@bitkyc08/opencodex 2.89.0 → 2.91.0

package/src/oauth/account-import/google-antigravity-adapter.ts

@@ -1,6 +1,7 @@
 import { validateAntigravityImportCredential } from "../google-antigravity";
 import { upsertCredentialByIdentity } from "../store";
 import type { OAuthCredentials } from "../types";
+import { probeAntigravityUsageQuota } from "../../providers/quota/antigravity";
 import {
   ACCOUNT_IMPORT_FORMAT,
   ACCOUNT_IMPORT_MAX_EMAIL_LENGTH,
@@ -14,6 +15,26 @@ import {
 export interface AntigravityImportAdapterDeps {
   validate(refreshToken: string, signal?: AbortSignal): Promise<ValidatedAntigravityCredential>;
   upsert(credential: OAuthCredentials): Promise<"inserted" | "updated">;
+  /**
+   * Prove that the freshly validated account token can use an operator-supplied project.
+   * Without this owner a fallback project is never admitted.
+   */
+  verifyProject?(accessToken: string, projectId: string, signal?: AbortSignal): Promise<boolean>;
+}
+
+/**
+ * The account-bound admission probe for a fallback project: the same Cloud Code Assist quota
+ * probe the account pool runs, authenticated with this account's own access token against the
+ * named project. Only a parsed quota answer admits it; denial, rate limiting, transport failure
+ * or an unusable body all keep the record out.
+ */
+export async function verifyAntigravityImportProject(accessToken: string, projectId: string, signal?: AbortSignal): Promise<boolean> {
+  if (signal?.aborted) return false;
+  try {
+    return (await probeAntigravityUsageQuota(accessToken, projectId, signal)).kind === "available" && !signal?.aborted;
+  } catch {
+    return false;
+  }
 }
 
 function safeProviderEmail(value: unknown): string | null {
@@ -32,6 +53,7 @@ export function createAntigravityAccountImportAdapter(
   deps: AntigravityImportAdapterDeps = {
     validate: validateAntigravityImportCredential,
     upsert: credential => upsertCredentialByIdentity(ACCOUNT_IMPORT_PROVIDER, credential),
+    verifyProject: verifyAntigravityImportProject,
   },
 ): AccountImportAdapter {
   return {
@@ -52,15 +74,29 @@ export function createAntigravityAccountImportAdapter(
       const providerEmail = safeProviderEmail(credential.email);
       if (!providerEmail) return { status: "failed", code: "credential_rejected" };
       if (providerEmail !== record.email) return { status: "failed", code: "identity_mismatch" };
-      if (typeof credential.projectId !== "string" || credential.projectId.length === 0) {
-        return { status: "failed", code: "missing_project" };
+      // Automatic discovery wins: a discovered project is used as-is and the record's project_id
+      // is ignored. The record's project is a fallback only, admitted after an account-bound probe.
+      let projectId = typeof credential.projectId === "string" && credential.projectId.length > 0
+        ? credential.projectId
+        : undefined;
+      if (!projectId && record.projectId && deps.verifyProject) {
+        let admitted = false;
+        try {
+          admitted = await deps.verifyProject(credential.access, record.projectId, signal);
+        } catch {
+          admitted = false;
+        }
+        throwIfAccountImportAborted(signal);
+        if (admitted) projectId = record.projectId;
       }
+      if (!projectId) return { status: "failed", code: "missing_project" };
 
       throwIfAccountImportAborted(signal);
       try {
         const disposition = await deps.upsert({
           ...credential,
           email: providerEmail,
+          projectId,
           source: "credential-file",
         });
         return disposition === "updated"

package/src/oauth/account-import/parser.ts

@@ -1,13 +1,17 @@
 import {
   ACCOUNT_IMPORT_MAX_BYTES,
   ACCOUNT_IMPORT_MAX_EMAIL_LENGTH,
+  ACCOUNT_IMPORT_MAX_PROJECT_ID_LENGTH,
   ACCOUNT_IMPORT_MAX_RECORDS,
   ACCOUNT_IMPORT_MAX_REFRESH_TOKEN_BYTES,
   type ParsedCockpitRecord,
 } from "./types";
 
