@yansigit/opencodex 2.32.0 → 2.33.1

package/src/oauth/google-aistudio-auth.ts

@@ -0,0 +1,98 @@
+/**
+ * Google AI Studio Web-UI (SAPISIDHASH) authorization & header builder.
+ */
+
+export interface GoogleCookieJar {
+  sapisid?: string;
+  psid?: string;
+  ssid?: string;
+  hsid?: string;
+  sid?: string;
+  cookieHeader: string;
+}
+
+const DEFAULT_ORIGIN = "https://aistudio.google.com";
+
+/**
+ * Generate the Google internal SAPISIDHASH Authorization header value.
+ * Formula uses Unix seconds: "SAPISIDHASH <timestamp>_<sha1(timestamp + " " + SAPISID + " " + origin)>".
+ */
+export async function generateSapisidHash(
+  sapisid: string,
+  origin: string = DEFAULT_ORIGIN,
+  timestamp: number = Date.now()
+): Promise<string> {
+  // Callers historically passed Date.now() (milliseconds); Google expects Unix seconds.
+  const seconds = Math.floor(timestamp > 10_000_000_000 ? timestamp / 1000 : timestamp);
+  const raw = `${seconds} ${sapisid} ${origin}`;
+  const buf = await crypto.subtle.digest("SHA-1", new TextEncoder().encode(raw));
+  const hexHash = Array.from(new Uint8Array(buf))
+    .map((b) => b.toString(16).padStart(2, "0"))
+    .join("");
+  return `SAPISIDHASH ${seconds}_${hexHash}`;
+}
+
+/**
+ * Parse a raw cookie string (from browser export, header, or config) into tokens and a normalized string.
+ */
+export function parseGoogleCookieJar(cookieInput: string): GoogleCookieJar {
+  const cleanInput = (cookieInput || "").trim();
+  const jar: GoogleCookieJar = { cookieHeader: cleanInput };
+  if (!cleanInput) return jar;
+  if (/[\r\n\u0000]/.test(cleanInput)) return { cookieHeader: "" };
+
+  const parts = cleanInput.split(";").map((p) => p.trim());
+  for (const part of parts) {
+    const eqIdx = part.indexOf("=");
+    if (eqIdx === -1) continue;
+    const name = part.slice(0, eqIdx).trim();
+    const value = part.slice(eqIdx + 1).trim();
+
+    if (name === "SAPISID" || name === "__Secure-3PAPISID") {
+      jar.sapisid = value;
+    } else if (name === "__Secure-1PSID" || name === "__Secure-3PSID") {
+      jar.psid = value;
+    } else if (name === "SSID") {
+      jar.ssid = value;
+    } else if (name === "HSID") {
+      jar.hsid = value;
+    } else if (name === "SID") {
+      jar.sid = value;
+    }
+  }
+
+  return jar;
+}
+
+/**
+ * Validate whether a cookie jar contains sufficient authentication credentials.
+ */
+export function validateAiStudioCookies(jar: GoogleCookieJar): { valid: boolean; error?: string } {
+  if (!jar.sapisid || !jar.cookieHeader) {
+    return {
+      valid: false,
+      error: "Missing SAPISID cookie required for Google AI Studio authorization.",
+    };
+  }
+  return { valid: true };
+}
+
+/**
+ * Build the HTTP headers required for alkalimakersuite-pa.clients6.google.com calls.
+ */
+export async function buildAiStudioHeaders(
+  jar: GoogleCookieJar,
+  origin: string = DEFAULT_ORIGIN
+): Promise<Record<string, string>> {
+  const sapisid = jar.sapisid || "";
+  const authHeader = await generateSapisidHash(sapisid, origin);
+
+  return {
+    "Authorization": authHeader,
+    "Cookie": jar.cookieHeader,
+    "X-Goog-AuthUser": "0",
+    "Origin": origin,
+    "Referer": origin.endsWith("/") ? origin : `${origin}/`,
+    "Content-Type": "application/json",
+  };
+}

