@bitkyc08/opencodex 2.58.0 → 2.60.0

package/src/config/diagnostics.ts

@@ -34,6 +34,7 @@ import {
   malformedQuotaResetNotifyWarning,
   malformedCatalogAutoRefreshWarning,
   malformedCodexPoolWarning,
+  malformedSpendWarning,
   rawConfigRecord,
   malformedNativeSubagentFields,
   malformedNativeSubagentFieldWarning,
@@ -58,6 +59,8 @@ import {
   quotaResetNotifySchema,
   remoteGuiConfigSchema,
   runtimeRoleSchema,
+  spendSchema,
+  compactionRoutingSchema,
 } from "./schema/leaf-validators";
 
 export type ConfigDiagnostics = {
@@ -122,6 +125,8 @@ function validFileConfigDiagnostics(config: OcxConfig, rawParsed: unknown): Conf
   if (catalogRefreshWarning) warnings.push(catalogRefreshWarning);
   const codexPoolWarning = malformedCodexPoolWarning(rawParsed);
   if (codexPoolWarning) warnings.push(codexPoolWarning);
+  const spendWarning = malformedSpendWarning(rawParsed);
+  if (spendWarning) warnings.push(spendWarning);
   const plaintextWarning = malformedPlaintextV2AgentMessagesWarning(rawParsed);
   if (plaintextWarning) warnings.push(plaintextWarning);
   if (syncDisabledReason) {
@@ -295,6 +300,22 @@ function catalogAutoRefreshError(value: unknown): string | null {
   return `schema_invalid: catalogAutoRefresh${field ? `.${field}` : ""}: ${issue?.message ?? "invalid configuration"}`;
 }
 
+/**
+ * The read path degrades a malformed spend section to undefined, which means no ceiling is
+ * enforced. Reject it on write so `ocx config set` cannot store a budget that reads back as
+ * configured and refuses nothing -- a ceiling that is not enforced looks identical to one
+ * nothing has reached.
+ */
+function spendError(value: unknown): string | null {
+  const raw = rawConfigRecord(value);
+  if (!raw || !Object.hasOwn(raw, "spend") || raw.spend === undefined) return null;
+  const result = spendSchema.safeParse(raw.spend);
+  if (result.success) return null;
+  const issue = result.error.issues[0];
+  const field = issue?.path.join(".");
+  return `schema_invalid: spend${field ? `.${field}` : ""}: ${issue?.message ?? "invalid configuration"}`;
+}
+
 /**
  * The read path degrades a malformed pool policy to undefined, which for an exclusion policy means
  * the excluded accounts quietly keep serving traffic. Reject it on write so `ocx config set` cannot
@@ -541,7 +562,26 @@ function managementIngressConfigError(value: unknown): string | null {
   return null;
 }
 
+/** Load degrades malformed metrics export config to off; live writes reject the same shape. */
+export function metricsExportConfigError(value: unknown): string | null {
+  const raw = rawConfigRecord(value);
+  if (!raw || !Object.hasOwn(raw, "metricsExport") || raw.metricsExport === undefined) return null;
+  const metricsExport = rawConfigRecord(raw.metricsExport);
+  if (!metricsExport) return "schema_invalid: metricsExport: must be an object or omitted";
+  if (Object.keys(metricsExport).some(key => key !== "enabled")) {
+    return "schema_invalid: metricsExport: contains an unsupported field";
+  }
+  if (metricsExport.enabled !== undefined && typeof metricsExport.enabled !== "boolean") {
+    return "schema_invalid: metricsExport.enabled: must be a boolean";
+  }
+  return null;
+}
+
 export function validateConfigCandidate(value: unknown): { ok: true; config: OcxConfig } | { ok: false; error: string } {
+  const compactionRouting = rawConfigRecord(value)?.compactionRouting;
+  if (compactionRouting !== undefined && !compactionRoutingSchema.safeParse(compactionRouting).success) {
+    return { ok: false, error: "schema_invalid: compactionRouting: requires a nonblank model, an optional valid reasoningEffort, and optional non-repeating triggers drawn from \"manual\" and \"auto\"" };
+  }
   const boundaryError = configReasoningPinsConfigError(value)
     ?? blankHostnameError(value)
     ?? claudeSubagentEffortError(value)
@@ -551,6 +591,7 @@ export function validateConfigCandidate(value: unknown): { ok: true; config: Ocx
     ?? agentTaskRecoveryError(value)
     ?? quotaResetNotifyError(value)
     ?? catalogAutoRefreshError(value)
+    ?? spendError(value)
     ?? codexPoolError(value)
     ?? googleAntigravityStaticCatalogVersionError(value)
     ?? codexAccountPrioritiesError(value)
@@ -565,7 +606,8 @@ export function validateConfigCandidate(value: unknown): { ok: true; config: Ocx
     ?? clientConnectionConfigError(value)
     ?? clientRolePairError(value)
     ?? loopbackListenerPortError(value)
-    ?? managementIngressConfigError(value);
+    ?? managementIngressConfigError(value)
+    ?? metricsExportConfigError(value);
   if (boundaryError) return { ok: false, error: boundaryError };
   const result = configSchema.safeParse(value);
   if (result.success) {

