@bitkyc08/opencodex 2.90.0 → 2.92.0

package/src/combos/jev-quota-activation.ts

@@ -15,9 +15,10 @@
  */
 import {
   clearDecisionAccountQuotas, invalidateDecisionKeyQuotas, observeDecisionKeyCredential, publishDecisionAccountQuota,
-  publishDecisionKeyQuota, publishDecisionQuotaRoster, readLoadedDecisionKeyQuota, readLoadedDecisionQuotaPool,
+  publishDecisionKeyQuota, publishDecisionQuotaRoster, readLoadedDecisionKeyQuota, readLoadedDecisionQuotaPool, replaceDecisionKeyQuotas,
   setDecisionAccountUsable, withdrawDecisionQuotaRoster,
 } from "../providers/quota-decision-snapshot";
+import { captureAntigravityReceipt, observeAntigravityQuotaStore, replaceAntigravityQuotas } from "../providers/quota-decision-antigravity";
 import { registerDecisionQuotaSink, type DecisionQuotaSink, type MainDecisionRow } from "../lib/decision-quota-sink";
 import { registerLiveConfigObserver } from "../lib/state-store-registrations";
 import { getConfigDir } from "../config/paths";
@@ -32,6 +33,7 @@ const POOL_PROVIDERS = ["anthropic", "codex", "codex-main"] as const;
 
 /** Project an auth store the owner already read into the secret-free Anthropic roster (primary pool only); a failure withdraws so the pool reads as unknown. The generation is a one-way digest of the credential, never the credential itself. */
 function publishAuthDecisionQuotaRoster(store: AuthStore): void {
+  observeAntigravityQuotaStore(store);
   try {
     publishDecisionQuotaRoster("anthropic", (store.anthropic?.accounts ?? []).map(row => ({
       id: row.id,
@@ -82,6 +84,8 @@ const snapshotSink: DecisionQuotaSink = {
   mainRosterChanged: row => publishMainRow(row),
   readKeyQuota: readLoadedDecisionKeyQuota,
   readPool: readLoadedDecisionQuotaPool,
+  captureAntigravityReceipt,
+  replaceCollectedQuotas: (keys, oauth) => { replaceDecisionKeyQuotas(keys); replaceAntigravityQuotas(oauth); },
 };
 
 let active: { detach: () => void; root: string } | undefined;

package/src/combos/jev-quota-route.ts

@@ -7,7 +7,7 @@ export function jevQuotaCandidates(options: ResolveJevDecisionOptions): readonly
   const tiers = normalizeJevQuotaTiers(options.decisionQuotaTiers) ?? JEV_QUOTA_DEFAULT_TIERS;
   const now = (options.now ?? Date.now)();
   return options.candidates.map(candidate => ({ ...candidate,
-    quota: jevQuotaSignalForTarget(options.config, candidate.provider, candidate.model, now, tiers) }));
+    quota: candidate.quotaIdentity === null ? { tier: "unknown" as const } : jevQuotaSignalForTarget(options.config, candidate.quotaIdentity?.provider ?? candidate.provider, candidate.quotaIdentity?.model ?? candidate.model, now, tiers) }));
 }
 /** Attach the per-tier quota summary to a decision when any candidate carried quota evidence. */
 export function withJevQuotaSummary(decision: JevDecision, candidates: readonly JevCandidate[]): JevDecision {

