
+  deps: ProviderCompletionTestDependencies = {},
+): Promise<ProviderCompletionTestResult> {
+  const row = config.providers[name];
+  if (!Object.hasOwn(config.providers, name) || !row) throw new Error("unknown provider");
+  if (row.disabled) return { applicable: false, reason: "disabled" };
+  const authKind = PROVIDER_REGISTRY.find(entry => entry.id === name)?.authKind;
+  if (row.authMode === "forward" || authKind === "forward") return { applicable: false, reason: "forward_auth" };
+  if (row.authMode === "oauth" || authKind === "oauth") return { applicable: false, reason: "oauth_auth" };
+  const detail = transportExclusion(row);
+  if (detail) return { applicable: false, reason: "unsupported_transport", detail };
+  // Metadata resolution must never dereference keychain/env/pool credentials.
+  const { apiKey: _key, apiKeyPool: _pool, _apiKeyAttempt: _attempt, ...metadata } = row;
+  let snapshot: OcxProviderConfig = metadata;
+  let destinationRefused = false;
+  try { snapshot = routedProviderConfig(name, metadata); } catch { destinationRefused = true; }
+  const native = nativeModel(config, snapshot, model);
+  const wire = resolveWireProtocolOverride(name, native, snapshot).adapter;
+  if (wire !== "openai-chat" && wire !== "openai-responses") return { applicable: false, reason: "unsupported_adapter", adapter: wire };
+  const now = deps.now ?? (() => performance.now());
+  const result: Extract<ProviderCompletionTestResult, { applicable: true }> = {
+    applicable: true, ok: false, provider: name, requestedModel: model,
+    wireModel: snapshot.modelSuffixBracketStrip ? stripBracketedModelSuffix(native) : native, wire,
+    upstreamModel: null, modelComparison: "unknown", comparisonNote: "missing_metadata", identityVerified: false,
+    ttftMs: null, totalLatencyMs: 0, outputTokenCap: COMPLETION_TEST_OUTPUT_TOKEN_CAP, termination: "failed", error: null,
+  };
+  const fail = (code: Code, status?: number) => {
+    result.error = { code, message: MESSAGES[code], ...(status !== undefined ? { status } : {}) };
+    result.termination = code === "timeout" || code === "aborted" || code === "too_large" ? code : "failed";
+    return result;
+  };
+  if (destinationRefused) return fail("destination_refused");
+  try { assertProviderDestinationAllowed(name, snapshot); } catch { return fail("destination_refused"); }
+  let resolved: OcxProviderConfig;
+  try { resolved = routedProviderConfig(name, row); } catch { return fail("credential_missing"); }
+  if (resolved.authMode === "key" && !resolved.keyOptional && !resolved.apiKey?.trim()) return fail("credential_missing");
+  let authority: ReturnType<typeof derive>;
+  try { authority = derive(config, name, row, model); } catch { return fail("network"); }
+  const secrets = [authority.routed.apiKey, ...Object.values(authority.routed.headers ?? {}),
+    ...[...authority.headers].filter(([name]) => name === "authorization" || name === "x-api-key").map(([, value]) => value)];
+  result.wire = authority.wire;
+  result.wireModel = authority.wireModel;
+  const controller = new AbortController();
+  const deadline = AbortSignal.timeout(deps.timeoutMs ?? COMPLETION_TEST_TIMEOUT_MS);
+  const signal = AbortSignal.any([...(requestSignal ? [requestSignal] : []), deadline, controller.signal]);
+  const started = now();
+  let reader: ReadableStreamDefaultReader<Uint8Array> | undefined;
+  let response: Response | undefined;
+  const translatorBudget = createTranslatorBudget();
+  let observed: string | undefined;
+  let conflicting = false, terminal = false, content = false, finishReason = false;
+  const observe = (value: unknown) => {
+    if (typeof value !== "string") return;
+    if (observed === undefined) observed = value;
+    else if (value !== observed) conflicting = true;
+  };
+  try {
+    signal.throwIfAborted();
+    const body = JSON.stringify(authority.wire === "openai-chat"
+      ? { model: authority.wireModel, messages: [{ role: "user", content: COMPLETION_TEST_PROMPT }], stream: true, max_tokens: 32,
+        ...(authority.providerRouting ? { provider: authority.providerRouting } : {}) }
+      : { model: authority.wireModel, input: COMPLETION_TEST_PROMPT, stream: true, max_output_tokens: 32, store: false });
+    const pending = providerOutboundPost(name, { ...authority.routed, allowPrivateNetwork: authority.allowLocalCleartextPost }, authority.url, { headers: authority.headers, body, signal }, {
+      ...deps.outboundDependencies,
+      allowLocalCleartextPost: authority.allowLocalCleartextPost,
+      beforeSend: () => {
+        try {
+          const current = config.providers[name];
+          return current === row && !current.disabled && !transportExclusion(current)
+            && derive(config, name, current, model).fingerprint === authority.fingerprint
+            && (!authority.routed.apiKey || providerApiKeySelectionIsCurrent(config, name, authority.routed));
+        } catch { return false; }
+      },
+    });
+    // Even an executor ignoring AbortSignal cannot retain a late response body.
+    void pending.then(late => { if (signal.aborted) void late.body?.cancel().catch(() => {}); }, () => {});
+    response = await abortable(pending, signal);