 const encoder = new TextEncoder();
-const ALLOWED_RECORD_KEYS = new Set(["email", "refresh_token", "tags", "notes"]);
+const ALLOWED_RECORD_KEYS = new Set(["email", "refresh_token", "project_id", "tags", "notes"]);
+// Google Cloud project id grammar: a lowercase letter, then lowercase letters, digits or hyphens,
+// not ending in a hyphen. Exact match only — no trimming, so whitespace or controls are rejected.
+const PROJECT_ID_SHAPE = /^[a-z][a-z0-9-]*[a-z0-9]$/;
 
 export type CockpitDocumentParseResult =
   | { ok: true; records: ParsedCockpitRecord[] }
@@ -50,10 +54,18 @@ function validMetadata(record: Record<string, unknown>): boolean {
   return record.notes === undefined || typeof record.notes === "string";
 }
 
+function validProjectId(value: unknown): value is string | undefined {
+  if (value === undefined) return true;
+  return typeof value === "string"
+    && value.length >= 6
+    && value.length <= ACCOUNT_IMPORT_MAX_PROJECT_ID_LENGTH
+    && PROJECT_ID_SHAPE.test(value);
+}
+
 function parseRecord(value: unknown, index: number): ParsedCockpitRecord {
   if (!isPlainRecord(value)) return { index, code: "invalid_record" };
   if (Object.keys(value).some(key => !ALLOWED_RECORD_KEYS.has(key))) return { index, code: "invalid_record" };
-  if (!validEmail(value.email) || !validRefreshToken(value.refresh_token) || !validMetadata(value)) {
+  if (!validEmail(value.email) || !validRefreshToken(value.refresh_token) || !validProjectId(value.project_id) || !validMetadata(value)) {
     return { index, code: "invalid_record" };
   }
   return {
@@ -61,6 +73,7 @@ function parseRecord(value: unknown, index: number): ParsedCockpitRecord {
     record: {
       email: value.email.toLowerCase(),
       refreshToken: value.refresh_token,
+      ...(typeof value.project_id === "string" ? { projectId: value.project_id } : {}),
     },
   };
 }

package/src/oauth/account-import/types.ts

@@ -11,6 +11,8 @@ export const ACCOUNT_IMPORT_MAX_REQUEST_BYTES = ACCOUNT_IMPORT_MAX_BYTES + 1024;
 export const ACCOUNT_IMPORT_DEADLINE_MS = 600_000;
 export const ACCOUNT_IMPORT_MAX_RECORDS = 25;
 export const ACCOUNT_IMPORT_MAX_EMAIL_LENGTH = 254;
+/** Google Cloud project ids are 6–30 characters; anything longer cannot name a project. */
+export const ACCOUNT_IMPORT_MAX_PROJECT_ID_LENGTH = 30;
 export const ACCOUNT_IMPORT_MAX_REFRESH_TOKEN_BYTES = 16 * 1024;
 
 export type AccountImportStatus = "imported" | "updated" | "failed" | "unsupported";
@@ -65,6 +67,11 @@ export function throwIfAccountImportAborted(signal?: AbortSignal): void {
 export interface CockpitAccountRecord {
   email: string;
   refreshToken: string;
+  /**
+   * Operator-supplied Cloud Code Assist project, used only when automatic discovery finds none
+   * and only after the account's own token proves it can use that project.
+   */
+  projectId?: string;
 }
 
 export type ParsedCockpitRecord =

package/src/oauth/chatgpt-shared.ts

@@ -46,7 +46,16 @@ export function extractEmail(idToken?: string, accessToken?: string): string | u
     if (!token) continue;
     const payload = decodeJwtPayload(token);
     if (!payload) continue;
-    if (typeof payload.email === "string") return payload.email.toLowerCase();
+    if (typeof payload.email === "string" && payload.email.trim()) {
+      return payload.email.trim().toLowerCase();
+    }
+    const profile = payload["https://api.openai.com/profile"];
+    if (profile && typeof profile === "object" && !Array.isArray(profile)) {
+      const email = (profile as Record<string, unknown>).email;
+      if (typeof email === "string" && email.trim()) {
+        return email.trim().toLowerCase();
+      }
+    }
   }
   return undefined;
 }

package/src/oauth/dsh.ts

@@ -9,6 +9,7 @@
  */
 
 import type { OAuthController, OAuthCredentials } from "./types";
+import { readBoundedResponseBody } from "../lib/bounded-body";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { existsSync, readFileSync } from "node:fs";
@@ -16,6 +17,20 @@ import { existsSync, readFileSync } from "node:fs";
 export const DSH_PLATFORM_ORIGIN = "https://platform.deepseek.com";
 export const DSH_INFERENCE_ORIGIN = "https://api.deepseek.com/anthropic";
 