package/src/config/feature-flags.ts

@@ -12,6 +12,11 @@ export function ultraFastTierEnabled(config: Pick<OcxConfig, "ultraFastTier">):
   return config.ultraFastTier === true;
 }
 
+/** Default-off aggregate request metrics; activation is fixed for one server process lifetime. */
+export function metricsExportEnabled(config: Pick<OcxConfig, "metricsExport">): boolean {
+  return config.metricsExport?.enabled === true;
+}
+
 /**
  * Default cadence for the opt-in catalog auto-refresh (issue #3630): one converge pass
  * per hour. Each pass spends a live /models call against every enabled provider, and

package/src/config/load-degrade.ts

@@ -33,6 +33,7 @@ import {
   remoteGuiConfigSchema,
   retryOn429PolicySchema,
   runtimeRoleSchema,
+  spendSchema,
 } from "./schema/leaf-validators";
 import { hasWarnedInheritedFastWireConflict, markWarnedInheritedFastWireConflict } from "./warn-memo";
 
@@ -100,6 +101,24 @@ export function warnDegradedStreamMode(rawParsed: unknown, validated: OcxConfig)
   }
 }
 
+export function warnDegradedCompactionRouting(rawParsed: unknown, validated: OcxConfig): void {
+  if (!rawParsed || typeof rawParsed !== "object") return;
+  const raw = (rawParsed as Record<string, unknown>).compactionRouting;
+  if (raw !== undefined && validated.compactionRouting === undefined) {
+    console.warn("⚠️  config.json compactionRouting is invalid (expected { model, reasoningEffort?, triggers? } with a nonblank model, a declared effort, and triggers drawn without repetition from \"manual\" and \"auto\") — compaction keeps the conversation model");
+  }
+}
+
+/**
+ * Top-level opt-in blocks whose hand-edited form degrades to "off" instead of failing the whole
+ * schema. Grouped behind one entry point because `src/config.ts` sits at its file-size cap, and
+ * the ratchet only ever moves down: a per-block call there costs a line the file does not have.
+ */
+export function warnDegradedTopLevelOptIns(rawParsed: unknown, validated: OcxConfig): void {
+  warnDegradedStreamMode(rawParsed, validated);
+  warnDegradedCompactionRouting(rawParsed, validated);
+}
+
 /**
  * Load-time degradation for `retryOn429` (loadConfig only): one hand-edited invalid optional
  * field (e.g. `attempts: 0` or a string) must not trip the whole provider schema and hide every
@@ -636,6 +655,20 @@ export function malformedCatalogAutoRefreshWarning(rawParsed: unknown): string |
   return `catalogAutoRefresh${field ? `.${field}` : ""} ignored: invalid catalog auto-refresh configuration`;
 }
 
