@bitkyc08/opencodex 2.7.23 → 2.7.24

package/src/config.ts

@@ -1,8 +1,9 @@
 import { execFileSync } from "node:child_process";
-import { copyFileSync, existsSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync, chmodSync } from "node:fs";
+import { copyFileSync, existsSync, linkSync, mkdirSync, readFileSync, renameSync, truncateSync, unlinkSync, writeFileSync, chmodSync } from "node:fs";
 import { homedir } from "node:os";
 import { join, resolve } from "node:path";
 import * as z from "zod/v4";
+import { comboConfigIssues } from "./combos/types";
 import { hardenSecretDir, hardenSecretPath } from "./lib/windows-secret-acl";
 import { providerDestinationConfigError } from "./lib/destination-policy";
 import type { OcxConfig } from "./types";
@@ -42,10 +43,213 @@ export function renameAtomicFile(
  * Write a file atomically (temp + rename) so concurrent writers — e.g. `ocx stop` and the
  * proxy's own shutdown handler both restoring Codex — can never leave a half-written file.
  */
-export function atomicWriteFile(path: string, content: string): void {
+export interface AtomicWriteIO {
+  write: (path: string, content: string) => void;
+  harden: (path: string) => void;
+  rename: (source: string, destination: string) => void;
+  truncate: (path: string) => void;
+  unlink: (path: string) => void;
+}
+
+export class AtomicWriteResidualTempError extends Error {
+  constructor(readonly tempPath: string, readonly hardened = true, options?: ErrorOptions) {
+    super(`Atomic config write left a ${hardened ? "hardened " : ""}zero-byte temporary file`, options);
+    this.name = "AtomicWriteResidualTempError";
+  }
+}
+
+export class AtomicWriteSecretResidualError extends Error {
+  constructor(readonly tempPath: string, options?: ErrorOptions) {
+    super("Atomic config write could not scrub or remove a secret-bearing temporary file", options);
+    this.name = "AtomicWriteSecretResidualError";
+  }
+}
+
+function isMissingPathError(error: unknown): boolean {
+  return (error as NodeJS.ErrnoException | undefined)?.code === "ENOENT";
+}
+
+export function atomicWriteFile(path: string, content: string, io: AtomicWriteIO = {
+  write: (target, value) => writeFileSync(target, value, { encoding: "utf-8", mode: 0o600 }),
+  harden: target => {
+    try { chmodSync(target, 0o600); } catch { /* platform may ignore chmod */ }
+    if (process.platform === "win32") hardenSecretPath(target, { required: true });
+  },
+  rename: renameAtomicFile,
+  truncate: target => truncateSync(target, 0),
+  unlink: unlinkSync,
+}): void {
   const tmp = `${path}.ocx.${process.pid}.${++_atomicSeq}.tmp`;
-  writeFileSync(tmp, content, { encoding: "utf-8", mode: 0o600 });
-  renameAtomicFile(tmp, path);
+  let hardened = false;
+  try {
+    io.write(tmp, content);
+    io.harden(tmp);
+    hardened = true;
+    io.rename(tmp, path);
+  } catch (cause) {
+    let scrubbed = false;
+    try {
+      io.truncate(tmp);
+      scrubbed = true;
+    } catch (error) {
+      if (isMissingPathError(error)) scrubbed = true;
+      else {
+        try { io.write(tmp, ""); scrubbed = true; } catch { /* removal may still succeed */ }
+      }
+    }
+    let removed = false;
+    try {
+      io.unlink(tmp);
+      removed = true;
+    } catch (error) {
+      if (isMissingPathError(error)) removed = true;
+      else {
+        try { io.unlink(tmp); removed = true; }
+        catch (retryError) { if (isMissingPathError(retryError)) removed = true; }
+      }
+    }
+    if (!removed && !scrubbed) throw new AtomicWriteSecretResidualError(tmp, { cause });
+    if (!removed && !hardened) {
+      try { io.harden(tmp); hardened = true; } catch { /* zero-byte residual is reported honestly */ }
+    }
+    if (!removed) throw new AtomicWriteResidualTempError(tmp, hardened, { cause });
+    throw cause;
+  }
+}
+
+export class OpenAiTierBackupCleanupError extends Error {
+  constructor() { super("OpenAI tier backup temporary cleanup failed"); this.name = "OpenAiTierBackupCleanupError"; }
+}
+
+export class OpenAiTierBackupRollbackError extends Error {
+  constructor() { super("OpenAI tier backup rollback failed"); this.name = "OpenAiTierBackupRollbackError"; }
+}
+
+export class OpenAiTierBackupCollisionError extends Error {
+  constructor() { super("Existing OpenAI tier backup differs from the current config"); this.name = "OpenAiTierBackupCollisionError"; }
