omnigateway 0.13.7 → 0.14.1

package/bin/omni.js

@@ -6025,12 +6025,43 @@ var spendWindows = object({
   "5h": spendLimit.optional(),
   "1w": spendLimit.optional()
 }).strict();
-var limitConfigSchema = object({
+var limitConfigBaseSchema = object({
   requests: countWindows.optional(),
   tokens: countWindows.optional(),
   spend: spendWindows.optional(),
   concurrency: countLimit.optional()
 }).strict();
+var MAX_MODEL_OVERRIDES = 64;
+var MAX_MODEL_NAME_LENGTH = 256;
+function setsAnyLimit(scope) {
+  if (scope.concurrency !== undefined && scope.concurrency !== null)
+    return true;
+  for (const dimension of ["requests", "tokens", "spend"]) {
+    const windows = scope[dimension];
+    if (windows === undefined)
+      continue;
+    for (const window of WINDOWS) {
+      const limit = windows[window];
+      if (limit !== undefined && limit !== null)
+        return true;
+    }
+  }
+  return false;
+}
+var modelOverrideSchema = limitConfigBaseSchema.refine(setsAnyLimit, {
+  message: "a model override must set at least one limit; omit the model to remove it"
+});
+var limitConfigSchema = limitConfigBaseSchema.extend({
+  models: record(string2().min(1).max(MAX_MODEL_NAME_LENGTH), modelOverrideSchema).refine((models) => Object.keys(models).length <= MAX_MODEL_OVERRIDES, {
+    message: `at most ${MAX_MODEL_OVERRIDES} model overrides per key`
+  }).optional()
+}).strict();
+function modelOverride(limits, model) {
+  const models = limits.models;
+  if (models === undefined || !Object.hasOwn(models, model))
+    return;
+  return models[model];
+}
 function assertNoProto(value, path) {
   if (typeof value !== "object" || value === null)
     return;
@@ -7695,6 +7726,31 @@ var _005_log_filter_indexes_default = `-- An index for the provider filter on \`
 CREATE INDEX idx_request_logs_provider ON request_logs (resolved_provider, at DESC, id DESC);
 `;
 
+// packages/store/src/postgres/migrations/006_model_window_index.sql
+var _006_model_window_index_default = `-- The per-model long-window reads behind a key's model overrides, on this
+-- backend: \`usage.sumSince\`, \`sumBuckets\` and \`oldestSince\` narrowed to one
+-- requested model, read from the log because \`usage_rollup\` has no model
+-- column. The SQLite copy is \`018_model_window_index.sql\`, same shape.
+--
+-- Without it the planner has no prefix to seek and the narrowed sums plan as a
+-- parallel sequential scan of the table. Measured at 500,000 rows in one key's
+-- week, a fifth of them the overridden model and a hundred rows of a rare one:
+--
+--   read                          without index    with index
+--   sumSince 1w, rare model             22.6ms         0.22ms
+--   sumSince 1w, 100k-row model         27.1ms         29.4ms
+--   sumBuckets 1w hour, rare            78.2ms         0.26ms
+--   sumBuckets 1w hour, 100k-row        89.4ms         55.5ms
+--   oldestSince 1w, rare                0.58ms         0.11ms
+--
+-- The heavy-model sum is a bitmap heap scan over that model's rows and does not
+-- beat the sequential scan it replaces: the cost is linear in the model's own
+-- traffic on either plan, and this index removes the part that was linear in
+-- everyone else's. 15MB at 500,000 rows, against 19MB for the key/time index.
+-- Neither partial nor covering, for the reasons the SQLite file records.
+CREATE INDEX idx_request_logs_key_model_at ON request_logs (api_key_id, requested_model, at);
+`;
+
 // packages/store/src/postgres/db.ts
 var num = (v) => Number(v);
 var numOrNull = (v) => v === null ? null : Number(v);
@@ -7704,7 +7760,8 @@ var MIGRATIONS = [
   { id: 2, sql: _002_health_measurements_default },
   { id: 3, sql: _003_key_expiry_default },
   { id: 4, sql: _004_log_keyset_default },
-  { id: 5, sql: _005_log_filter_indexes_default }
+  { id: 5, sql: _005_log_filter_indexes_default },
+  { id: 6, sql: _006_model_window_index_default }
 ];
 async function openPg(url) {
   const sql = new SQL({ url });
@@ -9069,6 +9126,24 @@ var sum = (row) => ({
   tokens: row === undefined ? 0 : num(row.tokens),
   costUsd: row === undefined ? 0 : row.cost_usd
 });
+var NARROWED_SQL = {
+  sumSince: `SELECT COUNT(*) AS requests,
+                  COALESCE(SUM(input_tokens + output_tokens
+                               + cache_read_tokens + cache_write_tokens), 0) AS tokens,
+                  COALESCE(SUM(cost_usd), 0) AS cost_usd
+             FROM request_logs
+            WHERE api_key_id = $1 AND requested_model = $2 AND state = 'done' AND at >= $3`,
+  sumBuckets: `SELECT (at / $1) * $2 AS bucket, COUNT(*) AS requests,
+                  COALESCE(SUM(input_tokens + output_tokens
+                               + cache_read_tokens + cache_write_tokens), 0) AS tokens,
+                  COALESCE(SUM(cost_usd), 0) AS cost_usd
+             FROM request_logs
+            WHERE api_key_id = $3 AND requested_model = $4 AND state = 'done' AND at >= $5
+            GROUP BY 1`,
+  oldestSince: `SELECT MIN(at) AS at
+                 FROM request_logs
+                WHERE api_key_id = $1 AND requested_model = $2 AND state = 'done' AND at >= $3`
+};
 function createUsageRepo(sql, nodeId, dayOffsetMinutes) {
   const complete = async (conn, log) => {
     const written = (await conn.unsafe(COMPLETE, values(log, "done", nodeId))).count;
@@ -9126,7 +9201,15 @@ function createUsageRepo(sql, nodeId, dayOffsetMinutes) {
                 ORDER BY at, id LIMIT $3`, [cursor.at, cursor.id, limit]);
       return rows.map(toLog);
     },
-    async sumSince(apiKeyId, sinceMs) {
+    async sumSince(apiKeyId, sinceMs, requestedModel) {
+      if (requestedModel !== undefined) {
+        const narrowed = await sql.unsafe(NARROWED_SQL.sumSince, [
+          apiKeyId,
+          requestedModel,
+          sinceMs
+        ]);
+        return sum(narrowed[0]);
+      }
       const boundary = hourOf(sinceMs);
       const whole = await sql.unsafe(`SELECT COALESCE(SUM(requests), 0) AS requests,
                 COALESCE(SUM(input_tokens + output_tokens
@@ -9148,7 +9231,18 @@ function createUsageRepo(sql, nodeId, dayOffsetMinutes) {
         costUsd: a.costUsd + b.costUsd
       };
     },
-    async sumBuckets(apiKeyId, sinceMs, grainMs) {
+    async sumBuckets(apiKeyId, sinceMs, grainMs, requestedModel) {
+      if (requestedModel !== undefined) {
+        const from = grainMs === HOUR_MS ? hourOf(sinceMs) * HOUR_MS : sinceMs;
+        const narrowed = await sql.unsafe(NARROWED_SQL.sumBuckets, [
+          grainMs,
+          grainMs,
+          apiKeyId,
+          requestedModel,
+          from
+        ]);
+        return narrowed.map((row) => [num(row.bucket), sum(row)]);
+      }
       const rows = grainMs === HOUR_MS ? await sql.unsafe(`SELECT hour * ${HOUR_MS} AS bucket, requests,
                       input_tokens + output_tokens + cache_read_tokens + cache_write_tokens
                         AS tokens,
@@ -9169,10 +9263,14 @@ function createUsageRepo(sql, nodeId, dayOffsetMinutes) {
     async auditRollup() {
       return auditRollup2(sql);
     },
-    async oldestSince(apiKeyId, sinceMs) {
-      const row = (await sql.unsafe(`SELECT MIN(at) AS at
-             FROM request_logs
-            WHERE api_key_id = $1 AND state = 'done' AND at >= $2`, [apiKeyId, sinceMs]))[0];
+    async oldestSince(apiKeyId, sinceMs, requestedModel) {
+      const row = (requestedModel === undefined ? await sql.unsafe(`SELECT MIN(at) AS at
+                 FROM request_logs
+                WHERE api_key_id = $1 AND state = 'done' AND at >= $2`, [apiKeyId, sinceMs]) : await sql.unsafe(NARROWED_SQL.oldestSince, [
+        apiKeyId,
+        requestedModel,
+        sinceMs
+      ]))[0];
       return row === undefined ? null : numOrNull(row.at);
     },
     async aggregate(q) {
@@ -10454,6 +10552,42 @@ CREATE INDEX idx_request_logs_at
   ON request_logs (at DESC, id DESC, requested_model, resolved_model, error_code);
 `;
 