+/**
+ * The same silent-in-the-wrong-direction failure, and the most expensive instance of it here:
+ * a dropped spend section means the ceilings are not enforced, and an unenforced ceiling is
+ * indistinguishable from one nothing has reached. The operator finds out from the bill.
+ */
+export function malformedSpendWarning(rawParsed: unknown): string | null {
+  const raw = rawConfigRecord(rawParsed);
+  if (!raw || !Object.hasOwn(raw, "spend")) return null;
+  const result = spendSchema.safeParse(raw.spend);
+  if (result.success) return null;
+  const field = result.error.issues[0]?.path.join(".");
+  return `spend${field ? `.${field}` : ""} ignored: invalid spend ceiling configuration, so no token ceiling is enforced`;
+}
+
 /**
  * Same silent-in-the-wrong-direction failure as the notification block: a dropped pool policy means
  * the accounts the operator meant to exclude keep taking traffic, and the only visible symptom is

package/src/config/pending-teardown.ts

@@ -295,6 +295,14 @@ export function quarantinePendingTeardown(nonce: string): string | null {
  * alone. Only an abandoned obligation is a candidate, and a VALID one still has to prove
  * its endpoint is down before anything is restored — an invalid one never can, which is
  * what {@link quarantinePendingTeardown} exists for.
+ *
+ * `isAlive` must answer "is the OWNER still running", which is not "is this PID alive".
+ * PIDs are reused: after the owner exits its number can be handed to an unrelated process,
+ * and a bare liveness probe then reports the owner as running for as long as that process
+ * lives. The receipt is neither recovered nor quarantined nor reported while both updater
+ * gates keep refusing on it, which is a permanent fail-closed with no way forward (#4897).
+ * `handleStop` therefore passes an identity-aware predicate; do not substitute a bare
+ * `process.kill(pid, 0)` here for cheapness.
  */
 export function isPendingTeardownAbandoned(
   read: PendingTeardownRead | TeardownScanFailure,

package/src/config/process-state.ts

@@ -110,16 +110,29 @@ export function removeRuntimePortIfPidIs(snapshotPid: number | null): void {
   try { unlinkSync(getRuntimePortPath()); } catch { /* ignore */ }
 }
 
-export function isOcxStartCommandLine(commandLine: string): boolean {
+/**
+ * Does this command line belong to an opencodex process at all, whatever it is doing?
+ *
+ * {@link isOcxStartCommandLine} answers the narrower question the pidfile needs — "is this
+ * the proxy?" — by additionally requiring the `start` verb. Ownership of a pending-teardown
+ * receipt is the broader question: the owner is whichever invocation claimed it, which is an
+ * `ocx stop` or the `ocx update` worker that drove it, never an `ocx start`. Asking the
+ * start-shaped question there would call every real owner foreign.
+ */
+export function isOcxCommandLine(commandLine: string): boolean {
   const normalized = commandLine.toLowerCase().replace(/\\/g, "/");
   // Keep legacy source launches and npm's in-place Windows rename recognizable:
   // a service wrapper may respawn from `.opencodex-*` during a global update.
-  const hasOcxEntrypoint = normalized.includes("src/cli.ts")
+  return normalized.includes("src/cli.ts")
     || normalized.includes("src/cli/index.ts")
     || normalized.includes("@bitkyc08/opencodex")
     || /@bitkyc08\/\.opencodex-/.test(normalized)
     || /(?:^|[\s/"'])(?:ocx|opencodex)(?:\.cmd)?(?:$|[\s"'])/.test(normalized);
-  return hasOcxEntrypoint && /(?:^|[\s"'])start(?:$|[\s"'])/.test(normalized);
+}
+
+export function isOcxStartCommandLine(commandLine: string): boolean {
+  const normalized = commandLine.toLowerCase().replace(/\\/g, "/");
+  return isOcxCommandLine(commandLine) && /(?:^|[\s"'])start(?:$|[\s"'])/.test(normalized);
 }
 
 /** Avoid spawning WMIC/PowerShell on every short liveness poll. */
@@ -227,6 +240,26 @@ export function verifyPidIdentity(candidatePid: number): number | null {
   return isLikelyOcxStartProcess(candidatePid) ? candidatePid : null;
 }
 
