@bitkyc08/opencodex 2.90.0 → 2.92.0

package/src/quota-pool/contract.ts

@@ -0,0 +1,58 @@
+/**
+ * Wire shape of `GET /api/quota-pool`: the GOAT contract `ocx.quota-pool/1`.
+ *
+ * GOAT owns the decoder (`packages/contracts/src/quotaPool.ts` in goat-si/goat); OpenCodex is
+ * the producer. Every optional field is OMITTED when OpenCodex does not know it. A missing
+ * window means unknown, never 0%, and no field is ever `null`.
+ */
+
+export const QUOTA_POOL_SCHEMA = "ocx.quota-pool/1" as const;
+
+export type QuotaPoolWindowKind = "burst_5h" | "daily" | "weekly" | "monthly" | "credits" | "custom";
+/** measured: a usage probe body; header: response rate-limit headers; estimated: derived by OpenCodex. */
+export type QuotaPoolSource = "measured" | "header" | "estimated";
+export type QuotaPoolUnit = "requests" | "tokens" | "credits" | "usd";
+export type QuotaPoolAccountState = "available" | "exhausted" | "paused" | "reauth" | "unknown";
+export type QuotaPoolRole = "standalone" | "hub" | "client";
+
+export interface QuotaPoolWindow {
+  id: string;
+  kind: QuotaPoolWindowKind;
+  label: string;
+  usedPercent?: number;
+  used?: number;
+  limit?: number;
+  unit?: QuotaPoolUnit;
+  resetsAt?: string;
+  windowSeconds?: number;
+  scopeModel?: string;
+  source: QuotaPoolSource;
+  observedAt: string;
+  exhausted?: boolean;
+}
+
+export interface QuotaPoolAccount {
+  provider: string;
+  driver?: string;
+  /** Opaque, stable for this install, never an email or a raw account id (see identity.ts). */
+  accountRef: string;
+  label?: string;
+  plan?: string;
+  state: QuotaPoolAccountState;
+  windows: QuotaPoolWindow[];
+  /** A closed `QuotaFailureCode`; never upstream text. */
+  failure?: string;
+}
+
+export interface QuotaPoolProvider {
+  provider: string;
+  accounts: QuotaPoolAccount[];
+  pooled: { windows: QuotaPoolWindow[]; headroom?: number; nextResetAt?: string };
+}
+
+export interface QuotaPool {
+  schema: typeof QUOTA_POOL_SCHEMA;
+  producer: { version: string; role: QuotaPoolRole; homeId: string };
+  generatedAt: string;
+  providers: QuotaPoolProvider[];
+}

