@bitkyc08/opencodex 2.5.6 → 2.6.0

package/src/config.ts

@@ -1,7 +1,7 @@
 import { execFileSync } from "node:child_process";
 import { copyFileSync, existsSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync, chmodSync } from "node:fs";
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { join, resolve } from "node:path";
 import * as z from "zod/v4";
 import type { OcxConfig } from "./types";
 
@@ -16,8 +16,14 @@ export function atomicWriteFile(path: string, content: string): void {
   renameSync(tmp, path);
 }
 
+let resolvedConfigDirCache: { raw: string | undefined; path: string } | null = null;
+
 function resolveConfigDir(): string {
-  return process.env["OPENCODEX_HOME"] || join(homedir(), ".opencodex");
+  const raw = process.env["OPENCODEX_HOME"]?.trim() || undefined;
+  if (resolvedConfigDirCache && resolvedConfigDirCache.raw === raw) return resolvedConfigDirCache.path;
+  const path = raw ? resolve(raw) : join(homedir(), ".opencodex");
+  resolvedConfigDirCache = { raw, path };
+  return path;
 }
 
 function resolveConfigPath(): string {
@@ -28,6 +34,10 @@ function resolvePidPath(): string {
   return join(resolveConfigDir(), "ocx.pid");
 }
 
+function resolveRuntimePortPath(): string {
+  return join(resolveConfigDir(), "runtime-port.json");
+}
+
 const warnedConfigFallbacks = new Set<string>();
 
 const providerConfigSchema = z.object({
@@ -35,12 +45,35 @@ const providerConfigSchema = z.object({
   baseUrl: z.string().min(1),
 }).passthrough();
 
+const RESERVED_PROVIDER_NAMES = new Set(["__proto__", "prototype", "constructor"]);
+const PROVIDER_NAME_PATTERN = /^[A-Za-z0-9](?:[A-Za-z0-9._-]{0,62}[A-Za-z0-9])?$/;
+
+export function isValidProviderName(name: string): boolean {
+  const trimmed = name.trim();
+  return trimmed === name
+    && PROVIDER_NAME_PATTERN.test(name)
+    && !RESERVED_PROVIDER_NAMES.has(name.toLowerCase());
+}
+
+export function hasOwnProvider(providers: Record<string, unknown>, name: string): boolean {
+  return Object.prototype.hasOwnProperty.call(providers, name);
+}
+
 const configSchema = z.object({
   port: z.number().int().min(0).max(65535).default(10100),
   providers: z.record(z.string(), providerConfigSchema),
   defaultProvider: z.string().min(1).default("openai"),
 }).passthrough().superRefine((config, ctx) => {
-  if (Object.keys(config.providers).length > 0 && !(config.defaultProvider in config.providers)) {
+  for (const name of Object.keys(config.providers)) {
+    if (!isValidProviderName(name)) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["providers", name],
+        message: "provider names must use letters, numbers, dot, underscore, or hyphen and cannot be reserved JavaScript object keys",
+      });
+    }
+  }
+  if (!hasOwnProvider(config.providers, config.defaultProvider)) {
     ctx.addIssue({
       code: "custom",
       path: ["defaultProvider"],
@@ -70,6 +103,10 @@ export function getPidPath(): string {
   return resolvePidPath();
 }
 
+export function getRuntimePortPath(): string {
+  return resolveRuntimePortPath();
+}
+
 export function hardenConfigDir(): void {
   const dir = getConfigDir();
   if (existsSync(dir)) {
@@ -120,6 +157,57 @@ export function loadConfig(): OcxConfig {
   }
 }
 
