@gajae-code/ai 0.12.7 → 0.12.8

package/CHANGELOG.md

@@ -2,6 +2,19 @@
 
 ## [Unreleased]
 
+## [0.12.8] - 2026-08-02
+### Added
+
+- Added read-only OpenCodex provider discovery with runtime-port resolution, identity-checked health probing, cached `/api/models` catalogs, raw wire model ids, and `/login opencodex` status reprobes without credential persistence.
+
+### Changed
+
+- OpenAI-compatible discovery and OpenAI Completions/Responses transports now preserve query-bearing endpoint routing, including repeated query parameters. Model resolution records whether a provider discovery result was fetched so consumers can distinguish current discovery evidence from cached data.
+
+### Fixed
+
+- Closed the two remaining ingress holes behind bare `Request Blocked` failures on OpenAI codex models. (1) The chatgpt.com/backend-api pre-model gate rejects with an HTTP 400 bare-`detail` body (`{"detail": "Request blocked."}`) carrying no `error.*` envelope and no `code=invalid_prompt`, so `parseCodexError` surfaced an unexplained message, `isInvalidPromptError` and the codex non-retryable classification missed it, and the session-level `invalid_prompt` circuit breaker never attempted a repaired resend. `parseCodexError` now reads top-level `detail` (string or `{message}`) bodies and classifies a leading `Request blocked` message without an explicit provider code as `invalid_prompt`, surfacing `Request blocked (code=invalid_prompt)` so every existing invalid_prompt contract engages. (2) Outgoing tool definitions (descriptions and JSON-schema strings) bypassed every request-boundary sanitizer on both the OpenAI Responses and OpenAI-codex-responses transports, so a `<|channel|>`-quoting MCP/skill tool description poisoned every request on the session in a way no history repair could fix. Both `convertTools` paths now neutralize reserved control tokens across the whole tool payload via the shared idempotent zero-width-space insertion (ref openai/codex#35838).
+
 ## [0.12.7] - 2026-07-31
 
 ## [0.12.6] - 2026-07-31

package/dist/types/auth-storage.d.ts

@@ -290,8 +290,9 @@ export type AuthStorageOptions = {
      * Resolve a config value (API key, header value, etc.) to an actual value.
      * - coding-agent injects its resolveConfigValue (supports "!command" syntax via pi-natives)
      * - Default: checks environment variable first, then treats as literal
+     * `cacheScope` changes whenever the provider credential configuration changes.
      */
-    configValueResolver?: (config: string) => Promise<string | undefined>;
+    configValueResolver?: (config: string, cacheScope?: string) => Promise<string | undefined>;
     /**
      * Optional callback fired when AuthStorage automatically disables a
      * credential because something detected it as no longer usable — today
@@ -389,6 +390,9 @@ export declare class AuthStorage {
      */
     close(): void;
     getGeneration(): number;
+    getProviderConfigurationGeneration(provider: string): number;
+    getProviderOAuthRefreshGeneration(provider: string): number;
+    getProviderEvidenceGeneration(provider: string, resolvedApiKey?: string): string;
     onGenerationChanged(listener: (generation: number) => void): () => void;
     offGenerationChanged(listener: (generation: number) => void): void;
     /**
@@ -482,11 +486,11 @@ export declare class AuthStorage {
      * Check if credentials exist for a provider in storage.
      */
     has(provider: string): boolean;
+    hasAuth(provider: string): boolean;
     /**
-     * Check if any form of auth is configured for a provider.
-     * Unlike getApiKey(), this doesn't refresh OAuth tokens.
+     * Check whether configured auth is currently usable without resolving credentials.
      */
-    hasAuth(provider: string): boolean;
+    hasUsableAuth(provider: string): boolean;
     /**
      * Check if OAuth credentials are configured for a provider.
      */

package/dist/types/index.d.ts

@@ -24,6 +24,7 @@ export * from "./providers/mock";
 export * from "./providers/ollama";
 export * from "./providers/openai-codex-responses";
 export * from "./providers/openai-completions";
+export * from "./providers/openai-opencodex-responses";
 export * from "./providers/openai-responses";
 export * from "./providers/synthetic";
 export * from "./rate-limit-utils";

package/dist/types/model-manager.d.ts

@@ -44,6 +44,8 @@ export interface ModelManagerOptions<TApi extends Api = Api, TModelsDevPayload =
 export interface ModelResolutionResult<TApi extends Api = Api> {
     models: Model<TApi>[];
     stale: boolean;
+    /** Whether this resolution successfully fetched dynamic models. */
+    fetched: boolean;
 }
 /**
  * Stateful facade over provider model resolution.

