@yansigit/opencodex 2.36.1-dev.20260829.48 → 2.36.1

package/src/cli/storage.ts

@@ -0,0 +1,234 @@
+/**
+ * `ocx storage` — the archived-session cleanup, trash, and cleanup-policy surface (wp7).
+ *
+ * Every route here existed with no CLI caller, so reclaiming disk space was dashboard-only.
+ * Three of them delete or move operator data, and the rules for those are deliberate:
+ *
+ * 1. **Default to preview.** `ocx storage cleanup --percent N` runs the preview route and prints
+ *    what WOULD be freed, then exits 0 having mutated nothing.
+ * 2. **`--yes` is required to mutate.** There is no interactive prompt: an agent cannot answer
+ *    one, and a prompt an agent can answer is not a safety boundary.
+ * 3. **`--json` on the preview emits the candidate list**, so an agent can decide from data
+ *    rather than from a sentence.
+ *
+ * This is the opposite of the GitHub star POST, which no flag can authorize: cleanup spends the
+ * operator's DATA, which they can delegate, while starring spends their IDENTITY, which they
+ * cannot delegate to an agent.
+ */
+import {
+  CliUsageError,
+  printData,
+  rejectArgs,
+  runCliAction,
+  runtimeRequest,
+  summaryLines,
+  takeFlag,
+  takeIntegerOption,
+  takeOption,
+  type RuntimeApiDeps,
+} from "./runtime-api";
+
+const USAGE = `Usage:
+  ocx storage report [--json]
+  ocx storage cleanup --percent <0-100> [--mode <quarantine|permanent>] [--yes] [--json]
+  ocx storage trash [list] [--json]
+  ocx storage trash restore <entry-id> [--yes] [--json]
+  ocx storage policy [show] [--json]
+  ocx storage policy set [--enabled <true|false>] [--percent <0-100>]
+      [--mode <quarantine|permanent>] [--schedule <startup|daily|weekly|manual>] [--json]
+  ocx storage policy run [--yes] [--json]
+
+Cleanup and restore MUTATE operator data and require --yes.
+Without --yes, cleanup prints the preview and changes nothing.`;
+
+/** The digest binds a run to the preview it was authorized against. */
+interface CleanupPreview {
+  percent?: number;
+  count?: number;
+  bytes?: number;
+  digest?: string;
+  candidates?: { relPath?: string; bytes?: number }[];
+}
+
+function mib(bytes: number | undefined): string {
+  if (typeof bytes !== "number" || !Number.isFinite(bytes)) return "unknown size";
+  return `${(bytes / 1024 / 1024).toFixed(1)} MiB`;
+}
+
+function previewLines(preview: CleanupPreview): string[] {
+  const lines = [
+    `Would remove ${preview.count ?? 0} archived session file(s), freeing ${mib(preview.bytes)}.`,
+  ];
+  for (const candidate of (preview.candidates ?? []).slice(0, 10)) {
+    lines.push(`  ${candidate.relPath ?? "(unnamed)"}  ${mib(candidate.bytes)}`);
+  }
+  const shown = Math.min((preview.candidates ?? []).length, 10);
+  if ((preview.count ?? 0) > shown) lines.push(`  … and ${(preview.count ?? 0) - shown} more`);
+  lines.push("Nothing was deleted. Re-run with --yes to apply.");
+  return lines;
+}
+
+async function cleanup(argv: string[], deps: RuntimeApiDeps): Promise<void> {
+  const args = [...argv];
+  const wantsJson = takeFlag(args, "--json");
+  const confirmed = takeFlag(args, "--yes");
+  const percent = takeIntegerOption(args, "--percent", { min: 0 });
+  const mode = takeOption(args, "--mode") ?? "quarantine";
+  rejectArgs(args, USAGE);
+
+  if (percent === undefined) throw new CliUsageError("--percent is required", USAGE);
+  if (percent > 100) throw new CliUsageError("--percent must be between 0 and 100", USAGE);
+  if (mode !== "quarantine" && mode !== "permanent") {
+    throw new CliUsageError("--mode must be quarantine or permanent", USAGE);
+  }
+
+  // The preview runs in BOTH paths, and not only to be friendly: the mutating route requires the
+  // digest this call returns and rejects a stale one with 409 `stale_preview`. So the confirmed
+  // path cannot skip it, which conveniently means --yes and no --yes agree on what they mean.
+  const preview = await runtimeRequest<CleanupPreview>("/api/storage/cleanup/preview", {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ percent }),
+  }, deps);
+
+  if (!confirmed) {
+    printData(preview, wantsJson, previewLines(preview));
+    return;
+  }
+
+  if (!preview.digest) {
+    // Refuse rather than send an empty digest: the server would reject it, but a clear local
+    // message beats a 400 that looks like a bug in the verb.
+    throw new CliUsageError("the preview returned no digest, so the cleanup cannot be authorized", USAGE);
+  }
+
+  const result = await runtimeRequest("/api/storage/cleanup", {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ percent, mode, digest: preview.digest }),
+  }, deps);
+  printData(result, wantsJson, summaryLines(result));
+}
+
+async function trash(argv: string[], deps: RuntimeApiDeps): Promise<void> {
+  const action = argv[0] && !argv[0].startsWith("-") ? argv[0] : "list";
+  const rest = argv[0] && !argv[0].startsWith("-") ? argv.slice(1) : argv;
+
+  if (action === "list") {
+    const args = [...rest];
