@gajae-code/ai 0.12.7 → 0.12.10

package/src/auth-storage.ts

@@ -8,9 +8,11 @@
  * - `SqliteAuthCredentialStore`: concrete SQLite-backed implementation
  */
 import { Database, type Statement } from "bun:sqlite";
+import * as crypto from "node:crypto";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import { getAgentDbPath, logger } from "@gajae-code/utils";
+import { checkOpenCodexStatus } from "./providers/openai-opencodex-responses";
 import { getEnvApiKey } from "./stream";
 import type { Provider } from "./types";
 import type {
@@ -35,7 +37,13 @@ import { getOAuthApiKey, getOAuthProvider, refreshOAuthToken, resolveOAuthStorag
 import { loginDeepInfra } from "./utils/oauth/deepinfra";
 import { loginDeepSeek } from "./utils/oauth/deepseek";
 import { loginOpenAICodexDevice } from "./utils/oauth/openai-codex";
-import type { OAuthController, OAuthCredentials, OAuthProvider, OAuthProviderId } from "./utils/oauth/types";
+import type {
+	OAuthController,
+	OAuthCredentials,
+	OAuthLoginOptions,
+	OAuthProvider,
+	OAuthProviderId,
+} from "./utils/oauth/types";
 
 // ─────────────────────────────────────────────────────────────────────────────
 // Credential Types
@@ -455,8 +463,9 @@ export type AuthStorageOptions = {
 	 * Resolve a config value (API key, header value, etc.) to an actual value.
 	 * - coding-agent injects its resolveConfigValue (supports "!command" syntax via pi-natives)
 	 * - Default: checks environment variable first, then treats as literal
+	 * `cacheScope` changes whenever the provider credential configuration changes.
 	 */
-	configValueResolver?: (config: string) => Promise<string | undefined>;
+	configValueResolver?: (config: string, cacheScope?: string) => Promise<string | undefined>;
 	/**
 	 * Optional callback fired when AuthStorage automatically disables a
 	 * credential because something detected it as no longer usable — today
@@ -843,7 +852,9 @@ export class AuthStorage {
 	#usageLogger?: UsageLogger;
 	#fallbackResolver?: (provider: string) => string | undefined;
 	#store: AuthCredentialStore;
-	#configValueResolver: (config: string) => Promise<string | undefined>;
+	#configValueResolver: (config: string, cacheScope?: string) => Promise<string | undefined>;
+	#resolvedStoredApiKeyValues: Map<string, Map<string, { fingerprint: string; usable: boolean }>> = new Map();
+	#storedApiKeyResolutionInFlight: Map<string, Map<string, Promise<string | undefined>>> = new Map();
 	#refreshOAuthCredentialOverride?: AuthStorageOptions["refreshOAuthCredential"];
 	#fetchUsageReportsOverride?: AuthStorageOptions["fetchUsageReports"];
 	#sourceLabel?: string;
@@ -858,6 +869,9 @@ export class AuthStorage {
 	 */
 	#pendingDisabledEvents: CredentialDisabledEvent[] = [];
 	#generation = 1;
+	#providerGenerations = new Map<string, number>();
+	#providerConfigurationGenerations = new Map<string, number>();
+	#providerOAuthRefreshGenerations = new Map<string, number>();
 	#generationListeners: Set<(generation: number) => void> = new Set();
 	#oauthRefreshInFlight: Map<number, Promise<AuthCredentialSnapshotEntry>> = new Map();
 	#oauthCredentialRefreshInFlight: Map<number, Promise<OAuthCredentials>> = new Map();
@@ -914,7 +928,66 @@ export class AuthStorage {
 	getGeneration(): number {
 		return this.#generation;
 	}
-
+	getProviderConfigurationGeneration(provider: string): number {
+		return this.#getProviderConfigurationGeneration(provider);
+	}
+	getProviderOAuthRefreshGeneration(provider: string): number {
+		return this.#providerOAuthRefreshGenerations.get(resolveOAuthStorageProvider(provider)) ?? 0;
+	}
+	#getProviderGeneration(provider: string): number {
+		return this.#providerGenerations.get(resolveOAuthStorageProvider(provider)) ?? 1;
+	}
+	#getProviderConfigurationGeneration(provider: string): number {
+		return this.#providerConfigurationGenerations.get(resolveOAuthStorageProvider(provider)) ?? 1;
+	}
+	getProviderEvidenceGeneration(provider: string, resolvedApiKey?: string): string {
+		const storageProvider = resolveOAuthStorageProvider(provider);
+		const evidenceApiKey = resolvedApiKey;
+		let selectedCredential: ({ index: number } & StoredCredential) | undefined;
+		try {
+			selectedCredential = this.#resolveSelectedStoredCredential(provider);
+		} catch {
+			return crypto
+				.createHash("sha256")
+				.update(`${this.#getProviderGeneration(storageProvider)}\u0000unavailable-selector`)
+				.digest("hex");
+		}
+		const credentials = selectedCredential
+			? [selectedCredential.credential]
+			: this.#getCredentialsForProvider(provider);
+		const hasApiKey = credentials.some(credential => credential.type === "api_key");
+		const hasUsableOAuth = credentials.some(
+			credential =>
+				credential.type === "oauth" && Number.isFinite(credential.expires) && credential.expires > Date.now(),
+		);
+		const effectiveEnvKey =
+			this.#runtimeOverrides.get(provider) || this.#configOverrides.get(provider) || hasApiKey || hasUsableOAuth
+				? undefined
+				: getEnvApiKey(provider);
+		const storedApiKeyFingerprint = credentials
+			.filter(
+				(credential): credential is Extract<AuthCredential, { type: "api_key" }> => credential.type === "api_key",
+			)
+			.map(credential => {
+				const resolved = this.#resolvedStoredApiKeyValues.get(storageProvider)?.get(credential.key);
+				return `${credential.key}\u0000${
+					credential.key.startsWith("!")
+						? (resolved?.fingerprint ?? "")
+						: (process.env[credential.key] ?? credential.key)
+				}`;
+			})
+			.join("\u0001");
+		const storedOAuthFingerprint = credentials
+			.filter((credential): credential is Extract<AuthCredential, { type: "oauth" }> => credential.type === "oauth")
+			.map(credential => `${credential.expires}\u0000${credential.expires > Date.now() ? "usable" : "expired"}`)
+			.join("\u0001");
+		return crypto
+			.createHash("sha256")
+			.update(
+				`${this.#getProviderGeneration(storageProvider)}\u0000${effectiveEnvKey ?? ""}\u0000${storedApiKeyFingerprint}\u0000${storedOAuthFingerprint}\u0000${evidenceApiKey ?? ""}`,
+			)
+			.digest("hex");
+	}
 	onGenerationChanged(listener: (generation: number) => void): () => void {
 		this.#generationListeners.add(listener);
 		return () => {
@@ -926,8 +999,18 @@ export class AuthStorage {
 		this.#generationListeners.delete(listener);
 	}
 
