@bitkyc08/opencodex 2.76.0 → 2.77.0

package/src/codex/routing.ts

@@ -1,3 +1,4 @@
+import { codexAccountUsesCreditsAfterLimit } from "./account-credit-use";
 import { clearIdleWindowSteering, pickIdleWindowAccount } from "./routing/idle-window";
 import { getEffectiveCodexAutoSwitchThreshold } from "./account-auto-switch";
 import { codexQuotaHasFreshUsage } from "./quota-observation-freshness";
@@ -522,7 +523,7 @@ function pickAffinityPriorityFailback(
       || now - quota.updatedAt >= CODEX_PRIORITY_FAILBACK_REFRESH_MS
       || (quota.shortObservedAt !== undefined
         && now - quota.shortObservedAt >= CODEX_PRIORITY_FAILBACK_REFRESH_MS)) return false;
-    const usage = computeCodexUsageScore(quota, plan, now);
+    const usage = computeCodexUsageScore(quota, plan, now, codexAccountUsesCreditsAfterLimit(config, id));
     const threshold = getEffectiveCodexAutoSwitchThreshold(config, id);
     return !isUnknownUsage(usage) && usage < 100 && (threshold <= 0 || usage < threshold);
   });
@@ -575,7 +576,7 @@ function previewReusableAffinityAccount(
       const usage = computeCodexUsageScore(
         getAccountQuota(entry.accountId),
         getPoolAccountPlanForSelection(config, entry.accountId, selectionOptions),
-      now,
+        now, codexAccountUsesCreditsAfterLimit(config, entry.accountId),
       );
       // Preview must agree with resolve: this is the second copy of the same rule, and the
       // suite asserts the two answer identically.
@@ -605,7 +606,7 @@ function resetFirstAffinityReplacement(
 ): string | null {
   const threshold = getEffectiveCodexAutoSwitchThreshold(config, entry.accountId);
   if (threshold <= 0) return null;
-  const usage = computeCodexUsageScore(getAccountQuota(entry.accountId), getPoolAccountPlanForSelection(config, entry.accountId, selectionOptions), now);
+  const usage = computeCodexUsageScore(getAccountQuota(entry.accountId), getPoolAccountPlanForSelection(config, entry.accountId, selectionOptions), now, codexAccountUsesCreditsAfterLimit(config, entry.accountId));
   if (!mayRebindAffinityForQuota(config, entry.accountId, usage, threshold, selectionOptions)) return null;
   const candidates = getEligiblePoolAccounts(config, entry.accountId, now, quotaScope, selectionOptions, true)
     // Headroom alone answers true for an UNMEASURED account, which is the right default for an
@@ -618,7 +619,7 @@ function resetFirstAffinityReplacement(
       return !isUnknownUsage(computeCodexUsageScore(
         getAccountQuota(id),
         getPoolAccountPlanForSelection(config, id, selectionOptions),
-        now,
+        now, codexAccountUsesCreditsAfterLimit(config, id),
       ));
     });
   return pickResetFirstCodexAccount(config, candidates, now, selectionOptions);
@@ -664,10 +665,9 @@ function pickCacheSafeQuotaReplacement(
   ).filter(id => hasCodexQuotaHeadroom(config, id, selectionOptions, now));
   const best = pickLowestUsageAmong(config, candidates, selectionOptions, now);
   if (best === null || best === boundAccountId) return null;
-  const bestUsage = computeCodexUsageScore(
-    getAccountQuota(best),
+  const bestUsage = computeCodexUsageScore(getAccountQuota(best),
     getPoolAccountPlanForSelection(config, best, selectionOptions),
-    now,
+    now, codexAccountUsesCreditsAfterLimit(config, best),
   );
   return bestUsage < boundUsage ? best : null;
 }
@@ -698,7 +698,7 @@ function reevaluateAffinityQuota(
     ? computeCodexUsageScore(
         getAccountQuota(entry.accountId),
         getPoolAccountPlanForSelection(config, entry.accountId, selectionOptions),
-      now,
+        now, codexAccountUsesCreditsAfterLimit(config, entry.accountId),
       )
     : 0;
   // One bar, used for BOTH the rebind decision and the re-score interval. Keying the short
@@ -823,7 +823,7 @@ export function previewCodexAccountForRequest(
     const usage = computeCodexUsageScore(
       getAccountQuota(active),
       getPoolAccountPlanForSelection(config, active, selectionOptions),
-      now,
+      now, codexAccountUsesCreditsAfterLimit(config, active),
     );
     if (!isUnknownUsage(usage) && usage >= threshold) {
       active = pickLowerUsageAccount(config, active, usage, now, quotaScope, selectionOptions);

