@bitkyc08/opencodex 2.28.0 → 2.29.0

package/src/clients/config-export.ts

@@ -25,6 +25,7 @@ import { isAbsolute, join, resolve } from "node:path";
 import { shouldInjectApiAuthHeader } from "../codex/inject";
 import { FORMAT_MEDIA_TYPE, serializeDocument, type ConfigFormat } from "../integrations/serialize";
 import { providerCodexAccountMode } from "../providers/registry";
+import { sanitizeCodexReasoningEfforts } from "../reasoning-effort";
 import { probeHostname } from "../server/proxy-liveness";
 import type { OcxConfig } from "../types";
 
@@ -192,6 +193,27 @@ function ompProfileName(env: OpencodeLaunchEnv): string | undefined {
   return profile;
 }
 
+/**
+ * Pi resolves its agent directory from `PI_CODING_AGENT_DIR`, falling back to
+ * `~/.pi/agent`. `ompAgentDir` below already reads that variable — OMP is a Pi
+ * derivative — so Pi's own resolver honoring it is what makes the two agree
+ * rather than a new claim about Pi's contract.
+ *
+ * A relative override is refused for the same reason MCode's and ZCode's are: a
+ * background proxy and a foreground client can have different working
+ * directories, and would otherwise disagree about which file is named.
+ */
+export function piAgentDir(env: OpencodeLaunchEnv = process.env, home: string = homedir()): string {
+  const override = env.PI_CODING_AGENT_DIR?.trim();
+  if (override) return absoluteClientPath(override, home, "PI_CODING_AGENT_DIR");
+  return join(home, ".pi", "agent");
+}
+
+/** Pi's canonical custom-provider catalog. */
+export function piConfigPath(env: OpencodeLaunchEnv = process.env, home: string = homedir()): string {
+  return join(piAgentDir(env, home), "models.json");
+}
+
 /** Resolve the global Oh My Pi agent directory using OMP's own env precedence. */
 export function ompAgentDir(env: OpencodeLaunchEnv = process.env, home: string = homedir()): string {
   const profile = ompProfileName(env);
@@ -432,6 +454,26 @@ export function zcodeConfigPath(env: OpencodeLaunchEnv = process.env, home: stri
   return join(zcodeHomeDir(env, home), "v2", "config.json");
 }
 
+/**
+ * Prime Agent resolves its agent directory from `PRIME_AGENT_CODING_AGENT_DIR`
+ * — the brand-derived spelling of the `PI_CODING_AGENT_DIR` that `ompAgentDir`
+ * already honors, because the agent builds that variable name from its own
+ * `piConfig.name` — and otherwise falls back to `~/.prime/agent`. Relative
+ * overrides are refused for the same reason as MCode's and ZCode's: a
+ * background proxy and a foreground client can have different working
+ * directories.
+ */
+export function primeAgentDir(env: OpencodeLaunchEnv = process.env, home: string = homedir()): string {
+  const override = env.PRIME_AGENT_CODING_AGENT_DIR?.trim();
+  if (override) return absoluteClientPath(override, home, "PRIME_AGENT_CODING_AGENT_DIR");
+  return join(home, ".prime", "agent");
+}
+
+/** Prime Agent's canonical custom-provider catalog. */
+export function primeConfigPath(env: OpencodeLaunchEnv = process.env, home: string = homedir()): string {
+  return join(primeAgentDir(env, home), "models.json");
+}
+
 /**
  * One proxy-routed model destined for a client config. Deliberately narrower than
  * `CatalogModel` so a serializer cannot reach for a field that does not survive the
@@ -473,7 +515,8 @@ export type ExportClientId =
   | "gajae"
   | "dsh"
   | "mcode"
-  | "zcode";
+  | "zcode"
+  | "prime";
 
 export interface ExportClientSpec {
   id: ExportClientId;
@@ -886,7 +929,14 @@ export interface McodeProviderBlock {
     baseURL: string;
     authMode: "api-key";
   };
-  models: Record<string, Record<string, never>>;
+  models: Record<string, McodeModelEntry>;
+}
+
+export interface McodeModelEntry {
+  /** MCode uses this value for context accounting and compaction. */
+  limit?: { context: number };
+  /** MCode exposes these exact levels in `/model` and sends the selected effort. */
+  thinking?: { effortOptions: string[] };
 }
 
 export interface McodeGeneratedConfig {
@@ -895,10 +945,10 @@ export interface McodeGeneratedConfig {
 