+/**
+ * Is this PID an opencodex process, rather than merely a live one?
+ *
+ * `process.kill(pid, 0)` answers "does this number name a process", which is not the same
+ * question. PIDs are reused, so a recorded owner that exited can have its number handed to
+ * an unrelated process, and bare liveness then reports the owner as still running forever.
+ *
+ * Deliberately uncached, unlike {@link isLikelyOcxStartProcess}. That cache exists because
+ * liveness polling asks about the same PID many times a second; this is asked once per
+ * outstanding teardown receipt in a short-lived `ocx stop`, so the cache would only add an
+ * unswept map. The Windows WMIC/PowerShell probe cost is the point rather than a regression:
+ * the runtime contract requires the identity check, not the cheap one, before acting on
+ * stale state.
+ */
+export function isLikelyOcxProcess(pid: number): boolean {
+  const commandLine = readProcessCommandLine(pid);
+  if (commandLine === undefined) return false;
+  return isOcxCommandLine(commandLine);
+}
+
 type ProcessCommandLineExec = (
   executable: string,
   args: string[],

package/src/config/provider-relative-send-path.ts

@@ -0,0 +1,16 @@
+/** Shared, initialization-independent shape check for provider send-path overrides. */
+export function providerRelativeSendPathConfigError(
+  field: "responsesPath" | "chatCompletionsPath",
+  value: unknown,
+): string | null {
+  if (value === undefined) return null;
+  if (typeof value !== "string") return `${field} must be a string`;
+  if (/^[A-Za-z][A-Za-z0-9+.-]*:/.test(value) || value.includes("://")) {
+    return `${field} must be a relative path without a URL scheme`;
+  }
+  if (!value.startsWith("/")) return `${field} must start with /`;
+  if (value.includes("?") || value.includes("#")) {
+    return `${field} must not include query strings or fragments`;
+  }
+  return null;
+}

package/src/config/proxy-env.ts

@@ -1,3 +1,5 @@
+import { configureSocks5Fetch } from "../lib/proxy-env";
+import { redactUrlForLog } from "../lib/redact";
 import { join } from "node:path";
 import { DEFAULT_SUBAGENT_MODELS, SUBAGENT_MODELS_VERSION } from "./subagent-models";
 import { MULTI_AGENT_SURFACE_ADVISORY_VERSION } from "./multi-agent-surface";
@@ -102,10 +104,15 @@ function warnProxyConfigDiscardOnce(kind: "proxy" | "noProxy" | "noProxyElements
  * variables win; config fills missing scheme proxies, which take precedence over ALL_PROXY for WS.
  * localhost/127.0.0.1 are appended to NO_PROXY so the CLI's own health checks and
  * running-proxy API calls stay direct. Call once per process entry that makes outbound provider
- * requests (server start, catalog sync).
+ * requests (server start, catalog sync). `announce` prints the one-line startup banner naming
+ * the outbound proxy actually in effect; only server start passes it, because on catalog sync
+ * that line is noise. The URL is redacted because a proxy URL can carry credentials.
  */
-export function applyProxyEnv(config: OcxConfig): void {
+export function applyProxyEnv(config: OcxConfig, announce = false): void {
   applyProxyEnvWith(config);
+  if (!announce) return;
+  const outbound = process.env.ALL_PROXY?.trim() || process.env.HTTPS_PROXY?.trim() || process.env.HTTP_PROXY?.trim();
+  if (outbound) console.log(`   outbound proxy: ${redactUrlForLog(outbound)}`);
 }
 