package/src/oauth/google-antigravity.ts

@@ -51,6 +51,28 @@ interface GoogleTokenPayload {
   id_token?: unknown;
 }
 
+const TERMINAL_OAUTH_ERRORS = new Set([
+  "access_denied",
+  "expired_token",
+  "invalid_grant",
+  "refresh_token_reused",
+  "refresh_token_revoked",
+  "revoked",
+  "revoked_token",
+]);
+
+export class AntigravityTokenRequestError extends Error {
+  readonly httpStatus: number;
+  readonly oauthError?: string;
+
+  constructor(httpStatus: number, oauthError?: string) {
+    super(`Antigravity token request failed: ${httpStatus}`);
+    this.name = "AntigravityTokenRequestError";
+    this.httpStatus = httpStatus;
+    if (oauthError) this.oauthError = oauthError;
+  }
+}
+
 function decodeJwtPayload(token: string): Record<string, unknown> | undefined {
   const part = token.split(".")[1];
   if (!part) return undefined;
@@ -75,8 +97,17 @@ async function postToken(body: Record<string, string>, signal?: AbortSignal): Pr
     signal: requestSignal(signal),
   });
   if (!response.ok) {
-    // Status only — the body can carry grant/account details.
-    throw new Error(`Antigravity token request failed: ${response.status}`);
+    let oauthError: string | undefined;
+    if (response.status === 400 || response.status === 401) {
+      try {
+        const body = await response.json() as { error?: unknown };
+        const candidate = typeof body.error === "string" ? body.error.trim().toLowerCase() : "";
+        if (TERMINAL_OAUTH_ERRORS.has(candidate)) oauthError = candidate;
+      } catch {
+        /* Keep status-only errors for malformed or non-JSON responses. */
+      }
+    }
+    throw new AntigravityTokenRequestError(response.status, oauthError);
   }
   return (await response.json()) as GoogleTokenPayload;
 }
@@ -221,7 +252,11 @@ export async function loginAntigravity(ctrl: OAuthController, opts?: { forceAcco
   return new AntigravityOAuthFlow(ctrl, opts).login();
 }
 
-export async function refreshAntigravityToken(refreshToken: string, signal?: AbortSignal): Promise<OAuthCredentials> {
+export async function refreshAntigravityToken(
+  refreshToken: string,
+  signal?: AbortSignal,
+  previousCredential?: OAuthCredentials,
+): Promise<OAuthCredentials> {
   if (!refreshToken) throw new Error("Antigravity credentials are expired and do not include a refresh token");
   const payload = await postToken({
     grant_type: "refresh_token",
@@ -230,8 +265,10 @@ export async function refreshAntigravityToken(refreshToken: string, signal?: Abo
     refresh_token: refreshToken,
   }, signal);
   const creds = credentialsFromPayload(payload, refreshToken);
-  // Re-discover the project on refresh so a newly-onboarded account fills in projectId.
-  const projectId = await discoverAntigravityProject(creds.access, signal).catch(() => undefined);
+  // Project discovery is onboarding work, not ordinary token renewal. Preserve the existing
+  // account-scoped project id and avoid an extra authenticated CCA call when it is present.
+  const projectId = previousCredential?.projectId
+    ?? await discoverAntigravityProject(creds.access, signal).catch(() => undefined);
   return projectId ? { ...creds, projectId } : creds;
 }
 