+    if (response.status >= 300 && response.status < 400) return fail("redirect");
+    if (!response.ok) return fail("http_status", response.status);
+    if (!response.body) return fail("premature_eof");
+    reader = response.body.getReader();
+    let bytes = 0;
+    const counted = new ReadableStream<Uint8Array>({
+      async pull(target) {
+        try {
+          const next = await abortable(reader!.read(), signal);
+          if (next.done) { target.close(); return; }
+          bytes += next.value.byteLength;
+          if (bytes > COMPLETION_TEST_MAX_BYTES) throw new DiagnosticFailure("too_large");
+          target.enqueue(next.value);
+        } catch (error) { target.error(error); }
+      },
+      cancel() { void reader!.cancel().catch(() => {}); },
+    }, { highWaterMark: 0 });
+    for await (const event of decodeServerSentEvents(counted, { signal, translatorBudget })) {
+      if (authority.wire === "openai-chat" && event.data.trim() === "[DONE]") { terminal = true; break; }
+      let chunk: Record<string, any>;
+      try { chunk = JSON.parse(event.data); } catch { throw new DiagnosticFailure("stream_error"); }
+      if (!chunk || typeof chunk !== "object" || chunk.error || event.event === "error" || chunk.type === "error" || chunk.type === "response.failed") {
+        throw new DiagnosticFailure("stream_error");
+      }
+      let text = false;
+      if (authority.wire === "openai-chat") {
+        observe(chunk.model);
+        if (Array.isArray(chunk.choices)) for (const choice of chunk.choices) {
+          if (typeof choice?.delta?.content === "string" && choice.delta.content.length > 0) text = true;
+          if (choice?.finish_reason != null) finishReason = true;
+        }
+      } else {
+        const type = chunk.type ?? event.event;
+        if (["response.created", "response.completed", "response.incomplete"].includes(type)) observe(chunk.response?.model);
+        text = type === "response.output_text.delta" && typeof chunk.delta === "string" && chunk.delta.length > 0;
+        terminal = type === "response.completed" || type === "response.incomplete";
+        if (type === "response.failed") throw new DiagnosticFailure("stream_error");
+      }
+      if (text) { content = true; result.ttftMs ??= Math.max(0, Math.round(now() - started)); }
+      if (terminal) break;
+    }
+    signal.throwIfAborted();
+    if (!terminal && !(authority.wire === "openai-chat" && finishReason)) return fail("premature_eof");
+    if (!content) return fail("no_content");
+    result.ok = true;
+    result.termination = "completed";
+    return result;
+  } catch (error) {
+    return fail(requestSignal?.aborted ? "aborted" : deadline.aborted ? "timeout"
+      : error instanceof DiagnosticFailure ? error.code
+      : error instanceof ProviderOutboundSendCancelledError ? "credential_changed"
+      : error instanceof ProviderOutboundPolicyError ? "destination_refused" : "network");
+  } finally {
+    translatorBudget.dispose();
+    result.totalLatencyMs = Math.max(0, Math.round(now() - started));
+    if (observed !== undefined && !conflicting) {
+      result.modelComparison = observed === authority.wireModel ? "match" : "mismatch";
+      delete result.comparisonNote;
+      result.upstreamModel = maskedModel(observed, secrets);
+    } else if (conflicting) result.comparisonNote = "conflicting_metadata";
+    controller.abort();
+    // Cancellation is initiated on every exit; do not wait on a misbehaving executor.
+    if (reader) { void reader.cancel().catch(() => {}); try { reader.releaseLock(); } catch { /* read pending */ } }
+    else void response?.body?.cancel().catch(() => {});
+  }
+}
+
+const inFlight = new Set<string>();
+export async function handleProviderCompletionTestRoute(
+  { req, url, config }: Pick<ManagementContext, "req" | "url" | "config">,
+  deps: ProviderCompletionTestDependencies = {},
+): Promise<Response> {
+  let body: unknown;
+  try { body = await readManagementJsonBody(req); } catch (error) {
+    return managementBodyTooLargeResponse(error, req, config) ?? jsonResponse({ error: "invalid completion test request" }, 400);
+  }
+  if (!body || typeof body !== "object" || Array.isArray(body)
+    || Object.keys(body).some(key => key !== "model" && key !== "confirm")
+    || (body as { confirm?: unknown }).confirm !== true || typeof (body as { model?: unknown }).model !== "string") {
+    return jsonResponse({ error: "invalid completion test request" }, 400);
+  }
+  const model = (body as { model: string }).model.trim();
+  if (!model || model.length > 256 || /[\x00-\x1f\x7f-\x9f]/.test((body as { model: string }).model)) {
+    return jsonResponse({ error: "invalid completion test request" }, 400);
+  }
+  const name = url.searchParams.get("name") ?? "";
+  if (!Object.hasOwn(config.providers, name) || !config.providers[name]) return jsonResponse({ error: "unknown provider" }, 404);
+  if (inFlight.has(name)) return jsonResponse({ error: "completion test already running for this provider" }, 409);
+  inFlight.add(name);
+  try { return jsonResponse(await runProviderCompletionTest({ config, name, model, signal: req.signal }, deps)); }
+  finally { inFlight.delete(name); }
+}