 /** Test seam for `proxy: "auto"`: the registry reader and platform are injectable. */
@@ -123,6 +130,7 @@ export function applyProxyEnvWith(
   let proxy = typeof rawProxy === "string" ? resolveEnvValue(rawProxy) : undefined;
   if (!proxy) {
     if (rawProxy !== undefined) warnProxyConfigDiscardOnce("proxy");
+    configureSocks5Fetch();
     return;
   }
   if (proxy.trim().toLowerCase() === "auto") {
@@ -135,8 +143,14 @@ export function applyProxyEnvWith(
     } else {
       const found = readWindowsSystemProxy(auto.reader, auto.platform);
       if (found.kind === "proxy") {
-        console.log(`[opencodex] proxy "auto": using Windows system proxy ${describeProxyForLog(found.url)}`);
-        proxy = found.url;
+        const origins = [
+          found.httpUrl && `HTTP ${describeProxyForLog(found.httpUrl)}`,
+          found.httpsUrl && `HTTPS ${describeProxyForLog(found.httpsUrl)}`,
+        ].filter(Boolean).join(", ");
+        console.log(`[opencodex] proxy "auto": using Windows system proxy ${origins}`);
+        if (found.httpUrl) process.env.HTTP_PROXY = found.httpUrl;
+        if (found.httpsUrl) process.env.HTTPS_PROXY = found.httpsUrl;
+        proxy = undefined;
       } else {
         const reason = found.kind === "unsupported"
           ? "only Windows system proxy discovery is supported; using direct egress on this OS"
@@ -151,8 +165,18 @@ export function applyProxyEnvWith(
     }
   }
   if (proxy) {
-  if (!process.env.HTTP_PROXY?.trim() && !process.env.http_proxy?.trim()) process.env.HTTP_PROXY = proxy;
-  if (!process.env.HTTPS_PROXY?.trim() && !process.env.https_proxy?.trim()) process.env.HTTPS_PROXY = proxy;
+    if (/^socks/i.test(proxy.trim()) && !/^socks5h?:\/\//i.test(proxy.trim())) {
+      throw new Error("Only SOCKS5 proxy URLs are supported; use socks5://host:port");
+    }
+    if (/^socks5h?:\/\//i.test(proxy.trim())) {
+      for (const key of ["HTTP_PROXY", "HTTPS_PROXY", "http_proxy", "https_proxy", "ALL_PROXY", "all_proxy"] as const) {
+        delete process.env[key];
+      }
+      process.env.ALL_PROXY = proxy;
+    } else {
+      if (!process.env.HTTP_PROXY?.trim() && !process.env.http_proxy?.trim()) process.env.HTTP_PROXY = proxy;
+      if (!process.env.HTTPS_PROXY?.trim() && !process.env.https_proxy?.trim()) process.env.HTTPS_PROXY = proxy;
+    }
   }
   const existing = process.env.NO_PROXY ?? process.env.no_proxy ?? "";
   const entries = existing.split(",").map(s => s.trim()).filter(Boolean);
@@ -184,5 +208,5 @@ export function applyProxyEnvWith(
     }
   }
   process.env.NO_PROXY = entries.join(",");
+  configureSocks5Fetch();
 }
-

package/src/config/schema/compaction-triggers.ts

@@ -0,0 +1,11 @@
+/**
+ * The `compaction.trigger` values Codex labels a compaction turn with (`CompactionTrigger`
+ * in codex-rs: a manual `/compact` versus automatic compaction). `compactionRouting.triggers`
+ * selects which of them an override applies to.
+ *
+ * This is its own leaf module and imports nothing on purpose. The request path reads it from
+ * `src/server/responses/compaction-routing.ts`; importing `leaf-validators.ts` there instead
+ * closes a cycle with `config-schema.ts` that survives typecheck and then fails at run time
+ * with "Cannot access 'runtimeRoleSchema' before initialization".
+ */
+export const COMPACTION_TRIGGERS = ["manual", "auto"] as const;

