@iislee/opencodex 2.11.0 → 2.35.0

package/src/providers/key-failover.ts

@@ -9,7 +9,7 @@
  * Modelled after src/codex/routing.ts cooldown logic but scoped to plain API-key pools.
  */
 import { saveConfigPreservingClaudeCode } from "../config";
-import type { OcxConfig, OcxProviderConfig } from "../types";
+import type { OcxConfig, OcxProviderConfig, RateLimitRetryPolicy } from "../types";
 import { resolveProviderTransport, type OcxProviderTransport } from "./xai-transport";
 import { sweepExpiredOnWrite } from "../lib/state-store-sweeper";
 
@@ -22,6 +22,18 @@ interface KeyCooldown {
 const DEFAULT_COOLDOWN_MS = 60_000;
 const MAX_COOLDOWN_MS = 10 * 60_000; // cap at 10 min for api-key rotation
 
+/**
+ * Default same-target 429 retry policy used when a provider opts in via a bare
+ * `retryOn429: {}` (presence = opt-in with these defaults).
+ */
+const DEFAULT_RATE_LIMIT_RETRY = {
+  enabled: true,
+  attempts: 3,
+  intervalMs: 5_000,
+  maxIntervalMs: 60_000,
+  respectRetryAfter: true,
+} as const satisfies Required<RateLimitRetryPolicy>;
+
 /** Map<`${providerName}\0${keyId}`, KeyCooldown> */
 const keyCooldowns = new Map<string, KeyCooldown>();
 
@@ -29,21 +41,32 @@ function cooldownKey(providerName: string, keyId: string): string {
   return `${providerName}\0${keyId}`;
 }
 
+/**
+ * Parse an upstream `Retry-After` header: numeric seconds (including `0`) or an HTTP-date.
+ * Returns a bounded delay in ms (1..MAX_COOLDOWN_MS), or undefined when the value is
+ * malformed. An HTTP-date already in the past yields an immediate (1 ms) retry.
+ */
 function parseRetryAfterMs(value: string | null | undefined, now = Date.now()): number | undefined {
   const text = value?.trim();
   if (!text) return undefined;
   if (/^\d+(?:\.\d+)?$/.test(text)) {
     const seconds = Number(text);
-    if (Number.isFinite(seconds) && seconds > 0) {
+    if (Number.isFinite(seconds) && seconds >= 0) {
       return Math.min(Math.max(Math.ceil(seconds * 1000), 1), MAX_COOLDOWN_MS);
     }
   }
   const timestamp = Date.parse(text);
   if (!Number.isFinite(timestamp)) return undefined;
   const delay = timestamp - now;
-  return delay > 0 ? Math.min(delay, MAX_COOLDOWN_MS) : undefined;
+  // A valid HTTP-date whose retry time has already passed is an immediate retry, exactly like
+  // numeric `Retry-After: 0` — never a malformed-header fallback to the fixed interval.
+  return Math.min(Math.max(delay, 1), MAX_COOLDOWN_MS);
 }
 
+/**
+ * True while the given key is inside its 429 cooldown window (lazily evicting the entry once the
+ * window expires). Used to skip keys that the upstream just rate-limited during failover.
+ */
 function isKeyInCooldown(providerName: string, keyId: string, now = Date.now()): boolean {
   const entry = keyCooldowns.get(cooldownKey(providerName, keyId));
   if (!entry) return false;
@@ -65,6 +88,51 @@ export function hasKeyPoolFailover(provider: OcxProviderConfig): boolean {
   return (provider.apiKeyPool?.length ?? 0) >= 2;
 }
 
