@bitkyc08/opencodex 2.91.0 → 2.92.0

package/src/providers/stale-model-roster-migration.ts

@@ -10,13 +10,18 @@
  * This rewrites one thing: a saved `models` list that is still byte-for-byte the roster
  * this file names as `from`, on a provider that still carries the registry adapter, and
  * only while the registry currently seeds `to`. A list the user changed does not match and
- * is left alone. For each added id it also fills a per-model context window and default
- * effort, but only inside a container the row already has: enrichment fills those records
- * all-or-nothing, so creating one here would hide the rest of the registry seed.
+ * is left alone. For each added id it also fills a per-model context window, output limit
+ * and default effort, but only inside a container the row already has: enrichment fills
+ * those records all-or-nothing, so creating one here would hide the rest of the registry seed.
  * Same shape and restraint as `stale-context-window-migration`.
  */
-import { PROVIDER_REGISTRY } from "./registry";
+import { ALIBABA_INTL_TOKEN_PLAN_BASE_URL } from "./base-url-choices";
+import { PROVIDER_REGISTRY, normalizedProviderEndpoint } from "./registry";
 import {
+  ALIBABA_TOKEN_PLAN_MODELS,
+  ALIBABA_INTL_TOKEN_PLAN_MODELS,
+  ALIBABA_TOKEN_PLAN_CONTEXT_WINDOWS,
+  ALIBABA_TOKEN_PLAN_MAX_OUTPUT_TOKENS,
   MINIMAX_M31_DEFAULT_REASONING_EFFORT,
   MINIMAX_M31_FLASH_PREVIEW,
   MINIMAX_MODELS,
@@ -33,7 +38,18 @@ export interface StaleModelRoster {
   to: readonly string[];
   /** Per-model seed values for the added ids, written only into containers that exist. */
   contextWindows?: Readonly<Record<string, number>>;
+  /**
+   * Custom catalog rows read the saved map directly, so an added id missing from a
+   * partial map would publish without the registry output limit.
+   */
+  maxOutputTokens?: Readonly<Record<string, number>>;
   defaultReasoningEfforts?: Readonly<Record<string, string>>;
+  /**
+   * For a provider whose saved URL may point elsewhere (pay-as-you-go or Custom), the
+   * destinations whose roster `to` describes. A row on any other URL keeps its list; a row
+   * with no saved URL uses the registry default and is refreshed.
+   */
+  destinationBaseUrls?: readonly string[];
 }
 
 export interface StaleModelRosterProjection {
@@ -42,17 +58,45 @@ export interface StaleModelRosterProjection {
   warnings: string[];
 }
 
+const ALIBABA_TOKEN_PLAN_MODELS_BEFORE_1017 = [
+  "qwen3.8-max", "qwen3.8-flash", "qwen3.7-max", "qwen3.7-plus", "qwen3.6-flash",
+  "deepseek-v4-pro", "deepseek-v4-flash-0731", "deepseek-v4.1-flash", "glm-5.2", "glm-5.3",
+];
+const ALIBABA_INTL_TOKEN_PLAN_MODELS_BEFORE_1017 = [
+  "qwen3.8-max", "qwen3.8-flash", "qwen3.7-max", "qwen3.7-plus", "qwen3.6-plus", "qwen3.6-flash",
+  "deepseek-v4-pro", "deepseek-v4-pro-0813", "deepseek-v4-flash", "deepseek-v4-flash-0731", "deepseek-v4.1-flash", "deepseek-v3.2",
+  "kimi-k2.7-code", "kimi-k2.6", "kimi-k2.5",
+  "glm-5.2", "glm-5.3", "glm-5.1", "glm-5",
+  "MiniMax-M2.5",
+];
+
 /**
  * MiniMax-M3.1-Flash-Preview (2026-09-30). MiniMax's /v1/models roster does not list the
  * preview, so live discovery cannot add it; the catalog keeps it only when it is configured.
  */
-export const STALE_MODEL_ROSTERS: readonly StaleModelRoster[] = ["minimax", "minimax-cn"].map(provider => ({
-  provider,
-  from: MINIMAX_MODELS_BEFORE_M31,
-  to: MINIMAX_MODELS,
-  contextWindows: { [MINIMAX_M31_FLASH_PREVIEW]: MINIMAX_MODEL_CONTEXT_WINDOWS[MINIMAX_M31_FLASH_PREVIEW]! },
-  defaultReasoningEfforts: { [MINIMAX_M31_FLASH_PREVIEW]: MINIMAX_M31_DEFAULT_REASONING_EFFORT },
-}));
+export const STALE_MODEL_ROSTERS: readonly StaleModelRoster[] = [
+  ...["minimax", "minimax-cn"].map(provider => ({
+    provider,
+    from: MINIMAX_MODELS_BEFORE_M31,
+    to: MINIMAX_MODELS,
+    contextWindows: { [MINIMAX_M31_FLASH_PREVIEW]: MINIMAX_MODEL_CONTEXT_WINDOWS[MINIMAX_M31_FLASH_PREVIEW]! },
+    defaultReasoningEfforts: { [MINIMAX_M31_FLASH_PREVIEW]: MINIMAX_M31_DEFAULT_REASONING_EFFORT },
+  })),
+  ...[
+    { provider: "alibaba-token-plan", from: ALIBABA_TOKEN_PLAN_MODELS_BEFORE_1017, to: ALIBABA_TOKEN_PLAN_MODELS },
+    // International honors pay-as-you-go and Custom URLs, which may still serve the retired ids.
+    // Beijing needs no guard: the router pins it to the registry Token Plan host.
+    {
+      provider: "alibaba-token-plan-intl", from: ALIBABA_INTL_TOKEN_PLAN_MODELS_BEFORE_1017, to: ALIBABA_INTL_TOKEN_PLAN_MODELS,
+      destinationBaseUrls: [ALIBABA_INTL_TOKEN_PLAN_BASE_URL],
+    },
+  ].map(entry => ({
+    ...entry,
+    contextWindows: ALIBABA_TOKEN_PLAN_CONTEXT_WINDOWS,
+    maxOutputTokens: ALIBABA_TOKEN_PLAN_MAX_OUTPUT_TOKENS,
+    defaultReasoningEfforts: { "deepseek-v4.1-flash-1017": "high" },
+  })),
+];
 