package/src/quota-pool/identity.ts

@@ -0,0 +1,203 @@
+/**
+ * The install identity behind `ocx.quota-pool/1`: the Home's `homeId` and the secret that keys
+ * every `accountRef`.
+ *
+ * Both live in `<OPENCODEX_HOME>/quota-pool-identity.json` (owner-only). The server creates the
+ * file once, in the background after it starts listening (`ensureQuotaPoolIdentity`); the
+ * `/api/quota-pool` read only reads it, so the read path never writes. A read that finds no
+ * valid file reports the identity as unavailable instead of minting one.
+ *
+ * `accountRef` is `acct_` + base64url(HMAC-SHA256(secret, "ocx.quota-pool/1" NUL provider NUL
+ * accountId)) truncated to 128 bits. It is stable across restarts because the secret is
+ * persisted, distinct per provider, and not reversible: without the per-install secret a
+ * recipient cannot confirm a guessed email or account id against it, and it never contains
+ * either. Deleting the file rotates `homeId` and every `accountRef` together.
+ */
+import { createHmac, randomBytes, randomUUID } from "node:crypto";
+import { closeSync, constants as fsConstants, fsyncSync, linkSync, lstatSync, openSync, readFileSync, unlinkSync, writeSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { getConfigDir } from "../config/paths";
+
+export const QUOTA_POOL_IDENTITY_FILE = "quota-pool-identity.json";
+
+export interface QuotaPoolIdentity {
+  homeId: string;
+  secret: string;
+}
+
+const HOME_ID = /^home_[0-9a-f]{32}$/;
+const SECRET = /^[0-9a-f]{64}$/;
+let memo: { path: string; identity: QuotaPoolIdentity } | null = null;
+
+export function quotaPoolIdentityPath(configDir = getConfigDir()): string {
+  return join(configDir, QUOTA_POOL_IDENTITY_FILE);
+}
+
+function parseIdentity(text: string): QuotaPoolIdentity | null {
+  try {
+    const raw = JSON.parse(text) as Record<string, unknown>;
+    if (raw?.version !== 1 || typeof raw.homeId !== "string" || typeof raw.secret !== "string") return null;
+    if (!HOME_ID.test(raw.homeId) || !SECRET.test(raw.secret)) return null;
+    return { homeId: raw.homeId, secret: raw.secret };
+  } catch {
+    return null;
+  }
+}
+
+/** Read-only: the persisted identity, or null when it is missing or malformed. Never writes. */
+export function readQuotaPoolIdentity(configDir = getConfigDir()): QuotaPoolIdentity | null {
+  const path = quotaPoolIdentityPath(configDir);
+  if (memo?.path === path) return memo.identity;
+  try {
+    const stat = lstatSync(path);
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 1024) return null;
+  } catch {
+    return null;
+  }
+  let identity: QuotaPoolIdentity | null;
+  try { identity = parseIdentity(readFileSync(path, "utf8")); } catch { return null; }
+  if (identity) memo = { path, identity };
+  return identity;
+}
+
+const NOFOLLOW = process.platform === "win32" ? 0 : fsConstants.O_NOFOLLOW;
+/** How long a loser waits for a concurrent winner's file to become readable before giving up. */
+const PUBLISHED_READ_ATTEMPTS = 50;
+const PUBLISHED_READ_INTERVAL_MS = 10;
+
+/** Test seams for the publication windows; production never sets them. */
+export interface QuotaPoolIdentityTestHooks {
+  /** After the first read found no identity, before the existence check. */
+  afterAbsentRead?: (path: string) => void;
+  /** After a file was exclusively created, before its bytes are written. */
+  afterCreate?: (path: string) => void;
+  /** Replace `linkSync` (to force the in-place fallback). */
+  link?: (existing: string, target: string) => void;
+  /** Override the bounded wait for a concurrent winner. */
+  publishedReadAttempts?: number;
+}
+let hooks: QuotaPoolIdentityTestHooks = {};
+
+export function setQuotaPoolIdentityHooksForTests(next: QuotaPoolIdentityTestHooks = {}): void {
+  hooks = next;
+}
+
+/** Write a whole new owner-only file, flushed to disk; fails if anything (a symlink included) already exists. */
+function createExclusive(path: string, content: string): void {
+  const fd = openSync(path, fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL | NOFOLLOW, 0o600);
+  try {
+    hooks.afterCreate?.(path);
+    writeSync(fd, content);
+    fsyncSync(fd);
+  } finally { closeSync(fd); }
+}
+
+function errorCode(error: unknown): string | undefined {
+  return (error as NodeJS.ErrnoException | null)?.code;
+}
+
+/**
+ * Make the new directory entry durable too: fsyncing the file alone can lose the entry on power
+ * loss, and a lost entry would mint a new identity and rotate every accountRef on the next start.
+ * Best effort; Windows cannot open a directory for fsync.