package/src/oauth/index.ts

@@ -10,7 +10,7 @@ import { ANTHROPIC_OAUTH_BETA, AnthropicTokenError, loginAnthropic, refreshAnthr
 import { loginKimi, refreshKimiToken } from "./kimi";
 import { loginNous, NousTokenError, refreshNousToken, clearNousRefreshIntent, RefreshIntentIOError } from "./nous";
 import { loginChatGPT, refreshChatGPTToken } from "./chatgpt";
-import { loginAntigravity, refreshAntigravityToken } from "./google-antigravity";
+import { AntigravityTokenRequestError, loginAntigravity, refreshAntigravityToken } from "./google-antigravity";
 import { loginCursor, refreshCursorToken } from "./cursor";
 import { loginGithubCopilot, refreshGithubCopilotToken, validateCopilotApiBaseUrl } from "./github-copilot";
 import { loginCommandCode, refreshCommandCodeToken } from "./command-code";
@@ -222,6 +222,7 @@ export const OAUTH_PROVIDERS: Record<string, OAuthProviderDef> = {
     refresh: refreshAntigravityToken,
     providerConfig: oauthConfig("google-antigravity"),
     defaultModel: oauthDefaultModel("google-antigravity"),
+    defaultRefreshPolicy: "lazy-only",
   },
   cursor: {
     login: (ctrl, opts) => loginCursor(ctrl, undefined, { forceLogin: opts?.forceLogin }),
@@ -466,8 +467,16 @@ export async function getValidAccessTokenSnapshot(provider: string): Promise<OAu
   return resolveAccessSnapshotForAccount(provider, set.activeAccountId);
 }
 
+/** Resolve a specific stored account without consulting or changing the active account. */
+export async function getValidAccessTokenSnapshotForAccount(
+  provider: string,
+  accountId: string,
+): Promise<OAuthAccessSnapshot> {
+  return resolveAccessSnapshotForAccount(provider, accountId);
+}
+
 /** Providers whose upstream-401 replay path may force a snapshot refresh. */
-const FORCE_REFRESH_PROVIDERS = new Set(["xai", "github-copilot", "kiro"]);
+const FORCE_REFRESH_PROVIDERS = new Set(["xai", "github-copilot", "kiro", "google-antigravity"]);
 
 export async function forceRefreshOAuthAccessSnapshot(
   rejected: OAuthAccessSnapshot,
@@ -501,6 +510,9 @@ function isTerminalRefreshError(err: unknown): boolean {
     || msg.includes("expired_token");
 }
 function terminal(error:unknown):boolean{
+  if (error instanceof AntigravityTokenRequestError) {
+    return (error.httpStatus === 400 || error.httpStatus === 401) && error.oauthError !== undefined;
+  }
   if(error instanceof XaiTokenRequestError)return ["invalid_grant","refresh_token_reused","revoked_token"].includes(error.oauthError??"");
   if(error instanceof AnthropicTokenError)return (error.httpStatus===400||error.httpStatus===401)&&["invalid_grant","refresh_token_reused","revoked","revoked_token","refresh_token_revoked"].includes(error.oauthError??"");
   if(error instanceof KiroTokenRefreshError)return (error.httpStatus===400||error.httpStatus===401)&&error.oauthError!==undefined;
@@ -630,7 +642,7 @@ export async function refreshAnthropicAccountWithLock(
       writeOAuthRefreshIntent(provider, accountId, generation, now(), deps.flight?.flightId);
       if (deps.signal?.aborted) throw deps.signal.reason;
       if (deps.flight) deps.flight.dispatched = true;
-      const fresh = merged(await def.refresh(stored.refresh, deps.signal), stored);
+      const fresh = merged(await def.refresh(stored.refresh, deps.signal, stored), stored);
       const outcome = await mergeAccountCredential(provider, accountId, fresh, {
         expectedGeneration: generation,
         afterPrePersistRead: deps.afterPrePersistRead,

package/src/oauth/key-providers.ts

@@ -1,6 +1,7 @@
 import type { OcxProviderConfig } from "../types";
 import { deriveKeyLoginMap, enrichProviderFromRegistry, type DerivedKeyLoginProvider } from "../providers/derive";
 import { resolveProviderModelDiscoveryUrl } from "../providers/model-discovery";
+import { parseGoogleCookieJar, validateAiStudioCookies } from "./google-aistudio-auth";
 
 /**
  * API-key "login" providers: not OAuth — the flow opens the provider's dashboard so the user can
@@ -86,6 +87,13 @@ export async function validateApiKey(
       return "unknown";
     }
 
