@bitkyc08/opencodex 2.7.43 → 2.8.0

package/src/providers/model-discovery.ts

@@ -0,0 +1,356 @@
+import type { OcxProviderConfig } from "../types";
+import {
+  getProviderRegistryEntry,
+  providerMatchesRegistryTransport,
+  type ProviderModelDiscoveryFilter,
+  type ProviderModelDiscoveryPredicate,
+  type ProviderModelDiscoveryScalar,
+  type ProviderModelDiscoverySpec,
+} from "./registry";
+
+/** Hard process-wide limits. Registry entries may lower, but never raise, these ceilings. */
+export const MODEL_DISCOVERY_MAX_RESPONSE_BYTES = 4 * 1024 * 1024;
+export const MODEL_DISCOVERY_MAX_MODELS = 2_000;
+export const MODEL_DISCOVERY_MAX_MODEL_ID_LENGTH = 1_024;
+const MODEL_DISCOVERY_MAX_FILTER_VALUES = 256;
+const MODEL_DISCOVERY_MAX_FILTER_STRING_LENGTH = 1_024;
+const MODEL_DISCOVERY_MODEL_ID_CONTROL_CHARS = /[\u0000-\u001f\u007f-\u009f\u2028\u2029]/;
+
+export interface ResolvedProviderModelDiscovery {
+  spec?: ProviderModelDiscoverySpec;
+  maxResponseBytes: number;
+  maxModels: number;
+}
+
+export type ProviderModelsApiItem = Record<string, unknown> & { id: string };
+
+export type ModelDiscoveryResponseFailure =
+  | "response_too_large"
+  | "invalid_json"
+  | "invalid_shape"
+  | "too_many_models";
+
+export type BoundedDiscoveryJsonResult =
+  | { ok: true; value: unknown }
+  | { ok: false; reason: "response_too_large" | "invalid_json" };
+
+export type ProviderModelItemsResult =
+  | { ok: true; items: ProviderModelsApiItem[]; rawCount: number }
+  | { ok: false; reason: "invalid_shape" | "too_many_models" };
+
+export type ModelEnvelopeRowsResult =
+  | { ok: true; rows: unknown[] }
+  | { ok: false; reason: "invalid_shape" | "too_many_models" };
+
+function positiveIntegerAtMost(value: number | undefined, hardLimit: number): number {
+  if (typeof value !== "number" || !Number.isFinite(value) || value <= 0) return hardLimit;
+  return Math.min(Math.floor(value), hardLimit);
+}
+
+function discoveryPredicateError(predicate: ProviderModelDiscoveryPredicate): string | null {
+  if (!Array.isArray(predicate.path) || predicate.path.length === 0 || predicate.path.length > 8) {
+    return "predicate path must contain 1-8 segments";
+  }
+  if (predicate.path.some(segment => typeof segment !== "string" || !segment.trim() || segment.length > 64)) {
+    return "predicate path segments must be nonblank strings up to 64 characters";
+  }
+  const values = "equalsAny" in predicate
+    ? predicate.equalsAny
+    : "containsAny" in predicate
+      ? predicate.containsAny
+      : predicate.containsAll;
+  if (!Array.isArray(values) || values.length === 0 || values.length > 32) {
+    return "predicate values must contain 1-32 scalars";
+  }
+  if (values.some(value => (
+    (typeof value !== "string" && typeof value !== "number" && typeof value !== "boolean")
+    || (typeof value === "string" && (!value.trim() || value.length > 128))
+    || (typeof value === "number" && !Number.isFinite(value))
+  ))) {
+    return "predicate values must be finite booleans/numbers or nonblank strings up to 128 characters";
+  }
+  return null;
+}
+
+/** Static registry validation used by parity tests; discovery metadata never comes from config. */
+export function providerModelDiscoverySpecError(spec: ProviderModelDiscoverySpec): string | null {
+  if (spec.url && spec.path) return "url and path are mutually exclusive";
+  if (spec.url !== undefined) {
+    try {
+      const parsed = new URL(spec.url);
+      if (parsed.protocol !== "https:") return "absolute discovery url must use https";
+      if (parsed.username || parsed.password || parsed.hash) return "absolute discovery url must not contain credentials or a fragment";
+    } catch {
+      return "absolute discovery url must be valid";