+ */
+function syncParentDirectory(path: string): void {
+  if (process.platform === "win32") return;
+  try {
+    const fd = openSync(dirname(path), fsConstants.O_RDONLY);
+    try { fsyncSync(fd); } finally { closeSync(fd); }
+  } catch { /* the file itself is flushed; a directory fsync is an extra guarantee */ }
+}
+
+function pause(ms: number): void {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+
+/**
+ * Something already sits at the path: adopt it once it reads as a valid identity.
+ *
+ * A concurrent winner's file is complete the moment it appears when it was hard-linked, but the
+ * in-place fallback creates the file before writing it, so a loser can briefly see it empty. The
+ * wait is bounded; an invalid result is never returned or memoized. A symlink, or a file that stays
+ * invalid past the bound, is refused and left alone.
+ */
+function adoptPublishedIdentity(configDir: string, path: string): QuotaPoolIdentity {
+  const attempts = hooks.publishedReadAttempts ?? PUBLISHED_READ_ATTEMPTS;
+  for (let attempt = 0; attempt < attempts; attempt++) {
+    let stat;
+    try { stat = lstatSync(path); } catch (error) {
+      if (errorCode(error) !== "ENOENT") throw error;
+      stat = null;
+    }
+    if (stat && (stat.isSymbolicLink() || !stat.isFile())) break;
+    const identity = readQuotaPoolIdentity(configDir);
+    if (identity) return identity;
+    if (attempt + 1 < attempts) pause(PUBLISHED_READ_INTERVAL_MS);
+  }
+  throw new Error("quota-pool identity file is not a valid regular file; remove it to rotate the identity");
+}
+
+/**
+ * Create the identity once. Called off the request path (server startup); idempotent.
+ *
+ * Publication is exclusive and never follows a link: the secret is written and flushed to a
+ * private temp file, then hard-linked into place, which fails if anything already sits at the path.
+ * Where hard links are unavailable it is created in place exclusively. Two servers starting on one
+ * fresh home therefore cannot each keep a different identity: a loser, including one that finds
+ * the winner's file appear between its own checks, re-reads within a bound and adopts the winner's.
+ * A symlink or a persistently malformed file at the path is refused and left alone (the read keeps
+ * reporting the identity as unavailable until an operator removes it); it is never overwritten.
+ */
+export function ensureQuotaPoolIdentity(configDir = getConfigDir()): QuotaPoolIdentity {
+  const existing = readQuotaPoolIdentity(configDir);
+  if (existing) return existing;
+  const path = quotaPoolIdentityPath(configDir);
+  hooks.afterAbsentRead?.(path);
+  let present = true;
+  try { lstatSync(path); } catch (error) { if (errorCode(error) !== "ENOENT") throw error; present = false; }
+  if (present) return adoptPublishedIdentity(configDir, path);
+  const identity: QuotaPoolIdentity = {
+    homeId: `home_${randomUUID().replaceAll("-", "")}`,
+    secret: randomBytes(32).toString("hex"),
+  };
+  const content = `${JSON.stringify({ version: 1, ...identity })}\n`;
+  const temp = `${path}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
+  let published = false;
+  try {
+    createExclusive(temp, content);
+    try {
+      (hooks.link ?? linkSync)(temp, path);
+      published = true;
+    } catch (error) {
+      const code = errorCode(error);
+      if (code === "EEXIST") return adoptPublishedIdentity(configDir, path);
+      // No hard links on this filesystem: exclusive create in place is still never a replacement.
+      if (code !== "EPERM" && code !== "ENOTSUP" && code !== "EXDEV" && code !== "ENOSYS") throw error;
+    }
+  } finally {
+    try { unlinkSync(temp); } catch { /* best effort */ }
+  }
+  if (!published) {
+    try {
+      createExclusive(path, content);
+    } catch (error) {
+      if (errorCode(error) !== "EEXIST") throw error;
+      return adoptPublishedIdentity(configDir, path);
+    }
+  }
+  syncParentDirectory(path);
+  memo = { path, identity };
+  return identity;
+}
+
+/** The opaque account reference: keyed by the install secret, never the raw id or an email. */
+export function quotaPoolAccountRef(identity: QuotaPoolIdentity, provider: string, accountId: string): string {
+  const digest = createHmac("sha256", Buffer.from(identity.secret, "hex"))
+    .update(`ocx.quota-pool/1\0${provider}\0${accountId}`)
+    .digest();
+  return `acct_${digest.subarray(0, 16).toString("base64url")}`;
+}
+
+export function resetQuotaPoolIdentityMemoForTests(): void {
+  memo = null;
+}