+    if (provider.adapter === "google" && provider.googleMode === "ai-studio-web") {
+      const jar = parseGoogleCookieJar(key);
+      const val = validateAiStudioCookies(jar);
+      if (!val.valid) return false;
+      return true;
+    }
+
     if (provider.adapter === "google" && (provider.googleMode ?? "ai-studio") === "ai-studio") {
       // Generative Language API rejects Bearer-wrapped API keys; probe models.list with the
       // documented x-goog-api-key header instead (pageSize=1 — validation only needs a 200).

package/src/oauth/kimi.ts

@@ -209,7 +209,15 @@ async function pollForToken(deviceCode: string, intervalMs: number, expiresInMs:
 
 export async function loginKimi(ctrl: OAuthController): Promise<OAuthCredentials> {
   const device = await requestDeviceAuthorization();
-  ctrl.onAuth?.({ url: device.verificationUriComplete, instructions: `Enter code: ${device.userCode}` });
+  // `deviceCode` carries the human-typed user code, matching the other device
+  // providers. It is also what tells the management login route this is a device
+  // flow, so a provider-supplied verification URI is no longer handed to a local
+  // browser spawn — the URL stays visible and copyable in every login surface.
+  ctrl.onAuth?.({
+    url: device.verificationUriComplete,
+    instructions: `Enter code: ${device.userCode}`,
+    deviceCode: device.userCode,
+  });
   return pollForToken(device.deviceCode, device.intervalMs, device.expiresInMs, ctrl.signal);
 }
 

package/src/oauth/login-cli.ts

@@ -15,6 +15,7 @@ import { codexAccountNamespaceProviderCollisionError } from "../codex/account-na
 const LIVE_RELOAD_PROVIDERS = new Set<string>([
   ...listOAuthProviders(),
   ...Object.keys(KEY_LOGIN_PROVIDERS),
+  "google-aistudio",
 ]);
 
 export function runningProxyUpdateHeaders(): Headers {
@@ -65,16 +66,80 @@ export function warnIfLiveReloadSkipped(result: LocalProviderReloadResult | null
 
 export async function handleLogin(provider?: string): Promise<void> {
   const name = (provider ?? "").trim().toLowerCase();
+  if (name === "google-aistudio" || name === "aistudio" || name === "gemini-aistudio") {
+    return handleAiStudioBridgeLogin();
+  }
   if (isPublicOAuthProvider(name)) return handleOAuthLogin(name);
   if (isKeyLoginProvider(name)) return handleKeyLogin(name);
   console.error(
     `Usage: ocx login <provider>\n` +
-      `  OAuth login:   ${listOAuthProviders().join(", ")}\n` +
+      `  OAuth / Web:   ${[...listOAuthProviders(), "google-aistudio"].join(", ")}\n` +
       `  API-key login: ${Object.keys(KEY_LOGIN_PROVIDERS).join(", ")}`,
   );
   process.exit(1);
 }
 