+/**
+ * Byte ceiling for the profile document returned by /auth-api/v0/users/current.
+ *
+ * A legitimate profile is a small fixed-shape JSON object (code, data.biz_code,
+ * biz_data.id/email/id_profile{name,picture}) well under a few KiB; 64 KiB matches
+ * the shared bounded-body ceiling and still leaves orders of magnitude of
+ * headroom. Anything larger is rejected before parsing so a hostile or broken
+ * upstream cannot turn an import validation into unbounded memory work.
+ */
+export const DSH_PROFILE_MAX_BYTES = 64 * 1024;
+
+/** Wall-clock budget for the profile request and its body read, in milliseconds. */
+const DSH_PROFILE_FETCH_TIMEOUT_MS = 10_000;
+
 export interface DshAccountDetectionResult {
   detected: boolean;
   token?: string;
@@ -80,7 +95,7 @@ export async function validateDshAccountToken(
   signal?: AbortSignal,
 ): Promise<DshValidatedAccountIdentity> {
   try {
-    const timeoutSignal = AbortSignal.timeout(10_000);
+    const timeoutSignal = AbortSignal.timeout(DSH_PROFILE_FETCH_TIMEOUT_MS);
     const combinedSignal = signal ? AbortSignal.any([signal, timeoutSignal]) : timeoutSignal;
     const response = await fetch(`${DSH_PLATFORM_ORIGIN}/auth-api/v0/users/current`, {
       method: "GET",
@@ -99,7 +114,35 @@ export async function validateDshAccountToken(
       return { valid: false, error: `Platform returned HTTP ${response.status}` };
     }
 
-    const body = (await response.json()) as {
+    // A declared length past the cap is rejected without touching the stream.
+    const declaredLength = Number(response.headers.get("content-length"));
+    if (Number.isFinite(declaredLength) && declaredLength > DSH_PROFILE_MAX_BYTES) {
+      try {
+        void response.body?.cancel(
+          new DOMException("DSH profile response is too large", "QuotaExceededError"),
+        ).catch(() => undefined);
+      } catch {
+        // Best-effort cancellation only.
+      }
+      return { valid: false, error: "PROFILE_VALIDATION_FAILED" };
+    }
+
+    // Missing or understated Content-Length still meets the cap on the decoded
+    // stream itself: once an over-limit byte is observed the retained buffer is
+    // discarded and cancellation is requested on the body. Malformed UTF-8 fails
+    // closed so a replacement character can never alter the authoritative ID.
+    const bounded = await readBoundedResponseBody(response, {
+      signal: combinedSignal,
+      maxBytes: DSH_PROFILE_MAX_BYTES,
+      totalTimeoutMs: DSH_PROFILE_FETCH_TIMEOUT_MS,
+      inactivityTimeoutMs: DSH_PROFILE_FETCH_TIMEOUT_MS,
+      fatalUtf8: true,
+    });
+    if (bounded.oversized || bounded.truncated || !bounded.displaySafe) {
+      return { valid: false, error: "PROFILE_VALIDATION_FAILED" };
+    }
+
+    const body = JSON.parse(bounded.text) as {
       code?: number;
       data?: {
         biz_code?: number;

package/src/oauth/index.ts

@@ -1672,7 +1672,7 @@ export async function runLogin(
         : existing.accountId && cred.accountId
           ? existing.accountId === cred.accountId
           : existing.email && cred.email
-            ? existing.email.toLowerCase() === cred.email.toLowerCase()
+            ? existing.email.trim().toLowerCase() === cred.email.trim().toLowerCase()
             : false;
       if (!identityMatches) {
         throw new OAuthReauthIdentityMismatchError();

package/src/oauth/kimi.ts

@@ -4,6 +4,7 @@ import * as os from "node:os";
 import { join } from "node:path";
 import { randomUUID } from "node:crypto";
 import { recordOwnedConfigPath } from "../lib/config-ownership";
+import { assertNotRealHomeUnderTest } from "../lib/test-home-guard";
 import { getConfigDir } from "../config";
 import type { OAuthController, OAuthCredentials } from "./types";
 
