cartethyia 2.7.9 → 2.8.1

package/src/providers/integrations/buddy/{buddy-media.ts → media.ts}

@@ -27,7 +27,7 @@ import { mapUpstreamHttpError } from "../../../transport/failure-policy";
 import type { ImageGenerationOutcome, ProviderDispatchContext, ProviderDispatchTarget, ValidatedOutboundFetch } from "../../provider-contracts";
 import type { CanonicalRequest } from "../../../protocol/canonical-model";
 import { codebuddyHeaders, type CodeBuddyVariant } from "./codebuddy/shared";
-import { applyBuddySystemPrompt, buddyPrePayloadCommon } from "./buddy-chat-shared";
+import { applyBuddySystemPrompt, buddyPrePayloadCommon } from "./chat";
 
 /** Media adapter identity: the variant's headers, its leading system turn, and base URL. */
 export interface BuddyMediaConfig {

package/src/providers/integrations/claude/claude-quota.ts

@@ -102,9 +102,13 @@ export async function fetchClaudeQuota(
   credential: string,
   fetcher: FetchLike,
 ): Promise<ProviderQuotaResult> {
+  // No module-local quota cache: the shared two-tier quota cache owns
+  // cross-call dedup, and a local tier keyed by credential only is never
+  // invalidated by `debitCachedQuota`, so a sweep within its TTL could
+  // resurrect a spent balance over the shared cache. Every call here is a
+  // fresh upstream read; the shared cache's in-flight dedup prevents
+  // duplicate traffic.
   const key = sha256Hex(credential);
-  const cached = quotaCache.get(key);
-  if (cached !== undefined) return cached;
   if (quotaCooldown.get(key) !== undefined) {
     throw new Error("Quota endpoint rejected request: rate limited (cooled down)");
   }
@@ -131,9 +135,7 @@ export async function fetchClaudeQuota(
       },
       observing,
     );
-    const result = parseClaudeQuota(body);
-    quotaCache.set(key, result);
-    return result;
+    return parseClaudeQuota(body);
   } catch (error: unknown) {
     // Hammering the usage endpoint on every call is its own rate-limit
     // risk: back off briefly after a 429 instead of retrying into it.
@@ -143,21 +145,16 @@ export async function fetchClaudeQuota(
 }
 
 /**
- * Bounded per-credential quota cache (5 min) plus a short 429 cooldown
- * (3 min). Keys are credential hashes, never raw secrets; both caches are
+ * Short 429 cooldown (3 min). Keys are credential hashes, never raw secrets;
  * capped so credential fan-out cannot pin memory.
+ *
+ * The cooldown is an absolute window (`until = now + QUOTA_COOLDOWN_MS`), not a
+ * TTL from read time, so it is a sentinel whose own TTL *is* that window: the
+ * entry lives for exactly the cooldown and is gone the moment it closes.
  */
-const QUOTA_CACHE_TTL_MS = 5 * 60_000;
 const QUOTA_COOLDOWN_MS = 3 * 60_000;
-const QUOTA_CACHE_MAX_ENTRIES = 256;
-const quotaCache = new TtlCache<ProviderQuotaResult>({
-  ttlMs: QUOTA_CACHE_TTL_MS,
-  maxEntries: QUOTA_CACHE_MAX_ENTRIES,
-});
-// The cooldown is an absolute window (`until = now + QUOTA_COOLDOWN_MS`), not a
-// TTL from read time, so it is a sentinel whose own TTL *is* that window: the
-// entry lives for exactly the cooldown and is gone the moment it closes.
+const QUOTA_COOLDOWN_MAX_ENTRIES = 256;
 const quotaCooldown = new TtlCache<true>({
   ttlMs: QUOTA_COOLDOWN_MS,
-  maxEntries: QUOTA_CACHE_MAX_ENTRIES,
+  maxEntries: QUOTA_COOLDOWN_MAX_ENTRIES,
 });

package/src/providers/integrations/cline/cline-oauth.ts

@@ -8,6 +8,7 @@ import {
   record,
 } from "../../authentication/oauth-flow-store";
 import type { OAuthDeviceFlowContext, OAuthDevicePollResult, OAuthDeviceStartResult, OAuthExchangeResult } from "../../authentication/oauth-flow-store";
+import { oauthAccountIdentity } from "../../authentication/oauth-flow-store";
 import type { OAuthTokenRefreshResult } from "../../authentication/oauth-refresh-service";
 import { OAuthDeviceFlow } from "../../authentication/oauth-device-flow";
 