+    }
+  }
+  if (spec.path !== undefined) {
+    const path = spec.path.trim();
+    if (!path || path.length > 512) return "discovery path must be 1-512 characters";
+    if (/^[a-z][a-z\d+.-]*:/i.test(path) || path.startsWith("//") || path.includes("?") || path.includes("#")) {
+      return "discovery path must be a query-free relative/origin path";
+    }
+    if (path.includes("\\")) return "discovery path must use forward slashes";
+    if (path.split("/").some(segment => segment.replace(/%2e/gi, ".") === "..")) {
+      return "discovery path must not contain parent-directory segments";
+    }
+  }
+  const queryEntries = Object.entries(spec.query ?? {});
+  if (queryEntries.length > 32) return "discovery query may contain at most 32 entries";
+  if (queryEntries.some(([key, value]) => !key.trim() || key.length > 128 || typeof value !== "string" || value.length > 512)) {
+    return "discovery query keys/values exceed their bounds";
+  }
+  for (const [field, value, hardLimit] of [
+    ["maxResponseBytes", spec.maxResponseBytes, MODEL_DISCOVERY_MAX_RESPONSE_BYTES],
+    ["maxModels", spec.maxModels, MODEL_DISCOVERY_MAX_MODELS],
+  ] as const) {
+    if (value !== undefined && (!Number.isInteger(value) || value <= 0 || value > hardLimit)) {
+      return `${field} must be a positive integer no greater than ${hardLimit}`;
+    }
+  }
+  for (const [group, predicates] of Object.entries(spec.filter ?? {})) {
+    if (!Array.isArray(predicates) || predicates.length === 0 || predicates.length > 32) {
+      return `${group} must contain 1-32 predicates`;
+    }
+    for (const predicate of predicates) {
+      const error = discoveryPredicateError(predicate);
+      if (error) return `${group}: ${error}`;
+    }
+  }
+  return null;
+}
+
+export function resolveProviderModelDiscovery(
+  providerName: string,
+  provider: Pick<OcxProviderConfig, "baseUrl" | "adapter"> & Partial<Pick<OcxProviderConfig, "authMode">>,
+): ResolvedProviderModelDiscovery {
+  const entry = providerMatchesRegistryTransport(providerName, provider)
+    ? getProviderRegistryEntry(providerName)
+    : undefined;
+  const spec = entry?.modelDiscovery;
+  return {
+    ...(spec ? { spec } : {}),
+    maxResponseBytes: positiveIntegerAtMost(spec?.maxResponseBytes, MODEL_DISCOVERY_MAX_RESPONSE_BYTES),
+    maxModels: positiveIntegerAtMost(spec?.maxModels, MODEL_DISCOVERY_MAX_MODELS),
+  };
+}
+
+function appendDiscoveryQuery(url: URL, query: Readonly<Record<string, string>> | undefined): URL {
+  for (const [key, value] of Object.entries(query ?? {})) url.searchParams.set(key, value);
+  return url;
+}
+
+/** Apply a registry-owned URL/path/query policy to the adapter's normal discovery endpoint. */
+export function resolveProviderModelDiscoveryUrl(
+  providerName: string,
+  configuredProvider: Pick<OcxProviderConfig, "baseUrl" | "adapter"> & Partial<Pick<OcxProviderConfig, "authMode">>,
+  effectiveBaseUrl: string,
+  defaultUrl: string,
+): string {
+  const { spec } = resolveProviderModelDiscovery(providerName, configuredProvider);
+  if (!spec) return defaultUrl;
+
+  let resolved: URL;
+  if (spec.url) {
+    resolved = new URL(spec.url);
+  } else if (spec.path) {
+    const base = new URL(effectiveBaseUrl.endsWith("/") ? effectiveBaseUrl : `${effectiveBaseUrl}/`);
+    resolved = spec.path.startsWith("/")
+      ? new URL(spec.path, base.origin)
+      : new URL(spec.path, base);
+  } else {
+    resolved = new URL(defaultUrl);
+  }
+  return appendDiscoveryQuery(resolved, spec.query).toString();
+}
+
+function cancelWithoutWaiting(reader: ReadableStreamDefaultReader<Uint8Array>, reason: unknown): void {
+  try {
+    void reader.cancel(reason).catch(() => undefined);