@@ -107,6 +108,7 @@ function getDeviceId(): string {
     if ((e as { code?: string })?.code !== "ENOENT") throw e;
   }
   const id = randomUUID().replace(/-/g, "");
+  assertNotRealHomeUnderTest(getConfigDir());
   recordOwnedConfigPath(getConfigDir(), p);
   if (!existsSync(getConfigDir())) mkdirSync(getConfigDir(), { recursive: true });
   writeFileSync(p, id + "\n", { mode: 0o600 });

package/src/oauth/kiro.ts

@@ -205,11 +205,54 @@ function profileArnFromWhoami(parsed: Record<string, unknown>): string | undefin
       : undefined);
 }
 
+/**
+ * `kiro-cli whoami --format json` prints its identity as one JSON object, but once an IAM Identity
+ * Center profile is selected kiro-cli 2.32 follows that object with a human-readable `Profile:`
+ * block on stdout. Parsing the whole stream then failed, which silently dropped the user email that
+ * tells organization users apart (#6641). Only the leading top-level object is identity evidence;
+ * it must start the output and end its line, so text on later lines is ignored while a second
+ * value on the same line makes the identity unreadable.
+ */
+function parseWhoamiObject(stdout: string): Record<string, unknown> | undefined {
+  const start = stdout.search(/\S/);
+  if (start < 0 || stdout[start] !== "{") return undefined;
+  let depth = 0;
+  let inString = false;
+  let escaped = false;
+  for (let index = start; index < stdout.length; index++) {
+    const char = stdout[index];
+    if (inString) {
+      if (escaped) escaped = false;
+      else if (char === "\\") escaped = true;
+      else if (char === "\"") inString = false;
+      continue;
+    }
+    if (char === "\"") inString = true;
+    else if (char === "{" || char === "[") depth++;
+    else if (char === "}" || char === "]") {
+      depth--;
+      if (depth > 0) continue;
+      if (!/^[ \t]*(?:\r?\n|$)/.test(stdout.slice(index + 1))) return undefined;
+      const parsed: unknown = JSON.parse(stdout.slice(start, index + 1));
+      return parsed && typeof parsed === "object" && !Array.isArray(parsed)
+        ? parsed as Record<string, unknown>
+        : undefined;
+    }
+  }
+  return undefined;
+}
+
+/**
+ * Same-session identity reported by `kiro-cli whoami --format json`: the lower-cased user email
+ * and a structurally valid profile ARN. Any failure (non-zero exit, unreadable output, a thrown
+ * runner) yields an empty identity, so a login falls back to the SQLite import instead of failing.
+ */
 async function readKiroCliIdentity(runner: KiroCliRunner, signal?: AbortSignal): Promise<{ email?: string; profileArn?: string }> {
   try {
     const result = await runner(["whoami", "--format", "json"], signal);
     if (result.exitCode !== 0) return {};
-    const parsed = JSON.parse(result.stdout) as Record<string, unknown>;
+    const parsed = parseWhoamiObject(result.stdout);
+    if (!parsed) return {};
     const email = typeof parsed.email === "string" ? parsed.email.trim().toLowerCase() : "";
     const profileArn = profileArnFromWhoami(parsed);
     return {