-	#bumpGeneration(reason: string): void {
+	#bumpGeneration(reason: string, provider?: string): void {
 		this.#generation += 1;
+		if (provider) {
+			const storageProvider = resolveOAuthStorageProvider(provider);
+			this.#providerGenerations.set(storageProvider, this.#getProviderGeneration(storageProvider) + 1);
+			if (reason !== "stored-api-key-usability") {
+				this.#providerConfigurationGenerations.set(
+					storageProvider,
+					this.#getProviderConfigurationGeneration(storageProvider) + 1,
+				);
+			}
+		}
 		for (const listener of [...this.#generationListeners]) {
 			try {
 				listener(this.#generation);
@@ -976,7 +1059,7 @@ export class AuthStorage {
 	 */
 	setRuntimeApiKey(provider: string, apiKey: string): void {
 		this.#runtimeOverrides.set(provider, apiKey);
-		this.#bumpGeneration("set-runtime-api-key");
+		this.#bumpGeneration("set-runtime-api-key", provider);
 	}
 
 	/**
@@ -987,20 +1070,24 @@ export class AuthStorage {
 		const storageProvider = resolveOAuthStorageProvider(provider);
 		this.#assertCredentialSelectorUsable(storageProvider, selector);
 		this.#runtimeCredentialSelectors.set(storageProvider, selector);
+		this.#bumpGeneration("set-runtime-credential-selector", provider);
 	}
 