+async function handleAiStudioBridgeLogin(): Promise<void> {
+  const live = await findLiveProxy();
+  const port = live?.port ?? 10100;
+  const bridgeUrl = "http://127.0.0.1:" + port + "/aistudio/bridge";
+
+  console.log("\n🌐 Google AI Studio Sign-In & Session Setup:");
+  console.log("   Option 1: Paste Session Token from the Brave/Chrome extension popup (Passkey-friendly)");
+  console.log("   Option 2: Open native macOS sign-in window");
+  console.log("   Option 3: Open browser bridge page (" + bridgeUrl + ")\n");
+
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    const choice = await new Promise<string>((res) => {
+      rl.question("Paste Session Token (or press Enter for native window): ", (ans) => res(ans.trim()));
+    });
+
+    if (choice.length > 20) {
+      const { saveAiStudioSessionFromToken } = await import("./aistudio-session-sync");
+      saveAiStudioSessionFromToken(choice);
+      console.log("\n✅ Session token imported successfully! Saved to ~/.opencodex/aistudio-session.json");
+    } else if (process.platform === "darwin") {
+      const { getAiStudioNativeDaemonSourcePath } = await import("./aistudio-native-daemon");
+      const swiftSrc = getAiStudioNativeDaemonSourcePath();
+      console.log("\n🚀 Opening native Google AI Studio login window...");
+      const proc = Bun.spawn(["swift", swiftSrc, "--login"], {
+        stdout: "inherit",
+        stderr: "inherit",
+      });
+      const code = await proc.exited;
+      if (code === 0) {
+        console.log("\n✅ Google AI Studio authenticated successfully! Session saved to ~/.opencodex/aistudio-session.json");
+      }
+    } else {
+      console.log("\n🌐 Opening bridge page in your browser: " + bridgeUrl);
+      openUrl(bridgeUrl);
+    }
+  } finally {
+    rl.close();
+  }
+
+  const config = loadConfig();
+  if (!config.providers["google-aistudio"]) {
+    config.providers["google-aistudio"] = {
+      adapter: "google",
+      googleMode: "ai-studio-web",
+      baseUrl: "https://alkalimakersuite-pa.clients6.google.com",
+      authMode: "local",
+      liveModels: false,
+      defaultModel: "gemini-3.7-flash",
+      models: ["gemini-3.7-flash", "gemini-3.1-pro-preview", "gemini-2.5-pro", "gemini-2.5-flash", "gemini-3.5-flash"],
+    };
+    saveConfig(config);
+    console.log("\n   ✓ Configured 'google-aistudio' in ~/.opencodex/config.json");
+  }
+
+  openUrl(bridgeUrl);
+  const reload = await notifyRunningProxy("google-aistudio");
+  console.log("\n✅ Ready! Use models with 'google-aistudio' provider in your coding agents.");
+  warnIfLiveReloadSkipped(reload);
+}
+
 async function handleOAuthLogin(name: string): Promise<void> {
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
   try {

package/src/oauth/open-browser-choice.ts

@@ -0,0 +1,26 @@
+import type { OcxConfig } from "../types";
+
+/**
+ * Whether a login should open a browser on the machine running the proxy.
+ *
+ * Both login routes share this so the two surfaces cannot drift: a per-request
+ * `openBrowser` beats the persisted setting, and the persisted setting beats
+ * the historical default. It lives in `src/oauth/` rather than beside either
+ * route because `src/codex/auth-api.ts` and
+ * `src/server/management/oauth-account-routes.ts` both already import from
+ * here, so no new edge is added to the import graph.
+ *
+ * The default is the important part. An operator who upgrades and configures
+ * nothing must see exactly what they saw before, so only an explicit `false`
+ * declines — `undefined`, `true`, and a malformed value all open.
+ *
+ * A malformed request field is ignored rather than rejected on purpose: this is
+ * a display preference, and no login should fail because of one.
+ */
+export function shouldOpenBrowserForLogin(
+  requested: unknown,
+  config: Pick<OcxConfig, "oauthOpenBrowser">,
+): boolean {
+  if (typeof requested === "boolean") return requested;
+  return config.oauthOpenBrowser !== false;
+}

package/src/oauth/store.ts

@@ -593,9 +593,11 @@ export async function upsertCredentialByIdentity(
 
 /** Remove the ACTIVE account; remaining accounts promote the first one. */
 export async function removeCredential(provider: string): Promise<void> {
+  let removedAccountId: string | undefined;
   await mutateStore(store => {
     const set = store[provider];
     if (!set) return;
+    removedAccountId = set.activeAccountId;
     set.accounts = set.accounts.filter(a => a.id !== set.activeAccountId);
     if (set.accounts.length === 0) {
       delete store[provider];
@@ -603,6 +605,10 @@ export async function removeCredential(provider: string): Promise<void> {
     }
     set.activeAccountId = set.accounts[0]!.id;
   }, [provider]);
+  if (provider === "google-antigravity" && removedAccountId) {
+    const { clearAntigravityRoutingStateForAccount } = await import("./antigravity-routing");
+    clearAntigravityRoutingStateForAccount(removedAccountId);
+  }
 }
 