package/src/codex/shim-path-resolution.ts

@@ -0,0 +1,133 @@
+import { closeSync, constants, existsSync, fstatSync, lstatSync, openSync, readSync, realpathSync, statSync } from "node:fs";
+import { posix, win32 } from "node:path";
+import { isWslRuntime, wslAutomountRoot } from "./home";
+import { SHIM_MARKER } from "./shim-templates";
+
+/**
+ * A PATH entry that reaches Windows through WSL drive interop
+ * (`<automount-root>/<drive>/...`; root defaults to /mnt, configurable via
+ * /etc/wsl.conf [automount] root).
+ */
+export function isWindowsInteropDir(dir: string, automountRoot = "/mnt"): boolean {
+  const root = automountRoot.replace(/\/+$/, "");
+  const escaped = root.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return new RegExp(`^${escaped}/[a-z](/|$)`, "i").test(dir);
+}
+
+export type CodexPathScanDeps = {
+  pathValue?: string;
+  wsl?: boolean;
+  /** Treat PATH entries as POSIX paths (WSL context). Defaults to wsl || non-win32. */
+  posixPaths?: boolean;
+  automountRoot?: string;
+  exists?: (path: string) => boolean;
+  isShimFile?: (path: string) => boolean;
+  isDirectory?: (path: string) => boolean;
+  realpath?: (path: string) => string;
+};
+
+export type CodexPathCandidate = {
+  path: string;
+  isShim: boolean;
+};
+
+export function realIsDirectory(path: string): boolean {
+  try {
+    return lstatSync(path).isDirectory();
+  } catch {
+    return true; // unreadable -> treat as unusable
+  }
+}
+
+const SHIM_HEADER_MAX_BYTES = 16 * 1024;
+
+function inspectShimFile(path: string): boolean | null {
+  let fd: number | undefined;
+  try {
+    // Follow npm launcher symlinks, but never read a known special file.
+    if (!statSync(path).isFile()) return null;
+    const flags = constants.O_RDONLY | (process.platform === "win32" ? 0 : constants.O_NONBLOCK);
+    fd = openSync(path, flags);
+    // The entry can change after stat; a replacement FIFO must not block open or read.
+    if (!fstatSync(fd).isFile()) return null;
+    const header = Buffer.allocUnsafe(SHIM_HEADER_MAX_BYTES);
+    let total = 0;
+    while (total < header.length) {
+      const count = readSync(fd, header, total, header.length - total, total);
+      if (count === 0) break;
+      total += count;
+    }
+    return header.subarray(0, total).toString("utf8").includes(SHIM_MARKER);
+  } catch {
+    // An unreadable command still shadows later PATH entries; do not claim they are active.
+    return false;
+  } finally {
+    if (fd !== undefined) closeSync(fd);
+  }
+}
+
+function commandNames(name: string): string[] {
+  if (process.platform !== "win32") return [name];
+  const exts = (process.env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD;.PS1").split(";").filter(Boolean);
+  return [name, ...exts.flatMap(ext => [`${name}${ext.toLowerCase()}`, `${name}${ext.toUpperCase()}`])];
+}
+
+/** The shell-local bin directory that fnm creates for one interactive shell. */
+export function isFnmMultishellPath(path: string, posixPaths: boolean): boolean {
+  const normalized = (posixPaths
+    ? posix.normalize(path)
+    : win32.normalize(path).replace(/\\/g, "/")).toLowerCase();
+  return /(?:^|\/)fnm_multishells?(?:\/|$)/.test(normalized);
+}
+
+/** Find the command the shell would actually use, including an OpenCodex shim. */
+export function findFirstCodexOnPath(deps: CodexPathScanDeps = {}): CodexPathCandidate | null {
+  const exists = deps.exists ?? existsSync;
+  const shimFile = deps.isShimFile ?? inspectShimFile;
+  const isDir = deps.isDirectory ?? realIsDirectory;
+  const wsl = deps.wsl ?? (process.platform === "linux" && isWslRuntime());
+  const usePosix = deps.posixPaths ?? (wsl || process.platform !== "win32");
+  const joinPath = usePosix ? posix.join : win32.join;
+  const pathSep = usePosix ? ":" : win32.delimiter;
+  const automountRoot = deps.automountRoot ?? (wsl ? wslAutomountRoot() : "/mnt");
+  const interopNames = ["codex", "codex.exe", "codex.cmd", "codex.ps1"];
+
+  for (const dir of (deps.pathValue ?? process.env.PATH ?? "").split(pathSep).filter(Boolean)) {
+    if (wsl && isWindowsInteropDir(dir, automountRoot)) continue;
+    const names = isWindowsInteropDir(dir, automountRoot) ? interopNames : commandNames("codex");
+    for (const name of names) {
+      const path = joinPath(dir, name);
+      if (!exists(path) || isDir(path)) continue;
+      const isShim = shimFile(path);
+      if (isShim !== null) return { path, isShim };
+    }
+  }
+  return null;
+}
+
+/**
+ * Resolve a Codex command discovered through fnm's temporary PATH entry.
+ *
+ * A temporary path is safe to use only when its physical target is outside the
+ * temporary tree. Returning null is deliberate: callers must not wrap the
+ * shell-local path or silently choose a lower-priority Codex installation.
+ */
+export function resolveStableFnmCodexPath(
+  path: string,
+  posixPaths: boolean,
+  realpath: ((path: string) => string) | undefined = realpathSync.native,
+): string | null {
+  if (!isFnmMultishellPath(path, posixPaths)) return path;
+  try {
+    // fnm normally links the temporary directory to the durable installation,
+    // while npm may link the command file again into its package internals.
+    // Resolve only the directory so the command basename remains the stable
+    // installation entry that the installer is allowed to replace.
+    const pathTools = posixPaths ? posix : win32;
+    const resolvedParent = realpath(pathTools.dirname(path));
+    if (!resolvedParent || isFnmMultishellPath(resolvedParent, posixPaths) || !pathTools.isAbsolute(resolvedParent)) return null;
+    return pathTools.join(resolvedParent, pathTools.basename(path));
+  } catch {
+    return null;
+  }
+}