 	/**
 	 * Remove a runtime credential selector.
 	 */
 	removeRuntimeCredentialSelector(provider: string): void {
-		this.#runtimeCredentialSelectors.delete(resolveOAuthStorageProvider(provider));
+		const storageProvider = resolveOAuthStorageProvider(provider);
+		if (this.#runtimeCredentialSelectors.delete(storageProvider)) {
+			this.#bumpGeneration("remove-runtime-credential-selector", provider);
+		}
 	}
 
 	/**
 	 * Remove a runtime API key override.
 	 */
 	removeRuntimeApiKey(provider: string): void {
-		if (this.#runtimeOverrides.delete(provider)) this.#bumpGeneration("remove-runtime-api-key");
+		if (this.#runtimeOverrides.delete(provider)) this.#bumpGeneration("remove-runtime-api-key", provider);
 	}
 
 	/** Whether a provider is currently authenticated by a runtime API-key override. */
@@ -1008,6 +1095,37 @@ export class AuthStorage {
 		return Boolean(this.#runtimeOverrides.get(provider));
 	}
 
+	/**
+	 * Whether credential selection for a provider is pinned to one stored row by
+	 * a runtime selector (`--credential`).
+	 *
+	 * Distinct from {@link AuthStorage.hasRuntimeApiKey}: that reports the
+	 * `--api-key` override, which lives in a different map and is mutually
+	 * exclusive with a selector. Callers that must not rotate away from a pinned
+	 * credential have to consult BOTH.
+	 */
+	hasRuntimeCredentialSelector(provider: string): boolean {
+		return this.#runtimeCredentialSelectors.has(resolveOAuthStorageProvider(provider));
+	}
+
+	/**
+	 * Opaque stored row id of the credential this session is currently using.
+	 *
+	 * Deliberately non-identifying: the persisted primary key, never an email,
+	 * account id, project id, or key material. Callers that need to correlate a
+	 * credential across a session boundary use this instead of projecting
+	 * personal metadata.
+	 *
+	 * Returns `undefined` when the session has not been routed to a stored
+	 * credential yet, or when it authenticated through an env key or fallback
+	 * resolver rather than a stored row.
+	 */
+	getSessionCredentialRowId(provider: string, sessionId?: string): number | undefined {
+		const session = this.#getSessionCredential(provider, sessionId);
+		if (!session) return undefined;
+		return this.#getStoredCredentials(provider)[session.index]?.id;
+	}
+
 	/**
 	 * Register a per-provider API key sourced from user configuration
 	 * (e.g. `models.yml` `providers.<name>.apiKey`). Higher priority than
@@ -1020,14 +1138,14 @@ export class AuthStorage {
 	 */
 	setConfigApiKey(provider: string, apiKey: string): void {
 		this.#configOverrides.set(provider, apiKey);
-		this.#bumpGeneration("set-config-api-key");
+		this.#bumpGeneration("set-config-api-key", provider);
 	}
 
 	/**
 	 * Remove a single config-sourced API key override.
 	 */
 	removeConfigApiKey(provider: string): void {
-		if (this.#configOverrides.delete(provider)) this.#bumpGeneration("remove-config-api-key");
+		if (this.#configOverrides.delete(provider)) this.#bumpGeneration("remove-config-api-key", provider);
 	}
 
 	/**
@@ -1035,9 +1153,10 @@ export class AuthStorage {
 	 * re-parsing `models.yml` so removed entries actually disappear.
 	 */
 	clearConfigApiKeys(): void {
-		if (this.#configOverrides.size === 0) return;
+		const providers = [...this.#configOverrides.keys()];
+		if (providers.length === 0) return;
 		this.#configOverrides.clear();
-		this.#bumpGeneration("clear-config-api-keys");
+		for (const provider of providers) this.#bumpGeneration("clear-config-api-keys", provider);
 	}
 
 	/**
@@ -1097,12 +1216,14 @@ export class AuthStorage {
 	#setStoredCredentials(provider: string, credentials: StoredCredential[]): void {
 		const current = this.#data.get(provider) ?? [];
 		if (storedCredentialArraysEqual(current, credentials)) return;
+		this.#resolvedStoredApiKeyValues.delete(provider);
+		this.#storedApiKeyResolutionInFlight.delete(provider);
 		if (credentials.length === 0) {
 			this.#data.delete(provider);
 		} else {
 			this.#data.set(provider, credentials);
 		}
-		this.#bumpGeneration("credentials");
+		this.#bumpGeneration("credentials", provider);
 	}
 