+  } catch {
+    // A non-conforming stream may throw synchronously from cancel().
+  }
+}
+
+/** Read a discovery response under a strict byte ceiling before JSON.parse can allocate freely. */
+export async function readBoundedDiscoveryJson(
+  response: Response,
+  maxResponseBytes: number,
+): Promise<BoundedDiscoveryJsonResult> {
+  const limit = positiveIntegerAtMost(maxResponseBytes, MODEL_DISCOVERY_MAX_RESPONSE_BYTES);
+  const declaredLength = Number(response.headers.get("content-length"));
+  if (Number.isFinite(declaredLength) && declaredLength > limit) {
+    try {
+      void response.body?.cancel(new DOMException("Model discovery response is too large", "QuotaExceededError"))
+        .catch(() => undefined);
+    } catch {
+      // Best-effort cancellation only.
+    }
+    return { ok: false, reason: "response_too_large" };
+  }
+
+  if (!response.body) return { ok: false, reason: "invalid_json" };
+  const reader = response.body.getReader();
+  const chunks: Uint8Array[] = [];
+  let total = 0;
+  try {
+    while (true) {
+      const { value, done } = await reader.read();
+      if (done) break;
+      if (!value || value.byteLength === 0) continue;
+      if (value.byteLength > limit - total) {
+        cancelWithoutWaiting(
+          reader,
+          new DOMException("Model discovery response is too large", "QuotaExceededError"),
+        );
+        return { ok: false, reason: "response_too_large" };
+      }
+      chunks.push(value);
+      total += value.byteLength;
+    }
+  } finally {
+    try {
+      reader.releaseLock();
+    } catch {
+      // Cancellation may keep the lock briefly.
+    }
+  }
+
+  const bytes = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  try {
+    const text = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    return { ok: true, value: JSON.parse(text) as unknown };
+  } catch {
+    return { ok: false, reason: "invalid_json" };
+  }
+}
+
+function valueAtPath(item: Record<string, unknown>, path: readonly string[]): unknown {
+  let current: unknown = item;
+  for (const segment of path) {
+    if (current === null || typeof current !== "object" || Array.isArray(current)) return undefined;
+    current = (current as Record<string, unknown>)[segment];
+  }
+  return current;
+}
+
+function comparableScalar(value: unknown, caseInsensitive: boolean): ProviderModelDiscoveryScalar | undefined {
+  if (typeof value !== "string" && typeof value !== "number" && typeof value !== "boolean") return undefined;
+  if (typeof value === "string" && value.length > MODEL_DISCOVERY_MAX_FILTER_STRING_LENGTH) return undefined;
+  return caseInsensitive && typeof value === "string" ? value.toLowerCase() : value;
+}
+
+function comparableNeedles(
+  values: readonly ProviderModelDiscoveryScalar[],
+  caseInsensitive: boolean,
+): ProviderModelDiscoveryScalar[] {
+  return values.map(value => caseInsensitive && typeof value === "string" ? value.toLowerCase() : value);
+}
+
+function predicateMatches(item: ProviderModelsApiItem, predicate: ProviderModelDiscoveryPredicate): boolean {
+  const caseInsensitive = predicate.caseInsensitive === true;
+  const raw = valueAtPath(item, predicate.path);
+  if ("equalsAny" in predicate) {
+    const value = comparableScalar(raw, caseInsensitive);
+    return value !== undefined && comparableNeedles(predicate.equalsAny, caseInsensitive).includes(value);
+  }
+
+  const collection = Array.isArray(raw);
+  const values: ProviderModelDiscoveryScalar[] = [];
+  if (collection) {
+    for (let i = 0; i < raw.length && i < MODEL_DISCOVERY_MAX_FILTER_VALUES; i += 1) {
+      const value = comparableScalar(raw[i], caseInsensitive);
+      if (value !== undefined) values.push(value);