package/src/codex/shim.ts

@@ -8,7 +8,7 @@ import {
   unlinkSync,
   writeFileSync,
 } from "node:fs";
-import { basename, delimiter, dirname, extname, join, posix } from "node:path";
+import { basename, delimiter, dirname, extname, join, posix, win32 } from "node:path";
 import { durableBunRuntime } from "../lib/bun-runtime";
 import type { BunRuntimeSource } from "../lib/bun-runtime";
 import { serviceApiTokenFilePath } from "../lib/service-secrets";
@@ -53,12 +53,20 @@ import {
   type UnixShimProbeResult,
 } from "./shim-probe";
 import { tryAcquireShimRestoreLock } from "./shim-restore-lock";
+import {
+  isWindowsInteropDir,
+  realIsDirectory,
+  resolveStableFnmCodexPath,
+  type CodexPathScanDeps,
+} from "./shim-path-resolution";
 
 export { buildUnixCodexShim, buildWindowsCodexShim, buildWindowsPowerShellCodexShim } from "./shim-templates";
 export { isVersionManagerOwnedCodexPath } from "./shim-fingerprint";
 export { CODEX_SHIM_STATE_MAX_BYTES } from "./shim-state-file";
 export { setCodexShimProbeHookForTests, setCodexShimProbeShellForTests, setCodexShimProbeObservationMsForTests } from "./shim-probe";
 export type { CodexShimBackingForCommand } from "./shim-inspect";
+export type { CodexPathScanDeps } from "./shim-path-resolution";
+export { isWindowsInteropDir } from "./shim-path-resolution";
 export { isLocalAbsoluteInspectionPath, inspectCodexShimBackingForCommand } from "./shim-inspect";
 
 export const CODEX_SHIM_REPLACEMENT_STABLE_MS = 100;
@@ -75,6 +83,17 @@ interface InstallCodexShimInternalOptions {
   beforeGuardedRefresh?: (wrapperPath: string, index: number) => void;
 }
 
+function discoveredCodexPath(path: string, posixPaths: boolean, realpath?: (path: string) => string): string | null {
+  const resolved = resolveStableFnmCodexPath(path, posixPaths, realpath);
+  if (resolved !== null) return resolved;
+  lastShimDiscoveryError = truncateRetainedUtf8(
+    `Found codex at ${path} inside fnm's temporary multishell path, but it did not resolve to a durable Node installation. `
+    + "Refusing to install a shim; retry after fnm selects a stable installation.",
+    MAX_DIAGNOSTIC_VALUE_BYTES,
+  );
+  return null;
+}
+
 export type CodexShimAutoRestoreResult =
   | { status: "not-installed" | "healthy" | "disabled" }
   | { status: "ineligible" | "deferred"; message?: string }
@@ -115,36 +134,6 @@ function isHealthyShim(path: string, platform: NodeJS.Platform): boolean {
   }
 }
 