+    const wantsJson = takeFlag(args, "--json");
+    rejectArgs(args, USAGE);
+    const result = await runtimeRequest("/api/storage/trash", {}, deps);
+    printData(result, wantsJson, summaryLines(result));
+    return;
+  }
+
+  if (action !== "restore") throw new CliUsageError(`unknown trash action ${action}`, USAGE);
+
+  const args = [...rest];
+  const wantsJson = takeFlag(args, "--json");
+  const confirmed = takeFlag(args, "--yes");
+  const id = args.shift();
+  rejectArgs(args, USAGE);
+  if (!id) throw new CliUsageError("a trash entry id is required", USAGE);
+
+  // Restore moves files back and reconciles database rows, and can collide with an existing
+  // destination, so it is gated like cleanup rather than treated as a read.
+  if (!confirmed) {
+    throw new CliUsageError(`restoring ${id} modifies stored sessions; pass --yes to confirm`, USAGE);
+  }
+
+  const result = await runtimeRequest("/api/storage/trash/restore", {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ id }),
+  }, deps);
+  printData(result, wantsJson, summaryLines(result));
+}
+
+async function policy(argv: string[], deps: RuntimeApiDeps): Promise<void> {
+  const action = argv[0] && !argv[0].startsWith("-") ? argv[0] : "show";
+  const rest = argv[0] && !argv[0].startsWith("-") ? argv.slice(1) : argv;
+
+  if (action === "show") {
+    const args = [...rest];
+    const wantsJson = takeFlag(args, "--json");
+    rejectArgs(args, USAGE);
+    const result = await runtimeRequest("/api/storage/cleanup-policy", {}, deps);
+    printData(result, wantsJson, summaryLines(result));
+    return;
+  }
+
+  if (action === "set") {
+    const args = [...rest];
+    const wantsJson = takeFlag(args, "--json");
+    const enabled = takeOption(args, "--enabled");
+    const percent = takeIntegerOption(args, "--percent", { min: 0 });
+    const mode = takeOption(args, "--mode");
+    const schedule = takeOption(args, "--schedule");
+    rejectArgs(args, USAGE);
+
+    if (enabled !== undefined && enabled !== "true" && enabled !== "false") {
+      throw new CliUsageError("--enabled must be true or false", USAGE);
+    }
+    const body: Record<string, unknown> = {};
+    if (enabled !== undefined) body.enabled = enabled === "true";
+    if (percent !== undefined) body.percent = percent;
+    if (mode !== undefined) body.mode = mode;
+    if (schedule !== undefined) body.schedule = schedule;
+    if (Object.keys(body).length === 0) {
+      throw new CliUsageError("policy set needs at least one of --enabled, --percent, --mode, --schedule", USAGE);
+    }
+    // Values are NOT re-validated here beyond --enabled's shape. The server owns the mode and
+    // schedule vocabularies and returns a named 400; duplicating them is a second thing to
+    // keep in sync. `enabled` is checked because "--enabled maybe" would otherwise be sent as
+    // `false`, which is a wrong write rather than a rejected one.
+    const result = await runtimeRequest("/api/storage/cleanup-policy", {
+      method: "PUT",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify(body),
+    }, deps);
+    printData(result, wantsJson, summaryLines(result));
+    return;
+  }
+
+  if (action !== "run") throw new CliUsageError(`unknown policy action ${action}`, USAGE);
+
+  const args = [...rest];
+  const wantsJson = takeFlag(args, "--json");
+  const confirmed = takeFlag(args, "--yes");
+  rejectArgs(args, USAGE);
+  // `force: true` server-side: this run ignores the schedule and deletes now.
+  if (!confirmed) {
+    throw new CliUsageError("policy run deletes archived sessions now; pass --yes to confirm", USAGE);
+  }
+  const result = await runtimeRequest("/api/storage/cleanup-policy/run", { method: "POST" }, deps);
+  printData(result, wantsJson, summaryLines(result));
+}
+
+export async function handleStorageCommand(argv: string[], deps: RuntimeApiDeps = {}): Promise<number> {
+  const hasSub = argv[0] !== undefined && !argv[0].startsWith("-");
+  const sub = hasSub ? argv[0]! : "report";
+  const rest = hasSub ? argv.slice(1) : argv;
+  if (sub === "codex-logs") {
+    // Doctor and the Log Guard guides still document `ocx storage codex-logs …`.
+    // This module owns cleanup/trash/policy; log-guard stays on the observe handler.
+    const { handleObserveCommand } = await import("./observe");
+    return handleObserveCommand(["storage", "codex-logs", ...rest], deps);
+  }
+  return runCliAction(async () => {
+    if (sub === "report") {
+      const args = [...rest];
+      const wantsJson = takeFlag(args, "--json");
+      rejectArgs(args, USAGE);
+      const result = await runtimeRequest("/api/storage", {}, deps);
+      printData(result, wantsJson, summaryLines(result));
+    }
+    else if (sub === "cleanup") await cleanup(rest, deps);
+    else if (sub === "trash") await trash(rest, deps);
+    else if (sub === "policy") await policy(rest, deps);
+    else throw new CliUsageError(`unknown storage command ${sub}`, USAGE);
+  });
+}
+
+export const STORAGE_USAGE = USAGE;

