@bitkyc08/opencodex 2.69.0 → 2.70.0

package/src/codex/low-quota-protection.ts

@@ -0,0 +1,272 @@
+import type { OcxConfig } from "../types";
+import { isSelectableCodexPoolAccount } from "./account-id";
+import { isCodexAccountPaused, setCodexAccountPaused } from "./account-pause";
+import { createLowQuotaEventLedger, type LowQuotaEvent } from "./low-quota-events";
+import { registerLowQuotaObserver } from "./low-quota-observer";
+import { resetAtToMs } from "./quota-types";
+
+type Window = "short" | "weekly";
+type Notice = { window: Window; percentUsed: number; threshold: number };
+type Dependencies = {
+  persist?: (config: OcxConfig) => void | Promise<void>;
+  notify?: (notice: Notice) => void | Promise<void>;
+};
+type EventBase = Omit<LowQuotaEvent, "timestamp" | "status" | "delivery">;
+type Episode = { reset: string; notice: "in-flight" | "logged" | "delivered" | "failed" | undefined; pausedByUs: boolean; noticeBase?: EventBase };
+export type LowQuotaRegistration = (() => void) & {
+  hasPendingSave(): boolean;
+  flush(): Promise<void>;
+  listEvents(limit?: number): LowQuotaEvent[];
+};
+
+const RETRY_DELAYS_MS = [100, 250];
+const FLUSH_DEADLINE_MS = 500;
+
+/** Each server owns its own policy, episode state and deferred writer. */
+export function registerCodexLowQuotaProtection(config: OcxConfig, deps: Dependencies = {}): LowQuotaRegistration {
+  const episodes = new Map<string, Episode>();
+  const autoPausedAccounts = new Set<string>();
+  const ledger = createLowQuotaEventLedger();
+  let policyKey: string | undefined;
+  let closed = false;
+  let generation = 0;
+  let dirty = false;
+  let attempts = 0;
+  let retryDelay: number | undefined;
+  let saveFlight: Promise<void> | null = null;
+  let activeSave: { events: Map<string, EventBase>; started: boolean; settled: boolean } | null = null;
+  let saveTimer: ReturnType<typeof setTimeout> | null = null;
+  const pendingPauseEvents = new Map<string, EventBase>();
+  const pauseStatus = new WeakMap<EventBase, LowQuotaEvent["status"]>();
+
+  function event(base: EventBase,
+    delivery: LowQuotaEvent["delivery"], status: LowQuotaEvent["status"]): void {
+    if (delivery === "pause-save") pauseStatus.set(base, status);
+    ledger.publish({ ...base, delivery, status, timestamp: Date.now() });
+  }
+  function cancelTimer(): void {
+    if (saveTimer) clearTimeout(saveTimer);
+    saveTimer = null;
+  }
+  function scheduleSave(delay = 0): void {
+    if (closed || saveTimer || saveFlight) return;
+    const ownerGeneration = generation;
+    saveTimer = setTimeout(() => {
+      saveTimer = null;
+      if (closed || ownerGeneration !== generation) {
+        for (const base of pendingPauseEvents.values()) {
+          if (pauseStatus.get(base) === "pending") event(base, "pause-save", "cancelled");
+        }
+        return;
+      }
+      void runSave();
+    }, delay);
+    saveTimer.unref?.();
+  }
+  function runSave(): Promise<void> {
+    if (closed || !dirty) return saveFlight ?? Promise.resolve();
+    if (saveFlight) return saveFlight;
+    cancelTimer();
+    const ownerGeneration = generation;
+    const saving = new Map(pendingPauseEvents);
+    const flightState = { events: saving, started: false, settled: false };
+    activeSave = flightState;
+    dirty = false;
+    saveFlight = Promise.resolve().then(async () => {
+      if (closed || ownerGeneration !== generation) {
+        return;
+      }
+      if (deps.persist) {
+        flightState.started = true;
+        return deps.persist(config);
+      }
+      // Import only for an actual deferred save, then recheck ownership: an import
+      // that resolves after a timed-out flush must not start a late config write.
+      const { saveConfigPreservingClaudeCode } = await import("../config/live-reconcile");
+      if (closed || ownerGeneration !== generation) {
+        return;
+      }
+      flightState.started = true;
+      saveConfigPreservingClaudeCode(config);