+/**
+ * Normalize a provider's `retryOn429` policy, or return null when the knob is absent,
+ * explicitly disabled, or the provider is not key-auth (OAuth/forward credentials must not be
+ * replayed on the same token, forward passthrough never reaches the recovery loop anyway, and
+ * local runtimes have no remote key to preserve). The returned policy is fully defaulted so
+ * callers never re-check fields.
+ */
+export function rateLimitRetryPolicyFor(
+  provider: Pick<OcxProviderConfig, "retryOn429" | "authMode">,
+): Required<RateLimitRetryPolicy> | null {
+  const policy = provider.retryOn429;
+  if (!policy || policy.enabled === false) return null;
+  // Fail closed: only explicit key auth or the documented omitted-default (undefined == key for
+  // custom API-key providers) may use same-key replays. OAuth/forward are never replayed on the
+  // same token, local runtimes have no remote key to preserve, and unknown/custom values are
+  // rejected rather than guessed at.
+  if (provider.authMode !== undefined && provider.authMode !== "key") return null;
+  return {
+    enabled: policy.enabled ?? DEFAULT_RATE_LIMIT_RETRY.enabled,
+    attempts: policy.attempts ?? DEFAULT_RATE_LIMIT_RETRY.attempts,
+    intervalMs: policy.intervalMs ?? DEFAULT_RATE_LIMIT_RETRY.intervalMs,
+    maxIntervalMs: policy.maxIntervalMs ?? DEFAULT_RATE_LIMIT_RETRY.maxIntervalMs,
+    respectRetryAfter: policy.respectRetryAfter ?? DEFAULT_RATE_LIMIT_RETRY.respectRetryAfter,
+  };
+}
+
+/**
+ * Wait before the next same-target replay: upstream Retry-After (seconds or HTTP-date) when
+ * `respectRetryAfter` is on and the header parses, capped at `maxIntervalMs`; otherwise the
+ * fixed `intervalMs`, also capped at `maxIntervalMs` (a single wait never exceeds the cap).
+ * Malformed headers fall back to the fixed interval.
+ */
+export function rateLimitRetryDelayMs(
+  policy: Required<RateLimitRetryPolicy>,
+  retryAfterHeader: string | null | undefined,
+  now = Date.now(),
+): number {
+  const raw = retryAfterHeader?.trim();
+  if (policy.respectRetryAfter && raw) {
+    const parsed = parseRetryAfterMs(raw, now);
+    if (parsed !== undefined) return Math.min(parsed, policy.maxIntervalMs);
+  }
+  return Math.min(policy.intervalMs, policy.maxIntervalMs);
+}
+
 /**
  * Record a 429 for the current key and attempt to switch to the next available one.
  *

package/src/providers/label.ts

@@ -1,6 +1,7 @@
-import { CODEX_ACCOUNT_LOG_LABEL_RE } from "../codex/account-label";
+import { CODEX_ACCOUNT_LOG_LABEL_RE, oauthAccountLogLabel } from "../codex/account-label";
+import type { OcxProviderConfig } from "../types";
 
-function canonicalUsageProviderLabel(provider: string): string {
+export function canonicalUsageProviderLabel(provider: string): string {
   return provider === "chatgpt" || provider === "openai-multi" ? "openai" : provider;
 }
 
@@ -17,3 +18,35 @@ export function baseProviderLabel(provider: string): string {
   if (suffix === "main") return canonicalUsageProviderLabel(provider.slice(0, cut));
   return CODEX_ACCOUNT_LOG_LABEL_RE.test(suffix) ? canonicalUsageProviderLabel(provider.slice(0, cut)) : provider;
 }
+
+/**
+ * Stamp the per-account usage label for a non-Codex OAuth provider (#2699).
+ *
+ * Call this where the resolved credential is known and NOT inside a failover gate. The obvious
+ * place -- next to the `genericFailoverAccountId` assignment in `core.ts` -- sits inside
+ * `isGenericFailoverProvider`, and the rotation paths additionally require two or more stored
+ * accounts. Stamping there would leave the ordinary case (one xai account, failover off) with no
+ * label at all while every test still passed, which is the bug this fixes rather than a variant
+ * of it.
+ *
+ * Two providers are skipped because they already have attribution:
+ * - `openai` produces its own `p`-labels through `codexAuthContextLogLabel`.
+ * - `anthropic` folds the account into the provider label (`formatAnthropicProviderForLog`).
+ *
+ * It lives here rather than in `account-label.ts` because it needs `baseProviderLabel`, and this
+ * module already imports from that one -- the reverse direction would be an import cycle. This
+ * file stays Lab-clean, which matters because `core.ts` is one of the three files
+ * `tests/core-lab-boundary.test.ts` guards.
+ */
+export function stampOAuthAccountLabel(
+  logCtx: { accountLogLabel?: string },
+  providerName: string,
+  provider: Pick<OcxProviderConfig, "authMode">,
+  accountId: string | undefined,
+): void {
+  if (!accountId) return;
+  if (provider.authMode !== "oauth") return;
+  const base = baseProviderLabel(providerName);
+  if (base === "openai" || base === "anthropic") return;
+  logCtx.accountLogLabel = oauthAccountLogLabel(accountId, base);
+}