 /**
  * ZCode's `~/.zcode/v2/config.json` provider entry (observed schema, validated
- * live against ZCode 3.7.7). `kind: "anthropic"` selects the Anthropic
- * Messages protocol, which the proxy serves at `/v1/messages`. `apiKeyRequired`
- * keeps ZCode's UI from prompting for a key it does not need on loopback; the
- * serialized key is always the non-secret loopback placeholder.
+ * live against ZCode 3.7.7 / 3.8.1). `kind: "openai-compatible"` selects the
+ * OpenAI Chat Completions protocol, which the proxy serves at `/v1/chat/completions`.
+ * `apiKeyRequired` keeps ZCode's UI from prompting for a key it does not need on
+ * loopback; the serialized key is always the non-secret loopback placeholder.
  */
 export interface ZcodeModelEntry {
   name?: string;
@@ -908,7 +958,7 @@ export interface ZcodeModelEntry {
 
 export interface ZcodeProviderBlock {
   name: "OpenCodex";
-  kind: "anthropic";
+  kind: "openai-compatible";
   enabled: true;
   source: "custom";
   options: {
@@ -1231,12 +1281,29 @@ function buildDshClientConfig(ctx: ExportContext): DshGeneratedConfig {
 
 /**
  * MiniMax Code's `provider add` command persists custom providers under
- * `custom_provider.<id>`. Do not emit `defaultModel`: connecting a client must
- * not silently replace the user's current model selection.
+ * `custom_provider.<id>`. Its current model schema reads `limit.context` for
+ * context accounting and `thinking.effortOptions` for the `/model` effort
+ * control. Do not emit the removed `thinking.effort` / `defaultEffort` fields:
+ * MCode 0.1.6 migrates those into options and keeps the selected effort in the
+ * session. Do not emit `defaultModel` either: connecting a client must not
+ * silently replace the user's current model selection.
  */
 function buildMcodeClientConfig(ctx: ExportContext): McodeGeneratedConfig {
-  const models: Record<string, Record<string, never>> = {};
-  for (const model of normalizeExportModels(ctx.models)) models[model.namespaced] = {};
+  const models: Record<string, McodeModelEntry> = {};
+  for (const model of normalizeExportModels(ctx.models)) {
+    const entry: McodeModelEntry = {};
+    const context = authoritativeContextWindow(model.contextWindow);
+    if (context !== undefined) entry.limit = { context };
+    // `none` is an internal Codex catalog sentinel, not an MCode effort. MCode
+    // forwards every option as `output_config.effort` while keeping adaptive
+    // thinking enabled, and the Anthropic ingress deliberately accepts only
+    // minimal..ultra. Advertising `none` would therefore create a selectable
+    // value that cannot disable reasoning and is not forwarded as an effort.
+    const efforts = sanitizeCodexReasoningEfforts(model.reasoningEfforts)
+      ?.filter(effort => effort !== "none");
+    if (efforts && efforts.length > 0) entry.thinking = { effortOptions: efforts };
+    models[model.namespaced] = entry;
+  }
   return {
     custom_provider: {
       [OPENCODE_PROVIDER_ID]: {
@@ -1256,10 +1323,10 @@ function buildMcodeClientConfig(ctx: ExportContext): McodeGeneratedConfig {
 }
 