+export type ConfigDiagnostics = {
+  config: OcxConfig;
+  source: "default" | "file" | "fallback";
+  error: string | null;
+};
+
+function mergeConfigDefaults(parsed: unknown): unknown {
+  if (!parsed || typeof parsed !== "object") return parsed;
+  const defaults = getDefaultConfig();
+  const raw = parsed as Record<string, unknown>;
+  const merged: Record<string, unknown> = { ...defaults, ...raw };
+  if (raw.providers && typeof raw.providers === "object" && defaults.providers) {
+    merged.providers = { ...defaults.providers, ...(raw.providers as Record<string, unknown>) };
+  }
+  return merged;
+}
+
+function configIssuePaths(error: z.ZodError): string[] {
+  const paths = error.issues.map(issue => issue.path.join(".") || "config");
+  return [...new Set(paths)].sort();
+}
+
+function schemaDiagnosticsError(error: z.ZodError): string {
+  const paths = configIssuePaths(error);
+  return paths.length > 0 ? `schema_invalid: ${paths.join(", ")}` : "schema_invalid";
+}
+
+export function readConfigDiagnostics(): ConfigDiagnostics {
+  const configPath = getConfigPath();
+  if (!existsSync(configPath)) {
+    return { config: getDefaultConfig(), source: "default", error: null };
+  }
+  try {
+    const raw = readFileSync(configPath, "utf-8").replace(/^\uFEFF/, "");
+    const parsed = JSON.parse(raw);
+    const result = configSchema.safeParse(parsed);
+    if (result.success) {
+      return { config: result.data as OcxConfig, source: "file", error: null };
+    }
+
+    const retryResult = configSchema.safeParse(mergeConfigDefaults(parsed));
+    if (retryResult.success) {
+      return { config: retryResult.data as OcxConfig, source: "file", error: null };
+    }
+
+    return { config: getDefaultConfig(), source: "fallback", error: schemaDiagnosticsError(result.error) };
+  } catch {
+    return { config: getDefaultConfig(), source: "fallback", error: "invalid_json" };
+  }
+}
+
 export function saveConfig(config: OcxConfig): void {
   const dir = getConfigDir();
   if (!existsSync(dir)) {
@@ -176,6 +264,34 @@ export function writePid(pid: number): void {
   atomicWriteFile(getPidPath(), String(pid));
 }
 
+export type RuntimePortState = {
+  pid: number;
+  port: number;
+  hostname?: string;
+};
+
+function isValidRuntimePortState(value: unknown): value is RuntimePortState {
+  if (!value || typeof value !== "object") return false;
+  const state = value as Record<string, unknown>;
+  const hostnameOk = state.hostname === undefined || typeof state.hostname === "string";
+  return Number.isSafeInteger(state.pid)
+    && Number(state.pid) > 0
+    && Number.isInteger(state.port)
+    && Number(state.port) > 0
+    && Number(state.port) <= 65535
+    && hostnameOk;
+}
+
+export function writeRuntimePort(state: RuntimePortState): void {
+  const dir = getConfigDir();
+  if (!existsSync(dir)) {
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+  } else {
+    hardenConfigDir();
+  }
+  atomicWriteFile(getRuntimePortPath(), JSON.stringify(state, null, 2) + "\n");
+}
+
 export function readPid(): number | null {
   const pidPath = getPidPath();
   if (!existsSync(pidPath)) return null;
@@ -197,6 +313,17 @@ export function readPid(): number | null {
   }
 }
 
+export function readRuntimePort(expectedPid?: number): RuntimePortState | null {
+  try {
+    const parsed = JSON.parse(readFileSync(getRuntimePortPath(), "utf-8"));
+    if (!isValidRuntimePortState(parsed)) return null;
+    if (expectedPid !== undefined && parsed.pid !== expectedPid) return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+
 export function removePid(expectedPid?: number): void {
   if (expectedPid !== undefined && readPidFileValue() !== expectedPid) return;
   try {
@@ -219,6 +346,13 @@ function readPidFileValue(): number | null {
   }
 }
 
+export function removeRuntimePort(expectedPid?: number): void {
+  if (expectedPid !== undefined && readRuntimePort(expectedPid) === null) return;
+  try {
+    unlinkSync(getRuntimePortPath());
+  } catch { /* ignore */ }
+}
+
 export function parsePidFile(raw: string): number | null {
   const trimmed = raw.trim();
   if (!/^\d+$/.test(trimmed)) return null;
@@ -273,7 +407,7 @@ function warnAndBackupInvalidConfig(configPath: string, error: unknown): void {
   console.error(`Could not load opencodex config at ${configPath}: ${reason}. Using default config.${backupNote}`);
 }
 