package/src/cli/system-command.ts

@@ -17,6 +17,8 @@ const USAGE = `Usage:
   ocx system startup <health|install-service|install-shim> [--json]
   ocx system diagnostics [--json]
   ocx system sync [--json]
+  ocx system codex-app-server [--json]
+  ocx system codex-restart --yes [--json]
   ocx system update check [--channel <latest|preview>] [--json]
   ocx system update run [--channel <latest|preview>] [--restart <on|off>] --yes [--json]
   ocx system update status <job-id> [--json]`;
@@ -104,6 +106,20 @@ export async function handleSystemCommand(argv: string[], deps: RuntimeApiDeps =
     } else if (sub === "sync") {
       const args = [...rest]; const wantsJson = takeFlag(args, "--json"); rejectArgs(args, USAGE);
       printData(await runtimeRequest("/api/sync", { method: "POST" }, deps), wantsJson);
+    } else if (sub === "codex-app-server") {
+      // The GUI reads this state directly (gui/src/codex-app-server-state.ts). Without a verb
+      // an agent could not see whether the Codex app-server was reachable at all.
+      const args = [...rest]; const wantsJson = takeFlag(args, "--json"); rejectArgs(args, USAGE);
+      printData(await runtimeRequest("/api/system/codex-app-server", {}, deps), wantsJson);
+    } else if (sub === "codex-restart") {
+      // --yes required: this restarts the user's running Codex app-server, so it is exactly the
+      // class of action that must not happen because an agent guessed a subcommand.
+      const args = [...rest];
+      const wantsJson = takeFlag(args, "--json");
+      const yes = takeFlag(args, "--yes");
+      if (!yes) throw new CliUsageError("system codex-restart requires --yes", USAGE);
+      rejectArgs(args, USAGE);
+      printData(await runtimeRequest("/api/system/codex-restart", { method: "POST" }, deps), wantsJson, ["Codex app-server restart requested."]);
     } else if (sub === "update") await update(rest, deps);
     else throw new CliUsageError(`unknown system command ${sub}`, USAGE);
   });

