@bitkyc08/opencodex 2.90.0 → 2.92.0

package/src/oauth/index.ts

@@ -50,6 +50,8 @@ import { validateDevinApiBaseUrl } from "./devin/api-base";
 import { loginGithubCopilot, refreshGithubCopilotToken, validateCopilotApiBaseUrl } from "./github-copilot";
 import { loginCommandCode, refreshCommandCodeToken } from "./command-code";
 import { loginMetaMuse, refreshMetaMuseToken } from "./meta-muse";
+import { loginWorkBuddy, refreshWorkBuddyToken } from "./workbuddy";
+import { WORKBUDDY_CONFIG_URL, workBuddyHeaders } from "../providers/workbuddy";
 import { DSH_ACCOUNT_AUTH } from "./dsh";
 import { loginOrcaRouter, orcaRouterInferenceBaseUrl, refreshOrcaRouterKey } from "./orcarouter";
 import { ANTIGRAVITY_DISCOVERY_UA } from "../adapters/google-antigravity-wire";
@@ -98,6 +100,7 @@ import { normalizeOAuthPlan, mergeOAuthPlan } from "./plan";
 import { mergeAnthropicIdentity, type AnthropicIdentityResolver } from "./anthropic-identity";
 import { AnthropicCrossInstanceDuplicateError, AnthropicLocalCliImportError, assertAnthropicCredentialSource } from "./store-anthropic-instance";
 export interface OAuthAccessSnapshot {
+  workbuddy?: import("./types").WorkBuddyOAuthMetadata;
   provider: string;
   accountId: string;
   generation: string;
@@ -246,6 +249,11 @@ function oauthDefaultModel(id: string): string {
 }
 
 export const OAUTH_PROVIDERS: Record<string, OAuthProviderDef> = {
+  "workbuddy-ai": {
+    login: loginWorkBuddy, refresh: refreshWorkBuddyToken,
+    providerConfig: oauthConfig("workbuddy-ai"), defaultModel: oauthDefaultModel("workbuddy-ai"),
+    defaultRefreshPolicy: "lazy-only",
+  },
   "dsh-account": {
     ...DSH_ACCOUNT_AUTH,
     providerConfig: oauthConfig("dsh-account"),
@@ -561,6 +569,7 @@ function accessSnapshot(provider: string, accountId: string, cred: OAuthCredenti
     accountId,
     generation: credentialGeneration(cred),
     accessToken: cred.access,
+    ...(oauthProvider === "workbuddy-ai" && cred.workbuddy ? { workbuddy: { ...cred.workbuddy } } : {}),
     ...(cred.projectId ? { projectId: cred.projectId } : {}),
     ...(accountApiBaseUrl ? { apiBaseUrl: accountApiBaseUrl } : {}),
     ...(oauthProvider === "zed" && cred.accountId ? { providerUserId: cred.accountId } : {}),
@@ -717,6 +726,7 @@ export async function getValidAccessTokenSnapshot(
 
 /** Providers whose upstream-401 replay path may force a snapshot refresh. */
 const FORCE_REFRESH_PROVIDERS = new Set([
+  "workbuddy-ai",
   "xai",
   "github-copilot",
   "kiro",
@@ -1177,6 +1187,7 @@ function modelDiscoveryTransportSeed(providerName: string, prov: OcxProviderConf
  * `/models` + Bearer with a `{ data: [{ id, owned_by? }] }` response.
  */
 export interface ModelsRequestObservedAuth {
+  readonly workbuddy?: import("./types").WorkBuddyOAuthMetadata;
   readonly oauthApiBaseUrl?: string;
 }
 
@@ -1186,6 +1197,10 @@ export function buildModelsRequest(
   providerName = "",
   observedAuth?: ModelsRequestObservedAuth,
 ): { method?: "POST"; url: string; headers: Record<string, string> } {
+  if (providerName === "workbuddy-ai" || prov.adapter === "workbuddy-ai") {
+    const allowed = mayResolveModelsOAuth(providerName, prov);
+    return { url: WORKBUDDY_CONFIG_URL, headers: workBuddyHeaders(allowed && observedAuth?.workbuddy ? apiKey : undefined, observedAuth?.workbuddy) };
+  }
   const authorizedTarget = captureModelsOAuthTarget(providerName, prov);
   if (prov.authMode === "oauth" && !mayResolveModelsOAuth(providerName, prov)) apiKey = undefined;
   const transportSeed = modelDiscoveryTransportSeed(providerName, prov);
@@ -1672,7 +1687,7 @@ export async function runLogin(
         : existing.accountId && cred.accountId
           ? existing.accountId === cred.accountId
           : existing.email && cred.email
-            ? existing.email.toLowerCase() === cred.email.toLowerCase()
+            ? existing.email.trim().toLowerCase() === cred.email.trim().toLowerCase()
             : false;
       if (!identityMatches) {
         throw new OAuthReauthIdentityMismatchError();