package/src/remote/features.ts

@@ -0,0 +1,74 @@
+/**
+ * The one registry of peer-visible features this build serves, advertised in `GET /readyz`
+ * `features` so a Hub, a Child or GOAT decides compatibility by feature instead of parsing versions.
+ *
+ * Every entry reads the module that owns the capability; nothing here restates a fact by hand:
+ *
+ * - `quota-pool/1` when the management route registry declares `GET /api/quota-pool`. The registry
+ *   is reconciled against dispatch source (`tests/server/management-route-registry.test.ts`), so the
+ *   feature appears exactly when the route is reachable.
+ * - `fallback-policy/1` when the registry declares `GET /api/fallback` (OCX-11). GOAT reads a Home
+ *   without it as "fallback state unknown".
+ * - `link-management-relay` when the Remote Link management read table is non-empty.
+ * - `served-by-header` when the served-by emitter says responses carry the header.
+ * - `relay-auth/<n>` with the connection-bound link relay auth version.
+ * - `link-peer-report/<n>` with the version of the report a Child sends on the relay challenge and a
+ *   Home records for `ocx link status` (`src/link/peer-report.ts`).
+ *
+ * The ids are static strings. They carry no account, credential or configuration data, which is
+ * what keeps the unauthenticated `/readyz` body safe. `parseRemoteReadyMetadata` accepts at most
+ * 64 unique ids of at most 80 characters, and `tests/server/readyz-features.test.ts` holds the
+ * full registry to that.
+ */
+import { LINK_MANAGEMENT_READ_PATHS } from "../link/management-routes";
+import { LINK_PEER_REPORT_VERSION } from "../link/peer-report";
+import { LINK_RELAY_AUTH_VERSION } from "../link/relay-auth";
+import { MANAGEMENT_ROUTES, type ManagementRoute } from "../server/management/route-registry";
+import { SERVED_BY_HEADER_EMITTED } from "./served-by";
+
+export const QUOTA_POOL_PATH = "/api/quota-pool";
+export const FALLBACK_STATE_PATH = "/api/fallback";
+
+/** The owning sources the registry reads. Tests pass their own to drive presence and absence. */
+export interface PeerFeatureSources {
+  readonly managementRoutes: readonly Pick<ManagementRoute, "method" | "path">[];
+  readonly linkManagementReadPaths: readonly string[];
+  readonly servedByHeaderEmitted: boolean;
+  readonly relayAuthVersion: string;
+  readonly linkPeerReportVersion: string;
+}
+
+/** One feature: its id when the sources say it is served, otherwise null. */
+export type PeerFeature = (sources: PeerFeatureSources) => string | null;
+
+/** Ordered; `/readyz` lists the served ids in this order. */
+export const PEER_FEATURES: readonly PeerFeature[] = [
+  s => s.managementRoutes.some(route => route.method === "GET" && route.path === QUOTA_POOL_PATH) ? "quota-pool/1" : null,
+  s => s.managementRoutes.some(route => route.method === "GET" && route.path === FALLBACK_STATE_PATH) ? "fallback-policy/1" : null,
+  s => s.linkManagementReadPaths.length > 0 ? "link-management-relay" : null,
+  s => s.servedByHeaderEmitted ? "served-by-header" : null,
+  s => `relay-auth/${s.relayAuthVersion}`,
+  s => `link-peer-report/${s.linkPeerReportVersion}`,
+];
+
+export function currentPeerFeatureSources(): PeerFeatureSources {
+  return {
+    managementRoutes: MANAGEMENT_ROUTES,
+    linkManagementReadPaths: LINK_MANAGEMENT_READ_PATHS,
+    servedByHeaderEmitted: SERVED_BY_HEADER_EMITTED,
+    relayAuthVersion: LINK_RELAY_AUTH_VERSION,
+    linkPeerReportVersion: LINK_PEER_REPORT_VERSION,
+  };
+}
+
+export function servedPeerFeatures(sources: PeerFeatureSources = currentPeerFeatureSources()): string[] {
+  return PEER_FEATURES.map(feature => feature(sources)).filter((id): id is string => id !== null);
+}
+
+let buildFeatures: readonly string[] | undefined;
+
+/** This build's served features. The sources are build constants, so the list is computed once. */
+export function buildPeerFeatures(): string[] {
+  buildFeatures ??= Object.freeze(servedPeerFeatures());
+  return [...buildFeatures];
+}

package/src/remote/protocol.ts

@@ -1,4 +1,5 @@
 import type { OcxConfig } from "../types/config";
+import { buildPeerFeatures } from "./features";
 