package/src/combos/jev-quota.ts

@@ -6,6 +6,7 @@ import type { DecisionQuotaWindow } from "../providers/quota-decision-snapshot";
 import { readLoadedDecisionKeyQuota, readLoadedDecisionQuotaPool } from "../lib/decision-quota-sink";
 import { isCanonicalOpenAiForwardProvider } from "../providers/openai-tiers-destination";
 import { providerCodexAccountMode } from "../providers/registry";
+import { isAntigravityArgonIdentity } from "../providers/antigravity-quota-identity";
 import { NATIVE_RESERVE_MODEL } from "../codex/catalog/native-models";
 import { isSelectableCodexPoolAccount, MAIN_CODEX_ACCOUNT_ID } from "../codex/account-id";
 import { JEV_QUOTA_DEFAULT_TIERS, jevQuotaRank, jevQuotaTier, type JevQuotaTier, type ResolvedJevQuotaTiers, type JevQuotaDecisionSummary } from "./jev-quota-config";
@@ -18,11 +19,18 @@ export interface JevQuotaSignal {
 }
 /** Build the signal used when evidence is missing, stale or invalid; it ties healthy. */
 const unknown = (): JevQuotaSignal => ({ tier: "unknown" });
+/** Antigravity quota buckets are metered per model family; Gemini and Claude/3P draw from separate counters. */
+function antigravityFamily(model: string): DecisionQuotaWindow["family"] {
+  const id = model.toLowerCase();
+  if (isAntigravityArgonIdentity(id)) return undefined;
+  return id.startsWith("gemini-") ? "gem" : id.startsWith("claude-") ? "cla" : undefined;
+}
 /** Reduce decision quota windows to the worst applicable window for a model, ignoring cold, stale, future, invalid or reset-expired rows. */
 export function jevQuotaSignalFromWindows(windows: readonly DecisionQuotaWindow[] | undefined, model: string, now: number, tiers = JEV_QUOTA_DEFAULT_TIERS): JevQuotaSignal {
   let worst: DecisionQuotaWindow | undefined;
   for (const row of windows ?? []) {
-    if (!["5h", "weekly", "monthly"].includes(row.window) && anthropicModelFamily(model)?.toLowerCase() !== row.window) continue;
+    if (row.family !== undefined) { if (row.family !== antigravityFamily(model)) continue; }
+    else if (!["5h", "weekly", "monthly"].includes(row.window) && anthropicModelFamily(model)?.toLowerCase() !== row.window) continue;
     if (!Number.isFinite(now) || now < 0 || !Number.isFinite(row.observedAt) || row.observedAt < 0 || row.observedAt > now
       || now - row.observedAt > JEV_QUOTA_SIGNAL_MAX_AGE_MS || !Number.isFinite(row.percent) || row.percent < 0 || row.percent > 100
       || row.resetAt !== undefined && (!Number.isFinite(row.resetAt) || row.resetAt < 0 || row.resetAt <= now)) continue;

package/src/combos/jev-session-pin-config.ts

@@ -0,0 +1,51 @@
+/**
+ * Opt-in JEV session pin settings (#7525). Dependency-free so combo validation, the management
+ * API and the CLI share one grammar and one range.
+ */
+
+/** Shortest idle window a pin may be configured with. */
+export const JEV_SESSION_PIN_TTL_MIN_MS = 60_000;
+/** Longest idle window a pin may be configured with (one day). */
+export const JEV_SESSION_PIN_TTL_MAX_MS = 86_400_000;
+
+export interface JevSessionPinConfig {
+  /** Idle window after the last successful pinned turn; a quieter session is decided afresh. */
+  ttlMs: number;
+}
+
+/**
+ * Closed persisted vocabulary: `session` marks a turn that reused its pin; every other value names
+ * why an existing pin was released before a fresh decision.
+ */
+export const JEV_SESSION_PIN_REASONS = [
+  "session",
+  "expired",
+  "config_changed",
+  "target_unavailable",
+  "effort_unavailable",
+  "quota_nearly_exhausted",
+] as const;
+export type JevSessionPinReason = (typeof JEV_SESSION_PIN_REASONS)[number];
+export type JevSessionPinRelease = Exclude<JevSessionPinReason, "session">;
+
+/** The canonical pin setting, or undefined for anything that is not exactly `{ ttlMs }` in range. */
+export function normalizeJevSessionPin(value: unknown): JevSessionPinConfig | undefined {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return undefined;
+  const keys = Object.keys(value);
+  if (keys.length !== 1 || keys[0] !== "ttlMs") return undefined;
+  const ttlMs = (value as { ttlMs?: unknown }).ttlMs;
+  return typeof ttlMs === "number" && Number.isSafeInteger(ttlMs)
+    && ttlMs >= JEV_SESSION_PIN_TTL_MIN_MS && ttlMs <= JEV_SESSION_PIN_TTL_MAX_MS
+    ? { ttlMs }
+    : undefined;
+}
+
+const DURATION_UNITS_MS: Readonly<Record<string, number>> = { ms: 1, s: 1_000, m: 60_000, h: 3_600_000 };
+
+/** Parse `90s`, `20m`, `1h` or bare milliseconds into an in-range TTL, else undefined. */
+export function parseJevSessionPinDuration(raw: string): number | undefined {
+  const match = /^(\d{1,9})(ms|s|m|h)?$/.exec(raw.trim());
+  if (!match) return undefined;
+  const ttlMs = Number(match[1]) * DURATION_UNITS_MS[match[2] ?? "ms"]!;
+  return ttlMs >= JEV_SESSION_PIN_TTL_MIN_MS && ttlMs <= JEV_SESSION_PIN_TTL_MAX_MS ? ttlMs : undefined;
+}