package/src/providers/model-discovery-limits.ts

@@ -0,0 +1,16 @@
+/** Hard process-wide limits shared by all live model-discovery parsers. */
+export const MODEL_DISCOVERY_MAX_RESPONSE_BYTES = 4 * 1024 * 1024;
+export const MODEL_DISCOVERY_MAX_MODELS = 2_000;
+export const MODEL_DISCOVERY_MAX_MODEL_ID_LENGTH = 1_024;
+
+const MODEL_DISCOVERY_MODEL_ID_CONTROL_CHARS = /[\u0000-\u001f\u007f-\u009f\u2028\u2029]/;
+
+/** Reject model IDs that cannot safely be published as callable catalog selectors. */
+export function isValidModelDiscoveryModelId(value: unknown): value is string {
+  if (typeof value !== "string") return false;
+  const normalized = value.trim();
+  return Boolean(normalized)
+    && normalized === value
+    && normalized.length <= MODEL_DISCOVERY_MAX_MODEL_ID_LENGTH
+    && !MODEL_DISCOVERY_MODEL_ID_CONTROL_CHARS.test(normalized);
+}

package/src/providers/model-discovery.ts

@@ -1,20 +1,28 @@
 import type { OcxProviderConfig } from "../types";
+import {
+  isValidModelDiscoveryModelId,
+  MODEL_DISCOVERY_MAX_MODEL_ID_LENGTH,
+  MODEL_DISCOVERY_MAX_MODELS,
+  MODEL_DISCOVERY_MAX_RESPONSE_BYTES,
+} from "./model-discovery-limits";
+export {
+  isValidModelDiscoveryModelId,
+  MODEL_DISCOVERY_MAX_MODEL_ID_LENGTH,
+  MODEL_DISCOVERY_MAX_MODELS,
+  MODEL_DISCOVERY_MAX_RESPONSE_BYTES,
+} from "./model-discovery-limits";
 import {
   getProviderRegistryEntry,
   providerMatchesRegistryTransport,
+  registryEntryForProviderDestination,
   type ProviderModelDiscoveryFilter,
   type ProviderModelDiscoveryPredicate,
   type ProviderModelDiscoveryScalar,
   type ProviderModelDiscoverySpec,
 } from "./registry";
 
-/** Hard process-wide limits. Registry entries may lower, but never raise, these ceilings. */
-export const MODEL_DISCOVERY_MAX_RESPONSE_BYTES = 4 * 1024 * 1024;
-export const MODEL_DISCOVERY_MAX_MODELS = 2_000;
-export const MODEL_DISCOVERY_MAX_MODEL_ID_LENGTH = 1_024;
 const MODEL_DISCOVERY_MAX_FILTER_VALUES = 256;
 const MODEL_DISCOVERY_MAX_FILTER_STRING_LENGTH = 1_024;
-const MODEL_DISCOVERY_MODEL_ID_CONTROL_CHARS = /[\u0000-\u001f\u007f-\u009f\u2028\u2029]/;
 