 /**
- * ZCode dials the Anthropic Messages surface, so `baseURL` is the proxy origin
- * without the `/v1` suffix (ZCode appends `/v1/messages` itself — the same
- * shape its builtin Z.ai providers use). Model ids are the proxy's canonical
- * `provider/id` selectors, which `/v1/messages` resolves directly. Context
+ * ZCode dials the OpenAI Chat Completions surface (`openai-compatible`), which
+ * appends `/chat/completions` to `baseURL`. We supply `baseURL` with the `/v1`
+ * suffix so requests land on `/v1/chat/completions`. Model ids are the proxy's canonical
+ * `provider/id` selectors, which `/v1/chat/completions` resolves directly. Context
  * limits follow the authoritative-window rule: a model without one ships
  * without `limit` rather than guessing. Modalities are ZCode's observed
  * `text`-floor vocabulary; image-capable rows advertise image input.
@@ -1288,12 +1355,12 @@ function buildZcodeClientConfig(ctx: ExportContext): ZcodeGeneratedConfig {
     provider: {
       [OPENCODE_PROVIDER_ID]: {
         name: "OpenCodex",
-        kind: "anthropic",
+        kind: "openai-compatible",
         enabled: true,
         source: "custom",
         options: {
           apiKey: LOOPBACK_API_KEY_PLACEHOLDER,
-          baseURL: ctx.baseUrl.replace(/\/v1\/?$/, ""),
+          baseURL: ctx.baseUrl.replace(/\/v1\/?$/, "") + "/v1",
           apiKeyRequired: true,
         },
         models,
@@ -1353,8 +1420,7 @@ function summarizeDsh(document: unknown): { modelCount: number; modelsWithoutLim
 
 function summarizeMcode(document: unknown): { modelCount: number; modelsWithoutLimits: number } {
   const models = Object.values((document as McodeGeneratedConfig | undefined)?.custom_provider?.[OPENCODE_PROVIDER_ID]?.models ?? {});
-  // MCode's custom-provider schema does not expose per-model context limits.
-  return { modelCount: models.length, modelsWithoutLimits: 0 };
+  return { modelCount: models.length, modelsWithoutLimits: models.filter(model => !model.limit).length };
 }
 
 function summarizeZcode(document: unknown): { modelCount: number; modelsWithoutLimits: number } {
@@ -1428,6 +1494,24 @@ function buildZcodeContribution(ctx: ExportContext): ManagedContribution {
   return singleFragment("zcode", ["provider", OPENCODE_PROVIDER_ID], doc.provider[OPENCODE_PROVIDER_ID]);
 }
 
+/**
+ * Prime Agent (PrimeIntellect) is the pi coding agent shipped under a different
+ * brand rather than a lookalike: its package declares a `piConfig` block, and
+ * the agent derives its config directory (`.prime/agent`) and env prefix from
+ * that block alone. `models.json` is therefore the SAME contract Pi reads, so
+ * this client reuses Pi's builder and summarizer verbatim. Restating the shape
+ * here would create a second copy of one fact, which is exactly how the
+ * "anything that is not OpenCode must be Pi" summarizer bug happened.
+ *
+ * The one thing that could still differ is the path we own, and it does not:
+ * Prime keeps our entries under the same `providers.<id>` key. So the only new
+ * code is stamping the right client id on the ownership record.
+ */
+function buildPrimeContribution(ctx: ExportContext): ManagedContribution {
+  const doc = buildPiClientConfig(ctx);
+  return singleFragment("prime", ["providers", OPENCODE_PROVIDER_ID], doc.providers[OPENCODE_PROVIDER_ID]);
+}
+
 export const EXPORT_CLIENTS: Record<ExportClientId, ExportClientSpec> = {
   opencode: {
     id: "opencode",
@@ -1445,7 +1529,7 @@ export const EXPORT_CLIENTS: Record<ExportClientId, ExportClientSpec> = {
   pi: {
     id: "pi",
     filename: "pi-models.json",
-    destination: () => join(homedir(), ".pi", "agent", "models.json"),
+    destination: env => piConfigPath(env),
     apiKeyEnv: "",
     exportHint: "Pi reads a non-secret placeholder from models.json; loopback needs no key.",
     build: buildPiClientConfig,
@@ -1566,6 +1650,21 @@ export const EXPORT_CLIENTS: Record<ExportClientId, ExportClientSpec> = {
     // remote binds refuse — same reasoning as MCode.
     loopbackOnly: true,
   },
+  prime: {
+    id: "prime",
+    filename: "prime-models.json",
+    destination: env => primeConfigPath(env),
+    apiKeyEnv: "",
+    exportHint: "Prime Agent reads a non-secret placeholder from models.json; loopback needs no key.",
+    build: buildPiClientConfig,
+    format: "json",
+    summarize: summarizePi,
+    buildContribution: buildPrimeContribution,
+    // Prime's provider block does accept `headers`, so a dedicated admission
+    // header has somewhere to live, but remote credential wiring is deferred
+    // from this initial loopback-only integration — same stance as OMP's.
+    loopbackOnly: true,
+  },
 };
 