package/dist/types/provider-models/special.d.ts

@@ -1,4 +1,5 @@
 import type { ModelManagerOptions } from "../model-manager";
+export declare function openCodexModelManagerOptions(): ModelManagerOptions<"openai-responses">;
 export interface OpenAICodexModelManagerConfig {
     accessToken?: string;
     accountId?: string;

package/dist/types/providers/openai-opencodex-responses.d.ts

@@ -0,0 +1,10 @@
+import type { Model } from "../types";
+export declare const OPENCODEX_DEFAULT_PORT = 10100;
+export declare const OPENCODEX_PROBE_TIMEOUT_MS = 750;
+export declare const OPENCODEX_MODEL_CACHE_TTL_MS: number;
+export interface OpenCodexEndpoint {
+    baseUrl: string;
+}
+export declare function resolveOpenCodexEndpoint(signal?: AbortSignal): Promise<OpenCodexEndpoint | undefined>;
+export declare function fetchOpenCodexModels(): Promise<readonly Model<"openai-responses">[] | null>;
+export declare function checkOpenCodexStatus(onProgress?: (message: string) => void): Promise<void>;

package/dist/types/types.d.ts

@@ -51,7 +51,7 @@ export interface ThinkingConfig {
     /** Provider-specific transport used to encode the selected effort. */
     mode: ThinkingControlMode;
 }
-export type KnownProvider = "alibaba-token-plan" | "amazon-bedrock" | "azure-openai" | "anthropic" | "google" | "google-gemini-cli" | "google-antigravity" | "google-vertex" | "openai" | "openai-codex" | "kimi-code" | "minimax-code" | "minimax-code-cn" | "github-copilot" | "fireworks" | "firepass" | "fugu" | "gitlab-duo" | "cursor" | "deepseek" | "deepinfra" | "xai" | "groq" | "cerebras" | "openrouter" | "kilo" | "vercel-ai-gateway" | "zai" | "glm-zcode" | "mistral" | "minimax" | "opencode-go" | "opencode-zen" | "opengateway" | "bizrouter" | "mara" | "synthetic" | "cloudflare-ai-gateway" | "huggingface" | "litellm" | "moonshot" | "nvidia" | "nanogpt" | "ollama" | "ollama-cloud" | "qianfan" | "qwen-portal" | "together" | "venice" | "vllm" | "xiaomi" | "xiaomi-token-plan-sgp" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "zenmux" | "lm-studio";
+export type KnownProvider = "alibaba-token-plan" | "amazon-bedrock" | "azure-openai" | "anthropic" | "google" | "google-gemini-cli" | "google-antigravity" | "google-vertex" | "openai" | "openai-codex" | "opencodex" | "kimi-code" | "minimax-code" | "minimax-code-cn" | "github-copilot" | "fireworks" | "firepass" | "fugu" | "gitlab-duo" | "cursor" | "deepseek" | "deepinfra" | "xai" | "groq" | "cerebras" | "openrouter" | "kilo" | "vercel-ai-gateway" | "zai" | "glm-zcode" | "mistral" | "minimax" | "opencode-go" | "opencode-zen" | "opengateway" | "bizrouter" | "mara" | "synthetic" | "cloudflare-ai-gateway" | "huggingface" | "litellm" | "moonshot" | "nvidia" | "nanogpt" | "ollama" | "ollama-cloud" | "qianfan" | "qwen-portal" | "together" | "venice" | "vllm" | "xiaomi" | "xiaomi-token-plan-sgp" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "zenmux" | "lm-studio";
 export type Provider = KnownProvider | string;
 import type { Effort } from "./model-thinking";
 /** Token budgets for each thinking level (token-based providers only) */