package/src/config/schema/config-schema.ts

@@ -13,6 +13,7 @@ import {
   quotaResetNotifySchema,
   remoteGuiConfigSchema,
   runtimeRoleSchema,
+  spendSchema,
   configuredCodexPoolAccountIds,
   apiKeyEntrySchema,
   asideProfileSyncSchema,
@@ -20,6 +21,7 @@ import {
   CODEX_ACCOUNT_NAMESPACE_ACCOUNT_ID_COLLISION_ERROR,
   codexAccountNamespacesSchema,
   modelPinnedEffortsSchema,
+  compactionRoutingSchema,
   modelPreferHostedToolsConfigError,
   providerModelCostsConfigError,
   providerRelativeSendPathConfigError,
@@ -72,6 +74,8 @@ export const configSchema = z.object({
   // A malformed privacy block must never be read as "unmask": .catch(undefined) drops it and
   // emailMaskingEnabled then falls back to masked, which is also what an absent block means.
   privacy: z.object({ maskEmails: z.boolean().optional() }).strict().optional().catch(undefined),
+  // Malformed hand edits disable this opt-in exporter. Live writes reject them in diagnostics.ts.
+  metricsExport: z.object({ enabled: z.boolean().optional() }).strict().optional().catch(undefined),
   // A malformed present client block must remain diagnosable from raw config and
   // fail closed through src/client/state.ts; unrelated provider state still loads.
   client: clientConnectionSchema.optional().catch(undefined),
@@ -124,6 +128,7 @@ export const configSchema = z.object({
   ]).optional().catch(undefined),
   providers: z.record(z.string(), providerConfigSchema),
   modelPinnedEfforts: modelPinnedEffortsSchema.optional(),
+  compactionRouting: compactionRoutingSchema.optional().catch(undefined),
   defaultProvider: z.string().min(1).default("openai"),
   defaultModelAliases: z.boolean().optional(),
   // Malformed hand edits disable this opt-in projection without rejecting providers.
@@ -166,6 +171,11 @@ export const configSchema = z.object({
   quotaResetNotify: quotaResetNotifySchema.optional().catch(undefined),
   // Same rationale: a bad auto-refresh section must not cost the operator their providers.
   catalogAutoRefresh: catalogAutoRefreshSchema.optional().catch(undefined),
+  // Same rationale again, with the failure direction stated: a malformed spend section
+  // degrades to "no ceiling", which means observe-only accounting rather than an outage. That
+  // is the safe degrade for traffic and the dangerous one for the operator, so the write path
+  // rejects it and loadConfig warns -- the same pair codexPool uses below.
+  spend: spendSchema.optional().catch(undefined),
   // These selections pre-date schema validation and used to pass through as
   // unknown fields. Invalid hand edits must disable only the optional
   // delegation/native-default feature, not reject the whole config and hide
@@ -182,6 +192,10 @@ export const configSchema = z.object({
   codexShimAutoRestore: z.boolean().optional(),
   codexDesktopAuthless: z.boolean().optional().catch(undefined),
   codexClientCompaction: z.boolean().optional().catch(undefined),
+  // Presentation-only label for the injected provider. A malformed value degrades to undefined
+  // and the default label is emitted, rather than failing the parse or writing a config Codex
+  // would refuse to load — the provider id routing depends on is never derived from it.
+  codexProviderDisplayName: z.string().trim().min(1).max(128).optional().catch(undefined),
   pausedCodexAccountIds: z.array(z.string().regex(/^[a-zA-Z0-9._-]{1,64}$/)).optional(),
   // A malformed policy degrades to "no policy" rather than failing the parse, so a hand-edited
   // typo cannot trip the backup-and-defaults repair path and wipe providers or pool accounts.
@@ -464,6 +478,17 @@ export const configSchema = z.object({
         message: reasoningSummariesError,
       });
     }
+    const suppressSyntheticMaxError = booleanRecordConfigError(
+      (provider as { modelSuppressSyntheticMax?: unknown }).modelSuppressSyntheticMax,
+      "modelSuppressSyntheticMax",
+    );
+    if (suppressSyntheticMaxError) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["providers", redactSecretString(name), "modelSuppressSyntheticMax"],
+        message: suppressSyntheticMaxError,
+      });
+    }
     const verbositySupportError = booleanRecordConfigError(
       (provider as { modelSupportsVerbosity?: unknown }).modelSupportsVerbosity,
       "modelSupportsVerbosity",

package/src/config/schema/leaf-validators.ts

@@ -32,14 +32,27 @@ import { getProviderRegistryEntry, providerMatchesRegistryTransport, providerMod
 import { resolveOpenAiVirtualModel } from "../../providers/openai-virtual-models";
 import { COST4_RATE_KEYS, isValidCost4Rate } from "../../usage/user-cost-overlays";
 import { MAX_COST4_RATE } from "../../usage/expected-prices";
-import { isHostedToolUnsupportedForModel } from "../../responses/hosted-tool-policy";
+import {
+  DECLARABLE_HOSTED_TOOL_TYPES,
+  declaredUnsupportedHostedTools,
+  isHostedToolUnsupportedForModel,
+} from "../../responses/hosted-tool-policy";
 import { getConfigDir } from "../paths";
+import { COMPACTION_TRIGGERS } from "./compaction-triggers";
 
 /** One definition of "usable secret", shared by the schema and the warnings. */
 export function isUsableApiKeySecret(value: unknown): value is string {
   return typeof value === "string" && value.length > 0 && value === value.trim();
 }
 