-/**
- * A PATH entry that reaches Windows through WSL drive interop
- * (`<automount-root>/<drive>/...`; root defaults to /mnt, configurable via
- * /etc/wsl.conf [automount] root).
- */
-export function isWindowsInteropDir(dir: string, automountRoot = "/mnt"): boolean {
-  const root = automountRoot.replace(/\/+$/, "");
-  const escaped = root.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  return new RegExp(`^${escaped}/[a-z](/|$)`, "i").test(dir);
-}
-
-export type CodexPathScanDeps = {
-  pathValue?: string;
-  wsl?: boolean;
-  /** Treat PATH entries as POSIX paths (WSL context). Defaults to wsl || non-win32. */
-  posixPaths?: boolean;
-  automountRoot?: string;
-  exists?: (path: string) => boolean;
-  isShimFile?: (path: string) => boolean;
-  isDirectory?: (path: string) => boolean;
-};
-
-function realIsDirectory(path: string): boolean {
-  try {
-    return lstatSync(path).isDirectory();
-  } catch {
-    return true; // unreadable -> treat as unusable
-  }
-}
-
 export function findCodexOnPath(deps: CodexPathScanDeps = {}): string | null {
   lastShimDiscoveryError = null;
   const exists = deps.exists ?? existsSync;
@@ -152,8 +141,10 @@ export function findCodexOnPath(deps: CodexPathScanDeps = {}): string | null {
   const isDir = deps.isDirectory ?? realIsDirectory;
   const wsl = deps.wsl ?? (process.platform === "linux" && isWslRuntime());
   const usePosix = deps.posixPaths ?? (wsl || process.platform !== "win32");
-  const joinPath = usePosix ? posix.join : join;
-  const pathSep = usePosix ? ":" : delimiter;
+  // The injected path flavour governs join and separator alike; host-native `join` and
+  // `delimiter` made a Windows-flavoured scan split `C:\...` on a Linux host.
+  const joinPath = usePosix ? posix.join : win32.join;
+  const pathSep = usePosix ? ":" : win32.delimiter;
   const automountRoot = deps.automountRoot ?? (wsl ? wslAutomountRoot() : "/mnt");
   // Windows npm prefixes ship codex.exe/codex.cmd next to the extensionless sh launcher.
   const interopNames = ["codex", "codex.exe", "codex.cmd", "codex.ps1"];
@@ -176,7 +167,11 @@ export function findCodexOnPath(deps: CodexPathScanDeps = {}): string | null {
     for (const name of names) {
       const path = joinPath(dir, name);
       if (!exists(path) || shimFile(path)) continue;
-      if (!isDir(path)) return path;
+      if (!isDir(path)) {
+        const resolved = discoveredCodexPath(path, usePosix, deps.realpath);
+        if (resolved !== null) return resolved;
+        return null;
+      }
     }
   }
 
@@ -195,11 +190,13 @@ function findWindowsCodexTargets(): ShimFileState[] | null {
   lastShimDiscoveryError = null;
   for (const dir of (process.env.PATH ?? "").split(delimiter).filter(Boolean)) {
     const exe = join(dir, "codex.exe");
-    if (existsSync(exe) && !isShim(exe)) {
+    const stableExe = existsSync(exe) && !isShim(exe) ? discoveredCodexPath(exe, false) : exe;
+    if (stableExe === null) return null;
+    if (existsSync(stableExe) && !isShim(stableExe)) {
       try {
-        if (!lstatSync(exe).isDirectory()) {
+        if (!lstatSync(stableExe).isDirectory()) {
           lastShimDiscoveryError = truncateRetainedUtf8(
-            `Found codex.exe at ${exe}. Refusing to rename a real .exe because exact codex.exe invocations would break; ` +
+            `Found codex.exe at ${stableExe}. Refusing to rename a real .exe because exact codex.exe invocations would break; ` +
             "install a codex.cmd/codex.ps1 launcher or use `ocx service install` for autostart.",
             MAX_DIAGNOSTIC_VALUE_BYTES,
           );
@@ -216,9 +213,12 @@ function findWindowsCodexTargets(): ShimFileState[] | null {
     const targets: ShimFileState[] = [];
     for (const path of [cmd, ps1, gitBashLauncher]) {
       if (!existsSync(path) || isShim(path)) continue;
+      const stablePath = discoveredCodexPath(path, false);
+      if (stablePath === null) return null;
+      if (!existsSync(stablePath) || isShim(stablePath)) continue;
       try {
-        if (!lstatSync(path).isDirectory()) {
-          targets.push({ wrapperPath: path, originalPath: path, backupPath: backupPathFor(path) });
+        if (!lstatSync(stablePath).isDirectory()) {
+          targets.push({ wrapperPath: stablePath, originalPath: stablePath, backupPath: backupPathFor(stablePath) });
         }
       } catch { /* keep scanning */ }
     }