 function sameList(value: unknown, expected: readonly string[]): boolean {
   return Array.isArray(value)
@@ -65,12 +109,24 @@ function registrySeeds(provider: string, adapter: unknown, roster: readonly stri
   return entry !== undefined && entry.adapter === adapter && sameList(entry.models, roster);
 }
 
-function fillExisting<T>(container: Record<string, T> | undefined, values: Readonly<Record<string, T>> | undefined, ids: readonly string[]): void {
-  if (!container || !values) return;
+function servesRoster(baseUrl: unknown, destinations: readonly string[] | undefined): boolean {
+  if (!destinations || baseUrl === undefined || baseUrl === "") return true;
+  if (typeof baseUrl !== "string") return false;
+  const saved = normalizedProviderEndpoint(baseUrl);
+  return destinations.some(url => normalizedProviderEndpoint(url) === saved);
+}
+
+function fillExisting<T>(container: Record<string, T> | undefined, values: Readonly<Record<string, T>> | undefined, ids: readonly string[]): boolean {
+  if (!container || !values) return false;
+  let filled = false;
   for (const id of ids) {
     const value = values[id];
-    if (value !== undefined && !Object.prototype.hasOwnProperty.call(container, id)) container[id] = value;
+    if (value !== undefined && !Object.prototype.hasOwnProperty.call(container, id)) {
+      container[id] = value;
+      filled = true;
+    }
   }
+  return filled;
 }
 
 /** Pure projection. The caller decides whether to persist. */
@@ -85,10 +141,22 @@ export function projectStaleModelRosters(
     const prov = config.providers?.[entry.provider];
     if (!prov) continue;
     if (!registrySeeds(entry.provider, prov.adapter, entry.to)) continue;
-    if (!sameList(prov.models, entry.from)) continue;
+    if (!servesRoster(prov.baseUrl, entry.destinationBaseUrls)) continue;
     const added = entry.to.filter(id => !entry.from.includes(id));
+    if (sameList(prov.models, entry.to)) {
+      // A row refreshed before output limits joined the refresh still has a partial map.
+      // Only that record is revisited: the earlier pass already filled windows and efforts,
+      // so refilling them could restore a key the operator has since removed.
+      if (fillExisting(prov.modelMaxOutputTokens, entry.maxOutputTokens, added)) {
+        changed = true;
+        warnings.push(`filled output limits for ${added.join(", ")} on the saved "${entry.provider}" row.`);
+      }
+      continue;
+    }
+    if (!sameList(prov.models, entry.from)) continue;
     prov.models = [...entry.to];
     fillExisting(prov.modelContextWindows, entry.contextWindows, added);
+    fillExisting(prov.modelMaxOutputTokens, entry.maxOutputTokens, added);
     fillExisting(prov.modelDefaultReasoningEfforts, entry.defaultReasoningEfforts, added);
     changed = true;
     warnings.push(