 export const REMOTE_HUB_PROTOCOL = 1;
 export const MINIMUM_REMOTE_CLIENT_PROTOCOL = 1;
@@ -53,6 +54,7 @@ export function readyProtocolMetadata(config: OcxConfig, req: Request): RemoteRe
     protocol: REMOTE_HUB_PROTOCOL,
     minimumClientProtocol: MINIMUM_REMOTE_CLIENT_PROTOCOL,
     managementUrl,
+    features: buildPeerFeatures(),
   };
 }
 

package/src/remote/served-by.ts

@@ -0,0 +1,57 @@
+/**
+ * The served-by response header, the Home instance id it carries, and whether this build sends it.
+ *
+ * Every `GET /v1/models` response the server answers itself names the serving Home in
+ * `x-opencodex-served-by`, and `GET /healthz` publishes the same value as `instanceId`, so a peer
+ * (GOAT's parity check P4) can prove which Home answered without reading logs. A Remote Link Child
+ * never answers `/v1/models` itself: its relay copies the Home's response headers, so the value a
+ * Child returns is the Home's. A Hub-mode client's Codex calls the Hub's data listener directly, so
+ * the Hub stamps its own response.
+ *
+ * The instance id is the install's `homeId` from `src/quota-pool/identity.ts`: a random
+ * `home_<32 hex>` minted once per install, persisted owner-only, and stable across restarts. It is
+ * never a hostname and is not derived from one. Until the identity exists (it is created in the
+ * background after the listener starts) or when its file is unreadable, the header and the
+ * `/healthz` field are omitted; an empty or malformed value is never sent.
+ *
+ * `SERVED_BY_HEADER_EMITTED` tells `/readyz` to advertise `served-by-header`
+ * (`src/remote/features.ts`); `tests/server/readyz-features.test.ts` fails if the advertisement
+ * and live responses disagree.
+ */
+import { readQuotaPoolIdentity } from "../quota-pool/identity";
+
+export const SERVED_BY_HEADER = "x-opencodex-served-by";
+
+/** Whether responses from this build carry {@link SERVED_BY_HEADER}. */
+export const SERVED_BY_HEADER_EMITTED: boolean = true;
+
+const INSTANCE_ID = /^home_[0-9a-f]{32}$/;
+
+/** This Home's opaque instance id, or undefined while the install identity is unavailable. */
+export function homeInstanceId(): string | undefined {
+  let homeId: unknown;
+  try { homeId = readQuotaPoolIdentity()?.homeId; } catch { return undefined; }
+  return typeof homeId === "string" && INSTANCE_ID.test(homeId) ? homeId : undefined;
+}
+
+/** Stamp {@link SERVED_BY_HEADER} with this Home's instance id; leaves the response alone without one. */
+export function withServedBy(response: Response, instanceId = homeInstanceId()): Response {
+  if (!instanceId) return response;
+  try {
+    response.headers.set(SERVED_BY_HEADER, instanceId);
+    return response;
+  } catch {
+    const headers = new Headers(response.headers);
+    headers.set(SERVED_BY_HEADER, instanceId);
+    return new Response(response.body, { status: response.status, statusText: response.statusText, headers });
+  }
+}
+
+/**
+ * The server's last step for every answered request: `GET /v1/models` names the serving Home,
+ * whichever branch produced the response. `pathname` is the dispatch path the router matched.
+ */
+export function stampServedBy(method: string, pathname: string, response: Response): Response {
+  if (!response || method !== "GET" || pathname !== "/v1/models") return response;
+  return withServedBy(response);
+}

package/src/responses/parser.ts

@@ -329,6 +329,13 @@ export function parseRequest(
         continue;
       }
 
+      if (effectiveType === "configuration_update") {
+        // Codex 0.164 positional reasoning-effort control. It is not a turn, so a translated route
+        // drops it without touching pending reasoning; the native passthrough keeps it verbatim in
+        // _rawBody. Mapping its effort onto the routed request is deliberately not done (#6895).
+        continue;
+      }
+
       if (isCompactionItemType(effectiveType)) {
         // A stored summary from a previous compaction. Decode our ocx1/ocx2 envelopes into plain text so
         // the routed model keeps the compacted context; real OpenAI-encrypted blobs degrade to a note.