package/src/combos/jev.ts

@@ -80,6 +80,8 @@ export interface JevCandidate {
   /** Optional operator note sent as decision evidence for this target only. */
   modelProfile?: string;
   quota?: JevQuotaSignal;
+  /** Internal native identity from ordinary routing; never replaces the configured allowlist. */
+  quotaIdentity?: { provider: string; model: string } | null;
 }
 
 /**
@@ -107,6 +109,10 @@ export interface JevDecision {
   confidence?: number;
   chosenProbability?: number;
   usage?: Record<string, number>;
+  /** Set when an opt-in session pin (#7525) supplied this decision without asking the backend. */
+  pinned?: true;
+  /** `session` with `pinned`; otherwise why an existing session pin was released first. */
+  pinReason?: import("./jev-session-pin-config").JevSessionPinReason;
 }
 
 export interface ResolveJevDecisionOptions {

package/src/combos/resolve.ts

@@ -74,6 +74,18 @@ function targetProviderIsUsable(config: OcxConfig, target: OcxComboTarget, now:
   return providerExclusionReason(config, target, now) === undefined;
 }
 
+/**
+ * OCX-11: the coarse fallback trigger for a target the picker passed over for a reason other
+ * than a cooldown (provider missing or disabled, cached quota spent, ineligible for the request).
+ */
+export function comboTargetSkipTrigger(
+  config: OcxConfig,
+  target: OcxComboTarget,
+  now = Date.now(),
+): "quota_exhausted" | "unavailable" {
+  return providerExclusionReason(config, target, now) === "quota exhausted" ? "quota_exhausted" : "unavailable";
+}
+
 /**
  * Why each target of a combo cannot be picked right now, for a zero-attempt refusal. Only the
  * configured provider/model and a coarse label are named, never account or request data.

package/src/combos/types.ts

@@ -1,4 +1,10 @@
 import { normalizeJevQuotaTiers, type ResolvedJevQuotaTiers } from "./jev-quota-config";
+import {
+  JEV_SESSION_PIN_TTL_MAX_MS,
+  JEV_SESSION_PIN_TTL_MIN_MS,
+  normalizeJevSessionPin,
+  type JevSessionPinConfig,
+} from "./jev-session-pin-config";
 import { isCodexReasoningEffort, isDeclaredReasoningEffort } from "../reasoning-effort";
 import { SUPPORTED_NATIVE_OPENAI_SLUGS } from "../codex/catalog/native-models";
 import type { OcxComboConfig, OcxComboCooldownWaitPolicy, OcxComboDefaultEffort, OcxComboDefaultEffortMode, OcxComboReasoningEffortMode, OcxComboStrategy, OcxComboTarget, OcxProviderConfig } from "../types";
@@ -79,6 +85,8 @@ export interface NormalizedComboConfig {
   decisionTimeoutMs?: number;
   decisionQuotaSignals?: boolean;
   decisionQuotaTiers?: ResolvedJevQuotaTiers;
+  /** JEV only, opt-in: keep a session on the target JEV chose for it (#7525). */
+  sessionPin?: JevSessionPinConfig;
   targets: NormalizedComboTarget[];
 }
 