package/src/codex/subagent-model-fallback.ts

@@ -1,3 +1,4 @@
+import { codexAccountUsesCreditsAfterLimit } from "./account-credit-use";
 /**
  * Quota-aware subagent model fallback (issue #374).
  *
@@ -233,7 +234,7 @@ export function isNativeModelQuotaExhausted(
   // Subagent fallback reads the same score, so a stale terminal reading would push
   // subagents off a native model whose window has already reset. Thread the caller's clock
   // rather than letting the scorer read wall time - the two would silently diverge.
-  const usage = computeCodexUsageScore(quota, getPoolAccountPlan(config, resolvedAccountId), now);
+  const usage = computeCodexUsageScore(quota, getPoolAccountPlan(config, resolvedAccountId), now, codexAccountUsesCreditsAfterLimit(config, resolvedAccountId));
   if (usage >= CODEX_UNKNOWN_USAGE_SCORE) return false;
   return usage >= quotaThreshold(config, resolvedAccountId);
 }

package/src/combos/failover.ts

@@ -670,10 +670,84 @@ function isDefiniteContextOverflow(status: number, message: string): boolean {
   return false;
 }
 
+const CODEX_ACCOUNT_MODEL_REFUSAL = /^The '[^']{1,256}' model is not supported when using Codex with a ChatGPT account\.$/;
+
+export type CodexAccountModelRefusal = "other" | "refusal" | "ambiguous";
+
+/** Inspect only the original root and its own response record, before carrier selection. */
+export function hasConflictingCodexModelRefusalEnvelopes(status: number, payload: unknown): boolean {
+  if (status !== 400 || !payload || typeof payload !== "object" || Array.isArray(payload)) return false;
+  const response = Object.hasOwn(payload, "response") ? (payload as Record<string, unknown>).response : undefined;
+  const nested = response && typeof response === "object" && !Array.isArray(response) ? response : undefined;
+  return (Object.hasOwn(payload, "detail") || !!nested && Object.hasOwn(nested, "detail"))
+    && (Object.hasOwn(payload, "error") || !!nested && Object.hasOwn(nested, "error"));
+}
+
+/** Inspect an already parsed, bounded error frame without copying or walking its body. */
+export function codexAccountModelRefusalPayload(status: number, payload: unknown): CodexAccountModelRefusal {
+  if (status !== 400 || !payload || typeof payload !== "object" || Array.isArray(payload)) return "other";
+  if (Object.hasOwn(payload, "detail") && Object.hasOwn(payload, "error")) return "ambiguous";
+  const { detail, error } = payload as { detail?: unknown; error?: unknown };
+  const field = typeof detail === "string" ? detail
+    : error && typeof error === "object" && !Array.isArray(error)
+      && typeof (error as Record<string, unknown>).message === "string"
+      ? (error as { message: string }).message : undefined;
+  return field !== undefined && CODEX_ACCOUNT_MODEL_REFUSAL.test(field) ? "refusal" : "other";
+}
+
+/** One complete, bounded HTTP envelope; accept only a single exact status prefix. */
+function parseCodexRefusalEnvelope(status: number, message: string): { text: string; payload: unknown } | undefined {
+  if (status !== 400 || message.length > 16_384) return undefined;
+  let text = message.trim();
+  if (text.startsWith("Provider error 400: ")) text = text.slice("Provider error 400: ".length);
+  let payload: unknown;
+  try { payload = JSON.parse(text); } catch { /* Bare refusal text is also a supported carrier. */ }
+  return { text, payload };
+}
+
+/** Only allowlisted hard stops cross the same HTTP boundary as positive refusal evidence. */
+export function codexAccountModelRefusalHardStopCode(status: number, message: string): string | undefined {
+  const payload = parseCodexRefusalEnvelope(status, message)?.payload;
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) return undefined;
+  const root = payload as Record<string, unknown>;
+  const response = Object.hasOwn(root, "response") ? root.response : undefined;
+  const records = response && typeof response === "object" && !Array.isArray(response)
+    ? [root, response as Record<string, unknown>] : [root];
+  for (const record of records) {
+    const error = record.error && typeof record.error === "object" && !Array.isArray(record.error)
+      ? record.error as Record<string, unknown> : undefined;
+    // Diagnostic type is never code evidence, even when a code is absent or malformed.
+    for (const code of [error?.code, record.code]) {
+      if (typeof code !== "string") continue;
+      if (isNonReplayableUpstreamCode(code) || isCyberPolicyCode(code)) return code;
+      if (normalizedFailureCode(code) === "origin_rejected") return "origin_rejected";
+    }
+  }
+  return undefined;
+}
+
+/** A bounded fallback signal, never credential or account-entitlement evidence. */
+export function codexAccountModelRefusal(
+  status: number, message: string, options?: { allowNestedResponse?: boolean },
+): CodexAccountModelRefusal {
+  const envelope = parseCodexRefusalEnvelope(status, message);
+  if (!envelope) return "other";
+  if (CODEX_ACCOUNT_MODEL_REFUSAL.test(envelope.text)) return "refusal";
+  const payload = envelope.payload;
+  if (hasConflictingCodexModelRefusalEnvelopes(status, payload)) return "ambiguous";
+  // A present root carrier stays authoritative, even when malformed or nonmatching.
+  if (options?.allowNestedResponse !== false && payload && typeof payload === "object" && !Array.isArray(payload)
+    && !Object.hasOwn(payload, "detail") && !Object.hasOwn(payload, "error")
+    && Object.hasOwn(payload, "response")) {
+    return codexAccountModelRefusalPayload(status, (payload as Record<string, unknown>).response);
+  }
+  return codexAccountModelRefusalPayload(status, payload);
+}
+
 export function comboFailureDecision(
   status: number,
   message: string,
-  options?: { code?: string | null },
+  options?: { code?: string | null; codexModelRefusal?: CodexAccountModelRefusal },
 ): ComboFailureDecision {
   if (status === 499) return "stop";
   if (message.toLowerCase().includes("origin_rejected")) return "stop";
@@ -688,6 +762,12 @@ export function comboFailureDecision(
   // Cyber policy is a hard non-retryable refusal — honor structured code even when
   // classificationText was truncated before the JSON code field.
   if (isCyberPolicyCode(options?.code)) return "stop";
+  // HTTP consumers retain hard codes before truncation; SSE metadata owns its selected carrier.
+  if (options?.codexModelRefusal === undefined && codexAccountModelRefusalHardStopCode(status, message)) return "stop";
+  const modelRefusal = status === 400
+    ? options?.codexModelRefusal ?? codexAccountModelRefusal(status, message) : "other";
+  // Competing envelopes cannot grant a hop through an earlier structured-code rule either.
+  if (modelRefusal === "ambiguous") return "stop";
   // HTTP 410 is normally terminal. A model-specific lifecycle verdict is target-local,
   // however: another provider/model in the declared combo can still serve the request.
   // Require structured lifecycle code or explicit model+lifecycle prose so unrelated
@@ -738,6 +818,7 @@ export function comboFailureDecision(
   if (["model_not_found", "model_unavailable", "unsupported_model"].includes(failureCode)) {
     return "hop";
   }
+  if (modelRefusal === "refusal") return "hop";
   // `free_rate_limited` no longer routes through `isProviderScopedQuotaCap` (it is a
   // per-request cap, not provider-wide evidence), so keep its hop verdict explicit here.
   if (failureCode === "free_rate_limited") return "hop";