+    }
+  } else if (typeof raw === "string") {
+    values.push(caseInsensitive ? raw.toLowerCase() : raw);
+  }
+  const needles = comparableNeedles(
+    "containsAny" in predicate ? predicate.containsAny : predicate.containsAll,
+    caseInsensitive,
+  );
+  if ("containsAny" in predicate) {
+    return needles.some(needle => values.some(value => (
+      !collection && typeof value === "string" && typeof needle === "string" ? value.includes(needle) : value === needle
+    )));
+  }
+  return needles.every(needle => values.some(value => (
+    !collection && typeof value === "string" && typeof needle === "string" ? value.includes(needle) : value === needle
+  )));
+}
+
+export function providerModelMatchesDiscoveryFilter(
+  item: ProviderModelsApiItem,
+  filter: ProviderModelDiscoveryFilter | undefined,
+): boolean {
+  if (!filter) return true;
+  if (filter.allOf && !filter.allOf.every(predicate => predicateMatches(item, predicate))) return false;
+  if (filter.anyOf && filter.anyOf.length > 0 && !filter.anyOf.some(predicate => predicateMatches(item, predicate))) return false;
+  if (filter.noneOf?.some(predicate => predicateMatches(item, predicate))) return false;
+  return true;
+}
+
+/** Extract one allowlisted array envelope while enforcing the raw-row ceiling. */
+export function extractModelEnvelopeRows(
+  value: unknown,
+  maxModels: number,
+  envelopeKeys: readonly string[],
+): ModelEnvelopeRowsResult {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return { ok: false, reason: "invalid_shape" };
+  }
+  const record = value as Record<string, unknown>;
+  const rows = envelopeKeys.map(key => record[key]).find(Array.isArray);
+  if (!rows) return { ok: false, reason: "invalid_shape" };
+  const limit = positiveIntegerAtMost(maxModels, MODEL_DISCOVERY_MAX_MODELS);
+  if (rows.length > limit) return { ok: false, reason: "too_many_models" };
+  return { ok: true, rows };
+}
+
+/** Validate, bound, deduplicate, and declaratively filter OpenAI `{data:[...]}` or top-level arrays (Together `#617`). */
+export function extractProviderModelItems(
+  value: unknown,
+  discovery: ResolvedProviderModelDiscovery,
+): ProviderModelItemsResult {
+  const limit = positiveIntegerAtMost(discovery.maxModels, MODEL_DISCOVERY_MAX_MODELS);
+  let data: unknown[];
+  if (Array.isArray(value)) {
+    // Together-style top-level /models arrays. Catalog discovery must not treat a stray
+    // `models` key on openai-chat responses as valid — only `data` envelopes or top-level arrays.
+    if (value.length > limit) return { ok: false, reason: "too_many_models" };
+    data = value;
+  } else {
+    const envelope = extractModelEnvelopeRows(value, discovery.maxModels, ["data"]);
+    if (!envelope.ok) return envelope;
+    data = envelope.rows;
+  }
+
+  const items: ProviderModelsApiItem[] = [];
+  const seen = new Set<string>();
+  for (const raw of data) {
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+      return { ok: false, reason: "invalid_shape" };
+    }
+    const id = (raw as { id?: unknown }).id;
+    if (typeof id !== "string") return { ok: false, reason: "invalid_shape" };
+    const normalizedId = id.trim();
+    if (
+      !normalizedId
+      || normalizedId !== id
+      || normalizedId.length > MODEL_DISCOVERY_MAX_MODEL_ID_LENGTH
+      || MODEL_DISCOVERY_MODEL_ID_CONTROL_CHARS.test(normalizedId)
+    ) {
+      return { ok: false, reason: "invalid_shape" };
+    }
+    const item = raw as ProviderModelsApiItem;
+    if (!providerModelMatchesDiscoveryFilter(item, discovery.spec?.filter) || seen.has(normalizedId)) continue;
+    seen.add(normalizedId);
+    items.push(item);
+  }
+  return { ok: true, items, rawCount: data.length };
+}