+// packages/store/src/sqlite/migrations/018_model_window_index.sql
+var _018_model_window_index_default = `-- An index for the per-model long-window reads behind a key's model overrides:
+-- \`usage.sumSince\`, \`sumBuckets\` and \`oldestSince\` narrowed to one requested
+-- model. \`usage_rollup\` has no model column, so those reads come from the log,
+-- and without this they walk \`idx_request_logs_key_at\` across the key's whole
+-- window and reject every other model's row one at a time. \`bun:sqlite\` is
+-- synchronous, so that walk is the event loop \u2014 and the console's key listing
+-- repeats it once per override per window on every fetch.
+--
+-- Key, then model, then time: one seek lands on one key's one model, and the
+-- window is a range from there. Measured at 500,000 rows in one key's week, a
+-- fifth of them the overridden model and a hundred rows of a rare one:
+--
+--   read                          without index    with index
+--   sumSince 1w, rare model             45.9ms         0.03ms
+--   sumSince 1w, 100k-row model         56.1ms         38.1ms
+--   sumBuckets 1w hour, rare            46.1ms         0.07ms
+--   sumBuckets 1w hour, 100k-row        76.8ms         58.9ms
+--   oldestSince 1w, rare                0.57ms         0.00ms
+--
+-- So the read stops costing the key's traffic and starts costing the model's
+-- own, which is still linear: a model that carries most of a key's traffic pays
+-- most of what it did before. That remaining cost is the design's, stated in
+-- \`ARCHITECTURE.md#rate-limiting\`, not something this index claims to remove.
+--
+-- Not partial on \`state = 'done'\`, and not covering, both measured. Partial
+-- bought nothing (37.4ms against 38.1ms) and, once \`ANALYZE\` had run, the
+-- planner moved the key-wide edge read onto it as a skip-scan over every model \u2014
+-- a plan that degrades with the number of models a key calls. Covering the four
+-- token columns and cost cut the heavy case to 9.0ms, for an index nearly three
+-- times as wide written on every completed request, and took the same key-wide
+-- plan. This shape leaves every key-wide read on \`idx_request_logs_key_at\`,
+-- which \`migrations.test.ts\` asserts beside the narrowed plans.
+CREATE INDEX idx_request_logs_key_model_at ON request_logs (api_key_id, requested_model, at);
+`;
+
 // packages/store/src/sqlite/db.ts
 var MIGRATIONS2 = [
   { id: 1, sql: _001_init_default2 },
@@ -10472,7 +10606,8 @@ var MIGRATIONS2 = [
   { id: 14, sql: _014_key_expiry_default },
   { id: 15, sql: _015_log_keyset_default },
   { id: 16, sql: _016_log_filter_indexes_default },
-  { id: 17, sql: _017_log_text_search_default }
+  { id: 17, sql: _017_log_text_search_default },
+  { id: 18, sql: _018_model_window_index_default }
 ];
 function statements(sql) {
   return sql.split(`
@@ -10916,6 +11051,24 @@ var COMPLETE2 = `INSERT INTO request_logs ${COLUMNS2} VALUES ${PLACEHOLDERS2}
     rtk_estimated_tokens_saved = excluded.rtk_estimated_tokens_saved,
     rtk_filters = excluded.rtk_filters
   WHERE request_logs.state = 'pending'`;
+var NARROWED_SQL2 = {
+  sumSince: `SELECT COUNT(*) AS requests,
+                    COALESCE(SUM(input_tokens + output_tokens
+                                 + cache_read_tokens + cache_write_tokens), 0) AS tokens,
+                    COALESCE(SUM(cost_usd), 0) AS cost_usd
+               FROM request_logs
+              WHERE api_key_id = ? AND requested_model = ? AND state = 'done' AND at >= ?`,
+  sumBuckets: `SELECT (at / ?) * ? AS bucket, COUNT(*) AS requests,
+                    COALESCE(SUM(input_tokens + output_tokens
+                                 + cache_read_tokens + cache_write_tokens), 0) AS tokens,
+                    COALESCE(SUM(cost_usd), 0) AS cost_usd
+               FROM request_logs
+              WHERE api_key_id = ? AND requested_model = ? AND state = 'done' AND at >= ?
+              GROUP BY bucket`,
+  oldestSince: `SELECT MIN(at) AS at
+                   FROM request_logs
+                  WHERE api_key_id = ? AND requested_model = ? AND state = 'done' AND at >= ?`
+};
 function createUsageRepo2(db, nodeId, dayOffsetMinutes = hostDayOffsetMinutes()) {
   const complete = db.transaction((log) => {
     if (db.run(COMPLETE2, values2(log, "done", nodeId)).changes === 0)
@@ -10988,7 +11141,15 @@ function createUsageRepo2(db, nodeId, dayOffsetMinutes = hostDayOffsetMinutes())
                   ORDER BY at, id LIMIT ?`).all(cursor.at, cursor.at, cursor.id, limit);
       return rows.map(toLog2);
     },
-    async sumSince(apiKeyId, sinceMs) {
+    async sumSince(apiKeyId, sinceMs, requestedModel) {
+      if (requestedModel !== undefined) {
+        const row = db.query(NARROWED_SQL2.sumSince).get(apiKeyId, requestedModel, sinceMs);
+        return {
+          requests: row?.requests ?? 0,
+          tokens: row?.tokens ?? 0,
+          costUsd: row?.cost_usd ?? 0
+        };
+      }
       const boundary = hourOf(sinceMs);
       const whole = db.query(`SELECT COALESCE(SUM(requests), 0) AS requests,
                   COALESCE(SUM(input_tokens + output_tokens
@@ -11008,7 +11169,15 @@ function createUsageRepo2(db, nodeId, dayOffsetMinutes = hostDayOffsetMinutes())
         costUsd: (whole?.cost_usd ?? 0) + (edge?.cost_usd ?? 0)
       };
     },
-    async sumBuckets(apiKeyId, sinceMs, grainMs) {
+    async sumBuckets(apiKeyId, sinceMs, grainMs, requestedModel) {
+      if (requestedModel !== undefined) {
+        const from = grainMs === HOUR_MS ? hourOf(sinceMs) * HOUR_MS : sinceMs;
+        const narrowed = db.query(NARROWED_SQL2.sumBuckets).all(grainMs, grainMs, apiKeyId, requestedModel, from);
+        return narrowed.map((row) => [
+          row.bucket,
+          { requests: row.requests, tokens: row.tokens, costUsd: row.cost_usd }
+        ]);
+      }
       const rows = grainMs === HOUR_MS ? db.query(`SELECT hour * ${HOUR_MS} AS bucket, requests,
                         input_tokens + output_tokens + cache_read_tokens + cache_write_tokens
                           AS tokens,
@@ -11032,10 +11201,10 @@ function createUsageRepo2(db, nodeId, dayOffsetMinutes = hostDayOffsetMinutes())
     async auditRollup() {
       return auditRollup(db);
     },
-    async oldestSince(apiKeyId, sinceMs) {
-      const row = db.query(`SELECT MIN(at) AS at
-             FROM request_logs
-            WHERE api_key_id = ? AND state = 'done' AND at >= ?`).get(apiKeyId, sinceMs);
+    async oldestSince(apiKeyId, sinceMs, requestedModel) {
+      const row = requestedModel === undefined ? db.query(`SELECT MIN(at) AS at
+                   FROM request_logs
+                  WHERE api_key_id = ? AND state = 'done' AND at >= ?`).get(apiKeyId, sinceMs) : db.query(NARROWED_SQL2.oldestSince).get(apiKeyId, requestedModel, sinceMs);
       return row?.at ?? null;
     },
     async aggregate(q) {
@@ -11176,9 +11345,9 @@ async function createStore(opts) {
       lastUsedByCredential: (credentialId) => handle.usage.lastUsedByCredential(credentialId),
       scan: (cursor, limit) => handle.usage.scan(cursor, limit),
       aggregate: (q) => handle.usage.aggregate(q),
-      sumSince: (apiKeyId, sinceMs) => handle.usage.sumSince(apiKeyId, sinceMs),
-      sumBuckets: (apiKeyId, sinceMs, grainMs) => handle.usage.sumBuckets(apiKeyId, sinceMs, grainMs),
-      oldestSince: (apiKeyId, sinceMs) => handle.usage.oldestSince(apiKeyId, sinceMs),
+      sumSince: (apiKeyId, sinceMs, requestedModel) => handle.usage.sumSince(apiKeyId, sinceMs, requestedModel),
+      sumBuckets: (apiKeyId, sinceMs, grainMs, requestedModel) => handle.usage.sumBuckets(apiKeyId, sinceMs, grainMs, requestedModel),
+      oldestSince: (apiKeyId, sinceMs, requestedModel) => handle.usage.oldestSince(apiKeyId, sinceMs, requestedModel),
       rebuildRollup: () => handle.usage.rebuildRollup(),
       auditRollup: () => handle.usage.auditRollup(),
       prune: (olderThan) => handle.usage.prune(olderThan),
@@ -12289,6 +12458,22 @@ function codecFailure(id, hook, what) {
     gatewayAuthored: true
   });
 }
+function framingAgrees(headers, body, bodyEncoding) {
+  const named = (name) => headers.filter(([n]) => n.toLowerCase() === name);
+  const lengths = named("content-length");
+  const encodings = named("content-encoding");
+  if (bodyEncoding !== undefined) {
+    return lengths.length === 0 && encodings.length === 1 && encodings[0]?.[1].trim().toLowerCase() === bodyEncoding;
+  }
+  if (lengths.length > 1 || encodings.length > 1)
+    return false;
+  const length = lengths[0]?.[1];
+  const bytes = new TextEncoder().encode(body).byteLength;
+  if (length !== undefined && length !== String(bytes))
+    return false;
+  const encoding = encodings[0]?.[1];
+  return encoding === undefined || encoding.trim().toLowerCase() === "identity";
+}
 function boundedDegradations(entries) {
   if (!Array.isArray(entries))
     return [];
@@ -12345,23 +12530,26 @@ function codecAdapter(id, capabilities, codec, origins) {
         fail,
         ...req.requestId === undefined ? {} : { requestId: req.requestId },
         ...req.autoCache === undefined ? {} : { autoCacheEnabled: req.autoCache },
-        ...req.maxOutputTokens === undefined ? {} : { maxOutputTokens: req.maxOutputTokens }
+        ...req.maxOutputTokens === undefined ? {} : { maxOutputTokens: req.maxOutputTokens },
+        ...req.requestStartedAt === undefined ? {} : { requestStartedAt: req.requestStartedAt }
       }));
       const described = built?.request ?? {};
       const request = {
         url: described.url,
         method: described.method,
         headers: Array.isArray(described.headers) ? [...described.headers] : described.headers,
-        body: described.body
+        body: described.body,
+        bodyEncoding: described.bodyEncoding
       };
-      if (typeof request.body !== "string" || !isSendableUrl(request.url) || !isHttpMethod(request.method) || !Array.isArray(request.headers) || !request.headers.every((pair) => Array.isArray(pair) && pair.length === 2 && typeof pair[0] === "string" && typeof pair[1] === "string")) {
+      if (typeof request.body !== "string" || request.bodyEncoding !== undefined && request.bodyEncoding !== "zstd" || !isSendableUrl(request.url) || !isHttpMethod(request.method) || !Array.isArray(request.headers) || !request.headers.every((pair) => Array.isArray(pair) && pair.length === 2 && typeof pair[0] === "string" && typeof pair[1] === "string") || !framingAgrees(request.headers, request.body, request.bodyEncoding)) {
         throw codecFailure(id, "buildRequest", "did not return a usable request");
       }
       const sendable = {
         url: request.url,
         method: request.method,
         headers: request.headers,
-        body: request.body
+        body: request.body,
+        ...request.bodyEncoding === "zstd" ? { bodyEncoding: request.bodyEncoding } : {}
       };
       if (origins !== undefined && !withinOrigins(request.url, origins)) {
         throw codecFailure(id, "buildRequest", "described a request to an origin its manifest does not declare");
@@ -12719,53 +12907,61 @@ var museBodyOrder = [
 ];
 