package/src/oauth/login-flow-state.ts

@@ -297,14 +297,23 @@ export function clearLoginState(provider: string): void {
 /**
  * Cancel one login. `flowId` names it exactly; without one the provider's newest in-flight flow
  * is cancelled, which is every single-flow caller (GUI, CLI) unchanged. A flow id belonging to a
- * different provider is refused rather than cancelled.
+ * different provider is refused rather than cancelled. Only the public OAuth cancellation
+ * endpoint opts into failed-outcome dismissal; callers using this boolean as proof of an
+ * aborted controller (Codex flow ownership) retain their original contract.
  */
-export function cancelLoginFlow(provider: string, flowId?: string): boolean {
+export function cancelLoginFlow(provider: string, flowId?: string, options?: { dismissSettledFailure?: boolean }): boolean {
   const flowKey = flowId ?? latestLoginFlowKey(provider);
   if (flowKey === undefined) return false;
   const active = loginAbort.get(flowKey);
   const existing = loginState.get(flowKey);
   if ((active?.provider ?? loginFlowProvider(flowKey)) !== provider) return false;
+  if (options?.dismissSettledFailure && !active && existing?.done && existing.error) {
+    // A failed add-account attempt does not invalidate a previously signed-in account. Let
+    // its owner dismiss the stale UI outcome without erasing credentials or another flow.
+    clearManualCodeSlot(flowKey);
+    dropLoginFlow(flowKey);
+    return true;
+  }
   if (!active && (!existing || existing.done)) return false;
   abandonLoginFlow(flowKey, { error: "Login cancelled", errorCode: "no_pending_login" });
   return true;

package/src/oauth/nous.ts

@@ -35,10 +35,11 @@
  */
 import { createHash } from "node:crypto";
 import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
 import type { OAuthController, OAuthCredentials } from "./types";
 import { getAuthStorePath } from "./store";
 import { atomicWriteFile, hardenConfigDir, hardenExistingSecret } from "../config";
+import { assertNotRealHomeUnderTest } from "../lib/test-home-guard";
 import { BOUNDED_BODY_MAX_BYTES, readBoundedResponseBytes } from "../lib/bounded-body";
 
 export const NOUS_PORTAL_BASE_URL = "https://portal.nousresearch.com";
@@ -220,6 +221,8 @@ function readRefreshIntent(refreshToken: string): RefreshIntent | undefined {
 }
 
 function writeRefreshIntent(refreshToken: string, status: RefreshIntentStatus): void {
+  // Before the mkdir/chmod below, which would otherwise touch the real home first.
+  assertNotRealHomeUnderTest(dirname(getAuthStorePath()));
   const dir = refreshIntentDir();
   // Hardened, owner-only directory + atomic (temp+rename) write. Throws on
   // failure so the caller can fail closed instead of refreshing blind.

package/src/oauth/store.ts

@@ -203,6 +203,7 @@ export function peekOAuthRefreshIntent(provider: string, accountId: string): OAu
 }
 export function writeOAuthRefreshIntent(provider: string, accountId: string, generation: string, createdAt = Date.now(), flightId?: string): OAuthRefreshIntent {
   const dir = getConfigDir();
+  assertNotRealHomeUnderTest(dir);
   if (!existsSync(dir)) mkdirSync(dir, { recursive: true, mode: 0o700 });
   hardenConfigDir();
   const intent: OAuthRefreshIntent = {
@@ -1152,7 +1153,7 @@ export async function upsertCredentialByIdentity(
       return Boolean(
         safe.email
         && account.credential.email
-        && account.credential.email.toLowerCase() === safe.email.toLowerCase(),
+        && account.credential.email.trim().toLowerCase() === safe.email.trim().toLowerCase(),
       );
     };
     const existing = safe.accountId

package/src/protocols/codecs/chat.ts

@@ -6,12 +6,12 @@
  * (`src/chat/inbound.ts`), including its validation and the fields it drops, which
  * `src/protocols/features.ts` declares.
  */
-import { chatCompletionsToResponsesBody, chatSettingsToResponsesBody } from "../../chat/inbound";
+import { chatCompletionsToResponsesBody, chatSettingsToResponsesBody, type ChatResponsesProjectionOptions } from "../../chat/inbound";
 import { featuresFromChatBody } from "../features";
 
 /** Project a Chat Completions body onto the internal Responses bridge body. */
-export function chatToResponsesBody(body: unknown): Record<string, unknown> {
-  return chatCompletionsToResponsesBody(body);
+export function chatToResponsesBody(body: unknown, options?: ChatResponsesProjectionOptions): Record<string, unknown> {
+  return chatCompletionsToResponsesBody(body, options);
 }
 