package/src/providers/workbuddy-credit-balance.ts

@@ -0,0 +1,81 @@
+export interface WorkBuddyCreditAmount {
+  total: number;
+  used: number;
+  remaining: number;
+  frozen: number;
+}
+
+export const WORKBUDDY_CREDIT_KINDS = ["plan_base", "plan_bonus", "addon", "benefit", "other"] as const;
+export type WorkBuddyCreditKind = typeof WORKBUDDY_CREDIT_KINDS[number];
+
+/** Display-only credits; they are neither USD nor provider-wide model eligibility. */
+export interface WorkBuddyCreditBalance extends WorkBuddyCreditAmount {
+  groups: Array<WorkBuddyCreditAmount & { kind: WorkBuddyCreditKind }>;
+  expiring?: { amount: number; at: number };
+}
+
+export function workBuddyRecord(value: unknown): Record<string, unknown> {
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value as Record<string, unknown> : {};
+}
+
+export function workBuddyCapacity(value: unknown): number | undefined {
+  if (typeof value !== "number" && !(typeof value === "string" && /^\d+(?:\.\d+)?$/.test(value))) return undefined;
+  const number = Number(value);
+  return Number.isFinite(number) && number >= 0 && number <= Number.MAX_SAFE_INTEGER ? number : undefined;
+}
+
+function amount(value: unknown): WorkBuddyCreditAmount | undefined {
+  const row = workBuddyRecord(value);
+  const total = workBuddyCapacity(row.total), used = workBuddyCapacity(row.used);
+  const remaining = workBuddyCapacity(row.remaining), frozen = workBuddyCapacity(row.frozen);
+  if (total === undefined || used === undefined || remaining === undefined || frozen === undefined) return undefined;
+  return { total, used, remaining, frozen };
+}
+
+/** Narrow wire/cache input before rendering, without admitting account or package identifiers. */
+export function normalizeWorkBuddyCredits(value: unknown): WorkBuddyCreditBalance | undefined {
+  const row = workBuddyRecord(value), balance = amount(value);
+  if (!balance || !Array.isArray(row.groups) || row.groups.length > WORKBUDDY_CREDIT_KINDS.length) return undefined;
+  const groups: WorkBuddyCreditBalance["groups"] = [];
+  const seen = new Set<string>();
+  for (const raw of row.groups) {
+    const group = workBuddyRecord(raw), quantities = amount(group);
+    const kind = WORKBUDDY_CREDIT_KINDS.find(kind => kind === group.kind);
+    if (!quantities || !kind || seen.has(kind)) return undefined;
+    seen.add(kind); groups.push({ kind, ...quantities });
+  }
+  const expiring = workBuddyRecord(row.expiring), quantity = workBuddyCapacity(expiring.amount);
+  const at = typeof expiring.at === "number" && expiring.at > 0 && Number.isFinite(new Date(expiring.at).getTime()) ? expiring.at : undefined;
+  return { ...balance, groups, ...(quantity !== undefined && quantity > 0 && at !== undefined ? { expiring: { amount: quantity, at } } : {}) };
+}
+
+function packageAmount(row: Record<string, unknown>): WorkBuddyCreditAmount | undefined {
+  const total = workBuddyCapacity(row.CycleTotalCapacity), used = workBuddyCapacity(row.CycleUsedCapacity);
+  const frozen = row.CycleFrozenCapacity === undefined ? 0 : workBuddyCapacity(row.CycleFrozenCapacity);
+  if (total === undefined || used === undefined || frozen === undefined) return undefined;
+  const remaining = row.CycleRemainCapacity === undefined ? Math.max(0, total - used - frozen) : workBuddyCapacity(row.CycleRemainCapacity);
+  return remaining === undefined ? undefined : { total, used, remaining, frozen };
+}
+
+export function parseWorkBuddyCredits(value: unknown): WorkBuddyCreditBalance | undefined {
+  const summary = workBuddyRecord(value);
+  if (!Array.isArray(summary.Packages) || summary.Packages.length > 512) return undefined;
+  const balance: WorkBuddyCreditBalance = { total: 0, used: 0, remaining: 0, frozen: 0, groups: [] };
+  for (const raw of summary.Packages) {
+    const quantities = packageAmount(workBuddyRecord(raw));
+    if (!quantities) return undefined;
+    for (const key of ["total", "used", "remaining", "frozen"] as const) balance[key] += quantities[key];
+  }
+  // CreditGroups is a breakdown of Packages, not another balance to add to it.
+  if (Array.isArray(summary.CreditGroups) && summary.CreditGroups.length <= 16) {
+    for (const raw of summary.CreditGroups) {
+      const row = workBuddyRecord(raw), quantities = packageAmount(row);
+      if (!quantities) continue;
+      const kind = WORKBUDDY_CREDIT_KINDS.find(kind => kind === row.Kind) ?? "other";
+      const existing = balance.groups.find(group => group.kind === kind);
+      if (existing) for (const key of ["total", "used", "remaining", "frozen"] as const) existing[key] += quantities[key];
+      else balance.groups.push({ kind, ...quantities });
+    }
+  }
+  return normalizeWorkBuddyCredits(balance);
+}