 // ---------------------------------------------------------------------------

package/src/providers/antigravity-quota.ts

@@ -90,7 +90,9 @@ function candidateModelName(record: Record<string, unknown>): string {
     ?? record.modelName
     ?? record.model
     ?? record.name
-    ?? record.displayName;
+    ?? record.displayName
+    ?? record.modelFamily
+    ?? record.model_family;
   return typeof explicit === "string" ? explicit.toLowerCase() : "";
 }
 

package/src/providers/api-keys.ts

@@ -8,6 +8,7 @@
  */
 import { createHash } from "node:crypto";
 import { saveConfigPreservingClaudeCode } from "../config";
+import { isAzureIdentityProvider } from "../config/provider-validation";
 import type { OcxConfig, OcxProviderConfig } from "../types";
 
 export interface ProviderApiKeyInfo {
@@ -36,7 +37,7 @@ export function apiKeyPoolEntryId(key: string): string {
 
 /** True for providers whose upstream auth is a configured API key (not oauth/forward). */
 export function isKeyAuthProvider(provider: OcxProviderConfig): boolean {
-  return provider.authMode !== "oauth" && provider.authMode !== "forward";
+  return !isAzureIdentityProvider(provider) && provider.authMode !== "oauth" && provider.authMode !== "forward";
 }
 
 /** Trim and reject blank / CRLF-bearing secrets. Shared by pool writes and OAuth upsert. */

package/src/providers/auto-compact-budget.ts

@@ -0,0 +1,65 @@
+import { SUPPORTED_NATIVE_OPENAI_SLUGS } from "../codex/catalog/native-models";
+import { redactSecretString } from "../lib/redact";
+
+const RESERVED_OBJECT_KEYS = new Set(["__proto__", "constructor", "prototype"]);
+
+function positiveSafeInteger(value: unknown): value is number {
+  return typeof value === "number" && Number.isSafeInteger(value) && value > 0;
+}
+
+/**
+ * Resolve a client-facing soft compaction budget without changing any hard
+ * model limit. Configuration and measured input ceilings may only lower the
+ * default 90% envelope.
+ */
+export function clampAutoCompactTokenLimit(
+  contextWindow: number,
+  maxInputTokens?: number,
+  configuredLimit?: number,
+): number {
+  const candidates = [Math.floor(contextWindow * 0.9), contextWindow];
+  if (positiveSafeInteger(maxInputTokens)) candidates.push(maxInputTokens);
+  if (positiveSafeInteger(configuredLimit)) candidates.push(configuredLimit);
+  return Math.min(...candidates);
+}
+
+export type AutoCompactBudgetValidationOptions = Readonly<{
+  /** PATCH accepts null for whole-map and per-key deletion. */
+  allowTombstones?: boolean;
+  /** The canonical ChatGPT provider accepts only exact supported native ids. */
+  requireNativeIds?: boolean;
+}>;
+
+/** Shared config/load/management boundary for per-model soft budgets. */
+export function modelAutoCompactTokenLimitsConfigError(
+  value: unknown,
+  options: AutoCompactBudgetValidationOptions = {},
+): string | null {
+  const field = "modelAutoCompactTokenLimits";
+  if (value === undefined || (options.allowTombstones && value === null)) return null;
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return `${field} must be a plain object${options.allowTombstones ? " or null" : ""}`;
+  }
+  const prototype = Object.getPrototypeOf(value);
+  if (prototype !== Object.prototype && prototype !== null) {
+    return `${field} must be a plain object with own properties`;
+  }
+  for (const [modelId, entry] of Object.entries(value as Record<string, unknown>)) {
+    const safeModelId = JSON.stringify(redactSecretString(modelId));
+    if (!modelId.trim()) return `${field} keys must be nonblank model ids`;
+    if (RESERVED_OBJECT_KEYS.has(modelId)) {
+      return `${field} key ${safeModelId} is reserved`;
+    }
+    if (options.requireNativeIds
+      && (modelId.includes("/") || !SUPPORTED_NATIVE_OPENAI_SLUGS.has(modelId))) {
+      return `${field} key ${safeModelId} must be an exact supported native model id`;
+    }
+    if (options.allowTombstones && entry === null) continue;
+    if (!positiveSafeInteger(entry)) {
+      return `${field}[${safeModelId}] must be a positive safe integer${
+        options.allowTombstones ? " or null" : ""
+      }`;
+    }
+  }
+  return null;
+}