-function backupInvalidConfig(configPath: string): string | null {
+export function backupInvalidConfig(configPath: string): string | null {
   if (!existsSync(configPath)) return null;
   const backupPath = `${configPath}.invalid-${new Date().toISOString().replace(/[:.]/g, "-")}`;
   try {

package/src/init.ts

@@ -1,6 +1,6 @@
 import * as readline from "node:readline";
 import { injectCodexConfig } from "./codex-inject";
-import { getDefaultConfig, saveConfig } from "./config";
+import { getDefaultConfig, isValidProviderName, saveConfig } from "./config";
 import { enrichProviderFromCatalog } from "./oauth/key-providers";
 import { deriveInitProviders } from "./providers/derive";
 import type { OcxConfig, OcxProviderConfig } from "./types";
@@ -97,7 +97,12 @@ export async function runInit(): Promise<void> {
       enrichProviderFromCatalog(p.id, providerConfig);
     }
   } else {
-    providerName = await prompt.ask("Provider name: ");
+    providerName = (await prompt.ask("Provider name: ")).trim();
+    if (!isValidProviderName(providerName)) {
+      console.error("Provider name must use letters, numbers, dot, underscore, or hyphen and cannot be a reserved object key.");
+      prompt.close();
+      process.exit(1);
+    }
     const baseUrl = await prompt.ask("Base URL (e.g. http://localhost:11434/v1): ");
     const adapter = await prompt.ask("Adapter [openai-chat]: ") || "openai-chat";
     const apiKey = await prompt.ask("API key (optional): ");

package/src/oauth/callback-server.ts

@@ -12,6 +12,7 @@ import type { OAuthController, OAuthCredentials } from "./types";
 
 const DEFAULT_TIMEOUT = 300_000;
 const DEFAULT_HOSTNAME = "localhost";
+const DEFAULT_BIND_HOSTNAME = "127.0.0.1";
 const CALLBACK_PATH = "/callback";
 
 const SUCCESS_HTML =
@@ -67,13 +68,13 @@ export abstract class OAuthCallbackFlow {
       this.preferredPort = preferredPortOrOptions;
       this.callbackPath = callbackPath;
       this.callbackHostname = DEFAULT_HOSTNAME;
-      this.callbackBindHostname = DEFAULT_HOSTNAME;
+      this.callbackBindHostname = DEFAULT_BIND_HOSTNAME;
       return;
     }
     this.preferredPort = preferredPortOrOptions.preferredPort;
     this.callbackPath = preferredPortOrOptions.callbackPath ?? CALLBACK_PATH;
     this.callbackHostname = preferredPortOrOptions.callbackHostname ?? DEFAULT_HOSTNAME;
-    this.callbackBindHostname = preferredPortOrOptions.callbackBindHostname ?? this.callbackHostname;
+    this.callbackBindHostname = preferredPortOrOptions.callbackBindHostname ?? DEFAULT_BIND_HOSTNAME;
     this.redirectUri = preferredPortOrOptions.redirectUri;
   }
 
@@ -151,30 +152,36 @@ export abstract class OAuthCallbackFlow {
     const errorDescription = url.searchParams.get("error_description") || error;
 
     let ok = false;
+    let consumeFlow = false;
     let errMessage = "";
+    const stateMatches = !expectedState || state === expectedState;
     if (error) {
       errMessage = `Authorization failed: ${errorDescription}`;
+      consumeFlow = stateMatches;
     } else if (!code) {
       errMessage = "Missing authorization code";
-    } else if (expectedState && state !== expectedState) {
+    } else if (!stateMatches) {
       errMessage = "State mismatch - possible CSRF attack";
     } else {
       ok = true;
+      consumeFlow = true;
     }
 