+    }).then(() => {
+      flightState.settled = true;
+      if (flightState.started) {
+        attempts = 0;
+        for (const [key, base] of saving) {
+          event(base, "pause-save", isCodexAccountPaused(config, base.accountId) ? "succeeded" : "cancelled");
+          if (pendingPauseEvents.get(key) === base) pendingPauseEvents.delete(key);
+        }
+      }
+    }, () => {
+      flightState.settled = true;
+      if (flightState.started || !closed) {
+        for (const base of saving.values()) event(base, "pause-save", "failed");
+      }
+      if (flightState.started) {
+        for (const [key, base] of saving) {
+          if (pendingPauseEvents.get(key) === base && closed) pendingPauseEvents.delete(key);
+        }
+      }
+      if (closed || ownerGeneration !== generation) return;
+      console.warn("[codex-low-quota] pause persistence failed");
+      dirty = true;
+      retryDelay = RETRY_DELAYS_MS[attempts++];
+    }).finally(() => {
+      if (activeSave === flightState) activeSave = null;
+      saveFlight = null;
+      if (dirty && !closed) {
+        if (retryDelay !== undefined) scheduleSave(retryDelay);
+        else if (attempts === 0) scheduleSave();
+        retryDelay = undefined;
+      }
+    });
+    return saveFlight;
+  }
+  function close(): void {
+    if (closed) return;
+    closed = true;
+    generation++;
+    cancelTimer();
+    for (const [key, base] of pendingPauseEvents) {
+      if (activeSave?.started && activeSave.events.get(key) === base) continue;
+      if (pauseStatus.get(base) === "pending") event(base, "pause-save", "cancelled");
+      pendingPauseEvents.delete(key);
+    }
+    for (const episode of episodes.values()) {
+      if (episode.notice === "in-flight" && episode.noticeBase) event(episode.noticeBase, "notice", "cancelled");
+    }
+    dirty = false;
+    autoPausedAccounts.clear();
+    unregister();
+  }
+  async function flush(): Promise<void> {
+    if (closed) return;
+    const deadline = Date.now() + FLUSH_DEADLINE_MS;
+    // Drain the in-flight write and any coalesced save before closing the owner.
+    while (saveFlight || dirty) {
+      cancelTimer();
+      const flight = saveFlight ?? runSave();
+      let timeout: ReturnType<typeof setTimeout> | undefined;
+      const completed = await Promise.race([
+        flight.then(() => true),
+        new Promise<false>(resolve => {
+          timeout = setTimeout(() => resolve(false), Math.max(0, deadline - Date.now()));
+        }),
+      ]);
+      if (timeout) clearTimeout(timeout);
+      if (!completed || Date.now() >= deadline) {
+        const inFlight = activeSave;
+        const stillRunning = inFlight !== null && inFlight.started && !inFlight.settled;
+        if (inFlight && stillRunning) {
+          for (const base of inFlight.events.values()) event(base, "pause-save", "pending");
+        }
+        console.warn(stillRunning
+          ? "[codex-low-quota] pause persistence flush timed out; in-flight save remains pending"
+          : "[codex-low-quota] pause persistence flush reached its deadline");
+        break;
+      }
+      if (attempts > RETRY_DELAYS_MS.length) break;
+    }
+    close();
+  }
+
+  const unregister = registerLowQuotaObserver((accountId, quota) => {
+    if (closed) return;
+    const policy = config.codexPool?.lowQuotaProtection;
+    const nextKey = JSON.stringify(policy);
+    if (policyKey !== nextKey) {
+      for (const episode of episodes.values()) {
+        if (episode.notice === "in-flight" && episode.noticeBase) event(episode.noticeBase, "notice", "cancelled");
+      }
+      episodes.clear();
+      autoPausedAccounts.clear();
+      policyKey = nextKey;
+    }
+    if (!policy?.enabled) return;
+    const liveIds = new Set((config.codexAccounts ?? []).filter(isSelectableCodexPoolAccount).map(account => account.id));
+    for (const id of autoPausedAccounts) if (!liveIds.has(id)) autoPausedAccounts.delete(id);