package/src/oauth/kimi.ts

@@ -4,6 +4,7 @@ import * as os from "node:os";
 import { join } from "node:path";
 import { randomUUID } from "node:crypto";
 import { recordOwnedConfigPath } from "../lib/config-ownership";
+import { assertNotRealHomeUnderTest } from "../lib/test-home-guard";
 import { getConfigDir } from "../config";
 import type { OAuthController, OAuthCredentials } from "./types";
 
@@ -107,6 +108,7 @@ function getDeviceId(): string {
     if ((e as { code?: string })?.code !== "ENOENT") throw e;
   }
   const id = randomUUID().replace(/-/g, "");
+  assertNotRealHomeUnderTest(getConfigDir());
   recordOwnedConfigPath(getConfigDir(), p);
   if (!existsSync(getConfigDir())) mkdirSync(getConfigDir(), { recursive: true });
   writeFileSync(p, id + "\n", { mode: 0o600 });

package/src/oauth/model-discovery-auth.ts

@@ -1,3 +1,4 @@
+import { assertWorkBuddyDestination } from "../providers/workbuddy";
 import type { OcxProviderConfig } from "../types";
 import { isBuiltinAnthropicInstanceRow } from "../providers/anthropic-instance";
 import { resolveProviderModelDiscoveryUrl } from "../providers/model-discovery";
@@ -8,6 +9,10 @@ export function mayResolveModelsOAuth(name: string, provider: OcxProviderConfig
   // The DSH account token is pinned to its own adapter and fixed DeepSeek hosts. Its catalog is
   // static, so no discovery path may resolve it, whatever adapter or baseUrl the row was edited to.
   if (name === "dsh-account") return false;
+  if (name === "workbuddy-ai" || provider?.adapter === "workbuddy-ai") {
+    if (name !== "workbuddy-ai" || provider?.adapter !== "workbuddy-ai" || provider.disabled) return false;
+    try { assertWorkBuddyDestination(provider.baseUrl); return true; } catch { return false; }
+  }
   return name !== "anthropic2" || (provider !== undefined && provider.disabled !== true
     && isBuiltinAnthropicInstanceRow(name, provider));
 }

package/src/oauth/nous.ts

@@ -35,10 +35,11 @@
  */
 import { createHash } from "node:crypto";
 import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
 import type { OAuthController, OAuthCredentials } from "./types";
 import { getAuthStorePath } from "./store";
 import { atomicWriteFile, hardenConfigDir, hardenExistingSecret } from "../config";
+import { assertNotRealHomeUnderTest } from "../lib/test-home-guard";
 import { BOUNDED_BODY_MAX_BYTES, readBoundedResponseBytes } from "../lib/bounded-body";
 
 export const NOUS_PORTAL_BASE_URL = "https://portal.nousresearch.com";
@@ -220,6 +221,8 @@ function readRefreshIntent(refreshToken: string): RefreshIntent | undefined {
 }
 
 function writeRefreshIntent(refreshToken: string, status: RefreshIntentStatus): void {
+  // Before the mkdir/chmod below, which would otherwise touch the real home first.
+  assertNotRealHomeUnderTest(dirname(getAuthStorePath()));
   const dir = refreshIntentDir();
   // Hardened, owner-only directory + atomic (temp+rename) write. Throws on
   // failure so the caller can fail closed instead of refreshing blind.