@@ -45,14 +46,18 @@ function tokenResult(value: unknown, fallbackRefresh?: string): OAuthExchangeRes
   const refresh =
     nonEmptyTrimmedString(payload.refresh_token) ?? nonEmptyTrimmedString(payload.refreshToken) ?? fallbackRefresh;
   if (!access || !refresh) throw new Error("Cline OAuth response omitted access or refresh token");
+  const identity = oauthAccountIdentity(value);
   const accountLabel =
     nonEmptyTrimmedString(payload.email) ??
     nonEmptyTrimmedString(record(payload.userInfo)?.email) ??
-    nonEmptyTrimmedString(record(payload.user)?.email);
+    nonEmptyTrimmedString(record(payload.user)?.email) ??
+    identity.accountEmail ??
+    identity.accountName;
   return {
     access,
     refresh,
     expiresAt: tokenExpiry(payload),
+    ...identity,
     ...(accountLabel === undefined ? {} : { accountLabel }),
   };
 }
@@ -107,8 +112,8 @@ export class ClineOAuthClient extends OAuthDeviceFlow {
     }
   }
 
-  override async startDeviceAuth(_context?: OAuthDeviceFlowContext): Promise<OAuthDeviceStartResult> {
-    const response = await this.fetchFn(WORKOS_DEVICE_AUTHORIZATION_URL, {
+  override async startDeviceAuth(context?: OAuthDeviceFlowContext): Promise<OAuthDeviceStartResult> {
+    const response = await this.fetchFor(context)(WORKOS_DEVICE_AUTHORIZATION_URL, {
       method: "POST",
       headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" },
       body: new URLSearchParams({ client_id: CLINE_WORKOS_CLIENT_ID }),
@@ -145,7 +150,7 @@ export class ClineOAuthClient extends OAuthDeviceFlow {
       this.#sessions.delete(deviceAuthId);
       return { status: "failed", reason: "Cline device authorization expired" };
     }
-    const response = await this.fetchFn(WORKOS_AUTHENTICATE_URL, {
+    const response = await this.fetchFor(context)(WORKOS_AUTHENTICATE_URL, {
       method: "POST",
       headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" },
       body: new URLSearchParams({
@@ -185,7 +190,7 @@ export class ClineOAuthClient extends OAuthDeviceFlow {
     // exception that escapes the poll.
     let registered: Record<string, unknown>;
     try {
-      const registerResponse = await this.fetchFn(CLINE_REGISTER_URL, {
+      const registerResponse = await this.fetchFor(context)(CLINE_REGISTER_URL, {
         method: "POST",
         headers: { "content-type": "application/json", accept: "application/json" },
         body: JSON.stringify({ accessToken, refreshToken }),

package/src/providers/integrations/cline/cline.ts

@@ -1,14 +1,14 @@
 import { createApiKeyAdapter } from "../../configured-provider";
 import type { ProviderDispatchTarget, ProviderAdapter, ProviderDispatchContext } from "../../provider-contracts";
 import type { ModelDefinition } from "../../provider-model-definition";
-import { unwrapProviderToken } from "../../provider-credential-envelope";
+import { unwrapProviderToken } from "../../provider-credentials";
 import { GatewayError } from "../../../protocol/gateway-error";
 import type { CanonicalRequest } from "../../../protocol/canonical-model";
 import { completeRequiredSchema, isRecord } from "../../../protocol/codecs";
 import { providerBaseUrl } from "../../provider-metadata";
-import { getCachedModelDiscovery } from "../../operations/model-discovery-cache";
+import { getCachedModelDiscovery } from "../../operations/provider-caches";
 import { defineModel } from "../../provider-model-definition";
-import { clineReasoningReplayPrepares } from "../buddy/buddy-chat-shared";
+import { clineReasoningReplayPrepares } from "../buddy/chat";
 import { clinePlatform, clinePlatformVersion } from "../../operations/cli-platform";
 import {
   getClineCliVersion,
@@ -105,7 +105,7 @@ function completeClineToolSchemas(payload: Record<string, unknown>): void {
   });
 }
 