 	#resolveOAuthDedupeIdentityKey(provider: string, credential: OAuthCredential): string | null {
@@ -1355,6 +1476,7 @@ export class AuthStorage {
 		provider: string,
 		type: T,
 		sessionId?: string,
+		isUsable?: (credential: Extract<AuthCredential, { type: T }>, index: number) => boolean,
 	): { credential: Extract<AuthCredential, { type: T }>; index: number } | undefined {
 		const credentials = this.#getCredentialsForProvider(provider)
 			.map((credential, index) => ({ credential, index }))
@@ -1372,7 +1494,10 @@ export class AuthStorage {
 
 		for (const idx of order) {
 			const candidate = credentials[idx];
-			if (!this.#isCredentialBlocked(providerKey, candidate.index)) {
+			if (
+				!this.#isCredentialBlocked(providerKey, candidate.index) &&
+				(isUsable === undefined || isUsable(candidate.credential, candidate.index))
+			) {
 				return candidate;
 			}
 		}
@@ -1407,6 +1532,19 @@ export class AuthStorage {
 		const updated = [...entries];
 		updated[index] = { id: target.id, credential };
 		this.#setStoredCredentials(provider, updated);
+		if (
+			credential.type === "oauth" &&
+			target.credential.type === "oauth" &&
+			(credential.access !== target.credential.access ||
+				credential.refresh !== target.credential.refresh ||
+				credential.expires !== target.credential.expires)
+		) {
+			const storageProvider = resolveOAuthStorageProvider(provider);
+			this.#providerOAuthRefreshGenerations.set(
+				storageProvider,
+				this.getProviderOAuthRefreshGeneration(storageProvider) + 1,
+			);
+		}
 	}
 
 	/**
@@ -1627,9 +1765,8 @@ export class AuthStorage {
 	 * Check if any form of auth is configured for a provider.
 	 * Unlike getApiKey(), this doesn't refresh OAuth tokens.
 	 */
-	hasAuth(provider: string): boolean {
-		const storageProvider = resolveOAuthStorageProvider(provider);
-		if (this.#runtimeOverrides.has(storageProvider)) return true;
+	#hasConfiguredAuth(storageProvider: string): boolean {
+		if (this.hasRuntimeApiKey(storageProvider)) return true;
 		if (this.#configOverrides.has(storageProvider)) return true;
 		if (this.#getCredentialsForProvider(storageProvider).length > 0) return true;
 		if (getEnvApiKey(storageProvider)) return true;
@@ -1637,6 +1774,67 @@ export class AuthStorage {
 		return false;
 	}
 