 export interface ResolvedProviderModelDiscovery {
   spec?: ProviderModelDiscoverySpec;
@@ -91,7 +99,12 @@ export function providerModelDiscoverySpecError(spec: ProviderModelDiscoverySpec
       return "discovery path must be a query-free relative/origin path";
     }
     if (path.includes("\\")) return "discovery path must use forward slashes";
-    if (path.split("/").some(segment => segment.replace(/%2e/gi, ".") === "..")) {
+    const segments = path.split("/");
+    if (segments.some((segment, index) => {
+      const decoded = segment.replace(/%2e/gi, ".");
+      if (decoded !== "..") return false;
+      return index !== 0 || segments.filter(s => s.replace(/%2e/gi, ".") === "..").length !== 1;
+    })) {
       return "discovery path must not contain parent-directory segments";
     }
   }
@@ -124,9 +137,14 @@ export function resolveProviderModelDiscovery(
   providerName: string,
   provider: Pick<OcxProviderConfig, "baseUrl" | "adapter"> & Partial<Pick<OcxProviderConfig, "authMode">>,
 ): ResolvedProviderModelDiscovery {
-  const entry = providerMatchesRegistryTransport(providerName, provider)
-    ? getProviderRegistryEntry(providerName)
-    : undefined;
+  // The dashboard permits a canonical preset to be saved under a different name. Recover its
+  // registry-owned discovery policy by transport in that case. The destination helper is limited
+  // to exact fixed-key baseUrl + adapter matches, so custom endpoints, OAuth rows, templates, and
+  // overridable destinations cannot acquire another provider's discovery URL or filter.
+  const namedEntry = getProviderRegistryEntry(providerName);
+  const entry = namedEntry
+    ? (providerMatchesRegistryTransport(providerName, provider) ? namedEntry : undefined)
+    : registryEntryForProviderDestination(provider);
   const spec = entry?.modelDiscovery;
   return {
     ...(spec ? { spec } : {}),
@@ -313,12 +331,83 @@ export function extractModelEnvelopeRows(
 }
 
 /** Validate, bound, deduplicate, and declaratively filter OpenAI `{data:[...]}` or top-level arrays (Together `#617`). */
+/**
+ * Metadata a sibling `models[]` array may contribute to an ALREADY-ADMITTED
+ * `data[]` row (#1797).
+ *
+ * llama.cpp serves a dual-envelope body: an Ollama-style `models[]` array
+ * carrying `capabilities` alongside the OpenAI-style `data[]` array carrying
+ * `meta`, so the two halves of one model's metadata never meet and a server
+ * that truthfully advertises "multimodal" produced an image-blind row.
+ *
+ * Two boundaries make this safe, and both were added after review found the
+ * first attempt unsound:
+ *
+ * 1. It runs AFTER admission filtering. Enriching first let a sibling supply
+ *    the exact field a provider filter requires — reproduced against the real
+ *    Chutes policy, where a row lacking `supported_features: ["tools"]` was
+ *    admitted once a same-id sibling provided it. Enrichment may change what is
+ *    KNOWN about a model, never WHICH models are published.
+ * 2. Only the capability keys #1797 needs are copied. A blanket "fill every
+ *    absent key" made the untrusted `models[]` array a way into any field the
+ *    pipeline consumes.
+ *
+ *    The list deliberately EXCLUDES `supported_features` and `features`, even
+ *    though both are capability-shaped: they are the two keys real provider
+ *    filters test (`registry.ts:1591` requires `supported_features` to contain
+ *    "tools"; `registry.ts:1883` tests `features.tool_use`). Ordering already
+ *    prevents a sibling from flipping an admission verdict, but a key that is
+ *    both enrichable and filter-relevant is one refactor away from becoming a
+ *    bypass again. #1797 does not need them.
+ */
+const SIBLING_ENRICHABLE_KEYS = new Set(["capabilities", "modalities", "input_modalities"]);
+
+type SiblingIndex = Map<string, Record<string, unknown> | null>;
+
+function buildSiblingIndex(value: unknown, limit: number): SiblingIndex | null {
+  const record = plainObject(value);
+  const sibling = record?.models;
+  if (!Array.isArray(sibling) || sibling.length === 0 || sibling.length > limit) return null;
+
+  const byId: SiblingIndex = new Map();
+  for (const raw of sibling) {
+    const entry = plainObject(raw);
+    if (!entry) continue;
+    for (const key of ["id", "model", "name"]) {
+      const id = entry[key];
+      if (typeof id !== "string" || id.length === 0) continue;
+      // `null` marks an ambiguous id: two sibling entries claim it, so neither
+      // can be attributed with confidence and both are ignored.
+      byId.set(id, byId.has(id) && byId.get(id) !== entry ? null : entry);
+    }
+  }
+  return byId.size > 0 ? byId : null;
+}
+
+function enrichAdmittedModel(item: ProviderModelsApiItem, siblings: SiblingIndex): ProviderModelsApiItem {
+  const extra = siblings.get(item.id);
+  if (!extra) return item;
+  let merged: Record<string, unknown> | null = null;
+  for (const key of SIBLING_ENRICHABLE_KEYS) {
+    if (!(key in extra) || key in item) continue;
+    merged ??= { ...(item as Record<string, unknown>) };
+    merged[key] = extra[key];
+  }
+  return (merged ?? item) as ProviderModelsApiItem;
+}
+
+function plainObject(value: unknown): Record<string, unknown> | null {
+  return typeof value === "object" && value !== null && !Array.isArray(value)
+    ? value as Record<string, unknown>
+    : null;
+}
 export function extractProviderModelItems(
   value: unknown,
   discovery: ResolvedProviderModelDiscovery,
 ): ProviderModelItemsResult {
   const limit = positiveIntegerAtMost(discovery.maxModels, MODEL_DISCOVERY_MAX_MODELS);
   let data: unknown[];
+  let siblings: SiblingIndex | null = null;
   if (Array.isArray(value)) {
     // Together-style top-level /models arrays. Catalog discovery must not treat a stray
     // `models` key on openai-chat responses as valid — only `data` envelopes or top-level arrays.
@@ -328,6 +417,7 @@ export function extractProviderModelItems(
     const envelope = extractModelEnvelopeRows(value, discovery.maxModels, ["data"]);
     if (!envelope.ok) return envelope;
     data = envelope.rows;
+    siblings = buildSiblingIndex(value, limit);
   }
 