 // packages/providers/src/openai/profile.ts
-var OPENAI_CLI_VERSION = env("OMNI_OPENAI_CLI_VERSION", "0.159.2");
+var OPENAI_CLI_VERSION = env("OMNI_OPENAI_CLI_VERSION", "0.163.0");
 var OPENAI_UA_PLATFORM = env("OMNI_OPENAI_UA_PLATFORM", "Windows 10.0.26200");
 var OPENAI_UA_ARCH = env("OMNI_OPENAI_UA_ARCH", "x86_64");
 var OPENAI_UA_TERMINAL = env("OMNI_OPENAI_UA_TERMINAL", "WindowsTerminal");
-var originator = env("OMNI_OPENAI_ORIGINATOR", "codex_cli_rs");
+var OPENAI_ORIGINATOR = env("OMNI_OPENAI_ORIGINATOR", "codex-tui");
+var OPENAI_SANDBOX = OPENAI_UA_PLATFORM.startsWith("Windows") ? "windows_elevated" : /^(Mac OS|macOS)/.test(OPENAI_UA_PLATFORM) ? "seatbelt" : "seccomp";
 var openaiProfile = {
   headers: [
     [
       "user-agent",
-      env("OMNI_UA_OPENAI", `${originator}/${OPENAI_CLI_VERSION} (${OPENAI_UA_PLATFORM}; ${OPENAI_UA_ARCH}) ${OPENAI_UA_TERMINAL}`)
+      env("OMNI_UA_OPENAI", `${OPENAI_ORIGINATOR}/${OPENAI_CLI_VERSION} (${OPENAI_UA_PLATFORM}; ${OPENAI_UA_ARCH}) ` + `${OPENAI_UA_TERMINAL} (${OPENAI_ORIGINATOR}; ${OPENAI_CLI_VERSION})`)
     ],
-    ["originator", originator],
+    ["originator", OPENAI_ORIGINATOR],
     ["version", OPENAI_CLI_VERSION],
     ["x-codex-beta-features", "remote_compaction_v2"],
     ["accept", "text/event-stream"]
   ],
   order: envOrder("OMNI_ORDER_OPENAI", [
-    "host",
     "version",
     "x-codex-beta-features",
-    "originator",
+    "x-codex-window-id",
+    "x-codex-turn-metadata",
+    "x-openai-internal-codex-responses-lite",
+    "x-codex-routing-hint",
     "x-client-request-id",
     "session-id",
     "thread-id",
     "accept",
+    "content-encoding",
     "content-type",
     "authorization",
     "chatgpt-account-id",
+    "originator",
     "user-agent",
-    "accept-encoding",
+    "host",
     "content-length"
   ])
 };
 var openaiBodyOrder = [
   "model",
   "stream",
+  "service_tier",
   "input",
   "instructions",
-  "store",
-  "reasoning",
-  "prompt_cache_key",
   "tools",
   "tool_choice",
+  "parallel_tool_calls",
+  "reasoning",
+  "store",
+  "stream_options",
   "include",
-  "service_tier",
+  "prompt_cache_key",
+  "text",
   "client_metadata",
-  "parallel_tool_calls",
+  "access_programs",
   "metadata"
 ];
 
@@ -16561,6 +16757,81 @@ function parseMuseUsage(value, now) {
   ]);
 }
 
+// packages/providers/src/openai/codexIdentity.ts
+import { createHash as createHash3, createHmac } from "crypto";
+var NAMESPACE_OID = "6ba7b812-9dad-11d1-80b4-00c04fd430c8";
+var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var WINDOW_END_MS = Date.UTC(2026, 9, 1);
+var WINDOW_MS2 = 365 * 24 * 60 * 60 * 1000;
+function isUuid(value) {
+  return UUID.test(value);
+}
+function format(bytes) {
+  const hex = Buffer.from(bytes).toString("hex");
+  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20, 32)}`;
+}
+function withVersion(bytes, version) {
+  const out = Uint8Array.from(bytes.subarray(0, 16));
+  out[6] = (out[6] ?? 0) & 15 | version << 4;
+  out[8] = (out[8] ?? 0) & 63 | 128;
+  return out;
+}
+var sha256 = (seed) => createHash3("sha256").update(seed).digest();
+function uuidV5(namespace, name) {
+  const digest = createHash3("sha1").update(Buffer.from(namespace.replace(/-/g, ""), "hex")).update(name, "utf8").digest();
+  return format(withVersion(digest, 5));
+}
+function uuidV4From(seed) {
+  return format(withVersion(sha256(seed), 4));
+}
+function uuidV7From(seed, timestampMs) {
+  const bytes = Uint8Array.from(sha256(seed).subarray(0, 16));
+  let ts = Math.max(0, Math.floor(timestampMs));
+  for (let i = 5;i >= 0; i--) {
+    bytes[i] = ts % 256;
+    ts = Math.floor(ts / 256);
+  }
+  return format(withVersion(bytes, 7));
+}
+function threadIdFrom(seed) {
+  const digest = sha256(`thread:${seed}`);
+  const offset = digest.readUIntBE(0, 6) % WINDOW_MS2;
+  return uuidV7From(seed, WINDOW_END_MS - WINDOW_MS2 + offset);
+}
+function threadInstant(threadId, now) {
+  const hex = threadId.replace(/-/g, "");
+  const version = hex[12];
+  const ts = Number.parseInt(hex.slice(0, 12), 16);
+  if (version === "7" && Number.isFinite(ts) && ts <= now)
+    return ts;
+  const digest = sha256(`thread:${threadId}`);
+  return WINDOW_END_MS - WINDOW_MS2 + digest.readUIntBE(0, 6) % WINDOW_MS2;
+}
+var ID_SALT = /^[0-9a-f]{64}$/;
+function codexSecretsFrom(providerData) {
+  const { installationId, idSalt } = providerData;
+  return {
+    ...typeof installationId === "string" && isUuid(installationId) ? { installationId } : {},
+    ...typeof idSalt === "string" && ID_SALT.test(idSalt) ? { idSalt } : {}
+  };
+}
+function ensureCodexSecrets(providerData) {
+  const stored = codexSecretsFrom(providerData);
+  const salt = () => Buffer.from(globalThis.crypto.getRandomValues(new Uint8Array(32))).toString("hex");
+  return {
+    installationId: stored.installationId ?? globalThis.crypto.randomUUID(),
+    idSalt: stored.idSalt ?? salt()
+  };
+}
+function keyed(salt, seed) {
+  if (salt === undefined)
+    return seed;
+  return createHmac("sha256", salt).update(seed).digest("hex");
+}
+function prefixNamespace(threadId) {
+  return uuidV5(NAMESPACE_OID, threadId);
+}
+
 // packages/providers/src/openai/oauth.ts
 var CLIENT_ID6 = "app_EMoamEEZ73f0CkXaXp7hrann";
 var AUTHORIZE_URL3 = "https://auth.openai.com/oauth/authorize";
@@ -16621,7 +16892,7 @@ async function* postToken4(body, fail) {
   }
   return token;
 }
-function toResult6(token, fallbackRefresh, now, fallbackAccountId = null) {
+function toResult6(token, fallbackRefresh, now, fallbackAccountId, prior) {
   const claims = decodeClaims(token.idToken);
   return {
     secrets: {
@@ -16632,7 +16903,10 @@ function toResult6(token, fallbackRefresh, now, fallbackAccountId = null) {
     },
     expiresAt: token.expiresIn === null ? null : now() + token.expiresIn * 1000,
     accountEmail: claims.email,
-    providerData: { accountId: claims.accountId ?? fallbackAccountId }
+    providerData: {
+      accountId: claims.accountId ?? fallbackAccountId,
+      ...ensureCodexSecrets(prior)
+    }
   };
 }
 function windowSecondsOf(value) {
@@ -16689,11 +16963,11 @@ var openaiOAuthFlow = {
     url.searchParams.set("id_token_add_organizations", "true");
     url.searchParams.set("codex_cli_simplified_flow", "true");
     url.searchParams.set("state", state);
-    url.searchParams.set("originator", "codex_cli_rs");
+    url.searchParams.set("originator", OPENAI_ORIGINATOR);
     url.searchParams.set("prompt", "login");
     return { authorizeUrl: url.toString(), pending: { verifier, challenge, state, redirectUri } };
   },
-  async* exchange({ code, pending, fail, now }) {
+  async* exchange({ code, pending, providerData, fail, now }) {
     const [rawCode, pastedState] = code.split("#");
     if (pastedState !== undefined && pastedState !== pending.state) {
       throw fail("AUTH", "authorization state mismatch");
@@ -16704,11 +16978,11 @@ var openaiOAuthFlow = {
       redirect_uri: pending.redirectUri,
       code_verifier: pending.verifier
     }, fail);
-    return toResult6(token, null, now);
+    return toResult6(token, null, now, null, providerData ?? {});
   },
   async* refresh({ refreshToken, providerData, fail, now }) {
     const token = yield* postToken4({ grant_type: "refresh_token", refresh_token: refreshToken, scope: SCOPES4 }, fail);
-    return toResult6(token, refreshToken, now, accountIdFromProviderData(providerData));
+    return toResult6(token, refreshToken, now, accountIdFromProviderData(providerData), providerData);
   },
   async* usage({ secrets, providerData, now }) {
     if (secrets.accessToken === null)
@@ -17458,7 +17732,7 @@ var customCodec = {
 // packages/providers/src/custom/index.ts
 var customAdapter = codecAdapter("custom", customDescriptor.capabilities, customCodec);
 // packages/providers/src/grok/codec.ts
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash5 } from "crypto";
 