package/src/providers/derive.ts

@@ -1,4 +1,5 @@
 import type { CodexAccountMode, OcxProviderConfig } from "../types";
+import { isAzureIdentityProvider } from "../config/provider-validation";
 import { cloneFastWire } from "./fastwire";
 import {
   PROVIDER_REGISTRY,
@@ -48,7 +49,7 @@ export interface DerivedKeyLoginProvider {
   thinkingBudgetModels?: string[];
   escapeBuiltinToolNames?: boolean;
   openaiChatEofTolerance?: boolean;
-  googleMode?: "ai-studio" | "vertex" | "cloud-code-assist";
+  googleMode?: "ai-studio" | "vertex" | "cloud-code-assist" | "ai-studio-web";
   project?: string;
   location?: string;
 }
@@ -226,6 +227,7 @@ export function providerConfigSeed(entry: ProviderRegistryEntry): OcxProviderCon
     ...(entry.modelSuffixBracketStrip !== undefined ? { modelSuffixBracketStrip: entry.modelSuffixBracketStrip } : {}),
     ...(entry.staticHeaders ? { headers: { ...entry.staticHeaders } } : {}),
     ...(entry.defaultModel ? { defaultModel: entry.defaultModel } : {}),
+    ...(entry.requestPacing ? { requestPacing: structuredClone(entry.requestPacing) } : {}),
     ...(entry.models ? { models: [...entry.models] } : {}),
     ...(liveModels !== undefined ? { liveModels } : {}),
     ...(entry.contextWindow !== undefined ? { contextWindow: entry.contextWindow } : {}),
@@ -416,6 +418,7 @@ export function hasLegacyClinePassReasoningEfforts(name: string, prov: OcxProvid
 }
 
 export function enrichProviderFromRegistry(name: string, prov: OcxProviderConfig): void {
+  if (isAzureIdentityProvider(prov)) prov.liveModels = false;
   const entry = PROVIDER_REGISTRY.find(row => row.id === name);
   if (!entry || !providerMatchesRegistryTransportWithStaticGuards(name, prov)) {
     // Name lookup failed, but the row may still point at a vendor route we know. #1100 was
@@ -438,6 +441,7 @@ export function enrichProviderFromRegistry(name: string, prov: OcxProviderConfig
   repairStaticModelCatalogProvider(name, prov);
   if (prov.apiKeyTransport === undefined && seed.apiKeyTransport !== undefined) prov.apiKeyTransport = seed.apiKeyTransport;
   if (!prov.defaultModel && seed.defaultModel) prov.defaultModel = seed.defaultModel;
+  if (prov.requestPacing === undefined && seed.requestPacing) prov.requestPacing = structuredClone(seed.requestPacing);
   if (prov.responsesPath === undefined && seed.responsesPath !== undefined) prov.responsesPath = seed.responsesPath;
   // Fill mode only when absent: an explicit persisted `direct` must never be overwritten.
   if (prov.codexAccountMode === undefined && seed.codexAccountMode !== undefined) prov.codexAccountMode = seed.codexAccountMode;