package/src/combos/jev.ts

@@ -127,6 +127,8 @@ export interface ResolveJevDecisionOptions {
    * any other id names a configured `jev-decision` row (for example a self-hosted Ollama `tev1`).
    */
   decisionProvider?: string;
+  /** Request-local authorization of the concrete decision destination, before credential access. */
+  isDestinationAllowed?: (providerName: string, modelId: string) => boolean;
   /** Decision deadline; values outside 1000..120000 ms keep the four-second default. */
   timeoutMs?: number;
   signal?: AbortSignal;
@@ -674,14 +676,20 @@ function selfHostedApiKey(name: string, apiKey: string | undefined): string | un
  * custom destination. Any other id must be an enabled `jev-decision` row whose baseUrl is a
  * `/systemone` endpoint and which names its own model; only its own key may accompany it, so no
  * TypeSafe credential can reach a self-hosted service. `undefined` means no usable decision
- * service (reported through the existing `missing_key` gate).
+ * service (reported through the existing `missing_key` gate); `null` means the request's
+ * destination scope refused it before any credential access.
  */
-function jevDecisionEndpoint(config: OcxConfig, decisionProvider: string): JevDecisionEndpoint | undefined {
+function jevDecisionEndpoint(
+  config: OcxConfig,
+  decisionProvider: string,
+  isDestinationAllowed?: ResolveJevDecisionOptions["isDestinationAllowed"],
+): JevDecisionEndpoint | undefined | null {
   const configured = Object.hasOwn(config.providers, decisionProvider)
     ? config.providers[decisionProvider]
     : undefined;
   if (configured?.disabled === true) return undefined;
   if (decisionProvider === JEV_PROVIDER_ID) {
+    if (isDestinationAllowed?.(JEV_PROVIDER_ID, JEV_MODEL) === false) return null;
     const configuredOwnsJev = configured
       && providerMatchesRegistryTransport(JEV_PROVIDER_ID, configured);
     const apiKey = (
@@ -704,6 +712,7 @@ function jevDecisionEndpoint(config: OcxConfig, decisionProvider: string): JevDe
   // `jev-latest` is TypeSafe's model name; a self-hosted host must name its own.
   const model = configured.defaultModel?.trim() || configured.models?.[0]?.trim();
   if (!model) return undefined;
+  if (isDestinationAllowed?.(decisionProvider, model) === false) return null;
   const apiKey = selfHostedApiKey(decisionProvider, configured.apiKey);
   if (apiKey === null) return undefined;
   return {
@@ -733,7 +742,8 @@ export async function resolveJevDecision(options: ResolveJevDecisionOptions): Pr
   if (options.candidates.length === 0) return failed("no_choices");
   if (!candidatesFitRequestBounds(options.candidates)) return failed("invalid");
 