package/dist/types/utils/oauth/types.d.ts

@@ -7,7 +7,7 @@ export type OAuthCredentials = {
     email?: string;
     accountId?: string;
 };
-export type OAuthProvider = "alibaba-token-plan" | "anthropic" | "bizrouter" | "mara" | "cerebras" | "cloudflare-ai-gateway" | "cursor" | "deepseek" | "deepinfra" | "fireworks" | "firepass" | "fugu" | "github-copilot" | "google-gemini-cli" | "google-antigravity" | "gitlab-duo" | "huggingface" | "kimi-code" | "kilo" | "kagi" | "litellm" | "lm-studio" | "minimax-code" | "minimax-code-cn" | "moonshot" | "nvidia" | "nanogpt" | "ollama" | "ollama-cloud" | "openai-codex" | "openai-codex-device" | "opencode-go" | "opencode-zen" | "opengateway" | "parallel" | "perplexity" | "qianfan" | "qwen-portal" | "synthetic" | "tavily" | "together" | "venice" | "vercel-ai-gateway" | "vllm" | "xai" | "glm-zcode" | "xiaomi" | "xiaomi-token-plan-sgp" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "zenmux" | "zai";
+export type OAuthProvider = "alibaba-token-plan" | "anthropic" | "bizrouter" | "mara" | "cerebras" | "cloudflare-ai-gateway" | "cursor" | "deepseek" | "deepinfra" | "fireworks" | "firepass" | "fugu" | "github-copilot" | "google-gemini-cli" | "google-antigravity" | "gitlab-duo" | "huggingface" | "kimi-code" | "kilo" | "kagi" | "litellm" | "lm-studio" | "minimax-code" | "minimax-code-cn" | "moonshot" | "nvidia" | "nanogpt" | "ollama" | "ollama-cloud" | "openai-codex" | "openai-codex-device" | "opencode-go" | "opencode-zen" | "opengateway" | "parallel" | "perplexity" | "qianfan" | "qwen-portal" | "synthetic" | "tavily" | "together" | "venice" | "vercel-ai-gateway" | "vllm" | "xai" | "glm-zcode" | "xiaomi" | "xiaomi-token-plan-sgp" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "zenmux" | "opencodex" | "zai";
 export type OAuthProviderId = OAuthProvider | (string & {});
 export type OAuthPrompt = {
     message: string;

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@gajae-code/ai",
-	"version": "0.12.7",
+	"version": "0.12.8",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"homepage": "https://gajae-code.com",
 	"author": "Yeachan-Heo and Gajae Code Contributors",
@@ -40,7 +40,7 @@
 	"dependencies": {
 		"@anthropic-ai/sdk": "^0.94.0",
 		"@bufbuild/protobuf": "^2.12.0",
-		"@gajae-code/utils": "0.12.7",
+		"@gajae-code/utils": "0.12.8",
 		"openai": "^6.36.0",
 		"partial-json": "^0.1.7",
 		"zod": "4.4.3"