package/src/oauth/store.ts

@@ -23,6 +23,7 @@ import { notifyAuthStoreLoaded } from "../lib/decision-quota-sink";
 import { accountPauseDetailsSchema } from "../config/schema/account-auto-pause";
 import { normalizeOAuthPlan, mergeOAuthPlan } from "./plan";
 import { normalizeAnthropicIdentity, matchesAnthropicImport, mergeAnthropicIdentity } from "./anthropic-identity";
+import { normalizeWorkBuddyMetadata } from "../providers/workbuddy";
 import { findKiroAccountForLogin, withRetainedKiroUser } from "./kiro-account-identity";
 import { isAnthropicInstanceId, type AnthropicInstanceId } from "../providers/anthropic-instance-id";
 import { assertNoCrossAnthropicRegistration, assertAnthropicCredentialSource, assertAnthropicInstanceLoginConfig } from "./store-anthropic-instance";
@@ -203,6 +204,7 @@ export function peekOAuthRefreshIntent(provider: string, accountId: string): OAu
 }
 export function writeOAuthRefreshIntent(provider: string, accountId: string, generation: string, createdAt = Date.now(), flightId?: string): OAuthRefreshIntent {
   const dir = getConfigDir();
+  assertNotRealHomeUnderTest(dir);
   if (!existsSync(dir)) mkdirSync(dir, { recursive: true, mode: 0o700 });
   hardenConfigDir();
   const intent: OAuthRefreshIntent = {
@@ -353,7 +355,7 @@ export function clearOAuthRefreshIntent(provider: string, accountId: string, gen
   });
 }
 export function credentialGeneration(cred: OAuthCredentials): string {
-  return createHash("sha256").update(JSON.stringify([cred.refresh, cred.access, cred.expires])).digest("hex");
+  return createHash("sha256").update(JSON.stringify([cred.refresh, cred.access, cred.expires, ...(cred.workbuddy ? [cred.workbuddy] : [])])).digest("hex");
 }
 
 /** Load and normalize the OAuth auth store with hardened permissions, and hand the result to the opt-in decision-quota slot (a no-op unless JEV quota signals are active). */
@@ -547,6 +549,8 @@ function normalizeCredential(cred: unknown): OAuthCredentials | null {
   };
   if (typeof candidate.email === "string" && candidate.email.length > 0) normalized.email = candidate.email;
   if (typeof candidate.accountId === "string" && candidate.accountId.length > 0) normalized.accountId = candidate.accountId;
+  const workbuddy = normalizeWorkBuddyMetadata(candidate.workbuddy);
+  if (workbuddy) normalized.workbuddy = workbuddy;
   const identity = normalizeAnthropicIdentity(candidate.anthropicIdentity, candidate.access);
   if (identity) normalized.anthropicIdentity = identity;
   if (candidate.plan !== undefined) normalized.plan = normalizeOAuthPlan(candidate.plan) ?? null;
@@ -1152,7 +1156,7 @@ export async function upsertCredentialByIdentity(
       return Boolean(
         safe.email
         && account.credential.email
-        && account.credential.email.toLowerCase() === safe.email.toLowerCase(),
+        && account.credential.email.trim().toLowerCase() === safe.email.trim().toLowerCase(),
       );
     };
     const existing = safe.accountId

package/src/oauth/token-guardian.ts

@@ -215,6 +215,13 @@ export async function guardianSweep(nowMs: number = Date.now()): Promise<Guardia
       if (!record || record.deletedAt != null) continue;
       const cred = record.credential;
       if (!cred) continue;
+      // A grant the token endpoint already called revoked or expired cannot be refreshed; posting
+      // it again only buys another 401 per backoff window (#7592). The OAuth branch above skips
+      // needsReauth for the same reason. A re-login or a completed validation rewrites the record
+      // without the marker, which is what readmits the account. A source-linked credential spends
+      // no grant of its own, so it keeps the sweep, matching the quota probe's hold.
+      if (record.lastCodexValidationTerminal === true && record.lastCodexValidationStatus === "failed"
+        && !cred.sourceAuthPath) continue;
       const needsRefresh = cred.expiresAt <= nowMs + horizonMs;
       const needsWarmup = opts.codexWarmupEnabled
         && !record.codexValidationPending

package/src/oauth/types.ts

@@ -54,7 +54,16 @@ export interface MuseOAuthMetadata {
   tierName?: string;
 }
 
+export interface WorkBuddyOAuthMetadata {
+  uid: string;
+  domain: string;
+  enterpriseId?: string;
+  refreshExpiresAt?: number;
+}
+
 export type OAuthCredentials = {
+  /** Account-scoped WorkBuddy identity, kept inside the protected credential store. */
+  workbuddy?: WorkBuddyOAuthMetadata;
   refresh: string;
   access: string;
   /** Epoch ms after any small provider-specific early-refresh margin; the shared gate adds 1 minute. */