 // packages/providers/src/grok/decode.ts
 var ERROR_CODE2 = {
@@ -17657,7 +17931,7 @@ async function* decodeGrokResponses(messages) {
 }
 
 // packages/providers/src/grok/wire.ts
-import { createHash as createHash3 } from "crypto";
+import { createHash as createHash4 } from "crypto";
 var MAX_TOOLS = 200;
 function encodeToolChoice3(c) {
   switch (c.type) {
@@ -17673,7 +17947,7 @@ function encodeToolChoice3(c) {
 }
 function promptCacheKey(instructions, firstInput) {
   const stable = JSON.stringify({ instructions, firstInput });
-  return createHash3("sha256").update(stable).digest("hex").slice(0, 32);
+  return createHash4("sha256").update(stable).digest("hex").slice(0, 32);
 }
 function toGrokWire(req, model) {
   const degradations = [];
@@ -17813,7 +18087,7 @@ var PROXY_URL = "https://cli-chat-proxy.grok.com/v1/responses";
 var API_URL = "https://api.x.ai/v1/responses";
 var CONV_NAMESPACE = "omni-grok-conv";
 function derivedUuid(value) {
-  const h = createHash4("sha256").update(`${CONV_NAMESPACE}:${value}`).digest("hex");
+  const h = createHash5("sha256").update(`${CONV_NAMESPACE}:${value}`).digest("hex");
   const variant = (Number.parseInt(h[16], 16) & 3 | 8).toString(16);
   return [
     h.slice(0, 8),
@@ -17873,11 +18147,12 @@ var grokAdapter = codecAdapter("grok", grokDescriptor.capabilities, grokCodec);
 import { request as httpRequest } from "http";
 import { request as httpsRequest } from "https";
 import { Readable } from "stream";
+import * as zlib from "zlib";
 var CONNECT_ATTEMPT_TIMEOUT_MS = 3000;
 function nodeHttpClient(options = {}) {
   const logger = options.logger ?? noopLogger;
   const now = options.now ?? (() => Date.now());
-  return (req) => new Promise((resolve, reject) => {
+  return (req) => encodeBody(req).then((bodyBytes) => new Promise((resolve, reject) => {
     const url = new URL(req.url);
     const startedAt = now();
     let traced = false;
@@ -17908,7 +18183,6 @@ function nodeHttpClient(options = {}) {
       });
     };
     const send = url.protocol === "https:" ? httpsRequest : httpRequest;
-    const bodyBytes = Buffer.from(req.body, "utf8");
     const headers = {};
     for (const [name, value] of req.headers)
       headers[name] = value;
@@ -17966,6 +18240,22 @@ function nodeHttpClient(options = {}) {
     if (bodyBytes.byteLength > 0)
       outgoing.write(bodyBytes);
     outgoing.end();
+  }));
+}
+function encodeBody(req) {
+  const raw = Buffer.from(req.body, "utf8");
+  if (req.bodyEncoding !== "zstd")
+    return Promise.resolve(raw);
+  return zstdEncode(raw);
+}
+function zstdEncode(raw, create = (options) => zlib.createZstdCompress(options)) {
+  return new Promise((resolve, reject) => {
+    const stream = create({ params: { [zlib.constants.ZSTD_c_compressionLevel]: 3 } });
+    const chunks = [];
+    stream.on("data", (chunk) => chunks.push(chunk));
+    stream.on("end", () => resolve(Buffer.concat(chunks)));
+    stream.on("error", reject);
+    stream.end(raw);
   });
 }
 function hasHeader(req, lowerName) {
@@ -18808,7 +19098,7 @@ async function* decodeMuseResponses(messages, options = {}) {
 }
 
 // packages/providers/src/muse/wire.ts
-import { createHash as createHash5 } from "crypto";
+import { createHash as createHash6 } from "crypto";
 function suppliedKey(req) {
   const vendor = req.vendor?.openai;
   for (const name of ["prompt_cache_key", "session_id"]) {
@@ -18820,7 +19110,7 @@ function suppliedKey(req) {
 }
 function cacheKey(req, instructions, firstInput) {
   const stable = req.conversationId !== undefined && req.conversationId.length > 0 ? JSON.stringify({ conversation: req.conversationId }) : JSON.stringify({ instructions, firstInput: firstInput ?? null });
-  return createHash5("sha256").update(stable).digest("hex").slice(0, 32);
+  return createHash6("sha256").update(stable).digest("hex").slice(0, 32);
 }
 function repairOrphanedCalls(input) {
   const answered = new Set;
@@ -19020,6 +19310,49 @@ var museCodec = {
 
 // packages/providers/src/muse/index.ts
 var museAdapter = codecAdapter("muse", museDescriptor.capabilities, museCodec);
+// packages/providers/src/openai/codexCatalog.ts
+var CODEX_EFFORTS = new Set([
+  "none",
+  "minimal",
+  "low",
+  "medium",
+  "high",
+  "xhigh",
+  "max",
+  "ultra",
+  "persistent"
+]);
+function isCodexEffort(value) {
+  return typeof value === "string" && CODEX_EFFORTS.has(value);
+}
+var entry = (defaultEffort, nodeReplAutoReviewRequired, over = {}) => ({
+  lite: true,
+  verbosity: "low",
+  defaultEffort,
+  lowestEffort: "low",
+  nodeReplAutoReviewRequired,
+  nodeReplDisabled: false,
+  supportsParallelToolCalls: true,
+  ...over
+});
+var UNLISTED = entry("low", false);
+var MODELS = Object.assign(Object.create(null), {
+  "gpt-6-astra": entry("low", true),
+  "gpt-6.1-sol": entry("low", true),
+  "gpt-6-sol": entry("medium", true),
+  "gpt-6-luna": entry("medium", false),
+  "gpt-5.6-sol": entry("low", false),
+  "gpt-5.6-terra": entry("medium", false),
+  "gpt-5.6-luna": entry("medium", false),
+  "gpt-daybreak-blue-latest": entry("low", false),
+  "gpt-daybreak-red-latest": entry("medium", false, { verbosity: "high" }),
+  "gpt-5.5": entry("medium", false, { lite: false }),
+  "codex-auto-review": entry("medium", false)
+});
+function codexModel(model) {
+  return MODELS[model] ?? UNLISTED;
+}
+
 // packages/providers/src/openai/decode.ts
 var ERROR_CODE4 = {
   rate_limit_exceeded: "RATE_LIMIT",
@@ -19237,8 +19570,170 @@ async function* decodeResponses(messages, options = {}) {
   }
 }
 