package/src/auth-storage.ts

@@ -8,9 +8,11 @@
  * - `SqliteAuthCredentialStore`: concrete SQLite-backed implementation
  */
 import { Database, type Statement } from "bun:sqlite";
+import * as crypto from "node:crypto";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import { getAgentDbPath, logger } from "@gajae-code/utils";
+import { checkOpenCodexStatus } from "./providers/openai-opencodex-responses";
 import { getEnvApiKey } from "./stream";
 import type { Provider } from "./types";
 import type {
@@ -455,8 +457,9 @@ export type AuthStorageOptions = {
 	 * Resolve a config value (API key, header value, etc.) to an actual value.
 	 * - coding-agent injects its resolveConfigValue (supports "!command" syntax via pi-natives)
 	 * - Default: checks environment variable first, then treats as literal
+	 * `cacheScope` changes whenever the provider credential configuration changes.
 	 */
-	configValueResolver?: (config: string) => Promise<string | undefined>;
+	configValueResolver?: (config: string, cacheScope?: string) => Promise<string | undefined>;
 	/**
 	 * Optional callback fired when AuthStorage automatically disables a
 	 * credential because something detected it as no longer usable — today
@@ -843,7 +846,9 @@ export class AuthStorage {
 	#usageLogger?: UsageLogger;
 	#fallbackResolver?: (provider: string) => string | undefined;
 	#store: AuthCredentialStore;
-	#configValueResolver: (config: string) => Promise<string | undefined>;
+	#configValueResolver: (config: string, cacheScope?: string) => Promise<string | undefined>;
+	#resolvedStoredApiKeyValues: Map<string, Map<string, { fingerprint: string; usable: boolean }>> = new Map();
+	#storedApiKeyResolutionInFlight: Map<string, Map<string, Promise<string | undefined>>> = new Map();
 	#refreshOAuthCredentialOverride?: AuthStorageOptions["refreshOAuthCredential"];
 	#fetchUsageReportsOverride?: AuthStorageOptions["fetchUsageReports"];
 	#sourceLabel?: string;
@@ -858,6 +863,9 @@ export class AuthStorage {
 	 */
 	#pendingDisabledEvents: CredentialDisabledEvent[] = [];
 	#generation = 1;
+	#providerGenerations = new Map<string, number>();
+	#providerConfigurationGenerations = new Map<string, number>();
+	#providerOAuthRefreshGenerations = new Map<string, number>();
 	#generationListeners: Set<(generation: number) => void> = new Set();
 	#oauthRefreshInFlight: Map<number, Promise<AuthCredentialSnapshotEntry>> = new Map();
 	#oauthCredentialRefreshInFlight: Map<number, Promise<OAuthCredentials>> = new Map();
@@ -914,7 +922,66 @@ export class AuthStorage {
 	getGeneration(): number {
 		return this.#generation;
 	}
-
+	getProviderConfigurationGeneration(provider: string): number {
+		return this.#getProviderConfigurationGeneration(provider);
+	}
+	getProviderOAuthRefreshGeneration(provider: string): number {
+		return this.#providerOAuthRefreshGenerations.get(resolveOAuthStorageProvider(provider)) ?? 0;
+	}
+	#getProviderGeneration(provider: string): number {
+		return this.#providerGenerations.get(resolveOAuthStorageProvider(provider)) ?? 1;
+	}
+	#getProviderConfigurationGeneration(provider: string): number {
+		return this.#providerConfigurationGenerations.get(resolveOAuthStorageProvider(provider)) ?? 1;
+	}
+	getProviderEvidenceGeneration(provider: string, resolvedApiKey?: string): string {
+		const storageProvider = resolveOAuthStorageProvider(provider);
+		const evidenceApiKey = resolvedApiKey;
+		let selectedCredential: ({ index: number } & StoredCredential) | undefined;
+		try {
+			selectedCredential = this.#resolveSelectedStoredCredential(provider);
+		} catch {
+			return crypto
+				.createHash("sha256")
+				.update(`${this.#getProviderGeneration(storageProvider)}\u0000unavailable-selector`)
+				.digest("hex");
+		}
+		const credentials = selectedCredential
+			? [selectedCredential.credential]
+			: this.#getCredentialsForProvider(provider);
+		const hasApiKey = credentials.some(credential => credential.type === "api_key");
+		const hasUsableOAuth = credentials.some(
+			credential =>
+				credential.type === "oauth" && Number.isFinite(credential.expires) && credential.expires > Date.now(),
+		);
+		const effectiveEnvKey =
+			this.#runtimeOverrides.get(provider) || this.#configOverrides.get(provider) || hasApiKey || hasUsableOAuth
+				? undefined
+				: getEnvApiKey(provider);
+		const storedApiKeyFingerprint = credentials
+			.filter(
+				(credential): credential is Extract<AuthCredential, { type: "api_key" }> => credential.type === "api_key",
+			)
+			.map(credential => {
+				const resolved = this.#resolvedStoredApiKeyValues.get(storageProvider)?.get(credential.key);
+				return `${credential.key}\u0000${
+					credential.key.startsWith("!")
+						? (resolved?.fingerprint ?? "")
+						: (process.env[credential.key] ?? credential.key)
+				}`;
+			})
+			.join("\u0001");
+		const storedOAuthFingerprint = credentials
+			.filter((credential): credential is Extract<AuthCredential, { type: "oauth" }> => credential.type === "oauth")
+			.map(credential => `${credential.expires}\u0000${credential.expires > Date.now() ? "usable" : "expired"}`)
+			.join("\u0001");
+		return crypto
+			.createHash("sha256")
+			.update(
+				`${this.#getProviderGeneration(storageProvider)}\u0000${effectiveEnvKey ?? ""}\u0000${storedApiKeyFingerprint}\u0000${storedOAuthFingerprint}\u0000${evidenceApiKey ?? ""}`,
+			)
+			.digest("hex");
+	}
 	onGenerationChanged(listener: (generation: number) => void): () => void {
 		this.#generationListeners.add(listener);
 		return () => {
@@ -926,8 +993,18 @@ export class AuthStorage {
 		this.#generationListeners.delete(listener);
 	}
 