+	hasAuth(provider: string): boolean {
+		const storageProvider = resolveOAuthStorageProvider(provider);
+		try {
+			this.#resolveSelectedStoredCredential(storageProvider);
+		} catch {
+			return false;
+		}
+		return this.#hasConfiguredAuth(storageProvider);
+	}
+
+	/**
+	 * Check whether configured auth is currently usable without resolving credentials.
+	 */
+	hasUsableAuth(provider: string): boolean {
+		const storageProvider = resolveOAuthStorageProvider(provider);
+		try {
+			const selectedCredential = this.#resolveSelectedStoredCredential(storageProvider);
+			if (this.hasRuntimeApiKey(storageProvider)) return true;
+			if (this.#configOverrides.has(storageProvider)) return true;
+			if (selectedCredential) {
+				if (selectedCredential.credential.type === "api_key") {
+					return (
+						!this.#isCredentialBlocked(
+							this.#getProviderTypeKey(storageProvider, selectedCredential.credential.type),
+							selectedCredential.index,
+						) && this.#hasUsableResolvedStoredApiKey(storageProvider, selectedCredential.credential.key)
+					);
+				}
+				return !this.#isCredentialBlocked(
+					this.#getProviderTypeKey(storageProvider, selectedCredential.credential.type),
+					selectedCredential.index,
+				);
+			}
+
+			const credentials = this.#getCredentialsForProvider(storageProvider);
+			let hasStoredApiKey = false;
+			let hasSelectableApiKey = false;
+			let hasUsableApiKey = false;
+			for (const [index, credential] of credentials.entries()) {
+				if (credential.type !== "api_key") continue;
+				hasStoredApiKey = true;
+				if (this.#isCredentialBlocked(this.#getProviderTypeKey(storageProvider, credential.type), index)) continue;
+				hasSelectableApiKey = true;
+				hasUsableApiKey ||= this.#hasUsableResolvedStoredApiKey(storageProvider, credential.key);
+			}
+			if (hasStoredApiKey) return hasSelectableApiKey && hasUsableApiKey;
+			if (
+				this.#getCredentialsForProvider(storageProvider).some(
+					(credential, index) =>
+						credential.type === "oauth" &&
+						!this.#isCredentialBlocked(this.#getProviderTypeKey(storageProvider, credential.type), index),
+				)
+			) {
+				return true;
+			}
+		} catch {
+			return false;
+		}
+		return Boolean(getEnvApiKey(storageProvider) || this.#fallbackResolver?.(storageProvider));
+	}
+
 	/**
 	 * Check if OAuth credentials are configured for a provider.
 	 */
@@ -1719,6 +1917,7 @@ export class AuthStorage {
 			/** onPrompt is required for some providers (github-copilot, OpenAI code provider) */
 			onPrompt: (prompt: { message: string; placeholder?: string }) => Promise<string>;
 		},
+		options: OAuthLoginOptions = {},
 	): Promise<void> {
 		let credentials: OAuthCredentials;
 		const saveApiKeyCredential = async (apiKey: string): Promise<void> => {
@@ -1726,13 +1925,21 @@ export class AuthStorage {
 			await this.set(provider, newCredential);
 		};
 		const manualCodeInput = () => ctrl.onPrompt({ message: "Paste the authorization code (or full redirect URL):" });
+
 		switch (provider) {
+			case "opencodex": {
+				await checkOpenCodexStatus(ctrl.onProgress);
+				return;
+			}
 			case "anthropic": {
 				const { loginAnthropic } = await import("./utils/oauth/anthropic");
-				credentials = await loginAnthropic({
-					...ctrl,
-					onManualCodeInput: ctrl.onManualCodeInput ?? manualCodeInput,
-				});
+				credentials = await loginAnthropic(
+					{
+						...ctrl,
+						onManualCodeInput: ctrl.onManualCodeInput ?? manualCodeInput,
+					},
+					{ manualCode: options.manualCode },
+				);
 				break;
 			}
 			case "alibaba-token-plan": {
@@ -3498,6 +3705,64 @@ export class AuthStorage {
 		return undefined;
 	}
 
+	async #resolveStoredApiKey(provider: string, key: string): Promise<string | undefined> {
+		const storageProvider = resolveOAuthStorageProvider(provider);
+		const configurationGeneration = this.#getProviderConfigurationGeneration(storageProvider);
+		const resolutions =
+			this.#storedApiKeyResolutionInFlight.get(storageProvider) ?? new Map<string, Promise<string | undefined>>();
+		this.#storedApiKeyResolutionInFlight.set(storageProvider, resolutions);
+		const existing = resolutions.get(key);
+		if (existing) return existing;
+
+		const { promise, resolve, reject } = Promise.withResolvers<string | undefined>();
+		resolutions.set(key, promise);
+		const publish = (value: string | undefined) => {
+			if (
+				configurationGeneration !== this.#getProviderConfigurationGeneration(storageProvider) ||
+				this.#storedApiKeyResolutionInFlight.get(storageProvider) !== resolutions ||
+				resolutions.get(key) !== promise
+			) {
+				return;
+			}
+			const values =
+				this.#resolvedStoredApiKeyValues.get(storageProvider) ??
+				new Map<string, { fingerprint: string; usable: boolean }>();
+			const wasUsable = !values.has(key) || values.get(key)?.usable === true;
+			const isUsable = (value?.length ?? 0) > 0;
+			values.set(key, {
+				fingerprint: value ? crypto.createHash("sha256").update(value).digest("hex") : "",
+				usable: isUsable,
+			});
+			this.#resolvedStoredApiKeyValues.set(storageProvider, values);
+			if (key.startsWith("!") && wasUsable !== isUsable) {
+				this.#bumpGeneration("stored-api-key-usability", storageProvider);
+			}
+		};
+		void (async () => {
+			try {
+				const value = await this.#configValueResolver(key, String(configurationGeneration));
+				publish(value);
+				resolve(value);
+			} catch (error) {
+				publish(undefined);
+				reject(error);
+			} finally {
+				if (
+					this.#storedApiKeyResolutionInFlight.get(storageProvider) === resolutions &&
+					resolutions.get(key) === promise
+				) {
+					resolutions.delete(key);
+					if (resolutions.size === 0) this.#storedApiKeyResolutionInFlight.delete(storageProvider);
+				}
+			}
+		})();
+		return promise;
+	}
+	#hasUsableResolvedStoredApiKey(provider: string, key: string): boolean {
+		const resolved = this.#resolvedStoredApiKeyValues.get(resolveOAuthStorageProvider(provider))?.get(key);
+		return key.startsWith("!") ? resolved?.usable === true : true;
+	}
+
 	/**
 	 * Peek at API key for a provider without refreshing OAuth tokens.
 	 * Used for model discovery where we only need to know if credentials exist
@@ -3506,21 +3771,38 @@ export class AuthStorage {
 	 */
 	async peekApiKey(provider: string): Promise<string | undefined> {
 		const runtimeKey = this.#runtimeOverrides.get(provider);
-		if (runtimeKey) {
-			return runtimeKey;
-		}
+		if (runtimeKey) return runtimeKey;
 