package/src/responses/reasoning-envelope.ts

@@ -121,6 +121,18 @@ export function isProviderIssuedThinkingSignature(
   }
 }
 
+/**
+ * Whether a value has the spelling of a signature Anthropic issued. An allow-list on top of
+ * `isProviderIssuedThinkingSignature`: Anthropic's signature is base64, so item ids and the
+ * parser's serialized placeholder never pass. Shared by the adapter, which forwards only such a
+ * signature, and the Chat `reasoning_details` carrier, which accepts and emits only such a one.
+ */
+export function isLikelyRealAnthropicThinkingSignature(signature: string | undefined): signature is string {
+  if (typeof signature !== "string" || signature.length < 16) return false;
+  if (/^(fc|call|msg|rs|resp|reasoning|item|ws|tool|func|function)[-_]/i.test(signature)) return false;
+  return /^[A-Za-z0-9+/_=-]+$/.test(signature);
+}
+
 /** Decode an ocxr1 envelope; returns null for native (OpenAI-encrypted) blobs or garbage. */
 export function decodeReasoningEnvelope(encryptedContent: string, budget?: TranslatorBudget): ReasoningEnvelope | null {
   if (!encryptedContent.startsWith(OCX_REASONING_PREFIX)) return null;

package/src/responses/reasoning-replay-cache.ts

@@ -143,8 +143,9 @@ function tupleForServingIdentity(
 
 function keyFor(callId: string, scope: OcxReasoningReplayScopeRef | undefined): string | undefined {
   const identity = tupleForIdentity(scope?.current);
-  if (!nonEmpty(callId) || !nonEmpty(scope?.clientThreadId) || !identity) return undefined;
+  if (!nonEmpty(callId) || !nonEmpty(scope?.clientPrincipalId) || !nonEmpty(scope.clientThreadId) || !identity) return undefined;
   return JSON.stringify([
+    scope.clientPrincipalId,
     scope.clientThreadId,
     ...identity,
     callId,
@@ -166,18 +167,21 @@ function sweepExpiredServingIdentities(at: number): void {
 
 function servingIdentityFor(
   scope: OcxReasoningReplayScopeRef | undefined,
-): { threadId: string; identity: string } | undefined {
+): { key: string; identity: string } | undefined {
   const threadId = scope?.clientThreadId;
   const identityTuple = tupleForServingIdentity(scope?.current);
   if (!nonEmpty(threadId) || !identityTuple) return undefined;
-  return { threadId, identity: JSON.stringify(identityTuple) };
+  // Preserve physical safeguards for keyless callers in a separate namespace. A caller's
+  // thread name cannot select an authenticated principal's serving or rejection history.
+  const key = JSON.stringify([nonEmpty(scope?.clientPrincipalId) ? scope.clientPrincipalId : null, threadId]);
+  return { key, identity: JSON.stringify(identityTuple) };
 }
 
 function opaqueBlobRejectionKeyFor(
   scope: OcxReasoningReplayScopeRef | undefined,
 ): string | undefined {
   const current = servingIdentityFor(scope);
-  return current ? JSON.stringify([current.threadId, current.identity]) : undefined;
+  return current ? JSON.stringify([current.key, current.identity]) : undefined;
 }
 