package/src/oauth/workbuddy.ts

@@ -0,0 +1,139 @@
+import { randomUUID } from "node:crypto";
+import { setTimeout as delay } from "node:timers/promises";
+import { readBoundedResponseBody } from "../lib/bounded-body";
+import { WORKBUDDY_ORIGIN, WORKBUDDY_USER_AGENT, workBuddyHeaderValue, workBuddyHeaders } from "../providers/workbuddy";
+import type { OAuthController, OAuthCredentials, WorkBuddyOAuthMetadata } from "./types";
+
+type Json = Record<string, unknown>;
+function record(value: unknown): Json {
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value as Json : {};
+}
+
+export class WorkBuddyApiError extends Error {
+  constructor(readonly status: number, readonly code: number) {
+    super(`WorkBuddy AI request failed (HTTP ${status}, code ${code})`);
+  }
+}
+
+/** Fixed-origin, bounded reads; upstream error/profile text never enters diagnostics. */
+export async function workBuddyApi(
+  path: string, headers: Record<string, string>, signal?: AbortSignal, post = false, payload: Json = {},
+): Promise<Json> {
+  const timeout = AbortSignal.timeout(15_000);
+  const boundedSignal = signal ? AbortSignal.any([signal, timeout]) : timeout;
+  const response = await fetch(`${WORKBUDDY_ORIGIN}${path}`, {
+    method: post ? "POST" : "GET", redirect: "error", signal: boundedSignal,
+    headers: { "Content-Type": "application/json", Accept: "application/json", "User-Agent": WORKBUDDY_USER_AGENT, ...headers },
+    ...(post ? { body: JSON.stringify(payload) } : {}),
+  }).catch(() => {
+    signal?.throwIfAborted();
+    throw new Error("WorkBuddy AI request unavailable");
+  });
+  const body = await readBoundedResponseBody(response, {
+    signal: boundedSignal, maxBytes: 256 * 1024, totalTimeoutMs: 15_000, inactivityTimeoutMs: 15_000, fatalUtf8: true,
+  }).catch(() => {
+    signal?.throwIfAborted();
+    throw new Error("WorkBuddy AI response unavailable");
+  });
+  let env: Json;
+  try {
+    if (body.oversized || body.truncated || !body.displaySafe) throw new Error();
+    env = record(JSON.parse(body.text));
+  } catch {
+    signal?.throwIfAborted();
+    if (!response.ok) throw new WorkBuddyApiError(response.status, -1);
+    throw new Error("WorkBuddy AI returned an invalid response");
+  }
+  const code = typeof env.code === "number" || typeof env.code === "string" && /^\d+$/.test(env.code)
+    ? Number(env.code) : NaN;
+  if (!response.ok || !Number.isFinite(code) || code !== 0) {
+    throw new WorkBuddyApiError(response.status, Number.isSafeInteger(code) ? code : -1);
+  }
+  return record(env.data);
+}
+
+function expiry(got: Json, absolute: string, relative: string, fallback?: number): number | undefined {
+  const at = got[absolute], seconds = got[relative];
+  if (typeof at === "number" && Number.isSafeInteger(at) && at > 0) return at;
+  if (typeof seconds === "number" && Number.isFinite(seconds) && seconds > 0) {
+    const result = Date.now() + seconds * 1000;
+    if (Number.isSafeInteger(result)) return result;
+  }
+  return fallback;
+}
+
+function credentials(got: Json, metadata: WorkBuddyOAuthMetadata, previous?: OAuthCredentials): OAuthCredentials {
+  const access = got.accessToken;
+  const refresh = got.refreshToken ?? previous?.refresh;
+  const expires = expiry(got, "expiresAt", "expiresIn");
+  const domain = got.domain ?? metadata.domain;
+  if (!workBuddyHeaderValue(access, 32768) || !workBuddyHeaderValue(refresh, 32768)
+    || !expires || expires <= Date.now() || !workBuddyHeaderValue(domain)) throw new Error("WorkBuddy AI returned invalid credentials");
+  return {
+    access, refresh, expires, source: "oauth",
+    // A uid may belong to both a personal plan and a team; they are separate account slots.
+    accountId: JSON.stringify([metadata.uid, metadata.enterpriseId ?? ""]),
+    workbuddy: { ...metadata, domain,
+      refreshExpiresAt: expiry(got, "refreshExpiresAt", "refreshExpiresIn", metadata.refreshExpiresAt) },
+  };
+}
+
+async function poll(path: string, headers: Record<string, string>, retryCode: number, signal: AbortSignal): Promise<Json> {
+  while (true) {