package/src/server/management/provider-routes.ts

@@ -764,7 +764,7 @@ function applyProviderPatchFields(
   if (Object.hasOwn(rawBody, "headers")) {
     const headersValue = rawBody.headers;
     if (headersValue === null || (isPlainRecord(headersValue) && Object.keys(headersValue).length === 0)) {
-      // Registry-owned static metadata (e.g. opencode-free's x-opencode-client marker)
+      // Registry-owned static metadata (e.g. meta-muse's x-api-version marker)
       // is not user-managed: restoring it keeps the upstream transport intact after a
       // clear instead of deleting the whole block.
       const entry = getProviderRegistryEntry(name);
@@ -1357,6 +1357,12 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
       if (submittedModelContextTiers && liveTiers) candidate.modelContextTiers = Object.assign(Object.create(null), liveTiers, candidate.modelContextTiers ?? {});
       else if (!submittedModelContextTiers && liveTiers) candidate.modelContextTiers = { ...liveTiers };
       else if (!submittedModelContextTiers) delete candidate.modelContextTiers;
+      // Read omitted policy at publication time, after any concurrent operator edit.
+      if (!Object.hasOwn(rawProvider, "accountAutoPause")) {
+        const livePolicy = config.providers[name]?.accountAutoPause;
+        if (livePolicy === undefined) delete candidate.accountAutoPause;
+        else candidate.accountAutoPause = structuredClone(livePolicy);
+      }
       // Full forms omit the opt-in; preserve the latest value, including a concurrent clear.
       if (!Object.hasOwn(rawProvider, "inferContextWindow")) {
         const liveInference = config.providers[name]?.inferContextWindow;
@@ -1602,6 +1608,8 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
     });
   }
 
+  if (url.pathname === "/api/providers/test-completion" && req.method === "POST") return (await import("./provider-completion-test")).handleProviderCompletionTestRoute(ctx);
+
   // Lightweight connectivity probe: perform the provider's live /models fetch DIRECTLY and
   // report only real upstream evidence. The catalog aggregate (fetchAllModels) deliberately
   // hides fetch failures behind stale/static fallbacks, so a catalog-presence check would

package/src/server/management/route-registry.ts

@@ -364,6 +364,7 @@ export const MANAGEMENT_ROUTES: readonly ManagementRoute[] = [
   { method: "PUT", path: "/api/oauth/accounts/pool", module: "server/management/oauth-account-routes", mutates: true },
   { method: "PUT", path: "/api/providers/keys/active", module: "server/management/oauth-account-routes", mutates: true },
   { method: "PUT", path: "/api/providers/keys/alias", module: "server/management/oauth-account-routes", mutates: true },
+  { method: "PUT", path: "/api/providers/keys/pause", module: "server/management/oauth-account-routes", mutates: true },
   // server/management/provider-routes
   { method: "DELETE", path: "/api/providers", module: "server/management/provider-routes", mutates: true },
   { method: "GET", path: "/api/provider-context-caps", module: "server/management/provider-routes", mutates: false },
@@ -373,6 +374,7 @@ export const MANAGEMENT_ROUTES: readonly ManagementRoute[] = [
   { method: "GET", path: "/api/providers", module: "server/management/provider-routes", mutates: false },
   { method: "PATCH", path: "/api/providers", module: "server/management/provider-routes", mutates: true },
   { method: "POST", path: "/api/providers", module: "server/management/provider-routes", mutates: true },
+  { method: "POST", path: "/api/providers/test-completion", module: "server/management/provider-routes", mutates: true },
   { method: "POST", path: "/api/providers/test", module: "server/management/provider-routes", mutates: true },
   { method: "PUT", path: "/api/providers", module: "server/management/provider-routes", mutates: true },
   { method: "PUT", path: "/api/provider-context-caps", module: "server/management/provider-routes", mutates: true },