 /**

package/src/protocols/encoders/adapter-events.ts

@@ -109,7 +109,13 @@ export interface ClientWireWriter {
   text(delta: string): void;
   messageDone(): void;
   reasoning(delta: string, itemId: string, channel: "summary" | "raw"): void;
-  reasoningDone(item: { itemId: string; signature?: string; redacted?: string[] }): void;
+  /** `hidden`: the signature covers thinking text the client was not shown (the bridge's `txt`). */
+  reasoningDone(item: { itemId: string; signature?: string; redacted?: string[]; hidden?: true }): void;
+  /**
+   * An Anthropic progress update: `text` is shown as content and is also the signed thinking
+   * block's text. Optional — a writer without it renders the update as ordinary text.
+   */
+  progressThinking?(text: string, signature: string): void;
   toolStart(call: ClientToolCall): void;
   toolArgsDelta(itemId: string, delta: string): void;
   toolArgsDone(itemId: string, args: string): void;
@@ -331,6 +337,8 @@ export function encodeAdapterEventStream(
   let currentRawReasoning: { itemId: string } | null = null;
   let pendingSignature: string | undefined;
   let pendingRedacted: string[] = [];
+  // The bridge's hiddenThinking: non-empty thinking text suppressed by hideThinkingSummary.
+  let hiddenThinkingSeen = false;
   let hiddenRawBytes = 0;
   let pendingKiroRedacted: string | undefined;
   let currentToolCall: OpenToolCall | null = null;
@@ -367,9 +375,11 @@ export function encodeAdapterEventStream(
   };
   // hideThinkingSummary: a signed or redacted block still round-trips as an envelope-only item.
   const flushHiddenReasoningEnvelope = () => {
+    const hidden = hiddenThinkingSeen;
+    hiddenThinkingSeen = false;
     const envelope = takeReasoningEnvelope();
     if (!envelope) return;
-    writer.reasoningDone({ itemId: `rs_${uuid()}`, ...envelope });
+    writer.reasoningDone({ itemId: `rs_${uuid()}`, ...envelope, ...(hidden ? { hidden: true as const } : {}) });
   };
   const flushHiddenRawReasoning = () => {
     if (hiddenRawBytes === 0) return;
@@ -570,6 +580,19 @@ export function encodeAdapterEventStream(
             break;
           }
           case "text_delta": {
+            if (event.anthropicThinkingSignature && writer.progressThinking) {
+              // The bridge's progress items: close everything, the carrier, then the visible copy.
+              if (currentMsg) closeCurrentMessage();
+              if (currentReasoning) closeCurrentReasoning();
+              if (currentRawReasoning) closeCurrentRawReasoning();
+              flushHiddenRawReasoning();
+              flushHiddenReasoningEnvelope();
+              if (currentToolCall) closeCurrentToolCall();
+              writer.progressThinking(event.text, event.anthropicThinkingSignature);
+              writer.text(event.text);
+              writer.messageDone();
+              break;
+            }
             if (currentReasoning) closeCurrentReasoning();
             if (currentRawReasoning) closeCurrentRawReasoning();
             flushHiddenRawReasoning();
@@ -585,6 +608,7 @@ export function encodeAdapterEventStream(
           }
           case "thinking_delta": {
             if (options.hideThinkingSummary) {
+              if (event.thinking.length > 0) hiddenThinkingSeen = true;
               flushHiddenRawReasoning();
               break;
             }

package/src/protocols/encoders/chat.ts

@@ -13,6 +13,7 @@ import type { AdapterEvent } from "../../types";
 import type { TranslatorBudget } from "../../lib/translator-budget";
 import { responsesUsage } from "../../bridge/internal";
 import {
+  appendedUtf8Bytes,
   chatCompletionsErrorResponse,
   chatCompletionsFailedResponse,
   chatCompletionsIncompleteOutcome,
@@ -32,6 +33,7 @@ import {
   type ClientWireWriter,
 } from "./adapter-events";
 import type { RelayedEventObservation } from "../../usage/attempt-delivery";
+import { reasoningDetailEntries } from "../../chat/reasoning-details";
 
 type Rec = Record<string, unknown>;
 