+    signal.throwIfAborted();
+    try {
+      const result = await workBuddyApi(path, headers, signal);
+      if (Object.keys(result).length) return result;
+    } catch (error) {
+      if (!(error instanceof WorkBuddyApiError) || (error.code !== retryCode && ![408, 429].includes(error.status))) throw error;
+    }
+    await delay(1000, undefined, { signal });
+  }
+}
+
+export async function loginWorkBuddy(ctrl: OAuthController): Promise<OAuthCredentials> {
+  const deadline = AbortSignal.timeout(5 * 60_000);
+  const signal = ctrl.signal ? AbortSignal.any([ctrl.signal, deadline]) : deadline;
+  signal.throwIfAborted();
+  const state = await workBuddyApi("/v2/plugin/auth/state?platform=workbuddy-ai", {
+    "X-No-Authorization": "true", "X-No-User-Id": "true",
+    "X-No-Enterprise-Id": "true", "X-No-Department-Info": "true",
+  }, signal, true);
+  if (!workBuddyHeaderValue(state.state, 4096) || typeof state.authUrl !== "string" || state.authUrl.length > 8192) throw new Error("WorkBuddy AI returned an invalid login state");
+  let url: URL;
+  try { url = new URL(state.authUrl); } catch { throw new Error("WorkBuddy AI returned an invalid login URL"); }
+  if (![WORKBUDDY_ORIGIN, "https://www.codebuddy.ai"].includes(url.origin) || url.username || url.password) throw new Error("WorkBuddy AI returned an untrusted login URL");
+  url.searchParams.set("version", "2.0.0");
+  url.searchParams.set("loginSessionId", randomUUID());
+  ctrl.onAuth?.({ url: url.href, instructions: "Sign in to WorkBuddy AI in your browser. OpenCodex will finish automatically." });
+  const query = encodeURIComponent(state.state);
+  const token = await poll(`/v2/plugin/auth/token?state=${query}`, {}, 11217, signal);
+  if (!workBuddyHeaderValue(token.accessToken, 32768)) throw new Error("WorkBuddy AI returned no access token");
+  const domain = token.domain ?? "www.workbuddy.ai";
+  if (!workBuddyHeaderValue(domain)) throw new Error("WorkBuddy AI returned an invalid account domain");
+  const headers = { Authorization: `Bearer ${token.accessToken}`, "X-Domain": domain, "X-No-User-Id": "true", "X-No-Enterprise-Id": "true" };
+  const who = await poll(`/v2/plugin/login/account?state=${query}`, headers, 12151, signal);
+  if (!workBuddyHeaderValue(who.uid)) throw new Error("WorkBuddy AI account identity unavailable");
+  let enterpriseId = who.enterpriseId;
+  if (!enterpriseId && typeof who.type === "string" && who.type.toLowerCase() !== "personal") {
+    const result = await workBuddyApi("/v2/plugin/accounts", headers, signal);
+    const mine = (Array.isArray(result.accounts) ? result.accounts : []).map(record)
+      .filter(a => a.uid === who.uid && workBuddyHeaderValue(a.enterpriseId));
+    const same = mine.filter(a => a.type === who.type), last = mine.filter(a => a.lastLogin === true);
+    enterpriseId = (same.length === 1 ? same[0] : last.length === 1 ? last[0] : mine.length === 1 ? mine[0] : undefined)?.enterpriseId;
+    if (!enterpriseId) throw new Error("WorkBuddy AI team identity unavailable; sign in again");
+  }
+  if (enterpriseId !== undefined && enterpriseId !== "" && !workBuddyHeaderValue(enterpriseId)) throw new Error("WorkBuddy AI returned an invalid team identity");
+  return credentials(token, { uid: who.uid, domain, ...(enterpriseId ? { enterpriseId: enterpriseId as string } : {}) });
+}
+
+export async function refreshWorkBuddyToken(refresh: string, signal?: AbortSignal, previous?: OAuthCredentials): Promise<OAuthCredentials> {
+  const metadata = previous?.workbuddy;
+  if (!metadata || !workBuddyHeaderValue(refresh, 32768)) throw new Error("WorkBuddy AI requires a new browser login");
+  if (metadata.refreshExpiresAt && metadata.refreshExpiresAt <= Date.now()) throw new Error("WorkBuddy AI refresh token expired; sign in again");
+  const headers = workBuddyHeaders(undefined, metadata);
+  headers["X-Refresh-Token"] = refresh;
+  headers["X-Auth-Refresh-Source"] = "plugin";
+  const token = await workBuddyApi("/v2/plugin/auth/token/refresh", headers, signal, true);
+  return credentials(token, metadata, previous);
+}