+// packages/providers/src/openai/codexLite.ts
+var PASSTHROUGH = "internal_chat_message_metadata_passthrough";
+function turnId(threadId, index, threadAt, salt) {
+  return uuidV7From(keyed(salt, `${threadId}:turn:${index}`), threadAt + index);
+}
+function contentKinds(content, role) {
+  if (!Array.isArray(content))
+    return;
+  if (role === "assistant")
+    return content.map(() => "unknown");
+  const kinds = [];
+  for (const part of content) {
+    const type = part.type;
+    if (type === "input_text")
+      kinds.push("user.text");
+    else if (type === "input_image")
+      kinds.push("user.image");
+    else
+      return;
+  }
+  return kinds;
+}
+function toLiteInput(args) {
+  const { threadId } = args;
+  const threadAt = threadInstant(threadId, args.startedAt ?? Number.POSITIVE_INFINITY);
+  const startedAt = args.startedAt ?? threadAt;
+  const historySeed = args.requestId ?? threadId;
+  const salt = args.idSalt;
+  const namespace = prefixNamespace(threadId);
+  const prefix = [];
+  if (args.tools !== undefined && args.tools.length > 0) {
+    const tools = [{ type: "namespace", name: "functions", description: "", tools: args.tools }];
+    prefix.push({
+      type: "additional_tools",
+      id: `at_${uuidV5(namespace, JSON.stringify(tools))}`,
+      role: "developer",
+      tools
+    });
+  }
+  if (args.instructions !== undefined && args.instructions.length > 0) {
+    prefix.push({
+      type: "message",
+      id: `msg_${uuidV5(namespace, args.instructions)}`,
+      role: "developer",
+      content: [{ type: "input_text", text: args.instructions }],
+      [PASSTHROUGH]: { content_item_kinds: ["model.base_instructions"] }
+    });
+  }
+  let turn = 0;
+  const history = args.input.map((raw, index) => {
+    const item = raw;
+    turn = args.turnOf.get(item) ?? turn;
+    const turn_id = turnId(threadId, turn, threadAt, salt);
+    const fresh = (prefixName) => `${prefixName}_${uuidV7From(keyed(salt, `${historySeed}:item:${index}`), startedAt)}`;
+    const create_time = (startedAt * 1000 + index) / 1e6;
+    switch (item.type) {
+      case "message": {
+        const role = String(item.role);
+        const kinds = contentKinds(item.content, role);
+        if (role === "assistant") {
+          return {
+            type: "message",
+            status: "completed",
+            id: fresh("msg"),
+            role,
+            content: Array.isArray(item.content) ? item.content.map((part) => part.type === "output_text" ? { ...part, annotations: [] } : part) : item.content,
+            [PASSTHROUGH]: {
+              turn_id,
+              ...kinds === undefined ? {} : { content_item_kinds: kinds }
+            }
+          };
+        }
+        return {
+          type: "message",
+          id: fresh("msg"),
+          role,
+          content: item.content,
+          [PASSTHROUGH]: {
+            turn_id,
+            create_time,
+            ...kinds === undefined ? {} : { content_item_kinds: kinds }
+          }
+        };
+      }
+      case "function_call":
+        return {
+          type: "function_call",
+          status: "completed",
+          id: fresh("fc"),
+          name: item.name,
+          arguments: item.arguments,
+          call_id: item.call_id,
+          [PASSTHROUGH]: { turn_id }
+        };
+      case "function_call_output":
+        return {
+          type: "function_call_output",
+          id: fresh("fco"),
+          call_id: item.call_id,
+          output: item.output,
+          [PASSTHROUGH]: { turn_id, create_time }
+        };
+      case "reasoning": {
+        const { [PASSTHROUGH]: _client, ...rest } = item;
+        return { ...rest, [PASSTHROUGH]: { turn_id } };
+      }
+      default:
+        return item;
+    }
+  });
+  return {
+    input: [...prefix, ...history],
+    turnId: turnId(threadId, turn, threadAt, salt),
+    startedAt
+  };
+}
+function asciiJson(value) {
+  return JSON.stringify(value).replace(/[^\x20-\x7e]/g, (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, "0")}`);
+}
+function codexTurn(args) {
+  const { threadId, turnId: turn } = args;
+  const windowId = `${threadId}:0`;
+  const installationId = args.installationId ?? uuidV4From(`installation:${args.installationSeed}`);
+  const threadAt = threadInstant(threadId, args.startedAt);
+  const catalog = codexModel(args.model);
+  const turnMetadata = asciiJson({
+    installation_id: installationId,
+    session_id: threadId,
+    thread_id: threadId,
+    agent_name: "/root",
+    turn_id: turn,
+    window_id: windowId,
+    window_number: 0,
+    context_window_id: uuidV7From(keyed(args.idSalt, `${threadId}:context-window`), threadAt),
+    request_kind: "turn",
+    history_initialization: "new",
+    root_turn_id: turn,
+    thread_source: "user",
+    turn_trigger: "user",
+    sandbox: OPENAI_SANDBOX,
+    sandbox_mode: "workspace-write",
+    auto_review_enabled: false,
+    node_repl_auto_review_required: catalog.nodeReplAutoReviewRequired,
+    node_repl_disabled: catalog.nodeReplDisabled,
+    turn_started_at_unix_ms: args.startedAt,
+    analytics_enabled: false,
+    model: args.model,
+    reasoning_effort: args.effort
+  });
+  const clientMetadata = {
+    turn_id: turn,
+    thread_id: threadId,
+    "x-codex-turn-metadata": turnMetadata,
+    mcp_attribution: '{"status":"none"}',
+    guardian_credits_requested: "true",
+    "x-codex-installation-id": installationId,
+    "x-codex-window-id": windowId,
+    root_turn_id: turn,
+    session_id: threadId
+  };
+  return { windowId, turnMetadata, clientMetadata };
+}
+
 // packages/providers/src/openai/wire.ts
-import { createHash as createHash6 } from "crypto";
 var MAX_CACHE_KEY_LENGTH = 1024;
 var HEADER_SAFE_KEY = /^[\x21-\x7e]+$/;
 function suppliedKey2(req) {
@@ -19250,9 +19745,16 @@ function suppliedKey2(req) {
   }
   return;
 }
-function cacheKey2(req, instructions, firstInput) {
-  const stable = req.conversationId !== undefined && req.conversationId.length > 0 ? JSON.stringify({ conversation: req.conversationId }) : JSON.stringify({ instructions, firstInput: firstInput ?? null });
-  return createHash6("sha256").update(stable).digest("hex").slice(0, 32);
+function cacheKey2(req, instructions, firstInput, salt) {
+  const supplied = suppliedKey2(req);
+  if (supplied !== undefined) {
+    if (isUuid(supplied))
+      return { key: supplied, seed: supplied };
+    const seed = JSON.stringify({ key: supplied });
+    return { key: threadIdFrom(keyed(salt, seed)), seed };
+  }
+  const seed = req.conversationId !== undefined && req.conversationId.length > 0 ? JSON.stringify({ conversation: req.conversationId }) : JSON.stringify({ instructions, firstInput: firstInput ?? null });
+  return { key: threadIdFrom(keyed(salt, seed)), seed };
 }
 function repairOrphanedCalls2(input) {
   const answered = new Set;
@@ -19283,6 +19785,44 @@ function encodeToolChoice7(c) {
       return { type: "function", name: c.name };
   }
 }
+function codexReasoning(req, model, note) {
+  const catalog = codexModel(model);
+  const context = catalog.lite ? { context: "all_turns" } : {};
+  const r = req.reasoning;
+  if (r === undefined)
+    return { effort: catalog.defaultEffort, ...context };
+  if (r.mode === "off") {
+    note("openai:reasoning-off-as-lowest");
+    return { effort: catalog.lowestEffort, ...context };
+  }