   const items: ProviderModelsApiItem[] = [];
@@ -337,20 +427,23 @@ export function extractProviderModelItems(
       return { ok: false, reason: "invalid_shape" };
     }
     const id = (raw as { id?: unknown }).id;
-    if (typeof id !== "string") return { ok: false, reason: "invalid_shape" };
-    const normalizedId = id.trim();
-    if (
-      !normalizedId
-      || normalizedId !== id
-      || normalizedId.length > MODEL_DISCOVERY_MAX_MODEL_ID_LENGTH
-      || MODEL_DISCOVERY_MODEL_ID_CONTROL_CHARS.test(normalizedId)
-    ) {
-      return { ok: false, reason: "invalid_shape" };
+    if (!isValidModelDiscoveryModelId(id)) return { ok: false, reason: "invalid_shape" };
+    const prefix = discovery.spec?.stripIdPrefix;
+    let finalId = id;
+    if (prefix && finalId.startsWith(prefix)) {
+      finalId = finalId.slice(prefix.length);
+      if (!isValidModelDiscoveryModelId(finalId)) continue;
     }
-    const item = raw as ProviderModelsApiItem;
-    if (!providerModelMatchesDiscoveryFilter(item, discovery.spec?.filter) || seen.has(normalizedId)) continue;
-    seen.add(normalizedId);
-    items.push(item);
+    const item = finalId === id ? raw as ProviderModelsApiItem : { ...(raw as ProviderModelsApiItem), id: finalId };
+    // Admission is decided on the ORIGINAL `data[]` row, before any sibling
+    // enrichment. Merging first let a `models[]` entry supply the very field a
+    // provider filter requires — reproduced against the real Chutes policy,
+    // where a row lacking `supported_features: ["tools"]` was admitted once a
+    // same-id sibling provided it. Enrichment must never change WHICH models
+    // are published, only what is known about an already-admitted one.
+    if (!providerModelMatchesDiscoveryFilter(item, discovery.spec?.filter) || seen.has(finalId)) continue;
+    seen.add(finalId);
+    items.push(siblings ? enrichAdmittedModel(item, siblings) : item);
   }
   return { ok: true, items, rawCount: data.length };
 }