-function clinePrePayload(
+export function clinePrePayload(
   payload: Record<string, unknown>,
   request: CanonicalRequest,
   candidate: ProviderDispatchTarget,
@@ -576,11 +576,10 @@ function clineRow(
  * not a tier marker — membership of the bucket is what makes a row free.
  */
 const CLINE_FREE_ROWS: readonly ClineSeedRow[] = [
-  { id: "reflection/beam-free", ctx: 128_000, out: 32_000 },
   { id: "cline-free/nemotron-3.5-super-vl", ctx: 1_000_000, out: 131_072, vision: true },
   { id: "nvidia/nemotron-3.5-lightning-free", ctx: 1_000_000, out: 65_536 },
-  { id: "poolside/laguna-s-2.1-free", ctx: 262_144, out: 32_768 },
   { id: "cline-free/solar-mini4", ctx: 524_288, out: 131_072 },
+  { id: "baidu/ernie-5.5-flash-preview:free", ctx: 1_000_000, out: 921_600 },
 ];
 
 /**

package/src/providers/integrations/clixad/clixad-oauth.ts

@@ -0,0 +1,98 @@
+// Clixad credential login (GitHub device flow).
+//
+// Clixad's only production login is a GitHub device flow served by the
+// gateway: `POST /v1/auth/device/start` returns a GitHub verification URL +
+// user code; the gateway polls `POST /v1/auth/device/poll` with the session
+// until the operator approves in the browser, then mints the CLI's bearer
+// token (`adg_...`). There is no refresh token — the token is long-lived and
+// the flow is re-run when needed.
+
+import { OAuthClient } from "../../authentication/oauth-client";
+import type {
+  OAuthDeviceStartResult,
+  OAuthDevicePollResult,
+  OAuthDeviceFlowContext,
+} from "../../authentication/oauth-flow-store";
+
+const CLIXAD_HANDOFF_PATH = "/v1/auth/device/start";
+const CLIXAD_POLL_PATH = "/v1/auth/device/poll";
+const CLIXAD_BASE_URL = "https://clixad.onrender.com";
+
+export class ClixadOAuthClient extends OAuthClient {
+  readonly supportsDeviceCode = true;
+  readonly supportsBrowserCode = false;
+  protected readonly providerLabel = "clixad";
+  protected readonly clientId = "";
+  protected readonly tokenUrl = "";
+  protected readonly scopes = "";
+
+  async startDeviceAuth(): Promise<OAuthDeviceStartResult> {
+    const res = await this.fetchFn(new URL(CLIXAD_HANDOFF_PATH, CLIXAD_BASE_URL), {
+      method: "POST",
+      headers: { "content-type": "application/json", accept: "application/json" },
+    });
+    if (!res.ok) {
+      const text = await res.text().catch(() => "");
+      throw new Error(`clixad device flow start failed: HTTP ${res.status} ${text.slice(0, 300)}`);
+    }
+    const body = (await res.json()) as Record<string, unknown>;
+    return {
+      verificationUri: String(body["verification_uri"] ?? ""),
+      userCode: String(body["user_code"] ?? ""),
+      deviceAuthId: String(body["session"] ?? ""),
+      intervalSeconds: Number(body["interval"] ?? 5),
+      expiresInSeconds: Number(body["expires_in"] ?? 900),
+      providerState: JSON.stringify({ session: body["session"] }),
+    };
+  }
+
+  async pollDeviceAuth(deviceAuthId: string, context?: OAuthDeviceFlowContext): Promise<OAuthDevicePollResult> {
+    let providerState: Record<string, unknown> = {};
+    try {
+      providerState = JSON.parse(context?.providerState ?? "{}") as Record<string, unknown>;
+    } catch {
+      /* ignore */
+    }
+    const session = String(providerState["session"] ?? deviceAuthId);
+    const res = await this.fetchFn(new URL(CLIXAD_POLL_PATH, CLIXAD_BASE_URL), {
+      method: "POST",
+      headers: { "content-type": "application/json", accept: "application/json" },
+      body: JSON.stringify({ session }),
+    });
+    const body = (await res.json().catch(() => ({}))) as Record<string, unknown>;
+    const status = String(body["status"] ?? "");
+    if (status === "complete") {
+      const token = String(body["token"] ?? "");
+      return {
+        status: "complete",
+        result: {
+          access: token,
+          // Clixad issues no refresh token — the bearer is long-lived and the
+          // flow is re-run when needed. Mirror the access token so the console
+          // store always has a non-empty refresh field.
+          refresh: token,
+          expiresAt: new Date(Date.now() + 365 * 24 * 60 * 60 * 1000),
+          accountLabel: String(body["email"] ?? body["login"] ?? ""),
+          auth_state: {
+            userId: body["userId"],
+            email: body["email"],
+            login: body["login"],
+            defaultModel: body["default_model"],
+          },
+        },
+      };
+    }
+    if (status === "closed") {
+      return {
+        status: "failed",
+        reason: `signup closed: ${String(body["message"] ?? "")} (${String(body["waitlist_url"] ?? "")})`,
+      };
+    }
+    if (status === "pending") return { status: "pending" };
+    if (status === "unavailable") return { status: "failed", reason: `unavailable: ${String(body["error"] ?? "")}` };
+    return { status: "failed", reason: `device poll failed: ${String(body["error"] ?? body["status"] ?? res.status)}` };
+  }
+}
+
+/** Shared Clixad device-login client instance (registry-facing). */
+export const clixadOAuthClient = new ClixadOAuthClient();