package/src/providers/registry.ts

@@ -17,6 +17,73 @@ import {
 export type ProviderAuthKind = "forward" | "oauth" | "key" | "local";
 export type MetadataModelIdNormalize = "case-insensitive";
 
+export type ProviderModelDiscoveryScalar = string | number | boolean;
+
+export type ProviderModelDiscoveryPredicate =
+  | {
+      path: readonly string[];
+      equalsAny: readonly ProviderModelDiscoveryScalar[];
+      caseInsensitive?: boolean;
+    }
+  | {
+      path: readonly string[];
+      /**
+       * A string-valued upstream target uses substring matching; an array-valued target uses
+       * exact element matching. Use `equalsAny` when the string must match in full.
+       */
+      containsAny: readonly ProviderModelDiscoveryScalar[];
+      caseInsensitive?: boolean;
+    }
+  | {
+      path: readonly string[];
+      /** Uses the same string-substring and array-element semantics as `containsAny`. */
+      containsAll: readonly ProviderModelDiscoveryScalar[];
+      caseInsensitive?: boolean;
+    };
+
+export interface ProviderModelDiscoveryFilter {
+  /** Every predicate must match. */
+  allOf?: readonly ProviderModelDiscoveryPredicate[];
+  /** At least one predicate must match. */
+  anyOf?: readonly ProviderModelDiscoveryPredicate[];
+  /** No predicate may match. */
+  noneOf?: readonly ProviderModelDiscoveryPredicate[];
+}
+
+interface ProviderModelDiscoverySharedSpec {
+  /** Query parameters applied to the resolved discovery URL. */
+  query?: Readonly<Record<string, string>>;
+  /** Declarative eligibility rules evaluated against each untrusted model row. */
+  filter?: ProviderModelDiscoveryFilter;
+  /** Optional lower byte ceiling; the process-wide hard ceiling still wins. */
+  maxResponseBytes?: number;
+  /** Optional lower raw-row ceiling; the process-wide hard ceiling still wins. */
+  maxModels?: number;
+}
+
+type ProviderModelDiscoveryLocation =
+  | {
+      /** Registry-owned absolute endpoint. Mutually exclusive with `path`. */
+      url: string;
+      path?: never;
+    }
+  | {
+      /** Resource path relative to baseUrl; query strings and fragments are disallowed. */
+      path: string;
+      url?: never;
+    }
+  | {
+      /** Keep the adapter-derived default discovery endpoint. */
+      url?: never;
+      path?: never;
+    };
+
+/**
+ * Trusted live-model discovery policy. This metadata is registry-only: it must never be copied
+ * into config.json, where a same-named custom provider could otherwise redirect a stored key.
+ */
+export type ProviderModelDiscoverySpec = ProviderModelDiscoverySharedSpec & ProviderModelDiscoveryLocation;
+
 export interface ProviderRegistryEntry {
   id: string;
   label: string;
@@ -35,6 +102,11 @@ export interface ProviderRegistryEntry {
    */
   freeTier?: boolean;
   allowBaseUrlOverride?: boolean;
+  /**
+   * Do not claim an existing same-named key provider whose fixed destination differs from this
+   * preset. Enable for newly promoted ids so an older custom key cannot be silently retargeted.
+   */
+  preserveCustomDestination?: boolean;
   /**
    * Optional endpoint picker for providers with multiple official hosts
    * (e.g. Qwen Cloud token plan vs pay-as-you-go). Requires `allowBaseUrlOverride`
@@ -51,6 +123,7 @@ export interface ProviderRegistryEntry {
   defaultModel?: string;
   models?: string[];
   liveModels?: boolean;
+  modelDiscovery?: ProviderModelDiscoverySpec;
   contextWindow?: number;
   modelContextWindows?: Record<string, number>;
   modelInputModalities?: Record<string, string[]>;
@@ -384,6 +457,12 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
     modelContextWindows: cursorModelContextWindows(CURSOR_STATIC_MODELS),
     modelInputModalities: cursorModelInputModalities(CURSOR_STATIC_MODELS),
     modelReasoningEfforts: cursorModelReasoningEfforts(CURSOR_STATIC_MODELS),
+    // Kimi K3 documents `max` as its API default, and its Cursor ladder has no `medium`
+    // rung — so applyReasoningLevels' medium->high->first fallback would settle the catalog
+    // default on `high`, the picker would send `high` explicitly, and the request builder's
+    // no-effort fallback to `kimi-k3-max` would never be reached. Mirrors the other K3
+    // routes (kimi, kimi-code, opencode-go).
+    modelDefaultReasoningEfforts: { "kimi-k3": "max" },
     // Cursor's wire protocol never forwards image parts (request-builder emits an unsupported-
     // content marker), so the vision sidecar covers ALL cursor models regardless of what the
     // upstream model could natively do. Live-discovered models outside the static list fall back
@@ -1121,6 +1200,41 @@ export function getProviderRegistryEntry(id: string): ProviderRegistryEntry | un
   return PROVIDER_REGISTRY.find(entry => entry.id === id);
 }
 