@@ -54,6 +56,41 @@ function createChatCompletionWriter(sink: ClientFrameSink, model: string): Clien
   const emittedToolIndexes = new Set<number>();
   let nextToolIndex = 0;
   let staged: { text: string; observation?: RelayedEventObservation }[] | undefined;
+  // #7429: the shown thinking text of the open reasoning item, which its signature pairs with.
+  const budget = sink.budget;
+  let reasoningItemId: string | undefined;
+  let reasoningText = "";
+  let reasoningTextBytes = 0;
+  let nextReasoningDetailIndex = 0;
+  const releaseReasoningText = () => {
+    budget.releaseRetained(reasoningTextBytes, { kind: "reasoning" });
+    reasoningItemId = undefined;
+    reasoningText = "";
+    reasoningTextBytes = 0;
+  };
+  const retainReasoningText = (itemId: string, delta: string) => {
+    if (reasoningItemId !== itemId) releaseReasoningText();
+    reasoningItemId = itemId;
+    const nextBytes = appendedUtf8Bytes(reasoningText, reasoningTextBytes, delta);
+    const reservation = budget.reserveTransient(nextBytes, { kind: "reasoning" });
+    try {
+      reasoningText += delta;
+      reservation.commitRetained();
+      budget.releaseRetained(reasoningTextBytes, { kind: "reasoning" });
+      reasoningTextBytes = nextBytes;
+    } catch (error) {
+      reservation.release();
+      throw error;
+    }
+  };
+  const emitReasoningDetails = (entries: Rec[]) => {
+    if (entries.length === 0) return;
+    nextReasoningDetailIndex += entries.length;
+    ensureRole();
+    const frame = chunkBase(id, model, created);
+    frame.choices = [{ index: 0, delta: { reasoning_details: entries }, finish_reason: null }];
+    emit(frame);
+  };
 
   const emit = (payload: Rec | "[DONE]", observation?: RelayedEventObservation) => {
     if (failed) return;
@@ -138,15 +175,30 @@ function createChatCompletionWriter(sink: ClientFrameSink, model: string): Clien
       emit(frame, { semanticBytes: Buffer.byteLength(delta) });
     },
     messageDone() { /* the converter reads nothing from a finished message */ },
-    reasoning(delta) {
+    reasoning(delta, itemId, channel) {
       if (!delta) return;
       ensureRole();
       // Many OpenAI-compatible clients accept reasoning_content; harmless if ignored.
       const frame = chunkBase(id, model, created);
       frame.choices = [{ index: 0, delta: { reasoning_content: delta }, finish_reason: null }];
       emit(frame, { semanticBytes: Buffer.byteLength(delta) });
+      // Only summary-channel thinking can carry a signature; raw reasoning never does.
+      if (channel === "summary") retainReasoningText(itemId, delta);
+    },
+    reasoningDone({ itemId, signature, redacted, hidden }) {
+      // The bridge converter's output_item.done for a reasoning item (#7429), entry for entry.
+      const entries = reasoningDetailEntries({
+        text: reasoningItemId === itemId ? reasoningText : "",
+        ...(signature ? { signature } : {}),
+        ...(redacted ? { redacted } : {}),
+        ...(hidden ? { hidden } : {}),
+      }, nextReasoningDetailIndex);
+      releaseReasoningText();
+      emitReasoningDetails(entries);
+    },
+    progressThinking(text, signature) {
+      emitReasoningDetails(reasoningDetailEntries({ text, signature }, nextReasoningDetailIndex));
     },
-    reasoningDone() { /* reasoning items carry nothing a Chat client reads */ },
     toolStart(call) {
       // Custom and tool-search calls have no Chat representation; the converter skips them.
       if (call.kind !== "function") return;
@@ -198,7 +250,7 @@ function createChatCompletionWriter(sink: ClientFrameSink, model: string): Clien
         type: "upstream_error",
       });
     },
-    dispose() { /* nothing retained beyond the driver's frames */ },
+    dispose() { releaseReasoningText(); },
   };
 }
 

package/src/providers/claude-cli-usage.ts

@@ -4,7 +4,8 @@ import { bindRawDecisionWindows } from "./quota-decision-publication";
 import { decisionQuotaSinkActive } from "../lib/decision-quota-sink";
 import { CLAUDE_CLI_USER_AGENT } from "./claude-cli-identity";
 import { asRecord, normalizePercent, normalizeResetAt, readQuotaJson, REQUEST_TIMEOUT_MS } from "./quota-wire";
-import type { ProviderQuota, ProviderQuotaWindow } from "./quota-types";
+import type { ProviderQuota, ProviderQuotaWindow, QuotaFailureCode } from "./quota-types";
+import { httpQuotaFailure } from "./quota/failure-codes";
 const hasQuotaRows = (q: ProviderQuota) => q.fiveHourPercent !== undefined || q.weeklyPercent !== undefined || Boolean(q.customWindows?.length);
 
 function parseClaudeBucket(value: unknown): { percent?: number; resetAt?: number } | null {
@@ -46,6 +47,16 @@ function parseClaudeLimit(value: unknown): ProviderQuotaWindow | null {
 