-    // Capture refs before they could be cleared, then resolve on the next microtask.
-    const resolve = this.#callbackResolve;
-    const reject = this.#callbackReject;
-    queueMicrotask(() => {
-      if (ok && code) {
-        resolve?.({ code, state });
-      } else {
-        reject?.(errMessage || "Unknown error");
-      }
-    });
+    if (consumeFlow) {
+      // Capture refs before they could be cleared, then resolve on the next microtask.
+      const resolve = this.#callbackResolve;
+      const reject = this.#callbackReject;
+      queueMicrotask(() => {
+        if (ok && code) {
+          resolve?.({ code, state });
+        } else {
+          reject?.(errMessage || "Unknown error");
+        }
+      });
+    }
 
     return new Response(ok ? SUCCESS_HTML : errorHtml(errMessage), {
-      status: ok ? 200 : 500,
+      status: ok ? 200 : consumeFlow ? 500 : 400,
       headers: { "Content-Type": "text/html" },
     });
   }
@@ -204,7 +211,7 @@ export abstract class OAuthCallbackFlow {
               .then((input): CallbackResult | null => {
                 const parsed = parseCallbackInput(input);
                 if (!parsed.code) return null;
-                if (expectedState && parsed.state && parsed.state !== expectedState) return null;
+                if (expectedState && parsed.state !== expectedState) return null;
                 return { code: parsed.code, state: parsed.state ?? "" };
               })
               .catch((): CallbackResult | null => null),

package/src/oauth/index.ts

@@ -69,12 +69,26 @@ export function listOAuthProviders(): string[] {
   return Object.keys(OAUTH_PROVIDERS);
 }
 
+export class UnsupportedOAuthProviderError extends Error {
+  constructor(provider: string) {
+    super(`Unsupported OAuth provider in config: ${provider}`);
+    this.name = "UnsupportedOAuthProviderError";
+  }
+}
+
+export class OAuthLoginRequiredError extends Error {
+  constructor(provider: string) {
+    super(`Not logged in to ${provider}. Run: ocx login ${provider}`);
+    this.name = "OAuthLoginRequiredError";
+  }
+}
+
 /** Return a valid access token, refreshing + persisting if expired. Throws if not logged in. */
 export async function getValidAccessToken(provider: string): Promise<string> {
   const def = OAUTH_PROVIDERS[provider];
-  if (!def) throw new Error(`Unknown OAuth provider: ${provider}`);
+  if (!def) throw new UnsupportedOAuthProviderError(provider);
   const cred = getCredential(provider);
-  if (!cred) throw new Error(`Not logged in to ${provider}. Run: ocx login ${provider}`);
+  if (!cred) throw new OAuthLoginRequiredError(provider);
   if (cred.expires > Date.now() + REFRESH_SKEW_MS) return cred.access;
   const fresh = await def.refresh(cred.refresh);
   saveCredential(provider, fresh);
@@ -190,7 +204,7 @@ export function upsertOAuthProvider(config: OcxConfig, provider: string): void {
 /** Run the login flow, persist the credential + upsert the provider entry to disk, return cred. */
 export async function runLogin(provider: string, ctrl: OAuthController, opts?: LoginOpts): Promise<OAuthCredentials> {
   const def = OAUTH_PROVIDERS[provider];
-  if (!def) throw new Error(`Unknown OAuth provider: ${provider}`);
+  if (!def) throw new UnsupportedOAuthProviderError(provider);
   const cred = await def.login(ctrl, opts);
   saveCredential(provider, cred);
   const config = loadConfig();
@@ -231,7 +245,7 @@ export function cancelLoginFlow(provider: string): boolean {
 
 export async function startLoginFlow(provider: string, opts?: LoginOpts): Promise<{ url: string; instructions?: string }> {
   const def = OAUTH_PROVIDERS[provider];
-  if (!def) throw new Error(`Unknown OAuth provider: ${provider}`);
+  if (!def) throw new UnsupportedOAuthProviderError(provider);
   const existing = loginState.get(provider);
   if (existing && !existing.done) {
     throw new Error(`A login for ${provider} is already in progress`);

package/src/oauth/login-cli.ts

@@ -5,6 +5,13 @@ import { OAUTH_PROVIDERS, runLogin } from "./index";
 import { KEY_LOGIN_PROVIDERS, isKeyLoginProvider, validateApiKey, type KeyLoginProvider } from "./key-providers";
 import type { OcxProviderConfig } from "../types";
 