+function normalizedProviderEndpoint(value: string): string {
+  const trimmed = value.trim();
+  try {
+    const parsed = new URL(trimmed);
+    parsed.pathname = parsed.pathname.replace(/\/+$/, "") || "/";
+    return parsed.toString().replace(/\/$/, "");
+  } catch {
+    return trimmed.replace(/\/+$/, "");
+  }
+}
+
+/**
+ * Whether registry transport defaults own this configured row.
+ *
+ * OAuth/forward providers stay pinned because their credentials must never be sent to an
+ * arbitrary same-named host. Existing key presets keep their historical pinning behavior; a new
+ * preset can opt into collision preservation, in which case its fixed endpoint owns only rows
+ * that still match that destination.
+ */
+export function providerMatchesRegistryTransport(
+  id: string,
+  provider: Pick<OcxProviderConfig, "baseUrl" | "adapter"> & Partial<Pick<OcxProviderConfig, "authMode">>,
+): boolean {
+  const entry = getProviderRegistryEntry(id);
+  if (!entry) return false;
+  if (entry.authKind !== "key" || entry.preserveCustomDestination !== true) return true;
+  // The opt-in is intentionally limited to fixed key destinations. Fail closed if a future
+  // registry edit combines it with an override/template despite the registry parity tests.
+  if (entry.allowBaseUrlOverride || /\{[^}]*\}/.test(entry.baseUrl)) return false;
+  if (typeof provider.baseUrl !== "string") return false;
+  if (provider.adapter !== entry.adapter) return false;
+  if (provider.authMode !== undefined && provider.authMode !== "key") return false;
+  return normalizedProviderEndpoint(provider.baseUrl) === normalizedProviderEndpoint(entry.baseUrl);
+}
+
 /**
  * Effective Codex account mode for a provider. For canonical `openai`, a valid persisted
  * `codexAccountMode` on the provider config wins and a missing/invalid value defaults to

package/src/router.ts

@@ -3,7 +3,7 @@ import { preservesPhysicalComboProvider, tryPickComboModel, type ComboPick } fro
 import { hasOwnProvider, resolveEnvValue } from "./config";
 import { assertProviderDestinationAllowed } from "./lib/destination-policy";
 import { redactSecretString, redactUrlForLog } from "./lib/redact";
-import { PROVIDER_REGISTRY, providerCodexAccountMode } from "./providers/registry";
+import { PROVIDER_REGISTRY, providerCodexAccountMode, providerMatchesRegistryTransport } from "./providers/registry";
 import { LEGACY_CHATGPT_PROVIDER_ID, LEGACY_OPENAI_MULTI_PROVIDER_ID, OPENAI_API_PROVIDER_ID, OPENAI_CODEX_PROVIDER_ID } from "./providers/openai-tiers";
 import { decodeRoutedModelId, encodeRoutedModelId } from "./providers/slug-codec";
 import { getStaleCached } from "./codex/model-cache";
@@ -40,7 +40,9 @@ const MODEL_PROVIDER_PATTERNS: Array<{ providerNames: string[]; prefixes: string
 export function knownModelIdsForProvider(provName: string, prov: OcxProviderConfig): string[] {
   const ids = new Set<string>();
   for (const id of prov.models ?? []) ids.add(id);
-  const registry = PROVIDER_REGISTRY.find(entry => entry.id === provName);
+  const registry = providerMatchesRegistryTransport(provName, prov)
+    ? PROVIDER_REGISTRY.find(entry => entry.id === provName)
+    : undefined;
   for (const id of registry?.models ?? []) ids.add(id);
   // Registry model-keyed hint maps double as known native ids (e.g. NVIDIA carries no
   // static models list but names `moonshotai/kimi-k2.6` in its effort/window maps).
@@ -192,7 +194,7 @@ function usableResolvedApiKey(apiKey: string | undefined): string | undefined {
 