-  const endpoint = jevDecisionEndpoint(options.config, options.decisionProvider ?? JEV_PROVIDER_ID);
+  const endpoint = jevDecisionEndpoint(options.config, options.decisionProvider ?? JEV_PROVIDER_ID, options.isDestinationAllowed);
+  if (endpoint === null) return failed("invalid");
   if (!endpoint) return failed("missing_key");
 
   let requestBody: string;

package/src/config/diagnostics.ts

@@ -1,3 +1,4 @@
+import { isSubagentModelEntry, rawSubagentModelForce } from "./subagent-models";
 import { createHash } from "node:crypto";
 import { lstatSync, readFileSync } from "node:fs";
 import { join } from "node:path";
@@ -100,9 +101,11 @@ function validFileConfigDiagnostics(config: OcxConfig, rawParsed: unknown): Conf
   // the entire config, which would hide unrelated providers/accounts. The next
   // ordinary save persists the normalized absence.
   const syncDisabledReason = nativeSubagentSyncDisabledReason(config, rawParsed);
+  const rawForce = rawSubagentModelForce(rawParsed);
   const rawEffort = rawClaudeSubagentEffort(rawParsed);
   const normalized = normalizeClaudeSubagentEffort(normalizeNativeSubagentSync(config, rawParsed), rawParsed);
   const warnings = configPlaceholderWarnings(normalized);
+  if (rawForce !== undefined && !isSubagentModelEntry(rawForce)) warnings.push("claudeCode.subagentModelForce ignored: expected a safe roster-style model id");
   if (normalized.chatgptDesktop?.appServerShim === true && process.platform !== "darwin") {
     warnings.push("chatgptDesktop.appServerShim is experimental and macOS only; ignored on this platform");
   }
@@ -652,6 +655,7 @@ export function validateConfigCandidate(value: unknown): { ok: true; config: Ocx
   const boundaryError = blockedModelRedirectsError(value)
     ?? compactionRecoveryConfigError(value) ?? configReasoningPinsConfigError(value)
     ?? blankHostnameError(value)
+    ?? (rawSubagentModelForce(value) !== undefined && !isSubagentModelEntry(rawSubagentModelForce(value)) ? "schema_invalid: claudeCode.subagentModelForce: expected a safe roster-style model id" : null)
     ?? claudeSubagentEffortError(value)
     ?? appOwnedMemoryBudgetError(value)
     ?? upstreamHostCircuitThresholdError(value)

package/src/config/load-degrade.ts

@@ -1,3 +1,4 @@
+import { isSubagentModelEntry, rawSubagentModelForce } from "./subagent-models";
 import { chmodSync, existsSync } from "node:fs";
 import { join } from "node:path";
 import { compactionRecoveryConfigError } from "./schema/compaction-recovery";
@@ -592,6 +593,7 @@ export function normalizePersistedClaudeCode(claudeCode: unknown): OcxConfig["cl
     return claudeCode as OcxConfig["claudeCode"];
   }
   const normalized = { ...claudeCode } as Record<string, unknown>;
+  if (Object.hasOwn(normalized, "subagentModelForce") && !isSubagentModelEntry(normalized.subagentModelForce)) delete normalized.subagentModelForce;
   // A malformed hand edit must not arm CLI interception or discard the whole config.
   if (Object.hasOwn(normalized, "cliFirstParty") && typeof normalized.cliFirstParty !== "boolean") {
     delete normalized.cliFirstParty;
@@ -634,6 +636,8 @@ export function normalizeClaudeSubagentEffort(config: OcxConfig, _rawParsed: unk
 }
 
 export function warnDegradedClaudeSubagentEffort(rawParsed: unknown): void {
+  const force = rawSubagentModelForce(rawParsed);
+  if (force !== undefined && !isSubagentModelEntry(force)) console.warn("⚠️ config.json claudeCode.subagentModelForce is invalid — ignoring it. Other settings were preserved.");
   const rawEffort = rawClaudeSubagentEffort(rawParsed);
   if (rawEffort !== undefined && !isClaudeSubagentEffort(rawEffort)) {
     console.warn(`⚠️  config.json claudeCode.subagentEffort is invalid (expected ${CLAUDE_SUBAGENT_EFFORTS.join(", ")}) — ignoring it. Other settings were preserved.`);