package/src/protocols/codecs/chat.ts

@@ -6,12 +6,12 @@
  * (`src/chat/inbound.ts`), including its validation and the fields it drops, which
  * `src/protocols/features.ts` declares.
  */
-import { chatCompletionsToResponsesBody, chatSettingsToResponsesBody } from "../../chat/inbound";
+import { chatCompletionsToResponsesBody, chatSettingsToResponsesBody, type ChatResponsesProjectionOptions } from "../../chat/inbound";
 import { featuresFromChatBody } from "../features";
 
 /** Project a Chat Completions body onto the internal Responses bridge body. */
-export function chatToResponsesBody(body: unknown): Record<string, unknown> {
-  return chatCompletionsToResponsesBody(body);
+export function chatToResponsesBody(body: unknown, options?: ChatResponsesProjectionOptions): Record<string, unknown> {
+  return chatCompletionsToResponsesBody(body, options);
 }
 
 /**

package/src/protocols/encoders/adapter-events.ts

@@ -109,7 +109,13 @@ export interface ClientWireWriter {
   text(delta: string): void;
   messageDone(): void;
   reasoning(delta: string, itemId: string, channel: "summary" | "raw"): void;
-  reasoningDone(item: { itemId: string; signature?: string; redacted?: string[] }): void;
+  /** `hidden`: the signature covers thinking text the client was not shown (the bridge's `txt`). */
+  reasoningDone(item: { itemId: string; signature?: string; redacted?: string[]; hidden?: true }): void;
+  /**
+   * An Anthropic progress update: `text` is shown as content and is also the signed thinking
+   * block's text. Optional — a writer without it renders the update as ordinary text.
+   */
+  progressThinking?(text: string, signature: string): void;
   toolStart(call: ClientToolCall): void;
   toolArgsDelta(itemId: string, delta: string): void;
   toolArgsDone(itemId: string, args: string): void;
@@ -331,6 +337,8 @@ export function encodeAdapterEventStream(
   let currentRawReasoning: { itemId: string } | null = null;
   let pendingSignature: string | undefined;
   let pendingRedacted: string[] = [];
+  // The bridge's hiddenThinking: non-empty thinking text suppressed by hideThinkingSummary.
+  let hiddenThinkingSeen = false;
   let hiddenRawBytes = 0;
   let pendingKiroRedacted: string | undefined;
   let currentToolCall: OpenToolCall | null = null;
@@ -367,9 +375,11 @@ export function encodeAdapterEventStream(
   };
   // hideThinkingSummary: a signed or redacted block still round-trips as an envelope-only item.
   const flushHiddenReasoningEnvelope = () => {
+    const hidden = hiddenThinkingSeen;
+    hiddenThinkingSeen = false;
     const envelope = takeReasoningEnvelope();
     if (!envelope) return;
-    writer.reasoningDone({ itemId: `rs_${uuid()}`, ...envelope });
+    writer.reasoningDone({ itemId: `rs_${uuid()}`, ...envelope, ...(hidden ? { hidden: true as const } : {}) });
   };
   const flushHiddenRawReasoning = () => {
     if (hiddenRawBytes === 0) return;
@@ -570,6 +580,19 @@ export function encodeAdapterEventStream(
             break;
           }
           case "text_delta": {
+            if (event.anthropicThinkingSignature && writer.progressThinking) {
+              // The bridge's progress items: close everything, the carrier, then the visible copy.
+              if (currentMsg) closeCurrentMessage();
+              if (currentReasoning) closeCurrentReasoning();
+              if (currentRawReasoning) closeCurrentRawReasoning();
+              flushHiddenRawReasoning();
+              flushHiddenReasoningEnvelope();
+              if (currentToolCall) closeCurrentToolCall();
+              writer.progressThinking(event.text, event.anthropicThinkingSignature);
+              writer.text(event.text);
+              writer.messageDone();
+              break;
+            }
             if (currentReasoning) closeCurrentReasoning();
             if (currentRawReasoning) closeCurrentRawReasoning();
             flushHiddenRawReasoning();
@@ -585,6 +608,7 @@ export function encodeAdapterEventStream(
           }
           case "thinking_delta": {
             if (options.hideThinkingSummary) {
+              if (event.thinking.length > 0) hiddenThinkingSeen = true;
               flushHiddenRawReasoning();
               break;
             }

package/src/protocols/encoders/chat.ts

@@ -13,6 +13,7 @@ import type { AdapterEvent } from "../../types";
 import type { TranslatorBudget } from "../../lib/translator-budget";
 import { responsesUsage } from "../../bridge/internal";
 import {
+  appendedUtf8Bytes,
   chatCompletionsErrorResponse,
   chatCompletionsFailedResponse,
   chatCompletionsIncompleteOutcome,
@@ -32,6 +33,7 @@ import {
   type ClientWireWriter,
 } from "./adapter-events";
 import type { RelayedEventObservation } from "../../usage/attempt-delivery";
+import { reasoningDetailEntries } from "../../chat/reasoning-details";
 
 type Rec = Record<string, unknown>;
 