+    for (const [key, episode] of episodes) {
+      if (liveIds.has(key.split("\u0000")[0]!)) continue;
+      if (episode.notice === "in-flight" && episode.noticeBase) event(episode.noticeBase, "notice", "cancelled");
+      episodes.delete(key);
+    }
+    if (!liveIds.has(accountId)) return;
+    // A manual resume ends this policy's active pause, but each already-high
+    // window keeps its episode marker until recovery or a new reset.
+    if (!isCodexAccountPaused(config, accountId)) autoPausedAccounts.delete(accountId);
+    for (const window of ["short", "weekly"] as const) {
+      if (!policy.windows[window]) continue;
+      const percentUsed = quota[`${window}Percent`];
+      const rawReset = quota[`${window}ResetAt`];
+      if (typeof percentUsed !== "number" || !Number.isFinite(percentUsed) || percentUsed < 0 || percentUsed > 100) continue;
+      if (rawReset !== undefined && (!Number.isFinite(rawReset) || resetAtToMs(rawReset) <= Date.now())) continue;
+      const key = `${accountId}\u0000${window}`;
+      if (percentUsed < policy.threshold) {
+        const prior = episodes.get(key);
+        if (prior?.notice === "in-flight" && prior.noticeBase) event(prior.noticeBase, "notice", "cancelled");
+        episodes.delete(key);
+        continue;
+      }
+      const resetAt = rawReset === undefined ? null : resetAtToMs(rawReset);
+      const reset = resetAt === null ? "unknown" : String(resetAt);
+      let episode = episodes.get(key);
+      if (!episode || episode.reset !== reset) {
+        episode = { reset, notice: undefined, pausedByUs: false };
+        episodes.set(key, episode);
+      }
+      const base = { accountId, window, percentUsed, resetAt };
+      if (autoPausedAccounts.has(accountId) && isCodexAccountPaused(config, accountId)) {
+        episode.pausedByUs = true;
+      }
+      if (dirty && attempts > RETRY_DELAYS_MS.length) {
+        attempts = 0;
+        scheduleSave();
+      }
+      if (policy.actions.pause && !isCodexAccountPaused(config, accountId) && !episode.pausedByUs) {
+        setCodexAccountPaused(config, accountId, true);
+        autoPausedAccounts.add(accountId);
+        episode.pausedByUs = true;
+        pendingPauseEvents.set(key, base);
+        dirty = true;
+        attempts = 0;
+        retryDelay = undefined;
+        event(base, "pause-save", "pending");
+        scheduleSave();
+      }
+      // A manual resume leaves pausedByUs set until recovery or a new reset episode.
+      if (policy.actions.notify && episode.notice !== "in-flight" && episode.notice !== "logged" && episode.notice !== "delivered") {
+        console.warn(`[codex-low-quota] ${window === "short" ? "5-hour" : "weekly"} quota reached ${percentUsed}% used (threshold ${policy.threshold}%)`);
+        if (!deps.notify) {
+          event(base, "notice", "logged");
+          episode.notice = "logged";
+          continue;
+        }
+        episode.notice = "in-flight";
+        episode.noticeBase = base;
+        event(base, "notice", "pending");
+        try {
+          void Promise.resolve(deps.notify({ window, percentUsed, threshold: policy.threshold })).then(() => {
+            if (closed || episodes.get(key) !== episode) return;
+            event(base, "notice", "delivered");
+            episode.notice = "delivered";
+            episode.noticeBase = undefined;
+          }, () => {
+            if (closed || episodes.get(key) !== episode) return;
+            event(base, "notice", "failed");
+            episode.notice = "failed";
+            episode.noticeBase = undefined;
+          });
+        } catch {
+          event(base, "notice", "failed");
+          episode.notice = "failed";
+          episode.noticeBase = undefined;
+        }
+      }
+    }
+  });
+  return Object.assign(close, {
+    hasPendingSave: () => dirty || saveFlight !== null || saveTimer !== null,
+    flush,
+    listEvents: ledger.list,
+  });
+}