+  if (r.mode === "betweenTools")
+    return { effort: catalog.lowestEffort, ...context };
+  if (r.mode === "budget") {
+    note("openai:reasoning-budget-dropped");
+    return { effort: catalog.defaultEffort, ...context };
+  }
+  return {
+    effort: r.effort ?? catalog.defaultEffort,
+    ...r.display === "omitted" || r.display === "updates" ? {} : { summary: "auto" },
+    ...context
+  };
+}
+var isRecord8 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+function mergeCodexVendor(body, vendor, note) {
+  const target = body;
+  for (const [name, value] of Object.entries(vendor)) {
+    if (name === "client_metadata") {
+      note("openai:client-metadata-replaced");
+      continue;
+    }
+    const ours = target[name];
+    if ((name === "text" || name === "reasoning") && isRecord8(ours) && isRecord8(value)) {
+      target[name] = { ...ours, ...value };
+      continue;
+    }
+    target[name] = value;
+  }
+}
 function toResponsesWire(req, model, opts = { oauth: false }) {
   const degradations = [];
   const input = [];
@@ -19290,6 +19830,12 @@ function toResponsesWire(req, model, opts = { oauth: false }) {
     if (!degradations.includes(d))
       degradations.push(d);
   };
+  const turnOf = new WeakMap;
+  let turn = -1;
+  const push = (item) => {
+    input.push(item);
+    turnOf.set(item, Math.max(0, turn));
+  };
   if (req.betas?.includes(CONTEXT_1M_BETA))
     note("openai:context-1m-dropped");
   for (const message of req.messages) {
@@ -19301,10 +19847,15 @@ function toResponsesWire(req, model, opts = { oauth: false }) {
     const flush = () => {
       if (parts.length === 0)
         return;
-      input.push({ type: "message", role, content: [...parts] });
+      push({ type: "message", role, content: [...parts] });
       parts.length = 0;
     };
+    let opened = false;
     for (const block of message.content) {
+      if (message.role === "user" && !opened && block.type !== "toolResult") {
+        opened = true;
+        turn++;
+      }
       switch (block.type) {
         case "text":
           parts.push({
@@ -19325,7 +19876,7 @@ function toResponsesWire(req, model, opts = { oauth: false }) {
           break;
         case "toolUse":
           flush();
-          input.push({
+          push({
             type: "function_call",
             call_id: block.id,
             name: block.name,
@@ -19337,7 +19888,7 @@ function toResponsesWire(req, model, opts = { oauth: false }) {
             note("openai:anthropic-native-block-dropped");
           flush();
           const files = responsesFiles(block.files ?? []);
-          input.push({
+          push({
             type: "function_call_output",
             call_id: block.toolUseId,
             output: withFileText(block.content, files.text)
@@ -19365,7 +19916,7 @@ function toResponsesWire(req, model, opts = { oauth: false }) {
           if (block.provider === "openai") {
             flush();
             const { id: _id, ...rest } = block.data;
-            input.push({ type: block.blockType, ...rest });
+            push({ type: block.blockType, ...rest });
             break;
           }
           note("openai:anthropic-native-block-dropped");
@@ -19377,8 +19928,10 @@ function toResponsesWire(req, model, opts = { oauth: false }) {
   repairOrphanedCalls2(input);
   const body = { model, input, stream: req.stream, store: false };
   const instructions = systemText(req.system, "openai", note);
-  if (instructions !== undefined && instructions.length > 0)
+  const lite = opts.oauth && codexModel(model).lite;
+  if (instructions !== undefined && instructions.length > 0 && !opts.oauth) {
     body.instructions = instructions;
+  }
   if (req.maxTokens !== undefined) {
     if (opts.oauth)
       note("openai:max-tokens-dropped");
@@ -19391,22 +19944,45 @@ function toResponsesWire(req, model, opts = { oauth: false }) {
     else
       body.temperature = req.temperature;
   }
+  let liteTools;
   if (req.tools !== undefined) {
     const custom = req.tools.filter((t) => t.kind === "portable");
     if (custom.length !== req.tools.length)
       note("openai:anthropic-tool-dropped");
-    body.tools = custom.map((t) => ({
-      type: "function",
-      name: t.name,
-      description: t.description,
-      parameters: t.inputSchema
-    }));
+    if (opts.oauth) {
+      const tools = custom.map((t) => ({
+        type: "function",
+        name: t.name,
+        description: t.description,
+        strict: false,
+        parameters: t.inputSchema
+      }));
+      if (lite)
+        liteTools = tools;
+      else
+        body.tools = tools;
+    } else {
+      body.tools = custom.map((t) => ({
+        type: "function",
+        name: t.name,
+        description: t.description,
+        parameters: t.inputSchema
+      }));
+    }
   }
   if (req.toolChoice !== undefined)
     body.tool_choice = encodeToolChoice7(req.toolChoice);
-  if (req.reasoning?.mode === "betweenTools")
-    degradations.push("openai:reasoning-between-tools-as-off");
-  if (req.reasoning !== undefined && req.reasoning.mode !== "off" && req.reasoning.mode !== "betweenTools") {
+  else if (opts.oauth)
+    body.tool_choice = "auto";
+  if (opts.oauth) {
+    body.parallel_tool_calls = !lite && codexModel(model).supportsParallelToolCalls;
+  }
+  if (req.reasoning?.mode === "betweenTools") {
+    note(opts.oauth ? "openai:reasoning-between-tools-as-lowest" : "openai:reasoning-between-tools-as-off");
+  }
+  if (opts.oauth) {
+    body.reasoning = codexReasoning(req, model, note);
+  } else if (req.reasoning !== undefined && req.reasoning.mode !== "off" && req.reasoning.mode !== "betweenTools") {
     if (req.reasoning.mode === "budget") {
       degradations.push("openai:reasoning-budget-dropped");
     } else {
@@ -19417,36 +19993,98 @@ function toResponsesWire(req, model, opts = { oauth: false }) {
       };
     }
   }
-  const key = suppliedKey2(req) ?? cacheKey2(req, instructions ?? "", input[0]);
-  Object.assign(body, req.vendor?.openai ?? {});
+  const salt = opts.oauth ? opts.idSalt : undefined;
+  const { key, seed } = cacheKey2(req, instructions ?? "", input[0], salt);
+  if (opts.oauth) {
+    body.include = ["reasoning.encrypted_content"];
+    body.text = { verbosity: codexModel(model).verbosity };
+    mergeCodexVendor(body, req.vendor?.openai ?? {}, note);
+  } else {
+    Object.assign(body, req.vendor?.openai ?? {});
+  }
   const moved = moveToResponsesText(req, body, "openai");
   if (moved !== undefined)
     note(moved);
   body.prompt_cache_key = key;
-  return { body, degradations, cacheKey: key };
+  if (!opts.oauth)
+    return { body, degradations, cacheKey: key };
+  const built = toLiteInput({
+    threadId: key,
+    input,
+    turnOf,
+    tools: liteTools,
+    instructions,
+    requestId: opts.requestId,
+    startedAt: opts.startedAt,
+    idSalt: salt
+  });
+  body.input = built.input;
+  const sent = body.reasoning?.effort;
+  const codex = codexTurn({
+    threadId: key,
+    turnId: built.turnId,
+    installationId: opts.installationId,
+    installationSeed: opts.accountId ?? seed,
+    idSalt: salt,
+    model,
+    effort: isCodexEffort(sent) ? sent : codexModel(model).defaultEffort,
+    startedAt: built.startedAt
+  });
+  body.client_metadata = codex.clientMetadata;
+  return { body, degradations, cacheKey: key, codex };
 }
 