package/src/cli/usage-report.ts

@@ -38,10 +38,34 @@ interface UsageReportInput {
   providers?: CostRow[];
   days?: { date: string; requests: number; totalTokens: number; estimatedCostUsd?: number }[];
   filter?: { provider: string | null; model: string | null; matched: boolean; comboOverlap: boolean };
+  /**
+   * Per-account totals the API already returns and the CLI discarded (#2700).
+   *
+   * Withheld by the server -- sent as `[]` -- whenever a provider or model filter is active,
+   * because account rows are not provider-partitioned in a way the projection could honestly
+   * re-derive (summary.ts, reasoned around :865-872). An empty array therefore means two very
+   * different things, and the renderer must say which.
+   */
+  accounts?: {
+    accountLogLabel: string;
+    ambiguous?: boolean;
+    requests: number;
+    totalTokens: number;
+    estimatedCostUsd?: number;
+  }[];
 }
 
 const MAX_MODEL_ROWS = 10;
 
+function terminalText(value: string): string {
+  return value.replace(/[\x00-\x1f\x7f-\x9f]/g, character => {
+    const code = character.charCodeAt(0);
+    return code <= 0x7f
+      ? `\\x${code.toString(16).padStart(2, "0")}`
+      : `\\u${code.toString(16).padStart(4, "0")}`;
+  });
+}
+
 function count(value: number | undefined): string {
   return (value ?? 0).toLocaleString("en-US");
 }
@@ -58,6 +82,8 @@ function usd(value: number | undefined): string {
 
 function table(header: string[], rows: string[][]): string[] {
   if (rows.length === 0) return [];
+  header = header.map(terminalText);
+  rows = rows.map(row => row.map(terminalText));
   const widths = header.map((h, i) => Math.max(h.length, ...rows.map(r => (r[i] ?? "").length)));
   const line = (cols: string[]): string => cols.map((c, i) => (c ?? "").padEnd(widths[i]!)).join("  ").trimEnd();
   return [line(header), ...rows.map(line)];
@@ -68,7 +94,7 @@ function describeScope(data: UsageReportInput): string {
   if (data.surface && data.surface !== "all") parts.push(`surface=${data.surface}`);
   if (data.filter?.provider) parts.push(`provider=${data.filter.provider}`);
   if (data.filter?.model) parts.push(`model=${data.filter.model}`);
-  return parts.join(", ");
+  return terminalText(parts.join(", "));
 }
 
 export function formatUsageReport(data: UsageReportInput): string[] {
@@ -78,7 +104,7 @@ export function formatUsageReport(data: UsageReportInput): string[] {
   if (data.filter && !data.filter.matched) {
     const what = [data.filter.provider && `provider "${data.filter.provider}"`, data.filter.model && `model "${data.filter.model}"`]
       .filter(Boolean).join(" and ");
-    lines.push(`No usage recorded for ${what} in this range.`);
+    lines.push(`No usage recorded for ${terminalText(what)} in this range.`);
     lines.push("Check the spelling against `ocx usage --json`, or widen --range.");
     return lines;
   }
@@ -110,6 +136,30 @@ export function formatUsageReport(data: UsageReportInput): string[] {
     ));
   }
 
+  // Per-account spend (#2700). The two empty cases are distinguished deliberately: printing an
+  // empty table under a filter would repeat the silently-wrong-output defect this unit removes,
+  // because "what did this provider cost me per account" is the most natural way to ask and the
+  // server cannot answer it honestly.
+  const accountFilterActive = Boolean(data.filter?.provider || data.filter?.model);
+  const accounts = (data.accounts ?? []).filter(row => row.requests > 0);
+  if (accountFilterActive) {
+    lines.push("");
+    lines.push("ACCOUNT: not reported under a provider or model filter; run without filters for per-account totals.");
+  } else if (accounts.length > 0) {
+    lines.push("");
+    lines.push(...table(
+      ["ACCOUNT", "REQUESTS", "TOKENS", "EST. COST"],
+      accounts.map(row => [
+        // An ambiguous row aggregates several accounts, so reading it as one account draws the
+        // wrong conclusion. Mark it rather than presenting it as a single identity.
+        row.ambiguous ? `${terminalText(row.accountLogLabel)} (ambiguous)` : terminalText(row.accountLogLabel),
+        count(row.requests),
+        count(row.totalTokens),
+        usd(row.estimatedCostUsd),
+      ]),
+    ));
+  }
+
   const models = (data.models ?? []).filter(row => row.requests > 0);
   if (models.length > 0) {
     lines.push("");