package/src/codex/quota-query-backoff.ts

@@ -0,0 +1,148 @@
+import { getConfigDir } from "../config/paths";
+import { parseRetryAfterMs } from "./routing/cooldown-math";
+
+const BASE_DELAY_MS = 5 * 60_000;
+const MAX_DELAY_MS = 60 * 60_000;
+const MAX_ENTRIES = 256;
+
+/** One capped schedule for failed queries and successful-but-blocked recovery. */
+export function nextQuotaQueryDelay(previous = BASE_DELAY_MS / 2): number {
+  return Math.min(previous * 2, MAX_DELAY_MS);
+}
+
+type Attempt = { delay: number; after: number; retryAfterUntil?: number; poolAccountId?: string; inFlight: boolean; pending?: Promise<unknown>; resolve?: (result: unknown) => void };
+// Keys contain configuration-home and caller-owned generation identifiers, never credentials.
+const attempts = new Map<string, Attempt>();
+const sharedDeadlines = new Map<string, { after: number; retryAfterUntil: number; poolAccountId?: string }>();
+const scopedKey = (key: string) => `${getConfigDir()}\0${key}`;
+const baseQueryKey = (key: string) => key.replace(/:post-reset:\d+$/, "");
+
+/** The next eligible query time for the current home and credential generation. */
+export function nextCodexUsageQueryAt(key: string): number | undefined {
+  const scoped = scopedKey(key);
+  const base = scopedKey(baseQueryKey(key));
+  return Math.max(attempts.get(scoped)?.after ?? 0, attempts.get(base)?.after ?? 0,
+    sharedDeadlines.get(base)?.after ?? 0) || undefined;
+}
+
+export interface CodexUsageOwner<T> {
+  kind: "owner";
+  response: Response;
+  /** Publish the parsed result to same-key joiners after validation and publication. */
+  settle(usable: boolean, result?: T): void;
+}
+export type CodexUsageRead<T> = CodexUsageOwner<T> | { kind: "joined"; result: T };
+
+export interface CodexUsageSchedule {
+  /** Same credential deadline for an epoch-specific dispatch key. */
+  pacingKey?: string;
+  /** Direct/non-pool main reads retain their original uncached dispatch behavior. */
+  unpaced?: true;
+  /** Opaque pool identity for removal cleanup; never logged or persisted. */
+  poolAccountId?: string;
+  /** Recovery claims already have their own five-minute admission interval. */
+  recoveryProbe?: true;
+  /** The sweep's clock also drives its quota-query deadline. */
+  now?: () => number;
+}
+
+/** Removal invalidates even active reads, so their late settlements cannot restore pacing. */
+export function pruneRemovedCodexPoolUsageAccounts(configuredIds: ReadonlySet<string>): void {
+  const homePrefix = `${getConfigDir()}\0`;
+  for (const [key, attempt] of attempts) {
+    if (key.startsWith(homePrefix) && attempt.poolAccountId
+      && !configuredIds.has(attempt.poolAccountId)) attempts.delete(key);
+  }
+  for (const [key, deadline] of sharedDeadlines) {
+    if (key.startsWith(homePrefix) && deadline.poolAccountId
+      && !configuredIds.has(deadline.poolAccountId)) sharedDeadlines.delete(key);
+  }
+}
+
+/** Shared by main, pool and 401-replay usage reads. Cache bypass does not bypass pacing. */
+export async function fetchCodexUsage<T>(
+  key: string,
+  init: RequestInit,
+  onDispatch?: () => void,
+  schedule: CodexUsageSchedule = {},
+): Promise<CodexUsageRead<T> | null> {
+  if (schedule.unpaced) {
+    onDispatch?.();
+    const response = await fetch("https://chatgpt.com/backend-api/wham/usage", init);
+    return { kind: "owner", response, settle: () => {} };
+  }