 // packages/providers/src/openai/codec.ts
 var OAUTH_URL2 = "https://chatgpt.com/backend-api/codex/responses";
 var API_URL3 = "https://api.openai.com/v1/responses";
+var HEADER_SAFE = /^[\x21-\x7e]+$/;
+function routingHint(model, tier) {
+  if (!HEADER_SAFE.test(model))
+    return;
+  if (typeof tier === "string" && HEADER_SAFE.test(tier) && !tier.includes(";")) {
+    return `model=${model};tier=${tier}`;
+  }
+  return `model=${model}`;
+}
 var openaiCodec = {
   buildRequest(input) {
     const oauth = input.credentials.accessToken !== null;
-    const { body, degradations, cacheKey } = toResponsesWire(input.request, input.model, { oauth });
-    const protocol = [["content-type", "application/json"]];
+    const accountId = input.credentials.providerData.accountId;
+    const secrets = oauth ? codexSecretsFrom(input.credentials.providerData) : {};
+    const { body, degradations, cacheKey, codex } = toResponsesWire(input.request, input.model, {
+      oauth,
+      requestId: input.requestId,
+      startedAt: input.requestStartedAt,
+      accountId: typeof accountId === "string" ? accountId : undefined,
+      installationId: secrets.installationId,
+      idSalt: secrets.idSalt
+    });
+    const protocol = [];
+    if (codex !== undefined) {
+      protocol.push(["x-codex-window-id", codex.windowId], ["x-codex-turn-metadata", codex.turnMetadata]);
+      if (codexModel(input.model).lite) {
+        protocol.push(["x-openai-internal-codex-responses-lite", "true"]);
+      }
+      const hint = routingHint(input.model, body.service_tier);
+      if (hint !== undefined)
+        protocol.push(["x-codex-routing-hint", hint]);
+    }
+    protocol.push(["x-client-request-id", cacheKey], ["session-id", cacheKey], ["thread-id", cacheKey]);
+    if (oauth)
+      protocol.push(["content-encoding", "zstd"]);
+    protocol.push(["content-type", "application/json"]);
     if (oauth) {
       protocol.push(["authorization", `Bearer ${input.credentials.accessToken}`]);
-      const accountId = input.credentials.providerData.accountId;
       if (typeof accountId === "string")
         protocol.push(["chatgpt-account-id", accountId]);
+      protocol.push(["host", "chatgpt.com"]);
     } else if (input.credentials.apiKey !== null) {
       protocol.push(["authorization", `Bearer ${input.credentials.apiKey}`]);
     } else {
       throw input.fail("AUTH", "openai credential has no token");
     }
-    protocol.push(["x-client-request-id", cacheKey], ["session-id", cacheKey], ["thread-id", cacheKey]);
     const headers = orderHeaders(mergeHeaders(openaiProfile.headers, protocol), openaiProfile.order);
-    const include = body.include;
+    const include = input.request.vendor?.openai?.include;
     const nativeReasoning = Array.isArray(include) && include.includes("reasoning.encrypted_content");
     return {
       decodeState: { nativeReasoning },
@@ -19454,7 +20092,8 @@ var openaiCodec = {
         url: oauth ? OAUTH_URL2 : API_URL3,
         method: "POST",
         headers,
-        body: JSON.stringify(orderFields({ ...body, stream: true }, openaiBodyOrder))
+        body: JSON.stringify(orderFields({ ...body, stream: true }, openaiBodyOrder)),
+        ...oauth ? { bodyEncoding: "zstd" } : {}
       },
       degradations
     };
@@ -19546,11 +20185,17 @@ function createConnectFlows(deps) {
     const provider = deps.providers[flow.provider];
     if (provider === undefined)
       throw new GatewayError("BAD_REQUEST", "provider does not support OAuth");
-    const result = await provider.exchange({ code, pending: flow.pending }, { http: deps.http, now: deps.now });
+    const existing = flow.credentialId === undefined ? null : await deps.store.credentials.get(flow.credentialId);
+    if (flow.credentialId !== undefined && existing === null) {
+      throw new GatewayError("BAD_REQUEST", "credential not found");
+    }
+    const prior = existing !== null && existing.provider === flow.provider ? existing.providerData : undefined;
+    const result = await provider.exchange({
+      code,
+      pending: flow.pending,
+      ...prior === undefined ? {} : { providerData: prior }
+    }, { http: deps.http, now: deps.now });
     if (flow.credentialId !== undefined) {
-      const existing = await deps.store.credentials.get(flow.credentialId);
-      if (existing === null)
-        throw new GatewayError("BAD_REQUEST", "credential not found");
       await deps.store.credentials.updateSecrets(flow.credentialId, result.secrets, result.expiresAt);
       await deps.store.credentials.update(flow.credentialId, {
         enabled: true,
@@ -20822,9 +21467,20 @@ function configuredWindows(limits) {
 async function readLimitUsage(store, id, limits, now) {
   if (limits === null)
     return [];
+  const readings = await readScope(store, id, limits, null, now);
+  for (const model of Object.keys(limits.models ?? {})) {
+    const override = modelOverride(limits, model);
+    if (override === undefined)
+      continue;
+    readings.push(...await readScope(store, id, override, model, now));
+  }
+  return readings;
+}
+async function readScope(store, id, limits, model, now) {
   const sums = new Map;
   for (const window of configuredWindows(limits)) {
-    sums.set(window, await store.usage.sumSince(id, now - WINDOW_MS[window]));
+    const since = now - WINDOW_MS[window];
+    sums.set(window, await store.usage.sumSince(id, since, model ?? undefined));
   }
   const readings = [];
   for (const dimension of ["requests", "tokens", "spend"]) {
@@ -20837,7 +21493,7 @@ async function readLimitUsage(store, id, limits, now) {
         continue;
       const sum = sums.get(window);
       const used = sum === undefined ? null : dimension === "requests" ? sum.requests : dimension === "tokens" ? sum.tokens : sum.costUsd;
-      readings.push({ dimension, window, limit, used });
+      readings.push({ dimension, window, limit, used, model });
     }
   }
   if (limits.concurrency !== undefined && limits.concurrency !== null) {
@@ -20845,7 +21501,8 @@ async function readLimitUsage(store, id, limits, now) {
       dimension: "concurrency",
       window: null,
       limit: limits.concurrency,
-      used: null
+      used: null,
+      model
     });
   }
   return readings;
@@ -22398,7 +23055,7 @@ function createRefresher(deps) {
 }
 // packages/control/src/pluginProviders.ts
 import { join as join5 } from "path";
-function isRecord8(value) {
+function isRecord9(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function isNumber(value) {
@@ -22409,7 +23066,7 @@ function checkAt(ok, id, path, expected) {
     throw new Error(`provider ${id} descriptor: ${path} must be ${expected}`);
 }
 function checkLimits(id, path, value) {
-  checkAt(isRecord8(value), id, path, "an object");
+  checkAt(isRecord9(value), id, path, "an object");
   const limits = value;
   checkAt(isNumber(limits.contextWindow), id, `${path}.contextWindow`, "a finite number");
   checkAt(isNumber(limits.maxOutputTokens), id, `${path}.maxOutputTokens`, "a finite number");
@@ -22427,19 +23084,19 @@ function checkDescriptor(id, record) {
     }
   }
   const capabilities = record.capabilities;
-  checkAt(isRecord8(capabilities), id, "capabilities", "an object");
+  checkAt(isRecord9(capabilities), id, "capabilities", "an object");
   for (const flag of ["tools", "images", "reasoning"]) {
     const value = capabilities[flag];
     checkAt(typeof value === "boolean", id, `capabilities.${flag}`, "a boolean");
   }
   const write = record.writeOverInput;
-  checkAt(isRecord8(write), id, "writeOverInput", "an object");
+  checkAt(isRecord9(write), id, "writeOverInput", "an object");
   for (const ttl of ["fiveMinute", "oneHour"]) {
     const value = write[ttl];
     checkAt(isNumber(value), id, `writeOverInput.${ttl}`, "a finite number");
   }
   const catalog = record.catalog;
-  checkAt(isRecord8(catalog), id, "catalog", "an object");
+  checkAt(isRecord9(catalog), id, "catalog", "an object");
   const entry = catalog;
   checkAt(typeof entry.defaultModel === "string", id, "catalog.defaultModel", "a string");
   checkAt(Array.isArray(entry.authTypes), id, "catalog.authTypes", "an array");
@@ -22450,11 +23107,11 @@ function checkDescriptor(id, record) {
   checkAt(Array.isArray(entry.models), id, "catalog.models", "an array");
   for (const [index, model] of entry.models.entries()) {
     const at = `catalog.models[${index}]`;
-    checkAt(isRecord8(model), id, at, "an object");
+    checkAt(isRecord9(model), id, at, "an object");
     const choice = model;
     checkAt(typeof choice.id === "string", id, `${at}.id`, "a string");
     checkAt(typeof choice.label === "string", id, `${at}.label`, "a string");
-    checkAt(isRecord8(choice.pricing), id, `${at}.pricing`, "an object");
+    checkAt(isRecord9(choice.pricing), id, `${at}.pricing`, "an object");
     const pricing = choice.pricing;
     for (const field of ["input", "output", "cacheRead", "cacheWrite5m", "cacheWrite1h"]) {
       checkAt(isNumber(pricing[field]), id, `${at}.pricing.${field}`, "a finite number");
@@ -22470,13 +23127,13 @@ function checkDescriptor(id, record) {
     checkAt(typeof prefix === "string", id, `modelPrefixes[${index}]`, "a string");
   }
   const presentation = record.presentation;
-  checkAt(isRecord8(presentation), id, "presentation", "an object");
+  checkAt(isRecord9(presentation), id, "presentation", "an object");
   const shown = presentation;
   for (const field of ["label", "tone"]) {
     checkAt(typeof shown[field] === "string", id, `presentation.${field}`, "a string");
   }
   checkAt(isNumber(shown.order), id, "presentation.order", "a finite number");
-  checkAt(isRecord8(shown.colour), id, "presentation.colour", "an object");
+  checkAt(isRecord9(shown.colour), id, "presentation.colour", "an object");
   for (const scheme of ["light", "dark"]) {
     const value = shown.colour[scheme];
     checkAt(typeof value === "string", id, `presentation.colour.${scheme}`, "a string");
@@ -22488,7 +23145,7 @@ function checkDescriptor(id, record) {
 function validateOAuthFlow(id, value) {
   if (value === undefined)
     return;
-  if (!isRecord8(value))
+  if (!isRecord9(value))
     throw new Error(`provider ${id} oauth must be an object`);
   const kind = value.kind;
   if (kind !== "pkce" && kind !== "device") {
@@ -23160,7 +23817,7 @@ function requirePositional(parsed, index, name) {
   return value;
 }
 // packages/plugin-api/src/events.ts
-var WINDOW_MS2 = {
+var WINDOW_MS3 = {
   "1m": 60000,
   "5h": 5 * 60 * 60 * 1000,
   "1w": 7 * 24 * 60 * 60 * 1000
@@ -24400,6 +25057,23 @@ var dbRestore = {
 