-	#bumpGeneration(reason: string): void {
+	#bumpGeneration(reason: string, provider?: string): void {
 		this.#generation += 1;
+		if (provider) {
+			const storageProvider = resolveOAuthStorageProvider(provider);
+			this.#providerGenerations.set(storageProvider, this.#getProviderGeneration(storageProvider) + 1);
+			if (reason !== "stored-api-key-usability") {
+				this.#providerConfigurationGenerations.set(
+					storageProvider,
+					this.#getProviderConfigurationGeneration(storageProvider) + 1,
+				);
+			}
+		}
 		for (const listener of [...this.#generationListeners]) {
 			try {
 				listener(this.#generation);
@@ -976,7 +1053,7 @@ export class AuthStorage {
 	 */
 	setRuntimeApiKey(provider: string, apiKey: string): void {
 		this.#runtimeOverrides.set(provider, apiKey);
-		this.#bumpGeneration("set-runtime-api-key");
+		this.#bumpGeneration("set-runtime-api-key", provider);
 	}
 
 	/**
@@ -987,20 +1064,24 @@ export class AuthStorage {
 		const storageProvider = resolveOAuthStorageProvider(provider);
 		this.#assertCredentialSelectorUsable(storageProvider, selector);
 		this.#runtimeCredentialSelectors.set(storageProvider, selector);
+		this.#bumpGeneration("set-runtime-credential-selector", provider);
 	}
 
 	/**
 	 * Remove a runtime credential selector.
 	 */
 	removeRuntimeCredentialSelector(provider: string): void {
-		this.#runtimeCredentialSelectors.delete(resolveOAuthStorageProvider(provider));
+		const storageProvider = resolveOAuthStorageProvider(provider);
+		if (this.#runtimeCredentialSelectors.delete(storageProvider)) {
+			this.#bumpGeneration("remove-runtime-credential-selector", provider);
+		}
 	}
 
 	/**
 	 * Remove a runtime API key override.
 	 */
 	removeRuntimeApiKey(provider: string): void {
-		if (this.#runtimeOverrides.delete(provider)) this.#bumpGeneration("remove-runtime-api-key");
+		if (this.#runtimeOverrides.delete(provider)) this.#bumpGeneration("remove-runtime-api-key", provider);
 	}
 
 	/** Whether a provider is currently authenticated by a runtime API-key override. */
@@ -1020,14 +1101,14 @@ export class AuthStorage {
 	 */
 	setConfigApiKey(provider: string, apiKey: string): void {
 		this.#configOverrides.set(provider, apiKey);
-		this.#bumpGeneration("set-config-api-key");
+		this.#bumpGeneration("set-config-api-key", provider);
 	}
 
 	/**
 	 * Remove a single config-sourced API key override.
 	 */
 	removeConfigApiKey(provider: string): void {
-		if (this.#configOverrides.delete(provider)) this.#bumpGeneration("remove-config-api-key");
+		if (this.#configOverrides.delete(provider)) this.#bumpGeneration("remove-config-api-key", provider);
 	}
 
 	/**
@@ -1035,9 +1116,10 @@ export class AuthStorage {
 	 * re-parsing `models.yml` so removed entries actually disappear.
 	 */
 	clearConfigApiKeys(): void {
-		if (this.#configOverrides.size === 0) return;
+		const providers = [...this.#configOverrides.keys()];
+		if (providers.length === 0) return;
 		this.#configOverrides.clear();
-		this.#bumpGeneration("clear-config-api-keys");
+		for (const provider of providers) this.#bumpGeneration("clear-config-api-keys", provider);
 	}
 
 	/**
@@ -1097,12 +1179,14 @@ export class AuthStorage {
 	#setStoredCredentials(provider: string, credentials: StoredCredential[]): void {
 		const current = this.#data.get(provider) ?? [];
 		if (storedCredentialArraysEqual(current, credentials)) return;
+		this.#resolvedStoredApiKeyValues.delete(provider);
+		this.#storedApiKeyResolutionInFlight.delete(provider);
 		if (credentials.length === 0) {
 			this.#data.delete(provider);
 		} else {
 			this.#data.set(provider, credentials);
 		}
-		this.#bumpGeneration("credentials");
+		this.#bumpGeneration("credentials", provider);
 	}
 