+  const pacingKey = scopedKey(schedule.pacingKey ?? baseQueryKey(key));
+  key = scopedKey(key);
+  const previous = attempts.get(key);
+  if (previous?.inFlight) {
+    const result = (await previous.pending) as T | undefined;
+    return result === undefined ? null : { kind: "joined", result };
+  }
+  const now = schedule.now ?? Date.now;
+  const base = attempts.get(pacingKey);
+  const shared = sharedDeadlines.get(pacingKey);
+  if (schedule.recoveryProbe
+    ? Math.max(previous?.retryAfterUntil ?? 0, base?.retryAfterUntil ?? 0,
+      shared?.retryAfterUntil ?? 0) > now()
+    : Math.max(previous?.after ?? 0, base?.after ?? 0, shared?.after ?? 0) > now()) return null;
+  if (!previous && attempts.size >= MAX_ENTRIES) {
+    const evict = [...attempts].find(([, entry]) => !entry.inFlight)?.[0];
+    if (!evict) return null;
+    attempts.delete(evict);
+  }
+  let resolve!: (result: unknown) => void;
+  const pending = new Promise<unknown>(done => { resolve = done; });
+  const attempt: Attempt = { delay: previous?.delay ?? BASE_DELAY_MS / 2, after: 0,
+    ...(schedule.poolAccountId ? { poolAccountId: schedule.poolAccountId } : {}),
+    inFlight: true, pending, resolve };
+  attempts.set(key, attempt);
+  let response: Response | undefined;
+  const settle = (usable: boolean, result?: T) => {
+    if (!attempt.inFlight) return;
+    attempt.inFlight = false;
+    if (attempts.get(key) === attempt) {
+      if (usable || response?.status === 401 || response?.status === 403) {
+        attempts.delete(key);
+        if (usable) {
+          sharedDeadlines.delete(pacingKey);
+          if (pacingKey !== key && attempts.get(pacingKey)?.inFlight === false)
+            attempts.delete(pacingKey);
+        }
+      }
+      else {
+        const at = now();
+        const delay = schedule.recoveryProbe ? BASE_DELAY_MS : nextQuotaQueryDelay(previous?.delay);
+        const retryAfter = parseRetryAfterMs(response?.headers.get("retry-after"), at) ?? 0;
+        const settledBase = pacingKey === key ? previous : attempts.get(pacingKey);
+        const settledShared = sharedDeadlines.get(pacingKey);
+        const after = Math.max(previous?.after ?? 0, settledBase?.after ?? 0, settledShared?.after ?? 0,
+          at + Math.max(delay, retryAfter));
+        const retryAfterUntil = Math.max(previous?.retryAfterUntil ?? 0,
+          settledBase?.retryAfterUntil ?? 0, settledShared?.retryAfterUntil ?? 0, at + retryAfter);
+        attempts.set(key, { delay, after,
+          ...(attempt.poolAccountId ? { poolAccountId: attempt.poolAccountId } : {}),
+          ...(retryAfterUntil > 0 ? { retryAfterUntil } : {}), inFlight: false });
+        if (pacingKey !== key) {
+          if (!sharedDeadlines.has(pacingKey) && sharedDeadlines.size >= MAX_ENTRIES)
+            sharedDeadlines.delete(sharedDeadlines.keys().next().value!);
+          sharedDeadlines.set(pacingKey, { after, retryAfterUntil,
+            ...(attempt.poolAccountId ? { poolAccountId: attempt.poolAccountId } : {}) });
+        }
+      }
+    }
+    attempt.resolve?.(result);
+  };
+  try {
+    onDispatch?.();
+    response = await fetch("https://chatgpt.com/backend-api/wham/usage", init);
+    return { kind: "owner", response, settle };
+  } catch (error) {
+    settle(false);
+    throw error;
+  }
+}
+
+export function resetQuotaQueryBackoffForTests(): void {
+  attempts.clear();
+  sharedDeadlines.clear();
+}