package/src/providers/workbuddy-models.ts

@@ -0,0 +1,37 @@
+import { isValidModelDiscoveryModelId } from "./model-discovery-limits";
+import type { ProviderModelItemsResult, ProviderModelsApiItem } from "./model-discovery";
+
+function record(value: unknown): Record<string, unknown> {
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value as Record<string, unknown> : {};
+}
+
+/** The product catalog contains non-chat models too; only the CLI agent's roster is routable. */
+export function extractWorkBuddyModels(value: unknown, limit: number): ProviderModelItemsResult {
+  const envelope = record(value), data = record(envelope.data);
+  if ((envelope.code !== 0 && envelope.code !== "0") || !Array.isArray(data.agents) || !Array.isArray(data.models)) return { ok: false, reason: "invalid_shape" };
+  if (data.models.length > limit || data.agents.length > limit) return { ok: false, reason: "too_many_models" };
+  const agent = data.agents.map(record).find(a => a.name === "cli");
+  if (!Array.isArray(agent?.models)) return { ok: false, reason: "invalid_shape" };
+  if (agent.models.length > limit) return { ok: false, reason: "too_many_models" };
+  const definitions = new Map(data.models.map(raw => { const row = record(raw); return [row.id, row] as const; }));
+  const items: ProviderModelsApiItem[] = [], seen = new Set<string>();
+  for (const id of agent.models) {
+    if (!isValidModelDiscoveryModelId(id)) return { ok: false, reason: "invalid_shape" };
+    if (seen.has(id)) continue;
+    seen.add(id);
+    const row = definitions.get(id) ?? {}, reasoning = record(row.reasoning);
+    const rawEfforts = Array.isArray(reasoning.supportedEfforts) ? reasoning.supportedEfforts
+      : row.supportsReasoning === true ? ["low", "high", "max"] : [];
+    const efforts = rawEfforts.filter(e => typeof e === "string" && ["low", "medium", "high", "xhigh", "max"].includes(e));
+    if (efforts.length && row.onlyReasoning !== true && reasoning.canDisableThinking !== false) efforts.unshift("none");
+    const positive = (v: unknown) => typeof v === "number" && Number.isSafeInteger(v) && v > 0 ? v : undefined;
+    items.push({
+      id, ...(typeof row.name === "string" && row.name.length <= 256 ? { name: row.name } : {}),
+      context_length: positive(row.maxInputTokens), max_input_tokens: positive(row.maxInputTokens),
+      max_output_tokens: positive(row.maxOutputTokens), reasoning_efforts: efforts,
+      // WorkBuddy AI filters images from GLM requests despite advertising supportsImages.
+      input_modalities: row.supportsImages === true && !id.startsWith("glm-") ? ["text", "image"] : ["text"],
+    });
+  }
+  return { ok: true, items, rawCount: agent.models.length };
+}

package/src/providers/workbuddy.ts

@@ -0,0 +1,60 @@
+import type { WorkBuddyOAuthMetadata } from "../oauth/types";
+import { createHash } from "node:crypto";
+
+export const WORKBUDDY_ORIGIN = "https://www.workbuddy.ai";
+export const WORKBUDDY_BASE_URL = `${WORKBUDDY_ORIGIN}/v2`;
+export const WORKBUDDY_CONFIG_URL = `${WORKBUDDY_ORIGIN}/v3/config`;
+export const WORKBUDDY_USER_AGENT = "WorkBuddy/5.5.6";
+
+export function workBuddyCatalogIdentity(access: string, metadata: WorkBuddyOAuthMetadata | undefined): string {
+  return createHash("sha256").update(JSON.stringify([access, metadata])).digest("hex");
+}
+
+export function workBuddyHeaderValue(value: unknown, max = 1024): value is string {
+  return typeof value === "string" && value.length > 0 && value.length <= max && /^[\x21-\x7e]+$/.test(value);
+}
+
+export function normalizeWorkBuddyMetadata(value: unknown): WorkBuddyOAuthMetadata | undefined {
+  if (!value || typeof value !== "object") return undefined;
+  const v = value as Partial<WorkBuddyOAuthMetadata>;
+  if (!workBuddyHeaderValue(v.uid) || !workBuddyHeaderValue(v.domain)) return undefined;
+  if (v.enterpriseId !== undefined && !workBuddyHeaderValue(v.enterpriseId)) return undefined;
+  return {
+    uid: v.uid, domain: v.domain,
+    ...(v.enterpriseId ? { enterpriseId: v.enterpriseId } : {}),
+    ...(typeof v.refreshExpiresAt === "number" && Number.isFinite(v.refreshExpiresAt) && v.refreshExpiresAt > 0
+      ? { refreshExpiresAt: v.refreshExpiresAt } : {}),
+  };
+}
+
+export function assertWorkBuddyDestination(baseUrl: string): void {
+  const u = new URL(baseUrl);
+  if (u.origin !== WORKBUDDY_ORIGIN || u.username || u.password || u.search || u.hash
+    || !["", "/v2", "/v2/chat/completions"].includes(u.pathname.replace(/\/+$/, ""))) {
+    throw new Error("WorkBuddy AI credentials require https://www.workbuddy.ai/v2");
+  }
+}
+
+export function workBuddyHeaders(access: string | undefined, metadata?: WorkBuddyOAuthMetadata): Record<string, string> {
+  const headers: Record<string, string> = {
+    "User-Agent": WORKBUDDY_USER_AGENT,
+    "X-Product": "SaaS", "X-IDE-Type": "WorkBuddy", "X-IDE-Name": "WorkBuddy",
+    "X-IDE-Version": "5.5.6", "X-Requested-With": "XMLHttpRequest",
+    "X-Agent-Intent": "craft", "X-Agent-Purpose": "conversation", "X-Agent-Type": "main",
+  };
+  if (access) {
+    if (!workBuddyHeaderValue(access, 32768)) throw new Error("Invalid WorkBuddy AI access token");
+    headers.Authorization = `Bearer ${access}`;
+  }
+  if (metadata) {
+    const valid = normalizeWorkBuddyMetadata(metadata);
+    if (!valid) throw new Error("WorkBuddy AI account identity unavailable; sign in again");
+    headers["X-User-Id"] = valid.uid;
+    headers["X-Domain"] = valid.domain;
+    if (valid.enterpriseId) {
+      headers["X-Enterprise-Id"] = valid.enterpriseId;
+      headers["X-Tenant-Id"] = valid.enterpriseId;
+    }
+  }
+  return headers;
+}