package/src/providers/integrations/clixad/clixad-quota.ts

@@ -0,0 +1,132 @@
+// Clixad quota collector.
+//
+// Reads the account's credit surface from the gateway's wallet endpoint
+// (`GET /v1/wallet` with the stored bearer token). The wallet reports the
+// billed balance, the daily free-tier allowance (`free_tier.daily_credits` /
+// `credits_left` — resets at midnight UTC), turns left per free model, and
+// the ad-reward earnings cap (`max_reward_usd_per_day`). Reads are
+// Bearer-authenticated; never throws — a failed read returns a null result so
+// the router treats it as unknown rather than dead.
+
+import type { FetchLike, ProviderQuotaResult, ProviderQuotaWindow } from "../../quota/quota-contracts";
+import { cleanError, number, percentWindow, text } from "../../quota/quota-contracts";
+import type { QuotaCollectionContext } from "../../quota/quota-support";
+
+async function readWallet(
+  baseUrl: string,
+  token: string,
+  fetcher: FetchLike,
+): Promise<Record<string, unknown> | null> {
+  if (!token) return null;
+  return fetcher(`${baseUrl}/v1/wallet`, {
+    method: "GET",
+    headers: {
+      accept: "application/json",
+      authorization: `Bearer ${token}`,
+    },
+    signal: AbortSignal.timeout(15_000),
+  })
+    .then(async (res) => {
+      if (!res.ok) return null;
+      try {
+        return (await res.json()) as Record<string, unknown>;
+      } catch {
+        return null;
+      }
+    })
+    .catch(() => null);
+}
+
+/** Next midnight UTC, for the free-tier reset window. */
+function nextMidnightUtc(): string {
+  const now = new Date();
+  const next = new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate() + 1));
+  return next.toISOString();
+}
+
+/**
+ * Reads the account quota and returns a normalized result.
+ *
+ * Pooled windows: the billed balance (no ceiling — absolute remaining only)
+ * and the daily free-tier allowance (120k credits/day, resets at midnight
+ * UTC). Independent window: the ad-reward earnings cap ($5/day).
+ */
+export async function fetchClixadQuota(
+  credential: string,
+  fetcher: FetchLike,
+  _context?: QuotaCollectionContext,
+): Promise<ProviderQuotaResult> {
+  try {
+    const token = text(credential) ?? "";
+    const wallet = await readWallet("https://clixad.onrender.com", token, fetcher);
+    if (!wallet) {
+      return { source: "clixad", plan: null, windows: [], error: "Clixad wallet endpoint unavailable" };
+    }
+    const windows: ProviderQuotaWindow[] = [];
+
+    const balance = number(wallet["balance"]);
+    if (balance !== null) {
+      // Billed balance: pooled, absolute remaining, no ceiling (a bonus pack
+      // has no declared limit — it simply is what it is).
+      windows.push({
+        kind: "credits",
+        label: "Account credits",
+        accounting: "pooled",
+        usedPercent: null,
+        remainingPercent: null,
+        resetsAt: null,
+        remaining: Math.max(0, balance),
+        recurring: false,
+      });
+    }
+
+    const freeTier = wallet["free_tier"] as Record<string, unknown> | undefined;
+    const dailyCredits = freeTier === undefined ? null : number(freeTier["daily_credits"]);
+    if (dailyCredits !== null && dailyCredits > 0) {
+      const creditsLeft = freeTier === undefined ? null : number(freeTier["credits_left"]);
+      const used = creditsLeft === null ? null : Math.max(0, dailyCredits - creditsLeft);
+      // Daily free tier: pooled (it is credit the account can spend), ceiling
+      // = the daily allowance, resets at midnight UTC.
+      windows.push(
+        percentWindow(
+          "free_daily",
+          "Daily free tier",
+          used === null ? null : (used / dailyCredits) * 100,
+          nextMidnightUtc(),
+          used,
+          dailyCredits,
+          "pooled",
+        ),
+      );
+    }
+
+    const maxRewardUsd = number(wallet["max_reward_usd_per_day"]);
+    if (maxRewardUsd !== null && maxRewardUsd > 0) {
+      const earnedUsd = number(wallet["earned_usd_today"]) ?? 0;
+      const usedUsd = Math.min(maxRewardUsd, Math.max(0, earnedUsd));
+      // Ad-reward earnings cap: independent (it does not fund model calls
+      // directly — it caps how much *earning* can happen per day).
+      windows.push(
+        percentWindow(
+          "earn_usd_daily",
+          "Daily reward cap",
+          (usedUsd / maxRewardUsd) * 100,
+          nextMidnightUtc(),
+          usedUsd,
+          maxRewardUsd,
+          "independent",
+        ),
+      );
+    }
+
+    const plan = number(wallet["balance"]) !== null ? "metered" : null;
+    return {
+      source: "clixad",
+      plan,
+      windows,
+      error: null,
+    };
+  } catch (error) {
+    return { source: "clixad", plan: null, windows: [], error: cleanError(error) };
+  }
+}