+export function runningProxyUpdateHeaders(): Headers {
+  const headers = new Headers({ "Content-Type": "application/json" });
+  const apiToken = process.env.OPENCODEX_API_AUTH_TOKEN?.trim();
+  if (apiToken) headers.set("X-OpenCodex-API-Key", apiToken);
+  return headers;
+}
+
 /** Push the new provider into a running proxy's live config so it routes without a restart. */
 async function notifyRunningProxy(name: string, provider: unknown): Promise<void> {
   if (!readPid()) return;
@@ -12,7 +19,7 @@ async function notifyRunningProxy(name: string, provider: unknown): Promise<void
   try {
     await fetch(`http://localhost:${cfg.port}/api/providers`, {
       method: "POST",
-      headers: { "Content-Type": "application/json" },
+      headers: runningProxyUpdateHeaders(),
       body: JSON.stringify({ name, provider }),
     });
   } catch {

package/src/oauth/store.ts

@@ -1,7 +1,7 @@
 /** OAuth token store at ~/.opencodex/auth.json, keyed by provider name. */
 import { existsSync, mkdirSync, readFileSync, chmodSync } from "node:fs";
 import { join } from "node:path";
-import { getConfigDir, atomicWriteFile, hardenConfigDir, hardenExistingSecret } from "../config";
+import { getConfigDir, atomicWriteFile, backupInvalidConfig, hardenConfigDir, hardenExistingSecret } from "../config";
 import type { OAuthCredentials } from "./types";
 
 type AuthStore = Record<string, OAuthCredentials>;
@@ -18,6 +18,7 @@ export function loadAuthStore(): AuthStore {
   try {
     return JSON.parse(readFileSync(path, "utf-8")) as AuthStore;
   } catch {
+    backupInvalidConfig(path);
     return {};
   }
 }

package/src/process-control.ts

@@ -0,0 +1,36 @@
+import { execFileSync } from "node:child_process";
+
+export function isProcessAlive(pid: number): boolean {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export function waitForExit(pid: number, timeoutMs: number): boolean {
+  const deadline = Date.now() + timeoutMs;
+  const marker = new Int32Array(new SharedArrayBuffer(4));
+  while (Date.now() < deadline) {
+    if (!isProcessAlive(pid)) return true;
+    Atomics.wait(marker, 0, 0, 50);
+  }
+  return !isProcessAlive(pid);
+}
+
+export function killProxy(pid: number): void {
+  if (!isProcessAlive(pid)) return;
+  if (process.platform === "win32") {
+    const taskkill = `${process.env.SystemRoot ?? "C:\\Windows"}\\System32\\taskkill.exe`;
+    try {
+      execFileSync(taskkill, ["/PID", String(pid), "/T", "/F"], { stdio: "pipe" });
+    } catch (err) {
+      if (isProcessAlive(pid)) throw err;
+    }
+  } else {
+    process.kill(pid, "SIGTERM");
+    if (!waitForExit(pid, 5000)) process.kill(pid, "SIGKILL");
+  }
+  if (!waitForExit(pid, 5000)) throw new Error(`process ${pid} did not exit`);
+}

package/src/provider-label.ts

@@ -0,0 +1,8 @@
+import { CODEX_ACCOUNT_LOG_LABEL_RE } from "./codex-account-label";
+
+export function baseProviderLabel(provider: string): string {
+  const cut = provider.lastIndexOf("-");
+  if (cut <= 0) return provider;
+  const suffix = provider.slice(cut + 1);
+  return CODEX_ACCOUNT_LOG_LABEL_RE.test(suffix) ? provider.slice(0, cut) : provider;
+}

package/src/responses/parser.ts

@@ -12,7 +12,7 @@ import type {
 } from "../types";
 import { namespacedToolName } from "../types";
 import { responsesRequestSchema } from "./schema";
-import { extractHostedWebSearch } from "../web-search/synthetic-tool";
+import { extractHostedWebSearch, WEB_SEARCH_TOOL_NAME } from "../web-search/synthetic-tool";
 