+}
+
+export class OpenAiTierBackupSecretResidualError extends Error {
+  constructor(readonly tempPath: string, options?: ErrorOptions) {
+    super("OpenAI tier backup could not scrub or remove a secret-bearing temporary file", options);
+    this.name = "OpenAiTierBackupSecretResidualError";
+  }
+}
+
+export interface OpenAiTierBackupIO {
+  exists(path: string): boolean;
+  read(path: string): Uint8Array;
+  createExclusive(path: string): void;
+  write(path: string, bytes: Uint8Array): void;
+  harden(path: string): void;
+  publishNoReplace(temp: string, backup: string): void;
+  truncate(path: string): void;
+  unlink(path: string): void;
+}
+
+function sameBytes(left: Uint8Array, right: Uint8Array): boolean {
+  return left.byteLength === right.byteLength && left.every((value, index) => value === right[index]);
+}
+
+function isAlreadyExistsError(error: unknown): boolean {
+  return (error as NodeJS.ErrnoException | undefined)?.code === "EEXIST";
+}
+
+export function backupConfigBeforeOpenAiTierMigration(
+  configPath = getConfigPath(),
+  io: OpenAiTierBackupIO = {
+    exists: existsSync,
+    read: target => readFileSync(target),
+    createExclusive: target => { writeFileSync(target, new Uint8Array(), { flag: "wx", mode: 0o600 }); },
+    write: (target, bytes) => writeFileSync(target, bytes),
+    harden: target => {
+      try { chmodSync(target, 0o600); } catch { /* platform may ignore chmod */ }
+      if (process.platform === "win32") hardenSecretPath(target, { required: true });
+    },
+    publishNoReplace: (temp, backup) => linkSync(temp, backup),
+    truncate: target => truncateSync(target, 0),
+    unlink: unlinkSync,
+  },
+): "absent" | "created" | "reused" {
+  const source = configPath;
+  if (!io.exists(source)) return "absent";
+  const original = io.read(source);
+  // v2 snapshot path. The historical `.pre-openai-tiers-v1.bak` is read only by restore
+  // docs/fixtures and is never reused or overwritten as the v2 snapshot.
+  const backup = `${source}.pre-openai-tiers-v2.bak`;
+  if (io.exists(backup)) {
+    if (!sameBytes(original, io.read(backup))) throw new OpenAiTierBackupCollisionError();
+    return "reused";
+  }
+  const temp = `${backup}.ocx.${process.pid}.${++_atomicSeq}.tmp`;
+  let published = false;
+  let cleanupAttempted = false;
+
+  const scrubUnpublishedTemp = (): void => {
+    cleanupAttempted = true;
+    if (!io.exists(temp)) return;
+    let scrubbed = false;
+    try {
+      io.truncate(temp);
+      scrubbed = true;
+    } catch (error) {
+      if (isMissingPathError(error)) scrubbed = true;
+      else {
+        try { io.write(temp, new Uint8Array()); scrubbed = true; } catch { /* removal may still succeed */ }
+      }
+    }
+    let removed = false;
+    try {
+      io.unlink(temp);
+      removed = true;
+    } catch (error) {
+      if (isMissingPathError(error) || !io.exists(temp)) removed = true;
+      else {
+        try { io.unlink(temp); removed = true; }
+        catch (retryError) {
+          if (isMissingPathError(retryError) || !io.exists(temp)) removed = true;
+        }
+      }
+    }
+    if (!removed && !scrubbed) throw new OpenAiTierBackupSecretResidualError(temp);
+    if (!removed) throw new OpenAiTierBackupCleanupError();
+  };
+
+  try {
+    io.createExclusive(temp);
+    io.write(temp, original);
+    io.harden(temp);
+    try {
+      io.publishNoReplace(temp, backup);
+    } catch (cause) {
+      if (!isAlreadyExistsError(cause)) throw cause;
+      const winner = io.read(backup);
+      if (!sameBytes(original, winner)) throw new OpenAiTierBackupCollisionError();
+      scrubUnpublishedTemp();
+      return "reused";
+    }
+    published = true;
+    try {
+      io.unlink(temp);
+    } catch {
+      try {
+        io.unlink(temp);
+      } catch {
+        // temp and backup are hard links to the same inode. Roll back the backup
+        // link before any truncation so the downgrade snapshot is never zeroed.
+        try { io.unlink(backup); } catch { throw new OpenAiTierBackupRollbackError(); }
+        published = false;
+        scrubUnpublishedTemp();
+        throw new OpenAiTierBackupCleanupError();
+      }
+    }
+    return "created";
+  } catch (cause) {
+    if (!published && !cleanupAttempted) {
+      scrubUnpublishedTemp();
+    }
+    throw cause;
+  }
 }
 