package/src/codex/quota.ts

@@ -4,6 +4,7 @@ import { atomicWriteFile, getConfigDir } from "../config";
 import { captureConfigGeneration, type GenerationContext } from "../lib/state-store-sweeper";
 import { isThirtyDayOnlyCodexPlan } from "./plan";
 import { stampCodexQuotaUsageObservation } from "./quota-observation-freshness";
+import { observeCodexLowQuota } from "./low-quota-observer";
 import { MAIN_CODEX_ACCOUNT_ID } from "./account-id";
 import { getObservedMainQuotaIdentityKey, isMainQuotaWriterLive, type MainQuotaWriter } from "./main-account-cache";
 
@@ -276,7 +277,7 @@ function snapshotHasUsage(quota: Omit<StoredAccountQuota, "updatedAt">): boolean
   return snapshotHasWeekly(quota) || snapshotHasMonthly(quota) || snapshotHasShort(quota) || snapshotHasCustom(quota);
 }
 /**
- * Publish parsed display quota and separately validated main-policy evidence after writer checks.
+ * Publish parsed display quota and separately validated policy evidence after writer checks.
  * A null policy observation retains only the matching main identity's previous evidence;
  * transient replacement markers are consumed during merging and never enter stored snapshots.
  */
@@ -285,7 +286,7 @@ export function setAccountQuotaFromParsed(
   quota: Omit<StoredAccountQuota, "updatedAt"> | null,
   writerGeneration = captureConfigGeneration(),
   mainWriter?: MainQuotaWriter,
-  policyQuota: MainPolicyQuotaObservation | null = quota,
+  policyQuota: MainPolicyQuotaObservation | null = accountId === MAIN_CODEX_ACCOUNT_ID ? quota : null,
   historyEvidence?: QuotaObservationEvidence,
 ): void {
   quota = withoutRetiredCodexQuota(quota);
@@ -322,6 +323,7 @@ export function setAccountQuotaFromParsed(
   schedulePersistAccountQuotas();
   // Credits carry the previous usage tuple; they must not refresh its observation clock.
   if (!(quota.resetCredits !== undefined && !snapshotHasUsage(quota))) {
+    if (!isMain && policyQuota) observeCodexLowQuota(accountId, policyQuota);
     notifyCodexQuotaSnapshot(accountId, next);
   }
 }
@@ -650,6 +652,9 @@ export function updateAccountQuota(
   // otherwise bypass detection AND leave a stale baseline that corrupts the next real diff.
   // The credits-only path at setAccountQuotaFromParsed deliberately does not notify; this one
   // writes window percentages and deadlines, so it must.
+  if (accountId !== MAIN_CODEX_ACCOUNT_ID && nextWeekly !== undefined && !isInvalidPolicyUsagePercent(weekly)) observeCodexLowQuota(accountId, {
+    weeklyPercent: nextWeekly, weeklyResetAt: nextWeeklyResetAt,
+  });
   notifyCodexQuotaSnapshot(accountId, quota);
 }
 

package/src/config/diagnostics.ts

@@ -3,7 +3,9 @@ import { lstatSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import * as z from "zod/v4";
 import { compactionRecoveryConfigError } from "./schema/compaction-recovery";
+import { blockedModelRedirectsError } from "./schema/blocked-model-redirects";
 import type { OcxConfig } from "../types";
+import { parseAnthropicModelRoutes } from "../oauth/anthropic-model-routes";
 import { configReasoningPinsConfigError } from "./provider-validation";
 import { loopbackCompanionAllowed } from "../codex/loopback-target";
 import { UPSTREAM_HOST_CIRCUIT_MAX_THRESHOLD } from "../codex/upstream-host-health";
@@ -103,6 +105,7 @@ function validFileConfigDiagnostics(config: OcxConfig, rawParsed: unknown): Conf
   warnings.push(...inheritedFastWireConflictProviderNames(normalized).map(inheritedFastWireConflictWarning));
   warnings.push(...degradedCodexAccountPriorityWarnings(rawParsed, normalized));
   warnings.push(...degradedListenerWarnings(rawParsed, normalized));
+  if (blockedModelRedirectsError(rawParsed)) warnings.push("blockedModelRedirects ignored: expected a map of nonempty model keys to nonempty string targets");
   const quotaAutoRefreshWarning = degradedCodexQuotaAutoRefreshWarning(rawParsed, normalized);
   if (quotaAutoRefreshWarning) warnings.push(quotaAutoRefreshWarning);
   if (rawEffort !== undefined && !isClaudeSubagentEffort(rawEffort)) {
@@ -616,7 +619,13 @@ export function validateConfigCandidate(value: unknown): { ok: true; config: Ocx
   if (memoryModels !== undefined && !memoryModelsSchema.safeParse(memoryModels).success) {
     return { ok: false, error: "schema_invalid: memoryModels: requires a nonblank model and an optional declared reasoningEffort per configured phase, and no other fields" };
   }
-  const boundaryError = compactionRecoveryConfigError(value) ?? configReasoningPinsConfigError(value)
+  const routeValue = (rawConfigRecord(value)?.anthropicAccountPool as Record<string, unknown> | undefined)?.routes;
+  if (routeValue !== undefined) {
+    const parsed = parseAnthropicModelRoutes(routeValue);
+    if (!parsed.ok) return { ok: false, error: `schema_invalid: anthropicAccountPool.routes: ${parsed.error}` };
+  }
+  const boundaryError = blockedModelRedirectsError(value)
+    ?? compactionRecoveryConfigError(value) ?? configReasoningPinsConfigError(value)
     ?? blankHostnameError(value)
     ?? claudeSubagentEffortError(value)
     ?? appOwnedMemoryBudgetError(value)