package/src/providers/model-presets.ts

@@ -0,0 +1,119 @@
+/**
+ * Shipped per-provider "latest/core" model presets (#2465).
+ *
+ * Adding a high-volume provider exposes its entire catalog to the Codex picker on day one:
+ * openrouter ships 400+ rows, an Anthropic provider ships every historical snapshot. The useful
+ * set is a handful of current flagships, so a newly added provider seeds from a curated preset
+ * and "everything" stays one click away.
+ *
+ * Rules are ID PATTERNS rather than literal id lists so a vendor snapshot suffix does not stale
+ * the preset between releases: `claude-opus-5-20260814` and `claude-opus-5` both match one rule.
+ *
+ * The preset is a SEED, not a lock. Materialization evaluates these rules against the provider's
+ * current catalog and stores CONCRETE ids in `selectedModels`, so the visibility hot path
+ * (`filterCatalogVisibleModels`) never learns about patterns and an older binary still sees a
+ * plain allowlist. Design: devlog/_plan/260824_model_ux_aliases_and_defaults/030_default_preset.md
+ */
+
+import type { OcxProviderConfig } from "../types";
+
+export interface ModelPresetRule {
+  readonly pattern: RegExp;
+}
+
+export interface ModelPreset {
+  /** Bumped whenever this provider's rules change; drives upgrade reconciliation. */
+  readonly version: number;
+  readonly rules: readonly ModelPresetRule[];
+}
+
+/**
+ * Curated on the same release train as the provider registry. A provider WITHOUT an entry has no
+ * preset and behaves exactly as today (mode "all").
+ *
+ * Deliberately limited to high-volume catalogs. A provider that already ships a short curated
+ * list gains nothing from a preset and would only add a marker to reconcile.
+ */
+export const MODEL_PRESETS: Readonly<Record<string, ModelPreset>> = Object.freeze({
+  openrouter: {
+    version: 1,
+    rules: [
+      { pattern: /^anthropic\/claude-(opus|sonnet|haiku)-[45]/ },
+      { pattern: /^google\/gemini-3(\.\d+)?-(pro|flash)/ },
+      { pattern: /^openai\/gpt-5(\.\d+)?/ },
+      { pattern: /^deepseek\/deepseek-(v4|r2)/ },
+      { pattern: /^x-ai\/grok-4(\.\d+)?/ },
+      { pattern: /^moonshotai\/kimi-k[23]/ },
+      { pattern: /^z-ai\/glm-[45]/ },
+    ],
+  },
+  anthropic: {
+    version: 1,
+    rules: [
+      { pattern: /^claude-opus-[45]/ },
+      { pattern: /^claude-sonnet-[45]/ },
+      { pattern: /^claude-haiku-[45]/ },
+      { pattern: /^claude-fable-5/ },
+    ],
+  },
+  "anthropic-apikey": {
+    version: 1,
+    rules: [
+      { pattern: /^claude-opus-[45]/ },
+      { pattern: /^claude-sonnet-[45]/ },
+      { pattern: /^claude-haiku-[45]/ },
+      { pattern: /^claude-fable-5/ },
+    ],
+  },
+});
+
+/** The preset for a provider, or undefined when none is shipped. */
+export function modelPresetFor(providerName: string): ModelPreset | undefined {
+  return MODEL_PRESETS[providerName];
+}
+
+/** True when a provider has a shipped preset at all. */
+export function hasModelPreset(providerName: string): boolean {
+  return modelPresetFor(providerName) !== undefined;
+}
+
+/**
+ * Evaluate a provider's rules against concrete catalog ids.
+ *
+ * Input order is preserved so a caller can show the preset in the same order the picker does.
+ * Duplicates are collapsed; a model matching several rules is selected once.
+ */
+export function materializeModelPreset(
+  providerName: string,
+  catalogModelIds: Iterable<string>,
+): string[] {
+  const preset = modelPresetFor(providerName);
+  if (!preset) return [];
+  const seen = new Set<string>();
+  const out: string[] = [];
+  for (const id of catalogModelIds) {
+    if (seen.has(id)) continue;
+    // `RegExp.test` on a shared literal is safe here because no rule uses the `g` flag; a
+    // sticky/global pattern would carry lastIndex between calls and skip rows.
+    if (preset.rules.some(rule => rule.pattern.test(id))) {
+      seen.add(id);
+      out.push(id);
+    }
+  }
+  return out;
+}
+
+
+/**
+ * Flip a provider out of preset mode when the user edits its selection (#2465).
+ *
+ * No-op unless the provider is currently in preset mode: "all" has no marker to keep, and
+ * "custom" is already terminal. The applied version is retained so the GUI can still offer
+ * "a newer preset is available" without losing what the user chose.
+ */
+export function markModelPresetDiverged(provider: OcxProviderConfig): void {
+  const marker = provider.modelPreset;
+  if (marker?.mode !== "preset") return;
+  provider.modelPreset = { ...marker, mode: "custom" };
+}
+