@@ -310,6 +318,16 @@ export function comboConfigIssues(
     if (field === "decisionQuotaSignals" ? typeof body[field] !== "boolean" : !normalizeJevQuotaTiers(body[field]))
       issues.push({ path: [field], message: field === "decisionQuotaSignals" ? "decisionQuotaSignals must be a boolean" : "decisionQuotaTiers must contain finite 0..100 strictly ascending thresholds" });
   }
+  if (body.sessionPin !== undefined && body.sessionPin !== null) {
+    if (body.strategy !== "jev") {
+      issues.push({ path: ["sessionPin"], message: 'sessionPin is only valid with strategy "jev"' });
+    } else if (!normalizeJevSessionPin(body.sessionPin)) {
+      issues.push({
+        path: ["sessionPin"],
+        message: `sessionPin must be { "ttlMs": <integer from ${JEV_SESSION_PIN_TTL_MIN_MS} to ${JEV_SESSION_PIN_TTL_MAX_MS}> }`,
+      });
+    }
+  }
   if (body.decisionProvider !== undefined && body.decisionProvider !== null) {
     const decisionProvider = typeof body.decisionProvider === "string" ? body.decisionProvider.trim() : "";
     if (!decisionProvider) {
@@ -533,6 +551,7 @@ export function normalizeComboConfig(raw: OcxComboConfig): NormalizedComboConfig
     ...(typeof raw.decisionTimeoutMs === "number" ? { decisionTimeoutMs: raw.decisionTimeoutMs } : {}),
     ...(raw.strategy === "jev" && raw.decisionQuotaSignals === true ? { decisionQuotaSignals: true } : {}),
     ...(raw.strategy === "jev" && normalizeJevQuotaTiers(raw.decisionQuotaTiers) ? { decisionQuotaTiers: normalizeJevQuotaTiers(raw.decisionQuotaTiers)! } : {}),
+    ...(raw.strategy === "jev" && normalizeJevSessionPin(raw.sessionPin) ? { sessionPin: normalizeJevSessionPin(raw.sessionPin)! } : {}),
     targets: raw.targets.map(target => ({
       provider: target.provider.trim(),
       model: target.model.trim(),

package/src/config/diagnostics.ts

@@ -11,6 +11,7 @@ import { nativeReasoningRetentionConfigError } from "./schema/native-reasoning-r
 import { desktopCompatibilityConfigError } from "./schema/desktop-compatibility";
 import { blockedModelRedirectsError } from "./schema/blocked-model-redirects";
 import { mainAccountHardLockFallbackError } from "./schema/main-account-hard-lock-fallback";
+import { fallbackPolicyError } from "./schema/fallback-policy";
 import type { OcxConfig } from "../types";
 import { anthropicAccountPoolConfigError, anthropicOAuthInstanceConfigError, anthropicSidecarConfigError } from "./schema/anthropic-account-pool";
 import { configReasoningPinsConfigError } from "./provider-validation";
@@ -145,6 +146,7 @@ function validFileConfigDiagnostics(config: OcxConfig, rawParsed: unknown): Conf
   if (blockedModelRedirectsError(rawParsed)) warnings.push("blockedModelRedirects ignored: expected a map of nonempty model keys to nonempty string targets");
   if (nativeReasoningRetentionConfigError(rawParsed)) warnings.push("nativeReasoningRetention ignored: expected only optional boolean modelSwitch and accountSwitch fields; both remain off");
   if (mainAccountHardLockFallbackError(rawParsed)) warnings.push("codexMainAccountHardLockFallback ignored: expected a nonblank model selector and an optional declared reasoningEffort");
+  if (fallbackPolicyError(rawParsed)) warnings.push("fallback partly ignored: expected boolean model/provider switches, providers/routes/devices maps of them, and devices.<id>.localFallback; ignored leaves keep today's fallback behavior");
   const quotaAutoRefreshWarning = degradedCodexQuotaAutoRefreshWarning(rawParsed, normalized);
   if (quotaAutoRefreshWarning) warnings.push(quotaAutoRefreshWarning);
   if (rawEffort !== undefined && !isClaudeSubagentEffort(rawEffort)) {
@@ -729,6 +731,9 @@ export function validateConfigCandidate(value: unknown): { ok: true; config: Ocx
   const anthropicError = anthropicOAuthInstanceConfigError(value) ?? anthropicAccountPoolConfigError(value) ?? anthropicSidecarConfigError(value);
   if (anthropicError) return { ok: false, error: anthropicError };
   const boundaryError = blockedModelRedirectsError(value)
+    // OCX-11: the read schema degrades a malformed fallback leaf to absent, which would silently
+    // drop a refusal on the next whole-config save; the write boundary rejects it instead.
+    ?? fallbackPolicyError(value)
     ?? nativeReasoningRetentionConfigError(value)
     ?? mainAccountHardLockFallbackError(value)
     ?? compactionRecoveryConfigError(value) ?? desktopCompatibilityConfigError(value) ?? configReasoningPinsConfigError(value)