 export const EXPORT_CLIENT_IDS: readonly ExportClientId[] = Object.keys(EXPORT_CLIENTS) as ExportClientId[];

package/src/codex/affinity-debug.ts

@@ -0,0 +1,162 @@
+/**
+ * Opt-in Codex affinity diagnostics for account-switch compatibility failures.
+ *
+ * The provider debug stream may compare values only within the current process. It never emits
+ * raw header values, credentials, account identifiers, or durable unsalted hashes.
+ */
+import { createHmac, randomBytes } from "node:crypto";
+import { isDebugEnabled } from "../lib/debug-settings";
+import { debugProviderDiagnostic } from "../lib/debug";
+
+const MAX_TAGGED_VALUE_BYTES = 16 * 1024;
+const RUN_KEY = randomBytes(32);
+let nextSequence = 0;
+
+const SAFE_AFFINITY_HEADERS = [
+  "openai-beta",
+  "originator",
+  "session_id",
+  "session-id",
+  "thread-id",
+  "x-client-request-id",
+  "x-codex-beta-features",
+  "x-codex-installation-id",
+  "x-codex-parent-thread-id",
+  "x-codex-turn-metadata",
+  "x-codex-turn-state",
+  "x-codex-window-id",
+  "x-openai-subagent",
+  "x-responsesapi-include-timing-metrics",
+] as const;
+
+const KNOWN_TURN_FIELDS = [
+  "forked_from_thread_id",
+  "parent_thread_id",
+  "request_kind",
+  "session_id",
+  "subagent_kind",
+  "thread_id",
+] as const;
+
+type SizeBucket = "0" | "1-31" | "32-127" | "128-511" | "512-2047" | "2048-16384" | "oversized";
+
+export interface CodexAffinityValueTag {
+  name: string;
+  size: SizeBucket;
+  tag?: string;
+}
+
+export interface CodexAffinityJsonSummary {
+  shape: "absent" | "malformed" | "oversized" | "array" | "scalar" | "object";
+  knownFields?: Array<CodexAffinityValueTag & { kind: "string" | "number" | "boolean" | "null" | "array" | "object" }>;
+  unknownFieldCount?: number;
+}
+
+export interface CodexAffinityDiagnosticInput {
+  inboundHeaders: Headers;
+  outboundHeaders: HeadersInit;
+  authKind: "main" | "pool" | "main-pool";
+  accountMode: "direct" | "pool" | undefined;
+  fixedAccount: boolean;
+  credentialSubstituted: boolean;
+  accountGatedModel: boolean;
+  wireModelNormalized: boolean;
+  status: number;
+}
+
+function sizeBucket(bytes: number): SizeBucket {
+  if (bytes === 0) return "0";
+  if (bytes <= 31) return "1-31";
+  if (bytes <= 127) return "32-127";
+  if (bytes <= 511) return "128-511";
+  if (bytes <= 2047) return "512-2047";
+  if (bytes <= MAX_TAGGED_VALUE_BYTES) return "2048-16384";
+  return "oversized";
+}
+
+function valueTag(name: string, value: string): CodexAffinityValueTag {
+  const bytes = Buffer.byteLength(value, "utf8");
+  const size = sizeBucket(bytes);
+  if (size === "oversized") return { name, size };
+  const tag = createHmac("sha256", RUN_KEY)
+    .update(name)
+    .update("\0")
+    .update(value)
+    .digest("hex")
+    .slice(0, 12);
+  return { name, size, tag };
+}
+
+function headerTags(headers: Headers): CodexAffinityValueTag[] {
+  const rows: CodexAffinityValueTag[] = [];
+  for (const name of SAFE_AFFINITY_HEADERS) {