package/src/responses/reasoning-replay-cache.ts

@@ -143,8 +143,9 @@ function tupleForServingIdentity(
 
 function keyFor(callId: string, scope: OcxReasoningReplayScopeRef | undefined): string | undefined {
   const identity = tupleForIdentity(scope?.current);
-  if (!nonEmpty(callId) || !nonEmpty(scope?.clientThreadId) || !identity) return undefined;
+  if (!nonEmpty(callId) || !nonEmpty(scope?.clientPrincipalId) || !nonEmpty(scope.clientThreadId) || !identity) return undefined;
   return JSON.stringify([
+    scope.clientPrincipalId,
     scope.clientThreadId,
     ...identity,
     callId,
@@ -166,18 +167,21 @@ function sweepExpiredServingIdentities(at: number): void {
 
 function servingIdentityFor(
   scope: OcxReasoningReplayScopeRef | undefined,
-): { threadId: string; identity: string } | undefined {
+): { key: string; identity: string } | undefined {
   const threadId = scope?.clientThreadId;
   const identityTuple = tupleForServingIdentity(scope?.current);
   if (!nonEmpty(threadId) || !identityTuple) return undefined;
-  return { threadId, identity: JSON.stringify(identityTuple) };
+  // Preserve physical safeguards for keyless callers in a separate namespace. A caller's
+  // thread name cannot select an authenticated principal's serving or rejection history.
+  const key = JSON.stringify([nonEmpty(scope?.clientPrincipalId) ? scope.clientPrincipalId : null, threadId]);
+  return { key, identity: JSON.stringify(identityTuple) };
 }
 
 function opaqueBlobRejectionKeyFor(
   scope: OcxReasoningReplayScopeRef | undefined,
 ): string | undefined {
   const current = servingIdentityFor(scope);
-  return current ? JSON.stringify([current.threadId, current.identity]) : undefined;
+  return current ? JSON.stringify([current.key, current.identity]) : undefined;
 }
 
 function deleteOpaqueBlobRejection(key: string): void {
@@ -224,7 +228,7 @@ export function reasoningReplayServingIdentityChange(
   if (!current) return undefined;
   const at = now();
   sweepExpiredServingIdentities(at);
-  const previous = servingIdentities.get(current.threadId);
+  const previous = servingIdentities.get(current.key);
   if (previous === undefined || previous.identity === current.identity) return undefined;
   const before = JSON.parse(previous.identity) as ReasoningReplayIdentityTuple;
   const after = JSON.parse(current.identity) as ReasoningReplayIdentityTuple;
@@ -254,7 +258,7 @@ export function reasoningReplayItemStoreChanged(
   if (!current) return false;
   const at = now();
   sweepExpiredServingIdentities(at);
-  const previous = servingIdentities.get(current.threadId);
+  const previous = servingIdentities.get(current.key);
   if (previous === undefined || previous.identity === current.identity) return false;
   const storeOwner = (identity: string): string => {
     const [, destination, , , credential] = JSON.parse(identity) as ReasoningReplayIdentityTuple;
@@ -271,16 +275,16 @@ export function commitReasoningReplayServingIdentity(
   if (!current) return;
   const at = now();
   sweepExpiredServingIdentities(at);
-  const previous = servingIdentities.get(current.threadId);
-  const { threadId, identity } = current;
-  const bytes = Buffer.byteLength(JSON.stringify([threadId, identity]), "utf8");
+  const previous = servingIdentities.get(current.key);
+  const { key, identity } = current;
+  const bytes = Buffer.byteLength(JSON.stringify([key, identity]), "utf8");
   if (bytes > MAX_TOTAL_BYTES) {
-    deleteServingIdentity(threadId);
+    deleteServingIdentity(key);
     return;
   }
 