package/src/config/load-degrade.ts

@@ -1,6 +1,7 @@
 import { chmodSync, existsSync } from "node:fs";
 import { join } from "node:path";
 import { compactionRecoveryConfigError } from "./schema/compaction-recovery";
+import { blockedModelRedirectsError } from "./schema/blocked-model-redirects";
 import {
   modelPinnedEffortsConfigError,
   pinnedReasoningEffortConfigError,
@@ -36,6 +37,7 @@ import {
   remoteGuiConfigSchema,
   retryOn429PolicySchema,
   retryOnResetPolicySchema,
+  transientRetryOn5xxPolicySchema,
   runtimeRoleSchema,
   spendSchema,
 } from "./schema/leaf-validators";
@@ -120,6 +122,7 @@ export function warnDegradedCompactionRouting(rawParsed: unknown, validated: Ocx
  */
 export function warnDegradedTopLevelOptIns(rawParsed: unknown, validated: OcxConfig): void {
   if (compactionRecoveryConfigError(rawParsed)) console.warn("⚠️  invalid compactionRecovery disabled; the original compaction failure is preserved");
+  if (blockedModelRedirectsError(rawParsed)) console.warn("⚠️  invalid blockedModelRedirects ignored; provider routing remains available");
   warnDegradedStreamMode(rawParsed, validated);
   warnDegradedCompactionRouting(rawParsed, validated);
   warnDegradedMemoryModels(rawParsed, validated);
@@ -241,6 +244,20 @@ export function retryOnResetPolicyConfigError(policy: unknown): string | null {
   return strictPolicyConfigError("retryOnReset", retryOnResetPolicySchema, policy);
 }
 
+/**
+ * Management write-boundary validation for `transientRetryOn5xx`, with the same fail-closed
+ * contract as the other retry policies.
+ *
+ * The load-time schema does not degrade a malformed block: `transientRetryOn5xxPolicySchema` has
+ * no `.catch`, so a bad value fails the whole config parse and the loader substitutes the default
+ * config, taking every provider with it. That makes this check the only place a malformed ladder
+ * can be refused without losing the file, and PATCH never runs the schema — only POST does,
+ * through `validateConfigCandidate`.
+ */
+export function transientRetryOn5xxPolicyConfigError(policy: unknown): string | null {
+  return strictPolicyConfigError("transientRetryOn5xx", transientRetryOn5xxPolicySchema, policy);
+}
+
 /**
  * The shared body of both. Written once because the two differ only in the field name they
  * report, and a second hand-copied formatter is a second place for the redaction to be

package/src/config/mutation-lock.ts

@@ -34,8 +34,7 @@ export class ConfigMutationLockError extends Error {
   }
 }
 
-function configMutationDatabasePath(): string {
-  const dir = getConfigDir();
+function configMutationDatabasePath(dir: string = getConfigDir()): string {
   // First statement on purpose: a rejected mutation must leave nothing behind, not a
   // freshly created/chmod'd directory or database. See src/lib/test-home-guard.ts.
   assertNotRealHomeUnderTest(dir);
@@ -102,7 +101,7 @@ let configMutationDatabase: Database | null = null;
  *
  * Reentrancy is limited to the current synchronous call stack; never return a Promise from `fn`.
  */
-export function withConfigMutationLockSync<T>(fn: () => T): T {
+export function withConfigMutationLockSync<T>(fn: () => T, dir?: string): T {
   if (configMutationLockDepth > 0) {
     configMutationLockDepth += 1;
     try {
@@ -111,7 +110,7 @@ export function withConfigMutationLockSync<T>(fn: () => T): T {
       configMutationLockDepth -= 1;
     }
   }
-  const path = configMutationDatabasePath();
+  const path = configMutationDatabasePath(dir);
   let database: Database | undefined;
   let transactionOpen = false;
   try {

package/src/config/process-state.ts

@@ -293,7 +293,7 @@ export function setProcessCommandLinePlatformForTests(next: NodeJS.Platform | nu
   processCommandLinePlatformForTests = next;
 }
 