 // apps/cli/src/commands/keys.ts
 var WINDOWED = new Set(["requests", "tokens", "spend"]);
+var GAUGE = "concurrency";
+var MODELS2 = "models";
+function emptyLimits() {
+  return { scope: {}, models: Object.create(null) };
+}
+function toWire2(limits) {
+  const models = Object.keys(limits.models);
+  if (models.length === 0)
+    return { ...limits.scope };
+  const out = {};
+  for (const model of models) {
+    const scope = limits.models[model];
+    if (scope !== undefined)
+      out[model] = scope;
+  }
+  return { ...limits.scope, [MODELS2]: out };
+}
 var PROTO = "__proto__";
 function rejectProto(flag, name) {
   if (name === PROTO)
@@ -24424,6 +25098,7 @@ function parseLimitFlags(entries, flag, into = {}) {
         throw new UsageError(`${flag} ${pair} needs a window, e.g. ${flag} ${pair}:1m=60`);
       }
       rejectProto(flag, pair);
+      rejectModels(flag, pair);
       limits[pair] = value;
       continue;
     }
@@ -24434,14 +25109,109 @@ function parseLimitFlags(entries, flag, into = {}) {
     }
     rejectProto(flag, dimension);
     rejectProto(flag, window);
-    const existing = limits[dimension];
-    const windows = typeof existing === "object" ? existing : {};
-    windows[window] = value;
-    limits[dimension] = windows;
+    rejectModels(flag, dimension);
+    setSlot(limits, dimension, window, value);
   }
   return limits;
 }
+function rejectModels(flag, name) {
+  if (name === MODELS2) {
+    throw new UsageError(`${flag} cannot name "${MODELS2}"; per-model limits use --model-limit`);
+  }
+}
+function setSlot(scope, dimension, window, value) {
+  const existing = scope[dimension];
+  const windows = typeof existing === "object" ? existing : {};
+  windows[window] = value;
+  scope[dimension] = windows;
+}
+function splitModelSlot(spec, flag, shape) {
+  const malformed = () => new UsageError(`${flag} must be ${shape}, got "${spec}"`);
+  const last = spec.lastIndexOf(":");
+  if (last < 0)
+    throw malformed();
+  const tail = spec.slice(last + 1);
+  if (tail === GAUGE) {
+    const model = spec.slice(0, last);
+    if (model.length === 0)
+      throw malformed();
+    rejectProto(flag, model);
+    return { model, dimension: GAUGE, window: null };
+  }
+  if (WINDOWED.has(tail)) {
+    throw new UsageError(`${flag} ${spec} needs a window, e.g. ${flag} ${spec}:1m`);
+  }
+  const head = spec.slice(0, last);
+  const second = head.lastIndexOf(":");
+  if (second < 0)
+    throw malformed();
+  const model = head.slice(0, second);
+  const dimension = head.slice(second + 1);
+  if (model.length === 0 || dimension.length === 0 || tail.length === 0)
+    throw malformed();
+  rejectProto(flag, model);
+  rejectProto(flag, dimension);
+  rejectProto(flag, tail);
+  return { model, dimension, window: tail };
+}
+var MODEL_LIMIT_SHAPE = "model:dimension:window=value or model:concurrency=value";
+function parseModelLimitFlags(entries, into) {
+  const flag = "--model-limit";
+  for (const entry of entries) {
+    const equals = entry.lastIndexOf("=");
+    if (equals <= 0)
+      throw new UsageError(`${flag} must be ${MODEL_LIMIT_SHAPE}, got "${entry}"`);
+    const spec = entry.slice(0, equals);
+    const raw = entry.slice(equals + 1);
+    const value = Number(raw);
+    if (raw.trim().length === 0 || !Number.isFinite(value)) {
+      throw new UsageError(`${flag} ${spec} must be a number, got "${raw}"`);
+    }
+    const { model, dimension, window } = splitModelSlot(spec, flag, MODEL_LIMIT_SHAPE);
+    const scope = into.models[model] ?? {};
+    if (window === null)
+      scope[dimension] = value;
+    else
+      setSlot(scope, dimension, window, value);
+    into.models[model] = scope;
+  }
+}
+function applyModelUnsetFlags(limits, entries) {
+  const flag = "--unset-model-limit";
+  for (const entry of entries) {
+    if (entry.includes("=")) {
+      throw new UsageError(`${flag} names a limit to remove, not a value, got "${entry}"`);
+    }
+    const { model, dimension, window } = splitModelSlot(entry, flag, "model:dimension:window or model:concurrency");
+    const scope = limits.models[model];
+    const missing = () => new UsageError(`this key has no ${entry} limit`);
+    if (scope === undefined || !Object.hasOwn(scope, dimension))
+      throw missing();
+    if (window === null) {
+      delete scope[dimension];
+    } else {
+      const windows = scope[dimension];
+      if (typeof windows !== "object" || !Object.hasOwn(windows, window))
+        throw missing();
+      delete windows[window];
+      if (Object.keys(windows).length === 0)
+        delete scope[dimension];
+    }
+    if (Object.keys(scope).length === 0)
+      delete limits.models[model];
+  }
+}
 function toLoose(limits) {
+  const loose = emptyLimits();
+  loose.scope = toLooseScope(limits);
+  for (const [model, override] of Object.entries(limits.models ?? {})) {
+    const scope = toLooseScope(override);
+    if (Object.keys(scope).length > 0)
+      loose.models[model] = scope;
+  }
+  return loose;
+}
+function toLooseScope(limits) {
   const loose = {};
   for (const dimension of ["requests", "tokens", "spend"]) {
     const windows = limits[dimension];
@@ -24497,6 +25267,7 @@ function limitRow(reading) {
   const money = reading.dimension === "spend";
   const amount = (value) => money ? formatUsd(value) : String(value);
   return [
+    reading.model ?? "key",
     reading.dimension,
     reading.window ?? "\u2014",
     amount(reading.limit),
@@ -24505,6 +25276,13 @@ function limitRow(reading) {
   ];
 }
 function summarizeLimits(limits) {
+  const parts = summarizeScope(limits, "");
+  for (const [model, override] of Object.entries(limits.models ?? {})) {
+    parts.push(...summarizeScope(override, `${model}:`));
+  }
+  return parts.length === 0 ? "\u2014" : parts.join(" ");
+}
+function summarizeScope(limits, prefix) {
   const parts = [];
   for (const dimension of ["requests", "tokens", "spend"]) {
     const windows = limits[dimension];
@@ -24513,13 +25291,13 @@ function summarizeLimits(limits) {
     for (const [window, value] of Object.entries(windows)) {
       if (value === null || value === undefined)
         continue;
-      parts.push(`${dimension}:${window}=${value}`);
+      parts.push(`${prefix}${dimension}:${window}=${value}`);
     }
   }
   if (limits.concurrency !== undefined && limits.concurrency !== null) {
-    parts.push(`concurrency=${limits.concurrency}`);
+    parts.push(`${prefix}concurrency=${limits.concurrency}`);
   }
-  return parts.length === 0 ? "\u2014" : parts.join(" ");
+  return parts;
 }
 function parseWhen(flag, raw) {
   const at = Date.parse(raw);
@@ -24567,22 +25345,26 @@ var keysList = {
   }
 };
 var keysCreate = {
-  usage: "keys create [--label L] [--allow <model> ...] [--limit <d>:<w>=N ...] [--expires <when>] [--no-bodies]",
+  usage: "keys create [--label L] [--allow <model> ...] [--limit <d>:<w>=N ...] [--model-limit <model>:<d>:<w>=N ...] [--expires <when>] [--no-bodies]",
   summary: "Mint a gateway API key, printed once",
   options: {
     label: { type: "string" },
     allow: { type: "string", multiple: true },
     limit: { type: "string", multiple: true },
+    "model-limit": { type: "string", multiple: true },
     expires: { type: "string" },
     "no-bodies": { type: "boolean" }
   },
   async run(args, { ctx, writer }) {
     const allow = listFlag(args.values, "allow");
     const expires = stringFlag(args.values, "expires");
+    const limits = emptyLimits();
+    parseLimitFlags(listFlag(args.values, "limit") ?? [], "--limit", limits.scope);
+    parseModelLimitFlags(listFlag(args.values, "model-limit") ?? [], limits);
     const created = await createKey(await ctx.store(), {
       ...stringFlag(args.values, "label") === undefined ? {} : { label: stringFlag(args.values, "label") },
       modelAllowlist: allow ?? null,
-      limits: parseLimitFlags(listFlag(args.values, "limit") ?? [], "--limit"),
+      limits: toWire2(limits),
       bodyLoggingOptOut: boolFlag(args.values, "no-bodies"),
       expiresAt: expires === undefined ? null : parseWhen("--expires", expires)
     });
@@ -24593,16 +25375,24 @@ var keysCreate = {
   }
 };
 var keysLimits = {
-  usage: "keys limits <id> [--set <d>:<w>=N ...] [--unset <d>:<w> ...]",
+  usage: "keys limits <id> [--set <d>:<w>=N ...] [--unset <d>:<w> ...] [--model-limit <model>:<d>:<w>=N ...] [--unset-model-limit <model>:<d>[:<w>] ...]",
   summary: "Show or edit one key's limits, with what has been used against them",
   options: {
     set: { type: "string", multiple: true },
-    unset: { type: "string", multiple: true }
+    unset: { type: "string", multiple: true },
+    "model-limit": { type: "string", multiple: true },
+    "unset-model-limit": { type: "string", multiple: true }
   },
   async run(args, { ctx, writer }) {
     const id = requirePositional(args, 0, "key id");
-    const sets = listFlag(args.values, "set") ?? [];
-    const unsets = listFlag(args.values, "unset") ?? [];
+    const sets = [
+      ...listFlag(args.values, "set") ?? [],
+      ...listFlag(args.values, "model-limit") ?? []
+    ];
+    const unsets = [
+      ...listFlag(args.values, "unset") ?? [],
+      ...listFlag(args.values, "unset-model-limit") ?? []
+    ];
     const store = await ctx.store();
     const existing = (await listKeys(store)).find((entry) => entry.id === id);
     if (existing === undefined)
@@ -24617,10 +25407,12 @@ var keysLimits = {
         replaced = true;
         note(ctx, writer, paint(ctx, "yellow", "the stored limits could not be read and are being replaced"));
       }
-      const next = existing.limits === null ? {} : toLoose(existing.limits);
-      applyUnsetFlags(next, unsets);
-      parseLimitFlags(sets, "--set", next);
-      key = await setKeyLimits(store, id, { limits: next });
+      const next = existing.limits === null ? emptyLimits() : toLoose(existing.limits);
+      applyUnsetFlags(next.scope, listFlag(args.values, "unset") ?? []);
+      applyModelUnsetFlags(next, listFlag(args.values, "unset-model-limit") ?? []);
+      parseLimitFlags(listFlag(args.values, "set") ?? [], "--set", next.scope);
+      parseModelLimitFlags(listFlag(args.values, "model-limit") ?? [], next);
+      key = await setKeyLimits(store, id, { limits: toWire2(next) });
     }
     emit(ctx, writer, replaced ? { ...key, limitsReplaced: true } : key, () => {
       const head = fields([
@@ -24641,6 +25433,7 @@ no limits configured; this key is unlimited`;
       return `${head}
 
 ${table([
+        { header: "SCOPE" },
         { header: "DIMENSION" },
         { header: "WINDOW" },
         { header: "LIMIT", align: "right" },
@@ -25288,7 +26081,7 @@ function createServiceDeps(input) {
 }
 
 // apps/cli/src/version.ts
-var VERSION = "0.13.7";
+var VERSION = "0.14.1";
 
 // apps/cli/src/commands/service.ts
 function gatewayArgv(root) {