-  if (previous) deleteServingIdentity(threadId);
-  servingIdentities.set(threadId, { identity, bytes, at });
+  if (previous) deleteServingIdentity(key);
+  servingIdentities.set(key, { identity, bytes, at });
   servingIdentityTotalBytes += bytes;
   while (
     (servingIdentityTotalBytes > MAX_TOTAL_BYTES || servingIdentities.size > MAX_ENTRIES)
@@ -517,13 +521,13 @@ export function reasoningReplayKeyCredentialIdentity(
   return reasoningReplayCredentialIdentity("key", apiKey, provider.headers);
 }
 
-/** Replace only the holder snapshot so parsed-request copies observe rotations. */
+/** Bind physical identity independently of the principal required for plaintext cache access. */
 export function bindReasoningReplayScope(
   scope: OcxReasoningReplayScopeRef | undefined,
   identity: OcxReasoningReplayIdentity | undefined,
 ): void {
   if (!scope) return;
-  if (!identity || !keyFor("binding-check", { ...scope, current: identity })) {
+  if (!identity || !nonEmpty(scope.clientThreadId) || !tupleForIdentity(identity)) {
     delete scope.current;
     return;
   }

package/src/router.ts

@@ -33,6 +33,7 @@ import {
 import { decodeRoutedModelIdOrThrow, encodeRoutedModelId } from "./providers/slug-codec";
 import { effectiveProviderAliasDecision, resolveModelAlias } from "./providers/default-aliases";
 import { resolveBlockedModelRedirect } from "./lib/shadow-call";
+import { workBuddyCatalogIdentity } from "./providers/workbuddy";
 import { getRoutingCached } from "./codex/model-cache";
 import { codexAccountNamespaceEntries } from "./codex/account-namespaces";
 import {
@@ -177,6 +178,7 @@ export function knownModelIdsForProvider(
       if (!account || account.needsReauth || !Number.isFinite(account.credential.expires)
         || account.credential.expires <= Date.now()) return undefined;
       key = account.credential.access;
+      if (provName === "workbuddy-ai") return workBuddyCatalogIdentity(key, account.credential.workbuddy);
       if (routed.adapter === "devin") destination = validateDevinApiBaseUrl(account.credential.apiBaseUrl) ?? routed.baseUrl;
     }
     if (!key) return undefined;

package/src/routing/analytics.ts

@@ -11,7 +11,7 @@
  * sample for the full history.
  */
 
-import type { PersistedUsageEntry } from "../usage/log";
+import { normalizePersistedUsageRow, type PersistedUsageEntry } from "../usage/log";
 import { computeEntryCost } from "../usage/summary";
 import { openRequestHistoryIndex, requestHistoryDb } from "./history/indexer";
 
@@ -141,8 +141,7 @@ function classifyRow(row: ScannedRow): "success" | "failure" | "cancelled" {
 
 function parseEntry(rowJson: string): PersistedUsageEntry | null {
   try {
-    const parsed = JSON.parse(rowJson) as PersistedUsageEntry;
-    return parsed && typeof parsed === "object" && typeof parsed.requestId === "string" ? parsed : null;
+    return normalizePersistedUsageRow(JSON.parse(rowJson)) ?? null;
   } catch {
     return null;
   }

package/src/routing/fallback-policy.ts

@@ -192,9 +192,9 @@ export type FallbackGuardResult =
     ok: true;
     kind: OcxFallbackKind | null;
     /**
-     * Record the hop as taken. A site calls it once the fallback dispatch is admitted (send
-     * budget reserved, candidate not locally skipped), so the ring never claims a target that was
-     * never contacted. Idempotent; a no-op for a same-target retry.
+     * Record the hop as taken at the site's admission boundary (body rewrite, send-budget
+     * reservation, or accepted candidate). This does not prove upstream contact or billing;
+     * later preparation may still refuse. Idempotent; a no-op for a same-target retry.
      */
     commit: () => void;
   }

package/src/server/auth-cors.ts

@@ -1195,6 +1195,7 @@ const PROVIDER_CONFIG_FIELD_POLICY = {
   desktopExecutor: "redacted",
   unsafeAllowNativeLocalExec: "editor",
   nativeLocalExec: "editor",
+  messagePhaseInference: "editor",
   tlsProfile: "editor",
 } as const satisfies Record<keyof OcxProviderConfig, ProviderConfigFieldPolicy>;
 