-function readProcessCommandLine(pid: number): string | undefined {
+export function readProcessCommandLine(pid: number): string | undefined {
   if (!Number.isSafeInteger(pid) || pid <= 0) return undefined;
   const platform = processCommandLinePlatformForTests ?? process.platform;
   try {

package/src/config/provider-validation.ts

@@ -142,6 +142,15 @@ export function apiKeyTransportConfigError(
   return null;
 }
 
+/** Keep local project-file disclosure specific to the Command Code native adapter. */
+export function projectContextConfigError(provider: Pick<OcxProviderConfig, "adapter" | "projectContext">): string | null {
+  if (provider.projectContext === undefined) return null;
+  if (provider.projectContext !== "off" && provider.projectContext !== "on") {
+    return 'projectContext must be "off" or "on"';
+  }
+  return provider.adapter === "command-code" ? null : "projectContext is supported only by the command-code adapter";
+}
+
 /** Shared strict boundary for the per-provider upstream HTTP-version pin. */
 export function upstreamHttpVersionConfigError(value: unknown): string | null {
   if (value === undefined || value === null) return null;
@@ -383,6 +392,19 @@ function capabilityRecord(value: unknown): value is Record<string, unknown> {
     && [Object.prototype, null].includes(Object.getPrototypeOf(value));
 }
 
+/** Strict per-model context-tier values; PATCH accepts null to clear the entire map. */
+export function contextTierRecordConfigError(value: unknown, allowClear = false): string | null {
+  if (value === undefined || (allowClear && value === null)) return null;
+  if (!capabilityRecord(value)) return "modelContextTiers must be a plain object";
+  if (Object.keys(value).length > MODEL_DISCOVERY_MAX_MODELS) return "modelContextTiers has too many models";
+  for (const [id, tier] of Object.entries(value)) {
+    if (!isValidModelDiscoveryModelId(id) || ["__proto__", "prototype", "constructor"].includes(id))
+      return "modelContextTiers keys must be exact non-reserved model ids";
+    if (tier !== "default" && tier !== "long_context") return "modelContextTiers values must be default or long_context";
+  }
+  return null;
+}
+
 /** Strict writes; only PATCH may carry deletion tombstones. Model IDs are exact. */
 export function modelCapabilitiesConfigError(value: unknown, allowTombstones = false): string | null {
   if (value === undefined || (allowTombstones && value === null)) return null;

package/src/config/schema/blocked-model-redirects.ts

@@ -0,0 +1,17 @@
+import * as z from "zod/v4";
+
+/** Keep invalid hand edits out of the live map without losing the rest of config.json. */
+export const blockedModelRedirectsSchema = z.record(
+  z.string().refine(key => key.trim().length > 0),
+  z.string().refine(target => target.trim().length > 0),
+);
+
+/** Candidate writes must reject maps the read schema would silently discard. */
+export function blockedModelRedirectsError(value: unknown): string | undefined {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return undefined;
+  const raw = (value as Record<string, unknown>).blockedModelRedirects;
+  if (raw === undefined) return undefined;
+  return blockedModelRedirectsSchema.safeParse(raw).success
+    ? undefined
+    : "schema_invalid: blockedModelRedirects requires a map of nonempty model keys to nonempty string targets";
+}

package/src/config/schema/config-schema.ts

@@ -1,5 +1,6 @@
 import * as z from "zod/v4";
 import { compactionRecoverySchema } from "./compaction-recovery";
+import { blockedModelRedirectsSchema } from "./blocked-model-redirects";
 import {
   agentTaskRecoverySchema,
   catalogAutoRefreshSchema,
@@ -284,7 +285,9 @@ export const configSchema = z.object({
   // parse: a hand-edited typo must never trip the backup-and-defaults repair
   // path below and wipe providers/pool accounts. Warning emitted in loadConfig.
   streamMode: z.enum(["auto", "legacy-tee", "eager-relay"]).optional().catch(undefined),
-  blockedModelRedirects: z.record(z.string(), z.string()).optional().catch(undefined),
+  blockedModelRedirects: blockedModelRedirectsSchema.optional().catch(undefined),
+  // Preserve malformed hand edits for a local routing error; candidate writes use the shared parser.
+  anthropicAccountPool: z.unknown().optional(),
   // Same degrade-don't-reject rationale as the fields above: a hand-edited
   // non-string must not trip the backup-and-defaults repair path. Unset then
   // takes the canonical sideband path (src/server/live.ts normalizeSidebandRoot).