package/src/providers/key-failover.ts

@@ -9,6 +9,7 @@
  * Modelled after src/codex/routing.ts cooldown logic but scoped to plain API-key pools.
  */
 import { saveConfigPreservingClaudeCode } from "../config";
+import { isAzureIdentityProvider } from "../config/provider-validation";
 import type { OcxConfig, OcxProviderConfig, RateLimitRetryPolicy } from "../types";
 import { resolveProviderTransport, type OcxProviderTransport } from "./xai-transport";
 import { sweepExpiredOnWrite } from "../lib/state-store-sweeper";
@@ -84,6 +85,7 @@ function isKeyInCooldown(providerName: string, keyId: string, now = Date.now()):
  * Returns true only for key-auth providers with 2+ pool entries.
  */
 export function hasKeyPoolFailover(provider: OcxProviderConfig): boolean {
+  if (isAzureIdentityProvider(provider)) return false;
   if (provider.authMode === "oauth" || provider.authMode === "forward") return false;
   return (provider.apiKeyPool?.length ?? 0) >= 2;
 }
@@ -96,7 +98,7 @@ export function hasKeyPoolFailover(provider: OcxProviderConfig): boolean {
  * callers never re-check fields.
  */
 export function rateLimitRetryPolicyFor(
-  provider: Pick<OcxProviderConfig, "retryOn429" | "authMode">,
+  provider: Pick<OcxProviderConfig, "retryOn429" | "authMode" | "adapter" | "azureCredential">,
 ): Required<RateLimitRetryPolicy> | null {
   const policy = provider.retryOn429;
   if (!policy || policy.enabled === false) return null;
@@ -105,6 +107,7 @@ export function rateLimitRetryPolicyFor(
   // same token, local runtimes have no remote key to preserve, and unknown/custom values are
   // rejected rather than guessed at.
   if (provider.authMode !== undefined && provider.authMode !== "key") return null;
+  if (isAzureIdentityProvider(provider)) return null;
   return {
     enabled: policy.enabled ?? DEFAULT_RATE_LIMIT_RETRY.enabled,
     attempts: policy.attempts ?? DEFAULT_RATE_LIMIT_RETRY.attempts,
@@ -153,6 +156,7 @@ export function rotateKeyOn429(
 ): OcxProviderConfig | null {
   const provider = config.providers[providerName];
   if (!provider) return null;
+  if (isAzureIdentityProvider(provider)) return null;
   if (provider.authMode === "oauth" || provider.authMode === "forward") return null;
 
   const pool = provider.apiKeyPool;

package/src/providers/openai-tiers.ts

@@ -237,6 +237,7 @@ function hasKnownLegacyOpenAiReference(config: OcxConfig): boolean {
     || matchesList(config.subagentModels)
     || (config.subagentRoles ?? []).some(role => matches(role.model))
     || matches(config.injectionModel)
+    || matches(config.v2NativeParentOverride?.model)
     || matches(config.shadowCallIntercept?.model)
     || matches(config.webSearchSidecar?.model)
     || matches(config.visionSidecar?.model)
@@ -260,6 +261,9 @@ function rewriteLegacyOpenAiReferences(config: OcxConfig, warnings: string[]): v
     }
   }
   if (config.injectionModel) config.injectionModel = rewriteLegacyOpenAiSelectedId(config.injectionModel);
+  if (config.v2NativeParentOverride?.model) {
+    config.v2NativeParentOverride.model = rewriteLegacyOpenAiSelectedId(config.v2NativeParentOverride.model);
+  }
   if (config.shadowCallIntercept?.model) {
     config.shadowCallIntercept.model = rewriteLegacyOpenAiSelectedId(config.shadowCallIntercept.model);
   }
@@ -305,6 +309,7 @@ function isKnownLegacyValuePath(path: readonly string[]): boolean {
   if (/^providers\.(openai|openai-multi)\.selectedModels\.\d+$/.test(joined)) return true;
   return new Set([
     "injectionModel",
+    "v2NativeParentOverride.model",
     "shadowCallIntercept.model",
     "webSearchSidecar.model",
     "visionSidecar.model",

package/src/providers/provider-id-rewrite.ts

@@ -82,6 +82,7 @@ export function rewriteProviderReferences(config: OcxConfig, from: string, to: s
 
   const scalarOwners: Array<[Record<string, unknown> | undefined, string]> = [
     [config as unknown as Record<string, unknown>, "injectionModel"],
+    [config.v2NativeParentOverride as Record<string, unknown> | undefined, "model"],
     [config.shadowCallIntercept as Record<string, unknown> | undefined, "model"],
     [config.webSearchSidecar as Record<string, unknown> | undefined, "model"],
     [config.visionSidecar as Record<string, unknown> | undefined, "model"],