 function deleteOpaqueBlobRejection(key: string): void {
@@ -224,7 +228,7 @@ export function reasoningReplayServingIdentityChange(
   if (!current) return undefined;
   const at = now();
   sweepExpiredServingIdentities(at);
-  const previous = servingIdentities.get(current.threadId);
+  const previous = servingIdentities.get(current.key);
   if (previous === undefined || previous.identity === current.identity) return undefined;
   const before = JSON.parse(previous.identity) as ReasoningReplayIdentityTuple;
   const after = JSON.parse(current.identity) as ReasoningReplayIdentityTuple;
@@ -254,7 +258,7 @@ export function reasoningReplayItemStoreChanged(
   if (!current) return false;
   const at = now();
   sweepExpiredServingIdentities(at);
-  const previous = servingIdentities.get(current.threadId);
+  const previous = servingIdentities.get(current.key);
   if (previous === undefined || previous.identity === current.identity) return false;
   const storeOwner = (identity: string): string => {
     const [, destination, , , credential] = JSON.parse(identity) as ReasoningReplayIdentityTuple;
@@ -271,16 +275,16 @@ export function commitReasoningReplayServingIdentity(
   if (!current) return;
   const at = now();
   sweepExpiredServingIdentities(at);
-  const previous = servingIdentities.get(current.threadId);
-  const { threadId, identity } = current;
-  const bytes = Buffer.byteLength(JSON.stringify([threadId, identity]), "utf8");
+  const previous = servingIdentities.get(current.key);
+  const { key, identity } = current;
+  const bytes = Buffer.byteLength(JSON.stringify([key, identity]), "utf8");
   if (bytes > MAX_TOTAL_BYTES) {
-    deleteServingIdentity(threadId);
+    deleteServingIdentity(key);
     return;
   }
 
-  if (previous) deleteServingIdentity(threadId);
-  servingIdentities.set(threadId, { identity, bytes, at });
+  if (previous) deleteServingIdentity(key);
+  servingIdentities.set(key, { identity, bytes, at });
   servingIdentityTotalBytes += bytes;
   while (
     (servingIdentityTotalBytes > MAX_TOTAL_BYTES || servingIdentities.size > MAX_ENTRIES)
@@ -517,13 +521,13 @@ export function reasoningReplayKeyCredentialIdentity(
   return reasoningReplayCredentialIdentity("key", apiKey, provider.headers);
 }
 
-/** Replace only the holder snapshot so parsed-request copies observe rotations. */
+/** Bind physical identity independently of the principal required for plaintext cache access. */
 export function bindReasoningReplayScope(
   scope: OcxReasoningReplayScopeRef | undefined,
   identity: OcxReasoningReplayIdentity | undefined,
 ): void {
   if (!scope) return;
-  if (!identity || !keyFor("binding-check", { ...scope, current: identity })) {
+  if (!identity || !nonEmpty(scope.clientThreadId) || !tupleForIdentity(identity)) {
     delete scope.current;
     return;
   }

package/src/router.ts

@@ -33,6 +33,7 @@ import {
 import { decodeRoutedModelIdOrThrow, encodeRoutedModelId } from "./providers/slug-codec";
 import { effectiveProviderAliasDecision, resolveModelAlias } from "./providers/default-aliases";
 import { resolveBlockedModelRedirect } from "./lib/shadow-call";
+import { workBuddyCatalogIdentity } from "./providers/workbuddy";
 import { getRoutingCached } from "./codex/model-cache";
 import { codexAccountNamespaceEntries } from "./codex/account-namespaces";
 import {
@@ -177,6 +178,7 @@ export function knownModelIdsForProvider(
       if (!account || account.needsReauth || !Number.isFinite(account.credential.expires)
         || account.credential.expires <= Date.now()) return undefined;
       key = account.credential.access;
+      if (provName === "workbuddy-ai") return workBuddyCatalogIdentity(key, account.credential.workbuddy);
       if (routed.adapter === "devin") destination = validateDevinApiBaseUrl(account.credential.apiBaseUrl) ?? routed.baseUrl;
     }
     if (!key) return undefined;

package/src/routing/analytics.ts

@@ -11,7 +11,7 @@
  * sample for the full history.
  */
 
-import type { PersistedUsageEntry } from "../usage/log";
+import { normalizePersistedUsageRow, type PersistedUsageEntry } from "../usage/log";
 import { computeEntryCost } from "../usage/summary";
 import { openRequestHistoryIndex, requestHistoryDb } from "./history/indexer";
 
@@ -141,8 +141,7 @@ function classifyRow(row: ScannedRow): "success" | "failure" | "cancelled" {
 
 function parseEntry(rowJson: string): PersistedUsageEntry | null {
   try {
-    const parsed = JSON.parse(rowJson) as PersistedUsageEntry;
-    return parsed && typeof parsed === "object" && typeof parsed.requestId === "string" ? parsed : null;
+    return normalizePersistedUsageRow(JSON.parse(rowJson)) ?? null;
   } catch {
     return null;
   }