+export const compactionRoutingSchema = z.object({
+  model: z.string().trim().min(1),
+  reasoningEffort: z.string().refine(value => pinnedReasoningEffortConfigError(value) === null).optional(),
+  triggers: z.array(z.enum(COMPACTION_TRIGGERS)).nonempty()
+    .refine(values => new Set(values).size === values.length, "triggers must not repeat a value")
+    .optional(),
+}).strict();
+
 /**
  * Bounds for the opt-in same-target 429 wait-and-retry policy. Single source of truth
  * shared by the config schema, the load-time sanitizer, and the management write
@@ -248,7 +261,10 @@ export const providerConfigSchema = z.object({
   fastWire: fastWireSchema.nullable().optional(),
   supportsServiceTier: z.boolean().optional(),
   modelSupportsServiceTier: z.record(z.string().min(1), z.boolean()).optional(),
+  modelSuppressSyntheticMax: z.record(z.string().min(1), z.boolean()).optional(),
   preserveResponsesReasoningContent: z.boolean().optional(),
+  dropResponsesReasoningItems: z.boolean().optional(),
+  modelReasoningEffortsAuthoritative: z.boolean().optional(),
   decodesNativeCompactionBlobs: z.boolean().optional(),
   allowEncryptedV2AgentTasks: z.boolean().optional(),
   allowPrivateNetwork: z.boolean().optional(),
@@ -263,6 +279,7 @@ export const providerConfigSchema = z.object({
   // canonical ChatGPT backend WS selection is independent of this flag.
   upstreamWebsocket: z.boolean().optional(),
   directGeminiWireRenames: z.boolean().optional(),
+  googleToolSchemaPolicy: z.enum(["compatible", "reject-lossy"]).optional(),
   noStructuredOutputModels: z.array(z.string().min(1))
     .transform(normalizeNonBlankStringArray)
     .optional(),
@@ -275,6 +292,18 @@ export const providerConfigSchema = z.object({
   omitReasoningEffortWithToolsModels: z.array(z.string().min(1))
     .transform(normalizeNonBlankStringArray)
     .optional(),
+  // Validated against a closed vocabulary rather than accepted as free strings. This
+  // schema ends in `.passthrough()`, so a misspelled `web_serch` would otherwise be
+  // accepted, persisted, and strip nothing -- leaving the operator with the upstream 400
+  // the field was set to prevent, and no message saying why (the `codexToolMode` lesson,
+  // #2106).
+  unsupportedHostedTools: z.array(z.string().min(1))
+    .transform(normalizeNonBlankStringArray)
+    .refine(
+      tools => tools.every(tool => DECLARABLE_HOSTED_TOOL_TYPES.has(tool)),
+      { message: `unsupportedHostedTools accepts only hosted tool types: ${[...DECLARABLE_HOSTED_TOOL_TYPES].join(", ")}` },
+    )
+    .optional(),
   retryOn429: retryOn429PolicySchema.optional(),
   transientRetryOn5xx: transientRetryOn5xxPolicySchema.optional(),
   codexAccountMode: z.enum(["pool", "direct"]).optional(),
@@ -300,21 +329,7 @@ export const providerConfigSchema = z.object({
 }).passthrough();
 
 
-/**
- * Shared shape check for the two relative send-path overrides. `field` names the
- * offending key so the message stays specific to what the user actually wrote.
- */
-export function providerRelativeSendPathConfigError(field: string, value: string | undefined): string | null {
-  if (value === undefined) return null;
-  if (/^[A-Za-z][A-Za-z0-9+.-]*:/.test(value) || value.includes("://")) {
-    return `${field} must be a relative path without a URL scheme`;
-  }
-  if (!value.startsWith("/")) return `${field} must start with /`;
-  if (value.includes("?") || value.includes("#")) {
-    return `${field} must not include query strings or fragments`;
-  }
-  return null;
-}
+export { providerRelativeSendPathConfigError } from "../provider-relative-send-path";
 