 	#resolveOAuthDedupeIdentityKey(provider: string, credential: OAuthCredential): string | null {
@@ -1355,6 +1439,7 @@ export class AuthStorage {
 		provider: string,
 		type: T,
 		sessionId?: string,
+		isUsable?: (credential: Extract<AuthCredential, { type: T }>, index: number) => boolean,
 	): { credential: Extract<AuthCredential, { type: T }>; index: number } | undefined {
 		const credentials = this.#getCredentialsForProvider(provider)
 			.map((credential, index) => ({ credential, index }))
@@ -1372,7 +1457,10 @@ export class AuthStorage {
 
 		for (const idx of order) {
 			const candidate = credentials[idx];
-			if (!this.#isCredentialBlocked(providerKey, candidate.index)) {
+			if (
+				!this.#isCredentialBlocked(providerKey, candidate.index) &&
+				(isUsable === undefined || isUsable(candidate.credential, candidate.index))
+			) {
 				return candidate;
 			}
 		}
@@ -1407,6 +1495,19 @@ export class AuthStorage {
 		const updated = [...entries];
 		updated[index] = { id: target.id, credential };
 		this.#setStoredCredentials(provider, updated);
+		if (
+			credential.type === "oauth" &&
+			target.credential.type === "oauth" &&
+			(credential.access !== target.credential.access ||
+				credential.refresh !== target.credential.refresh ||
+				credential.expires !== target.credential.expires)
+		) {
+			const storageProvider = resolveOAuthStorageProvider(provider);
+			this.#providerOAuthRefreshGenerations.set(
+				storageProvider,
+				this.getProviderOAuthRefreshGeneration(storageProvider) + 1,
+			);
+		}
 	}
 
 	/**
@@ -1627,9 +1728,8 @@ export class AuthStorage {
 	 * Check if any form of auth is configured for a provider.
 	 * Unlike getApiKey(), this doesn't refresh OAuth tokens.
 	 */
-	hasAuth(provider: string): boolean {
-		const storageProvider = resolveOAuthStorageProvider(provider);
-		if (this.#runtimeOverrides.has(storageProvider)) return true;
+	#hasConfiguredAuth(storageProvider: string): boolean {
+		if (this.hasRuntimeApiKey(storageProvider)) return true;
 		if (this.#configOverrides.has(storageProvider)) return true;
 		if (this.#getCredentialsForProvider(storageProvider).length > 0) return true;
 		if (getEnvApiKey(storageProvider)) return true;
@@ -1637,6 +1737,67 @@ export class AuthStorage {
 		return false;
 	}
 
+	hasAuth(provider: string): boolean {
+		const storageProvider = resolveOAuthStorageProvider(provider);
+		try {
+			this.#resolveSelectedStoredCredential(storageProvider);
+		} catch {
+			return false;
+		}
+		return this.#hasConfiguredAuth(storageProvider);
+	}
+
+	/**
+	 * Check whether configured auth is currently usable without resolving credentials.
+	 */
+	hasUsableAuth(provider: string): boolean {
+		const storageProvider = resolveOAuthStorageProvider(provider);
+		try {
+			const selectedCredential = this.#resolveSelectedStoredCredential(storageProvider);
+			if (this.hasRuntimeApiKey(storageProvider)) return true;
+			if (this.#configOverrides.has(storageProvider)) return true;
+			if (selectedCredential) {
+				if (selectedCredential.credential.type === "api_key") {
+					return (
+						!this.#isCredentialBlocked(
+							this.#getProviderTypeKey(storageProvider, selectedCredential.credential.type),
+							selectedCredential.index,
+						) && this.#hasUsableResolvedStoredApiKey(storageProvider, selectedCredential.credential.key)
+					);
+				}
+				return !this.#isCredentialBlocked(
+					this.#getProviderTypeKey(storageProvider, selectedCredential.credential.type),
+					selectedCredential.index,
+				);
+			}
+
+			const credentials = this.#getCredentialsForProvider(storageProvider);
+			let hasStoredApiKey = false;
+			let hasSelectableApiKey = false;
+			let hasUsableApiKey = false;
+			for (const [index, credential] of credentials.entries()) {
+				if (credential.type !== "api_key") continue;
+				hasStoredApiKey = true;
+				if (this.#isCredentialBlocked(this.#getProviderTypeKey(storageProvider, credential.type), index)) continue;
+				hasSelectableApiKey = true;
+				hasUsableApiKey ||= this.#hasUsableResolvedStoredApiKey(storageProvider, credential.key);
+			}
+			if (hasStoredApiKey) return hasSelectableApiKey && hasUsableApiKey;
+			if (
+				this.#getCredentialsForProvider(storageProvider).some(
+					(credential, index) =>
+						credential.type === "oauth" &&
+						!this.#isCredentialBlocked(this.#getProviderTypeKey(storageProvider, credential.type), index),
+				)
+			) {
+				return true;
+			}
+		} catch {
+			return false;
+		}
+		return Boolean(getEnvApiKey(storageProvider) || this.#fallbackResolver?.(storageProvider));
+	}
+
 	/**
 	 * Check if OAuth credentials are configured for a provider.
 	 */
@@ -1726,7 +1887,12 @@ export class AuthStorage {
 			await this.set(provider, newCredential);
 		};
 		const manualCodeInput = () => ctrl.onPrompt({ message: "Paste the authorization code (or full redirect URL):" });
+
 		switch (provider) {
+			case "opencodex": {
+				await checkOpenCodexStatus(ctrl.onProgress);
+				return;
+			}
 			case "anthropic": {
 				const { loginAnthropic } = await import("./utils/oauth/anthropic");
 				credentials = await loginAnthropic({
@@ -3498,6 +3664,64 @@ export class AuthStorage {
 		return undefined;
 	}
 