package/src/cli/version-skew.ts

@@ -0,0 +1,46 @@
+/**
+ * CLI-versus-proxy version skew (#2701).
+ *
+ * The reported failure: `ocx` on PATH is an older install than the running proxy, so its
+ * help describes commands the proxy does not have and its output describes a different
+ * build. Nothing surfaced that, because the CLI never compared the two.
+ *
+ * Kept in its own module rather than inside `status.ts` so `doctor` can reuse the exact
+ * comparison instead of reimplementing it -- two diagnostics disagreeing about whether an
+ * install is stale would be worse than neither reporting it.
+ */
+
+/** Placeholder versions that mean "unknown", not "different". */
+const PLACEHOLDERS = new Set(["unknown", "0.0.0"]);
+
+export interface VersionSkew {
+  readonly cliVersion: string;
+  /** Version the live proxy reported, or null when nothing is live or it reported none. */
+  readonly proxyVersion: string | null;
+  readonly skewed: boolean;
+  /** Operator-facing explanation; null when there is nothing to report. */
+  readonly warning: string | null;
+}
+
+/**
+ * Compare the running CLI against the live proxy.
+ *
+ * Suppressed rather than reported when either side is a placeholder. `packageVersion()`
+ * answers `"unknown"` when `package.json` carries no string version, and the server's
+ * `VERSION` falls back to `"0.0.0"` when it cannot resolve its own package -- comparing
+ * against either would report skew that says nothing about the install. A false stale-CLI
+ * warning would send an operator to reinstall a healthy setup.
+ */
+export function computeVersionSkew(cliVersion: string, proxyVersion: string | undefined): VersionSkew {
+  const proxy = proxyVersion ?? null;
+  if (proxy === null || PLACEHOLDERS.has(proxy) || PLACEHOLDERS.has(cliVersion) || proxy === cliVersion) {
+    return { cliVersion, proxyVersion: proxy, skewed: false, warning: null };
+  }
+  return {
+    cliVersion,
+    proxyVersion: proxy,
+    skewed: true,
+    warning: `CLI ${cliVersion} does not match the running proxy ${proxy} — this ocx on PATH is stale. `
+      + "Its help and features describe a different build. Reinstall, or run the proxy's own binary.",
+  };
+}

package/src/codex/account-label.ts

@@ -5,6 +5,27 @@ import { MAIN_CODEX_ACCOUNT_ID } from "./main-account";
 
 export const CODEX_ACCOUNT_LOG_LABEL_RE = /^p[a-f0-9]{6}$/;
 
+/**
+ * Account log labels come in two families (#2699):
+ *
+ * - `p<hex6>` (plus the literal `main`) — a Codex pool account.
+ * - `o<hex6>` — a non-Codex OAuth provider account (xai, cursor, and siblings).
+ *
+ * Both are sha256-derived digests, never an email and never a raw provider account id. That is
+ * a privacy requirement, not a formatting preference: these labels are written to the usage log
+ * and served over the management API.
+ *
+ * hex6 is 16.7M values, so two accounts CAN collide and merge into one reported row. That is a
+ * reporting inaccuracy at operator scale, not a correctness or privacy failure, and it is the
+ * accepted cost of keeping the existing `p` format byte-compatible.
+ */
+export const OAUTH_ACCOUNT_LOG_LABEL_RE = /^o[a-f0-9]{6}$/;
+export const ACCOUNT_LOG_LABEL_RE = /^(?:main|[po][a-f0-9]{6})$/;
+
+export function oauthAccountLogLabel(accountId: string, provider = ""): string {
+  return `o${createHash("sha256").update(`${provider}\0${accountId}`).digest("hex").slice(0, 6)}`;
+}
+
 export function createCodexAccountLogLabel(existingLabels: Iterable<string | undefined | null> = []): string {
   const used = new Set([...existingLabels].filter((value): value is string => !!value));
   for (let i = 0; i < 16; i++) {