package/src/server/chat-completions.ts

@@ -40,6 +40,9 @@ import { evidenceFromBody } from "../routing/request-evidence";
 import { resolveWireProtocolOverride } from "./adapter-resolve";
 import { resolveOpenCodeGoTransport } from "../providers/opencode-go-transport";
 import {
+  assignNativeLogConversationId,
+  fillHermesLogConversationFallback,
+  nativeLogConversationIdFromHeaders,
   getOrAllocateRequestSessionLane,
   linkRequestSessionLane,
 } from "./request-log-conversation";
@@ -69,7 +72,7 @@ import {
   assertRouteAllowedByScope,
   resolveAdmissionModelScope,
 } from "./admission-model-scope";
-import type { DataPlaneAdmission } from "./auth-cors";
+import { resolveContextPrincipal, type DataPlaneAdmission } from "./auth-cors";
 import { tryClaimNativeMainProfileForTurn } from "../codex/native-main-admission";
 import {
   createTranslatorBudget,
@@ -114,6 +117,10 @@ export async function handleChatCompletions(
   logCtx: RequestLogContext,
   logIds?: { requestId: string; start: number; turnAdmissionLease?: AdmissionLease; admission?: DataPlaneAdmission },
 ): Promise<Response> {
+  // Set before routing so pre-dispatch refusals stay correlated. A Hermes-only id is marked as a
+  // fallback, so a native id resolved later on the Responses bridge still replaces it.
+  assignNativeLogConversationId(logCtx, nativeLogConversationIdFromHeaders(req.headers));
+  fillHermesLogConversationFallback(logCtx, req.headers);
   const translatorBudget = createTranslatorBudget();
   try {
     let response = await handleChatCompletionsWithBudget(req, config, logCtx, translatorBudget, logIds);
@@ -420,6 +427,7 @@ async function handleChatCompletionsWithBudget(
   // Unresolved combos are checked after their concrete child route is selected in Responses.
   if (settledRoute && !settledRoute.combo && isCanonicalOpenAiForwardProvider(settledRoute.provider)
     && isCodexReserveHelperUnsupported(config, settledRoute.modelId, logIds?.admission, visionDescribeTerminal)) {
+    if (logIds) addFinalRequestLog(logIds.requestId, logIds.start, logCtx, 400, { closeReason: "non_stream" });
     return chatCompletionsErrorResponse(400, CODEX_RESERVE_HELPER_UNSUPPORTED_MESSAGE, "invalid_request_error");
   }
   const nativeCallerAuth = captureExplicitOpenAiCallerAuth(req.headers, config);
@@ -498,6 +506,8 @@ async function handleChatCompletionsWithBudget(
     // #1686: the Chat surface translates its body and replays here, so the admission fact has
     // to ride along or a bearer-admitted Chat caller would still be refused by Direct.
     ...(logIds?.admission ? { admission: logIds.admission } : {}),
+    // The bridge request carries no caller credential, so resolve the replay principal here.
+    replayPrincipal: { clientPrincipalId: resolveContextPrincipal(req, config, logIds?.admission) },
     abortSignal: req.signal,
     // Body is Responses-shaped by now, but the client spoke Chat Completions.
     inboundWire: "chat",
@@ -512,6 +522,9 @@ async function handleChatCompletionsWithBudget(
     ...(envelope && nativeChatCombos ? {
       protocolSource: createNativeChatComboSource({
         req, config, envelope, requestedModel, requestedStream: stream, translatorBudget,
+        // Children run without logIds; the request's admission rides the source so their
+        // replay scope resolves the same caller principal as every other surface.
+        ...(logIds?.admission ? { admission: logIds.admission } : {}),
       }),
     } : {}),
     // Terminal vision-describe marker (roadmap 180): the bridge rebuilds

package/src/server/chat-native-reasoning.ts

@@ -7,11 +7,17 @@ import { reasoningReplayConversationIdFromResponsesRequest, sessionIdHeaderFromR
 
 type Rec = Record<string, unknown>;
 
-export function nativeChatReplayScope(headers: Headers): OcxReasoningReplayScopeRef | undefined {
+export function nativeChatReplayScope(
+  headers: Headers,
+  clientPrincipalId: string | undefined,
+): OcxReasoningReplayScopeRef | undefined {
   const clientThreadId = reasoningReplayConversationIdFromResponsesRequest({
     threadIdHeader: headers.get("thread-id"), sessionIdHeader: sessionIdHeaderFromRequest(headers),
   });
-  return clientThreadId ? { clientThreadId } : undefined;
+  return clientThreadId ? {
+    clientThreadId,
+    ...(clientPrincipalId ? { clientPrincipalId } : {}),
+  } : undefined;
 }
 