 /**
@@ -87,6 +291,7 @@ const providerConfigSchema = z.object({
   adapter: z.string().min(1),
   baseUrl: z.string().min(1),
   allowPrivateNetwork: z.boolean().optional(),
+  codexAccountMode: z.enum(["pool", "direct"]).optional(),
 }).passthrough();
 
 const RESERVED_PROVIDER_NAMES = new Set(["__proto__", "prototype", "constructor"]);
@@ -138,10 +343,25 @@ export function providerHeadersConfigError(headers: unknown): string | null {
   return null;
 }
 
+export function positiveIntegerRecordConfigError(value: unknown, field: string): string | null {
+  if (value === undefined) return null;
+  if (!value || typeof value !== "object" || Array.isArray(value)) return `${field} must be a plain object`;
+  const prototype = Object.getPrototypeOf(value);
+  if (prototype !== Object.prototype && prototype !== null) return `${field} must be a plain object with own properties`;
+  for (const [key, entry] of Object.entries(value)) {
+    if (!key.trim()) return `${field} keys must be nonblank model ids`;
+    if (typeof entry !== "number" || !Number.isFinite(entry) || !Number.isInteger(entry) || entry <= 0) {
+      return `${field}.${key} must be a positive finite integer`;
+    }
+  }
+  return null;
+}
+
 const configSchema = z.object({
   port: z.number().int().min(0).max(65535).default(10100),
   providers: z.record(z.string(), providerConfigSchema),
   defaultProvider: z.string().min(1).default("openai"),
+  openaiProviderTierVersion: z.union([z.literal(1), z.literal(2)]).optional(),
   providerContextCaps: z.record(z.string(), z.number().int().positive()).optional(),
   contextCapValue: z.number().int().positive().optional(),
 }).passthrough().superRefine((config, ctx) => {
@@ -154,6 +374,13 @@ const configSchema = z.object({
       });
     }
     const provider = config.providers[name];
+    if (Object.hasOwn(provider, "virtualModels")) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["providers", name, "virtualModels"],
+        message: "virtualModels is registry-only and must not be persisted",
+      });
+    }
     const baseUrlError = providerBaseUrlConfigError(provider.baseUrl);
     if (baseUrlError) {
       ctx.addIssue({
@@ -179,6 +406,33 @@ const configSchema = z.object({
         message: headersError,
       });
     }
+    const maxInputError = positiveIntegerRecordConfigError(
+      (provider as { modelMaxInputTokens?: unknown }).modelMaxInputTokens,
+      "modelMaxInputTokens",
+    );
+    if (maxInputError) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["providers", name, "modelMaxInputTokens"],
+        message: maxInputError,
+      });
+    }
+    if (Object.hasOwn(provider, "codexAccountMode") && provider.codexAccountMode !== undefined) {
+      // Persisted account mode is valid ONLY on the canonical built-in `openai` forward provider.
+      // Old openai-multi rows stay parseable (they never carry a mode) so startup can migrate them.
+      const canonicalOpenAiShape = name === "openai"
+        && provider.adapter === "openai-responses"
+        && (provider as { authMode?: unknown }).authMode === "forward"
+        && typeof provider.baseUrl === "string"
+        && provider.baseUrl.replace(/\/+$/, "") === "https://chatgpt.com/backend-api/codex";
+      if (!canonicalOpenAiShape) {
+        ctx.addIssue({
+          code: "custom",
+          path: ["providers", name, "codexAccountMode"],
+          message: "codexAccountMode is valid only on the canonical built-in openai provider",
+        });
+      }
+    }
   }
   if (!hasOwnProvider(config.providers, config.defaultProvider)) {
     ctx.addIssue({
@@ -187,6 +441,22 @@ const configSchema = z.object({
       message: "defaultProvider must exist in providers",
     });
   }
+  const combos = (config as { combos?: unknown }).combos;
+  if (combos !== undefined) {
+    if (!combos || typeof combos !== "object" || Array.isArray(combos)) {
+      ctx.addIssue({ code: "custom", path: ["combos"], message: "combos must be an object" });
+    } else {
+      for (const [id, raw] of Object.entries(combos as Record<string, unknown>)) {
+        for (const issue of comboConfigIssues(id, raw, config.providers)) {
+          ctx.addIssue({
+            code: "custom",
+            path: ["combos", id, ...issue.path],
+            message: issue.message,
+          });
+        }
+      }
+    }
+  }
 });
 