 function isObj(v: unknown): v is Record<string, unknown> {
   return typeof v === "object" && v !== null && !Array.isArray(v);
@@ -73,11 +73,27 @@ function mapToolChoice(value: unknown): OcxRequestOptions["toolChoice"] {
     if ((t === "function" || t === "custom") && "name" in value) {
       return { name: (value as { name: string }).name };
     }
+    if (t === "allowed_tools" && Array.isArray(value.tools)) {
+      const names = value.tools
+        .map(allowedToolName)
+        .filter((name): name is string => Boolean(name));
+      return names.length > 0
+        ? { allowedTools: [...new Set(names)], mode: value.mode === "required" ? "required" : "auto" }
+        : "none";
+    }
     return "auto";
   }
   return undefined;
 }
 
+function allowedToolName(tool: unknown): string | undefined {
+  if (!isObj(tool)) return undefined;
+  if (typeof tool.name === "string" && tool.name.length > 0) return tool.name;
+  if (tool.type === "web_search" || tool.type === "web_search_preview") return WEB_SEARCH_TOOL_NAME;
+  if (tool.type === "tool_search") return "tool_search";
+  return undefined;
+}
+
 function buildTools(tools: unknown[] | undefined): OcxTool[] | undefined {
   if (!tools) return undefined;
   const out: OcxTool[] = [];
@@ -379,6 +395,7 @@ export function parseRequest(body: unknown): OcxParsedRequest {
   if (!summaryMode || summaryMode === "none") options.hideThinkingSummary = true;
   if (data.presence_penalty !== undefined) options.presencePenalty = data.presence_penalty;
   if (data.frequency_penalty !== undefined) options.frequencyPenalty = data.frequency_penalty;
+  if (data.service_tier !== undefined) options.serviceTier = data.service_tier;
 
   // Stash the hosted web_search config (if Codex enabled it) so the proxy can run searches via the
   // gpt-mini sidecar for routed providers. buildTools still drops the hosted tool; the sidecar path

package/src/router.ts

@@ -1,5 +1,5 @@
 import type { OcxConfig, OcxProviderConfig } from "./types";
-import { resolveEnvValue } from "./config";
+import { hasOwnProvider, resolveEnvValue } from "./config";
 import { PROVIDER_REGISTRY } from "./providers/registry";
 
 interface RouteResult {
@@ -42,17 +42,73 @@ function mergeNestedRecord(
   return out;
 }
 
+function mergeStringArray(
+  seed: string[] | undefined,
+  user: string[] | undefined,
+): string[] | undefined {
+  if (!seed && !user) return undefined;
+  return [...new Set([...(seed ?? []), ...(user ?? [])])];
+}
+
+function mergeRecordFill<T>(
+  seed: Record<string, T> | undefined,
+  user: Record<string, T> | undefined,
+): Record<string, T> | undefined {
+  if (!seed && !user) return undefined;
+  return { ...(seed ?? {}), ...(user ?? {}) };
+}
+
+function mergeStringArrayRecord(
+  seed: Record<string, string[]> | undefined,
+  user: Record<string, string[]> | undefined,
+): Record<string, string[]> | undefined {
+  if (!seed && !user) return undefined;
+  const out: Record<string, string[]> = {};
+  for (const [key, value] of Object.entries(seed ?? {})) out[key] = [...value];
+  for (const [key, value] of Object.entries(user ?? {})) out[key] = [...value];
+  return out;
+}
+
 function routedProviderConfig(providerName: string, provider: OcxProviderConfig): OcxProviderConfig {
   const registryEntry = PROVIDER_REGISTRY.find(entry => entry.id === providerName);
   if (!registryEntry) return { ...provider, apiKey: resolveEnvValue(provider.apiKey) };
+  const canonicalAuthMode = registryEntry.authKind === "forward" || registryEntry.authKind === "oauth"
+    ? registryEntry.authKind
+    : provider.authMode === "forward" ? undefined : provider.authMode;
   const reasoningEffortMap = mergeRecord(registryEntry.reasoningEffortMap, provider.reasoningEffortMap);
   const modelReasoningEffortMap = mergeNestedRecord(registryEntry.modelReasoningEffortMap, provider.modelReasoningEffortMap);
+  const modelReasoningEfforts = mergeStringArrayRecord(registryEntry.modelReasoningEfforts, provider.modelReasoningEfforts);
+  const modelContextWindows = mergeRecordFill(registryEntry.modelContextWindows, provider.modelContextWindows);
+  const modelInputModalities = mergeRecordFill(registryEntry.modelInputModalities, provider.modelInputModalities);
+  const noVisionModels = mergeStringArray(registryEntry.noVisionModels, provider.noVisionModels);
+  const noReasoningModels = mergeStringArray(registryEntry.noReasoningModels, provider.noReasoningModels);
+  const noTemperatureModels = mergeStringArray(registryEntry.noTemperatureModels, provider.noTemperatureModels);
+  const noTopPModels = mergeStringArray(registryEntry.noTopPModels, provider.noTopPModels);
+  const noPenaltyModels = mergeStringArray(registryEntry.noPenaltyModels, provider.noPenaltyModels);
+  const autoToolChoiceOnlyModels = mergeStringArray(registryEntry.autoToolChoiceOnlyModels, provider.autoToolChoiceOnlyModels);
+  const preserveReasoningContentModels = mergeStringArray(registryEntry.preserveReasoningContentModels, provider.preserveReasoningContentModels);
 