 /** Rebind before EVERY build: a key rotation must not retrieve another credential's reasoning. */
@@ -42,7 +48,8 @@ export function nativeChatReasoningCapture(
   const maxBytes = 256 * 1024;
   let bytes = 0;
   let callCount = 0;
-  let disabled = !scope?.current || !chatReasoningReplayPolicy(provider, modelId).preserve;
+  let disabled = !scope?.clientPrincipalId || !scope.current
+    || !chatReasoningReplayPolicy(provider, modelId).preserve;
   const discard = () => {
     budget.releaseRetained(bytes, accounting);
     bytes = 0;

package/src/server/chat-native.ts

@@ -24,6 +24,7 @@ import {
 } from "../lib/errors";
 import { reportDispatchSends, type RequestExecutionBudget, type SingleUseDispatchPermit } from "../lib/request-execution-budget";
 import type { AdmissionLease } from "../lib/admission";
+import { resolveContextPrincipal, type DataPlaneAdmission } from "./auth-cors";
 import { readBoundedResponseBody } from "../lib/bounded-body";
 import { redactSecretString } from "../lib/redact";
 import { resolveClientRetryAfter } from "../lib/retry-after";
@@ -179,7 +180,7 @@ export interface HandleNativeChatOptions {
   req: Request;
   config: OcxConfig;
   logCtx: RequestLogContext;
-  logIds?: { requestId: string; start: number; turnAdmissionLease?: AdmissionLease };
+  logIds?: { requestId: string; start: number; turnAdmissionLease?: AdmissionLease; admission?: DataPlaneAdmission };
   route: RouteResult;
   chatBody: Rec;
   requestedModel: string;
@@ -209,6 +210,12 @@ export interface NativeChatExecution extends HandleNativeChatOptions {
   onFirstOutput?: () => void;
   /** The lease a streamed body holds; defaults to `logIds.turnAdmissionLease`. */
   turnAdmissionLease?: AdmissionLease;
+  /**
+   * The request's resolved data-plane admission, when the caller carries it without `logIds`.
+   * A combo child runs on the parent's log row, so it receives the admitted identity here or
+   * its reasoning replay scope can never establish a caller principal (PF-07).
+   */
+  admission?: DataPlaneAdmission;
 }
 
 /**
@@ -246,6 +253,8 @@ export function createNativeChatComboSource(input: {
   requestedModel: string;
   requestedStream: boolean;
   translatorBudget: TranslatorBudget;
+  /** The request's data-plane admission; native children inherit it for replay scope. */
+  admission?: DataPlaneAdmission;
 }): ComboProtocolSource {
   return {
     inbound: "chat",
@@ -264,6 +273,7 @@ export function createNativeChatComboSource(input: {
       comboDispatchPermit: child.comboDispatchPermit,
       onFirstOutput: child.onFirstOutput,
       ...(child.turnAdmissionLease ? { turnAdmissionLease: child.turnAdmissionLease } : {}),
+      ...(input.admission ? { admission: input.admission } : {}),
     }, child.attemptHandle),
   };
 }
@@ -340,7 +350,8 @@ export async function runNativeChatAttempt(
   const physicalBudget = sendBudget ?? createInferenceSendBudget(req, logCtx);
   let activeAdapter: ProviderAdapter = createOpenAIChatAdapter(activeProvider);
   let activeRequest: AdapterRequest;
-  const replayScope = nativeChatReplayScope(req.headers);
+  const replayScope = nativeChatReplayScope(req.headers,
+    resolveContextPrincipal(req, config, execution.admission ?? logIds?.admission));
   let retainedRequestBytes = 0;
   const releaseRetainedRequest = () => {
     if (retainedRequestBytes === 0) return;

package/src/server/claude-messages.ts

@@ -100,6 +100,7 @@ import {
   isApiAuthRequired,
   isDataPlaneAdmissionSecret,
   isProxyAdmissionSecret,
+  resolveContextPrincipal,
   type RequestPolicyView,
   type DataPlaneAdmission,
 } from "./auth-cors";
@@ -1117,6 +1118,8 @@ async function handleClaudeMessagesWithBudget(
     // Routing keeps Claude-only sidecar overrides; admission policy must follow the live owner.
     codexAuthPolicy: config,
     ...(logIds?.admission ? { admission: logIds.admission } : {}),
+    // The translated request never forwards the caller credential; resolve the principal first.
+    replayPrincipal: { clientPrincipalId: resolveContextPrincipal(req, config, logIds?.admission) },
     ...(logIds?.turnAdmissionLease ? { turnAdmissionLease: logIds.turnAdmissionLease } : {}),
     abortSignal: req.signal,
     promptCacheKeyIsSharedCohort: cacheKeySource === "system",