+    const value = headers.get(name);
+    if (value !== null) rows.push(valueTag(name, value));
+  }
+  return rows;
+}
+
+function jsonSummary(headers: Headers, name: "x-codex-turn-metadata" | "x-codex-turn-state"): CodexAffinityJsonSummary {
+  const raw = headers.get(name);
+  if (raw === null) return { shape: "absent" };
+  if (Buffer.byteLength(raw, "utf8") > MAX_TAGGED_VALUE_BYTES) return { shape: "oversized" };
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(raw) as unknown;
+  } catch {
+    return { shape: "malformed" };
+  }
+  if (Array.isArray(parsed)) return { shape: "array" };
+  if (!parsed || typeof parsed !== "object") return { shape: "scalar" };
+  const record = parsed as Record<string, unknown>;
+  const knownFields: NonNullable<CodexAffinityJsonSummary["knownFields"]> = [];
+  for (const field of KNOWN_TURN_FIELDS) {
+    if (!Object.hasOwn(record, field)) continue;
+    const value = record[field];
+    if (value === null) {
+      knownFields.push({ name: field, kind: "null", size: "0" });
+    } else {
+      const scalarKind = typeof value;
+      if (scalarKind === "string" || scalarKind === "number" || scalarKind === "boolean") {
+        knownFields.push({ ...valueTag(`${name}.${field}`, String(value)), name: field, kind: scalarKind });
+        continue;
+      }
+      knownFields.push({ name: field, kind: Array.isArray(value) ? "array" : "object", size: "0" });
+    }
+  }
+  const known = new Set<string>(KNOWN_TURN_FIELDS);
+  const unknownFieldCount = Object.keys(record).filter(key => !known.has(key)).length;
+  return {
+    shape: "object",
+    ...(knownFields.length > 0 ? { knownFields } : {}),
+    ...(unknownFieldCount > 0 ? { unknownFieldCount } : {}),
+  };
+}
+
+/** Emit one observation-only, privacy-bounded provider-debug record. */
+export function captureCodexAffinityDiagnostic(input: CodexAffinityDiagnosticInput): void {
+  if (!isDebugEnabled()) return;
+  try {
+    const outbound = new Headers(input.outboundHeaders);
+    debugProviderDiagnostic("codex", "affinity", {
+      sequence: ++nextSequence,
+      authKind: input.authKind,
+      accountMode: input.accountMode ?? "unset",
+      fixedAccount: input.fixedAccount,
+      credentialSubstituted: input.credentialSubstituted,
+      accountGatedModel: input.accountGatedModel,
+      wireModelNormalized: input.wireModelNormalized,
+      status: input.status,
+      inbound: headerTags(input.inboundHeaders),
+      outbound: headerTags(outbound),
+      inboundTurnMetadata: jsonSummary(input.inboundHeaders, "x-codex-turn-metadata"),
+      outboundTurnMetadata: jsonSummary(outbound, "x-codex-turn-metadata"),
+      inboundTurnState: jsonSummary(input.inboundHeaders, "x-codex-turn-state"),
+      outboundTurnState: jsonSummary(outbound, "x-codex-turn-state"),
+    });
+  } catch {
+    // Diagnostics must never affect request handling.
+  }
+}
+
+export const CODEX_AFFINITY_DEBUG_SAFE_HEADERS = SAFE_AFFINITY_HEADERS;