@@ -54,6 +56,41 @@ function createChatCompletionWriter(sink: ClientFrameSink, model: string): Clien
   const emittedToolIndexes = new Set<number>();
   let nextToolIndex = 0;
   let staged: { text: string; observation?: RelayedEventObservation }[] | undefined;
+  // #7429: the shown thinking text of the open reasoning item, which its signature pairs with.
+  const budget = sink.budget;
+  let reasoningItemId: string | undefined;
+  let reasoningText = "";
+  let reasoningTextBytes = 0;
+  let nextReasoningDetailIndex = 0;
+  const releaseReasoningText = () => {
+    budget.releaseRetained(reasoningTextBytes, { kind: "reasoning" });
+    reasoningItemId = undefined;
+    reasoningText = "";
+    reasoningTextBytes = 0;
+  };
+  const retainReasoningText = (itemId: string, delta: string) => {
+    if (reasoningItemId !== itemId) releaseReasoningText();
+    reasoningItemId = itemId;
+    const nextBytes = appendedUtf8Bytes(reasoningText, reasoningTextBytes, delta);
+    const reservation = budget.reserveTransient(nextBytes, { kind: "reasoning" });
+    try {
+      reasoningText += delta;
+      reservation.commitRetained();
+      budget.releaseRetained(reasoningTextBytes, { kind: "reasoning" });
+      reasoningTextBytes = nextBytes;
+    } catch (error) {
+      reservation.release();
+      throw error;
+    }
+  };
+  const emitReasoningDetails = (entries: Rec[]) => {
+    if (entries.length === 0) return;
+    nextReasoningDetailIndex += entries.length;
+    ensureRole();
+    const frame = chunkBase(id, model, created);
+    frame.choices = [{ index: 0, delta: { reasoning_details: entries }, finish_reason: null }];
+    emit(frame);
+  };
 
   const emit = (payload: Rec | "[DONE]", observation?: RelayedEventObservation) => {
     if (failed) return;
@@ -138,15 +175,30 @@ function createChatCompletionWriter(sink: ClientFrameSink, model: string): Clien
       emit(frame, { semanticBytes: Buffer.byteLength(delta) });
     },
     messageDone() { /* the converter reads nothing from a finished message */ },
-    reasoning(delta) {
+    reasoning(delta, itemId, channel) {
       if (!delta) return;
       ensureRole();
       // Many OpenAI-compatible clients accept reasoning_content; harmless if ignored.
       const frame = chunkBase(id, model, created);
       frame.choices = [{ index: 0, delta: { reasoning_content: delta }, finish_reason: null }];
       emit(frame, { semanticBytes: Buffer.byteLength(delta) });
+      // Only summary-channel thinking can carry a signature; raw reasoning never does.
+      if (channel === "summary") retainReasoningText(itemId, delta);
+    },
+    reasoningDone({ itemId, signature, redacted, hidden }) {
+      // The bridge converter's output_item.done for a reasoning item (#7429), entry for entry.
+      const entries = reasoningDetailEntries({
+        text: reasoningItemId === itemId ? reasoningText : "",
+        ...(signature ? { signature } : {}),
+        ...(redacted ? { redacted } : {}),
+        ...(hidden ? { hidden } : {}),
+      }, nextReasoningDetailIndex);
+      releaseReasoningText();
+      emitReasoningDetails(entries);
+    },
+    progressThinking(text, signature) {
+      emitReasoningDetails(reasoningDetailEntries({ text, signature }, nextReasoningDetailIndex));
     },
-    reasoningDone() { /* reasoning items carry nothing a Chat client reads */ },
     toolStart(call) {
       // Custom and tool-search calls have no Chat representation; the converter skips them.
       if (call.kind !== "function") return;
@@ -198,7 +250,7 @@ function createChatCompletionWriter(sink: ClientFrameSink, model: string): Clien
         type: "upstream_error",
       });
     },
-    dispose() { /* nothing retained beyond the driver's frames */ },
+    dispose() { releaseReasoningText(); },
   };
 }
 