package/src/config/load-degrade.ts

@@ -7,6 +7,7 @@ import { nativeReasoningRetentionConfigError } from "./schema/native-reasoning-r
 import { desktopCompatibilityConfigError } from "./schema/desktop-compatibility";
 import { blockedModelRedirectsError } from "./schema/blocked-model-redirects";
 import { mainAccountHardLockFallbackError } from "./schema/main-account-hard-lock-fallback";
+import { fallbackPolicyError } from "./schema/fallback-policy";
 import { anthropicSidecarConfigError } from "./schema/anthropic-account-pool";
 import {
   modelPinnedEffortsConfigError,
@@ -142,6 +143,7 @@ export function warnDegradedTopLevelOptIns(rawParsed: unknown, validated: OcxCon
   if (desktopCompatibilityConfigError(rawParsed)) console.warn("Invalid desktopCompatibility startup preference ignored; no desktop compatibility service will start automatically.");
   if (blockedModelRedirectsError(rawParsed)) console.warn("⚠️  invalid blockedModelRedirects ignored; provider routing remains available");
   if (mainAccountHardLockFallbackError(rawParsed)) console.warn("⚠️  invalid codexMainAccountHardLockFallback ignored; the main-account hard lock still refuses while blocked");
+  if (fallbackPolicyError(rawParsed)) console.warn("⚠️  invalid fallback leaves ignored; those scopes keep today's fallback behavior");
   const chatgptDesktop = chatgptDesktopConfigIssue(rawParsed);
   if (chatgptDesktop) console.warn(`⚠️  config.json ${chatgptDesktop} — the whole chatgptDesktop block is ignored, so the ChatGPT desktop integration reads as off`);
   warnDegradedStreamMode(rawParsed, validated);

package/src/config/provider-validation.ts

@@ -1,4 +1,5 @@
 import { isCanonicalOpenAiForwardProvider } from "../providers/openai-tiers";
+import { assertWorkBuddyDestination } from "../providers/workbuddy";
 import { resolveDshAccountMessagesUrl } from "../providers/dsh-account-destination";
 import { redactSecretString } from "../lib/redact";
 import {
@@ -421,6 +422,12 @@ export function credentialPinnedProviderConfigError(
   providerName: string,
   provider: { adapter?: unknown; baseUrl?: unknown },
 ): string | null {
+  if (providerName === "workbuddy-ai" || provider.adapter === "workbuddy-ai") {
+    if (provider.adapter !== undefined && provider.adapter !== "workbuddy-ai") return 'adapter must stay "workbuddy-ai"';
+    try { if (typeof provider.baseUrl === "string") assertWorkBuddyDestination(provider.baseUrl); }
+    catch { return "WorkBuddy AI credentials require https://www.workbuddy.ai/v2"; }
+    return null;
+  }
   if (providerName !== "dsh-account") return null;
   if (provider.adapter !== undefined && provider.adapter !== "dsh-account") {
     return 'adapter must stay "dsh-account": its account token is pinned to that adapter';