package/src/codex/inject.ts

@@ -482,25 +482,47 @@ function setRootModelProvider(content: string): string {
 }
 
 function readRootModelCatalogPath(content: string): string | null {
-  return readRootTomlString(content, "model_catalog_json");
+  const lines = content.split("\n");
+  const firstTable = lines.findIndex((line) => /^\s*\[/.test(line));
+  const rootEnd = firstTable === -1 ? lines.length : firstTable;
+  const modelCatalogAssignment = tomlStringPattern("model_catalog_json");
+  let ownedCatalogPath: string | null = null;
+  for (let index = 0; index < rootEnd; index += 1) {
+    const match = modelCatalogAssignment.exec(lines[index]);
+    if (!match) continue;
+    const catalogPath = parseTomlString(match[1]);
+    if (!isOpencodexCatalogPath(catalogPath)) return catalogPath;
+    ownedCatalogPath ??= catalogPath;
+  }
+  return ownedCatalogPath;
 }
 
 function setRootModelCatalogPath(content: string, catalogPath: string): string {
   const lines = content.split("\n");
   const firstTable = lines.findIndex((l) => /^\s*\[/.test(l));
   const key = `model_catalog_json = ${tomlString(catalogPath)}`;
+  const modelCatalogAssignment = tomlStringPattern("model_catalog_json");
   const rootEnd = firstTable === -1 ? lines.length : firstTable;
+  const ownedAssignments: number[] = [];
+  let hasUserAssignment = false;
   for (let i = 0; i < rootEnd; i++) {
-    const m = lines[i].match(
-      /^\s*model_catalog_json\s*=\s*("(?:\\.|[^"\\])*"|'[^']*')\s*$/,
-    );
+    const m = modelCatalogAssignment.exec(lines[i]);
     if (!m) continue;
     const existing = parseTomlString(m[1]);
     if (isOpencodexCatalogPath(existing)) {
-      lines[i] = key;
-      return lines.join("\n");
+      ownedAssignments.push(i);
+    } else {
+      hasUserAssignment = true;
     }
-    return content;
+  }
+  if (hasUserAssignment) {
+    const owned = new Set(ownedAssignments);
+    return lines.filter((_, index) => !owned.has(index)).join("\n");
+  }
+  if (ownedAssignments.length > 0) {
+    lines[ownedAssignments[0]] = key;
+    const duplicates = new Set(ownedAssignments.slice(1));
+    return lines.filter((_, index) => !duplicates.has(index)).join("\n");
   }
   if (firstTable === -1) {
     return content.replace(/\n+$/, "") + "\n" + key + "\n";
@@ -583,12 +605,14 @@ function isOpencodexCatalogPath(path: string): boolean {
 }
 
 function stripOpencodexCatalogPath(content: string): string {
-  return content
-    .split("\n")
-    .filter((line) => {
-      const m = line.match(
-        /^\s*model_catalog_json\s*=\s*("(?:\\.|[^"\\])*"|'[^']*')\s*$/,
-      );
+  const modelCatalogAssignment = tomlStringPattern("model_catalog_json");
+  const lines = content.split("\n");
+  const firstTable = lines.findIndex((line) => /^\s*\[/.test(line));
+  const rootEnd = firstTable === -1 ? lines.length : firstTable;
+  return lines
+    .filter((line, index) => {
+      if (index >= rootEnd) return true;
+      const m = modelCatalogAssignment.exec(line);
       return !m || !isOpencodexCatalogPath(parseTomlString(m[1]));
     })
     .join("\n");
@@ -894,7 +918,15 @@ export async function injectCodexConfig(
     });
     atomicWriteFile(CODEX_CONFIG_PATH, content);
     atomicWriteFile(CODEX_PROFILE_PATH, profileContent);
-    markJournalInjectedState(content, profileContent);
+    markJournalInjectedState(content, profileContent, {
+      // A root override is ours only in loopback Design B when no user-owned value won.
+      injectedOpenaiBaseUrl: legacyMode || keptUserBaseUrl
+        ? null
+        : rootTomlString(content, "openai_base_url"),
+      // This is the catalog artifact selected for this injection, even when config.toml
+      // already points at that path and therefore needs no textual rewrite.
+      injectedCatalogPath: catalogPath,
+    });
   };
 