 /**
@@ -311,14 +581,12 @@ function mergeConfigDefaults(parsed: unknown): unknown {
   return merged;
 }
 
-function configIssuePaths(error: z.ZodError): string[] {
-  const paths = error.issues.map(issue => issue.path.join(".") || "config");
-  return [...new Set(paths)].sort();
-}
-
 function schemaDiagnosticsError(error: z.ZodError): string {
-  const paths = configIssuePaths(error);
-  return paths.length > 0 ? `schema_invalid: ${paths.join(", ")}` : "schema_invalid";
+  const details = error.issues.map(issue => {
+    const path = issue.path.join(".") || "config";
+    return `${path}: ${issue.message}`;
+  });
+  return details.length > 0 ? `schema_invalid: ${details.join("; ")}` : "schema_invalid";
 }
 
 export function readConfigDiagnostics(): ConfigDiagnostics {
@@ -378,6 +646,7 @@ export function getDefaultConfig(): OcxConfig {
         adapter: "openai-responses",
         baseUrl: "https://chatgpt.com/backend-api/codex",
         authMode: "forward",
+        codexAccountMode: "pool",
       },
     },
     defaultProvider: "openai",

package/src/lib/errors.ts

@@ -4,6 +4,59 @@ export interface OcxErrorPayload {
   code: string | null;
 }
 
+function isSubscriptionGateMessage(text: string): boolean {
+  return (
+    text.includes("requires a subscription") ||
+    text.includes("requires subscription") ||
+    text.includes("subscription required") ||
+    text.includes("upgrade for access") ||
+    text.includes("upgrade to pro") ||
+    text.includes("pro subscription") ||
+    text.includes("ollama.com/upgrade") ||
+    (text.includes("upgrade") && text.includes("subscription"))
+  );
+}
+
+function isAuthenticationMessage(text: string): boolean {
+  const accessDeniedWithCredentialCue = (
+    text.includes("access denied") ||
+    text.includes("accessdeniedexception")
+  ) && (
+    text.includes("authentication") ||
+    text.includes("credential") ||
+    text.includes("api key") ||
+    text.includes("token") ||
+    text.includes("signature")
+  );
+  return (
+    text.includes("authentication failed") ||
+    text.includes("authentication") ||
+    text.includes("invalid_api_key") ||
+    text.includes("invalid api key") ||
+    text.includes("invalid token") ||
+    text.includes("unauthorizedexception") ||
+    text.includes("unrecognizedclientexception") ||
+    text.includes("unrecognizedclient") ||
+    text.includes("expired token") ||
+    text.includes("expiredtoken") ||
+    text.includes("unauthenticated") ||
+    text.includes("unauthorized") ||
+    accessDeniedWithCredentialCue
+  );
+}
+
+function isPermissionMessage(text: string): boolean {
+  return (
+    text.includes("permission_denied") ||
+    text.includes("permission denied") ||
+    text.includes("forbidden") ||
+    text.includes("access denied") ||
+    text.includes("accessdeniedexception") ||
+    text.includes("not allowed to use") ||
+    text.includes("model access")
+  );
+}
+
 export function classifyError(status: number, type: string, message: string): OcxErrorPayload {
   const text = message.toLowerCase();
   if (
@@ -40,20 +93,29 @@ export function classifyError(status: number, type: string, message: string): Oc
   if (type === "origin_rejected") {
     return { message, type: "invalid_request_error", code: "origin_rejected" };
   }
+  // HTTP 401 and explicit auth failures are authoritative even when provider text
+  // also advertises an upgrade or subscription.
   if (
     status === 401 ||