 function routedProviderConfig(providerName: string, provider: OcxProviderConfig): OcxProviderConfig {
   const registryEntry = PROVIDER_REGISTRY.find(entry => entry.id === providerName);
-  if (!registryEntry) {
+  if (!registryEntry || !providerMatchesRegistryTransport(providerName, provider)) {
     assertProviderDestinationAllowed(providerName, provider);
     return { ...provider, apiKey: usableResolvedApiKey(provider.apiKey) };
   }

package/src/server/auth-cors.ts

@@ -12,7 +12,7 @@ import {
   reasoningSummaryDeliveryRecordConfigError,
 } from "../config";
 import { providerDestinationConfigError } from "../lib/destination-policy";
-import { getProviderRegistryEntry, providerCodexAccountMode } from "../providers/registry";
+import { getProviderRegistryEntry, providerCodexAccountMode, providerMatchesRegistryTransport } from "../providers/registry";
 import { providerConfigSeed } from "../providers/derive";
 import type { OcxConfig, OcxProviderConfig } from "../types";
 import { openRouterRoutingConfigError } from "../providers/openrouter-routing";
@@ -418,7 +418,9 @@ export function safeConfigDTO(config: OcxConfig): unknown {
     ] as const) {
       copyIfDefined(dto, provider, key);
     }
-    const registryNote = getProviderRegistryEntry(name)?.note;
+    const registryNote = providerMatchesRegistryTransport(name, provider)
+      ? getProviderRegistryEntry(name)?.note
+      : undefined;
     if (typeof registryNote === "string" && registryNote.trim()) dto.note = registryNote;
     const codexAccountMode = providerCodexAccountMode(name, provider);
     if (codexAccountMode) dto.codexAccountMode = codexAccountMode;

package/src/server/live.ts

@@ -197,42 +197,92 @@ export function parseLiveSidebandTarget(pathname: string, searchParams: URLSearc
   return null;
 }
 