package/src/providers/integrations/clixad/provider.ts

@@ -0,0 +1,145 @@
+// Clixad provider — TypeScript, Clixad gateway, Bun gateway.
+//
+// Clixad is an ad-funded terminal coding agent whose gateway
+// (`https://clixad.onrender.com`) meters model calls and keeps the account
+// balance, free-tier allowance, and ad-reward network server-side. The chat
+// surface is OpenAI-compatible (`/v1/chat/completions`) with a bearer token
+// (`adg_...`) minted by the GitHub device flow at login; model calls report
+// credit accounting in an extra `clixad` envelope.
+//
+// Verified live 2026-11-11 (evidence ledger:
+// `documentation/research/clixad/2026-11-11-clixad-wire.md`):
+//   - GET /v1/models            → 200, 14 rows; the five `free: true` rows are
+//     served on the daily free tier (120k credits/day) and are the ones seeded
+//     below. The remaining rows are billed against the account balance.
+//   - POST /v1/chat/completions → 200 stream for all five free models, with
+//     `clixad.credits_waived` accounting the free-tier draw.
+//   - GET /v1/wallet            → balance + free_tier (daily allowance, turns
+//     left per model), the quota source.
+//
+// The static roster carries the five live-verified free rows so the Free
+// Limited section is populated before any fetch. Live discovery keeps the list
+// current; the roster rows are preserved when the upstream listing reports the
+// same id (the shared reader would otherwise overwrite freeTier/reasoning/tool
+// flags with its conservative defaults).
+
+import type { ApiKeyProviderSpec } from "../../configured-provider";
+import { fetchOpenAICompatibleModels } from "../../discovery/openai-model-discovery";
+import {
+  defineModel,
+  type ModelDefinition,
+} from "../../provider-model-definition";
+
+const CLIXAD_PROVIDER_ID = "clixad" as const;
+
+/** Chat path below the `/v1` base root. */
+const CLIXAD_CHAT_PATH = "/chat/completions";
+
+/**
+ * Clixad adapter spec: plain bearer, OpenAI-compatible chat.
+ *
+ * The model call endpoint accepts standard OpenAI fields and streams normally,
+ * so the generic API-key adapter serves it. No bespoke headers are required
+ * beyond the bearer. (The upstream's gzipped-body fallback is a *client-side*
+ * workaround for an edge WAF; the gateway itself answers plain JSON.)
+ */
+export const CLIXAD_SPEC: ApiKeyProviderSpec = {
+  provider_id: CLIXAD_PROVIDER_ID,
+  endpoint_paths_by_wire_family: { chat: CLIXAD_CHAT_PATH },
+};
+
+/**
+ * Default rows for the Clixad provider (2026-11-11).
+ *
+ * Every row below was verified live on a fresh account: it streams a reply and
+ * draws from the daily free tier (`credits_waived` per call). Context windows
+ * and effort ladders come from the upstream's own `/v1/models` listing; token