 /** Read the Anthropic OAuth usage endpoint for an access token and return the parsed quota, or null on a non-OK or malformed response. */
 export async function readAnthropicUsageQuota(accessToken: string): Promise<ProviderQuota | null> {
+  return (await probeAnthropicUsageQuota(accessToken)).quota;
+}
+
+/** A usage read plus, when it yields no quota, the closed reason why. A thrown fetch still throws. */
+export interface AnthropicUsageProbe {
+  quota: ProviderQuota | null;
+  failure?: QuotaFailureCode;
+}
+
+export async function probeAnthropicUsageQuota(accessToken: string): Promise<AnthropicUsageProbe> {
   const response = await fetch("https://api.anthropic.com/api/oauth/usage", {
     headers: {
       Accept: "application/json, text/plain, */*",
@@ -56,9 +67,12 @@ export async function readAnthropicUsageQuota(accessToken: string): Promise<Prov
     },
     signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
   });
-  if (!response.ok) return null;
+  if (!response.ok) {
+    try { await response.body?.cancel(); } catch { /* Best-effort release; the status is the diagnosis. */ }
+    return { quota: null, failure: httpQuotaFailure(response.status) };
+  }
   const body = asRecord(await readQuotaJson(response));
-  if (!body) return null;
+  if (!body) return { quota: null, failure: "response_unusable" };
   const fiveHour = parseClaudeBucket(body.five_hour);
   const sevenDay = parseClaudeBucket(body.seven_day);
   const fable = parseClaudeBucket(body.seven_day_fable);
@@ -93,9 +107,10 @@ export async function readAnthropicUsageQuota(accessToken: string): Promise<Prov
   };
   if (decisionQuotaSinkActive()) bindRawDecisionWindows(quota, rawAnthropicUsageWindows(body, quota.updatedAt));
   // Empty / schema-changed payloads must not cache as "success with no bars".
-  return hasQuotaRows(quota) ? markAnthropicFamilyEnumeration(quota, Array.isArray(body.limits) && body.limits.every(raw => {
+  if (!hasQuotaRows(quota)) return { quota: null, failure: "response_unusable" };
+  return { quota: markAnthropicFamilyEnumeration(quota, Array.isArray(body.limits) && body.limits.every(raw => {
     const kind = asRecord(raw)?.kind;
     return kind === "session" || kind === "weekly_all" || kind === "weekly_scoped" && parseClaudeLimit(raw) !== null;
-  })) : null;
+  })) };
 }
 

package/src/providers/initial-model-selection.ts

@@ -3,7 +3,7 @@ import { randomUUID } from "node:crypto";
 import { getProviderRegistryEntry, providerMatchesRegistryTransport } from "./registry";
 import { routedSlug, slugEquivalenceKey } from "./slug-codec";
 import { comboDisabledModelSelectors } from "../combos/types";
-import { providerUsesKeyAuthOverride, resolveProviderApiKey } from "./key-store";
+import { providerUsesKeyAuthOverride } from "./key-store";
 
 export const INITIAL_MODEL_SELECTION_THRESHOLD = 20;
 type Selection = NonNullable<OcxProviderConfig["initialModelSelection"]>;
@@ -31,7 +31,7 @@ function loginConnection(name: string, provider: OcxProviderConfig): boolean {
   if (entry && providerMatchesRegistryTransport(name, provider)) {
     if (entry.authKind === "forward") return true;
     if (entry.authKind === "oauth") {
-      return !providerUsesKeyAuthOverride(entry, provider, resolveProviderApiKey(provider.apiKey));
+      return !providerUsesKeyAuthOverride(entry, provider);
     }
   }
   return provider.authMode === "oauth" || provider.authMode === "forward";