+/**
+ * True for the loopback hosts plaintext development servers listen on.
+ * `URL.hostname` keeps the brackets on IPv6, so both forms are accepted.
+ */
+function isLoopbackHost(hostname: string): boolean {
+  const lower = hostname.toLowerCase();
+  return lower === "localhost" || lower.endsWith(".localhost")
+    || lower === "127.0.0.1" || lower.startsWith("127.")
+    || lower === "::1" || lower === "[::1]";
+}
+
+/**
+ * Normalize the sideband base to end in exactly `/v1`, with no query, fragment,
+ * or userinfo. Any failure closes to the canonical Realtime API root — never to
+ * the input — because this string decides where upstream bearer credentials and
+ * user audio are sent.
+ *
+ * Bounds, all fail-closed:
+ *   - scheme must be https/wss, or http/ws with a loopback host (the local
+ *     development case this knob exists for);
+ *   - URL userinfo is rejected (URL#toString would forward it verbatim);
+ *   - unparseable input is rejected.
+ *
+ * Endpoint-form overrides are recognized the way upstream recognizes them
+ * (codex-rs realtime_websocket/methods.rs:994): a terminal `/realtime`,
+ * `/realtime/calls/<id>`, or `/live/<id>` is stripped so the root can be
+ * re-derived. A path prefix survives (`https://host/api/v1` keeps `/api`).
+ */
+function normalizeSidebandRoot(baseUrl: string): string {
+  let parsed: URL;
+  try {
+    parsed = new URL(baseUrl);
+  } catch {
+    return LIVE_SIDEBAND_API_ROOT;
+  }
+  const secure = parsed.protocol === "https:" || parsed.protocol === "wss:";
+  const plaintext = parsed.protocol === "http:" || parsed.protocol === "ws:";
+  if ((!secure && !plaintext) || (plaintext && !isLoopbackHost(parsed.hostname)) || parsed.username || parsed.password) {
+    return LIVE_SIDEBAND_API_ROOT;
+  }
+  parsed.search = "";
+  parsed.hash = "";
+  const path = parsed.pathname
+    .replace(/\/+$/, "")
+    .replace(/\/realtime(?:\/calls\/[^/]+)?$/, "")
+    .replace(/\/live\/[^/]+$/, "")
+    .replace(/\/v1$/, "");
+  parsed.pathname = `${path}/v1`;
+  return parsed.toString().replace(/\/$/, "");
+}
+
+/**
+ * Resolve the sideband base. Upstream policy (codex-rs 438c9e98d): the sideband
+ * join is NOT derived from the selected model provider — precedence is exactly
+ * the explicit override when configured, otherwise the canonical Realtime API
+ * root. The provider base URL deliberately plays no part; a user who needs a
+ * non-canonical host sets the override, the same escape hatch upstream ships as
+ * `experimental_realtime_ws_base_url`.
+ */
+function sidebandBaseRoot(overrideBaseUrl?: string): string {
+  return normalizeSidebandRoot(overrideBaseUrl?.trim() || LIVE_SIDEBAND_API_ROOT);
+}
+
 /**
  * Build the upstream sideband WebSocket URL for a resolved OpenAI/ChatGPT provider.
  * Mirrors openai/codex `websocket_url_from_api_url_for_call` + `normalize_realtime_path`.
+ *
+ * Deliberate deviation: the realtime-query style keeps `intent=quicksilver`,
+ * which upstream does not send. That URL is live against real OpenAI
+ * infrastructure for every canonical voice user and this parameter is known to
+ * work; dropping it is future work gated on a live smoke test. Parity here is
+ * scoped to the host, override precedence, and provider-query exclusion.
  */
 export function buildLiveSidebandUpstreamWsUrl(
-  providerBaseUrl: string,
-  usesBackendShape: boolean,
   target: LiveSidebandTarget,
+  overrideBaseUrl?: string,
 ): string {
-  const root = providerBaseUrl.replace(/\/$/, "");
-  if (usesBackendShape) {
-    // ChatGPT backend-api call-create, but the sideband join lives on the public API host
-    // (matches openai/codex, which builds the sideband from the ApiKey provider default).
-    if (target.style === "frameless-path") {
-      return httpsToWss(`${LIVE_SIDEBAND_API_ROOT}/live/${target.callId}`);
-    }
-    if (target.style === "realtime-calls-path") {
-      return httpsToWss(`${LIVE_SIDEBAND_API_ROOT}/realtime/calls/${target.callId}`);
-    }
-    return httpsToWss(
-      `${LIVE_SIDEBAND_API_ROOT}/realtime?intent=quicksilver&call_id=${encodeURIComponent(target.callId)}`,
-    );
-  }
+  const sidebandRoot = sidebandBaseRoot(overrideBaseUrl);
   if (target.style === "frameless-path") {
-    // Frameless: normalize to .../live then append /{callId}.
-    const apiRoot = root.replace(/\/v1\/?$/, "");
-    return httpsToWss(`${apiRoot}/v1/live/${target.callId}`);
+    return httpsToWss(`${sidebandRoot}/live/${target.callId}`);
   }
   if (target.style === "realtime-calls-path") {
-    const apiRoot = root.replace(/\/v1\/?$/, "");
-    return httpsToWss(`${apiRoot}/v1/realtime/calls/${target.callId}`);
+    return httpsToWss(`${sidebandRoot}/realtime/calls/${target.callId}`);
   }
-  // Realtime v1/v2: /v1/realtime?intent=quicksilver&call_id=
-  const apiRoot = root.replace(/\/v1\/?$/, "");
   return httpsToWss(
-    `${apiRoot}/v1/realtime?intent=quicksilver&call_id=${encodeURIComponent(target.callId)}`,
+    `${sidebandRoot}/realtime?intent=quicksilver&call_id=${encodeURIComponent(target.callId)}`,
   );
 }
 
@@ -542,7 +592,7 @@ export async function resolveLiveSidebandUpgrade(
   if (relay instanceof Response) return relay;
   return {
     headers: relay.headers,
-    upstreamWsUrl: buildLiveSidebandUpstreamWsUrl(relay.providerBaseUrl, relay.usesBackendShape, target),
+    upstreamWsUrl: buildLiveSidebandUpstreamWsUrl(target, config.experimentalRealtimeWsBaseUrl),
     recordOutcome: relay.recordOutcome,
   };
 }