package/src/config/provider-validation.ts

@@ -6,6 +6,7 @@ import {
 } from "../providers/model-discovery-limits";
 import { isDeclaredReasoningEffort, modelRecordValue } from "../reasoning-effort";
 import { encodeRoutedModelId } from "../providers/slug-codec";
+import { providerForwardClientHeadersConfigError } from "../lib/provider-client-headers";
 import {
   isWirePinnedModel,
   MODEL_ADAPTER_OVERRIDE_ALLOWED,
@@ -125,6 +126,8 @@ export function providerHeadersConfigError(headers: unknown): string | null {
   return null;
 }
 
+export { providerForwardClientHeadersConfigError };
+
 /** Keep the configured API-key header style scoped to Anthropic-compatible key auth. */
 export function apiKeyTransportConfigError(
   provider: Pick<OcxProviderConfig, "adapter" | "authMode" | "apiKeyTransport">,

package/src/config/schema/compaction-triggers.ts

@@ -9,3 +9,11 @@
  * with "Cannot access 'runtimeRoleSchema' before initialization".
  */
 export const COMPACTION_TRIGGERS = ["manual", "auto"] as const;
+
+/** Exact selectors or a provider-qualified trailing wildcard; never a global wildcard. */
+export function validCompactionSourceModels(value: unknown): value is string[] {
+  return Array.isArray(value) && value.length > 0 && new Set(value).size === value.length
+    && value.every(entry => typeof entry === "string" && entry.length > 0
+      && entry === entry.trim() && !/\s/.test(entry)
+      && (!entry.includes("*") || /^[^/*]+\/\*$/.test(entry)));
+}

package/src/config/schema/config-schema.ts

@@ -45,6 +45,7 @@ import {
   positiveIntegerRecordConfigError,
   providerBaseUrlConfigError,
   providerHeadersConfigError,
+  providerForwardClientHeadersConfigError,
   reasoningSummaryDeliveryRecordConfigError,
 } from "../provider-validation";
 import {
@@ -506,6 +507,16 @@ export const configSchema = z.object({
         message: headersError,
       });
     }
+    const forwardClientHeadersError = providerForwardClientHeadersConfigError(
+      (provider as { forwardClientHeaders?: unknown }).forwardClientHeaders,
+    );
+    if (forwardClientHeadersError) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["providers", redactSecretString(name), "forwardClientHeaders"],
+        message: forwardClientHeadersError,
+      });
+    }
     const modelCostsError = providerModelCostsConfigError((provider as { modelCosts?: unknown }).modelCosts);
     if (modelCostsError) {
       ctx.addIssue({

package/src/config/schema/leaf-validators.ts

@@ -41,7 +41,7 @@ import {
   isHostedToolUnsupportedForModel,
 } from "../../responses/hosted-tool-policy";
 import { getConfigDir } from "../paths";
-import { COMPACTION_TRIGGERS } from "./compaction-triggers";
+import { COMPACTION_TRIGGERS, validCompactionSourceModels } from "./compaction-triggers";
 
 /** Experimental macOS ChatGPT app-server shim; only a strict optional boolean is accepted. */
 export const chatgptDesktopSchema = z.object({ appServerShim: z.boolean().optional() }).strict();
@@ -53,6 +53,8 @@ export function isUsableApiKeySecret(value: unknown): value is string {
 
 export const compactionRoutingSchema = z.object({
   model: z.string().trim().min(1),
+  sourceModels: z.array(z.string()).refine(validCompactionSourceModels,
+    "sourceModels requires unique exact selectors or provider/* patterns").optional(),
   reasoningEffort: z.string().refine(value => pinnedReasoningEffortConfigError(value) === null).optional(),
   triggers: z.array(z.enum(COMPACTION_TRIGGERS)).nonempty()
     .refine(values => new Set(values).size === values.length, "triggers must not repeat a value")
@@ -327,6 +329,8 @@ export const providerConfigSchema = z.object({
   modelSupportsServiceTier: z.record(z.string().min(1), z.boolean()).optional(),
   modelSuppressSyntheticMax: z.record(z.string().min(1), z.boolean()).optional(),
   preserveResponsesReasoningContent: z.boolean().optional(),
+  preserveResponsesInputItemIds: z.boolean().optional(),
+  preserveResponsesMessageMetadata: z.boolean().optional(),
   dropResponsesReasoningItems: z.boolean().optional(),
   modelReasoningEffortsAuthoritative: z.boolean().optional(),
   decodesNativeCompactionBlobs: z.boolean().optional(),