+ * prices are the credits-per-1M figures the upstream publishes, kept here as
+ * `cost` for the operator (the tier itself bills zero — `FREE_TIER_COST`).
+ */
+export const CLIXAD_DEFAULT_MODELS: readonly ModelDefinition[] = [
+  defineModel({
+    id: "gpt-5-nano",
+    wireFamily: "chat",
+    endpoint: CLIXAD_CHAT_PATH,
+    ctx: 400_000,
+    out: 60_000,
+    reasoning: true,
+    toolCall: true,
+    free: true,
+    freeTier: true,
+    reasoningEfforts: ["minimal", "low", "medium", "high"]
+  }),
+  defineModel({
+    id: "gemini-2.5-flash-lite",
+    wireFamily: "chat",
+    endpoint: CLIXAD_CHAT_PATH,
+    ctx: 1_048_576,
+    out: 60_000,
+    reasoning: true,
+    toolCall: true,
+    free: true,
+    freeTier: true,
+    reasoningEfforts: ["off", "low", "medium", "high"]
+  }),
+  defineModel({
+    id: "claude-haiku-5.5",
+    wireFamily: "chat",
+    endpoint: CLIXAD_CHAT_PATH,
+    ctx: 24_000,
+    // The gateway publishes no output cap; clamp under the 24k context so a
+    // request can never exceed the endpoint (input + output budget).
+    out: 16_000,
+    reasoning: true,
+    toolCall: true,
+    free: true,
+    freeTier: true,
+    reasoningEfforts: ["off", "low", "medium", "high", "xhigh", "max"]
+  }),
+  defineModel({
+    id: "deepseek-v4-flash",
+    wireFamily: "chat",
+    endpoint: CLIXAD_CHAT_PATH,
+    ctx: 1_048_576,
+    out: 42_000,
+    reasoning: true,
+    toolCall: true,
+    free: true,
+    freeTier: true,
+    reasoningEfforts: ["off", "low", "medium", "high", "xhigh", "max"]
+  }),
+  defineModel({
+    id: "gemini-3.5-flash-lite",
+    wireFamily: "chat",
+    endpoint: CLIXAD_CHAT_PATH,
+    ctx: 1_048_576,
+    out: 375_000,
+    reasoning: true,
+    toolCall: true,
+    free: true,
+    freeTier: true,
+    reasoningEfforts: ["off", "low", "medium", "high", "xhigh", "max"]
+  }),
+];
+
+/**
+ * Live `/v1/models` listing.
+ *
+ * The listing is unauthenticated (verified live). Every fetched row is kept
+ * as the shared reader resolved it, except ids the static roster already knows
+ * — those keep the roster row whole so the freeTier/reasoning/tool flags are
+ * not overwritten by the listing's conservative defaults.
+ */
+export async function discoverClixadModels(options: {
+  readonly baseUrl: string;
+  readonly fetcher?: typeof fetch;
+}): Promise<readonly ModelDefinition[] | null> {
+  const listed = await fetchOpenAICompatibleModels({
+    baseUrl: options.baseUrl,
+    providerId: "clixad",
+    ...(options.fetcher === undefined ? {} : { fetcher: options.fetcher }),
+  });
+  if (listed === null) return null;
+  const known = new Map(CLIXAD_DEFAULT_MODELS.map((model) => [model.modelId, model]));
+  return listed.map((model) => known.get(model.modelId) ?? model);
+}