 		const configKey = this.#configOverrides.get(provider);
-		if (configKey) {
-			return configKey;
+		if (configKey) return configKey;
+
+		const selectedCredential = this.#resolveSelectedStoredCredential(provider);
+		if (selectedCredential?.credential.type === "api_key") {
+			return this.#resolveStoredApiKey(provider, selectedCredential.credential.key);
 		}
 
-		const apiKeySelection = this.#selectCredentialByType(provider, "api_key");
+		// Return current OAuth access token only if it is not already expired.
+		if (selectedCredential?.credential.type === "oauth") {
+			const expiresAt = selectedCredential.credential.expires;
+			if (Number.isFinite(expiresAt) && expiresAt > Date.now()) {
+				if (provider === "github-copilot") {
+					return JSON.stringify({
+						token: selectedCredential.credential.access,
+						enterpriseUrl: selectedCredential.credential.enterpriseUrl,
+					});
+				}
+				return selectedCredential.credential.access;
+			}
+			return undefined;
+		}
+
+		const apiKeySelection = this.#selectCredentialByType(provider, "api_key", undefined, credential =>
+			this.#hasUsableResolvedStoredApiKey(provider, credential.key),
+		);
 		if (apiKeySelection) {
-			return this.#configValueResolver(apiKeySelection.credential.key);
+			return this.#resolveStoredApiKey(provider, apiKeySelection.credential.key);
 		}
 
-		// Return current OAuth access token only if it is not already expired.
 		const oauthSelection = this.#selectCredentialByType(provider, "oauth");
 		if (oauthSelection) {
 			const expiresAt = oauthSelection.credential.expires;
@@ -3535,10 +3817,7 @@ export class AuthStorage {
 			}
 		}
 
-		const envKey = getEnvApiKey(provider);
-		if (envKey) return envKey;
-
-		return this.#fallbackResolver?.(provider) ?? undefined;
+		return getEnvApiKey(provider) || this.#fallbackResolver?.(provider);
 	}
 
 	/**
@@ -3572,14 +3851,16 @@ export class AuthStorage {
 
 		if (selectedCredential?.credential.type === "api_key") {
 			this.#recordSessionCredential(provider, sessionId, "api_key", selectedCredential.index);
-			return this.#configValueResolver(selectedCredential.credential.key);
+			return this.#resolveStoredApiKey(provider, selectedCredential.credential.key);
 		}
 
 		if (!selectedCredential) {
-			const apiKeySelection = this.#selectCredentialByType(provider, "api_key", sessionId);
+			const apiKeySelection = this.#selectCredentialByType(provider, "api_key", sessionId, credential =>
+				this.#hasUsableResolvedStoredApiKey(provider, credential.key),
+			);
 			if (apiKeySelection) {
 				this.#recordSessionCredential(provider, sessionId, "api_key", apiKeySelection.index);
-				return this.#configValueResolver(apiKeySelection.credential.key);
+				return this.#resolveStoredApiKey(provider, apiKeySelection.credential.key);
 			}
 		}
 