 /**
  * Validate `providers.<name>.modelCosts`: a plain object keyed by exact model
@@ -391,7 +406,13 @@ export function modelPreferHostedToolsConfigError(
   value: unknown,
   field: string,
   providerName: string,
-  provider: { adapter?: unknown; authMode?: unknown; modelAdapters?: unknown; baseUrl?: unknown },
+  provider: {
+    adapter?: unknown;
+    authMode?: unknown;
+    modelAdapters?: unknown;
+    baseUrl?: unknown;
+    unsupportedHostedTools?: unknown;
+  },
 ): string | null {
   if (value === undefined) return null;
   if (!value || typeof value !== "object" || Array.isArray(value)) return `${field} must be a plain object`;
@@ -399,6 +420,12 @@ export function modelPreferHostedToolsConfigError(
   if (prototype !== Object.prototype && prototype !== null) return `${field} must be a plain object with own properties`;
   const entries = Object.entries(value);
   const registry = getProviderRegistryEntry(providerName);
+  // A provider that denies a hosted tool cannot also prefer it. Both keys are
+  // provider-owned capability statements about the same tool, and the denial wins at
+  // request time, so accepting the pair would silently ignore the preference.
+  const declaredUnsupported = declaredUnsupportedHostedTools(
+    provider as { unsupportedHostedTools?: readonly string[] },
+  );
   // Effective transport: a `preserveCustomDestination` registry row reused under a
   // different endpoint keeps its own adapter AND its own auth at runtime, because
   // `routedProviderConfig()` honors `providerMatchesRegistryTransport()`. Both the
@@ -459,6 +486,9 @@ export function modelPreferHostedToolsConfigError(
       if (typeof tool !== "string" || !SUPPORTED_PREFERRED_HOSTED_TOOLS.has(tool)) {
         return `${field}.${key} supports only image_generation`;
       }
+      if (declaredUnsupported.has(tool)) {
+        return `${field}.${key} cannot prefer ${tool}: unsupportedHostedTools declares it unsupported`;
+      }
       if (isHostedToolUnsupportedForModel(key, tool)) {
         return `${field}.${key} cannot prefer ${tool}: the model does not support it`;
       }
@@ -854,3 +884,32 @@ export const catalogAutoRefreshSchema = z.object({
   enabled: z.boolean().optional(),
   intervalMinutes: z.number().int().min(0).max(1440).optional(),
 }).strict();
+
+/**
+ * One spend scope's ceiling.
+ *
+ * `.strict()` for the usual reason and one sharper one. Elsewhere a silently ignored key
+ * leaves a feature off that the operator believed was on; here it leaves a BUDGET off, and a
+ * budget nobody is enforcing looks exactly like a budget nobody has exceeded. That is #2106 --
+ * an undeclared option accepted, persisted, and then read as its default -- aimed at spend.
+ *
+ * Only positive integers: 0 would read as "no tokens at all" and refuse every request under
+ * the scope, which is never what writing a budget means. An operator who wants no ceiling
+ * removes the key.
+ */
+const spendScopeSchema = z.object({
+  maxTokens: z.number().int().positive().optional(),
+}).strict();
+
+/**
+ * Durable spend ceilings (#4546).
+ *
+ * Absent, empty, and all-scopes-absent are the same thing: observe-only accounting. There is
+ * no default ceiling anywhere in this section, deliberately.
+ */
+export const spendSchema = z.object({
+  root: spendScopeSchema.optional(),
+  identity: spendScopeSchema.optional(),
+  pool: spendScopeSchema.optional(),
+  retentionDays: z.number().int().min(1).max(365).optional(),
+}).strict();

package/src/config.ts

@@ -170,7 +170,7 @@ import {
   sanitizeModelCostsForLoad,
   sanitizeCapabilityDeclarationsForLoad,
   warnInheritedFastWireConflicts,
-  warnDegradedStreamMode,
+  warnDegradedTopLevelOptIns,
   warnDegradedHostname,
   warnDegradedListeners,
   warnDegradedApiKeys,
@@ -227,7 +227,7 @@ export function loadConfig(): OcxConfig {
     if (result.success) {
       const config = normalizeApiKeyIds(result.data as OcxConfig);
       warnInheritedFastWireConflicts(configPath, config);
-      warnDegradedStreamMode(parsed, config);
+      warnDegradedTopLevelOptIns(parsed, config);
       warnDegradedHostname(parsed, config);
       warnDegradedListeners(parsed, config);
       warnDegradedApiKeys(parsed, config);