package/src/codex/catalog/provider-fetch.ts

@@ -46,6 +46,7 @@ import { routedSlug, slugEquals, slugEquivalenceKey, slugsEquivalent } from "../
 import { CODEX_GPT5_IDENTITY_LINE } from "../../adapters/identity";
 import { filterCursorConfiguredModelsByLiveDiscovery } from "../../adapters/cursor/discovery";
 import { fetchCursorUsableModels } from "../../adapters/cursor/live-models";
+import { recordLiveCursorMaxModeModels } from "../../adapters/cursor/catalog";
 import { isCanonicalOpenAiForwardProvider, OPENAI_API_PROVIDER_ID, OPENAI_CODEX_PROVIDER_ID } from "../../providers/openai-tiers";
 import {
   COMBO_NAMESPACE,
@@ -1330,6 +1331,9 @@ async function fetchProviderModelsWithAuth(
     });
     if (liveResult.ok) {
       const available = filterCursorConfiguredModelsByLiveDiscovery(configured, liveResult.models);
+      // Live Max-Mode evidence feeds the umbrella resolver's ultra gate
+      // (devlog 260828_cursor_umbrella_catalog; union with static evidence).
+      recordLiveCursorMaxModeModels(liveResult.maxModeModels ?? []);
       const result = available.length > 0 ? available : configured;
       // Cache the discovery-filtered roster without combo retention so a later
       // gather can re-apply the current capture's retain set on read.

package/src/codex/transition-state.ts

@@ -280,7 +280,16 @@ export interface CodexCoordinatorAdoptionOptions {
   readonly onCheckpoint?: (checkpoint: CodexCoordinatorAdoptionCheckpoint) => void;
 }
 
-function fsyncPath(path: string): void {
+function fsyncFile(path: string): void {
+  // Writable fd on purpose. Windows FlushFileBuffers needs GENERIC_WRITE;
+  // openSync(path, "r") is GENERIC_READ only and fails with EPERM (measured on
+  // Windows 11 25H2 / bun 1.3.14). prompt-journal.ts uses the same "r+" open.
+  const fd = openSync(path, "r+");
+  try { fsyncSync(fd); } finally { closeSync(fd); }
+}
+
+function fsyncDir(path: string): void {
+  // POSIX directory fsync is O_RDONLY. O_RDWR ("r+") is EISDIR.
   const fd = openSync(path, "r");
   try { fsyncSync(fd); } finally { closeSync(fd); }
 }
@@ -316,12 +325,12 @@ function publishAdoptionDatabase(
     } finally {
       temp.close();
     }
-    fsyncPath(tempPath);
+    fsyncFile(tempPath);
     options.onCheckpoint?.("temp-committed");
 
     linkSync(tempPath, finalDatabasePath);
     options.onCheckpoint?.("published");
-    if (process.platform !== "win32") fsyncPath(parent);
+    if (process.platform !== "win32") fsyncDir(parent);
   } catch (error) {
     if (errorCode(error) !== "EEXIST") throw error;
   } finally {

package/src/compatibility/openai-responses.ts

@@ -9,7 +9,7 @@ const FIXTURE_ID = "openai-codex-forward-gpt56-sol-v1";
 export const OPENAI_CODEX_FORWARD_GPT56_SOL_MANIFEST = defineCompatibilityManifest({
   schemaVersion: 1,
   id: "openai.codex-forward.gpt-5-6-sol.responses",
-  version: "1.2.0",
+  version: "1.3.0",
   subject: {
     providerId: "openai",
     baseUrl: "https://chatgpt.com/backend-api/codex",
@@ -109,5 +109,13 @@ export const OPENAI_CODEX_FORWARD_GPT56_SOL_MANIFEST = defineCompatibilityManife
       limitation: "The field is removed without inventing a replacement prompt_cache_options value.",
       evidence: [{ kind: "fixture", id: FIXTURE_ID, assertionIds: ["prompt-cache-retention-removed"] }],
     },
+    {
+      id: "prompt-cache-options",
+      feature: "request.prompt_cache_options",
+      disposition: "unsupported",
+      summary: "The ChatGPT Codex forward route does not receive public prompt cache options.",
+      limitation: "The field is removed only for the canonical forward destination; public and custom Responses providers keep it.",
+      evidence: [{ kind: "fixture", id: FIXTURE_ID, assertionIds: ["prompt-cache-options-removed"] }],
+    },
   ],
 } as const);