@@ -3648,9 +3929,14 @@ export class AuthStorage {
 		}
 	}
 
-	async #credentialMatchesApiKey(credential: AuthCredential, apiKey: string): Promise<boolean> {
+	async #credentialMatchesApiKey(provider: string, credential: AuthCredential, apiKey: string): Promise<boolean> {
 		if (credential.type === "api_key") {
-			return (await this.#configValueResolver(credential.key)) === apiKey;
+			return (
+				(await this.#configValueResolver(
+					credential.key,
+					String(this.#getProviderConfigurationGeneration(provider)),
+				)) === apiKey
+			);
 		}
 		if (credential.access === apiKey) return true;
 		return this.#extractStructuredApiKeyToken(apiKey) === credential.access;
@@ -3673,7 +3959,7 @@ export class AuthStorage {
 		let matched: { id: number; type: AuthCredential["type"]; index: number } | undefined;
 		for (let index = 0; index < stored.length; index++) {
 			const entry = stored[index];
-			if (entry && (await this.#credentialMatchesApiKey(entry.credential, apiKey))) {
+			if (entry && (await this.#credentialMatchesApiKey(provider, entry.credential, apiKey))) {
 				matched = { id: entry.id, type: entry.credential.type, index };
 				break;
 			}

package/src/index.ts

@@ -24,6 +24,7 @@ export * from "./providers/mock";
 export * from "./providers/ollama";
 export * from "./providers/openai-codex-responses";
 export * from "./providers/openai-completions";
+export * from "./providers/openai-opencodex-responses";
 export * from "./providers/openai-responses";
 export * from "./providers/synthetic";
 export * from "./rate-limit-utils";
@@ -47,6 +48,7 @@ export * from "./utils/h2-fetch";
 export * from "./utils/oauth";
 export type {
 	OAuthCredentials,
+	OAuthLoginOptions,
 	OAuthProvider,
 	OAuthProviderId,
 	OAuthProviderInfo,

package/src/model-manager.ts

@@ -56,6 +56,8 @@ export interface ModelManagerOptions<TApi extends Api = Api, TModelsDevPayload =
 export interface ModelResolutionResult<TApi extends Api = Api> {
 	models: Model<TApi>[];
 	stale: boolean;
+	/** Whether this resolution successfully fetched dynamic models. */
+	fetched: boolean;
 }
 
 /**
@@ -147,13 +149,13 @@ export async function resolveProviderModels<TApi extends Api = Api, TModelsDevPa
 	) {
 		const cachedModels = passModelList<TApi>(cache.models);
 		if (!hasStaticTransportDrift(staticModels, cachedModels)) {
-			return { models: cachedModels, stale: false };
+			return { models: cachedModels, stale: false, fetched: false };
 		}
 		const repairedModels = mergeDynamicModels(staticModels, cachedModels);
 		if (options.canPublishCache?.() ?? true) {
 			writeModelCache(options.providerId, now(), repairedModels, true, staticFingerprint, dbPath);
 		}
-		return { models: repairedModels, stale: false };
+		return { models: repairedModels, stale: false, fetched: false };
 	}
 
 	const [fetchedModelsDevModels, fetchedDynamicModels] = shouldFetchFromNetwork
@@ -200,6 +202,7 @@ export async function resolveProviderModels<TApi extends Api = Api, TModelsDevPa
 	return {
 		models,
 		stale: !dynamicAuthoritative,
+		fetched: shouldFetchFromNetwork && dynamicFetchSucceeded,
 	};
 }
 
@@ -403,9 +406,12 @@ function normalizeModelList<TApi extends Api>(value: unknown): Model<TApi>[] {
 	const models: Model<TApi>[] = [];
 	for (const item of value) {
 		if (isModelLike(item) && !isRetiredModel(item)) {
-			models.push(enrichModelThinking(item as Model<TApi>));
+			const model = enrichModelThinking(item as Model<TApi>);
+			model.longContextPricing = undefined;
+			models.push(model);
 		}
 	}
+	applyGeneratedModelPolicies(models as Model<Api>[]);
 	return applyFinalCodexGpt56ContextCap(models);
 }