-    status === 403 ||
     type === "authentication_error" ||
-    text.includes("authentication failed") ||
-    text.includes("access denied") ||
-    text.includes("unauthorizedexception") ||
-    text.includes("unrecognizedclientexception") ||
-    text.includes("unrecognizedclient") ||
-    text.includes("expired token") ||
-    text.includes("expiredtoken")
+    isAuthenticationMessage(text)
   ) {
     return { message, type: "authentication_error", code: "invalid_api_key" };
   }
+  // Subscription labels are valid only in a known permission context.
+  if (
+    (status === 403 || type === "permission_error") &&
+    isSubscriptionGateMessage(text)
+  ) {
+    return { message, type: "permission_error", code: "subscription_required" };
+  }
+  if (
+    status === 403 ||
+    type === "permission_error" ||
+    isPermissionMessage(text)
+  ) {
+    return { message, type: "permission_error", code: "permission_denied" };
+  }
   if (
     status === 503 ||
     text.includes("overloaded") ||
@@ -111,17 +173,10 @@ export function inferHttpStatusFromAdapterMessage(message: string): number {
     lower.includes("too many requests") ||
     lower.includes("throttling")
   ) return 429;
-  if (
-    lower.includes("unauthenticated") ||
-    lower.includes("unauthorized") ||
-    lower.includes("permission_denied") ||
-    lower.includes("permission denied") ||
-    lower.includes("forbidden") ||
-    lower.includes("invalid token") ||
-    lower.includes("expired token") ||
-    lower.includes("authentication") ||
-    lower.includes("access denied")
-  ) return 401;
+  // Strong authentication signals win when a message contains mixed auth and
+  // subscription/permission wording.
+  if (isAuthenticationMessage(lower)) return 401;
+  if (isSubscriptionGateMessage(lower) || isPermissionMessage(lower)) return 403;
   if (
     lower.includes("unavailable") ||
     lower.includes("overloaded") ||
@@ -156,11 +211,13 @@ export function adapterFailureFromMessage(message: string): { httpStatus: number
     ? "rate_limit_error"
     : httpStatus === 401
       ? "authentication_error"
-      : httpStatus === 503 || httpStatus === 504
-        ? "server_error"
-        : httpStatus === 400
-          ? "invalid_request_error"
-          : "upstream_error";
+      : httpStatus === 403
+        ? "permission_error"
+        : httpStatus === 503 || httpStatus === 504
+          ? "server_error"
+          : httpStatus === 400
+            ? "invalid_request_error"
+            : "upstream_error";
   return {
     httpStatus,
     error: classifyError(httpStatus, errorType, finalMessage),
@@ -176,6 +233,11 @@ export function httpStatusFromTerminalError(error: {
   if (!error) return 502;
   if (error.type === "rate_limit_error" || error.code === "rate_limit_exceeded") return 429;
   if (error.type === "authentication_error" || error.code === "invalid_api_key") return 401;
+  if (
+    error.type === "permission_error" ||
+    error.code === "permission_denied" ||
+    error.code === "subscription_required"
+  ) return 403;
   if (error.type === "insufficient_quota" || error.code === "insufficient_quota") return 429;
   if (error.type === "server_error" && error.code === "server_is_overloaded") return 503;
   if (error.type === "invalid_request_error") return 400;

package/src/lib/upstream-retry.ts

@@ -145,21 +145,25 @@ export interface TransientRetryOptions extends ResetRetryOptions {
   slowAttemptMs?: number;
 }
 