   return {
     ...provider,
+    adapter: registryEntry.adapter,
+    baseUrl: registryEntry.baseUrl,
+    authMode: canonicalAuthMode,
     apiKey: resolveEnvValue(provider.apiKey),
+    ...(provider.contextWindow === undefined && registryEntry.contextWindow !== undefined ? { contextWindow: registryEntry.contextWindow } : {}),
+    ...(provider.reasoningEfforts === undefined && registryEntry.reasoningEfforts !== undefined ? { reasoningEfforts: registryEntry.reasoningEfforts } : {}),
+    ...(provider.escapeBuiltinToolNames === undefined && registryEntry.escapeBuiltinToolNames !== undefined ? { escapeBuiltinToolNames: registryEntry.escapeBuiltinToolNames } : {}),
+    ...(modelContextWindows ? { modelContextWindows } : {}),
+    ...(modelInputModalities ? { modelInputModalities } : {}),
+    ...(modelReasoningEfforts ? { modelReasoningEfforts } : {}),
     ...(reasoningEffortMap ? { reasoningEffortMap } : {}),
     ...(modelReasoningEffortMap ? { modelReasoningEffortMap } : {}),
+    ...(noVisionModels ? { noVisionModels } : {}),
+    ...(noReasoningModels ? { noReasoningModels } : {}),
+    ...(noTemperatureModels ? { noTemperatureModels } : {}),
+    ...(noTopPModels ? { noTopPModels } : {}),
+    ...(noPenaltyModels ? { noPenaltyModels } : {}),
+    ...(autoToolChoiceOnlyModels ? { autoToolChoiceOnlyModels } : {}),
+    ...(preserveReasoningContentModels ? { preserveReasoningContentModels } : {}),
   };
 }
 
@@ -64,8 +120,8 @@ export function routeModel(config: OcxConfig, modelId: string): RouteResult {
   const slash = modelId.indexOf("/");
   if (slash > 0) {
     const provName = modelId.slice(0, slash);
-    const prov = config.providers[provName];
-    if (prov) {
+    if (hasOwnProvider(config.providers, provName)) {
+      const prov = config.providers[provName];
       return {
         providerName: provName,
         provider: routedProviderConfig(provName, prov),
@@ -110,8 +166,8 @@ export function routeModel(config: OcxConfig, modelId: string): RouteResult {
     }
   }
 
-  const defaultProv = config.providers[config.defaultProvider];
-  if (defaultProv) {
+  if (hasOwnProvider(config.providers, config.defaultProvider)) {
+    const defaultProv = config.providers[config.defaultProvider];
     return {
       providerName: config.defaultProvider,
       provider: routedProviderConfig(config.defaultProvider, defaultProv),