   /*

package/src/codex/journal.ts

@@ -2,7 +2,7 @@ import { createHash } from "node:crypto";
 import { existsSync, readFileSync, unlinkSync } from "node:fs";
 import { join } from "node:path";
 import { atomicWriteFile } from "../config";
-import { hasInjectedCodexRouting, rootTomlString } from "./injected-marker";
+import { hasInjectedCodexRouting } from "./injected-marker";
 import { CODEX_HOME, CODEX_CONFIG_PATH, CODEX_PROFILE_PATH } from "./paths";
 
 /**
@@ -108,16 +108,30 @@ export function writeJournal(options: WriteJournalOptions = {}): void {
   atomicWriteFile(JOURNAL_PATH, JSON.stringify(journal));
 }
 
-export function markJournalInjectedState(config: string, profile: string | null): void {
+export interface InjectedJournalOwnership {
+  injectedOpenaiBaseUrl: string | null;
+  injectedCatalogPath: string | null;
+}
+
+export function markJournalInjectedState(
+  config: string,
+  profile: string | null,
+  ownership: InjectedJournalOwnership,
+): void {
   const journal = readJournal();
   if (!journal) return;
-  if (journal.injectedConfigHash) return;
-  journal.injectedConfigHash = sha256(config) ?? undefined;
+  // The first exact injected config is the only safe whole-snapshot restore boundary for
+  // the first native snapshot. A later reinjection may preserve user edits made while routed;
+  // hashing those newer bytes and restoring the first snapshot would delete those edits.
+  // Keep the first hash so changed/reinjected configs take the owned-field fallback path.
+  journal.injectedConfigHash ??= sha256(config) ?? undefined;
+  // The profile file is wholly generated by OpenCodex, so its latest exact hash remains safe
+  // to refresh and lets restore remove the latest generated profile after a port change.
   journal.injectedProfileHash = sha256(profile);
-  // Read from the bytes we are about to install, not from the file: another writer may
-  // already have rewritten it, and then the recorded value would describe their config.
-  journal.injectedOpenaiBaseUrl = rootTomlString(config, "openai_base_url");
-  journal.injectedCatalogPath = rootTomlString(config, "model_catalog_json");
+  // Only the caller knows which values it actually owns. Deriving these from the final TOML
+  // would mistake a preserved user override for injected routing.
+  journal.injectedOpenaiBaseUrl = ownership.injectedOpenaiBaseUrl;
+  journal.injectedCatalogPath = ownership.injectedCatalogPath;
   atomicWriteFile(JOURNAL_PATH, JSON.stringify(journal));
 }
 

package/src/config.ts

@@ -715,6 +715,7 @@ const providerConfigSchema = z.object({
   supportsServiceTier: z.boolean().optional(),
   modelSupportsServiceTier: z.record(z.string().min(1), z.boolean()).optional(),
   preserveResponsesReasoningContent: z.boolean().optional(),
+  decodesNativeCompactionBlobs: z.boolean().optional(),
   allowPrivateNetwork: z.boolean().optional(),
   // The management API accepts `null` as "clear this", so a config written before the POST
   // canonicalization below can hold one on disk. Rejecting it here would send the operator