+export type UpstreamSendRecovery = "connection-reset" | "transient-5xx";
+type ReplayableFetch = (recovery?: UpstreamSendRecovery) => Promise<Response>;
+
 /**
  * Run `doFetch`, retrying only connection-reset-shaped rejections (see
  * isConnectionResetError) with jittered backoff. The caller's thunk must be replay-safe
  * (string body); every retry is logged so persistent resets stay visible.
  */
 export async function fetchWithResetRetry(
-  doFetch: () => Promise<Response>,
+  doFetch: ReplayableFetch,
   opts: ResetRetryOptions = {},
+  firstRecovery?: UpstreamSendRecovery,
 ): Promise<Response> {
   const attempts = Math.max(1, opts.attempts ?? RESET_RETRY_MAX_ATTEMPTS);
   let lastError: unknown;
   for (let attempt = 0; attempt < attempts; attempt++) {
     if (opts.abortSignal?.aborted) throw abortError(opts.abortSignal);
     try {
-      return await doFetch();
+      return await doFetch(attempt === 0 ? firstRecovery : "connection-reset");
     } catch (err) {
       if (opts.abortSignal?.aborted || !isConnectionResetError(err) || attempt === attempts - 1) throw err;
       lastError = err;
@@ -186,7 +190,7 @@ export async function fetchWithResetRetry(
  * note `opts.attempts` is shared with the inner reset layer (no caller passes it today).
  */
 export async function fetchWithTransientRetry(
-  doFetch: () => Promise<Response>,
+  doFetch: ReplayableFetch,
   opts: TransientRetryOptions = {},
 ): Promise<Response> {
   const attempts = Math.max(1, opts.attempts ?? TRANSIENT_RETRY_MAX_ATTEMPTS);
@@ -208,7 +212,7 @@ export async function fetchWithTransientRetry(
     cancelResponseBodyBestEffort(res);
     await sleepWithAbort(delay, opts.abortSignal);
     attemptStart = Date.now();
-    res = await fetchWithResetRetry(doFetch, opts);
+    res = await fetchWithResetRetry(doFetch, opts, "transient-5xx");
   }
   return res;
 }

package/src/oauth/index.ts

@@ -112,6 +112,10 @@ export function isOAuthProvider(name: string): boolean {
   return name in OAUTH_PROVIDERS;
 }
 
+export function isPublicOAuthProvider(name: string): boolean {
+  return name !== "chatgpt" && isOAuthProvider(name);
+}
+
 function isRefreshPolicy(value: unknown): value is RefreshPolicy {
   return value === "proactive" || value === "lazy-only" || value === "disabled";
 }
@@ -135,7 +139,7 @@ export function getOAuthCredentialProjectId(provider: string): string | undefine
 
 /** Provider ids that support real OAuth login (drives the GUI's "Log in with …" buttons). */
 export function listOAuthProviders(): string[] {
-  return Object.keys(OAUTH_PROVIDERS);
+  return Object.keys(OAUTH_PROVIDERS).filter(isPublicOAuthProvider);
 }
 
 export class UnsupportedOAuthProviderError extends Error {
@@ -399,6 +403,7 @@ export function reconcileOAuthProviders(config: OcxConfig): boolean {
 
 /** Add/refresh an OAuth provider's config entry on a config object (does not persist). */
 export function upsertOAuthProvider(config: OcxConfig, provider: string): void {
+  if (provider === "chatgpt") return;
   const def = OAUTH_PROVIDERS[provider];
   if (!def) return;
   config.providers[provider] = { ...def.providerConfig };
@@ -411,6 +416,7 @@ export async function runLogin(provider: string, ctrl: OAuthController, opts?: L
   const rawCred = await def.login(ctrl, opts);
   const cred: OAuthCredentials = rawCred.source ? rawCred : { ...rawCred, source: "oauth" };
   await saveCredential(provider, cred);
+  if (provider === "chatgpt") return cred;
   const config = loadConfig();
   upsertOAuthProvider(config, provider);
   saveConfig(config);

package/src/oauth/key-providers.ts

@@ -1,5 +1,5 @@
 import type { OcxProviderConfig } from "../types";
-import { deriveKeyLoginMap, enrichProviderFromRegistry } from "../providers/derive";
+import { deriveKeyLoginMap, enrichProviderFromRegistry, type DerivedKeyLoginProvider } from "../providers/derive";
 