package/src/providers/antigravity-quota-identity.ts

@@ -0,0 +1,37 @@
+import { createHash } from "node:crypto";
+import { effectiveGoogleMode, getProviderRegistryEntry } from "./registry";
+import type { OAuthCredentials } from "../oauth/types";
+import type { OcxProviderConfig } from "../types";
+
+const ARGON_TOKEN = /(?:^|[^a-z0-9])argon(?:[^a-z0-9]|$)/i;
+/** Argon has an independent quota pool, including its native effort-suffixed identities. */
+export function isAntigravityArgonIdentity(identity: string): boolean { return ARGON_TOKEN.test(identity); }
+
+/**
+ * The OAuth store key whose account both inference and the quota probe resolve. Inference reads
+ * `store[route.providerName]` and refreshes through the OAuth definition registered under that same
+ * name, and `ocx login` only accepts registered names, so a renamed provider row never authenticates
+ * as this account. Evidence is bound to this key alone; a renamed row reads unknown.
+ */
+export const ANTIGRAVITY_OAUTH_STORE_KEY = "google-antigravity";
+
+/** Accounting and inference must refer to the same OAuth store entry and the supported Antigravity destination. */
+export function antigravityQuotaEligible(name: string, provider: OcxProviderConfig): boolean {
+  if (name !== ANTIGRAVITY_OAUTH_STORE_KEY || provider.disabled || provider.authMode !== "oauth"
+    || effectiveGoogleMode(name, provider) !== "cloud-code-assist") return false;
+  try {
+    const url = new URL(provider.baseUrl);
+    const expected = new URL(getProviderRegistryEntry(ANTIGRAVITY_OAUTH_STORE_KEY)!.baseUrl);
+    return url.href.replace(/\/$/, "") === expected.href.replace(/\/$/, "");
+  } catch { return false; }
+}
+
+/** Private generation includes the accounting project, not just the rotating bearer. */
+export function antigravityQuotaCredentialGeneration(credential: OAuthCredentials): string {
+  return createHash("sha256").update(JSON.stringify([credential.refresh, credential.access, credential.expires, credential.projectId])).digest("hex");
+}
+
+/** Immutable instance/destination policy, never returned to decision services. */
+export function antigravityQuotaPolicy(name: string, provider: OcxProviderConfig): string {
+  return createHash("sha256").update(JSON.stringify([name, provider])).digest("hex");
+}

package/src/providers/base-url-choices.ts

@@ -1,9 +1,11 @@
 /**
  * Qwen Cloud OpenAI-compatible endpoint presets.
  * Token plan is the GUI default; pay-as-you-go and custom are selectable.
+ * Token plan host per https://docs.qwencloud.com/token-plan/personal/token-plan-personal-quickstart
+ * (checked 2026-10-23); a saved older host stays usable as a custom URL.
  */
 export const QWEN_CLOUD_TOKEN_PLAN_BASE_URL =
-  "https://token-plan.ap-southeast-1.maas.aliyuncs.com/compatible-mode/v1";
+  "https://token-plan.maas.qwencloudapi.com/compatible-mode/v1";
 export const QWEN_CLOUD_PAYG_BASE_URL =
   "https://dashscope.aliyuncs.com/compatible-mode/v1";
 
@@ -23,10 +25,11 @@ export const QWEN_CLOUD_BASE_URL_CHOICES: readonly ProviderBaseUrlChoice[] = [
 
 /**
  * Alibaba Token Plan International (ap-southeast-1) endpoint presets.
- * Same product as the Beijing Token Plan but for international accounts.
- * Note: ALIBABA_INTL_TOKEN_PLAN_BASE_URL intentionally duplicates
- * QWEN_CLOUD_TOKEN_PLAN_BASE_URL — same host, different product branding
- * and model lineup. Kept as a separate constant for clarity.
+ * Separate regional account and billing destination; both regions offer both tiers.
+ * Alibaba Cloud's own quick start still documents this host (checked 2026-10-23):
+ * https://www.alibabacloud.com/help/en/model-studio/token-plan-personal-quick-start
+ * Qwen Cloud documents a different Token Plan host, so the two constants are
+ * independent and must not be assumed equal.
  */
 export const ALIBABA_INTL_TOKEN_PLAN_BASE_URL =
   "https://token-plan.ap-southeast-1.maas.aliyuncs.com/compatible-mode/v1";