+	async #resolveStoredApiKey(provider: string, key: string): Promise<string | undefined> {
+		const storageProvider = resolveOAuthStorageProvider(provider);
+		const configurationGeneration = this.#getProviderConfigurationGeneration(storageProvider);
+		const resolutions =
+			this.#storedApiKeyResolutionInFlight.get(storageProvider) ?? new Map<string, Promise<string | undefined>>();
+		this.#storedApiKeyResolutionInFlight.set(storageProvider, resolutions);
+		const existing = resolutions.get(key);
+		if (existing) return existing;
+
+		const { promise, resolve, reject } = Promise.withResolvers<string | undefined>();
+		resolutions.set(key, promise);
+		const publish = (value: string | undefined) => {
+			if (
+				configurationGeneration !== this.#getProviderConfigurationGeneration(storageProvider) ||
+				this.#storedApiKeyResolutionInFlight.get(storageProvider) !== resolutions ||
+				resolutions.get(key) !== promise
+			) {
+				return;
+			}
+			const values =
+				this.#resolvedStoredApiKeyValues.get(storageProvider) ??
+				new Map<string, { fingerprint: string; usable: boolean }>();
+			const wasUsable = !values.has(key) || values.get(key)?.usable === true;
+			const isUsable = (value?.length ?? 0) > 0;
+			values.set(key, {
+				fingerprint: value ? crypto.createHash("sha256").update(value).digest("hex") : "",
+				usable: isUsable,
+			});
+			this.#resolvedStoredApiKeyValues.set(storageProvider, values);
+			if (key.startsWith("!") && wasUsable !== isUsable) {
+				this.#bumpGeneration("stored-api-key-usability", storageProvider);
+			}
+		};
+		void (async () => {
+			try {
+				const value = await this.#configValueResolver(key, String(configurationGeneration));
+				publish(value);
+				resolve(value);
+			} catch (error) {
+				publish(undefined);
+				reject(error);
+			} finally {
+				if (
+					this.#storedApiKeyResolutionInFlight.get(storageProvider) === resolutions &&
+					resolutions.get(key) === promise
+				) {
+					resolutions.delete(key);
+					if (resolutions.size === 0) this.#storedApiKeyResolutionInFlight.delete(storageProvider);
+				}
+			}
+		})();
+		return promise;
+	}
+	#hasUsableResolvedStoredApiKey(provider: string, key: string): boolean {
+		const resolved = this.#resolvedStoredApiKeyValues.get(resolveOAuthStorageProvider(provider))?.get(key);
+		return key.startsWith("!") ? resolved?.usable === true : true;
+	}
+
 	/**
 	 * Peek at API key for a provider without refreshing OAuth tokens.
 	 * Used for model discovery where we only need to know if credentials exist
@@ -3506,21 +3730,38 @@ export class AuthStorage {
 	 */
 	async peekApiKey(provider: string): Promise<string | undefined> {
 		const runtimeKey = this.#runtimeOverrides.get(provider);
-		if (runtimeKey) {
-			return runtimeKey;
-		}
+		if (runtimeKey) return runtimeKey;
 
 		const configKey = this.#configOverrides.get(provider);
-		if (configKey) {
-			return configKey;
+		if (configKey) return configKey;
+
+		const selectedCredential = this.#resolveSelectedStoredCredential(provider);
+		if (selectedCredential?.credential.type === "api_key") {
+			return this.#resolveStoredApiKey(provider, selectedCredential.credential.key);
 		}
 