 /**
  * API-key "login" providers: not OAuth — the flow opens the provider's dashboard so the user can
@@ -7,37 +7,7 @@ import { deriveKeyLoginMap, enrichProviderFromRegistry } from "../providers/deri
  * Most use the OpenAI-compatible chat API (`openai-chat` adapter, `Authorization: Bearer <key>`); a
  * few expose only an Anthropic-compatible endpoint and set `adapter: "anthropic"` (`x-api-key`).
  */
-export interface KeyLoginProvider {
-  label: string;
-  baseUrl: string;
-  adapter: string;
-  /** Where the user creates/copies the API key. */
-  dashboardUrl: string;
-  models?: string[];
-  liveModels?: boolean;
-  defaultModel?: string;
-  contextWindow?: number;
-  modelContextWindows?: Record<string, number>;
-  modelInputModalities?: Record<string, string[]>;
-  /**
-   * Model ids that do NOT accept image input (the vision sidecar describes images for them) / do NOT
-   * accept a reasoning param. Copied into the created provider config by `enrichProviderFromCatalog`,
-   * so the classification actually gates the sidecars (matching is tolerant of an Ollama ":size" tag).
-   */
-  reasoningEfforts?: string[];
-  modelReasoningEfforts?: Record<string, string[]>;
-  reasoningEffortMap?: Record<string, string>;
-  modelReasoningEffortMap?: Record<string, Record<string, string>>;
-  noVisionModels?: string[];
-  noReasoningModels?: string[];
-  noTemperatureModels?: string[];
-  noTopPModels?: string[];
-  noPenaltyModels?: string[];
-  autoToolChoiceOnlyModels?: string[];
-  preserveReasoningContentModels?: string[];
-  escapeBuiltinToolNames?: boolean;
-  googleMode?: "ai-studio" | "vertex" | "cloud-code-assist";
-}
+export interface KeyLoginProvider extends DerivedKeyLoginProvider {}
 
 export const KEY_LOGIN_PROVIDERS: Record<string, KeyLoginProvider> = deriveKeyLoginMap();
 

package/src/oauth/login-cli.ts

@@ -2,7 +2,7 @@ import * as readline from "node:readline";
 import { openUrl } from "../lib/open-url";
 import { loadConfig, saveConfig } from "../config";
 import { findLiveProxy, probeHostname } from "../server/proxy-liveness";
-import { OAUTH_PROVIDERS, runLogin } from "./index";
+import { isPublicOAuthProvider, listOAuthProviders, OAUTH_PROVIDERS, runLogin } from "./index";
 import { KEY_LOGIN_PROVIDERS, isKeyLoginProvider, validateApiKey, type KeyLoginProvider } from "./key-providers";
 import type { OcxProviderConfig } from "../types";
 
@@ -32,11 +32,11 @@ async function notifyRunningProxy(name: string, provider: unknown): Promise<void
 
 export async function handleLogin(provider?: string): Promise<void> {
   const name = (provider ?? "").trim().toLowerCase();
-  if (OAUTH_PROVIDERS[name]) return handleOAuthLogin(name);
+  if (isPublicOAuthProvider(name)) return handleOAuthLogin(name);
   if (isKeyLoginProvider(name)) return handleKeyLogin(name);
   console.error(
     `Usage: ocx login <provider>\n` +
-      `  OAuth login:   ${Object.keys(OAUTH_PROVIDERS).join(", ")}\n` +
+      `  OAuth login:   ${listOAuthProviders().join(", ")}\n` +
       `  API-key login: ${Object.keys(KEY_LOGIN_PROVIDERS).join(", ")}`,
   );
   process.exit(1);
@@ -71,6 +71,7 @@ export function providerConfigFromKeyLoginProvider(def: KeyLoginProvider, key: s
     ...(def.models ? { models: [...def.models] } : {}),
     ...(def.contextWindow !== undefined ? { contextWindow: def.contextWindow } : {}),
     ...(def.modelContextWindows ? { modelContextWindows: { ...def.modelContextWindows } } : {}),
+    ...(def.modelMaxInputTokens ? { modelMaxInputTokens: { ...def.modelMaxInputTokens } } : {}),
     ...(def.modelInputModalities ? { modelInputModalities: cloneRecordOfArrays(def.modelInputModalities) } : {}),
     ...(def.reasoningEfforts ? { reasoningEfforts: [...def.reasoningEfforts] } : {}),
     ...(def.modelReasoningEfforts ? { modelReasoningEfforts: cloneRecordOfArrays(def.modelReasoningEfforts) } : {}),