package/src/providers/integrations/codex/codex-oauth.ts

@@ -3,6 +3,8 @@ import {
   postFormTokenRequest,
   InMemoryOAuthFlowStore,
   OAuthFlowStore,
+  type OAuthCodeExchangeContext,
+  type OAuthDeviceFlowContext,
   type OAuthDevicePollResult,
   type OAuthDeviceStartResult,
   type OAuthExchangeResult,
@@ -200,12 +202,13 @@ export class CodexOAuthClient extends OAuthDeviceFlow {
     codeVerifier: string,
     redirectUri: string,
     _state?: string,
+    _context?: OAuthCodeExchangeContext,
   ): Promise<OAuthExchangeResult> {
     return exchangeCodeForToken(code, codeVerifier, redirectUri, this.fetchFn);
   }
 
-  override async startDeviceAuth(): Promise<OAuthDeviceStartResult> {
-    const started = await startCodexDeviceAuth(CODEX_CLIENT_ID, this.fetchFn);
+  override async startDeviceAuth(context?: OAuthDeviceFlowContext): Promise<OAuthDeviceStartResult> {
+    const started = await startCodexDeviceAuth(CODEX_CLIENT_ID, this.fetchFor(context));
     await this.#requireStore().saveDeviceState(started.deviceAuthId, { ...started });
     return {
       verificationUri: "https://auth.openai.com/codex/device",
@@ -216,7 +219,7 @@ export class CodexOAuthClient extends OAuthDeviceFlow {
     };
   }
 
-  override async pollDeviceAuth(deviceAuthId: string): Promise<OAuthDevicePollResult> {
+  override async pollDeviceAuth(deviceAuthId: string, context?: OAuthDeviceFlowContext): Promise<OAuthDevicePollResult> {
     const store = this.#requireStore();
     const stored = await store.getDeviceState(deviceAuthId);
     const device = stored === undefined ? undefined : parseCodexDeviceStart(stored);
@@ -227,7 +230,7 @@ export class CodexOAuthClient extends OAuthDeviceFlow {
     // never an exception that escapes the dashboard's poll request.
     let authorization;
     try {
-      authorization = await pollCodexDeviceAuth(device, this.fetchFn);
+      authorization = await pollCodexDeviceAuth(device, this.fetchFor(context));
     } catch (error) {
       return { status: "failed", reason: error instanceof Error ? error.message : "Codex device polling failed" };
     }
@@ -238,7 +241,7 @@ export class CodexOAuthClient extends OAuthDeviceFlow {
         authorization.authorizationCode,
         authorization.codeVerifier,
         CODEX_DEVICE_REDIRECT_URI,
-        this.fetchFn,
+        this.fetchFor(context),
       );
     } catch (error) {
       return { status: "failed", reason: error instanceof Error ? error.message : "Codex token exchange failed" };