package/src/config/schema/config-schema.ts

@@ -8,6 +8,7 @@ import { nativeReasoningRetentionSchema } from "./native-reasoning-retention";
 import { desktopCompatibilitySchema } from "./desktop-compatibility";
 import { blockedModelRedirectsSchema } from "./blocked-model-redirects";
 import { mainAccountHardLockFallbackSchema } from "./main-account-hard-lock-fallback";
+import { fallbackPolicySchema } from "./fallback-policy";
 import {
   agentTaskRecoverySchema,
   catalogAutoRefreshSchema,
@@ -241,6 +242,8 @@ export const configSchema = z.object({
   // A malformed fallback section disables only the reroute, never the lock's refusal
   // behavior; the management write boundary still rejects the bad value.
   codexMainAccountHardLockFallback: mainAccountHardLockFallbackSchema.optional().catch(undefined),
+  // OCX-11: a malformed section reads as absent, which keeps today's fallback behavior.
+  fallback: fallbackPolicySchema.optional().catch(undefined),
   // #2999: a malformed hand edit falls back to auto detection rather than rejecting the config.
   nativeMainRefresh: z.enum(["codex", "opencodex"]).optional().catch(undefined),
   // Future versions remain opaque through passthrough-compatible whole-config saves.

package/src/config/schema/fallback-policy.ts

@@ -0,0 +1,40 @@
+import * as z from "zod/v4";
+
+/**
+ * Read schema of `fallback` (OCX-11). A malformed leaf degrades to absent, which is today's
+ * behavior, and config diagnostics name it; the management write boundary rejects it instead.
+ * Map keys are checked by the resolver's normalization, so one bad key never drops its siblings.
+ */
+const switchValue = z.boolean().optional().catch(undefined);
+const switchesSchema = z.object({ model: switchValue, provider: switchValue });
+const deviceSchema = switchesSchema.extend({ localFallback: switchValue });
+
+export const fallbackPolicySchema = z.object({
+  model: switchValue,
+  provider: switchValue,
+  providers: z.record(z.string(), switchesSchema.catch({})).optional().catch(undefined),
+  routes: z.record(z.string(), switchesSchema.catch({})).optional().catch(undefined),
+  devices: z.record(z.string(), deviceSchema.catch({})).optional().catch(undefined),
+});
+
+export const FALLBACK_DEVICE_ID = /^(?:lnk_[0-9a-f]{16}|[A-Za-z0-9][A-Za-z0-9_.:-]{0,255})$/;
+export const FALLBACK_SELECTOR = /^[^\s]{1,256}$/;
+
+const strictSwitches = z.object({ model: z.boolean().optional(), provider: z.boolean().optional() }).strict();
+const strictPolicy = z.object({
+  model: z.boolean().optional(),
+  provider: z.boolean().optional(),
+  providers: z.record(z.string().regex(FALLBACK_SELECTOR), strictSwitches).optional(),
+  routes: z.record(z.string().regex(FALLBACK_SELECTOR), strictSwitches).optional(),
+  devices: z.record(z.string().regex(FALLBACK_DEVICE_ID), strictSwitches.extend({ localFallback: z.boolean().optional() }).strict()).optional(),
+}).strict();
+
+/** Diagnostics text for a section the read schema would partly ignore, or undefined. */
+export function fallbackPolicyError(rawConfig: unknown): string | undefined {
+  if (!rawConfig || typeof rawConfig !== "object" || Array.isArray(rawConfig)) return undefined;
+  const raw = (rawConfig as Record<string, unknown>).fallback;
+  if (raw === undefined) return undefined;
+  return strictPolicy.safeParse(raw).success
+    ? undefined
+    : "schema_invalid: fallback accepts boolean model/provider switches, providers/routes/devices maps of them, and devices.<id>.localFallback";
+}

package/src/config/schema/leaf-validators.ts

@@ -427,6 +427,7 @@ export const providerConfigSchema = z.object({
     repairInvalidIds: z.boolean().optional(),
   }).strict().optional(),
   responsesSnapshotRepair: z.boolean().optional(),
+  messagePhaseInference: z.boolean().optional(),
   hideRawReasoning: z.boolean().optional(),
   // Invalid blocks degrade to "absent" rather than failing the whole config load: an unusable
   // bridge block must never send an operator through invalid-config recovery for an opt-in