-		const apiKeySelection = this.#selectCredentialByType(provider, "api_key");
+		// Return current OAuth access token only if it is not already expired.
+		if (selectedCredential?.credential.type === "oauth") {
+			const expiresAt = selectedCredential.credential.expires;
+			if (Number.isFinite(expiresAt) && expiresAt > Date.now()) {
+				if (provider === "github-copilot") {
+					return JSON.stringify({
+						token: selectedCredential.credential.access,
+						enterpriseUrl: selectedCredential.credential.enterpriseUrl,
+					});
+				}
+				return selectedCredential.credential.access;
+			}
+			return undefined;
+		}
+
+		const apiKeySelection = this.#selectCredentialByType(provider, "api_key", undefined, credential =>
+			this.#hasUsableResolvedStoredApiKey(provider, credential.key),
+		);
 		if (apiKeySelection) {
-			return this.#configValueResolver(apiKeySelection.credential.key);
+			return this.#resolveStoredApiKey(provider, apiKeySelection.credential.key);
 		}
 
-		// Return current OAuth access token only if it is not already expired.
 		const oauthSelection = this.#selectCredentialByType(provider, "oauth");
 		if (oauthSelection) {
 			const expiresAt = oauthSelection.credential.expires;
@@ -3535,10 +3776,7 @@ export class AuthStorage {
 			}
 		}
 
-		const envKey = getEnvApiKey(provider);
-		if (envKey) return envKey;
-
-		return this.#fallbackResolver?.(provider) ?? undefined;
+		return getEnvApiKey(provider) || this.#fallbackResolver?.(provider);
 	}
 
 	/**
@@ -3572,14 +3810,16 @@ export class AuthStorage {
 
 		if (selectedCredential?.credential.type === "api_key") {
 			this.#recordSessionCredential(provider, sessionId, "api_key", selectedCredential.index);
-			return this.#configValueResolver(selectedCredential.credential.key);
+			return this.#resolveStoredApiKey(provider, selectedCredential.credential.key);
 		}
 
 		if (!selectedCredential) {
-			const apiKeySelection = this.#selectCredentialByType(provider, "api_key", sessionId);
+			const apiKeySelection = this.#selectCredentialByType(provider, "api_key", sessionId, credential =>
+				this.#hasUsableResolvedStoredApiKey(provider, credential.key),
+			);
 			if (apiKeySelection) {
 				this.#recordSessionCredential(provider, sessionId, "api_key", apiKeySelection.index);
-				return this.#configValueResolver(apiKeySelection.credential.key);
+				return this.#resolveStoredApiKey(provider, apiKeySelection.credential.key);
 			}
 		}
 
@@ -3648,9 +3888,14 @@ export class AuthStorage {
 		}
 	}
 
-	async #credentialMatchesApiKey(credential: AuthCredential, apiKey: string): Promise<boolean> {
+	async #credentialMatchesApiKey(provider: string, credential: AuthCredential, apiKey: string): Promise<boolean> {
 		if (credential.type === "api_key") {
-			return (await this.#configValueResolver(credential.key)) === apiKey;
+			return (
+				(await this.#configValueResolver(
+					credential.key,
+					String(this.#getProviderConfigurationGeneration(provider)),
+				)) === apiKey
+			);
 		}
 		if (credential.access === apiKey) return true;
 		return this.#extractStructuredApiKeyToken(apiKey) === credential.access;
@@ -3673,7 +3918,7 @@ export class AuthStorage {
 		let matched: { id: number; type: AuthCredential["type"]; index: number } | undefined;
 		for (let index = 0; index < stored.length; index++) {
 			const entry = stored[index];
-			if (entry && (await this.#credentialMatchesApiKey(entry.credential, apiKey))) {
+			if (entry && (await this.#credentialMatchesApiKey(provider, entry.credential, apiKey))) {
 				matched = { id: entry.id, type: entry.credential.type, index };
 				break;
 			}

package/src/index.ts

@@ -24,6 +24,7 @@ export * from "./providers/mock";
 export * from "./providers/ollama";
 export * from "./providers/openai-codex-responses";
 export * from "./providers/openai-completions";
+export * from "./providers/openai-opencodex-responses";
 export * from "./providers/openai-responses";
 export * from "./providers/synthetic";
 export * from "./rate-limit-utils";